Updated WebKit from /home/joce/dev/qtwebkit/ to qtwebkit-4.6-snapshot-18092009 ( 15c07fb8d7fa5e93c939aa7eb21c06e19c754cee )

Changes in WebKit/qt since the last update:

++ b/WebKit/qt/ChangeLog
2009-09-17  Janne Koskinen  <janne.p.koskinen@digia.com>

        Reviewed by Simon Hausmann.

        Symbian build fix.

        Moved the #ifdefs around _q_cleanupLeakMessages() into the function
        definition.

        QMake is not being able to distinguish between release and debug builds
        in Symbian build. This is a Symbian toolchain issue.

        * Api/qwebpage.cpp:
        (QWebPagePrivate::_q_cleanupLeakMessages):
        * Api/qwebpage.h:
        * Api/qwebpage_p.h:

2009-09-17  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>

        Reviewed by Simon Hausmann.

        Small cosmetic documentation fixlet in the QWebInspector.

        * Api/qwebinspector.cpp:

2009-09-16  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>

        Reviewed by Eric Seidel.

        Detect and add Windows7 properly to the user agent.

        * Api/qwebpage.cpp:
        (QWebPage::userAgentForUrl):

2009-09-16  Andras Becsi  <andrewbecsi@yahoo.co.uk>

        Rubberstamped by Kenneth Christiansen.

        [Qt] Build fix for previous changes.

        * QGVLauncher/main.cpp:
        (MainView::flip):

2009-09-16  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Unreviewed potential Qt < 4.6 build fix.

        * QGVLauncher/main.cpp:
        (MainView::flip):

2009-09-16  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Reviewed by Simon Hausmann.

        Add a "Flip effect" to our GraphicsView based launcher.

        * QGVLauncher/main.cpp:
        (MainView::resizeEvent):
        (MainView::flip):
        (MainWindow::flip):
        (MainWindow::buildUI):

2009-09-16  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>

        Rubber-stamped by Simon Hausmann.

        [Qt] Typo fix. Pass the window object to the Format
        menu. In this way Qt can free its internal graphical
        objects during exit.

        * QtLauncher/main.cpp:
        (MainWindow::setupUI):

2009-09-16  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>

        Reviewed by Tor Arne Vestbø.

        [Qt] Build break fix on gcc ARM.

        * Api/qwebgraphicsitem.cpp:
        (QWebGraphicsItemPrivate::_q_doLoadProgress):

2009-09-16  Warwick Allison  <warwick.allison@nokia.com>

        Reviewed by Simon Hausmann.

        Fix a crash in QWebFrame::hasFocus() with a simple null pointer check
        when the focused frame is null. We do the same check in other places
        where we call kit().

        * Api/qwebframe.cpp:
        (QWebFrame::hasFocus):

2009-09-16  Jure Repinc  <jlp@holodeck1.com>

        Reviewed by Simon Hausmann.

        Fixed a typo found during translation.

        * WebCoreSupport/FrameLoaderClientQt.cpp:
        (WebCore::FrameLoaderClientQt::interruptForPolicyChangeError):

2009-09-14  Jakub Wieczorek  <faw217@gmail.com>

        Reviewed by Simon Hausmann.

        [Qt] QWebGraphicsItem should check for null QWebPage.
        https://bugs.webkit.org/show_bug.cgi?id=29185

        Don't crash in QWebGraphicsItem when the page is still null, by
        either checking if it's the case or constructing the default one.

        * Api/qwebgraphicsitem.cpp:
        (QWebGraphicsItem::icon):
        (QWebGraphicsItem::setZoomFactor):
        (QWebGraphicsItem::zoomFactor):
        (QWebGraphicsItem::setGeometry):
        (QWebGraphicsItem::load):
        (QWebGraphicsItem::setHtml):
        (QWebGraphicsItem::toHtml):
        (QWebGraphicsItem::setContent):
        (QWebGraphicsItem::history):
        (QWebGraphicsItem::settings):

2009-09-11  David Boddie  <dboddie@trolltech.com>

        Reviewed by Simon Hausmann.

        Doc: Note that Netscape plugins are only available on desktop platforms.

        * docs/qtwebkit.qdoc:

2009-09-11  Martin Smith  <msmith@trolltech.com>

        Reviewed by Simon Hausmann.

        Adjust the name of the contentspage for the documentation
        to the new name used in Qt 4.6.

        * docs/qtwebkit.qdoc:

2009-09-11  Ariya Hidayat  <ariya.hidayat@nokia.com>

        Reviewed by Simon Hausmann.

        Changed URLs from qtsoftware.com to qt.nokia.com, as part of a general
        renaming.

        * Api/qwebpluginfactory.cpp:
        * docs/webkitsnippets/simple/main.cpp:
        (main):
        * docs/webkitsnippets/webpage/main.cpp:
        (main):

2009-09-11  Volker Hilsheimer  <volker.hilsheimer@nokia.com>

        Reviewed by Simon Hausmann.

        Restructure the documentation, both on a file and on a content level.

        * Api/qwebdatabase.cpp:
        * Api/qwebelement.cpp:
        * Api/qwebframe.cpp:
        * Api/qwebhistory.cpp:
        * Api/qwebhistoryinterface.cpp:
        * Api/qwebpage.cpp:
        * Api/qwebpluginfactory.cpp:
        * Api/qwebsecurityorigin.cpp:
        * Api/qwebsettings.cpp:
        * Api/qwebview.cpp:
        * docs/qtwebkit.qdoc:

2009-09-11  Yongjun Zhang  <yongjun.zhang@nokia.com>

        Reviewed by Simon Hausmann.

        https://bugs.webkit.org/show_bug.cgi?id=29136
        [Qt] emit microFocusChanged() signal when no QWidget-based view is present.

        emit microFocusChange() signal regardless of view.

        * WebCoreSupport/EditorClientQt.cpp:
        (WebCore::EditorClientQt::setInputMethodState):

2009-09-11  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>

        Reviewed by Simon Hausmann.

        https://bugs.webkit.org/show_bug.cgi?id=28806

        [Qt] Make the WebInspector available as a QWidget.

        * Api/headers.pri:
        * Api/qwebelement.cpp:
        (QWebElement::enclosingElement):
        * Api/qwebelement.h:
        * Api/qwebinspector.cpp: Added.
        * Api/qwebinspector.h: Added.
        * Api/qwebinspector_p.h: Added.
        * Api/qwebpage.cpp:
        (QWebPagePrivate::QWebPagePrivate):
        (QWebPagePrivate::setInspector):
        (QWebPagePrivate::getOrCreateInspector):
        (QWebPagePrivate::inspectorController):
        (QWebPage::~QWebPage):
        (QWebPage::triggerAction):
        * Api/qwebpage.h:
        * Api/qwebpage_p.h:
        * Api/qwebsettings.cpp:
        * QtLauncher/main.cpp:
        (MainWindow::MainWindow):
        * WebCoreSupport/InspectorClientQt.cpp:
        (WebCore::InspectorClientWebPage::InspectorClientWebPage):
        (WebCore::InspectorClientWebPage::createWindow):
        (WebCore::InspectorClientQt::createPage):
        (WebCore::InspectorClientQt::showWindow):
        (WebCore::InspectorClientQt::closeWindow):
        (WebCore::InspectorClientQt::attachWindow):
        (WebCore::InspectorClientQt::detachWindow):
        (WebCore::InspectorClientQt::updateWindowTitle):
        * WebCoreSupport/InspectorClientQt.h:
        * docs/webkitsnippets/qtwebkit_qwebinspector_snippet.cpp: Added.

2009-09-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>

        Reviewed by Eric Seidel.

        [Qt] Fix comparison between signed and unsigned integer warnings
        https://bugs.webkit.org/show_bug.cgi?id=29162

        No functional change.

        * Api/qwebelement.cpp:
        (QWebElement::findAll):
        * Api/qwebhistory.cpp:
        (QWebHistory::items):
        (QWebHistory::backItems):
        (QWebHistory::forwardItems):
        (QWebHistory::saveState):
        * Api/qwebplugindatabase.cpp:
        (QWebPluginDatabase::setSearchPaths):
        * WebCoreSupport/ChromeClientQt.cpp:
        (WebCore::ChromeClientQt::runOpenPanel):
        * WebCoreSupport/FrameLoaderClientQt.cpp:
        (WebCore::FrameLoaderClientQt::createPlugin):

2009-09-10  Simon Hausmann  <hausmann@webkit.org>

        Rubber-stamped by Ariya Hidayat.

        Fix a bunch of qdoc warnings: Invalid references, non-standard
        wording, etc.

        * Api/qwebelement.cpp:
        * Api/qwebgraphicsitem.cpp:
        * Api/qwebsecurityorigin.cpp:

2009-09-10  Simon Hausmann  <hausmann@webkit.org>

        Reviewed by Ariya Hidayat.

        Fix context menu event delivery with QWebGraphicsItem.

        Re-implement the correct context menu virtual function using
        a QGraphicsSceneContextMenuEvent and forward & handle it in
        QWebPage.

        * Api/qwebgraphicsitem.cpp:
        (QWebGraphicsItem::contextMenuEvent):
        * Api/qwebgraphicsitem.h:
        * Api/qwebpage.cpp:
        (QWebPagePrivate::contextMenuEvent):
        (QWebPage::event):
        * Api/qwebpage_p.h:

2009-09-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>

        Unreviewed.

        Build fix for QtWebKit for Mac after r48219.

        qevent and qstyleoption are QtGui interfaces.

        * Api/qwebgraphicsitem.cpp:
        * Api/qwebgraphicsitem.h:

2009-09-09  Simon Hausmann  <hausmann@webkit.org>

        Reviewed by Tor Arne Vestbø.

        Call the right base class function QGraphicsWidget::event() instead
        of skipping it and using QObject::event() instead.

        * Api/qwebgraphicsitem.cpp:
        (QWebGraphicsItem::event):

2009-09-09  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Unreviewed.

        Fix comment at Tor Arne Vestbø's request.

        * Api/qwebgraphicsitem.cpp:
        (QWebGraphicsItem::sceneEvent):
        (QWebGraphicsItem::event):

2009-09-09  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Reviewed by Tor Arne Vestbø.

        Implement some virtual event methods so that we can fix
        event-related bugs in Qt patch releases.

        * Api/qwebgraphicsitem.cpp:
        (QWebGraphicsItem::sceneEvent):
        (QWebGraphicsItem::event):
        * Api/qwebgraphicsitem.h:

2009-09-09  Kenneth Rohde Christiansen  <kenneth@webkit.org>, Antonio Gomes  <antonio.gomes@openbossa.org>

        Reviewed by Simon Hausmann.

        Add a new QGraphicsWidget based version of the "QWebView"
        under the name "QWebGraphicsItem".

        https://bugs.webkit.org/show_bug.cgi?id=28862

        Includes an alternative Qt launcher using the QGraphicsView.

        * Api/headers.pri:
        * Api/qwebgraphicsitem.cpp: Added.
        * Api/qwebgraphicsitem.h: Added.
        * Api/qwebpage.h:
        * QGVLauncher/QGVLauncher.pro: Copied from WebKit/qt/QtLauncher/QtLauncher.pro.
        * QGVLauncher/main.cpp: Added.
        * WebCoreSupport/ChromeClientQt.cpp:
        (WebCore::ChromeClientQt::repaint):
        (WebCore::ChromeClientQt::scroll):

2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Unreviewed build fix.

        Potential build fix for Qt 4.5

        * Api/qwebpage.cpp:
        (QWebPagePrivate::mousePressEvent):

2009-09-08  Benjamin Poulain  <benjamin.poulain@nokia.com>

        Reviewed by Simon Hausmann.

        https://bugs.webkit.org/show_bug.cgi?id=29007
        Add a test for the signal QWebFrame::javaScriptWindowObjectCleared()

        * tests/qwebframe/tst_qwebframe.cpp:

2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>

        Reviewed by Simon Hausmann.

        [Qt] Fix unused variable warnings
        https://bugs.webkit.org/show_bug.cgi?id=29018

        * Api/qwebpage.cpp:
        (QWebPagePrivate::keyPressEvent):
        * WebCoreSupport/FrameLoaderClientQt.cpp:
        (WebCore::FrameLoaderClientQt::startDownload):
        (WebCore::FrameLoaderClientQt::createFrame):

2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>

        Reviewed by Ariya Hidayat.

        [Qt] Use the declaration order in initializer lists
        https://bugs.webkit.org/show_bug.cgi?id=29017

        * Api/qwebframe_p.h:

2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Reviewed by Simon Hausmann.

        Add support for handling QGraphicsScene events.

        * Api/qwebpage.cpp:
        (QWebPagePrivate::mouseMoveEvent):
        (QWebPagePrivate::mousePressEvent):
        (QWebPagePrivate::mouseDoubleClickEvent):
        (QWebPagePrivate::mouseTripleClickEvent):
        (QWebPagePrivate::handleClipboard):
        (QWebPagePrivate::mouseReleaseEvent):
        (QWebPagePrivate::wheelEvent):
        (QWebPagePrivate::dragEnterEvent):
        (QWebPagePrivate::dragLeaveEvent):
        (QWebPagePrivate::dragMoveEvent):
        (QWebPagePrivate::dropEvent):
        (QWebPage::event):
        * Api/qwebpage_p.h:

2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Reviewed by Simon Hausmann.

        [Qt] Make cursor set cleaner in QtWebKit Api: eliminate SetCursorEvent hack.
        https://bugs.webkit.org/show_bug.cgi?id=28865

        Clean up the unserCursor hack to use the QCursor set
        as a property of the QWidget by WebCore::WidgetQt.

        Remove all code that are no longer necessary for getting
        cursor change events.

        Patch by Kenneth Rohde Christiansen <kenneth@webkit.org> and
                 Antonio Gomes <antonio.gomes@openbossa.org> on 2009-09-07

        * Api/qwebpage.cpp:
        * Api/qwebpage_p.h:
        * Api/qwebview.cpp:
        (QWebViewPrivate::QWebViewPrivate):
        (QWebView::event):

2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>

        Reviewed by Simon Hausmann.

        [Qt] QtWebKit single API to enable persistency
        https://bugs.webkit.org/show_bug.cgi?id=28682

        Disable LocalStorage, ApplicationCache, HTML5 offline storage by
        default.

        If persistency is enabled the default directory for LocalStorage and
        ApplicationCache is now based on QDesktopServices::DataLocation and not
        QDesktopServices::CacheLocation (as it is expected to keep this data
        around after a reboot).

        If persistency is enabled initialize HTML5 offline storage as well - this
        fixed offline Storage for QtLauncher.

        * Api/qwebpage.cpp:
        (QWebPagePrivate::QWebPagePrivate):
        * Api/qwebsettings.cpp:
        (QWebSettings::QWebSettings):
        (QWebSettings::enablePersistentStorage):
        * Api/qwebsettings.h: Add a new API called enablePersistentStorage
        * QtLauncher/main.cpp: Use the new enablePersistentStorage API
        (main):

2009-09-07  Jakub Wieczorek  <faw217@gmail.com>

        Reviewed by Simon Hausmann.

        Speed up the QWebPluginInfo::supportsMimeType() function.
        https://bugs.webkit.org/show_bug.cgi?id=27651

        Instead of going through the MIME types list constructed with
        mimeTypes() function, look up the internal mimeToDescriptions map.

        * Api/qwebplugindatabase.cpp:
        (QWebPluginInfo::supportsMimeType):

2009-09-07  Jakub Wieczorek  <faw217@gmail.com>

        Reviewed by Simon Hausmann.

        Speed up the QWebPluginInfo::mimeTypes() function.
        https://bugs.webkit.org/show_bug.cgi?id=27651

        Instead of constructing a list of MIME types every time it is called,
        do this only once.

        * Api/qwebplugindatabase.cpp:
        (QWebPluginInfo::mimeTypes):
        (QWebPluginInfo::operator=):
        * Api/qwebplugindatabase.h:
        * tests/qwebplugindatabase/tst_qwebplugindatabase.cpp:
        (tst_QWebPluginDatabase::operatorassign_data):
        (tst_QWebPluginDatabase::operatorassign):

2009-09-07  Jakub Wieczorek  <faw217@gmail.com>

        Reviewed by Simon Hausmann.

        Remove the private classes from QWebPluginDatabase.
        https://bugs.webkit.org/show_bug.cgi?id=27651

        Instead, hold the PluginDatabase and PluginPackage objects as class
        members and take care of refcounting on our own instead of using RefPtr.

        This way we not only made the code cleaner but also got rid of
        redundant allocations when constructing null QWebPluginInfo objects.

        The private classes have been forward-declared and the d-pointers left
        to be on the safe side.

        * Api/qwebplugindatabase.cpp:
        (QWebPluginInfo::QWebPluginInfo):
        (QWebPluginInfo::~QWebPluginInfo):
        (QWebPluginInfo::name):
        (QWebPluginInfo::description):
        (QWebPluginInfo::mimeTypes):
        (QWebPluginInfo::path):
        (QWebPluginInfo::isNull):
        (QWebPluginInfo::setEnabled):
        (QWebPluginInfo::isEnabled):
        (QWebPluginInfo::operator==):
        (QWebPluginInfo::operator!=):
        (QWebPluginInfo::operator=):
        (QWebPluginDatabase::QWebPluginDatabase):
        (QWebPluginDatabase::~QWebPluginDatabase):
        (QWebPluginDatabase::plugins):
        (QWebPluginDatabase::searchPaths):
        (QWebPluginDatabase::setSearchPaths):
        (QWebPluginDatabase::addSearchPath):
        (QWebPluginDatabase::refresh):
        (QWebPluginDatabase::pluginForMimeType):
        (QWebPluginDatabase::setPreferredPluginForMimeType):
        * Api/qwebplugindatabase.h:
        * Api/qwebplugindatabase_p.h: Removed.

2009-09-05  Jakub Wieczorek  <faw217@gmail.com>

        Reviewed by Eric Seidel.

        [Qt] r47424 broke binary compatibility
        https://bugs.webkit.org/show_bug.cgi?id=28996

        Append the new DnsPrefetchEnabled attribute at the end of the enum.

        * Api/qwebsettings.h:

2009-09-04  Mark Mentovai  <mark@chromium.org>

        Reviewed by Dave Hyatt.

        https://bugs.webkit.org/show_bug.cgi?id=28614

        Account for scrollbar state changes that occur during layout.

        * Api/qwebframe.cpp:
        (QWebFrame::setScrollBarPolicy):

        Eliminate duplicated (and incorrect) scrollbar mode tracking between
        FrameView and ScrollView.

2009-09-04  Laszlo Gombos  <laszlo.1.gombos@nokia.com>

        Reviewed by Eric Seidel.

        [Qt] Fix tst_QWebPage::database autotest failure
        https://bugs.webkit.org/show_bug.cgi?id=28961

        Make sure that the test case enables the feature before
        the feature gets tested

        * tests/qwebpage/tst_qwebpage.cpp:
        (tst_QWebPage::database):

2009-09-04  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>

        Reviewed by Eric Seidel.

        Any QtWebKit application crashes on exit if the inspector is
        used during the session rather then exiting.

        If a QWebView has a QWebPage that is destroyed the QWebView
        does not update its pointer and will crash the next time
        it access the page pointers (such as in its destructor).

        InspectorClientView should not call deleteLater when the page
        is destroyed because it does not have a parent and is a top
        level widget.  close() needs to be called so that QApplication
        can exit the application if quitOnLastWindowClosed is set
        and a InspectorClientView is the last window, otherwise
        the application will never exit.

        * Api/qwebview.cpp:
        (QWebViewPrivate::_q_pageDestroyed):
        (QWebView::setPage):
        * Api/qwebview.h:
        * WebCoreSupport/InspectorClientQt.cpp:
        (WebCore::InspectorClientView::InspectorClientView):

2009-09-03  Adam Barth  <abarth@webkit.org>

        Reviewed by eric@webkit.org.

        https://bugs.webkit.org/show_bug.cgi?id=24696

        Stub implementations of mixed content methods of FrameLoaderClient.

        * WebCoreSupport/FrameLoaderClientQt.cpp:
        (WebCore::FrameLoaderClientQt::didDisplayInsecureContent):
        (WebCore::FrameLoaderClientQt::didRunInsecureContent):
        * WebCoreSupport/FrameLoaderClientQt.h:

2009-09-03  Laszlo Gombos  <laszlo.1.gombos@nokia.com>

        Reviewed by Eric Seidel.

        [Qt] Add a setting to turn SessionStorage on/off
        https://bugs.webkit.org/show_bug.cgi?id=28836

        * Api/qwebsettings.cpp:
        (QWebSettingsPrivate::apply):
        (QWebSettings::QWebSettings):
        * Api/qwebsettings.h:
        * tests/qwebpage/tst_qwebpage.cpp:
        (testFlag):
        (tst_QWebPage::testOptionalJSObjects):

2009-09-02  Richard Moore  <rich@kde.org>

        Reviewed by Tor Arne Vestbø.

        [Qt] Make sure we relayout the page after evaluating JS

        https://bugs.webkit.org/show_bug.cgi?id=28235

        QtWebKit does not always seem to reflow the page when evaluating
        javascript. This patch changes the way evaluateJavaScript works to
        use the frameloader which ensures that this is done properly.

        * Api/qwebframe.cpp:
        (QWebFrame::evaluateJavaScript):
        * tests/qwebframe/tst_qwebframe.cpp:

2009-08-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>

        Reviewed by Holger Freyther.

        https://bugs.webkit.org/show_bug.cgi?id=25889
        [GTK] scrollbar policy for main frame is not implementable

        Add empty implementation for new ChromeClient method.

        * WebCoreSupport/ChromeClientQt.h:
        (WebCore::ChromeClientQt::scrollbarsModeDidChange):

2009-08-27  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>

        Reviewed by Ariya Hidayat.

        QWebHistory::clear() modifications.

        Clear() method was changed. If QWebHistory is empty (there is no
        elements even current) clear() do nothing. If there at least one
        element clear() will delete everything apart of current.

        New autotests in QWebHistory

        New autotests were added to QWebHistory. They should check some crashes
        in save and restore state process and clear() method and general
        behavior on where QWebHistory::count() == 0 or QWebHistory::count() == 1

        Bugzilla: https://bugs.webkit.org/show_bug.cgi?id=28711

        * Api/qwebhistory.cpp:
        (QWebHistory::clear):
        * tests/qwebhistory/tst_qwebhistory.cpp:
        (tst_QWebHistory::back):
        (tst_QWebHistory::forward):
        (tst_QWebHistory::saveAndRestore_crash_1):
        (tst_QWebHistory::saveAndRestore_crash_2):
        (tst_QWebHistory::saveAndRestore_crash_3):
        (tst_QWebHistory::clear):

2009-08-27  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>

        Reviewed by Ariya Hidayat.

        [Qt] Cleanup, old and commented part of source code was removed.
        Fix some formatting problems.

        https://bugs.webkit.org/show_bug.cgi?id=28712

        * Api/qwebhistory_p.h:
        (QWebHistoryPrivate::QWebHistoryPrivate):

2009-08-26  Adam Barth  <abarth@webkit.org>

        Reviewed by Oliver Hunt.

        Don't let local files access web URLs
        https://bugs.webkit.org/show_bug.cgi?id=28480

        * Api/qwebsettings.cpp:
        (QWebSettings::QWebSettings):

2009-08-25  Antonio Gomes   <antonio.gomes@openbossa.org>

        Reviewed by Ariya Hidayat.

        Bug 28708 - Make possible to better use ResourceError in FrameLoaderClientQt class.

        * Api/qwebframe.cpp:
        (QWebFrame::requestedUrl):
        * WebCoreSupport/FrameLoaderClientQt.cpp:
        (WebCore::FrameLoaderClientQt::FrameLoaderClientQt):
        (WebCore::FrameLoaderClientQt::dispatchDidFinishLoad):
        (WebCore::FrameLoaderClientQt::postProgressFinishedNotification):
        (WebCore::FrameLoaderClientQt::dispatchDidFailProvisionalLoad):
        (WebCore::FrameLoaderClientQt::dispatchDidFailLoad):
        * WebCoreSupport/FrameLoaderClientQt.h:

2009-08-22  Adam Barth  <abarth@webkit.org>

        Revert 47684.  We're going to do this later once clients have had a
        chance to opt into the setting they like.

        * Api/qwebsettings.cpp:
        (QWebSettings::QWebSettings):

2009-08-22  Adam Barth  <abarth@webkit.org>

        Reviewed by Eric Seidel.

        Don't let local files access web URLs
        https://bugs.webkit.org/show_bug.cgi?id=28480

        * Api/qwebsettings.cpp:
        (QWebSettings::QWebSettings):

2009-08-19  Aaron Boodman  <aa@chromium.org>

        Speculative build break fix for qt.

        * Api/qwebsecurityorigin.cpp:
        (QWebSecurityOrigin::whiteListAccessFromOrigin):
        * Api/qwebsecurityorigin.h:

2009-08-19  Aaron Boodman  <aa@chromium.org>

        Reviewed by David Levin.

        https://bugs.webkit.org/show_bug.cgi?id=24853: Provide a way for WebKit clients to
        specify a more granular policy for cross-origin XHR access.

        * Api/qwebsecurityorigin.cpp: Add API to manipulate origin access whitelists.
        (QWebSecurityOrigin::whiteListAccessFromOrigin): Ditto.
        (QWebSecurityOrigin::resetOriginAccessWhiteLists): Ditto.
        * Api/qwebsecurityorigin.h: Ditto.

2009-08-18  Markus Goetz <Markus.Goetz@nokia.com>

        Reviwed by Ariya Hidayat.

        [Qt] For prefecthDNS, the pre-fetching has to be enabled in the
        WebSettings.

        * Api/qwebsettings.cpp:
        (QWebSettings::QWebSettings):
        * Api/qwebsettings.h:

2009-08-17  Darin Adler  <darin@apple.com>

        Try to fix Qt build again.

        * WebCoreSupport/EditorClientQt.cpp: Move "using namespace".

2009-08-17  Darin Adler  <darin@apple.com>

        Try to fix Qt build.

        * WebCoreSupport/EditorClientQt.cpp:
        (WebCore::EditorClientQt::shouldShowDeleteInterface):
        Use getAttribute(classAttr) instead of className() function.

2009-08-14  Yongjun Zhang  <yongjun.zhang@nokia.com>

        Reviewed by Simon Hausmann.

        RVCT elftran fails to resolve QPainter::staticMetaObject coming with
        QWebView::RenderHints property.

        This is a temporary fix and will be revereted when the right symbols
        exported from Qt lib in S60.

        https://bugs.webkit.org/show_bug.cgi?id=28181

        * Api/qwebview.h:

2009-08-14  Laszlo Gombos  <laszlo.1.gombos@nokia.com>

        Reviewed by Simon Hausmann.

        [Qt] Public API to configure the storage path for HTML5 localStorage
        https://bugs.webkit.org/show_bug.cgi?id=28036

        Disables LocalStorage for QtWebKit by default by setting
        QWebSettings::LocalStorageEnabled to false.

        Sets up a default for the LocalStorage path so that clients would only
        need to enable the LocalStorageEnabled setting to turn on LocalStoragre
        support.

        Turn on LocalStorage support for QtLauncher and the relevant test
        since LocalStorage is now disabled by default for QtWebkit.

        * Api/qwebpage.cpp:
        (defaultCachePath):
        (initializeApplicationCachePathIfNecessary):
        (QWebPagePrivate::QWebPagePrivate):
        * Api/qwebsettings.cpp:
        (QWebSettingsPrivate::apply):
        (QWebSettings::QWebSettings):
        (QWebSettings::setLocalStoragePath):
        (QWebSettings::localStoragePath):
        * Api/qwebsettings.h:
        * QtLauncher/main.cpp:
        (main):
        * tests/qwebpage/tst_qwebpage.cpp:
        (tst_QWebPage::multiplePageGroupsAndLocalStorage):

2009-08-14  Yael Aharon  <yael.aharon@nokia.com>

        Reviewed by Simon Hausmann.

        [Qt] Allow applications to register their own local URL scheme.
        https://bugs.webkit.org/show_bug.cgi?id=28240

        * Api/qwebsecurityorigin.cpp:
        (QWebSecurityOrigin::addLocalScheme):
        (QWebSecurityOrigin::removeLocalScheme):
        (QWebSecurityOrigin::localSchemes):
        * Api/qwebsecurityorigin.h:
        * tests/qwebpage/tst_qwebpage.cpp:
        (tst_QWebPage::localURLSchemes):

2009-08-13  Mark Rowe  <mrowe@apple.com>

        Try and fix the Qt build.

        * Api/qwebelement.cpp:

2009-08-13  Kavindra Devi Palaraja  <kavindra.palaraja@nokia.com>

        Reviewed by Simon Hausmann.

        Doc - Some cleanup on the documentation of QWebElement

        * Api/qwebelement.cpp:

2009-08-13  Norbert Leser  <norbert.leser@nokia.com>

        Reviewed by Simon Hausmann.

        Symbian target components (library and executable files)
        require Unique Identifiers (i.e., UID3).
        These identifiers are defined in the respective project
        files, conditionally for "symbian" platform.

        * QtLauncher/QtLauncher.pro:
        * tests/qwebelement/qwebelement.pro:
        * tests/qwebframe/qwebframe.pro:
        * tests/qwebhistory/qwebhistory.pro:
        * tests/qwebhistoryinterface/qwebhistoryinterface.pro:
        * tests/qwebpage/qwebpage.pro:
        * tests/qwebview/qwebview.pro:

2009-08-12  George Wright  <george.wright@torchmobile.com>

        Reviewed by Adam Treat.

        Initialise zoom levels independent of whether a URL is valid or not to
        fix https://bugs.webkit.org/show_bug.cgi?id=28162

        * QtLauncher/main.cpp:
        (MainWindow::MainWindow):

2009-08-12  Joerg Bornemann  <joerg.bornemann@trolltech.com>

        Reviewed by Simon Hausmann.

        QtWebKit compile fix for Windows CE

        There's no getenv on Windows CE, use qgetenv instead.

        * Api/qwebpage.cpp:
        (qt_drt_overwritePluginDirectories):

2009-08-10  Kavindra Palaraja  <kavindra.palaraja@nokia.com>

        Reviewed by Simon Hausmann.

        Various fixes and improvements to the QWebPluginInfo, QWebPluginDatabase and QWebSettings documentation.

        * Api/qwebplugindatabase.cpp:
        * Api/qwebsettings.cpp:

2009-08-08  Volker Hilsheimer  <volker.hilsheimer@nokia.com>

        Reviewed by Simon Hausmann.

        Doc: there is no group of explicitly shared classes, only one class uses this.

        Explain the implications in the QWebHistoryItem documentation, and get rid
        of the "group".

        * Api/qwebhistory.cpp:

2009-08-05  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>

        Reviewed by Simon Hausmann.

        [Qt] Fix build error caused by http://trac.webkit.org/changeset/46763

        * Api/qwebpluginfactory.h: Export macro added.

2009-08-04  Antonio Gomes   <antonio.gomes@openbossa.org>

        Reviewed by Simon Hausmann.

        [Qt] QWebFrame::requestedUrl method can mis-behave in case of unhandled sslErrors.
        https://bugs.webkit.org/show_bug.cgi?id=27804

        * Api/qwebframe.cpp:
        (QWebFrame::requestedUrl):
        * tests/qwebframe/tst_qwebframe.cpp:

2009-08-04  Simon Hausmann  <simon.hausmann@nokia.com>

        Reviewed by Tor Arne Vestbø.

        Rename QWebPlugin to QWebPluginInfo, as discussed on IRC.

        * Api/qwebplugindatabase.cpp:
        (QWebPluginInfoPrivate::QWebPluginInfoPrivate):
        (QWebPluginInfo::QWebPluginInfo):
        (QWebPluginInfo::~QWebPluginInfo):
        (QWebPluginInfo::name):
        (QWebPluginInfo::description):
        (QWebPluginInfo::mimeTypes):
        (QWebPluginInfo::supportsMimeType):
        (QWebPluginInfo::path):
        (QWebPluginInfo::isNull):
        (QWebPluginInfo::setEnabled):
        (QWebPluginInfo::isEnabled):
        (QWebPluginInfo::operator==):
        (QWebPluginInfo::operator!=):
        (QWebPluginInfo::operator=):
        (QWebPluginDatabase::plugins):
        (QWebPluginDatabase::pluginForMimeType):
        (QWebPluginDatabase::setPreferredPluginForMimeType):
        * Api/qwebplugindatabase.h:
        * Api/qwebplugindatabase_p.h:
        * tests/qwebplugindatabase/tst_qwebplugindatabase.cpp:
        (tst_QWebPluginDatabase::installedPlugins):
        (tst_QWebPluginDatabase::searchPaths):
        (tst_QWebPluginDatabase::null_data):
        (tst_QWebPluginDatabase::null):
        (tst_QWebPluginDatabase::pluginForMimeType):
        (tst_QWebPluginDatabase::enabled):
        (tst_QWebPluginDatabase::operatorequal_data):
        (tst_QWebPluginDatabase::operatorequal):
        (tst_QWebPluginDatabase::preferredPlugin):

2009-08-04  Simon Hausmann  <simon.hausmann@nokia.com>

        Reviewed by Adam Treat.

        Replace QWebPlugin::MimeType with a typedef to
        QWebPluginFactory::MimeType.

        * Api/qwebplugindatabase.cpp:
        * Api/qwebplugindatabase.h:
        * Api/qwebpluginfactory.cpp:
        (QWebPluginFactory::MimeType::operator==):
        * Api/qwebpluginfactory.h:

2009-08-04  Jakub Wieczorek  <faw217@gmail.com>

        Reviewed by Simon Hausmann.

        Add QWebPluginDatabase API to the Qt API.

        https://bugs.webkit.org/show_bug.cgi?id=27651

        * Api/headers.pri:
        * Api/qwebplugindatabase.cpp: Added.
        (QWebPluginPrivate::QWebPluginPrivate):
        (QWebPluginDatabasePrivate::QWebPluginDatabasePrivate):
        (QWebPlugin::MimeType::operator==):
        (QWebPlugin::QWebPlugin):
        (QWebPlugin::~QWebPlugin):
        (QWebPlugin::name):
        (QWebPlugin::description):
        (QWebPlugin::mimeTypes):
        (QWebPlugin::supportsMimeType):
        (QWebPlugin::path):
        (QWebPlugin::isNull):
        (QWebPlugin::setEnabled):
        (QWebPlugin::isEnabled):
        (QWebPlugin::operator==):
        (QWebPlugin::operator!=):
        (QWebPlugin::operator=):
        (QWebPluginDatabase::QWebPluginDatabase):
        (QWebPluginDatabase::~QWebPluginDatabase):
        (QWebPluginDatabase::plugins):
        (QWebPluginDatabase::defaultSearchPaths):
        (QWebPluginDatabase::searchPaths):
        (QWebPluginDatabase::setSearchPaths):
        (QWebPluginDatabase::addSearchPath):
        (QWebPluginDatabase::refresh):
        (QWebPluginDatabase::pluginForMimeType):
        (QWebPluginDatabase::setPreferredPluginForMimeType):
        * Api/qwebplugindatabase.h: Added.
        * Api/qwebplugindatabase_p.h: Added.
        * Api/qwebsettings.cpp:
        (QWebSettings::pluginDatabase):
        * Api/qwebsettings.h:
        * tests/qwebplugindatabase/qwebplugindatabase.pro: Added.
        * tests/qwebplugindatabase/tst_qwebplugindatabase.cpp: Added.
        (tst_QWebPluginDatabase::installedPlugins):
        (tst_QWebPluginDatabase::searchPaths):
        (tst_QWebPluginDatabase::null_data):
        (tst_QWebPluginDatabase::null):
        (tst_QWebPluginDatabase::pluginForMimeType):
        (tst_QWebPluginDatabase::enabled):
        (tst_QWebPluginDatabase::operatorequal_data):
        (tst_QWebPluginDatabase::operatorequal):
        (tst_QWebPluginDatabase::preferredPlugin):
        * tests/tests.pro:

2009-08-03  Balazs Kelemen  <kelemen.balazs.3@stud.u-szeged.hu>

        Reviewed by Simon Hausmann.

        Do memory cleanup when running robotized QtLauncher in debug as well.

        * QtLauncher/main.cpp:
        (launcherMain):
        (main):

2009-07-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>

        Reviewed by Tor Arne Vestbø.

        [Qt] Initialize HTML5 Application Cache for QtWebKit to a sensible default
        https://bugs.webkit.org/show_bug.cgi?id=27866

        * Api/qwebpage.cpp:
        (initializeApplicationCachePathIfNecessary):
        (QWebPagePrivate::QWebPagePrivate):

2009-07-31  Jakob Petsovits  <jakob.petsovits@torchmobile.com>

        Reviewed by Adam Treat.

        Build QtWebKit without benchmark tests for Qt < 4.5.
        https://bugs.webkit.org/show_bug.cgi?id=27886

        The QBENCHMARK macro is only available from 4.5 on,
        so builds for Qt < 4.5 shouldn't try to build those.

        * tests/tests.pro:

2009-07-31  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Reviewed by Adam Treat.

        Fix warning by migrating use of QString.sprintf(...) to
        QString.arg().arg()...

        * WebCoreSupport/EditorClientQt.cpp:
        (dumpRange):

2009-07-31  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Reviewed by Tor Arne Vestbø.

        Expose the Offline Web Application Cache in the Qt API.

        * Api/qwebsettings.cpp:
        (QWebSettings::QWebSettings):
        (QWebSettings::setOfflineWebApplicationCachePath):
        (QWebSettings::offlineWebApplicationCachePath):
        (QWebSettings::setOfflineWebApplicationCacheQuota):
        (QWebSettings::offlineWebApplicationCacheQuota):
        * Api/qwebsettings.h:

2009-07-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Reviewed by Adam Treat.

        Add missing Q_OBJECT to class inheriting from QObject.

        * tests/qwebframe/tst_qwebframe.cpp:

2009-07-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Reviewed by Adam Treat.

        Fix indentation.

        * tests/qwebframe/tst_qwebframe.cpp:

2009-07-30  Volker Hilsheimer <volker.hilsheimer@nokia.com>

        Reviewed by Simon Hausmann.

        Fix documentation links to examples.

        * Api/qwebview.cpp:

2009-07-30  Balazs Kelemen  <kelemen.balazs.3@stud.u-szeged.hu>

        Reviewed by Simon Hausmann.

        Allocate MainWindow on heap in robotized QtLauncher as well.

        * QtLauncher/main.cpp:
        (main):

2009-07-29  Kevin McCullough  <kmccullough@apple.com>

        Reviewed by Darin Adler.

        Added foundation work to allow a testing infrastructure for the Web
        Inspector.

        * WebCoreSupport/InspectorClientQt.cpp:
        (WebCore::InspectorClientQt::inspectorWindowObjectCleared):
        * WebCoreSupport/InspectorClientQt.h:

2009-07-29  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>

        Reviewed by Simon Hausmann.

        [Qt] In debug mode, this fix frees cached resources
        and other unreferenced objects (by calling the
        garbage collector) to remove the LEAK messages.
        https://bugs.webkit.org/show_bug.cgi?id=27767

        * Api/qwebframe.cpp:
        (qt_drt_cache_clear):
        * QtLauncher/main.cpp:
        (main):

2009-07-28  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Fix the Qt build by adapting to the changes of ScriptObject.

        * Api/qwebelement.cpp:
        (setupScriptObject):

2009-07-28  Robert Hogan  <robert@roberthogan.net>

        Reviewed by Simon Hausmann.

        Add WebKit version API to Qt.

        Get the current version of WebKit from WebKit/mac/Configurations/Version.xcconfig
        at compile time and make it available to Qt applications through
        qWebKitVersion().

        Also amend the User Agent string to place the Safari clause outside
        the final bracket and to the end of the UA string.

        https://bugs.webkit.org/show_bug.cgi?id=27158

        Minor build tweak by Simon Hausmann (adding export macros to new functions).

        * Api/headers.pri:
        * Api/qwebkitversion.cpp: Added.
        (webKitVersion):
        (webKitMajorVersion):
        (webKitMinorVersion):
        * Api/qwebkitversion.h: Added.
        * Api/qwebpage.cpp:
        (QWebPage::userAgentForUrl):
        * tests/qwebview/tst_qwebview.cpp:
        (tst_QWebView::getWebKitVersion):

        http://qt.nokia.com/developer/task-tracker/index_html?id=238391&method=entry
        http://qt.nokia.com/developer/task-tracker/index_html?id=219344&method=entry
        http://qt.nokia.com/developer/task-tracker/index_html?id=241144&method=entry

2246 files changed, 114278 insertions, 29270 deletions

diff --git a/src/3rdparty/webkit/ChangeLog b/src/3rdparty/webkit/ChangeLog
index a08a7b4..4a08347 100644
--- a/src/3rdparty/webkit/ChangeLog
+++ b/src/3rdparty/webkit/ChangeLog
@@ -1,3 +1,297 @@
+2009-09-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Disable some ARM compiler warnings
+        https://bugs.webkit.org/show_bug.cgi?id=29083
+
+        The following ARM compiler warnings are disabled
+
+        - #68-D: integer conversion resulted in a change of sign
+        - #111-D: statement is unreachable
+        - #177-D: variable XXX was declared but never referenced
+        - #368-D: class XXX defines no constructor to initialize the following: YYY
+        - #830-D: function XXX "XXX::operator new" has no corresponding operator delete
+        - #1293-D: assignment in condition
+
+        * WebKit.pri:
+
+2009-09-09  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add the alternative QtLauncher (based on QGraphicsView) to the build.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28862
+
+        * WebKit.pro:
+
+2009-09-07  Xan Lopez  <xlopez@igalia.com>
+
+        Rubber-stamped by Gustavo Noronha.
+
+        Bump versions in preparation for 1.1.14 release.
+
+        * configure.ac:
+
+2009-09-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26854
+        [GTK] Needs API to allow more control over outgoing requests
+
+        * GNUmakefile.am: new files added to the build for new class
+        WebKitNetworkResponse
+
+2009-09-06  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha, Jan Alonzo and Xan Lopez.
+
+        [Gtk] Expose a database API
+        https://bugs.webkit.org/show_bug.cgi?id=27899
+
+        Expose an HTML5 database API for GTK+.
+
+        * GNUmakefile.am:
+
+2009-09-04  Albert Bachand  <albertb@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Modify the condition regarding the key modifier for opening combo
+        boxes under GTK from just PLATFORM(GTK) to also look for
+        (PLATFORM(CHROMIUM) && PLATFORM(LINUX)).
+
+        * WebCore/dom/SelectElement.cpp:
+        * WebCore/manual-tests/select-popup-on-spacebar.html:
+
+2009-09-02  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez and Gustavo Noronha.
+
+        [Gtk] Implement a WebDataSource for the gtk port
+        https://bugs.webkit.org/show_bug.cgi?id=24758
+
+        Add WebKitWebDataSource unit test to the build script
+
+        * GNUmakefile.am:
+
+2009-09-02  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez and Gustavo Noronha.
+
+        [Gtk] Implement a WebDataSource for the gtk port
+        https://bugs.webkit.org/show_bug.cgi?id=24758
+
+        Add WebKitWebDataSource and DocumentLoaderGtk to the build script.
+
+        * GNUmakefile.am:
+
+2009-09-01  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez and Gustavo Noronha.
+
+        [Gtk] Implement a WebDataSource for the gtk port
+        https://bugs.webkit.org/show_bug.cgi?id=24758
+
+        Add WebKitWebResource to the build script.
+
+        * GNUmakefile.am:
+
+2009-08-28  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Gtk Build broken for OSX Quartz
+        https://bugs.webkit.org/show_bug.cgi?id=28727
+
+        Define XP_UNIX for non-Win OS builds.
+
+        * GNUmakefile.am:
+
+2009-08-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25889
+        [GTK] scrollbar policy for main frame is not implementable
+
+        Adding files for the new test for window-related issues (starting
+        with scrollbar policy).
+
+        * GNUmakefile.am:
+
+2009-08-27  Priit Laes  <plaes@plaes.org>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Out-of-srcdir build problem
+        https://bugs.webkit.org/show_bug.cgi?id=28741
+
+        * GNUmakefile.am, autotools/webkit.m4:
+        Fix problem with out-of-srcdir builds. Also bump required glib version.
+
+2009-08-24  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Bump package and so versions for 1.1.13 release.
+
+        * configure.ac:
+
+2009-08-22 Javier Jardón <javierjc1982@gmail.com>
+
+        [GTK] Not use deprecated symbols in WebKitWebView example code.
+        https://bugs.webkit.org/show_bug.cgi?id=28651
+
+        * WebKit/gtk/webkit/webkitwebview.cpp
+
+2009-08-18  Xan Lopez  <xlopez@igalia.com>
+
+        Rubber-stamped by Holger Freyther.
+
+        Require at least libsoup 2.27.91 for the new password
+        manager/authentication APIs.
+
+        * configure.ac:
+
+2009-08-18  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by NOBODY (Build Break).
+
+        Speculative fix for GTK DumpRenderTree.
+
+        * GNUmakefile.am:
+
+2009-08-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add --enable-datalist option.
+
+        * configure.ac:
+
+2009-08-14  Adam Bergkvist  <adam.bergkvist@ericsson.com>
+
+        Reviewed by Sam Weinig.
+
+        [GTK] Added EventSource to the build (default on).
+        https://bugs.webkit.org/show_bug.cgi?id=14997 
+
+        * configure.ac:
+
+2009-08-14  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Rubber-stamped by Gustavo Noronha.
+
+        Initialize CFLAGS and CXXFLAGS before the main body of the
+        WEBKIT_INIT macro so C files don't get built with "-g -O2".
+
+        * autotools/webkit.m4:
+
+2009-08-12  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Remove keyring optional features
+        https://bugs.webkit.org/show_bug.cgi?id=28173
+
+        Remove keyring support, we now do authentication storage through
+        libsoup. We depend on libsoup master now, will bump the dependency
+        when there's a new release.
+
+        * GNUmakefile.am:
+        * configure.ac:
+
+2009-08-11  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by NOBODY (Build break).
+
+        Speculative fix for GTK build break.
+
+        * WebKit.pro:
+
+2009-08-11  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Build the TestNetscapePlugin on Qt/Mac
+
+        * WebKit.pro:
+
+2009-08-11  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        Prefix lengthy commands with AM_V_GEN so that they produce an
+        output like 'GEN <filename>' when in silent mode.
+
+        * GNUmakefile.am:
+
+2009-08-05  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] macros in webkit.m4 should be defined once only
+        https://bugs.webkit.org/show_bug.cgi?id=27929
+
+        The macros in webkit.m4 are not meant to be called multiple times
+        so we'll make them AC_DEFUN_ONCE. Also make AC_HEADER_STDC and AC_PROG_CXX
+        AC_REQUIRE to remove the automake warnings when doing autogen.sh.
+
+        Lastly, make sure CXXFLAGS and CFLAGS are defined before
+        AC_PROG_CXX gets expanded so it doesn't add "-g -O2" on Release builds.
+
+        * autotools/webkit.m4:
+
+2009-08-05  Xan Lopez  <xlopez@igalia.com>
+
+        Revert r46714, it was making us build debug images by default.
+
+        * autotools/webkit.m4:
+
+2009-08-03  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Consolidate common gcc flags to WebKit.pri
+        https://bugs.webkit.org/show_bug.cgi?id=27934
+
+        * WebKit.pri:
+
+2009-08-03  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Rubber-stamped by Eric Seidel.
+
+        [Gtk] macros in webkit.m4 should be defined once only
+        https://bugs.webkit.org/show_bug.cgi?id=27929
+
+        The macros in webkit.m4 are not meant to be called multiple times
+        so we'll make them AC_DEFUN_ONCE. Also make AC_HEADER_STDC and AC_PROG_CXX
+        AC_REQUIRE to remove the automake warnings when doing autogen.sh.
+
+        * autotools/webkit.m4:
+
+2009-07-29  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Adding ImageDiff project file.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27813
+
+        * WebKit.pro: Added ImageDiff.pro.
+
+2009-07-29  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Eric Seidel and Xan Lopez.
+
+        [Gtk] Enable http/tests/appcache tests
+        https://bugs.webkit.org/show_bug.cgi?id=27674
+
+        * GNUmakefile.am: Add webkit/webkitapplicationcache.cpp
+
 2009-07-28  Xan Lopez  <xlopez@igalia.com>
 
         Reviewed by Gustavo Noronha.
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/APICast.h b/src/3rdparty/webkit/JavaScriptCore/API/APICast.h
index 762a15e..b6d1532 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/APICast.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/APICast.h
@@ -26,7 +26,7 @@
 #ifndef APICast_h
 #define APICast_h
 
-#include "JSNumberCell.h"
+#include "JSAPIValueWrapper.h"
 #include "JSValue.h"
 #include <wtf/Platform.h>
 #include <wtf/UnusedParam.h>
@@ -58,18 +58,18 @@ inline JSC::ExecState* toJS(JSGlobalContextRef c)
     return reinterpret_cast<JSC::ExecState*>(c);
 }
 
-inline JSC::JSValue toJS(JSC::ExecState* exec, JSValueRef v)
+inline JSC::JSValue toJS(JSC::ExecState*, JSValueRef v)
 {
-    JSC::JSValue jsValue = JSC::JSValue::decode(reinterpret_cast<JSC::EncodedJSValue>(const_cast<OpaqueJSValue*>(v)));
-#if USE(ALTERNATE_JSIMMEDIATE)
-    UNUSED_PARAM(exec);
+#if USE(JSVALUE32_64)
+    JSC::JSCell* jsCell = reinterpret_cast<JSC::JSCell*>(const_cast<OpaqueJSValue*>(v));
+    if (!jsCell)
+        return JSC::JSValue();
+    if (jsCell->isAPIValueWrapper())
+        return static_cast<JSC::JSAPIValueWrapper*>(jsCell)->value();
+    return jsCell;
 #else
-    if (jsValue && jsValue.isNumber()) {
-        ASSERT(jsValue.isAPIMangledNumber());
-        return JSC::jsNumber(exec, jsValue.uncheckedGetNumber());
-    }
+    return JSC::JSValue::decode(reinterpret_cast<JSC::EncodedJSValue>(const_cast<OpaqueJSValue*>(v)));
 #endif
-    return jsValue;
 }
 
 inline JSC::JSObject* toJS(JSObjectRef o)
@@ -89,15 +89,16 @@ inline JSC::JSGlobalData* toJS(JSContextGroupRef g)
 
 inline JSValueRef toRef(JSC::ExecState* exec, JSC::JSValue v)
 {
-#if USE(ALTERNATE_JSIMMEDIATE)
-    UNUSED_PARAM(exec);
+#if USE(JSVALUE32_64)
+    if (!v)
+        return 0;
+    if (!v.isCell())
+        return reinterpret_cast<JSValueRef>(asCell(JSC::jsAPIValueWrapper(exec, v)));
+    return reinterpret_cast<JSValueRef>(asCell(v));
 #else
-    if (v && v.isNumber()) {
-        ASSERT(!v.isAPIMangledNumber());
-        return reinterpret_cast<JSValueRef>(JSC::JSValue::encode(JSC::jsAPIMangledNumber(exec, v.uncheckedGetNumber())));
-    }
-#endif
+    UNUSED_PARAM(exec);
     return reinterpret_cast<JSValueRef>(JSC::JSValue::encode(v));
+#endif
 }
 
 inline JSObjectRef toRef(JSC::JSObject* o)
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSBase.h b/src/3rdparty/webkit/JavaScriptCore/API/JSBase.h
index 9f3d88e..d1ce9b3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSBase.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSBase.h
@@ -67,7 +67,7 @@ typedef struct OpaqueJSValue* JSObjectRef;
 #undef JS_EXPORT
 #if defined(BUILDING_WX__)
     #define JS_EXPORT
-#elif defined(__GNUC__)
+#elif defined(__GNUC__) && !defined(__CC_ARM) && !defined(__ARMCC__)
     #define JS_EXPORT __attribute__((visibility("default")))
 #elif defined(_WIN32_WCE)
     #if defined(JS_BUILDING_JS)
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h
index 1f06249..0497aa2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h
@@ -41,7 +41,7 @@ public:
     
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | HasStandardGetOwnPropertySlot)); 
+        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames)); 
     }
 
 private:
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.cpp
index 1b3217b..b7dd768 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.cpp
@@ -28,6 +28,7 @@
 #include "JSCallbackFunction.h"
 
 #include "APICast.h"
+#include "CodeBlock.h"
 #include "JSFunction.h"
 #include "FunctionPrototype.h"
 #include <runtime/JSGlobalObject.h>
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h
index 7dd87b5..3a17fa2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h
@@ -41,7 +41,7 @@ public:
     // refactor the code so this override isn't necessary
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot)); 
+        return Structure::create(proto, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark)); 
     }
 
 private:
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h
index 4360baa..47fd6c3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h
@@ -61,12 +61,12 @@ private:
     
     virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
 
-    virtual bool deleteProperty(ExecState*, const Identifier&, bool checkDontDelete = true);
-    virtual bool deleteProperty(ExecState*, unsigned, bool checkDontDelete = true);
+    virtual bool deleteProperty(ExecState*, const Identifier&);
+    virtual bool deleteProperty(ExecState*, unsigned);
 
     virtual bool hasInstance(ExecState* exec, JSValue value, JSValue proto);
 
-    virtual void getPropertyNames(ExecState*, PropertyNameArray&, unsigned listedAttributes = Structure::Prototype);
+    virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
 
     virtual double toNumber(ExecState*) const;
     virtual UString toString(ExecState*) const;
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObjectFunctions.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObjectFunctions.h
index 669b3cd..4d113fe 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObjectFunctions.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObjectFunctions.h
@@ -224,7 +224,7 @@ void JSCallbackObject<Base>::put(ExecState* exec, const Identifier& propertyName
 }
 
 template <class Base>
-bool JSCallbackObject<Base>::deleteProperty(ExecState* exec, const Identifier& propertyName, bool checkDontDelete)
+bool JSCallbackObject<Base>::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
     JSContextRef ctx = toRef(exec);
     JSObjectRef thisRef = toRef(this);
@@ -262,13 +262,13 @@ bool JSCallbackObject<Base>::deleteProperty(ExecState* exec, const Identifier& p
         }
     }
     
-    return Base::deleteProperty(exec, propertyName, checkDontDelete);
+    return Base::deleteProperty(exec, propertyName);
 }
 
 template <class Base>
-bool JSCallbackObject<Base>::deleteProperty(ExecState* exec, unsigned propertyName, bool checkDontDelete)
+bool JSCallbackObject<Base>::deleteProperty(ExecState* exec, unsigned propertyName)
 {
-    return deleteProperty(exec, Identifier::from(exec, propertyName), checkDontDelete);
+    return deleteProperty(exec, Identifier::from(exec, propertyName));
 }
 
 template <class Base>
@@ -318,11 +318,12 @@ bool JSCallbackObject<Base>::hasInstance(ExecState* exec, JSValue value, JSValue
     
     for (JSClassRef jsClass = classRef(); jsClass; jsClass = jsClass->parentClass) {
         if (JSObjectHasInstanceCallback hasInstance = jsClass->hasInstance) {
+            JSValueRef valueRef = toRef(exec, value);
             JSValueRef exception = 0;
             bool result;
             {
                 JSLock::DropAllLocks dropAllLocks(exec);
-                result = hasInstance(execRef, thisRef, toRef(exec, value), &exception);
+                result = hasInstance(execRef, thisRef, valueRef, &exception);
             }
             exec->setException(toJS(exec, exception));
             return result;
@@ -372,7 +373,7 @@ JSValue JSCallbackObject<Base>::call(ExecState* exec, JSObject* functionObject,
 }
 
 template <class Base>
-void JSCallbackObject<Base>::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSCallbackObject<Base>::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     JSContextRef execRef = toRef(exec);
     JSObjectRef thisRef = toRef(this);
@@ -380,7 +381,7 @@ void JSCallbackObject<Base>::getPropertyNames(ExecState* exec, PropertyNameArray
     for (JSClassRef jsClass = classRef(); jsClass; jsClass = jsClass->parentClass) {
         if (JSObjectGetPropertyNamesCallback getPropertyNames = jsClass->getPropertyNames) {
             JSLock::DropAllLocks dropAllLocks(exec);
-            getPropertyNames(execRef, thisRef, toRef(&propertyNames), listedAttributes);
+            getPropertyNames(execRef, thisRef, toRef(&propertyNames));
         }
         
         if (OpaqueJSClassStaticValuesTable* staticValues = jsClass->staticValues(exec)) {
@@ -406,7 +407,7 @@ void JSCallbackObject<Base>::getPropertyNames(ExecState* exec, PropertyNameArray
         }
     }
     
-    Base::getPropertyNames(exec, propertyNames, listedAttributes);
+    Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 template <class Base>
@@ -428,11 +429,13 @@ double JSCallbackObject<Base>::toNumber(ExecState* exec) const
                 JSLock::DropAllLocks dropAllLocks(exec);
                 value = convertToType(ctx, thisRef, kJSTypeNumber, &exception);
             }
-            exec->setException(toJS(exec, exception));
-            if (value) {
-                double dValue;
-                return toJS(exec, value).getNumber(dValue) ? dValue : NaN;
+            if (exception) {
+                exec->setException(toJS(exec, exception));
+                return 0;
             }
+
+            double dValue;
+            return toJS(exec, value).getNumber(dValue) ? dValue : NaN;
         }
             
     return Base::toNumber(exec);
@@ -452,11 +455,11 @@ UString JSCallbackObject<Base>::toString(ExecState* exec) const
                 JSLock::DropAllLocks dropAllLocks(exec);
                 value = convertToType(ctx, thisRef, kJSTypeString, &exception);
             }
-            exec->setException(toJS(exec, exception));
-            if (value)
-                return toJS(exec, value).getString();
-            if (exception)
+            if (exception) {
+                exec->setException(toJS(exec, exception));
                 return "";
+            }
+            return toJS(exec, value).getString();
         }
             
     return Base::toString(exec);
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.h b/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.h
index c742d96..c4777dd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.h
@@ -58,7 +58,7 @@ struct StaticFunctionEntry : FastAllocBase {
 typedef HashMap<RefPtr<JSC::UString::Rep>, StaticValueEntry*> OpaqueJSClassStaticValuesTable;
 typedef HashMap<RefPtr<JSC::UString::Rep>, StaticFunctionEntry*> OpaqueJSClassStaticFunctionsTable;
 
-class OpaqueJSClass;
+struct OpaqueJSClass;
 
 // An OpaqueJSClass (JSClass) is created without a context, so it can be used with any context, even across context groups.
 // This structure holds data members that vary across context groups.
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.cpp
index 87d36ec..06ef578 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.cpp
@@ -28,6 +28,7 @@
 #include "JSObjectRef.h"
 
 #include "APICast.h"
+#include "CodeBlock.h"
 #include "DateConstructor.h"
 #include "ErrorConstructor.h"
 #include "FunctionConstructor.h"
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.h b/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.h
index 86921bd..3e8b0eb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.h
@@ -187,7 +187,6 @@ typedef bool
 @param ctx The execution context to use.
 @param object The JSObject whose property names are being collected.
 @param accumulator A JavaScript property name accumulator in which to accumulate the names of object's properties.
-@param flag Specify which property should be included
 @discussion If you named your function GetPropertyNames, you would declare it like this:
 
 void GetPropertyNames(JSContextRef ctx, JSObjectRef object, JSPropertyNameAccumulatorRef propertyNames);
@@ -197,7 +196,7 @@ Property name accumulators are used by JSObjectCopyPropertyNames and JavaScript
 Use JSPropertyNameAccumulatorAddName to add property names to accumulator. A class's getPropertyNames callback only needs to provide the names of properties that the class vends through a custom getProperty or setProperty callback. Other properties, including statically declared properties, properties vended by other classes, and properties belonging to object's prototype, are added independently.
 */
 typedef void
-(*JSObjectGetPropertyNamesCallback) (JSContextRef ctx, JSObjectRef object, JSPropertyNameAccumulatorRef propertyNames, unsigned flag);
+(*JSObjectGetPropertyNamesCallback) (JSContextRef ctx, JSObjectRef object, JSPropertyNameAccumulatorRef propertyNames);
 
 /*! 
 @typedef JSObjectCallAsFunctionCallback
diff --git a/src/3rdparty/webkit/JavaScriptCore/ChangeLog b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
index 24fc7e7..8aa8c1d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/ChangeLog
+++ b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
@@ -1,3 +1,6959 @@
+2009-09-17  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Symbian/WINSCW build fox.
+
+        Repeat Q_OS_WIN wchar_t hack for WINSCW, similar to
+        revision 24774.
+
+        WINSCW defines wchar_t, thus UChar has to be wchar_t
+
+        * wtf/unicode/qt4/UnicodeQt4.h:
+
+2009-09-17  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Symbian/WINSCW build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29186
+
+        WINSCW Template specialisation name in declaration must the be the same as in implementation.
+
+        * runtime/LiteralParser.h:
+
+2009-09-15  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27060
+
+        Symbian compiler for emulator target (WINSCW) fails with
+        "illegal operand" for m_attributesInPrevious in structure.ccp
+        (when calling make_pair functions).
+        This error is apparently due to the compiler not properly
+        resolving the unsigned type of the declared bitfield.
+
+        Initial patch explicitly casted m_attributesInPrevious
+        to unsigned, but since bitfield optimization is not critical for
+        the emulator target, this conditional change in header file
+        appears to be least intrusive.
+
+        * runtime/Structure.h:
+
+2009-09-16  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Fix GCC warnings on ARM_THUMB2 platform
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMThumbImmediate::countLeadingZerosPartial):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerARMv7::moveFixedWidthEncoding):
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(INSPECTOR)
+        https://bugs.webkit.org/show_bug.cgi?id=29260
+
+        Reviewed by David Kilzer.
+
+        * wtf/Platform.h:
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(CONTEXT_MENUS)
+        https://bugs.webkit.org/show_bug.cgi?id=29225
+
+        Reviewed by David Kilzer.
+
+        * wtf/Platform.h:
+
+2009-09-16  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        The webkit stdint and stdbool headers exists because
+        the compiler MSVC doesn't include them.  The check
+        should not check for PLATFORM(WIN_OS) but for MSVC.
+
+        * os-win32/stdbool.h:
+        * os-win32/stdint.h:
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(DRAG_SUPPORT)
+        https://bugs.webkit.org/show_bug.cgi?id=29233
+
+        Reviewed by David Kilzer.
+
+        * wtf/Platform.h:
+
+2009-09-16  Kevin Ollivier  <kevino@theolliviers.com>
+
+        waf build fix after flag was moved to correct place.
+
+        * wscript:
+
+2009-09-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Build fix for 64-bit Qt on Mac OS X
+
+        * wtf/Platform.h: Use JSVALUE64 on DARWIN, not only on MAC
+
+2009-09-16  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix wtf/ThreadSpecific.h under Qt to free thread local objects.
+        https://bugs.webkit.org/show_bug.cgi?id=29295
+
+        This is an important fix when JavaScript workers are in use, since
+        unfreed ThreadGlobalDatas leak a big amount of memory (50-100k each).
+        QThreadStorage calls the destructor of a given object, which is the
+        ThreadSpecific::Data. Unlike pthread, Qt is object oriented, and does
+        not support the calling of a static utility function when the thread
+        is about to close. In this patch we call the ThreadSpecific::destroy()
+        utility function from the destructor of ThreadSpecific::Data. Moreover,
+        since Qt resets all thread local values to 0 before the calling of the
+        appropriate destructors, we set back the pointer to its original value.
+        This is necessary because the get() method of the ThreadSpecific
+        object may be called during the exuction of the destructor.
+
+        * wtf/ThreadSpecific.h:
+        (WTF::ThreadSpecific::Data::~Data):
+        (WTF::::~ThreadSpecific):
+        (WTF::::set):
+        (WTF::::destroy):
+
+2009-09-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Allow anonymous storage inside JSObject
+        https://bugs.webkit.org/show_bug.cgi?id=29168
+
+        Add the concept of anonymous slots to Structures so that it is
+        possible to store references to values that need marking in the
+        standard JSObject storage buffer.  This allows us to reduce the
+        malloc overhead of some objects (by allowing them to store JS
+        values in the inline storage of the object) and reduce the 
+        dependence of custom mark functions (if all an objects children
+        are in the standard object property storage there's no need to
+        mark them manually).
+
+        * JavaScriptCore.exp:
+        * runtime/JSObject.h:
+        (JSC::JSObject::putAnonymousValue):
+        (JSC::JSObject::getAnonymousValue):
+        (JSC::JSObject::addAnonymousSlots):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        (JSC::JSWrapperObject::JSWrapperObject):
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/PropertyMapHashTable.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addAnonymousSlotsTransition):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::put):
+        (JSC::Structure::rehashPropertyMapHashTable):
+        * runtime/Structure.h:
+        (JSC::Structure::propertyStorageSize):
+        (JSC::StructureTransitionTable::reifySingleTransition):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTable::TransitionTable::addSlotTransition):
+        (JSC::StructureTransitionTable::TransitionTable::removeSlotTransition):
+        (JSC::StructureTransitionTable::TransitionTable::getSlotTransition):
+        (JSC::StructureTransitionTable::getAnonymousSlotTransition):
+        (JSC::StructureTransitionTable::addAnonymousSlotTransition):
+        (JSC::StructureTransitionTable::removeAnonymousSlotTransition):
+
+2009-09-15  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Added the ENABLE_MATHML define to the features
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-09-15 Csaba Osztrogonac <oszi@inf.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Build fix for windows.
+
+        After http://trac.webkit.org/changeset/47795 the MinGW build broke,
+        because MinGW has __mingw_aligned_malloc instead of _aligned_malloc.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::allocateBlock): MinGW case added.
+        (JSC::Heap::freeBlock): MinGW case added.
+
+2009-09-15  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Build fix for Windows/MinGW
+
+        https://bugs.webkit.org/show_bug.cgi?id=29268
+
+        * wtf/Platform.h: JSVALUE32_64 temporarily disabled on PLATFORM(WIN_OS) with COMPILER(MINGW)
+
+2009-09-14  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Detect VFP at runtime in generic ARM port on Linux platform.
+        https://bugs.webkit.org/show_bug.cgi?id=29076
+
+        * JavaScriptCore.pri:
+        * assembler/MacroAssemblerARM.cpp: Added.
+        (JSC::isVFPPresent):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::supportsFloatingPoint):
+
+2009-09-14  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Build fix for windows build.
+
+        * JavaScriptCore.pri: Correct a logic error.
+        * pcre/dftables: Add missing paranthesis for tmpdir function.
+
+2009-09-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Build fix for windows exports (again).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Build fix for windows exports.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Correct fix for non-allinonefile builds
+
+        * runtime/ObjectConstructor.cpp:
+
+2009-09-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Fix non-allinonefile builds
+
+        * runtime/ObjectConstructor.cpp:
+
+2009-09-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        [ES5] Implement Object.keys
+        https://bugs.webkit.org/show_bug.cgi?id=29170
+
+        This patch basically requires two separate steps, the first is to split getPropertyNames
+        into two functions -- getOwnPropertyNames and getPropertyNames, basically making them behave
+        in the same way as getOwnPropertySlot and getPropertySlot.  In essence getOwnPropertyNames
+        produces the list of properties on an object excluding its prototype chain and getPropertyNames
+        just iterates the the object and its prototype chain calling getOwnPropertyNames at each level.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertyNames):
+        * JavaScriptCore.exp:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::getOwnPropertyNames):
+        * debugger/DebuggerActivation.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertyNames):
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::getOwnPropertyNames):
+        * runtime/JSByteArray.h:
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::getOwnPropertyNames):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertyNames):
+        * runtime/JSObject.h:
+        * runtime/JSVariableObject.cpp:
+        (JSC::JSVariableObject::getOwnPropertyNames):
+        * runtime/JSVariableObject.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorKeys):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::getOwnPropertyNames):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertyNames):
+        * runtime/StringObject.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::getOwnEnumerablePropertyNames):
+        (JSC::Structure::getEnumerablePropertyNames):
+        * runtime/Structure.h:
+
+2009-09-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        getPropertyNames caching is invalid when the prototype chain contains objects with custom getPropertyNames
+        https://bugs.webkit.org/show_bug.cgi?id=29214
+
+        Add a flag to TypeInfo to indicate whether a type overrides getPropertyNames.
+        This flag is used to make sure that caching of the property name data is safe.
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::hasDefaultGetPropertyNames):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::isCacheable):
+
+2009-09-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29207
+        Add checks for using WebCore JS context on secondary threads
+
+        * runtime/JSGlobalData.cpp: (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        Added a new mainThreadOnly flag that WebCore would set.
+
+        * runtime/Collector.cpp: (JSC::Heap::registerThread): JSC API methods always call this,
+        so this is a good place to check that the API isn't used form a wrong thread.
+
+2009-09-11  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Compiling JavaScriptCore on sparc 64 with gcc fails.
+
+        ThreadSafeShared uses the atomic __gnu_cxx::__exchange_and_add with an int,
+        however on sparc 64 the _Atomic_word argument is typedefed to long (8 bytes).
+
+        The patch disables WTF_USE_LOCKFREE_THREADSAFESHARED in ThreadSafeShared to use
+        a mutex instead when compiling for sparc 64 with gcc.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29175
+
+        * wtf/Platform.h:
+        __sparc64__ is not defined on all OS.
+        Uses instead: __sparc__ && __arch64__ || __sparcv9
+        * wtf/Threading.h:
+
+2009-09-11  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix compile error on Windows7(64Bit) with latest SDK.
+
+        Added the missing include file.
+
+        * runtime/UString.cpp:
+
+2009-09-11  Joerg Bornemann  <joerg.bornemann@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Qt/Windows CE compile fix, include the executable allocator and
+        markstack implementation in the windows build.
+
+        * JavaScriptCore.pri:
+
+2009-09-08  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Remove unneeded define for ActiveX.
+        https://bugs.webkit.org/show_bug.cgi?id=29054
+
+        * wtf/Platform.h:
+
+2009-09-10  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Update JavaScriptCore and WebKit's FeatureDefines.xcconfig so that they are in sync with WebCore as they need to be.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-09-10  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Export WTF::tryFastMalloc used in WebSocketChannel.
+        https://bugs.webkit.org/show_bug.cgi?id=28038
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Make StructureTransitionTable use an enum for the PtrAndFlags member
+        used for the single transition slot optimisation.
+
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTable::StructureTransitionTable):
+        (JSC::StructureTransitionTable::usingSingleTransitionSlot):
+        (JSC::StructureTransitionTable::):
+
+2009-09-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Refactor StructureTransitionTable and Structure to unify handling of the single slot optimization
+        https://bugs.webkit.org/show_bug.cgi?id=29141
+
+        Make StructureTransitionTable encapsulate the single transition slot optimization.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::~Structure):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        (JSC::Structure::hasTransition):
+        * runtime/Structure.h:
+        (JSC::StructureTransitionTable::contains):
+        (JSC::StructureTransitionTable::get):
+        (JSC::StructureTransitionTable::hasTransition):
+        (JSC::StructureTransitionTable::reifySingleTransition):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTable::StructureTransitionTable):
+        (JSC::StructureTransitionTable::~StructureTransitionTable):
+        (JSC::StructureTransitionTable::remove):
+        (JSC::StructureTransitionTable::add):
+        (JSC::StructureTransitionTable::table):
+        (JSC::StructureTransitionTable::singleTransition):
+        (JSC::StructureTransitionTable::usingSingleTransitionSlot):
+        (JSC::StructureTransitionTable::setSingleTransition):
+        (JSC::StructureTransitionTable::setTransitionTable):
+        (JSC::StructureTransitionTable::):
+        * wtf/PtrAndFlags.h:
+        (WTF::PtrAndFlags::PtrAndFlags):
+
+2009-09-10  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Implement fastDeleteSkippingDestructor for FastAllocBase and fastDeleteAllValues for HashSet
+        https://bugs.webkit.org/show_bug.cgi?id=25930
+
+        FastAllocBase has been extended with fastDeleteSkippingDestructor function which
+        releases memory without destructor call. fastDeleteAllValues has been implemented 
+        similar as deleteAllValues but it uses fastDelete function to release memory.
+
+        * wtf/FastAllocBase.h:
+        (WTF::fastDeleteSkippingDestructor):
+        * wtf/HashSet.h:
+        (WTF::fastDeleteAllValues):
+
+2009-09-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        ARM compiler does not understand GCC visibility attribute
+        https://bugs.webkit.org/show_bug.cgi?id=29079
+
+        * API/JSBase.h: Make the test more specific to hit only
+        the GCC compiler
+
+2009-09-10  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed revert of the previous change.  It broke the tests.
+
+        * wtf/dtoa.cpp:
+        (WTF::dtoa):
+
+2009-09-10  Ben Laurie  <benl@google.com>
+
+        Reviewed by Adam Barth.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=26836>
+
+        If dtoa was given a small buffer and the number was either infinite or
+        NaN, then the buffer would be overflowed.
+
+        * wtf/dtoa.cpp:
+
+2009-09-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Change reinterpret_cast to static_cast in r48212.
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2009-09-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Remove WTF_PLATFORM_FORCE_PACK as it is no longer used
+        https://bugs.webkit.org/show_bug.cgi?id=29066
+
+        * wtf/Platform.h:
+
+2009-09-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Implement flushing the instruction cache for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=29075
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush): Call IMB_Range to flush
+        the instruction cache on Symbian
+
+2009-09-09  Kent Hansen  <khansen@trolltech.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29024
+        Make JavaScriptCore compile on platforms with case-insensitive file systems and typeinfo.h in STL
+
+        These platforms include Microsoft Visual Studio 2003, and Symbian with Metrowerks compiler.
+
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSTypeInfo.h: Copied from JavaScriptCore/runtime/TypeInfo.h.
+        * runtime/Structure.h:
+        * runtime/TypeInfo.h: Removed.
+
+2009-09-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        JSON.stringify(Date) loses the milliseconds information
+        https://bugs.webkit.org/show_bug.cgi?id=29063
+
+        Make sure we include milliseconds in the output of toISOString.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToISOString):
+
+2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, generate derived sources earlier in order to make sure
+        they're found by the build system when generating the list of sources to build.
+
+        * wscript:
+
+2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Build fix when USE(LOCKFREE_THREADSAFESHARED) is not defined
+        https://bugs.webkit.org/show_bug.cgi?id=29011
+
+        * wtf/Threading.h: Use LOCKFREE_THREADSAFESHARED guard for 
+        atomicIncrement and atomicDecrement
+
+2009-09-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control in Yarr's RegexInterpreter
+        https://bugs.webkit.org/show_bug.cgi?id=29025
+
+        Inherits RegexInterpreter classes from FastAllocBase (bug #20422), which has
+        been instantiated by 'new':
+
+        class ByteDisjunction
+        -> instantiated in JavaScriptCore/yarr/RegexInterpreter.cpp:1462
+
+        struct BytecodePattern
+        -> instantiated in JavaScriptCore/yarr/RegexInterpreter.cpp:1279
+
+        * yarr/RegexInterpreter.h:
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Reverting r48121 to fix Windows build errors.
+
+        * JavaScriptCore.exp:
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Enable SHARED_WORKERS by default
+        https://bugs.webkit.org/show_bug.cgi?id=28959
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-09-07  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Export WTF::tryFastMalloc used in WebSocketChannel.
+        https://bugs.webkit.org/show_bug.cgi?id=28038
+
+        * JavaScriptCore.exp:
+
+2009-09-04  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Fix windows export files
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-04  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [[ToString]] conversion should use the actual toString function for String objects.
+
+        Remove incorrect specialisations of toString conversions on StringObject.
+
+        * JavaScriptCore.exp:
+        * runtime/StringObject.cpp:
+        * runtime/StringObject.h:
+
+2009-09-04  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Add new export.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: Add new export.
+
+2009-09-04  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Remove unneeded export.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: Remove unneeded export.
+
+2009-09-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        DateInstance object collected on ARM JIT (JSValue: WTF_USE_JSVALUE32)
+        https://bugs.webkit.org/show_bug.cgi?id=28909
+
+        Part two.
+
+        Make some improvements to garbage collection code:
+
+            1) Create a runtime assertion that catches any classes that
+               override markChildren but have the HasDefaultMark bit set.
+            2) Remove checks of the mark bit outside the MarkStack::append
+               function; they are redundant.
+            3) Improve the efficiency of the asObject and asArray functions
+               when called on JSCell* to avoid a round trip to JSValue.
+            4) Make more callers use the checked asCell and asObject
+               casting functions rather than unchecked casts.
+            5) Removed the JSCell::marked function and other GC-related
+               functions because these operations are no longer things that
+               code other than the core GC code needs to do directly. Fixed
+               callers that were calling them.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::markConservatively): Removed unneeded call to MarkStack::drain.
+        (JSC::Heap::markProtectedObjects): Removed unneeded check of the mark
+        bit and call to MarkStack::drain.
+        (JSC::Heap::collect): Removed unneeded checks of the mark bit and also
+        changed call to SmallStrings::mark to call markChildren instead to match
+        the rest of the objects.
+        (JSC::typeName): Removed unneeded cast to JSObject*.
+
+        * runtime/JSArray.h:
+        (JSC::asArray): Added an overload for JSCell* and changed the JSValue
+        version to call it. Removed some unneeded casts.
+        (JSC::JSArray::markChildrenDirect): Marked this function inline. It's in
+        a header, and if not marked inline this could lead to linking problems.
+        (JSC::MarkStack::markChildren): Added. This helper function is used by
+        the drain function to avoid repating code. Also added the code here to
+        check fro default mark violations in debug code. If a markChildren
+        function adds something to the mark stack, but the type info claimed
+        hasDefaultMark was true, then we will get an assertion now. Also fixed
+        the assertion about the mark bit to use the Heap function directly
+        because we don't have a JSCell::marked function any more.
+        (JSC::MarkStack::drain): Changed a local variable from "v" to "value",
+        and from "currentCell" to "cell". Changed to call markChildren in two
+        places instead of repeating a chain of if statements twice. Changed
+        code that reads and writes the mark bit to use Heap::isCellMarked and
+        Heap::markCell so we can eliminate the JSCell::marked and
+        JSCell::markCellDirect functions.
+
+        * runtime/JSCell.h: Removed JSCell's markCellDirect and marked member
+        functions. Added a comment explaining that asCell should be deprecated
+        in favor of the JSValue asCell member function.
+        (JSC::MarkStack::append): Added the assertion that catches callers
+        that have set the HasDefaultMark bit incorrectly. Changed
+        code that reads and writes the mark bit to use Heap::isCellMarked and
+        Heap::markCell so we can eliminate the JSCell::marked and
+        JSCell::markCellDirect functions. Moved the overload of
+        MarkStack::append for JSValue here so it can call through to the cell
+        version. The old version had a copy of all the code instead, but that
+        repeated the conversion from JSValue to JSCell* and the check for
+        whether a value is a cell multiple times.
+        (JSC::Structure::markAggregate): Moved this function here to avoid
+        dependencies for Structure.h, since this calls MarkStack::append.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::markChildren): Added code to clear
+        m_isCheckingForDefaultMarkViolation so the marking done by JSObject
+        doesn't trigger the assertion.
+
+        * runtime/JSValue.h: Moved some stray includes that were outside the
+        header guard inside it. Not sure how that happened! Removed the
+        GC-related member functions markChildren, hasChildren, marked, and
+        markDirect.
+
+        * runtime/JSWrapperObject.h: Made markChildren private.
+        (JSC::JSWrapperObject::createStructure): Added. Fixes a bug where the
+        HasDefaultMark bit was set.
+
+        * runtime/MarkStack.h: Added m_isCheckingForDefaultMarkViolation and
+        initialized it to false. Moved the append function body from here to
+        JSCell.h. Added a declaration of a private markChildren function used
+        inside the drain function.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::markChildren): Changed the name and style of this
+        function to match other functions. This allows us to share the normal
+        mark stack code path.
+
+        * runtime/SmallStrings.h: Changed the name and interface of mark to
+        the more-normal markChildren style.
+
+        * runtime/Structure.h: Moved the body of markAggregate into the
+        JSCell.h to avoid a circular dependency with JSCell.h.
+
+2009-09-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        DateInstance object collected on ARM JIT (JSValue: WTF_USE_JSVALUE32)
+        https://bugs.webkit.org/show_bug.cgi?id=28909
+
+        Part one.
+
+        Make some improvements to garbage collection code:
+
+            1) Fix the two classes that had the default mark bit set but
+               should not.
+            2) Remove checks of the mark bit outside the MarkStack::append
+               function; they are redundant.
+            3) Make more callers use the checked asCell and asObject
+               casting functions rather than unchecked casts.
+            4) Removed some GC-related functions because these operations are
+               no longer things that code other than the core GC code needs
+               to do directly. Fixed callers that were calling them.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate): Removed unneeded check of the mark
+        bit before calling MarkStack::append.
+
+        * interpreter/Register.h: Removed unneeded marked and markChildren
+        functions.
+
+        * jit/JITStubs.cpp:
+        (op_eq): Removed unneeded assertions, instead using checked casting
+        functions such as asObject.
+
+        * runtime/ArgList.h: Added now-needed forward declaration of MarkStack.
+
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::markChildren): Remmoved unneeded check of the mark bit.
+
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::createStructure): Added. Fixes a bug where the
+        HasDefaultMark bit was set.
+
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getObject): Use asObject to avoid a direct static_cast.
+
+        * runtime/JSObject.h:
+        (JSC::asObject): Added an overload for JSCell* and changed the JSValue
+        version to call it.
+        (JSC::JSValue::get): Use asObject to avoid a direct static_cast.
+
+        * runtime/JSWrapperObject.h: Made markChildren private.
+        (JSC::JSWrapperObject::createStructure): Added. Fixes a bug where the
+        HasDefaultMark bit was set. Later we may want to optimize this for
+        wrapper types that never have cells in their internal values, but there
+        is no measured performance regression in SunSpider or V8 doing this
+        all the time.
+
+        * runtime/MarkStack.cpp: Tweaked formatting.
+
+2009-09-04  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Switch USE_ defines over to the compiler so that they can be
+        checked by files not including config.h (like WebCorePrefix.h).
+
+        * wtf/Platform.h:
+
+2009-09-03  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by David Levin.
+
+        Remove unnecessary dependency on unistd.h
+        https://bugs.webkit.org/show_bug.cgi?id=28962
+
+        * runtime/Completion.cpp:
+
+2009-09-03  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add strnstr for Linux and Windows in StringExtras.h
+        https://bugs.webkit.org/show_bug.cgi?id=28901
+
+        * wtf/StringExtras.h:
+        (strnstr):
+
+2009-09-03  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for JavaScriptCore's HashEntry class
+        https://bugs.webkit.org/show_bug.cgi?id=27830
+
+        Inherits HashEntry class from FastAllocBase because it has been
+        instantiated by 'new' JavaScriptCore/runtime/Lookup.cpp:32.
+
+        * runtime/Lookup.h:
+
+2009-09-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Should crash if JIT code buffer allocation fails.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28926
+        <rdar://problem/7031922>
+
+        * jit/ExecutableAllocatorPosix.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+        * jit/ExecutableAllocatorWin.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        waf build fixes for Windows/MSVC.
+
+        * wscript:
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fix for building on Windows.
+
+        * wtf/ThreadingPthreads.cpp:
+
+2009-09-02  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Use fastMalloc when neither MMAP nor VIRTUALALLOC are enabled
+        
+        RegisterFile constructor currently throws #error when both
+        MMAP and VIRTUALALLOC conditions fail.
+        On any platform that does not provide these features
+        (for instance, Symbian),
+        the fallback should be regular malloc (or fastMalloc).
+        It is functionally equivalent in this case, even though it may
+        have certain drawbacks such as lack of dynamic pre-allocation.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::~RegisterFile):
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+
+2009-08-31  Robert Agoston  <Agoston.Robert@stud.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Fixed typo.
+        https://bugs.webkit.org/show_bug.cgi?id=28691
+
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+
+2009-08-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        JSON Stringifier does not follow ES5 spec for handling of Number, String and Boolean objects
+        https://bugs.webkit.org/show_bug.cgi?id=28797
+
+        Fixed unwrapBoxedPrimitive to do the right thing, which necessitated a couple of new exception
+        checks, and corrected the logic in gap to correctly convert Number and String objects.
+
+        * runtime/JSONObject.cpp:
+        (JSC::unwrapBoxedPrimitive):
+        (JSC::gap):
+        (JSC::Stringifier::Stringifier):
+        (JSC::Stringifier::appendStringifiedValue):
+
+2009-08-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Adam Roben.
+
+        JSON.stringify replacer array does not accept values that are not string primitives.
+        https://bugs.webkit.org/show_bug.cgi?id=28788
+
+        Update the JSON stringifier to initialise its replacer array according to the most
+        recent version of the spec.
+
+        * runtime/Identifier.h:
+        (JSC::Identifier::from):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Stringifier):
+
+2009-08-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28753
+        <rdar://problem/7173448> Excessive number of threads (and a crash)
+
+        * wtf/Threading.h: (WTF::atomicIncrement): Changed atomicIncrement to match decrement
+        and return the new value. Also added using directives for these functions, to match
+        te rest of WTF.
+
+2009-08-27  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Link the testapi against CFLite when building the WinCairo port.
+
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj: Add new Release_CFLite
+          target.  Update all targets to inherit from either the
+          JavaScriptCF.vsprops (Apple target) or the JavaScriptCFLite.vsprops
+          file (WinCairo target).
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops: Remove
+          input file CoreFoundation.lib. This is provided by either the
+          JavaScriptCF.vsprops or JavaScriptCFLite.vsprops file.
+
+2009-08-27  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Geoff Garen.
+        
+        Fix Windows-specific crash due to missing memory clearing call.
+        
+        * runtime/Collector.cpp:
+        (JSC::Heap::allocateBlock):
+
+2009-08-27  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix: JavaScriptCore_debug.def missing some exports.  Apple
+        Windows build does not use this file, so it was not noticed previously.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        x86-64 GTK broken due to code offsets changing, pointers sometimes packed into immediates.
+        https://bugs.webkit.org/show_bug.cgi?id=28317
+
+        Missed one, fix part II.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::move):
+        * assembler/X86Assembler.h:
+        (JSC::CAN_SIGN_EXTEND_8_32):
+
+2009-08-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Adam Roben.
+
+        JSON.stringify replacer array does not accept values that are not string primitives.
+        https://bugs.webkit.org/show_bug.cgi?id=28788
+
+        Update the JSON stringifier to initialise its replacer array according to the most
+        recent version of the spec.
+
+        * runtime/Identifier.h:
+        (JSC::Identifier::from):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Stringifier):
+
+2009-08-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        JSON parser accepts trailing comma in array literals
+        https://bugs.webkit.org/show_bug.cgi?id=28779
+
+        Update parser to correctly fail if there's a trailing comma.
+
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parse):
+
+2009-08-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        'this' in JSON.parse reviver is the global object
+        https://bugs.webkit.org/show_bug.cgi?id=28752
+
+        This is a technically simple change, we merely update the code for calling
+        the reviver function to pass the correct this object.  Doing so however
+        exposes the holder to arbitrary mutation by the reviver function so it is
+        necessary for us to now guard all property accesses against the possibility
+        of failure.
+
+        * runtime/JSArray.h:
+          JSON needs to delete a property from the array, so we friend its 
+          Walker class so that we can make a non-virtual call to the arrays
+          delete and getOwnPropertySlot methods.
+        * runtime/JSONObject.cpp:
+        (JSC::Walker::callReviver):
+          We need to pass the correct this object
+        (JSC::Walker::walk):
+          Update calls to callReviver, and update property logic logic
+          to correctly handle the holder being mutated by the reviver
+          function.
+
+2009-08-26  Alice Liu  <alice.liu@apple.com>
+
+        Windows build fix: added some exported symbols
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Removed some exported symbols that no longer exist.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Olliejver Hunt.
+
+        x86-64 GTK broken due to code offsets changing, pointers sometimes packed into immediates.
+        https://bugs.webkit.org/show_bug.cgi?id=28317
+
+        We rely on a slightly OS X specific behaviour, that x86-64 applications have a 4Gb zero page,
+        so pointers are never representable as a 32-bit integer, and always have to be represented by
+        a separate immediate load instruction, rather than within the immediate field of an arithmetic
+        or memory operation.
+
+        We explicitly check for a couple of cases where a value might be representable in 32-bit, but
+        these probably never kick in on Mac OS, and only kick in to hose GTK.  Deleting these does not
+        show a performance degradation on SunSpider.  Remove.
+
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::storePtr):
+        (JSC::MacroAssemblerX86_64::branchPtr):
+
+2009-08-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        A bit of Collector refatoring.
+        
+        SunSpider says no change. v8 says 1.003x faster (1.02x faster on splay).
+
+        * JavaScriptCore.exp:
+
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::toPrimitive):
+        (JSC::JSCell::getPrimitiveNumber):
+        (JSC::JSCell::toBoolean):
+        (JSC::JSCell::toNumber):
+        (JSC::JSCell::toString):
+        (JSC::JSCell::toObject): Removed pure virtual functions from
+        JSCell, so the collector can construct one. This allowed
+        me to remove a bunch of ASSERT_NOT_REACHED throughout the
+        code, too.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSCell): ditto
+        (JSC::Heap::heap): Inlined this function because it's trivial.
+
+        * JavaScriptCore.exp:
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy):
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlock):
+        (JSC::Heap::freeBlocks): Renamed freeHeap to freeBlocks, since
+        it doesn't actually free the Heap object.
+        (JSC::Heap::heapAllocate):
+        (JSC::Heap::sweep):
+        * runtime/Collector.h: Refactored block allocation and destruction
+        into helper functions.
+        
+        * runtime/GetterSetter.cpp:
+        * runtime/JSAPIValueWrapper.cpp:
+        * runtime/JSPropertyNameIterator.cpp: Removed dummy implementations
+        of pure virtual functions. (See above.)
+
+=== End re-roll-in of r47738:47740 with Windows crash fixed ===
+
+2009-08-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: start out with a 32-bit value to avoid a shortening warning.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::sweep):
+
+2009-08-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Substantially reduced VM thrash in the GC heap.
+        
+        1.08x faster on v8 (1.60x faster on v8-splay).
+        
+        1.40x faster on bench-alloc-nonretained.
+        
+        1.90x faster on bench-alloc-retained.
+        
+        SunSpider says no change.
+        
+        * runtime/Collector.cpp:
+        (JSC::Heap::heapAllocate): Fixed a long-standing bug: update a few local
+        variables unconditionally after calling collect(), since they may be used
+        even if we don't "goto scan". (In the bug I saw, usedBlocks got out of
+        sync with heap.usedBlocks).
+        (JSC::Heap::sweep): Keep enough free heap space to accomodate 
+        the number of objects we'll allocate before the next GC, plus 25%, for
+        good measure.
+        * runtime/Collector.h: Bumped the block size to 256k. This seems to give
+        the best cache performance, and it prevents us from initiating lots of
+        VM traffic to recover very small chunks of memory.
+
+=== Begin re-roll-in of r47738:47740 with Windows crash fixed ===
+
+2009-08-25  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        postMessage() spec now supports sending arrays of ports
+        https://bugs.webkit.org/show_bug.cgi?id=26902
+
+        Added OwnPtr to VectorTraits so we can store OwnPtrs in Vectors.
+
+        * wtf/VectorTraits.h:
+
+2009-08-26  Xan Lopez  <xlopez@igalia.com>
+
+        Rubber-stamped by Gustavo Noronha.
+
+        Remove duplicated files from file list.
+
+        * GNUmakefile.am:
+
+2009-08-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        More export fixes.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Hopefully fix all the exports from JSC on windows
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fixes).
+
+        Forgot I added files to JavaScriptCore. 
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCoreSources.bkl:
+
+2009-08-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [ES5] Implement getOwnPropertyDescriptor
+        https://bugs.webkit.org/show_bug.cgi?id=28724
+
+        Implement the core runtime support for getOwnPropertyDescriptor.
+        This adds a virtual getOwnPropertyDescriptor method to every class
+        that implements getOwnPropertySlot that shadows the behaviour of
+        getOwnPropertySlot.  The alternative would be to make getOwnPropertySlot
+        (or PropertySlots in general) provide property attribute information,
+        but quick testing showed this to be a regression.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        * runtime/Arguments.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::getOwnPropertyDescriptor):
+        * runtime/ArrayPrototype.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::getOwnPropertyDescriptor):
+        * runtime/DatePrototype.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::getOwnPropertyDescriptor):
+        * runtime/JSByteArray.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertyDescriptor):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::getOwnPropertyDescriptor):
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::getOwnPropertyDescriptor):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSONObject.cpp:
+        (JSC::JSONObject::getOwnPropertySlot):
+        (JSC::JSONObject::getOwnPropertyDescriptor):
+        * runtime/JSONObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        (JSC::JSObject::getPropertyDescriptor):
+        * runtime/JSObject.h:
+        * runtime/JSString.cpp:
+        (JSC::JSString::getStringPropertyDescriptor):
+        (JSC::JSString::getOwnPropertyDescriptor):
+        * runtime/JSString.h:
+        * runtime/JSVariableObject.cpp:
+        (JSC::JSVariableObject::symbolTableGet):
+        * runtime/JSVariableObject.h:
+        * runtime/Lookup.h:
+        (JSC::getStaticPropertyDescriptor):
+        (JSC::getStaticFunctionDescriptor):
+        (JSC::getStaticValueDescriptor):
+          Add property descriptor equivalents of the lookup
+          table access functions
+
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::getOwnPropertySlot):
+        (JSC::MathObject::getOwnPropertyDescriptor):
+        * runtime/MathObject.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::getOwnPropertyDescriptor):
+        * runtime/NumberConstructor.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        * runtime/PropertyDescriptor.cpp: Added.
+        (JSC::PropertyDescriptor::writable):
+        (JSC::PropertyDescriptor::enumerable):
+        (JSC::PropertyDescriptor::configurable):
+        (JSC::PropertyDescriptor::hasAccessors):
+        (JSC::PropertyDescriptor::setUndefined):
+        (JSC::PropertyDescriptor::getter):
+        (JSC::PropertyDescriptor::setter):
+        (JSC::PropertyDescriptor::setDescriptor):
+        (JSC::PropertyDescriptor::setAccessorDescriptor):
+        * runtime/PropertyDescriptor.h: Added.
+        (JSC::PropertyDescriptor::PropertyDescriptor):
+        (JSC::PropertyDescriptor::attributes):
+        (JSC::PropertyDescriptor::isValid):
+        (JSC::PropertyDescriptor::value):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getOwnPropertyDescriptor):
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::getOwnPropertyDescriptor):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::getOwnPropertyDescriptor):
+        * runtime/RegExpObject.h:
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertyDescriptor):
+        * runtime/StringObject.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::getOwnPropertyDescriptor):
+        * runtime/StringPrototype.h:
+
+2009-08-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        How many copies of the parameters do you need?
+        https://bugs.webkit.org/show_bug.cgi?id=28701
+
+        The function parameters in JSC get copied a lot - and unnecessarily so.
+
+        Originally this happened due to duplicating FunctionBodyNodes on recompilation,
+        though the problem has been exacerbated by copying the parameters from the
+        original function body onto the executable, then back onto the real body that
+        will be generated (this happens on every function).  And this is all made worse
+        since the data structures in question are a little ugly - C style arrays of C++
+        objects containing ref counts, so they need a full copy-construct (rather than
+        a simple memcpy).
+
+        This can all be greatly simplified by just punting the parameters off into
+        their own ref-counted object, and forgoing all the copying.
+
+        ~no performance change, possible slight progression.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::makeFunction):
+        * parser/Nodes.cpp:
+        (JSC::FunctionParameters::FunctionParameters):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::finishParsing):
+        * parser/Nodes.h:
+        (JSC::FunctionBodyNode::parameters):
+        (JSC::FunctionBodyNode::parameterCount):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::~FunctionExecutable):
+        (JSC::FunctionExecutable::compile):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::FunctionExecutable::fromGlobalCode):
+        (JSC::FunctionExecutable::paramString):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::parameterCount):
+
+2009-08-25  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by NOBODY (Buildfix).
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Add Debug_CFLite target
+          that inherits from the debug_wincairo property sheet and therefore
+          links to the proper debug library.
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj: Add Debug_CFLite target
+          that inherits from the debug_wincairo property sheet and therefore
+          links to the proper debug library.
+
+2009-08-25  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Export tryFastMalloc for Canvas3D work
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        * JavaScriptCore.exp:
+
+2009-08-25  David Levin  <levin@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        PLATFORM(CFNETWORK) should be USE(CFNETWORK).
+        https://bugs.webkit.org/show_bug.cgi?id=28713
+
+        * wtf/Platform.h: Added a #define to catch this issue in the
+        future. The define would generate an error on gcc without the
+        space in the expansion, but Visual C++ needs the space to cause an error.
+
+2009-08-24  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Steve Falkenburg.
+
+        Revise CFLite Debug build to emit DLL's with _debug label.
+        https://bugs.webkit.org/show_bug.cgi?id=28695.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Modify
+          Cairo debug build to inherit from new debug_cairo property sheet.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCFLite.vsprops:
+          Modify to look for debug CFLite when in debug build.
+
+2009-08-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Adler & Darin Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28691
+        Do not retain ScopeNodes outside of parsing
+        
+        There is now no need for these to exist outside of parsing - their use in the runtime is replaced by Executable types.
+
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::makeFunction):
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNodeData::ScopeNodeData):
+        (JSC::ProgramNode::create):
+        (JSC::EvalNode::create):
+        (JSC::FunctionBodyNode::create):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::adoptData):
+        (JSC::FunctionBodyNode::parameterCount):
+        * parser/Parser.cpp:
+        * parser/Parser.h:
+        (JSC::Parser::arena):
+        (JSC::Parser::Parser):
+        (JSC::Parser::parse):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction):
+        (JSC::arrayProtoFuncSort):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::~FunctionExecutable):
+        (JSC::EvalExecutable::compile):
+        (JSC::ProgramExecutable::checkSyntax):
+        (JSC::ProgramExecutable::compile):
+        (JSC::FunctionExecutable::compile):
+        (JSC::EvalExecutable::generateJITCode):
+        (JSC::ProgramExecutable::generateJITCode):
+        (JSC::FunctionExecutable::generateJITCode):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::EvalExecutable::reparseExceptionInfo):
+        (JSC::FunctionExecutable::recompile):
+        (JSC::FunctionExecutable::fromGlobalCode):
+        (JSC::FunctionExecutable::copyParameters):
+        (JSC::FunctionExecutable::paramString):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::ScriptExecutable::sourceID):
+        (JSC::ScriptExecutable::sourceURL):
+        (JSC::ScriptExecutable::lineNo):
+        (JSC::ScriptExecutable::lastLine):
+        (JSC::ScriptExecutable::usesEval):
+        (JSC::ScriptExecutable::usesArguments):
+        (JSC::ScriptExecutable::needsActivation):
+        (JSC::ScriptExecutable::recordParse):
+        (JSC::EvalExecutable::bytecode):
+        (JSC::EvalExecutable::jitCode):
+        (JSC::ProgramExecutable::bytecode):
+        (JSC::ProgramExecutable::reparseExceptionInfo):
+        (JSC::ProgramExecutable::jitCode):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::make):
+        (JSC::FunctionExecutable::bytecode):
+        (JSC::FunctionExecutable::isGenerated):
+        (JSC::FunctionExecutable::name):
+        (JSC::FunctionExecutable::parameterCount):
+        (JSC::FunctionExecutable::jitCode):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::numericCompareFunction):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+
+2009-08-24  Darin Adler  <darin@apple.com>
+
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::put): Landed revised version I had tested but forgot
+        to land. Leave out the branch, since we don't need one.
+
+2009-08-24  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Array index miss case creates a string every time
+        https://bugs.webkit.org/show_bug.cgi?id=28664
+
+        SunSpider test results I saw:
+
+            0.5% faster overall
+            1% faster on crypto-aes
+            20% faster on crypto-md5
+            13% faster on crypto-sha1
+
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype): Initialize m_hasNoPropertiesWithUInt32Names
+        to true.
+        (JSC::ObjectPrototype::put): Clearly m_hasNoPropertiesWithUInt32Names if the new
+        property has a name that is the string form of a UInt32.
+        (JSC::ObjectPrototype::getOwnPropertySlot): Don't call JSObject::getOwnPropertySlot
+        if m_hasNoPropertiesWithUInt32Names is true, and it is highly likely to be true.
+
+        * runtime/ObjectPrototype.h: Added declarations for the above.
+
+2009-08-24  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Fix a typo in my distcheck build fix.
+
+        * GNUmakefile.am:
+
+2009-08-23  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed build fix for make distcheck.
+
+        * GNUmakefile.am: Added files required for the build.
+
+2009-08-22  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        REGRESSION(r47639-r47660): Webkit crashes on launch on PowerPC
+        https://bugs.webkit.org/show_bug.cgi?id=28655
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction): Initialize properly with a VPtrHackExecutable.
+        * wtf/Platform.h:
+
+2009-08-22  Darin Adler  <darin@apple.com>
+
+        Fix storage leak from syntax tree arena allocation patch.
+
+        * parser/Nodes.h: CommaNode needs to inherit from ParserArenaDeletable
+        because it has a vector.
+
+2009-08-21  Darin Adler  <darin@apple.com>
+
+        Fix Qt build.
+
+        * parser/Nodes.cpp:
+        (JSC::ScopeNodeData::ScopeNodeData): Made non-inline again.
+        This is used outside Nodes.cpp so can't be inline unless
+        it is in the header.
+
+2009-08-21  Darin Adler  <darin@apple.com>
+
+        Two loose ends from the last commit.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Made ParserArena.h
+        and create_hash_table project-internal instead of "private".
+        * runtime/Executable.h: Removed accidentally-added constructor.
+
+2009-08-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Syntax tree nodes should use arena allocation
+        https://bugs.webkit.org/show_bug.cgi?id=25674
+
+        Use an actual arena now. 0.6% speedup on SunSpider.
+
+        New and improved with 100% less leaking of the universe.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        Removed all exports involving the class FunctionBodyNode, which no
+        longer needs to be used outside JavaScriptCore.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Made Nodes.h and
+        Executable.h project-internal instead of "private".
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Updated since VarStack
+        contains const Identifier* now.
+
+        * parser/Grammar.y: Made identifiers from the lexer be const
+        Identifier* and updated since VarStack contains const Identifier* now.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::setCode): Pass in ParserArena, used for identifiers.
+        (JSC::Lexer::makeIdentifier): Changed return type to const Identifier*
+        and changed to call ParserArena.
+        (JSC::Lexer::clear): Removed the code to manage m_identifiers and
+        added code to set m_arena to 0.
+        * parser/Lexer.h: Updated for changes above.
+
+        * parser/NodeConstructors.h:
+        (JSC::ParserArenaFreeable::operator new): Added. Calls allocateFreeable
+        on the arena.
+        (JSC::ParserArenaDeletable::operator new): Changed to call the
+        allocateDeletable function on the arena instead of deleteWithArena.
+        (JSC::PropertyNode::PropertyNode): Added new constructor that makes
+        numeric identifiers. Some day we might want to optimize this for
+        integers so it doesn't create a string for each one.
+        (JSC::ContinueNode::ContinueNode): Initialize m_ident to nullIdentifier
+        since it's now a const Identifier& so it can't be left uninitialized.
+        (JSC::BreakNode::BreakNode): Ditto.
+        (JSC::CaseClauseNode::CaseClauseNode): Updated to use SourceElements*
+        to keep track of the statements rather than a separate statement vector.
+        (JSC::BlockNode::BlockNode): Ditto.
+        (JSC::ForInNode::ForInNode): Initialize m_ident to nullIdentifier.
+
+        * parser/Nodes.cpp: Moved the comment explaining emitBytecode in here.
+        It seemed strangely out of place in the header.
+        (JSC::ThrowableExpressionData::emitThrowError): Added an overload for
+        UString as well as Identifier.
+        (JSC::SourceElements::singleStatement): Added.
+        (JSC::SourceElements::lastStatement): Added.
+        (JSC::RegExpNode::emitBytecode): Changed the throwError code to use
+        the substitution mechanism instead of doing a string append.
+        (JSC::SourceElements::emitBytecode): Added. Replaces the old
+        statementListEmitCode function, since we now keep the SourceElements
+        objects around.
+        (JSC::BlockNode::lastStatement): Added.
+        (JSC::BlockNode::emitBytecode): Changed to use emitBytecode instead of
+        statementListEmitCode.
+        (JSC::CaseClauseNode::emitBytecode): Added.
+        (JSC::CaseBlockNode::emitBytecodeForBlock): Changed to use emitBytecode
+        instead of statementListEmitCode.
+        (JSC::ScopeNodeData::ScopeNodeData): Changed to store the
+        SourceElements* instead of using releaseContentsIntoVector.
+        (JSC::ScopeNode::emitStatementsBytecode): Added.
+        (JSC::ScopeNode::singleStatement): Added.
+        (JSC::ProgramNode::emitBytecode): Call emitStatementsBytecode instead
+        of statementListEmitCode.
+        (JSC::EvalNode::emitBytecode): Ditto.
+        (JSC::FunctionBodyNode::emitBytecode): Call emitStatementsBytecode
+        insetad of statementListEmitCode and check for the return node using
+        the new functions.
+
+        * parser/Nodes.h: Changed VarStack to store const Identifier* instead
+        of Identifier and rely on the arena to control lifetime. Added a new
+        ParserArenaFreeable class. Made ParserArenaDeletable inherit from
+        FastAllocBase instead of having its own operator new. Base the Node
+        class on ParserArenaFreeable. Changed the various Node classes
+        to use const Identifier& instead of Identifier to avoid the need to
+        call their destructors and allow them to function as "freeable" in the
+        arena. Removed extraneous JSC_FAST_CALL on definitions of inline functions.
+        Changed ElementNode, PropertyNode, ArgumentsNode, ParameterNode,
+        CaseClauseNode, ClauseListNode, and CaseBlockNode to use ParserArenaFreeable
+        as a base class since they do not descend from Node. Eliminated the
+        StatementVector type and instead have various classes use SourceElements*
+        instead of StatementVector. This prevents those classes from having to
+        use ParserArenaDeletable to make sure the vector destructor is called.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::parse): Pass the arena to the lexer.
+
+        * parser/Parser.h: Added an include of ParserArena.h, which is no longer
+        included by Nodes.h.
+        (JSC::Parser::parseFunctionFromGlobalCode): Changed to use the
+        singleStatement function, since there is no longer any children function.
+        Removed some unneeded use of RefPtr.
+
+        * parser/ParserArena.cpp:
+        (JSC::ParserArena::ParserArena): Added. Initializes the new members,
+        m_freeableMemory, m_freeablePoolEnd, and m_identifiers.
+        (JSC::ParserArena::freeablePool): Added. Computes the pool pointer,
+        since we store only the current pointer and the end of pool pointer.
+        (JSC::ParserArena::deallocateObjects): Added. Contains the common
+        memory-deallocation logic used by both the destructor and the
+        reset function.
+        (JSC::ParserArena::~ParserArena): Changed to call deallocateObjects.
+        (JSC::ParserArena::reset): Ditto. Also added code to zero out the
+        new structures, and switched to use clear() instead of shrink(0) since
+        we don't really reuse arenas.
+        (JSC::ParserArena::makeNumericIdentifier): Added.
+        (JSC::ParserArena::allocateFreeablePool): Added. Used when the pool
+        is empty.
+        (JSC::ParserArena::isEmpty): Added. No longer inline, which is fine
+        since this is used only for assertions at the moment.
+        (JSC::ParserArena::derefWithArena): Make non-inline.
+
+        * parser/ParserArena.h: Added an actual arena of "freeable" objects,
+        ones that don't need destructors to be called. Also added a separate
+        IdentifierArena object, a segmented vector of identifiers that used
+        to be in the Lexer.
+
+        * runtime/Executable.h: Moved the definition of the
+        FunctionExecutable::make function here. It can't go in JSFunction.h
+        since that header has to be used outside JavaScriptCore and so can't
+        include this, which includes Nodes.h. The function could be moved
+        elswhere if we don't want to include JSFunction.h in this header, but
+        for now this seems to be the best place.
+
+        * runtime/JSFunction.h: Removed the include of Executable.h and
+        definition of the FunctionExecutable::make function.
+
+        * wtf/FastMalloc.cpp: Fixed an incorrect comment.
+
+2009-08-21  Mark Rowe  <mrowe@apple.com>
+
+        Fix the non-JIT build.
+
+        * runtime/Executable.cpp:
+        * runtime/Executable.h:
+
+2009-08-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Speculative QuickTime build fix.
+
+        * runtime/JSArray.cpp:
+
+2009-08-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Speculative QT build fix.
+
+        * runtime/StringPrototype.cpp:
+
+2009-08-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Restructure Executable types so that host functions do not hold a FunctionExecutable.
+        https://bugs.webkit.org/show_bug.cgi?id=28621
+
+        All JSFunction objects have a pointer to an Executable*.  This is currently always a
+        FunctionExecutable, however this has a couple of drawbacks.  Host functions do not
+        store a range of information that the FunctionExecutable provides (source, name,
+        CodeBlock & information presently held on the FunctionBodyNode). 
+
+        [ * nearly all... see below! ]
+
+        Instead, make JSFunctions hold a pointer to an ExecutableBase, move fields specific
+        to JS sourced executable types (source, node) into a new subclass (ScriptExecutable),
+        and create a new NativeExecutable type.  We now provide a new method in JSFunction
+        to access & downcast to FunctionExecutable, but in doing so we can make an early
+        check (with an ASSERT) to ensure that the Executable read from a function will only
+        be treated as a FunctionExecutable (and thus the JS sepcific fields will only be
+        accessed) if the JSFunction is not a host function.
+
+        There is one JSFunction that currently does not have an Executable, which is the
+        object created to allow us to read out the vtable pointer.  By making this change
+        we can also add a new Executable type fror this object (VPtrHackExecutable).
+        Since this means that really all JSFunctions have an Executable we no longer have
+        to null-check m_executable before us it - particularly in isHostFunction().
+
+        This patch removes CacheableEvalExecutable, since all subclasses of ExecutableBase
+        can now be ref-counted - since both JSFunction holds (and ref-counts) an ExecutableBase
+        that might be a FunctionExecutable or a NativeExecutable.  This does now mean that all
+        ProgramExecutables and EvalExecutables (unnecessarily) provide an interface to be
+        ref-counted, however this seems less-bad than host functions unnecessarily providing
+        interface to access non-host specific information.
+
+        The class hierarcy has changed from this:
+        
+        - ExecutableBase
+            - ProgramExecutable
+            - EvalExecutable
+                - CacheableEvalExecutable (also RefCounted by multiple-inheritance)
+            - FunctionExecutable (also RefCounted by multiple-inheritance, 'special' FunctionExecutable also used for host functions)
+
+        To this:
+        
+        - RefCounted
+            - ExecutableBase
+                - NativeExecutable
+                - VPtrHackExecutable
+                - ScriptExecutable
+                    - ProgramExecutable
+                    - EvalExecutable
+                    - FunctionExecutable
+
+        This patch speeds up sunspidey by a couple of ms (presumably due to the changes to isHostFunction()).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::ownerExecutable):
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * profiler/Profiler.cpp:
+        (JSC::createCallIdentifierFromFunctionImp):
+        * runtime/Arguments.h:
+        (JSC::Arguments::getArgumentsData):
+        (JSC::Arguments::Arguments):
+        * runtime/Executable.cpp:
+        (JSC::NativeExecutable::~NativeExecutable):
+        (JSC::VPtrHackExecutable::~VPtrHackExecutable):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::ExecutableBase):
+        (JSC::ExecutableBase::~ExecutableBase):
+        (JSC::ExecutableBase::isHostFunction):
+        (JSC::NativeExecutable::NativeExecutable):
+        (JSC::VPtrHackExecutable::VPtrHackExecutable):
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::ScriptExecutable::source):
+        (JSC::ScriptExecutable::sourceID):
+        (JSC::ScriptExecutable::sourceURL):
+        (JSC::ScriptExecutable::lineNo):
+        (JSC::ScriptExecutable::lastLine):
+        (JSC::ScriptExecutable::usesEval):
+        (JSC::ScriptExecutable::usesArguments):
+        (JSC::ScriptExecutable::needsActivation):
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::EvalExecutable::create):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::~JSFunction):
+        (JSC::JSFunction::markChildren):
+        (JSC::JSFunction::getCallData):
+        (JSC::JSFunction::call):
+        (JSC::JSFunction::lengthGetter):
+        (JSC::JSFunction::getConstructData):
+        (JSC::JSFunction::construct):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::executable):
+        (JSC::JSFunction::jsExecutable):
+        (JSC::JSFunction::isHostFunction):
+
+2009-08-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Browser hangs on opening Web Inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=28438
+
+        Code generation needs to be able to walk the entire scopechain in some
+        cases, however the symbol table used by activations was a member of the
+        codeblock.  Following recompilation this may no longer exist, leading
+        to a crash or hang on lookup.
+
+        We fix this by introducing a refcounted SymbolTable subclass, SharedSymbolTable,
+        for the CodeBlocks used by function code.  This allows activations to
+        maintain ownership of a copy of the symbol table even after recompilation so
+        they can continue to work.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::symbolTable):
+        (JSC::CodeBlock::sharedSymbolTable):
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        (JSC::FunctionCodeBlock::FunctionCodeBlock):
+        (JSC::FunctionCodeBlock::~FunctionCodeBlock):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::retrieveArguments):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::generateBytecode):
+        (JSC::FunctionExecutable::generateBytecode):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::EvalExecutable::reparseExceptionInfo):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::JSActivationData::JSActivationData):
+        (JSC::JSActivation::JSActivationData::~JSActivationData):
+        * runtime/SymbolTable.h:
+
+2009-08-20  Xan Lopez  <xlopez@igalia.com>
+
+        Add new file to GTK+ build.
+
+        * GNUmakefile.am:
+
+2009-08-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Added a number => string cache.
+        
+        1.07x faster on v8 (1.7x faster on v8-splay).
+        1.004x faster on SunSpider.
+
+        * runtime/JSCell.h: Moved JSValue::toString to JSString.h.
+        * runtime/JSGlobalData.h: Holds the cache.
+        * runtime/JSNumberCell.cpp:
+        (JSC::JSNumberCell::toString):
+        (JSC::JSNumberCell::toThisString): Removed -0 special case.
+        UString handles this now, since too many clients were
+        special-casing it.
+
+        * runtime/JSString.h:
+        (JSC::JSValue::toString): Use the cache when converting
+        an int or double to string.
+
+        * runtime/Operations.h:
+        (JSC::concatenateStrings): Call toString to take advantage
+        of the cache.
+
+        * runtime/SmallStrings.h:
+        (JSC::NumericStrings::add):
+        (JSC::NumericStrings::lookup): The cache.
+
+        * runtime/UString.cpp:
+        (JSC::UString::from): Added -0 special case mentioned above.
+        Removed appendNumeric because it's mutually exclusive with the
+        cache.
+
+2009-08-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION: fast/profiler/call.html is crashing occasionally
+        https://bugs.webkit.org/show_bug.cgi?id=28476
+
+        Using the codeblock for information about how many parameters and
+        locals a function has is unsafe in certain circumstances.  The
+        basic scenario is all function code being cleared in response to
+        the debugger or profiler being enabled, and then an activation is
+        marked before its associated function is re-executed.
+
+        To deal with this scenario we store the variable count of a function
+        directly in the FunctionExecutable, and then use that information.
+
+        * runtime/Arguments.h:
+        (JSC::Arguments::getArgumentsData):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::generateBytecode):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::variableCount):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::markChildren):
+
+2009-08-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Numbering of arguments to emitGetJITStubArg/emitPutJITStubArg incorrect
+        <bug lost in the great bug disasteroony of 08/20/09!>
+
+        The argumentNumber argument to emitGetJITStubArg/emitPutJITStubArg should match
+        the argument number used within the stub functions in JITStubs.cpp, but it doesn't.
+
+        Firstly, all the numbers changed when we added a void* 'reserved' as the first slot
+        (rather than leaving argument 0 unused), and secondly in 32_64 builds the index to
+        peek/poke needs to be multiplies by 2 (since the argument to peek/poke is a number
+        of machine words, and on 32_64 build the argument slots to stub functions are two
+        words wide).
+
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpConstructSetupArgs):
+        (JSC::JIT::compileOpCallVarargsSetupArgs):
+        (JSC::JIT::compileOpCall):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutJITStubArg):
+        (JSC::JIT::emitPutJITStubArgConstant):
+        (JSC::JIT::emitGetJITStubArg):
+        (JSC::JIT::emitPutJITStubArgFromVirtualRegister):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+
+2009-08-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        REGRESSION: significant slowdown on Celtic Kane "AJAX declaration" subtest
+        https://bugs.webkit.org/show_bug.cgi?id=28332
+
+        Follow up style fixes that were missed in review.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::hasTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::get):
+        (JSC::StructureTransitionTable::contains):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTable::add):
+
+2009-08-20  Oliver Hunt  <oliver@apple.com>
+
+        Add new exports to windows jsc build
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION: significant slowdown on Celtic Kane "AJAX declaration" subtest
+        https://bugs.webkit.org/show_bug.cgi?id=28332
+
+        The method check optimisation made transitions aware of the value being
+        assigned when a transition was assigning a function.  This had the side
+        effect of making every assignment of a function expression result in a
+        new transition, and thus a new Structure.  The net result of this is that
+        the common JS idiom of
+
+            function MyObject() {
+                this.myFunction = function(...){...};
+            }
+            new MyObject();
+
+        Will produce a unique structure on every iteration, meaning that all
+        caching is defeated and there is a significant amount of structure churn.
+
+        The fix is to return the transition to its original form where it is
+        keyed off a property name + attributes tuple, but have each transition
+        support an optional transition on a specific value.
+
+        * JavaScriptCore.exp:
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::hasTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::transitionedFor):
+        (JSC::Structure::hasTransition):
+        (JSC::Structure::):
+        (JSC::StructureTransitionTable::contains):
+        (JSC::StructureTransitionTable::get):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTableHashTraits::emptyValue):
+        (JSC::StructureTransitionTable::hasTransition):
+        (JSC::StructureTransitionTable::remove):
+        (JSC::StructureTransitionTable::add):
+
+2009-08-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Remove FunctionCodeBlock.
+        https://bugs.webkit.org/show_bug.cgi?id=28502
+
+        These only exist to allow JIT code to dereference properties off the
+        CodeBlock for any callee, regardless of whether it is a host function.
+
+        Instead just use the FunctionExecutable.  Copy the m_parameters field
+        from the CodeBlock into the Executable, and use this to distinguish
+        between host functions, functions that have been bytecompiled, and
+        functions that have not.
+
+        m_parameters is moved to ExecutableBase rather than FunctionExecutable
+        so that (as a separate change) we can move make a separate class of
+        executable for host code, which is not devived from FunctionExecutable
+        (host code does not feature any of the properties that normal executable
+        do and will provide, such as source, attributes, and a parsed name).
+
+        1% win on v8 tests, 0.5% on sunspider.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        (JSC::CodeBlock::handlerForBytecodeOffset):
+        (JSC::CodeBlock::lineNumberForBytecodeOffset):
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
+        (JSC::CodeBlock::getByIdExceptionInfoForBytecodeOffset):
+        (JSC::CodeBlock::functionRegisterForBytecodeOffset):
+        (JSC::CodeBlock::hasGlobalResolveInstructionAtBytecodeOffset):
+        (JSC::CodeBlock::hasGlobalResolveInfoAtBytecodeOffset):
+        * bytecode/CodeBlock.h:
+        (JSC::):
+        (JSC::CodeBlock::source):
+        (JSC::CodeBlock::sourceOffset):
+        (JSC::CodeBlock::evalCodeCache):
+        (JSC::CodeBlock::createRareDataIfNecessary):
+        
+            remove NativeCodeBlocks and the NativeCode code type.
+        
+        * jit/JIT.cpp:
+        (JSC::JIT::linkCall):
+
+            Revert to previous behaviour (as currently still commented!) that Hhost functions have a null codeblock.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpCallVarargsSetupArgs):
+        (JSC::JIT::compileOpConstructSetupArgs):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+
+            Bring the 32_64 & non-32_64 JITs into line with each other, callee in regT0.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+
+            Rewrite call trampolines to not use the CodeBlock.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+            Make call_JSFunction & call_arityCheck return the callee, don't expect to be passed the CodeBlock.
+
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::generateBytecode):
+        (JSC::FunctionExecutable::recompile):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::):
+        (JSC::ExecutableBase::ExecutableBase):
+        (JSC::FunctionExecutable::isHostFunction):
+
+            Add m_numParameters.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::~JSFunction):
+
+            Only call generatedBytecode() on JSFunctions non-host FunctionExecutables.
+
+2009-08-20  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28054
+       
+        Use a helper function to work around winscw compiler forward declaration bug
+        regarding templated classes.
+
+        Add parenthesis around (PassRefPtr::*UnspecifiedBoolType) to make winscw compiler
+        work with the default UnSpecifiedBoolType() operator, which removes the winscw
+        specific bool cast hack.
+
+        * wtf/PassRefPtr.h:
+        (WTF::derefIfNotNull):
+        (WTF::PassRefPtr::~PassRefPtr):
+
+2009-08-19  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Change namespace ARM to ARMRegisters
+        X86 to X86Registers to avoid conflict with macros
+        https://bugs.webkit.org/show_bug.cgi?id=28428
+
+        * assembler/ARMAssembler.cpp:
+        * assembler/ARMAssembler.h:
+        * assembler/ARMv7Assembler.h:
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerARMv7.h:
+        * assembler/MacroAssemblerX86Common.h:
+        * assembler/MacroAssemblerX86_64.h:
+        * assembler/X86Assembler.h:
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        * jit/JITInlineMethods.h:
+        * jit/JITOpcodes.cpp:
+        * wrec/WRECGenerator.cpp:
+        * wrec/WRECGenerator.h:
+        * yarr/RegexJIT.cpp:
+
+2009-08-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Devirtualise marking
+        https://bugs.webkit.org/show_bug.cgi?id=28294
+
+        We actually need to mark the value in a number object if we're using the
+        32bit number representation.
+
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+
+2009-08-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+         We probably shouldn't be keeping the AST for eval nodes around forevar.
+        https://bugs.webkit.org/show_bug.cgi?id=28469
+
+        EvalNodes don't destroyData() (delete their parser data) since they need to hold onto
+        their varStack.  Copy a list of variable onto EvalCodeBlock, and this can go away.
+
+        * bytecode/CodeBlock.h:
+        (JSC::EvalCodeBlock::variable):
+        (JSC::EvalCodeBlock::numVariables):
+        (JSC::EvalCodeBlock::adoptVariables):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * parser/Nodes.h:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::generateBytecode):
+        * runtime/Executable.h:
+
+2009-08-19  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        http://bugs.webkit.org/show_bug.cgi?id=28441
+
+        Fix a build issue with ICU 4.2 or later on Windows with Visual C++. 
+        Instead of defining all isXXX and toupper/tolower as 
+          WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h,
+        #define them to be different by prepending 'WTF_...ASCIIType_h' with
+        the originial names like 'toupper_WTF_...ASCIIType_h'. 
+
+        * wtf/DisallowCType.h:
+
+2009-08-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Assigning a function to an object should always use the existing transition, even if the transition is not specialized
+        https://bugs.webkit.org/show_bug.cgi?id=28442
+
+        Check for an unspecialized transition as an alternative to always failing if specialisation does not match.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+
+2009-08-18  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Added additional getter to ByteArray with an unsigned char as return.
+        ByteArray can take unsigned char directly now.
+
+        * wtf/ByteArray.h:
+        (WTF::ByteArray::set):
+        (WTF::ByteArray::get):
+
+2009-08-18  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28415
+        Set svn:eol-style CRLF on all .sln and .vcproj files that don't already
+        have it.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+        
+2009-08-18  Xan Lopez  <xlopez@igalia.com>
+
+        Try to fix the GTK+ build.
+
+        * GNUmakefile.am:
+
+2009-08-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        No, silly runtime, AST nodes are not for you.
+
+        We still use AST nodes (ScopeNodes, particularly FunctionBodyNodes) within
+        the runtime, which means that these nodes must be persisted outside of the
+        arena, contain both parser & runtime data, etc.  This is all a bit of a mess.
+
+        Move functionality into a new FunctionExecutable class.
+
+        * API/JSCallbackFunction.cpp:
+        * API/JSObjectRef.cpp:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::markAggregate):
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        (JSC::CodeBlock::lineNumberForBytecodeOffset):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getBytecodeIndex):
+        (JSC::CodeBlock::discardBytecode):
+        (JSC::CodeBlock::instructionCount):
+        (JSC::CodeBlock::getJITCode):
+        (JSC::CodeBlock::executablePool):
+        (JSC::CodeBlock::ownerExecutable):
+        (JSC::CodeBlock::extractExceptionInfo):
+        (JSC::CodeBlock::addFunctionDecl):
+        (JSC::CodeBlock::functionDecl):
+        (JSC::CodeBlock::numberOfFunctionDecls):
+        (JSC::CodeBlock::addFunctionExpr):
+        (JSC::CodeBlock::functionExpr):
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        (JSC::ProgramCodeBlock::ProgramCodeBlock):
+        (JSC::EvalCodeBlock::EvalCodeBlock):
+        (JSC::FunctionCodeBlock::FunctionCodeBlock):
+        (JSC::NativeCodeBlock::NativeCodeBlock):
+        * bytecode/EvalCodeCache.h:
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::doRun):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        * bytecompiler/BytecodeGenerator.h:
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/CallFrameClosure.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::debug):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveLastCaller):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::compile):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::emit_op_new_func):
+        (JSC::JIT::emit_op_new_func_exp):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::):
+        * parser/Nodes.cpp:
+        (JSC::FunctionBodyNode::reparseDataIfNecessary):
+        * parser/Nodes.h:
+        (JSC::EvalNode::partialDestroyData):
+        * parser/Parser.h:
+        * profiler/ProfileGenerator.cpp:
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::createCallIdentifier):
+        (JSC::createCallIdentifierFromFunctionImp):
+        * runtime/Arguments.h:
+        (JSC::Arguments::getArgumentsData):
+        (JSC::Arguments::Arguments):
+        (JSC::JSActivation::copyRegisters):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction):
+        * runtime/CallData.h:
+        (JSC::):
+        * runtime/Collector.cpp:
+        (JSC::Heap::collect):
+        * runtime/ConstructData.h:
+        (JSC::):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createUndefinedVariableError):
+        (JSC::createInvalidParamError):
+        (JSC::createNotAConstructorError):
+        (JSC::createNotAFunctionError):
+        (JSC::createNotAnObjectError):
+        * runtime/Executable.cpp: Added.
+        (JSC::EvalExecutable::generateBytecode):
+        (JSC::ProgramExecutable::generateBytecode):
+        (JSC::FunctionExecutable::generateBytecode):
+        (JSC::EvalExecutable::generateJITCode):
+        (JSC::ProgramExecutable::generateJITCode):
+        (JSC::FunctionExecutable::generateJITCode):
+        (JSC::FunctionExecutable::isHostFunction):
+        (JSC::FunctionExecutable::markAggregate):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::EvalExecutable::reparseExceptionInfo):
+        (JSC::FunctionExecutable::recompile):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::~ExecutableBase):
+        (JSC::ExecutableBase::ExecutableBase):
+        (JSC::ExecutableBase::source):
+        (JSC::ExecutableBase::sourceID):
+        (JSC::ExecutableBase::lastLine):
+        (JSC::ExecutableBase::usesEval):
+        (JSC::ExecutableBase::usesArguments):
+        (JSC::ExecutableBase::needsActivation):
+        (JSC::ExecutableBase::astNode):
+        (JSC::ExecutableBase::generatedJITCode):
+        (JSC::ExecutableBase::getExecutablePool):
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::EvalExecutable::bytecode):
+        (JSC::EvalExecutable::varStack):
+        (JSC::EvalExecutable::evalNode):
+        (JSC::EvalExecutable::jitCode):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::ProgramExecutable::reparseExceptionInfo):
+        (JSC::ProgramExecutable::bytecode):
+        (JSC::ProgramExecutable::programNode):
+        (JSC::ProgramExecutable::jitCode):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::name):
+        (JSC::FunctionExecutable::bytecode):
+        (JSC::FunctionExecutable::generatedBytecode):
+        (JSC::FunctionExecutable::usesEval):
+        (JSC::FunctionExecutable::usesArguments):
+        (JSC::FunctionExecutable::parameterCount):
+        (JSC::FunctionExecutable::paramString):
+        (JSC::FunctionExecutable::isGenerated):
+        (JSC::FunctionExecutable::body):
+        (JSC::FunctionExecutable::jitCode):
+        (JSC::FunctionExecutable::createNativeThunk):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        (JSC::JSActivation::markChildren):
+        (JSC::JSActivation::isDynamicScope):
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::JSActivationData::JSActivationData):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::isHostFunction):
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::~JSFunction):
+        (JSC::JSFunction::markChildren):
+        (JSC::JSFunction::getCallData):
+        (JSC::JSFunction::call):
+        (JSC::JSFunction::lengthGetter):
+        (JSC::JSFunction::getConstructData):
+        (JSC::JSFunction::construct):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::executable):
+        (JSC::FunctionExecutable::make):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::numericCompareFunction):
+        * runtime/JSGlobalData.h:
+
+2009-08-17  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix 300,000+ leaks seen during the regression tests.
+
+        EvalCodeCache::get was heap-allocating an EvalExecutable instance without adopting the initial reference.
+        While fixing this we noticed that EvalExecutable was a RefCounted type that was sometimes stack allocated.
+        To make this cleaner and to prevent clients from attempting to ref a stack-allocated instance, we move the
+        refcounting down to a new CacheableEvalExecutable class that derives from EvalExecutable. EvalCodeCache::get
+        now uses CacheableEvalExecutable::create and avoids the leak.
+
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        * runtime/Executable.h:
+        (JSC::CacheableEvalExecutable::create):
+        (JSC::CacheableEvalExecutable::CacheableEvalExecutable):
+
+2009-08-17  Oliver Hunt  <oliver@apple.com>
+
+        RS=Mark Rowe.
+
+        REGRESSION (r47292): Prototype.js is broken by ES5 Arguments changes
+        https://bugs.webkit.org/show_bug.cgi?id=28341
+        <rdar://problem/7145615>
+
+        Reverting r47292.  Alas Prototype.js breaks with Arguments inheriting
+        from Array as ES5 attempted.  Prototype.js defines $A in terms of a 
+        function it places on (among other global objects) the Array prototype,
+        thus breaking $A for arrays.
+
+        * runtime/Arguments.h:
+        (JSC::Arguments::Arguments):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        * runtime/ObjectPrototype.h:
+        * tests/mozilla/ecma_3/Function/arguments-001.js:
+
+2009-08-17  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Steve Falkenburg.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27323
+        Only add Cygwin to the path when it isn't already there.  This avoids
+        causing problems for people who purposefully have non-Cygwin versions of
+        executables like svn in front of the Cygwin ones in their paths.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
+
+2009-08-17  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Mark Rowe.
+
+        Fix build with FAST_MALLOC_MATCH_VALIDATION enabled.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMalloc):
+        (WTF::fastCalloc):
+        (WTF::fastRealloc):
+
+2009-08-16  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix crash on ./ecma_2/RegExp/exec-002.js.
+        https://bugs.webkit.org/show_bug.cgi?id=28353
+
+        Change the order of freeParenthesesDisjunctionContext and
+        popParenthesesDisjunctionContext on all call sites as the pop
+        method is accessing backTrack->lastContext which is the context
+        that is about to be freed.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::parenthesesDoBacktrack):
+        (JSC::Yarr::Interpreter::backtrackParentheses):
+
+2009-08-16  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28352
+
+        Fix coding style violations. Use m_ for C++ class members. Remove
+        trailing whitespace on empty lines.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::ParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::tryConsumeCharacter):
+        (JSC::Yarr::Interpreter::tryConsumeBackReference):
+        (JSC::Yarr::Interpreter::parenthesesDoBacktrack):
+        (JSC::Yarr::Interpreter::backtrackParentheses):
+        (JSC::Yarr::ByteCompiler::ByteCompiler):
+        (JSC::Yarr::ByteCompiler::compile):
+        (JSC::Yarr::ByteCompiler::checkInput):
+        (JSC::Yarr::ByteCompiler::assertionBOL):
+        (JSC::Yarr::ByteCompiler::assertionEOL):
+        (JSC::Yarr::ByteCompiler::assertionWordBoundary):
+        (JSC::Yarr::ByteCompiler::atomPatternCharacter):
+        (JSC::Yarr::ByteCompiler::atomCharacterClass):
+        (JSC::Yarr::ByteCompiler::atomBackReference):
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionBegin):
+        (JSC::Yarr::ByteCompiler::popParenthesesStack):
+        (JSC::Yarr::ByteCompiler::closeAlternative):
+        (JSC::Yarr::ByteCompiler::closeBodyAlternative):
+        (JSC::Yarr::ByteCompiler::atomParenthesesEnd):
+        (JSC::Yarr::ByteCompiler::regexBegin):
+        (JSC::Yarr::ByteCompiler::alterantiveBodyDisjunction):
+        (JSC::Yarr::ByteCompiler::alterantiveDisjunction):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+
+2009-08-15  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build with JIT disabled.
+
+        * runtime/Arguments.h: Only compile the jitCode method when the JIT is enabled.
+        * runtime/Executable.h: Include PrototypeFunction.h so the compiler knows what
+        NativeFunctionWrapper is when the JIT is disabled.
+
+2009-08-15  Adam Bergkvist  <adam.bergkvist@ericsson.com>
+
+        Reviewed by Sam Weinig.
+
+        Added ENABLE_EVENTSOURCE flag.
+        https://bugs.webkit.org/show_bug.cgi?id=14997
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-08-14  Gavin Barraclough  <barraclough@apple.com>
+
+        * parser/Parser.h:
+        (JSC::EvalExecutable::parse):
+        (JSC::ProgramExecutable::parse):
+        * runtime/Executable.h:
+
+2009-08-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Remove AST nodes from use within the Runtime (outside of parsing), stage 1
+        https://bugs.webkit.org/show_bug.cgi?id=28330
+
+        Remove the EvalNode and ProgramNode from use in the runtime.  They still exist
+        after this patch, but are hidden behind EvalExecutable and FunctionExecutable,
+        and are also still reachable behind CodeBlock::m_ownerNode.
+
+        The next step will be to beat back FunctionBodyNode in the same fashion.
+        Then remove the usage via CodeBlock, then only construct these nodes only on
+        demand during bytecode generation.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.h:
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        (JSC::GlobalCodeBlock::~GlobalCodeBlock):
+        (JSC::ProgramCodeBlock::ProgramCodeBlock):
+        (JSC::EvalCodeBlock::EvalCodeBlock):
+        (JSC::FunctionCodeBlock::FunctionCodeBlock):
+        (JSC::NativeCodeBlock::NativeCodeBlock):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::execute):
+        * interpreter/Interpreter.h:
+        * parser/Nodes.cpp:
+        (JSC::FunctionBodyNode::createNativeThunk):
+        (JSC::FunctionBodyNode::generateBytecode):
+        (JSC::FunctionBodyNode::bytecodeForExceptionInfoReparse):
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+        (JSC::Parser::reparse):
+        (JSC::Parser::parseFunctionFromGlobalCode):
+        (JSC::::parse):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/Error.cpp:
+        (JSC::throwError):
+        * runtime/Error.h:
+        * runtime/Executable.h: Added.
+        (JSC::TemplateExecutable::TemplateExecutable):
+        (JSC::TemplateExecutable::markAggregate):
+        (JSC::TemplateExecutable::sourceURL):
+        (JSC::TemplateExecutable::lineNo):
+        (JSC::TemplateExecutable::bytecode):
+        (JSC::TemplateExecutable::jitCode):
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/FunctionConstructor.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::numericCompareFunction):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::codeBlocks):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+
+2009-08-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Rename the confusing isObject(<class>) to inherits(<class>).
+        It still works on non-objects, returning false.
+
+        * runtime/ArrayConstructor.cpp:
+        (JSC::arrayConstructorIsArray): Removed unneeded isObject call
+        and updated remaining isObject call to new name, inherits.
+
+        * runtime/JSCell.h: Renamed isObject(<class>) to inherits(<class>)
+        but more importantly, made it non-virtual (it was already inline)
+        so it is now as fast as JSObject::inherits was.
+
+        * runtime/JSObject.h: Removed inherits function since the one
+        in the base class is fine as-is. Also made various JSCell functions
+        that should not be called on JSObject uncallable by making them
+        both private and not implemented.
+        (JSC::JSCell::inherits): Updated name.
+        (JSC::JSValue::inherits): Ditto.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncConcat):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString):
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSValue.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChain::localDepth):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncToString):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSplit):
+        Updated to new name, inherits, from old name, isObject.
+
+2009-07-31  Harald Fernengel  <harald.fernengel@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Adding QNX as a platform. Currently only tested with Qt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27885
+
+        * JavaScriptCore/runtime/Collector.cpp: Added retrieving of stack base
+          since QNX doesn't have the pthread _nt functions
+        * JavaScriptCore/wtf/Platform.h: Added WTF_PLATFORM_QNX and corresponding
+          defines
+        * WebCore/bridge/npapi.h: Build fix for missing typedefs on QNX
+
+2009-08-14  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        Currently generic ARM and ARMv7 platforms work only with JSVALUE32
+        https://bugs.webkit.org/show_bug.cgi?id=28300
+
+        * wtf/Platform.h:
+
+2009-08-14  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        Enable JIT on ARM for QT by default
+        https://bugs.webkit.org/show_bug.cgi?id=28259
+
+        * wtf/Platform.h:
+
+2009-08-14  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        Enable YARR_JIT on ARM for QT by default
+        https://bugs.webkit.org/show_bug.cgi?id=28259
+
+        * wtf/Platform.h:
+
+2009-08-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [ES5] Arguments object should inherit from Array
+        https://bugs.webkit.org/show_bug.cgi?id=28298
+
+        Make the Arguments object conform to the behaviour specified in ES5.
+        The simple portion of this is to make Arguments use Array.prototype
+        as its prototype rather than Object.prototype.
+
+        The spec then requires us to set instance.constructor to the pristine
+        Object constructor, and instance.toString and instance.toLocaleString
+        to the pristine versions from Object.prototype.  To do this we now 
+        make the ObjectPrototype constructor return its toString and
+        toLocaleString functions (similar to the call and apply functions
+        from FunctionPrototype).
+
+        Oddly enough this reports itself as a slight win, but given the code
+        isn't hit in the tests that claim to have improved I put this down to
+        code motion.
+
+        * runtime/Arguments.h:
+        (JSC::Arguments::Arguments):
+        (JSC::Arguments::initializeStandardProperties):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::objectConstructor):
+        (JSC::JSGlobalObject::objectToStringFunction):
+        (JSC::JSGlobalObject::objectToLocaleStringFunction):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        * runtime/ObjectPrototype.h:
+        * tests/mozilla/ecma_3/Function/arguments-001.js:
+          Update test to new es5 behaviour
+
+2009-08-14  Oliver Hunt  <oliver@apple.com>
+
+        Remove MarkStack::drain from the JSC exports file
+
+        MarkStack::drain is now marked inline, the including it in the exports file
+        produces an ld warning
+
+        * JavaScriptCore.exp:
+
+2009-08-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Remove accidentally left in debugging statement.
+
+        * runtime/JSArray.h:
+        (JSC::MarkStack::drain):
+
+2009-08-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        [ES5] Implement Array.isArray
+        https://bugs.webkit.org/show_bug.cgi?id=28296
+
+        Add support for Array.isArray to the Array constructor
+
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        (JSC::arrayConstructorIsArray):
+        * runtime/ArrayConstructor.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSArray.h:
+        (JSC::MarkStack::drain):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+
+2009-08-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Buildfix).
+
+        Attempt to fix windows build
+
+        * runtime/Collector.cpp:
+
+2009-08-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Devirtualise marking
+        https://bugs.webkit.org/show_bug.cgi?id=28294
+
+        Add a bit to TypeInfo to indicate that an object uses the standard
+        JSObject::markChildren method.  This allows us to devirtualise marking
+        of most objects (though a branch is still needed).  We also add a branch
+        to identify arrays thus devirtualising marking in that case as well.
+
+        In order to make the best use of this devirtualisation I've also reworked
+        the MarkStack::drain() logic to make the iteration more efficient.
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * JavaScriptCore.exp:
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::markChildren):
+        * runtime/JSArray.h:
+        (JSC::JSArray::markChildrenDirect):
+        (JSC::MarkStack::drain):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSCell.h:
+        (JSC::MarkStack::append):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::markChildren):
+        * runtime/JSObject.h:
+        (JSC::JSObject::markChildrenDirect):
+        (JSC::JSObject::createStructure):
+        * runtime/JSString.h:
+        (JSC::JSString::createStructure):
+        * runtime/JSType.h:
+        (JSC::):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStack):
+        (JSC::MarkStack::MarkSet::MarkSet):
+        (JSC::MarkStack::MarkStackArray::last):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+        * runtime/TypeInfo.h:
+        (JSC::TypeInfo::hasDefaultMark):
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Some small bits of housekeeping.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Make Parser.h
+        project instead of private. Remove JSONObject.lut.h.
+
+        * assembler/ARMAssembler.h: Remove unneeded WTF prefix.
+        * assembler/AssemblerBufferWithConstantPool.h: Ditto.
+        * bytecompiler/BytecodeGenerator.h: Ditto.
+
+        * wtf/SegmentedVector.h: Add a "using" statement as we do
+        with the other WTF headers.
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Fix Tiger build.
+
+        * parser/Grammar.y: Use a template function so we can compile
+        setStatementLocation even if it comes before YYLTYPE is defined.
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by George Staikos.
+
+        Too much use of void* in Grammar.y
+        https://bugs.webkit.org/show_bug.cgi?id=28287
+
+        * parser/Grammar.y: Changed all the helper functions to
+        take a JSGlobalData* instead of a void*. A couple formatting
+        tweaks that I missed when breaking this into pieces.
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by George Staikos.
+
+        Another part of https://bugs.webkit.org/show_bug.cgi?id=28287
+
+        * parser/Grammar.y: Reduced and sorted includes. Tweaked comment
+        format. Marked a few more functions inline.
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by George Staikos.
+
+        Another part of https://bugs.webkit.org/show_bug.cgi?id=28287
+
+        * parser/Grammar.y: Pass the number to the PropertyNode instead of
+        first turning it into an Identifier.
+
+        * parser/NodeConstructors.h:
+        (JSC::PropertyNode::PropertyNode): Add an overload that takes a double
+        so the code to convert to a string can be here instead of Grammar.y.
+        * parser/Nodes.h: Ditto.
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by George Staikos.
+
+        Another part of https://bugs.webkit.org/show_bug.cgi?id=28287
+
+        * parser/Grammar.y: Eliminate the DBG macro.
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by George Staikos.
+
+        Another part of https://bugs.webkit.org/show_bug.cgi?id=28287
+
+        * parser/Grammar.y: Eliminate the SET_EXCEPTION_LOCATION macro.
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by George Staikos.
+
+        George asked me to break the patch from
+        https://bugs.webkit.org/show_bug.cgi?id=28287
+        into smaller pieces and land it in stages.
+
+        * parser/Grammar.y: Eliminate the LEXER macro.
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Try some more to fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export a new symbol.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: Ditto.
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Try and fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export a new symbol.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: Ditto.
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Levin.
+
+        JavaScriptCore tweaks to get ready for the parser arena
+        https://bugs.webkit.org/show_bug.cgi?id=28243
+
+        Eliminate dependencies on Nodes.h outside JavaScriptCore,
+        and cut down on them inside JavaScriptCore.
+
+        Change regular expression parsing to use identifiers as
+        with other strings we parse.
+
+        Fix a couple things that are needed to use const Identifier
+        more, which will be part of the parser arena work.
+
+        * JavaScriptCore.exp: Resorted and updated.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Changed
+        CollectorHeapIterator.h to be project-internal.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitPushNewScope): Added const.
+        * bytecompiler/BytecodeGenerator.h: Ditto.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions): Moved this function
+        here from WebCore. Here is better since it uses so many internals.
+        Removed unimportant optimization for the no listener case.
+        * debugger/Debugger.h: Ditto. Also removed unneeded include
+        and tweaked formatting and comments.
+
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::functionName): Call asFunction instead
+        of doing the unchecked static_cast.
+        (JSC::DebuggerCallFrame::calculatedFunctionName): Ditto.
+
+        * jit/JITStubs.cpp:
+        (JSC::op_call_JSFunction): Call isHostFunction on the body rather
+        than on the JSFunction.
+        (JSC::vm_lazyLinkCall): Ditto.
+        (JSC::op_construct_JSConstruct): Ditto.
+
+        * parser/Grammar.y: Changed callers to use new scanRegExp with
+        out arguments instead of relying on state in the Lexer. And
+        callers that just want to skip a regular expression to use
+        skipRegExp.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::scanRegExp): Changed to use out arguments, and to
+        add a prefix argument so we can add in the "=" character as needed.
+        Also rewrote to streamline the logic a bit inspired by suggestions
+        by David Levin.
+        (JSC::Lexer::skipRegExp): Added. Version of the function above that
+        does not actually put the regular expression into a string.
+        (JSC::Lexer::clear): Removed code to clear m_pattern and m_flags.
+        * parser/Lexer.h: Changed scanRegExp to have out arguments. Added
+        skipRegExp. Eliminated pattern, flags, m_pattern, and m_flags.
+
+        * parser/NodeConstructors.h:
+        (JSC::RegExpNode::RegExpNode): Changed to take const Identifier&.
+        * parser/Nodes.cpp:
+        (JSC::RegExpNode::emitBytecode): Changed since m_pattern and
+        m_flags are now Identifier instead of UString.
+        (JSC::FunctionBodyNode::make): Moved this function here instead
+        of putting it in the JSFunction.h header.
+        * parser/Nodes.h: Changed RegExpNode to use Identifier.
+
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::createCallIdentifier): Changed to use isHostFunction
+        on the body instead of on the JSFunction object.
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString): Ditto.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::isHostFunction): Moved here from header.
+        (JSC::JSFunction::isHostFunctionNonInline): Added.
+        (JSC::JSFunction::JSFunction): Removed unneeded initialization of
+        m_body to 0.
+        (JSC::JSFunction::setBody): Moved here from header.
+
+        * runtime/JSFunction.h: Removed unneeded includes. Moved private
+        constructor down to the private section. Made virtual functions
+        private. Removed unneeded overload of setBody and moved the body
+        of the function into the .cpp file. Changed assertions to use
+        the non-inline version of isHostFunction.
+
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::functionGetter): Use asFunction instead
+        of doing the unchecked static_cast.
+
+        * wtf/SegmentedVector.h:
+        (WTF::SegmentedVector::isEmpty): Added.
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Darin Adler.
+
+        Use the version of operator new that takes a JSGlobalData when allocating FuncDeclNode and FuncExprNode
+        from within the grammar to prevent these nodes from being leaked.
+
+        * parser/Grammar.y:
+
+2009-08-13  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Remove the special-case for Qt wrt JSVALUE_32 introduced in
+        r46709. It must've been a dependency issue on the bot, as
+        after a manual build all the tests pass on amd64 and ia32.
+
+        * wtf/Platform.h:
+
+2009-08-12  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Add optimize call and property access support for ARM JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=24986
+
+        For tightly coupled sequences the BEGIN_UNINTERRUPTED_SEQUENCE and
+        END_UNINTERRUPTED_SEQUENCE macros have been introduced which ensure
+        space for instructions and constants of the named sequence. This
+        method is vital for those architecture which are using constant pool.
+
+        The 'latePatch' method - which was linked to JmpSrc - is replaced with
+        a port specific solution (each calls are marked to place their address
+        on the constant pool).
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::linkBranch):
+        (JSC::ARMAssembler::executableCopy): Add extra align for constant pool.
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::JmpSrc::JmpSrc):
+        (JSC::ARMAssembler::sizeOfConstantPool):
+        (JSC::ARMAssembler::jmp):
+        (JSC::ARMAssembler::linkCall):
+        * assembler/ARMv7Assembler.h:
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/AssemblerBufferWithConstantPool.h:
+        (JSC::AssemblerBufferWithConstantPool::flushIfNoSpaceFor): Fix the
+        computation of the remaining space.
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branch32):
+        (JSC::MacroAssemblerARM::nearCall):
+        (JSC::MacroAssemblerARM::call):
+        (JSC::MacroAssemblerARM::branchPtrWithPatch):
+        (JSC::MacroAssemblerARM::ensureSpace):
+        (JSC::MacroAssemblerARM::sizeOfConstantPool):
+        (JSC::MacroAssemblerARM::prepareCall):
+        * assembler/X86Assembler.h:
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::beginUninterruptedSequence):
+        (JSC::JIT::endUninterruptedSequence):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::emit_op_put_by_id):
+
+2009-08-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Dave Kilzer.
+
+        Disable WTF_USE_JSVALUE32_64 on iPhone for now (support not yet added for ARMv7).
+
+        * wtf/Platform.h:
+
+2009-08-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Maciej Stachoviak.
+
+        Ooops - moved code that had been accidentally added to op_new_func instead of
+        op_new_func_exp, to where it shoulds be.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * wtf/Platform.h:
+
+2009-08-12  Ada Chan  <adachan@apple.com>
+
+        Added workaround for the limitation that VirtualFree with MEM_RELEASE
+        can only accept the base address returned by VirtualAlloc when the region
+        was reserved and it can only free the entire region, and not a part of it.
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStackArray::shrinkAllocation):
+        * runtime/MarkStackWin.cpp:
+        (JSC::MarkStack::releaseStack):
+
+2009-08-12  Balazs Kelemen  <kelemen.balazs.3@stud.u-szeged.hu>
+
+        Reviewed by Ariya Hidayat.
+
+        Build fix: use std::numeric_limits<long long>::min() instead of LLONG_MIN
+        since LLONG_MIN is not defined in standard c++.
+
+        * runtime/UString.cpp:
+        (JSC::UString::from):
+
+2009-08-12  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Jan Alonzo.
+
+        Buildfix for Gtk platforms debug builds.
+
+        * GNUmakefile.am: Choose MarkStackPosix.cpp or MarkStackWin.cpp
+        depending on platform.
+
+2009-08-12  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Prospective build fix for Mac and 32-bit Windows.
+
+        * runtime/UString.cpp: Include wtf/StringExtras.h for snprintf.
+        (JSC::UString::from): Use %lld instead of %I64d for snprintf
+        on non-windows platforms.
+
+2009-08-12  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix compile error on 64Bit Windows, when UString::from
+        is called with an intptr_t.
+
+        Added new UString::From overload with long long parameter.
+
+        Thanks to Holger for the long long idea.
+
+        * runtime/UString.cpp:
+        (JSC::UString::from):
+        * runtime/UString.h:
+
+2009-08-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Minor style fixes.
+
+        * runtime/UString.h:
+        (JSC::UString::Rep::createEmptyBuffer):
+        * wtf/FastMalloc.h:
+        (WTF::TryMallocReturnValue::getValue):
+
+2009-08-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make it harder to misuse try* allocation routines
+        https://bugs.webkit.org/show_bug.cgi?id=27469
+
+        Jump through a few hoops to make it much harder to accidentally
+        miss null-checking of values returned by the try-* allocation
+        routines.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::increaseVectorLength):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncLink):
+        * runtime/UString.cpp:
+        (JSC::allocChars):
+        (JSC::reallocChars):
+        (JSC::expandCapacity):
+        (JSC::UString::Rep::reserveCapacity):
+        (JSC::UString::expandPreCapacity):
+        (JSC::createRep):
+        (JSC::concatenate):
+        (JSC::UString::spliceSubstringsWithSeparators):
+        (JSC::UString::replaceRange):
+        (JSC::UString::append):
+        (JSC::UString::operator=):
+        * runtime/UString.h:
+        (JSC::UString::Rep::createEmptyBuffer):
+        * wtf/FastMalloc.cpp:
+        (WTF::tryFastZeroedMalloc):
+        (WTF::tryFastMalloc):
+        (WTF::tryFastCalloc):
+        (WTF::tryFastRealloc):
+        (WTF::TCMallocStats::tryFastMalloc):
+        (WTF::TCMallocStats::tryFastCalloc):
+        (WTF::TCMallocStats::tryFastRealloc):
+        * wtf/FastMalloc.h:
+        (WTF::TryMallocReturnValue::TryMallocReturnValue):
+        (WTF::TryMallocReturnValue::~TryMallocReturnValue):
+        (WTF::TryMallocReturnValue::operator PossiblyNull<T>):
+        (WTF::TryMallocReturnValue::getValue):
+        * wtf/Platform.h:
+        * wtf/PossiblyNull.h: Added.
+        (WTF::PossiblyNull::PossiblyNull):
+        (WTF::PossiblyNull::~PossiblyNull):
+        (WTF::::getValue):
+
+2009-08-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix part deux).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-11  Gavin Barraclough  <barraclough@apple.com>
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Restrict use of FuncDeclNode & FuncExprNode to the parser.
+        https://bugs.webkit.org/show_bug.cgi?id=28209
+
+        These objects were also being referenced from the CodeBlock.  By changing this
+        to just retain pointers to FunctionBodyNodes these classes can be restricted to
+        use during parsing.
+
+        No performance impact (or sub-percent progression).
+
+        * JavaScriptCore.exp:
+            Update symbols.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::mark):
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addFunction):
+        (JSC::CodeBlock::function):
+            Unify m_functions & m_functionExpressions into a single Vector<RefPtr<FuncExprNode> >.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::addConstant):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        * bytecompiler/BytecodeGenerator.h:
+            FunctionStacks now contain FunctionBodyNodes not FuncDeclNodes.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::privateExecute):
+            Update to reflect chnages in CodeBlock.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_func_exp):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::):
+            Update to reflect chnages in CodeBlock.
+
+        * parser/Grammar.y:
+            FunctionStacks now contain FunctionBodyNodes not FuncDeclNodes.
+
+        * parser/NodeConstructors.h:
+        (JSC::FuncExprNode::FuncExprNode):
+        (JSC::FuncDeclNode::FuncDeclNode):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNodeData::mark):
+        (JSC::FunctionBodyNode::finishParsing):
+        * parser/Nodes.h:
+        (JSC::FunctionBodyNode::ident):
+            Move m_ident & make methods from FuncDeclNode & FuncExprNode to FunctionBodyNode.
+
+        * runtime/JSFunction.h:
+        (JSC::FunctionBodyNode::make):
+            Make this method inline (was FuncDeclNode::makeFunction).
+
+2009-08-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Native JSON.stringify does not omit functions
+        https://bugs.webkit.org/show_bug.cgi?id=28117
+
+        Objects that are callable should be treated as undefined when
+        serialising to JSON.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendStringifiedValue):
+
+2009-08-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        REGRESSION: Hang/crash in BytecodeGenerator::constRegisterFor loading simple page
+        https://bugs.webkit.org/show_bug.cgi?id=28169
+
+        Handle the case where someone has attempted to shadow a property
+        on the global object with a constant.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::constRegisterFor):
+        * parser/Nodes.cpp:
+        (JSC::ConstDeclNode::emitCodeSingle):
+
+2009-08-11  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Desktop Notifications API
+        https://bugs.webkit.org/show_bug.cgi?id=25463
+
+        Adds ENABLE_NOTIFICATION flag.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * wtf/Platform.h:
+
+2009-08-11  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Modifications on JavaScriptCore to allow Haiku port.
+        https://bugs.webkit.org/show_bug.cgi?id=28121
+
+        * runtime/Collector.cpp: Haiku doesn't have sys/mman.h, using OS.h instead.
+        (JSC::currentThreadStackBase): Haiku uses its own threading system.
+        * wtf/Platform.h: Defining all Haiku platform values.
+        * wtf/haiku/MainThreadHaiku.cpp: Adding a missing header (NotImplemented.h).
+
+2009-08-11  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fix windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-11  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Buildfix for Qt-win platforms.
+
+        * JavaScriptCore.pri: Choose MarkStackPosix.cpp or MarkStackWin.cpp depend on platform.
+
+2009-08-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (And another build fix).
+
+        Add new exports for MSVC
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-08-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (yet another build fix).
+
+        Remove obsolete entries from MSVC exports file
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-10  Oliver Hunt  <oliver@apple.com>
+
+        Add includes needed for non-allinonefile builds
+
+        * runtime/GetterSetter.h:
+        * runtime/ScopeChain.h:
+
+2009-08-10  Oliver Hunt  <oliver@apple.com>
+
+        Fix export file for last build fix
+
+        * JavaScriptCore.exp:
+
+2009-08-10  Oliver Hunt  <oliver@apple.com>
+
+        Hoist page size initialization into platform specific code.
+
+        * jit/ExecutableAllocatorPosix.cpp:
+        * jit/ExecutableAllocatorWin.cpp:
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::pageSize):
+        * runtime/MarkStackPosix.cpp:
+        (JSC::MarkStack::initializePagesize):
+        * runtime/MarkStackWin.cpp:
+        (JSC::MarkStack::initializePagesize):
+
+2009-08-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Stack overflow crash in JavaScript garbage collector mark pass
+        https://bugs.webkit.org/show_bug.cgi?id=12216
+
+        Make the GC mark phase iterative by using an explicit mark stack.
+        To do this marking any single object is performed in multiple stages
+          * The object is appended to the MarkStack, this sets the marked
+            bit for the object using the new markDirect() function, and then
+            returns
+          * When the MarkStack is drain()ed the object is popped off the stack
+            and markChildren(MarkStack&) is called on the object to collect 
+            all of its children.  drain() then repeats until the stack is empty.
+
+        Additionally I renamed a number of methods from 'mark' to 'markAggregate'
+        in order to make it more clear that marking of those object was not
+        going to result in an actual recursive mark.
+
+        * GNUmakefile.am
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::markAggregate):
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::markChildren):
+        * debugger/DebuggerActivation.h:
+        * interpreter/Register.h:
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::markGlobals):
+        (JSC::RegisterFile::markCallFrames):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNodeData::markAggregate):
+        (JSC::EvalNode::markAggregate):
+        (JSC::FunctionBodyNode::markAggregate):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::markAggregate):
+        * runtime/ArgList.cpp:
+        (JSC::MarkedArgumentBuffer::markLists):
+        * runtime/ArgList.h:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::markChildren):
+        * runtime/Arguments.h:
+        * runtime/Collector.cpp:
+        (JSC::Heap::markConservatively):
+        (JSC::Heap::markCurrentThreadConservativelyInternal):
+        (JSC::Heap::markCurrentThreadConservatively):
+        (JSC::Heap::markOtherThreadConservatively):
+        (JSC::Heap::markStackObjectsConservatively):
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::collect):
+        * runtime/Collector.h:
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::markChildren):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::GetterSetter):
+        (JSC::GetterSetter::createStructure):
+        * runtime/GlobalEvalFunction.cpp:
+        (JSC::GlobalEvalFunction::markChildren):
+        * runtime/GlobalEvalFunction.h:
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::markChildren):
+        * runtime/JSActivation.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::markChildren):
+        * runtime/JSArray.h:
+        * runtime/JSCell.h:
+        (JSC::JSCell::markCellDirect):
+        (JSC::JSCell::markChildren):
+        (JSC::JSValue::markDirect):
+        (JSC::JSValue::markChildren):
+        (JSC::JSValue::hasChildren):
+        (JSC::MarkStack::append):
+        (JSC::MarkStack::drain):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::markChildren):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::markChildren):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::markAggregate):
+        (JSC::JSONObject::markStringifiers):
+        * runtime/JSONObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::markChildren):
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        * runtime/JSObject.h:
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::markChildren):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::createStructure):
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::create):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::markChildren):
+        * runtime/JSStaticScopeObject.h:
+        * runtime/JSType.h:
+        (JSC::):
+        * runtime/JSValue.h:
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::markChildren):
+        * runtime/JSWrapperObject.h:
+        * runtime/MarkStack.cpp: Added.
+        (JSC::MarkStack::compact):
+        * runtime/MarkStack.h: Added.
+        (JSC::):
+        (JSC::MarkStack::MarkStack):
+        (JSC::MarkStack::append):
+        (JSC::MarkStack::appendValues):
+        (JSC::MarkStack::~MarkStack):
+        (JSC::MarkStack::MarkSet::MarkSet):
+        (JSC::MarkStack::pageSize):
+        
+        MarkStackArray is a non-shrinking, mmap-based vector type
+        used for storing objects to be marked.
+        (JSC::MarkStack::MarkStackArray::MarkStackArray):
+        (JSC::MarkStack::MarkStackArray::~MarkStackArray):
+        (JSC::MarkStack::MarkStackArray::expand):
+        (JSC::MarkStack::MarkStackArray::append):
+        (JSC::MarkStack::MarkStackArray::removeLast):
+        (JSC::MarkStack::MarkStackArray::isEmpty):
+        (JSC::MarkStack::MarkStackArray::size):
+        (JSC::MarkStack::MarkStackArray::shrinkAllocation):
+        * runtime/MarkStackPosix.cpp: Added.
+        (JSC::MarkStack::allocateStack):
+        (JSC::MarkStack::releaseStack):
+        * runtime/MarkStackWin.cpp: Added.
+        (JSC::MarkStack::allocateStack):
+        (JSC::MarkStack::releaseStack):
+
+        * runtime/ScopeChain.h:
+        * runtime/ScopeChainMark.h:
+        (JSC::ScopeChain::markAggregate):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::mark):
+        * runtime/Structure.h:
+        (JSC::Structure::markAggregate):
+
+2009-08-10  Mark Rowe  <mrowe@apple.com>
+        
+        Reviewed by Darin Adler.
+
+        Fix hundreds of "pointer being freed was not allocated" errors seen on the build bot.
+
+        * wtf/FastMalloc.h: Implement nothrow variants of the delete and delete[] operators since
+        we implement the nothrow variants of new and new[].  The nothrow variant of delete is called
+        explicitly in the implementation of std::sort which was resulting in FastMalloc-allocated
+        memory being passed to the system allocator to free.
+
+2009-08-10  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        [Gtk] Unreviewed build fix. Move JSAPIValueWrapper.cpp/.h in the debug
+        section. This file is already part of AllInOneFile in Release builds.
+
+        * GNUmakefile.am:
+
+2009-08-10  Darin Adler  <darin@apple.com>
+
+        * wtf/FastMalloc.h: Fix build.
+
+2009-08-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        FastMalloc.h has cross-platform code but marked as WinCE-only
+        https://bugs.webkit.org/show_bug.cgi?id=28160
+
+        1) The support for nothrow was inside #if PLATFORM(WINCE) even though it is
+           not platform-specific.
+        2) The code tried to override operator delete nothrow, which does not exist.
+        3) The code in the header checks the value of USE_SYSTEM_MALLOC, but the code
+           in FastMalloc.cpp checks only if the macro is defined.
+
+        * wtf/FastMalloc.h: See above.
+        * wtf/FastMalloc.cpp: Ditto.
+
+2009-08-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix an annoying indentation issue.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+
+2009-08-10  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        Add new files to makefile.
+
+        * GNUmakefile.am:
+
+2009-08-10  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix compilation with the interpreter instead of the JIT by including
+        PrototypeFunction.h as forward-declared through NativeFunctionWrapper.h.
+
+        * runtime/ObjectConstructor.cpp:
+
+2009-08-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by George Staikos.
+
+        JSON.stringify replacer returning undefined does not omit object properties
+        https://bugs.webkit.org/show_bug.cgi?id=28118
+
+        Correct behaviour of stringify when using a replacer function that returns
+        undefined.  This is a simple change to move the undefined value check to
+        after the replacer function is called.  This means that the replacer function
+        is now called for properties with the value undefined, however i've confirmed
+        that this behaviour is correct.
+        
+        In addition I've made the cyclic object exception have a more useful error
+        message.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendStringifiedValue):
+
+2009-08-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Eric Seidel and Sam Weinig.
+
+        [ES5] Implement Object.getPrototypeOf
+        https://bugs.webkit.org/show_bug.cgi?id=28114
+
+        Implement getPrototypeOf
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConsGetPrototypeOf):
+        * runtime/ObjectConstructor.h:
+
+2009-08-07  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for Noncopyable class
+        https://bugs.webkit.org/show_bug.cgi?id=27879
+
+        Several classes which are inherited from Noncopyable are instantiated by
+        operator new, so Noncopyable class has been inherited from FastAllocBase.
+
+        * wtf/Noncopyable.h:
+
+2009-08-07  George Staikos <george.staikos@torchmobile.com> 
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27305
+        Implement WinCE-specific unicode layer.
+        Written by George Staikos <george.staikos@torchmobile.com>
+        with bug fixes by Yong Li <yong.li@torchmobile.com>
+        refactored by Joe Mason <joe.mason@torchmobile.com> 
+
+        * wtf/Platform.h:
+        * wtf/unicode/Unicode.h:
+        * wtf/unicode/wince/UnicodeWince.cpp: Added.
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        (WTF::Unicode::foldCase):
+        (WTF::Unicode::isPrintableChar):
+        (WTF::Unicode::isSpace):
+        (WTF::Unicode::isLetter):
+        (WTF::Unicode::isUpper):
+        (WTF::Unicode::isLower):
+        (WTF::Unicode::isDigit):
+        (WTF::Unicode::isPunct):
+        (WTF::Unicode::toTitleCase):
+        (WTF::Unicode::direction):
+        (WTF::Unicode::category):
+        (WTF::Unicode::decompositionType):
+        (WTF::Unicode::combiningClass):
+        (WTF::Unicode::mirroredChar):
+        (WTF::Unicode::digitValue):
+        * wtf/unicode/wince/UnicodeWince.h: Added.
+        (WTF::Unicode::):
+        (WTF::Unicode::isSeparatorSpace):
+        (WTF::Unicode::isHighSurrogate):
+        (WTF::Unicode::isLowSurrogate):
+        (WTF::Unicode::isArabicChar):
+        (WTF::Unicode::hasLineBreakingPropertyComplexContext):
+        (WTF::Unicode::umemcasecmp):
+        (WTF::Unicode::surrogateToUcs4):
+
+2009-08-07  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28069
+
+        Add inline to help winscw compiler resolve specialized argument in 
+        templated functions.  
+
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lexString):
+
+2009-08-07  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for RegExpObjectData struct
+        http://bugs.webkit.org/show_bug.cgi?id=26750
+
+        Inherits RegExpObjectData struct from FastAllocBase because
+        it has been instantiated by 'new' in JavaScriptCore/runtime/RegExpObject.cpp:62
+
+        * runtime/RegExpObject.h:
+
+2009-08-06  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Updated patch for bug #27059:
+        Symbian platform always uses little endian encoding,
+        regardless of compiler.
+        We need to make sure that we correctly detect EABI architecture
+        for armv5 targets on Symbian,
+        where __EABI__ is set but not __ARM_EABI__
+
+        * wtf/Platform.h:
+
+2009-08-06  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed revert.
+
+        http://bugs.webkit.org/show_bug.cgi?id=27879
+
+        Revert 46877 because it broke GTK.
+
+        * wtf/Noncopyable.h:
+
+2009-08-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Make get_by_id/put_by_id/method_check/call defer optimization using a data flag rather than a code modification.
+        ( https://bugs.webkit.org/show_bug.cgi?id=27635 )
+
+        This improves performance of ENABLE(ASSEMBLER_WX_EXCLUSIVE) builds by 2-2.5%, reducing the overhead to about 2.5%.
+        (No performance impact with ASSEMBLER_WX_EXCLUSIVE disabled).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::printStructureStubInfo):
+            - Make StructureStubInfo store the type as an integer, rather than an OpcodeID.
+
+        * bytecode/CodeBlock.h:
+        (JSC::):
+        (JSC::CallLinkInfo::seenOnce):
+        (JSC::CallLinkInfo::setSeen):
+        (JSC::MethodCallLinkInfo::seenOnce):
+        (JSC::MethodCallLinkInfo::setSeen):
+            - Change a pointer in CallLinkInfo/MethodCallLinkInfo to use a PtrAndFlags, use a flag to track when an op has been executed once.
+
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+            - Make StructureStubInfo store the type as an integer, rather than an OpcodeID.
+
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::StructureStubInfo):
+        (JSC::StructureStubInfo::initGetByIdSelf):
+        (JSC::StructureStubInfo::initGetByIdProto):
+        (JSC::StructureStubInfo::initGetByIdChain):
+        (JSC::StructureStubInfo::initGetByIdSelfList):
+        (JSC::StructureStubInfo::initGetByIdProtoList):
+        (JSC::StructureStubInfo::initPutByIdTransition):
+        (JSC::StructureStubInfo::initPutByIdReplace):
+        (JSC::StructureStubInfo::seenOnce):
+        (JSC::StructureStubInfo::setSeen):
+            - Make StructureStubInfo store the type as an integer, rather than an OpcodeID, add a flag to track when an op has been executed once.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitPutById):
+            - Make StructureStubInfo store the type as an integer, rather than an OpcodeID.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::unlinkCall):
+            - Remove the "don't lazy link" stage of calls.
+
+        * jit/JIT.h:
+        (JSC::JIT::compileCTIMachineTrampolines):
+            - Remove the "don't lazy link" stage of calls.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSlowCase):
+            - Remove the "don't lazy link" stage of calls.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+        (JSC::JITStubs::getPolymorphicAccessStructureListSlot):
+            - Remove the "don't lazy link" stage of calls, and the "_second" stage of get_by_id/put_by_id/method_check.
+
+        * jit/JITStubs.h:
+        (JSC::JITThunks::ctiStringLengthTrampoline):
+        (JSC::JITStubs::):
+            - Remove the "don't lazy link" stage of calls, and the "_second" stage of get_by_id/put_by_id/method_check.
+
+        * wtf/PtrAndFlags.h:
+        (WTF::PtrAndFlags::PtrAndFlags):
+        (WTF::PtrAndFlags::operator!):
+        (WTF::PtrAndFlags::operator->):
+            - Add ! and -> operators, add constuctor with pointer argument.
+
+2009-08-06  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Adam Barth.
+
+        Allow custom memory allocation control for Noncopyable class
+        https://bugs.webkit.org/show_bug.cgi?id=27879
+
+        Several classes which inherited from Noncopyable are instantiated by
+        operator new, so Noncopyable class has been inherited from FastAllocBase.
+
+        * wtf/Noncopyable.h:
+
+2009-08-06  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Add explicit dependencies for our build verification scripts to ensure that they always run after linking has completed.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-08-06  Mark Rowe  <mrowe@apple.com>
+
+        Bring a little order to our otherwise out of control lives.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-08-06  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for JavaScriptCore's PolymorphicAccessStructureList struct
+        https://bugs.webkit.org/show_bug.cgi?id=27877
+
+        Inherits PolymorphicAccessStructureList struct from FastAllocBase because it has been instantiated by
+        'new' in JavaScriptCore/jit/JITStubs.cpp:1229.
+
+        * bytecode/Instruction.h:
+
+2009-08-05  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for JavaScriptCore's ScopeNodeData struct
+        https://bugs.webkit.org/show_bug.cgi?id=27875
+
+        Inherits ScopeNodeData struct from FastAllocBase because it has been instantiated by
+        'new' in JavaScriptCore/parser/Nodes.cpp:1848.
+
+        * parser/Nodes.h:
+
+2009-08-05  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Add floating point support for generic ARM port.
+        https://bugs.webkit.org/show_bug.cgi?id=24986
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::doubleTransfer):
+        * assembler/ARMAssembler.h:
+        (JSC::ARM::):
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::faddd_r):
+        (JSC::ARMAssembler::fsubd_r):
+        (JSC::ARMAssembler::fmuld_r):
+        (JSC::ARMAssembler::fcmpd_r):
+        (JSC::ARMAssembler::fdtr_u):
+        (JSC::ARMAssembler::fdtr_d):
+        (JSC::ARMAssembler::fmsr_r):
+        (JSC::ARMAssembler::fsitod_r):
+        (JSC::ARMAssembler::fmstat):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::):
+        (JSC::MacroAssemblerARM::supportsFloatingPoint):
+        (JSC::MacroAssemblerARM::loadDouble):
+        (JSC::MacroAssemblerARM::storeDouble):
+        (JSC::MacroAssemblerARM::addDouble):
+        (JSC::MacroAssemblerARM::subDouble):
+        (JSC::MacroAssemblerARM::mulDouble):
+        (JSC::MacroAssemblerARM::convertInt32ToDouble):
+        (JSC::MacroAssemblerARM::branchDouble):
+        * jit/JIT.h:
+
+2009-08-05  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Add JIT support for generic ARM port without optimizations.
+        https://bugs.webkit.org/show_bug.cgi?id=24986
+
+        All JIT optimizations are disabled.
+
+        Signed off by Zoltan Herczeg <zherczeg@inf.u-szeged.hu>
+        Signed off by Gabor Loki <loki@inf.u-szeged.hu>
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::baseIndexTransfer32):
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Imm32::Imm32):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::store32):
+        (JSC::MacroAssemblerARM::move):
+        (JSC::MacroAssemblerARM::branch32):
+        (JSC::MacroAssemblerARM::add32):
+        (JSC::MacroAssemblerARM::sub32):
+        (JSC::MacroAssemblerARM::load32):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getBytecodeIndex):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReference):
+        * jit/JITOpcodes.cpp:
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        (JSC::JITStackFrame::returnAddressSlot):
+        * wtf/Platform.h:
+
+2009-08-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Oiver Hunt.
+
+        Revert r46643 since this breaks the Yarr::Interpreter running the v8 tests.
+        https://bugs.webkit.org/show_bug.cgi?id=27874
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::allocDisjunctionContext):
+        (JSC::Yarr::Interpreter::freeDisjunctionContext):
+        (JSC::Yarr::Interpreter::allocParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::freeParenthesesDisjunctionContext):
+
+2009-08-04  Oliver Hunt  <oliver@apple.com>
+
+        PPC64 Build fix
+
+        * wtf/Platform.h:
+
+2009-08-04  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
+
+        Reviewed by Adam Treat
+
+        Explicitly include limits.h header when using INT_MAX and INT_MIN
+
+        * interpreter/Interpreter.cpp
+
+2009-08-03  Harald Fernengel  <harald.fernengel@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Fix compile error for ambigous call to abs()
+        https://bugs.webkit.org/show_bug.cgi?id=27873
+
+        Fix ambiguity in abs(long int) call by calling labs() instead
+
+        * wtf/DateMath.cpp: replace call to abs() with labs()
+
+2009-08-03  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Consolidate common gcc flags to WebKit.pri
+        https://bugs.webkit.org/show_bug.cgi?id=27934
+
+        * JavaScriptCore.pro:
+
+2009-08-03  Ada Chan  <adachan@apple.com>
+
+        Fixed the Tiger build.
+
+        * wtf/FastMalloc.cpp:
+
+2009-08-03  Ada Chan  <adachan@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Don't use background thread to scavenge memory on Tiger until we figure out why it causes a crash.
+        https://bugs.webkit.org/show_bug.cgi?id=27900
+
+        * wtf/FastMalloc.cpp:
+
+2009-08-03  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Jan Alonzo.
+
+        Fix build break on Gtk/x86_64.
+        https://bugs.webkit.org/show_bug.cgi?id=27936
+
+        Use JSVALUE64 for X86_64 LINUX, except Qt.
+
+        * wtf/Platform.h:
+
+2009-08-02  Xan Lopez  <xlopez@igalia.com>
+
+        Fix the GTK+ build.
+
+        * wtf/Platform.h:
+
+2009-08-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Disabled JSVALUE32_64 on Qt builds, since all layout tests mysteriously
+        crash with it enabled.
+
+        * wtf/Platform.h:
+
+2009-08-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Qt build fix.
+
+        Added JSAPIValueWrapper.cpp to the build.
+
+        * JavaScriptCore.pri:
+
+2009-08-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix.
+
+        Exported symbols for JSAPIValueWrapper.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-02  Geoffrey Garen  <ggaren@apple.com>
+
+        GTK build fix.
+
+        * jit/JITStubs.cpp: #include <stdarg.h>, for a definition of va_start.
+
+2009-08-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Qt build fix.
+        
+        * runtime/Collector.cpp: #include <limits.h>, for a definition of ULONG_MAX.
+
+2009-08-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Nixed JSImmediate::prototype, JSImmediate::toObject,
+        and JSImmediate::toThisObject, and removed their exported symbols.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        * runtime/JSImmediate.cpp:
+        * runtime/JSImmediate.h:
+
+2009-08-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Enabled JSVALUE32_64 by default on all platforms other than x86_64 (which uses JSVALUE64).
+
+        * wtf/Platform.h:
+
+2009-08-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Jan Alonzo.
+
+        Script for building the JavaScriptCore library for wx.
+        https://bugs.webkit.org/show_bug.cgi?id=27619
+
+        * wscript: Added.
+
+2009-08-02  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        DateMath depends on strftime and localtime, which need to be imported manually on WinCE
+        https://bugs.webkit.org/show_bug.cgi?id=26558
+
+        * wtf/DateMath.cpp:
+
+2009-08-01  David Kilzer  <ddkilzer@apple.com>
+
+        wtf/Threading.h: added include of Platform.h
+
+        Reviewed by Mark Rowe.
+
+        * wtf/Threading.h: Added #include "Platform.h" since this header
+        uses PLATFORM() and other macros.
+
+2009-08-01  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Roll out r46668 as it was misinformed.  ScopeChain is only used with placement new.
+
+        * runtime/ScopeChain.h:
+
+2009-08-01  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Allow custom memory allocation control for JavaScriptCore's HashMap class
+        http://bugs.webkit.org/show_bug.cgi?id=27871
+
+        Inherits HashMap class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/API/JSClassRef.cpp:148.
+
+        * wtf/RefPtrHashMap.h:
+        (WTF::):
+
+2009-08-01  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Allow custom memory allocation control for JavaScriptCore's ScopeChain class
+        https://bugs.webkit.org/show_bug.cgi?id=27834
+
+        Inherits ScopeChain class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/JSFunction.h:109.
+
+        * runtime/ScopeChain.h:
+
+2009-08-01  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for JavaScriptCore's RegExpConstructorPrivate struct 
+        https://bugs.webkit.org/show_bug.cgi?id=27833
+
+        Inherits RegExpConstructorPrivate class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/RegExpConstructor.cpp:152.
+
+        * runtime/RegExpConstructor.cpp:
+
+2009-07-31  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Resurrect the old GetTickCount implementation of currentTime, controlled by WTF_USE_QUERY_PERFORMANCE_COUNTER
+        currentSystemTime taken from older WebKit; currentTime written by Yong Li <yong.li@torchmobile.com>; cleanup by Joe Mason <joe.mason@torchmobile.com>
+        https://bugs.webkit.org/show_bug.cgi?id=27848
+
+        * wtf/CurrentTime.cpp:
+        (WTF::currentSystemTime): get current time with GetCurrentFT
+        (WTF::currentTime): track msec elapsed since first currentSystemTime call using GetTickCount
+        * wtf/Platform.h:
+
+2009-07-31  Ada Chan  <adachan@apple.com>
+
+        Fixes the Windows release-PGO build.
+
+        Reviewed by Jon Honeycutt.
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Suppresses the warning about unreachable code that we get by adding "return 0" to WTF::TCMalloc_PageHeap::runScavengerThread().
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::runScavengerThread): Fixes the error about the method not returning a value in the release-PGO build.
+
+2009-07-31  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Change malloc to fastMalloc and free to fastFree in Yarr's RegexInterpreter.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27874
+
+        Use fastMalloc and fastFree instead of malloc and free in RegexInterpreter.cpp's methods.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::allocDisjunctionContext):
+        (JSC::Yarr::Interpreter::freeDisjunctionContext):
+        (JSC::Yarr::Interpreter::allocParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::freeParenthesesDisjunctionContext):
+
+2009-07-30  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        Fix compiler warning.
+
+        GCC does not like C++-style comments in preprocessor directives.
+
+        * wtf/Platform.h:
+
+2009-07-30  John McCall  <rjmccall@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Optimize the X86_64 trampolines: avoid the need for filler arguments
+        and move the stub-args area closer to the stack pointer.
+
+        * jit/JIT.h: adjust patch offsets because of slight code-size change 
+        * jit/JITCode.h:
+        (JSC::JITCode::execute): don't pass filler args
+        * jit/JITStubs.cpp:
+        (ctiTrampoline): (X86_64): push args onto stack, use args directly
+        (ctiVMThrowTrampoline): (X86_64): adjust %rsp by correct displacement
+        (ctiOpThrowNotCaught): (X86_64): adjust %rsp by correct displacement
+        * jit/JITStubs.h:
+        (JITStackFrame): (X86_64): move args area earlier
+        (ctiTrampoline): remove filler args from prototype
+
+2009-07-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Temporarily revert r46618 since this is b0rking on Linux.
+
+2009-07-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Make get_by_id/put_by_id/method_check/call defer optimization using a data flag rather than a code modification.
+        ( https://bugs.webkit.org/show_bug.cgi?id=27635 )
+
+        This improves performance of ENABLE(ASSEMBLER_WX_EXCLUSIVE) builds by 2-2.5%, reducing the overhead to about 2.5%.
+        (No performance impact with ASSEMBLER_WX_EXCLUSIVE disabled).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::printStructureStubInfo):
+            - Make StructureStubInfo store the type as an integer, rather than an OpcodeID.
+
+        * bytecode/CodeBlock.h:
+        (JSC::):
+        (JSC::CallLinkInfo::seenOnce):
+        (JSC::CallLinkInfo::setSeen):
+        (JSC::MethodCallLinkInfo::seenOnce):
+        (JSC::MethodCallLinkInfo::setSeen):
+            - Change a pointer in CallLinkInfo/MethodCallLinkInfo to use a PtrAndFlags, use a flag to track when an op has been executed once.
+
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+            - Make StructureStubInfo store the type as an integer, rather than an OpcodeID.
+
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::StructureStubInfo):
+        (JSC::StructureStubInfo::initGetByIdSelf):
+        (JSC::StructureStubInfo::initGetByIdProto):
+        (JSC::StructureStubInfo::initGetByIdChain):
+        (JSC::StructureStubInfo::initGetByIdSelfList):
+        (JSC::StructureStubInfo::initGetByIdProtoList):
+        (JSC::StructureStubInfo::initPutByIdTransition):
+        (JSC::StructureStubInfo::initPutByIdReplace):
+        (JSC::StructureStubInfo::seenOnce):
+        (JSC::StructureStubInfo::setSeen):
+            - Make StructureStubInfo store the type as an integer, rather than an OpcodeID, add a flag to track when an op has been executed once.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitPutById):
+            - Make StructureStubInfo store the type as an integer, rather than an OpcodeID.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::unlinkCall):
+            - Remove the "don't lazy link" stage of calls.
+
+        * jit/JIT.h:
+        (JSC::JIT::compileCTIMachineTrampolines):
+            - Remove the "don't lazy link" stage of calls.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSlowCase):
+            - Remove the "don't lazy link" stage of calls.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+        (JSC::JITStubs::getPolymorphicAccessStructureListSlot):
+            - Remove the "don't lazy link" stage of calls, and the "_second" stage of get_by_id/put_by_id/method_check.
+
+        * jit/JITStubs.h:
+        (JSC::JITThunks::ctiStringLengthTrampoline):
+        (JSC::JITStubs::):
+            - Remove the "don't lazy link" stage of calls, and the "_second" stage of get_by_id/put_by_id/method_check.
+
+        * wtf/PtrAndFlags.h:
+        (WTF::PtrAndFlags::PtrAndFlags):
+        (WTF::PtrAndFlags::operator!):
+        (WTF::PtrAndFlags::operator->):
+            - Add ! and -> operators, add constuctor with pointer argument.
+
+2009-07-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fixed failing tests seen on Windows buildbot.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::): Use "int" instead of "bool" to guarantee a 32-bit result,
+        regardless of compiler. gcc on mac uses 32-bit values for bool,
+        but gcc on linux and MSVC on Windows use 8-bit values.
+
+2009-07-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: added missing symbols on Windows.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-07-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: removed stale symbols on Windows.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+=== End merge of nitro-extreme branch 2009-07-30 ===
+
+2009-07-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Fixed a post-review typo in r46066 that caused tons of test failures.
+        
+        SunSpider reports no change.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray): Initialize the full vector capacity, to avoid
+        uninitialized members at the end.
+
+2009-07-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows WebKit build fix: Added some missing exports.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-07-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Get the branch working on windows.
+        https://bugs.webkit.org/show_bug.cgi?id=27391
+        
+        SunSpider says 0.3% faster.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: Updated
+        MSVC export lists to fix linker errors.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Added / removed
+        new / old project files.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines): Used #pragma pack to tell
+        MSVC that these structures represent actual memory layout, and should not be
+        automatically aligned. Changed the return value load to load a 64bit quantity
+        into the canonical registers.
+
+        * jit/JIT.h: Moved OBJECT_OFFSETOF definition to StdLibExtras.h because
+        it's needed by more than just the JIT, and it supplements a standard library
+        macro (offsetof).
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame): Fixed an incorrectly signed
+        cast to resolve an MSVC warning.
+
+        * jit/JITStubs.h: Used #pragma pack to tell MSVC that these structures
+        represent actual memory layout, and should not be automatically aligned. 
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray): Replaced memset_pattern8 with a for loop, since
+        memset_pattern8 is not portable. (I verified that this version of the loop
+        gives the best performance / generated code in GCC.)
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::JSObject): Removed accidental usage of FIELD_OFFSET --
+        OBJECT_OFFSETOF is our new macro name. (FIELD_OFFSET conflicts with a
+        definition in winnt.h.)
+
+        * runtime/JSValue.cpp: Added some headers needed by non-all-in-one builds.
+        
+        * runtime/JSValue.h:
+        (JSC::JSValue::): Made the tag signed, to match MSVC's signed enum values.
+        (GCC doesn't seem to care one way or the other.)
+
+        * wtf/MainThread.cpp: Moved the StdLibExtras.h #include -- I did this a
+        while ago to resolve a conflict with winnt.h. I can't remember if it's truly
+        still needed, but what the heck.
+
+        * wtf/StdLibExtras.h: Moved OBJECT_OFFSETOF definition here.
+
+2009-07-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig (?).
+        
+        Fixed an assertion seen during the stress test.
+        
+        Don't assume that, if op1 is constant, op2 is not, and vice versa. Sadly,
+        not all constants get folded.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+
+2009-07-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Include op_convert_this in result caching.
+        
+        No change on SunSpider or v8.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_convert_this):
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::): Made the op_convert_this JIT stub return an EncodedJSValue, so
+        to maintain the result caching contract that { tag, payload } can be
+        found in { regT1, regT0 }.
+
+2009-07-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Implemented result chaining.
+        
+        1% faster on SunSpider. 4%-5% faster on v8.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::move):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movl_rr): Added an optimization to eliminate
+        no-op mov instructions, to simplify chaining.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        * jit/JIT.h: Added data members and helper functions for recording
+        chained results. We record both a mapping from virtual to machine register
+        and the opcode for which the mapping is valid, to help ensure that the
+        mapping isn't used after the mapped register has been stomped by other
+        instructions.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCallVarargsSlowCase):
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_construct_verify):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase): Chain function call results.
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitLoadTag):
+        (JSC::JIT::emitLoadPayload):
+        (JSC::JIT::emitLoad):
+        (JSC::JIT::emitLoad2):
+        (JSC::JIT::isLabeled):
+        (JSC::JIT::map):
+        (JSC::JIT::unmap):
+        (JSC::JIT::isMapped):
+        (JSC::JIT::getMappedPayload):
+        (JSC::JIT::getMappedTag): Use helper functions when loading virtual
+        registers into machine registers, in case the loads can be eliminated
+        by chaining.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_mov):
+        (JSC::JIT::emit_op_end):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_get_global_var):
+        (JSC::JIT::emit_op_put_global_var):
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emit_op_jneq_ptr):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emit_op_catch): Chain results from these opcodes.
+
+        (JSC::JIT::emit_op_profile_will_call):
+        (JSC::JIT::emit_op_profile_did_call): Load the profiler into regT2 to
+        avoid stomping a chained result.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_get_by_id): Chain results from these opcodes.
+
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::addArgument): Always use { regT1, regT0 }, to facilitate
+        chaining.
+
+        (JSC::JITStubCall::call): Unmap all mapped registers, since our callee
+        stub might stomp them.
+
+2009-07-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Don't reload values in emitBinaryDoubleOp.
+
+        SunSpider reports a 0.6% progression. 
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emitBinaryDoubleOp):
+
+2009-07-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Convert op_div to load op1 and op2 up front.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_div):
+
+2009-07-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Don't emit code in emitBinaryDoubleOp if code is unreachable, observable
+        via an empty (unlinked) jumplist passed in.  This only effects op_jnless
+        and op_jnlesseq at present.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        (JSC::JIT::emitBinaryDoubleOp):
+
+2009-07-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Converted op_mod to put { tag, payload } in { regT1, regT0 }, and
+        tidied up its constant case.
+        
+        SunSpider reports a 0.2% regression, but a micro-benchmark of op_mod
+        shows a 12% speedup, and the SunSpider test that uses op_mod most should
+        benefit a lot from result caching in the end, since it almost always
+        performs (expression) % constant.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+
+2009-06-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Converted some more arithmetic ops to put { tag, payload } in
+        { regT1, regT0 }.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+
+2009-06-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Converted some more arithmetic ops to put { tag, payload } in
+        { regT1, regT0 }, and added a case for subtract constant.
+        
+        SunSpider says no change. v8 says 0.3% slower.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitSub32Constant):
+        (JSC::JIT::emitSlow_op_sub):
+
+2009-06-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove more uses of addressFor(), load double constants directly from
+        the constantpool in the CodeBlock, rather than from the register file.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emitBinaryDoubleOp):
+
+2009-06-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed a bug in postfix ops, where we would treat x = x++ and x = x--
+        as a no-op, even if x were not an int, and the ++/-- could have side-effects.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emitSlow_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emitSlow_op_post_dec):
+
+2009-06-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Converted some arithmetic ops to put { tag, payload } in
+        { regT1, regT0 }.
+        
+        SunSpider says 0.7% faster. v8 says no change.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emit_op_bitxor):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::isOperandConstantImmediateInt):
+        (JSC::JIT::getOperandConstantImmediateInt):
+
+2009-06-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Start removing cases of addressFor().
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_div):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitLoadDouble):
+        (JSC::JIT::emitLoadInt32ToDouble):
+        (JSC::JIT::emitStoreDouble):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+
+2009-06-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled back in my last patch with regression fixed.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emitSlow_op_resolve_global):
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emitSlow_op_neq):
+
+2009-06-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled out my last patch because it was a 2% SunSpider regression.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emitSlow_op_neq):
+
+2009-06-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin "Sam Weinig" Barraclough.
+        
+        Standardized the rest of our opcodes to put { tag, payload } in
+        { regT1, regT0 } where possible.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emitSlow_op_resolve_global):
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emitSlow_op_neq):
+
+2009-06-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Replace calls to store32(tagFor()) and store32(payloadFor())
+        with emitStoreInt32(), emitStoreBool(), and emitStoreCell().
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_negate):
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emitBitAnd32Constant):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emitBitOr32Constant):
+        (JSC::JIT::emit_op_bitxor):
+        (JSC::JIT::emitBitXor32Constant):
+        (JSC::JIT::emit_op_bitnot):
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emit_op_pre_inc):
+        (JSC::JIT::emit_op_pre_dec):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitSub32ConstantLeft):
+        (JSC::JIT::emitSub32ConstantRight):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emit_op_mod):
+        * jit/JITCall.cpp:
+        (JSC::JIT::emit_op_load_varargs):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitStoreInt32):
+        (JSC::JIT::emitStoreCell):
+        (JSC::JIT::emitStoreBool):
+        (JSC::JIT::emitStore):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_not):
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emitSlow_op_neq):
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::call):
+
+2009-06-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Standardized the rest of the property access instructions to put { tag,
+        payload } in { regT1, regT0 }.
+
+        Small v8 speedup, 0.2% SunSpider slowdown.
+
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitLoad):
+        (JSC::JIT::emitLoad2):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::patchPutByIdReplace):
+
+2009-06-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Various cleanups.
+        - Use fpRegT* instead of X86::xmm*.
+        - Use a switch statement in emitBinaryDoubleOp instead of a bunch of
+          if/elses.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_div):
+
+2009-06-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Add inline code dealing with doubles for op_jfalse and op_jtrue.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::):
+        (JSC::MacroAssemblerX86Common::zeroDouble):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+
+2009-06-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Standardized op_get_by_id to put { tag, payload } in { regT1, regT0 }.
+        
+        SunSpider and v8 report maybe 0.2%-0.4% regressions, but the optimization
+        this enables will win much more than that back.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+
+2009-06-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Standardized op_call to put { tag, payload } in { regT1, regT0 }.
+        
+        SunSpider and v8 report no change.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpConstructSetupArgs):
+        (JSC::JIT::compileOpCallVarargsSetupArgs):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+
+2009-06-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Handle multiplying by zero a little better by
+        inlining the case that both operands are non-negative
+        into the slowpath.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branchOr32):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+
+2009-06-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Optimize x++ to ++x inside for loops.
+        
+        Sadly, no measurable speedup, but this should help with result chaining.
+
+        * parser/Nodes.cpp:
+        (JSC::ForNode::emitBytecode):
+
+2009-06-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Standardized some more opcodes to put { tag, payload } in { regT1, regT0 }.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_bitnot):
+        (JSC::JIT::emit_op_post_inc):
+
+2009-06-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Standardized some more opcodes to put { tag, payload } in { regT1, regT0 }.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_bitnot):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emit_op_pre_inc):
+        (JSC::JIT::emitSlow_op_pre_inc):
+        (JSC::JIT::emit_op_pre_dec):
+        (JSC::JIT::emitSlow_op_pre_dec):
+
+2009-06-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Standardized some more opcodes to put { tag, payload } in { regT1, regT0 }.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_negate):
+        (JSC::JIT::emitSlow_op_negate):
+        * jit/JITCall.cpp:
+        (JSC::JIT::emit_op_construct_verify):
+        (JSC::JIT::emitSlow_op_construct_verify):
+
+2009-06-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Standardized some more opcodes to put { tag, payload } in { regT1, regT0 }.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_true):
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+
+2009-06-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig (sort of, maybe).
+        
+        Fixed some ASSERTs in http/tests/security.
+        
+        These ASSERTs were introduced by http://trac.webkit.org/changeset/45057,
+        but the underlying problem was actually older. http://trac.webkit.org/changeset/45057
+        just exposed the problem by enabling optimization in more cases.
+        
+        The ASSERTs fired because we tested PropertySlot::slotBase() for validity,
+        but slotBase() ASSERTs if it's invalid, so we would ASSERT before
+        the test could happen. Solution: Remove the ASSERT. Maybe it was valid
+        once, but it clearly goes against a pattern we've deployed of late.
+        
+        The underlying problem was that WebCore would re-use a PropertySlot in
+        the case of a forwarding access, and the second use would not completely
+        overwrite the first use. Solution: Make sure to overwrite m_offset when
+        setting a value on a PropertySlot. (Other values already get implicitly
+        overwritten during reuse.)
+
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::PropertySlot):
+        (JSC::PropertySlot::setValueSlot):
+        (JSC::PropertySlot::setValue):
+        (JSC::PropertySlot::setRegisterSlot):
+        (JSC::PropertySlot::setUndefined):
+        (JSC::PropertySlot::slotBase):
+        (JSC::PropertySlot::clearOffset):
+
+2009-06-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Enable JIT_OPTIMIZE_METHOD_CALLS on the branch, implementation matches current implemenatation in ToT.
+
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::emitSlow_op_method_check):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::compileGetByIdSlowCase):
+
+2009-06-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bit off a tiny bit more of standardizing opcode behavior to help with result
+        caching.
+        
+        SunSpider reports no change, v8 maybe a tiny speedup.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emitSlow_op_to_jsnumber):
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emitSlow_op_convert_this):
+
+2009-06-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bit off a tiny bit more of standardizing opcode behavior to help with result
+        caching -- including removing my old enemy, op_resolve_function, because
+        it was non-standard, and removing it felt better than helping it limp along.
+        
+        SunSpider reports no change, v8 maybe a tiny speedup.
+        
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emitSlow_op_to_primitive):
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * parser/Nodes.cpp:
+        (JSC::FunctionCallResolveNode::emitBytecode):
+
+2009-06-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Bit off a tiny bit of standardizing opcode behavior to help with result
+        caching.
+        
+        0.6% SunSpider speedup. 0.3% v8 speedup.
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitLoad): Accomodate a base register that overlaps with payload
+        by loading tag before payload, to avoid stomping base/payload.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_mov): Abide by the standard "tag in regT1, payload in
+        regT0" semantics.
+
+        (JSC::JIT::emit_op_get_global_var):
+        (JSC::JIT::emit_op_put_global_var): Ditto. Also, removed some irrelevent
+        loads while I was at it. The global object's "d" pointer never changes
+        after construction.
+
+2009-06-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove 'arguments' field from Register union (again).
+        This time do so without breaking tests (radical, I know).
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::optionalCalleeArguments):
+        (JSC::ExecState::setArgumentCount):
+        (JSC::ExecState::init):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments):
+        * interpreter/Register.h:
+        (JSC::Register::withInt):
+        (JSC::Register::):
+        (JSC::Register::Register):
+        (JSC::Register::i):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_tear_off_arguments):
+        * runtime/Arguments.h:
+        (JSC::JSActivation::copyRegisters):
+        (JSC::Register::arguments):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h:
+
+2009-06-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Removed some result register tracking cruft in preparation for a new
+        result tracking mechanism.
+        
+        SunSpider reports no change.
+
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::JmpDst::JmpDst): No need to track jump targets in
+        machine code; we already do this in bytecode.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        (JSC::JIT::emitTimeoutCheck): Make sure to save and restore the result
+        registers, so an opcode with a timeout check can still benefit from result
+        register caching.
+
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases): Removed calls to killLastResultRegister()
+        in preparation for something new.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitGetFromCallFrameHeaderPtr):
+        (JSC::JIT::emitGetFromCallFrameHeader32):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jmp):
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_jneq_ptr):
+        (JSC::JIT::emit_op_jsr):
+        (JSC::JIT::emit_op_sret):
+        (JSC::JIT::emit_op_jmp_scopes): ditto
+
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::JITStubCall):
+        (JSC::JITStubCall::getArgument): added a mechanism for reloading an argument
+        you passed to a JIT stub, for use in emitTimeoutCheck.
+
+2009-06-23  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove now-useless inplace variants of binary ops.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emit_op_bitxor):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emit_op_mul):
+
+2009-06-23  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Move off memory operands to aid in re-enabling result caching.
+
+        - No regression measured.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_negate):
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emitBitAnd32Constant):
+        (JSC::JIT::emitBitAnd32InPlace):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emitBitOr32Constant):
+        (JSC::JIT::emitBitOr32InPlace):
+        (JSC::JIT::emit_op_bitxor):
+        (JSC::JIT::emitBitXor32Constant):
+        (JSC::JIT::emitBitXor32InPlace):
+        (JSC::JIT::emit_op_bitnot):
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emit_op_pre_inc):
+        (JSC::JIT::emitSlow_op_pre_inc):
+        (JSC::JIT::emit_op_pre_dec):
+        (JSC::JIT::emitSlow_op_pre_dec):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emitAdd32InPlace):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emitSlowAdd32Constant):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitSlow_op_sub):
+        (JSC::JIT::emitSub32ConstantLeft):
+        (JSC::JIT::emitSub32ConstantRight):
+        (JSC::JIT::emitSub32InPlaceLeft):
+        (JSC::JIT::emitSub32InPlaceRight):
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitMul32InPlace):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emit_op_mod):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallVarargs):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emit_op_not):
+        (JSC::JIT::emit_op_jneq_ptr):
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emit_op_to_jsnumber):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+
+2009-06-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed some missing and/or misplaced labels in bytecode generation, so
+        we don't have to work around them in JIT code generation.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpSubroutine):
+        * parser/Nodes.cpp:
+        (JSC::TryNode::emitBytecode):
+
+2009-06-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        For member function calls, emit "this" directly into the "this" slot
+        for the function call, instead of moving it there later. This reduces
+        time spent in op_mov during certain calls, like "a.b.c()".
+        
+        1%-2% speedup on v8, mostly richards and delta-blue.
+
+        * parser/Nodes.cpp:
+        (JSC::FunctionCallDotNode::emitBytecode):
+
+2009-06-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove 'arguments' field from Register union.  Having JSCell derived types in the union is
+        dangerous since it opens the possibility for the field to be written as a raw pointer but
+        then read as a JSValue.  This will lead to statle data being read for the tag, which may
+        be dangerous.  Having removed Arguments* types form Register, all arguments objects must
+        always explicitly be stored in the register file as JSValues.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::optionalCalleeArguments):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments):
+        * interpreter/Register.h:
+        (JSC::Register::):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_tear_off_arguments):
+        * runtime/Arguments.h:
+        (JSC::JSActivation::copyRegisters):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h:
+
+2009-06-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Add back known this value optimization by abstracting
+        slow case if not JSCell jumps.
+
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCallVarargsSlowCase):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
+        (JSC::JIT::linkSlowCaseIfNotJSCell):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+
+2009-06-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed some of the regression in crypto-aes.js. (8.5% speedup in
+        crypto-aes.js.)
+        
+        SunSpider reports no change overall.
+        
+        Division was producing double results, which took the slow path through
+        array access code.
+        
+        Strangely, all my attempts at versions of this patch that modified array
+        access code to accept ints encoded as doubles along the fast or slow paths
+        were regressions. So I did this instead.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_div): When dividing an int by an int, go ahead and try
+        to turn the result into an int. Don't just do int division, though, because
+        testing shows it to be slower than SSE double division, and the corner
+        cases are pretty complicated / lengthy on top of that. Also, don't try
+        to canonicalize division of known tiny numerators into ints, since that's a
+        waste of time.
+
+2009-05-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed a regression caused by my recent fix for NaN.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitBinaryDoubleOp): Actually do the comparison in reverse
+        order, like the ChangeLog said we would, bokay?
+
+2009-05-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig and Oliver Hunt.
+        
+        Fixed two edge cases in %:
+        
+        - Don't do -2147483648 % x as a fast case, since you might do -2147483648 % -1,
+        which will signal a hardware exception due to overflow.
+
+        - In the case of a zero remainder, be sure to store negative zero if the
+        dividend was zero.
+        
+        SunSpider reports no change.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+
+2009-05-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Fixed a regression when comparing to NaN.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitBinaryDoubleOp): For op_jnless and op_jnless_eq, do the
+        comparison in reverse order, and jump if the result is below or 
+        below-or-equal. This ensures that we do jump in the case of NaN.
+
+2009-05-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        SunSpider says no change.
+        
+        Fixed regressions in fast/js/var-declarations-shadowing.html and
+        fast/js/equality.html, caused by recent == and != optimizations.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_eq): Don't treat "compare to string" as always
+        numeric or string comparison. If the second operand is an object, you
+        need to ToPrimitive it, and start all over again. Also, I wrote out each
+        of the possible cases explicitly, to cut down on redundant branching.
+
+2009-05-25  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix bug in fast/js/constant-folding.html where we were not negating
+        -0 properly.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_negate):
+
+2009-05-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Refactored new slow case codegen for == and !=.
+        
+        SunSpider reports no change, maybe a tiny speedup.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emitSlow_op_neq): Made a vptr comparison a *Ptr operation,
+        instead of *32, to make it portable to 64bit. Reorganized the string
+        and generic cases to make their control flow a little clearer.
+
+2009-05-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Optimized == and != for our new value representation -- especially for strings.
+        
+        14% speedup on date-format-tofte.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emitSlow_op_neq):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::JITStubCall):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_eq):
+        (JSC::JITStubs::cti_op_eq_strings):
+        (JSC::JITStubs::cti_op_call_eval):
+        * jit/JITStubs.h:
+        (JSC::):
+        * runtime/JSValue.h:
+
+2009-05-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix non-SSE enabled builds.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_add): Don't early return here, we still need to call the JIT stub.
+        (JSC::JIT::emitSlow_op_sub): Ditto.
+
+2009-05-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Here's a thought: let's not take a jit stub call just to multiply by 1,
+        bokay?
+        
+        imul doesn't set the zero flag, so to test for a zero result, we need
+        an explicit instruction. (Luckily, it does set the overflow flag, so
+        we can still use that.)
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emitMul32InPlace):
+
+2009-05-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey "Premature Commit" Garen.
+
+        Add back constant integer cases for op_add.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emitSlowAdd32Constant):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::getConstantOperandImmediateDouble):
+        (JSC::JIT::isOperandConstantImmediateDouble):
+
+2009-05-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Added fast double cases for op_jnless and op_jnlesseq.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::JumpList::jumps): New accesor, used by
+        addSlowCase.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::ucomisd_rm): New method for comparing register to
+        memory.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emit_op_div): Modified emitBinaryDoubleOp to accept comparison/jump
+        operations in addition to operations with explicit result registers.
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::addSlowCase): Added an "addSlowCase" for JumpLists, so clients
+        can track multiple jumps to the same slow case condition together.
+
+2009-05-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Implement op_negate inline fast cases.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::neg32):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::negl_m):
+        (JSC::X86Assembler::xorpd_rr):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_negate):
+        (JSC::JIT::emitSlow_op_negate):
+
+2009-05-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Update the patchOffsetGetByIdSlowCaseCall constant for the
+        case that OPCODE_SAMPLING is enabled.
+
+        * jit/JIT.h:
+
+2009-05-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added support for inline subtraction of doubles.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitSlow_op_sub):
+        (JSC::JIT::emitSlowSub32InPlaceLeft):
+        (JSC::JIT::emitBinaryDoubleOp):
+
+2009-05-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Added support for inline division.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::divsd_rr):
+        (JSC::X86Assembler::divsd_mr):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitBinaryOp):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emitSlow_op_div):
+
+2009-05-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added support for inline addition of doubles.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emitSlowAdd32InPlace):
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+
+2009-05-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Factored inline double operations into a helper function, so that we
+        can reuse this code for other math operations.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_mul):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+
+2009-05-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Added support for inline multiplication of doubles.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::cvtsi2sd_mr): New function, useful for loading an
+        int32 into a double register.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul): Filled out these cases for double arithmetic.
+
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::addressFor): New function, useful for addressing a JSValue's
+        full 64bits as a double.
+
+2009-05-19  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Implement and enable optimized calls.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines): Add ENABLE(JIT_OPTIMIZE_CALL) guards
+        around the the optimize call only trampolines (virtualCallPreLink and virtualCallLink).
+        Update the trampolines to account for the new JSValue representation.
+        (JSC::JIT::unlinkCall): Use NULL instead of JSValue noValue. 
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall): Update to account for the new JSValue representation
+        (JSC::JIT::compileOpCallSlowCase): Ditto.
+
+        * jit/JITStubs.h: Remove incorrect !ENABLE(JIT_OPTIMIZE_CALL) guard.
+
+        * wtf/Platform.h: Enable ENABLE_JIT_OPTIMIZE_CALL.
+
+2009-05-19  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Implement and enable optimized property access.
+
+        * assembler/AbstractMacroAssembler.h: Fix comment.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines): Remove array length trampoline
+        and implement the string length trampoline.
+        * jit/JIT.h: Add new constants for patch offsets.
+        * jit/JITInlineMethods.h: Remove FIELD_OFFSET which is now in StdLibExtras.h.
+        * jit/JITPropertyAccess.cpp: 
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::addArgument): Add version of addArgument that takes
+        two registers for the tag and payload.
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::JITStubs): Remove array length trampoline pointer.
+        (JSC::JITStubs::cti_op_get_by_id_self_fail): 
+        * jit/JITStubs.h:
+        * runtime/JSObject.h:
+        (JSC::JSObject::JSObject): Move m_inheritorID below the property storage
+        to align it to a 16 byte boundary.
+        * wtf/Platform.h: Enable ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS
+        * wtf/StdLibExtras.h: Move FIELD_OFFSET here.
+
+2009-05-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove unneeded ExecState parameter from the number JSValue constructors.
+
+        * runtime/JSValue.h:
+        (JSC::jsNumber):
+        (JSC::jsNaN):
+        (JSC::JSValue::JSValue):
+
+2009-05-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Implemented fast path for op_put_by_val when putting to arrays.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+
+2009-05-15  Geoffrey Garen  <ggaren@apple.com> (Mostly by Sam)
+
+        Reviewed by Sam Weinig.
+        
+        Implemented fast path for op_get_by_val when accessing array.
+
+        * jit/JIT.cpp:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+
+2009-05-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed a failure in fast/js/math-transforms.html caused by failing to
+        preserve -0 in multiplication.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::jz):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emitMul32Constant):
+        (JSC::JIT::emitMul32InPlace): Check both for overflow and for zero when
+        doing multiplication. Use a slow case to get these right.
+
+2009-05-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed a bug in the varargs calling convention.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallVarargs): Move the argument count into regT1,
+        since that's where ctiVirtualCall expects it to be.
+
+2009-05-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixed a small bug in instanceof's looping code.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof): NULL means the object has no prototype,
+        so only loop when *not* equal to NULL.
+
+2009-05-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed a small bug in instanceof's result writing code.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof): Make sure to fill out the payload bits
+        in all cases.
+
+2009-05-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Removed an invalid assertion in cti_op_urshift which
+        depended on a fast path for op_urshift which has
+        never existed.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_urshift):
+
+2009-05-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed loop_if_true, which had the same reversed test that jtrue had.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_true):
+
+2009-05-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        In op_neq, we apparently want to check that one value
+        does *not* equal another.  Go figure.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_neq):
+
+2009-05-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        The slow case of op_mod should call op_mod's jit stub,
+        not op_mul.  That would be dumb.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_mod):
+
+2009-05-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed problems when using 'arguments' due to a half-initialized register.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::setCalleeArguments):
+        (JSC::ExecState::init): Require a full JSValue when setting up the 
+        'arguments' virtual register, since this register is accessible from JIT
+        code and bytecode, and needs to be a true JSValue.
+
+        * interpreter/CallFrameClosure.h:
+        (JSC::CallFrameClosure::resetCallFrame): ditto
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): ditto
+
+        * interpreter/Register.h: Removed the constructor that allowed assignment
+        of a JSArguments* to a register. That is not safe. See above.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_create_arguments):
+        (JSC::JITStubs::cti_op_create_arguments_no_params): ditto
+
+2009-05-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        We really want to go to the slow case in op_jfalse and
+        op_jtrue if the value is *not* boolean. 
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+
+2009-05-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Flipped the condition when emitting a an op_loop_if_less or op_loop_if_lesseq
+        if the first operand is a constant.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emit_op_loop_if_lesseq):
+
+2009-05-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Added missing return in op_jnless and op_jnlesseq. 
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+
+2009-05-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Load constants into the the register file as a temporary measure to
+        aid bring up.  This allows us to use to treat constants like any
+        other virtual register.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_enter):
+        (JSC::JIT::emit_op_enter_with_activation):
+
+2009-05-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Implemented op_strict_eq. Original patch by Snowy, by way of Sam and Gavin.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::set8): Added set8, since it's slightly
+        faster than set32, and the new value representation usually doesn't
+        need set32.
+
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitLoadTag):
+        (JSC::JIT::emitLoadPayload): Added helper functions for dealing with
+        constants. Eventually, we should write special cases for all constants,
+        but these are helpful in the short term.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emitSlow_op_stricteq):
+        (JSC::JIT::emitSlow_op_nstricteq): teh opcodez.
+
+        * runtime/JSValue.h:
+        (JSC::JSValue::):
+        (JSC::JSValue::isDouble): Added a LowestTag for clarity.
+
+2009-05-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed some bugs in host function calls.
+        
+        testapi now passes!
+
+        * jit/JIT.cpp: Changed some registers around to avoid overwriting edx:eax,
+        which is how JSValues are now returned. Also changed the code that
+        passes thisValue to pass the full 64bits of the value. Also added
+        an #error compiler directive to other platform builds, since the JSValue
+        return signature probably won't return in edx:eax on those platforms,
+        and we'll have to investigate a solution.
+
+2009-05-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Removed parameters from functions that are intended never to use their
+        parameters.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+
+2009-05-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Ported op_instance_of from TOT. It's basically the same, but some register
+        stuff changed to memory stuff.
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutJITStubArgFromVirtualRegister):
+        (JSC::JIT::emitStore): Changed to use helper functions.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof): Ported from TOT.
+
+2009-05-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+        
+        Added a comment to explain an exception-handling subtelty that we found
+        hard to remember when reviewing my last patch.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_catch):
+
+2009-05-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Implemented try/catch.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_throw): Updated to use JITStackFrame abstraction.
+        (JSC::JIT::emit_op_catch): Filled out.
+
+2009-05-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Implemented op_loop_if_true, op_jfalse, op_jtrue, op_jeq_null and op_jneq_null
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_instanceof): Moved from below to be next to its
+        fast brother.
+
+        (JSC::JIT::emit_op_loop_if_true): Similar to the old version
+        in that it tries to do the integer case first and reduce the
+        number of jumps you might need to take.
+        (JSC::JIT::emitSlow_op_loop_if_true):
+
+        (JSC::JIT::emit_op_jfalse): Very similar to op_loop_if_true, only
+        the inverse and without a timeout check.
+        (JSC::JIT::emitSlow_op_jfalse):
+
+        (JSC::JIT::emit_op_jtrue): Very similar to op_loop_if_true except
+        without the timeout check.
+        (JSC::JIT::emitSlow_op_jtrue):
+
+        (JSC::JIT::emit_op_jeq_null): Very similar to the implementation
+        of op_eq, except it takes jumps instead of copying the condition
+        to a dst.
+        (JSC::JIT::emit_op_jneq_null): Ditto but for op_neq.
+
+2009-05-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Implemented op_call_varargs.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallVarargsSetupArgs):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::emit_op_call):
+        (JSC::JIT::emit_op_call_eval):
+        (JSC::JIT::emit_op_load_varargs):
+        (JSC::JIT::emit_op_call_varargs):
+        (JSC::JIT::emit_op_construct):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jneq_ptr):
+
+2009-05-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Implemented op_call_eval.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallVarargsSetupArgs):
+        (JSC::JIT::compileOpCall):
+        * jit/JITStubCall.h:
+        (JSC::CallEvalJITStub::CallEvalJITStub):
+
+2009-05-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Implemented op_not. (Gavin did most of the work!)
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_not):
+        (JSC::JIT::emitSlow_op_not):
+
+2009-05-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Implemented op_global_resolve.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emit_op_loop_if_lesseq): Added back accidentally removed
+        early returns. 
+
+        (JSC::JIT::emit_op_resolve_global):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_resolve_global): Pretty similar to the old code,
+        but we need two reads and a TimesEight step in order to account for the
+        64bit value size.
+
+        * jit/JITStubs.h:
+        (JSC::): Slightly tweaked this code to specialize for a JSGlobalObject*,
+        to avoid having to pass an irrelevant tag pointer to the stub.
+
+2009-05-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Implemented op_to_jsnumber.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emitSlow_op_to_jsnumber):
+
+2009-05-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Implemented op_convert_this.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emitSlow_op_convert_this):
+
+2009-05-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Got basic JS function and constructor calls working.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpCallVarargsSetupArgs):
+        (JSC::JIT::compileOpConstructSetupArgs):
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_construct_verify):
+        (JSC::JIT::emitSlow_op_construct_verify):
+        (JSC::JIT::emitSlow_op_call):
+        (JSC::JIT::emitSlow_op_call_eval):
+        (JSC::JIT::emitSlow_op_call_varargs):
+        (JSC::JIT::emitSlow_op_construct):
+        (JSC::JIT::compileOpCall): Filled out these cases, with call_eval #if'd out.
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutJITStubArgFromVirtualRegister):
+        (JSC::JIT::emitLoad): Restored some legacy "*CTIArg*" functions,
+        since I wanted to avoid the complexity of revamping the API here while
+        trying to bring it up. Eventually, we should re-remove all of these functions.
+
+        (JSC::JIT::recordJumpTarget): Removed unnecessary macro cruft. You will
+        not silence me, Sam Weinig! The world will know that you are a crufty,
+        crufty, crufty programmer!!!
+
+        * jit/JITOpcodes.cpp:
+        * jit/JITStubs.cpp:
+        (JSC::):
+        * jit/JITStubs.h: Changed up some offsets in the JITStackFrame class, since
+        and off-by-one error was causing stack misalignment.
+
+2009-05-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Implement op_eq_null and op_neq_null.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::set8):
+        (JSC::MacroAssemblerX86Common::setTest8):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_stricteq):
+        (JSC::JIT::emitSlow_op_stricteq):
+        (JSC::JIT::emit_op_nstricteq):
+        (JSC::JIT::emitSlow_op_nstricteq):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        * jsc.cpp:
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Implement op_new_error.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_error):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::addArgument): Add a version of addArgument
+        that takes a constant JSValue.
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove now unused emitGetVariableObjectRegister and emitPutVariableObjectRegister.
+
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Implement op_to_primitive and op_next_pname.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_construct_verify):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emitSlow_op_to_primitive):
+        (JSC::JIT::emitSlow_op_loop_if_true):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emit_op_next_pname):
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Add op_get_global_var, op_put_global_var, emit_op_get_scoped_var, emit_op_put_scoped_var and
+        op_unexpected_load.
+
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::tagFor):
+        (JSC::JIT::payloadFor):
+        (JSC::JIT::emitLoad):
+        (JSC::JIT::emitStore):
+        (JSC::JIT::emitLoadReturnValue):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_global_var):
+        (JSC::JIT::emit_op_put_global_var):
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_unexpected_load):
+
+2009-05-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added overflow handling to op_sub.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_sub):
+        (JSC::JIT::emitSlowSub32InPlaceLeft):
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove a function call by folding op_get_by_id and op_put_by_id into
+        their respective compile functions.
+
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Make JITStubCall work in 64bit by making the stack index
+        step dependent on the size of void*.
+
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::JITStubCall):
+        (JSC::JITStubCall::addArgument):
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Implement simple version of property access opcodes
+        which just call a stub functions.
+
+        * jit/JITOpcodes.cpp:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        (JSC::JIT::emit_op_put_by_index):
+        (JSC::JIT::emit_op_put_getter):
+        (JSC::JIT::emit_op_put_setter):
+        (JSC::JIT::emit_op_del_by_id):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::addArgument):
+        * jsc.cpp:
+
+2009-05-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Added work-around for XCode debugging echo problem.
+
+        * jsc.cpp:
+        (runInteractive):
+
+2009-05-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Added overflow handling to op_add.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emitSlowAdd32InPlace):
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Add slow cases for op_jnless or emit_op_jnlesseq.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Add implementations for op_jnless, emit_op_jnlesseq, op_loop_if_less and op_loop_if_lesseq.
+        No slow cases for op_jnless or emit_op_jnlesseq yet.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emitSlow_op_loop_if_less):
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emitSlow_op_loop_if_lesseq):
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Turn the RECORD_JUMP_TARGET macro into an inline function.
+
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::recordJumpTarget):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jmp):
+        (JSC::JIT::emit_op_jsr):
+        (JSC::JIT::emit_op_jmp_scopes):
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Add MacroAssemblerX86Common::set8 to fix the build.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::set8):
+
+2009-05-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Added overflow recovery for pre_inc and pre_dec.
+        
+        Turned some short-circuit code into early returns, as is the WebKit style.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emitSlow_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emitSlow_op_post_dec):
+        (JSC::JIT::emitSlow_op_pre_inc):
+        (JSC::JIT::emitSlow_op_pre_dec):
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Implement op_jmp, op_loop, op_eq and op_neq.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jmp):
+        (JSC::JIT::emit_op_loop):
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emitSlow_op_neq):
+        (JSC::JIT::emit_op_enter):
+        (JSC::JIT::emit_op_enter_with_activation):
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Implement the slow cases for arithmetic opcodes.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_lshift):
+        (JSC::JIT::emitSlow_op_rshift):
+        (JSC::JIT::emitSlow_op_bitand):
+        (JSC::JIT::emitSlow_op_bitor):
+        (JSC::JIT::emitSlow_op_bitxor):
+        (JSC::JIT::emitSlow_op_bitnot):
+        (JSC::JIT::emitSlow_op_sub):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emitSlow_op_mod):
+        (JSC::JIT::emit_op_mod):
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Implement op_bitnot.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::not32):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::notl_m):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_bitnot):
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Add arithmetic opcode implementations from the old nitro-extreme branch.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emitSlow_op_lshift):
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emitSlow_op_rshift):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emitBitAnd32Constant):
+        (JSC::JIT::emitBitAnd32InPlace):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emitSlow_op_bitor):
+        (JSC::JIT::emitBitOr32Constant):
+        (JSC::JIT::emitBitOr32InPlace):
+        (JSC::JIT::emit_op_bitxor):
+        (JSC::JIT::emitSlow_op_bitxor):
+        (JSC::JIT::emitBitXor32Constant):
+        (JSC::JIT::emitBitXor32InPlace):
+        (JSC::JIT::emit_op_bitnot):
+        (JSC::JIT::emitSlow_op_bitnot):
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emitSlow_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emitSlow_op_post_dec):
+        (JSC::JIT::emit_op_pre_inc):
+        (JSC::JIT::emitSlow_op_pre_inc):
+        (JSC::JIT::emit_op_pre_dec):
+        (JSC::JIT::emitSlow_op_pre_dec):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emitAdd32InPlace):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitSlow_op_sub):
+        (JSC::JIT::emitSub32ConstantLeft):
+        (JSC::JIT::emitSub32ConstantRight):
+        (JSC::JIT::emitSub32InPlaceLeft):
+        (JSC::JIT::emitSub32InPlaceRight):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emitMul32Constant):
+        (JSC::JIT::emitMul32InPlace):
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+        * jit/JITOpcodes.cpp:
+
+2009-05-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed JIT_OPTIMIZE_ARITHMETIC setting, since it was all about 32bit
+        value representations.
+        
+        Added JSAPIValueWrapper to the repository.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        * runtime/JSAPIValueWrapper.cpp: Added.
+        (JSC::JSAPIValueWrapper::toPrimitive):
+        (JSC::JSAPIValueWrapper::getPrimitiveNumber):
+        (JSC::JSAPIValueWrapper::toBoolean):
+        (JSC::JSAPIValueWrapper::toNumber):
+        (JSC::JSAPIValueWrapper::toString):
+        (JSC::JSAPIValueWrapper::toObject):
+        * runtime/JSAPIValueWrapper.h: Added.
+        (JSC::JSAPIValueWrapper::value):
+        (JSC::JSAPIValueWrapper::isAPIValueWrapper):
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        (JSC::jsAPIValueWrapper):
+        * wtf/Platform.h:
+
+2009-05-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Turned on the JIT and got it building and running the most trivial of
+        programs.
+        
+        All configurable optimizations are turned off, and a few opcodes are ad
+        hoc #if'd out.
+        
+        So far, I've only merged op_mov and op_end, but some stub-reliant
+        opcodes work as-is from TOT.
+        
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        * bytecode/CodeBlock.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emitSlow_op_lshift):
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emitSlow_op_rshift):
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emitSlow_op_bitand):
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emitSlow_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emitSlow_op_post_dec):
+        (JSC::JIT::emit_op_pre_inc):
+        (JSC::JIT::emitSlow_op_pre_inc):
+        (JSC::JIT::emit_op_pre_dec):
+        (JSC::JIT::emitSlow_op_pre_dec):
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emitSlow_op_mul):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpConstructSetupArgs):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::getConstantOperandImmediateInt):
+        (JSC::JIT::isOperandConstantImmediateInt):
+        (JSC::JIT::emitInitRegister):
+        (JSC::JIT::addSlowCase):
+        (JSC::JIT::addJump):
+        (JSC::JIT::emitJumpSlowToHot):
+        (JSC::JIT::tagFor):
+        (JSC::JIT::payloadFor):
+        (JSC::JIT::emitLoad):
+        (JSC::JIT::emitLoadReturnValue):
+        (JSC::JIT::emitStore):
+        (JSC::JIT::emitStoreReturnValue):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_mov):
+        (JSC::JIT::emit_op_end):
+        (JSC::JIT::emit_op_jmp):
+        (JSC::JIT::emit_op_loop):
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_get_global_var):
+        (JSC::JIT::emit_op_put_global_var):
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_tear_off_activation):
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_construct_verify):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emit_op_loop_if_true):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emit_op_not):
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_jneq_ptr):
+        (JSC::JIT::emit_op_unexpected_load):
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emit_op_bitnot):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emit_op_bitxor):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emit_op_throw):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emit_op_push_scope):
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emit_op_push_new_scope):
+        (JSC::JIT::emit_op_catch):
+        (JSC::JIT::emit_op_switch_imm):
+        (JSC::JIT::emit_op_switch_char):
+        (JSC::JIT::emit_op_switch_string):
+        (JSC::JIT::emit_op_new_error):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emit_op_profile_will_call):
+        (JSC::JIT::emit_op_profile_did_call):
+        (JSC::JIT::emitSlow_op_construct_verify):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emitSlow_op_loop_if_less):
+        (JSC::JIT::emitSlow_op_loop_if_lesseq):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        (JSC::JIT::emitSlow_op_not):
+        (JSC::JIT::emitSlow_op_instanceof):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emit_op_put_by_index):
+        (JSC::JIT::emit_op_put_getter):
+        (JSC::JIT::emit_op_put_setter):
+        (JSC::JIT::emit_op_del_by_id):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::JITStubCall):
+        (JSC::JITStubCall::addArgument):
+        (JSC::JITStubCall::call):
+        (JSC::JITStubCall::):
+        (JSC::CallEvalJITStub::CallEvalJITStub):
+        * jit/JITStubs.cpp:
+        (JSC::):
+        (JSC::JITStubs::cti_op_add):
+        (JSC::JITStubs::cti_op_pre_inc):
+        (JSC::JITStubs::cti_op_mul):
+        (JSC::JITStubs::cti_op_get_by_val):
+        (JSC::JITStubs::cti_op_get_by_val_string):
+        (JSC::JITStubs::cti_op_get_by_val_byte_array):
+        (JSC::JITStubs::cti_op_sub):
+        (JSC::JITStubs::cti_op_put_by_val):
+        (JSC::JITStubs::cti_op_put_by_val_array):
+        (JSC::JITStubs::cti_op_put_by_val_byte_array):
+        (JSC::JITStubs::cti_op_negate):
+        (JSC::JITStubs::cti_op_div):
+        (JSC::JITStubs::cti_op_pre_dec):
+        (JSC::JITStubs::cti_op_post_inc):
+        (JSC::JITStubs::cti_op_eq):
+        (JSC::JITStubs::cti_op_lshift):
+        (JSC::JITStubs::cti_op_bitand):
+        (JSC::JITStubs::cti_op_rshift):
+        (JSC::JITStubs::cti_op_bitnot):
+        (JSC::JITStubs::cti_op_mod):
+        (JSC::JITStubs::cti_op_neq):
+        (JSC::JITStubs::cti_op_post_dec):
+        (JSC::JITStubs::cti_op_urshift):
+        (JSC::JITStubs::cti_op_bitxor):
+        (JSC::JITStubs::cti_op_bitor):
+        (JSC::JITStubs::cti_op_switch_imm):
+        * jit/JITStubs.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::~JSFunction):
+        * runtime/JSValue.h:
+        (JSC::JSValue::payload):
+        * wtf/Platform.h:
+
+2009-05-07  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Add some new MacroAssembler and assembler functions that will be needed shortly.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::add32):
+        (JSC::MacroAssemblerX86Common::and32):
+        (JSC::MacroAssemblerX86Common::mul32):
+        (JSC::MacroAssemblerX86Common::neg32):
+        (JSC::MacroAssemblerX86Common::or32):
+        (JSC::MacroAssemblerX86Common::sub32):
+        (JSC::MacroAssemblerX86Common::xor32):
+        (JSC::MacroAssemblerX86Common::branchAdd32):
+        (JSC::MacroAssemblerX86Common::branchMul32):
+        (JSC::MacroAssemblerX86Common::branchSub32):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::addl_rm):
+        (JSC::X86Assembler::andl_mr):
+        (JSC::X86Assembler::andl_rm):
+        (JSC::X86Assembler::andl_im):
+        (JSC::X86Assembler::negl_r):
+        (JSC::X86Assembler::notl_r):
+        (JSC::X86Assembler::orl_rm):
+        (JSC::X86Assembler::orl_im):
+        (JSC::X86Assembler::subl_rm):
+        (JSC::X86Assembler::xorl_mr):
+        (JSC::X86Assembler::xorl_rm):
+        (JSC::X86Assembler::xorl_im):
+        (JSC::X86Assembler::imull_mr):
+
+2009-05-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Remove the NumberHeap.
+
+        * JavaScriptCore.exp:
+        * runtime/Collector.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::destroy):
+        (JSC::Heap::recordExtraCost):
+        (JSC::Heap::heapAllocate):
+        (JSC::Heap::markConservatively):
+        (JSC::Heap::sweep):
+        (JSC::Heap::collect):
+        (JSC::Heap::objectCount):
+        (JSC::Heap::statistics):
+        (JSC::typeName):
+        (JSC::Heap::isBusy):
+        * runtime/Collector.h:
+        (JSC::Heap::globalData):
+        * runtime/JSCell.h:
+
+2009-05-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Land initial commit of new number representation for 32 bit platforms,
+        with JIT disabled.
+
+        * API/APICast.h:
+        (toJS):
+        (toRef):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::hasInstance):
+        (JSC::::toNumber):
+        (JSC::::toString):
+        * API/tests/testapi.c:
+        (EvilExceptionObject_convertToType):
+        * AllInOneFile.cpp:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::valueToSourceString):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoad):
+        (JSC::BytecodeGenerator::emitUnexpectedLoad):
+        (JSC::keyForImmediateSwitch):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::Interpreter::privateExecute):
+        * parser/Nodes.cpp:
+        (JSC::ArrayNode::emitBytecode):
+        (JSC::processClauseList):
+        * runtime/ArgList.h:
+        * runtime/Collector.h:
+        (JSC::sizeof):
+        * runtime/DateMath.cpp:
+        * runtime/ExceptionHelpers.h:
+        * runtime/InitializeThreading.cpp:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+        (JSC::JSCell::isAPIValueWrapper):
+        (JSC::JSValue::isString):
+        (JSC::JSValue::isGetterSetter):
+        (JSC::JSValue::isObject):
+        (JSC::JSValue::getString):
+        (JSC::JSValue::getObject):
+        (JSC::JSValue::getCallData):
+        (JSC::JSValue::getConstructData):
+        (JSC::JSValue::getUInt32):
+        (JSC::JSValue::marked):
+        (JSC::JSValue::toPrimitive):
+        (JSC::JSValue::getPrimitiveNumber):
+        (JSC::JSValue::toBoolean):
+        (JSC::JSValue::toNumber):
+        (JSC::JSValue::toString):
+        (JSC::JSValue::needsThisConversion):
+        (JSC::JSValue::toThisString):
+        (JSC::JSValue::getJSNumber):
+        (JSC::JSValue::toObject):
+        (JSC::JSValue::toThisObject):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.h:
+        (JSC::Structure::prototypeForLookup):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt):
+        * runtime/JSImmediate.h:
+        * runtime/JSNumberCell.cpp: Removed.
+        * runtime/JSNumberCell.h: Removed.
+        * runtime/JSObject.h:
+        (JSC::JSValue::get):
+        (JSC::JSValue::put):
+        * runtime/JSString.h:
+        (JSC::JSValue::toThisJSString):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::toInteger):
+        (JSC::JSValue::toIntegerPreserveNaN):
+        (JSC::JSValue::toObjectSlowCase):
+        (JSC::JSValue::toThisObjectSlowCase):
+        (JSC::JSValue::synthesizeObject):
+        (JSC::JSValue::synthesizePrototype):
+        (JSC::JSValue::description):
+        (JSC::nonInlineNaN):
+        * runtime/JSValue.h:
+        (JSC::JSValue::):
+        (JSC::EncodedJSValueHashTraits::emptyValue):
+        (JSC::jsNaN):
+        (JSC::operator==):
+        (JSC::operator!=):
+        (JSC::toInt32):
+        (JSC::toUInt32):
+        (JSC::JSValue::encode):
+        (JSC::JSValue::decode):
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::operator bool):
+        (JSC::JSValue::operator==):
+        (JSC::JSValue::operator!=):
+        (JSC::JSValue::isUndefined):
+        (JSC::JSValue::isNull):
+        (JSC::JSValue::isUndefinedOrNull):
+        (JSC::JSValue::isCell):
+        (JSC::JSValue::isInt32):
+        (JSC::JSValue::isUInt32):
+        (JSC::JSValue::isDouble):
+        (JSC::JSValue::isTrue):
+        (JSC::JSValue::isFalse):
+        (JSC::JSValue::tag):
+        (JSC::JSValue::asInt32):
+        (JSC::JSValue::asUInt32):
+        (JSC::JSValue::asDouble):
+        (JSC::JSValue::asCell):
+        (JSC::JSValue::isNumber):
+        (JSC::JSValue::isBoolean):
+        (JSC::JSValue::getBoolean):
+        (JSC::JSValue::uncheckedGetNumber):
+        (JSC::JSValue::toJSNumber):
+        (JSC::JSValue::getNumber):
+        (JSC::JSValue::toInt32):
+        (JSC::JSValue::toUInt32):
+        * runtime/Operations.h:
+        (JSC::JSValue::equal):
+        (JSC::JSValue::equalSlowCaseInline):
+        (JSC::JSValue::strictEqual):
+        (JSC::JSValue::strictEqualSlowCaseInline):
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::jsAdd):
+        * runtime/PropertySlot.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncIndexOf):
+        * wtf/Platform.h:
+
+=== Start merge of nitro-extreme branch 2009-07-30 ===
+
+2009-07-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by George Staikos.
+
+        Resolve class/struct mixup in forward declarations
+        https://bugs.webkit.org/show_bug.cgi?id=27708
+
+        * API/JSClassRef.h:
+        * bytecode/SamplingTool.h:
+        * interpreter/Interpreter.h:
+        * jit/JIT.h:
+        * profiler/ProfileGenerator.h:
+        * profiler/Profiler.h:
+        * runtime/ClassInfo.h:
+        * runtime/ExceptionHelpers.h:
+        * runtime/JSByteArray.h:
+        * runtime/JSCell.h:
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.h:
+        * runtime/JSObject.h:
+        * runtime/JSString.h:
+
+2009-07-28  Ada Chan  <adachan@apple.com>        
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27236
+        - Implement TCMalloc_SystemRelease and TCMalloc_SystemCommit for Windows.
+        - Use a background thread to periodically scavenge memory to release back to the system.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::init):
+        (WTF::TCMalloc_PageHeap::runScavengerThread):
+        (WTF::TCMalloc_PageHeap::scavenge):
+        (WTF::TCMalloc_PageHeap::shouldContinueScavenging):
+        (WTF::TCMalloc_PageHeap::New):
+        (WTF::TCMalloc_PageHeap::AllocLarge):
+        (WTF::TCMalloc_PageHeap::Delete):
+        (WTF::TCMalloc_PageHeap::GrowHeap):
+        (WTF::sleep):
+        (WTF::TCMalloc_PageHeap::scavengerThread):
+        * wtf/TCSystemAlloc.cpp:
+        (TCMalloc_SystemRelease):
+        (TCMalloc_SystemCommit):
+        * wtf/TCSystemAlloc.h:
+
 2009-07-28  Xan Lopez  <xlopez@igalia.com>
 
         Add new files, fixes distcheck.
@@ -429,8 +7385,6 @@
 
 2009-07-20  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by NOBODY (Build fix).
-
         Build fix attempt #2
 
         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
@@ -438,8 +7392,6 @@
 
 2009-07-20  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by NOBODY (Build fix).
-
         Build fix attempt #1
 
         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
@@ -1455,8 +8407,6 @@
 
 2009-07-09  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by NOBODY (Build fix).
-
         * interpreter/Interpreter.cpp:
         (JSC::Interpreter::privateExecute):
 
@@ -2091,8 +9041,6 @@
 
 2009-06-21  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by NOBODY (Build fix).
-
         Remove dead code.
 
         * runtime/LiteralParser.cpp:
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.gypi b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.gypi
index 5a75ab7..15a0c0f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.gypi
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.gypi
@@ -255,6 +255,7 @@
             'runtime/JSString.cpp',
             'runtime/JSString.h',
             'runtime/JSType.h',
+            'runtime/JSTypeInfo.h',
             'runtime/JSValue.cpp',
             'runtime/JSValue.h',
             'runtime/JSVariableObject.cpp',
@@ -265,6 +266,9 @@
             'runtime/LiteralParser.h',
             'runtime/Lookup.cpp',
             'runtime/Lookup.h',
+            'runtime/MarkStack.cpp',
+            'runtime/MarkStack.h',
+            'runtime/MarkStackWin.cpp',
             'runtime/MathObject.cpp',
             'runtime/MathObject.h',
             'runtime/NativeErrorConstructor.cpp',
@@ -284,6 +288,8 @@
             'runtime/ObjectPrototype.h',
             'runtime/Operations.cpp',
             'runtime/Operations.h',
+            'runtime/PropertyDescriptor.cpp',
+            'runtime/PropertyDescriptor.h',
             'runtime/PropertyMapHashTable.h',
             'runtime/PropertyNameArray.cpp',
             'runtime/PropertyNameArray.h',
@@ -323,7 +329,6 @@
             'runtime/TimeoutChecker.cpp',
             'runtime/TimeoutChecker.h',
             'runtime/Tracing.h',
-            'runtime/JSTypeInfo.h',
             'runtime/UString.cpp',
             'runtime/UString.h',
             'wrec/CharacterClass.cpp',
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
index 85645be..cbd7dbe 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
@@ -105,11 +105,13 @@ SOURCES += \
     runtime/JSNotAnObject.cpp \
     runtime/JSONObject.cpp \
     runtime/LiteralParser.cpp \
+    runtime/MarkStack.cpp \
     runtime/TimeoutChecker.cpp \
     bytecode/CodeBlock.cpp \
     bytecode/StructureStubInfo.cpp \
     bytecode/JumpTable.cpp \
     assembler/ARMAssembler.cpp \
+    assembler/MacroAssemblerARM.cpp \
     jit/JIT.cpp \
     jit/JITCall.cpp \
     jit/JITArithmetic.cpp \
@@ -128,8 +130,13 @@ SOURCES += \
     yarr/RegexJIT.cpp \
     interpreter/RegisterFile.cpp
 
-win32-*|wince*: SOURCES += jit/ExecutableAllocatorWin.cpp
-else: SOURCES += jit/ExecutableAllocatorPosix.cpp
+win32-*|wince* {
+    SOURCES += jit/ExecutableAllocatorWin.cpp \
+               runtime/MarkStackWin.cpp
+} else {
+    SOURCES += jit/ExecutableAllocatorPosix.cpp \
+               runtime/MarkStackPosix.cpp
+}
 
 # AllInOneFile.cpp helps gcc analize and optimize code
 # Other compilers may be able to do this at link time
@@ -159,6 +166,7 @@ SOURCES += \
     runtime/ErrorInstance.cpp \
     runtime/ErrorPrototype.cpp \
     interpreter/CallFrame.cpp \
+    runtime/Executable.cpp \
     runtime/FunctionConstructor.cpp \
     runtime/FunctionPrototype.cpp \
     runtime/GetterSetter.cpp \
@@ -167,6 +175,7 @@ SOURCES += \
     runtime/InternalFunction.cpp \
     runtime/Completion.cpp \
     runtime/JSArray.cpp \
+    runtime/JSAPIValueWrapper.cpp \
     runtime/JSByteArray.cpp \
     runtime/JSCell.cpp \
     runtime/JSFunction.cpp \
@@ -192,6 +201,7 @@ SOURCES += \
     runtime/Operations.cpp \
     parser/Parser.cpp \
     parser/ParserArena.cpp \
+    runtime/PropertyDescriptor.cpp \
     runtime/PropertyNameArray.cpp \
     runtime/PropertySlot.cpp \
     runtime/PrototypeFunction.cpp \
@@ -216,8 +226,7 @@ SOURCES += \
     wtf/DateMath.cpp \
     wtf/FastMalloc.cpp \
     wtf/Threading.cpp \
-    wtf/qt/MainThreadQt.cpp \
-    parser/SourcePoolQt.cpp
+    wtf/qt/MainThreadQt.cpp
 
 !contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
     SOURCES += wtf/qt/ThreadingQt.cpp
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro
index f881c05..0cd2e1a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro
@@ -33,10 +33,6 @@ INCLUDEPATH += $$GENERATED_SOURCES_DIR
     }
 }
 
-CONFIG -= warn_on
-*-g++*:QMAKE_CXXFLAGS += -Wreturn-type -fno-strict-aliasing
-#QMAKE_CXXFLAGS += -Wall -Wno-undef -Wno-unused-parameter
-
 CONFIG(release):!CONFIG(QTDIR_build) {
     contains(QT_CONFIG, reduce_exports):CONFIG += hide_symbols
     unix:contains(QT_CONFIG, reduce_relocations):CONFIG += bsymbolic_functions
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.cpp b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.cpp
index dafc482..77d7a53 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.cpp
@@ -49,11 +49,11 @@ ARMWord* ARMAssembler::getLdrImmAddress(ARMWord* insn, uint32_t* constPool)
         return reinterpret_cast<ARMWord*>(addr - (*insn & SDT_OFFSET_MASK));
 }
 
-void ARMAssembler::linkBranch(void* code, JmpSrc from, void* to)
+void ARMAssembler::linkBranch(void* code, JmpSrc from, void* to, int useConstantPool)
 {
     ARMWord* insn = reinterpret_cast<ARMWord*>(code) + (from.m_offset / sizeof(ARMWord));
 
-    if (!from.m_latePatch) {
+    if (!useConstantPool) {
         int diff = reinterpret_cast<ARMWord*>(to) - reinterpret_cast<ARMWord*>(insn + 2);
 
         if ((diff <= BOFFSET_MAX && diff >= BOFFSET_MIN)) {
@@ -291,10 +291,10 @@ void ARMAssembler::dataTransfer32(bool isLoad, RegisterID srcDst, RegisterID bas
         if (offset <= 0xfff)
             dtr_u(isLoad, srcDst, base, offset);
         else if (offset <= 0xfffff) {
-            add_r(ARM::S0, base, OP2_IMM | (offset >> 12) | (10 << 8));
-            dtr_u(isLoad, srcDst, ARM::S0, offset & 0xfff);
+            add_r(ARMRegisters::S0, base, OP2_IMM | (offset >> 12) | (10 << 8));
+            dtr_u(isLoad, srcDst, ARMRegisters::S0, offset & 0xfff);
         } else {
-            ARMWord reg = getImm(offset, ARM::S0);
+            ARMWord reg = getImm(offset, ARMRegisters::S0);
             dtr_ur(isLoad, srcDst, base, reg);
         }
     } else {
@@ -302,10 +302,10 @@ void ARMAssembler::dataTransfer32(bool isLoad, RegisterID srcDst, RegisterID bas
         if (offset <= 0xfff)
             dtr_d(isLoad, srcDst, base, offset);
         else if (offset <= 0xfffff) {
-            sub_r(ARM::S0, base, OP2_IMM | (offset >> 12) | (10 << 8));
-            dtr_d(isLoad, srcDst, ARM::S0, offset & 0xfff);
+            sub_r(ARMRegisters::S0, base, OP2_IMM | (offset >> 12) | (10 << 8));
+            dtr_d(isLoad, srcDst, ARMRegisters::S0, offset & 0xfff);
         } else {
-            ARMWord reg = getImm(offset, ARM::S0);
+            ARMWord reg = getImm(offset, ARMRegisters::S0);
             dtr_dr(isLoad, srcDst, base, reg);
         }
     }
@@ -319,30 +319,70 @@ void ARMAssembler::baseIndexTransfer32(bool isLoad, RegisterID srcDst, RegisterI
     op2 = lsl(index, scale);
 
     if (offset >= 0 && offset <= 0xfff) {
-        add_r(ARM::S0, base, op2);
-        dtr_u(isLoad, srcDst, ARM::S0, offset);
+        add_r(ARMRegisters::S0, base, op2);
+        dtr_u(isLoad, srcDst, ARMRegisters::S0, offset);
         return;
     }
     if (offset <= 0 && offset >= -0xfff) {
-        add_r(ARM::S0, base, op2);
-        dtr_d(isLoad, srcDst, ARM::S0, -offset);
+        add_r(ARMRegisters::S0, base, op2);
+        dtr_d(isLoad, srcDst, ARMRegisters::S0, -offset);
         return;
     }
 
-    moveImm(offset, ARM::S0);
-    add_r(ARM::S0, ARM::S0, op2);
-    dtr_ur(isLoad, srcDst, base, ARM::S0);
+    ldr_un_imm(ARMRegisters::S0, offset);
+    add_r(ARMRegisters::S0, ARMRegisters::S0, op2);
+    dtr_ur(isLoad, srcDst, base, ARMRegisters::S0);
+}
+
+void ARMAssembler::doubleTransfer(bool isLoad, FPRegisterID srcDst, RegisterID base, int32_t offset)
+{
+    if (offset & 0x3) {
+        if (offset <= 0x3ff && offset >= 0) {
+            fdtr_u(isLoad, srcDst, base, offset >> 2);
+            return;
+        }
+        if (offset <= 0x3ffff && offset >= 0) {
+            add_r(ARMRegisters::S0, base, OP2_IMM | (offset >> 10) | (11 << 8));
+            fdtr_u(isLoad, srcDst, ARMRegisters::S0, (offset >> 2) & 0xff);
+            return;
+        }
+        offset = -offset;
+
+        if (offset <= 0x3ff && offset >= 0) {
+            fdtr_d(isLoad, srcDst, base, offset >> 2);
+            return;
+        }
+        if (offset <= 0x3ffff && offset >= 0) {
+            sub_r(ARMRegisters::S0, base, OP2_IMM | (offset >> 10) | (11 << 8));
+            fdtr_d(isLoad, srcDst, ARMRegisters::S0, (offset >> 2) & 0xff);
+            return;
+        }
+        offset = -offset;
+    }
+
+    ldr_un_imm(ARMRegisters::S0, offset);
+    add_r(ARMRegisters::S0, ARMRegisters::S0, base);
+    fdtr_u(isLoad, srcDst, ARMRegisters::S0, 0);
 }
 
 void* ARMAssembler::executableCopy(ExecutablePool* allocator)
 {
+    // 64-bit alignment is required for next constant pool and JIT code as well
+    m_buffer.flushWithoutBarrier(true);
+    if (m_buffer.uncheckedSize() & 0x7)
+        bkpt(0);
+
     char* data = reinterpret_cast<char*>(m_buffer.executableCopy(allocator));
 
     for (Jumps::Iterator iter = m_jumps.begin(); iter != m_jumps.end(); ++iter) {
-        ARMWord* ldrAddr = reinterpret_cast<ARMWord*>(data + *iter);
-        ARMWord* offset = getLdrImmAddress(ldrAddr);
-        if (*offset != 0xffffffff)
-            linkBranch(data, JmpSrc(*iter), data + *offset);
+        // The last bit is set if the constant must be placed on constant pool.
+        int pos = (*iter) & (~0x1);
+        ARMWord* ldrAddr = reinterpret_cast<ARMWord*>(data + pos);
+        ARMWord offset = *getLdrImmAddress(ldrAddr);
+        if (offset != 0xffffffff) {
+            JmpSrc jmpSrc(pos);
+            linkBranch(data, jmpSrc, data + offset, ((*iter) & 1));
+        }
     }
 
     return data;
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.h
index d6bb43e..0b04bb4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.h
@@ -35,44 +35,49 @@
 #include <wtf/Assertions.h>
 namespace JSC {
 
-typedef uint32_t ARMWord;
-
-namespace ARM {
-    typedef enum {
-        r0 = 0,
-        r1,
-        r2,
-        r3,
-        S0 = r3,
-        r4,
-        r5,
-        r6,
-        r7,
-        r8,
-        S1 = r8,
-        r9,
-        r10,
-        r11,
-        r12,
-        r13,
-        sp = r13,
-        r14,
-        lr = r14,
-        r15,
-        pc = r15
-    } RegisterID;
-
-    typedef enum {
-        fp0 //FIXME
-    } FPRegisterID;
-} // namespace ARM
+    typedef uint32_t ARMWord;
+
+    namespace ARMRegisters {
+        typedef enum {
+            r0 = 0,
+            r1,
+            r2,
+            r3,
+            S0 = r3,
+            r4,
+            r5,
+            r6,
+            r7,
+            r8,
+            S1 = r8,
+            r9,
+            r10,
+            r11,
+            r12,
+            r13,
+            sp = r13,
+            r14,
+            lr = r14,
+            r15,
+            pc = r15
+        } RegisterID;
+
+        typedef enum {
+            d0,
+            d1,
+            d2,
+            d3,
+            SD0 = d3
+        } FPRegisterID;
+
+    } // namespace ARMRegisters
 
     class ARMAssembler {
     public:
-        typedef ARM::RegisterID RegisterID;
-        typedef ARM::FPRegisterID FPRegisterID;
+        typedef ARMRegisters::RegisterID RegisterID;
+        typedef ARMRegisters::FPRegisterID FPRegisterID;
         typedef AssemblerBufferWithConstantPool<2048, 4, 4, ARMAssembler> ARMBuffer;
-        typedef WTF::SegmentedVector<int, 64> Jumps;
+        typedef SegmentedVector<int, 64> Jumps;
 
         ARMAssembler() { }
 
@@ -115,13 +120,21 @@ namespace ARM {
             MVN = (0xf << 21),
             MUL = 0x00000090,
             MULL = 0x00c00090,
+            FADDD = 0x0e300b00,
+            FSUBD = 0x0e300b40,
+            FMULD = 0x0e200b00,
+            FCMPD = 0x0eb40b40,
             DTR = 0x05000000,
             LDRH = 0x00100090,
             STRH = 0x00000090,
             STMDB = 0x09200000,
             LDMIA = 0x08b00000,
+            FDTR = 0x0d000b00,
             B = 0x0a000000,
             BL = 0x0b000000,
+            FMSR = 0x0e000a10,
+            FSITOD = 0x0eb80bc0,
+            FMSTAT = 0x0ef1fa10,
 #if ARM_ARCH_VERSION >= 5
             CLZ = 0x016f0f10,
             BKPT = 0xe120070,
@@ -167,20 +180,16 @@ namespace ARM {
         public:
             JmpSrc()
                 : m_offset(-1)
-                , m_latePatch(false)
             {
             }
 
-            void enableLatePatch() { m_latePatch = true; }
         private:
             JmpSrc(int offset)
                 : m_offset(offset)
-                , m_latePatch(false)
             {
             }
 
-            int m_offset : 31;
-            int m_latePatch : 1;
+            int m_offset;
         };
 
         class JmpDst {
@@ -321,12 +330,12 @@ namespace ARM {
 
         void mov_r(int rd, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | MOV, rd, ARM::r0, op2);
+            emitInst(static_cast<ARMWord>(cc) | MOV, rd, ARMRegisters::r0, op2);
         }
 
         void movs_r(int rd, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | MOV | SET_CC, rd, ARM::r0, op2);
+            emitInst(static_cast<ARMWord>(cc) | MOV | SET_CC, rd, ARMRegisters::r0, op2);
         }
 
         void bic_r(int rd, int rn, ARMWord op2, Condition cc = AL)
@@ -341,12 +350,12 @@ namespace ARM {
 
         void mvn_r(int rd, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | MVN, rd, ARM::r0, op2);
+            emitInst(static_cast<ARMWord>(cc) | MVN, rd, ARMRegisters::r0, op2);
         }
 
         void mvns_r(int rd, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | MVN | SET_CC, rd, ARM::r0, op2);
+            emitInst(static_cast<ARMWord>(cc) | MVN | SET_CC, rd, ARMRegisters::r0, op2);
         }
 
         void mul_r(int rd, int rn, int rm, Condition cc = AL)
@@ -364,14 +373,34 @@ namespace ARM {
             m_buffer.putInt(static_cast<ARMWord>(cc) | MULL | RN(rdhi) | RD(rdlo) | RS(rn) | RM(rm));
         }
 
+        void faddd_r(int dd, int dn, int dm, Condition cc = AL)
+        {
+            emitInst(static_cast<ARMWord>(cc) | FADDD, dd, dn, dm);
+        }
+
+        void fsubd_r(int dd, int dn, int dm, Condition cc = AL)
+        {
+            emitInst(static_cast<ARMWord>(cc) | FSUBD, dd, dn, dm);
+        }
+
+        void fmuld_r(int dd, int dn, int dm, Condition cc = AL)
+        {
+            emitInst(static_cast<ARMWord>(cc) | FMULD, dd, dn, dm);
+        }
+
+        void fcmpd_r(int dd, int dm, Condition cc = AL)
+        {
+            emitInst(static_cast<ARMWord>(cc) | FCMPD, dd, 0, dm);
+        }
+
         void ldr_imm(int rd, ARMWord imm, Condition cc = AL)
         {
-            m_buffer.putIntWithConstantInt(static_cast<ARMWord>(cc) | DTR | DT_LOAD | DT_UP | RN(ARM::pc) | RD(rd), imm, true);
+            m_buffer.putIntWithConstantInt(static_cast<ARMWord>(cc) | DTR | DT_LOAD | DT_UP | RN(ARMRegisters::pc) | RD(rd), imm, true);
         }
 
         void ldr_un_imm(int rd, ARMWord imm, Condition cc = AL)
         {
-            m_buffer.putIntWithConstantInt(static_cast<ARMWord>(cc) | DTR | DT_LOAD | DT_UP | RN(ARM::pc) | RD(rd), imm);
+            m_buffer.putIntWithConstantInt(static_cast<ARMWord>(cc) | DTR | DT_LOAD | DT_UP | RN(ARMRegisters::pc) | RD(rd), imm);
         }
 
         void dtr_u(bool isLoad, int rd, int rb, ARMWord op2, Condition cc = AL)
@@ -414,26 +443,53 @@ namespace ARM {
             emitInst(static_cast<ARMWord>(cc) | STRH | HDT_UH | DT_UP | DT_PRE, rd, rn, rm);
         }
 
+        void fdtr_u(bool isLoad, int rd, int rb, ARMWord op2, Condition cc = AL)
+        {
+            ASSERT(op2 <= 0xff);
+            emitInst(static_cast<ARMWord>(cc) | FDTR | DT_UP | (isLoad ? DT_LOAD : 0), rd, rb, op2);
+        }
+
+        void fdtr_d(bool isLoad, int rd, int rb, ARMWord op2, Condition cc = AL)
+        {
+            ASSERT(op2 <= 0xff);
+            emitInst(static_cast<ARMWord>(cc) | FDTR | (isLoad ? DT_LOAD : 0), rd, rb, op2);
+        }
+
         void push_r(int reg, Condition cc = AL)
         {
             ASSERT(ARMWord(reg) <= 0xf);
-            m_buffer.putInt(cc | DTR | DT_WB | RN(ARM::sp) | RD(reg) | 0x4);
+            m_buffer.putInt(cc | DTR | DT_WB | RN(ARMRegisters::sp) | RD(reg) | 0x4);
         }
 
         void pop_r(int reg, Condition cc = AL)
         {
             ASSERT(ARMWord(reg) <= 0xf);
-            m_buffer.putInt(cc | (DTR ^ DT_PRE) | DT_LOAD | DT_UP | RN(ARM::sp) | RD(reg) | 0x4);
+            m_buffer.putInt(cc | (DTR ^ DT_PRE) | DT_LOAD | DT_UP | RN(ARMRegisters::sp) | RD(reg) | 0x4);
         }
 
         inline void poke_r(int reg, Condition cc = AL)
         {
-            dtr_d(false, ARM::sp, 0, reg, cc);
+            dtr_d(false, ARMRegisters::sp, 0, reg, cc);
         }
 
         inline void peek_r(int reg, Condition cc = AL)
         {
-            dtr_u(true, reg, ARM::sp, 0, cc);
+            dtr_u(true, reg, ARMRegisters::sp, 0, cc);
+        }
+
+        void fmsr_r(int dd, int rn, Condition cc = AL)
+        {
+            emitInst(static_cast<ARMWord>(cc) | FMSR, rn, dd, 0);
+        }
+
+        void fsitod_r(int dd, int dm, Condition cc = AL)
+        {
+            emitInst(static_cast<ARMWord>(cc) | FSITOD, dd, 0, dm);
+        }
+
+        void fmstat(Condition cc = AL)
+        {
+            m_buffer.putInt(static_cast<ARMWord>(cc) | FMSTAT);
         }
 
 #if ARM_ARCH_VERSION >= 5
@@ -449,49 +505,49 @@ namespace ARM {
             m_buffer.putInt(BKPT | ((value & 0xff0) << 4) | (value & 0xf));
 #else
             // Cannot access to Zero memory address
-            dtr_dr(true, ARM::S0, ARM::S0, ARM::S0);
+            dtr_dr(true, ARMRegisters::S0, ARMRegisters::S0, ARMRegisters::S0);
 #endif
         }
 
         static ARMWord lsl(int reg, ARMWord value)
         {
-            ASSERT(reg <= ARM::pc);
+            ASSERT(reg <= ARMRegisters::pc);
             ASSERT(value <= 0x1f);
             return reg | (value << 7) | 0x00;
         }
 
         static ARMWord lsr(int reg, ARMWord value)
         {
-            ASSERT(reg <= ARM::pc);
+            ASSERT(reg <= ARMRegisters::pc);
             ASSERT(value <= 0x1f);
             return reg | (value << 7) | 0x20;
         }
 
         static ARMWord asr(int reg, ARMWord value)
         {
-            ASSERT(reg <= ARM::pc);
+            ASSERT(reg <= ARMRegisters::pc);
             ASSERT(value <= 0x1f);
             return reg | (value << 7) | 0x40;
         }
 
         static ARMWord lsl_r(int reg, int shiftReg)
         {
-            ASSERT(reg <= ARM::pc);
-            ASSERT(shiftReg <= ARM::pc);
+            ASSERT(reg <= ARMRegisters::pc);
+            ASSERT(shiftReg <= ARMRegisters::pc);
             return reg | (shiftReg << 8) | 0x10;
         }
 
         static ARMWord lsr_r(int reg, int shiftReg)
         {
-            ASSERT(reg <= ARM::pc);
-            ASSERT(shiftReg <= ARM::pc);
+            ASSERT(reg <= ARMRegisters::pc);
+            ASSERT(shiftReg <= ARMRegisters::pc);
             return reg | (shiftReg << 8) | 0x30;
         }
 
         static ARMWord asr_r(int reg, int shiftReg)
         {
-            ASSERT(reg <= ARM::pc);
-            ASSERT(shiftReg <= ARM::pc);
+            ASSERT(reg <= ARMRegisters::pc);
+            ASSERT(shiftReg <= ARMRegisters::pc);
             return reg | (shiftReg << 8) | 0x50;
         }
 
@@ -507,6 +563,11 @@ namespace ARM {
             m_buffer.ensureSpace(insnSpace, constSpace);
         }
 
+        int sizeOfConstantPool()
+        {
+            return m_buffer.sizeOfConstantPool();
+        }
+
         JmpDst label()
         {
             return JmpDst(m_buffer.size());
@@ -515,16 +576,17 @@ namespace ARM {
         JmpDst align(int alignment)
         {
             while (!m_buffer.isAligned(alignment))
-                mov_r(ARM::r0, ARM::r0);
+                mov_r(ARMRegisters::r0, ARMRegisters::r0);
 
             return label();
         }
 
-        JmpSrc jmp(Condition cc = AL)
+        JmpSrc jmp(Condition cc = AL, int useConstantPool = 0)
         {
-            int s = size();
-            ldr_un_imm(ARM::pc, 0xffffffff, cc);
-            m_jumps.append(s);
+            ensureSpace(sizeof(ARMWord), sizeof(ARMWord));
+            int s = m_buffer.uncheckedSize();
+            ldr_un_imm(ARMRegisters::pc, 0xffffffff, cc);
+            m_jumps.append(s | (useConstantPool & 0x1));
             return JmpSrc(s);
         }
 
@@ -533,7 +595,7 @@ namespace ARM {
         // Patching helpers
 
         static ARMWord* getLdrImmAddress(ARMWord* insn, uint32_t* constPool = 0);
-        static void linkBranch(void* code, JmpSrc from, void* to);
+        static void linkBranch(void* code, JmpSrc from, void* to, int useConstantPool = 0);
 
         static void patchPointerInternal(intptr_t from, void* to)
         {
@@ -600,7 +662,7 @@ namespace ARM {
 
         static void linkCall(void* code, JmpSrc from, void* to)
         {
-            linkBranch(code, from, to);
+            linkBranch(code, from, to, true);
         }
 
         static void relinkCall(void* from, void* to)
@@ -653,6 +715,7 @@ namespace ARM {
 
         void dataTransfer32(bool isLoad, RegisterID srcDst, RegisterID base, int32_t offset);
         void baseIndexTransfer32(bool isLoad, RegisterID srcDst, RegisterID base, RegisterID index, int scale, int32_t offset);
+        void doubleTransfer(bool isLoad, FPRegisterID srcDst, RegisterID base, int32_t offset);
 
         // Constant pool hnadlers
 
@@ -666,25 +729,25 @@ namespace ARM {
     private:
         ARMWord RM(int reg)
         {
-            ASSERT(reg <= ARM::pc);
+            ASSERT(reg <= ARMRegisters::pc);
             return reg;
         }
 
         ARMWord RS(int reg)
         {
-            ASSERT(reg <= ARM::pc);
+            ASSERT(reg <= ARMRegisters::pc);
             return reg << 8;
         }
 
         ARMWord RD(int reg)
         {
-            ASSERT(reg <= ARM::pc);
+            ASSERT(reg <= ARMRegisters::pc);
             return reg << 12;
         }
 
         ARMWord RN(int reg)
         {
-            ASSERT(reg <= ARM::pc);
+            ASSERT(reg <= ARMRegisters::pc);
             return reg << 16;
         }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMv7Assembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMv7Assembler.h
index f7e2fb4..e920255 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMv7Assembler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMv7Assembler.h
@@ -37,7 +37,7 @@
 
 namespace JSC {
 
-namespace ARM {
+namespace ARMRegisters {
     typedef enum {
         r0,
         r1,
@@ -199,7 +199,7 @@ class ARMThumbImmediate {
         };
     } PatternBytes;
 
-    ALWAYS_INLINE static int32_t countLeadingZerosPartial(uint32_t& value, int32_t& zeros, const int N)
+    ALWAYS_INLINE static void countLeadingZerosPartial(uint32_t& value, int32_t& zeros, const int N)
     {
         if (value & ~((1<<N)-1)) /* check for any of the top N bits (of 2N bits) are set */ \
             value >>= N;         /* if any were set, lose the bottom N */ \
@@ -407,8 +407,8 @@ register writeback
 
 class ARMv7Assembler {
 public:
-    typedef ARM::RegisterID RegisterID;
-    typedef ARM::FPRegisterID FPRegisterID;
+    typedef ARMRegisters::RegisterID RegisterID;
+    typedef ARMRegisters::FPRegisterID FPRegisterID;
 
     // (HS, LO, HI, LS) -> (AE, B, A, BE)
     // (VS, VC) -> (O, NO)
@@ -442,7 +442,6 @@ public:
         {
         }
 
-        void enableLatePatch() { }
     private:
         JmpSrc(int offset)
             : m_offset(offset)
@@ -481,7 +480,7 @@ private:
     // ARMv7, Appx-A.6.3
     bool BadReg(RegisterID reg)
     {
-        return (reg == ARM::sp) || (reg == ARM::pc);
+        return (reg == ARMRegisters::sp) || (reg == ARMRegisters::pc);
     }
 
     bool isSingleRegister(FPRegisterID reg)
@@ -693,16 +692,16 @@ public:
     void add(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
     {
         // Rd can only be SP if Rn is also SP.
-        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
-        ASSERT(rd != ARM::pc);
-        ASSERT(rn != ARM::pc);
+        ASSERT((rd != ARMRegisters::sp) || (rn == ARMRegisters::sp));
+        ASSERT(rd != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(imm.isValid());
 
-        if (rn == ARM::sp) {
+        if (rn == ARMRegisters::sp) {
             if (!(rd & 8) && imm.isUInt10()) {
                 m_formatter.oneWordOp5Reg3Imm8(OP_ADD_SP_imm_T1, rd, imm.getUInt10() >> 2);
                 return;
-            } else if ((rd == ARM::sp) && imm.isUInt9()) {
+            } else if ((rd == ARMRegisters::sp) && imm.isUInt9()) {
                 m_formatter.oneWordOp9Imm7(OP_ADD_SP_imm_T2, imm.getUInt9() >> 2);
                 return;
             }
@@ -726,9 +725,9 @@ public:
 
     void add(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
     {
-        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
-        ASSERT(rd != ARM::pc);
-        ASSERT(rn != ARM::pc);
+        ASSERT((rd != ARMRegisters::sp) || (rn == ARMRegisters::sp));
+        ASSERT(rd != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(!BadReg(rm));
         m_formatter.twoWordOp12Reg4FourFours(OP_ADD_reg_T3, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
     }
@@ -750,9 +749,9 @@ public:
     void add_S(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
     {
         // Rd can only be SP if Rn is also SP.
-        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
-        ASSERT(rd != ARM::pc);
-        ASSERT(rn != ARM::pc);
+        ASSERT((rd != ARMRegisters::sp) || (rn == ARMRegisters::sp));
+        ASSERT(rd != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(imm.isEncodedImm());
 
         if (!((rd | rn) & 8)) {
@@ -771,9 +770,9 @@ public:
     // Not allowed in an IT (if then) block?
     void add_S(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
     {
-        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
-        ASSERT(rd != ARM::pc);
-        ASSERT(rn != ARM::pc);
+        ASSERT((rd != ARMRegisters::sp) || (rn == ARMRegisters::sp));
+        ASSERT(rd != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(!BadReg(rm));
         m_formatter.twoWordOp12Reg4FourFours(OP_ADD_S_reg_T3, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
     }
@@ -839,7 +838,7 @@ public:
     // Only allowed in IT (if then) block if last instruction.
     JmpSrc blx(RegisterID rm)
     {
-        ASSERT(rm != ARM::pc);
+        ASSERT(rm != ARMRegisters::pc);
         m_formatter.oneWordOp8RegReg143(OP_BLX, rm, (RegisterID)8);
         return JmpSrc(m_formatter.size());
     }
@@ -858,7 +857,7 @@ public:
 
     void cmn(RegisterID rn, ARMThumbImmediate imm)
     {
-        ASSERT(rn != ARM::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(imm.isEncodedImm());
 
         m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_CMN_imm, rn, (RegisterID)0xf, imm);
@@ -866,7 +865,7 @@ public:
 
     void cmp(RegisterID rn, ARMThumbImmediate imm)
     {
-        ASSERT(rn != ARM::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(imm.isEncodedImm());
 
         if (!(rn & 8) && imm.isUInt8())
@@ -877,7 +876,7 @@ public:
 
     void cmp(RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
     {
-        ASSERT(rn != ARM::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(!BadReg(rm));
         m_formatter.twoWordOp12Reg4FourFours(OP_CMP_reg_T2, rn, FourFours(shift.hi4(), 0xf, shift.lo4(), rm));
     }
@@ -939,15 +938,15 @@ public:
         m_formatter.oneWordOp8Imm8(OP_IT, ifThenElse(cond, inst2if, inst3if, inst4if));
     }
 
-    // rt == ARM::pc only allowed if last instruction in IT (if then) block.
+    // rt == ARMRegisters::pc only allowed if last instruction in IT (if then) block.
     void ldr(RegisterID rt, RegisterID rn, ARMThumbImmediate imm)
     {
-        ASSERT(rn != ARM::pc); // LDR (literal)
+        ASSERT(rn != ARMRegisters::pc); // LDR (literal)
         ASSERT(imm.isUInt12());
 
         if (!((rt | rn) & 8) && imm.isUInt7())
             m_formatter.oneWordOp5Imm5Reg3Reg3(OP_LDR_imm_T1, imm.getUInt7() >> 2, rn, rt);
-        else if ((rn == ARM::sp) && !(rt & 8) && imm.isUInt10())
+        else if ((rn == ARMRegisters::sp) && !(rt & 8) && imm.isUInt10())
             m_formatter.oneWordOp5Reg3Imm8(OP_LDR_imm_T2, rt, imm.getUInt10() >> 2);
         else
             m_formatter.twoWordOp12Reg4Reg4Imm12(OP_LDR_imm_T3, rn, rt, imm.getUInt12());
@@ -966,8 +965,8 @@ public:
     // if (wback) REG[rn] = _tmp
     void ldr(RegisterID rt, RegisterID rn, int offset, bool index, bool wback)
     {
-        ASSERT(rt != ARM::pc);
-        ASSERT(rn != ARM::pc);
+        ASSERT(rt != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(index || wback);
         ASSERT(!wback | (rt != rn));
     
@@ -986,10 +985,10 @@ public:
         m_formatter.twoWordOp12Reg4Reg4Imm12(OP_LDR_imm_T4, rn, rt, offset);
     }
 
-    // rt == ARM::pc only allowed if last instruction in IT (if then) block.
+    // rt == ARMRegisters::pc only allowed if last instruction in IT (if then) block.
     void ldr(RegisterID rt, RegisterID rn, RegisterID rm, unsigned shift=0)
     {
-        ASSERT(rn != ARM::pc); // LDR (literal)
+        ASSERT(rn != ARMRegisters::pc); // LDR (literal)
         ASSERT(!BadReg(rm));
         ASSERT(shift <= 3);
 
@@ -999,10 +998,10 @@ public:
             m_formatter.twoWordOp12Reg4FourFours(OP_LDR_reg_T2, rn, FourFours(rt, 0, shift, rm));
     }
 
-    // rt == ARM::pc only allowed if last instruction in IT (if then) block.
+    // rt == ARMRegisters::pc only allowed if last instruction in IT (if then) block.
     void ldrh(RegisterID rt, RegisterID rn, ARMThumbImmediate imm)
     {
-        ASSERT(rn != ARM::pc); // LDR (literal)
+        ASSERT(rn != ARMRegisters::pc); // LDR (literal)
         ASSERT(imm.isUInt12());
 
         if (!((rt | rn) & 8) && imm.isUInt6())
@@ -1024,8 +1023,8 @@ public:
     // if (wback) REG[rn] = _tmp
     void ldrh(RegisterID rt, RegisterID rn, int offset, bool index, bool wback)
     {
-        ASSERT(rt != ARM::pc);
-        ASSERT(rn != ARM::pc);
+        ASSERT(rt != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(index || wback);
         ASSERT(!wback | (rt != rn));
     
@@ -1047,7 +1046,7 @@ public:
     void ldrh(RegisterID rt, RegisterID rn, RegisterID rm, unsigned shift=0)
     {
         ASSERT(!BadReg(rt));   // Memory hint
-        ASSERT(rn != ARM::pc); // LDRH (literal)
+        ASSERT(rn != ARMRegisters::pc); // LDRH (literal)
         ASSERT(!BadReg(rm));
         ASSERT(shift <= 3);
 
@@ -1198,16 +1197,16 @@ public:
         m_formatter.twoWordOp12Reg4FourFours(OP_SMULL_T1, rn, FourFours(rdLo, rdHi, 0, rm));
     }
 
-    // rt == ARM::pc only allowed if last instruction in IT (if then) block.
+    // rt == ARMRegisters::pc only allowed if last instruction in IT (if then) block.
     void str(RegisterID rt, RegisterID rn, ARMThumbImmediate imm)
     {
-        ASSERT(rt != ARM::pc);
-        ASSERT(rn != ARM::pc);
+        ASSERT(rt != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(imm.isUInt12());
 
         if (!((rt | rn) & 8) && imm.isUInt7())
             m_formatter.oneWordOp5Imm5Reg3Reg3(OP_STR_imm_T1, imm.getUInt7() >> 2, rn, rt);
-        else if ((rn == ARM::sp) && !(rt & 8) && imm.isUInt10())
+        else if ((rn == ARMRegisters::sp) && !(rt & 8) && imm.isUInt10())
             m_formatter.oneWordOp5Reg3Imm8(OP_STR_imm_T2, rt, imm.getUInt10() >> 2);
         else
             m_formatter.twoWordOp12Reg4Reg4Imm12(OP_STR_imm_T3, rn, rt, imm.getUInt12());
@@ -1226,8 +1225,8 @@ public:
     // if (wback) REG[rn] = _tmp
     void str(RegisterID rt, RegisterID rn, int offset, bool index, bool wback)
     {
-        ASSERT(rt != ARM::pc);
-        ASSERT(rn != ARM::pc);
+        ASSERT(rt != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(index || wback);
         ASSERT(!wback | (rt != rn));
     
@@ -1246,10 +1245,10 @@ public:
         m_formatter.twoWordOp12Reg4Reg4Imm12(OP_STR_imm_T4, rn, rt, offset);
     }
 
-    // rt == ARM::pc only allowed if last instruction in IT (if then) block.
+    // rt == ARMRegisters::pc only allowed if last instruction in IT (if then) block.
     void str(RegisterID rt, RegisterID rn, RegisterID rm, unsigned shift=0)
     {
-        ASSERT(rn != ARM::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(!BadReg(rm));
         ASSERT(shift <= 3);
 
@@ -1262,12 +1261,12 @@ public:
     void sub(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
     {
         // Rd can only be SP if Rn is also SP.
-        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
-        ASSERT(rd != ARM::pc);
-        ASSERT(rn != ARM::pc);
+        ASSERT((rd != ARMRegisters::sp) || (rn == ARMRegisters::sp));
+        ASSERT(rd != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(imm.isValid());
 
-        if ((rn == ARM::sp) && (rd == ARM::sp) && imm.isUInt9()) {
+        if ((rn == ARMRegisters::sp) && (rd == ARMRegisters::sp) && imm.isUInt9()) {
             m_formatter.oneWordOp9Imm7(OP_SUB_SP_imm_T1, imm.getUInt9() >> 2);
             return;
         } else if (!((rd | rn) & 8)) {
@@ -1290,9 +1289,9 @@ public:
 
     void sub(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
     {
-        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
-        ASSERT(rd != ARM::pc);
-        ASSERT(rn != ARM::pc);
+        ASSERT((rd != ARMRegisters::sp) || (rn == ARMRegisters::sp));
+        ASSERT(rd != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(!BadReg(rm));
         m_formatter.twoWordOp12Reg4FourFours(OP_SUB_reg_T2, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
     }
@@ -1310,12 +1309,12 @@ public:
     void sub_S(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
     {
         // Rd can only be SP if Rn is also SP.
-        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
-        ASSERT(rd != ARM::pc);
-        ASSERT(rn != ARM::pc);
+        ASSERT((rd != ARMRegisters::sp) || (rn == ARMRegisters::sp));
+        ASSERT(rd != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(imm.isValid());
 
-        if ((rn == ARM::sp) && (rd == ARM::sp) && imm.isUInt9()) {
+        if ((rn == ARMRegisters::sp) && (rd == ARMRegisters::sp) && imm.isUInt9()) {
             m_formatter.oneWordOp9Imm7(OP_SUB_SP_imm_T1, imm.getUInt9() >> 2);
             return;
         } else if (!((rd | rn) & 8)) {
@@ -1334,9 +1333,9 @@ public:
     // Not allowed in an IT (if then) block?
     void sub_S(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
     {
-        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
-        ASSERT(rd != ARM::pc);
-        ASSERT(rn != ARM::pc);
+        ASSERT((rd != ARMRegisters::sp) || (rn == ARMRegisters::sp));
+        ASSERT(rd != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
         ASSERT(!BadReg(rm));
         m_formatter.twoWordOp12Reg4FourFours(OP_SUB_S_reg_T2, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
     }
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/AbstractMacroAssembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/AbstractMacroAssembler.h
index 95b5afc..525fe98 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/AbstractMacroAssembler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/AbstractMacroAssembler.h
@@ -173,7 +173,7 @@ public:
     struct Imm32 {
         explicit Imm32(int32_t value)
             : m_value(value)
-#if PLATFORM_ARM_ARCH(7)
+#if PLATFORM(ARM)
             , m_isPointer(false)
 #endif
         {
@@ -182,7 +182,7 @@ public:
 #if !PLATFORM(X86_64)
         explicit Imm32(ImmPtr ptr)
             : m_value(ptr.asIntptr())
-#if PLATFORM_ARM_ARCH(7)
+#if PLATFORM(ARM)
             , m_isPointer(true)
 #endif
         {
@@ -190,7 +190,7 @@ public:
 #endif
 
         int32_t m_value;
-#if PLATFORM_ARM_ARCH(7)
+#if PLATFORM(ARM)
         // We rely on being able to regenerate code to recover exception handling
         // information.  Since ARMv7 supports 16-bit immediates there is a danger
         // that if pointer values change the layout of the generated code will change.
@@ -320,11 +320,6 @@ public:
             return Call(jump.m_jmp, Linkable);
         }
 
-        void enableLatePatch()
-        {
-            m_jmp.enableLatePatch();
-        }
-
         JmpSrc m_jmp;
     private:
         Flags m_flags;
@@ -361,11 +356,6 @@ public:
             masm->m_assembler.linkJump(m_jmp, label.m_label);
         }
 
-        void enableLatePatch()
-        {
-            m_jmp.enableLatePatch();
-        }
-
     private:
         JmpSrc m_jmp;
     };
@@ -378,6 +368,8 @@ public:
         friend class LinkBuffer;
 
     public:
+        typedef Vector<Jump, 16> JumpVector;
+
         void link(AbstractMacroAssembler<AssemblerType>* masm)
         {
             size_t size = m_jumps.size();
@@ -408,9 +400,11 @@ public:
         {
             return !m_jumps.size();
         }
+        
+        const JumpVector& jumps() { return m_jumps; }
 
     private:
-        Vector<Jump, 16> m_jumps;
+        JumpVector m_jumps;
     };
 
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h b/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
index f15b7f3..af3c3be 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
@@ -34,6 +34,8 @@
 #include "AssemblerBuffer.h"
 #include <wtf/SegmentedVector.h>
 
+#define ASSEMBLER_HAS_CONSTANT_POOL 1
+
 namespace JSC {
 
 /*
@@ -84,7 +86,7 @@ namespace JSC {
 
 template <int maxPoolSize, int barrierSize, int maxInstructionSize, class AssemblerType>
 class AssemblerBufferWithConstantPool: public AssemblerBuffer {
-    typedef WTF::SegmentedVector<uint32_t, 512> LoadOffsets;
+    typedef SegmentedVector<uint32_t, 512> LoadOffsets;
 public:
     enum {
         UniqueConst,
@@ -177,6 +179,11 @@ public:
         return AssemblerBuffer::size();
     }
 
+    int uncheckedSize()
+    {
+        return AssemblerBuffer::size();
+    }
+
     void* executableCopy(ExecutablePool* allocator)
     {
         flushConstantPool(false);
@@ -207,10 +214,10 @@ public:
     }
 
     // This flushing mechanism can be called after any unconditional jumps.
-    void flushWithoutBarrier()
+    void flushWithoutBarrier(bool isForced = false)
     {
         // Flush if constant pool is more than 60% full to avoid overuse of this function.
-        if (5 * m_numConsts > 3 * maxPoolSize / sizeof(uint32_t))
+        if (isForced || 5 * m_numConsts > 3 * maxPoolSize / sizeof(uint32_t))
             flushConstantPool(false);
     }
 
@@ -219,6 +226,11 @@ public:
         return m_pool;
     }
 
+    int sizeOfConstantPool()
+    {
+        return m_numConsts;
+    }
+
 private:
     void correctDeltas(int insnSize)
     {
@@ -276,7 +288,8 @@ private:
     {
         if (m_numConsts == 0)
             return;
-        if ((m_maxDistance < nextInsnSize + m_lastConstDelta + barrierSize + (int)sizeof(uint32_t)))
+        int lastConstDelta = m_lastConstDelta > nextInsnSize ? m_lastConstDelta - nextInsnSize : 0;
+        if ((m_maxDistance < nextInsnSize + lastConstDelta + barrierSize + (int)sizeof(uint32_t)))
             flushConstantPool();
     }
 
@@ -284,8 +297,8 @@ private:
     {
         if (m_numConsts == 0)
             return;
-        if ((m_maxDistance < nextInsnSize + m_lastConstDelta + barrierSize + (int)sizeof(uint32_t)) ||
-            (m_numConsts + nextConstSize / sizeof(uint32_t) >= maxPoolSize))
+        if ((m_maxDistance < nextInsnSize + m_lastConstDelta + nextConstSize + barrierSize + (int)sizeof(uint32_t)) ||
+            (m_numConsts * sizeof(uint32_t) + nextConstSize >= maxPoolSize))
             flushConstantPool();
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.cpp b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.cpp
new file mode 100644
index 0000000..33fac64
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 University of Szeged
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY UNIVERSITY OF SZEGED ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL UNIVERSITY OF SZEGED OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(ASSEMBLER) && PLATFORM(ARM) && !PLATFORM_ARM_ARCH(7)
+
+#include "MacroAssemblerARM.h"
+
+#if PLATFORM(LINUX)
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <elf.h>
+#include <asm/hwcap.h>
+#endif
+
+namespace JSC {
+
+static bool isVFPPresent()
+{
+#if PLATFORM(LINUX)
+    int fd = open("/proc/self/auxv", O_RDONLY);
+    if (fd > 0) {
+        Elf32_auxv_t aux;
+        while (read(fd, &aux, sizeof(Elf32_auxv_t))) {
+            if (aux.a_type == AT_HWCAP) {
+                close(fd);
+                return aux.a_un.a_val & HWCAP_VFP;
+            }
+        }
+        close(fd);
+    }
+#endif
+
+    return false;
+}
+
+const bool MacroAssemblerARM::s_isVFPPresent = isVFPPresent();
+
+}
+
+#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM) && !PLATFORM_ARM_ARCH(7)
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.h
index 27879a9..4a7c10a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.h
@@ -30,7 +30,7 @@
 
 #include <wtf/Platform.h>
 
-#if ENABLE(ASSEMBLER) && PLATFORM(ARM)
+#if ENABLE(ASSEMBLER) && PLATFORM(ARM) && !PLATFORM_ARM_ARCH(7)
 
 #include "ARMAssembler.h"
 #include "AbstractMacroAssembler.h"
@@ -57,15 +57,14 @@ public:
     };
 
     enum DoubleCondition {
-        DoubleEqual, //FIXME
-        DoubleNotEqual, //FIXME
-        DoubleGreaterThan, //FIXME
-        DoubleGreaterThanOrEqual, //FIXME
-        DoubleLessThan, //FIXME
-        DoubleLessThanOrEqual, //FIXME
+        DoubleEqual = ARMAssembler::EQ,
+        DoubleGreaterThan = ARMAssembler::GT,
+        DoubleGreaterThanOrEqual = ARMAssembler::GE,
+        DoubleLessThan = ARMAssembler::LT,
+        DoubleLessThanOrEqual = ARMAssembler::LE,
     };
 
-    static const RegisterID stackPointerRegister = ARM::sp;
+    static const RegisterID stackPointerRegister = ARMRegisters::sp;
 
     static const Scale ScalePtr = TimesFour;
 
@@ -76,20 +75,20 @@ public:
 
     void add32(Imm32 imm, Address address)
     {
-        load32(address, ARM::S1);
-        add32(imm, ARM::S1);
-        store32(ARM::S1, address);
+        load32(address, ARMRegisters::S1);
+        add32(imm, ARMRegisters::S1);
+        store32(ARMRegisters::S1, address);
     }
 
     void add32(Imm32 imm, RegisterID dest)
     {
-        m_assembler.adds_r(dest, dest, m_assembler.getImm(imm.m_value, ARM::S0));
+        m_assembler.adds_r(dest, dest, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
     }
 
     void add32(Address src, RegisterID dest)
     {
-        load32(src, ARM::S1);
-        add32(ARM::S1, dest);
+        load32(src, ARMRegisters::S1);
+        add32(ARMRegisters::S1, dest);
     }
 
     void and32(RegisterID src, RegisterID dest)
@@ -99,7 +98,7 @@ public:
 
     void and32(Imm32 imm, RegisterID dest)
     {
-        ARMWord w = m_assembler.getImm(imm.m_value, ARM::S0, true);
+        ARMWord w = m_assembler.getImm(imm.m_value, ARMRegisters::S0, true);
         if (w & ARMAssembler::OP2_INV_IMM)
             m_assembler.bics_r(dest, dest, w & ~ARMAssembler::OP2_INV_IMM);
         else
@@ -119,16 +118,16 @@ public:
     void mul32(RegisterID src, RegisterID dest)
     {
         if (src == dest) {
-            move(src, ARM::S0);
-            src = ARM::S0;
+            move(src, ARMRegisters::S0);
+            src = ARMRegisters::S0;
         }
         m_assembler.muls_r(dest, dest, src);
     }
 
     void mul32(Imm32 imm, RegisterID src, RegisterID dest)
     {
-        move(imm, ARM::S0);
-        m_assembler.muls_r(dest, src, ARM::S0);
+        move(imm, ARMRegisters::S0);
+        m_assembler.muls_r(dest, src, ARMRegisters::S0);
     }
 
     void not32(RegisterID dest)
@@ -143,7 +142,7 @@ public:
 
     void or32(Imm32 imm, RegisterID dest)
     {
-        m_assembler.orrs_r(dest, dest, m_assembler.getImm(imm.m_value, ARM::S0));
+        m_assembler.orrs_r(dest, dest, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
     }
 
     void rshift32(RegisterID shift_amount, RegisterID dest)
@@ -163,20 +162,20 @@ public:
 
     void sub32(Imm32 imm, RegisterID dest)
     {
-        m_assembler.subs_r(dest, dest, m_assembler.getImm(imm.m_value, ARM::S0));
+        m_assembler.subs_r(dest, dest, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
     }
 
     void sub32(Imm32 imm, Address address)
     {
-        load32(address, ARM::S1);
-        sub32(imm, ARM::S1);
-        store32(ARM::S1, address);
+        load32(address, ARMRegisters::S1);
+        sub32(imm, ARMRegisters::S1);
+        store32(ARMRegisters::S1, address);
     }
 
     void sub32(Address src, RegisterID dest)
     {
-        load32(src, ARM::S1);
-        sub32(ARM::S1, dest);
+        load32(src, ARMRegisters::S1);
+        sub32(ARMRegisters::S1, dest);
     }
 
     void xor32(RegisterID src, RegisterID dest)
@@ -186,7 +185,7 @@ public:
 
     void xor32(Imm32 imm, RegisterID dest)
     {
-        m_assembler.eors_r(dest, dest, m_assembler.getImm(imm.m_value, ARM::S0));
+        m_assembler.eors_r(dest, dest, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
     }
 
     void load32(ImplicitAddress address, RegisterID dest)
@@ -202,8 +201,8 @@ public:
     DataLabel32 load32WithAddressOffsetPatch(Address address, RegisterID dest)
     {
         DataLabel32 dataLabel(this);
-        m_assembler.ldr_un_imm(ARM::S0, 0);
-        m_assembler.dtr_ur(true, dest, address.base, ARM::S0);
+        m_assembler.ldr_un_imm(ARMRegisters::S0, 0);
+        m_assembler.dtr_ur(true, dest, address.base, ARMRegisters::S0);
         return dataLabel;
     }
 
@@ -216,18 +215,18 @@ public:
 
     void load16(BaseIndex address, RegisterID dest)
     {
-        m_assembler.add_r(ARM::S0, address.base, m_assembler.lsl(address.index, address.scale));
+        m_assembler.add_r(ARMRegisters::S0, address.base, m_assembler.lsl(address.index, address.scale));
         if (address.offset>=0)
-            m_assembler.ldrh_u(dest, ARM::S0, ARMAssembler::getOp2Byte(address.offset));
+            m_assembler.ldrh_u(dest, ARMRegisters::S0, ARMAssembler::getOp2Byte(address.offset));
         else
-            m_assembler.ldrh_d(dest, ARM::S0, ARMAssembler::getOp2Byte(-address.offset));
+            m_assembler.ldrh_d(dest, ARMRegisters::S0, ARMAssembler::getOp2Byte(-address.offset));
     }
 
     DataLabel32 store32WithAddressOffsetPatch(RegisterID src, Address address)
     {
         DataLabel32 dataLabel(this);
-        m_assembler.ldr_un_imm(ARM::S0, 0);
-        m_assembler.dtr_ur(false, src, address.base, ARM::S0);
+        m_assembler.ldr_un_imm(ARMRegisters::S0, 0);
+        m_assembler.dtr_ur(false, src, address.base, ARMRegisters::S0);
         return dataLabel;
     }
 
@@ -243,21 +242,27 @@ public:
 
     void store32(Imm32 imm, ImplicitAddress address)
     {
-        move(imm, ARM::S1);
-        store32(ARM::S1, address);
+        if (imm.m_isPointer)
+            m_assembler.ldr_un_imm(ARMRegisters::S1, imm.m_value);
+        else
+            move(imm, ARMRegisters::S1);
+        store32(ARMRegisters::S1, address);
     }
 
     void store32(RegisterID src, void* address)
     {
-        m_assembler.moveImm(reinterpret_cast<ARMWord>(address), ARM::S0);
-        m_assembler.dtr_u(false, src, ARM::S0, 0);
+        m_assembler.ldr_un_imm(ARMRegisters::S0, reinterpret_cast<ARMWord>(address));
+        m_assembler.dtr_u(false, src, ARMRegisters::S0, 0);
     }
 
     void store32(Imm32 imm, void* address)
     {
-        m_assembler.moveImm(reinterpret_cast<ARMWord>(address), ARM::S0);
-        m_assembler.moveImm(imm.m_value, ARM::S1);
-        m_assembler.dtr_u(false, ARM::S1, ARM::S0, 0);
+        m_assembler.ldr_un_imm(ARMRegisters::S0, reinterpret_cast<ARMWord>(address));
+        if (imm.m_isPointer)
+            m_assembler.ldr_un_imm(ARMRegisters::S1, imm.m_value);
+        else
+            m_assembler.moveImm(imm.m_value, ARMRegisters::S1);
+        m_assembler.dtr_u(false, ARMRegisters::S1, ARMRegisters::S0, 0);
     }
 
     void pop(RegisterID dest)
@@ -272,19 +277,22 @@ public:
 
     void push(Address address)
     {
-        load32(address, ARM::S1);
-        push(ARM::S1);
+        load32(address, ARMRegisters::S1);
+        push(ARMRegisters::S1);
     }
 
     void push(Imm32 imm)
     {
-        move(imm, ARM::S0);
-        push(ARM::S0);
+        move(imm, ARMRegisters::S0);
+        push(ARMRegisters::S0);
     }
 
     void move(Imm32 imm, RegisterID dest)
     {
-        m_assembler.moveImm(imm.m_value, dest);
+        if (imm.m_isPointer)
+            m_assembler.ldr_un_imm(dest, imm.m_value);
+        else
+            m_assembler.moveImm(imm.m_value, dest);
     }
 
     void move(RegisterID src, RegisterID dest)
@@ -294,14 +302,14 @@ public:
 
     void move(ImmPtr imm, RegisterID dest)
     {
-        m_assembler.mov_r(dest, m_assembler.getImm(reinterpret_cast<ARMWord>(imm.m_value), ARM::S0));
+        move(Imm32(imm), dest);
     }
 
     void swap(RegisterID reg1, RegisterID reg2)
     {
-        m_assembler.mov_r(ARM::S0, reg1);
+        m_assembler.mov_r(ARMRegisters::S0, reg1);
         m_assembler.mov_r(reg1, reg2);
-        m_assembler.mov_r(reg2, ARM::S0);
+        m_assembler.mov_r(reg2, ARMRegisters::S0);
     }
 
     void signExtend32ToPtr(RegisterID src, RegisterID dest)
@@ -316,40 +324,44 @@ public:
             move(src, dest);
     }
 
-    Jump branch32(Condition cond, RegisterID left, RegisterID right)
+    Jump branch32(Condition cond, RegisterID left, RegisterID right, int useConstantPool = 0)
     {
         m_assembler.cmp_r(left, right);
-        return Jump(m_assembler.jmp(ARMCondition(cond)));
+        return Jump(m_assembler.jmp(ARMCondition(cond), useConstantPool));
     }
 
-    Jump branch32(Condition cond, RegisterID left, Imm32 right)
+    Jump branch32(Condition cond, RegisterID left, Imm32 right, int useConstantPool = 0)
     {
-        m_assembler.cmp_r(left, m_assembler.getImm(right.m_value, ARM::S0));
-        return Jump(m_assembler.jmp(ARMCondition(cond)));
+        if (right.m_isPointer) {
+            m_assembler.ldr_un_imm(ARMRegisters::S0, right.m_value);
+            m_assembler.cmp_r(left, ARMRegisters::S0);
+        } else
+            m_assembler.cmp_r(left, m_assembler.getImm(right.m_value, ARMRegisters::S0));
+        return Jump(m_assembler.jmp(ARMCondition(cond), useConstantPool));
     }
 
     Jump branch32(Condition cond, RegisterID left, Address right)
     {
-        load32(right, ARM::S1);
-        return branch32(cond, left, ARM::S1);
+        load32(right, ARMRegisters::S1);
+        return branch32(cond, left, ARMRegisters::S1);
     }
 
     Jump branch32(Condition cond, Address left, RegisterID right)
     {
-        load32(left, ARM::S1);
-        return branch32(cond, ARM::S1, right);
+        load32(left, ARMRegisters::S1);
+        return branch32(cond, ARMRegisters::S1, right);
     }
 
     Jump branch32(Condition cond, Address left, Imm32 right)
     {
-        load32(left, ARM::S1);
-        return branch32(cond, ARM::S1, right);
+        load32(left, ARMRegisters::S1);
+        return branch32(cond, ARMRegisters::S1, right);
     }
 
     Jump branch32(Condition cond, BaseIndex left, Imm32 right)
     {
-        load32(left, ARM::S1);
-        return branch32(cond, ARM::S1, right);
+        load32(left, ARMRegisters::S1);
+        return branch32(cond, ARMRegisters::S1, right);
     }
 
     Jump branch16(Condition cond, BaseIndex left, RegisterID right)
@@ -363,9 +375,9 @@ public:
 
     Jump branch16(Condition cond, BaseIndex left, Imm32 right)
     {
-        load16(left, ARM::S0);
-        move(right, ARM::S1);
-        m_assembler.cmp_r(ARM::S0, ARM::S1);
+        load16(left, ARMRegisters::S0);
+        move(right, ARMRegisters::S1);
+        m_assembler.cmp_r(ARMRegisters::S0, ARMRegisters::S1);
         return m_assembler.jmp(ARMCondition(cond));
     }
 
@@ -379,9 +391,9 @@ public:
     Jump branchTest32(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
     {
         ASSERT((cond == Zero) || (cond == NonZero));
-        ARMWord w = m_assembler.getImm(mask.m_value, ARM::S0, true);
+        ARMWord w = m_assembler.getImm(mask.m_value, ARMRegisters::S0, true);
         if (w & ARMAssembler::OP2_INV_IMM)
-            m_assembler.bics_r(ARM::S0, reg, w & ~ARMAssembler::OP2_INV_IMM);
+            m_assembler.bics_r(ARMRegisters::S0, reg, w & ~ARMAssembler::OP2_INV_IMM);
         else
             m_assembler.tst_r(reg, w);
         return Jump(m_assembler.jmp(ARMCondition(cond)));
@@ -389,14 +401,14 @@ public:
 
     Jump branchTest32(Condition cond, Address address, Imm32 mask = Imm32(-1))
     {
-        load32(address, ARM::S1);
-        return branchTest32(cond, ARM::S1, mask);
+        load32(address, ARMRegisters::S1);
+        return branchTest32(cond, ARMRegisters::S1, mask);
     }
 
     Jump branchTest32(Condition cond, BaseIndex address, Imm32 mask = Imm32(-1))
     {
-        load32(address, ARM::S1);
-        return branchTest32(cond, ARM::S1, mask);
+        load32(address, ARMRegisters::S1);
+        return branchTest32(cond, ARMRegisters::S1, mask);
     }
 
     Jump jump()
@@ -406,12 +418,12 @@ public:
 
     void jump(RegisterID target)
     {
-        move(target, ARM::pc);
+        move(target, ARMRegisters::pc);
     }
 
     void jump(Address address)
     {
-        load32(address, ARM::pc);
+        load32(address, ARMRegisters::pc);
     }
 
     Jump branchAdd32(Condition cond, RegisterID src, RegisterID dest)
@@ -431,11 +443,11 @@ public:
     void mull32(RegisterID src1, RegisterID src2, RegisterID dest)
     {
         if (src1 == dest) {
-            move(src1, ARM::S0);
-            src1 = ARM::S0;
+            move(src1, ARMRegisters::S0);
+            src1 = ARMRegisters::S0;
         }
-        m_assembler.mull_r(ARM::S1, dest, src2, src1);
-        m_assembler.cmp_r(ARM::S1, m_assembler.asr(dest, 31));
+        m_assembler.mull_r(ARMRegisters::S1, dest, src2, src1);
+        m_assembler.cmp_r(ARMRegisters::S1, m_assembler.asr(dest, 31));
     }
 
     Jump branchMul32(Condition cond, RegisterID src, RegisterID dest)
@@ -454,8 +466,8 @@ public:
     {
         ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
         if (cond == Overflow) {
-            move(imm, ARM::S0);
-            mull32(ARM::S0, src, dest);
+            move(imm, ARMRegisters::S0);
+            mull32(ARMRegisters::S0, src, dest);
             cond = NonZero;
         }
         else
@@ -485,13 +497,13 @@ public:
     Call nearCall()
     {
         prepareCall();
-        return Call(m_assembler.jmp(), Call::LinkableNear);
+        return Call(m_assembler.jmp(ARMAssembler::AL, true), Call::LinkableNear);
     }
 
     Call call(RegisterID target)
     {
         prepareCall();
-        move(ARM::pc, target);
+        move(ARMRegisters::pc, target);
         JmpSrc jmpSrc;
         return Call(jmpSrc, Call::None);
     }
@@ -503,7 +515,7 @@ public:
 
     void ret()
     {
-        pop(ARM::pc);
+        pop(ARMRegisters::pc);
     }
 
     void set32(Condition cond, RegisterID left, RegisterID right, RegisterID dest)
@@ -515,67 +527,67 @@ public:
 
     void set32(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
     {
-        m_assembler.cmp_r(left, m_assembler.getImm(right.m_value, ARM::S0));
+        m_assembler.cmp_r(left, m_assembler.getImm(right.m_value, ARMRegisters::S0));
         m_assembler.mov_r(dest, ARMAssembler::getOp2(0));
         m_assembler.mov_r(dest, ARMAssembler::getOp2(1), ARMCondition(cond));
     }
 
     void setTest32(Condition cond, Address address, Imm32 mask, RegisterID dest)
     {
-        load32(address, ARM::S1);
+        load32(address, ARMRegisters::S1);
         if (mask.m_value == -1)
-            m_assembler.cmp_r(0, ARM::S1);
+            m_assembler.cmp_r(0, ARMRegisters::S1);
         else
-            m_assembler.tst_r(ARM::S1, m_assembler.getImm(mask.m_value, ARM::S0));
+            m_assembler.tst_r(ARMRegisters::S1, m_assembler.getImm(mask.m_value, ARMRegisters::S0));
         m_assembler.mov_r(dest, ARMAssembler::getOp2(0));
         m_assembler.mov_r(dest, ARMAssembler::getOp2(1), ARMCondition(cond));
     }
 
     void add32(Imm32 imm, RegisterID src, RegisterID dest)
     {
-        m_assembler.add_r(dest, src, m_assembler.getImm(imm.m_value, ARM::S0));
+        m_assembler.add_r(dest, src, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
     }
 
     void add32(Imm32 imm, AbsoluteAddress address)
     {
-        m_assembler.moveImm(reinterpret_cast<ARMWord>(address.m_ptr), ARM::S1);
-        m_assembler.dtr_u(true, ARM::S1, ARM::S1, 0);
-        add32(imm, ARM::S1);
-        m_assembler.moveImm(reinterpret_cast<ARMWord>(address.m_ptr), ARM::S0);
-        m_assembler.dtr_u(false, ARM::S1, ARM::S0, 0);
+        m_assembler.ldr_un_imm(ARMRegisters::S1, reinterpret_cast<ARMWord>(address.m_ptr));
+        m_assembler.dtr_u(true, ARMRegisters::S1, ARMRegisters::S1, 0);
+        add32(imm, ARMRegisters::S1);
+        m_assembler.ldr_un_imm(ARMRegisters::S0, reinterpret_cast<ARMWord>(address.m_ptr));
+        m_assembler.dtr_u(false, ARMRegisters::S1, ARMRegisters::S0, 0);
     }
 
     void sub32(Imm32 imm, AbsoluteAddress address)
     {
-        m_assembler.moveImm(reinterpret_cast<ARMWord>(address.m_ptr), ARM::S1);
-        m_assembler.dtr_u(true, ARM::S1, ARM::S1, 0);
-        sub32(imm, ARM::S1);
-        m_assembler.moveImm(reinterpret_cast<ARMWord>(address.m_ptr), ARM::S0);
-        m_assembler.dtr_u(false, ARM::S1, ARM::S0, 0);
+        m_assembler.ldr_un_imm(ARMRegisters::S1, reinterpret_cast<ARMWord>(address.m_ptr));
+        m_assembler.dtr_u(true, ARMRegisters::S1, ARMRegisters::S1, 0);
+        sub32(imm, ARMRegisters::S1);
+        m_assembler.ldr_un_imm(ARMRegisters::S0, reinterpret_cast<ARMWord>(address.m_ptr));
+        m_assembler.dtr_u(false, ARMRegisters::S1, ARMRegisters::S0, 0);
     }
 
     void load32(void* address, RegisterID dest)
     {
-        m_assembler.moveImm(reinterpret_cast<ARMWord>(address), ARM::S0);
-        m_assembler.dtr_u(true, dest, ARM::S0, 0);
+        m_assembler.ldr_un_imm(ARMRegisters::S0, reinterpret_cast<ARMWord>(address));
+        m_assembler.dtr_u(true, dest, ARMRegisters::S0, 0);
     }
 
     Jump branch32(Condition cond, AbsoluteAddress left, RegisterID right)
     {
-        load32(left.m_ptr, ARM::S1);
-        return branch32(cond, ARM::S1, right);
+        load32(left.m_ptr, ARMRegisters::S1);
+        return branch32(cond, ARMRegisters::S1, right);
     }
 
     Jump branch32(Condition cond, AbsoluteAddress left, Imm32 right)
     {
-        load32(left.m_ptr, ARM::S1);
-        return branch32(cond, ARM::S1, right);
+        load32(left.m_ptr, ARMRegisters::S1);
+        return branch32(cond, ARMRegisters::S1, right);
     }
 
     Call call()
     {
         prepareCall();
-        return Call(m_assembler.jmp(), Call::Linkable);
+        return Call(m_assembler.jmp(ARMAssembler::AL, true), Call::Linkable);
     }
 
     Call tailRecursiveCall()
@@ -597,25 +609,23 @@ public:
 
     Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
     {
-        dataLabel = moveWithPatch(initialRightValue, ARM::S1);
-        Jump jump = branch32(cond, left, ARM::S1);
-        jump.enableLatePatch();
+        dataLabel = moveWithPatch(initialRightValue, ARMRegisters::S1);
+        Jump jump = branch32(cond, left, ARMRegisters::S1, true);
         return jump;
     }
 
     Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
     {
-        load32(left, ARM::S1);
-        dataLabel = moveWithPatch(initialRightValue, ARM::S0);
-        Jump jump = branch32(cond, ARM::S0, ARM::S1);
-        jump.enableLatePatch();
+        load32(left, ARMRegisters::S1);
+        dataLabel = moveWithPatch(initialRightValue, ARMRegisters::S0);
+        Jump jump = branch32(cond, ARMRegisters::S0, ARMRegisters::S1, true);
         return jump;
     }
 
     DataLabelPtr storePtrWithPatch(ImmPtr initialValue, ImplicitAddress address)
     {
-        DataLabelPtr dataLabel = moveWithPatch(initialValue, ARM::S1);
-        store32(ARM::S1, address);
+        DataLabelPtr dataLabel = moveWithPatch(initialValue, ARMRegisters::S1);
+        store32(ARMRegisters::S1, address);
         return dataLabel;
     }
 
@@ -627,7 +637,7 @@ public:
     // Floating point operators
     bool supportsFloatingPoint() const
     {
-        return false;
+        return s_isVFPPresent;
     }
 
     bool supportsFloatingPointTruncate() const
@@ -637,74 +647,58 @@ public:
 
     void loadDouble(ImplicitAddress address, FPRegisterID dest)
     {
-        UNUSED_PARAM(address);
-        UNUSED_PARAM(dest);
-        ASSERT_NOT_REACHED();
+        m_assembler.doubleTransfer(true, dest, address.base, address.offset);
     }
 
     void storeDouble(FPRegisterID src, ImplicitAddress address)
     {
-        UNUSED_PARAM(src);
-        UNUSED_PARAM(address);
-        ASSERT_NOT_REACHED();
+        m_assembler.doubleTransfer(false, src, address.base, address.offset);
     }
 
     void addDouble(FPRegisterID src, FPRegisterID dest)
     {
-        UNUSED_PARAM(src);
-        UNUSED_PARAM(dest);
-        ASSERT_NOT_REACHED();
+        m_assembler.faddd_r(dest, dest, src);
     }
 
     void addDouble(Address src, FPRegisterID dest)
     {
-        UNUSED_PARAM(src);
-        UNUSED_PARAM(dest);
-        ASSERT_NOT_REACHED();
+        loadDouble(src, ARMRegisters::SD0);
+        addDouble(ARMRegisters::SD0, dest);
     }
 
     void subDouble(FPRegisterID src, FPRegisterID dest)
     {
-        UNUSED_PARAM(src);
-        UNUSED_PARAM(dest);
-        ASSERT_NOT_REACHED();
+        m_assembler.fsubd_r(dest, dest, src);
     }
 
     void subDouble(Address src, FPRegisterID dest)
     {
-        UNUSED_PARAM(src);
-        UNUSED_PARAM(dest);
-        ASSERT_NOT_REACHED();
+        loadDouble(src, ARMRegisters::SD0);
+        subDouble(ARMRegisters::SD0, dest);
     }
 
     void mulDouble(FPRegisterID src, FPRegisterID dest)
     {
-        UNUSED_PARAM(src);
-        UNUSED_PARAM(dest);
-        ASSERT_NOT_REACHED();
+        m_assembler.fmuld_r(dest, dest, src);
     }
 
     void mulDouble(Address src, FPRegisterID dest)
     {
-        UNUSED_PARAM(src);
-        UNUSED_PARAM(dest);
-        ASSERT_NOT_REACHED();
+        loadDouble(src, ARMRegisters::SD0);
+        mulDouble(ARMRegisters::SD0, dest);
     }
 
     void convertInt32ToDouble(RegisterID src, FPRegisterID dest)
     {
-        UNUSED_PARAM(src);
-        UNUSED_PARAM(dest);
-        ASSERT_NOT_REACHED();
+        m_assembler.fmsr_r(dest, src);
+        m_assembler.fsitod_r(dest, dest);
     }
 
     Jump branchDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right)
     {
-        UNUSED_PARAM(cond);
-        UNUSED_PARAM(left);
-        UNUSED_PARAM(right);
-        ASSERT_NOT_REACHED();
-        return jump();
+        m_assembler.fcmpd_r(left, right);
+        m_assembler.fmstat();
+        return Jump(m_assembler.jmp(static_cast<ARMAssembler::Condition>(cond)));
     }
 
     // Truncates 'src' to an integer, and places the resulting 'dest'.
@@ -725,46 +719,56 @@ protected:
         return static_cast<ARMAssembler::Condition>(cond);
     }
 
+    void ensureSpace(int insnSpace, int constSpace)
+    {
+        m_assembler.ensureSpace(insnSpace, constSpace);
+    }
+
+    int sizeOfConstantPool()
+    {
+        return m_assembler.sizeOfConstantPool();
+    }
+
     void prepareCall()
     {
-        m_assembler.ensureSpace(3 * sizeof(ARMWord), sizeof(ARMWord));
+        ensureSpace(3 * sizeof(ARMWord), sizeof(ARMWord));
 
         // S0 might be used for parameter passing
-        m_assembler.add_r(ARM::S1, ARM::pc, ARMAssembler::OP2_IMM | 0x4);
-        m_assembler.push_r(ARM::S1);
+        m_assembler.add_r(ARMRegisters::S1, ARMRegisters::pc, ARMAssembler::OP2_IMM | 0x4);
+        m_assembler.push_r(ARMRegisters::S1);
     }
 
     void call32(RegisterID base, int32_t offset)
     {
-        if (base == ARM::sp)
+        if (base == ARMRegisters::sp)
             offset += 4;
 
         if (offset >= 0) {
             if (offset <= 0xfff) {
                 prepareCall();
-                m_assembler.dtr_u(true, ARM::pc, base, offset);
+                m_assembler.dtr_u(true, ARMRegisters::pc, base, offset);
             } else if (offset <= 0xfffff) {
-                m_assembler.add_r(ARM::S0, base, ARMAssembler::OP2_IMM | (offset >> 12) | (10 << 8));
+                m_assembler.add_r(ARMRegisters::S0, base, ARMAssembler::OP2_IMM | (offset >> 12) | (10 << 8));
                 prepareCall();
-                m_assembler.dtr_u(true, ARM::pc, ARM::S0, offset & 0xfff);
+                m_assembler.dtr_u(true, ARMRegisters::pc, ARMRegisters::S0, offset & 0xfff);
             } else {
-                ARMWord reg = m_assembler.getImm(offset, ARM::S0);
+                ARMWord reg = m_assembler.getImm(offset, ARMRegisters::S0);
                 prepareCall();
-                m_assembler.dtr_ur(true, ARM::pc, base, reg);
+                m_assembler.dtr_ur(true, ARMRegisters::pc, base, reg);
             }
         } else  {
             offset = -offset;
             if (offset <= 0xfff) {
                 prepareCall();
-                m_assembler.dtr_d(true, ARM::pc, base, offset);
+                m_assembler.dtr_d(true, ARMRegisters::pc, base, offset);
             } else if (offset <= 0xfffff) {
-                m_assembler.sub_r(ARM::S0, base, ARMAssembler::OP2_IMM | (offset >> 12) | (10 << 8));
+                m_assembler.sub_r(ARMRegisters::S0, base, ARMAssembler::OP2_IMM | (offset >> 12) | (10 << 8));
                 prepareCall();
-                m_assembler.dtr_d(true, ARM::pc, ARM::S0, offset & 0xfff);
+                m_assembler.dtr_d(true, ARMRegisters::pc, ARMRegisters::S0, offset & 0xfff);
             } else {
-                ARMWord reg = m_assembler.getImm(offset, ARM::S0);
+                ARMWord reg = m_assembler.getImm(offset, ARMRegisters::S0);
                 prepareCall();
-                m_assembler.dtr_dr(true, ARM::pc, base, reg);
+                m_assembler.dtr_dr(true, ARMRegisters::pc, base, reg);
             }
         }
     }
@@ -788,10 +792,11 @@ private:
         ARMAssembler::relinkCall(call.dataLocation(), destination.executableAddress());
     }
 
+    static const bool s_isVFPPresent;
 };
 
 }
 
-#endif
+#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM) && !PLATFORM_ARM_ARCH(7)
 
 #endif // MacroAssemblerARM_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARMv7.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARMv7.h
index f7a8402..999056b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARMv7.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARMv7.h
@@ -39,9 +39,9 @@ class MacroAssemblerARMv7 : public AbstractMacroAssembler<ARMv7Assembler> {
     // FIXME: switch dataTempRegister & addressTempRegister, or possibly use r7?
     //        - dTR is likely used more than aTR, and we'll get better instruction
     //        encoding if it's in the low 8 registers.
-    static const ARM::RegisterID dataTempRegister = ARM::ip;
-    static const RegisterID addressTempRegister = ARM::r3;
-    static const FPRegisterID fpTempRegister = ARM::d7;
+    static const ARMRegisters::RegisterID dataTempRegister = ARMRegisters::ip;
+    static const RegisterID addressTempRegister = ARMRegisters::r3;
+    static const FPRegisterID fpTempRegister = ARMRegisters::d7;
 
     struct ArmAddress {
         enum AddressType {
@@ -102,8 +102,8 @@ public:
         DoubleLessThanOrEqual = ARMv7Assembler::ConditionLS,
     };
 
-    static const RegisterID stackPointerRegister = ARM::sp;
-    static const RegisterID linkRegister = ARM::lr;
+    static const RegisterID stackPointerRegister = ARMRegisters::sp;
+    static const RegisterID linkRegister = ARMRegisters::lr;
 
     // Integer arithmetic operations:
     //
@@ -532,6 +532,7 @@ public:
     Jump branchTruncateDoubleToInt32(FPRegisterID, RegisterID)
     {
         ASSERT_NOT_REACHED();
+        return jump();
     }
 
 
@@ -546,13 +547,13 @@ public:
     void pop(RegisterID dest)
     {
         // store postindexed with writeback
-        m_assembler.ldr(dest, ARM::sp, sizeof(void*), false, true);
+        m_assembler.ldr(dest, ARMRegisters::sp, sizeof(void*), false, true);
     }
 
     void push(RegisterID src)
     {
         // store preindexed with writeback
-        m_assembler.str(src, ARM::sp, -sizeof(void*), true, true);
+        m_assembler.str(src, ARMRegisters::sp, -sizeof(void*), true, true);
     }
 
     void push(Address address)
@@ -1038,7 +1039,7 @@ protected:
         return addressTempRegister;
     }
 
-    DataLabel32 moveFixedWidthEncoding(Imm32 imm, RegisterID dst)
+    void moveFixedWidthEncoding(Imm32 imm, RegisterID dst)
     {
         uint32_t value = imm.m_value;
         m_assembler.movT3(dst, ARMThumbImmediate::makeUInt16(value & 0xffff));
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86.h
index 0b9ff35..6e96240 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86.h
@@ -51,6 +51,8 @@ public:
     using MacroAssemblerX86Common::store32;
     using MacroAssemblerX86Common::branch32;
     using MacroAssemblerX86Common::call;
+    using MacroAssemblerX86Common::loadDouble;
+    using MacroAssemblerX86Common::convertInt32ToDouble;
 
     void add32(Imm32 imm, RegisterID src, RegisterID dest)
     {
@@ -87,6 +89,17 @@ public:
         m_assembler.movl_mr(address, dest);
     }
 
+    void loadDouble(void* address, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.movsd_mr(address, dest);
+    }
+
+    void convertInt32ToDouble(AbsoluteAddress src, FPRegisterID dest)
+    {
+        m_assembler.cvtsi2sd_mr(src.m_ptr, dest);
+    }
+
     void store32(Imm32 imm, void* address)
     {
         m_assembler.movl_i32m(imm.m_value, address);
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86Common.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86Common.h
index cea691e..61e0e17 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86Common.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86Common.h
@@ -57,13 +57,14 @@ public:
 
     enum DoubleCondition {
         DoubleEqual = X86Assembler::ConditionE,
+        DoubleNotEqual = X86Assembler::ConditionNE,
         DoubleGreaterThan = X86Assembler::ConditionA,
         DoubleGreaterThanOrEqual = X86Assembler::ConditionAE,
         DoubleLessThan = X86Assembler::ConditionB,
         DoubleLessThanOrEqual = X86Assembler::ConditionBE,
     };
 
-    static const RegisterID stackPointerRegister = X86::esp;
+    static const RegisterID stackPointerRegister = X86Registers::esp;
 
     // Integer arithmetic operations:
     //
@@ -91,6 +92,11 @@ public:
     {
         m_assembler.addl_mr(src.offset, src.base, dest);
     }
+
+    void add32(RegisterID src, Address dest)
+    {
+        m_assembler.addl_rm(src, dest.offset, dest.base);
+    }
     
     void and32(RegisterID src, RegisterID dest)
     {
@@ -102,6 +108,16 @@ public:
         m_assembler.andl_ir(imm.m_value, dest);
     }
 
+    void and32(RegisterID src, Address dest)
+    {
+        m_assembler.andl_rm(src, dest.offset, dest.base);
+    }
+
+    void and32(Address src, RegisterID dest)
+    {
+        m_assembler.andl_mr(src.offset, src.base, dest);
+    }
+
     void and32(Imm32 imm, Address address)
     {
         m_assembler.andl_im(imm.m_value, address.offset, address.base);
@@ -116,20 +132,20 @@ public:
     {
         // On x86 we can only shift by ecx; if asked to shift by another register we'll
         // need rejig the shift amount into ecx first, and restore the registers afterwards.
-        if (shift_amount != X86::ecx) {
-            swap(shift_amount, X86::ecx);
+        if (shift_amount != X86Registers::ecx) {
+            swap(shift_amount, X86Registers::ecx);
 
             // E.g. transform "shll %eax, %eax" -> "xchgl %eax, %ecx; shll %ecx, %ecx; xchgl %eax, %ecx"
             if (dest == shift_amount)
-                m_assembler.shll_CLr(X86::ecx);
+                m_assembler.shll_CLr(X86Registers::ecx);
             // E.g. transform "shll %eax, %ecx" -> "xchgl %eax, %ecx; shll %ecx, %eax; xchgl %eax, %ecx"
-            else if (dest == X86::ecx)
+            else if (dest == X86Registers::ecx)
                 m_assembler.shll_CLr(shift_amount);
             // E.g. transform "shll %eax, %ebx" -> "xchgl %eax, %ecx; shll %ecx, %ebx; xchgl %eax, %ecx"
             else
                 m_assembler.shll_CLr(dest);
         
-            swap(shift_amount, X86::ecx);
+            swap(shift_amount, X86Registers::ecx);
         } else
             m_assembler.shll_CLr(dest);
     }
@@ -138,16 +154,36 @@ public:
     {
         m_assembler.imull_rr(src, dest);
     }
+
+    void mul32(Address src, RegisterID dest)
+    {
+        m_assembler.imull_mr(src.offset, src.base, dest);
+    }
     
     void mul32(Imm32 imm, RegisterID src, RegisterID dest)
     {
         m_assembler.imull_i32r(src, imm.m_value, dest);
     }
-    
+
+    void neg32(RegisterID srcDest)
+    {
+        m_assembler.negl_r(srcDest);
+    }
+
+    void neg32(Address srcDest)
+    {
+        m_assembler.negl_m(srcDest.offset, srcDest.base);
+    }
+
     void not32(RegisterID srcDest)
     {
         m_assembler.notl_r(srcDest);
     }
+
+    void not32(Address srcDest)
+    {
+        m_assembler.notl_m(srcDest.offset, srcDest.base);
+    }
     
     void or32(RegisterID src, RegisterID dest)
     {
@@ -159,6 +195,16 @@ public:
         m_assembler.orl_ir(imm.m_value, dest);
     }
 
+    void or32(RegisterID src, Address dest)
+    {
+        m_assembler.orl_rm(src, dest.offset, dest.base);
+    }
+
+    void or32(Address src, RegisterID dest)
+    {
+        m_assembler.orl_mr(src.offset, src.base, dest);
+    }
+
     void or32(Imm32 imm, Address address)
     {
         m_assembler.orl_im(imm.m_value, address.offset, address.base);
@@ -168,20 +214,20 @@ public:
     {
         // On x86 we can only shift by ecx; if asked to shift by another register we'll
         // need rejig the shift amount into ecx first, and restore the registers afterwards.
-        if (shift_amount != X86::ecx) {
-            swap(shift_amount, X86::ecx);
+        if (shift_amount != X86Registers::ecx) {
+            swap(shift_amount, X86Registers::ecx);
 
             // E.g. transform "shll %eax, %eax" -> "xchgl %eax, %ecx; shll %ecx, %ecx; xchgl %eax, %ecx"
             if (dest == shift_amount)
-                m_assembler.sarl_CLr(X86::ecx);
+                m_assembler.sarl_CLr(X86Registers::ecx);
             // E.g. transform "shll %eax, %ecx" -> "xchgl %eax, %ecx; shll %ecx, %eax; xchgl %eax, %ecx"
-            else if (dest == X86::ecx)
+            else if (dest == X86Registers::ecx)
                 m_assembler.sarl_CLr(shift_amount);
             // E.g. transform "shll %eax, %ebx" -> "xchgl %eax, %ecx; shll %ecx, %ebx; xchgl %eax, %ecx"
             else
                 m_assembler.sarl_CLr(dest);
         
-            swap(shift_amount, X86::ecx);
+            swap(shift_amount, X86Registers::ecx);
         } else
             m_assembler.sarl_CLr(dest);
     }
@@ -211,14 +257,35 @@ public:
         m_assembler.subl_mr(src.offset, src.base, dest);
     }
 
+    void sub32(RegisterID src, Address dest)
+    {
+        m_assembler.subl_rm(src, dest.offset, dest.base);
+    }
+
+
     void xor32(RegisterID src, RegisterID dest)
     {
         m_assembler.xorl_rr(src, dest);
     }
 
-    void xor32(Imm32 imm, RegisterID srcDest)
+    void xor32(Imm32 imm, Address dest)
     {
-        m_assembler.xorl_ir(imm.m_value, srcDest);
+        m_assembler.xorl_im(imm.m_value, dest.offset, dest.base);
+    }
+
+    void xor32(Imm32 imm, RegisterID dest)
+    {
+        m_assembler.xorl_ir(imm.m_value, dest);
+    }
+
+    void xor32(RegisterID src, Address dest)
+    {
+        m_assembler.xorl_rm(src, dest.offset, dest.base);
+    }
+
+    void xor32(Address src, RegisterID dest)
+    {
+        m_assembler.xorl_mr(src.offset, src.base, dest);
     }
     
 
@@ -300,6 +367,18 @@ public:
         m_assembler.addsd_mr(src.offset, src.base, dest);
     }
 
+    void divDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.divsd_rr(src, dest);
+    }
+
+    void divDouble(Address src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.divsd_mr(src.offset, src.base, dest);
+    }
+
     void subDouble(FPRegisterID src, FPRegisterID dest)
     {
         ASSERT(isSSE2Present());
@@ -330,6 +409,11 @@ public:
         m_assembler.cvtsi2sd_rr(src, dest);
     }
 
+    void convertInt32ToDouble(Address src, FPRegisterID dest)
+    {
+        m_assembler.cvtsi2sd_mr(src.offset, src.base, dest);
+    }
+
     Jump branchDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right)
     {
         ASSERT(isSSE2Present());
@@ -337,6 +421,12 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
+    Jump branchDouble(DoubleCondition cond, FPRegisterID left, Address right)
+    {
+        m_assembler.ucomisd_mr(right.offset, right.base, left);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
     // Truncates 'src' to an integer, and places the resulting 'dest'.
     // If the result is not representable as a 32 bit value, branch.
     // May also branch for some values that are representable in 32 bits
@@ -348,6 +438,12 @@ public:
         return branch32(Equal, dest, Imm32(0x80000000));
     }
 
+    void zeroDouble(FPRegisterID srcDest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.xorpd_rr(srcDest, srcDest);
+    }
+
 
     // Stack manipulation operations:
     //
@@ -397,15 +493,13 @@ public:
     {
         // Note: on 64-bit this is is a full register move; perhaps it would be
         // useful to have separate move32 & movePtr, with move32 zero extending?
-        m_assembler.movq_rr(src, dest);
+        if (src != dest)
+            m_assembler.movq_rr(src, dest);
     }
 
     void move(ImmPtr imm, RegisterID dest)
     {
-        if (CAN_SIGN_EXTEND_U32_64(imm.asIntptr()))
-            m_assembler.movl_i32r(static_cast<int32_t>(imm.asIntptr()), dest);
-        else
-            m_assembler.movq_i64r(imm.asIntptr(), dest);
+        m_assembler.movq_i64r(imm.asIntptr(), dest);
     }
 
     void swap(RegisterID reg1, RegisterID reg2)
@@ -605,12 +699,40 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
     
+    Jump branchAdd32(Condition cond, Imm32 src, Address dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
+        add32(src, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchAdd32(Condition cond, RegisterID src, Address dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
+        add32(src, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchAdd32(Condition cond, Address src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
+        add32(src, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
     Jump branchMul32(Condition cond, RegisterID src, RegisterID dest)
     {
         ASSERT(cond == Overflow);
         mul32(src, dest);
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
+
+    Jump branchMul32(Condition cond, Address src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
+        mul32(src, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
     
     Jump branchMul32(Condition cond, Imm32 imm, RegisterID src, RegisterID dest)
     {
@@ -632,7 +754,35 @@ public:
         sub32(imm, dest);
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
-    
+
+    Jump branchSub32(Condition cond, Imm32 imm, Address dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
+        sub32(imm, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchSub32(Condition cond, RegisterID src, Address dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
+        sub32(src, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchSub32(Condition cond, Address src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
+        sub32(src, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchOr32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Signed) || (cond == Zero) || (cond == NonZero));
+        or32(src, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
 
     // Miscellaneous operations:
 
@@ -661,6 +811,27 @@ public:
         m_assembler.ret();
     }
 
+    void set8(Condition cond, RegisterID left, RegisterID right, RegisterID dest)
+    {
+        m_assembler.cmpl_rr(right, left);
+        m_assembler.setCC_r(x86Condition(cond), dest);
+    }
+
+    void set8(Condition cond, Address left, RegisterID right, RegisterID dest)
+    {
+        m_assembler.cmpl_mr(left.offset, left.base, right);
+        m_assembler.setCC_r(x86Condition(cond), dest);
+    }
+
+    void set8(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    {
+        if (((cond == Equal) || (cond == NotEqual)) && !right.m_value)
+            m_assembler.testl_rr(left, left);
+        else
+            m_assembler.cmpl_ir(right.m_value, left);
+        m_assembler.setCC_r(x86Condition(cond), dest);
+    }
+
     void set32(Condition cond, RegisterID left, RegisterID right, RegisterID dest)
     {
         m_assembler.cmpl_rr(right, left);
@@ -682,6 +853,16 @@ public:
     // The mask should be optional... paerhaps the argument order should be
     // dest-src, operations always have a dest? ... possibly not true, considering
     // asm ops like test, or pseudo ops like pop().
+
+    void setTest8(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    {
+        if (mask.m_value == -1)
+            m_assembler.cmpl_im(0, address.offset, address.base);
+        else
+            m_assembler.testl_i32m(mask.m_value, address.offset, address.base);
+        m_assembler.setCC_r(x86Condition(cond), dest);
+    }
+
     void setTest32(Condition cond, Address address, Imm32 mask, RegisterID dest)
     {
         if (mask.m_value == -1)
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86_64.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86_64.h
index df0090a..0f95fe6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86_64.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86_64.h
@@ -38,7 +38,7 @@ namespace JSC {
 
 class MacroAssemblerX86_64 : public MacroAssemblerX86Common {
 protected:
-    static const X86::RegisterID scratchRegister = X86::r11;
+    static const X86Registers::RegisterID scratchRegister = X86Registers::r11;
 
 public:
     static const Scale ScalePtr = TimesEight;
@@ -50,6 +50,8 @@ public:
     using MacroAssemblerX86Common::load32;
     using MacroAssemblerX86Common::store32;
     using MacroAssemblerX86Common::call;
+    using MacroAssemblerX86Common::loadDouble;
+    using MacroAssemblerX86Common::convertInt32ToDouble;
 
     void add32(Imm32 imm, AbsoluteAddress address)
     {
@@ -77,21 +79,33 @@ public:
 
     void load32(void* address, RegisterID dest)
     {
-        if (dest == X86::eax)
+        if (dest == X86Registers::eax)
             m_assembler.movl_mEAX(address);
         else {
-            move(X86::eax, dest);
+            move(X86Registers::eax, dest);
             m_assembler.movl_mEAX(address);
-            swap(X86::eax, dest);
+            swap(X86Registers::eax, dest);
         }
     }
 
+    void loadDouble(void* address, FPRegisterID dest)
+    {
+        move(ImmPtr(address), scratchRegister);
+        loadDouble(scratchRegister, dest);
+    }
+
+    void convertInt32ToDouble(AbsoluteAddress src, FPRegisterID dest)
+    {
+        move(Imm32(*static_cast<int32_t*>(src.m_ptr)), scratchRegister);
+        m_assembler.cvtsi2sd_rr(scratchRegister, dest);
+    }
+
     void store32(Imm32 imm, void* address)
     {
-        move(X86::eax, scratchRegister);
-        move(imm, X86::eax);
+        move(X86Registers::eax, scratchRegister);
+        move(imm, X86Registers::eax);
         m_assembler.movl_EAXm(address);
-        move(scratchRegister, X86::eax);
+        move(scratchRegister, X86Registers::eax);
     }
 
     Call call()
@@ -182,20 +196,20 @@ public:
     {
         // On x86 we can only shift by ecx; if asked to shift by another register we'll
         // need rejig the shift amount into ecx first, and restore the registers afterwards.
-        if (shift_amount != X86::ecx) {
-            swap(shift_amount, X86::ecx);
+        if (shift_amount != X86Registers::ecx) {
+            swap(shift_amount, X86Registers::ecx);
 
             // E.g. transform "shll %eax, %eax" -> "xchgl %eax, %ecx; shll %ecx, %ecx; xchgl %eax, %ecx"
             if (dest == shift_amount)
-                m_assembler.sarq_CLr(X86::ecx);
+                m_assembler.sarq_CLr(X86Registers::ecx);
             // E.g. transform "shll %eax, %ecx" -> "xchgl %eax, %ecx; shll %ecx, %eax; xchgl %eax, %ecx"
-            else if (dest == X86::ecx)
+            else if (dest == X86Registers::ecx)
                 m_assembler.sarq_CLr(shift_amount);
             // E.g. transform "shll %eax, %ebx" -> "xchgl %eax, %ecx; shll %ecx, %ebx; xchgl %eax, %ecx"
             else
                 m_assembler.sarq_CLr(dest);
         
-            swap(shift_amount, X86::ecx);
+            swap(shift_amount, X86Registers::ecx);
         } else
             m_assembler.sarq_CLr(dest);
     }
@@ -244,12 +258,12 @@ public:
 
     void loadPtr(void* address, RegisterID dest)
     {
-        if (dest == X86::eax)
+        if (dest == X86Registers::eax)
             m_assembler.movq_mEAX(address);
         else {
-            move(X86::eax, dest);
+            move(X86Registers::eax, dest);
             m_assembler.movq_mEAX(address);
-            swap(X86::eax, dest);
+            swap(X86Registers::eax, dest);
         }
     }
 
@@ -271,24 +285,19 @@ public:
     
     void storePtr(RegisterID src, void* address)
     {
-        if (src == X86::eax)
+        if (src == X86Registers::eax)
             m_assembler.movq_EAXm(address);
         else {
-            swap(X86::eax, src);
+            swap(X86Registers::eax, src);
             m_assembler.movq_EAXm(address);
-            swap(X86::eax, src);
+            swap(X86Registers::eax, src);
         }
     }
 
     void storePtr(ImmPtr imm, ImplicitAddress address)
     {
-        intptr_t ptr = imm.asIntptr();
-        if (CAN_SIGN_EXTEND_32_64(ptr))
-            m_assembler.movq_i32m(static_cast<int>(ptr), address.offset, address.base);
-        else {
-            move(imm, scratchRegister);
-            storePtr(scratchRegister, address);
-        }
+        move(imm, scratchRegister);
+        storePtr(scratchRegister, address);
     }
 
     DataLabel32 storePtrWithAddressOffsetPatch(RegisterID src, Address address)
@@ -325,17 +334,8 @@ public:
 
     Jump branchPtr(Condition cond, RegisterID left, ImmPtr right)
     {
-        intptr_t imm = right.asIntptr();
-        if (CAN_SIGN_EXTEND_32_64(imm)) {
-            if (!imm)
-                m_assembler.testq_rr(left, left);
-            else
-                m_assembler.cmpq_ir(imm, left);
-            return Jump(m_assembler.jCC(x86Condition(cond)));
-        } else {
-            move(right, scratchRegister);
-            return branchPtr(cond, left, scratchRegister);
-        }
+        move(right, scratchRegister);
+        return branchPtr(cond, left, scratchRegister);
     }
 
     Jump branchPtr(Condition cond, RegisterID left, Address right)
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/X86Assembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/X86Assembler.h
index 745bc60..cbbaaa5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/X86Assembler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/X86Assembler.h
@@ -38,12 +38,8 @@
 namespace JSC {
 
 inline bool CAN_SIGN_EXTEND_8_32(int32_t value) { return value == (int32_t)(signed char)value; }
-#if PLATFORM(X86_64)
-inline bool CAN_SIGN_EXTEND_32_64(intptr_t value) { return value == (intptr_t)(int32_t)value; }
-inline bool CAN_SIGN_EXTEND_U32_64(intptr_t value) { return value == (intptr_t)(uint32_t)value; }
-#endif
 
-namespace X86 {
+namespace X86Registers {
     typedef enum {
         eax,
         ecx,
@@ -80,8 +76,8 @@ namespace X86 {
 
 class X86Assembler {
 public:
-    typedef X86::RegisterID RegisterID;
-    typedef X86::XMMRegisterID XMMRegisterID;
+    typedef X86Registers::RegisterID RegisterID;
+    typedef X86Registers::XMMRegisterID XMMRegisterID;
     typedef XMMRegisterID FPRegisterID;
 
     typedef enum {
@@ -114,10 +110,12 @@ private:
         OP_OR_GvEv                      = 0x0B,
         OP_2BYTE_ESCAPE                 = 0x0F,
         OP_AND_EvGv                     = 0x21,
+        OP_AND_GvEv                     = 0x23,
         OP_SUB_EvGv                     = 0x29,
         OP_SUB_GvEv                     = 0x2B,
         PRE_PREDICT_BRANCH_NOT_TAKEN    = 0x2E,
         OP_XOR_EvGv                     = 0x31,
+        OP_XOR_GvEv                     = 0x33,
         OP_CMP_EvGv                     = 0x39,
         OP_CMP_GvEv                     = 0x3B,
 #if PLATFORM(X86_64)
@@ -169,6 +167,8 @@ private:
         OP2_ADDSD_VsdWsd    = 0x58,
         OP2_MULSD_VsdWsd    = 0x59,
         OP2_SUBSD_VsdWsd    = 0x5C,
+        OP2_DIVSD_VsdWsd    = 0x5E,
+        OP2_XORPD_VpdWpd    = 0x57,
         OP2_MOVD_VdEd       = 0x6E,
         OP2_MOVD_EdVd       = 0x7E,
         OP2_JCC_rel32       = 0x80,
@@ -205,6 +205,7 @@ private:
 
         GROUP3_OP_TEST = 0,
         GROUP3_OP_NOT  = 2,
+        GROUP3_OP_NEG  = 3,
         GROUP3_OP_IDIV = 7,
 
         GROUP5_OP_CALLN = 2,
@@ -226,7 +227,6 @@ public:
         {
         }
 
-        void enableLatePatch() { }
     private:
         JmpSrc(int offset)
             : m_offset(offset)
@@ -319,6 +319,11 @@ public:
         m_formatter.oneByteOp(OP_ADD_GvEv, dst, base, offset);
     }
 
+    void addl_rm(RegisterID src, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_ADD_EvGv, src, base, offset);
+    }
+
     void addl_ir(int imm, RegisterID dst)
     {
         if (CAN_SIGN_EXTEND_8_32(imm)) {
@@ -386,6 +391,16 @@ public:
         m_formatter.oneByteOp(OP_AND_EvGv, src, dst);
     }
 
+    void andl_mr(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_AND_GvEv, dst, base, offset);
+    }
+
+    void andl_rm(RegisterID src, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_AND_EvGv, src, base, offset);
+    }
+
     void andl_ir(int imm, RegisterID dst)
     {
         if (CAN_SIGN_EXTEND_8_32(imm)) {
@@ -437,11 +452,26 @@ public:
     }
 #endif
 
+    void negl_r(RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_GROUP3_Ev, GROUP3_OP_NEG, dst);
+    }
+
+    void negl_m(int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_GROUP3_Ev, GROUP3_OP_NEG, base, offset);
+    }
+
     void notl_r(RegisterID dst)
     {
         m_formatter.oneByteOp(OP_GROUP3_Ev, GROUP3_OP_NOT, dst);
     }
 
+    void notl_m(int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_GROUP3_Ev, GROUP3_OP_NOT, base, offset);
+    }
+
     void orl_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp(OP_OR_EvGv, src, dst);
@@ -452,6 +482,11 @@ public:
         m_formatter.oneByteOp(OP_OR_GvEv, dst, base, offset);
     }
 
+    void orl_rm(RegisterID src, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_OR_EvGv, src, base, offset);
+    }
+
     void orl_ir(int imm, RegisterID dst)
     {
         if (CAN_SIGN_EXTEND_8_32(imm)) {
@@ -513,6 +548,11 @@ public:
         m_formatter.oneByteOp(OP_SUB_GvEv, dst, base, offset);
     }
 
+    void subl_rm(RegisterID src, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_SUB_EvGv, src, base, offset);
+    }
+
     void subl_ir(int imm, RegisterID dst)
     {
         if (CAN_SIGN_EXTEND_8_32(imm)) {
@@ -569,6 +609,27 @@ public:
         m_formatter.oneByteOp(OP_XOR_EvGv, src, dst);
     }
 
+    void xorl_mr(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_XOR_GvEv, dst, base, offset);
+    }
+
+    void xorl_rm(RegisterID src, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_XOR_EvGv, src, base, offset);
+    }
+
+    void xorl_im(int imm, int offset, RegisterID base)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_XOR, base, offset);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_XOR, base, offset);
+            m_formatter.immediate32(imm);
+        }
+    }
+
     void xorl_ir(int imm, RegisterID dst)
     {
         if (CAN_SIGN_EXTEND_8_32(imm)) {
@@ -649,7 +710,12 @@ public:
     {
         m_formatter.twoByteOp(OP2_IMUL_GvEv, dst, src);
     }
-    
+
+    void imull_mr(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.twoByteOp(OP2_IMUL_GvEv, dst, base, offset);
+    }
+
     void imull_i32r(RegisterID src, int32_t value, RegisterID dst)
     {
         m_formatter.oneByteOp(OP_IMUL_GvEvIz, dst, src);
@@ -1048,7 +1114,7 @@ public:
 #else
     void movl_rm(RegisterID src, void* addr)
     {
-        if (src == X86::eax)
+        if (src == X86Registers::eax)
             movl_EAXm(addr);
         else 
             m_formatter.oneByteOp(OP_MOV_EvGv, src, addr);
@@ -1056,7 +1122,7 @@ public:
     
     void movl_mr(void* addr, RegisterID dst)
     {
-        if (dst == X86::eax)
+        if (dst == X86Registers::eax)
             movl_mEAX(addr);
         else
             m_formatter.oneByteOp(OP_MOV_GvEv, dst, addr);
@@ -1154,6 +1220,11 @@ public:
         return m_formatter.immediateRel32();
     }
     
+    JmpSrc jz()
+    {
+        return je();
+    }
+
     JmpSrc jl()
     {
         m_formatter.twoByteOp(jccRel32(ConditionL));
@@ -1246,6 +1317,20 @@ public:
         m_formatter.twoByteOp(OP2_CVTSI2SD_VsdEd, (RegisterID)dst, src);
     }
 
+    void cvtsi2sd_mr(int offset, RegisterID base, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_CVTSI2SD_VsdEd, (RegisterID)dst, base, offset);
+    }
+
+#if !PLATFORM(X86_64)
+    void cvtsi2sd_mr(void* address, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_CVTSI2SD_VsdEd, (RegisterID)dst, address);
+    }
+#endif
+
     void cvttsd2si_rr(XMMRegisterID src, RegisterID dst)
     {
         m_formatter.prefix(PRE_SSE_F2);
@@ -1284,6 +1369,14 @@ public:
         m_formatter.twoByteOp(OP2_MOVSD_VsdWsd, (RegisterID)dst, base, offset);
     }
 
+#if !PLATFORM(X86_64)
+    void movsd_mr(void* address, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_MOVSD_VsdWsd, (RegisterID)dst, address);
+    }
+#endif
+
     void mulsd_rr(XMMRegisterID src, XMMRegisterID dst)
     {
         m_formatter.prefix(PRE_SSE_F2);
@@ -1321,6 +1414,30 @@ public:
         m_formatter.twoByteOp(OP2_UCOMISD_VsdWsd, (RegisterID)dst, (RegisterID)src);
     }
 
+    void ucomisd_mr(int offset, RegisterID base, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_66);
+        m_formatter.twoByteOp(OP2_UCOMISD_VsdWsd, (RegisterID)dst, base, offset);
+    }
+
+    void divsd_rr(XMMRegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_DIVSD_VsdWsd, (RegisterID)dst, (RegisterID)src);
+    }
+
+    void divsd_mr(int offset, RegisterID base, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_DIVSD_VsdWsd, (RegisterID)dst, base, offset);
+    }
+
+    void xorpd_rr(XMMRegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_66);
+        m_formatter.twoByteOp(OP2_XORPD_VpdWpd, (RegisterID)dst, (RegisterID)src);
+    }
+
     // Misc instructions:
 
     void int3()
@@ -1605,6 +1722,16 @@ private:
             memoryModRM(reg, base, index, scale, offset);
         }
 
+#if !PLATFORM(X86_64)
+        void twoByteOp(TwoByteOpcodeID opcode, int reg, void* address)
+        {
+            m_buffer.ensureSpace(maxInstructionSize);
+            m_buffer.putByteUnchecked(OP_2BYTE_ESCAPE);
+            m_buffer.putByteUnchecked(opcode);
+            memoryModRM(reg, address);
+        }
+#endif
+
 #if PLATFORM(X86_64)
         // Quad-word-sized operands:
         //
@@ -1761,23 +1888,23 @@ private:
 
         // Internals; ModRm and REX formatters.
 
-        static const RegisterID noBase = X86::ebp;
-        static const RegisterID hasSib = X86::esp;
-        static const RegisterID noIndex = X86::esp;
+        static const RegisterID noBase = X86Registers::ebp;
+        static const RegisterID hasSib = X86Registers::esp;
+        static const RegisterID noIndex = X86Registers::esp;
 #if PLATFORM(X86_64)
-        static const RegisterID noBase2 = X86::r13;
-        static const RegisterID hasSib2 = X86::r12;
+        static const RegisterID noBase2 = X86Registers::r13;
+        static const RegisterID hasSib2 = X86Registers::r12;
 
         // Registers r8 & above require a REX prefixe.
         inline bool regRequiresRex(int reg)
         {
-            return (reg >= X86::r8);
+            return (reg >= X86Registers::r8);
         }
 
         // Byte operand register spl & above require a REX prefix (to prevent the 'H' registers be accessed).
         inline bool byteRegRequiresRex(int reg)
         {
-            return (reg >= X86::esp);
+            return (reg >= X86Registers::esp);
         }
 
         // Format a REX prefix byte.
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp
index 596d89a..6bac9b9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -33,6 +33,8 @@
 #include "JIT.h"
 #include "JSValue.h"
 #include "Interpreter.h"
+#include "JSFunction.h"
+#include "JSStaticScopeObject.h"
 #include "Debugger.h"
 #include "BytecodeGenerator.h"
 #include <stdio.h>
@@ -57,6 +59,9 @@ static UString escapeQuotes(const UString& str)
 
 static UString valueToSourceString(ExecState* exec, JSValue val)
 {
+    if (!val)
+        return "0";
+
     if (val.isString()) {
         UString result("\"");
         result += escapeQuotes(val.toString(exec)) + "\"";
@@ -227,44 +232,44 @@ static void printGlobalResolveInfo(const GlobalResolveInfo& resolveInfo, unsigne
 
 static void printStructureStubInfo(const StructureStubInfo& stubInfo, unsigned instructionOffset)
 {
-    switch (stubInfo.opcodeID) {
-    case op_get_by_id_self:
+    switch (stubInfo.accessType) {
+    case access_get_by_id_self:
         printf("  [%4d] %s: %s\n", instructionOffset, "get_by_id_self", pointerToSourceString(stubInfo.u.getByIdSelf.baseObjectStructure).UTF8String().c_str());
         return;
-    case op_get_by_id_proto:
+    case access_get_by_id_proto:
         printf("  [%4d] %s: %s, %s\n", instructionOffset, "get_by_id_proto", pointerToSourceString(stubInfo.u.getByIdProto.baseObjectStructure).UTF8String().c_str(), pointerToSourceString(stubInfo.u.getByIdProto.prototypeStructure).UTF8String().c_str());
         return;
-    case op_get_by_id_chain:
+    case access_get_by_id_chain:
         printf("  [%4d] %s: %s, %s\n", instructionOffset, "get_by_id_chain", pointerToSourceString(stubInfo.u.getByIdChain.baseObjectStructure).UTF8String().c_str(), pointerToSourceString(stubInfo.u.getByIdChain.chain).UTF8String().c_str());
         return;
-    case op_get_by_id_self_list:
+    case access_get_by_id_self_list:
         printf("  [%4d] %s: %s (%d)\n", instructionOffset, "op_get_by_id_self_list", pointerToSourceString(stubInfo.u.getByIdSelfList.structureList).UTF8String().c_str(), stubInfo.u.getByIdSelfList.listSize);
         return;
-    case op_get_by_id_proto_list:
+    case access_get_by_id_proto_list:
         printf("  [%4d] %s: %s (%d)\n", instructionOffset, "op_get_by_id_proto_list", pointerToSourceString(stubInfo.u.getByIdProtoList.structureList).UTF8String().c_str(), stubInfo.u.getByIdProtoList.listSize);
         return;
-    case op_put_by_id_transition:
+    case access_put_by_id_transition:
         printf("  [%4d] %s: %s, %s, %s\n", instructionOffset, "put_by_id_transition", pointerToSourceString(stubInfo.u.putByIdTransition.previousStructure).UTF8String().c_str(), pointerToSourceString(stubInfo.u.putByIdTransition.structure).UTF8String().c_str(), pointerToSourceString(stubInfo.u.putByIdTransition.chain).UTF8String().c_str());
         return;
-    case op_put_by_id_replace:
+    case access_put_by_id_replace:
         printf("  [%4d] %s: %s\n", instructionOffset, "put_by_id_replace", pointerToSourceString(stubInfo.u.putByIdReplace.baseObjectStructure).UTF8String().c_str());
         return;
-    case op_get_by_id:
+    case access_get_by_id:
         printf("  [%4d] %s\n", instructionOffset, "get_by_id");
         return;
-    case op_put_by_id:
+    case access_put_by_id:
         printf("  [%4d] %s\n", instructionOffset, "put_by_id");
         return;
-    case op_get_by_id_generic:
+    case access_get_by_id_generic:
         printf("  [%4d] %s\n", instructionOffset, "op_get_by_id_generic");
         return;
-    case op_put_by_id_generic:
+    case access_put_by_id_generic:
         printf("  [%4d] %s\n", instructionOffset, "op_put_by_id_generic");
         return;
-    case op_get_array_length:
+    case access_get_array_length:
         printf("  [%4d] %s\n", instructionOffset, "op_get_array_length");
         return;
-    case op_get_string_length:
+    case access_get_string_length:
         printf("  [%4d] %s\n", instructionOffset, "op_get_string_length");
         return;
     default:
@@ -595,6 +600,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_div: {
             printBinaryOp(location, it, "div");
+            ++it;
             break;
         }
         case op_mod: {
@@ -739,13 +745,6 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             printf("[%4d] resolve_with_base %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), idName(id0, m_identifiers[id0]).c_str());
             break;
         }
-        case op_resolve_func: {
-            int r0 = (++it)->u.operand;
-            int r1 = (++it)->u.operand;
-            int id0 = (++it)->u.operand;
-            printf("[%4d] resolve_func\t %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), idName(id0, m_identifiers[id0]).c_str());
-            break;
-        }
         case op_get_by_id: {
             printGetByIdOp(location, it, m_identifiers, "get_by_id");
             break;
@@ -1087,8 +1086,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int debugHookID = (++it)->u.operand;
             int firstLine = (++it)->u.operand;
             int lastLine = (++it)->u.operand;
-            int column = (++it)->u.operand;
-            printf("[%4d] debug\t\t %s, %d, %d, %d\n", location, debugHookName(debugHookID), firstLine, lastLine, column);
+            printf("[%4d] debug\t\t %s, %d, %d\n", location, debugHookName(debugHookID), firstLine, lastLine);
             break;
         }
         case op_profile_will_call: {
@@ -1250,45 +1248,22 @@ void CodeBlock::dumpStatistics()
 #endif
 }
 
-CodeBlock::CodeBlock(ScopeNode* ownerNode)
-    : m_numCalleeRegisters(0)
-    , m_numVars(0)
-    , m_numParameters(0)
-    , m_ownerNode(ownerNode)
-    , m_globalData(0)
-#ifndef NDEBUG
-    , m_instructionCount(0)
-#endif
-    , m_needsFullScopeChain(false)
-    , m_usesEval(false)
-    , m_usesArguments(false)
-    , m_isNumericCompareFunction(false)
-    , m_codeType(NativeCode)
-    , m_source(0)
-    , m_sourceOffset(0)
-    , m_exceptionInfo(0)
-{
-#if DUMP_CODE_BLOCK_STATISTICS
-    liveCodeBlockSet.add(this);
-#endif
-}
-
-CodeBlock::CodeBlock(ScopeNode* ownerNode, CodeType codeType, PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset)
+CodeBlock::CodeBlock(ScriptExecutable* ownerExecutable, CodeType codeType, PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset, SymbolTable* symTab)
     : m_numCalleeRegisters(0)
     , m_numVars(0)
     , m_numParameters(0)
-    , m_ownerNode(ownerNode)
+    , m_ownerExecutable(ownerExecutable)
     , m_globalData(0)
 #ifndef NDEBUG
     , m_instructionCount(0)
 #endif
-    , m_needsFullScopeChain(ownerNode->needsActivation())
-    , m_usesEval(ownerNode->usesEval())
-    , m_usesArguments(ownerNode->usesArguments())
+    , m_needsFullScopeChain(ownerExecutable->needsActivation())
+    , m_usesEval(ownerExecutable->usesEval())
     , m_isNumericCompareFunction(false)
     , m_codeType(codeType)
     , m_source(sourceProvider)
     , m_sourceOffset(sourceOffset)
+    , m_symbolTable(symTab)
     , m_exceptionInfo(new ExceptionInfo)
 {
     ASSERT(m_source);
@@ -1325,20 +1300,23 @@ CodeBlock::~CodeBlock()
         if (Structure* structure = m_methodCallLinkInfos[i].cachedStructure) {
             structure->deref();
             // Both members must be filled at the same time
-            ASSERT(m_methodCallLinkInfos[i].cachedPrototypeStructure);
+            ASSERT(!!m_methodCallLinkInfos[i].cachedPrototypeStructure);
             m_methodCallLinkInfos[i].cachedPrototypeStructure->deref();
         }
     }
 
+#if ENABLE(JIT_OPTIMIZE_CALL)
     unlinkCallers();
 #endif
 
+#endif // !ENABLE(JIT)
+
 #if DUMP_CODE_BLOCK_STATISTICS
     liveCodeBlockSet.remove(this);
 #endif
 }
 
-#if ENABLE(JIT) 
+#if ENABLE(JIT_OPTIMIZE_CALL)
 void CodeBlock::unlinkCallers()
 {
     size_t size = m_linkedCallerList.size();
@@ -1353,7 +1331,6 @@ void CodeBlock::unlinkCallers()
 
 void CodeBlock::derefStructures(Instruction* vPC) const
 {
-    ASSERT(m_codeType != NativeCode);
     Interpreter* interpreter = m_globalData->interpreter;
 
     if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self)) {
@@ -1399,7 +1376,6 @@ void CodeBlock::derefStructures(Instruction* vPC) const
 
 void CodeBlock::refStructures(Instruction* vPC) const
 {
-    ASSERT(m_codeType != NativeCode);
     Interpreter* interpreter = m_globalData->interpreter;
 
     if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self)) {
@@ -1431,26 +1407,18 @@ void CodeBlock::refStructures(Instruction* vPC) const
     ASSERT(vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id) || vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_generic) || vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id_generic));
 }
 
-void CodeBlock::mark()
+void CodeBlock::markAggregate(MarkStack& markStack)
 {
     for (size_t i = 0; i < m_constantRegisters.size(); ++i)
-        if (!m_constantRegisters[i].marked())
-            m_constantRegisters[i].mark();
-
-    for (size_t i = 0; i < m_functionExpressions.size(); ++i)
-        m_functionExpressions[i]->body()->mark();
-
-    if (m_rareData) {
-        for (size_t i = 0; i < m_rareData->m_functions.size(); ++i)
-            m_rareData->m_functions[i]->body()->mark();
-
-        m_rareData->m_evalCodeCache.mark();
-    }
+        markStack.append(m_constantRegisters[i].jsValue());
+    for (size_t i = 0; i < m_functionExprs.size(); ++i)
+        m_functionExprs[i]->markAggregate(markStack);
+    for (size_t i = 0; i < m_functionDecls.size(); ++i)
+        m_functionDecls[i]->markAggregate(markStack);
 }
 
 void CodeBlock::reparseForExceptionInfoIfNecessary(CallFrame* callFrame)
 {
-    ASSERT(m_codeType != NativeCode);
     if (m_exceptionInfo)
         return;
 
@@ -1467,61 +1435,11 @@ void CodeBlock::reparseForExceptionInfoIfNecessary(CallFrame* callFrame)
             scopeChain = scopeChain->next;
     }
 
-    switch (m_codeType) {
-        case FunctionCode: {
-            FunctionBodyNode* ownerFunctionBodyNode = static_cast<FunctionBodyNode*>(m_ownerNode);
-            RefPtr<FunctionBodyNode> newFunctionBody = m_globalData->parser->reparse<FunctionBodyNode>(m_globalData, ownerFunctionBodyNode);
-            ASSERT(newFunctionBody);
-            newFunctionBody->finishParsing(ownerFunctionBodyNode->copyParameters(), ownerFunctionBodyNode->parameterCount());
-
-            m_globalData->scopeNodeBeingReparsed = newFunctionBody.get();
-
-            CodeBlock& newCodeBlock = newFunctionBody->bytecodeForExceptionInfoReparse(scopeChain, this);
-            ASSERT(newCodeBlock.m_exceptionInfo);
-            ASSERT(newCodeBlock.m_instructionCount == m_instructionCount);
-
-#if ENABLE(JIT)
-            JIT::compile(m_globalData, &newCodeBlock);
-            ASSERT(newFunctionBody->generatedJITCode().size() == ownerNode()->generatedJITCode().size());
-#endif
-
-            m_exceptionInfo.set(newCodeBlock.m_exceptionInfo.release());
-
-            m_globalData->scopeNodeBeingReparsed = 0;
-
-            break;
-        }
-        case EvalCode: {
-            EvalNode* ownerEvalNode = static_cast<EvalNode*>(m_ownerNode);
-            RefPtr<EvalNode> newEvalBody = m_globalData->parser->reparse<EvalNode>(m_globalData, ownerEvalNode);
-
-            m_globalData->scopeNodeBeingReparsed = newEvalBody.get();
-
-            EvalCodeBlock& newCodeBlock = newEvalBody->bytecodeForExceptionInfoReparse(scopeChain, this);
-            ASSERT(newCodeBlock.m_exceptionInfo);
-            ASSERT(newCodeBlock.m_instructionCount == m_instructionCount);
-
-#if ENABLE(JIT)
-            JIT::compile(m_globalData, &newCodeBlock);
-            ASSERT(newEvalBody->generatedJITCode().size() == ownerNode()->generatedJITCode().size());
-#endif
-
-            m_exceptionInfo.set(newCodeBlock.m_exceptionInfo.release());
-
-            m_globalData->scopeNodeBeingReparsed = 0;
-
-            break;
-        }
-        default:
-            // CodeBlocks for Global code blocks are transient and therefore to not gain from 
-            // from throwing out there exception information.
-            ASSERT_NOT_REACHED();
-    }
+    m_exceptionInfo.set(m_ownerExecutable->reparseExceptionInfo(m_globalData, scopeChain, this));
 }
 
 HandlerInfo* CodeBlock::handlerForBytecodeOffset(unsigned bytecodeOffset)
 {
-    ASSERT(m_codeType != NativeCode);
     ASSERT(bytecodeOffset < m_instructionCount);
 
     if (!m_rareData)
@@ -1540,14 +1458,13 @@ HandlerInfo* CodeBlock::handlerForBytecodeOffset(unsigned bytecodeOffset)
 
 int CodeBlock::lineNumberForBytecodeOffset(CallFrame* callFrame, unsigned bytecodeOffset)
 {
-    ASSERT(m_codeType != NativeCode);
     ASSERT(bytecodeOffset < m_instructionCount);
 
     reparseForExceptionInfoIfNecessary(callFrame);
     ASSERT(m_exceptionInfo);
 
     if (!m_exceptionInfo->m_lineInfo.size())
-        return m_ownerNode->source().firstLine(); // Empty function
+        return m_ownerExecutable->source().firstLine(); // Empty function
 
     int low = 0;
     int high = m_exceptionInfo->m_lineInfo.size();
@@ -1560,13 +1477,12 @@ int CodeBlock::lineNumberForBytecodeOffset(CallFrame* callFrame, unsigned byteco
     }
     
     if (!low)
-        return m_ownerNode->source().firstLine();
+        return m_ownerExecutable->source().firstLine();
     return m_exceptionInfo->m_lineInfo[low - 1].lineNumber;
 }
 
 int CodeBlock::expressionRangeForBytecodeOffset(CallFrame* callFrame, unsigned bytecodeOffset, int& divot, int& startOffset, int& endOffset)
 {
-    ASSERT(m_codeType != NativeCode);
     ASSERT(bytecodeOffset < m_instructionCount);
 
     reparseForExceptionInfoIfNecessary(callFrame);
@@ -1606,7 +1522,6 @@ int CodeBlock::expressionRangeForBytecodeOffset(CallFrame* callFrame, unsigned b
 
 bool CodeBlock::getByIdExceptionInfoForBytecodeOffset(CallFrame* callFrame, unsigned bytecodeOffset, OpcodeID& opcodeID)
 {
-    ASSERT(m_codeType != NativeCode);
     ASSERT(bytecodeOffset < m_instructionCount);
 
     reparseForExceptionInfoIfNecessary(callFrame);
@@ -1635,7 +1550,6 @@ bool CodeBlock::getByIdExceptionInfoForBytecodeOffset(CallFrame* callFrame, unsi
 #if ENABLE(JIT)
 bool CodeBlock::functionRegisterForBytecodeOffset(unsigned bytecodeOffset, int& functionRegisterIndex)
 {
-    ASSERT(m_codeType != NativeCode);
     ASSERT(bytecodeOffset < m_instructionCount);
 
     if (!m_rareData || !m_rareData->m_functionRegisterInfos.size())
@@ -1662,7 +1576,6 @@ bool CodeBlock::functionRegisterForBytecodeOffset(unsigned bytecodeOffset, int&
 #if !ENABLE(JIT)
 bool CodeBlock::hasGlobalResolveInstructionAtBytecodeOffset(unsigned bytecodeOffset)
 {
-    ASSERT(m_codeType != NativeCode);
     if (m_globalResolveInstructions.isEmpty())
         return false;
 
@@ -1683,7 +1596,6 @@ bool CodeBlock::hasGlobalResolveInstructionAtBytecodeOffset(unsigned bytecodeOff
 #else
 bool CodeBlock::hasGlobalResolveInfoAtBytecodeOffset(unsigned bytecodeOffset)
 {
-    ASSERT(m_codeType != NativeCode);
     if (m_globalResolveInfos.isEmpty())
         return false;
 
@@ -1703,18 +1615,6 @@ bool CodeBlock::hasGlobalResolveInfoAtBytecodeOffset(unsigned bytecodeOffset)
 }
 #endif
 
-#if ENABLE(JIT)
-void CodeBlock::setJITCode(JITCode jitCode)
-{
-    ASSERT(m_codeType != NativeCode); 
-    ownerNode()->setJITCode(jitCode);
-#if !ENABLE(OPCODE_SAMPLING)
-    if (!BytecodeGenerator::dumpsGeneratedCode())
-        m_instructions.clear();
-#endif
-}
-#endif
-
 void CodeBlock::shrinkToFit()
 {
     m_instructions.shrinkToFit();
@@ -1730,7 +1630,8 @@ void CodeBlock::shrinkToFit()
 #endif
 
     m_identifiers.shrinkToFit();
-    m_functionExpressions.shrinkToFit();
+    m_functionDecls.shrinkToFit();
+    m_functionExprs.shrinkToFit();
     m_constantRegisters.shrinkToFit();
 
     if (m_exceptionInfo) {
@@ -1741,7 +1642,6 @@ void CodeBlock::shrinkToFit()
 
     if (m_rareData) {
         m_rareData->m_exceptionHandlers.shrinkToFit();
-        m_rareData->m_functions.shrinkToFit();
         m_rareData->m_regexps.shrinkToFit();
         m_rareData->m_immediateSwitchJumpTables.shrinkToFit();
         m_rareData->m_characterSwitchJumpTables.shrinkToFit();
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h
index e9f2697..0163540 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h
@@ -36,6 +36,7 @@
 #include "JSGlobalObject.h"
 #include "JumpTable.h"
 #include "Nodes.h"
+#include "PtrAndFlags.h"
 #include "RegExp.h"
 #include "UString.h"
 #include <wtf/FastAllocBase.h>
@@ -54,9 +55,13 @@ static const int FirstConstantRegisterIndex = 0x40000000;
 
 namespace JSC {
 
+    enum HasSeenShouldRepatch {
+        hasSeenShouldRepatch
+    };
+
     class ExecState;
 
-    enum CodeType { GlobalCode, EvalCode, FunctionCode, NativeCode };
+    enum CodeType { GlobalCode, EvalCode, FunctionCode };
 
     static ALWAYS_INLINE int missingThisObjectMarker() { return std::numeric_limits<int>::max(); }
 
@@ -105,25 +110,44 @@ namespace JSC {
         CodeLocationNearCall callReturnLocation;
         CodeLocationDataLabelPtr hotPathBegin;
         CodeLocationNearCall hotPathOther;
-        CodeBlock* ownerCodeBlock;
+        PtrAndFlags<CodeBlock, HasSeenShouldRepatch> ownerCodeBlock;
         CodeBlock* callee;
         unsigned position;
         
         void setUnlinked() { callee = 0; }
         bool isLinked() { return callee; }
+
+        bool seenOnce()
+        {
+            return ownerCodeBlock.isFlagSet(hasSeenShouldRepatch);
+        }
+
+        void setSeen()
+        {
+            ownerCodeBlock.setFlag(hasSeenShouldRepatch);
+        }
     };
 
     struct MethodCallLinkInfo {
         MethodCallLinkInfo()
             : cachedStructure(0)
-            , cachedPrototypeStructure(0)
         {
         }
 
+        bool seenOnce()
+        {
+            return cachedPrototypeStructure.isFlagSet(hasSeenShouldRepatch);
+        }
+
+        void setSeen()
+        {
+            cachedPrototypeStructure.setFlag(hasSeenShouldRepatch);
+        }
+
         CodeLocationCall callReturnLocation;
         CodeLocationDataLabelPtr structureLabel;
         Structure* cachedStructure;
-        Structure* cachedPrototypeStructure;
+        PtrAndFlags<Structure, HasSeenShouldRepatch> cachedPrototypeStructure;
     };
 
     struct FunctionRegisterInfo {
@@ -224,17 +248,27 @@ namespace JSC {
     }
 #endif
 
+    struct ExceptionInfo : FastAllocBase {
+        Vector<ExpressionRangeInfo> m_expressionInfo;
+        Vector<LineInfo> m_lineInfo;
+        Vector<GetByIdExceptionInfo> m_getByIdExceptionInfo;
+
+#if ENABLE(JIT)
+        Vector<CallReturnOffsetToBytecodeIndex> m_callReturnIndexVector;
+#endif
+    };
+
     class CodeBlock : public FastAllocBase {
         friend class JIT;
+    protected:
+        CodeBlock(ScriptExecutable* ownerExecutable, CodeType, PassRefPtr<SourceProvider>, unsigned sourceOffset, SymbolTable* symbolTable);
     public:
-        CodeBlock(ScopeNode* ownerNode);
-        CodeBlock(ScopeNode* ownerNode, CodeType, PassRefPtr<SourceProvider>, unsigned sourceOffset);
-        ~CodeBlock();
+        virtual ~CodeBlock();
 
-        void mark();
+        void markAggregate(MarkStack&);
         void refStructures(Instruction* vPC) const;
         void derefStructures(Instruction* vPC) const;
-#if ENABLE(JIT)
+#if ENABLE(JIT_OPTIMIZE_CALL)
         void unlinkCallers();
 #endif
 
@@ -305,7 +339,7 @@ namespace JSC {
         unsigned getBytecodeIndex(CallFrame* callFrame, ReturnAddressPtr returnAddress)
         {
             reparseForExceptionInfoIfNecessary(callFrame);
-            return binaryChop<CallReturnOffsetToBytecodeIndex, unsigned, getCallReturnOffset>(m_exceptionInfo->m_callReturnIndexVector.begin(), m_exceptionInfo->m_callReturnIndexVector.size(), ownerNode()->generatedJITCode().offsetOf(returnAddress.value()))->bytecodeIndex;
+            return binaryChop<CallReturnOffsetToBytecodeIndex, unsigned, getCallReturnOffset>(callReturnIndexVector().begin(), callReturnIndexVector().size(), ownerExecutable()->generatedJITCode().offsetOf(returnAddress.value()))->bytecodeIndex;
         }
         
         bool functionRegisterForBytecodeOffset(unsigned bytecodeOffset, int& functionRegisterIndex);
@@ -315,17 +349,19 @@ namespace JSC {
         bool isNumericCompareFunction() { return m_isNumericCompareFunction; }
 
         Vector<Instruction>& instructions() { return m_instructions; }
+        void discardBytecode() { m_instructions.clear(); }
+
 #ifndef NDEBUG
+        unsigned instructionCount() { return m_instructionCount; }
         void setInstructionCount(unsigned instructionCount) { m_instructionCount = instructionCount; }
 #endif
 
 #if ENABLE(JIT)
-        JITCode& getJITCode() { return ownerNode()->generatedJITCode(); }
-        void setJITCode(JITCode);
-        ExecutablePool* executablePool() { return ownerNode()->getExecutablePool(); }
+        JITCode& getJITCode() { return ownerExecutable()->generatedJITCode(); }
+        ExecutablePool* executablePool() { return ownerExecutable()->getExecutablePool(); }
 #endif
 
-        ScopeNode* ownerNode() const { return m_ownerNode; }
+        ScriptExecutable* ownerExecutable() const { return m_ownerExecutable; }
 
         void setGlobalData(JSGlobalData* globalData) { m_globalData = globalData; }
 
@@ -341,8 +377,8 @@ namespace JSC {
 
         CodeType codeType() const { return m_codeType; }
 
-        SourceProvider* source() const { ASSERT(m_codeType != NativeCode); return m_source.get(); }
-        unsigned sourceOffset() const { ASSERT(m_codeType != NativeCode); return m_sourceOffset; }
+        SourceProvider* source() const { return m_source.get(); }
+        unsigned sourceOffset() const { return m_sourceOffset; }
 
         size_t numberOfJumpTargets() const { return m_jumpTargets.size(); }
         void addJumpTarget(unsigned jumpTarget) { m_jumpTargets.append(jumpTarget); }
@@ -380,6 +416,7 @@ namespace JSC {
 
         bool hasExceptionInfo() const { return m_exceptionInfo; }
         void clearExceptionInfo() { m_exceptionInfo.clear(); }
+        ExceptionInfo* extractExceptionInfo() { ASSERT(m_exceptionInfo); return m_exceptionInfo.release(); }
 
         void addExpressionInfo(const ExpressionRangeInfo& expressionInfo) { ASSERT(m_exceptionInfo); m_exceptionInfo->m_expressionInfo.append(expressionInfo); }
         void addGetByIdExceptionInfo(const GetByIdExceptionInfo& info) { ASSERT(m_exceptionInfo); m_exceptionInfo->m_getByIdExceptionInfo.append(info); }
@@ -404,13 +441,11 @@ namespace JSC {
         ALWAYS_INLINE bool isConstantRegisterIndex(int index) { return index >= FirstConstantRegisterIndex; }
         ALWAYS_INLINE JSValue getConstant(int index) const { return m_constantRegisters[index - FirstConstantRegisterIndex].jsValue(); }
 
-        unsigned addFunctionExpression(FuncExprNode* n) { unsigned size = m_functionExpressions.size(); m_functionExpressions.append(n); return size; }
-        FuncExprNode* functionExpression(int index) const { return m_functionExpressions[index].get(); }
-
-        unsigned addFunction(FuncDeclNode* n) { createRareDataIfNecessary(); unsigned size = m_rareData->m_functions.size(); m_rareData->m_functions.append(n); return size; }
-        FuncDeclNode* function(int index) const { ASSERT(m_rareData); return m_rareData->m_functions[index].get(); }
-
-        bool hasFunctions() const { return m_functionExpressions.size() || (m_rareData && m_rareData->m_functions.size()); }
+        unsigned addFunctionDecl(PassRefPtr<FunctionExecutable> n) { unsigned size = m_functionDecls.size(); m_functionDecls.append(n); return size; }
+        FunctionExecutable* functionDecl(int index) { return m_functionDecls[index].get(); }
+        int numberOfFunctionDecls() { return m_functionDecls.size(); }
+        unsigned addFunctionExpr(PassRefPtr<FunctionExecutable> n) { unsigned size = m_functionExprs.size(); m_functionExprs.append(n); return size; }
+        FunctionExecutable* functionExpr(int index) { return m_functionExprs[index].get(); }
 
         unsigned addRegExp(RegExp* r) { createRareDataIfNecessary(); unsigned size = m_rareData->m_regexps.size(); m_rareData->m_regexps.append(r); return size; }
         RegExp* regexp(int index) const { ASSERT(m_rareData); return m_rareData->m_regexps[index].get(); }
@@ -431,9 +466,10 @@ namespace JSC {
         StringJumpTable& stringSwitchJumpTable(int tableIndex) { ASSERT(m_rareData); return m_rareData->m_stringSwitchJumpTables[tableIndex]; }
 
 
-        SymbolTable& symbolTable() { return m_symbolTable; }
+        SymbolTable* symbolTable() { return m_symbolTable; }
+        SharedSymbolTable* sharedSymbolTable() { ASSERT(m_codeType == FunctionCode); return static_cast<SharedSymbolTable*>(m_symbolTable); }
 
-        EvalCodeCache& evalCodeCache() { ASSERT(m_codeType != NativeCode); createRareDataIfNecessary(); return m_rareData->m_evalCodeCache; }
+        EvalCodeCache& evalCodeCache() { createRareDataIfNecessary(); return m_rareData->m_evalCodeCache; }
 
         void shrinkToFit();
 
@@ -452,12 +488,11 @@ namespace JSC {
 
         void createRareDataIfNecessary()
         {
-            ASSERT(m_codeType != NativeCode); 
             if (!m_rareData)
                 m_rareData.set(new RareData);
         }
 
-        ScopeNode* m_ownerNode;
+        ScriptExecutable* m_ownerExecutable;
         JSGlobalData* m_globalData;
 
         Vector<Instruction> m_instructions;
@@ -493,26 +528,17 @@ namespace JSC {
         // Constant Pool
         Vector<Identifier> m_identifiers;
         Vector<Register> m_constantRegisters;
-        Vector<RefPtr<FuncExprNode> > m_functionExpressions;
-
-        SymbolTable m_symbolTable;
+        Vector<RefPtr<FunctionExecutable> > m_functionDecls;
+        Vector<RefPtr<FunctionExecutable> > m_functionExprs;
 
-        struct ExceptionInfo : FastAllocBase {
-            Vector<ExpressionRangeInfo> m_expressionInfo;
-            Vector<LineInfo> m_lineInfo;
-            Vector<GetByIdExceptionInfo> m_getByIdExceptionInfo;
+        SymbolTable* m_symbolTable;
 
-#if ENABLE(JIT)
-            Vector<CallReturnOffsetToBytecodeIndex> m_callReturnIndexVector;
-#endif
-        };
         OwnPtr<ExceptionInfo> m_exceptionInfo;
 
         struct RareData : FastAllocBase {
             Vector<HandlerInfo> m_exceptionHandlers;
 
             // Rare Constants
-            Vector<RefPtr<FuncDeclNode> > m_functions;
             Vector<RefPtr<RegExp> > m_regexps;
 
             // Jump Tables
@@ -532,16 +558,16 @@ namespace JSC {
     // Program code is not marked by any function, so we make the global object
     // responsible for marking it.
 
-    class ProgramCodeBlock : public CodeBlock {
+    class GlobalCodeBlock : public CodeBlock {
     public:
-        ProgramCodeBlock(ScopeNode* ownerNode, CodeType codeType, JSGlobalObject* globalObject, PassRefPtr<SourceProvider> sourceProvider)
-            : CodeBlock(ownerNode, codeType, sourceProvider, 0)
+        GlobalCodeBlock(ScriptExecutable* ownerExecutable, CodeType codeType, PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset, JSGlobalObject* globalObject)
+            : CodeBlock(ownerExecutable, codeType, sourceProvider, sourceOffset, &m_unsharedSymbolTable)
             , m_globalObject(globalObject)
         {
             m_globalObject->codeBlocks().add(this);
         }
 
-        ~ProgramCodeBlock()
+        ~GlobalCodeBlock()
         {
             if (m_globalObject)
                 m_globalObject->codeBlocks().remove(this);
@@ -551,20 +577,54 @@ namespace JSC {
 
     private:
         JSGlobalObject* m_globalObject; // For program and eval nodes, the global object that marks the constant pool.
+        SymbolTable m_unsharedSymbolTable;
+    };
+
+    class ProgramCodeBlock : public GlobalCodeBlock {
+    public:
+        ProgramCodeBlock(ProgramExecutable* ownerExecutable, CodeType codeType, JSGlobalObject* globalObject, PassRefPtr<SourceProvider> sourceProvider)
+            : GlobalCodeBlock(ownerExecutable, codeType, sourceProvider, 0, globalObject)
+        {
+        }
     };
 
-    class EvalCodeBlock : public ProgramCodeBlock {
+    class EvalCodeBlock : public GlobalCodeBlock {
     public:
-        EvalCodeBlock(ScopeNode* ownerNode, JSGlobalObject* globalObject, PassRefPtr<SourceProvider> sourceProvider, int baseScopeDepth)
-            : ProgramCodeBlock(ownerNode, EvalCode, globalObject, sourceProvider)
+        EvalCodeBlock(EvalExecutable* ownerExecutable, JSGlobalObject* globalObject, PassRefPtr<SourceProvider> sourceProvider, int baseScopeDepth)
+            : GlobalCodeBlock(ownerExecutable, EvalCode, sourceProvider, 0, globalObject)
             , m_baseScopeDepth(baseScopeDepth)
         {
         }
 
         int baseScopeDepth() const { return m_baseScopeDepth; }
 
+        const Identifier& variable(unsigned index) { return m_variables[index]; }
+        unsigned numVariables() { return m_variables.size(); }
+        void adoptVariables(Vector<Identifier>& variables)
+        {
+            ASSERT(m_variables.isEmpty());
+            m_variables.swap(variables);
+        }
+
     private:
         int m_baseScopeDepth;
+        Vector<Identifier> m_variables;
+    };
+
+    class FunctionCodeBlock : public CodeBlock {
+    public:
+        // Rather than using the usual RefCounted::create idiom for SharedSymbolTable we just use new
+        // as we need to initialise the CodeBlock before we could initialise any RefPtr to hold the shared
+        // symbol table, so we just pass as a raw pointer with a ref count of 1.  We then manually deref
+        // in the destructor.
+        FunctionCodeBlock(FunctionExecutable* ownerExecutable, CodeType codeType, PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset)
+            : CodeBlock(ownerExecutable, codeType, sourceProvider, sourceOffset, new SharedSymbolTable)
+        {
+        }
+        ~FunctionCodeBlock()
+        {
+            sharedSymbolTable()->deref();
+        }
     };
 
     inline Register& ExecState::r(int index)
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/EvalCodeCache.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/EvalCodeCache.h
index f0ce73e..0e1fb1e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/EvalCodeCache.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/EvalCodeCache.h
@@ -29,6 +29,7 @@
 #ifndef EvalCodeCache_h
 #define EvalCodeCache_h
 
+#include "Executable.h"
 #include "JSGlobalObject.h"
 #include "Nodes.h"
 #include "Parser.h"
@@ -41,44 +42,33 @@ namespace JSC {
 
     class EvalCodeCache {
     public:
-        PassRefPtr<EvalNode> get(ExecState* exec, const UString& evalSource, ScopeChainNode* scopeChain, JSValue& exceptionValue)
+        PassRefPtr<EvalExecutable> get(ExecState* exec, const UString& evalSource, ScopeChainNode* scopeChain, JSValue& exceptionValue)
         {
-            RefPtr<EvalNode> evalNode;
+            RefPtr<EvalExecutable> evalExecutable;
 
             if (evalSource.size() < maxCacheableSourceLength && (*scopeChain->begin())->isVariableObject())
-                evalNode = m_cacheMap.get(evalSource.rep());
+                evalExecutable = m_cacheMap.get(evalSource.rep());
 
-            if (!evalNode) {
-                int errorLine;
-                UString errorMessage;
-                
-                SourceCode source = makeSource(evalSource);
-                evalNode = exec->globalData().parser->parse<EvalNode>(exec, exec->dynamicGlobalObject()->debugger(), source, &errorLine, &errorMessage);
-                if (evalNode) {
-                    if (evalSource.size() < maxCacheableSourceLength && (*scopeChain->begin())->isVariableObject() && m_cacheMap.size() < maxCacheEntries)
-                        m_cacheMap.set(evalSource.rep(), evalNode);
-                } else {
-                    exceptionValue = Error::create(exec, SyntaxError, errorMessage, errorLine, source.provider()->asID(), 0);
+            if (!evalExecutable) {
+                evalExecutable = EvalExecutable::create(makeSource(evalSource));
+                exceptionValue = evalExecutable->compile(exec, scopeChain);
+                if (exceptionValue)
                     return 0;
-                }
+
+                if (evalSource.size() < maxCacheableSourceLength && (*scopeChain->begin())->isVariableObject() && m_cacheMap.size() < maxCacheEntries)
+                    m_cacheMap.set(evalSource.rep(), evalExecutable);
             }
 
-            return evalNode.release();
+            return evalExecutable.release();
         }
 
         bool isEmpty() const { return m_cacheMap.isEmpty(); }
 
-        void mark()
-        {
-            EvalCacheMap::iterator end = m_cacheMap.end();
-            for (EvalCacheMap::iterator ptr = m_cacheMap.begin(); ptr != end; ++ptr)
-                ptr->second->mark();
-        }
     private:
         static const int maxCacheableSourceLength = 256;
         static const int maxCacheEntries = 64;
 
-        typedef HashMap<RefPtr<UString::Rep>, RefPtr<EvalNode> > EvalCacheMap;
+        typedef HashMap<RefPtr<UString::Rep>, RefPtr<EvalExecutable> > EvalCacheMap;
         EvalCacheMap m_cacheMap;
     };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/Instruction.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/Instruction.h
index 594c4dd..bcef7fb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/Instruction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/Instruction.h
@@ -32,7 +32,6 @@
 #include "MacroAssembler.h"
 #include "Opcode.h"
 #include "Structure.h"
-#include "StructureChain.h"
 #include <wtf/VectorTraits.h>
 
 #define POLYMORPHIC_LIST_CACHE_SIZE 8
@@ -54,7 +53,7 @@ namespace JSC {
     class StructureChain;
 
     // Structure used by op_get_by_id_self_list and op_get_by_id_proto_list instruction to hold data off the main opcode stream.
-    struct PolymorphicAccessStructureList {
+    struct PolymorphicAccessStructureList : FastAllocBase {
         struct PolymorphicStubInfo {
             bool isChain;
             PolymorphicAccessStructureListStubRoutineType stubRoutine;
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h
index 4baa0be..c9196ce 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h
@@ -67,7 +67,7 @@ namespace JSC {
         macro(op_negate, 3) \
         macro(op_add, 5) \
         macro(op_mul, 5) \
-        macro(op_div, 4) \
+        macro(op_div, 5) \
         macro(op_mod, 4) \
         macro(op_sub, 5) \
         \
@@ -98,7 +98,6 @@ namespace JSC {
         macro(op_put_global_var, 4) \
         macro(op_resolve_base, 3) \
         macro(op_resolve_with_base, 4) \
-        macro(op_resolve_func, 4) \
         macro(op_get_by_id, 8) \
         macro(op_get_by_id_self, 8) \
         macro(op_get_by_id_self_list, 8) \
@@ -167,7 +166,7 @@ namespace JSC {
         macro(op_jsr, 3) \
         macro(op_sret, 2) \
         \
-        macro(op_debug, 5) \
+        macro(op_debug, 4) \
         macro(op_profile_will_call, 2) \
         macro(op_profile_did_call, 2) \
         \
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.cpp
index 8651723..8d0faa1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.cpp
@@ -197,7 +197,7 @@ void SamplingTool::doRun()
 #if ENABLE(CODEBLOCK_SAMPLING)
     if (CodeBlock* codeBlock = sample.codeBlock()) {
         MutexLocker locker(m_scopeSampleMapMutex);
-        ScopeSampleRecord* record = m_scopeSampleMap->get(codeBlock->ownerNode());
+        ScopeSampleRecord* record = m_scopeSampleMap->get(codeBlock->ownerExecutable());
         ASSERT(record);
         record->sample(codeBlock, sample.vPC());
     }
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.h
index fa95603..1a3f7cf 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.h
@@ -136,7 +136,7 @@ namespace JSC {
 
     class SamplingTool {
     public:
-        friend class CallRecord;
+        friend struct CallRecord;
         friend class HostCallRecord;
         
 #if ENABLE(OPCODE_SAMPLING)
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/StructureStubInfo.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecode/StructureStubInfo.cpp
index bf3fdc4..018d832 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/StructureStubInfo.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/StructureStubInfo.cpp
@@ -31,44 +31,44 @@ namespace JSC {
 #if ENABLE(JIT)
 void StructureStubInfo::deref()
 {
-    switch (opcodeID) {
-    case op_get_by_id_self:
+    switch (accessType) {
+    case access_get_by_id_self:
         u.getByIdSelf.baseObjectStructure->deref();
         return;
-    case op_get_by_id_proto:
+    case access_get_by_id_proto:
         u.getByIdProto.baseObjectStructure->deref();
         u.getByIdProto.prototypeStructure->deref();
         return;
-    case op_get_by_id_chain:
+    case access_get_by_id_chain:
         u.getByIdChain.baseObjectStructure->deref();
         u.getByIdChain.chain->deref();
         return;
-    case op_get_by_id_self_list: {
+    case access_get_by_id_self_list: {
         PolymorphicAccessStructureList* polymorphicStructures = u.getByIdSelfList.structureList;
         polymorphicStructures->derefStructures(u.getByIdSelfList.listSize);
         delete polymorphicStructures;
         return;
     }
-    case op_get_by_id_proto_list: {
+    case access_get_by_id_proto_list: {
         PolymorphicAccessStructureList* polymorphicStructures = u.getByIdProtoList.structureList;
         polymorphicStructures->derefStructures(u.getByIdProtoList.listSize);
         delete polymorphicStructures;
         return;
     }
-    case op_put_by_id_transition:
+    case access_put_by_id_transition:
         u.putByIdTransition.previousStructure->deref();
         u.putByIdTransition.structure->deref();
         u.putByIdTransition.chain->deref();
         return;
-    case op_put_by_id_replace:
+    case access_put_by_id_replace:
         u.putByIdReplace.baseObjectStructure->deref();
         return;
-    case op_get_by_id:
-    case op_put_by_id:
-    case op_get_by_id_generic:
-    case op_put_by_id_generic:
-    case op_get_array_length:
-    case op_get_string_length:
+    case access_get_by_id:
+    case access_put_by_id:
+    case access_get_by_id_generic:
+    case access_put_by_id_generic:
+    case access_get_array_length:
+    case access_get_string_length:
         // These instructions don't ref their Structures.
         return;
     default:
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/StructureStubInfo.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/StructureStubInfo.h
index 95dd266..8e2c489 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/StructureStubInfo.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/StructureStubInfo.h
@@ -35,15 +35,32 @@
 
 namespace JSC {
 
+    enum AccessType {
+        access_get_by_id_self,
+        access_get_by_id_proto,
+        access_get_by_id_chain,
+        access_get_by_id_self_list,
+        access_get_by_id_proto_list,
+        access_put_by_id_transition,
+        access_put_by_id_replace,
+        access_get_by_id,
+        access_put_by_id,
+        access_get_by_id_generic,
+        access_put_by_id_generic,
+        access_get_array_length,
+        access_get_string_length,
+    };
+
     struct StructureStubInfo {
-        StructureStubInfo(OpcodeID opcodeID)
-            : opcodeID(opcodeID)
+        StructureStubInfo(AccessType accessType)
+            : accessType(accessType)
+            , seen(false)
         {
         }
 
         void initGetByIdSelf(Structure* baseObjectStructure)
         {
-            opcodeID = op_get_by_id_self;
+            accessType = access_get_by_id_self;
 
             u.getByIdSelf.baseObjectStructure = baseObjectStructure;
             baseObjectStructure->ref();
@@ -51,7 +68,7 @@ namespace JSC {
 
         void initGetByIdProto(Structure* baseObjectStructure, Structure* prototypeStructure)
         {
-            opcodeID = op_get_by_id_proto;
+            accessType = access_get_by_id_proto;
 
             u.getByIdProto.baseObjectStructure = baseObjectStructure;
             baseObjectStructure->ref();
@@ -62,7 +79,7 @@ namespace JSC {
 
         void initGetByIdChain(Structure* baseObjectStructure, StructureChain* chain)
         {
-            opcodeID = op_get_by_id_chain;
+            accessType = access_get_by_id_chain;
 
             u.getByIdChain.baseObjectStructure = baseObjectStructure;
             baseObjectStructure->ref();
@@ -73,7 +90,7 @@ namespace JSC {
 
         void initGetByIdSelfList(PolymorphicAccessStructureList* structureList, int listSize)
         {
-            opcodeID = op_get_by_id_self_list;
+            accessType = access_get_by_id_self_list;
 
             u.getByIdProtoList.structureList = structureList;
             u.getByIdProtoList.listSize = listSize;
@@ -81,7 +98,7 @@ namespace JSC {
 
         void initGetByIdProtoList(PolymorphicAccessStructureList* structureList, int listSize)
         {
-            opcodeID = op_get_by_id_proto_list;
+            accessType = access_get_by_id_proto_list;
 
             u.getByIdProtoList.structureList = structureList;
             u.getByIdProtoList.listSize = listSize;
@@ -91,7 +108,7 @@ namespace JSC {
 
         void initPutByIdTransition(Structure* previousStructure, Structure* structure, StructureChain* chain)
         {
-            opcodeID = op_put_by_id_transition;
+            accessType = access_put_by_id_transition;
 
             u.putByIdTransition.previousStructure = previousStructure;
             previousStructure->ref();
@@ -105,7 +122,7 @@ namespace JSC {
 
         void initPutByIdReplace(Structure* baseObjectStructure)
         {
-            opcodeID = op_put_by_id_replace;
+            accessType = access_put_by_id_replace;
     
             u.putByIdReplace.baseObjectStructure = baseObjectStructure;
             baseObjectStructure->ref();
@@ -113,7 +130,19 @@ namespace JSC {
 
         void deref();
 
-        OpcodeID opcodeID;
+        bool seenOnce()
+        {
+            return seen;
+        }
+
+        void setSeen()
+        {
+            seen = true;
+        }
+
+        int accessType : 31;
+        int seen : 1;
+
         union {
             struct {
                 Structure* baseObjectStructure;
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index 711beb4..af8f784 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -256,15 +256,15 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, const Debugger* d
         m_nextGlobalIndex -= symbolTable->size();
 
         for (size_t i = 0; i < functionStack.size(); ++i) {
-            FuncDeclNode* funcDecl = functionStack[i];
-            globalObject->removeDirect(funcDecl->m_ident); // Make sure our new function is not shadowed by an old property.
-            emitNewFunction(addGlobalVar(funcDecl->m_ident, false), funcDecl);
+            FunctionBodyNode* function = functionStack[i];
+            globalObject->removeDirect(function->ident()); // Make sure our new function is not shadowed by an old property.
+            emitNewFunction(addGlobalVar(function->ident(), false), function);
         }
 
         Vector<RegisterID*, 32> newVars;
         for (size_t i = 0; i < varStack.size(); ++i)
-            if (!globalObject->hasProperty(exec, varStack[i].first))
-                newVars.append(addGlobalVar(varStack[i].first, varStack[i].second & DeclarationStacks::IsConstant));
+            if (!globalObject->hasProperty(exec, *varStack[i].first))
+                newVars.append(addGlobalVar(*varStack[i].first, varStack[i].second & DeclarationStacks::IsConstant));
 
         preserveLastVar();
 
@@ -272,16 +272,16 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, const Debugger* d
             emitLoad(newVars[i], jsUndefined());
     } else {
         for (size_t i = 0; i < functionStack.size(); ++i) {
-            FuncDeclNode* funcDecl = functionStack[i];
-            globalObject->putWithAttributes(exec, funcDecl->m_ident, funcDecl->makeFunction(exec, scopeChain.node()), DontDelete);
+            FunctionBodyNode* function = functionStack[i];
+            globalObject->putWithAttributes(exec, function->ident(), new (exec) JSFunction(exec, makeFunction(function), scopeChain.node()), DontDelete);
         }
         for (size_t i = 0; i < varStack.size(); ++i) {
-            if (globalObject->hasProperty(exec, varStack[i].first))
+            if (globalObject->hasProperty(exec, *varStack[i].first))
                 continue;
             int attributes = DontDelete;
             if (varStack[i].second & DeclarationStacks::IsConstant)
                 attributes |= ReadOnly;
-            globalObject->putWithAttributes(exec, varStack[i].first, jsUndefined(), attributes);
+            globalObject->putWithAttributes(exec, *varStack[i].first, jsUndefined(), attributes);
         }
 
         preserveLastVar();
@@ -327,7 +327,7 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, const Debug
     } else
         emitOpcode(op_enter);
 
-     if (usesArguments) {
+    if (usesArguments) {
         emitOpcode(op_init_arguments);
 
         // The debugger currently retrieves the arguments object from an activation rather than pulling
@@ -339,18 +339,18 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, const Debug
 
     const DeclarationStacks::FunctionStack& functionStack = functionBody->functionStack();
     for (size_t i = 0; i < functionStack.size(); ++i) {
-        FuncDeclNode* funcDecl = functionStack[i];
-        const Identifier& ident = funcDecl->m_ident;
+        FunctionBodyNode* function = functionStack[i];
+        const Identifier& ident = function->ident();
         m_functions.add(ident.ustring().rep());
-        emitNewFunction(addVar(ident, false), funcDecl);
+        emitNewFunction(addVar(ident, false), function);
     }
 
     const DeclarationStacks::VarStack& varStack = functionBody->varStack();
     for (size_t i = 0; i < varStack.size(); ++i)
-        addVar(varStack[i].first, varStack[i].second & DeclarationStacks::IsConstant);
+        addVar(*varStack[i].first, varStack[i].second & DeclarationStacks::IsConstant);
 
-    const Identifier* parameters = functionBody->parameters();
-    size_t parameterCount = functionBody->parameterCount();
+    FunctionParameters& parameters = *functionBody->parameters();
+    size_t parameterCount = parameters.size();
     m_nextParameterIndex = -RegisterFile::CallFrameHeaderSize - parameterCount - 1;
     m_parameters.grow(1 + parameterCount); // reserve space for "this"
 
@@ -397,6 +397,18 @@ BytecodeGenerator::BytecodeGenerator(EvalNode* evalNode, const Debugger* debugge
     codeBlock->setGlobalData(m_globalData);
     m_codeBlock->m_numParameters = 1; // Allocate space for "this"
 
+    const DeclarationStacks::FunctionStack& functionStack = evalNode->functionStack();
+    for (size_t i = 0; i < functionStack.size(); ++i)
+        m_codeBlock->addFunctionDecl(makeFunction(functionStack[i]));
+
+    const DeclarationStacks::VarStack& varStack = evalNode->varStack();
+    unsigned numVariables = varStack.size();
+    Vector<Identifier> variables;
+    variables.reserveCapacity(numVariables);
+    for (size_t i = 0; i < numVariables; ++i)
+        variables.append(*varStack[i].first);
+    codeBlock->adoptVariables(variables);
+
     preserveLastVar();
 }
 
@@ -470,7 +482,8 @@ RegisterID* BytecodeGenerator::constRegisterFor(const Identifier& ident)
         return 0;
 
     SymbolTableEntry entry = symbolTable().get(ident.ustring().rep());
-    ASSERT(!entry.isNull());
+    if (entry.isNull())
+        return 0;
 
     return &registerFor(entry.getIndex());
 }
@@ -521,7 +534,7 @@ PassRefPtr<LabelScope> BytecodeGenerator::newLabelScope(LabelScope::Type type, c
         m_labelScopes.removeLast();
 
     // Allocate new label scope.
-    LabelScope scope(type, name, scopeDepth(), newLabel(), type == LabelScope::Loop ? newLabel() : PassRefPtr<Label>(0)); // Only loops have continue targets.
+    LabelScope scope(type, name, scopeDepth(), newLabel(), type == LabelScope::Loop ? newLabel() : PassRefPtr<Label>()); // Only loops have continue targets.
     m_labelScopes.append(scope);
     return &m_labelScopes.last();
 }
@@ -765,18 +778,6 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfNotFunctionApply(RegisterID* cond
     return target;
 }
 
-unsigned BytecodeGenerator::addConstant(FuncDeclNode* n)
-{
-    // No need to explicitly unique function body nodes -- they're unique already.
-    return m_codeBlock->addFunction(n);
-}
-
-unsigned BytecodeGenerator::addConstant(FuncExprNode* n)
-{
-    // No need to explicitly unique function expression nodes -- they're unique already.
-    return m_codeBlock->addFunctionExpression(n);
-}
-
 unsigned BytecodeGenerator::addConstant(const Identifier& ident)
 {
     UString::Rep* rep = ident.ustring().rep();
@@ -861,9 +862,8 @@ RegisterID* BytecodeGenerator::emitBinaryOp(OpcodeID opcodeID, RegisterID* dst,
     instructions().append(src2->index());
 
     if (opcodeID == op_bitor || opcodeID == op_bitand || opcodeID == op_bitxor ||
-        opcodeID == op_add || opcodeID == op_mul || opcodeID == op_sub) {
+        opcodeID == op_add || opcodeID == op_mul || opcodeID == op_sub || opcodeID == op_div)
         instructions().append(types.toInt());
-    }
 
     return dst;
 }
@@ -1183,15 +1183,6 @@ RegisterID* BytecodeGenerator::emitResolveWithBase(RegisterID* baseDst, Register
     return baseDst;
 }
 
-RegisterID* BytecodeGenerator::emitResolveFunction(RegisterID* baseDst, RegisterID* funcDst, const Identifier& property)
-{
-    emitOpcode(op_resolve_func);
-    instructions().append(baseDst->index());
-    instructions().append(funcDst->index());
-    instructions().append(addConstant(property));
-    return baseDst;
-}
-
 void BytecodeGenerator::emitMethodCheck()
 {
     emitOpcode(op_method_check);
@@ -1200,7 +1191,7 @@ void BytecodeGenerator::emitMethodCheck()
 RegisterID* BytecodeGenerator::emitGetById(RegisterID* dst, RegisterID* base, const Identifier& property)
 {
 #if ENABLE(JIT)
-    m_codeBlock->addStructureStubInfo(StructureStubInfo(op_get_by_id));
+    m_codeBlock->addStructureStubInfo(StructureStubInfo(access_get_by_id));
 #else
     m_codeBlock->addPropertyAccessInstruction(instructions().size());
 #endif
@@ -1219,7 +1210,7 @@ RegisterID* BytecodeGenerator::emitGetById(RegisterID* dst, RegisterID* base, co
 RegisterID* BytecodeGenerator::emitPutById(RegisterID* base, const Identifier& property, RegisterID* value)
 {
 #if ENABLE(JIT)
-    m_codeBlock->addStructureStubInfo(StructureStubInfo(op_put_by_id));
+    m_codeBlock->addStructureStubInfo(StructureStubInfo(access_put_by_id));
 #else
     m_codeBlock->addPropertyAccessInstruction(instructions().size());
 #endif
@@ -1323,11 +1314,13 @@ RegisterID* BytecodeGenerator::emitNewArray(RegisterID* dst, ElementNode* elemen
     return dst;
 }
 
-RegisterID* BytecodeGenerator::emitNewFunction(RegisterID* dst, FuncDeclNode* n)
+RegisterID* BytecodeGenerator::emitNewFunction(RegisterID* dst, FunctionBodyNode* function)
 {
+    unsigned index = m_codeBlock->addFunctionDecl(makeFunction(function));
+
     emitOpcode(op_new_func);
     instructions().append(dst->index());
-    instructions().append(addConstant(n));
+    instructions().append(index);
     return dst;
 }
 
@@ -1342,9 +1335,12 @@ RegisterID* BytecodeGenerator::emitNewRegExp(RegisterID* dst, RegExp* regExp)
 
 RegisterID* BytecodeGenerator::emitNewFunctionExpression(RegisterID* r0, FuncExprNode* n)
 {
+    FunctionBodyNode* function = n->body();
+    unsigned index = m_codeBlock->addFunctionExpr(makeFunction(function));
+
     emitOpcode(op_new_func_exp);
     instructions().append(r0->index());
-    instructions().append(addConstant(n));
+    instructions().append(index);
     return r0;
 }
 
@@ -1602,7 +1598,7 @@ void BytecodeGenerator::emitPopScope()
     m_dynamicScopeDepth--;
 }
 
-void BytecodeGenerator::emitDebugHook(DebugHookID debugHookID, int firstLine, int lastLine, int column)
+void BytecodeGenerator::emitDebugHook(DebugHookID debugHookID, int firstLine, int lastLine)
 {
     if (!m_shouldEmitDebugHooks)
         return;
@@ -1610,7 +1606,6 @@ void BytecodeGenerator::emitDebugHook(DebugHookID debugHookID, int firstLine, in
     instructions().append(debugHookID);
     instructions().append(firstLine);
     instructions().append(lastLine);
-    instructions().append(column);
 }
 
 void BytecodeGenerator::pushFinallyContext(Label* target, RegisterID* retAddrDst)
@@ -1806,6 +1801,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpSubroutine(RegisterID* retAddrDst,
     emitOpcode(op_jsr);
     instructions().append(retAddrDst->index());
     instructions().append(finally->offsetFrom(instructions().size()));
+    emitLabel(newLabel().get()); // Record the fact that the next instruction is implicitly labeled, because op_sret will return to it.
     return finally;
 }
 
@@ -1815,7 +1811,7 @@ void BytecodeGenerator::emitSubroutineReturn(RegisterID* retAddrSrc)
     instructions().append(retAddrSrc->index());
 }
 
-void BytecodeGenerator::emitPushNewScope(RegisterID* dst, Identifier& property, RegisterID* value)
+void BytecodeGenerator::emitPushNewScope(RegisterID* dst, const Identifier& property, RegisterID* value)
 {
     ControlFlowContext context;
     context.isFinallyBlock = false;
@@ -1859,7 +1855,6 @@ static int32_t keyForImmediateSwitch(ExpressionNode* node, int32_t min, int32_t
     ASSERT(node->isNumber());
     double value = static_cast<NumberNode*>(node)->value();
     int32_t key = static_cast<int32_t>(value);
-    ASSERT(JSValue::makeInt32Fast(key) && (JSValue::makeInt32Fast(key).getInt32Fast() == value));
     ASSERT(key == value);
     ASSERT(key >= min);
     ASSERT(key <= max);
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index f7f7e1c..650b362 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -61,7 +61,7 @@ namespace JSC {
         FinallyContext finallyContext;
     };
 
-    class BytecodeGenerator : public WTF::FastAllocBase {
+    class BytecodeGenerator : public FastAllocBase {
     public:
         typedef DeclarationStacks::VarStack VarStack;
         typedef DeclarationStacks::FunctionStack FunctionStack;
@@ -254,7 +254,7 @@ namespace JSC {
         RegisterID* emitNewObject(RegisterID* dst);
         RegisterID* emitNewArray(RegisterID* dst, ElementNode*); // stops at first elision
 
-        RegisterID* emitNewFunction(RegisterID* dst, FuncDeclNode* func);
+        RegisterID* emitNewFunction(RegisterID* dst, FunctionBodyNode* body);
         RegisterID* emitNewFunctionExpression(RegisterID* dst, FuncExprNode* func);
         RegisterID* emitNewRegExp(RegisterID* dst, RegExp* regExp);
 
@@ -276,7 +276,6 @@ namespace JSC {
 
         RegisterID* emitResolveBase(RegisterID* dst, const Identifier& property);
         RegisterID* emitResolveWithBase(RegisterID* baseDst, RegisterID* propDst, const Identifier& property);
-        RegisterID* emitResolveFunction(RegisterID* baseDst, RegisterID* funcDst, const Identifier& property);
 
         void emitMethodCheck();
 
@@ -319,12 +318,12 @@ namespace JSC {
         RegisterID* emitCatch(RegisterID*, Label* start, Label* end);
         void emitThrow(RegisterID* exc) { emitUnaryNoDstOp(op_throw, exc); }
         RegisterID* emitNewError(RegisterID* dst, ErrorType type, JSValue message);
-        void emitPushNewScope(RegisterID* dst, Identifier& property, RegisterID* value);
+        void emitPushNewScope(RegisterID* dst, const Identifier& property, RegisterID* value);
 
         RegisterID* emitPushScope(RegisterID* scope);
         void emitPopScope();
 
-        void emitDebugHook(DebugHookID, int firstLine, int lastLine, int column );
+        void emitDebugHook(DebugHookID, int firstLine, int lastLine);
 
         int scopeDepth() { return m_dynamicScopeDepth + m_finallyDepth; }
         bool hasFinaliser() { return m_finallyDepth != 0; }
@@ -355,7 +354,7 @@ namespace JSC {
 
         PassRefPtr<Label> emitComplexJumpScopes(Label* target, ControlFlowContext* topScope, ControlFlowContext* bottomScope);
 
-        typedef HashMap<EncodedJSValue, unsigned, PtrHash<EncodedJSValue>, JSValueHashTraits> JSValueMap;
+        typedef HashMap<EncodedJSValue, unsigned, EncodedJSValueHash, EncodedJSValueHashTraits> JSValueMap;
 
         struct IdentifierMapIndexHashTraits {
             typedef int TraitType;
@@ -414,12 +413,15 @@ namespace JSC {
             return m_globals[-index - 1];
         }
 
-        unsigned addConstant(FuncDeclNode*);
-        unsigned addConstant(FuncExprNode*);
         unsigned addConstant(const Identifier&);
         RegisterID* addConstantValue(JSValue);
         unsigned addRegExp(RegExp*);
 
+        PassRefPtr<FunctionExecutable> makeFunction(FunctionBodyNode* body)
+        {
+            return FunctionExecutable::create(body->ident(), body->source(), body->usesArguments(), body->parameters(), body->lineNo(), body->lastLine());
+        }
+
         Vector<Instruction>& instructions() { return m_codeBlock->instructions(); }
         SymbolTable& symbolTable() { return *m_symbolTable; }
 
@@ -446,12 +448,12 @@ namespace JSC {
         RegisterID m_thisRegister;
         RegisterID m_argumentsRegister;
         int m_activationRegisterIndex;
-        WTF::SegmentedVector<RegisterID, 32> m_constantPoolRegisters;
-        WTF::SegmentedVector<RegisterID, 32> m_calleeRegisters;
-        WTF::SegmentedVector<RegisterID, 32> m_parameters;
-        WTF::SegmentedVector<RegisterID, 32> m_globals;
-        WTF::SegmentedVector<Label, 32> m_labels;
-        WTF::SegmentedVector<LabelScope, 8> m_labelScopes;
+        SegmentedVector<RegisterID, 32> m_constantPoolRegisters;
+        SegmentedVector<RegisterID, 32> m_calleeRegisters;
+        SegmentedVector<RegisterID, 32> m_parameters;
+        SegmentedVector<RegisterID, 32> m_globals;
+        SegmentedVector<Label, 32> m_labels;
+        SegmentedVector<LabelScope, 8> m_labelScopes;
         RefPtr<RegisterID> m_lastVar;
         int m_finallyDepth;
         int m_dynamicScopeDepth;
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.cpp b/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.cpp
index 7d791e7..61167d4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.cpp
@@ -22,16 +22,16 @@
 #include "config.h"
 #include "Debugger.h"
 
-#include "JSGlobalObject.h"
+#include "CollectorHeapIterator.h"
+#include "Error.h"
 #include "Interpreter.h"
+#include "JSFunction.h"
+#include "JSGlobalObject.h"
 #include "Parser.h"
+#include "Protect.h"
 
 namespace JSC {
 
-Debugger::Debugger()
-{
-}
-
 Debugger::~Debugger()
 {
     HashSet<JSGlobalObject*>::iterator end = m_globalObjects.end();
@@ -53,18 +53,59 @@ void Debugger::detach(JSGlobalObject* globalObject)
     globalObject->setDebugger(0);
 }
 
+void Debugger::recompileAllJSFunctions(JSGlobalData* globalData)
+{
+    // If JavaScript is running, it's not safe to recompile, since we'll end
+    // up throwing away code that is live on the stack.
+    ASSERT(!globalData->dynamicGlobalObject);
+    if (globalData->dynamicGlobalObject)
+        return;
+
+    typedef HashSet<FunctionExecutable*> FunctionExecutableSet;
+    typedef HashMap<SourceProvider*, ExecState*> SourceProviderMap;
+
+    FunctionExecutableSet functionExecutables;
+    SourceProviderMap sourceProviders;
+
+    Heap::iterator heapEnd = globalData->heap.primaryHeapEnd();
+    for (Heap::iterator it = globalData->heap.primaryHeapBegin(); it != heapEnd; ++it) {
+        if (!(*it)->inherits(&JSFunction::info))
+            continue;
+
+        JSFunction* function = asFunction(*it);
+        if (function->executable()->isHostFunction())
+            continue;
+
+        FunctionExecutable* executable = function->jsExecutable();
+
+        // Check if the function is already in the set - if so,
+        // we've already retranslated it, nothing to do here.
+        if (!functionExecutables.add(executable).second)
+            continue;
+
+        ExecState* exec = function->scope().globalObject()->JSGlobalObject::globalExec();
+        executable->recompile(exec);
+        if (function->scope().globalObject()->debugger() == this)
+            sourceProviders.add(executable->source().provider(), exec);
+    }
+
+    // Call sourceParsed() after reparsing all functions because it will execute
+    // JavaScript in the inspector.
+    SourceProviderMap::const_iterator end = sourceProviders.end();
+    for (SourceProviderMap::const_iterator iter = sourceProviders.begin(); iter != end; ++iter)
+        sourceParsed(iter->second, SourceCode(iter->first), -1, 0);
+}
+
 JSValue evaluateInGlobalCallFrame(const UString& script, JSValue& exception, JSGlobalObject* globalObject)
 {
     CallFrame* globalCallFrame = globalObject->globalExec();
 
-    int errLine;
-    UString errMsg;
-    SourceCode source = makeSource(script);
-    RefPtr<EvalNode> evalNode = globalObject->globalData()->parser->parse<EvalNode>(globalCallFrame, globalObject->debugger(), source, &errLine, &errMsg);
-    if (!evalNode)
-        return Error::create(globalCallFrame, SyntaxError, errMsg, errLine, source.provider()->asID(), source.provider()->url());
+    EvalExecutable eval(makeSource(script));
+    JSObject* error = eval.compile(globalCallFrame, globalCallFrame->scopeChain());
+    if (error)
+        return error;
 
-    return globalObject->globalData()->interpreter->execute(evalNode.get(), globalCallFrame, globalObject, globalCallFrame->scopeChain(), &exception);
+    return globalObject->globalData()->interpreter->execute(&eval, globalCallFrame, globalObject, globalCallFrame->scopeChain(), &exception);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.h b/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.h
index 1ed39ec..3ee9767 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.h
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.h
@@ -1,7 +1,7 @@
 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -22,87 +22,42 @@
 #ifndef Debugger_h
 #define Debugger_h
 
-#include <debugger/DebuggerCallFrame.h>
-#include "Protect.h"
+#include <wtf/HashSet.h>
 
 namespace JSC {
 
+    class DebuggerCallFrame;
     class ExecState;
+    class JSGlobalData;
     class JSGlobalObject;
+    class JSValue;
     class SourceCode;
     class UString;
 
     class Debugger {
     public:
-        Debugger();
         virtual ~Debugger();
 
         void attach(JSGlobalObject*);
         virtual void detach(JSGlobalObject*);
 
-#if PLATFORM(QT)
-#ifdef QT_BUILD_SCRIPT_LIB
-        virtual void scriptUnload(qint64 id)
-        {
-            UNUSED_PARAM(id);
-        };
-        virtual void scriptLoad(qint64 id, const UString &program,
-                            const UString &fileName, int baseLineNumber)
-        {
-            UNUSED_PARAM(id);
-            UNUSED_PARAM(program);
-            UNUSED_PARAM(fileName);
-            UNUSED_PARAM(baseLineNumber);
-        };
-        virtual void contextPush() {};
-        virtual void contextPop() {};
+        virtual void sourceParsed(ExecState*, const SourceCode&, int errorLineNumber, const UString& errorMessage) = 0;
+        virtual void exception(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
+        virtual void atStatement(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
+        virtual void callEvent(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
+        virtual void returnEvent(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
 
-        virtual void evaluateStart(intptr_t sourceID)
-        {
-            UNUSED_PARAM(sourceID);
-        }
-        virtual void evaluateStop(const JSC::JSValue& returnValue, intptr_t sourceID)
-        {
-            UNUSED_PARAM(sourceID);
-            UNUSED_PARAM(returnValue);
-        }
+        virtual void willExecuteProgram(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
+        virtual void didExecuteProgram(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
+        virtual void didReachBreakpoint(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
 
-        virtual void exceptionThrow(const JSC::DebuggerCallFrame& frame, intptr_t sourceID, bool hasHandler)
-        {
-            UNUSED_PARAM(frame);
-            UNUSED_PARAM(sourceID);
-            UNUSED_PARAM(hasHandler);
-        };
-        virtual void exceptionCatch(const JSC::DebuggerCallFrame& frame, intptr_t sourceID)
-        {
-            UNUSED_PARAM(frame);
-            UNUSED_PARAM(sourceID);
-        };
-
-        virtual void functionExit(const JSC::JSValue& returnValue, intptr_t sourceID)
-        {
-            UNUSED_PARAM(returnValue);
-            UNUSED_PARAM(sourceID);
-        };
-#endif
-#endif
-
-        virtual void sourceParsed(ExecState*, const SourceCode&, int errorLine, const UString& errorMsg) = 0;
-        virtual void exception(const DebuggerCallFrame&, intptr_t sourceID, int lineno) = 0;
-        virtual void atStatement(const DebuggerCallFrame&, intptr_t sourceID, int lineno, int column) = 0;
-        virtual void callEvent(const DebuggerCallFrame&, intptr_t sourceID, int lineno) = 0;
-        virtual void returnEvent(const DebuggerCallFrame&, intptr_t sourceID, int lineno) = 0;
-
-        virtual void willExecuteProgram(const DebuggerCallFrame&, intptr_t sourceID, int lineno) = 0;
-        virtual void didExecuteProgram(const DebuggerCallFrame&, intptr_t sourceID, int lineno) = 0;
-        virtual void didReachBreakpoint(const DebuggerCallFrame&, intptr_t sourceID, int lineno, int column) = 0;
+        void recompileAllJSFunctions(JSGlobalData*);
 
     private:
         HashSet<JSGlobalObject*> m_globalObjects;
     };
 
-    // This method exists only for backwards compatibility with existing
-    // WebScriptDebugger clients
+    // This function exists only for backwards compatibility with existing WebScriptDebugger clients.
     JSValue evaluateInGlobalCallFrame(const UString&, JSValue& exception, JSGlobalObject*);
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.cpp b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.cpp
index c1815c8..7a68d7d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -38,11 +38,12 @@ DebuggerActivation::DebuggerActivation(JSObject* activation)
     m_activation = static_cast<JSActivation*>(activation);
 }
 
-void DebuggerActivation::mark()
+void DebuggerActivation::markChildren(MarkStack& markStack)
 {
-    JSObject::mark();
-    if (m_activation && !m_activation->marked())
-        m_activation->mark();
+    JSObject::markChildren(markStack);
+
+    if (m_activation)
+        markStack.append(m_activation);
 }
 
 UString DebuggerActivation::className() const
@@ -65,14 +66,14 @@ void DebuggerActivation::putWithAttributes(ExecState* exec, const Identifier& pr
     m_activation->putWithAttributes(exec, propertyName, value, attributes);
 }
 
-bool DebuggerActivation::deleteProperty(ExecState* exec, const Identifier& propertyName, bool checkDontDelete)
+bool DebuggerActivation::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
-    return m_activation->deleteProperty(exec, propertyName, checkDontDelete);
+    return m_activation->deleteProperty(exec, propertyName);
 }
 
-void DebuggerActivation::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void DebuggerActivation::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
-    m_activation->getPropertyNames(exec, propertyNames, listedAttributes);
+    m_activation->getPropertyNames(exec, propertyNames);
 }
 
 bool DebuggerActivation::getPropertyAttributes(JSC::ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h
index 7c9f7d1..06aea5a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -36,13 +36,13 @@ namespace JSC {
     public:
         DebuggerActivation(JSObject*);
 
-        virtual void mark();
+        virtual void markChildren(MarkStack&);
         virtual UString className() const;
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual void putWithAttributes(ExecState*, const Identifier& propertyName, JSValue, unsigned attributes);
-        virtual bool deleteProperty(ExecState*, const Identifier& propertyName, bool checkDontDelete = true);
-        virtual void getPropertyNames(ExecState*, PropertyNameArray&, unsigned listedAttributes = Structure::Prototype);
+        virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
         virtual bool getPropertyAttributes(ExecState*, const Identifier& propertyName, unsigned& attributes) const;
         virtual void defineGetter(ExecState*, const Identifier& propertyName, JSObject* getterFunction);
         virtual void defineSetter(ExecState*, const Identifier& propertyName, JSObject* setterFunction);
@@ -51,7 +51,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         {
-            return Structure::create(prototype, TypeInfo(ObjectType)); 
+            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultGetPropertyNames)); 
         }
 
     private:
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.cpp b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.cpp
index cd8702b..9c8ca2a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.cpp
@@ -41,7 +41,7 @@ const UString* DebuggerCallFrame::functionName() const
     if (!m_callFrame->codeBlock())
         return 0;
 
-    JSFunction* function = static_cast<JSFunction*>(m_callFrame->callee());
+    JSFunction* function = asFunction(m_callFrame->callee());
     if (!function)
         return 0;
     return &function->name(&m_callFrame->globalData());
@@ -52,7 +52,7 @@ UString DebuggerCallFrame::calculatedFunctionName() const
     if (!m_callFrame->codeBlock())
         return 0;
     
-    JSFunction* function = static_cast<JSFunction*>(m_callFrame->callee());
+    JSFunction* function = asFunction(m_callFrame->callee());
     if (!function)
         return 0;
     return function->calculatedDisplayName(&m_callFrame->globalData());
@@ -79,14 +79,12 @@ JSValue DebuggerCallFrame::evaluate(const UString& script, JSValue& exception) c
     if (!m_callFrame->codeBlock())
         return JSValue();
 
-    int errLine;
-    UString errMsg;
-    SourceCode source = makeSource(script);
-    RefPtr<EvalNode> evalNode = m_callFrame->scopeChain()->globalData->parser->parse<EvalNode>(m_callFrame, m_callFrame->dynamicGlobalObject()->debugger(), source, &errLine, &errMsg);
-    if (!evalNode)
-        return Error::create(m_callFrame, SyntaxError, errMsg, errLine, source.provider()->asID(), source.provider()->url());
+    EvalExecutable eval(makeSource(script));
+    JSObject* error = eval.compile(m_callFrame, m_callFrame->scopeChain());
+    if (error)
+        return error;
 
-    return m_callFrame->scopeChain()->globalData->interpreter->execute(evalNode.get(), m_callFrame, thisObject(), m_callFrame->scopeChain(), &exception);
+    return m_callFrame->scopeChain()->globalData->interpreter->execute(&eval, m_callFrame, thisObject(), m_callFrame->scopeChain(), &exception);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.h b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.h
index 5984fab..9d377ef 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.h
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.h
@@ -56,9 +56,6 @@ namespace JSC {
         JSObject* thisObject() const;
         JSValue evaluate(const UString&, JSValue& exception) const;
         JSValue exception() const { return m_exception; }
-#if QT_BUILD_SCRIPT_LIB
-        CallFrame* callFrame() const { return m_callFrame; }
-#endif
 
     private:
         CallFrame* m_callFrame;
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
index 06c6e38..71451d6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
@@ -1,23 +1,24 @@
-
-/* A Bison parser, made by GNU Bison 2.4.1.  */
+/* A Bison parser, made by GNU Bison 2.3.  */
 
 /* Skeleton implementation for Bison's Yacc-like parsers in C
-   
-      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
+
+   Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
    Free Software Foundation, Inc.
-   
-   This program is free software: you can redistribute it and/or modify
+
+   This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation, either version 3 of the License, or
-   (at your option) any later version.
-   
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
-   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin Street, Fifth Floor,
+   Boston, MA 02110-1301, USA.  */
 
 /* As a special exception, you may create a larger work that contains
    part or all of the Bison parser skeleton and distribute that work
@@ -28,7 +29,7 @@
    special exception, which will cause the skeleton and the resulting
    Bison output files to be licensed under the GNU General Public
    License without this special exception.
-   
+
    This special exception was added by the Free Software Foundation in
    version 2.2 of Bison.  */
 
@@ -46,7 +47,7 @@
 #define YYBISON 1
 
 /* Bison version.  */
-#define YYBISON_VERSION "2.4.1"
+#define YYBISON_VERSION "2.3"
 
 /* Skeleton name.  */
 #define YYSKELETON_NAME "yacc.c"
@@ -54,28 +55,159 @@
 /* Pure parsers.  */
 #define YYPURE 1
 
-/* Push parsers.  */
-#define YYPUSH 0
-
-/* Pull parsers.  */
-#define YYPULL 1
-
 /* Using locations.  */
 #define YYLSP_NEEDED 1
 
 /* Substitute the variable and function names.  */
-#define yyparse         jscyyparse
-#define yylex           jscyylex
-#define yyerror         jscyyerror
-#define yylval          jscyylval
-#define yychar          jscyychar
-#define yydebug         jscyydebug
-#define yynerrs         jscyynerrs
-#define yylloc          jscyylloc
+#define yyparse jscyyparse
+#define yylex   jscyylex
+#define yyerror jscyyerror
+#define yylval  jscyylval
+#define yychar  jscyychar
+#define yydebug jscyydebug
+#define yynerrs jscyynerrs
+#define yylloc jscyylloc
+
+/* Tokens.  */
+#ifndef YYTOKENTYPE
+# define YYTOKENTYPE
+   /* Put the tokens into the symbol table, so that GDB and other debuggers
+      know about them.  */
+   enum yytokentype {
+     NULLTOKEN = 258,
+     TRUETOKEN = 259,
+     FALSETOKEN = 260,
+     BREAK = 261,
+     CASE = 262,
+     DEFAULT = 263,
+     FOR = 264,
+     NEW = 265,
+     VAR = 266,
+     CONSTTOKEN = 267,
+     CONTINUE = 268,
+     FUNCTION = 269,
+     RETURN = 270,
+     VOIDTOKEN = 271,
+     DELETETOKEN = 272,
+     IF = 273,
+     THISTOKEN = 274,
+     DO = 275,
+     WHILE = 276,
+     INTOKEN = 277,
+     INSTANCEOF = 278,
+     TYPEOF = 279,
+     SWITCH = 280,
+     WITH = 281,
+     RESERVED = 282,
+     THROW = 283,
+     TRY = 284,
+     CATCH = 285,
+     FINALLY = 286,
+     DEBUGGER = 287,
+     IF_WITHOUT_ELSE = 288,
+     ELSE = 289,
+     EQEQ = 290,
+     NE = 291,
+     STREQ = 292,
+     STRNEQ = 293,
+     LE = 294,
+     GE = 295,
+     OR = 296,
+     AND = 297,
+     PLUSPLUS = 298,
+     MINUSMINUS = 299,
+     LSHIFT = 300,
+     RSHIFT = 301,
+     URSHIFT = 302,
+     PLUSEQUAL = 303,
+     MINUSEQUAL = 304,
+     MULTEQUAL = 305,
+     DIVEQUAL = 306,
+     LSHIFTEQUAL = 307,
+     RSHIFTEQUAL = 308,
+     URSHIFTEQUAL = 309,
+     ANDEQUAL = 310,
+     MODEQUAL = 311,
+     XOREQUAL = 312,
+     OREQUAL = 313,
+     OPENBRACE = 314,
+     CLOSEBRACE = 315,
+     NUMBER = 316,
+     IDENT = 317,
+     STRING = 318,
+     AUTOPLUSPLUS = 319,
+     AUTOMINUSMINUS = 320
+   };
+#endif
+/* Tokens.  */
+#define NULLTOKEN 258
+#define TRUETOKEN 259
+#define FALSETOKEN 260
+#define BREAK 261
+#define CASE 262
+#define DEFAULT 263
+#define FOR 264
+#define NEW 265
+#define VAR 266
+#define CONSTTOKEN 267
+#define CONTINUE 268
+#define FUNCTION 269
+#define RETURN 270
+#define VOIDTOKEN 271
+#define DELETETOKEN 272
+#define IF 273
+#define THISTOKEN 274
+#define DO 275
+#define WHILE 276
+#define INTOKEN 277
+#define INSTANCEOF 278
+#define TYPEOF 279
+#define SWITCH 280
+#define WITH 281
+#define RESERVED 282
+#define THROW 283
+#define TRY 284
+#define CATCH 285
+#define FINALLY 286
+#define DEBUGGER 287
+#define IF_WITHOUT_ELSE 288
+#define ELSE 289
+#define EQEQ 290
+#define NE 291
+#define STREQ 292
+#define STRNEQ 293
+#define LE 294
+#define GE 295
+#define OR 296
+#define AND 297
+#define PLUSPLUS 298
+#define MINUSMINUS 299
+#define LSHIFT 300
+#define RSHIFT 301
+#define URSHIFT 302
+#define PLUSEQUAL 303
+#define MINUSEQUAL 304
+#define MULTEQUAL 305
+#define DIVEQUAL 306
+#define LSHIFTEQUAL 307
+#define RSHIFTEQUAL 308
+#define URSHIFTEQUAL 309
+#define ANDEQUAL 310
+#define MODEQUAL 311
+#define XOREQUAL 312
+#define OREQUAL 313
+#define OPENBRACE 314
+#define CLOSEBRACE 315
+#define NUMBER 316
+#define IDENT 317
+#define STRING 318
+#define AUTOPLUSPLUS 319
+#define AUTOMINUSMINUS 320
 
-/* Copy the first part of user declarations.  */
 
-/* Line 189 of yacc.c  */
+
+
+/* Copy the first part of user declarations.  */
 #line 3 "../parser/Grammar.y"
 
 
@@ -102,18 +234,12 @@
 
 #include "config.h"
 
-#include <string.h>
-#include <stdlib.h>
-#include "JSValue.h"
 #include "JSObject.h"
-#include "NodeConstructors.h"
-#include "Lexer.h"
 #include "JSString.h"
-#include "JSGlobalData.h"
-#include "CommonIdentifiers.h"
+#include "NodeConstructors.h"
 #include "NodeInfo.h"
-#include "Parser.h"
-#include <wtf/FastMalloc.h>
+#include <stdlib.h>
+#include <string.h>
 #include <wtf/MathExtras.h>
 
 #define YYMALLOC fastMalloc
@@ -122,46 +248,44 @@
 #define YYMAXDEPTH 10000
 #define YYENABLE_NLS 0
 
-/* default values for bison */
+// Default values for bison.
 #define YYDEBUG 0 // Set to 1 to debug a parse error.
 #define jscyydebug 0 // Set to 1 to debug a parse error.
 #if !PLATFORM(DARWIN)
-    // avoid triggering warnings in older bison
+// Avoid triggering warnings in older bison by not setting this on the Darwin platform.
+// FIXME: Is this still needed?
 #define YYERROR_VERBOSE
 #endif
 
 int jscyylex(void* lvalp, void* llocp, void* globalPtr);
 int jscyyerror(const char*);
+
 static inline bool allowAutomaticSemicolon(JSC::Lexer&, int);
 
 #define GLOBAL_DATA static_cast<JSGlobalData*>(globalPtr)
-#define LEXER (GLOBAL_DATA->lexer)
-
-#define AUTO_SEMICOLON do { if (!allowAutomaticSemicolon(*LEXER, yychar)) YYABORT; } while (0)
-#define SET_EXCEPTION_LOCATION(node, start, divot, end) node->setExceptionSourceCode((divot), (divot) - (start), (end) - (divot))
-#define DBG(l, s, e) (l)->setLoc((s).first_line, (e).last_line, (s).first_column + 1)
+#define AUTO_SEMICOLON do { if (!allowAutomaticSemicolon(*GLOBAL_DATA->lexer, yychar)) YYABORT; } while (0)
 
 using namespace JSC;
 using namespace std;
 
-static ExpressionNode* makeAssignNode(void*, ExpressionNode* loc, Operator, ExpressionNode* expr, bool locHasAssignments, bool exprHasAssignments, int start, int divot, int end);
-static ExpressionNode* makePrefixNode(void*, ExpressionNode* expr, Operator, int start, int divot, int end);
-static ExpressionNode* makePostfixNode(void*, ExpressionNode* expr, Operator, int start, int divot, int end);
-static PropertyNode* makeGetterOrSetterPropertyNode(void*, const Identifier &getOrSet, const Identifier& name, ParameterNode*, FunctionBodyNode*, const SourceCode&);
-static ExpressionNodeInfo makeFunctionCallNode(void*, ExpressionNodeInfo func, ArgumentsNodeInfo, int start, int divot, int end);
-static ExpressionNode* makeTypeOfNode(void*, ExpressionNode*);
-static ExpressionNode* makeDeleteNode(void*, ExpressionNode*, int start, int divot, int end);
-static ExpressionNode* makeNegateNode(void*, ExpressionNode*);
-static NumberNode* makeNumberNode(void*, double);
-static ExpressionNode* makeBitwiseNotNode(void*, ExpressionNode*);
-static ExpressionNode* makeMultNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
-static ExpressionNode* makeDivNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
-static ExpressionNode* makeAddNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
-static ExpressionNode* makeSubNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
-static ExpressionNode* makeLeftShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
-static ExpressionNode* makeRightShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
-static StatementNode* makeVarStatementNode(void*, ExpressionNode*);
-static ExpressionNode* combineCommaNodes(void*, ExpressionNode* list, ExpressionNode* init);
+static ExpressionNode* makeAssignNode(JSGlobalData*, ExpressionNode* left, Operator, ExpressionNode* right, bool leftHasAssignments, bool rightHasAssignments, int start, int divot, int end);
+static ExpressionNode* makePrefixNode(JSGlobalData*, ExpressionNode*, Operator, int start, int divot, int end);
+static ExpressionNode* makePostfixNode(JSGlobalData*, ExpressionNode*, Operator, int start, int divot, int end);
+static PropertyNode* makeGetterOrSetterPropertyNode(JSGlobalData*, const Identifier& getOrSet, const Identifier& name, ParameterNode*, FunctionBodyNode*, const SourceCode&);
+static ExpressionNodeInfo makeFunctionCallNode(JSGlobalData*, ExpressionNodeInfo function, ArgumentsNodeInfo, int start, int divot, int end);
+static ExpressionNode* makeTypeOfNode(JSGlobalData*, ExpressionNode*);
+static ExpressionNode* makeDeleteNode(JSGlobalData*, ExpressionNode*, int start, int divot, int end);
+static ExpressionNode* makeNegateNode(JSGlobalData*, ExpressionNode*);
+static NumberNode* makeNumberNode(JSGlobalData*, double);
+static ExpressionNode* makeBitwiseNotNode(JSGlobalData*, ExpressionNode*);
+static ExpressionNode* makeMultNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+static ExpressionNode* makeDivNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+static ExpressionNode* makeAddNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+static ExpressionNode* makeSubNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+static ExpressionNode* makeLeftShiftNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+static ExpressionNode* makeRightShiftNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+static StatementNode* makeVarStatementNode(JSGlobalData*, ExpressionNode*);
+static ExpressionNode* combineCommaNodes(JSGlobalData*, ExpressionNode* list, ExpressionNode* init);
 
 #if COMPILER(MSVC)
 
@@ -174,17 +298,17 @@ static ExpressionNode* combineCommaNodes(void*, ExpressionNode* list, Expression
 #define YYPARSE_PARAM globalPtr
 #define YYLEX_PARAM globalPtr
 
-template <typename T> NodeDeclarationInfo<T> createNodeDeclarationInfo(T node, ParserArenaData<DeclarationStacks::VarStack>* varDecls, 
-                                                                       ParserArenaData<DeclarationStacks::FunctionStack>* funcDecls,
-                                                                       CodeFeatures info,
-                                                                       int numConstants) 
+template <typename T> inline NodeDeclarationInfo<T> createNodeDeclarationInfo(T node,
+    ParserArenaData<DeclarationStacks::VarStack>* varDecls,
+    ParserArenaData<DeclarationStacks::FunctionStack>* funcDecls,
+    CodeFeatures info, int numConstants) 
 {
     ASSERT((info & ~AllFeatures) == 0);
     NodeDeclarationInfo<T> result = { node, varDecls, funcDecls, info, numConstants };
     return result;
 }
 
-template <typename T> NodeInfo<T> createNodeInfo(T node, CodeFeatures info, int numConstants)
+template <typename T> inline NodeInfo<T> createNodeInfo(T node, CodeFeatures info, int numConstants)
 {
     ASSERT((info & ~AllFeatures) == 0);
     NodeInfo<T> result = { node, info, numConstants };
@@ -210,28 +334,24 @@ template <typename T> inline T mergeDeclarationLists(T decls1, T decls2)
     return decls1;
 }
 
-static void appendToVarDeclarationList(void* globalPtr, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, const Identifier& ident, unsigned attrs)
+static inline void appendToVarDeclarationList(JSGlobalData* globalData, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, const Identifier& ident, unsigned attrs)
 {
     if (!varDecls)
-        varDecls = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
-
-    varDecls->data.append(make_pair(ident, attrs));
+        varDecls = new (globalData) ParserArenaData<DeclarationStacks::VarStack>;
 
+    varDecls->data.append(make_pair(&ident, attrs));
 }
 
-static inline void appendToVarDeclarationList(void* globalPtr, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, ConstDeclNode* decl)
+static inline void appendToVarDeclarationList(JSGlobalData* globalData, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, ConstDeclNode* decl)
 {
     unsigned attrs = DeclarationStacks::IsConstant;
     if (decl->hasInitializer())
         attrs |= DeclarationStacks::HasInitializer;        
-    appendToVarDeclarationList(globalPtr, varDecls, decl->ident(), attrs);
+    appendToVarDeclarationList(globalData, varDecls, decl->ident(), attrs);
 }
 
 
 
-/* Line 189 of yacc.c  */
-#line 234 "JavaScriptCore/tmp/../generated/Grammar.tab.c"
-
 /* Enabling traces.  */
 #ifndef YYDEBUG
 # define YYDEBUG 0
@@ -250,91 +370,13 @@ static inline void appendToVarDeclarationList(void* globalPtr, ParserArenaData<D
 # define YYTOKEN_TABLE 0
 #endif
 
-
-/* Tokens.  */
-#ifndef YYTOKENTYPE
-# define YYTOKENTYPE
-   /* Put the tokens into the symbol table, so that GDB and other debuggers
-      know about them.  */
-   enum yytokentype {
-     NULLTOKEN = 258,
-     TRUETOKEN = 259,
-     FALSETOKEN = 260,
-     BREAK = 261,
-     CASE = 262,
-     DEFAULT = 263,
-     FOR = 264,
-     NEW = 265,
-     VAR = 266,
-     CONSTTOKEN = 267,
-     CONTINUE = 268,
-     FUNCTION = 269,
-     RETURN = 270,
-     VOIDTOKEN = 271,
-     DELETETOKEN = 272,
-     IF = 273,
-     THISTOKEN = 274,
-     DO = 275,
-     WHILE = 276,
-     INTOKEN = 277,
-     INSTANCEOF = 278,
-     TYPEOF = 279,
-     SWITCH = 280,
-     WITH = 281,
-     RESERVED = 282,
-     THROW = 283,
-     TRY = 284,
-     CATCH = 285,
-     FINALLY = 286,
-     DEBUGGER = 287,
-     IF_WITHOUT_ELSE = 288,
-     ELSE = 289,
-     EQEQ = 290,
-     NE = 291,
-     STREQ = 292,
-     STRNEQ = 293,
-     LE = 294,
-     GE = 295,
-     OR = 296,
-     AND = 297,
-     PLUSPLUS = 298,
-     MINUSMINUS = 299,
-     LSHIFT = 300,
-     RSHIFT = 301,
-     URSHIFT = 302,
-     PLUSEQUAL = 303,
-     MINUSEQUAL = 304,
-     MULTEQUAL = 305,
-     DIVEQUAL = 306,
-     LSHIFTEQUAL = 307,
-     RSHIFTEQUAL = 308,
-     URSHIFTEQUAL = 309,
-     ANDEQUAL = 310,
-     MODEQUAL = 311,
-     XOREQUAL = 312,
-     OREQUAL = 313,
-     OPENBRACE = 314,
-     CLOSEBRACE = 315,
-     NUMBER = 316,
-     IDENT = 317,
-     STRING = 318,
-     AUTOPLUSPLUS = 319,
-     AUTOMINUSMINUS = 320
-   };
-#endif
-
-
-
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
+#line 146 "../parser/Grammar.y"
 {
-
-/* Line 214 of yacc.c  */
-#line 155 "../parser/Grammar.y"
-
     int                 intValue;
     double              doubleValue;
-    Identifier*         ident;
+    const Identifier*   ident;
 
     // expression subtrees
     ExpressionNodeInfo  expressionNode;
@@ -361,15 +403,13 @@ typedef union YYSTYPE
     ParameterListInfo   parameterList;
 
     Operator            op;
-
-
-
-/* Line 214 of yacc.c  */
-#line 369 "JavaScriptCore/tmp/../generated/Grammar.tab.c"
-} YYSTYPE;
-# define YYSTYPE_IS_TRIVIAL 1
+}
+/* Line 187 of yacc.c.  */
+#line 409 "JavaScriptCore/tmp/../generated/Grammar.tab.c"
+	YYSTYPE;
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
+# define YYSTYPE_IS_TRIVIAL 1
 #endif
 
 #if ! defined YYLTYPE && ! defined YYLTYPE_IS_DECLARED
@@ -387,10 +427,23 @@ typedef struct YYLTYPE
 
 
 /* Copy the second part of user declarations.  */
+#line 178 "../parser/Grammar.y"
+
 
+template <typename T> inline void setStatementLocation(StatementNode* statement, const T& start, const T& end)
+{
+    statement->setLoc(start.first_line, end.last_line);
+}
+
+static inline void setExceptionLocation(ThrowableExpressionData* node, unsigned start, unsigned divot, unsigned end)
+{
+    node->setExceptionSourceCode(divot, divot - start, end - divot);
+}
 
-/* Line 264 of yacc.c  */
-#line 394 "JavaScriptCore/tmp/../generated/Grammar.tab.c"
+
+
+/* Line 216 of yacc.c.  */
+#line 447 "JavaScriptCore/tmp/../generated/Grammar.tab.c"
 
 #ifdef short
 # undef short
@@ -465,14 +518,14 @@ typedef short int yytype_int16;
 #if (defined __STDC__ || defined __C99__FUNC__ \
      || defined __cplusplus || defined _MSC_VER)
 static int
-YYID (int yyi)
+YYID (int i)
 #else
 static int
-YYID (yyi)
-    int yyi;
+YYID (i)
+    int i;
 #endif
 {
-  return yyi;
+  return i;
 }
 #endif
 
@@ -554,9 +607,9 @@ void free (void *); /* INFRINGES ON USER NAME SPACE */
 /* A type that is properly aligned for any stack member.  */
 union yyalloc
 {
-  yytype_int16 yyss_alloc;
-  YYSTYPE yyvs_alloc;
-  YYLTYPE yyls_alloc;
+  yytype_int16 yyss;
+  YYSTYPE yyvs;
+    YYLTYPE yyls;
 };
 
 /* The size of the maximum gap between one aligned stack and the next.  */
@@ -591,12 +644,12 @@ union yyalloc
    elements in the stack, and YYPTR gives the new location of the
    stack.  Advance YYPTR to a properly aligned location for the next
    stack.  */
-# define YYSTACK_RELOCATE(Stack_alloc, Stack)				\
+# define YYSTACK_RELOCATE(Stack)					\
     do									\
       {									\
 	YYSIZE_T yynewbytes;						\
-	YYCOPY (&yyptr->Stack_alloc, Stack, yysize);			\
-	Stack = &yyptr->Stack_alloc;					\
+	YYCOPY (&yyptr->Stack, Stack, yysize);				\
+	Stack = &yyptr->Stack;						\
 	yynewbytes = yystacksize * sizeof (*Stack) + YYSTACK_GAP_MAXIMUM; \
 	yyptr += yynewbytes / sizeof (*yyptr);				\
       }									\
@@ -944,66 +997,66 @@ static const yytype_int16 yyrhs[] =
 /* YYRLINE[YYN] -- source line where rule number YYN was defined.  */
 static const yytype_uint16 yyrline[] =
 {
-       0,   288,   288,   289,   290,   291,   292,   293,   302,   314,
-     315,   316,   317,   318,   330,   334,   341,   342,   343,   345,
-     349,   350,   351,   352,   353,   357,   358,   359,   363,   367,
-     375,   376,   380,   381,   385,   386,   387,   391,   395,   402,
-     403,   407,   411,   418,   419,   426,   427,   434,   435,   436,
-     440,   446,   447,   448,   452,   459,   460,   464,   468,   475,
-     476,   480,   481,   485,   486,   487,   491,   492,   493,   497,
-     498,   499,   500,   501,   502,   503,   504,   505,   506,   507,
-     510,   511,   515,   516,   520,   521,   522,   523,   527,   528,
-     530,   532,   537,   538,   539,   543,   544,   546,   551,   552,
-     553,   554,   558,   559,   560,   561,   565,   566,   567,   568,
-     569,   570,   573,   579,   580,   581,   582,   583,   584,   591,
-     592,   593,   594,   595,   596,   600,   607,   608,   609,   610,
-     611,   615,   616,   618,   620,   622,   627,   628,   630,   631,
-     633,   638,   639,   643,   644,   649,   650,   654,   655,   659,
-     660,   665,   666,   671,   672,   676,   677,   682,   683,   688,
-     689,   693,   694,   699,   700,   705,   706,   710,   711,   716,
-     717,   721,   722,   727,   728,   733,   734,   739,   740,   747,
-     748,   755,   756,   763,   764,   765,   766,   767,   768,   769,
-     770,   771,   772,   773,   774,   778,   779,   783,   784,   788,
-     789,   793,   794,   795,   796,   797,   798,   799,   800,   801,
-     802,   803,   804,   805,   806,   807,   808,   809,   813,   815,
-     820,   822,   828,   835,   844,   852,   865,   872,   881,   889,
-     902,   904,   910,   918,   930,   931,   935,   939,   943,   947,
-     949,   954,   957,   967,   969,   971,   973,   979,   986,   995,
-    1001,  1012,  1013,  1017,  1018,  1022,  1026,  1030,  1034,  1041,
-    1044,  1047,  1050,  1056,  1059,  1062,  1065,  1071,  1077,  1083,
-    1084,  1093,  1094,  1098,  1104,  1114,  1115,  1119,  1120,  1124,
-    1130,  1134,  1141,  1147,  1153,  1163,  1165,  1170,  1171,  1182,
-    1183,  1190,  1191,  1201,  1204,  1210,  1211,  1215,  1216,  1221,
-    1228,  1239,  1240,  1241,  1242,  1243,  1244,  1245,  1249,  1250,
-    1251,  1252,  1253,  1257,  1258,  1262,  1263,  1264,  1266,  1270,
-    1271,  1272,  1273,  1274,  1278,  1279,  1280,  1284,  1285,  1288,
-    1290,  1294,  1295,  1299,  1300,  1301,  1302,  1303,  1307,  1308,
-    1309,  1310,  1314,  1315,  1319,  1320,  1324,  1325,  1326,  1327,
-    1331,  1332,  1333,  1334,  1338,  1339,  1343,  1344,  1348,  1349,
-    1353,  1354,  1358,  1359,  1360,  1364,  1365,  1366,  1370,  1371,
-    1372,  1373,  1374,  1375,  1376,  1377,  1378,  1379,  1380,  1383,
-    1384,  1388,  1389,  1393,  1394,  1395,  1396,  1400,  1401,  1402,
-    1403,  1407,  1408,  1409,  1413,  1414,  1415,  1419,  1420,  1421,
-    1422,  1426,  1427,  1428,  1429,  1433,  1434,  1435,  1436,  1437,
-    1438,  1439,  1443,  1444,  1445,  1446,  1447,  1448,  1452,  1453,
-    1454,  1455,  1456,  1457,  1458,  1462,  1463,  1464,  1465,  1466,
-    1470,  1471,  1472,  1473,  1474,  1478,  1479,  1480,  1481,  1482,
-    1486,  1487,  1491,  1492,  1496,  1497,  1501,  1502,  1506,  1507,
-    1511,  1512,  1516,  1517,  1521,  1522,  1526,  1527,  1531,  1532,
-    1536,  1537,  1541,  1542,  1546,  1547,  1551,  1552,  1556,  1557,
-    1561,  1562,  1566,  1567,  1571,  1572,  1576,  1577,  1581,  1582,
-    1586,  1587,  1591,  1592,  1593,  1594,  1595,  1596,  1597,  1598,
-    1599,  1600,  1601,  1602,  1606,  1607,  1611,  1612,  1616,  1617,
-    1621,  1622,  1623,  1624,  1625,  1626,  1627,  1628,  1629,  1630,
-    1631,  1632,  1633,  1634,  1635,  1636,  1637,  1641,  1642,  1646,
-    1647,  1651,  1652,  1653,  1654,  1658,  1659,  1660,  1661,  1665,
-    1666,  1670,  1671,  1675,  1676,  1680,  1684,  1688,  1692,  1693,
-    1697,  1698,  1702,  1703,  1704,  1705,  1706,  1707,  1708,  1709,
-    1712,  1714,  1717,  1719,  1723,  1724,  1725,  1726,  1730,  1731,
-    1732,  1733,  1737,  1738,  1739,  1740,  1744,  1748,  1752,  1753,
-    1756,  1758,  1762,  1763,  1767,  1768,  1772,  1773,  1777,  1781,
-    1782,  1786,  1787,  1788,  1792,  1793,  1797,  1798,  1802,  1803,
-    1804,  1805,  1809,  1810,  1813,  1815,  1819,  1820
+       0,   293,   293,   294,   295,   296,   297,   298,   309,   323,
+     324,   325,   326,   327,   339,   343,   350,   351,   352,   354,
+     358,   359,   360,   361,   362,   366,   367,   368,   372,   376,
+     384,   385,   389,   390,   394,   395,   396,   400,   404,   411,
+     412,   416,   420,   427,   428,   435,   436,   443,   444,   445,
+     449,   455,   456,   457,   461,   468,   469,   473,   477,   484,
+     485,   489,   490,   494,   495,   496,   500,   501,   502,   506,
+     507,   508,   509,   510,   511,   512,   513,   514,   515,   516,
+     519,   520,   524,   525,   529,   530,   531,   532,   536,   537,
+     539,   541,   546,   547,   548,   552,   553,   555,   560,   561,
+     562,   563,   567,   568,   569,   570,   574,   575,   576,   577,
+     578,   579,   582,   588,   589,   590,   591,   592,   593,   600,
+     601,   602,   603,   604,   605,   609,   616,   617,   618,   619,
+     620,   624,   625,   627,   629,   631,   636,   637,   639,   640,
+     642,   647,   648,   652,   653,   658,   659,   663,   664,   668,
+     669,   674,   675,   680,   681,   685,   686,   691,   692,   697,
+     698,   702,   703,   708,   709,   714,   715,   719,   720,   725,
+     726,   730,   731,   736,   737,   742,   743,   748,   749,   756,
+     757,   764,   765,   772,   773,   774,   775,   776,   777,   778,
+     779,   780,   781,   782,   783,   787,   788,   792,   793,   797,
+     798,   802,   803,   804,   805,   806,   807,   808,   809,   810,
+     811,   812,   813,   814,   815,   816,   817,   818,   822,   824,
+     829,   831,   837,   844,   853,   861,   874,   881,   890,   898,
+     911,   913,   919,   927,   939,   940,   944,   948,   952,   956,
+     958,   963,   966,   976,   978,   980,   982,   988,   995,  1004,
+    1010,  1021,  1022,  1026,  1027,  1031,  1035,  1039,  1043,  1050,
+    1053,  1056,  1059,  1065,  1068,  1071,  1074,  1080,  1086,  1092,
+    1093,  1102,  1103,  1107,  1113,  1123,  1124,  1128,  1129,  1133,
+    1139,  1143,  1150,  1156,  1162,  1172,  1174,  1179,  1180,  1191,
+    1192,  1199,  1200,  1210,  1213,  1219,  1220,  1224,  1225,  1230,
+    1237,  1248,  1249,  1250,  1251,  1252,  1253,  1254,  1258,  1259,
+    1260,  1261,  1262,  1266,  1267,  1271,  1272,  1273,  1275,  1279,
+    1280,  1281,  1282,  1283,  1287,  1288,  1289,  1293,  1294,  1297,
+    1299,  1303,  1304,  1308,  1309,  1310,  1311,  1312,  1316,  1317,
+    1318,  1319,  1323,  1324,  1328,  1329,  1333,  1334,  1335,  1336,
+    1340,  1341,  1342,  1343,  1347,  1348,  1352,  1353,  1357,  1358,
+    1362,  1363,  1367,  1368,  1369,  1373,  1374,  1375,  1379,  1380,
+    1381,  1382,  1383,  1384,  1385,  1386,  1387,  1388,  1389,  1392,
+    1393,  1397,  1398,  1402,  1403,  1404,  1405,  1409,  1410,  1411,
+    1412,  1416,  1417,  1418,  1422,  1423,  1424,  1428,  1429,  1430,
+    1431,  1435,  1436,  1437,  1438,  1442,  1443,  1444,  1445,  1446,
+    1447,  1448,  1452,  1453,  1454,  1455,  1456,  1457,  1461,  1462,
+    1463,  1464,  1465,  1466,  1467,  1471,  1472,  1473,  1474,  1475,
+    1479,  1480,  1481,  1482,  1483,  1487,  1488,  1489,  1490,  1491,
+    1495,  1496,  1500,  1501,  1505,  1506,  1510,  1511,  1515,  1516,
+    1520,  1521,  1525,  1526,  1530,  1531,  1535,  1536,  1540,  1541,
+    1545,  1546,  1550,  1551,  1555,  1556,  1560,  1561,  1565,  1566,
+    1570,  1571,  1575,  1576,  1580,  1581,  1585,  1586,  1590,  1591,
+    1595,  1596,  1600,  1601,  1602,  1603,  1604,  1605,  1606,  1607,
+    1608,  1609,  1610,  1611,  1615,  1616,  1620,  1621,  1625,  1626,
+    1630,  1631,  1632,  1633,  1634,  1635,  1636,  1637,  1638,  1639,
+    1640,  1641,  1642,  1643,  1644,  1645,  1646,  1650,  1651,  1655,
+    1656,  1660,  1661,  1662,  1663,  1667,  1668,  1669,  1670,  1674,
+    1675,  1679,  1680,  1684,  1685,  1689,  1693,  1697,  1701,  1702,
+    1706,  1707,  1711,  1712,  1713,  1714,  1715,  1716,  1717,  1718,
+    1721,  1723,  1726,  1728,  1732,  1733,  1734,  1735,  1739,  1740,
+    1741,  1742,  1746,  1747,  1748,  1749,  1753,  1757,  1761,  1762,
+    1765,  1767,  1771,  1772,  1776,  1777,  1781,  1782,  1786,  1790,
+    1791,  1795,  1796,  1797,  1801,  1802,  1806,  1807,  1811,  1812,
+    1813,  1814,  1818,  1819,  1822,  1824,  1828,  1829
 };
 #endif
 
@@ -2310,20 +2363,17 @@ yy_symbol_print (yyoutput, yytype, yyvaluep, yylocationp)
 #if (defined __STDC__ || defined __C99__FUNC__ \
      || defined __cplusplus || defined _MSC_VER)
 static void
-yy_stack_print (yytype_int16 *yybottom, yytype_int16 *yytop)
+yy_stack_print (yytype_int16 *bottom, yytype_int16 *top)
 #else
 static void
-yy_stack_print (yybottom, yytop)
-    yytype_int16 *yybottom;
-    yytype_int16 *yytop;
+yy_stack_print (bottom, top)
+    yytype_int16 *bottom;
+    yytype_int16 *top;
 #endif
 {
   YYFPRINTF (stderr, "Stack now");
-  for (; yybottom <= yytop; yybottom++)
-    {
-      int yybot = *yybottom;
-      YYFPRINTF (stderr, " %d", yybot);
-    }
+  for (; bottom <= top; ++bottom)
+    YYFPRINTF (stderr, " %d", *bottom);
   YYFPRINTF (stderr, "\n");
 }
 
@@ -2358,11 +2408,11 @@ yy_reduce_print (yyvsp, yylsp, yyrule)
   /* The symbols being reduced.  */
   for (yyi = 0; yyi < yynrhs; yyi++)
     {
-      YYFPRINTF (stderr, "   $%d = ", yyi + 1);
+      fprintf (stderr, "   $%d = ", yyi + 1);
       yy_symbol_print (stderr, yyrhs[yyprhs[yyrule] + yyi],
 		       &(yyvsp[(yyi + 1) - (yynrhs)])
 		       , &(yylsp[(yyi + 1) - (yynrhs)])		       );
-      YYFPRINTF (stderr, "\n");
+      fprintf (stderr, "\n");
     }
 }
 
@@ -2644,8 +2694,10 @@ yydestruct (yymsg, yytype, yyvaluep, yylocationp)
 	break;
     }
 }
+
 
 /* Prevent warnings from -Wmissing-prototypes.  */
+
 #ifdef YYPARSE_PARAM
 #if defined __STDC__ || defined __cplusplus
 int yyparse (void *YYPARSE_PARAM);
@@ -2664,9 +2716,10 @@ int yyparse ();
 
 
 
-/*-------------------------.
-| yyparse or yypush_parse.  |
-`-------------------------*/
+
+/*----------.
+| yyparse.  |
+`----------*/
 
 #ifdef YYPARSE_PARAM
 #if (defined __STDC__ || defined __C99__FUNC__ \
@@ -2690,97 +2743,88 @@ yyparse ()
 #endif
 #endif
 {
-/* The lookahead symbol.  */
+  /* The look-ahead symbol.  */
 int yychar;
 
-/* The semantic value of the lookahead symbol.  */
+/* The semantic value of the look-ahead symbol.  */
 YYSTYPE yylval;
 
-/* Location data for the lookahead symbol.  */
+/* Number of syntax errors so far.  */
+int yynerrs;
+/* Location data for the look-ahead symbol.  */
 YYLTYPE yylloc;
 
-    /* Number of syntax errors so far.  */
-    int yynerrs;
-
-    int yystate;
-    /* Number of tokens to shift before error messages enabled.  */
-    int yyerrstatus;
+  int yystate;
+  int yyn;
+  int yyresult;
+  /* Number of tokens to shift before error messages enabled.  */
+  int yyerrstatus;
+  /* Look-ahead token as an internal (translated) token number.  */
+  int yytoken = 0;
+#if YYERROR_VERBOSE
+  /* Buffer for error messages, and its allocated size.  */
+  char yymsgbuf[128];
+  char *yymsg = yymsgbuf;
+  YYSIZE_T yymsg_alloc = sizeof yymsgbuf;
+#endif
 
-    /* The stacks and their tools:
-       `yyss': related to states.
-       `yyvs': related to semantic values.
-       `yyls': related to locations.
+  /* Three stacks and their tools:
+     `yyss': related to states,
+     `yyvs': related to semantic values,
+     `yyls': related to locations.
 
-       Refer to the stacks thru separate pointers, to allow yyoverflow
-       to reallocate them elsewhere.  */
+     Refer to the stacks thru separate pointers, to allow yyoverflow
+     to reallocate them elsewhere.  */
 
-    /* The state stack.  */
-    yytype_int16 yyssa[YYINITDEPTH];
-    yytype_int16 *yyss;
-    yytype_int16 *yyssp;
+  /* The state stack.  */
+  yytype_int16 yyssa[YYINITDEPTH];
+  yytype_int16 *yyss = yyssa;
+  yytype_int16 *yyssp;
 
-    /* The semantic value stack.  */
-    YYSTYPE yyvsa[YYINITDEPTH];
-    YYSTYPE *yyvs;
-    YYSTYPE *yyvsp;
+  /* The semantic value stack.  */
+  YYSTYPE yyvsa[YYINITDEPTH];
+  YYSTYPE *yyvs = yyvsa;
+  YYSTYPE *yyvsp;
 
-    /* The location stack.  */
-    YYLTYPE yylsa[YYINITDEPTH];
-    YYLTYPE *yyls;
-    YYLTYPE *yylsp;
+  /* The location stack.  */
+  YYLTYPE yylsa[YYINITDEPTH];
+  YYLTYPE *yyls = yylsa;
+  YYLTYPE *yylsp;
+  /* The locations where the error started and ended.  */
+  YYLTYPE yyerror_range[2];
 
-    /* The locations where the error started and ended.  */
-    YYLTYPE yyerror_range[2];
+#define YYPOPSTACK(N)   (yyvsp -= (N), yyssp -= (N), yylsp -= (N))
 
-    YYSIZE_T yystacksize;
+  YYSIZE_T yystacksize = YYINITDEPTH;
 
-  int yyn;
-  int yyresult;
-  /* Lookahead token as an internal (translated) token number.  */
-  int yytoken;
   /* The variables used to return semantic value and location from the
      action routines.  */
   YYSTYPE yyval;
   YYLTYPE yyloc;
 
-#if YYERROR_VERBOSE
-  /* Buffer for error messages, and its allocated size.  */
-  char yymsgbuf[128];
-  char *yymsg = yymsgbuf;
-  YYSIZE_T yymsg_alloc = sizeof yymsgbuf;
-#endif
-
-#define YYPOPSTACK(N)   (yyvsp -= (N), yyssp -= (N), yylsp -= (N))
-
   /* The number of symbols on the RHS of the reduced rule.
      Keep to zero when no symbol should be popped.  */
   int yylen = 0;
 
-  yytoken = 0;
-  yyss = yyssa;
-  yyvs = yyvsa;
-  yyls = yylsa;
-  yystacksize = YYINITDEPTH;
-
   YYDPRINTF ((stderr, "Starting parse\n"));
 
   yystate = 0;
   yyerrstatus = 0;
   yynerrs = 0;
-  yychar = YYEMPTY; /* Cause a token to be read.  */
+  yychar = YYEMPTY;		/* Cause a token to be read.  */
 
   /* Initialize stack pointers.
      Waste one element of value and location stack
      so that they stay on the same level as the state stack.
      The wasted elements are never initialized.  */
+
   yyssp = yyss;
   yyvsp = yyvs;
   yylsp = yyls;
-
 #if YYLTYPE_IS_TRIVIAL
   /* Initialize the default location before parsing starts.  */
   yylloc.first_line   = yylloc.last_line   = 1;
-  yylloc.first_column = yylloc.last_column = 1;
+  yylloc.first_column = yylloc.last_column = 0;
 #endif
 
   goto yysetstate;
@@ -2819,7 +2863,6 @@ YYLTYPE yylloc;
 		    &yyvs1, yysize * sizeof (*yyvsp),
 		    &yyls1, yysize * sizeof (*yylsp),
 		    &yystacksize);
-
 	yyls = yyls1;
 	yyss = yyss1;
 	yyvs = yyvs1;
@@ -2841,9 +2884,9 @@ YYLTYPE yylloc;
 	  (union yyalloc *) YYSTACK_ALLOC (YYSTACK_BYTES (yystacksize));
 	if (! yyptr)
 	  goto yyexhaustedlab;
-	YYSTACK_RELOCATE (yyss_alloc, yyss);
-	YYSTACK_RELOCATE (yyvs_alloc, yyvs);
-	YYSTACK_RELOCATE (yyls_alloc, yyls);
+	YYSTACK_RELOCATE (yyss);
+	YYSTACK_RELOCATE (yyvs);
+	YYSTACK_RELOCATE (yyls);
 #  undef YYSTACK_RELOCATE
 	if (yyss1 != yyssa)
 	  YYSTACK_FREE (yyss1);
@@ -2864,9 +2907,6 @@ YYLTYPE yylloc;
 
   YYDPRINTF ((stderr, "Entering state %d\n", yystate));
 
-  if (yystate == YYFINAL)
-    YYACCEPT;
-
   goto yybackup;
 
 /*-----------.
@@ -2875,16 +2915,16 @@ YYLTYPE yylloc;
 yybackup:
 
   /* Do appropriate processing given the current state.  Read a
-     lookahead token if we need one and don't already have one.  */
+     look-ahead token if we need one and don't already have one.  */
 
-  /* First try to decide what to do without reference to lookahead token.  */
+  /* First try to decide what to do without reference to look-ahead token.  */
   yyn = yypact[yystate];
   if (yyn == YYPACT_NINF)
     goto yydefault;
 
-  /* Not known => get a lookahead token if don't already have one.  */
+  /* Not known => get a look-ahead token if don't already have one.  */
 
-  /* YYCHAR is either YYEMPTY or YYEOF or a valid lookahead symbol.  */
+  /* YYCHAR is either YYEMPTY or YYEOF or a valid look-ahead symbol.  */
   if (yychar == YYEMPTY)
     {
       YYDPRINTF ((stderr, "Reading a token: "));
@@ -2916,16 +2956,20 @@ yybackup:
       goto yyreduce;
     }
 
+  if (yyn == YYFINAL)
+    YYACCEPT;
+
   /* Count tokens shifted since error; after three, turn off error
      status.  */
   if (yyerrstatus)
     yyerrstatus--;
 
-  /* Shift the lookahead token.  */
+  /* Shift the look-ahead token.  */
   YY_SYMBOL_PRINT ("Shifting", yytoken, &yylval, &yylloc);
 
-  /* Discard the shifted token.  */
-  yychar = YYEMPTY;
+  /* Discard the shifted token unless it is eof.  */
+  if (yychar != YYEOF)
+    yychar = YYEMPTY;
 
   yystate = yyn;
   *++yyvsp = yylval;
@@ -2966,116 +3010,94 @@ yyreduce:
   switch (yyn)
     {
         case 2:
-
-/* Line 1455 of yacc.c  */
-#line 288 "../parser/Grammar.y"
+#line 293 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NullNode(GLOBAL_DATA), 0, 1); ;}
     break;
 
   case 3:
-
-/* Line 1455 of yacc.c  */
-#line 289 "../parser/Grammar.y"
+#line 294 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, true), 0, 1); ;}
     break;
 
   case 4:
-
-/* Line 1455 of yacc.c  */
-#line 290 "../parser/Grammar.y"
+#line 295 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, false), 0, 1); ;}
     break;
 
   case 5:
-
-/* Line 1455 of yacc.c  */
-#line 291 "../parser/Grammar.y"
+#line 296 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeNumberNode(GLOBAL_DATA, (yyvsp[(1) - (1)].doubleValue)), 0, 1); ;}
     break;
 
   case 6:
-
-/* Line 1455 of yacc.c  */
-#line 292 "../parser/Grammar.y"
+#line 297 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StringNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident)), 0, 1); ;}
     break;
 
   case 7:
-
-/* Line 1455 of yacc.c  */
-#line 293 "../parser/Grammar.y"
+#line 298 "../parser/Grammar.y"
     {
-                                            Lexer& l = *LEXER;
-                                            if (!l.scanRegExp())
+                                            Lexer& l = *GLOBAL_DATA->lexer;
+                                            const Identifier* pattern;
+                                            const Identifier* flags;
+                                            if (!l.scanRegExp(pattern, flags))
                                                 YYABORT;
-                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, l.pattern(), l.flags());
-                                            int size = l.pattern().size() + 2; // + 2 for the two /'s
-                                            SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (1)]).first_column, (yylsp[(1) - (1)]).first_column + size, (yylsp[(1) - (1)]).first_column + size);
+                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, *pattern, *flags);
+                                            int size = pattern->size() + 2; // + 2 for the two /'s
+                                            setExceptionLocation(node, (yylsp[(1) - (1)]).first_column, (yylsp[(1) - (1)]).first_column + size, (yylsp[(1) - (1)]).first_column + size);
                                             (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, 0, 0);
                                         ;}
     break;
 
   case 8:
-
-/* Line 1455 of yacc.c  */
-#line 302 "../parser/Grammar.y"
+#line 309 "../parser/Grammar.y"
     {
-                                            Lexer& l = *LEXER;
-                                            if (!l.scanRegExp())
+                                            Lexer& l = *GLOBAL_DATA->lexer;
+                                            const Identifier* pattern;
+                                            const Identifier* flags;
+                                            if (!l.scanRegExp(pattern, flags, '='))
                                                 YYABORT;
-                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, "=" + l.pattern(), l.flags());
-                                            int size = l.pattern().size() + 2; // + 2 for the two /'s
-                                            SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (1)]).first_column, (yylsp[(1) - (1)]).first_column + size, (yylsp[(1) - (1)]).first_column + size);
+                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, *pattern, *flags);
+                                            int size = pattern->size() + 2; // + 2 for the two /'s
+                                            setExceptionLocation(node, (yylsp[(1) - (1)]).first_column, (yylsp[(1) - (1)]).first_column + size, (yylsp[(1) - (1)]).first_column + size);
                                             (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, 0, 0);
                                         ;}
     break;
 
   case 9:
-
-/* Line 1455 of yacc.c  */
-#line 314 "../parser/Grammar.y"
+#line 323 "../parser/Grammar.y"
     { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 10:
-
-/* Line 1455 of yacc.c  */
-#line 315 "../parser/Grammar.y"
+#line 324 "../parser/Grammar.y"
     { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 11:
-
-/* Line 1455 of yacc.c  */
-#line 316 "../parser/Grammar.y"
-    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, Identifier(GLOBAL_DATA, UString::from((yyvsp[(1) - (3)].doubleValue))), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+#line 325 "../parser/Grammar.y"
+    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, (yyvsp[(1) - (3)].doubleValue), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 12:
-
-/* Line 1455 of yacc.c  */
-#line 317 "../parser/Grammar.y"
-    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(globalPtr, *(yyvsp[(1) - (7)].ident), *(yyvsp[(2) - (7)].ident), 0, (yyvsp[(6) - (7)].functionBodyNode), LEXER->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), ClosureFeature, 0); DBG((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); if (!(yyval.propertyNode).m_node) YYABORT; ;}
+#line 326 "../parser/Grammar.y"
+    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (7)].ident), *(yyvsp[(2) - (7)].ident), 0, (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), ClosureFeature, 0); setStatementLocation((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); if (!(yyval.propertyNode).m_node) YYABORT; ;}
     break;
 
   case 13:
-
-/* Line 1455 of yacc.c  */
-#line 319 "../parser/Grammar.y"
+#line 328 "../parser/Grammar.y"
     {
-                                                                 (yyval.propertyNode) = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(globalPtr, *(yyvsp[(1) - (8)].ident), *(yyvsp[(2) - (8)].ident), (yyvsp[(4) - (8)].parameterList).m_node.head, (yyvsp[(7) - (8)].functionBodyNode), LEXER->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line)), (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
+                                                                 (yyval.propertyNode) = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (8)].ident), *(yyvsp[(2) - (8)].ident), (yyvsp[(4) - (8)].parameterList).m_node.head, (yyvsp[(7) - (8)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line)), (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
                                                                  if ((yyvsp[(4) - (8)].parameterList).m_features & ArgumentsFeature)
                                                                      (yyvsp[(7) - (8)].functionBodyNode)->setUsesArguments(); 
-                                                                 DBG((yyvsp[(7) - (8)].functionBodyNode), (yylsp[(6) - (8)]), (yylsp[(8) - (8)])); 
+                                                                 setStatementLocation((yyvsp[(7) - (8)].functionBodyNode), (yylsp[(6) - (8)]), (yylsp[(8) - (8)])); 
                                                                  if (!(yyval.propertyNode).m_node) 
                                                                      YYABORT; 
                                                              ;}
     break;
 
   case 14:
-
-/* Line 1455 of yacc.c  */
-#line 330 "../parser/Grammar.y"
+#line 339 "../parser/Grammar.y"
     { (yyval.propertyList).m_node.head = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].propertyNode).m_node); 
                                           (yyval.propertyList).m_node.tail = (yyval.propertyList).m_node.head;
                                           (yyval.propertyList).m_features = (yyvsp[(1) - (1)].propertyNode).m_features;
@@ -3083,9 +3105,7 @@ yyreduce:
     break;
 
   case 15:
-
-/* Line 1455 of yacc.c  */
-#line 334 "../parser/Grammar.y"
+#line 343 "../parser/Grammar.y"
     { (yyval.propertyList).m_node.head = (yyvsp[(1) - (3)].propertyList).m_node.head;
                                           (yyval.propertyList).m_node.tail = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, (yyvsp[(3) - (3)].propertyNode).m_node, (yyvsp[(1) - (3)].propertyList).m_node.tail);
                                           (yyval.propertyList).m_features = (yyvsp[(1) - (3)].propertyList).m_features | (yyvsp[(3) - (3)].propertyNode).m_features;
@@ -3093,72 +3113,52 @@ yyreduce:
     break;
 
   case 17:
-
-/* Line 1455 of yacc.c  */
-#line 342 "../parser/Grammar.y"
+#line 351 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA), 0, 0); ;}
     break;
 
   case 18:
-
-/* Line 1455 of yacc.c  */
-#line 343 "../parser/Grammar.y"
+#line 352 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (3)].propertyList).m_node.head), (yyvsp[(2) - (3)].propertyList).m_features, (yyvsp[(2) - (3)].propertyList).m_numConstants); ;}
     break;
 
   case 19:
-
-/* Line 1455 of yacc.c  */
-#line 345 "../parser/Grammar.y"
+#line 354 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (4)].propertyList).m_node.head), (yyvsp[(2) - (4)].propertyList).m_features, (yyvsp[(2) - (4)].propertyList).m_numConstants); ;}
     break;
 
   case 20:
-
-/* Line 1455 of yacc.c  */
-#line 349 "../parser/Grammar.y"
+#line 358 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ThisNode(GLOBAL_DATA), ThisFeature, 0); ;}
     break;
 
   case 23:
-
-/* Line 1455 of yacc.c  */
-#line 352 "../parser/Grammar.y"
+#line 361 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), (yylsp[(1) - (1)]).first_column), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
     break;
 
   case 24:
-
-/* Line 1455 of yacc.c  */
-#line 353 "../parser/Grammar.y"
+#line 362 "../parser/Grammar.y"
     { (yyval.expressionNode) = (yyvsp[(2) - (3)].expressionNode); ;}
     break;
 
   case 25:
-
-/* Line 1455 of yacc.c  */
-#line 357 "../parser/Grammar.y"
+#line 366 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].intValue)), 0, (yyvsp[(2) - (3)].intValue) ? 1 : 0); ;}
     break;
 
   case 26:
-
-/* Line 1455 of yacc.c  */
-#line 358 "../parser/Grammar.y"
+#line 367 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].elementList).m_node.head), (yyvsp[(2) - (3)].elementList).m_features, (yyvsp[(2) - (3)].elementList).m_numConstants); ;}
     break;
 
   case 27:
-
-/* Line 1455 of yacc.c  */
-#line 359 "../parser/Grammar.y"
+#line 368 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(4) - (5)].intValue), (yyvsp[(2) - (5)].elementList).m_node.head), (yyvsp[(2) - (5)].elementList).m_features, (yyvsp[(4) - (5)].intValue) ? (yyvsp[(2) - (5)].elementList).m_numConstants + 1 : (yyvsp[(2) - (5)].elementList).m_numConstants); ;}
     break;
 
   case 28:
-
-/* Line 1455 of yacc.c  */
-#line 363 "../parser/Grammar.y"
+#line 372 "../parser/Grammar.y"
     { (yyval.elementList).m_node.head = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].intValue), (yyvsp[(2) - (2)].expressionNode).m_node);
                                           (yyval.elementList).m_node.tail = (yyval.elementList).m_node.head;
                                           (yyval.elementList).m_features = (yyvsp[(2) - (2)].expressionNode).m_features;
@@ -3166,9 +3166,7 @@ yyreduce:
     break;
 
   case 29:
-
-/* Line 1455 of yacc.c  */
-#line 368 "../parser/Grammar.y"
+#line 377 "../parser/Grammar.y"
     { (yyval.elementList).m_node.head = (yyvsp[(1) - (4)].elementList).m_node.head;
                                           (yyval.elementList).m_node.tail = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, (yyvsp[(1) - (4)].elementList).m_node.tail, (yyvsp[(3) - (4)].intValue), (yyvsp[(4) - (4)].expressionNode).m_node);
                                           (yyval.elementList).m_features = (yyvsp[(1) - (4)].elementList).m_features | (yyvsp[(4) - (4)].expressionNode).m_features;
@@ -3176,198 +3174,152 @@ yyreduce:
     break;
 
   case 30:
-
-/* Line 1455 of yacc.c  */
-#line 375 "../parser/Grammar.y"
+#line 384 "../parser/Grammar.y"
     { (yyval.intValue) = 0; ;}
     break;
 
   case 32:
-
-/* Line 1455 of yacc.c  */
-#line 380 "../parser/Grammar.y"
+#line 389 "../parser/Grammar.y"
     { (yyval.intValue) = 1; ;}
     break;
 
   case 33:
-
-/* Line 1455 of yacc.c  */
-#line 381 "../parser/Grammar.y"
+#line 390 "../parser/Grammar.y"
     { (yyval.intValue) = (yyvsp[(1) - (2)].intValue) + 1; ;}
     break;
 
   case 35:
-
-/* Line 1455 of yacc.c  */
-#line 386 "../parser/Grammar.y"
+#line 395 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>((yyvsp[(1) - (1)].funcExprNode).m_node, (yyvsp[(1) - (1)].funcExprNode).m_features, (yyvsp[(1) - (1)].funcExprNode).m_numConstants); ;}
     break;
 
   case 36:
-
-/* Line 1455 of yacc.c  */
-#line 387 "../parser/Grammar.y"
+#line 396 "../parser/Grammar.y"
     { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
                                         ;}
     break;
 
   case 37:
-
-/* Line 1455 of yacc.c  */
-#line 391 "../parser/Grammar.y"
+#line 400 "../parser/Grammar.y"
     { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants);
                                         ;}
     break;
 
   case 38:
-
-/* Line 1455 of yacc.c  */
-#line 395 "../parser/Grammar.y"
+#line 404 "../parser/Grammar.y"
     { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].argumentsNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].argumentsNode).m_numConstants);
                                         ;}
     break;
 
   case 40:
-
-/* Line 1455 of yacc.c  */
-#line 403 "../parser/Grammar.y"
+#line 412 "../parser/Grammar.y"
     { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
                                         ;}
     break;
 
   case 41:
-
-/* Line 1455 of yacc.c  */
-#line 407 "../parser/Grammar.y"
+#line 416 "../parser/Grammar.y"
     { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants);
                                         ;}
     break;
 
   case 42:
-
-/* Line 1455 of yacc.c  */
-#line 411 "../parser/Grammar.y"
+#line 420 "../parser/Grammar.y"
     { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].argumentsNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].argumentsNode).m_numConstants);
                                         ;}
     break;
 
   case 44:
-
-/* Line 1455 of yacc.c  */
-#line 419 "../parser/Grammar.y"
+#line 428 "../parser/Grammar.y"
     { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); 
                                         ;}
     break;
 
   case 46:
-
-/* Line 1455 of yacc.c  */
-#line 427 "../parser/Grammar.y"
+#line 436 "../parser/Grammar.y"
     { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants);
                                         ;}
     break;
 
   case 47:
-
-/* Line 1455 of yacc.c  */
-#line 434 "../parser/Grammar.y"
-    { (yyval.expressionNode) = makeFunctionCallNode(globalPtr, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
+#line 443 "../parser/Grammar.y"
+    { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 48:
-
-/* Line 1455 of yacc.c  */
-#line 435 "../parser/Grammar.y"
-    { (yyval.expressionNode) = makeFunctionCallNode(globalPtr, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
+#line 444 "../parser/Grammar.y"
+    { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 49:
-
-/* Line 1455 of yacc.c  */
-#line 436 "../parser/Grammar.y"
+#line 445 "../parser/Grammar.y"
     { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
                                         ;}
     break;
 
   case 50:
-
-/* Line 1455 of yacc.c  */
-#line 440 "../parser/Grammar.y"
+#line 449 "../parser/Grammar.y"
     { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 51:
-
-/* Line 1455 of yacc.c  */
-#line 446 "../parser/Grammar.y"
-    { (yyval.expressionNode) = makeFunctionCallNode(globalPtr, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
+#line 455 "../parser/Grammar.y"
+    { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 52:
-
-/* Line 1455 of yacc.c  */
-#line 447 "../parser/Grammar.y"
-    { (yyval.expressionNode) = makeFunctionCallNode(globalPtr, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
+#line 456 "../parser/Grammar.y"
+    { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 53:
-
-/* Line 1455 of yacc.c  */
-#line 448 "../parser/Grammar.y"
+#line 457 "../parser/Grammar.y"
     { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
                                         ;}
     break;
 
   case 54:
-
-/* Line 1455 of yacc.c  */
-#line 452 "../parser/Grammar.y"
+#line 461 "../parser/Grammar.y"
     { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants); 
                                         ;}
     break;
 
   case 55:
-
-/* Line 1455 of yacc.c  */
-#line 459 "../parser/Grammar.y"
+#line 468 "../parser/Grammar.y"
     { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA), 0, 0); ;}
     break;
 
   case 56:
-
-/* Line 1455 of yacc.c  */
-#line 460 "../parser/Grammar.y"
+#line 469 "../parser/Grammar.y"
     { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA, (yyvsp[(2) - (3)].argumentList).m_node.head), (yyvsp[(2) - (3)].argumentList).m_features, (yyvsp[(2) - (3)].argumentList).m_numConstants); ;}
     break;
 
   case 57:
-
-/* Line 1455 of yacc.c  */
-#line 464 "../parser/Grammar.y"
+#line 473 "../parser/Grammar.y"
     { (yyval.argumentList).m_node.head = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].expressionNode).m_node);
                                           (yyval.argumentList).m_node.tail = (yyval.argumentList).m_node.head;
                                           (yyval.argumentList).m_features = (yyvsp[(1) - (1)].expressionNode).m_features;
@@ -3375,9 +3327,7 @@ yyreduce:
     break;
 
   case 58:
-
-/* Line 1455 of yacc.c  */
-#line 468 "../parser/Grammar.y"
+#line 477 "../parser/Grammar.y"
     { (yyval.argumentList).m_node.head = (yyvsp[(1) - (3)].argumentList).m_node.head;
                                           (yyval.argumentList).m_node.tail = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (3)].argumentList).m_node.tail, (yyvsp[(3) - (3)].expressionNode).m_node);
                                           (yyval.argumentList).m_features = (yyvsp[(1) - (3)].argumentList).m_features | (yyvsp[(3) - (3)].expressionNode).m_features;
@@ -3385,730 +3335,528 @@ yyreduce:
     break;
 
   case 64:
-
-/* Line 1455 of yacc.c  */
-#line 486 "../parser/Grammar.y"
+#line 495 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 65:
-
-/* Line 1455 of yacc.c  */
-#line 487 "../parser/Grammar.y"
+#line 496 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 67:
-
-/* Line 1455 of yacc.c  */
-#line 492 "../parser/Grammar.y"
+#line 501 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 68:
-
-/* Line 1455 of yacc.c  */
-#line 493 "../parser/Grammar.y"
+#line 502 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 69:
-
-/* Line 1455 of yacc.c  */
-#line 497 "../parser/Grammar.y"
+#line 506 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDeleteNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 70:
-
-/* Line 1455 of yacc.c  */
-#line 498 "../parser/Grammar.y"
+#line 507 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) VoidNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants + 1); ;}
     break;
 
   case 71:
-
-/* Line 1455 of yacc.c  */
-#line 499 "../parser/Grammar.y"
+#line 508 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeTypeOfNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 72:
-
-/* Line 1455 of yacc.c  */
-#line 500 "../parser/Grammar.y"
+#line 509 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 73:
-
-/* Line 1455 of yacc.c  */
-#line 501 "../parser/Grammar.y"
+#line 510 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 74:
-
-/* Line 1455 of yacc.c  */
-#line 502 "../parser/Grammar.y"
+#line 511 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 75:
-
-/* Line 1455 of yacc.c  */
-#line 503 "../parser/Grammar.y"
+#line 512 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 76:
-
-/* Line 1455 of yacc.c  */
-#line 504 "../parser/Grammar.y"
+#line 513 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 77:
-
-/* Line 1455 of yacc.c  */
-#line 505 "../parser/Grammar.y"
+#line 514 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeNegateNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 78:
-
-/* Line 1455 of yacc.c  */
-#line 506 "../parser/Grammar.y"
+#line 515 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeBitwiseNotNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 79:
-
-/* Line 1455 of yacc.c  */
-#line 507 "../parser/Grammar.y"
+#line 516 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalNotNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 85:
-
-/* Line 1455 of yacc.c  */
-#line 521 "../parser/Grammar.y"
+#line 530 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeMultNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 86:
-
-/* Line 1455 of yacc.c  */
-#line 522 "../parser/Grammar.y"
+#line 531 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDivNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 87:
-
-/* Line 1455 of yacc.c  */
-#line 523 "../parser/Grammar.y"
+#line 532 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 89:
-
-/* Line 1455 of yacc.c  */
-#line 529 "../parser/Grammar.y"
+#line 538 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeMultNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 90:
-
-/* Line 1455 of yacc.c  */
-#line 531 "../parser/Grammar.y"
+#line 540 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDivNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 91:
-
-/* Line 1455 of yacc.c  */
-#line 533 "../parser/Grammar.y"
+#line 542 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 93:
-
-/* Line 1455 of yacc.c  */
-#line 538 "../parser/Grammar.y"
+#line 547 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAddNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 94:
-
-/* Line 1455 of yacc.c  */
-#line 539 "../parser/Grammar.y"
+#line 548 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeSubNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 96:
-
-/* Line 1455 of yacc.c  */
-#line 545 "../parser/Grammar.y"
+#line 554 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAddNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 97:
-
-/* Line 1455 of yacc.c  */
-#line 547 "../parser/Grammar.y"
+#line 556 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeSubNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 99:
-
-/* Line 1455 of yacc.c  */
-#line 552 "../parser/Grammar.y"
+#line 561 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeLeftShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 100:
-
-/* Line 1455 of yacc.c  */
-#line 553 "../parser/Grammar.y"
+#line 562 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 101:
-
-/* Line 1455 of yacc.c  */
-#line 554 "../parser/Grammar.y"
+#line 563 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 103:
-
-/* Line 1455 of yacc.c  */
-#line 559 "../parser/Grammar.y"
+#line 568 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeLeftShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 104:
-
-/* Line 1455 of yacc.c  */
-#line 560 "../parser/Grammar.y"
+#line 569 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 105:
-
-/* Line 1455 of yacc.c  */
-#line 561 "../parser/Grammar.y"
+#line 570 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 107:
-
-/* Line 1455 of yacc.c  */
-#line 566 "../parser/Grammar.y"
+#line 575 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 108:
-
-/* Line 1455 of yacc.c  */
-#line 567 "../parser/Grammar.y"
+#line 576 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 109:
-
-/* Line 1455 of yacc.c  */
-#line 568 "../parser/Grammar.y"
+#line 577 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 110:
-
-/* Line 1455 of yacc.c  */
-#line 569 "../parser/Grammar.y"
+#line 578 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 111:
-
-/* Line 1455 of yacc.c  */
-#line 570 "../parser/Grammar.y"
+#line 579 "../parser/Grammar.y"
     { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 112:
-
-/* Line 1455 of yacc.c  */
-#line 573 "../parser/Grammar.y"
+#line 582 "../parser/Grammar.y"
     { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 114:
-
-/* Line 1455 of yacc.c  */
-#line 580 "../parser/Grammar.y"
+#line 589 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 115:
-
-/* Line 1455 of yacc.c  */
-#line 581 "../parser/Grammar.y"
+#line 590 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 116:
-
-/* Line 1455 of yacc.c  */
-#line 582 "../parser/Grammar.y"
+#line 591 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 117:
-
-/* Line 1455 of yacc.c  */
-#line 583 "../parser/Grammar.y"
+#line 592 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 118:
-
-/* Line 1455 of yacc.c  */
-#line 585 "../parser/Grammar.y"
+#line 594 "../parser/Grammar.y"
     { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 120:
-
-/* Line 1455 of yacc.c  */
-#line 592 "../parser/Grammar.y"
+#line 601 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 121:
-
-/* Line 1455 of yacc.c  */
-#line 593 "../parser/Grammar.y"
+#line 602 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 122:
-
-/* Line 1455 of yacc.c  */
-#line 594 "../parser/Grammar.y"
+#line 603 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 123:
-
-/* Line 1455 of yacc.c  */
-#line 595 "../parser/Grammar.y"
+#line 604 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 124:
-
-/* Line 1455 of yacc.c  */
-#line 597 "../parser/Grammar.y"
+#line 606 "../parser/Grammar.y"
     { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 125:
-
-/* Line 1455 of yacc.c  */
-#line 601 "../parser/Grammar.y"
+#line 610 "../parser/Grammar.y"
     { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 127:
-
-/* Line 1455 of yacc.c  */
-#line 608 "../parser/Grammar.y"
+#line 617 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 128:
-
-/* Line 1455 of yacc.c  */
-#line 609 "../parser/Grammar.y"
+#line 618 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 129:
-
-/* Line 1455 of yacc.c  */
-#line 610 "../parser/Grammar.y"
+#line 619 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 130:
-
-/* Line 1455 of yacc.c  */
-#line 611 "../parser/Grammar.y"
+#line 620 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 132:
-
-/* Line 1455 of yacc.c  */
-#line 617 "../parser/Grammar.y"
+#line 626 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 133:
-
-/* Line 1455 of yacc.c  */
-#line 619 "../parser/Grammar.y"
+#line 628 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 134:
-
-/* Line 1455 of yacc.c  */
-#line 621 "../parser/Grammar.y"
+#line 630 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 135:
-
-/* Line 1455 of yacc.c  */
-#line 623 "../parser/Grammar.y"
+#line 632 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 137:
-
-/* Line 1455 of yacc.c  */
-#line 629 "../parser/Grammar.y"
+#line 638 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 138:
-
-/* Line 1455 of yacc.c  */
-#line 630 "../parser/Grammar.y"
+#line 639 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 139:
-
-/* Line 1455 of yacc.c  */
-#line 632 "../parser/Grammar.y"
+#line 641 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 140:
-
-/* Line 1455 of yacc.c  */
-#line 634 "../parser/Grammar.y"
+#line 643 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 142:
-
-/* Line 1455 of yacc.c  */
-#line 639 "../parser/Grammar.y"
+#line 648 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 144:
-
-/* Line 1455 of yacc.c  */
-#line 645 "../parser/Grammar.y"
+#line 654 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 146:
-
-/* Line 1455 of yacc.c  */
-#line 650 "../parser/Grammar.y"
+#line 659 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 148:
-
-/* Line 1455 of yacc.c  */
-#line 655 "../parser/Grammar.y"
+#line 664 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 150:
-
-/* Line 1455 of yacc.c  */
-#line 661 "../parser/Grammar.y"
+#line 670 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 152:
-
-/* Line 1455 of yacc.c  */
-#line 667 "../parser/Grammar.y"
+#line 676 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 154:
-
-/* Line 1455 of yacc.c  */
-#line 672 "../parser/Grammar.y"
+#line 681 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 156:
-
-/* Line 1455 of yacc.c  */
-#line 678 "../parser/Grammar.y"
+#line 687 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 158:
-
-/* Line 1455 of yacc.c  */
-#line 684 "../parser/Grammar.y"
+#line 693 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 160:
-
-/* Line 1455 of yacc.c  */
-#line 689 "../parser/Grammar.y"
+#line 698 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 162:
-
-/* Line 1455 of yacc.c  */
-#line 695 "../parser/Grammar.y"
+#line 704 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 164:
-
-/* Line 1455 of yacc.c  */
-#line 701 "../parser/Grammar.y"
+#line 710 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 166:
-
-/* Line 1455 of yacc.c  */
-#line 706 "../parser/Grammar.y"
+#line 715 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 168:
-
-/* Line 1455 of yacc.c  */
-#line 712 "../parser/Grammar.y"
+#line 721 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 170:
-
-/* Line 1455 of yacc.c  */
-#line 717 "../parser/Grammar.y"
+#line 726 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 172:
-
-/* Line 1455 of yacc.c  */
-#line 723 "../parser/Grammar.y"
+#line 732 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 174:
-
-/* Line 1455 of yacc.c  */
-#line 729 "../parser/Grammar.y"
+#line 738 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 176:
-
-/* Line 1455 of yacc.c  */
-#line 735 "../parser/Grammar.y"
+#line 744 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 178:
-
-/* Line 1455 of yacc.c  */
-#line 741 "../parser/Grammar.y"
+#line 750 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature, 
                                                                                                      (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); 
                                         ;}
     break;
 
   case 180:
-
-/* Line 1455 of yacc.c  */
-#line 749 "../parser/Grammar.y"
+#line 758 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature, 
                                                                                                      (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants);
                                         ;}
     break;
 
   case 182:
-
-/* Line 1455 of yacc.c  */
-#line 757 "../parser/Grammar.y"
+#line 766 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature,
                                                                                                      (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); 
                                         ;}
     break;
 
   case 183:
-
-/* Line 1455 of yacc.c  */
-#line 763 "../parser/Grammar.y"
+#line 772 "../parser/Grammar.y"
     { (yyval.op) = OpEqual; ;}
     break;
 
   case 184:
-
-/* Line 1455 of yacc.c  */
-#line 764 "../parser/Grammar.y"
+#line 773 "../parser/Grammar.y"
     { (yyval.op) = OpPlusEq; ;}
     break;
 
   case 185:
-
-/* Line 1455 of yacc.c  */
-#line 765 "../parser/Grammar.y"
+#line 774 "../parser/Grammar.y"
     { (yyval.op) = OpMinusEq; ;}
     break;
 
   case 186:
-
-/* Line 1455 of yacc.c  */
-#line 766 "../parser/Grammar.y"
+#line 775 "../parser/Grammar.y"
     { (yyval.op) = OpMultEq; ;}
     break;
 
   case 187:
-
-/* Line 1455 of yacc.c  */
-#line 767 "../parser/Grammar.y"
+#line 776 "../parser/Grammar.y"
     { (yyval.op) = OpDivEq; ;}
     break;
 
   case 188:
-
-/* Line 1455 of yacc.c  */
-#line 768 "../parser/Grammar.y"
+#line 777 "../parser/Grammar.y"
     { (yyval.op) = OpLShift; ;}
     break;
 
   case 189:
-
-/* Line 1455 of yacc.c  */
-#line 769 "../parser/Grammar.y"
+#line 778 "../parser/Grammar.y"
     { (yyval.op) = OpRShift; ;}
     break;
 
   case 190:
-
-/* Line 1455 of yacc.c  */
-#line 770 "../parser/Grammar.y"
+#line 779 "../parser/Grammar.y"
     { (yyval.op) = OpURShift; ;}
     break;
 
   case 191:
-
-/* Line 1455 of yacc.c  */
-#line 771 "../parser/Grammar.y"
+#line 780 "../parser/Grammar.y"
     { (yyval.op) = OpAndEq; ;}
     break;
 
   case 192:
-
-/* Line 1455 of yacc.c  */
-#line 772 "../parser/Grammar.y"
+#line 781 "../parser/Grammar.y"
     { (yyval.op) = OpXOrEq; ;}
     break;
 
   case 193:
-
-/* Line 1455 of yacc.c  */
-#line 773 "../parser/Grammar.y"
+#line 782 "../parser/Grammar.y"
     { (yyval.op) = OpOrEq; ;}
     break;
 
   case 194:
-
-/* Line 1455 of yacc.c  */
-#line 774 "../parser/Grammar.y"
+#line 783 "../parser/Grammar.y"
     { (yyval.op) = OpModEq; ;}
     break;
 
   case 196:
-
-/* Line 1455 of yacc.c  */
-#line 779 "../parser/Grammar.y"
+#line 788 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 198:
-
-/* Line 1455 of yacc.c  */
-#line 784 "../parser/Grammar.y"
+#line 793 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 200:
-
-/* Line 1455 of yacc.c  */
-#line 789 "../parser/Grammar.y"
+#line 798 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 218:
-
-/* Line 1455 of yacc.c  */
-#line 813 "../parser/Grammar.y"
+#line 822 "../parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, 0), 0, 0, 0, 0);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 219:
-
-/* Line 1455 of yacc.c  */
-#line 815 "../parser/Grammar.y"
+#line 824 "../parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].sourceElements).m_node), (yyvsp[(2) - (3)].sourceElements).m_varDeclarations, (yyvsp[(2) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (3)].sourceElements).m_features, (yyvsp[(2) - (3)].sourceElements).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 220:
-
-/* Line 1455 of yacc.c  */
-#line 820 "../parser/Grammar.y"
+#line 829 "../parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(makeVarStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].varDeclList).m_node), (yyvsp[(2) - (3)].varDeclList).m_varDeclarations, (yyvsp[(2) - (3)].varDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].varDeclList).m_features, (yyvsp[(2) - (3)].varDeclList).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 221:
-
-/* Line 1455 of yacc.c  */
-#line 822 "../parser/Grammar.y"
+#line 831 "../parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(makeVarStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].varDeclList).m_node), (yyvsp[(2) - (3)].varDeclList).m_varDeclarations, (yyvsp[(2) - (3)].varDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].varDeclList).m_features, (yyvsp[(2) - (3)].varDeclList).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)]));
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)]));
                                           AUTO_SEMICOLON; ;}
     break;
 
   case 222:
-
-/* Line 1455 of yacc.c  */
-#line 828 "../parser/Grammar.y"
+#line 837 "../parser/Grammar.y"
     { (yyval.varDeclList).m_node = 0;
                                           (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (1)].ident), 0);
@@ -4119,11 +3867,9 @@ yyreduce:
     break;
 
   case 223:
-
-/* Line 1455 of yacc.c  */
-#line 835 "../parser/Grammar.y"
+#line 844 "../parser/Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column);
                                           (yyval.varDeclList).m_node = node;
                                           (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (2)].ident), DeclarationStacks::HasInitializer);
@@ -4134,9 +3880,7 @@ yyreduce:
     break;
 
   case 224:
-
-/* Line 1455 of yacc.c  */
-#line 845 "../parser/Grammar.y"
+#line 854 "../parser/Grammar.y"
     { (yyval.varDeclList).m_node = (yyvsp[(1) - (3)].varDeclList).m_node;
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (3)].varDeclList).m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (3)].ident), 0);
@@ -4147,11 +3891,9 @@ yyreduce:
     break;
 
   case 225:
-
-/* Line 1455 of yacc.c  */
-#line 853 "../parser/Grammar.y"
+#line 862 "../parser/Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
                                           (yyval.varDeclList).m_node = combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (4)].varDeclList).m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (4)].ident), DeclarationStacks::HasInitializer);
@@ -4162,9 +3904,7 @@ yyreduce:
     break;
 
   case 226:
-
-/* Line 1455 of yacc.c  */
-#line 865 "../parser/Grammar.y"
+#line 874 "../parser/Grammar.y"
     { (yyval.varDeclList).m_node = 0;
                                           (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (1)].ident), 0);
@@ -4175,11 +3915,9 @@ yyreduce:
     break;
 
   case 227:
-
-/* Line 1455 of yacc.c  */
-#line 872 "../parser/Grammar.y"
+#line 881 "../parser/Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column);
                                           (yyval.varDeclList).m_node = node;
                                           (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (2)].ident), DeclarationStacks::HasInitializer);
@@ -4190,9 +3928,7 @@ yyreduce:
     break;
 
   case 228:
-
-/* Line 1455 of yacc.c  */
-#line 882 "../parser/Grammar.y"
+#line 891 "../parser/Grammar.y"
     { (yyval.varDeclList).m_node = (yyvsp[(1) - (3)].varDeclList).m_node;
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (3)].varDeclList).m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (3)].ident), 0);
@@ -4203,11 +3939,9 @@ yyreduce:
     break;
 
   case 229:
-
-/* Line 1455 of yacc.c  */
-#line 890 "../parser/Grammar.y"
+#line 899 "../parser/Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
                                           (yyval.varDeclList).m_node = combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (4)].varDeclList).m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (4)].ident), DeclarationStacks::HasInitializer);
@@ -4218,25 +3952,19 @@ yyreduce:
     break;
 
   case 230:
-
-/* Line 1455 of yacc.c  */
-#line 902 "../parser/Grammar.y"
+#line 911 "../parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 231:
-
-/* Line 1455 of yacc.c  */
-#line 905 "../parser/Grammar.y"
+#line 914 "../parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
     break;
 
   case 232:
-
-/* Line 1455 of yacc.c  */
-#line 910 "../parser/Grammar.y"
+#line 919 "../parser/Grammar.y"
     { (yyval.constDeclList).m_node.head = (yyvsp[(1) - (1)].constDeclNode).m_node;
                                           (yyval.constDeclList).m_node.tail = (yyval.constDeclList).m_node.head;
                                           (yyval.constDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
@@ -4248,9 +3976,7 @@ yyreduce:
     break;
 
   case 233:
-
-/* Line 1455 of yacc.c  */
-#line 919 "../parser/Grammar.y"
+#line 928 "../parser/Grammar.y"
     { (yyval.constDeclList).m_node.head = (yyvsp[(1) - (3)].constDeclList).m_node.head;
                                           (yyvsp[(1) - (3)].constDeclList).m_node.tail->m_next = (yyvsp[(3) - (3)].constDeclNode).m_node;
                                           (yyval.constDeclList).m_node.tail = (yyvsp[(3) - (3)].constDeclNode).m_node;
@@ -4262,316 +3988,246 @@ yyreduce:
     break;
 
   case 234:
-
-/* Line 1455 of yacc.c  */
-#line 930 "../parser/Grammar.y"
+#line 939 "../parser/Grammar.y"
     { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), 0), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
     break;
 
   case 235:
-
-/* Line 1455 of yacc.c  */
-#line 931 "../parser/Grammar.y"
+#line 940 "../parser/Grammar.y"
     { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node), ((*(yyvsp[(1) - (2)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 236:
-
-/* Line 1455 of yacc.c  */
-#line 935 "../parser/Grammar.y"
+#line 944 "../parser/Grammar.y"
     { (yyval.expressionNode) = (yyvsp[(2) - (2)].expressionNode); ;}
     break;
 
   case 237:
-
-/* Line 1455 of yacc.c  */
-#line 939 "../parser/Grammar.y"
+#line 948 "../parser/Grammar.y"
     { (yyval.expressionNode) = (yyvsp[(2) - (2)].expressionNode); ;}
     break;
 
   case 238:
-
-/* Line 1455 of yacc.c  */
-#line 943 "../parser/Grammar.y"
+#line 952 "../parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) EmptyStatementNode(GLOBAL_DATA), 0, 0, 0, 0); ;}
     break;
 
   case 239:
-
-/* Line 1455 of yacc.c  */
-#line 947 "../parser/Grammar.y"
+#line 956 "../parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 240:
-
-/* Line 1455 of yacc.c  */
-#line 949 "../parser/Grammar.y"
+#line 958 "../parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 241:
-
-/* Line 1455 of yacc.c  */
-#line 955 "../parser/Grammar.y"
+#line 964 "../parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
 
   case 242:
-
-/* Line 1455 of yacc.c  */
-#line 958 "../parser/Grammar.y"
+#line 967 "../parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfElseNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].statementNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node), 
                                                                                          mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_funcDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(3) - (7)].expressionNode).m_features | (yyvsp[(5) - (7)].statementNode).m_features | (yyvsp[(7) - (7)].statementNode).m_features,
                                                                                          (yyvsp[(3) - (7)].expressionNode).m_numConstants + (yyvsp[(5) - (7)].statementNode).m_numConstants + (yyvsp[(7) - (7)].statementNode).m_numConstants); 
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(4) - (7)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(4) - (7)])); ;}
     break;
 
   case 243:
-
-/* Line 1455 of yacc.c  */
-#line 967 "../parser/Grammar.y"
+#line 976 "../parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
-                                             DBG((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(3) - (7)])); ;}
+                                             setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(3) - (7)])); ;}
     break;
 
   case 244:
-
-/* Line 1455 of yacc.c  */
-#line 969 "../parser/Grammar.y"
+#line 978 "../parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
-                                             DBG((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(3) - (7)])); ;}
+                                             setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(3) - (7)])); ;}
     break;
 
   case 245:
-
-/* Line 1455 of yacc.c  */
-#line 971 "../parser/Grammar.y"
+#line 980 "../parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WhileNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
 
   case 246:
-
-/* Line 1455 of yacc.c  */
-#line 974 "../parser/Grammar.y"
+#line 983 "../parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, (yyvsp[(3) - (9)].expressionNode).m_node, (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, false), (yyvsp[(9) - (9)].statementNode).m_varDeclarations, (yyvsp[(9) - (9)].statementNode).m_funcDeclarations, 
                                                                                          (yyvsp[(3) - (9)].expressionNode).m_features | (yyvsp[(5) - (9)].expressionNode).m_features | (yyvsp[(7) - (9)].expressionNode).m_features | (yyvsp[(9) - (9)].statementNode).m_features,
                                                                                          (yyvsp[(3) - (9)].expressionNode).m_numConstants + (yyvsp[(5) - (9)].expressionNode).m_numConstants + (yyvsp[(7) - (9)].expressionNode).m_numConstants + (yyvsp[(9) - (9)].statementNode).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (9)]), (yylsp[(8) - (9)])); 
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (9)]), (yylsp[(8) - (9)])); 
                                         ;}
     break;
 
   case 247:
-
-/* Line 1455 of yacc.c  */
-#line 980 "../parser/Grammar.y"
+#line 989 "../parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, (yyvsp[(4) - (10)].varDeclList).m_node, (yyvsp[(6) - (10)].expressionNode).m_node, (yyvsp[(8) - (10)].expressionNode).m_node, (yyvsp[(10) - (10)].statementNode).m_node, true),
                                                                                          mergeDeclarationLists((yyvsp[(4) - (10)].varDeclList).m_varDeclarations, (yyvsp[(10) - (10)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(4) - (10)].varDeclList).m_funcDeclarations, (yyvsp[(10) - (10)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(4) - (10)].varDeclList).m_features | (yyvsp[(6) - (10)].expressionNode).m_features | (yyvsp[(8) - (10)].expressionNode).m_features | (yyvsp[(10) - (10)].statementNode).m_features,
                                                                                          (yyvsp[(4) - (10)].varDeclList).m_numConstants + (yyvsp[(6) - (10)].expressionNode).m_numConstants + (yyvsp[(8) - (10)].expressionNode).m_numConstants + (yyvsp[(10) - (10)].statementNode).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (10)]), (yylsp[(9) - (10)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (10)]), (yylsp[(9) - (10)])); ;}
     break;
 
   case 248:
-
-/* Line 1455 of yacc.c  */
-#line 987 "../parser/Grammar.y"
+#line 996 "../parser/Grammar.y"
     {
                                             ForInNode* node = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node);
-                                            SET_EXCEPTION_LOCATION(node, (yylsp[(3) - (7)]).first_column, (yylsp[(3) - (7)]).last_column, (yylsp[(5) - (7)]).last_column);
+                                            setExceptionLocation(node, (yylsp[(3) - (7)]).first_column, (yylsp[(3) - (7)]).last_column, (yylsp[(5) - (7)]).last_column);
                                             (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, (yyvsp[(7) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations,
                                                                                            (yyvsp[(3) - (7)].expressionNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features | (yyvsp[(7) - (7)].statementNode).m_features,
                                                                                            (yyvsp[(3) - (7)].expressionNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants + (yyvsp[(7) - (7)].statementNode).m_numConstants);
-                                            DBG((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(6) - (7)]));
+                                            setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(6) - (7)]));
                                         ;}
     break;
 
   case 249:
-
-/* Line 1455 of yacc.c  */
-#line 996 "../parser/Grammar.y"
+#line 1005 "../parser/Grammar.y"
     { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (8)].ident), 0, (yyvsp[(6) - (8)].expressionNode).m_node, (yyvsp[(8) - (8)].statementNode).m_node, (yylsp[(5) - (8)]).first_column, (yylsp[(5) - (8)]).first_column - (yylsp[(4) - (8)]).first_column, (yylsp[(6) - (8)]).last_column - (yylsp[(5) - (8)]).first_column);
-                                          SET_EXCEPTION_LOCATION(forIn, (yylsp[(4) - (8)]).first_column, (yylsp[(5) - (8)]).first_column + 1, (yylsp[(6) - (8)]).last_column);
+                                          setExceptionLocation(forIn, (yylsp[(4) - (8)]).first_column, (yylsp[(5) - (8)]).first_column + 1, (yylsp[(6) - (8)]).last_column);
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyvsp[(8) - (8)].statementNode).m_varDeclarations, *(yyvsp[(4) - (8)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(forIn, (yyvsp[(8) - (8)].statementNode).m_varDeclarations, (yyvsp[(8) - (8)].statementNode).m_funcDeclarations, ((*(yyvsp[(4) - (8)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(6) - (8)].expressionNode).m_features | (yyvsp[(8) - (8)].statementNode).m_features, (yyvsp[(6) - (8)].expressionNode).m_numConstants + (yyvsp[(8) - (8)].statementNode).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (8)]), (yylsp[(7) - (8)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (8)]), (yylsp[(7) - (8)])); ;}
     break;
 
   case 250:
-
-/* Line 1455 of yacc.c  */
-#line 1002 "../parser/Grammar.y"
+#line 1011 "../parser/Grammar.y"
     { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (9)].ident), (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, (yylsp[(5) - (9)]).first_column, (yylsp[(5) - (9)]).first_column - (yylsp[(4) - (9)]).first_column, (yylsp[(5) - (9)]).last_column - (yylsp[(5) - (9)]).first_column);
-                                          SET_EXCEPTION_LOCATION(forIn, (yylsp[(4) - (9)]).first_column, (yylsp[(6) - (9)]).first_column + 1, (yylsp[(7) - (9)]).last_column);
+                                          setExceptionLocation(forIn, (yylsp[(4) - (9)]).first_column, (yylsp[(6) - (9)]).first_column + 1, (yylsp[(7) - (9)]).last_column);
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyvsp[(9) - (9)].statementNode).m_varDeclarations, *(yyvsp[(4) - (9)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(forIn, (yyvsp[(9) - (9)].statementNode).m_varDeclarations, (yyvsp[(9) - (9)].statementNode).m_funcDeclarations,
                                                                                          ((*(yyvsp[(4) - (9)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(5) - (9)].expressionNode).m_features | (yyvsp[(7) - (9)].expressionNode).m_features | (yyvsp[(9) - (9)].statementNode).m_features,
                                                                                          (yyvsp[(5) - (9)].expressionNode).m_numConstants + (yyvsp[(7) - (9)].expressionNode).m_numConstants + (yyvsp[(9) - (9)].statementNode).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (9)]), (yylsp[(8) - (9)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (9)]), (yylsp[(8) - (9)])); ;}
     break;
 
   case 251:
-
-/* Line 1455 of yacc.c  */
-#line 1012 "../parser/Grammar.y"
+#line 1021 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(0, 0, 0); ;}
     break;
 
   case 253:
-
-/* Line 1455 of yacc.c  */
-#line 1017 "../parser/Grammar.y"
+#line 1026 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(0, 0, 0); ;}
     break;
 
   case 255:
-
-/* Line 1455 of yacc.c  */
-#line 1022 "../parser/Grammar.y"
+#line 1031 "../parser/Grammar.y"
     { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
+                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 256:
-
-/* Line 1455 of yacc.c  */
-#line 1026 "../parser/Grammar.y"
+#line 1035 "../parser/Grammar.y"
     { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
+                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 257:
-
-/* Line 1455 of yacc.c  */
-#line 1030 "../parser/Grammar.y"
+#line 1039 "../parser/Grammar.y"
     { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 258:
-
-/* Line 1455 of yacc.c  */
-#line 1034 "../parser/Grammar.y"
+#line 1043 "../parser/Grammar.y"
     { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
     break;
 
   case 259:
-
-/* Line 1455 of yacc.c  */
-#line 1041 "../parser/Grammar.y"
+#line 1050 "../parser/Grammar.y"
     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
+                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column);
+                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 260:
-
-/* Line 1455 of yacc.c  */
-#line 1044 "../parser/Grammar.y"
+#line 1053 "../parser/Grammar.y"
     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA), 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
+                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column);
+                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA), 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 261:
-
-/* Line 1455 of yacc.c  */
-#line 1047 "../parser/Grammar.y"
+#line 1056 "../parser/Grammar.y"
     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
+                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 262:
-
-/* Line 1455 of yacc.c  */
-#line 1050 "../parser/Grammar.y"
+#line 1059 "../parser/Grammar.y"
     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident)), 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
+                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident)), 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
     break;
 
   case 263:
-
-/* Line 1455 of yacc.c  */
-#line 1056 "../parser/Grammar.y"
+#line 1065 "../parser/Grammar.y"
     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
+                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
+                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 264:
-
-/* Line 1455 of yacc.c  */
-#line 1059 "../parser/Grammar.y"
+#line 1068 "../parser/Grammar.y"
     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
+                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
+                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 265:
-
-/* Line 1455 of yacc.c  */
-#line 1062 "../parser/Grammar.y"
+#line 1071 "../parser/Grammar.y"
     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
+                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 266:
-
-/* Line 1455 of yacc.c  */
-#line 1065 "../parser/Grammar.y"
+#line 1074 "../parser/Grammar.y"
     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
+                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
     break;
 
   case 267:
-
-/* Line 1455 of yacc.c  */
-#line 1071 "../parser/Grammar.y"
+#line 1080 "../parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WithNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node, (yylsp[(3) - (5)]).last_column, (yylsp[(3) - (5)]).last_column - (yylsp[(3) - (5)]).first_column),
                                                                                          (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features | WithFeature, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
 
   case 268:
-
-/* Line 1455 of yacc.c  */
-#line 1077 "../parser/Grammar.y"
+#line 1086 "../parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) SwitchNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].caseBlockNode).m_node), (yyvsp[(5) - (5)].caseBlockNode).m_varDeclarations, (yyvsp[(5) - (5)].caseBlockNode).m_funcDeclarations,
                                                                                          (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].caseBlockNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].caseBlockNode).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
 
   case 269:
-
-/* Line 1455 of yacc.c  */
-#line 1083 "../parser/Grammar.y"
+#line 1092 "../parser/Grammar.y"
     { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].clauseList).m_node.head, 0, 0), (yyvsp[(2) - (3)].clauseList).m_varDeclarations, (yyvsp[(2) - (3)].clauseList).m_funcDeclarations, (yyvsp[(2) - (3)].clauseList).m_features, (yyvsp[(2) - (3)].clauseList).m_numConstants); ;}
     break;
 
   case 270:
-
-/* Line 1455 of yacc.c  */
-#line 1085 "../parser/Grammar.y"
+#line 1094 "../parser/Grammar.y"
     { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (5)].clauseList).m_node.head, (yyvsp[(3) - (5)].caseClauseNode).m_node, (yyvsp[(4) - (5)].clauseList).m_node.head),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (5)].clauseList).m_varDeclarations, (yyvsp[(3) - (5)].caseClauseNode).m_varDeclarations), (yyvsp[(4) - (5)].clauseList).m_varDeclarations),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (5)].clauseList).m_funcDeclarations, (yyvsp[(3) - (5)].caseClauseNode).m_funcDeclarations), (yyvsp[(4) - (5)].clauseList).m_funcDeclarations),
@@ -4580,16 +4236,12 @@ yyreduce:
     break;
 
   case 271:
-
-/* Line 1455 of yacc.c  */
-#line 1093 "../parser/Grammar.y"
+#line 1102 "../parser/Grammar.y"
     { (yyval.clauseList).m_node.head = 0; (yyval.clauseList).m_node.tail = 0; (yyval.clauseList).m_varDeclarations = 0; (yyval.clauseList).m_funcDeclarations = 0; (yyval.clauseList).m_features = 0; (yyval.clauseList).m_numConstants = 0; ;}
     break;
 
   case 273:
-
-/* Line 1455 of yacc.c  */
-#line 1098 "../parser/Grammar.y"
+#line 1107 "../parser/Grammar.y"
     { (yyval.clauseList).m_node.head = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].caseClauseNode).m_node);
                                           (yyval.clauseList).m_node.tail = (yyval.clauseList).m_node.head;
                                           (yyval.clauseList).m_varDeclarations = (yyvsp[(1) - (1)].caseClauseNode).m_varDeclarations;
@@ -4599,9 +4251,7 @@ yyreduce:
     break;
 
   case 274:
-
-/* Line 1455 of yacc.c  */
-#line 1104 "../parser/Grammar.y"
+#line 1113 "../parser/Grammar.y"
     { (yyval.clauseList).m_node.head = (yyvsp[(1) - (2)].clauseList).m_node.head;
                                           (yyval.clauseList).m_node.tail = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (2)].clauseList).m_node.tail, (yyvsp[(2) - (2)].caseClauseNode).m_node);
                                           (yyval.clauseList).m_varDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].clauseList).m_varDeclarations, (yyvsp[(2) - (2)].caseClauseNode).m_varDeclarations);
@@ -4612,223 +4262,173 @@ yyreduce:
     break;
 
   case 275:
-
-/* Line 1455 of yacc.c  */
-#line 1114 "../parser/Grammar.y"
+#line 1123 "../parser/Grammar.y"
     { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node), 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 276:
-
-/* Line 1455 of yacc.c  */
-#line 1115 "../parser/Grammar.y"
+#line 1124 "../parser/Grammar.y"
     { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].sourceElements).m_node), (yyvsp[(4) - (4)].sourceElements).m_varDeclarations, (yyvsp[(4) - (4)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (4)].expressionNode).m_features | (yyvsp[(4) - (4)].sourceElements).m_features, (yyvsp[(2) - (4)].expressionNode).m_numConstants + (yyvsp[(4) - (4)].sourceElements).m_numConstants); ;}
     break;
 
   case 277:
-
-/* Line 1455 of yacc.c  */
-#line 1119 "../parser/Grammar.y"
+#line 1128 "../parser/Grammar.y"
     { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0), 0, 0, 0, 0); ;}
     break;
 
   case 278:
-
-/* Line 1455 of yacc.c  */
-#line 1120 "../parser/Grammar.y"
+#line 1129 "../parser/Grammar.y"
     { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0, (yyvsp[(3) - (3)].sourceElements).m_node), (yyvsp[(3) - (3)].sourceElements).m_varDeclarations, (yyvsp[(3) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(3) - (3)].sourceElements).m_features, (yyvsp[(3) - (3)].sourceElements).m_numConstants); ;}
     break;
 
   case 279:
-
-/* Line 1455 of yacc.c  */
-#line 1124 "../parser/Grammar.y"
+#line 1133 "../parser/Grammar.y"
     { LabelNode* node = new (GLOBAL_DATA) LabelNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].statementNode).m_node);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, (yyvsp[(3) - (3)].statementNode).m_varDeclarations, (yyvsp[(3) - (3)].statementNode).m_funcDeclarations, (yyvsp[(3) - (3)].statementNode).m_features, (yyvsp[(3) - (3)].statementNode).m_numConstants); ;}
     break;
 
   case 280:
-
-/* Line 1455 of yacc.c  */
-#line 1130 "../parser/Grammar.y"
+#line 1139 "../parser/Grammar.y"
     { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)]));
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
+                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)]));
                                         ;}
     break;
 
   case 281:
-
-/* Line 1455 of yacc.c  */
-#line 1134 "../parser/Grammar.y"
+#line 1143 "../parser/Grammar.y"
     { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; 
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
+                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; 
                                         ;}
     break;
 
   case 282:
-
-/* Line 1455 of yacc.c  */
-#line 1141 "../parser/Grammar.y"
+#line 1150 "../parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (4)].statementNode).m_node, GLOBAL_DATA->propertyNames->nullIdentifier, false, 0, (yyvsp[(4) - (4)].statementNode).m_node),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (4)].statementNode).m_varDeclarations, (yyvsp[(4) - (4)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (4)].statementNode).m_funcDeclarations, (yyvsp[(4) - (4)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(2) - (4)].statementNode).m_features | (yyvsp[(4) - (4)].statementNode).m_features,
                                                                                          (yyvsp[(2) - (4)].statementNode).m_numConstants + (yyvsp[(4) - (4)].statementNode).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (4)]), (yylsp[(2) - (4)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (4)]), (yylsp[(2) - (4)])); ;}
     break;
 
   case 283:
-
-/* Line 1455 of yacc.c  */
-#line 1147 "../parser/Grammar.y"
+#line 1156 "../parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, *(yyvsp[(5) - (7)].ident), ((yyvsp[(7) - (7)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (7)].statementNode).m_node, 0),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(7) - (7)].statementNode).m_features | CatchFeature,
                                                                                          (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(7) - (7)].statementNode).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(2) - (7)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(2) - (7)])); ;}
     break;
 
   case 284:
-
-/* Line 1455 of yacc.c  */
-#line 1154 "../parser/Grammar.y"
+#line 1163 "../parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (9)].statementNode).m_node, *(yyvsp[(5) - (9)].ident), ((yyvsp[(7) - (9)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (9)].statementNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (9)].statementNode).m_varDeclarations, (yyvsp[(7) - (9)].statementNode).m_varDeclarations), (yyvsp[(9) - (9)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (9)].statementNode).m_funcDeclarations, (yyvsp[(7) - (9)].statementNode).m_funcDeclarations), (yyvsp[(9) - (9)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(2) - (9)].statementNode).m_features | (yyvsp[(7) - (9)].statementNode).m_features | (yyvsp[(9) - (9)].statementNode).m_features | CatchFeature,
                                                                                          (yyvsp[(2) - (9)].statementNode).m_numConstants + (yyvsp[(7) - (9)].statementNode).m_numConstants + (yyvsp[(9) - (9)].statementNode).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (9)]), (yylsp[(2) - (9)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (9)]), (yylsp[(2) - (9)])); ;}
     break;
 
   case 285:
-
-/* Line 1455 of yacc.c  */
-#line 1163 "../parser/Grammar.y"
+#line 1172 "../parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 286:
-
-/* Line 1455 of yacc.c  */
-#line 1165 "../parser/Grammar.y"
+#line 1174 "../parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 287:
-
-/* Line 1455 of yacc.c  */
-#line 1170 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), LEXER->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*(yyvsp[(2) - (7)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | ClosureFeature, 0); DBG((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); (yyval.statementNode).m_funcDeclarations->data.append(static_cast<FuncDeclNode*>((yyval.statementNode).m_node)); ;}
+#line 1179 "../parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*(yyvsp[(2) - (7)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | ClosureFeature, 0); setStatementLocation((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); (yyval.statementNode).m_funcDeclarations->data.append(static_cast<FuncDeclNode*>((yyval.statementNode).m_node)->body()); ;}
     break;
 
   case 288:
-
-/* Line 1455 of yacc.c  */
-#line 1172 "../parser/Grammar.y"
-    { 
-          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), LEXER->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*(yyvsp[(2) - (8)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
+#line 1181 "../parser/Grammar.y"
+    {
+          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*(yyvsp[(2) - (8)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0);
           if ((yyvsp[(4) - (8)].parameterList).m_features & ArgumentsFeature)
-              (yyvsp[(7) - (8)].functionBodyNode)->setUsesArguments(); 
-          DBG((yyvsp[(7) - (8)].functionBodyNode), (yylsp[(6) - (8)]), (yylsp[(8) - (8)]));
-          (yyval.statementNode).m_funcDeclarations->data.append(static_cast<FuncDeclNode*>((yyval.statementNode).m_node));
+              (yyvsp[(7) - (8)].functionBodyNode)->setUsesArguments();
+          setStatementLocation((yyvsp[(7) - (8)].functionBodyNode), (yylsp[(6) - (8)]), (yylsp[(8) - (8)]));
+          (yyval.statementNode).m_funcDeclarations->data.append(static_cast<FuncDeclNode*>((yyval.statementNode).m_node)->body());
       ;}
     break;
 
   case 289:
-
-/* Line 1455 of yacc.c  */
-#line 1182 "../parser/Grammar.y"
-    { (yyval.funcExprNode) = createNodeInfo(new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, (yyvsp[(5) - (6)].functionBodyNode), LEXER->sourceCode((yyvsp[(4) - (6)].intValue), (yyvsp[(6) - (6)].intValue), (yylsp[(4) - (6)]).first_line)), ClosureFeature, 0); DBG((yyvsp[(5) - (6)].functionBodyNode), (yylsp[(4) - (6)]), (yylsp[(6) - (6)])); ;}
+#line 1191 "../parser/Grammar.y"
+    { (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, (yyvsp[(5) - (6)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(4) - (6)].intValue), (yyvsp[(6) - (6)].intValue), (yylsp[(4) - (6)]).first_line)), ClosureFeature, 0); setStatementLocation((yyvsp[(5) - (6)].functionBodyNode), (yylsp[(4) - (6)]), (yylsp[(6) - (6)])); ;}
     break;
 
   case 290:
-
-/* Line 1455 of yacc.c  */
-#line 1184 "../parser/Grammar.y"
-    { 
-          (yyval.funcExprNode) = createNodeInfo(new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, (yyvsp[(6) - (7)].functionBodyNode), LEXER->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line), (yyvsp[(3) - (7)].parameterList).m_node.head), (yyvsp[(3) - (7)].parameterList).m_features | ClosureFeature, 0); 
-          if ((yyvsp[(3) - (7)].parameterList).m_features & ArgumentsFeature) 
+#line 1193 "../parser/Grammar.y"
+    {
+          (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line), (yyvsp[(3) - (7)].parameterList).m_node.head), (yyvsp[(3) - (7)].parameterList).m_features | ClosureFeature, 0);
+          if ((yyvsp[(3) - (7)].parameterList).m_features & ArgumentsFeature)
               (yyvsp[(6) - (7)].functionBodyNode)->setUsesArguments();
-          DBG((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); 
+          setStatementLocation((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)]));
       ;}
     break;
 
   case 291:
-
-/* Line 1455 of yacc.c  */
-#line 1190 "../parser/Grammar.y"
-    { (yyval.funcExprNode) = createNodeInfo(new FuncExprNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), LEXER->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), ClosureFeature, 0); DBG((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); ;}
+#line 1199 "../parser/Grammar.y"
+    { (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), ClosureFeature, 0); setStatementLocation((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); ;}
     break;
 
   case 292:
-
-/* Line 1455 of yacc.c  */
-#line 1192 "../parser/Grammar.y"
-    { 
-          (yyval.funcExprNode) = createNodeInfo(new FuncExprNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), LEXER->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
+#line 1201 "../parser/Grammar.y"
+    {
+          (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
           if ((yyvsp[(4) - (8)].parameterList).m_features & ArgumentsFeature)
               (yyvsp[(7) - (8)].functionBodyNode)->setUsesArguments();
-          DBG((yyvsp[(7) - (8)].functionBodyNode), (yylsp[(6) - (8)]), (yylsp[(8) - (8)])); 
+          setStatementLocation((yyvsp[(7) - (8)].functionBodyNode), (yylsp[(6) - (8)]), (yylsp[(8) - (8)]));
       ;}
     break;
 
   case 293:
-
-/* Line 1455 of yacc.c  */
-#line 1201 "../parser/Grammar.y"
+#line 1210 "../parser/Grammar.y"
     { (yyval.parameterList).m_node.head = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident));
                                           (yyval.parameterList).m_features = (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
                                           (yyval.parameterList).m_node.tail = (yyval.parameterList).m_node.head; ;}
     break;
 
   case 294:
-
-/* Line 1455 of yacc.c  */
-#line 1204 "../parser/Grammar.y"
+#line 1213 "../parser/Grammar.y"
     { (yyval.parameterList).m_node.head = (yyvsp[(1) - (3)].parameterList).m_node.head;
                                           (yyval.parameterList).m_features = (yyvsp[(1) - (3)].parameterList).m_features | ((*(yyvsp[(3) - (3)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0);
                                           (yyval.parameterList).m_node.tail = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].parameterList).m_node.tail, *(yyvsp[(3) - (3)].ident));  ;}
     break;
 
   case 295:
-
-/* Line 1455 of yacc.c  */
-#line 1210 "../parser/Grammar.y"
+#line 1219 "../parser/Grammar.y"
     { (yyval.functionBodyNode) = FunctionBodyNode::create(GLOBAL_DATA); ;}
     break;
 
   case 296:
-
-/* Line 1455 of yacc.c  */
-#line 1211 "../parser/Grammar.y"
+#line 1220 "../parser/Grammar.y"
     { (yyval.functionBodyNode) = FunctionBodyNode::create(GLOBAL_DATA); ;}
     break;
 
   case 297:
-
-/* Line 1455 of yacc.c  */
-#line 1215 "../parser/Grammar.y"
+#line 1224 "../parser/Grammar.y"
     { GLOBAL_DATA->parser->didFinishParsing(new (GLOBAL_DATA) SourceElements(GLOBAL_DATA), 0, 0, NoFeatures, (yylsp[(0) - (0)]).last_line, 0); ;}
     break;
 
   case 298:
-
-/* Line 1455 of yacc.c  */
-#line 1216 "../parser/Grammar.y"
+#line 1225 "../parser/Grammar.y"
     { GLOBAL_DATA->parser->didFinishParsing((yyvsp[(1) - (1)].sourceElements).m_node, (yyvsp[(1) - (1)].sourceElements).m_varDeclarations, (yyvsp[(1) - (1)].sourceElements).m_funcDeclarations, (yyvsp[(1) - (1)].sourceElements).m_features, 
                                                                                 (yylsp[(1) - (1)]).last_line, (yyvsp[(1) - (1)].sourceElements).m_numConstants); ;}
     break;
 
   case 299:
-
-/* Line 1455 of yacc.c  */
-#line 1221 "../parser/Grammar.y"
+#line 1230 "../parser/Grammar.y"
     { (yyval.sourceElements).m_node = new (GLOBAL_DATA) SourceElements(GLOBAL_DATA);
                                           (yyval.sourceElements).m_node->append((yyvsp[(1) - (1)].statementNode).m_node);
                                           (yyval.sourceElements).m_varDeclarations = (yyvsp[(1) - (1)].statementNode).m_varDeclarations;
@@ -4839,9 +4439,7 @@ yyreduce:
     break;
 
   case 300:
-
-/* Line 1455 of yacc.c  */
-#line 1228 "../parser/Grammar.y"
+#line 1237 "../parser/Grammar.y"
     { (yyval.sourceElements).m_node->append((yyvsp[(2) - (2)].statementNode).m_node);
                                           (yyval.sourceElements).m_varDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].sourceElements).m_varDeclarations, (yyvsp[(2) - (2)].statementNode).m_varDeclarations);
                                           (yyval.sourceElements).m_funcDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (2)].statementNode).m_funcDeclarations);
@@ -4851,261 +4449,188 @@ yyreduce:
     break;
 
   case 304:
-
-/* Line 1455 of yacc.c  */
-#line 1242 "../parser/Grammar.y"
+#line 1251 "../parser/Grammar.y"
     { ;}
     break;
 
   case 305:
-
-/* Line 1455 of yacc.c  */
-#line 1243 "../parser/Grammar.y"
+#line 1252 "../parser/Grammar.y"
     { ;}
     break;
 
   case 306:
-
-/* Line 1455 of yacc.c  */
-#line 1244 "../parser/Grammar.y"
-    { Lexer& l = *LEXER; if (!l.scanRegExp()) YYABORT; ;}
+#line 1253 "../parser/Grammar.y"
+    { if (!GLOBAL_DATA->lexer->skipRegExp()) YYABORT; ;}
     break;
 
   case 307:
-
-/* Line 1455 of yacc.c  */
-#line 1245 "../parser/Grammar.y"
-    { Lexer& l = *LEXER; if (!l.scanRegExp()) YYABORT; ;}
+#line 1254 "../parser/Grammar.y"
+    { if (!GLOBAL_DATA->lexer->skipRegExp()) YYABORT; ;}
     break;
 
   case 308:
-
-/* Line 1455 of yacc.c  */
-#line 1249 "../parser/Grammar.y"
+#line 1258 "../parser/Grammar.y"
     { ;}
     break;
 
   case 309:
-
-/* Line 1455 of yacc.c  */
-#line 1250 "../parser/Grammar.y"
+#line 1259 "../parser/Grammar.y"
     { ;}
     break;
 
   case 310:
-
-/* Line 1455 of yacc.c  */
-#line 1251 "../parser/Grammar.y"
+#line 1260 "../parser/Grammar.y"
     { ;}
     break;
 
   case 311:
-
-/* Line 1455 of yacc.c  */
-#line 1252 "../parser/Grammar.y"
+#line 1261 "../parser/Grammar.y"
     { if (*(yyvsp[(1) - (7)].ident) != "get" && *(yyvsp[(1) - (7)].ident) != "set") YYABORT; ;}
     break;
 
   case 312:
-
-/* Line 1455 of yacc.c  */
-#line 1253 "../parser/Grammar.y"
+#line 1262 "../parser/Grammar.y"
     { if (*(yyvsp[(1) - (8)].ident) != "get" && *(yyvsp[(1) - (8)].ident) != "set") YYABORT; ;}
     break;
 
   case 316:
-
-/* Line 1455 of yacc.c  */
-#line 1263 "../parser/Grammar.y"
+#line 1272 "../parser/Grammar.y"
     { ;}
     break;
 
   case 317:
-
-/* Line 1455 of yacc.c  */
-#line 1264 "../parser/Grammar.y"
+#line 1273 "../parser/Grammar.y"
     { ;}
     break;
 
   case 318:
-
-/* Line 1455 of yacc.c  */
-#line 1266 "../parser/Grammar.y"
+#line 1275 "../parser/Grammar.y"
     { ;}
     break;
 
   case 322:
-
-/* Line 1455 of yacc.c  */
-#line 1273 "../parser/Grammar.y"
+#line 1282 "../parser/Grammar.y"
     { ;}
     break;
 
   case 517:
-
-/* Line 1455 of yacc.c  */
-#line 1641 "../parser/Grammar.y"
+#line 1650 "../parser/Grammar.y"
     { ;}
     break;
 
   case 518:
-
-/* Line 1455 of yacc.c  */
-#line 1642 "../parser/Grammar.y"
+#line 1651 "../parser/Grammar.y"
     { ;}
     break;
 
   case 520:
-
-/* Line 1455 of yacc.c  */
-#line 1647 "../parser/Grammar.y"
+#line 1656 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 521:
-
-/* Line 1455 of yacc.c  */
-#line 1651 "../parser/Grammar.y"
+#line 1660 "../parser/Grammar.y"
     { ;}
     break;
 
   case 522:
-
-/* Line 1455 of yacc.c  */
-#line 1652 "../parser/Grammar.y"
+#line 1661 "../parser/Grammar.y"
     { ;}
     break;
 
   case 525:
-
-/* Line 1455 of yacc.c  */
-#line 1658 "../parser/Grammar.y"
+#line 1667 "../parser/Grammar.y"
     { ;}
     break;
 
   case 526:
-
-/* Line 1455 of yacc.c  */
-#line 1659 "../parser/Grammar.y"
+#line 1668 "../parser/Grammar.y"
     { ;}
     break;
 
   case 530:
-
-/* Line 1455 of yacc.c  */
-#line 1666 "../parser/Grammar.y"
+#line 1675 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 533:
-
-/* Line 1455 of yacc.c  */
-#line 1675 "../parser/Grammar.y"
+#line 1684 "../parser/Grammar.y"
     { ;}
     break;
 
   case 534:
-
-/* Line 1455 of yacc.c  */
-#line 1676 "../parser/Grammar.y"
+#line 1685 "../parser/Grammar.y"
     { ;}
     break;
 
   case 539:
-
-/* Line 1455 of yacc.c  */
-#line 1693 "../parser/Grammar.y"
+#line 1702 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 555:
-
-/* Line 1455 of yacc.c  */
-#line 1724 "../parser/Grammar.y"
+#line 1733 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 557:
-
-/* Line 1455 of yacc.c  */
-#line 1726 "../parser/Grammar.y"
+#line 1735 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 559:
-
-/* Line 1455 of yacc.c  */
-#line 1731 "../parser/Grammar.y"
+#line 1740 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 561:
-
-/* Line 1455 of yacc.c  */
-#line 1733 "../parser/Grammar.y"
+#line 1742 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 563:
-
-/* Line 1455 of yacc.c  */
-#line 1738 "../parser/Grammar.y"
+#line 1747 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 565:
-
-/* Line 1455 of yacc.c  */
-#line 1740 "../parser/Grammar.y"
+#line 1749 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 568:
-
-/* Line 1455 of yacc.c  */
-#line 1752 "../parser/Grammar.y"
+#line 1761 "../parser/Grammar.y"
     { ;}
     break;
 
   case 569:
-
-/* Line 1455 of yacc.c  */
-#line 1753 "../parser/Grammar.y"
+#line 1762 "../parser/Grammar.y"
     { ;}
     break;
 
   case 578:
-
-/* Line 1455 of yacc.c  */
-#line 1777 "../parser/Grammar.y"
+#line 1786 "../parser/Grammar.y"
     { ;}
     break;
 
   case 580:
-
-/* Line 1455 of yacc.c  */
-#line 1782 "../parser/Grammar.y"
+#line 1791 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 585:
-
-/* Line 1455 of yacc.c  */
-#line 1793 "../parser/Grammar.y"
+#line 1802 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 592:
-
-/* Line 1455 of yacc.c  */
-#line 1809 "../parser/Grammar.y"
+#line 1818 "../parser/Grammar.y"
     { ;}
     break;
 
 
-
-/* Line 1455 of yacc.c  */
-#line 5109 "JavaScriptCore/tmp/../generated/Grammar.tab.c"
+/* Line 1267 of yacc.c.  */
+#line 4634 "JavaScriptCore/tmp/../generated/Grammar.tab.c"
       default: break;
     }
   YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
@@ -5181,7 +4706,7 @@ yyerrlab:
 
   if (yyerrstatus == 3)
     {
-      /* If just tried and failed to reuse lookahead token after an
+      /* If just tried and failed to reuse look-ahead token after an
 	 error, discard it.  */
 
       if (yychar <= YYEOF)
@@ -5198,7 +4723,7 @@ yyerrlab:
 	}
     }
 
-  /* Else will try to reuse lookahead token after shifting the error
+  /* Else will try to reuse look-ahead token after shifting the error
      token.  */
   goto yyerrlab1;
 
@@ -5256,11 +4781,14 @@ yyerrlab1:
       YY_STACK_PRINT (yyss, yyssp);
     }
 
+  if (yyn == YYFINAL)
+    YYACCEPT;
+
   *++yyvsp = yylval;
 
   yyerror_range[1] = yylloc;
   /* Using YYLLOC is tempting, but would change the location of
-     the lookahead.  YYLOC is available though.  */
+     the look-ahead.  YYLOC is available though.  */
   YYLLOC_DEFAULT (yyloc, (yyerror_range - 1), 2);
   *++yylsp = yyloc;
 
@@ -5285,7 +4813,7 @@ yyabortlab:
   yyresult = 1;
   goto yyreturn;
 
-#if !defined(yyoverflow) || YYERROR_VERBOSE
+#ifndef yyoverflow
 /*-------------------------------------------------.
 | yyexhaustedlab -- memory exhaustion comes here.  |
 `-------------------------------------------------*/
@@ -5296,7 +4824,7 @@ yyexhaustedlab:
 #endif
 
 yyreturn:
-  if (yychar != YYEMPTY)
+  if (yychar != YYEOF && yychar != YYEMPTY)
      yydestruct ("Cleanup: discarding lookahead",
 		 yytoken, &yylval, &yylloc);
   /* Do not reclaim the symbols of the rule which action triggered
@@ -5322,31 +4850,31 @@ yyreturn:
 }
 
 
+#line 1834 "../parser/Grammar.y"
 
-/* Line 1675 of yacc.c  */
-#line 1825 "../parser/Grammar.y"
 
+#undef GLOBAL_DATA
 
-static ExpressionNode* makeAssignNode(void* globalPtr, ExpressionNode* loc, Operator op, ExpressionNode* expr, bool locHasAssignments, bool exprHasAssignments, int start, int divot, int end)
+static ExpressionNode* makeAssignNode(JSGlobalData* globalData, ExpressionNode* loc, Operator op, ExpressionNode* expr, bool locHasAssignments, bool exprHasAssignments, int start, int divot, int end)
 {
     if (!loc->isLocation())
-        return new (GLOBAL_DATA) AssignErrorNode(GLOBAL_DATA, loc, op, expr, divot, divot - start, end - divot);
+        return new (globalData) AssignErrorNode(globalData, loc, op, expr, divot, divot - start, end - divot);
 
     if (loc->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(loc);
         if (op == OpEqual) {
-            AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, resolve->identifier(), expr, exprHasAssignments);
-            SET_EXCEPTION_LOCATION(node, start, divot, end);
+            AssignResolveNode* node = new (globalData) AssignResolveNode(globalData, resolve->identifier(), expr, exprHasAssignments);
+            setExceptionLocation(node, start, divot, end);
             return node;
         } else
-            return new (GLOBAL_DATA) ReadModifyResolveNode(GLOBAL_DATA, resolve->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
+            return new (globalData) ReadModifyResolveNode(globalData, resolve->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
     }
     if (loc->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(loc);
         if (op == OpEqual)
-            return new (GLOBAL_DATA) AssignBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), expr, locHasAssignments, exprHasAssignments, bracket->divot(), bracket->divot() - start, end - bracket->divot());
+            return new (globalData) AssignBracketNode(globalData, bracket->base(), bracket->subscript(), expr, locHasAssignments, exprHasAssignments, bracket->divot(), bracket->divot() - start, end - bracket->divot());
         else {
-            ReadModifyBracketNode* node = new (GLOBAL_DATA) ReadModifyBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, expr, locHasAssignments, exprHasAssignments, divot, divot - start, end - divot);
+            ReadModifyBracketNode* node = new (globalData) ReadModifyBracketNode(globalData, bracket->base(), bracket->subscript(), op, expr, locHasAssignments, exprHasAssignments, divot, divot - start, end - divot);
             node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
             return node;
         }
@@ -5354,117 +4882,117 @@ static ExpressionNode* makeAssignNode(void* globalPtr, ExpressionNode* loc, Oper
     ASSERT(loc->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(loc);
     if (op == OpEqual)
-        return new (GLOBAL_DATA) AssignDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), expr, exprHasAssignments, dot->divot(), dot->divot() - start, end - dot->divot());
+        return new (globalData) AssignDotNode(globalData, dot->base(), dot->identifier(), expr, exprHasAssignments, dot->divot(), dot->divot() - start, end - dot->divot());
 
-    ReadModifyDotNode* node = new (GLOBAL_DATA) ReadModifyDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
+    ReadModifyDotNode* node = new (globalData) ReadModifyDotNode(globalData, dot->base(), dot->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return node;
 }
 
-static ExpressionNode* makePrefixNode(void* globalPtr, ExpressionNode* expr, Operator op, int start, int divot, int end)
+static ExpressionNode* makePrefixNode(JSGlobalData* globalData, ExpressionNode* expr, Operator op, int start, int divot, int end)
 {
     if (!expr->isLocation())
-        return new (GLOBAL_DATA) PrefixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
+        return new (globalData) PrefixErrorNode(globalData, expr, op, divot, divot - start, end - divot);
     
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (GLOBAL_DATA) PrefixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
+        return new (globalData) PrefixResolveNode(globalData, resolve->identifier(), op, divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PrefixBracketNode* node = new (GLOBAL_DATA) PrefixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
+        PrefixBracketNode* node = new (globalData) PrefixBracketNode(globalData, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->startOffset());
         return node;
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PrefixDotNode* node = new (GLOBAL_DATA) PrefixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
+    PrefixDotNode* node = new (globalData) PrefixDotNode(globalData, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->startOffset());
     return node;
 }
 
-static ExpressionNode* makePostfixNode(void* globalPtr, ExpressionNode* expr, Operator op, int start, int divot, int end)
+static ExpressionNode* makePostfixNode(JSGlobalData* globalData, ExpressionNode* expr, Operator op, int start, int divot, int end)
 { 
     if (!expr->isLocation())
-        return new (GLOBAL_DATA) PostfixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
+        return new (globalData) PostfixErrorNode(globalData, expr, op, divot, divot - start, end - divot);
     
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (GLOBAL_DATA) PostfixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
+        return new (globalData) PostfixResolveNode(globalData, resolve->identifier(), op, divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PostfixBracketNode* node = new (GLOBAL_DATA) PostfixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
+        PostfixBracketNode* node = new (globalData) PostfixBracketNode(globalData, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
         return node;
         
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PostfixDotNode* node = new (GLOBAL_DATA) PostfixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
+    PostfixDotNode* node = new (globalData) PostfixDotNode(globalData, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return node;
 }
 
-static ExpressionNodeInfo makeFunctionCallNode(void* globalPtr, ExpressionNodeInfo func, ArgumentsNodeInfo args, int start, int divot, int end)
+static ExpressionNodeInfo makeFunctionCallNode(JSGlobalData* globalData, ExpressionNodeInfo func, ArgumentsNodeInfo args, int start, int divot, int end)
 {
     CodeFeatures features = func.m_features | args.m_features;
     int numConstants = func.m_numConstants + args.m_numConstants;
     if (!func.m_node->isLocation())
-        return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) FunctionCallValueNode(GLOBAL_DATA, func.m_node, args.m_node, divot, divot - start, end - divot), features, numConstants);
+        return createNodeInfo<ExpressionNode*>(new (globalData) FunctionCallValueNode(globalData, func.m_node, args.m_node, divot, divot - start, end - divot), features, numConstants);
     if (func.m_node->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(func.m_node);
         const Identifier& identifier = resolve->identifier();
-        if (identifier == GLOBAL_DATA->propertyNames->eval)
-            return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EvalFunctionCallNode(GLOBAL_DATA, args.m_node, divot, divot - start, end - divot), EvalFeature | features, numConstants);
-        return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) FunctionCallResolveNode(GLOBAL_DATA, identifier, args.m_node, divot, divot - start, end - divot), features, numConstants);
+        if (identifier == globalData->propertyNames->eval)
+            return createNodeInfo<ExpressionNode*>(new (globalData) EvalFunctionCallNode(globalData, args.m_node, divot, divot - start, end - divot), EvalFeature | features, numConstants);
+        return createNodeInfo<ExpressionNode*>(new (globalData) FunctionCallResolveNode(globalData, identifier, args.m_node, divot, divot - start, end - divot), features, numConstants);
     }
     if (func.m_node->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(func.m_node);
-        FunctionCallBracketNode* node = new (GLOBAL_DATA) FunctionCallBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), args.m_node, divot, divot - start, end - divot);
+        FunctionCallBracketNode* node = new (globalData) FunctionCallBracketNode(globalData, bracket->base(), bracket->subscript(), args.m_node, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
         return createNodeInfo<ExpressionNode*>(node, features, numConstants);
     }
     ASSERT(func.m_node->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(func.m_node);
     FunctionCallDotNode* node;
-    if (dot->identifier() == GLOBAL_DATA->propertyNames->call)
-        node = new (GLOBAL_DATA) CallFunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
-    else if (dot->identifier() == GLOBAL_DATA->propertyNames->apply)
-        node = new (GLOBAL_DATA) ApplyFunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+    if (dot->identifier() == globalData->propertyNames->call)
+        node = new (globalData) CallFunctionCallDotNode(globalData, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+    else if (dot->identifier() == globalData->propertyNames->apply)
+        node = new (globalData) ApplyFunctionCallDotNode(globalData, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
     else
-        node = new (GLOBAL_DATA) FunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+        node = new (globalData) FunctionCallDotNode(globalData, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return createNodeInfo<ExpressionNode*>(node, features, numConstants);
 }
 
-static ExpressionNode* makeTypeOfNode(void* globalPtr, ExpressionNode* expr)
+static ExpressionNode* makeTypeOfNode(JSGlobalData* globalData, ExpressionNode* expr)
 {
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (GLOBAL_DATA) TypeOfResolveNode(GLOBAL_DATA, resolve->identifier());
+        return new (globalData) TypeOfResolveNode(globalData, resolve->identifier());
     }
-    return new (GLOBAL_DATA) TypeOfValueNode(GLOBAL_DATA, expr);
+    return new (globalData) TypeOfValueNode(globalData, expr);
 }
 
-static ExpressionNode* makeDeleteNode(void* globalPtr, ExpressionNode* expr, int start, int divot, int end)
+static ExpressionNode* makeDeleteNode(JSGlobalData* globalData, ExpressionNode* expr, int start, int divot, int end)
 {
     if (!expr->isLocation())
-        return new (GLOBAL_DATA) DeleteValueNode(GLOBAL_DATA, expr);
+        return new (globalData) DeleteValueNode(globalData, expr);
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (GLOBAL_DATA) DeleteResolveNode(GLOBAL_DATA, resolve->identifier(), divot, divot - start, end - divot);
+        return new (globalData) DeleteResolveNode(globalData, resolve->identifier(), divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        return new (GLOBAL_DATA) DeleteBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), divot, divot - start, end - divot);
+        return new (globalData) DeleteBracketNode(globalData, bracket->base(), bracket->subscript(), divot, divot - start, end - divot);
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    return new (GLOBAL_DATA) DeleteDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), divot, divot - start, end - divot);
+    return new (globalData) DeleteDotNode(globalData, dot->base(), dot->identifier(), divot, divot - start, end - divot);
 }
 
-static PropertyNode* makeGetterOrSetterPropertyNode(void* globalPtr, const Identifier& getOrSet, const Identifier& name, ParameterNode* params, FunctionBodyNode* body, const SourceCode& source)
+static PropertyNode* makeGetterOrSetterPropertyNode(JSGlobalData* globalData, const Identifier& getOrSet, const Identifier& name, ParameterNode* params, FunctionBodyNode* body, const SourceCode& source)
 {
     PropertyNode::Type type;
     if (getOrSet == "get")
@@ -5473,10 +5001,10 @@ static PropertyNode* makeGetterOrSetterPropertyNode(void* globalPtr, const Ident
         type = PropertyNode::Setter;
     else
         return 0;
-    return new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, name, new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, body, source, params), type);
+    return new (globalData) PropertyNode(globalData, name, new (globalData) FuncExprNode(globalData, globalData->propertyNames->nullIdentifier, body, source, params), type);
 }
 
-static ExpressionNode* makeNegateNode(void* globalPtr, ExpressionNode* n)
+static ExpressionNode* makeNegateNode(JSGlobalData* globalData, ExpressionNode* n)
 {
     if (n->isNumber()) {
         NumberNode* number = static_cast<NumberNode*>(n);
@@ -5487,92 +5015,92 @@ static ExpressionNode* makeNegateNode(void* globalPtr, ExpressionNode* n)
         }
     }
 
-    return new (GLOBAL_DATA) NegateNode(GLOBAL_DATA, n);
+    return new (globalData) NegateNode(globalData, n);
 }
 
-static NumberNode* makeNumberNode(void* globalPtr, double d)
+static NumberNode* makeNumberNode(JSGlobalData* globalData, double d)
 {
-    return new (GLOBAL_DATA) NumberNode(GLOBAL_DATA, d);
+    return new (globalData) NumberNode(globalData, d);
 }
 
-static ExpressionNode* makeBitwiseNotNode(void* globalPtr, ExpressionNode* expr)
+static ExpressionNode* makeBitwiseNotNode(JSGlobalData* globalData, ExpressionNode* expr)
 {
     if (expr->isNumber())
-        return makeNumberNode(globalPtr, ~toInt32(static_cast<NumberNode*>(expr)->value()));
-    return new (GLOBAL_DATA) BitwiseNotNode(GLOBAL_DATA, expr);
+        return makeNumberNode(globalData, ~toInt32(static_cast<NumberNode*>(expr)->value()));
+    return new (globalData) BitwiseNotNode(globalData, expr);
 }
 
-static ExpressionNode* makeMultNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+static ExpressionNode* makeMultNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     expr1 = expr1->stripUnaryPlus();
     expr2 = expr2->stripUnaryPlus();
 
     if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() * static_cast<NumberNode*>(expr2)->value());
+        return makeNumberNode(globalData, static_cast<NumberNode*>(expr1)->value() * static_cast<NumberNode*>(expr2)->value());
 
     if (expr1->isNumber() && static_cast<NumberNode*>(expr1)->value() == 1)
-        return new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, expr2);
+        return new (globalData) UnaryPlusNode(globalData, expr2);
 
     if (expr2->isNumber() && static_cast<NumberNode*>(expr2)->value() == 1)
-        return new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, expr1);
+        return new (globalData) UnaryPlusNode(globalData, expr1);
 
-    return new (GLOBAL_DATA) MultNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (globalData) MultNode(globalData, expr1, expr2, rightHasAssignments);
 }
 
-static ExpressionNode* makeDivNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+static ExpressionNode* makeDivNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     expr1 = expr1->stripUnaryPlus();
     expr2 = expr2->stripUnaryPlus();
 
     if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() / static_cast<NumberNode*>(expr2)->value());
-    return new (GLOBAL_DATA) DivNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+        return makeNumberNode(globalData, static_cast<NumberNode*>(expr1)->value() / static_cast<NumberNode*>(expr2)->value());
+    return new (globalData) DivNode(globalData, expr1, expr2, rightHasAssignments);
 }
 
-static ExpressionNode* makeAddNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+static ExpressionNode* makeAddNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() + static_cast<NumberNode*>(expr2)->value());
-    return new (GLOBAL_DATA) AddNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+        return makeNumberNode(globalData, static_cast<NumberNode*>(expr1)->value() + static_cast<NumberNode*>(expr2)->value());
+    return new (globalData) AddNode(globalData, expr1, expr2, rightHasAssignments);
 }
 
-static ExpressionNode* makeSubNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+static ExpressionNode* makeSubNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     expr1 = expr1->stripUnaryPlus();
     expr2 = expr2->stripUnaryPlus();
 
     if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() - static_cast<NumberNode*>(expr2)->value());
-    return new (GLOBAL_DATA) SubNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+        return makeNumberNode(globalData, static_cast<NumberNode*>(expr1)->value() - static_cast<NumberNode*>(expr2)->value());
+    return new (globalData) SubNode(globalData, expr1, expr2, rightHasAssignments);
 }
 
-static ExpressionNode* makeLeftShiftNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+static ExpressionNode* makeLeftShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalPtr, toInt32(static_cast<NumberNode*>(expr1)->value()) << (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new (GLOBAL_DATA) LeftShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+        return makeNumberNode(globalData, toInt32(static_cast<NumberNode*>(expr1)->value()) << (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
+    return new (globalData) LeftShiftNode(globalData, expr1, expr2, rightHasAssignments);
 }
 
-static ExpressionNode* makeRightShiftNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+static ExpressionNode* makeRightShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalPtr, toInt32(static_cast<NumberNode*>(expr1)->value()) >> (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new (GLOBAL_DATA) RightShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+        return makeNumberNode(globalData, toInt32(static_cast<NumberNode*>(expr1)->value()) >> (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
+    return new (globalData) RightShiftNode(globalData, expr1, expr2, rightHasAssignments);
 }
 
-/* called by yyparse on error */
-int yyerror(const char *)
+// Called by yyparse on error.
+int yyerror(const char*)
 {
     return 1;
 }
 
-/* may we automatically insert a semicolon ? */
+// May we automatically insert a semicolon?
 static bool allowAutomaticSemicolon(Lexer& lexer, int yychar)
 {
     return yychar == CLOSEBRACE || yychar == 0 || lexer.prevTerminator();
 }
 
-static ExpressionNode* combineCommaNodes(void* globalPtr, ExpressionNode* list, ExpressionNode* init)
+static ExpressionNode* combineCommaNodes(JSGlobalData* globalData, ExpressionNode* list, ExpressionNode* init)
 {
     if (!list)
         return init;
@@ -5580,18 +5108,16 @@ static ExpressionNode* combineCommaNodes(void* globalPtr, ExpressionNode* list,
         static_cast<CommaNode*>(list)->append(init);
         return list;
     }
-    return new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, list, init);
+    return new (globalData) CommaNode(globalData, list, init);
 }
 
 // We turn variable declarations into either assignments or empty
 // statements (which later get stripped out), because the actual
 // declaration work is hoisted up to the start of the function body
-static StatementNode* makeVarStatementNode(void* globalPtr, ExpressionNode* expr)
+static StatementNode* makeVarStatementNode(JSGlobalData* globalData, ExpressionNode* expr)
 {
     if (!expr)
-        return new (GLOBAL_DATA) EmptyStatementNode(GLOBAL_DATA);
-    return new (GLOBAL_DATA) VarStatementNode(GLOBAL_DATA, expr);
+        return new (globalData) EmptyStatementNode(globalData);
+    return new (globalData) VarStatementNode(globalData, expr);
 }
 
-#undef GLOBAL_DATA
-
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.h b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.h
index 847624f..1fdb035 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.h
@@ -1,23 +1,24 @@
-
-/* A Bison parser, made by GNU Bison 2.4.1.  */
+/* A Bison parser, made by GNU Bison 2.3.  */
 
 /* Skeleton interface for Bison's Yacc-like parsers in C
-   
-      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
+
+   Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
    Free Software Foundation, Inc.
-   
-   This program is free software: you can redistribute it and/or modify
+
+   This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation, either version 3 of the License, or
-   (at your option) any later version.
-   
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
-   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin Street, Fifth Floor,
+   Boston, MA 02110-1301, USA.  */
 
 /* As a special exception, you may create a larger work that contains
    part or all of the Bison parser skeleton and distribute that work
@@ -28,11 +29,10 @@
    special exception, which will cause the skeleton and the resulting
    Bison output files to be licensed under the GNU General Public
    License without this special exception.
-   
+
    This special exception was added by the Free Software Foundation in
    version 2.2 of Bison.  */
 
-
 /* Tokens.  */
 #ifndef YYTOKENTYPE
 # define YYTOKENTYPE
@@ -104,19 +104,81 @@
      AUTOMINUSMINUS = 320
    };
 #endif
+/* Tokens.  */
+#define NULLTOKEN 258
+#define TRUETOKEN 259
+#define FALSETOKEN 260
+#define BREAK 261
+#define CASE 262
+#define DEFAULT 263
+#define FOR 264
+#define NEW 265
+#define VAR 266
+#define CONSTTOKEN 267
+#define CONTINUE 268
+#define FUNCTION 269
+#define RETURN 270
+#define VOIDTOKEN 271
+#define DELETETOKEN 272
+#define IF 273
+#define THISTOKEN 274
+#define DO 275
+#define WHILE 276
+#define INTOKEN 277
+#define INSTANCEOF 278
+#define TYPEOF 279
+#define SWITCH 280
+#define WITH 281
+#define RESERVED 282
+#define THROW 283
+#define TRY 284
+#define CATCH 285
+#define FINALLY 286
+#define DEBUGGER 287
+#define IF_WITHOUT_ELSE 288
+#define ELSE 289
+#define EQEQ 290
+#define NE 291
+#define STREQ 292
+#define STRNEQ 293
+#define LE 294
+#define GE 295
+#define OR 296
+#define AND 297
+#define PLUSPLUS 298
+#define MINUSMINUS 299
+#define LSHIFT 300
+#define RSHIFT 301
+#define URSHIFT 302
+#define PLUSEQUAL 303
+#define MINUSEQUAL 304
+#define MULTEQUAL 305
+#define DIVEQUAL 306
+#define LSHIFTEQUAL 307
+#define RSHIFTEQUAL 308
+#define URSHIFTEQUAL 309
+#define ANDEQUAL 310
+#define MODEQUAL 311
+#define XOREQUAL 312
+#define OREQUAL 313
+#define OPENBRACE 314
+#define CLOSEBRACE 315
+#define NUMBER 316
+#define IDENT 317
+#define STRING 318
+#define AUTOPLUSPLUS 319
+#define AUTOMINUSMINUS 320
+
 
 
 
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
+#line 146 "../parser/Grammar.y"
 {
-
-/* Line 1676 of yacc.c  */
-#line 155 "../parser/Grammar.y"
-
     int                 intValue;
     double              doubleValue;
-    Identifier*         ident;
+    const Identifier*   ident;
 
     // expression subtrees
     ExpressionNodeInfo  expressionNode;
@@ -143,15 +205,13 @@ typedef union YYSTYPE
     ParameterListInfo   parameterList;
 
     Operator            op;
-
-
-
-/* Line 1676 of yacc.c  */
-#line 151 "JavaScriptCore/tmp/../generated/Grammar.tab.h"
-} YYSTYPE;
-# define YYSTYPE_IS_TRIVIAL 1
+}
+/* Line 1489 of yacc.c.  */
+#line 211 "JavaScriptCore/tmp/../generated/Grammar.tab.h"
+	YYSTYPE;
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
+# define YYSTYPE_IS_TRIVIAL 1
 #endif
 
 
@@ -170,4 +230,3 @@ typedef struct YYLTYPE
 #endif
 
 
-
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/CachedCall.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/CachedCall.h
index 767c262..b9fa484 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/CachedCall.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/CachedCall.h
@@ -40,7 +40,8 @@ namespace JSC {
             , m_exception(exception)
             , m_globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : function->scope().node()->globalObject())
         {
-            m_closure = m_interpreter->prepareForRepeatCall(function->body(), callFrame, function, argCount, function->scope().node(), exception);
+            ASSERT(!function->isHostFunction());
+            m_closure = m_interpreter->prepareForRepeatCall(function->jsExecutable(), callFrame, function, argCount, function->scope().node(), exception);
             m_valid = !*exception;
         }
         
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.h
index 75de082..92ec06e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.h
@@ -37,7 +37,7 @@ namespace JSC  {
     // Passed as the first argument to most functions.
     class ExecState : private Register {
     public:
-        JSObject* callee() const { return this[RegisterFile::Callee].object(); }
+        JSFunction* callee() const { return this[RegisterFile::Callee].function(); }
         CodeBlock* codeBlock() const { return this[RegisterFile::CodeBlock].Register::codeBlock(); }
         ScopeChainNode* scopeChain() const { return this[RegisterFile::ScopeChain].Register::scopeChain(); }
         int argumentCount() const { return this[RegisterFile::ArgumentCount].i(); }
@@ -105,12 +105,12 @@ namespace JSC  {
         Arguments* optionalCalleeArguments() const { return this[RegisterFile::OptionalCalleeArguments].arguments(); }
         Instruction* returnPC() const { return this[RegisterFile::ReturnPC].vPC(); }
 
-        void setCalleeArguments(Arguments* arguments) { this[RegisterFile::OptionalCalleeArguments] = arguments; }
+        void setCalleeArguments(JSValue arguments) { this[RegisterFile::OptionalCalleeArguments] = arguments; }
         void setCallerFrame(CallFrame* callerFrame) { this[RegisterFile::CallerFrame] = callerFrame; }
         void setScopeChain(ScopeChainNode* scopeChain) { this[RegisterFile::ScopeChain] = scopeChain; }
 
         ALWAYS_INLINE void init(CodeBlock* codeBlock, Instruction* vPC, ScopeChainNode* scopeChain,
-            CallFrame* callerFrame, int returnValueRegister, int argc, JSObject* callee)
+            CallFrame* callerFrame, int returnValueRegister, int argc, JSFunction* function)
         {
             ASSERT(callerFrame); // Use noCaller() rather than 0 for the outer host call frame caller.
 
@@ -118,10 +118,10 @@ namespace JSC  {
             setScopeChain(scopeChain);
             setCallerFrame(callerFrame);
             this[RegisterFile::ReturnPC] = vPC; // This is either an Instruction* or a pointer into JIT generated code stored as an Instruction*.
-            this[RegisterFile::ReturnValueRegister] = returnValueRegister;
+            this[RegisterFile::ReturnValueRegister] = Register::withInt(returnValueRegister);
             setArgumentCount(argc); // original argument count (for the sake of the "arguments" object)
-            setCallee(callee);
-            setCalleeArguments(0);
+            setCallee(function);
+            setCalleeArguments(JSValue());
         }
 
         // Read a register from the codeframe (or constant from the CodeBlock).
@@ -135,8 +135,8 @@ namespace JSC  {
         CallFrame* removeHostCallFrameFlag() { return reinterpret_cast<CallFrame*>(reinterpret_cast<intptr_t>(this) & ~HostCallFrameFlag); }
 
     private:
-        void setArgumentCount(int count) { this[RegisterFile::ArgumentCount] = count; }
-        void setCallee(JSObject* callee) { this[RegisterFile::Callee] = callee; }
+        void setArgumentCount(int count) { this[RegisterFile::ArgumentCount] = Register::withInt(count); }
+        void setCallee(JSFunction* callee) { this[RegisterFile::Callee] = callee; }
         void setCodeBlock(CodeBlock* codeBlock) { this[RegisterFile::CodeBlock] = codeBlock; }
 
         static const intptr_t HostCallFrameFlag = 1;
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrameClosure.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrameClosure.h
index 0e14ced..a301060 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrameClosure.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrameClosure.h
@@ -32,7 +32,7 @@ struct CallFrameClosure {
     CallFrame* oldCallFrame;
     CallFrame* newCallFrame;
     JSFunction* function;
-    FunctionBodyNode* functionBody;
+    FunctionExecutable* functionExecutable;
     JSGlobalData* globalData;
     Register* oldEnd;
     ScopeChainNode* scopeChain;
@@ -49,7 +49,7 @@ struct CallFrameClosure {
     void resetCallFrame()
     {
         newCallFrame->setScopeChain(scopeChain);
-        newCallFrame->setCalleeArguments(0);
+        newCallFrame->setCalleeArguments(JSValue());
         for (int i = providedParams; i < expectedParams; ++i)
             newCallFrame[i - RegisterFile::CallFrameHeaderSize - expectedParams] = jsUndefined();
     }
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
index c538eb1..4560db0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
@@ -58,6 +58,7 @@
 #include "RegExpPrototype.h"
 #include "Register.h"
 #include "SamplingTool.h"
+#include <limits.h>
 #include <stdio.h>
 #include <wtf/Threading.h>
 
@@ -65,14 +66,6 @@
 #include "JIT.h"
 #endif
 
-#if ENABLE(ASSEMBLER)
-#include "AssemblerBuffer.h"
-#endif
-
-#ifdef QT_BUILD_SCRIPT_LIB
-#include "bridge/qscriptobject_p.h"
-#endif
-
 using namespace std;
 
 namespace JSC {
@@ -357,15 +350,14 @@ NEVER_INLINE JSValue Interpreter::callEval(CallFrame* callFrame, RegisterFile* r
     LiteralParser preparser(callFrame, programSource, LiteralParser::NonStrictJSON);
     if (JSValue parsedObject = preparser.tryLiteralParse())
         return parsedObject;
-    
-    
+
     ScopeChainNode* scopeChain = callFrame->scopeChain();
     CodeBlock* codeBlock = callFrame->codeBlock();
-    RefPtr<EvalNode> evalNode = codeBlock->evalCodeCache().get(callFrame, programSource, scopeChain, exceptionValue);
+    RefPtr<EvalExecutable> eval = codeBlock->evalCodeCache().get(callFrame, programSource, scopeChain, exceptionValue);
 
     JSValue result = jsUndefined();
-    if (evalNode)
-        result = callFrame->globalData().interpreter->execute(evalNode.get(), callFrame, callFrame->thisValue().toThisObject(callFrame), callFrame->registers() - registerFile->start() + registerOffset, scopeChain, &exceptionValue);
+    if (eval)
+        result = callFrame->globalData().interpreter->execute(eval.get(), callFrame, callFrame->thisValue().toThisObject(callFrame), callFrame->registers() - registerFile->start() + registerOffset, scopeChain, &exceptionValue);
 
     return result;
 }
@@ -388,67 +380,92 @@ void Interpreter::dumpCallFrame(CallFrame* callFrame)
 void Interpreter::dumpRegisters(CallFrame* callFrame)
 {
     printf("Register frame: \n\n");
-    printf("----------------------------------------------------\n");
-    printf("            use            |   address  |   value   \n");
-    printf("----------------------------------------------------\n");
+    printf("-----------------------------------------------------------------------------\n");
+    printf("            use            |   address  |                value               \n");
+    printf("-----------------------------------------------------------------------------\n");
 
     CodeBlock* codeBlock = callFrame->codeBlock();
     RegisterFile* registerFile = &callFrame->scopeChain()->globalObject()->globalData()->interpreter->registerFile();
     const Register* it;
     const Register* end;
+    JSValue v;
 
     if (codeBlock->codeType() == GlobalCode) {
         it = registerFile->lastGlobal();
         end = it + registerFile->numGlobals();
         while (it != end) {
-            printf("[global var]               | %10p | %10p \n", it, (*it).v());
+            v = (*it).jsValue();
+#if USE(JSVALUE32_64)
+            printf("[global var]               | %10p | %-16s 0x%llx \n", it, v.description(), JSValue::encode(v));
+#else
+            printf("[global var]               | %10p | %-16s %p \n", it, v.description(), JSValue::encode(v));
+#endif
             ++it;
         }
-        printf("----------------------------------------------------\n");
+        printf("-----------------------------------------------------------------------------\n");
     }
     
     it = callFrame->registers() - RegisterFile::CallFrameHeaderSize - codeBlock->m_numParameters;
-    printf("[this]                     | %10p | %10p \n", it, (*it).v()); ++it;
+    v = (*it).jsValue();
+#if USE(JSVALUE32_64)
+    printf("[this]                     | %10p | %-16s 0x%llx \n", it, v.description(), JSValue::encode(v)); ++it;
+#else
+    printf("[this]                     | %10p | %-16s %p \n", it, v.description(), JSValue::encode(v)); ++it;
+#endif
     end = it + max(codeBlock->m_numParameters - 1, 0); // - 1 to skip "this"
     if (it != end) {
         do {
-            printf("[param]                    | %10p | %10p \n", it, (*it).v());
+            v = (*it).jsValue();
+#if USE(JSVALUE32_64)
+            printf("[param]                    | %10p | %-16s 0x%llx \n", it, v.description(), JSValue::encode(v));
+#else
+            printf("[param]                    | %10p | %-16s %p \n", it, v.description(), JSValue::encode(v));
+#endif
             ++it;
         } while (it != end);
     }
-    printf("----------------------------------------------------\n");
-
-    printf("[CodeBlock]                | %10p | %10p \n", it, (*it).v()); ++it;
-    printf("[ScopeChain]               | %10p | %10p \n", it, (*it).v()); ++it;
-    printf("[CallerRegisters]          | %10p | %10p \n", it, (*it).v()); ++it;
-    printf("[ReturnPC]                 | %10p | %10p \n", it, (*it).v()); ++it;
-    printf("[ReturnValueRegister]      | %10p | %10p \n", it, (*it).v()); ++it;
-    printf("[ArgumentCount]            | %10p | %10p \n", it, (*it).v()); ++it;
-    printf("[Callee]                   | %10p | %10p \n", it, (*it).v()); ++it;
-    printf("[OptionalCalleeArguments]  | %10p | %10p \n", it, (*it).v()); ++it;
-    printf("----------------------------------------------------\n");
+    printf("-----------------------------------------------------------------------------\n");
+    printf("[CodeBlock]                | %10p | %p \n", it, (*it).codeBlock()); ++it;
+    printf("[ScopeChain]               | %10p | %p \n", it, (*it).scopeChain()); ++it;
+    printf("[CallerRegisters]          | %10p | %d \n", it, (*it).i()); ++it;
+    printf("[ReturnPC]                 | %10p | %p \n", it, (*it).vPC()); ++it;
+    printf("[ReturnValueRegister]      | %10p | %d \n", it, (*it).i()); ++it;
+    printf("[ArgumentCount]            | %10p | %d \n", it, (*it).i()); ++it;
+    printf("[Callee]                   | %10p | %p \n", it, (*it).function()); ++it;
+    printf("[OptionalCalleeArguments]  | %10p | %p \n", it, (*it).arguments()); ++it;
+    printf("-----------------------------------------------------------------------------\n");
 
     int registerCount = 0;
 
     end = it + codeBlock->m_numVars;
     if (it != end) {
         do {
-            printf("[r%2d]                      | %10p | %10p \n", registerCount, it, (*it).v());
+            v = (*it).jsValue();
+#if USE(JSVALUE32_64)
+            printf("[r%2d]                      | %10p | %-16s 0x%llx \n", registerCount, it, v.description(), JSValue::encode(v));
+#else
+            printf("[r%2d]                      | %10p | %-16s %p \n", registerCount, it, v.description(), JSValue::encode(v));
+#endif
             ++it;
             ++registerCount;
         } while (it != end);
     }
-    printf("----------------------------------------------------\n");
+    printf("-----------------------------------------------------------------------------\n");
 
     end = it + codeBlock->m_numCalleeRegisters - codeBlock->m_numVars;
     if (it != end) {
         do {
-            printf("[r%2d]                      | %10p | %10p \n", registerCount, it, (*it).v());
+            v = (*it).jsValue();
+#if USE(JSVALUE32_64)
+            printf("[r%2d]                      | %10p | %-16s 0x%llx \n", registerCount, it, v.description(), JSValue::encode(v));
+#else
+            printf("[r%2d]                      | %10p | %-16s %p \n", registerCount, it, v.description(), JSValue::encode(v));
+#endif
             ++it;
             ++registerCount;
         } while (it != end);
     }
-    printf("----------------------------------------------------\n");
+    printf("-----------------------------------------------------------------------------\n");
 }
 
 #endif
@@ -471,25 +488,22 @@ NEVER_INLINE bool Interpreter::unwindCallFrame(CallFrame*& callFrame, JSValue ex
 
     if (Debugger* debugger = callFrame->dynamicGlobalObject()->debugger()) {
         DebuggerCallFrame debuggerCallFrame(callFrame, exceptionValue);
-        if (callFrame->callee()) {
-            debugger->returnEvent(debuggerCallFrame, codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->lastLine());
-#ifdef QT_BUILD_SCRIPT_LIB
-            debugger->functionExit(exceptionValue, codeBlock->ownerNode()->sourceID());
-#endif
-        } else
-            debugger->didExecuteProgram(debuggerCallFrame, codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->lastLine());
+        if (callFrame->callee())
+            debugger->returnEvent(debuggerCallFrame, codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->lastLine());
+        else
+            debugger->didExecuteProgram(debuggerCallFrame, codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->lastLine());
     }
 
     if (Profiler* profiler = *Profiler::enabledProfilerReference()) {
         if (callFrame->callee())
             profiler->didExecute(callFrame, callFrame->callee());
         else
-            profiler->didExecute(callFrame, codeBlock->ownerNode()->sourceURL(), codeBlock->ownerNode()->lineNo());
+            profiler->didExecute(callFrame, codeBlock->ownerExecutable()->sourceURL(), codeBlock->ownerExecutable()->lineNo());
     }
 
     // If this call frame created an activation or an 'arguments' object, tear it off.
     if (oldCodeBlock->codeType() == FunctionCode && oldCodeBlock->needsFullScopeChain()) {
-        while (!scopeChain->object->isObject(&JSActivation::info))
+        while (!scopeChain->object->inherits(&JSActivation::info))
             scopeChain = scopeChain->pop();
         static_cast<JSActivation*>(scopeChain->object)->copyRegisters(callFrame->optionalCalleeArguments());
     } else if (Arguments* arguments = callFrame->optionalCalleeArguments()) {
@@ -521,9 +535,9 @@ NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSV
             exception = createNotAnObjectError(callFrame, static_cast<JSNotAnObjectErrorStub*>(exception), bytecodeOffset, codeBlock);
             exceptionValue = exception;
         } else {
-            if (!exception->hasProperty(callFrame, Identifier(callFrame, JSC_ERROR_LINENUMBER_PROPERTYNAME)) && 
+            if (!exception->hasProperty(callFrame, Identifier(callFrame, "line")) && 
                 !exception->hasProperty(callFrame, Identifier(callFrame, "sourceId")) && 
-                !exception->hasProperty(callFrame, Identifier(callFrame, JSC_ERROR_FILENAME_PROPERTYNAME)) && 
+                !exception->hasProperty(callFrame, Identifier(callFrame, "sourceURL")) && 
                 !exception->hasProperty(callFrame, Identifier(callFrame, expressionBeginOffsetPropertyName)) && 
                 !exception->hasProperty(callFrame, Identifier(callFrame, expressionCaretOffsetPropertyName)) && 
                 !exception->hasProperty(callFrame, Identifier(callFrame, expressionEndOffsetPropertyName))) {
@@ -532,16 +546,16 @@ NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSV
                     int endOffset = 0;
                     int divotPoint = 0;
                     int line = codeBlock->expressionRangeForBytecodeOffset(callFrame, bytecodeOffset, divotPoint, startOffset, endOffset);
-                    exception->putWithAttributes(callFrame, Identifier(callFrame, JSC_ERROR_LINENUMBER_PROPERTYNAME), jsNumber(callFrame, line), ReadOnly | DontDelete);
+                    exception->putWithAttributes(callFrame, Identifier(callFrame, "line"), jsNumber(callFrame, line), ReadOnly | DontDelete);
                     
                     // We only hit this path for error messages and throw statements, which don't have a specific failure position
                     // So we just give the full range of the error/throw statement.
                     exception->putWithAttributes(callFrame, Identifier(callFrame, expressionBeginOffsetPropertyName), jsNumber(callFrame, divotPoint - startOffset), ReadOnly | DontDelete);
                     exception->putWithAttributes(callFrame, Identifier(callFrame, expressionEndOffsetPropertyName), jsNumber(callFrame, divotPoint + endOffset), ReadOnly | DontDelete);
                 } else
-                    exception->putWithAttributes(callFrame, Identifier(callFrame, JSC_ERROR_LINENUMBER_PROPERTYNAME), jsNumber(callFrame, codeBlock->lineNumberForBytecodeOffset(callFrame, bytecodeOffset)), ReadOnly | DontDelete);
-                exception->putWithAttributes(callFrame, Identifier(callFrame, "sourceId"), jsNumber(callFrame, codeBlock->ownerNode()->sourceID()), ReadOnly | DontDelete);
-                exception->putWithAttributes(callFrame, Identifier(callFrame, JSC_ERROR_FILENAME_PROPERTYNAME), jsOwnedString(callFrame, codeBlock->ownerNode()->sourceURL()), ReadOnly | DontDelete);
+                    exception->putWithAttributes(callFrame, Identifier(callFrame, "line"), jsNumber(callFrame, codeBlock->lineNumberForBytecodeOffset(callFrame, bytecodeOffset)), ReadOnly | DontDelete);
+                exception->putWithAttributes(callFrame, Identifier(callFrame, "sourceId"), jsNumber(callFrame, codeBlock->ownerExecutable()->sourceID()), ReadOnly | DontDelete);
+                exception->putWithAttributes(callFrame, Identifier(callFrame, "sourceURL"), jsOwnedString(callFrame, codeBlock->ownerExecutable()->sourceURL()), ReadOnly | DontDelete);
             }
             
             if (exception->isWatchdogException()) {
@@ -553,10 +567,9 @@ NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSV
         }
     }
 
-    Debugger* debugger = callFrame->dynamicGlobalObject()->debugger();
-    if (debugger) {
+    if (Debugger* debugger = callFrame->dynamicGlobalObject()->debugger()) {
         DebuggerCallFrame debuggerCallFrame(callFrame, exceptionValue);
-        debugger->exception(debuggerCallFrame, codeBlock->ownerNode()->sourceID(), codeBlock->lineNumberForBytecodeOffset(callFrame, bytecodeOffset));
+        debugger->exception(debuggerCallFrame, codeBlock->ownerExecutable()->sourceID(), codeBlock->lineNumberForBytecodeOffset(callFrame, bytecodeOffset));
     }
 
     // If we throw in the middle of a call instruction, we need to notify
@@ -578,33 +591,11 @@ NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSV
     // Calculate an exception handler vPC, unwinding call frames as necessary.
 
     HandlerInfo* handler = 0;
-
-#ifdef QT_BUILD_SCRIPT_LIB
-    //try to find handler
-    bool hasHandler = true;
-    CallFrame *callFrameTemp = callFrame;
-    unsigned bytecodeOffsetTemp = bytecodeOffset;
-    CodeBlock *codeBlockTemp = codeBlock;
-    while (!(handler = codeBlockTemp->handlerForBytecodeOffset(bytecodeOffsetTemp))) {
-        void* returnPC = callFrameTemp->returnPC();
-        callFrameTemp = callFrameTemp->callerFrame();
-        if (callFrameTemp->hasHostCallFrameFlag()) {
-            hasHandler = false;
-            break;
-        } else {
-            codeBlockTemp = callFrameTemp->codeBlock();
-            bytecodeOffsetTemp = bytecodeOffsetForPC(callFrameTemp, codeBlockTemp, returnPC);
-        }
-    }
-    if (debugger)
-        debugger->exceptionThrow(DebuggerCallFrame(callFrame, exceptionValue), codeBlock->ownerNode()->sourceID(), hasHandler);
-#endif
-
     while (!(handler = codeBlock->handlerForBytecodeOffset(bytecodeOffset))) {
-        if (!unwindCallFrame(callFrame, exceptionValue, bytecodeOffset, codeBlock)) {
+        if (!unwindCallFrame(callFrame, exceptionValue, bytecodeOffset, codeBlock))
             return 0;
-        }
     }
+
     // Now unwind the scope chain within the exception handler's call frame.
 
     ScopeChainNode* scopeChain = callFrame->scopeChain();
@@ -618,7 +609,7 @@ NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSV
     return handler;
 }
 
-JSValue Interpreter::execute(ProgramNode* programNode, CallFrame* callFrame, ScopeChainNode* scopeChain, JSObject* thisObj, JSValue* exception)
+JSValue Interpreter::execute(ProgramExecutable* program, CallFrame* callFrame, ScopeChainNode* scopeChain, JSObject* thisObj, JSValue* exception)
 {
     ASSERT(!scopeChain->globalData->exception);
 
@@ -629,7 +620,7 @@ JSValue Interpreter::execute(ProgramNode* programNode, CallFrame* callFrame, Sco
         }
     }
 
-    CodeBlock* codeBlock = &programNode->bytecode(scopeChain);
+    CodeBlock* codeBlock = &program->bytecode(callFrame, scopeChain);
 
     Register* oldEnd = m_registerFile.end();
     Register* newEnd = oldEnd + codeBlock->m_numParameters + RegisterFile::CallFrameHeaderSize + codeBlock->m_numCalleeRegisters;
@@ -653,7 +644,7 @@ JSValue Interpreter::execute(ProgramNode* programNode, CallFrame* callFrame, Sco
 
     Profiler** profiler = Profiler::enabledProfilerReference();
     if (*profiler)
-        (*profiler)->willExecute(newCallFrame, programNode->sourceURL(), programNode->lineNo());
+        (*profiler)->willExecute(newCallFrame, program->sourceURL(), program->lineNo());
 
     JSValue result;
     {
@@ -661,7 +652,7 @@ JSValue Interpreter::execute(ProgramNode* programNode, CallFrame* callFrame, Sco
 
         m_reentryDepth++;
 #if ENABLE(JIT)
-        result = programNode->jitCode(scopeChain).execute(&m_registerFile, newCallFrame, scopeChain->globalData, exception);
+        result = program->jitCode(newCallFrame, scopeChain).execute(&m_registerFile, newCallFrame, scopeChain->globalData, exception);
 #else
         result = privateExecute(Normal, &m_registerFile, newCallFrame, exception);
 #endif
@@ -669,7 +660,7 @@ JSValue Interpreter::execute(ProgramNode* programNode, CallFrame* callFrame, Sco
     }
 
     if (*profiler)
-        (*profiler)->didExecute(callFrame, programNode->sourceURL(), programNode->lineNo());
+        (*profiler)->didExecute(callFrame, program->sourceURL(), program->lineNo());
 
     if (m_reentryDepth && lastGlobalObject && globalObject != lastGlobalObject)
         lastGlobalObject->copyGlobalsTo(m_registerFile);
@@ -679,7 +670,7 @@ JSValue Interpreter::execute(ProgramNode* programNode, CallFrame* callFrame, Sco
     return result;
 }
 
-JSValue Interpreter::execute(FunctionBodyNode* functionBodyNode, CallFrame* callFrame, JSFunction* function, JSObject* thisObj, const ArgList& args, ScopeChainNode* scopeChain, JSValue* exception)
+JSValue Interpreter::execute(FunctionExecutable* functionExecutable, CallFrame* callFrame, JSFunction* function, JSObject* thisObj, const ArgList& args, ScopeChainNode* scopeChain, JSValue* exception)
 {
     ASSERT(!scopeChain->globalData->exception);
 
@@ -707,7 +698,7 @@ JSValue Interpreter::execute(FunctionBodyNode* functionBodyNode, CallFrame* call
     for (ArgList::const_iterator it = args.begin(); it != end; ++it)
         newCallFrame->r(++dst) = *it;
 
-    CodeBlock* codeBlock = &functionBodyNode->bytecode(scopeChain);
+    CodeBlock* codeBlock = &functionExecutable->bytecode(callFrame, scopeChain);
     newCallFrame = slideRegisterWindowForCall(codeBlock, &m_registerFile, newCallFrame, argc + RegisterFile::CallFrameHeaderSize, argc);
     if (UNLIKELY(!newCallFrame)) {
         *exception = createStackOverflowError(callFrame);
@@ -727,7 +718,7 @@ JSValue Interpreter::execute(FunctionBodyNode* functionBodyNode, CallFrame* call
 
         m_reentryDepth++;
 #if ENABLE(JIT)
-        result = functionBodyNode->jitCode(scopeChain).execute(&m_registerFile, newCallFrame, scopeChain->globalData, exception);
+        result = functionExecutable->jitCode(newCallFrame, scopeChain).execute(&m_registerFile, newCallFrame, scopeChain->globalData, exception);
 #else
         result = privateExecute(Normal, &m_registerFile, newCallFrame, exception);
 #endif
@@ -741,7 +732,7 @@ JSValue Interpreter::execute(FunctionBodyNode* functionBodyNode, CallFrame* call
     return result;
 }
 
-CallFrameClosure Interpreter::prepareForRepeatCall(FunctionBodyNode* functionBodyNode, CallFrame* callFrame, JSFunction* function, int argCount, ScopeChainNode* scopeChain, JSValue* exception)
+CallFrameClosure Interpreter::prepareForRepeatCall(FunctionExecutable* FunctionExecutable, CallFrame* callFrame, JSFunction* function, int argCount, ScopeChainNode* scopeChain, JSValue* exception)
 {
     ASSERT(!scopeChain->globalData->exception);
     
@@ -765,7 +756,7 @@ CallFrameClosure Interpreter::prepareForRepeatCall(FunctionBodyNode* functionBod
     for (int i = 0; i < argc; ++i)
         newCallFrame->r(++dst) = jsUndefined();
     
-    CodeBlock* codeBlock = &functionBodyNode->bytecode(scopeChain);
+    CodeBlock* codeBlock = &FunctionExecutable->bytecode(callFrame, scopeChain);
     newCallFrame = slideRegisterWindowForCall(codeBlock, &m_registerFile, newCallFrame, argc + RegisterFile::CallFrameHeaderSize, argc);
     if (UNLIKELY(!newCallFrame)) {
         *exception = createStackOverflowError(callFrame);
@@ -775,10 +766,10 @@ CallFrameClosure Interpreter::prepareForRepeatCall(FunctionBodyNode* functionBod
     // a 0 codeBlock indicates a built-in caller
     newCallFrame->init(codeBlock, 0, scopeChain, callFrame->addHostCallFrameFlag(), 0, argc, function);
 #if ENABLE(JIT)
-    functionBodyNode->jitCode(scopeChain);
+    FunctionExecutable->jitCode(newCallFrame, scopeChain);
 #endif
 
-    CallFrameClosure result = { callFrame, newCallFrame, function, functionBodyNode, scopeChain->globalData, oldEnd, scopeChain, codeBlock->m_numParameters, argc };
+    CallFrameClosure result = { callFrame, newCallFrame, function, FunctionExecutable, scopeChain->globalData, oldEnd, scopeChain, codeBlock->m_numParameters, argc };
     return result;
 }
 
@@ -795,7 +786,7 @@ JSValue Interpreter::execute(CallFrameClosure& closure, JSValue* exception)
         
         m_reentryDepth++;
 #if ENABLE(JIT)
-        result = closure.functionBody->generatedJITCode().execute(&m_registerFile, closure.newCallFrame, closure.globalData, exception);
+        result = closure.functionExecutable->generatedJITCode().execute(&m_registerFile, closure.newCallFrame, closure.globalData, exception);
 #else
         result = privateExecute(Normal, &m_registerFile, closure.newCallFrame, exception);
 #endif
@@ -812,12 +803,12 @@ void Interpreter::endRepeatCall(CallFrameClosure& closure)
     m_registerFile.shrink(closure.oldEnd);
 }
 
-JSValue Interpreter::execute(EvalNode* evalNode, CallFrame* callFrame, JSObject* thisObj, ScopeChainNode* scopeChain, JSValue* exception)
+JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSObject* thisObj, ScopeChainNode* scopeChain, JSValue* exception)
 {
-    return execute(evalNode, callFrame, thisObj, m_registerFile.size() + evalNode->bytecode(scopeChain).m_numParameters + RegisterFile::CallFrameHeaderSize, scopeChain, exception);
+    return execute(eval, callFrame, thisObj, m_registerFile.size() + eval->bytecode(callFrame, scopeChain).m_numParameters + RegisterFile::CallFrameHeaderSize, scopeChain, exception);
 }
 
-JSValue Interpreter::execute(EvalNode* evalNode, CallFrame* callFrame, JSObject* thisObj, int globalRegisterOffset, ScopeChainNode* scopeChain, JSValue* exception)
+JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSObject* thisObj, int globalRegisterOffset, ScopeChainNode* scopeChain, JSValue* exception)
 {
     ASSERT(!scopeChain->globalData->exception);
 
@@ -830,7 +821,7 @@ JSValue Interpreter::execute(EvalNode* evalNode, CallFrame* callFrame, JSObject*
 
     DynamicGlobalObjectScope globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : scopeChain->globalObject());
 
-    EvalCodeBlock* codeBlock = &evalNode->bytecode(scopeChain);
+    EvalCodeBlock* codeBlock = &eval->bytecode(callFrame, scopeChain);
 
     JSVariableObject* variableObject;
     for (ScopeChainNode* node = scopeChain; ; node = node->next) {
@@ -845,21 +836,20 @@ JSValue Interpreter::execute(EvalNode* evalNode, CallFrame* callFrame, JSObject*
 
         BatchedTransitionOptimizer optimizer(variableObject);
 
-        const DeclarationStacks::VarStack& varStack = codeBlock->ownerNode()->varStack();
-        DeclarationStacks::VarStack::const_iterator varStackEnd = varStack.end();
-        for (DeclarationStacks::VarStack::const_iterator it = varStack.begin(); it != varStackEnd; ++it) {
-            const Identifier& ident = (*it).first;
+        unsigned numVariables = codeBlock->numVariables();
+        for (unsigned i = 0; i < numVariables; ++i) {
+            const Identifier& ident = codeBlock->variable(i);
             if (!variableObject->hasProperty(callFrame, ident)) {
                 PutPropertySlot slot;
                 variableObject->put(callFrame, ident, jsUndefined(), slot);
             }
         }
 
-        const DeclarationStacks::FunctionStack& functionStack = codeBlock->ownerNode()->functionStack();
-        DeclarationStacks::FunctionStack::const_iterator functionStackEnd = functionStack.end();
-        for (DeclarationStacks::FunctionStack::const_iterator it = functionStack.begin(); it != functionStackEnd; ++it) {
+        int numFunctions = codeBlock->numberOfFunctionDecls();
+        for (int i = 0; i < numFunctions; ++i) {
+            FunctionExecutable* function = codeBlock->functionDecl(i);
             PutPropertySlot slot;
-            variableObject->put(callFrame, (*it)->m_ident, (*it)->makeFunction(callFrame, scopeChain), slot);
+            variableObject->put(callFrame, function->name(), function->make(callFrame, scopeChain), slot);
         }
 
     }
@@ -882,7 +872,7 @@ JSValue Interpreter::execute(EvalNode* evalNode, CallFrame* callFrame, JSObject*
 
     Profiler** profiler = Profiler::enabledProfilerReference();
     if (*profiler)
-        (*profiler)->willExecute(newCallFrame, evalNode->sourceURL(), evalNode->lineNo());
+        (*profiler)->willExecute(newCallFrame, eval->sourceURL(), eval->lineNo());
 
     JSValue result;
     {
@@ -890,7 +880,7 @@ JSValue Interpreter::execute(EvalNode* evalNode, CallFrame* callFrame, JSObject*
 
         m_reentryDepth++;
 #if ENABLE(JIT)
-        result = evalNode->jitCode(scopeChain).execute(&m_registerFile, newCallFrame, scopeChain->globalData, exception);
+        result = eval->jitCode(newCallFrame, scopeChain).execute(&m_registerFile, newCallFrame, scopeChain->globalData, exception);
 #else
         result = privateExecute(Normal, &m_registerFile, newCallFrame, exception);
 #endif
@@ -898,13 +888,13 @@ JSValue Interpreter::execute(EvalNode* evalNode, CallFrame* callFrame, JSObject*
     }
 
     if (*profiler)
-        (*profiler)->didExecute(callFrame, evalNode->sourceURL(), evalNode->lineNo());
+        (*profiler)->didExecute(callFrame, eval->sourceURL(), eval->lineNo());
 
     m_registerFile.shrink(oldEnd);
     return result;
 }
 
-NEVER_INLINE void Interpreter::debug(CallFrame* callFrame, DebugHookID debugHookID, int firstLine, int lastLine, int column)
+NEVER_INLINE void Interpreter::debug(CallFrame* callFrame, DebugHookID debugHookID, int firstLine, int lastLine)
 {
     Debugger* debugger = callFrame->dynamicGlobalObject()->debugger();
     if (!debugger)
@@ -912,22 +902,22 @@ NEVER_INLINE void Interpreter::debug(CallFrame* callFrame, DebugHookID debugHook
 
     switch (debugHookID) {
         case DidEnterCallFrame:
-            debugger->callEvent(callFrame, callFrame->codeBlock()->ownerNode()->sourceID(), firstLine);
+            debugger->callEvent(callFrame, callFrame->codeBlock()->ownerExecutable()->sourceID(), firstLine);
             return;
         case WillLeaveCallFrame:
-            debugger->returnEvent(callFrame, callFrame->codeBlock()->ownerNode()->sourceID(), lastLine);
+            debugger->returnEvent(callFrame, callFrame->codeBlock()->ownerExecutable()->sourceID(), lastLine);
             return;
         case WillExecuteStatement:
-            debugger->atStatement(callFrame, callFrame->codeBlock()->ownerNode()->sourceID(), firstLine, column);
+            debugger->atStatement(callFrame, callFrame->codeBlock()->ownerExecutable()->sourceID(), firstLine);
             return;
         case WillExecuteProgram:
-            debugger->willExecuteProgram(callFrame, callFrame->codeBlock()->ownerNode()->sourceID(), firstLine);
+            debugger->willExecuteProgram(callFrame, callFrame->codeBlock()->ownerExecutable()->sourceID(), firstLine);
             return;
         case DidExecuteProgram:
-            debugger->didExecuteProgram(callFrame, callFrame->codeBlock()->ownerNode()->sourceID(), lastLine);
+            debugger->didExecuteProgram(callFrame, callFrame->codeBlock()->ownerExecutable()->sourceID(), lastLine);
             return;
         case DidReachBreakpoint:
-            debugger->didReachBreakpoint(callFrame, callFrame->codeBlock()->ownerNode()->sourceID(), lastLine, column);
+            debugger->didReachBreakpoint(callFrame, callFrame->codeBlock()->ownerExecutable()->sourceID(), lastLine);
             return;
     }
 }
@@ -1145,7 +1135,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
     }
 
 #if ENABLE(JIT)
-    // Currently with CTI enabled we never interpret functions
+    // Mixing Interpreter + JIT is not supported.
     ASSERT_NOT_REACHED();
 #endif
 #if !USE(INTERPRETER)
@@ -1161,7 +1151,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
     Instruction* vPC = callFrame->codeBlock()->instructions().begin();
     Profiler** enabledProfilerReference = Profiler::enabledProfilerReference();
-    unsigned tickCount = globalData->timeoutChecker->ticksUntilNextCheck();
+    unsigned tickCount = globalData->timeoutChecker.ticksUntilNextCheck();
 
 #define CHECK_FOR_EXCEPTION() \
     do { \
@@ -1177,11 +1167,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
 #define CHECK_FOR_TIMEOUT() \
     if (!--tickCount) { \
-        if (globalData->timeoutChecker->didTimeOut(callFrame)) { \
+        if (globalData->timeoutChecker.didTimeOut(callFrame)) { \
             exceptionValue = jsNull(); \
             goto vm_throw; \
         } \
-        tickCount = globalData->timeoutChecker->ticksUntilNextCheck(); \
+        tickCount = globalData->timeoutChecker.ticksUntilNextCheck(); \
     }
     
 #if ENABLE(OPCODE_SAMPLING)
@@ -1275,8 +1265,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = (++vPC)->u.operand;
         JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
         JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
-        if (JSFastMath::canDoFastBitwiseOperations(src1, src2))
-            callFrame->r(dst) = JSFastMath::equal(src1, src2);
+        if (src1.isInt32() && src2.isInt32())
+            callFrame->r(dst) = jsBoolean(src1.asInt32() == src2.asInt32());
         else {
             JSValue result = jsBoolean(JSValue::equalSlowCase(callFrame, src1, src2));
             CHECK_FOR_EXCEPTION();
@@ -1315,8 +1305,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = (++vPC)->u.operand;
         JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
         JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
-        if (JSFastMath::canDoFastBitwiseOperations(src1, src2))
-            callFrame->r(dst) = JSFastMath::notEqual(src1, src2);
+        if (src1.isInt32() && src2.isInt32())
+            callFrame->r(dst) = jsBoolean(src1.asInt32() != src2.asInt32());
         else {
             JSValue result = jsBoolean(!JSValue::equalSlowCase(callFrame, src1, src2));
             CHECK_FOR_EXCEPTION();
@@ -1417,8 +1407,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         */
         int srcDst = (++vPC)->u.operand;
         JSValue v = callFrame->r(srcDst).jsValue();
-        if (JSFastMath::canDoFastAdditiveOperations(v))
-            callFrame->r(srcDst) = JSValue(JSFastMath::incImmediateNumber(v));
+        if (v.isInt32() && v.asInt32() < INT_MAX)
+            callFrame->r(srcDst) = jsNumber(callFrame, v.asInt32() + 1);
         else {
             JSValue result = jsNumber(callFrame, v.toNumber(callFrame) + 1);
             CHECK_FOR_EXCEPTION();
@@ -1436,8 +1426,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         */
         int srcDst = (++vPC)->u.operand;
         JSValue v = callFrame->r(srcDst).jsValue();
-        if (JSFastMath::canDoFastAdditiveOperations(v))
-            callFrame->r(srcDst) = JSValue(JSFastMath::decImmediateNumber(v));
+        if (v.isInt32() && v.asInt32() > INT_MIN)
+            callFrame->r(srcDst) = jsNumber(callFrame, v.asInt32() - 1);
         else {
             JSValue result = jsNumber(callFrame, v.toNumber(callFrame) - 1);
             CHECK_FOR_EXCEPTION();
@@ -1457,14 +1447,14 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = (++vPC)->u.operand;
         int srcDst = (++vPC)->u.operand;
         JSValue v = callFrame->r(srcDst).jsValue();
-        if (JSFastMath::canDoFastAdditiveOperations(v)) {
+        if (v.isInt32() && v.asInt32() < INT_MAX) {
+            callFrame->r(srcDst) = jsNumber(callFrame, v.asInt32() + 1);
             callFrame->r(dst) = v;
-            callFrame->r(srcDst) = JSValue(JSFastMath::incImmediateNumber(v));
         } else {
             JSValue number = callFrame->r(srcDst).jsValue().toJSNumber(callFrame);
             CHECK_FOR_EXCEPTION();
+            callFrame->r(srcDst) = jsNumber(callFrame, number.uncheckedGetNumber() + 1);
             callFrame->r(dst) = number;
-            callFrame->r(srcDst) = JSValue(jsNumber(callFrame, number.uncheckedGetNumber() + 1));
         }
 
         ++vPC;
@@ -1480,14 +1470,14 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = (++vPC)->u.operand;
         int srcDst = (++vPC)->u.operand;
         JSValue v = callFrame->r(srcDst).jsValue();
-        if (JSFastMath::canDoFastAdditiveOperations(v)) {
+        if (v.isInt32() && v.asInt32() > INT_MIN) {
+            callFrame->r(srcDst) = jsNumber(callFrame, v.asInt32() - 1);
             callFrame->r(dst) = v;
-            callFrame->r(srcDst) = JSValue(JSFastMath::decImmediateNumber(v));
         } else {
             JSValue number = callFrame->r(srcDst).jsValue().toJSNumber(callFrame);
             CHECK_FOR_EXCEPTION();
+            callFrame->r(srcDst) = jsNumber(callFrame, number.uncheckedGetNumber() - 1);
             callFrame->r(dst) = number;
-            callFrame->r(srcDst) = JSValue(jsNumber(callFrame, number.uncheckedGetNumber() - 1));
         }
 
         ++vPC;
@@ -1523,16 +1513,15 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         */
         int dst = (++vPC)->u.operand;
         JSValue src = callFrame->r((++vPC)->u.operand).jsValue();
-        ++vPC;
-        double v;
-        if (src.getNumber(v))
-            callFrame->r(dst) = JSValue(jsNumber(callFrame, -v));
+        if (src.isInt32() && src.asInt32())
+            callFrame->r(dst) = jsNumber(callFrame, -src.asInt32());
         else {
             JSValue result = jsNumber(callFrame, -src.toNumber(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame->r(dst) = result;
         }
 
+        ++vPC;
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_add) {
@@ -1545,8 +1534,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = (++vPC)->u.operand;
         JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
         JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
-        if (JSFastMath::canDoFastAdditiveOperations(src1, src2))
-            callFrame->r(dst) = JSValue(JSFastMath::addImmediateNumbers(src1, src2));
+        if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | src2.asInt32() & 0xc0000000)) // no overflow
+            callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() + src2.asInt32());
         else {
             JSValue result = jsAdd(callFrame, src1, src2);
             CHECK_FOR_EXCEPTION();
@@ -1564,17 +1553,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = (++vPC)->u.operand;
         JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
         JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
-        double left;
-        double right;
-        if (JSValue::areBothInt32Fast(src1, src2)) {
-            int32_t left = src1.getInt32Fast();
-            int32_t right = src2.getInt32Fast();
-            if ((left | right) >> 15 == 0)
-                callFrame->r(dst) = JSValue(jsNumber(callFrame, left * right));
-            else
-                callFrame->r(dst) = JSValue(jsNumber(callFrame, static_cast<double>(left) * static_cast<double>(right)));
-        } else if (src1.getNumber(left) && src2.getNumber(right))
-            callFrame->r(dst) = JSValue(jsNumber(callFrame, left * right));
+        if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | src2.asInt32() >> 15)) // no overflow
+                callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() * src2.asInt32());
         else {
             JSValue result = jsNumber(callFrame, src1.toNumber(callFrame) * src2.toNumber(callFrame));
             CHECK_FOR_EXCEPTION();
@@ -1594,16 +1574,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = (++vPC)->u.operand;
         JSValue dividend = callFrame->r((++vPC)->u.operand).jsValue();
         JSValue divisor = callFrame->r((++vPC)->u.operand).jsValue();
-        double left;
-        double right;
-        if (dividend.getNumber(left) && divisor.getNumber(right))
-            callFrame->r(dst) = JSValue(jsNumber(callFrame, left / right));
-        else {
-            JSValue result = jsNumber(callFrame, dividend.toNumber(callFrame) / divisor.toNumber(callFrame));
-            CHECK_FOR_EXCEPTION();
-            callFrame->r(dst) = result;
-        }
-        ++vPC;
+
+        JSValue result = jsNumber(callFrame, dividend.toNumber(callFrame) / divisor.toNumber(callFrame));
+        CHECK_FOR_EXCEPTION();
+        callFrame->r(dst) = result;
+
+        vPC += 2;
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_mod) {
@@ -1614,24 +1590,22 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            remainder in register dst.
         */
         int dst = (++vPC)->u.operand;
-        int dividend = (++vPC)->u.operand;
-        int divisor = (++vPC)->u.operand;
-
-        JSValue dividendValue = callFrame->r(dividend).jsValue();
-        JSValue divisorValue = callFrame->r(divisor).jsValue();
+        JSValue dividend = callFrame->r((++vPC)->u.operand).jsValue();
+        JSValue divisor = callFrame->r((++vPC)->u.operand).jsValue();
 
-        if (JSValue::areBothInt32Fast(dividendValue, divisorValue) && divisorValue != jsNumber(callFrame, 0)) {
-            // We expect the result of the modulus of a number that was representable as an int32 to also be representable
-            // as an int32.
-            JSValue result = JSValue::makeInt32Fast(dividendValue.getInt32Fast() % divisorValue.getInt32Fast());
+        if (dividend.isInt32() && divisor.isInt32() && divisor.asInt32() != 0) {
+            JSValue result = jsNumber(callFrame, dividend.asInt32() % divisor.asInt32());
             ASSERT(result);
             callFrame->r(dst) = result;
             ++vPC;
             NEXT_INSTRUCTION();
         }
 
-        double d = dividendValue.toNumber(callFrame);
-        JSValue result = jsNumber(callFrame, fmod(d, divisorValue.toNumber(callFrame)));
+        // Conversion to double must happen outside the call to fmod since the
+        // order of argument evaluation is not guaranteed.
+        double d1 = dividend.toNumber(callFrame);
+        double d2 = divisor.toNumber(callFrame);
+        JSValue result = jsNumber(callFrame, fmod(d1, d2));
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = result;
         ++vPC;
@@ -1647,12 +1621,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = (++vPC)->u.operand;
         JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
         JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
-        double left;
-        double right;
-        if (JSFastMath::canDoFastAdditiveOperations(src1, src2))
-            callFrame->r(dst) = JSValue(JSFastMath::subImmediateNumbers(src1, src2));
-        else if (src1.getNumber(left) && src2.getNumber(right))
-            callFrame->r(dst) = JSValue(jsNumber(callFrame, left - right));
+        if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | src2.asInt32() & 0xc0000000)) // no overflow
+            callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() - src2.asInt32());
         else {
             JSValue result = jsNumber(callFrame, src1.toNumber(callFrame) - src2.toNumber(callFrame));
             CHECK_FOR_EXCEPTION();
@@ -1671,12 +1641,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = (++vPC)->u.operand;
         JSValue val = callFrame->r((++vPC)->u.operand).jsValue();
         JSValue shift = callFrame->r((++vPC)->u.operand).jsValue();
-        int32_t left;
-        uint32_t right;
-        if (JSValue::areBothInt32Fast(val, shift))
-            callFrame->r(dst) = JSValue(jsNumber(callFrame, val.getInt32Fast() << (shift.getInt32Fast() & 0x1f)));
-        else if (val.numberToInt32(left) && shift.numberToUInt32(right))
-            callFrame->r(dst) = JSValue(jsNumber(callFrame, left << (right & 0x1f)));
+
+        if (val.isInt32() && shift.isInt32())
+            callFrame->r(dst) = jsNumber(callFrame, val.asInt32() << (shift.asInt32() & 0x1f));
         else {
             JSValue result = jsNumber(callFrame, (val.toInt32(callFrame)) << (shift.toUInt32(callFrame) & 0x1f));
             CHECK_FOR_EXCEPTION();
@@ -1696,12 +1663,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = (++vPC)->u.operand;
         JSValue val = callFrame->r((++vPC)->u.operand).jsValue();
         JSValue shift = callFrame->r((++vPC)->u.operand).jsValue();
-        int32_t left;
-        uint32_t right;
-        if (JSFastMath::canDoFastRshift(val, shift))
-            callFrame->r(dst) = JSValue(JSFastMath::rightShiftImmediateNumbers(val, shift));
-        else if (val.numberToInt32(left) && shift.numberToUInt32(right))
-            callFrame->r(dst) = JSValue(jsNumber(callFrame, left >> (right & 0x1f)));
+
+        if (val.isInt32() && shift.isInt32())
+            callFrame->r(dst) = jsNumber(callFrame, val.asInt32() >> (shift.asInt32() & 0x1f));
         else {
             JSValue result = jsNumber(callFrame, (val.toInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
             CHECK_FOR_EXCEPTION();
@@ -1721,8 +1685,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = (++vPC)->u.operand;
         JSValue val = callFrame->r((++vPC)->u.operand).jsValue();
         JSValue shift = callFrame->r((++vPC)->u.operand).jsValue();
-        if (JSFastMath::canDoFastUrshift(val, shift))
-            callFrame->r(dst) = JSValue(JSFastMath::rightShiftImmediateNumbers(val, shift));
+        if (val.isUInt32() && shift.isInt32())
+            callFrame->r(dst) = jsNumber(callFrame, val.asInt32() >> (shift.asInt32() & 0x1f));
         else {
             JSValue result = jsNumber(callFrame, (val.toUInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
             CHECK_FOR_EXCEPTION();
@@ -1742,12 +1706,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = (++vPC)->u.operand;
         JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
         JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
-        int32_t left;
-        int32_t right;
-        if (JSFastMath::canDoFastBitwiseOperations(src1, src2))
-            callFrame->r(dst) = JSValue(JSFastMath::andImmediateNumbers(src1, src2));
-        else if (src1.numberToInt32(left) && src2.numberToInt32(right))
-            callFrame->r(dst) = JSValue(jsNumber(callFrame, left & right));
+        if (src1.isInt32() && src2.isInt32())
+            callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() & src2.asInt32());
         else {
             JSValue result = jsNumber(callFrame, src1.toInt32(callFrame) & src2.toInt32(callFrame));
             CHECK_FOR_EXCEPTION();
@@ -1767,12 +1727,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = (++vPC)->u.operand;
         JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
         JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
-        int32_t left;
-        int32_t right;
-        if (JSFastMath::canDoFastBitwiseOperations(src1, src2))
-            callFrame->r(dst) = JSValue(JSFastMath::xorImmediateNumbers(src1, src2));
-        else if (src1.numberToInt32(left) && src2.numberToInt32(right))
-            callFrame->r(dst) = JSValue(jsNumber(callFrame, left ^ right));
+        if (src1.isInt32() && src2.isInt32())
+            callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() ^ src2.asInt32());
         else {
             JSValue result = jsNumber(callFrame, src1.toInt32(callFrame) ^ src2.toInt32(callFrame));
             CHECK_FOR_EXCEPTION();
@@ -1792,12 +1748,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = (++vPC)->u.operand;
         JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
         JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
-        int32_t left;
-        int32_t right;
-        if (JSFastMath::canDoFastBitwiseOperations(src1, src2))
-            callFrame->r(dst) = JSValue(JSFastMath::orImmediateNumbers(src1, src2));
-        else if (src1.numberToInt32(left) && src2.numberToInt32(right))
-            callFrame->r(dst) = JSValue(jsNumber(callFrame, left | right));
+        if (src1.isInt32() && src2.isInt32())
+            callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() | src2.asInt32());
         else {
             JSValue result = jsNumber(callFrame, src1.toInt32(callFrame) | src2.toInt32(callFrame));
             CHECK_FOR_EXCEPTION();
@@ -1815,9 +1767,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         */
         int dst = (++vPC)->u.operand;
         JSValue src = callFrame->r((++vPC)->u.operand).jsValue();
-        int32_t value;
-        if (src.numberToInt32(value))
-            callFrame->r(dst) = JSValue(jsNumber(callFrame, ~value));
+        if (src.isInt32())
+            callFrame->r(dst) = jsNumber(callFrame, ~src.asInt32());
         else {
             JSValue result = jsNumber(callFrame, ~src.toInt32(callFrame));
             CHECK_FOR_EXCEPTION();
@@ -2151,27 +2102,6 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         vPC += 4;
         NEXT_INSTRUCTION();
     }
-    DEFINE_OPCODE(op_resolve_func) {
-        /* resolve_func baseDst(r) funcDst(r) property(id)
-
-           Searches the scope chain for an object containing
-           identifier property, and if one is found, writes the
-           appropriate object to use as "this" when calling its
-           properties to register baseDst; and the retrieved property
-           value to register propDst. If the property is not found,
-           raises an exception.
-
-           This differs from resolve_with_base, because the
-           global this value will be substituted for activations or
-           the global object, which is the right behavior for function
-           calls but not for other property lookup.
-        */
-        if (UNLIKELY(!resolveBaseAndFunc(callFrame, vPC, exceptionValue)))
-            goto vm_throw;
-
-        vPC += 4;
-        NEXT_INSTRUCTION();
-    }
     DEFINE_OPCODE(op_get_by_id) {
         /* get_by_id dst(r) base(r) property(id) structure(sID) nop(n) nop(n) nop(n)
 
@@ -2352,7 +2282,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSValue baseValue = callFrame->r(base).jsValue();
         if (LIKELY(isJSArray(globalData, baseValue))) {
             int dst = vPC[1].u.operand;
-            callFrame->r(dst) = JSValue(jsNumber(callFrame, asArray(baseValue)->length()));
+            callFrame->r(dst) = jsNumber(callFrame, asArray(baseValue)->length());
             vPC += 8;
             NEXT_INSTRUCTION();
         }
@@ -2372,7 +2302,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSValue baseValue = callFrame->r(base).jsValue();
         if (LIKELY(isJSString(globalData, baseValue))) {
             int dst = vPC[1].u.operand;
-            callFrame->r(dst) = JSValue(jsNumber(callFrame, asString(baseValue)->value().size()));
+            callFrame->r(dst) = jsNumber(callFrame, asString(baseValue)->value().size());
             vPC += 8;
             NEXT_INSTRUCTION();
         }
@@ -2550,8 +2480,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
         JSValue result;
 
-        if (LIKELY(subscript.isUInt32Fast())) {
-            uint32_t i = subscript.getUInt32Fast();
+        if (LIKELY(subscript.isUInt32())) {
+            uint32_t i = subscript.asUInt32();
             if (isJSArray(globalData, baseValue)) {
                 JSArray* jsArray = asArray(baseValue);
                 if (jsArray->canGetIndex(i))
@@ -2592,8 +2522,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSValue baseValue = callFrame->r(base).jsValue();
         JSValue subscript = callFrame->r(property).jsValue();
 
-        if (LIKELY(subscript.isUInt32Fast())) {
-            uint32_t i = subscript.getUInt32Fast();
+        if (LIKELY(subscript.isUInt32())) {
+            uint32_t i = subscript.asUInt32();
             if (isJSArray(globalData, baseValue)) {
                 JSArray* jsArray = asArray(baseValue);
                 if (jsArray->canSetIndex(i))
@@ -2604,8 +2534,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
                 JSByteArray* jsByteArray = asByteArray(baseValue);
                 double dValue = 0;
                 JSValue jsValue = callFrame->r(value).jsValue();
-                if (jsValue.isInt32Fast())
-                    jsByteArray->setIndex(i, jsValue.getInt32Fast());
+                if (jsValue.isInt32())
+                    jsByteArray->setIndex(i, jsValue.asInt32());
                 else if (jsValue.getNumber(dValue))
                     jsByteArray->setIndex(i, dValue);
                 else
@@ -2925,8 +2855,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int tableIndex = (++vPC)->u.operand;
         int defaultOffset = (++vPC)->u.operand;
         JSValue scrutinee = callFrame->r((++vPC)->u.operand).jsValue();
-        if (scrutinee.isInt32Fast())
-            vPC += callFrame->codeBlock()->immediateSwitchJumpTable(tableIndex).offsetForValue(scrutinee.getInt32Fast(), defaultOffset);
+        if (scrutinee.isInt32())
+            vPC += callFrame->codeBlock()->immediateSwitchJumpTable(tableIndex).offsetForValue(scrutinee.asInt32(), defaultOffset);
         else {
             double value;
             int32_t intValue;
@@ -2989,7 +2919,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = (++vPC)->u.operand;
         int func = (++vPC)->u.operand;
 
-        callFrame->r(dst) = callFrame->codeBlock()->function(func)->makeFunction(callFrame, callFrame->scopeChain());
+        callFrame->r(dst) = JSValue(callFrame->codeBlock()->functionDecl(func)->make(callFrame, callFrame->scopeChain()));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -3003,9 +2933,24 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            puts the result in register dst.
         */
         int dst = (++vPC)->u.operand;
-        int func = (++vPC)->u.operand;
+        int funcIndex = (++vPC)->u.operand;
+
+        FunctionExecutable* function = callFrame->codeBlock()->functionExpr(funcIndex);
+        JSFunction* func = function->make(callFrame, callFrame->scopeChain());
+
+        /* 
+            The Identifier in a FunctionExpression can be referenced from inside
+            the FunctionExpression's FunctionBody to allow the function to call
+            itself recursively. However, unlike in a FunctionDeclaration, the
+            Identifier in a FunctionExpression cannot be referenced from and
+            does not affect the scope enclosing the FunctionExpression.
+         */
+        if (!function->name().isNull()) {
+            JSStaticScopeObject* functionScopeObject = new (callFrame) JSStaticScopeObject(callFrame, function->name(), func, ReadOnly | DontDelete);
+            func->scope().push(functionScopeObject);
+        }
 
-        callFrame->r(dst) = callFrame->codeBlock()->functionExpression(func)->makeFunction(callFrame, callFrame->scopeChain());
+        callFrame->r(dst) = JSValue(func);
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -3071,8 +3016,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
         if (callType == CallTypeJS) {
             ScopeChainNode* callDataScopeChain = callData.js.scopeChain;
-            FunctionBodyNode* functionBodyNode = callData.js.functionBody;
-            CodeBlock* newCodeBlock = &functionBodyNode->bytecode(callDataScopeChain);
+            CodeBlock* newCodeBlock = &callData.js.functionExecutable->bytecode(callFrame, callDataScopeChain);
 
             CallFrame* previousCallFrame = callFrame;
 
@@ -3096,7 +3040,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (callType == CallTypeHost) {
             ScopeChainNode* scopeChain = callFrame->scopeChain();
             CallFrame* newCallFrame = CallFrame::create(callFrame->registers() + registerOffset);
-            newCallFrame->init(0, vPC + 5, scopeChain, callFrame, dst, argCount, asObject(v));
+            newCallFrame->init(0, vPC + 5, scopeChain, callFrame, dst, argCount, 0);
 
             Register* thisRegister = newCallFrame->registers() - RegisterFile::CallFrameHeaderSize - argCount;
             ArgList args(thisRegister + 1, argCount - 1);
@@ -3113,7 +3057,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             }
             CHECK_FOR_EXCEPTION();
 
-            callFrame->r(dst) = JSValue(returnValue);
+            callFrame->r(dst) = returnValue;
 
             vPC += 5;
             NEXT_INSTRUCTION();
@@ -3138,7 +3082,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
                 exceptionValue = createStackOverflowError(callFrame);
                 goto vm_throw;
             }
-            int32_t expectedParams = static_cast<JSFunction*>(callFrame->callee())->body()->parameterCount();
+            ASSERT(!callFrame->callee()->isHostFunction());
+            int32_t expectedParams = callFrame->callee()->jsExecutable()->parameterCount();
             int32_t inplaceArgs = min(argCount, expectedParams);
             int32_t i = 0;
             Register* argStore = callFrame->registers() + argsOffset;
@@ -3196,7 +3141,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             }
         }
         CHECK_FOR_EXCEPTION();
-        callFrame->r(argCountDst) = argCount + 1;
+        callFrame->r(argCountDst) = Register::withInt(argCount + 1);
         ++vPC;
         NEXT_INSTRUCTION();
     }
@@ -3225,8 +3170,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         
         if (callType == CallTypeJS) {
             ScopeChainNode* callDataScopeChain = callData.js.scopeChain;
-            FunctionBodyNode* functionBodyNode = callData.js.functionBody;
-            CodeBlock* newCodeBlock = &functionBodyNode->bytecode(callDataScopeChain);
+            CodeBlock* newCodeBlock = &callData.js.functionExecutable->bytecode(callFrame, callDataScopeChain);
             
             CallFrame* previousCallFrame = callFrame;
             
@@ -3250,7 +3194,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (callType == CallTypeHost) {
             ScopeChainNode* scopeChain = callFrame->scopeChain();
             CallFrame* newCallFrame = CallFrame::create(callFrame->registers() + registerOffset);
-            newCallFrame->init(0, vPC + 5, scopeChain, callFrame, dst, argCount, asObject(v));
+            newCallFrame->init(0, vPC + 5, scopeChain, callFrame, dst, argCount, 0);
             
             Register* thisRegister = newCallFrame->registers() - RegisterFile::CallFrameHeaderSize - argCount;
             ArgList args(thisRegister + 1, argCount - 1);
@@ -3267,7 +3211,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             }
             CHECK_FOR_EXCEPTION();
             
-            callFrame->r(dst) = JSValue(returnValue);
+            callFrame->r(dst) = returnValue;
             
             vPC += 5;
             NEXT_INSTRUCTION();
@@ -3313,6 +3257,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         */
 
         ASSERT(callFrame->codeBlock()->usesArguments() && !callFrame->codeBlock()->needsFullScopeChain());
+
         if (callFrame->optionalCalleeArguments())
             callFrame->optionalCalleeArguments()->copyRegisters();
 
@@ -3329,31 +3274,21 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            register base to those of the calling function.
         */
 
-#ifdef QT_BUILD_SCRIPT_LIB
-        Debugger* debugger = callFrame->dynamicGlobalObject()->debugger();
-        intptr_t sourceId = callFrame->codeBlock()->source()->asID();
-#endif
-
         int result = (++vPC)->u.operand;
 
         if (callFrame->codeBlock()->needsFullScopeChain())
             callFrame->scopeChain()->deref();
 
         JSValue returnValue = callFrame->r(result).jsValue();
-#ifdef QT_BUILD_SCRIPT_LIB
-        if (debugger) {
-            debugger->functionExit(returnValue, sourceId);
-        }
-#endif
 
         vPC = callFrame->returnPC();
         int dst = callFrame->returnValueRegister();
         callFrame = callFrame->callerFrame();
-
+        
         if (callFrame->hasHostCallFrameFlag())
             return returnValue;
 
-        callFrame->r(dst) = JSValue(returnValue);
+        callFrame->r(dst) = returnValue;
 
         NEXT_INSTRUCTION();
     }
@@ -3397,8 +3332,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(i) = jsUndefined();
 
         int dst = (++vPC)->u.operand;
-        JSActivation* activation = new (globalData) JSActivation(callFrame, static_cast<FunctionBodyNode*>(codeBlock->ownerNode()));
-        callFrame->r(dst) = activation;
+        JSActivation* activation = new (globalData) JSActivation(callFrame, static_cast<FunctionExecutable*>(codeBlock->ownerExecutable()));
+        callFrame->r(dst) = JSValue(activation);
         callFrame->setScopeChain(callFrame->scopeChain()->copy()->push(activation));
 
         ++vPC;
@@ -3449,7 +3384,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
          if (!callFrame->r(RegisterFile::ArgumentsRegister).jsValue()) {
              Arguments* arguments = new (globalData) Arguments(callFrame);
              callFrame->setCalleeArguments(arguments);
-             callFrame->r(RegisterFile::ArgumentsRegister) = arguments;
+             callFrame->r(RegisterFile::ArgumentsRegister) = JSValue(arguments);
          }
         ++vPC;
         NEXT_INSTRUCTION();
@@ -3483,8 +3418,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
         if (constructType == ConstructTypeJS) {
             ScopeChainNode* callDataScopeChain = constructData.js.scopeChain;
-            FunctionBodyNode* functionBodyNode = constructData.js.functionBody;
-            CodeBlock* newCodeBlock = &functionBodyNode->bytecode(callDataScopeChain);
+            CodeBlock* newCodeBlock = &constructData.js.functionExecutable->bytecode(callFrame, callDataScopeChain);
 
             Structure* structure;
             JSValue prototype = callFrame->r(proto).jsValue();
@@ -3492,12 +3426,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
                 structure = asObject(prototype)->inheritorID();
             else
                 structure = callDataScopeChain->globalObject()->emptyObjectStructure();
-#ifdef QT_BUILD_SCRIPT_LIB
-            // ### world-class hack
-            QScriptObject* newObject = new (globalData) QScriptObject(structure);
-#else
             JSObject* newObject = new (globalData) JSObject(structure);
-#endif
+
             callFrame->r(thisRegister) = JSValue(newObject); // "this" value
 
             CallFrame* previousCallFrame = callFrame;
@@ -3523,9 +3453,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             ArgList args(callFrame->registers() + thisRegister + 1, argCount - 1);
 
             ScopeChainNode* scopeChain = callFrame->scopeChain();
-
             CallFrame* newCallFrame = CallFrame::create(callFrame->registers() + registerOffset);
-            newCallFrame->init(0, vPC + 7, scopeChain, callFrame, dst, argCount, asObject(v));
+            newCallFrame->init(0, vPC + 7, scopeChain, callFrame, dst, argCount, 0);
 
             JSValue returnValue;
             {
@@ -3696,16 +3625,6 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         */
         ASSERT(exceptionValue);
         ASSERT(!globalData->exception);
-
-#ifdef QT_BUILD_SCRIPT_LIB
-        CodeBlock* codeBlock = callFrame->codeBlock();
-        Debugger* debugger = callFrame->dynamicGlobalObject()->debugger();
-        if (debugger) {
-            DebuggerCallFrame debuggerCallFrame(callFrame, exceptionValue);
-            debugger->exceptionCatch(debuggerCallFrame, codeBlock->ownerNode()->sourceID());
-        }
-#endif
-
         int ex = (++vPC)->u.operand;
         callFrame->r(ex) = exceptionValue;
         exceptionValue = JSValue();
@@ -3749,7 +3668,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int message = (++vPC)->u.operand;
 
         CodeBlock* codeBlock = callFrame->codeBlock();
-        callFrame->r(dst) = JSValue(Error::create(callFrame, (ErrorType)type, callFrame->r(message).jsValue().toString(callFrame), codeBlock->lineNumberForBytecodeOffset(callFrame, vPC - codeBlock->instructions().begin()), codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->sourceURL()));
+        callFrame->r(dst) = JSValue(Error::create(callFrame, (ErrorType)type, callFrame->r(message).jsValue().toString(callFrame), codeBlock->lineNumberForBytecodeOffset(callFrame, vPC - codeBlock->instructions().begin()), codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->sourceURL()));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -3846,7 +3765,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_debug) {
-        /* debug debugHookID(n) firstLine(n) lastLine(n) columnNumber(n)
+        /* debug debugHookID(n) firstLine(n) lastLine(n)
 
          Notifies the debugger of the current state of execution. This opcode
          is only generated while the debugger is attached.
@@ -3854,9 +3773,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int debugHookID = (++vPC)->u.operand;
         int firstLine = (++vPC)->u.operand;
         int lastLine = (++vPC)->u.operand;
-        int column = (++vPC)->u.operand;
 
-        debug(callFrame, static_cast<DebugHookID>(debugHookID), firstLine, lastLine, column);
+        debug(callFrame, static_cast<DebugHookID>(debugHookID), firstLine, lastLine);
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -3925,12 +3843,12 @@ JSValue Interpreter::retrieveArguments(CallFrame* callFrame, JSFunction* functio
     CodeBlock* codeBlock = functionCallFrame->codeBlock();
     if (codeBlock->usesArguments()) {
         ASSERT(codeBlock->codeType() == FunctionCode);
-        SymbolTable& symbolTable = codeBlock->symbolTable();
+        SymbolTable& symbolTable = *codeBlock->symbolTable();
         int argumentsIndex = symbolTable.get(functionCallFrame->propertyNames().arguments.ustring().rep()).getIndex();
-        if (!functionCallFrame->r(argumentsIndex).arguments()) {
+        if (!functionCallFrame->r(argumentsIndex).jsValue()) {
             Arguments* arguments = new (callFrame) Arguments(functionCallFrame);
             functionCallFrame->setCalleeArguments(arguments);
-            functionCallFrame->r(RegisterFile::ArgumentsRegister) = arguments;
+            functionCallFrame->r(RegisterFile::ArgumentsRegister) = JSValue(arguments);
         }
         return functionCallFrame->r(argumentsIndex).jsValue();
     }
@@ -3978,8 +3896,8 @@ void Interpreter::retrieveLastCaller(CallFrame* callFrame, int& lineNumber, intp
 
     unsigned bytecodeOffset = bytecodeOffsetForPC(callerFrame, callerCodeBlock, callFrame->returnPC());
     lineNumber = callerCodeBlock->lineNumberForBytecodeOffset(callerFrame, bytecodeOffset - 1);
-    sourceID = callerCodeBlock->ownerNode()->sourceID();
-    sourceURL = callerCodeBlock->ownerNode()->sourceURL();
+    sourceID = callerCodeBlock->ownerExecutable()->sourceID();
+    sourceURL = callerCodeBlock->ownerExecutable()->sourceURL();
     function = callerFrame->callee();
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h
index 69f83cf..8cb75d2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h
@@ -42,19 +42,19 @@
 namespace JSC {
 
     class CodeBlock;
-    class EvalNode;
-    class FunctionBodyNode;
-    class Instruction;
+    class EvalExecutable;
+    class FunctionExecutable;
     class InternalFunction;
     class JSFunction;
     class JSGlobalObject;
-    class ProgramNode;
+    class ProgramExecutable;
     class Register;
     class ScopeChainNode;
     class SamplingTool;
     struct CallFrameClosure;
     struct HandlerInfo;
-
+    struct Instruction;
+    
     enum DebugHookID {
         WillExecuteProgram,
         DidExecuteProgram,
@@ -95,9 +95,9 @@ namespace JSC {
 
         bool isOpcode(Opcode);
         
-        JSValue execute(ProgramNode*, CallFrame*, ScopeChainNode*, JSObject* thisObj, JSValue* exception);
-        JSValue execute(FunctionBodyNode*, CallFrame*, JSFunction*, JSObject* thisObj, const ArgList& args, ScopeChainNode*, JSValue* exception);
-        JSValue execute(EvalNode* evalNode, CallFrame* exec, JSObject* thisObj, ScopeChainNode* scopeChain, JSValue* exception);
+        JSValue execute(ProgramExecutable*, CallFrame*, ScopeChainNode*, JSObject* thisObj, JSValue* exception);
+        JSValue execute(FunctionExecutable*, CallFrame*, JSFunction*, JSObject* thisObj, const ArgList& args, ScopeChainNode*, JSValue* exception);
+        JSValue execute(EvalExecutable* evalNode, CallFrame* exec, JSObject* thisObj, ScopeChainNode* scopeChain, JSValue* exception);
 
         JSValue retrieveArguments(CallFrame*, JSFunction*) const;
         JSValue retrieveCaller(CallFrame*, InternalFunction*) const;
@@ -110,16 +110,16 @@ namespace JSC {
 
         NEVER_INLINE JSValue callEval(CallFrame*, RegisterFile*, Register* argv, int argc, int registerOffset, JSValue& exceptionValue);
         NEVER_INLINE HandlerInfo* throwException(CallFrame*&, JSValue&, unsigned bytecodeOffset, bool);
-        NEVER_INLINE void debug(CallFrame*, DebugHookID, int firstLine, int lastLine, int column);
+        NEVER_INLINE void debug(CallFrame*, DebugHookID, int firstLine, int lastLine);
 
     private:
         enum ExecutionFlag { Normal, InitializeAndReturn };
 
-        CallFrameClosure prepareForRepeatCall(FunctionBodyNode*, CallFrame*, JSFunction*, int argCount, ScopeChainNode*, JSValue* exception);
+        CallFrameClosure prepareForRepeatCall(FunctionExecutable*, CallFrame*, JSFunction*, int argCount, ScopeChainNode*, JSValue* exception);
         void endRepeatCall(CallFrameClosure&);
         JSValue execute(CallFrameClosure&, JSValue* exception);
 
-        JSValue execute(EvalNode*, CallFrame*, JSObject* thisObject, int globalRegisterOffset, ScopeChainNode*, JSValue* exception);
+        JSValue execute(EvalExecutable*, CallFrame*, JSObject* thisObject, int globalRegisterOffset, ScopeChainNode*, JSValue* exception);
 
 #if USE(INTERPRETER)
         NEVER_INLINE bool resolve(CallFrame*, Instruction*, JSValue& exceptionValue);
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h
index 6d01eb7..76184ba 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -40,6 +40,7 @@ namespace JSC {
     class CodeBlock;
     class ExecState;
     class JSActivation;
+    class JSFunction;
     class JSPropertyNameIterator;
     class ScopeChainNode;
 
@@ -51,51 +52,43 @@ namespace JSC {
     public:
         Register();
         Register(JSValue);
-        Register(Arguments*);
 
         JSValue jsValue() const;
-
-        bool marked() const;
-        void mark();
         
-        int32_t i() const;
-        void* v() const;
-
-    private:
-        friend class ExecState;
-        friend class Interpreter;
-
-        // Only CallFrame, Interpreter, and JITStubs should use these functions.
-
-        Register(intptr_t);
-
         Register(JSActivation*);
         Register(CallFrame*);
         Register(CodeBlock*);
-        Register(JSObject*);
+        Register(JSFunction*);
         Register(JSPropertyNameIterator*);
         Register(ScopeChainNode*);
         Register(Instruction*);
 
+        int32_t i() const;
         JSActivation* activation() const;
         Arguments* arguments() const;
         CallFrame* callFrame() const;
         CodeBlock* codeBlock() const;
-        JSObject* object() const;
+        JSFunction* function() const;
         JSPropertyNameIterator* propertyNameIterator() const;
         ScopeChainNode* scopeChain() const;
         Instruction* vPC() const;
 
+        static Register withInt(int32_t i)
+        {
+            return Register(i);
+        }
+
+    private:
+        Register(int32_t);
+
         union {
-            intptr_t i;
-            void* v;
+            int32_t i;
             EncodedJSValue value;
 
             JSActivation* activation;
-            Arguments* arguments;
             CallFrame* callFrame;
             CodeBlock* codeBlock;
-            JSObject* object;
+            JSFunction* function;
             JSPropertyNameIterator* propertyNameIterator;
             ScopeChainNode* scopeChain;
             Instruction* vPC;
@@ -118,24 +111,9 @@ namespace JSC {
     {
         return JSValue::decode(u.value);
     }
-    
-    ALWAYS_INLINE bool Register::marked() const
-    {
-        return jsValue().marked();
-    }
 
-    ALWAYS_INLINE void Register::mark()
-    {
-        jsValue().mark();
-    }
-    
     // Interpreter functions
 
-    ALWAYS_INLINE Register::Register(Arguments* arguments)
-    {
-        u.arguments = arguments;
-    }
-
     ALWAYS_INLINE Register::Register(JSActivation* activation)
     {
         u.activation = activation;
@@ -151,9 +129,9 @@ namespace JSC {
         u.codeBlock = codeBlock;
     }
 
-    ALWAYS_INLINE Register::Register(JSObject* object)
+    ALWAYS_INLINE Register::Register(JSFunction* function)
     {
-        u.object = object;
+        u.function = function;
     }
 
     ALWAYS_INLINE Register::Register(Instruction* vPC)
@@ -171,35 +149,21 @@ namespace JSC {
         u.propertyNameIterator = propertyNameIterator;
     }
 
-    ALWAYS_INLINE Register::Register(intptr_t i)
+    ALWAYS_INLINE Register::Register(int32_t i)
     {
-        // See comment on 'i()' below.
-        ASSERT(i == static_cast<int32_t>(i));
         u.i = i;
     }
 
-    // Read 'i' as a 32-bit integer; we only use it to hold 32-bit values,
-    // and we only write 32-bits when writing the arg count from JIT code.
     ALWAYS_INLINE int32_t Register::i() const
     {
-        return static_cast<int32_t>(u.i);
+        return u.i;
     }
     
-    ALWAYS_INLINE void* Register::v() const
-    {
-        return u.v;
-    }
-
     ALWAYS_INLINE JSActivation* Register::activation() const
     {
         return u.activation;
     }
     
-    ALWAYS_INLINE Arguments* Register::arguments() const
-    {
-        return u.arguments;
-    }
-    
     ALWAYS_INLINE CallFrame* Register::callFrame() const
     {
         return u.callFrame;
@@ -210,9 +174,9 @@ namespace JSC {
         return u.codeBlock;
     }
     
-    ALWAYS_INLINE JSObject* Register::object() const
+    ALWAYS_INLINE JSFunction* Register::function() const
     {
-        return u.object;
+        return u.function;
     }
     
     ALWAYS_INLINE JSPropertyNameIterator* Register::propertyNameIterator() const
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.cpp b/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.cpp
index de5175e..06ddefc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.cpp
@@ -34,11 +34,8 @@ namespace JSC {
 RegisterFile::~RegisterFile()
 {
 #if HAVE(MMAP)
-    munmap(reinterpret_cast<char*>(m_buffer), ((m_max - m_start) + m_maxGlobals) * sizeof(Register));
+    munmap(m_buffer, ((m_max - m_start) + m_maxGlobals) * sizeof(Register));
 #elif HAVE(VIRTUALALLOC)
-#if PLATFORM(WINCE)
-    VirtualFree(m_buffer, DWORD(m_commitEnd) - DWORD(m_buffer), MEM_DECOMMIT);
-#endif
     VirtualFree(m_buffer, 0, MEM_RELEASE);
 #else
     fastFree(m_buffer);
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.h
index 14e189e..953c70f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -105,7 +105,7 @@ namespace JSC {
             ReturnValueRegister = -4,
             ArgumentCount = -3,
             Callee = -2,
-            OptionalCalleeArguments = -1
+            OptionalCalleeArguments = -1,
         };
 
         enum { ProgramCodeThisRegister = -CallFrameHeaderSize - 1 };
@@ -136,8 +136,8 @@ namespace JSC {
 
         Register* lastGlobal() const { return m_start - m_numGlobals; }
         
-        void markGlobals(Heap* heap) { heap->markConservatively(lastGlobal(), m_start); }
-        void markCallFrames(Heap* heap) { heap->markConservatively(m_start, m_end); }
+        void markGlobals(MarkStack& markStack, Heap* heap) { heap->markConservatively(markStack, lastGlobal(), m_start); }
+        void markCallFrames(MarkStack& markStack, Heap* heap) { heap->markConservatively(markStack, m_start, m_end); }
 
     private:
         void releaseExcessCapacity();
@@ -174,7 +174,7 @@ namespace JSC {
 
         size_t bufferLength = (capacity + maxGlobals) * sizeof(Register);
     #if HAVE(MMAP)
-        m_buffer = reinterpret_cast<Register*>(mmap(0, bufferLength, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, VM_TAG_FOR_REGISTERFILE_MEMORY, 0));
+        m_buffer = static_cast<Register*>(mmap(0, bufferLength, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, VM_TAG_FOR_REGISTERFILE_MEMORY, 0));
         if (m_buffer == MAP_FAILED) {
 #if PLATFORM(WINCE)
             fprintf(stderr, "Could not allocate register file: %d\n", GetLastError());
@@ -204,7 +204,15 @@ namespace JSC {
             CRASH();
         }
         m_commitEnd = reinterpret_cast<Register*>(reinterpret_cast<char*>(m_buffer) + committedSize);
-    #else // Neither MMAP nor VIRTUALALLOC - use fastMalloc instead
+    #else 
+        /* 
+         * If neither MMAP nor VIRTUALALLOC are available - use fastMalloc instead.
+         *
+         * Please note that this is the fallback case, which is non-optimal.
+         * If any possible, the platform should provide for a better memory
+         * allocation mechanism that allows for "lazy commit" or dynamic
+         * pre-allocation, similar to mmap or VirtualAlloc, to avoid waste of memory.
+         */
         m_buffer = static_cast<Register*>(fastMalloc(bufferLength));
     #endif
         m_start = m_buffer + maxGlobals;
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
index 4ed47e3..51ada03 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
@@ -38,6 +38,10 @@
 #include <sys/mman.h>
 #endif
 
+#if PLATFORM(SYMBIAN)
+#include <e32std.h>
+#endif
+
 #define JIT_ALLOCATOR_PAGE_SIZE (ExecutableAllocator::pageSize)
 #define JIT_ALLOCATOR_LARGE_ALLOC_SIZE (ExecutableAllocator::pageSize * 4)
 
@@ -182,6 +186,11 @@ public:
         sys_dcache_flush(code, size);
         sys_icache_invalidate(code, size);
     }
+#elif PLATFORM(SYMBIAN)
+    static void cacheFlush(void* code, size_t size)
+    {
+        User::IMB_Range(code, static_cast<char*>(code) + size);
+    }
 #elif PLATFORM(ARM)
     static void cacheFlush(void* code, size_t size)
     {
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp
index 4bd5a2c..13a8626 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp
@@ -44,7 +44,10 @@ void ExecutableAllocator::intializePageSize()
 
 ExecutablePool::Allocation ExecutablePool::systemAlloc(size_t n)
 {
-    ExecutablePool::Allocation alloc = { reinterpret_cast<char*>(mmap(NULL, n, INITIAL_PROTECTION_FLAGS, MAP_PRIVATE | MAP_ANON, VM_TAG_FOR_EXECUTABLEALLOCATOR_MEMORY, 0)), n };
+    void* allocation = mmap(NULL, n, INITIAL_PROTECTION_FLAGS, MAP_PRIVATE | MAP_ANON, VM_TAG_FOR_EXECUTABLEALLOCATOR_MEMORY, 0);
+    if (allocation == MAP_FAILED)
+        CRASH();
+    ExecutablePool::Allocation alloc = { reinterpret_cast<char*>(allocation), n };
     return alloc;
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorWin.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorWin.cpp
index a9ba7d0..e6ac855 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorWin.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorWin.cpp
@@ -42,7 +42,10 @@ void ExecutableAllocator::intializePageSize()
 
 ExecutablePool::Allocation ExecutablePool::systemAlloc(size_t n)
 {
-    ExecutablePool::Allocation alloc = {reinterpret_cast<char*>(VirtualAlloc(0, n, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE)), n};
+    void* allocation = VirtualAlloc(0, n, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
+    if (!allocation)
+        CRASH();
+    ExecutablePool::Allocation alloc = {reinterpret_cast<char*>(allocation), n};
     return alloc;
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
index a0e462b..bf3a418 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
@@ -37,6 +37,7 @@ JSC::MacroAssemblerX86Common::SSE2CheckState JSC::MacroAssemblerX86Common::s_sse
 #include "CodeBlock.h"
 #include "Interpreter.h"
 #include "JITInlineMethods.h"
+#include "JITStubs.h"
 #include "JITStubCall.h"
 #include "JSArray.h"
 #include "JSFunction.h"
@@ -79,51 +80,67 @@ JIT::JIT(JSGlobalData* globalData, CodeBlock* codeBlock)
     , m_propertyAccessCompilationInfo(codeBlock ? codeBlock->numberOfStructureStubInfos() : 0)
     , m_callStructureStubCompilationInfo(codeBlock ? codeBlock->numberOfCallLinkInfos() : 0)
     , m_bytecodeIndex((unsigned)-1)
+#if USE(JSVALUE32_64)
+    , m_jumpTargetIndex(0)
+    , m_mappedBytecodeIndex((unsigned)-1)
+    , m_mappedVirtualRegisterIndex((unsigned)-1)
+    , m_mappedTag((RegisterID)-1)
+    , m_mappedPayload((RegisterID)-1)
+#else
     , m_lastResultBytecodeRegister(std::numeric_limits<int>::max())
     , m_jumpTargetsPosition(0)
+#endif
 {
 }
 
-void JIT::compileOpStrictEq(Instruction* currentInstruction, CompileOpStrictEqType type)
+#if USE(JSVALUE32_64)
+void JIT::emitTimeoutCheck()
 {
-    unsigned dst = currentInstruction[1].u.operand;
-    unsigned src1 = currentInstruction[2].u.operand;
-    unsigned src2 = currentInstruction[3].u.operand;
-
-    emitGetVirtualRegisters(src1, regT0, src2, regT1);
-
-    // Jump to a slow case if either operand is a number, or if both are JSCell*s.
-    move(regT0, regT2);
-    orPtr(regT1, regT2);
-    addSlowCase(emitJumpIfJSCell(regT2));
-    addSlowCase(emitJumpIfImmediateNumber(regT2));
-
-    if (type == OpStrictEq)
-        set32(Equal, regT1, regT0, regT0);
-    else
-        set32(NotEqual, regT1, regT0, regT0);
-    emitTagAsBoolImmediate(regT0);
-
-    emitPutVirtualRegister(dst);
+    Jump skipTimeout = branchSub32(NonZero, Imm32(1), timeoutCheckRegister);
+    JITStubCall stubCall(this, cti_timeout_check);
+    stubCall.addArgument(regT1, regT0); // save last result registers.
+    stubCall.call(timeoutCheckRegister);
+    stubCall.getArgument(0, regT1, regT0); // reload last result registers.
+    skipTimeout.link(this);
 }
-
+#else
 void JIT::emitTimeoutCheck()
 {
     Jump skipTimeout = branchSub32(NonZero, Imm32(1), timeoutCheckRegister);
-    JITStubCall(this, JITStubs::cti_timeout_check).call(timeoutCheckRegister);
+    JITStubCall(this, cti_timeout_check).call(timeoutCheckRegister);
     skipTimeout.link(this);
 
     killLastResultRegister();
 }
-
+#endif
 
 #define NEXT_OPCODE(name) \
     m_bytecodeIndex += OPCODE_LENGTH(name); \
     break;
 
+#if USE(JSVALUE32_64)
 #define DEFINE_BINARY_OP(name) \
     case name: { \
-        JITStubCall stubCall(this, JITStubs::cti_##name); \
+        JITStubCall stubCall(this, cti_##name); \
+        stubCall.addArgument(currentInstruction[2].u.operand); \
+        stubCall.addArgument(currentInstruction[3].u.operand); \
+        stubCall.call(currentInstruction[1].u.operand); \
+        NEXT_OPCODE(name); \
+    }
+
+#define DEFINE_UNARY_OP(name) \
+    case name: { \
+        JITStubCall stubCall(this, cti_##name); \
+        stubCall.addArgument(currentInstruction[2].u.operand); \
+        stubCall.call(currentInstruction[1].u.operand); \
+        NEXT_OPCODE(name); \
+    }
+
+#else // USE(JSVALUE32_64)
+
+#define DEFINE_BINARY_OP(name) \
+    case name: { \
+        JITStubCall stubCall(this, cti_##name); \
         stubCall.addArgument(currentInstruction[2].u.operand, regT2); \
         stubCall.addArgument(currentInstruction[3].u.operand, regT2); \
         stubCall.call(currentInstruction[1].u.operand); \
@@ -132,11 +149,12 @@ void JIT::emitTimeoutCheck()
 
 #define DEFINE_UNARY_OP(name) \
     case name: { \
-        JITStubCall stubCall(this, JITStubs::cti_##name); \
+        JITStubCall stubCall(this, cti_##name); \
         stubCall.addArgument(currentInstruction[2].u.operand, regT2); \
         stubCall.call(currentInstruction[1].u.operand); \
         NEXT_OPCODE(name); \
     }
+#endif // USE(JSVALUE32_64)
 
 #define DEFINE_OP(name) \
     case name: { \
@@ -168,14 +186,18 @@ void JIT::privateCompileMainPass()
             sampleInstruction(currentInstruction);
 #endif
 
+#if !USE(JSVALUE32_64)
         if (m_labels[m_bytecodeIndex].isUsed())
             killLastResultRegister();
-        
+#endif
+
         m_labels[m_bytecodeIndex] = label();
 
         switch (m_interpreter->getOpcodeID(currentInstruction->u.opcode)) {
         DEFINE_BINARY_OP(op_del_by_val)
+#if !USE(JSVALUE32_64)
         DEFINE_BINARY_OP(op_div)
+#endif
         DEFINE_BINARY_OP(op_in)
         DEFINE_BINARY_OP(op_less)
         DEFINE_BINARY_OP(op_lesseq)
@@ -187,7 +209,9 @@ void JIT::privateCompileMainPass()
         DEFINE_UNARY_OP(op_is_object)
         DEFINE_UNARY_OP(op_is_string)
         DEFINE_UNARY_OP(op_is_undefined)
+#if !USE(JSVALUE32_64)
         DEFINE_UNARY_OP(op_negate)
+#endif
         DEFINE_UNARY_OP(op_typeof)
 
         DEFINE_OP(op_add)
@@ -206,6 +230,9 @@ void JIT::privateCompileMainPass()
         DEFINE_OP(op_create_arguments)
         DEFINE_OP(op_debug)
         DEFINE_OP(op_del_by_id)
+#if USE(JSVALUE32_64)
+        DEFINE_OP(op_div)
+#endif
         DEFINE_OP(op_end)
         DEFINE_OP(op_enter)
         DEFINE_OP(op_enter_with_activation)
@@ -236,6 +263,9 @@ void JIT::privateCompileMainPass()
         DEFINE_OP(op_mod)
         DEFINE_OP(op_mov)
         DEFINE_OP(op_mul)
+#if USE(JSVALUE32_64)
+        DEFINE_OP(op_negate)
+#endif
         DEFINE_OP(op_neq)
         DEFINE_OP(op_neq_null)
         DEFINE_OP(op_new_array)
@@ -265,7 +295,6 @@ void JIT::privateCompileMainPass()
         DEFINE_OP(op_put_setter)
         DEFINE_OP(op_resolve)
         DEFINE_OP(op_resolve_base)
-        DEFINE_OP(op_resolve_func)
         DEFINE_OP(op_resolve_global)
         DEFINE_OP(op_resolve_skip)
         DEFINE_OP(op_resolve_with_base)
@@ -322,11 +351,15 @@ void JIT::privateCompileSlowCases()
     Instruction* instructionsBegin = m_codeBlock->instructions().begin();
 
     m_propertyAccessInstructionIndex = 0;
+#if USE(JSVALUE32_64)
+    m_globalResolveInfoIndex = 0;
+#endif
     m_callLinkInfoIndex = 0;
 
     for (Vector<SlowCaseEntry>::iterator iter = m_slowCases.begin(); iter != m_slowCases.end();) {
-        // FIXME: enable peephole optimizations for slow cases when applicable
+#if !USE(JSVALUE32_64)
         killLastResultRegister();
+#endif
 
         m_bytecodeIndex = iter->to;
 #ifndef NDEBUG
@@ -346,6 +379,9 @@ void JIT::privateCompileSlowCases()
         DEFINE_SLOWCASE_OP(op_construct)
         DEFINE_SLOWCASE_OP(op_construct_verify)
         DEFINE_SLOWCASE_OP(op_convert_this)
+#if USE(JSVALUE32_64)
+        DEFINE_SLOWCASE_OP(op_div)
+#endif
         DEFINE_SLOWCASE_OP(op_eq)
         DEFINE_SLOWCASE_OP(op_get_by_id)
         DEFINE_SLOWCASE_OP(op_get_by_val)
@@ -358,9 +394,12 @@ void JIT::privateCompileSlowCases()
         DEFINE_SLOWCASE_OP(op_loop_if_lesseq)
         DEFINE_SLOWCASE_OP(op_loop_if_true)
         DEFINE_SLOWCASE_OP(op_lshift)
+        DEFINE_SLOWCASE_OP(op_method_check)
         DEFINE_SLOWCASE_OP(op_mod)
         DEFINE_SLOWCASE_OP(op_mul)
-        DEFINE_SLOWCASE_OP(op_method_check)
+#if USE(JSVALUE32_64)
+        DEFINE_SLOWCASE_OP(op_negate)
+#endif
         DEFINE_SLOWCASE_OP(op_neq)
         DEFINE_SLOWCASE_OP(op_not)
         DEFINE_SLOWCASE_OP(op_nstricteq)
@@ -370,6 +409,9 @@ void JIT::privateCompileSlowCases()
         DEFINE_SLOWCASE_OP(op_pre_inc)
         DEFINE_SLOWCASE_OP(op_put_by_id)
         DEFINE_SLOWCASE_OP(op_put_by_val)
+#if USE(JSVALUE32_64)
+        DEFINE_SLOWCASE_OP(op_resolve_global)
+#endif
         DEFINE_SLOWCASE_OP(op_rshift)
         DEFINE_SLOWCASE_OP(op_stricteq)
         DEFINE_SLOWCASE_OP(op_sub)
@@ -396,7 +438,7 @@ void JIT::privateCompileSlowCases()
 #endif
 }
 
-void JIT::privateCompile()
+JITCode JIT::privateCompile()
 {
     sampleCodeBlock(m_codeBlock);
 #if ENABLE(OPCODE_SAMPLING)
@@ -427,7 +469,7 @@ void JIT::privateCompile()
     if (m_codeBlock->codeType() == FunctionCode) {
         slowRegisterFileCheck.link(this);
         m_bytecodeIndex = 0;
-        JITStubCall(this, JITStubs::cti_register_file_check).call();
+        JITStubCall(this, cti_register_file_check).call();
 #ifndef NDEBUG
         m_bytecodeIndex = (unsigned)-1; // Reset this, in order to guard its use with ASSERTs.
 #endif
@@ -510,389 +552,10 @@ void JIT::privateCompile()
         info.callReturnLocation = m_codeBlock->structureStubInfo(m_methodCallCompilationInfo[i].propertyAccessIndex).callReturnLocation;
     }
 
-    m_codeBlock->setJITCode(patchBuffer.finalizeCode());
-}
-
-void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* globalData, CodePtr* ctiArrayLengthTrampoline, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallPreLink, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk)
-{
-#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-    // (1) The first function provides fast property access for array length
-    Label arrayLengthBegin = align();
-
-    // Check eax is an array
-    Jump array_failureCases1 = emitJumpIfNotJSCell(regT0);
-    Jump array_failureCases2 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr));
-
-    // Checks out okay! - get the length from the storage
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT0);
-    load32(Address(regT0, OBJECT_OFFSETOF(ArrayStorage, m_length)), regT0);
-
-    Jump array_failureCases3 = branch32(Above, regT0, Imm32(JSImmediate::maxImmediateInt));
-
-    // regT0 contains a 64 bit value (is positive, is zero extended) so we don't need sign extend here.
-    emitFastArithIntToImmNoCheck(regT0, regT0);
-
-    ret();
-
-    // (2) The second function provides fast property access for string length
-    Label stringLengthBegin = align();
-
-    // Check eax is a string
-    Jump string_failureCases1 = emitJumpIfNotJSCell(regT0);
-    Jump string_failureCases2 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr));
-
-    // Checks out okay! - get the length from the Ustring.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSString, m_value) + OBJECT_OFFSETOF(UString, m_rep)), regT0);
-    load32(Address(regT0, OBJECT_OFFSETOF(UString::Rep, len)), regT0);
-
-    Jump string_failureCases3 = branch32(Above, regT0, Imm32(JSImmediate::maxImmediateInt));
-
-    // regT0 contains a 64 bit value (is positive, is zero extended) so we don't need sign extend here.
-    emitFastArithIntToImmNoCheck(regT0, regT0);
-    
-    ret();
-#endif
-
-    // (3) Trampolines for the slow cases of op_call / op_call_eval / op_construct.
-    COMPILE_ASSERT(sizeof(CodeType) == 4, CodeTypeEnumMustBe32Bit);
-
-    Label virtualCallPreLinkBegin = align();
-
-    // Load the callee CodeBlock* into eax
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_body)), regT3);
-    loadPtr(Address(regT3, OBJECT_OFFSETOF(FunctionBodyNode, m_code)), regT0);
-    Jump hasCodeBlock1 = branchTestPtr(NonZero, regT0);
-    preserveReturnAddressAfterCall(regT3);
-    restoreArgumentReference();
-    Call callJSFunction1 = call();
-    emitGetJITStubArg(1, regT2);
-    emitGetJITStubArg(3, regT1);
-    restoreReturnAddressBeforeReturn(regT3);
-    hasCodeBlock1.link(this);
-
-    Jump isNativeFunc1 = branch32(Equal, Address(regT0, OBJECT_OFFSETOF(CodeBlock, m_codeType)), Imm32(NativeCode));
-
-    // Check argCount matches callee arity.
-    Jump arityCheckOkay1 = branch32(Equal, Address(regT0, OBJECT_OFFSETOF(CodeBlock, m_numParameters)), regT1);
-    preserveReturnAddressAfterCall(regT3);
-    emitPutJITStubArg(regT3, 2);
-    emitPutJITStubArg(regT0, 4);
-    restoreArgumentReference();
-    Call callArityCheck1 = call();
-    move(regT1, callFrameRegister);
-    emitGetJITStubArg(1, regT2);
-    emitGetJITStubArg(3, regT1);
-    restoreReturnAddressBeforeReturn(regT3);
-    arityCheckOkay1.link(this);
-    isNativeFunc1.link(this);
-    
-    compileOpCallInitializeCallFrame();
-
-    preserveReturnAddressAfterCall(regT3);
-    emitPutJITStubArg(regT3, 2);
-    restoreArgumentReference();
-    Call callDontLazyLinkCall = call();
-    emitGetJITStubArg(1, regT2);
-    restoreReturnAddressBeforeReturn(regT3);
-
-    jump(regT0);
-
-    Label virtualCallLinkBegin = align();
-
-    // Load the callee CodeBlock* into eax
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_body)), regT3);
-    loadPtr(Address(regT3, OBJECT_OFFSETOF(FunctionBodyNode, m_code)), regT0);
-    Jump hasCodeBlock2 = branchTestPtr(NonZero, regT0);
-    preserveReturnAddressAfterCall(regT3);
-    restoreArgumentReference();
-    Call callJSFunction2 = call();
-    emitGetJITStubArg(1, regT2);
-    emitGetJITStubArg(3, regT1);
-    restoreReturnAddressBeforeReturn(regT3);
-    hasCodeBlock2.link(this);
-
-    Jump isNativeFunc2 = branch32(Equal, Address(regT0, OBJECT_OFFSETOF(CodeBlock, m_codeType)), Imm32(NativeCode));
-
-    // Check argCount matches callee arity.
-    Jump arityCheckOkay2 = branch32(Equal, Address(regT0, OBJECT_OFFSETOF(CodeBlock, m_numParameters)), regT1);
-    preserveReturnAddressAfterCall(regT3);
-    emitPutJITStubArg(regT3, 2);
-    emitPutJITStubArg(regT0, 4);
-    restoreArgumentReference();
-    Call callArityCheck2 = call();
-    move(regT1, callFrameRegister);
-    emitGetJITStubArg(1, regT2);
-    emitGetJITStubArg(3, regT1);
-    restoreReturnAddressBeforeReturn(regT3);
-    arityCheckOkay2.link(this);
-    isNativeFunc2.link(this);
-
-    compileOpCallInitializeCallFrame();
-
-    preserveReturnAddressAfterCall(regT3);
-    emitPutJITStubArg(regT3, 2);
-    restoreArgumentReference();
-    Call callLazyLinkCall = call();
-    restoreReturnAddressBeforeReturn(regT3);
-
-    jump(regT0);
-
-    Label virtualCallBegin = align();
-
-    // Load the callee CodeBlock* into eax
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_body)), regT3);
-    loadPtr(Address(regT3, OBJECT_OFFSETOF(FunctionBodyNode, m_code)), regT0);
-    Jump hasCodeBlock3 = branchTestPtr(NonZero, regT0);
-    preserveReturnAddressAfterCall(regT3);
-    restoreArgumentReference();
-    Call callJSFunction3 = call();
-    emitGetJITStubArg(1, regT2);
-    emitGetJITStubArg(3, regT1);
-    restoreReturnAddressBeforeReturn(regT3);
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_body)), regT3); // reload the function body nody, so we can reload the code pointer.
-    hasCodeBlock3.link(this);
-    
-    Jump isNativeFunc3 = branch32(Equal, Address(regT0, OBJECT_OFFSETOF(CodeBlock, m_codeType)), Imm32(NativeCode));
-
-    // Check argCount matches callee arity.
-    Jump arityCheckOkay3 = branch32(Equal, Address(regT0, OBJECT_OFFSETOF(CodeBlock, m_numParameters)), regT1);
-    preserveReturnAddressAfterCall(regT3);
-    emitPutJITStubArg(regT3, 2);
-    emitPutJITStubArg(regT0, 4);
-    restoreArgumentReference();
-    Call callArityCheck3 = call();
-    move(regT1, callFrameRegister);
-    emitGetJITStubArg(1, regT2);
-    emitGetJITStubArg(3, regT1);
-    restoreReturnAddressBeforeReturn(regT3);
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_body)), regT3); // reload the function body nody, so we can reload the code pointer.
-    arityCheckOkay3.link(this);
-    isNativeFunc3.link(this);
-
-    // load ctiCode from the new codeBlock.
-    loadPtr(Address(regT3, OBJECT_OFFSETOF(FunctionBodyNode, m_jitCode)), regT0);
-    
-    compileOpCallInitializeCallFrame();
-    jump(regT0);
-
-    
-    Label nativeCallThunk = align();
-    preserveReturnAddressAfterCall(regT0);
-    emitPutToCallFrameHeader(regT0, RegisterFile::ReturnPC); // Push return address
-
-    // Load caller frame's scope chain into this callframe so that whatever we call can
-    // get to its global data.
-    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT1);
-    emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT1);
-    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
-    
-
-#if PLATFORM(X86_64)
-    emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, X86::ecx);
-
-    // Allocate stack space for our arglist
-    subPtr(Imm32(sizeof(ArgList)), stackPointerRegister);
-    COMPILE_ASSERT((sizeof(ArgList) & 0xf) == 0, ArgList_should_by_16byte_aligned);
-    
-    // Set up arguments
-    subPtr(Imm32(1), X86::ecx); // Don't include 'this' in argcount
-
-    // Push argcount
-    storePtr(X86::ecx, Address(stackPointerRegister, OBJECT_OFFSETOF(ArgList, m_argCount)));
-
-    // Calculate the start of the callframe header, and store in edx
-    addPtr(Imm32(-RegisterFile::CallFrameHeaderSize * (int32_t)sizeof(Register)), callFrameRegister, X86::edx);
-    
-    // Calculate start of arguments as callframe header - sizeof(Register) * argcount (ecx)
-    mul32(Imm32(sizeof(Register)), X86::ecx, X86::ecx);
-    subPtr(X86::ecx, X86::edx);
-
-    // push pointer to arguments
-    storePtr(X86::edx, Address(stackPointerRegister, OBJECT_OFFSETOF(ArgList, m_args)));
-    
-    // ArgList is passed by reference so is stackPointerRegister
-    move(stackPointerRegister, X86::ecx);
-    
-    // edx currently points to the first argument, edx-sizeof(Register) points to 'this'
-    loadPtr(Address(X86::edx, -(int32_t)sizeof(Register)), X86::edx);
-    
-    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86::esi);
-
-    move(callFrameRegister, X86::edi); 
-
-    call(Address(X86::esi, OBJECT_OFFSETOF(JSFunction, m_data)));
-    
-    addPtr(Imm32(sizeof(ArgList)), stackPointerRegister);
-#elif PLATFORM(X86)
-    emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
-
-    /* We have two structs that we use to describe the stackframe we set up for our
-     * call to native code.  NativeCallFrameStructure describes the how we set up the stack
-     * in advance of the call.  NativeFunctionCalleeSignature describes the callframe
-     * as the native code expects it.  We do this as we are using the fastcall calling
-     * convention which results in the callee popping its arguments off the stack, but
-     * not the rest of the callframe so we need a nice way to ensure we increment the
-     * stack pointer by the right amount after the call.
-     */
-#if COMPILER(MSVC) || PLATFORM(LINUX)
-    struct NativeCallFrameStructure {
-      //  CallFrame* callFrame; // passed in EDX
-        JSObject* callee;
-        JSValue thisValue;
-        ArgList* argPointer;
-        ArgList args;
-        JSValue result;
-    };
-    struct NativeFunctionCalleeSignature {
-        JSObject* callee;
-        JSValue thisValue;
-        ArgList* argPointer;
-    };
-#else
-    struct NativeCallFrameStructure {
-      //  CallFrame* callFrame; // passed in ECX
-      //  JSObject* callee; // passed in EDX
-        JSValue thisValue;
-        ArgList* argPointer;
-        ArgList args;
-    };
-    struct NativeFunctionCalleeSignature {
-        JSValue thisValue;
-        ArgList* argPointer;
-    };
-#endif
-    const int NativeCallFrameSize = (sizeof(NativeCallFrameStructure) + 15) & ~15;
-    // Allocate system stack frame
-    subPtr(Imm32(NativeCallFrameSize), stackPointerRegister);
-
-    // Set up arguments
-    subPtr(Imm32(1), regT0); // Don't include 'this' in argcount
-
-    // push argcount
-    storePtr(regT0, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, args) + OBJECT_OFFSETOF(ArgList, m_argCount)));
-    
-    // Calculate the start of the callframe header, and store in regT1
-    addPtr(Imm32(-RegisterFile::CallFrameHeaderSize * (int)sizeof(Register)), callFrameRegister, regT1);
-    
-    // Calculate start of arguments as callframe header - sizeof(Register) * argcount (regT0)
-    mul32(Imm32(sizeof(Register)), regT0, regT0);
-    subPtr(regT0, regT1);
-    storePtr(regT1, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, args) + OBJECT_OFFSETOF(ArgList, m_args)));
-
-    // ArgList is passed by reference so is stackPointerRegister + 4 * sizeof(Register)
-    addPtr(Imm32(OBJECT_OFFSETOF(NativeCallFrameStructure, args)), stackPointerRegister, regT0);
-    storePtr(regT0, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, argPointer)));
-
-    // regT1 currently points to the first argument, regT1 - sizeof(Register) points to 'this'
-    loadPtr(Address(regT1, -(int)sizeof(Register)), regT1);
-    storePtr(regT1, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, thisValue)));
-
-#if COMPILER(MSVC) || PLATFORM(LINUX)
-    // ArgList is passed by reference so is stackPointerRegister + 4 * sizeof(Register)
-    addPtr(Imm32(OBJECT_OFFSETOF(NativeCallFrameStructure, result)), stackPointerRegister, X86::ecx);
-
-    // Plant callee
-    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86::eax);
-    storePtr(X86::eax, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, callee)));
-
-    // Plant callframe
-    move(callFrameRegister, X86::edx);
-
-    call(Address(X86::eax, OBJECT_OFFSETOF(JSFunction, m_data)));
-
-    // JSValue is a non-POD type
-    loadPtr(Address(X86::eax), X86::eax);
-#else
-    // Plant callee
-    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86::edx);
-
-    // Plant callframe
-    move(callFrameRegister, X86::ecx);
-    call(Address(X86::edx, OBJECT_OFFSETOF(JSFunction, m_data)));
-#endif
-
-    // We've put a few temporaries on the stack in addition to the actual arguments
-    // so pull them off now
-    addPtr(Imm32(NativeCallFrameSize - sizeof(NativeFunctionCalleeSignature)), stackPointerRegister);
-
-#elif ENABLE(JIT_OPTIMIZE_NATIVE_CALL)
-#error "JIT_OPTIMIZE_NATIVE_CALL not yet supported on this platform."
-#else
-    breakpoint();
-#endif
-
-    // Check for an exception
-    loadPtr(&(globalData->exception), regT2);
-    Jump exceptionHandler = branchTestPtr(NonZero, regT2);
-
-    // Grab the return address.
-    emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
-    
-    // Restore our caller's "r".
-    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
-    
-    // Return.
-    restoreReturnAddressBeforeReturn(regT1);
-    ret();
-
-    // Handle an exception
-    exceptionHandler.link(this);
-    // Grab the return address.
-    emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
-    move(ImmPtr(&globalData->exceptionLocation), regT2);
-    storePtr(regT1, regT2);
-    move(ImmPtr(reinterpret_cast<void*>(ctiVMThrowTrampoline)), regT2);
-    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
-    poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof (void*));
-    restoreReturnAddressBeforeReturn(regT2);
-    ret();
-    
-
-#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-    Call array_failureCases1Call = makeTailRecursiveCall(array_failureCases1);
-    Call array_failureCases2Call = makeTailRecursiveCall(array_failureCases2);
-    Call array_failureCases3Call = makeTailRecursiveCall(array_failureCases3);
-    Call string_failureCases1Call = makeTailRecursiveCall(string_failureCases1);
-    Call string_failureCases2Call = makeTailRecursiveCall(string_failureCases2);
-    Call string_failureCases3Call = makeTailRecursiveCall(string_failureCases3);
-#endif
-
-    // All trampolines constructed! copy the code, link up calls, and set the pointers on the Machine object.
-    LinkBuffer patchBuffer(this, m_globalData->executableAllocator.poolForSize(m_assembler.size()));
-
-#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-    patchBuffer.link(array_failureCases1Call, FunctionPtr(JITStubs::cti_op_get_by_id_array_fail));
-    patchBuffer.link(array_failureCases2Call, FunctionPtr(JITStubs::cti_op_get_by_id_array_fail));
-    patchBuffer.link(array_failureCases3Call, FunctionPtr(JITStubs::cti_op_get_by_id_array_fail));
-    patchBuffer.link(string_failureCases1Call, FunctionPtr(JITStubs::cti_op_get_by_id_string_fail));
-    patchBuffer.link(string_failureCases2Call, FunctionPtr(JITStubs::cti_op_get_by_id_string_fail));
-    patchBuffer.link(string_failureCases3Call, FunctionPtr(JITStubs::cti_op_get_by_id_string_fail));
-#endif
-    patchBuffer.link(callArityCheck1, FunctionPtr(JITStubs::cti_op_call_arityCheck));
-    patchBuffer.link(callArityCheck2, FunctionPtr(JITStubs::cti_op_call_arityCheck));
-    patchBuffer.link(callArityCheck3, FunctionPtr(JITStubs::cti_op_call_arityCheck));
-    patchBuffer.link(callJSFunction1, FunctionPtr(JITStubs::cti_op_call_JSFunction));
-    patchBuffer.link(callJSFunction2, FunctionPtr(JITStubs::cti_op_call_JSFunction));
-    patchBuffer.link(callJSFunction3, FunctionPtr(JITStubs::cti_op_call_JSFunction));
-    patchBuffer.link(callDontLazyLinkCall, FunctionPtr(JITStubs::cti_vm_dontLazyLinkCall));
-    patchBuffer.link(callLazyLinkCall, FunctionPtr(JITStubs::cti_vm_lazyLinkCall));
-
-    CodeRef finalCode = patchBuffer.finalizeCode();
-    *executablePool = finalCode.m_executablePool;
-
-    *ctiVirtualCallPreLink = trampolineAt(finalCode, virtualCallPreLinkBegin);
-    *ctiVirtualCallLink = trampolineAt(finalCode, virtualCallLinkBegin);
-    *ctiVirtualCall = trampolineAt(finalCode, virtualCallBegin);
-    *ctiNativeCallThunk = trampolineAt(finalCode, nativeCallThunk);
-#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-    *ctiArrayLengthTrampoline = trampolineAt(finalCode, arrayLengthBegin);
-    *ctiStringLengthTrampoline = trampolineAt(finalCode, stringLengthBegin);
-#else
-    UNUSED_PARAM(ctiArrayLengthTrampoline);
-    UNUSED_PARAM(ctiStringLengthTrampoline);
-#endif
+    return patchBuffer.finalizeCode();
 }
 
+#if !USE(JSVALUE32_64)
 void JIT::emitGetVariableObjectRegister(RegisterID variableObject, int index, RegisterID dst)
 {
     loadPtr(Address(variableObject, OBJECT_OFFSETOF(JSVariableObject, d)), dst);
@@ -906,24 +569,29 @@ void JIT::emitPutVariableObjectRegister(RegisterID src, RegisterID variableObjec
     loadPtr(Address(variableObject, OBJECT_OFFSETOF(JSVariableObject::JSVariableObjectData, registers)), variableObject);
     storePtr(src, Address(variableObject, index * sizeof(Register)));
 }
+#endif
 
+#if ENABLE(JIT_OPTIMIZE_CALL)
 void JIT::unlinkCall(CallLinkInfo* callLinkInfo)
 {
     // When the JSFunction is deleted the pointer embedded in the instruction stream will no longer be valid
     // (and, if a new JSFunction happened to be constructed at the same location, we could get a false positive
     // match).  Reset the check so it no longer matches.
-    RepatchBuffer repatchBuffer(callLinkInfo->ownerCodeBlock);
+    RepatchBuffer repatchBuffer(callLinkInfo->ownerCodeBlock.get());
+#if USE(JSVALUE32_64)
+    repatchBuffer.repatch(callLinkInfo->hotPathBegin, 0);
+#else
     repatchBuffer.repatch(callLinkInfo->hotPathBegin, JSValue::encode(JSValue()));
+#endif
 }
 
 void JIT::linkCall(JSFunction* callee, CodeBlock* callerCodeBlock, CodeBlock* calleeCodeBlock, JITCode& code, CallLinkInfo* callLinkInfo, int callerArgCount, JSGlobalData* globalData)
 {
-    ASSERT(calleeCodeBlock);
     RepatchBuffer repatchBuffer(callerCodeBlock);
 
     // Currently we only link calls with the exact number of arguments.
     // If this is a native call calleeCodeBlock is null so the number of parameters is unimportant
-    if (callerArgCount == calleeCodeBlock->m_numParameters || calleeCodeBlock->codeType() == NativeCode) {
+    if (!calleeCodeBlock || (callerArgCount == calleeCodeBlock->m_numParameters)) {
         ASSERT(!callLinkInfo->isLinked());
     
         if (calleeCodeBlock)
@@ -936,6 +604,7 @@ void JIT::linkCall(JSFunction* callee, CodeBlock* callerCodeBlock, CodeBlock* ca
     // patch the call so we do not continue to try to link.
     repatchBuffer.relink(callLinkInfo->callReturnLocation, globalData->jitStubs.ctiVirtualCall());
 }
+#endif // ENABLE(JIT_OPTIMIZE_CALL)
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
index ceffe59..f7ac20e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
@@ -28,11 +28,6 @@
 
 #include <wtf/Platform.h>
 
-// OBJECT_OFFSETOF: Like the C++ offsetof macro, but you can use it with classes.
-// The magic number 0x4000 is insignificant. We use it to avoid using NULL, since
-// NULL can cause compiler problems, especially in cases of multiple inheritance.
-#define OBJECT_OFFSETOF(class, field) (reinterpret_cast<ptrdiff_t>(&(reinterpret_cast<class*>(0x4000)->field)) - 0x4000)
-
 #if ENABLE(JIT)
 
 // We've run into some problems where changing the size of the class JIT leads to
@@ -64,14 +59,14 @@ namespace JSC {
     class Register;
     class RegisterFile;
     class ScopeChainNode;
-    class SimpleJumpTable;
-    class StringJumpTable;
     class StructureChain;
 
     struct CallLinkInfo;
     struct Instruction;
     struct OperandTypes;
     struct PolymorphicAccessStructureList;
+    struct SimpleJumpTable;
+    struct StringJumpTable;
     struct StructureStubInfo;
 
     struct CallRecord {
@@ -177,7 +172,6 @@ namespace JSC {
 
     class JIT : private MacroAssembler {
         friend class JITStubCall;
-        friend class CallEvalJITStub;
 
         using MacroAssembler::Jump;
         using MacroAssembler::JumpList;
@@ -197,57 +191,82 @@ namespace JSC {
         // MacroAssembler will need to plant register swaps if it is not -
         // however the code will still function correctly.
 #if PLATFORM(X86_64)
-        static const RegisterID returnValueRegister = X86::eax;
-        static const RegisterID cachedResultRegister = X86::eax;
-        static const RegisterID firstArgumentRegister = X86::edi;
-
-        static const RegisterID timeoutCheckRegister = X86::r12;
-        static const RegisterID callFrameRegister = X86::r13;
-        static const RegisterID tagTypeNumberRegister = X86::r14;
-        static const RegisterID tagMaskRegister = X86::r15;
-
-        static const RegisterID regT0 = X86::eax;
-        static const RegisterID regT1 = X86::edx;
-        static const RegisterID regT2 = X86::ecx;
-        static const RegisterID regT3 = X86::ebx;
-
-        static const FPRegisterID fpRegT0 = X86::xmm0;
-        static const FPRegisterID fpRegT1 = X86::xmm1;
-        static const FPRegisterID fpRegT2 = X86::xmm2;
+        static const RegisterID returnValueRegister = X86Registers::eax;
+        static const RegisterID cachedResultRegister = X86Registers::eax;
+        static const RegisterID firstArgumentRegister = X86Registers::edi;
+
+        static const RegisterID timeoutCheckRegister = X86Registers::r12;
+        static const RegisterID callFrameRegister = X86Registers::r13;
+        static const RegisterID tagTypeNumberRegister = X86Registers::r14;
+        static const RegisterID tagMaskRegister = X86Registers::r15;
+
+        static const RegisterID regT0 = X86Registers::eax;
+        static const RegisterID regT1 = X86Registers::edx;
+        static const RegisterID regT2 = X86Registers::ecx;
+        static const RegisterID regT3 = X86Registers::ebx;
+
+        static const FPRegisterID fpRegT0 = X86Registers::xmm0;
+        static const FPRegisterID fpRegT1 = X86Registers::xmm1;
+        static const FPRegisterID fpRegT2 = X86Registers::xmm2;
 #elif PLATFORM(X86)
-        static const RegisterID returnValueRegister = X86::eax;
-        static const RegisterID cachedResultRegister = X86::eax;
+        static const RegisterID returnValueRegister = X86Registers::eax;
+        static const RegisterID cachedResultRegister = X86Registers::eax;
         // On x86 we always use fastcall conventions = but on
         // OS X if might make more sense to just use regparm.
-        static const RegisterID firstArgumentRegister = X86::ecx;
+        static const RegisterID firstArgumentRegister = X86Registers::ecx;
 
-        static const RegisterID timeoutCheckRegister = X86::esi;
-        static const RegisterID callFrameRegister = X86::edi;
+        static const RegisterID timeoutCheckRegister = X86Registers::esi;
+        static const RegisterID callFrameRegister = X86Registers::edi;
 
-        static const RegisterID regT0 = X86::eax;
-        static const RegisterID regT1 = X86::edx;
-        static const RegisterID regT2 = X86::ecx;
-        static const RegisterID regT3 = X86::ebx;
+        static const RegisterID regT0 = X86Registers::eax;
+        static const RegisterID regT1 = X86Registers::edx;
+        static const RegisterID regT2 = X86Registers::ecx;
+        static const RegisterID regT3 = X86Registers::ebx;
 
-        static const FPRegisterID fpRegT0 = X86::xmm0;
-        static const FPRegisterID fpRegT1 = X86::xmm1;
-        static const FPRegisterID fpRegT2 = X86::xmm2;
+        static const FPRegisterID fpRegT0 = X86Registers::xmm0;
+        static const FPRegisterID fpRegT1 = X86Registers::xmm1;
+        static const FPRegisterID fpRegT2 = X86Registers::xmm2;
 #elif PLATFORM_ARM_ARCH(7)
-        static const RegisterID returnValueRegister = ARM::r0;
-        static const RegisterID cachedResultRegister = ARM::r0;
-        static const RegisterID firstArgumentRegister = ARM::r0;
-
-        static const RegisterID regT0 = ARM::r0;
-        static const RegisterID regT1 = ARM::r1;
-        static const RegisterID regT2 = ARM::r2;
-        static const RegisterID regT3 = ARM::r4;
-
-        static const RegisterID callFrameRegister = ARM::r5;
-        static const RegisterID timeoutCheckRegister = ARM::r6;
-
-        static const FPRegisterID fpRegT0 = ARM::d0;
-        static const FPRegisterID fpRegT1 = ARM::d1;
-        static const FPRegisterID fpRegT2 = ARM::d2;
+        static const RegisterID returnValueRegister = ARMRegisters::r0;
+        static const RegisterID cachedResultRegister = ARMRegisters::r0;
+        static const RegisterID firstArgumentRegister = ARMRegisters::r0;
+
+        static const RegisterID regT0 = ARMRegisters::r0;
+        static const RegisterID regT1 = ARMRegisters::r1;
+        static const RegisterID regT2 = ARMRegisters::r2;
+        static const RegisterID regT3 = ARMRegisters::r4;
+
+        static const RegisterID callFrameRegister = ARMRegisters::r5;
+        static const RegisterID timeoutCheckRegister = ARMRegisters::r6;
+
+        static const FPRegisterID fpRegT0 = ARMRegisters::d0;
+        static const FPRegisterID fpRegT1 = ARMRegisters::d1;
+        static const FPRegisterID fpRegT2 = ARMRegisters::d2;
+#elif PLATFORM(ARM)
+        static const RegisterID returnValueRegister = ARMRegisters::r0;
+        static const RegisterID cachedResultRegister = ARMRegisters::r0;
+        static const RegisterID firstArgumentRegister = ARMRegisters::r0;
+
+        static const RegisterID timeoutCheckRegister = ARMRegisters::r5;
+        static const RegisterID callFrameRegister = ARMRegisters::r4;
+        static const RegisterID ctiReturnRegister = ARMRegisters::r6;
+
+        static const RegisterID regT0 = ARMRegisters::r0;
+        static const RegisterID regT1 = ARMRegisters::r1;
+        static const RegisterID regT2 = ARMRegisters::r2;
+        // Callee preserved
+        static const RegisterID regT3 = ARMRegisters::r7;
+
+        static const RegisterID regS0 = ARMRegisters::S0;
+        // Callee preserved
+        static const RegisterID regS1 = ARMRegisters::S1;
+
+        static const RegisterID regStackPtr = ARMRegisters::sp;
+        static const RegisterID regLink = ARMRegisters::lr;
+
+        static const FPRegisterID fpRegT0 = ARMRegisters::d0;
+        static const FPRegisterID fpRegT1 = ARMRegisters::d1;
+        static const FPRegisterID fpRegT2 = ARMRegisters::d2;
 #else
     #error "JIT not supported on this platform."
 #endif
@@ -257,86 +276,10 @@ namespace JSC {
         // will compress the displacement, and we may not be able to fit a patched offset.
         static const int patchGetByIdDefaultOffset = 256;
 
-#if PLATFORM(X86_64)
-        // These architecture specific value are used to enable patching - see comment on op_put_by_id.
-        static const int patchOffsetPutByIdStructure = 10;
-        static const int patchOffsetPutByIdExternalLoad = 20;
-        static const int patchLengthPutByIdExternalLoad = 4;
-        static const int patchOffsetPutByIdPropertyMapOffset = 31;
-        // These architecture specific value are used to enable patching - see comment on op_get_by_id.
-        static const int patchOffsetGetByIdStructure = 10;
-        static const int patchOffsetGetByIdBranchToSlowCase = 20;
-        static const int patchOffsetGetByIdExternalLoad = 20;
-        static const int patchLengthGetByIdExternalLoad = 4;
-        static const int patchOffsetGetByIdPropertyMapOffset = 31;
-        static const int patchOffsetGetByIdPutResult = 31;
-#if ENABLE(OPCODE_SAMPLING)
-        static const int patchOffsetGetByIdSlowCaseCall = 66;
-#else
-        static const int patchOffsetGetByIdSlowCaseCall = 44;
-#endif
-        static const int patchOffsetOpCallCompareToJump = 9;
-
-        static const int patchOffsetMethodCheckProtoObj = 20;
-        static const int patchOffsetMethodCheckProtoStruct = 30;
-        static const int patchOffsetMethodCheckPutFunction = 50;
-#elif PLATFORM(X86)
-        // These architecture specific value are used to enable patching - see comment on op_put_by_id.
-        static const int patchOffsetPutByIdStructure = 7;
-        static const int patchOffsetPutByIdExternalLoad = 13;
-        static const int patchLengthPutByIdExternalLoad = 3;
-        static const int patchOffsetPutByIdPropertyMapOffset = 22;
-        // These architecture specific value are used to enable patching - see comment on op_get_by_id.
-        static const int patchOffsetGetByIdStructure = 7;
-        static const int patchOffsetGetByIdBranchToSlowCase = 13;
-        static const int patchOffsetGetByIdExternalLoad = 13;
-        static const int patchLengthGetByIdExternalLoad = 3;
-        static const int patchOffsetGetByIdPropertyMapOffset = 22;
-        static const int patchOffsetGetByIdPutResult = 22;
-#if ENABLE(OPCODE_SAMPLING) && USE(JIT_STUB_ARGUMENT_VA_LIST)
-        static const int patchOffsetGetByIdSlowCaseCall = 31;
-#elif ENABLE(OPCODE_SAMPLING)
-        static const int patchOffsetGetByIdSlowCaseCall = 33;
-#elif USE(JIT_STUB_ARGUMENT_VA_LIST)
-        static const int patchOffsetGetByIdSlowCaseCall = 21;
-#else
-        static const int patchOffsetGetByIdSlowCaseCall = 23;
-#endif
-        static const int patchOffsetOpCallCompareToJump = 6;
-
-        static const int patchOffsetMethodCheckProtoObj = 11;
-        static const int patchOffsetMethodCheckProtoStruct = 18;
-        static const int patchOffsetMethodCheckPutFunction = 29;
-#elif PLATFORM_ARM_ARCH(7)
-        // These architecture specific value are used to enable patching - see comment on op_put_by_id.
-        static const int patchOffsetPutByIdStructure = 10;
-        static const int patchOffsetPutByIdExternalLoad = 20;
-        static const int patchLengthPutByIdExternalLoad = 12;
-        static const int patchOffsetPutByIdPropertyMapOffset = 40;
-        // These architecture specific value are used to enable patching - see comment on op_get_by_id.
-        static const int patchOffsetGetByIdStructure = 10;
-        static const int patchOffsetGetByIdBranchToSlowCase = 20;
-        static const int patchOffsetGetByIdExternalLoad = 20;
-        static const int patchLengthGetByIdExternalLoad = 12;
-        static const int patchOffsetGetByIdPropertyMapOffset = 40;
-        static const int patchOffsetGetByIdPutResult = 44;
-#if ENABLE(OPCODE_SAMPLING)
-        static const int patchOffsetGetByIdSlowCaseCall = 0; // FIMXE
-#else
-        static const int patchOffsetGetByIdSlowCaseCall = 28;
-#endif
-        static const int patchOffsetOpCallCompareToJump = 10;
-
-        static const int patchOffsetMethodCheckProtoObj = 18;
-        static const int patchOffsetMethodCheckProtoStruct = 28;
-        static const int patchOffsetMethodCheckPutFunction = 46;
-#endif
-
     public:
-        static void compile(JSGlobalData* globalData, CodeBlock* codeBlock)
+        static JITCode compile(JSGlobalData* globalData, CodeBlock* codeBlock)
         {
-            JIT jit(globalData, codeBlock);
-            jit.privateCompile();
+            return JIT(globalData, codeBlock).privateCompile();
         }
 
         static void compileGetByIdProto(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, ReturnAddressPtr returnAddress)
@@ -373,15 +316,15 @@ namespace JSC {
             jit.privateCompilePutByIdTransition(stubInfo, oldStructure, newStructure, cachedOffset, chain, returnAddress);
         }
 
-        static void compileCTIMachineTrampolines(JSGlobalData* globalData, RefPtr<ExecutablePool>* executablePool, CodePtr* ctiArrayLengthTrampoline, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallPreLink, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk)
+        static void compileCTIMachineTrampolines(JSGlobalData* globalData, RefPtr<ExecutablePool>* executablePool, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk)
         {
             JIT jit(globalData);
-            jit.privateCompileCTIMachineTrampolines(executablePool, globalData, ctiArrayLengthTrampoline, ctiStringLengthTrampoline, ctiVirtualCallPreLink, ctiVirtualCallLink, ctiVirtualCall, ctiNativeCallThunk);
+            jit.privateCompileCTIMachineTrampolines(executablePool, globalData, ctiStringLengthTrampoline, ctiVirtualCallLink, ctiVirtualCall, ctiNativeCallThunk);
         }
 
         static void patchGetByIdSelf(CodeBlock* codeblock, StructureStubInfo*, Structure*, size_t cachedOffset, ReturnAddressPtr returnAddress);
         static void patchPutByIdReplace(CodeBlock* codeblock, StructureStubInfo*, Structure*, size_t cachedOffset, ReturnAddressPtr returnAddress);
-        static void patchMethodCallProto(CodeBlock* codeblock, MethodCallLinkInfo&, JSFunction*, Structure*, JSObject*);
+        static void patchMethodCallProto(CodeBlock* codeblock, MethodCallLinkInfo&, JSFunction*, Structure*, JSObject*, ReturnAddressPtr);
 
         static void compilePatchGetArrayLength(JSGlobalData* globalData, CodeBlock* codeBlock, ReturnAddressPtr returnAddress)
         {
@@ -409,7 +352,7 @@ namespace JSC {
         void privateCompileMainPass();
         void privateCompileLinkPass();
         void privateCompileSlowCases();
-        void privateCompile();
+        JITCode privateCompile();
         void privateCompileGetByIdProto(StructureStubInfo*, Structure*, Structure* prototypeStructure, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame);
         void privateCompileGetByIdSelfList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, size_t cachedOffset);
         void privateCompileGetByIdProtoList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, Structure* prototypeStructure, size_t cachedOffset, CallFrame* callFrame);
@@ -417,17 +360,14 @@ namespace JSC {
         void privateCompileGetByIdChain(StructureStubInfo*, Structure*, StructureChain*, size_t count, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame);
         void privateCompilePutByIdTransition(StructureStubInfo*, Structure*, Structure*, size_t cachedOffset, StructureChain*, ReturnAddressPtr returnAddress);
 
-        void privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* data, CodePtr* ctiArrayLengthTrampoline, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallPreLink, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk);
+        void privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* data, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk);
         void privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress);
 
         void addSlowCase(Jump);
+        void addSlowCase(JumpList);
         void addJump(Jump, int);
         void emitJumpSlowToHot(Jump, int);
 
-#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-        void compileGetByIdHotPath(int resultVReg, int baseVReg, Identifier* ident, unsigned propertyAccessInstructionIndex);
-        void compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, unsigned propertyAccessInstructionIndex, bool isMethodCheck = false);
-#endif
         void compileOpCall(OpcodeID, Instruction* instruction, unsigned callLinkInfoIndex);
         void compileOpCallVarargs(Instruction* instruction);
         void compileOpCallInitializeCallFrame();
@@ -436,164 +376,428 @@ namespace JSC {
         void compileOpCallSlowCase(Instruction* instruction, Vector<SlowCaseEntry>::iterator& iter, unsigned callLinkInfoIndex, OpcodeID opcodeID);
         void compileOpCallVarargsSlowCase(Instruction* instruction, Vector<SlowCaseEntry>::iterator& iter);
         void compileOpConstructSetupArgs(Instruction*);
+
         enum CompileOpStrictEqType { OpStrictEq, OpNStrictEq };
         void compileOpStrictEq(Instruction* instruction, CompileOpStrictEqType type);
 
+#if USE(JSVALUE32_64)
+        Address tagFor(unsigned index, RegisterID base = callFrameRegister);
+        Address payloadFor(unsigned index, RegisterID base = callFrameRegister);
+        Address addressFor(unsigned index, RegisterID base = callFrameRegister);
+
+        bool getOperandConstantImmediateInt(unsigned op1, unsigned op2, unsigned& op, int32_t& constant);
+        bool isOperandConstantImmediateDouble(unsigned src);
+
+        void emitLoadTag(unsigned index, RegisterID tag);
+        void emitLoadPayload(unsigned index, RegisterID payload);
+
+        void emitLoad(const JSValue& v, RegisterID tag, RegisterID payload);
+        void emitLoad(unsigned index, RegisterID tag, RegisterID payload, RegisterID base = callFrameRegister);
+        void emitLoad2(unsigned index1, RegisterID tag1, RegisterID payload1, unsigned index2, RegisterID tag2, RegisterID payload2);
+        void emitLoadDouble(unsigned index, FPRegisterID value);
+        void emitLoadInt32ToDouble(unsigned index, FPRegisterID value);
+
+        void emitStore(unsigned index, RegisterID tag, RegisterID payload, RegisterID base = callFrameRegister);
+        void emitStore(unsigned index, const JSValue constant, RegisterID base = callFrameRegister);
+        void emitStoreInt32(unsigned index, RegisterID payload, bool indexIsInt32 = false);
+        void emitStoreInt32(unsigned index, Imm32 payload, bool indexIsInt32 = false);
+        void emitStoreCell(unsigned index, RegisterID payload, bool indexIsCell = false);
+        void emitStoreBool(unsigned index, RegisterID tag, bool indexIsBool = false);
+        void emitStoreDouble(unsigned index, FPRegisterID value);
+
+        bool isLabeled(unsigned bytecodeIndex);
+        void map(unsigned bytecodeIndex, unsigned virtualRegisterIndex, RegisterID tag, RegisterID payload);
+        void unmap(RegisterID);
+        void unmap();
+        bool isMapped(unsigned virtualRegisterIndex);
+        bool getMappedPayload(unsigned virtualRegisterIndex, RegisterID& payload);
+        bool getMappedTag(unsigned virtualRegisterIndex, RegisterID& tag);
+
+        void emitJumpSlowCaseIfNotJSCell(unsigned virtualRegisterIndex);
+        void emitJumpSlowCaseIfNotJSCell(unsigned virtualRegisterIndex, RegisterID tag);
+        void linkSlowCaseIfNotJSCell(Vector<SlowCaseEntry>::iterator&, unsigned virtualRegisterIndex);
+
+#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+        void compileGetByIdHotPath();
+        void compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, bool isMethodCheck = false);
+#endif
+        void compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, Structure* structure, size_t cachedOffset);
+        void compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID resultTag, RegisterID resultPayload, size_t cachedOffset);
+        void compilePutDirectOffset(RegisterID base, RegisterID valueTag, RegisterID valuePayload, Structure* structure, size_t cachedOffset);
+
+        // Arithmetic opcode helpers
+        void emitAdd32Constant(unsigned dst, unsigned op, int32_t constant, ResultType opType);
+        void emitSub32Constant(unsigned dst, unsigned op, int32_t constant, ResultType opType);
+        void emitBinaryDoubleOp(OpcodeID, unsigned dst, unsigned op1, unsigned op2, OperandTypes, JumpList& notInt32Op1, JumpList& notInt32Op2, bool op1IsInRegisters = true, bool op2IsInRegisters = true);
+
+#if PLATFORM(X86)
+        // These architecture specific value are used to enable patching - see comment on op_put_by_id.
+        static const int patchOffsetPutByIdStructure = 7;
+        static const int patchOffsetPutByIdExternalLoad = 13;
+        static const int patchLengthPutByIdExternalLoad = 3;
+        static const int patchOffsetPutByIdPropertyMapOffset1 = 22;
+        static const int patchOffsetPutByIdPropertyMapOffset2 = 28;
+        // These architecture specific value are used to enable patching - see comment on op_get_by_id.
+        static const int patchOffsetGetByIdStructure = 7;
+        static const int patchOffsetGetByIdBranchToSlowCase = 13;
+        static const int patchOffsetGetByIdExternalLoad = 13;
+        static const int patchLengthGetByIdExternalLoad = 3;
+        static const int patchOffsetGetByIdPropertyMapOffset1 = 22;
+        static const int patchOffsetGetByIdPropertyMapOffset2 = 28;
+        static const int patchOffsetGetByIdPutResult = 28;
+#if ENABLE(OPCODE_SAMPLING) && USE(JIT_STUB_ARGUMENT_VA_LIST)
+        static const int patchOffsetGetByIdSlowCaseCall = 35;
+#elif ENABLE(OPCODE_SAMPLING)
+        static const int patchOffsetGetByIdSlowCaseCall = 37;
+#elif USE(JIT_STUB_ARGUMENT_VA_LIST)
+        static const int patchOffsetGetByIdSlowCaseCall = 25;
+#else
+        static const int patchOffsetGetByIdSlowCaseCall = 27;
+#endif
+        static const int patchOffsetOpCallCompareToJump = 6;
+
+        static const int patchOffsetMethodCheckProtoObj = 11;
+        static const int patchOffsetMethodCheckProtoStruct = 18;
+        static const int patchOffsetMethodCheckPutFunction = 29;
+#else
+#error "JSVALUE32_64 not supported on this platform."
+#endif
+
+#else // USE(JSVALUE32_64)
+        void emitGetVirtualRegister(int src, RegisterID dst);
+        void emitGetVirtualRegisters(int src1, RegisterID dst1, int src2, RegisterID dst2);
+        void emitPutVirtualRegister(unsigned dst, RegisterID from = regT0);
+
+        int32_t getConstantOperandImmediateInt(unsigned src);
+
+        void emitGetVariableObjectRegister(RegisterID variableObject, int index, RegisterID dst);
+        void emitPutVariableObjectRegister(RegisterID src, RegisterID variableObject, int index);
+        
+        void killLastResultRegister();
+
+        Jump emitJumpIfJSCell(RegisterID);
+        Jump emitJumpIfBothJSCells(RegisterID, RegisterID, RegisterID);
+        void emitJumpSlowCaseIfJSCell(RegisterID);
+        Jump emitJumpIfNotJSCell(RegisterID);
+        void emitJumpSlowCaseIfNotJSCell(RegisterID);
+        void emitJumpSlowCaseIfNotJSCell(RegisterID, int VReg);
+#if USE(JSVALUE64)
+        JIT::Jump emitJumpIfImmediateNumber(RegisterID);
+        JIT::Jump emitJumpIfNotImmediateNumber(RegisterID);
+#else
+        JIT::Jump emitJumpIfImmediateNumber(RegisterID reg)
+        {
+            return emitJumpIfImmediateInteger(reg);
+        }
+        
+        JIT::Jump emitJumpIfNotImmediateNumber(RegisterID reg)
+        {
+            return emitJumpIfNotImmediateInteger(reg);
+        }
+#endif
+        JIT::Jump emitJumpIfImmediateInteger(RegisterID);
+        JIT::Jump emitJumpIfNotImmediateInteger(RegisterID);
+        JIT::Jump emitJumpIfNotImmediateIntegers(RegisterID, RegisterID, RegisterID);
+        void emitJumpSlowCaseIfNotImmediateInteger(RegisterID);
+        void emitJumpSlowCaseIfNotImmediateIntegers(RegisterID, RegisterID, RegisterID);
+
+#if !USE(JSVALUE64)
+        void emitFastArithDeTagImmediate(RegisterID);
+        Jump emitFastArithDeTagImmediateJumpIfZero(RegisterID);
+#endif
+        void emitFastArithReTagImmediate(RegisterID src, RegisterID dest);
+        void emitFastArithImmToInt(RegisterID);
+        void emitFastArithIntToImmNoCheck(RegisterID src, RegisterID dest);
+
+        void emitTagAsBoolImmediate(RegisterID reg);
+        void compileBinaryArithOp(OpcodeID, unsigned dst, unsigned src1, unsigned src2, OperandTypes opi);
+        void compileBinaryArithOpSlowCase(OpcodeID, Vector<SlowCaseEntry>::iterator&, unsigned dst, unsigned src1, unsigned src2, OperandTypes opi);
+
+#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+        void compileGetByIdHotPath(int resultVReg, int baseVReg, Identifier* ident, unsigned propertyAccessInstructionIndex);
+        void compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, bool isMethodCheck = false);
+#endif
         void compileGetDirectOffset(RegisterID base, RegisterID result, Structure* structure, size_t cachedOffset);
         void compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID result, size_t cachedOffset);
         void compilePutDirectOffset(RegisterID base, RegisterID value, Structure* structure, size_t cachedOffset);
 
-        // Arithmetic Ops
+#if PLATFORM(X86_64)
+        // These architecture specific value are used to enable patching - see comment on op_put_by_id.
+        static const int patchOffsetPutByIdStructure = 10;
+        static const int patchOffsetPutByIdExternalLoad = 20;
+        static const int patchLengthPutByIdExternalLoad = 4;
+        static const int patchOffsetPutByIdPropertyMapOffset = 31;
+        // These architecture specific value are used to enable patching - see comment on op_get_by_id.
+        static const int patchOffsetGetByIdStructure = 10;
+        static const int patchOffsetGetByIdBranchToSlowCase = 20;
+        static const int patchOffsetGetByIdExternalLoad = 20;
+        static const int patchLengthGetByIdExternalLoad = 4;
+        static const int patchOffsetGetByIdPropertyMapOffset = 31;
+        static const int patchOffsetGetByIdPutResult = 31;
+#if ENABLE(OPCODE_SAMPLING)
+        static const int patchOffsetGetByIdSlowCaseCall = 63;
+#else
+        static const int patchOffsetGetByIdSlowCaseCall = 41;
+#endif
+        static const int patchOffsetOpCallCompareToJump = 9;
 
-        void emit_op_add(Instruction*);
-        void emit_op_sub(Instruction*);
-        void emit_op_mul(Instruction*);
-        void emit_op_mod(Instruction*);
-        void emit_op_bitand(Instruction*);
-        void emit_op_lshift(Instruction*);
-        void emit_op_rshift(Instruction*);
-        void emit_op_jnless(Instruction*);
-        void emit_op_jnlesseq(Instruction*);
-        void emit_op_pre_inc(Instruction*);
-        void emit_op_pre_dec(Instruction*);
-        void emit_op_post_inc(Instruction*);
-        void emit_op_post_dec(Instruction*);
-        void emitSlow_op_add(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_sub(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_mul(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_mod(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_bitand(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_lshift(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_rshift(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_jnless(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_jnlesseq(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_pre_inc(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_pre_dec(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_post_inc(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_post_dec(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        static const int patchOffsetMethodCheckProtoObj = 20;
+        static const int patchOffsetMethodCheckProtoStruct = 30;
+        static const int patchOffsetMethodCheckPutFunction = 50;
+#elif PLATFORM(X86)
+        // These architecture specific value are used to enable patching - see comment on op_put_by_id.
+        static const int patchOffsetPutByIdStructure = 7;
+        static const int patchOffsetPutByIdExternalLoad = 13;
+        static const int patchLengthPutByIdExternalLoad = 3;
+        static const int patchOffsetPutByIdPropertyMapOffset = 22;
+        // These architecture specific value are used to enable patching - see comment on op_get_by_id.
+        static const int patchOffsetGetByIdStructure = 7;
+        static const int patchOffsetGetByIdBranchToSlowCase = 13;
+        static const int patchOffsetGetByIdExternalLoad = 13;
+        static const int patchLengthGetByIdExternalLoad = 3;
+        static const int patchOffsetGetByIdPropertyMapOffset = 22;
+        static const int patchOffsetGetByIdPutResult = 22;
+#if ENABLE(OPCODE_SAMPLING) && USE(JIT_STUB_ARGUMENT_VA_LIST)
+        static const int patchOffsetGetByIdSlowCaseCall = 31;
+#elif ENABLE(OPCODE_SAMPLING)
+        static const int patchOffsetGetByIdSlowCaseCall = 33;
+#elif USE(JIT_STUB_ARGUMENT_VA_LIST)
+        static const int patchOffsetGetByIdSlowCaseCall = 21;
+#else
+        static const int patchOffsetGetByIdSlowCaseCall = 23;
+#endif
+        static const int patchOffsetOpCallCompareToJump = 6;
 
-        void emit_op_get_by_val(Instruction*);
-        void emit_op_put_by_val(Instruction*);
-        void emit_op_put_by_index(Instruction*);
-        void emit_op_put_getter(Instruction*);
-        void emit_op_put_setter(Instruction*);
-        void emit_op_del_by_id(Instruction*);
+        static const int patchOffsetMethodCheckProtoObj = 11;
+        static const int patchOffsetMethodCheckProtoStruct = 18;
+        static const int patchOffsetMethodCheckPutFunction = 29;
+#elif PLATFORM_ARM_ARCH(7)
+        // These architecture specific value are used to enable patching - see comment on op_put_by_id.
+        static const int patchOffsetPutByIdStructure = 10;
+        static const int patchOffsetPutByIdExternalLoad = 20;
+        static const int patchLengthPutByIdExternalLoad = 12;
+        static const int patchOffsetPutByIdPropertyMapOffset = 40;
+        // These architecture specific value are used to enable patching - see comment on op_get_by_id.
+        static const int patchOffsetGetByIdStructure = 10;
+        static const int patchOffsetGetByIdBranchToSlowCase = 20;
+        static const int patchOffsetGetByIdExternalLoad = 20;
+        static const int patchLengthGetByIdExternalLoad = 12;
+        static const int patchOffsetGetByIdPropertyMapOffset = 40;
+        static const int patchOffsetGetByIdPutResult = 44;
+#if ENABLE(OPCODE_SAMPLING)
+        static const int patchOffsetGetByIdSlowCaseCall = 0; // FIMXE
+#else
+        static const int patchOffsetGetByIdSlowCaseCall = 28;
+#endif
+        static const int patchOffsetOpCallCompareToJump = 10;
 
-        void emit_op_mov(Instruction*);
-        void emit_op_end(Instruction*);
-        void emit_op_jmp(Instruction*);
-        void emit_op_loop(Instruction*);
-        void emit_op_loop_if_less(Instruction*);
-        void emit_op_loop_if_lesseq(Instruction*);
-        void emit_op_new_object(Instruction*);
-        void emit_op_put_by_id(Instruction*);
-        void emit_op_get_by_id(Instruction*);
-        void emit_op_instanceof(Instruction*);
-        void emit_op_new_func(Instruction*);
+        static const int patchOffsetMethodCheckProtoObj = 18;
+        static const int patchOffsetMethodCheckProtoStruct = 28;
+        static const int patchOffsetMethodCheckPutFunction = 46;
+#elif PLATFORM(ARM)
+        // These architecture specific value are used to enable patching - see comment on op_put_by_id.
+        static const int patchOffsetPutByIdStructure = 4;
+        static const int patchOffsetPutByIdExternalLoad = 16;
+        static const int patchLengthPutByIdExternalLoad = 4;
+        static const int patchOffsetPutByIdPropertyMapOffset = 20;
+        // These architecture specific value are used to enable patching - see comment on op_get_by_id.
+        static const int patchOffsetGetByIdStructure = 4;
+        static const int patchOffsetGetByIdBranchToSlowCase = 16;
+        static const int patchOffsetGetByIdExternalLoad = 16;
+        static const int patchLengthGetByIdExternalLoad = 4;
+        static const int patchOffsetGetByIdPropertyMapOffset = 20;
+        static const int patchOffsetGetByIdPutResult = 28;
+#if ENABLE(OPCODE_SAMPLING)
+        #error "OPCODE_SAMPLING is not yet supported"
+#else
+        static const int patchOffsetGetByIdSlowCaseCall = 36;
+#endif
+        static const int patchOffsetOpCallCompareToJump = 12;
+
+        static const int patchOffsetMethodCheckProtoObj = 12;
+        static const int patchOffsetMethodCheckProtoStruct = 20;
+        static const int patchOffsetMethodCheckPutFunction = 32;
+#endif
+#endif // USE(JSVALUE32_64)
+
+#if PLATFORM(ARM) && !PLATFORM_ARM_ARCH(7)
+        // sequenceOpCall
+        static const int sequenceOpCallInstructionSpace = 12;
+        static const int sequenceOpCallConstantSpace = 2;
+        // sequenceMethodCheck
+        static const int sequenceMethodCheckInstructionSpace = 40;
+        static const int sequenceMethodCheckConstantSpace = 6;
+        // sequenceGetByIdHotPath
+        static const int sequenceGetByIdHotPathInstructionSpace = 28;
+        static const int sequenceGetByIdHotPathConstantSpace = 3;
+        // sequenceGetByIdSlowCase
+        static const int sequenceGetByIdSlowCaseInstructionSpace = 40;
+        static const int sequenceGetByIdSlowCaseConstantSpace = 2;
+        // sequencePutById
+        static const int sequencePutByIdInstructionSpace = 28;
+        static const int sequencePutByIdConstantSpace = 3;
+#endif
+
+#if defined(ASSEMBLER_HAS_CONSTANT_POOL) && ASSEMBLER_HAS_CONSTANT_POOL
+#define BEGIN_UNINTERRUPTED_SEQUENCE(name) beginUninterruptedSequence(name ## InstructionSpace, name ## ConstantSpace)
+#define END_UNINTERRUPTED_SEQUENCE(name) endUninterruptedSequence(name ## InstructionSpace, name ## ConstantSpace)
+
+        void beginUninterruptedSequence(int, int);
+        void endUninterruptedSequence(int, int);
+
+#else
+#define BEGIN_UNINTERRUPTED_SEQUENCE(name)
+#define END_UNINTERRUPTED_SEQUENCE(name)
+#endif
+
+        void emit_op_add(Instruction*);
+        void emit_op_bitand(Instruction*);
+        void emit_op_bitnot(Instruction*);
+        void emit_op_bitor(Instruction*);
+        void emit_op_bitxor(Instruction*);
         void emit_op_call(Instruction*);
         void emit_op_call_eval(Instruction*);
-        void emit_op_method_check(Instruction*);
-        void emit_op_load_varargs(Instruction*);
         void emit_op_call_varargs(Instruction*);
+        void emit_op_catch(Instruction*);
         void emit_op_construct(Instruction*);
+        void emit_op_construct_verify(Instruction*);
+        void emit_op_convert_this(Instruction*);
+        void emit_op_create_arguments(Instruction*);
+        void emit_op_debug(Instruction*);
+        void emit_op_del_by_id(Instruction*);
+        void emit_op_div(Instruction*);
+        void emit_op_end(Instruction*);
+        void emit_op_enter(Instruction*);
+        void emit_op_enter_with_activation(Instruction*);
+        void emit_op_eq(Instruction*);
+        void emit_op_eq_null(Instruction*);
+        void emit_op_get_by_id(Instruction*);
+        void emit_op_get_by_val(Instruction*);
         void emit_op_get_global_var(Instruction*);
-        void emit_op_put_global_var(Instruction*);
         void emit_op_get_scoped_var(Instruction*);
-        void emit_op_put_scoped_var(Instruction*);
-        void emit_op_tear_off_activation(Instruction*);
-        void emit_op_tear_off_arguments(Instruction*);
-        void emit_op_ret(Instruction*);
-        void emit_op_new_array(Instruction*);
-        void emit_op_resolve(Instruction*);
-        void emit_op_construct_verify(Instruction*);
-        void emit_op_to_primitive(Instruction*);
-        void emit_op_strcat(Instruction*);
-        void emit_op_resolve_func(Instruction*);
-        void emit_op_loop_if_true(Instruction*);
-        void emit_op_resolve_base(Instruction*);
-        void emit_op_resolve_skip(Instruction*);
-        void emit_op_resolve_global(Instruction*);
-        void emit_op_not(Instruction*);
-        void emit_op_jfalse(Instruction*);
+        void emit_op_init_arguments(Instruction*);
+        void emit_op_instanceof(Instruction*);
         void emit_op_jeq_null(Instruction*);
+        void emit_op_jfalse(Instruction*);
+        void emit_op_jmp(Instruction*);
+        void emit_op_jmp_scopes(Instruction*);
         void emit_op_jneq_null(Instruction*);
         void emit_op_jneq_ptr(Instruction*);
-        void emit_op_unexpected_load(Instruction*);
+        void emit_op_jnless(Instruction*);
+        void emit_op_jnlesseq(Instruction*);
         void emit_op_jsr(Instruction*);
-        void emit_op_sret(Instruction*);
-        void emit_op_eq(Instruction*);
-        void emit_op_bitnot(Instruction*);
-        void emit_op_resolve_with_base(Instruction*);
-        void emit_op_new_func_exp(Instruction*);
         void emit_op_jtrue(Instruction*);
+        void emit_op_load_varargs(Instruction*);
+        void emit_op_loop(Instruction*);
+        void emit_op_loop_if_less(Instruction*);
+        void emit_op_loop_if_lesseq(Instruction*);
+        void emit_op_loop_if_true(Instruction*);
+        void emit_op_lshift(Instruction*);
+        void emit_op_method_check(Instruction*);
+        void emit_op_mod(Instruction*);
+        void emit_op_mov(Instruction*);
+        void emit_op_mul(Instruction*);
+        void emit_op_negate(Instruction*);
         void emit_op_neq(Instruction*);
-        void emit_op_bitxor(Instruction*);
+        void emit_op_neq_null(Instruction*);
+        void emit_op_new_array(Instruction*);
+        void emit_op_new_error(Instruction*);
+        void emit_op_new_func(Instruction*);
+        void emit_op_new_func_exp(Instruction*);
+        void emit_op_new_object(Instruction*);
         void emit_op_new_regexp(Instruction*);
-        void emit_op_bitor(Instruction*);
-        void emit_op_throw(Instruction*);
         void emit_op_next_pname(Instruction*);
-        void emit_op_push_scope(Instruction*);
-        void emit_op_pop_scope(Instruction*);
-        void emit_op_stricteq(Instruction*);
+        void emit_op_not(Instruction*);
         void emit_op_nstricteq(Instruction*);
-        void emit_op_to_jsnumber(Instruction*);
+        void emit_op_pop_scope(Instruction*);
+        void emit_op_post_dec(Instruction*);
+        void emit_op_post_inc(Instruction*);
+        void emit_op_pre_dec(Instruction*);
+        void emit_op_pre_inc(Instruction*);
+        void emit_op_profile_did_call(Instruction*);
+        void emit_op_profile_will_call(Instruction*);
         void emit_op_push_new_scope(Instruction*);
-        void emit_op_catch(Instruction*);
-        void emit_op_jmp_scopes(Instruction*);
-        void emit_op_switch_imm(Instruction*);
+        void emit_op_push_scope(Instruction*);
+        void emit_op_put_by_id(Instruction*);
+        void emit_op_put_by_index(Instruction*);
+        void emit_op_put_by_val(Instruction*);
+        void emit_op_put_getter(Instruction*);
+        void emit_op_put_global_var(Instruction*);
+        void emit_op_put_scoped_var(Instruction*);
+        void emit_op_put_setter(Instruction*);
+        void emit_op_resolve(Instruction*);
+        void emit_op_resolve_base(Instruction*);
+        void emit_op_resolve_global(Instruction*);
+        void emit_op_resolve_skip(Instruction*);
+        void emit_op_resolve_with_base(Instruction*);
+        void emit_op_ret(Instruction*);
+        void emit_op_rshift(Instruction*);
+        void emit_op_sret(Instruction*);
+        void emit_op_strcat(Instruction*);
+        void emit_op_stricteq(Instruction*);
+        void emit_op_sub(Instruction*);
         void emit_op_switch_char(Instruction*);
+        void emit_op_switch_imm(Instruction*);
         void emit_op_switch_string(Instruction*);
-        void emit_op_new_error(Instruction*);
-        void emit_op_debug(Instruction*);
-        void emit_op_eq_null(Instruction*);
-        void emit_op_neq_null(Instruction*);
-        void emit_op_enter(Instruction*);
-        void emit_op_enter_with_activation(Instruction*);
-        void emit_op_init_arguments(Instruction*);
-        void emit_op_create_arguments(Instruction*);
-        void emit_op_convert_this(Instruction*);
-        void emit_op_profile_will_call(Instruction*);
-        void emit_op_profile_did_call(Instruction*);
+        void emit_op_tear_off_activation(Instruction*);
+        void emit_op_tear_off_arguments(Instruction*);
+        void emit_op_throw(Instruction*);
+        void emit_op_to_jsnumber(Instruction*);
+        void emit_op_to_primitive(Instruction*);
+        void emit_op_unexpected_load(Instruction*);
 
-        void emitSlow_op_convert_this(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_add(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_bitand(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_bitnot(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_bitor(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_bitxor(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_call(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_call_eval(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_call_varargs(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_construct(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_construct_verify(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_to_primitive(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_convert_this(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_div(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_eq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_get_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_get_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_instanceof(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_jfalse(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_jnless(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_jnlesseq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_jtrue(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_loop_if_less(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_put_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_get_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_loop_if_lesseq(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_put_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_loop_if_true(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_not(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_jfalse(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_bitnot(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_jtrue(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_bitxor(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_bitor(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_eq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_lshift(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_mod(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_mul(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_negate(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_neq(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_stricteq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_not(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_nstricteq(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_instanceof(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_call(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_call_eval(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_call_varargs(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_construct(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_post_dec(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_post_inc(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_pre_dec(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_pre_inc(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_put_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_put_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_resolve_global(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_rshift(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_stricteq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_sub(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_to_jsnumber(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_to_primitive(Instruction*, Vector<SlowCaseEntry>::iterator&);
 
-#if ENABLE(JIT_OPTIMIZE_ARITHMETIC)
-        void compileBinaryArithOp(OpcodeID, unsigned dst, unsigned src1, unsigned src2, OperandTypes opi);
-        void compileBinaryArithOpSlowCase(OpcodeID, Vector<SlowCaseEntry>::iterator&, unsigned dst, unsigned src1, unsigned src2, OperandTypes opi);
-#endif
-
-        void emitGetVirtualRegister(int src, RegisterID dst);
-        void emitGetVirtualRegisters(int src1, RegisterID dst1, int src2, RegisterID dst2);
-        void emitPutVirtualRegister(unsigned dst, RegisterID from = regT0);
-
+        /* These functions are deprecated: Please use JITStubCall instead. */
         void emitPutJITStubArg(RegisterID src, unsigned argumentNumber);
+#if USE(JSVALUE32_64)
+        void emitPutJITStubArg(RegisterID tag, RegisterID payload, unsigned argumentNumber);
+        void emitPutJITStubArgFromVirtualRegister(unsigned src, unsigned argumentNumber, RegisterID scratch1, RegisterID scratch2);
+#else
         void emitPutJITStubArgFromVirtualRegister(unsigned src, unsigned argumentNumber, RegisterID scratch);
+#endif
         void emitPutJITStubArgConstant(unsigned value, unsigned argumentNumber);
         void emitPutJITStubArgConstant(void* value, unsigned argumentNumber);
         void emitGetJITStubArg(unsigned argumentNumber, RegisterID dst);
@@ -606,30 +810,8 @@ namespace JSC {
         void emitGetFromCallFrameHeader32(RegisterFile::CallFrameHeaderEntry entry, RegisterID to, RegisterID from = callFrameRegister);
 
         JSValue getConstantOperand(unsigned src);
-        int32_t getConstantOperandImmediateInt(unsigned src);
         bool isOperandConstantImmediateInt(unsigned src);
 
-        Jump emitJumpIfJSCell(RegisterID);
-        Jump emitJumpIfBothJSCells(RegisterID, RegisterID, RegisterID);
-        void emitJumpSlowCaseIfJSCell(RegisterID);
-        Jump emitJumpIfNotJSCell(RegisterID);
-        void emitJumpSlowCaseIfNotJSCell(RegisterID);
-        void emitJumpSlowCaseIfNotJSCell(RegisterID, int VReg);
-#if USE(ALTERNATE_JSIMMEDIATE)
-        JIT::Jump emitJumpIfImmediateNumber(RegisterID);
-        JIT::Jump emitJumpIfNotImmediateNumber(RegisterID);
-#else
-        JIT::Jump emitJumpIfImmediateNumber(RegisterID reg)
-        {
-            return emitJumpIfImmediateInteger(reg);
-        }
-        
-        JIT::Jump emitJumpIfNotImmediateNumber(RegisterID reg)
-        {
-            return emitJumpIfNotImmediateInteger(reg);
-        }
-#endif
-
         Jump getSlowCase(Vector<SlowCaseEntry>::iterator& iter)
         {
             return iter++->from;
@@ -641,43 +823,22 @@ namespace JSC {
         }
         void linkSlowCaseIfNotJSCell(Vector<SlowCaseEntry>::iterator&, int vReg);
 
-        JIT::Jump emitJumpIfImmediateInteger(RegisterID);
-        JIT::Jump emitJumpIfNotImmediateInteger(RegisterID);
-        JIT::Jump emitJumpIfNotImmediateIntegers(RegisterID, RegisterID, RegisterID);
-        void emitJumpSlowCaseIfNotImmediateInteger(RegisterID);
-        void emitJumpSlowCaseIfNotImmediateIntegers(RegisterID, RegisterID, RegisterID);
-
         Jump checkStructure(RegisterID reg, Structure* structure);
 
-#if !USE(ALTERNATE_JSIMMEDIATE)
-        void emitFastArithDeTagImmediate(RegisterID);
-        Jump emitFastArithDeTagImmediateJumpIfZero(RegisterID);
-#endif
-        void emitFastArithReTagImmediate(RegisterID src, RegisterID dest);
-        void emitFastArithImmToInt(RegisterID);
-        void emitFastArithIntToImmNoCheck(RegisterID src, RegisterID dest);
-
-        void emitTagAsBoolImmediate(RegisterID reg);
-
         void restoreArgumentReference();
         void restoreArgumentReferenceForTrampoline();
 
         Call emitNakedCall(CodePtr function = CodePtr());
+
         void preserveReturnAddressAfterCall(RegisterID);
         void restoreReturnAddressBeforeReturn(RegisterID);
         void restoreReturnAddressBeforeReturn(Address);
 
-        void emitGetVariableObjectRegister(RegisterID variableObject, int index, RegisterID dst);
-        void emitPutVariableObjectRegister(RegisterID src, RegisterID variableObject, int index);
-        
         void emitTimeoutCheck();
 #ifndef NDEBUG
         void printBytecodeOperandTypes(unsigned src1, unsigned src2);
 #endif
 
-        void killLastResultRegister();
-
-
 #if ENABLE(SAMPLING_FLAGS)
         void setSamplingFlag(int32_t);
         void clearSamplingFlag(int32_t);
@@ -713,15 +874,29 @@ namespace JSC {
         Vector<SlowCaseEntry> m_slowCases;
         Vector<SwitchRecord> m_switches;
 
-        int m_lastResultBytecodeRegister;
-        unsigned m_jumpTargetsPosition;
-
         unsigned m_propertyAccessInstructionIndex;
         unsigned m_globalResolveInfoIndex;
         unsigned m_callLinkInfoIndex;
-    } JIT_CLASS_ALIGNMENT;
 
-}
+#if USE(JSVALUE32_64)
+        unsigned m_jumpTargetIndex;
+        unsigned m_mappedBytecodeIndex;
+        unsigned m_mappedVirtualRegisterIndex;
+        RegisterID m_mappedTag;
+        RegisterID m_mappedPayload;
+#else
+        int m_lastResultBytecodeRegister;
+        unsigned m_jumpTargetsPosition;
+#endif
+
+#ifndef NDEBUG
+#if defined(ASSEMBLER_HAS_CONSTANT_POOL) && ASSEMBLER_HAS_CONSTANT_POOL
+        Label m_uninterruptedInstructionSequenceBegin;
+        int m_uninterruptedConstantSequenceBegin;
+#endif
+#endif
+    } JIT_CLASS_ALIGNMENT;
+} // namespace JSC
 
 #endif // ENABLE(JIT)
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp
index 15808e2..3be13cb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp
@@ -41,11 +41,1095 @@
 #include <stdio.h>
 #endif
 
-
 using namespace std;
 
 namespace JSC {
 
+#if USE(JSVALUE32_64)
+
+void JIT::emit_op_negate(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned src = currentInstruction[2].u.operand;
+
+    emitLoad(src, regT1, regT0);
+
+    Jump srcNotInt = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
+    addSlowCase(branch32(Equal, regT0, Imm32(0)));
+
+    neg32(regT0);
+    emitStoreInt32(dst, regT0, (dst == src));
+
+    Jump end = jump();
+
+    srcNotInt.link(this);
+    addSlowCase(branch32(Above, regT1, Imm32(JSValue::LowestTag)));
+
+    xor32(Imm32(1 << 31), regT1);
+    store32(regT1, tagFor(dst));
+    if (dst != src)
+        store32(regT0, payloadFor(dst));
+
+    end.link(this);
+}
+
+void JIT::emitSlow_op_negate(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+
+    linkSlowCase(iter); // 0 check
+    linkSlowCase(iter); // double check
+
+    JITStubCall stubCall(this, cti_op_negate);
+    stubCall.addArgument(regT1, regT0);
+    stubCall.call(dst);
+}
+
+void JIT::emit_op_jnless(Instruction* currentInstruction)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    JumpList notInt32Op1;
+    JumpList notInt32Op2;
+
+    // Int32 less.
+    if (isOperandConstantImmediateInt(op1)) {
+        emitLoad(op2, regT3, regT2);
+        notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        addJump(branch32(LessThanOrEqual, regT2, Imm32(getConstantOperand(op1).asInt32())), target + 3);
+    } else if (isOperandConstantImmediateInt(op2)) {
+        emitLoad(op1, regT1, regT0);
+        notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        addJump(branch32(GreaterThanOrEqual, regT0, Imm32(getConstantOperand(op2).asInt32())), target + 3);
+    } else {
+        emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
+        notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        addJump(branch32(GreaterThanOrEqual, regT0, regT2), target + 3);
+    }
+
+    if (!supportsFloatingPoint()) {
+        addSlowCase(notInt32Op1);
+        addSlowCase(notInt32Op2);
+        return;
+    }
+    Jump end = jump();
+
+    // Double less.
+    emitBinaryDoubleOp(op_jnless, target, op1, op2, OperandTypes(), notInt32Op1, notInt32Op2, !isOperandConstantImmediateInt(op1), isOperandConstantImmediateInt(op1) || !isOperandConstantImmediateInt(op2));
+    end.link(this);
+}
+
+void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    if (!supportsFloatingPoint()) {
+        if (!isOperandConstantImmediateInt(op1) && !isOperandConstantImmediateInt(op2))
+            linkSlowCase(iter); // int32 check
+        linkSlowCase(iter); // int32 check
+    } else {
+        if (!isOperandConstantImmediateInt(op1)) {
+            linkSlowCase(iter); // double check
+            linkSlowCase(iter); // int32 check
+        }
+        if (isOperandConstantImmediateInt(op1) || !isOperandConstantImmediateInt(op2))
+            linkSlowCase(iter); // double check
+    }
+
+    JITStubCall stubCall(this, cti_op_jless);
+    stubCall.addArgument(op1);
+    stubCall.addArgument(op2);
+    stubCall.call();
+    emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+}
+
+void JIT::emit_op_jnlesseq(Instruction* currentInstruction)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    JumpList notInt32Op1;
+    JumpList notInt32Op2;
+
+    // Int32 less.
+    if (isOperandConstantImmediateInt(op1)) {
+        emitLoad(op2, regT3, regT2);
+        notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        addJump(branch32(LessThan, regT2, Imm32(getConstantOperand(op1).asInt32())), target + 3);
+    } else if (isOperandConstantImmediateInt(op2)) {
+        emitLoad(op1, regT1, regT0);
+        notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        addJump(branch32(GreaterThan, regT0, Imm32(getConstantOperand(op2).asInt32())), target + 3);
+    } else {
+        emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
+        notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        addJump(branch32(GreaterThan, regT0, regT2), target + 3);
+    }
+
+    if (!supportsFloatingPoint()) {
+        addSlowCase(notInt32Op1);
+        addSlowCase(notInt32Op2);
+        return;
+    }
+    Jump end = jump();
+
+    // Double less.
+    emitBinaryDoubleOp(op_jnlesseq, target, op1, op2, OperandTypes(), notInt32Op1, notInt32Op2, !isOperandConstantImmediateInt(op1), isOperandConstantImmediateInt(op1) || !isOperandConstantImmediateInt(op2));
+    end.link(this);
+}
+
+void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    if (!supportsFloatingPoint()) {
+        if (!isOperandConstantImmediateInt(op1) && !isOperandConstantImmediateInt(op2))
+            linkSlowCase(iter); // int32 check
+        linkSlowCase(iter); // int32 check
+    } else {
+        if (!isOperandConstantImmediateInt(op1)) {
+            linkSlowCase(iter); // double check
+            linkSlowCase(iter); // int32 check
+        }
+        if (isOperandConstantImmediateInt(op1) || !isOperandConstantImmediateInt(op2))
+            linkSlowCase(iter); // double check
+    }
+
+    JITStubCall stubCall(this, cti_op_jlesseq);
+    stubCall.addArgument(op1);
+    stubCall.addArgument(op2);
+    stubCall.call();
+    emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+}
+
+// LeftShift (<<)
+
+void JIT::emit_op_lshift(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    if (isOperandConstantImmediateInt(op2)) {
+        emitLoad(op1, regT1, regT0);
+        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        lshift32(Imm32(getConstantOperand(op2).asInt32()), regT0);
+        emitStoreInt32(dst, regT0, dst == op1);
+        return;
+    }
+
+    emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
+    if (!isOperandConstantImmediateInt(op1))
+        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    lshift32(regT2, regT0);
+    emitStoreInt32(dst, regT0, dst == op1 || dst == op2);
+}
+
+void JIT::emitSlow_op_lshift(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    if (!isOperandConstantImmediateInt(op1) && !isOperandConstantImmediateInt(op2))
+        linkSlowCase(iter); // int32 check
+    linkSlowCase(iter); // int32 check
+
+    JITStubCall stubCall(this, cti_op_lshift);
+    stubCall.addArgument(op1);
+    stubCall.addArgument(op2);
+    stubCall.call(dst);
+}
+
+// RightShift (>>)
+
+void JIT::emit_op_rshift(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    if (isOperandConstantImmediateInt(op2)) {
+        emitLoad(op1, regT1, regT0);
+        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        rshift32(Imm32(getConstantOperand(op2).asInt32()), regT0);
+        emitStoreInt32(dst, regT0, dst == op1);
+        return;
+    }
+
+    emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
+    if (!isOperandConstantImmediateInt(op1))
+        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    rshift32(regT2, regT0);
+    emitStoreInt32(dst, regT0, dst == op1 || dst == op2);
+}
+
+void JIT::emitSlow_op_rshift(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    if (!isOperandConstantImmediateInt(op1) && !isOperandConstantImmediateInt(op2))
+        linkSlowCase(iter); // int32 check
+    linkSlowCase(iter); // int32 check
+
+    JITStubCall stubCall(this, cti_op_rshift);
+    stubCall.addArgument(op1);
+    stubCall.addArgument(op2);
+    stubCall.call(dst);
+}
+
+// BitAnd (&)
+
+void JIT::emit_op_bitand(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    unsigned op;
+    int32_t constant;
+    if (getOperandConstantImmediateInt(op1, op2, op, constant)) {
+        emitLoad(op, regT1, regT0);
+        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        and32(Imm32(constant), regT0);
+        emitStoreInt32(dst, regT0, (op == dst));
+        return;
+    }
+
+    emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
+    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    and32(regT2, regT0);
+    emitStoreInt32(dst, regT0, (op1 == dst || op2 == dst));
+}
+
+void JIT::emitSlow_op_bitand(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    if (!isOperandConstantImmediateInt(op1) && !isOperandConstantImmediateInt(op2))
+        linkSlowCase(iter); // int32 check
+    linkSlowCase(iter); // int32 check
+
+    JITStubCall stubCall(this, cti_op_bitand);
+    stubCall.addArgument(op1);
+    stubCall.addArgument(op2);
+    stubCall.call(dst);
+}
+
+// BitOr (|)
+
+void JIT::emit_op_bitor(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    unsigned op;
+    int32_t constant;
+    if (getOperandConstantImmediateInt(op1, op2, op, constant)) {
+        emitLoad(op, regT1, regT0);
+        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        or32(Imm32(constant), regT0);
+        emitStoreInt32(dst, regT0, (op == dst));
+        return;
+    }
+
+    emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
+    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    or32(regT2, regT0);
+    emitStoreInt32(dst, regT0, (op1 == dst || op2 == dst));
+}
+
+void JIT::emitSlow_op_bitor(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    if (!isOperandConstantImmediateInt(op1) && !isOperandConstantImmediateInt(op2))
+        linkSlowCase(iter); // int32 check
+    linkSlowCase(iter); // int32 check
+
+    JITStubCall stubCall(this, cti_op_bitor);
+    stubCall.addArgument(op1);
+    stubCall.addArgument(op2);
+    stubCall.call(dst);
+}
+
+// BitXor (^)
+
+void JIT::emit_op_bitxor(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    unsigned op;
+    int32_t constant;
+    if (getOperandConstantImmediateInt(op1, op2, op, constant)) {
+        emitLoad(op, regT1, regT0);
+        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        xor32(Imm32(constant), regT0);
+        emitStoreInt32(dst, regT0, (op == dst));
+        return;
+    }
+
+    emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
+    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    xor32(regT2, regT0);
+    emitStoreInt32(dst, regT0, (op1 == dst || op2 == dst));
+}
+
+void JIT::emitSlow_op_bitxor(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    if (!isOperandConstantImmediateInt(op1) && !isOperandConstantImmediateInt(op2))
+        linkSlowCase(iter); // int32 check
+    linkSlowCase(iter); // int32 check
+
+    JITStubCall stubCall(this, cti_op_bitxor);
+    stubCall.addArgument(op1);
+    stubCall.addArgument(op2);
+    stubCall.call(dst);
+}
+
+// BitNot (~)
+
+void JIT::emit_op_bitnot(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned src = currentInstruction[2].u.operand;
+
+    emitLoad(src, regT1, regT0);
+    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+
+    not32(regT0);
+    emitStoreInt32(dst, regT0, (dst == src));
+}
+
+void JIT::emitSlow_op_bitnot(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+
+    linkSlowCase(iter); // int32 check
+
+    JITStubCall stubCall(this, cti_op_bitnot);
+    stubCall.addArgument(regT1, regT0);
+    stubCall.call(dst);
+}
+
+// PostInc (i++)
+
+void JIT::emit_op_post_inc(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned srcDst = currentInstruction[2].u.operand;
+    
+    emitLoad(srcDst, regT1, regT0);
+    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+
+    if (dst == srcDst) // x = x++ is a noop for ints.
+        return;
+
+    emitStoreInt32(dst, regT0);
+
+    addSlowCase(branchAdd32(Overflow, Imm32(1), regT0));
+    emitStoreInt32(srcDst, regT0, true);
+}
+
+void JIT::emitSlow_op_post_inc(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned srcDst = currentInstruction[2].u.operand;
+
+    linkSlowCase(iter); // int32 check
+    if (dst != srcDst)
+        linkSlowCase(iter); // overflow check
+
+    JITStubCall stubCall(this, cti_op_post_inc);
+    stubCall.addArgument(srcDst);
+    stubCall.addArgument(Imm32(srcDst));
+    stubCall.call(dst);
+}
+
+// PostDec (i--)
+
+void JIT::emit_op_post_dec(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned srcDst = currentInstruction[2].u.operand;
+
+    emitLoad(srcDst, regT1, regT0);
+    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+
+    if (dst == srcDst) // x = x-- is a noop for ints.
+        return;
+
+    emitStoreInt32(dst, regT0);
+
+    addSlowCase(branchSub32(Overflow, Imm32(1), regT0));
+    emitStoreInt32(srcDst, regT0, true);
+}
+
+void JIT::emitSlow_op_post_dec(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned srcDst = currentInstruction[2].u.operand;
+
+    linkSlowCase(iter); // int32 check
+    if (dst != srcDst)
+        linkSlowCase(iter); // overflow check
+
+    JITStubCall stubCall(this, cti_op_post_dec);
+    stubCall.addArgument(srcDst);
+    stubCall.addArgument(Imm32(srcDst));
+    stubCall.call(dst);
+}
+
+// PreInc (++i)
+
+void JIT::emit_op_pre_inc(Instruction* currentInstruction)
+{
+    unsigned srcDst = currentInstruction[1].u.operand;
+
+    emitLoad(srcDst, regT1, regT0);
+
+    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branchAdd32(Overflow, Imm32(1), regT0));
+    emitStoreInt32(srcDst, regT0, true);
+}
+
+void JIT::emitSlow_op_pre_inc(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned srcDst = currentInstruction[1].u.operand;
+
+    linkSlowCase(iter); // int32 check
+    linkSlowCase(iter); // overflow check
+
+    JITStubCall stubCall(this, cti_op_pre_inc);
+    stubCall.addArgument(srcDst);
+    stubCall.call(srcDst);
+}
+
+// PreDec (--i)
+
+void JIT::emit_op_pre_dec(Instruction* currentInstruction)
+{
+    unsigned srcDst = currentInstruction[1].u.operand;
+
+    emitLoad(srcDst, regT1, regT0);
+
+    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branchSub32(Overflow, Imm32(1), regT0));
+    emitStoreInt32(srcDst, regT0, true);
+}
+
+void JIT::emitSlow_op_pre_dec(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned srcDst = currentInstruction[1].u.operand;
+
+    linkSlowCase(iter); // int32 check
+    linkSlowCase(iter); // overflow check
+
+    JITStubCall stubCall(this, cti_op_pre_dec);
+    stubCall.addArgument(srcDst);
+    stubCall.call(srcDst);
+}
+
+// Addition (+)
+
+void JIT::emit_op_add(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
+
+    JumpList notInt32Op1;
+    JumpList notInt32Op2;
+
+    unsigned op;
+    int32_t constant;
+    if (getOperandConstantImmediateInt(op1, op2, op, constant)) {
+        emitAdd32Constant(dst, op, constant, op == op1 ? types.first() : types.second());
+        return;
+    }
+
+    emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
+    notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+    notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+
+    // Int32 case.
+    addSlowCase(branchAdd32(Overflow, regT2, regT0));
+    emitStoreInt32(dst, regT0, (op1 == dst || op2 == dst));
+
+    if (!supportsFloatingPoint()) {
+        addSlowCase(notInt32Op1);
+        addSlowCase(notInt32Op2);
+        return;
+    }
+    Jump end = jump();
+
+    // Double case.
+    emitBinaryDoubleOp(op_add, dst, op1, op2, types, notInt32Op1, notInt32Op2);
+    end.link(this);
+}
+
+void JIT::emitAdd32Constant(unsigned dst, unsigned op, int32_t constant, ResultType opType)
+{
+    // Int32 case.
+    emitLoad(op, regT1, regT0);
+    Jump notInt32 = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
+    addSlowCase(branchAdd32(Overflow, Imm32(constant), regT0));
+    emitStoreInt32(dst, regT0, (op == dst));
+
+    // Double case.
+    if (!supportsFloatingPoint()) {
+        addSlowCase(notInt32);
+        return;
+    }
+    Jump end = jump();
+
+    notInt32.link(this);
+    if (!opType.definitelyIsNumber())
+        addSlowCase(branch32(Above, regT1, Imm32(JSValue::LowestTag)));
+    move(Imm32(constant), regT2);
+    convertInt32ToDouble(regT2, fpRegT0);
+    emitLoadDouble(op, fpRegT1);
+    addDouble(fpRegT1, fpRegT0);
+    emitStoreDouble(dst, fpRegT0);
+
+    end.link(this);
+}
+
+void JIT::emitSlow_op_add(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
+
+    unsigned op;
+    int32_t constant;
+    if (getOperandConstantImmediateInt(op1, op2, op, constant)) {
+        linkSlowCase(iter); // overflow check
+
+        if (!supportsFloatingPoint()) {
+            linkSlowCase(iter); // non-sse case
+            return;
+        }
+
+        ResultType opType = op == op1 ? types.first() : types.second();
+        if (!opType.definitelyIsNumber())
+            linkSlowCase(iter); // double check
+    } else {
+        linkSlowCase(iter); // overflow check
+
+        if (!supportsFloatingPoint()) {
+            linkSlowCase(iter); // int32 check
+            linkSlowCase(iter); // int32 check
+        } else {
+            if (!types.first().definitelyIsNumber())
+                linkSlowCase(iter); // double check
+
+            if (!types.second().definitelyIsNumber()) {
+                linkSlowCase(iter); // int32 check
+                linkSlowCase(iter); // double check
+            }
+        }
+    }
+
+    JITStubCall stubCall(this, cti_op_add);
+    stubCall.addArgument(op1);
+    stubCall.addArgument(op2);
+    stubCall.call(dst);
+}
+
+// Subtraction (-)
+
+void JIT::emit_op_sub(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
+
+    JumpList notInt32Op1;
+    JumpList notInt32Op2;
+
+    if (isOperandConstantImmediateInt(op2)) {
+        emitSub32Constant(dst, op1, getConstantOperand(op2).asInt32(), types.first());
+        return;
+    }
+
+    emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
+    notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+    notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+
+    // Int32 case.
+    addSlowCase(branchSub32(Overflow, regT2, regT0));
+    emitStoreInt32(dst, regT0, (op1 == dst || op2 == dst));
+
+    if (!supportsFloatingPoint()) {
+        addSlowCase(notInt32Op1);
+        addSlowCase(notInt32Op2);
+        return;
+    }
+    Jump end = jump();
+
+    // Double case.
+    emitBinaryDoubleOp(op_sub, dst, op1, op2, types, notInt32Op1, notInt32Op2);
+    end.link(this);
+}
+
+void JIT::emitSub32Constant(unsigned dst, unsigned op, int32_t constant, ResultType opType)
+{
+    // Int32 case.
+    emitLoad(op, regT1, regT0);
+    Jump notInt32 = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
+    addSlowCase(branchSub32(Overflow, Imm32(constant), regT0));
+    emitStoreInt32(dst, regT0, (op == dst));
+
+    // Double case.
+    if (!supportsFloatingPoint()) {
+        addSlowCase(notInt32);
+        return;
+    }
+    Jump end = jump();
+
+    notInt32.link(this);
+    if (!opType.definitelyIsNumber())
+        addSlowCase(branch32(Above, regT1, Imm32(JSValue::LowestTag)));
+    move(Imm32(constant), regT2);
+    convertInt32ToDouble(regT2, fpRegT0);
+    emitLoadDouble(op, fpRegT1);
+    subDouble(fpRegT0, fpRegT1);
+    emitStoreDouble(dst, fpRegT1);
+
+    end.link(this);
+}
+
+void JIT::emitSlow_op_sub(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
+
+    if (isOperandConstantImmediateInt(op2)) {
+        linkSlowCase(iter); // overflow check
+
+        if (!supportsFloatingPoint() || !types.first().definitelyIsNumber())
+            linkSlowCase(iter); // int32 or double check
+    } else {
+        linkSlowCase(iter); // overflow check
+
+        if (!supportsFloatingPoint()) {
+            linkSlowCase(iter); // int32 check
+            linkSlowCase(iter); // int32 check
+        } else {
+            if (!types.first().definitelyIsNumber())
+                linkSlowCase(iter); // double check
+
+            if (!types.second().definitelyIsNumber()) {
+                linkSlowCase(iter); // int32 check
+                linkSlowCase(iter); // double check
+            }
+        }
+    }
+
+    JITStubCall stubCall(this, cti_op_sub);
+    stubCall.addArgument(op1);
+    stubCall.addArgument(op2);
+    stubCall.call(dst);
+}
+
+void JIT::emitBinaryDoubleOp(OpcodeID opcodeID, unsigned dst, unsigned op1, unsigned op2, OperandTypes types, JumpList& notInt32Op1, JumpList& notInt32Op2, bool op1IsInRegisters, bool op2IsInRegisters)
+{
+    JumpList end;
+    
+    if (!notInt32Op1.empty()) {
+        // Double case 1: Op1 is not int32; Op2 is unknown.
+        notInt32Op1.link(this);
+
+        ASSERT(op1IsInRegisters);
+
+        // Verify Op1 is double.
+        if (!types.first().definitelyIsNumber())
+            addSlowCase(branch32(Above, regT1, Imm32(JSValue::LowestTag)));
+
+        if (!op2IsInRegisters)
+            emitLoad(op2, regT3, regT2);
+
+        Jump doubleOp2 = branch32(Below, regT3, Imm32(JSValue::LowestTag));
+
+        if (!types.second().definitelyIsNumber())
+            addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+
+        convertInt32ToDouble(regT2, fpRegT0);
+        Jump doTheMath = jump();
+
+        // Load Op2 as double into double register.
+        doubleOp2.link(this);
+        emitLoadDouble(op2, fpRegT0);
+
+        // Do the math.
+        doTheMath.link(this);
+        switch (opcodeID) {
+            case op_mul:
+                emitLoadDouble(op1, fpRegT2);
+                mulDouble(fpRegT2, fpRegT0);
+                emitStoreDouble(dst, fpRegT0);
+                break;
+            case op_add:
+                emitLoadDouble(op1, fpRegT2);
+                addDouble(fpRegT2, fpRegT0);
+                emitStoreDouble(dst, fpRegT0);
+                break;
+            case op_sub:
+                emitLoadDouble(op1, fpRegT1);
+                subDouble(fpRegT0, fpRegT1);
+                emitStoreDouble(dst, fpRegT1);
+                break;
+            case op_div:
+                emitLoadDouble(op1, fpRegT1);
+                divDouble(fpRegT0, fpRegT1);
+                emitStoreDouble(dst, fpRegT1);
+                break;
+            case op_jnless:
+                emitLoadDouble(op1, fpRegT2);
+                addJump(branchDouble(DoubleLessThanOrEqual, fpRegT0, fpRegT2), dst + 3);
+                break;
+            case op_jnlesseq:
+                emitLoadDouble(op1, fpRegT2);
+                addJump(branchDouble(DoubleLessThan, fpRegT0, fpRegT2), dst + 3);
+                break;
+            default:
+                ASSERT_NOT_REACHED();
+        }
+
+        if (!notInt32Op2.empty())
+            end.append(jump());
+    }
+
+    if (!notInt32Op2.empty()) {
+        // Double case 2: Op1 is int32; Op2 is not int32.
+        notInt32Op2.link(this);
+
+        ASSERT(op2IsInRegisters);
+
+        if (!op1IsInRegisters)
+            emitLoadPayload(op1, regT0);
+
+        convertInt32ToDouble(regT0, fpRegT0);
+
+        // Verify op2 is double.
+        if (!types.second().definitelyIsNumber())
+            addSlowCase(branch32(Above, regT3, Imm32(JSValue::LowestTag)));
+
+        // Do the math.
+        switch (opcodeID) {
+            case op_mul:
+                emitLoadDouble(op2, fpRegT2);
+                mulDouble(fpRegT2, fpRegT0);
+                emitStoreDouble(dst, fpRegT0);
+                break;
+            case op_add:
+                emitLoadDouble(op2, fpRegT2);
+                addDouble(fpRegT2, fpRegT0);
+                emitStoreDouble(dst, fpRegT0);
+                break;
+            case op_sub:
+                emitLoadDouble(op2, fpRegT2);
+                subDouble(fpRegT2, fpRegT0);
+                emitStoreDouble(dst, fpRegT0);
+                break;
+            case op_div:
+                emitLoadDouble(op2, fpRegT2);
+                divDouble(fpRegT2, fpRegT0);
+                emitStoreDouble(dst, fpRegT0);
+                break;
+            case op_jnless:
+                emitLoadDouble(op2, fpRegT1);
+                addJump(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), dst + 3);
+                break;
+            case op_jnlesseq:
+                emitLoadDouble(op2, fpRegT1);
+                addJump(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), dst + 3);
+                break;
+            default:
+                ASSERT_NOT_REACHED();
+        }
+    }
+
+    end.link(this);
+}
+
+// Multiplication (*)
+
+void JIT::emit_op_mul(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
+
+    JumpList notInt32Op1;
+    JumpList notInt32Op2;
+
+    emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
+    notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+    notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+
+    // Int32 case.
+    move(regT0, regT3);
+    addSlowCase(branchMul32(Overflow, regT2, regT0));
+    addSlowCase(branchTest32(Zero, regT0));
+    emitStoreInt32(dst, regT0, (op1 == dst || op2 == dst));
+
+    if (!supportsFloatingPoint()) {
+        addSlowCase(notInt32Op1);
+        addSlowCase(notInt32Op2);
+        return;
+    }
+    Jump end = jump();
+
+    // Double case.
+    emitBinaryDoubleOp(op_mul, dst, op1, op2, types, notInt32Op1, notInt32Op2);
+    end.link(this);
+}
+
+void JIT::emitSlow_op_mul(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
+
+    Jump overflow = getSlowCase(iter); // overflow check
+    linkSlowCase(iter); // zero result check
+
+    Jump negZero = branchOr32(Signed, regT2, regT3);
+    emitStoreInt32(dst, Imm32(0), (op1 == dst || op2 == dst));
+
+    emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_mul));
+
+    negZero.link(this);
+    overflow.link(this);
+
+    if (!supportsFloatingPoint()) {
+        linkSlowCase(iter); // int32 check
+        linkSlowCase(iter); // int32 check
+    }
+
+    if (supportsFloatingPoint()) {
+        if (!types.first().definitelyIsNumber())
+            linkSlowCase(iter); // double check
+
+        if (!types.second().definitelyIsNumber()) {
+            linkSlowCase(iter); // int32 check
+            linkSlowCase(iter); // double check
+        }
+    }
+
+    Label jitStubCall(this);
+    JITStubCall stubCall(this, cti_op_mul);
+    stubCall.addArgument(op1);
+    stubCall.addArgument(op2);
+    stubCall.call(dst);
+}
+
+// Division (/)
+
+void JIT::emit_op_div(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
+
+    if (!supportsFloatingPoint()) {
+        addSlowCase(jump());
+        return;
+    }
+
+    // Int32 divide.
+    JumpList notInt32Op1;
+    JumpList notInt32Op2;
+
+    JumpList end;
+
+    emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
+
+    notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+    notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+
+    convertInt32ToDouble(regT0, fpRegT0);
+    convertInt32ToDouble(regT2, fpRegT1);
+    divDouble(fpRegT1, fpRegT0);
+
+    JumpList doubleResult;
+    if (!isOperandConstantImmediateInt(op1) || getConstantOperand(op1).asInt32() > 1) {
+        m_assembler.cvttsd2si_rr(fpRegT0, regT0);
+        convertInt32ToDouble(regT0, fpRegT1);
+        m_assembler.ucomisd_rr(fpRegT1, fpRegT0);
+
+        doubleResult.append(m_assembler.jne());
+        doubleResult.append(m_assembler.jp());
+        
+        doubleResult.append(branchTest32(Zero, regT0));
+
+        // Int32 result.
+        emitStoreInt32(dst, regT0, (op1 == dst || op2 == dst));
+        end.append(jump());
+    }
+
+    // Double result.
+    doubleResult.link(this);
+    emitStoreDouble(dst, fpRegT0);
+    end.append(jump());
+
+    // Double divide.
+    emitBinaryDoubleOp(op_div, dst, op1, op2, types, notInt32Op1, notInt32Op2);
+    end.link(this);
+}
+
+void JIT::emitSlow_op_div(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
+
+    if (!supportsFloatingPoint())
+        linkSlowCase(iter);
+    else {
+        if (!types.first().definitelyIsNumber())
+            linkSlowCase(iter); // double check
+
+        if (!types.second().definitelyIsNumber()) {
+            linkSlowCase(iter); // int32 check
+            linkSlowCase(iter); // double check
+        }
+    }
+
+    JITStubCall stubCall(this, cti_op_div);
+    stubCall.addArgument(op1);
+    stubCall.addArgument(op2);
+    stubCall.call(dst);
+}
+
+// Mod (%)
+
+/* ------------------------------ BEGIN: OP_MOD ------------------------------ */
+
+#if PLATFORM(X86) || PLATFORM(X86_64)
+
+void JIT::emit_op_mod(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    if (isOperandConstantImmediateInt(op2) && getConstantOperand(op2).asInt32() != 0) {
+        emitLoad(op1, X86Registers::edx, X86Registers::eax);
+        move(Imm32(getConstantOperand(op2).asInt32()), X86Registers::ecx);
+        addSlowCase(branch32(NotEqual, X86Registers::edx, Imm32(JSValue::Int32Tag)));
+        if (getConstantOperand(op2).asInt32() == -1)
+            addSlowCase(branch32(Equal, X86Registers::eax, Imm32(0x80000000))); // -2147483648 / -1 => EXC_ARITHMETIC
+    } else {
+        emitLoad2(op1, X86Registers::edx, X86Registers::eax, op2, X86Registers::ebx, X86Registers::ecx);
+        addSlowCase(branch32(NotEqual, X86Registers::edx, Imm32(JSValue::Int32Tag)));
+        addSlowCase(branch32(NotEqual, X86Registers::ebx, Imm32(JSValue::Int32Tag)));
+
+        addSlowCase(branch32(Equal, X86Registers::eax, Imm32(0x80000000))); // -2147483648 / -1 => EXC_ARITHMETIC
+        addSlowCase(branch32(Equal, X86Registers::ecx, Imm32(0))); // divide by 0
+    }
+
+    move(X86Registers::eax, X86Registers::ebx); // Save dividend payload, in case of 0.
+    m_assembler.cdq();
+    m_assembler.idivl_r(X86Registers::ecx);
+    
+    // If the remainder is zero and the dividend is negative, the result is -0.
+    Jump storeResult1 = branchTest32(NonZero, X86Registers::edx);
+    Jump storeResult2 = branchTest32(Zero, X86Registers::ebx, Imm32(0x80000000)); // not negative
+    emitStore(dst, jsNumber(m_globalData, -0.0));
+    Jump end = jump();
+
+    storeResult1.link(this);
+    storeResult2.link(this);
+    emitStoreInt32(dst, X86Registers::edx, (op1 == dst || op2 == dst));
+    end.link(this);
+}
+
+void JIT::emitSlow_op_mod(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    if (isOperandConstantImmediateInt(op2) && getConstantOperand(op2).asInt32() != 0) {
+        linkSlowCase(iter); // int32 check
+        if (getConstantOperand(op2).asInt32() == -1)
+            linkSlowCase(iter); // 0x80000000 check
+    } else {
+        linkSlowCase(iter); // int32 check
+        linkSlowCase(iter); // int32 check
+        linkSlowCase(iter); // 0 check
+        linkSlowCase(iter); // 0x80000000 check
+    }
+
+    JITStubCall stubCall(this, cti_op_mod);
+    stubCall.addArgument(op1);
+    stubCall.addArgument(op2);
+    stubCall.call(dst);
+}
+
+#else // PLATFORM(X86) || PLATFORM(X86_64)
+
+void JIT::emit_op_mod(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    JITStubCall stubCall(this, cti_op_mod);
+    stubCall.addArgument(op1);
+    stubCall.addArgument(op2);
+    stubCall.call(dst);
+}
+
+void JIT::emitSlow_op_mod(Instruction*, Vector<SlowCaseEntry>::iterator&)
+{
+}
+
+#endif // PLATFORM(X86) || PLATFORM(X86_64)
+
+/* ------------------------------ END: OP_MOD ------------------------------ */
+
+#else // USE(JSVALUE32_64)
+
 void JIT::emit_op_lshift(Instruction* currentInstruction)
 {
     unsigned result = currentInstruction[1].u.operand;
@@ -64,7 +1148,7 @@ void JIT::emit_op_lshift(Instruction* currentInstruction)
     and32(Imm32(0x1f), regT2);
 #endif
     lshift32(regT2, regT0);
-#if !USE(ALTERNATE_JSIMMEDIATE)
+#if !USE(JSVALUE64)
     addSlowCase(branchAdd32(Overflow, regT0, regT0));
     signExtend32ToPtr(regT0, regT0);
 #endif
@@ -78,7 +1162,7 @@ void JIT::emitSlow_op_lshift(Instruction* currentInstruction, Vector<SlowCaseEnt
     unsigned op1 = currentInstruction[2].u.operand;
     unsigned op2 = currentInstruction[3].u.operand;
 
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
     UNUSED_PARAM(op1);
     UNUSED_PARAM(op2);
     linkSlowCase(iter);
@@ -92,7 +1176,7 @@ void JIT::emitSlow_op_lshift(Instruction* currentInstruction, Vector<SlowCaseEnt
     notImm1.link(this);
     notImm2.link(this);
 #endif
-    JITStubCall stubCall(this, JITStubs::cti_op_lshift);
+    JITStubCall stubCall(this, cti_op_lshift);
     stubCall.addArgument(regT0);
     stubCall.addArgument(regT2);
     stubCall.call(result);
@@ -109,7 +1193,7 @@ void JIT::emit_op_rshift(Instruction* currentInstruction)
         emitGetVirtualRegister(op1, regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
         // Mask with 0x1f as per ecma-262 11.7.2 step 7.
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
         rshift32(Imm32(getConstantOperandImmediateInt(op2) & 0x1f), regT0);
 #else
         rshiftPtr(Imm32(getConstantOperandImmediateInt(op2) & 0x1f), regT0);
@@ -118,14 +1202,14 @@ void JIT::emit_op_rshift(Instruction* currentInstruction)
         emitGetVirtualRegisters(op1, regT0, op2, regT2);
         if (supportsFloatingPointTruncate()) {
             Jump lhsIsInt = emitJumpIfImmediateInteger(regT0);
-#if USE(ALTERNATE_JSIMMEDIATE)
-            // supportsFloatingPoint() && USE(ALTERNATE_JSIMMEDIATE) => 3 SlowCases
+#if USE(JSVALUE64)
+            // supportsFloatingPoint() && USE(JSVALUE64) => 3 SlowCases
             addSlowCase(emitJumpIfNotImmediateNumber(regT0));
             addPtr(tagTypeNumberRegister, regT0);
             movePtrToDouble(regT0, fpRegT0);
             addSlowCase(branchTruncateDoubleToInt32(fpRegT0, regT0));
 #else
-            // supportsFloatingPoint() && !USE(ALTERNATE_JSIMMEDIATE) => 5 SlowCases (of which 1 IfNotJSCell)
+            // supportsFloatingPoint() && !USE(JSVALUE64) => 5 SlowCases (of which 1 IfNotJSCell)
             emitJumpSlowCaseIfNotJSCell(regT0, op1);
             addSlowCase(checkStructure(regT0, m_globalData->numberStructure.get()));
             loadDouble(Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
@@ -145,13 +1229,13 @@ void JIT::emit_op_rshift(Instruction* currentInstruction)
         // On 32-bit x86 this is not necessary, since the shift anount is implicitly masked in the instruction.
         and32(Imm32(0x1f), regT2);
 #endif
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
         rshift32(regT2, regT0);
 #else
         rshiftPtr(regT2, regT0);
 #endif
     }
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
     emitFastArithIntToImmNoCheck(regT0, regT0);
 #else
     orPtr(Imm32(JSImmediate::TagTypeNumber), regT0);
@@ -165,7 +1249,7 @@ void JIT::emitSlow_op_rshift(Instruction* currentInstruction, Vector<SlowCaseEnt
     unsigned op1 = currentInstruction[2].u.operand;
     unsigned op2 = currentInstruction[3].u.operand;
 
-    JITStubCall stubCall(this, JITStubs::cti_op_rshift);
+    JITStubCall stubCall(this, cti_op_rshift);
 
     if (isOperandConstantImmediateInt(op2)) {
         linkSlowCase(iter);
@@ -173,7 +1257,7 @@ void JIT::emitSlow_op_rshift(Instruction* currentInstruction, Vector<SlowCaseEnt
         stubCall.addArgument(op2, regT2);
     } else {
         if (supportsFloatingPointTruncate()) {
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
             linkSlowCase(iter);
             linkSlowCase(iter);
             linkSlowCase(iter);
@@ -214,7 +1298,7 @@ void JIT::emit_op_jnless(Instruction* currentInstruction)
     if (isOperandConstantImmediateInt(op2)) {
         emitGetVirtualRegister(op1, regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
         int32_t op2imm = getConstantOperandImmediateInt(op2);
 #else
         int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
@@ -223,7 +1307,7 @@ void JIT::emit_op_jnless(Instruction* currentInstruction)
     } else if (isOperandConstantImmediateInt(op1)) {
         emitGetVirtualRegister(op2, regT1);
         emitJumpSlowCaseIfNotImmediateInteger(regT1);
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
         int32_t op1imm = getConstantOperandImmediateInt(op1);
 #else
         int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
@@ -253,7 +1337,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
         linkSlowCase(iter);
 
         if (supportsFloatingPoint()) {
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
             Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
             addPtr(tagTypeNumberRegister, regT0);
             movePtrToDouble(regT0, fpRegT0);
@@ -266,7 +1350,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
             loadDouble(Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
 #endif
             
-            int32_t op2imm = getConstantOperand(op2).getInt32Fast();;
+            int32_t op2imm = getConstantOperand(op2).asInt32();;
                     
             move(Imm32(op2imm), regT1);
             convertInt32ToDouble(regT1, fpRegT1);
@@ -275,7 +1359,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
             fail1.link(this);
 #else
             if (!m_codeBlock->isKnownNotImmediate(op1))
@@ -284,7 +1368,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
 #endif
         }
 
-        JITStubCall stubCall(this, JITStubs::cti_op_jless);
+        JITStubCall stubCall(this, cti_op_jless);
         stubCall.addArgument(regT0);
         stubCall.addArgument(op2, regT2);
         stubCall.call();
@@ -294,7 +1378,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
         linkSlowCase(iter);
 
         if (supportsFloatingPoint()) {
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
             Jump fail1 = emitJumpIfNotImmediateNumber(regT1);
             addPtr(tagTypeNumberRegister, regT1);
             movePtrToDouble(regT1, fpRegT1);
@@ -307,7 +1391,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
             loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
 #endif
             
-            int32_t op1imm = getConstantOperand(op1).getInt32Fast();;
+            int32_t op1imm = getConstantOperand(op1).asInt32();;
                     
             move(Imm32(op1imm), regT0);
             convertInt32ToDouble(regT0, fpRegT0);
@@ -316,7 +1400,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
             fail1.link(this);
 #else
             if (!m_codeBlock->isKnownNotImmediate(op2))
@@ -325,7 +1409,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
 #endif
         }
 
-        JITStubCall stubCall(this, JITStubs::cti_op_jless);
+        JITStubCall stubCall(this, cti_op_jless);
         stubCall.addArgument(op1, regT2);
         stubCall.addArgument(regT1);
         stubCall.call();
@@ -335,7 +1419,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
         linkSlowCase(iter);
 
         if (supportsFloatingPoint()) {
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
             Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
             Jump fail2 = emitJumpIfNotImmediateNumber(regT1);
             Jump fail3 = emitJumpIfImmediateInteger(regT1);
@@ -362,7 +1446,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
             fail1.link(this);
             fail2.link(this);
             fail3.link(this);
@@ -377,7 +1461,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
         }
 
         linkSlowCase(iter);
-        JITStubCall stubCall(this, JITStubs::cti_op_jless);
+        JITStubCall stubCall(this, cti_op_jless);
         stubCall.addArgument(regT0);
         stubCall.addArgument(regT1);
         stubCall.call();
@@ -399,7 +1483,7 @@ void JIT::emit_op_jnlesseq(Instruction* currentInstruction)
     if (isOperandConstantImmediateInt(op2)) {
         emitGetVirtualRegister(op1, regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
         int32_t op2imm = getConstantOperandImmediateInt(op2);
 #else
         int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
@@ -408,7 +1492,7 @@ void JIT::emit_op_jnlesseq(Instruction* currentInstruction)
     } else if (isOperandConstantImmediateInt(op1)) {
         emitGetVirtualRegister(op2, regT1);
         emitJumpSlowCaseIfNotImmediateInteger(regT1);
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
         int32_t op1imm = getConstantOperandImmediateInt(op1);
 #else
         int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
@@ -438,7 +1522,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
         linkSlowCase(iter);
 
         if (supportsFloatingPoint()) {
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
             Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
             addPtr(tagTypeNumberRegister, regT0);
             movePtrToDouble(regT0, fpRegT0);
@@ -451,7 +1535,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
             loadDouble(Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
 #endif
             
-            int32_t op2imm = getConstantOperand(op2).getInt32Fast();;
+            int32_t op2imm = getConstantOperand(op2).asInt32();;
                     
             move(Imm32(op2imm), regT1);
             convertInt32ToDouble(regT1, fpRegT1);
@@ -460,7 +1544,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
 
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
             fail1.link(this);
 #else
             if (!m_codeBlock->isKnownNotImmediate(op1))
@@ -469,7 +1553,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
 #endif
         }
 
-        JITStubCall stubCall(this, JITStubs::cti_op_jlesseq);
+        JITStubCall stubCall(this, cti_op_jlesseq);
         stubCall.addArgument(regT0);
         stubCall.addArgument(op2, regT2);
         stubCall.call();
@@ -479,7 +1563,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
         linkSlowCase(iter);
 
         if (supportsFloatingPoint()) {
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
             Jump fail1 = emitJumpIfNotImmediateNumber(regT1);
             addPtr(tagTypeNumberRegister, regT1);
             movePtrToDouble(regT1, fpRegT1);
@@ -492,7 +1576,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
             loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
 #endif
             
-            int32_t op1imm = getConstantOperand(op1).getInt32Fast();;
+            int32_t op1imm = getConstantOperand(op1).asInt32();;
                     
             move(Imm32(op1imm), regT0);
             convertInt32ToDouble(regT0, fpRegT0);
@@ -501,7 +1585,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
 
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
             fail1.link(this);
 #else
             if (!m_codeBlock->isKnownNotImmediate(op2))
@@ -510,7 +1594,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
 #endif
         }
 
-        JITStubCall stubCall(this, JITStubs::cti_op_jlesseq);
+        JITStubCall stubCall(this, cti_op_jlesseq);
         stubCall.addArgument(op1, regT2);
         stubCall.addArgument(regT1);
         stubCall.call();
@@ -520,7 +1604,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
         linkSlowCase(iter);
 
         if (supportsFloatingPoint()) {
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
             Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
             Jump fail2 = emitJumpIfNotImmediateNumber(regT1);
             Jump fail3 = emitJumpIfImmediateInteger(regT1);
@@ -547,7 +1631,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
 
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
             fail1.link(this);
             fail2.link(this);
             fail3.link(this);
@@ -562,7 +1646,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
         }
 
         linkSlowCase(iter);
-        JITStubCall stubCall(this, JITStubs::cti_op_jlesseq);
+        JITStubCall stubCall(this, cti_op_jlesseq);
         stubCall.addArgument(regT0);
         stubCall.addArgument(regT1);
         stubCall.call();
@@ -579,7 +1663,7 @@ void JIT::emit_op_bitand(Instruction* currentInstruction)
     if (isOperandConstantImmediateInt(op1)) {
         emitGetVirtualRegister(op2, regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
         int32_t imm = getConstantOperandImmediateInt(op1);
         andPtr(Imm32(imm), regT0);
         if (imm >= 0)
@@ -590,7 +1674,7 @@ void JIT::emit_op_bitand(Instruction* currentInstruction)
     } else if (isOperandConstantImmediateInt(op2)) {
         emitGetVirtualRegister(op1, regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
         int32_t imm = getConstantOperandImmediateInt(op2);
         andPtr(Imm32(imm), regT0);
         if (imm >= 0)
@@ -614,17 +1698,17 @@ void JIT::emitSlow_op_bitand(Instruction* currentInstruction, Vector<SlowCaseEnt
 
     linkSlowCase(iter);
     if (isOperandConstantImmediateInt(op1)) {
-        JITStubCall stubCall(this, JITStubs::cti_op_bitand);
+        JITStubCall stubCall(this, cti_op_bitand);
         stubCall.addArgument(op1, regT2);
         stubCall.addArgument(regT0);
         stubCall.call(result);
     } else if (isOperandConstantImmediateInt(op2)) {
-        JITStubCall stubCall(this, JITStubs::cti_op_bitand);
+        JITStubCall stubCall(this, cti_op_bitand);
         stubCall.addArgument(regT0);
         stubCall.addArgument(op2, regT2);
         stubCall.call(result);
     } else {
-        JITStubCall stubCall(this, JITStubs::cti_op_bitand);
+        JITStubCall stubCall(this, cti_op_bitand);
         stubCall.addArgument(op1, regT2);
         stubCall.addArgument(regT1);
         stubCall.call(result);
@@ -639,7 +1723,7 @@ void JIT::emit_op_post_inc(Instruction* currentInstruction)
     emitGetVirtualRegister(srcDst, regT0);
     move(regT0, regT1);
     emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
     addSlowCase(branchAdd32(Overflow, Imm32(1), regT1));
     emitFastArithIntToImmNoCheck(regT1, regT1);
 #else
@@ -657,7 +1741,7 @@ void JIT::emitSlow_op_post_inc(Instruction* currentInstruction, Vector<SlowCaseE
 
     linkSlowCase(iter);
     linkSlowCase(iter);
-    JITStubCall stubCall(this, JITStubs::cti_op_post_inc);
+    JITStubCall stubCall(this, cti_op_post_inc);
     stubCall.addArgument(regT0);
     stubCall.addArgument(Imm32(srcDst));
     stubCall.call(result);
@@ -671,7 +1755,7 @@ void JIT::emit_op_post_dec(Instruction* currentInstruction)
     emitGetVirtualRegister(srcDst, regT0);
     move(regT0, regT1);
     emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
     addSlowCase(branchSub32(Zero, Imm32(1), regT1));
     emitFastArithIntToImmNoCheck(regT1, regT1);
 #else
@@ -689,7 +1773,7 @@ void JIT::emitSlow_op_post_dec(Instruction* currentInstruction, Vector<SlowCaseE
 
     linkSlowCase(iter);
     linkSlowCase(iter);
-    JITStubCall stubCall(this, JITStubs::cti_op_post_dec);
+    JITStubCall stubCall(this, cti_op_post_dec);
     stubCall.addArgument(regT0);
     stubCall.addArgument(Imm32(srcDst));
     stubCall.call(result);
@@ -701,7 +1785,7 @@ void JIT::emit_op_pre_inc(Instruction* currentInstruction)
 
     emitGetVirtualRegister(srcDst, regT0);
     emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
     addSlowCase(branchAdd32(Overflow, Imm32(1), regT0));
     emitFastArithIntToImmNoCheck(regT0, regT0);
 #else
@@ -719,7 +1803,7 @@ void JIT::emitSlow_op_pre_inc(Instruction* currentInstruction, Vector<SlowCaseEn
     linkSlowCase(iter);
     emitGetVirtualRegister(srcDst, regT0);
     notImm.link(this);
-    JITStubCall stubCall(this, JITStubs::cti_op_pre_inc);
+    JITStubCall stubCall(this, cti_op_pre_inc);
     stubCall.addArgument(regT0);
     stubCall.call(srcDst);
 }
@@ -730,7 +1814,7 @@ void JIT::emit_op_pre_dec(Instruction* currentInstruction)
 
     emitGetVirtualRegister(srcDst, regT0);
     emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
     addSlowCase(branchSub32(Zero, Imm32(1), regT0));
     emitFastArithIntToImmNoCheck(regT0, regT0);
 #else
@@ -748,7 +1832,7 @@ void JIT::emitSlow_op_pre_dec(Instruction* currentInstruction, Vector<SlowCaseEn
     linkSlowCase(iter);
     emitGetVirtualRegister(srcDst, regT0);
     notImm.link(this);
-    JITStubCall stubCall(this, JITStubs::cti_op_pre_dec);
+    JITStubCall stubCall(this, cti_op_pre_dec);
     stubCall.addArgument(regT0);
     stubCall.call(srcDst);
 }
@@ -763,21 +1847,21 @@ void JIT::emit_op_mod(Instruction* currentInstruction)
     unsigned op1 = currentInstruction[2].u.operand;
     unsigned op2 = currentInstruction[3].u.operand;
 
-    emitGetVirtualRegisters(op1, X86::eax, op2, X86::ecx);
-    emitJumpSlowCaseIfNotImmediateInteger(X86::eax);
-    emitJumpSlowCaseIfNotImmediateInteger(X86::ecx);
-#if USE(ALTERNATE_JSIMMEDIATE)
-    addSlowCase(branchPtr(Equal, X86::ecx, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0)))));
+    emitGetVirtualRegisters(op1, X86Registers::eax, op2, X86Registers::ecx);
+    emitJumpSlowCaseIfNotImmediateInteger(X86Registers::eax);
+    emitJumpSlowCaseIfNotImmediateInteger(X86Registers::ecx);
+#if USE(JSVALUE64)
+    addSlowCase(branchPtr(Equal, X86Registers::ecx, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0)))));
     m_assembler.cdq();
-    m_assembler.idivl_r(X86::ecx);
+    m_assembler.idivl_r(X86Registers::ecx);
 #else
-    emitFastArithDeTagImmediate(X86::eax);
-    addSlowCase(emitFastArithDeTagImmediateJumpIfZero(X86::ecx));
+    emitFastArithDeTagImmediate(X86Registers::eax);
+    addSlowCase(emitFastArithDeTagImmediateJumpIfZero(X86Registers::ecx));
     m_assembler.cdq();
-    m_assembler.idivl_r(X86::ecx);
-    signExtend32ToPtr(X86::edx, X86::edx);
+    m_assembler.idivl_r(X86Registers::ecx);
+    signExtend32ToPtr(X86Registers::edx, X86Registers::edx);
 #endif
-    emitFastArithReTagImmediate(X86::edx, X86::eax);
+    emitFastArithReTagImmediate(X86Registers::edx, X86Registers::eax);
     emitPutVirtualRegister(result);
 }
 
@@ -785,7 +1869,7 @@ void JIT::emitSlow_op_mod(Instruction* currentInstruction, Vector<SlowCaseEntry>
 {
     unsigned result = currentInstruction[1].u.operand;
 
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
     linkSlowCase(iter);
     linkSlowCase(iter);
     linkSlowCase(iter);
@@ -793,14 +1877,14 @@ void JIT::emitSlow_op_mod(Instruction* currentInstruction, Vector<SlowCaseEntry>
     Jump notImm1 = getSlowCase(iter);
     Jump notImm2 = getSlowCase(iter);
     linkSlowCase(iter);
-    emitFastArithReTagImmediate(X86::eax, X86::eax);
-    emitFastArithReTagImmediate(X86::ecx, X86::ecx);
+    emitFastArithReTagImmediate(X86Registers::eax, X86Registers::eax);
+    emitFastArithReTagImmediate(X86Registers::ecx, X86Registers::ecx);
     notImm1.link(this);
     notImm2.link(this);
 #endif
-    JITStubCall stubCall(this, JITStubs::cti_op_mod);
-    stubCall.addArgument(X86::eax);
-    stubCall.addArgument(X86::ecx);
+    JITStubCall stubCall(this, cti_op_mod);
+    stubCall.addArgument(X86Registers::eax);
+    stubCall.addArgument(X86Registers::ecx);
     stubCall.call(result);
 }
 
@@ -812,7 +1896,7 @@ void JIT::emit_op_mod(Instruction* currentInstruction)
     unsigned op1 = currentInstruction[2].u.operand;
     unsigned op2 = currentInstruction[3].u.operand;
 
-    JITStubCall stubCall(this, JITStubs::cti_op_mod);
+    JITStubCall stubCall(this, cti_op_mod);
     stubCall.addArgument(op1, regT2);
     stubCall.addArgument(op2, regT2);
     stubCall.call(result);
@@ -827,64 +1911,9 @@ void JIT::emitSlow_op_mod(Instruction*, Vector<SlowCaseEntry>::iterator&)
 
 /* ------------------------------ END: OP_MOD ------------------------------ */
 
-#if !ENABLE(JIT_OPTIMIZE_ARITHMETIC)
-
-/* ------------------------------ BEGIN: !ENABLE(JIT_OPTIMIZE_ARITHMETIC) (OP_ADD, OP_SUB, OP_MUL) ------------------------------ */
-
-void JIT::emit_op_add(Instruction* currentInstruction)
-{
-    unsigned result = currentInstruction[1].u.operand;
-    unsigned op1 = currentInstruction[2].u.operand;
-    unsigned op2 = currentInstruction[3].u.operand;
-
-    JITStubCall stubCall(this, JITStubs::cti_op_add);
-    stubCall.addArgument(op1, regT2);
-    stubCall.addArgument(op2, regT2);
-    stubCall.call(result);
-}
-
-void JIT::emitSlow_op_add(Instruction*, Vector<SlowCaseEntry>::iterator&)
-{
-    ASSERT_NOT_REACHED();
-}
-
-void JIT::emit_op_mul(Instruction* currentInstruction)
-{
-    unsigned result = currentInstruction[1].u.operand;
-    unsigned op1 = currentInstruction[2].u.operand;
-    unsigned op2 = currentInstruction[3].u.operand;
-
-    JITStubCall stubCall(this, JITStubs::cti_op_mul);
-    stubCall.addArgument(op1, regT2);
-    stubCall.addArgument(op2, regT2);
-    stubCall.call(result);
-}
-
-void JIT::emitSlow_op_mul(Instruction*, Vector<SlowCaseEntry>::iterator&)
-{
-    ASSERT_NOT_REACHED();
-}
-
-void JIT::emit_op_sub(Instruction* currentInstruction)
-{
-    unsigned result = currentInstruction[1].u.operand;
-    unsigned op1 = currentInstruction[2].u.operand;
-    unsigned op2 = currentInstruction[3].u.operand;
+#if USE(JSVALUE64)
 
-    JITStubCall stubCall(this, JITStubs::cti_op_sub);
-    stubCall.addArgument(op1, regT2);
-    stubCall.addArgument(op2, regT2);
-    stubCall.call(result);
-}
-
-void JIT::emitSlow_op_sub(Instruction*, Vector<SlowCaseEntry>::iterator&)
-{
-    ASSERT_NOT_REACHED();
-}
-
-#elif USE(ALTERNATE_JSIMMEDIATE) // *AND* ENABLE(JIT_OPTIMIZE_ARITHMETIC)
-
-/* ------------------------------ BEGIN: USE(ALTERNATE_JSIMMEDIATE) (OP_ADD, OP_SUB, OP_MUL) ------------------------------ */
+/* ------------------------------ BEGIN: USE(JSVALUE64) (OP_ADD, OP_SUB, OP_MUL) ------------------------------ */
 
 void JIT::compileBinaryArithOp(OpcodeID opcodeID, unsigned, unsigned op1, unsigned op2, OperandTypes)
 {
@@ -917,7 +1946,7 @@ void JIT::compileBinaryArithOpSlowCase(OpcodeID opcodeID, Vector<SlowCaseEntry>:
     emitGetVirtualRegister(op1, regT0);
 
     Label stubFunctionCall(this);
-    JITStubCall stubCall(this, opcodeID == op_add ? JITStubs::cti_op_add : opcodeID == op_sub ? JITStubs::cti_op_sub : JITStubs::cti_op_mul);
+    JITStubCall stubCall(this, opcodeID == op_add ? cti_op_add : opcodeID == op_sub ? cti_op_sub : cti_op_mul);
     stubCall.addArgument(regT0);
     stubCall.addArgument(regT1);
     stubCall.call(result);
@@ -968,7 +1997,7 @@ void JIT::emit_op_add(Instruction* currentInstruction)
     OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
 
     if (!types.first().mightBeNumber() || !types.second().mightBeNumber()) {
-        JITStubCall stubCall(this, JITStubs::cti_op_add);
+        JITStubCall stubCall(this, cti_op_add);
         stubCall.addArgument(op1, regT2);
         stubCall.addArgument(op2, regT2);
         stubCall.call(result);
@@ -1000,7 +2029,7 @@ void JIT::emitSlow_op_add(Instruction* currentInstruction, Vector<SlowCaseEntry>
     if (isOperandConstantImmediateInt(op1) || isOperandConstantImmediateInt(op2)) {
         linkSlowCase(iter);
         linkSlowCase(iter);
-        JITStubCall stubCall(this, JITStubs::cti_op_add);
+        JITStubCall stubCall(this, cti_op_add);
         stubCall.addArgument(op1, regT2);
         stubCall.addArgument(op2, regT2);
         stubCall.call(result);
@@ -1045,7 +2074,7 @@ void JIT::emitSlow_op_mul(Instruction* currentInstruction, Vector<SlowCaseEntry>
         linkSlowCase(iter);
         linkSlowCase(iter);
         // There is an extra slow case for (op1 * -N) or (-N * op2), to check for 0 since this should produce a result of -0.
-        JITStubCall stubCall(this, JITStubs::cti_op_mul);
+        JITStubCall stubCall(this, cti_op_mul);
         stubCall.addArgument(op1, regT2);
         stubCall.addArgument(op2, regT2);
         stubCall.call(result);
@@ -1075,9 +2104,9 @@ void JIT::emitSlow_op_sub(Instruction* currentInstruction, Vector<SlowCaseEntry>
     compileBinaryArithOpSlowCase(op_sub, iter, result, op1, op2, types);
 }
 
-#else // !ENABLE(JIT_OPTIMIZE_ARITHMETIC)
+#else // USE(JSVALUE64)
 
-/* ------------------------------ BEGIN: !ENABLE(JIT_OPTIMIZE_ARITHMETIC) (OP_ADD, OP_SUB, OP_MUL) ------------------------------ */
+/* ------------------------------ BEGIN: !USE(JSVALUE64) (OP_ADD, OP_SUB, OP_MUL) ------------------------------ */
 
 void JIT::compileBinaryArithOp(OpcodeID opcodeID, unsigned dst, unsigned src1, unsigned src2, OperandTypes types)
 {
@@ -1244,7 +2273,7 @@ void JIT::compileBinaryArithOpSlowCase(OpcodeID opcodeID, Vector<SlowCaseEntry>:
     if (opcodeID == op_mul)
         linkSlowCase(iter);
 
-    JITStubCall stubCall(this, opcodeID == op_add ? JITStubs::cti_op_add : opcodeID == op_sub ? JITStubs::cti_op_sub : JITStubs::cti_op_mul);
+    JITStubCall stubCall(this, opcodeID == op_add ? cti_op_add : opcodeID == op_sub ? cti_op_sub : cti_op_mul);
     stubCall.addArgument(src1, regT2);
     stubCall.addArgument(src2, regT2);
     stubCall.call(dst);
@@ -1273,7 +2302,7 @@ void JIT::emit_op_add(Instruction* currentInstruction)
         if (types.first().mightBeNumber() && types.second().mightBeNumber())
             compileBinaryArithOp(op_add, result, op1, op2, OperandTypes::fromInt(currentInstruction[4].u.operand));
         else {
-            JITStubCall stubCall(this, JITStubs::cti_op_add);
+            JITStubCall stubCall(this, cti_op_add);
             stubCall.addArgument(op1, regT2);
             stubCall.addArgument(op2, regT2);
             stubCall.call(result);
@@ -1292,7 +2321,7 @@ void JIT::emitSlow_op_add(Instruction* currentInstruction, Vector<SlowCaseEntry>
         linkSlowCase(iter);
         sub32(Imm32(getConstantOperandImmediateInt(op1) << JSImmediate::IntegerPayloadShift), regT0);
         notImm.link(this);
-        JITStubCall stubCall(this, JITStubs::cti_op_add);
+        JITStubCall stubCall(this, cti_op_add);
         stubCall.addArgument(op1, regT2);
         stubCall.addArgument(regT0);
         stubCall.call(result);
@@ -1301,7 +2330,7 @@ void JIT::emitSlow_op_add(Instruction* currentInstruction, Vector<SlowCaseEntry>
         linkSlowCase(iter);
         sub32(Imm32(getConstantOperandImmediateInt(op2) << JSImmediate::IntegerPayloadShift), regT0);
         notImm.link(this);
-        JITStubCall stubCall(this, JITStubs::cti_op_add);
+        JITStubCall stubCall(this, cti_op_add);
         stubCall.addArgument(regT0);
         stubCall.addArgument(op2, regT2);
         stubCall.call(result);
@@ -1351,7 +2380,7 @@ void JIT::emitSlow_op_mul(Instruction* currentInstruction, Vector<SlowCaseEntry>
         linkSlowCase(iter);
         linkSlowCase(iter);
         // There is an extra slow case for (op1 * -N) or (-N * op2), to check for 0 since this should produce a result of -0.
-        JITStubCall stubCall(this, JITStubs::cti_op_mul);
+        JITStubCall stubCall(this, cti_op_mul);
         stubCall.addArgument(op1, regT2);
         stubCall.addArgument(op2, regT2);
         stubCall.call(result);
@@ -1369,10 +2398,12 @@ void JIT::emitSlow_op_sub(Instruction* currentInstruction, Vector<SlowCaseEntry>
     compileBinaryArithOpSlowCase(op_sub, iter, currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand, OperandTypes::fromInt(currentInstruction[4].u.operand));
 }
 
-#endif // !ENABLE(JIT_OPTIMIZE_ARITHMETIC)
+#endif // USE(JSVALUE64)
 
 /* ------------------------------ END: OP_ADD, OP_SUB, OP_MUL ------------------------------ */
 
+#endif // USE(JSVALUE32_64)
+
 } // namespace JSC
 
 #endif // ENABLE(JIT)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp
index abdb5ed..4fd24d2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp
@@ -45,14 +45,401 @@ using namespace std;
 
 namespace JSC {
 
+#if USE(JSVALUE32_64)
+
+void JIT::compileOpCallInitializeCallFrame()
+{
+    // regT0 holds callee, regT1 holds argCount
+    store32(regT1, Address(callFrameRegister, RegisterFile::ArgumentCount * static_cast<int>(sizeof(Register))));
+
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_data) + OBJECT_OFFSETOF(ScopeChain, m_node)), regT1); // scopeChain
+
+    emitStore(static_cast<unsigned>(RegisterFile::OptionalCalleeArguments), JSValue());
+    storePtr(regT0, Address(callFrameRegister, RegisterFile::Callee * static_cast<int>(sizeof(Register)))); // callee
+    storePtr(regT1, Address(callFrameRegister, RegisterFile::ScopeChain * static_cast<int>(sizeof(Register)))); // scopeChain
+}
+
+void JIT::compileOpCallSetupArgs(Instruction* instruction)
+{
+    int argCount = instruction[3].u.operand;
+    int registerOffset = instruction[4].u.operand;
+
+    emitPutJITStubArg(regT1, regT0, 0);
+    emitPutJITStubArgConstant(registerOffset, 1);
+    emitPutJITStubArgConstant(argCount, 2);
+}
+          
+void JIT::compileOpConstructSetupArgs(Instruction* instruction)
+{
+    int argCount = instruction[3].u.operand;
+    int registerOffset = instruction[4].u.operand;
+    int proto = instruction[5].u.operand;
+    int thisRegister = instruction[6].u.operand;
+
+    emitPutJITStubArg(regT1, regT0, 0);
+    emitPutJITStubArgConstant(registerOffset, 1);
+    emitPutJITStubArgConstant(argCount, 2);
+    emitPutJITStubArgFromVirtualRegister(proto, 3, regT2, regT3);
+    emitPutJITStubArgConstant(thisRegister, 4);
+}
+
+void JIT::compileOpCallVarargsSetupArgs(Instruction*)
+{
+    emitPutJITStubArg(regT1, regT0, 0);
+    emitPutJITStubArg(regT3, 1); // registerOffset
+    emitPutJITStubArg(regT2, 2); // argCount
+}
+
+void JIT::compileOpCallVarargs(Instruction* instruction)
+{
+    int dst = instruction[1].u.operand;
+    int callee = instruction[2].u.operand;
+    int argCountRegister = instruction[3].u.operand;
+    int registerOffset = instruction[4].u.operand;
+
+    emitLoad(callee, regT1, regT0);
+    emitLoadPayload(argCountRegister, regT2); // argCount
+    addPtr(Imm32(registerOffset), regT2, regT3); // registerOffset
+
+    compileOpCallVarargsSetupArgs(instruction);
+
+    emitJumpSlowCaseIfNotJSCell(callee, regT1);
+    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsFunctionVPtr)));
+
+    // Speculatively roll the callframe, assuming argCount will match the arity.
+    mul32(Imm32(sizeof(Register)), regT3, regT3);
+    addPtr(callFrameRegister, regT3);
+    storePtr(callFrameRegister, Address(regT3, RegisterFile::CallerFrame * static_cast<int>(sizeof(Register))));
+    move(regT3, callFrameRegister);
+
+    move(regT2, regT1); // argCount
+
+    emitNakedCall(m_globalData->jitStubs.ctiVirtualCall());
+
+    emitStore(dst, regT1, regT0);
+    
+    sampleCodeBlock(m_codeBlock);
+}
+
+void JIT::compileOpCallVarargsSlowCase(Instruction* instruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int dst = instruction[1].u.operand;
+    int callee = instruction[2].u.operand;
+
+    linkSlowCaseIfNotJSCell(iter, callee);
+    linkSlowCase(iter);
+
+    JITStubCall stubCall(this, cti_op_call_NotJSFunction);
+    stubCall.call(dst); // In the interpreter, the callee puts the return value in dst.
+
+    map(m_bytecodeIndex + OPCODE_LENGTH(op_call_varargs), dst, regT1, regT0);
+    sampleCodeBlock(m_codeBlock);
+}
+
+void JIT::emit_op_ret(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+
+    // We could JIT generate the deref, only calling out to C when the refcount hits zero.
+    if (m_codeBlock->needsFullScopeChain())
+        JITStubCall(this, cti_op_ret_scopeChain).call();
+
+    emitLoad(dst, regT1, regT0);
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT2);
+    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
+
+    restoreReturnAddressBeforeReturn(regT2);
+    ret();
+}
+
+void JIT::emit_op_construct_verify(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+
+    emitLoad(dst, regT1, regT0);
+    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    addSlowCase(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo) + OBJECT_OFFSETOF(TypeInfo, m_type)), Imm32(ObjectType)));
+}
+
+void JIT::emitSlow_op_construct_verify(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned src = currentInstruction[2].u.operand;
+
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    emitLoad(src, regT1, regT0);
+    emitStore(dst, regT1, regT0);
+}
+
+void JIT::emitSlow_op_call(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallSlowCase(currentInstruction, iter, m_callLinkInfoIndex++, op_call);
+}
+
+void JIT::emitSlow_op_call_eval(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallSlowCase(currentInstruction, iter, m_callLinkInfoIndex++, op_call_eval);
+}
+
+void JIT::emitSlow_op_call_varargs(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallVarargsSlowCase(currentInstruction, iter);
+}
+
+void JIT::emitSlow_op_construct(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallSlowCase(currentInstruction, iter, m_callLinkInfoIndex++, op_construct);
+}
+
+void JIT::emit_op_call(Instruction* currentInstruction)
+{
+    compileOpCall(op_call, currentInstruction, m_callLinkInfoIndex++);
+}
+
+void JIT::emit_op_call_eval(Instruction* currentInstruction)
+{
+    compileOpCall(op_call_eval, currentInstruction, m_callLinkInfoIndex++);
+}
+
+void JIT::emit_op_load_varargs(Instruction* currentInstruction)
+{
+    int argCountDst = currentInstruction[1].u.operand;
+    int argsOffset = currentInstruction[2].u.operand;
+
+    JITStubCall stubCall(this, cti_op_load_varargs);
+    stubCall.addArgument(Imm32(argsOffset));
+    stubCall.call();
+    // Stores a naked int32 in the register file.
+    store32(returnValueRegister, Address(callFrameRegister, argCountDst * sizeof(Register)));
+}
+
+void JIT::emit_op_call_varargs(Instruction* currentInstruction)
+{
+    compileOpCallVarargs(currentInstruction);
+}
+
+void JIT::emit_op_construct(Instruction* currentInstruction)
+{
+    compileOpCall(op_construct, currentInstruction, m_callLinkInfoIndex++);
+}
+
+#if !ENABLE(JIT_OPTIMIZE_CALL)
+
+/* ------------------------------ BEGIN: !ENABLE(JIT_OPTIMIZE_CALL) ------------------------------ */
+
+void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned)
+{
+    int dst = instruction[1].u.operand;
+    int callee = instruction[2].u.operand;
+    int argCount = instruction[3].u.operand;
+    int registerOffset = instruction[4].u.operand;
+
+    Jump wasEval1;
+    Jump wasEval2;
+    if (opcodeID == op_call_eval) {
+        JITStubCall stubCall(this, cti_op_call_eval);
+        stubCall.addArgument(callee);
+        stubCall.addArgument(JIT::Imm32(registerOffset));
+        stubCall.addArgument(JIT::Imm32(argCount));
+        stubCall.call();
+        wasEval1 = branchTest32(NonZero, regT0);
+        wasEval2 = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
+    }
+
+    emitLoad(callee, regT1, regT2);
+
+    if (opcodeID == op_call)
+        compileOpCallSetupArgs(instruction);
+    else if (opcodeID == op_construct)
+        compileOpConstructSetupArgs(instruction);
+
+    emitJumpSlowCaseIfNotJSCell(callee, regT1);
+    addSlowCase(branchPtr(NotEqual, Address(regT2), ImmPtr(m_globalData->jsFunctionVPtr)));
+
+    // First, in the case of a construct, allocate the new object.
+    if (opcodeID == op_construct) {
+        JITStubCall(this, cti_op_construct_JSConstruct).call(registerOffset - RegisterFile::CallFrameHeaderSize - argCount);
+        emitLoad(callee, regT1, regT2);
+    }
+
+    // Speculatively roll the callframe, assuming argCount will match the arity.
+    storePtr(callFrameRegister, Address(callFrameRegister, (RegisterFile::CallerFrame + registerOffset) * static_cast<int>(sizeof(Register))));
+    addPtr(Imm32(registerOffset * static_cast<int>(sizeof(Register))), callFrameRegister);
+    move(Imm32(argCount), regT1);
+
+    emitNakedCall(m_globalData->jitStubs.ctiVirtualCall());
+
+    if (opcodeID == op_call_eval) {
+        wasEval1.link(this);
+        wasEval2.link(this);
+    }
+
+    emitStore(dst, regT1, regT0);;
+
+    sampleCodeBlock(m_codeBlock);
+}
+
+void JIT::compileOpCallSlowCase(Instruction* instruction, Vector<SlowCaseEntry>::iterator& iter, unsigned, OpcodeID opcodeID)
+{
+    int dst = instruction[1].u.operand;
+    int callee = instruction[2].u.operand;
+
+    linkSlowCaseIfNotJSCell(iter, callee);
+    linkSlowCase(iter);
+
+    JITStubCall stubCall(this, opcodeID == op_construct ? cti_op_construct_NotJSConstruct : cti_op_call_NotJSFunction);
+    stubCall.call(dst); // In the interpreter, the callee puts the return value in dst.
+
+    sampleCodeBlock(m_codeBlock);
+}
+
+#else // !ENABLE(JIT_OPTIMIZE_CALL)
+
+/* ------------------------------ BEGIN: ENABLE(JIT_OPTIMIZE_CALL) ------------------------------ */
+
+void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned callLinkInfoIndex)
+{
+    int dst = instruction[1].u.operand;
+    int callee = instruction[2].u.operand;
+    int argCount = instruction[3].u.operand;
+    int registerOffset = instruction[4].u.operand;
+
+    Jump wasEval1;
+    Jump wasEval2;
+    if (opcodeID == op_call_eval) {
+        JITStubCall stubCall(this, cti_op_call_eval);
+        stubCall.addArgument(callee);
+        stubCall.addArgument(JIT::Imm32(registerOffset));
+        stubCall.addArgument(JIT::Imm32(argCount));
+        stubCall.call();
+        wasEval1 = branchTest32(NonZero, regT0);
+        wasEval2 = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
+    }
+
+    emitLoad(callee, regT1, regT0);
+
+    DataLabelPtr addressOfLinkedFunctionCheck;
+    Jump jumpToSlow = branchPtrWithPatch(NotEqual, regT0, addressOfLinkedFunctionCheck, ImmPtr(0));
+    addSlowCase(jumpToSlow);
+    ASSERT(differenceBetween(addressOfLinkedFunctionCheck, jumpToSlow) == patchOffsetOpCallCompareToJump);
+    m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathBegin = addressOfLinkedFunctionCheck;
+
+    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
+
+    // The following is the fast case, only used whan a callee can be linked.
+
+    // In the case of OpConstruct, call out to a cti_ function to create the new object.
+    if (opcodeID == op_construct) {
+        int proto = instruction[5].u.operand;
+        int thisRegister = instruction[6].u.operand;
+
+        JITStubCall stubCall(this, cti_op_construct_JSConstruct);
+        stubCall.addArgument(regT1, regT0);
+        stubCall.addArgument(Imm32(0)); // FIXME: Remove this unused JITStub argument.
+        stubCall.addArgument(Imm32(0)); // FIXME: Remove this unused JITStub argument.
+        stubCall.addArgument(proto);
+        stubCall.call(thisRegister);
+
+        emitLoad(callee, regT1, regT0);
+    }
+
+    // Fast version of stack frame initialization, directly relative to edi.
+    // Note that this omits to set up RegisterFile::CodeBlock, which is set in the callee
+    emitStore(registerOffset + RegisterFile::OptionalCalleeArguments, JSValue());
+    emitStore(registerOffset + RegisterFile::Callee, regT1, regT0);
+
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_data) + OBJECT_OFFSETOF(ScopeChain, m_node)), regT1); // newScopeChain
+    store32(Imm32(argCount), Address(callFrameRegister, (registerOffset + RegisterFile::ArgumentCount) * static_cast<int>(sizeof(Register))));
+    storePtr(callFrameRegister, Address(callFrameRegister, (registerOffset + RegisterFile::CallerFrame) * static_cast<int>(sizeof(Register))));
+    storePtr(regT1, Address(callFrameRegister, (registerOffset + RegisterFile::ScopeChain) * static_cast<int>(sizeof(Register))));
+    addPtr(Imm32(registerOffset * sizeof(Register)), callFrameRegister);
+
+    // Call to the callee
+    m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathOther = emitNakedCall();
+    
+    if (opcodeID == op_call_eval) {
+        wasEval1.link(this);
+        wasEval2.link(this);
+    }
+
+    // Put the return value in dst. In the interpreter, op_ret does this.
+    emitStore(dst, regT1, regT0);
+    map(m_bytecodeIndex + opcodeLengths[opcodeID], dst, regT1, regT0);
+
+    sampleCodeBlock(m_codeBlock);
+}
+
+void JIT::compileOpCallSlowCase(Instruction* instruction, Vector<SlowCaseEntry>::iterator& iter, unsigned callLinkInfoIndex, OpcodeID opcodeID)
+{
+    int dst = instruction[1].u.operand;
+    int callee = instruction[2].u.operand;
+    int argCount = instruction[3].u.operand;
+    int registerOffset = instruction[4].u.operand;
+
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+
+    // The arguments have been set up on the hot path for op_call_eval
+    if (opcodeID == op_call)
+        compileOpCallSetupArgs(instruction);
+    else if (opcodeID == op_construct)
+        compileOpConstructSetupArgs(instruction);
+
+    // Fast check for JS function.
+    Jump callLinkFailNotObject = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
+    Jump callLinkFailNotJSFunction = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsFunctionVPtr));
+
+    // First, in the case of a construct, allocate the new object.
+    if (opcodeID == op_construct) {
+        JITStubCall(this, cti_op_construct_JSConstruct).call(registerOffset - RegisterFile::CallFrameHeaderSize - argCount);
+        emitLoad(callee, regT1, regT0);
+    }
+
+    // Speculatively roll the callframe, assuming argCount will match the arity.
+    storePtr(callFrameRegister, Address(callFrameRegister, (RegisterFile::CallerFrame + registerOffset) * static_cast<int>(sizeof(Register))));
+    addPtr(Imm32(registerOffset * static_cast<int>(sizeof(Register))), callFrameRegister);
+    move(Imm32(argCount), regT1);
+
+    m_callStructureStubCompilationInfo[callLinkInfoIndex].callReturnLocation = emitNakedCall(m_globalData->jitStubs.ctiVirtualCallLink());
+
+    // Put the return value in dst.
+    emitStore(dst, regT1, regT0);;
+    sampleCodeBlock(m_codeBlock);
+
+    // If not, we need an extra case in the if below!
+    ASSERT(OPCODE_LENGTH(op_call) == OPCODE_LENGTH(op_call_eval));
+
+    // Done! - return back to the hot path.
+    if (opcodeID == op_construct)
+        emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_construct));
+    else
+        emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_call));
+
+    // This handles host functions
+    callLinkFailNotObject.link(this);
+    callLinkFailNotJSFunction.link(this);
+    JITStubCall(this, opcodeID == op_construct ? cti_op_construct_NotJSConstruct : cti_op_call_NotJSFunction).call();
+
+    emitStore(dst, regT1, regT0);;
+    sampleCodeBlock(m_codeBlock);
+}
+
+/* ------------------------------ END: !ENABLE / ENABLE(JIT_OPTIMIZE_CALL) ------------------------------ */
+
+#endif // !ENABLE(JIT_OPTIMIZE_CALL)
+
+#else // USE(JSVALUE32_64)
+
 void JIT::compileOpCallInitializeCallFrame()
 {
     store32(regT1, Address(callFrameRegister, RegisterFile::ArgumentCount * static_cast<int>(sizeof(Register))));
 
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_data) + OBJECT_OFFSETOF(ScopeChain, m_node)), regT1); // newScopeChain
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_data) + OBJECT_OFFSETOF(ScopeChain, m_node)), regT1); // newScopeChain
 
     storePtr(ImmPtr(JSValue::encode(JSValue())), Address(callFrameRegister, RegisterFile::OptionalCalleeArguments * static_cast<int>(sizeof(Register))));
-    storePtr(regT2, Address(callFrameRegister, RegisterFile::Callee * static_cast<int>(sizeof(Register))));
+    storePtr(regT0, Address(callFrameRegister, RegisterFile::Callee * static_cast<int>(sizeof(Register))));
     storePtr(regT1, Address(callFrameRegister, RegisterFile::ScopeChain * static_cast<int>(sizeof(Register))));
 }
 
@@ -62,9 +449,9 @@ void JIT::compileOpCallSetupArgs(Instruction* instruction)
     int registerOffset = instruction[4].u.operand;
 
     // ecx holds func
-    emitPutJITStubArg(regT2, 1);
-    emitPutJITStubArgConstant(argCount, 3);
-    emitPutJITStubArgConstant(registerOffset, 2);
+    emitPutJITStubArg(regT0, 0);
+    emitPutJITStubArgConstant(argCount, 2);
+    emitPutJITStubArgConstant(registerOffset, 1);
 }
           
 void JIT::compileOpCallVarargsSetupArgs(Instruction* instruction)
@@ -72,10 +459,10 @@ void JIT::compileOpCallVarargsSetupArgs(Instruction* instruction)
     int registerOffset = instruction[4].u.operand;
     
     // ecx holds func
+    emitPutJITStubArg(regT0, 0);
+    emitPutJITStubArg(regT1, 2);
+    addPtr(Imm32(registerOffset), regT1, regT2);
     emitPutJITStubArg(regT2, 1);
-    emitPutJITStubArg(regT1, 3);
-    addPtr(Imm32(registerOffset), regT1, regT0);
-    emitPutJITStubArg(regT0, 2);
 }
 
 void JIT::compileOpConstructSetupArgs(Instruction* instruction)
@@ -86,11 +473,11 @@ void JIT::compileOpConstructSetupArgs(Instruction* instruction)
     int thisRegister = instruction[6].u.operand;
 
     // ecx holds func
-    emitPutJITStubArg(regT2, 1);
-    emitPutJITStubArgConstant(registerOffset, 2);
-    emitPutJITStubArgConstant(argCount, 3);
-    emitPutJITStubArgFromVirtualRegister(proto, 4, regT0);
-    emitPutJITStubArgConstant(thisRegister, 5);
+    emitPutJITStubArg(regT0, 0);
+    emitPutJITStubArgConstant(registerOffset, 1);
+    emitPutJITStubArgConstant(argCount, 2);
+    emitPutJITStubArgFromVirtualRegister(proto, 3, regT2);
+    emitPutJITStubArgConstant(thisRegister, 4);
 }
 
 void JIT::compileOpCallVarargs(Instruction* instruction)
@@ -100,20 +487,20 @@ void JIT::compileOpCallVarargs(Instruction* instruction)
     int argCountRegister = instruction[3].u.operand;
 
     emitGetVirtualRegister(argCountRegister, regT1);
-    emitGetVirtualRegister(callee, regT2);
+    emitGetVirtualRegister(callee, regT0);
     compileOpCallVarargsSetupArgs(instruction);
 
     // Check for JSFunctions.
-    emitJumpSlowCaseIfNotJSCell(regT2);
-    addSlowCase(branchPtr(NotEqual, Address(regT2), ImmPtr(m_globalData->jsFunctionVPtr)));
-    
+    emitJumpSlowCaseIfNotJSCell(regT0);
+    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsFunctionVPtr)));
+
     // Speculatively roll the callframe, assuming argCount will match the arity.
-    mul32(Imm32(sizeof(Register)), regT0, regT0);
+    mul32(Imm32(sizeof(Register)), regT2, regT2);
     intptr_t offset = (intptr_t)sizeof(Register) * (intptr_t)RegisterFile::CallerFrame;
-    addPtr(Imm32((int32_t)offset), regT0, regT3);
+    addPtr(Imm32((int32_t)offset), regT2, regT3);
     addPtr(callFrameRegister, regT3);
     storePtr(callFrameRegister, regT3);
-    addPtr(regT0, callFrameRegister);
+    addPtr(regT2, callFrameRegister);
     emitNakedCall(m_globalData->jitStubs.ctiVirtualCall());
 
     // Put the return value in dst. In the interpreter, op_ret does this.
@@ -128,7 +515,7 @@ void JIT::compileOpCallVarargsSlowCase(Instruction* instruction, Vector<SlowCase
     
     linkSlowCase(iter);
     linkSlowCase(iter);
-    JITStubCall stubCall(this, JITStubs::cti_op_call_NotJSFunction);
+    JITStubCall stubCall(this, cti_op_call_NotJSFunction);
     stubCall.call(dst); // In the interpreter, the callee puts the return value in dst.
     
     sampleCodeBlock(m_codeBlock);
@@ -148,11 +535,15 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned)
     // Handle eval
     Jump wasEval;
     if (opcodeID == op_call_eval) {
-        CallEvalJITStub(this, instruction).call();
+        JITStubCall stubCall(this, cti_op_call_eval);
+        stubCall.addArgument(callee, regT0);
+        stubCall.addArgument(JIT::Imm32(registerOffset));
+        stubCall.addArgument(JIT::Imm32(argCount));
+        stubCall.call();
         wasEval = branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(JSValue())));
     }
 
-    emitGetVirtualRegister(callee, regT2);
+    emitGetVirtualRegister(callee, regT0);
     // The arguments have been set up on the hot path for op_call_eval
     if (opcodeID == op_call)
         compileOpCallSetupArgs(instruction);
@@ -160,13 +551,13 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned)
         compileOpConstructSetupArgs(instruction);
 
     // Check for JSFunctions.
-    emitJumpSlowCaseIfNotJSCell(regT2);
-    addSlowCase(branchPtr(NotEqual, Address(regT2), ImmPtr(m_globalData->jsFunctionVPtr)));
+    emitJumpSlowCaseIfNotJSCell(regT0);
+    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsFunctionVPtr)));
 
     // First, in the case of a construct, allocate the new object.
     if (opcodeID == op_construct) {
-        JITStubCall(this, JITStubs::cti_op_construct_JSConstruct).call(registerOffset - RegisterFile::CallFrameHeaderSize - argCount);
-        emitGetVirtualRegister(callee, regT2);
+        JITStubCall(this, cti_op_construct_JSConstruct).call(registerOffset - RegisterFile::CallFrameHeaderSize - argCount);
+        emitGetVirtualRegister(callee, regT0);
     }
 
     // Speculatively roll the callframe, assuming argCount will match the arity.
@@ -191,7 +582,7 @@ void JIT::compileOpCallSlowCase(Instruction* instruction, Vector<SlowCaseEntry>:
 
     linkSlowCase(iter);
     linkSlowCase(iter);
-    JITStubCall stubCall(this, opcodeID == op_construct ? JITStubs::cti_op_construct_NotJSConstruct : JITStubs::cti_op_call_NotJSFunction);
+    JITStubCall stubCall(this, opcodeID == op_construct ? cti_op_construct_NotJSConstruct : cti_op_call_NotJSFunction);
     stubCall.call(dst); // In the interpreter, the callee puts the return value in dst.
 
     sampleCodeBlock(m_codeBlock);
@@ -211,15 +602,25 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
     // Handle eval
     Jump wasEval;
     if (opcodeID == op_call_eval) {
-        CallEvalJITStub(this, instruction).call();
+        JITStubCall stubCall(this, cti_op_call_eval);
+        stubCall.addArgument(callee, regT0);
+        stubCall.addArgument(JIT::Imm32(registerOffset));
+        stubCall.addArgument(JIT::Imm32(argCount));
+        stubCall.call();
         wasEval = branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(JSValue())));
     }
 
     // This plants a check for a cached JSFunction value, so we can plant a fast link to the callee.
     // This deliberately leaves the callee in ecx, used when setting up the stack frame below
-    emitGetVirtualRegister(callee, regT2);
+    emitGetVirtualRegister(callee, regT0);
     DataLabelPtr addressOfLinkedFunctionCheck;
-    Jump jumpToSlow = branchPtrWithPatch(NotEqual, regT2, addressOfLinkedFunctionCheck, ImmPtr(JSValue::encode(JSValue())));
+
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequenceOpCall);
+
+    Jump jumpToSlow = branchPtrWithPatch(NotEqual, regT0, addressOfLinkedFunctionCheck, ImmPtr(JSValue::encode(JSValue())));
+
+    END_UNINTERRUPTED_SEQUENCE(sequenceOpCall);
+
     addSlowCase(jumpToSlow);
     ASSERT(differenceBetween(addressOfLinkedFunctionCheck, jumpToSlow) == patchOffsetOpCallCompareToJump);
     m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathBegin = addressOfLinkedFunctionCheck;
@@ -231,18 +632,18 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
         int proto = instruction[5].u.operand;
         int thisRegister = instruction[6].u.operand;
 
-        emitPutJITStubArg(regT2, 1);
-        emitPutJITStubArgFromVirtualRegister(proto, 4, regT0);
-        JITStubCall stubCall(this, JITStubs::cti_op_construct_JSConstruct);
+        emitPutJITStubArg(regT0, 0);
+        emitPutJITStubArgFromVirtualRegister(proto, 3, regT2);
+        JITStubCall stubCall(this, cti_op_construct_JSConstruct);
         stubCall.call(thisRegister);
-        emitGetVirtualRegister(callee, regT2);
+        emitGetVirtualRegister(callee, regT0);
     }
 
     // Fast version of stack frame initialization, directly relative to edi.
     // Note that this omits to set up RegisterFile::CodeBlock, which is set in the callee
     storePtr(ImmPtr(JSValue::encode(JSValue())), Address(callFrameRegister, (registerOffset + RegisterFile::OptionalCalleeArguments) * static_cast<int>(sizeof(Register))));
-    storePtr(regT2, Address(callFrameRegister, (registerOffset + RegisterFile::Callee) * static_cast<int>(sizeof(Register))));
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_data) + OBJECT_OFFSETOF(ScopeChain, m_node)), regT1); // newScopeChain
+    storePtr(regT0, Address(callFrameRegister, (registerOffset + RegisterFile::Callee) * static_cast<int>(sizeof(Register))));
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_data) + OBJECT_OFFSETOF(ScopeChain, m_node)), regT1); // newScopeChain
     store32(Imm32(argCount), Address(callFrameRegister, (registerOffset + RegisterFile::ArgumentCount) * static_cast<int>(sizeof(Register))));
     storePtr(callFrameRegister, Address(callFrameRegister, (registerOffset + RegisterFile::CallerFrame) * static_cast<int>(sizeof(Register))));
     storePtr(regT1, Address(callFrameRegister, (registerOffset + RegisterFile::ScopeChain) * static_cast<int>(sizeof(Register))));
@@ -276,13 +677,13 @@ void JIT::compileOpCallSlowCase(Instruction* instruction, Vector<SlowCaseEntry>:
         compileOpConstructSetupArgs(instruction);
 
     // Fast check for JS function.
-    Jump callLinkFailNotObject = emitJumpIfNotJSCell(regT2);
-    Jump callLinkFailNotJSFunction = branchPtr(NotEqual, Address(regT2), ImmPtr(m_globalData->jsFunctionVPtr));
+    Jump callLinkFailNotObject = emitJumpIfNotJSCell(regT0);
+    Jump callLinkFailNotJSFunction = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsFunctionVPtr));
 
     // First, in the case of a construct, allocate the new object.
     if (opcodeID == op_construct) {
-        JITStubCall(this, JITStubs::cti_op_construct_JSConstruct).call(registerOffset - RegisterFile::CallFrameHeaderSize - argCount);
-        emitGetVirtualRegister(callee, regT2);
+        JITStubCall(this, cti_op_construct_JSConstruct).call(registerOffset - RegisterFile::CallFrameHeaderSize - argCount);
+        emitGetVirtualRegister(callee, regT0);
     }
 
     // Speculatively roll the callframe, assuming argCount will match the arity.
@@ -290,7 +691,9 @@ void JIT::compileOpCallSlowCase(Instruction* instruction, Vector<SlowCaseEntry>:
     addPtr(Imm32(registerOffset * static_cast<int>(sizeof(Register))), callFrameRegister);
     move(Imm32(argCount), regT1);
 
-    m_callStructureStubCompilationInfo[callLinkInfoIndex].callReturnLocation = emitNakedCall(m_globalData->jitStubs.ctiVirtualCallPreLink());
+    move(regT0, regT2);
+
+    m_callStructureStubCompilationInfo[callLinkInfoIndex].callReturnLocation = emitNakedCall(m_globalData->jitStubs.ctiVirtualCallLink());
 
     // Put the return value in dst.
     emitPutVirtualRegister(dst);
@@ -308,7 +711,7 @@ void JIT::compileOpCallSlowCase(Instruction* instruction, Vector<SlowCaseEntry>:
     // This handles host functions
     callLinkFailNotObject.link(this);
     callLinkFailNotJSFunction.link(this);
-    JITStubCall(this, opcodeID == op_construct ? JITStubs::cti_op_construct_NotJSConstruct : JITStubs::cti_op_call_NotJSFunction).call();
+    JITStubCall(this, opcodeID == op_construct ? cti_op_construct_NotJSConstruct : cti_op_call_NotJSFunction).call();
 
     emitPutVirtualRegister(dst);
     sampleCodeBlock(m_codeBlock);
@@ -318,6 +721,8 @@ void JIT::compileOpCallSlowCase(Instruction* instruction, Vector<SlowCaseEntry>:
 
 #endif // !ENABLE(JIT_OPTIMIZE_CALL)
 
+#endif // USE(JSVALUE32_64)
+
 } // namespace JSC
 
 #endif // ENABLE(JIT)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITCode.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITCode.h
index b502c8a..69cf167 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITCode.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITCode.h
@@ -76,11 +76,7 @@ namespace JSC {
         // Execute the code!
         inline JSValue execute(RegisterFile* registerFile, CallFrame* callFrame, JSGlobalData* globalData, JSValue* exception)
         {
-            return JSValue::decode(ctiTrampoline(
-#if PLATFORM(X86_64)
-                0, 0, 0, 0, 0, 0,
-#endif
-                m_ref.m_code.executableAddress(), registerFile, callFrame, exception, Profiler::enabledProfilerReference(), globalData));
+            return JSValue::decode(ctiTrampoline(m_ref.m_code.executableAddress(), registerFile, callFrame, exception, Profiler::enabledProfilerReference(), globalData));
         }
 
         void* start()
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h
index f03d635..60c9658 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h
@@ -32,75 +32,37 @@
 
 namespace JSC {
 
-ALWAYS_INLINE void JIT::killLastResultRegister()
-{
-    m_lastResultBytecodeRegister = std::numeric_limits<int>::max();
-}
-
-// get arg puts an arg from the SF register array into a h/w register
-ALWAYS_INLINE void JIT::emitGetVirtualRegister(int src, RegisterID dst)
-{
-    ASSERT(m_bytecodeIndex != (unsigned)-1); // This method should only be called during hot/cold path generation, so that m_bytecodeIndex is set.
-
-    // TODO: we want to reuse values that are already in registers if we can - add a register allocator!
-    if (m_codeBlock->isConstantRegisterIndex(src)) {
-        JSValue value = m_codeBlock->getConstant(src);
-        move(ImmPtr(JSValue::encode(value)), dst);
-        killLastResultRegister();
-        return;
-    }
-
-    if (src == m_lastResultBytecodeRegister && m_codeBlock->isTemporaryRegisterIndex(src)) {
-        bool atJumpTarget = false;
-        while (m_jumpTargetsPosition < m_codeBlock->numberOfJumpTargets() && m_codeBlock->jumpTarget(m_jumpTargetsPosition) <= m_bytecodeIndex) {
-            if (m_codeBlock->jumpTarget(m_jumpTargetsPosition) == m_bytecodeIndex)
-                atJumpTarget = true;
-            ++m_jumpTargetsPosition;
-        }
-
-        if (!atJumpTarget) {
-            // The argument we want is already stored in eax
-            if (dst != cachedResultRegister)
-                move(cachedResultRegister, dst);
-            killLastResultRegister();
-            return;
-        }
-    }
-
-    loadPtr(Address(callFrameRegister, src * sizeof(Register)), dst);
-    killLastResultRegister();
-}
-
-ALWAYS_INLINE void JIT::emitGetVirtualRegisters(int src1, RegisterID dst1, int src2, RegisterID dst2)
-{
-    if (src2 == m_lastResultBytecodeRegister) {
-        emitGetVirtualRegister(src2, dst2);
-        emitGetVirtualRegister(src1, dst1);
-    } else {
-        emitGetVirtualRegister(src1, dst1);
-        emitGetVirtualRegister(src2, dst2);
-    }
-}
+/* Deprecated: Please use JITStubCall instead. */
 
 // puts an arg onto the stack, as an arg to a context threaded function.
 ALWAYS_INLINE void JIT::emitPutJITStubArg(RegisterID src, unsigned argumentNumber)
 {
-    poke(src, argumentNumber);
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    poke(src, argumentStackOffset);
 }
 
+/* Deprecated: Please use JITStubCall instead. */
+
 ALWAYS_INLINE void JIT::emitPutJITStubArgConstant(unsigned value, unsigned argumentNumber)
 {
-    poke(Imm32(value), argumentNumber);
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    poke(Imm32(value), argumentStackOffset);
 }
 
+/* Deprecated: Please use JITStubCall instead. */
+
 ALWAYS_INLINE void JIT::emitPutJITStubArgConstant(void* value, unsigned argumentNumber)
 {
-    poke(ImmPtr(value), argumentNumber);
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    poke(ImmPtr(value), argumentStackOffset);
 }
 
+/* Deprecated: Please use JITStubCall instead. */
+
 ALWAYS_INLINE void JIT::emitGetJITStubArg(unsigned argumentNumber, RegisterID dst)
 {
-    peek(dst, argumentNumber);
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    peek(dst, argumentStackOffset);
 }
 
 ALWAYS_INLINE JSValue JIT::getConstantOperand(unsigned src)
@@ -109,30 +71,6 @@ ALWAYS_INLINE JSValue JIT::getConstantOperand(unsigned src)
     return m_codeBlock->getConstant(src);
 }
 
-ALWAYS_INLINE int32_t JIT::getConstantOperandImmediateInt(unsigned src)
-{
-    return getConstantOperand(src).getInt32Fast();
-}
-
-ALWAYS_INLINE bool JIT::isOperandConstantImmediateInt(unsigned src)
-{
-    return m_codeBlock->isConstantRegisterIndex(src) && getConstantOperand(src).isInt32Fast();
-}
-
-// get arg puts an arg from the SF register array onto the stack, as an arg to a context threaded function.
-ALWAYS_INLINE void JIT::emitPutJITStubArgFromVirtualRegister(unsigned src, unsigned argumentNumber, RegisterID scratch)
-{
-    if (m_codeBlock->isConstantRegisterIndex(src)) {
-        JSValue value = m_codeBlock->getConstant(src);
-        emitPutJITStubArgConstant(JSValue::encode(value), argumentNumber);
-    } else {
-        loadPtr(Address(callFrameRegister, src * sizeof(Register)), scratch);
-        emitPutJITStubArg(scratch, argumentNumber);
-    }
-
-    killLastResultRegister();
-}
-
 ALWAYS_INLINE void JIT::emitPutToCallFrameHeader(RegisterID from, RegisterFile::CallFrameHeaderEntry entry)
 {
     storePtr(from, Address(callFrameRegister, entry * sizeof(Register)));
@@ -146,26 +84,17 @@ ALWAYS_INLINE void JIT::emitPutImmediateToCallFrameHeader(void* value, RegisterF
 ALWAYS_INLINE void JIT::emitGetFromCallFrameHeaderPtr(RegisterFile::CallFrameHeaderEntry entry, RegisterID to, RegisterID from)
 {
     loadPtr(Address(from, entry * sizeof(Register)), to);
+#if !USE(JSVALUE32_64)
     killLastResultRegister();
+#endif
 }
 
 ALWAYS_INLINE void JIT::emitGetFromCallFrameHeader32(RegisterFile::CallFrameHeaderEntry entry, RegisterID to, RegisterID from)
 {
     load32(Address(from, entry * sizeof(Register)), to);
+#if !USE(JSVALUE32_64)
     killLastResultRegister();
-}
-
-ALWAYS_INLINE void JIT::emitPutVirtualRegister(unsigned dst, RegisterID from)
-{
-    storePtr(from, Address(callFrameRegister, dst * sizeof(Register)));
-    m_lastResultBytecodeRegister = (from == cachedResultRegister) ? dst : std::numeric_limits<int>::max();
-    // FIXME: #ifndef NDEBUG, Write the correct m_type to the register.
-}
-
-ALWAYS_INLINE void JIT::emitInitRegister(unsigned dst)
-{
-    storePtr(ImmPtr(JSValue::encode(jsUndefined())), Address(callFrameRegister, dst * sizeof(Register)));
-    // FIXME: #ifndef NDEBUG, Write the correct m_type to the register.
+#endif
 }
 
 ALWAYS_INLINE JIT::Call JIT::emitNakedCall(CodePtr function)
@@ -177,7 +106,40 @@ ALWAYS_INLINE JIT::Call JIT::emitNakedCall(CodePtr function)
     return nakedCall;
 }
 
-#if PLATFORM(X86) || PLATFORM(X86_64)
+#if defined(ASSEMBLER_HAS_CONSTANT_POOL) && ASSEMBLER_HAS_CONSTANT_POOL
+
+ALWAYS_INLINE void JIT::beginUninterruptedSequence(int insnSpace, int constSpace)
+{
+#if PLATFORM(ARM) && !PLATFORM_ARM_ARCH(7)
+#ifndef NDEBUG
+    // Ensure the label after the sequence can also fit
+    insnSpace += sizeof(ARMWord);
+    constSpace += sizeof(uint64_t);
+#endif
+
+    ensureSpace(insnSpace, constSpace);
+
+#endif
+
+#if defined(ASSEMBLER_HAS_CONSTANT_POOL) && ASSEMBLER_HAS_CONSTANT_POOL
+#ifndef NDEBUG
+    m_uninterruptedInstructionSequenceBegin = label();
+    m_uninterruptedConstantSequenceBegin = sizeOfConstantPool();
+#endif
+#endif
+}
+
+ALWAYS_INLINE void JIT::endUninterruptedSequence(int insnSpace, int constSpace)
+{
+#if defined(ASSEMBLER_HAS_CONSTANT_POOL) && ASSEMBLER_HAS_CONSTANT_POOL
+    ASSERT(differenceBetween(m_uninterruptedInstructionSequenceBegin, label()) == insnSpace);
+    ASSERT(sizeOfConstantPool() - m_uninterruptedConstantSequenceBegin == constSpace);
+#endif
+}
+
+#endif
+
+#if PLATFORM(X86) || PLATFORM(X86_64) || (PLATFORM(ARM) && !PLATFORM_ARM_ARCH(7))
 
 ALWAYS_INLINE void JIT::preserveReturnAddressAfterCall(RegisterID reg)
 {
@@ -224,6 +186,9 @@ ALWAYS_INLINE void JIT::restoreArgumentReference()
 {
     move(stackPointerRegister, firstArgumentRegister);
     poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof (void*));
+#if PLATFORM(ARM) && !PLATFORM_ARM_ARCH(7)
+    move(ctiReturnRegister, ARMRegisters::lr);
+#endif
 }
 ALWAYS_INLINE void JIT::restoreArgumentReferenceForTrampoline()
 {
@@ -242,9 +207,484 @@ ALWAYS_INLINE JIT::Jump JIT::checkStructure(RegisterID reg, Structure* structure
     return branchPtr(NotEqual, Address(reg, OBJECT_OFFSETOF(JSCell, m_structure)), ImmPtr(structure));
 }
 
+ALWAYS_INLINE void JIT::linkSlowCaseIfNotJSCell(Vector<SlowCaseEntry>::iterator& iter, int vReg)
+{
+    if (!m_codeBlock->isKnownNotImmediate(vReg))
+        linkSlowCase(iter);
+}
+
+ALWAYS_INLINE void JIT::addSlowCase(Jump jump)
+{
+    ASSERT(m_bytecodeIndex != (unsigned)-1); // This method should only be called during hot/cold path generation, so that m_bytecodeIndex is set.
+
+    m_slowCases.append(SlowCaseEntry(jump, m_bytecodeIndex));
+}
+
+ALWAYS_INLINE void JIT::addSlowCase(JumpList jumpList)
+{
+    ASSERT(m_bytecodeIndex != (unsigned)-1); // This method should only be called during hot/cold path generation, so that m_bytecodeIndex is set.
+
+    const JumpList::JumpVector& jumpVector = jumpList.jumps();
+    size_t size = jumpVector.size();
+    for (size_t i = 0; i < size; ++i)
+        m_slowCases.append(SlowCaseEntry(jumpVector[i], m_bytecodeIndex));
+}
+
+ALWAYS_INLINE void JIT::addJump(Jump jump, int relativeOffset)
+{
+    ASSERT(m_bytecodeIndex != (unsigned)-1); // This method should only be called during hot/cold path generation, so that m_bytecodeIndex is set.
+
+    m_jmpTable.append(JumpTable(jump, m_bytecodeIndex + relativeOffset));
+}
+
+ALWAYS_INLINE void JIT::emitJumpSlowToHot(Jump jump, int relativeOffset)
+{
+    ASSERT(m_bytecodeIndex != (unsigned)-1); // This method should only be called during hot/cold path generation, so that m_bytecodeIndex is set.
+
+    jump.linkTo(m_labels[m_bytecodeIndex + relativeOffset], this);
+}
+
+#if ENABLE(SAMPLING_FLAGS)
+ALWAYS_INLINE void JIT::setSamplingFlag(int32_t flag)
+{
+    ASSERT(flag >= 1);
+    ASSERT(flag <= 32);
+    or32(Imm32(1u << (flag - 1)), AbsoluteAddress(&SamplingFlags::s_flags));
+}
+
+ALWAYS_INLINE void JIT::clearSamplingFlag(int32_t flag)
+{
+    ASSERT(flag >= 1);
+    ASSERT(flag <= 32);
+    and32(Imm32(~(1u << (flag - 1))), AbsoluteAddress(&SamplingFlags::s_flags));
+}
+#endif
+
+#if ENABLE(SAMPLING_COUNTERS)
+ALWAYS_INLINE void JIT::emitCount(AbstractSamplingCounter& counter, uint32_t count)
+{
+#if PLATFORM(X86_64) // Or any other 64-bit plattform.
+    addPtr(Imm32(count), AbsoluteAddress(&counter.m_counter));
+#elif PLATFORM(X86) // Or any other little-endian 32-bit plattform.
+    intptr_t hiWord = reinterpret_cast<intptr_t>(&counter.m_counter) + sizeof(int32_t);
+    add32(Imm32(count), AbsoluteAddress(&counter.m_counter));
+    addWithCarry32(Imm32(0), AbsoluteAddress(reinterpret_cast<void*>(hiWord)));
+#else
+#error "SAMPLING_FLAGS not implemented on this platform."
+#endif
+}
+#endif
+
+#if ENABLE(OPCODE_SAMPLING)
+#if PLATFORM(X86_64)
+ALWAYS_INLINE void JIT::sampleInstruction(Instruction* instruction, bool inHostFunction)
+{
+    move(ImmPtr(m_interpreter->sampler()->sampleSlot()), X86Registers::ecx);
+    storePtr(ImmPtr(m_interpreter->sampler()->encodeSample(instruction, inHostFunction)), X86Registers::ecx);
+}
+#else
+ALWAYS_INLINE void JIT::sampleInstruction(Instruction* instruction, bool inHostFunction)
+{
+    storePtr(ImmPtr(m_interpreter->sampler()->encodeSample(instruction, inHostFunction)), m_interpreter->sampler()->sampleSlot());
+}
+#endif
+#endif
+
+#if ENABLE(CODEBLOCK_SAMPLING)
+#if PLATFORM(X86_64)
+ALWAYS_INLINE void JIT::sampleCodeBlock(CodeBlock* codeBlock)
+{
+    move(ImmPtr(m_interpreter->sampler()->codeBlockSlot()), X86Registers::ecx);
+    storePtr(ImmPtr(codeBlock), X86Registers::ecx);
+}
+#else
+ALWAYS_INLINE void JIT::sampleCodeBlock(CodeBlock* codeBlock)
+{
+    storePtr(ImmPtr(codeBlock), m_interpreter->sampler()->codeBlockSlot());
+}
+#endif
+#endif
+
+#if USE(JSVALUE32_64)
+
+inline JIT::Address JIT::tagFor(unsigned index, RegisterID base)
+{
+    return Address(base, (index * sizeof(Register)) + OBJECT_OFFSETOF(JSValue, u.asBits.tag));
+}
+
+inline JIT::Address JIT::payloadFor(unsigned index, RegisterID base)
+{
+    return Address(base, (index * sizeof(Register)) + OBJECT_OFFSETOF(JSValue, u.asBits.payload));
+}
+
+inline JIT::Address JIT::addressFor(unsigned index, RegisterID base)
+{
+    return Address(base, (index * sizeof(Register)));
+}
+
+inline void JIT::emitLoadTag(unsigned index, RegisterID tag)
+{
+    RegisterID mappedTag;
+    if (getMappedTag(index, mappedTag)) {
+        move(mappedTag, tag);
+        unmap(tag);
+        return;
+    }
+
+    if (m_codeBlock->isConstantRegisterIndex(index)) {
+        move(Imm32(getConstantOperand(index).tag()), tag);
+        unmap(tag);
+        return;
+    }
+
+    load32(tagFor(index), tag);
+    unmap(tag);
+}
+
+inline void JIT::emitLoadPayload(unsigned index, RegisterID payload)
+{
+    RegisterID mappedPayload;
+    if (getMappedPayload(index, mappedPayload)) {
+        move(mappedPayload, payload);
+        unmap(payload);
+        return;
+    }
+
+    if (m_codeBlock->isConstantRegisterIndex(index)) {
+        move(Imm32(getConstantOperand(index).payload()), payload);
+        unmap(payload);
+        return;
+    }
+
+    load32(payloadFor(index), payload);
+    unmap(payload);
+}
+
+inline void JIT::emitLoad(const JSValue& v, RegisterID tag, RegisterID payload)
+{
+    move(Imm32(v.payload()), payload);
+    move(Imm32(v.tag()), tag);
+}
+
+inline void JIT::emitLoad(unsigned index, RegisterID tag, RegisterID payload, RegisterID base)
+{
+    ASSERT(tag != payload);
+
+    if (base == callFrameRegister) {
+        ASSERT(payload != base);
+        emitLoadPayload(index, payload);
+        emitLoadTag(index, tag);
+        return;
+    }
+
+    if (payload == base) { // avoid stomping base
+        load32(tagFor(index, base), tag);
+        load32(payloadFor(index, base), payload);
+        return;
+    }
+
+    load32(payloadFor(index, base), payload);
+    load32(tagFor(index, base), tag);
+}
+
+inline void JIT::emitLoad2(unsigned index1, RegisterID tag1, RegisterID payload1, unsigned index2, RegisterID tag2, RegisterID payload2)
+{
+    if (isMapped(index1)) {
+        emitLoad(index1, tag1, payload1);
+        emitLoad(index2, tag2, payload2);
+        return;
+    }
+    emitLoad(index2, tag2, payload2);
+    emitLoad(index1, tag1, payload1);
+}
+
+inline void JIT::emitLoadDouble(unsigned index, FPRegisterID value)
+{
+    if (m_codeBlock->isConstantRegisterIndex(index)) {
+        Register& inConstantPool = m_codeBlock->constantRegister(index);
+        loadDouble(&inConstantPool, value);
+    } else
+        loadDouble(addressFor(index), value);
+}
+
+inline void JIT::emitLoadInt32ToDouble(unsigned index, FPRegisterID value)
+{
+    if (m_codeBlock->isConstantRegisterIndex(index)) {
+        Register& inConstantPool = m_codeBlock->constantRegister(index);
+        char* bytePointer = reinterpret_cast<char*>(&inConstantPool);
+        convertInt32ToDouble(AbsoluteAddress(bytePointer + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), value);
+    } else
+        convertInt32ToDouble(payloadFor(index), value);
+}
+
+inline void JIT::emitStore(unsigned index, RegisterID tag, RegisterID payload, RegisterID base)
+{
+    store32(payload, payloadFor(index, base));
+    store32(tag, tagFor(index, base));
+}
+
+inline void JIT::emitStoreInt32(unsigned index, RegisterID payload, bool indexIsInt32)
+{
+    store32(payload, payloadFor(index, callFrameRegister));
+    if (!indexIsInt32)
+        store32(Imm32(JSValue::Int32Tag), tagFor(index, callFrameRegister));
+}
+
+inline void JIT::emitStoreInt32(unsigned index, Imm32 payload, bool indexIsInt32)
+{
+    store32(payload, payloadFor(index, callFrameRegister));
+    if (!indexIsInt32)
+        store32(Imm32(JSValue::Int32Tag), tagFor(index, callFrameRegister));
+}
+
+inline void JIT::emitStoreCell(unsigned index, RegisterID payload, bool indexIsCell)
+{
+    store32(payload, payloadFor(index, callFrameRegister));
+    if (!indexIsCell)
+        store32(Imm32(JSValue::CellTag), tagFor(index, callFrameRegister));
+}
+
+inline void JIT::emitStoreBool(unsigned index, RegisterID tag, bool indexIsBool)
+{
+    if (!indexIsBool)
+        store32(Imm32(0), payloadFor(index, callFrameRegister));
+    store32(tag, tagFor(index, callFrameRegister));
+}
+
+inline void JIT::emitStoreDouble(unsigned index, FPRegisterID value)
+{
+    storeDouble(value, addressFor(index));
+}
+
+inline void JIT::emitStore(unsigned index, const JSValue constant, RegisterID base)
+{
+    store32(Imm32(constant.payload()), payloadFor(index, base));
+    store32(Imm32(constant.tag()), tagFor(index, base));
+}
+
+ALWAYS_INLINE void JIT::emitInitRegister(unsigned dst)
+{
+    emitStore(dst, jsUndefined());
+}
+
+inline bool JIT::isLabeled(unsigned bytecodeIndex)
+{
+    for (size_t numberOfJumpTargets = m_codeBlock->numberOfJumpTargets(); m_jumpTargetIndex != numberOfJumpTargets; ++m_jumpTargetIndex) {
+        unsigned jumpTarget = m_codeBlock->jumpTarget(m_jumpTargetIndex);
+        if (jumpTarget == bytecodeIndex)
+            return true;
+        if (jumpTarget > bytecodeIndex)
+            return false;
+    }
+    return false;
+}
+
+inline void JIT::map(unsigned bytecodeIndex, unsigned virtualRegisterIndex, RegisterID tag, RegisterID payload)
+{
+    if (isLabeled(bytecodeIndex))
+        return;
+
+    m_mappedBytecodeIndex = bytecodeIndex;
+    m_mappedVirtualRegisterIndex = virtualRegisterIndex;
+    m_mappedTag = tag;
+    m_mappedPayload = payload;
+}
+
+inline void JIT::unmap(RegisterID registerID)
+{
+    if (m_mappedTag == registerID)
+        m_mappedTag = (RegisterID)-1;
+    else if (m_mappedPayload == registerID)
+        m_mappedPayload = (RegisterID)-1;
+}
+
+inline void JIT::unmap()
+{
+    m_mappedBytecodeIndex = (unsigned)-1;
+    m_mappedVirtualRegisterIndex = (unsigned)-1;
+    m_mappedTag = (RegisterID)-1;
+    m_mappedPayload = (RegisterID)-1;
+}
+
+inline bool JIT::isMapped(unsigned virtualRegisterIndex)
+{
+    if (m_mappedBytecodeIndex != m_bytecodeIndex)
+        return false;
+    if (m_mappedVirtualRegisterIndex != virtualRegisterIndex)
+        return false;
+    return true;
+}
+
+inline bool JIT::getMappedPayload(unsigned virtualRegisterIndex, RegisterID& payload)
+{
+    if (m_mappedBytecodeIndex != m_bytecodeIndex)
+        return false;
+    if (m_mappedVirtualRegisterIndex != virtualRegisterIndex)
+        return false;
+    if (m_mappedPayload == (RegisterID)-1)
+        return false;
+    payload = m_mappedPayload;
+    return true;
+}
+
+inline bool JIT::getMappedTag(unsigned virtualRegisterIndex, RegisterID& tag)
+{
+    if (m_mappedBytecodeIndex != m_bytecodeIndex)
+        return false;
+    if (m_mappedVirtualRegisterIndex != virtualRegisterIndex)
+        return false;
+    if (m_mappedTag == (RegisterID)-1)
+        return false;
+    tag = m_mappedTag;
+    return true;
+}
+
+inline void JIT::emitJumpSlowCaseIfNotJSCell(unsigned virtualRegisterIndex)
+{
+    if (!m_codeBlock->isKnownNotImmediate(virtualRegisterIndex))
+        addSlowCase(branch32(NotEqual, tagFor(virtualRegisterIndex), Imm32(JSValue::CellTag)));
+}
+
+inline void JIT::emitJumpSlowCaseIfNotJSCell(unsigned virtualRegisterIndex, RegisterID tag)
+{
+    if (!m_codeBlock->isKnownNotImmediate(virtualRegisterIndex))
+        addSlowCase(branch32(NotEqual, tag, Imm32(JSValue::CellTag)));
+}
+
+inline void JIT::linkSlowCaseIfNotJSCell(Vector<SlowCaseEntry>::iterator& iter, unsigned virtualRegisterIndex)
+{
+    if (!m_codeBlock->isKnownNotImmediate(virtualRegisterIndex))
+        linkSlowCase(iter);
+}
+
+ALWAYS_INLINE bool JIT::isOperandConstantImmediateInt(unsigned src)
+{
+    return m_codeBlock->isConstantRegisterIndex(src) && getConstantOperand(src).isInt32();
+}
+
+ALWAYS_INLINE bool JIT::getOperandConstantImmediateInt(unsigned op1, unsigned op2, unsigned& op, int32_t& constant)
+{
+    if (isOperandConstantImmediateInt(op1)) {
+        constant = getConstantOperand(op1).asInt32();
+        op = op2;
+        return true;
+    }
+
+    if (isOperandConstantImmediateInt(op2)) {
+        constant = getConstantOperand(op2).asInt32();
+        op = op1;
+        return true;
+    }
+    
+    return false;
+}
+
+ALWAYS_INLINE bool JIT::isOperandConstantImmediateDouble(unsigned src)
+{
+    return m_codeBlock->isConstantRegisterIndex(src) && getConstantOperand(src).isDouble();
+}
+
+/* Deprecated: Please use JITStubCall instead. */
+
+ALWAYS_INLINE void JIT::emitPutJITStubArg(RegisterID tag, RegisterID payload, unsigned argumentNumber)
+{
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    poke(payload, argumentStackOffset);
+    poke(tag, argumentStackOffset + 1);
+}
+
+/* Deprecated: Please use JITStubCall instead. */
+
+ALWAYS_INLINE void JIT::emitPutJITStubArgFromVirtualRegister(unsigned src, unsigned argumentNumber, RegisterID scratch1, RegisterID scratch2)
+{
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    if (m_codeBlock->isConstantRegisterIndex(src)) {
+        JSValue constant = m_codeBlock->getConstant(src);
+        poke(Imm32(constant.payload()), argumentStackOffset);
+        poke(Imm32(constant.tag()), argumentStackOffset + 1);
+    } else {
+        emitLoad(src, scratch1, scratch2);
+        poke(scratch2, argumentStackOffset);
+        poke(scratch1, argumentStackOffset + 1);
+    }
+}
+
+#else // USE(JSVALUE32_64)
+
+ALWAYS_INLINE void JIT::killLastResultRegister()
+{
+    m_lastResultBytecodeRegister = std::numeric_limits<int>::max();
+}
+
+// get arg puts an arg from the SF register array into a h/w register
+ALWAYS_INLINE void JIT::emitGetVirtualRegister(int src, RegisterID dst)
+{
+    ASSERT(m_bytecodeIndex != (unsigned)-1); // This method should only be called during hot/cold path generation, so that m_bytecodeIndex is set.
+
+    // TODO: we want to reuse values that are already in registers if we can - add a register allocator!
+    if (m_codeBlock->isConstantRegisterIndex(src)) {
+        JSValue value = m_codeBlock->getConstant(src);
+        move(ImmPtr(JSValue::encode(value)), dst);
+        killLastResultRegister();
+        return;
+    }
+
+    if (src == m_lastResultBytecodeRegister && m_codeBlock->isTemporaryRegisterIndex(src)) {
+        bool atJumpTarget = false;
+        while (m_jumpTargetsPosition < m_codeBlock->numberOfJumpTargets() && m_codeBlock->jumpTarget(m_jumpTargetsPosition) <= m_bytecodeIndex) {
+            if (m_codeBlock->jumpTarget(m_jumpTargetsPosition) == m_bytecodeIndex)
+                atJumpTarget = true;
+            ++m_jumpTargetsPosition;
+        }
+
+        if (!atJumpTarget) {
+            // The argument we want is already stored in eax
+            if (dst != cachedResultRegister)
+                move(cachedResultRegister, dst);
+            killLastResultRegister();
+            return;
+        }
+    }
+
+    loadPtr(Address(callFrameRegister, src * sizeof(Register)), dst);
+    killLastResultRegister();
+}
+
+ALWAYS_INLINE void JIT::emitGetVirtualRegisters(int src1, RegisterID dst1, int src2, RegisterID dst2)
+{
+    if (src2 == m_lastResultBytecodeRegister) {
+        emitGetVirtualRegister(src2, dst2);
+        emitGetVirtualRegister(src1, dst1);
+    } else {
+        emitGetVirtualRegister(src1, dst1);
+        emitGetVirtualRegister(src2, dst2);
+    }
+}
+
+ALWAYS_INLINE int32_t JIT::getConstantOperandImmediateInt(unsigned src)
+{
+    return getConstantOperand(src).asInt32();
+}
+
+ALWAYS_INLINE bool JIT::isOperandConstantImmediateInt(unsigned src)
+{
+    return m_codeBlock->isConstantRegisterIndex(src) && getConstantOperand(src).isInt32();
+}
+
+ALWAYS_INLINE void JIT::emitPutVirtualRegister(unsigned dst, RegisterID from)
+{
+    storePtr(from, Address(callFrameRegister, dst * sizeof(Register)));
+    m_lastResultBytecodeRegister = (from == cachedResultRegister) ? dst : std::numeric_limits<int>::max();
+}
+
+ALWAYS_INLINE void JIT::emitInitRegister(unsigned dst)
+{
+    storePtr(ImmPtr(JSValue::encode(jsUndefined())), Address(callFrameRegister, dst * sizeof(Register)));
+}
+
 ALWAYS_INLINE JIT::Jump JIT::emitJumpIfJSCell(RegisterID reg)
 {
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
     return branchTestPtr(Zero, reg, tagMaskRegister);
 #else
     return branchTest32(Zero, reg, Imm32(JSImmediate::TagMask));
@@ -265,7 +705,7 @@ ALWAYS_INLINE void JIT::emitJumpSlowCaseIfJSCell(RegisterID reg)
 
 ALWAYS_INLINE JIT::Jump JIT::emitJumpIfNotJSCell(RegisterID reg)
 {
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
     return branchTestPtr(NonZero, reg, tagMaskRegister);
 #else
     return branchTest32(NonZero, reg, Imm32(JSImmediate::TagMask));
@@ -283,13 +723,7 @@ ALWAYS_INLINE void JIT::emitJumpSlowCaseIfNotJSCell(RegisterID reg, int vReg)
         emitJumpSlowCaseIfNotJSCell(reg);
 }
 
-ALWAYS_INLINE void JIT::linkSlowCaseIfNotJSCell(Vector<SlowCaseEntry>::iterator& iter, int vReg)
-{
-    if (!m_codeBlock->isKnownNotImmediate(vReg))
-        linkSlowCase(iter);
-}
-
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
 ALWAYS_INLINE JIT::Jump JIT::emitJumpIfImmediateNumber(RegisterID reg)
 {
     return branchTestPtr(NonZero, reg, tagTypeNumberRegister);
@@ -302,7 +736,7 @@ ALWAYS_INLINE JIT::Jump JIT::emitJumpIfNotImmediateNumber(RegisterID reg)
 
 ALWAYS_INLINE JIT::Jump JIT::emitJumpIfImmediateInteger(RegisterID reg)
 {
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
     return branchPtr(AboveOrEqual, reg, tagTypeNumberRegister);
 #else
     return branchTest32(NonZero, reg, Imm32(JSImmediate::TagTypeNumber));
@@ -311,7 +745,7 @@ ALWAYS_INLINE JIT::Jump JIT::emitJumpIfImmediateInteger(RegisterID reg)
 
 ALWAYS_INLINE JIT::Jump JIT::emitJumpIfNotImmediateInteger(RegisterID reg)
 {
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
     return branchPtr(Below, reg, tagTypeNumberRegister);
 #else
     return branchTest32(Zero, reg, Imm32(JSImmediate::TagTypeNumber));
@@ -335,7 +769,7 @@ ALWAYS_INLINE void JIT::emitJumpSlowCaseIfNotImmediateIntegers(RegisterID reg1,
     addSlowCase(emitJumpIfNotImmediateIntegers(reg1, reg2, scratch));
 }
 
-#if !USE(ALTERNATE_JSIMMEDIATE)
+#if !USE(JSVALUE64)
 ALWAYS_INLINE void JIT::emitFastArithDeTagImmediate(RegisterID reg)
 {
     subPtr(Imm32(JSImmediate::TagTypeNumber), reg);
@@ -349,7 +783,7 @@ ALWAYS_INLINE JIT::Jump JIT::emitFastArithDeTagImmediateJumpIfZero(RegisterID re
 
 ALWAYS_INLINE void JIT::emitFastArithReTagImmediate(RegisterID src, RegisterID dest)
 {
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
     emitFastArithIntToImmNoCheck(src, dest);
 #else
     if (src != dest)
@@ -360,7 +794,7 @@ ALWAYS_INLINE void JIT::emitFastArithReTagImmediate(RegisterID src, RegisterID d
 
 ALWAYS_INLINE void JIT::emitFastArithImmToInt(RegisterID reg)
 {
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
     UNUSED_PARAM(reg);
 #else
     rshiftPtr(Imm32(JSImmediate::IntegerPayloadShift), reg);
@@ -370,7 +804,7 @@ ALWAYS_INLINE void JIT::emitFastArithImmToInt(RegisterID reg)
 // operand is int32_t, must have been zero-extended if register is 64-bit.
 ALWAYS_INLINE void JIT::emitFastArithIntToImmNoCheck(RegisterID src, RegisterID dest)
 {
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
     if (src != dest)
         move(src, dest);
     orPtr(tagTypeNumberRegister, dest);
@@ -387,88 +821,26 @@ ALWAYS_INLINE void JIT::emitTagAsBoolImmediate(RegisterID reg)
     or32(Imm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool)), reg);
 }
 
-ALWAYS_INLINE void JIT::addSlowCase(Jump jump)
-{
-    ASSERT(m_bytecodeIndex != (unsigned)-1); // This method should only be called during hot/cold path generation, so that m_bytecodeIndex is set.
-
-    m_slowCases.append(SlowCaseEntry(jump, m_bytecodeIndex));
-}
-
-ALWAYS_INLINE void JIT::addJump(Jump jump, int relativeOffset)
-{
-    ASSERT(m_bytecodeIndex != (unsigned)-1); // This method should only be called during hot/cold path generation, so that m_bytecodeIndex is set.
-
-    m_jmpTable.append(JumpTable(jump, m_bytecodeIndex + relativeOffset));
-}
-
-ALWAYS_INLINE void JIT::emitJumpSlowToHot(Jump jump, int relativeOffset)
-{
-    ASSERT(m_bytecodeIndex != (unsigned)-1); // This method should only be called during hot/cold path generation, so that m_bytecodeIndex is set.
-
-    jump.linkTo(m_labels[m_bytecodeIndex + relativeOffset], this);
-}
-
-#if ENABLE(SAMPLING_FLAGS)
-ALWAYS_INLINE void JIT::setSamplingFlag(int32_t flag)
-{
-    ASSERT(flag >= 1);
-    ASSERT(flag <= 32);
-    or32(Imm32(1u << (flag - 1)), AbsoluteAddress(&SamplingFlags::s_flags));
-}
+/* Deprecated: Please use JITStubCall instead. */
 
-ALWAYS_INLINE void JIT::clearSamplingFlag(int32_t flag)
+// get arg puts an arg from the SF register array onto the stack, as an arg to a context threaded function.
+ALWAYS_INLINE void JIT::emitPutJITStubArgFromVirtualRegister(unsigned src, unsigned argumentNumber, RegisterID scratch)
 {
-    ASSERT(flag >= 1);
-    ASSERT(flag <= 32);
-    and32(Imm32(~(1u << (flag - 1))), AbsoluteAddress(&SamplingFlags::s_flags));
-}
-#endif
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    if (m_codeBlock->isConstantRegisterIndex(src)) {
+        JSValue value = m_codeBlock->getConstant(src);
+        poke(ImmPtr(JSValue::encode(value)), argumentStackOffset);
+    } else {
+        loadPtr(Address(callFrameRegister, src * sizeof(Register)), scratch);
+        poke(scratch, argumentStackOffset);
+    }
 
-#if ENABLE(SAMPLING_COUNTERS)
-ALWAYS_INLINE void JIT::emitCount(AbstractSamplingCounter& counter, uint32_t count)
-{
-#if PLATFORM(X86_64) // Or any other 64-bit plattform.
-    addPtr(Imm32(count), AbsoluteAddress(&counter.m_counter));
-#elif PLATFORM(X86) // Or any other little-endian 32-bit plattform.
-    intptr_t hiWord = reinterpret_cast<intptr_t>(&counter.m_counter) + sizeof(int32_t);
-    add32(Imm32(count), AbsoluteAddress(&counter.m_counter));
-    addWithCarry32(Imm32(0), AbsoluteAddress(reinterpret_cast<void*>(hiWord)));
-#else
-#error "SAMPLING_FLAGS not implemented on this platform."
-#endif
+    killLastResultRegister();
 }
-#endif
 
-#if ENABLE(OPCODE_SAMPLING)
-#if PLATFORM(X86_64)
-ALWAYS_INLINE void JIT::sampleInstruction(Instruction* instruction, bool inHostFunction)
-{
-    move(ImmPtr(m_interpreter->sampler()->sampleSlot()), X86::ecx);
-    storePtr(ImmPtr(m_interpreter->sampler()->encodeSample(instruction, inHostFunction)), X86::ecx);
-}
-#else
-ALWAYS_INLINE void JIT::sampleInstruction(Instruction* instruction, bool inHostFunction)
-{
-    storePtr(ImmPtr(m_interpreter->sampler()->encodeSample(instruction, inHostFunction)), m_interpreter->sampler()->sampleSlot());
-}
-#endif
-#endif
+#endif // USE(JSVALUE32_64)
 
-#if ENABLE(CODEBLOCK_SAMPLING)
-#if PLATFORM(X86_64)
-ALWAYS_INLINE void JIT::sampleCodeBlock(CodeBlock* codeBlock)
-{
-    move(ImmPtr(m_interpreter->sampler()->codeBlockSlot()), X86::ecx);
-    storePtr(ImmPtr(codeBlock), X86::ecx);
-}
-#else
-ALWAYS_INLINE void JIT::sampleCodeBlock(CodeBlock* codeBlock)
-{
-    storePtr(ImmPtr(codeBlock), m_interpreter->sampler()->codeBlockSlot());
-}
-#endif
-#endif
-}
+} // namespace JSC
 
 #endif // ENABLE(JIT)
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp
index da541c5..1c9cd7e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp
@@ -32,12 +32,1764 @@
 #include "JITStubCall.h"
 #include "JSArray.h"
 #include "JSCell.h"
+#include "JSFunction.h"
+#include "LinkBuffer.h"
 
 namespace JSC {
 
+#if USE(JSVALUE32_64)
+
+void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* globalData, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk)
+{
+#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+    // (1) This function provides fast property access for string length
+    Label stringLengthBegin = align();
+    
+    // regT0 holds payload, regT1 holds tag
+    
+    Jump string_failureCases1 = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
+    Jump string_failureCases2 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr));
+
+    // Checks out okay! - get the length from the Ustring.
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSString, m_value) + OBJECT_OFFSETOF(UString, m_rep)), regT2);
+    load32(Address(regT2, OBJECT_OFFSETOF(UString::Rep, len)), regT2);
+
+    Jump string_failureCases3 = branch32(Above, regT2, Imm32(INT_MAX));
+    move(regT2, regT0);
+    move(Imm32(JSValue::Int32Tag), regT1);
+
+    ret();
+#endif
+
+    // (2) Trampolines for the slow cases of op_call / op_call_eval / op_construct.
+
+#if ENABLE(JIT_OPTIMIZE_CALL)
+    // VirtualCallLink Trampoline
+    // regT0 holds callee, regT1 holds argCount.  regT2 will hold the FunctionExecutable.
+    Label virtualCallLinkBegin = align();
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
+
+    Jump isNativeFunc2 = branch32(Equal, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), Imm32(0));
+
+    Jump hasCodeBlock2 = branch32(GreaterThan, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), Imm32(0));
+    preserveReturnAddressAfterCall(regT3);
+    restoreArgumentReference();
+    Call callJSFunction2 = call();
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
+    emitGetJITStubArg(2, regT1); // argCount
+    restoreReturnAddressBeforeReturn(regT3);
+    hasCodeBlock2.link(this);
+
+    // Check argCount matches callee arity.
+    Jump arityCheckOkay2 = branch32(Equal, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), regT1);
+    preserveReturnAddressAfterCall(regT3);
+    emitPutJITStubArg(regT3, 1); // return address
+    restoreArgumentReference();
+    Call callArityCheck2 = call();
+    move(regT1, callFrameRegister);
+    emitGetJITStubArg(2, regT1); // argCount
+    restoreReturnAddressBeforeReturn(regT3);
+    arityCheckOkay2.link(this);
+
+    isNativeFunc2.link(this);
+
+    compileOpCallInitializeCallFrame();
+
+    preserveReturnAddressAfterCall(regT3);
+    emitPutJITStubArg(regT3, 1); // return address
+    restoreArgumentReference();
+    Call callLazyLinkCall = call();
+    restoreReturnAddressBeforeReturn(regT3);
+    jump(regT0);
+#endif // ENABLE(JIT_OPTIMIZE_CALL)
+
+    // VirtualCall Trampoline
+    // regT0 holds callee, regT1 holds argCount.  regT2 will hold the FunctionExecutable.
+    Label virtualCallBegin = align();
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
+
+    Jump isNativeFunc3 = branch32(Equal, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), Imm32(0));
+
+    Jump hasCodeBlock3 = branch32(GreaterThan, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), Imm32(0));
+    preserveReturnAddressAfterCall(regT3);
+    restoreArgumentReference();
+    Call callJSFunction1 = call();
+    emitGetJITStubArg(2, regT1); // argCount
+    restoreReturnAddressBeforeReturn(regT3);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
+    hasCodeBlock3.link(this);
+    
+    // Check argCount matches callee arity.
+    Jump arityCheckOkay3 = branch32(Equal, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), regT1);
+    preserveReturnAddressAfterCall(regT3);
+    emitPutJITStubArg(regT3, 1); // return address
+    restoreArgumentReference();
+    Call callArityCheck1 = call();
+    move(regT1, callFrameRegister);
+    emitGetJITStubArg(2, regT1); // argCount
+    restoreReturnAddressBeforeReturn(regT3);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
+    arityCheckOkay3.link(this);
+
+    isNativeFunc3.link(this);
+
+    compileOpCallInitializeCallFrame();
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_jitCode)), regT0);
+    jump(regT0);
+
+#if PLATFORM(X86)
+    Label nativeCallThunk = align();
+    preserveReturnAddressAfterCall(regT0);
+    emitPutToCallFrameHeader(regT0, RegisterFile::ReturnPC); // Push return address
+
+    // Load caller frame's scope chain into this callframe so that whatever we call can
+    // get to its global data.
+    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT1);
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT1);
+    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
+    
+    emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
+
+    /* We have two structs that we use to describe the stackframe we set up for our
+     * call to native code.  NativeCallFrameStructure describes the how we set up the stack
+     * in advance of the call.  NativeFunctionCalleeSignature describes the callframe
+     * as the native code expects it.  We do this as we are using the fastcall calling
+     * convention which results in the callee popping its arguments off the stack, but
+     * not the rest of the callframe so we need a nice way to ensure we increment the
+     * stack pointer by the right amount after the call.
+     */
+
+#if COMPILER(MSVC) || PLATFORM(LINUX)
+#if COMPILER(MSVC)
+#pragma pack(push)
+#pragma pack(4)
+#endif // COMPILER(MSVC)
+    struct NativeCallFrameStructure {
+      //  CallFrame* callFrame; // passed in EDX
+        JSObject* callee;
+        JSValue thisValue;
+        ArgList* argPointer;
+        ArgList args;
+        JSValue result;
+    };
+    struct NativeFunctionCalleeSignature {
+        JSObject* callee;
+        JSValue thisValue;
+        ArgList* argPointer;
+    };
+#if COMPILER(MSVC)
+#pragma pack(pop)
+#endif // COMPILER(MSVC)
+#else
+    struct NativeCallFrameStructure {
+      //  CallFrame* callFrame; // passed in ECX
+      //  JSObject* callee; // passed in EDX
+        JSValue thisValue;
+        ArgList* argPointer;
+        ArgList args;
+    };
+    struct NativeFunctionCalleeSignature {
+        JSValue thisValue;
+        ArgList* argPointer;
+    };
+#endif
+    
+    const int NativeCallFrameSize = (sizeof(NativeCallFrameStructure) + 15) & ~15;
+    // Allocate system stack frame
+    subPtr(Imm32(NativeCallFrameSize), stackPointerRegister);
+
+    // Set up arguments
+    subPtr(Imm32(1), regT0); // Don't include 'this' in argcount
+
+    // push argcount
+    storePtr(regT0, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, args) + OBJECT_OFFSETOF(ArgList, m_argCount)));
+    
+    // Calculate the start of the callframe header, and store in regT1
+    addPtr(Imm32(-RegisterFile::CallFrameHeaderSize * (int)sizeof(Register)), callFrameRegister, regT1);
+    
+    // Calculate start of arguments as callframe header - sizeof(Register) * argcount (regT0)
+    mul32(Imm32(sizeof(Register)), regT0, regT0);
+    subPtr(regT0, regT1);
+    storePtr(regT1, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, args) + OBJECT_OFFSETOF(ArgList, m_args)));
+
+    // ArgList is passed by reference so is stackPointerRegister + 4 * sizeof(Register)
+    addPtr(Imm32(OBJECT_OFFSETOF(NativeCallFrameStructure, args)), stackPointerRegister, regT0);
+    storePtr(regT0, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, argPointer)));
+
+    // regT1 currently points to the first argument, regT1 - sizeof(Register) points to 'this'
+    loadPtr(Address(regT1, -(int)sizeof(Register) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT2);
+    loadPtr(Address(regT1, -(int)sizeof(Register) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), regT3);
+    storePtr(regT2, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, thisValue) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
+    storePtr(regT3, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, thisValue) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+
+#if COMPILER(MSVC) || PLATFORM(LINUX)
+    // ArgList is passed by reference so is stackPointerRegister + 4 * sizeof(Register)
+    addPtr(Imm32(OBJECT_OFFSETOF(NativeCallFrameStructure, result)), stackPointerRegister, X86Registers::ecx);
+
+    // Plant callee
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86Registers::eax);
+    storePtr(X86Registers::eax, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, callee)));
+
+    // Plant callframe
+    move(callFrameRegister, X86Registers::edx);
+
+    call(Address(X86Registers::eax, OBJECT_OFFSETOF(JSFunction, m_data)));
+
+    // JSValue is a non-POD type, so eax points to it
+    emitLoad(0, regT1, regT0, X86Registers::eax);
+#else
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86Registers::edx); // callee
+    move(callFrameRegister, X86Registers::ecx); // callFrame
+    call(Address(X86Registers::edx, OBJECT_OFFSETOF(JSFunction, m_data)));
+#endif
+
+    // We've put a few temporaries on the stack in addition to the actual arguments
+    // so pull them off now
+    addPtr(Imm32(NativeCallFrameSize - sizeof(NativeFunctionCalleeSignature)), stackPointerRegister);
+
+    // Check for an exception
+    // FIXME: Maybe we can optimize this comparison to JSValue().
+    move(ImmPtr(&globalData->exception), regT2);
+    Jump sawException1 = branch32(NotEqual, tagFor(0, regT2), Imm32(JSValue::CellTag));
+    Jump sawException2 = branch32(NonZero, payloadFor(0, regT2), Imm32(0));
+
+    // Grab the return address.
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT3);
+    
+    // Restore our caller's "r".
+    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
+    
+    // Return.
+    restoreReturnAddressBeforeReturn(regT3);
+    ret();
+
+    // Handle an exception
+    sawException1.link(this);
+    sawException2.link(this);
+    // Grab the return address.
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
+    move(ImmPtr(&globalData->exceptionLocation), regT2);
+    storePtr(regT1, regT2);
+    move(ImmPtr(reinterpret_cast<void*>(ctiVMThrowTrampoline)), regT2);
+    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
+    poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof (void*));
+    restoreReturnAddressBeforeReturn(regT2);
+    ret();
+
+#elif ENABLE(JIT_OPTIMIZE_NATIVE_CALL)
+#error "JIT_OPTIMIZE_NATIVE_CALL not yet supported on this platform."
+#else
+    breakpoint();
+#endif
+    
+#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+    Call string_failureCases1Call = makeTailRecursiveCall(string_failureCases1);
+    Call string_failureCases2Call = makeTailRecursiveCall(string_failureCases2);
+    Call string_failureCases3Call = makeTailRecursiveCall(string_failureCases3);
+#endif
+
+    // All trampolines constructed! copy the code, link up calls, and set the pointers on the Machine object.
+    LinkBuffer patchBuffer(this, m_globalData->executableAllocator.poolForSize(m_assembler.size()));
+
+#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+    patchBuffer.link(string_failureCases1Call, FunctionPtr(cti_op_get_by_id_string_fail));
+    patchBuffer.link(string_failureCases2Call, FunctionPtr(cti_op_get_by_id_string_fail));
+    patchBuffer.link(string_failureCases3Call, FunctionPtr(cti_op_get_by_id_string_fail));
+#endif
+    patchBuffer.link(callArityCheck1, FunctionPtr(cti_op_call_arityCheck));
+    patchBuffer.link(callJSFunction1, FunctionPtr(cti_op_call_JSFunction));
+#if ENABLE(JIT_OPTIMIZE_CALL)
+    patchBuffer.link(callArityCheck2, FunctionPtr(cti_op_call_arityCheck));
+    patchBuffer.link(callJSFunction2, FunctionPtr(cti_op_call_JSFunction));
+    patchBuffer.link(callLazyLinkCall, FunctionPtr(cti_vm_lazyLinkCall));
+#endif
+
+    CodeRef finalCode = patchBuffer.finalizeCode();
+    *executablePool = finalCode.m_executablePool;
+
+    *ctiVirtualCall = trampolineAt(finalCode, virtualCallBegin);
+    *ctiNativeCallThunk = trampolineAt(finalCode, nativeCallThunk);
+#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+    *ctiStringLengthTrampoline = trampolineAt(finalCode, stringLengthBegin);
+#else
+    UNUSED_PARAM(ctiStringLengthTrampoline);
+#endif
+#if ENABLE(JIT_OPTIMIZE_CALL)
+    *ctiVirtualCallLink = trampolineAt(finalCode, virtualCallLinkBegin);
+#else
+    UNUSED_PARAM(ctiVirtualCallLink);
+#endif
+}
+
+void JIT::emit_op_mov(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned src = currentInstruction[2].u.operand;
+
+    if (m_codeBlock->isConstantRegisterIndex(src))
+        emitStore(dst, getConstantOperand(src));
+    else {
+        emitLoad(src, regT1, regT0);
+        emitStore(dst, regT1, regT0);
+        map(m_bytecodeIndex + OPCODE_LENGTH(op_mov), dst, regT1, regT0);
+    }
+}
+
+void JIT::emit_op_end(Instruction* currentInstruction)
+{
+    if (m_codeBlock->needsFullScopeChain())
+        JITStubCall(this, cti_op_end).call();
+    ASSERT(returnValueRegister != callFrameRegister);
+    emitLoad(currentInstruction[1].u.operand, regT1, regT0);
+    restoreReturnAddressBeforeReturn(Address(callFrameRegister, RegisterFile::ReturnPC * static_cast<int>(sizeof(Register))));
+    ret();
+}
+
+void JIT::emit_op_jmp(Instruction* currentInstruction)
+{
+    unsigned target = currentInstruction[1].u.operand;
+    addJump(jump(), target + 1);
+}
+
+void JIT::emit_op_loop(Instruction* currentInstruction)
+{
+    unsigned target = currentInstruction[1].u.operand;
+    emitTimeoutCheck();
+    addJump(jump(), target + 1);
+}
+
+void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    emitTimeoutCheck();
+
+    if (isOperandConstantImmediateInt(op1)) {
+        emitLoad(op2, regT1, regT0);
+        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        addJump(branch32(GreaterThan, regT0, Imm32(getConstantOperand(op1).asInt32())), target + 3);
+        return;
+    }
+    
+    if (isOperandConstantImmediateInt(op2)) {
+        emitLoad(op1, regT1, regT0);
+        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        addJump(branch32(LessThan, regT0, Imm32(getConstantOperand(op2).asInt32())), target + 3);
+        return;
+    }
+
+    emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
+    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    addJump(branch32(LessThan, regT0, regT2), target + 3);
+}
+
+void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    if (!isOperandConstantImmediateInt(op1) && !isOperandConstantImmediateInt(op2))
+        linkSlowCase(iter); // int32 check
+    linkSlowCase(iter); // int32 check
+
+    JITStubCall stubCall(this, cti_op_loop_if_less);
+    stubCall.addArgument(op1);
+    stubCall.addArgument(op2);
+    stubCall.call();
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+}
+
+void JIT::emit_op_loop_if_lesseq(Instruction* currentInstruction)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    emitTimeoutCheck();
+
+    if (isOperandConstantImmediateInt(op1)) {
+        emitLoad(op2, regT1, regT0);
+        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        addJump(branch32(GreaterThanOrEqual, regT0, Imm32(getConstantOperand(op1).asInt32())), target + 3);
+        return;
+    }
+
+    if (isOperandConstantImmediateInt(op2)) {
+        emitLoad(op1, regT1, regT0);
+        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        addJump(branch32(LessThanOrEqual, regT0, Imm32(getConstantOperand(op2).asInt32())), target + 3);
+        return;
+    }
+
+    emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
+    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    addJump(branch32(LessThanOrEqual, regT0, regT2), target + 3);
+}
+
+void JIT::emitSlow_op_loop_if_lesseq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    if (!isOperandConstantImmediateInt(op1) && !isOperandConstantImmediateInt(op2))
+        linkSlowCase(iter); // int32 check
+    linkSlowCase(iter); // int32 check
+
+    JITStubCall stubCall(this, cti_op_loop_if_lesseq);
+    stubCall.addArgument(op1);
+    stubCall.addArgument(op2);
+    stubCall.call();
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+}
+
+void JIT::emit_op_new_object(Instruction* currentInstruction)
+{
+    JITStubCall(this, cti_op_new_object).call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_instanceof(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned value = currentInstruction[2].u.operand;
+    unsigned baseVal = currentInstruction[3].u.operand;
+    unsigned proto = currentInstruction[4].u.operand;
+
+    // Load the operands (baseVal, proto, and value respectively) into registers.
+    // We use regT0 for baseVal since we will be done with this first, and we can then use it for the result.
+    emitLoadPayload(proto, regT1);
+    emitLoadPayload(baseVal, regT0);
+    emitLoadPayload(value, regT2);
+
+    // Check that baseVal & proto are cells.
+    emitJumpSlowCaseIfNotJSCell(proto);
+    emitJumpSlowCaseIfNotJSCell(baseVal);
+
+    // Check that baseVal is an object, that it 'ImplementsHasInstance' but that it does not 'OverridesHasInstance'.
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
+    addSlowCase(branch32(NotEqual, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType))); // FIXME: Maybe remove this test.
+    addSlowCase(branchTest32(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsHasInstance))); // FIXME: TOT checks ImplementsDefaultHasInstance.
+
+    // If value is not an Object, return false.
+    emitLoadTag(value, regT0);
+    Jump valueIsImmediate = branch32(NotEqual, regT0, Imm32(JSValue::CellTag));
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
+    Jump valueIsNotObject = branch32(NotEqual, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)); // FIXME: Maybe remove this test.
+
+    // Check proto is object.
+    loadPtr(Address(regT1, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
+    addSlowCase(branch32(NotEqual, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+
+    // Optimistically load the result true, and start looping.
+    // Initially, regT1 still contains proto and regT2 still contains value.
+    // As we loop regT2 will be updated with its prototype, recursively walking the prototype chain.
+    move(Imm32(JSValue::TrueTag), regT0);
+    Label loop(this);
+
+    // Load the prototype of the object in regT2.  If this is equal to regT1 - WIN!
+    // Otherwise, check if we've hit null - if we have then drop out of the loop, if not go again.
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    load32(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT2);
+    Jump isInstance = branchPtr(Equal, regT2, regT1);
+    branch32(NotEqual, regT2, Imm32(0), loop);
+
+    // We get here either by dropping out of the loop, or if value was not an Object.  Result is false.
+    valueIsImmediate.link(this);
+    valueIsNotObject.link(this);
+    move(Imm32(JSValue::FalseTag), regT0);
+
+    // isInstance jumps right down to here, to skip setting the result to false (it has already set true).
+    isInstance.link(this);
+    emitStoreBool(dst, regT0);
+}
+
+void JIT::emitSlow_op_instanceof(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned value = currentInstruction[2].u.operand;
+    unsigned baseVal = currentInstruction[3].u.operand;
+    unsigned proto = currentInstruction[4].u.operand;
+
+    linkSlowCaseIfNotJSCell(iter, baseVal);
+    linkSlowCaseIfNotJSCell(iter, proto);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+
+    JITStubCall stubCall(this, cti_op_instanceof);
+    stubCall.addArgument(value);
+    stubCall.addArgument(baseVal);
+    stubCall.addArgument(proto);
+    stubCall.call(dst);
+}
+
+void JIT::emit_op_new_func(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, cti_op_new_func);
+    stubCall.addArgument(ImmPtr(m_codeBlock->functionDecl(currentInstruction[2].u.operand)));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_get_global_var(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    JSGlobalObject* globalObject = static_cast<JSGlobalObject*>(currentInstruction[2].u.jsCell);
+    ASSERT(globalObject->isGlobalObject());
+    int index = currentInstruction[3].u.operand;
+
+    loadPtr(&globalObject->d()->registers, regT2);
+
+    emitLoad(index, regT1, regT0, regT2);
+    emitStore(dst, regT1, regT0);
+    map(m_bytecodeIndex + OPCODE_LENGTH(op_get_global_var), dst, regT1, regT0);
+}
+
+void JIT::emit_op_put_global_var(Instruction* currentInstruction)
+{
+    JSGlobalObject* globalObject = static_cast<JSGlobalObject*>(currentInstruction[1].u.jsCell);
+    ASSERT(globalObject->isGlobalObject());
+    int index = currentInstruction[2].u.operand;
+    int value = currentInstruction[3].u.operand;
+
+    emitLoad(value, regT1, regT0);
+
+    loadPtr(&globalObject->d()->registers, regT2);
+    emitStore(index, regT1, regT0, regT2);
+    map(m_bytecodeIndex + OPCODE_LENGTH(op_put_global_var), value, regT1, regT0);
+}
+
+void JIT::emit_op_get_scoped_var(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int index = currentInstruction[2].u.operand;
+    int skip = currentInstruction[3].u.operand + m_codeBlock->needsFullScopeChain();
+
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT2);
+    while (skip--)
+        loadPtr(Address(regT2, OBJECT_OFFSETOF(ScopeChainNode, next)), regT2);
+
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(ScopeChainNode, object)), regT2);
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSVariableObject, d)), regT2);
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSVariableObject::JSVariableObjectData, registers)), regT2);
+
+    emitLoad(index, regT1, regT0, regT2);
+    emitStore(dst, regT1, regT0);
+    map(m_bytecodeIndex + OPCODE_LENGTH(op_get_scoped_var), dst, regT1, regT0);
+}
+
+void JIT::emit_op_put_scoped_var(Instruction* currentInstruction)
+{
+    int index = currentInstruction[1].u.operand;
+    int skip = currentInstruction[2].u.operand + m_codeBlock->needsFullScopeChain();
+    int value = currentInstruction[3].u.operand;
+
+    emitLoad(value, regT1, regT0);
+
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT2);
+    while (skip--)
+        loadPtr(Address(regT2, OBJECT_OFFSETOF(ScopeChainNode, next)), regT2);
+
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(ScopeChainNode, object)), regT2);
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSVariableObject, d)), regT2);
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSVariableObject::JSVariableObjectData, registers)), regT2);
+
+    emitStore(index, regT1, regT0, regT2);
+    map(m_bytecodeIndex + OPCODE_LENGTH(op_put_scoped_var), value, regT1, regT0);
+}
+
+void JIT::emit_op_tear_off_activation(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, cti_op_tear_off_activation);
+    stubCall.addArgument(currentInstruction[1].u.operand);
+    stubCall.call();
+}
+
+void JIT::emit_op_tear_off_arguments(Instruction*)
+{
+    JITStubCall(this, cti_op_tear_off_arguments).call();
+}
+
+void JIT::emit_op_new_array(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, cti_op_new_array);
+    stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
+    stubCall.addArgument(Imm32(currentInstruction[3].u.operand));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_resolve(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, cti_op_resolve);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_to_primitive(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int src = currentInstruction[2].u.operand;
+
+    emitLoad(src, regT1, regT0);
+
+    Jump isImm = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
+    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr)));
+    isImm.link(this);
+
+    if (dst != src)
+        emitStore(dst, regT1, regT0);
+    map(m_bytecodeIndex + OPCODE_LENGTH(op_to_primitive), dst, regT1, regT0);
+}
+
+void JIT::emitSlow_op_to_primitive(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int dst = currentInstruction[1].u.operand;
+
+    linkSlowCase(iter);
+
+    JITStubCall stubCall(this, cti_op_to_primitive);
+    stubCall.addArgument(regT1, regT0);
+    stubCall.call(dst);
+}
+
+void JIT::emit_op_strcat(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, cti_op_strcat);
+    stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
+    stubCall.addArgument(Imm32(currentInstruction[3].u.operand));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_loop_if_true(Instruction* currentInstruction)
+{
+    unsigned cond = currentInstruction[1].u.operand;
+    unsigned target = currentInstruction[2].u.operand;
+
+    emitTimeoutCheck();
+
+    emitLoad(cond, regT1, regT0);
+
+    Jump isNotInteger = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
+    addJump(branch32(NotEqual, regT0, Imm32(0)), target + 2);
+    Jump isNotZero = jump();
+
+    isNotInteger.link(this);
+
+    addJump(branch32(Equal, regT1, Imm32(JSValue::TrueTag)), target + 2);
+    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::FalseTag)));
+
+    isNotZero.link(this);
+}
+
+void JIT::emitSlow_op_loop_if_true(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned cond = currentInstruction[1].u.operand;
+    unsigned target = currentInstruction[2].u.operand;
+
+    linkSlowCase(iter);
+
+    JITStubCall stubCall(this, cti_op_jtrue);
+    stubCall.addArgument(cond);
+    stubCall.call();
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 2);
+}
+
+void JIT::emit_op_resolve_base(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, cti_op_resolve_base);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_resolve_skip(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, cti_op_resolve_skip);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(Imm32(currentInstruction[3].u.operand + m_codeBlock->needsFullScopeChain()));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_resolve_global(Instruction* currentInstruction)
+{
+    // FIXME: Optimize to use patching instead of so many memory accesses.
+
+    unsigned dst = currentInstruction[1].u.operand;
+    void* globalObject = currentInstruction[2].u.jsCell;
+    
+    unsigned currentIndex = m_globalResolveInfoIndex++;
+    void* structureAddress = &(m_codeBlock->globalResolveInfo(currentIndex).structure);
+    void* offsetAddr = &(m_codeBlock->globalResolveInfo(currentIndex).offset);
+
+    // Verify structure.
+    move(ImmPtr(globalObject), regT0);
+    loadPtr(structureAddress, regT1);
+    addSlowCase(branchPtr(NotEqual, regT1, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure))));
+
+    // Load property.
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSGlobalObject, m_externalStorage)), regT2);
+    load32(offsetAddr, regT3);
+    load32(BaseIndex(regT2, regT3, TimesEight), regT0); // payload
+    load32(BaseIndex(regT2, regT3, TimesEight, 4), regT1); // tag
+    emitStore(dst, regT1, regT0);
+    map(m_bytecodeIndex + OPCODE_LENGTH(op_resolve_global), dst, regT1, regT0);
+}
+
+void JIT::emitSlow_op_resolve_global(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    void* globalObject = currentInstruction[2].u.jsCell;
+    Identifier* ident = &m_codeBlock->identifier(currentInstruction[3].u.operand);
+
+    unsigned currentIndex = m_globalResolveInfoIndex++;
+
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, cti_op_resolve_global);
+    stubCall.addArgument(ImmPtr(globalObject));
+    stubCall.addArgument(ImmPtr(ident));
+    stubCall.addArgument(Imm32(currentIndex));
+    stubCall.call(dst);
+}
+
+void JIT::emit_op_not(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned src = currentInstruction[2].u.operand;
+
+    emitLoadTag(src, regT0);
+
+    xor32(Imm32(JSValue::FalseTag), regT0);
+    addSlowCase(branchTest32(NonZero, regT0, Imm32(~1)));
+    xor32(Imm32(JSValue::TrueTag), regT0);
+
+    emitStoreBool(dst, regT0, (dst == src));
+}
+
+void JIT::emitSlow_op_not(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned src = currentInstruction[2].u.operand;
+
+    linkSlowCase(iter);
+
+    JITStubCall stubCall(this, cti_op_not);
+    stubCall.addArgument(src);
+    stubCall.call(dst);
+}
+
+void JIT::emit_op_jfalse(Instruction* currentInstruction)
+{
+    unsigned cond = currentInstruction[1].u.operand;
+    unsigned target = currentInstruction[2].u.operand;
+
+    emitLoad(cond, regT1, regT0);
+
+    Jump isTrue = branch32(Equal, regT1, Imm32(JSValue::TrueTag));
+    addJump(branch32(Equal, regT1, Imm32(JSValue::FalseTag)), target + 2);
+
+    Jump isNotInteger = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
+    Jump isTrue2 = branch32(NotEqual, regT0, Imm32(0));
+    addJump(jump(), target + 2);
+
+    isNotInteger.link(this);
+
+    addSlowCase(branch32(Above, regT1, Imm32(JSValue::LowestTag)));
+
+    zeroDouble(fpRegT0);
+    emitLoadDouble(cond, fpRegT1);
+    addJump(branchDouble(DoubleEqual, fpRegT0, fpRegT1), target + 2);
+    
+    isTrue.link(this);
+    isTrue2.link(this);
+}
+
+void JIT::emitSlow_op_jfalse(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned cond = currentInstruction[1].u.operand;
+    unsigned target = currentInstruction[2].u.operand;
+
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, cti_op_jtrue);
+    stubCall.addArgument(cond);
+    stubCall.call();
+    emitJumpSlowToHot(branchTest32(Zero, regT0), target + 2); // Inverted.
+}
+
+void JIT::emit_op_jtrue(Instruction* currentInstruction)
+{
+    unsigned cond = currentInstruction[1].u.operand;
+    unsigned target = currentInstruction[2].u.operand;
+
+    emitLoad(cond, regT1, regT0);
+
+    Jump isFalse = branch32(Equal, regT1, Imm32(JSValue::FalseTag));
+    addJump(branch32(Equal, regT1, Imm32(JSValue::TrueTag)), target + 2);
+
+    Jump isNotInteger = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
+    Jump isFalse2 = branch32(Equal, regT0, Imm32(0));
+    addJump(jump(), target + 2);
+
+    isNotInteger.link(this);
+
+    addSlowCase(branch32(Above, regT1, Imm32(JSValue::LowestTag)));
+
+    zeroDouble(fpRegT0);
+    emitLoadDouble(cond, fpRegT1);
+    addJump(branchDouble(DoubleNotEqual, fpRegT0, fpRegT1), target + 2);
+    
+    isFalse.link(this);
+    isFalse2.link(this);
+}
+
+void JIT::emitSlow_op_jtrue(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned cond = currentInstruction[1].u.operand;
+    unsigned target = currentInstruction[2].u.operand;
+
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, cti_op_jtrue);
+    stubCall.addArgument(cond);
+    stubCall.call();
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 2);
+}
+
+void JIT::emit_op_jeq_null(Instruction* currentInstruction)
+{
+    unsigned src = currentInstruction[1].u.operand;
+    unsigned target = currentInstruction[2].u.operand;
+
+    emitLoad(src, regT1, regT0);
+
+    Jump isImmediate = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
+
+    // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    addJump(branchTest32(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target + 2);
+
+    Jump wasNotImmediate = jump();
+
+    // Now handle the immediate cases - undefined & null
+    isImmediate.link(this);
+
+    set32(Equal, regT1, Imm32(JSValue::NullTag), regT2);
+    set32(Equal, regT1, Imm32(JSValue::UndefinedTag), regT1);
+    or32(regT2, regT1);
+
+    addJump(branchTest32(NonZero, regT1), target + 2);
+
+    wasNotImmediate.link(this);
+}
+
+void JIT::emit_op_jneq_null(Instruction* currentInstruction)
+{
+    unsigned src = currentInstruction[1].u.operand;
+    unsigned target = currentInstruction[2].u.operand;
+
+    emitLoad(src, regT1, regT0);
+
+    Jump isImmediate = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
+
+    // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    addJump(branchTest32(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target + 2);
+
+    Jump wasNotImmediate = jump();
+
+    // Now handle the immediate cases - undefined & null
+    isImmediate.link(this);
+
+    set32(Equal, regT1, Imm32(JSValue::NullTag), regT2);
+    set32(Equal, regT1, Imm32(JSValue::UndefinedTag), regT1);
+    or32(regT2, regT1);
+
+    addJump(branchTest32(Zero, regT1), target + 2);
+
+    wasNotImmediate.link(this);
+}
+
+void JIT::emit_op_jneq_ptr(Instruction* currentInstruction)
+{
+    unsigned src = currentInstruction[1].u.operand;
+    JSCell* ptr = currentInstruction[2].u.jsCell;
+    unsigned target = currentInstruction[3].u.operand;
+
+    emitLoad(src, regT1, regT0);
+    addJump(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)), target + 3);
+    addJump(branchPtr(NotEqual, regT0, ImmPtr(ptr)), target + 3);
+}
+
+void JIT::emit_op_jsr(Instruction* currentInstruction)
+{
+    int retAddrDst = currentInstruction[1].u.operand;
+    int target = currentInstruction[2].u.operand;
+    DataLabelPtr storeLocation = storePtrWithPatch(ImmPtr(0), Address(callFrameRegister, sizeof(Register) * retAddrDst));
+    addJump(jump(), target + 2);
+    m_jsrSites.append(JSRInfo(storeLocation, label()));
+}
+
+void JIT::emit_op_sret(Instruction* currentInstruction)
+{
+    jump(Address(callFrameRegister, sizeof(Register) * currentInstruction[1].u.operand));
+}
+
+void JIT::emit_op_eq(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned src1 = currentInstruction[2].u.operand;
+    unsigned src2 = currentInstruction[3].u.operand;
+    
+    emitLoad2(src1, regT1, regT0, src2, regT3, regT2);
+    addSlowCase(branch32(NotEqual, regT1, regT3));
+    addSlowCase(branch32(Equal, regT1, Imm32(JSValue::CellTag)));
+    addSlowCase(branch32(Below, regT1, Imm32(JSValue::LowestTag)));
+
+    set8(Equal, regT0, regT2, regT0);
+    or32(Imm32(JSValue::FalseTag), regT0);
+
+    emitStoreBool(dst, regT0);
+}
+
+void JIT::emitSlow_op_eq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+    
+    JumpList storeResult;
+    JumpList genericCase;
+    
+    genericCase.append(getSlowCase(iter)); // tags not equal
+
+    linkSlowCase(iter); // tags equal and JSCell
+    genericCase.append(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr)));
+    genericCase.append(branchPtr(NotEqual, Address(regT2), ImmPtr(m_globalData->jsStringVPtr)));
+
+    // String case.
+    JITStubCall stubCallEqStrings(this, cti_op_eq_strings);
+    stubCallEqStrings.addArgument(regT0);
+    stubCallEqStrings.addArgument(regT2);
+    stubCallEqStrings.call();
+    storeResult.append(jump());
+
+    // Generic case.
+    genericCase.append(getSlowCase(iter)); // doubles
+    genericCase.link(this);
+    JITStubCall stubCallEq(this, cti_op_eq);
+    stubCallEq.addArgument(op1);
+    stubCallEq.addArgument(op2);
+    stubCallEq.call(regT0);
+
+    storeResult.link(this);
+    or32(Imm32(JSValue::FalseTag), regT0);
+    emitStoreBool(dst, regT0);
+}
+
+void JIT::emit_op_neq(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned src1 = currentInstruction[2].u.operand;
+    unsigned src2 = currentInstruction[3].u.operand;
+    
+    emitLoad2(src1, regT1, regT0, src2, regT3, regT2);
+    addSlowCase(branch32(NotEqual, regT1, regT3));
+    addSlowCase(branch32(Equal, regT1, Imm32(JSValue::CellTag)));
+    addSlowCase(branch32(Below, regT1, Imm32(JSValue::LowestTag)));
+
+    set8(NotEqual, regT0, regT2, regT0);
+    or32(Imm32(JSValue::FalseTag), regT0);
+
+    emitStoreBool(dst, regT0);
+}
+
+void JIT::emitSlow_op_neq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    
+    JumpList storeResult;
+    JumpList genericCase;
+    
+    genericCase.append(getSlowCase(iter)); // tags not equal
+
+    linkSlowCase(iter); // tags equal and JSCell
+    genericCase.append(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr)));
+    genericCase.append(branchPtr(NotEqual, Address(regT2), ImmPtr(m_globalData->jsStringVPtr)));
+
+    // String case.
+    JITStubCall stubCallEqStrings(this, cti_op_eq_strings);
+    stubCallEqStrings.addArgument(regT0);
+    stubCallEqStrings.addArgument(regT2);
+    stubCallEqStrings.call(regT0);
+    storeResult.append(jump());
+
+    // Generic case.
+    genericCase.append(getSlowCase(iter)); // doubles
+    genericCase.link(this);
+    JITStubCall stubCallEq(this, cti_op_eq);
+    stubCallEq.addArgument(regT1, regT0);
+    stubCallEq.addArgument(regT3, regT2);
+    stubCallEq.call(regT0);
+
+    storeResult.link(this);
+    xor32(Imm32(0x1), regT0);
+    or32(Imm32(JSValue::FalseTag), regT0);
+    emitStoreBool(dst, regT0);
+}
+
+void JIT::compileOpStrictEq(Instruction* currentInstruction, CompileOpStrictEqType type)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned src1 = currentInstruction[2].u.operand;
+    unsigned src2 = currentInstruction[3].u.operand;
+
+    emitLoadTag(src1, regT0);
+    emitLoadTag(src2, regT1);
+
+    // Jump to a slow case if either operand is double, or if both operands are
+    // cells and/or Int32s.
+    move(regT0, regT2);
+    and32(regT1, regT2);
+    addSlowCase(branch32(Below, regT2, Imm32(JSValue::LowestTag)));
+    addSlowCase(branch32(AboveOrEqual, regT2, Imm32(JSValue::CellTag)));
+
+    if (type == OpStrictEq)
+        set8(Equal, regT0, regT1, regT0);
+    else
+        set8(NotEqual, regT0, regT1, regT0);
+
+    or32(Imm32(JSValue::FalseTag), regT0);
+
+    emitStoreBool(dst, regT0);
+}
+
+void JIT::emit_op_stricteq(Instruction* currentInstruction)
+{
+    compileOpStrictEq(currentInstruction, OpStrictEq);
+}
+
+void JIT::emitSlow_op_stricteq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned src1 = currentInstruction[2].u.operand;
+    unsigned src2 = currentInstruction[3].u.operand;
+
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+
+    JITStubCall stubCall(this, cti_op_stricteq);
+    stubCall.addArgument(src1);
+    stubCall.addArgument(src2);
+    stubCall.call(dst);
+}
+
+void JIT::emit_op_nstricteq(Instruction* currentInstruction)
+{
+    compileOpStrictEq(currentInstruction, OpNStrictEq);
+}
+
+void JIT::emitSlow_op_nstricteq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned src1 = currentInstruction[2].u.operand;
+    unsigned src2 = currentInstruction[3].u.operand;
+
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+
+    JITStubCall stubCall(this, cti_op_nstricteq);
+    stubCall.addArgument(src1);
+    stubCall.addArgument(src2);
+    stubCall.call(dst);
+}
+
+void JIT::emit_op_eq_null(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned src = currentInstruction[2].u.operand;
+
+    emitLoad(src, regT1, regT0);
+    Jump isImmediate = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
+
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT1);
+    setTest8(NonZero, Address(regT1, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT1);
+
+    Jump wasNotImmediate = jump();
+
+    isImmediate.link(this);
+
+    set8(Equal, regT1, Imm32(JSValue::NullTag), regT2);
+    set8(Equal, regT1, Imm32(JSValue::UndefinedTag), regT1);
+    or32(regT2, regT1);
+
+    wasNotImmediate.link(this);
+
+    or32(Imm32(JSValue::FalseTag), regT1);
+
+    emitStoreBool(dst, regT1);
+}
+
+void JIT::emit_op_neq_null(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned src = currentInstruction[2].u.operand;
+
+    emitLoad(src, regT1, regT0);
+    Jump isImmediate = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
+
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT1);
+    setTest8(Zero, Address(regT1, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT1);
+
+    Jump wasNotImmediate = jump();
+
+    isImmediate.link(this);
+
+    set8(NotEqual, regT1, Imm32(JSValue::NullTag), regT2);
+    set8(NotEqual, regT1, Imm32(JSValue::UndefinedTag), regT1);
+    and32(regT2, regT1);
+
+    wasNotImmediate.link(this);
+
+    or32(Imm32(JSValue::FalseTag), regT1);
+
+    emitStoreBool(dst, regT1);
+}
+
+void JIT::emit_op_resolve_with_base(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, cti_op_resolve_with_base);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[3].u.operand)));
+    stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
+    stubCall.call(currentInstruction[2].u.operand);
+}
+
+void JIT::emit_op_new_func_exp(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, cti_op_new_func_exp);
+    stubCall.addArgument(ImmPtr(m_codeBlock->functionExpr(currentInstruction[2].u.operand)));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_new_regexp(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, cti_op_new_regexp);
+    stubCall.addArgument(ImmPtr(m_codeBlock->regexp(currentInstruction[2].u.operand)));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_throw(Instruction* currentInstruction)
+{
+    unsigned exception = currentInstruction[1].u.operand;
+    JITStubCall stubCall(this, cti_op_throw);
+    stubCall.addArgument(exception);
+    stubCall.call();
+
+#ifndef NDEBUG
+    // cti_op_throw always changes it's return address,
+    // this point in the code should never be reached.
+    breakpoint();
+#endif
+}
+
+void JIT::emit_op_next_pname(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int iter = currentInstruction[2].u.operand;
+    int target = currentInstruction[3].u.operand;
+
+    load32(Address(callFrameRegister, (iter * sizeof(Register))), regT0);
+
+    JITStubCall stubCall(this, cti_op_next_pname);
+    stubCall.addArgument(regT0);
+    stubCall.call();
+
+    Jump endOfIter = branchTestPtr(Zero, regT0);
+    emitStore(dst, regT1, regT0);
+    map(m_bytecodeIndex + OPCODE_LENGTH(op_next_pname), dst, regT1, regT0);
+    addJump(jump(), target + 3);
+    endOfIter.link(this);
+}
+
+void JIT::emit_op_push_scope(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, cti_op_push_scope);
+    stubCall.addArgument(currentInstruction[1].u.operand);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_pop_scope(Instruction*)
+{
+    JITStubCall(this, cti_op_pop_scope).call();
+}
+
+void JIT::emit_op_to_jsnumber(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int src = currentInstruction[2].u.operand;
+
+    emitLoad(src, regT1, regT0);
+
+    Jump isInt32 = branch32(Equal, regT1, Imm32(JSValue::Int32Tag));
+    addSlowCase(branch32(AboveOrEqual, regT1, Imm32(JSValue::DeletedValueTag)));
+    isInt32.link(this);
+
+    if (src != dst)
+        emitStore(dst, regT1, regT0);
+    map(m_bytecodeIndex + OPCODE_LENGTH(op_to_jsnumber), dst, regT1, regT0);
+}
+
+void JIT::emitSlow_op_to_jsnumber(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int dst = currentInstruction[1].u.operand;
+
+    linkSlowCase(iter);
+
+    JITStubCall stubCall(this, cti_op_to_jsnumber);
+    stubCall.addArgument(regT1, regT0);
+    stubCall.call(dst);
+}
+
+void JIT::emit_op_push_new_scope(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, cti_op_push_new_scope);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(currentInstruction[3].u.operand);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_catch(Instruction* currentInstruction)
+{
+    unsigned exception = currentInstruction[1].u.operand;
+
+    // This opcode only executes after a return from cti_op_throw.
+
+    // cti_op_throw may have taken us to a call frame further up the stack; reload
+    // the call frame pointer to adjust.
+    peek(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof (void*));
+
+    // Now store the exception returned by cti_op_throw.
+    emitStore(exception, regT1, regT0);
+    map(m_bytecodeIndex + OPCODE_LENGTH(op_catch), exception, regT1, regT0);
+}
+
+void JIT::emit_op_jmp_scopes(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, cti_op_jmp_scopes);
+    stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
+    stubCall.call();
+    addJump(jump(), currentInstruction[2].u.operand + 2);
+}
+
+void JIT::emit_op_switch_imm(Instruction* currentInstruction)
+{
+    unsigned tableIndex = currentInstruction[1].u.operand;
+    unsigned defaultOffset = currentInstruction[2].u.operand;
+    unsigned scrutinee = currentInstruction[3].u.operand;
+
+    // create jump table for switch destinations, track this switch statement.
+    SimpleJumpTable* jumpTable = &m_codeBlock->immediateSwitchJumpTable(tableIndex);
+    m_switches.append(SwitchRecord(jumpTable, m_bytecodeIndex, defaultOffset, SwitchRecord::Immediate));
+    jumpTable->ctiOffsets.grow(jumpTable->branchOffsets.size());
+
+    JITStubCall stubCall(this, cti_op_switch_imm);
+    stubCall.addArgument(scrutinee);
+    stubCall.addArgument(Imm32(tableIndex));
+    stubCall.call();
+    jump(regT0);
+}
+
+void JIT::emit_op_switch_char(Instruction* currentInstruction)
+{
+    unsigned tableIndex = currentInstruction[1].u.operand;
+    unsigned defaultOffset = currentInstruction[2].u.operand;
+    unsigned scrutinee = currentInstruction[3].u.operand;
+
+    // create jump table for switch destinations, track this switch statement.
+    SimpleJumpTable* jumpTable = &m_codeBlock->characterSwitchJumpTable(tableIndex);
+    m_switches.append(SwitchRecord(jumpTable, m_bytecodeIndex, defaultOffset, SwitchRecord::Character));
+    jumpTable->ctiOffsets.grow(jumpTable->branchOffsets.size());
+
+    JITStubCall stubCall(this, cti_op_switch_char);
+    stubCall.addArgument(scrutinee);
+    stubCall.addArgument(Imm32(tableIndex));
+    stubCall.call();
+    jump(regT0);
+}
+
+void JIT::emit_op_switch_string(Instruction* currentInstruction)
+{
+    unsigned tableIndex = currentInstruction[1].u.operand;
+    unsigned defaultOffset = currentInstruction[2].u.operand;
+    unsigned scrutinee = currentInstruction[3].u.operand;
+
+    // create jump table for switch destinations, track this switch statement.
+    StringJumpTable* jumpTable = &m_codeBlock->stringSwitchJumpTable(tableIndex);
+    m_switches.append(SwitchRecord(jumpTable, m_bytecodeIndex, defaultOffset));
+
+    JITStubCall stubCall(this, cti_op_switch_string);
+    stubCall.addArgument(scrutinee);
+    stubCall.addArgument(Imm32(tableIndex));
+    stubCall.call();
+    jump(regT0);
+}
+
+void JIT::emit_op_new_error(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned type = currentInstruction[2].u.operand;
+    unsigned message = currentInstruction[3].u.operand;
+
+    JITStubCall stubCall(this, cti_op_new_error);
+    stubCall.addArgument(Imm32(type));
+    stubCall.addArgument(m_codeBlock->getConstant(message));
+    stubCall.addArgument(Imm32(m_bytecodeIndex));
+    stubCall.call(dst);
+}
+
+void JIT::emit_op_debug(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, cti_op_debug);
+    stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
+    stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
+    stubCall.addArgument(Imm32(currentInstruction[3].u.operand));
+    stubCall.call();
+}
+
+
+void JIT::emit_op_enter(Instruction*)
+{
+    // Even though JIT code doesn't use them, we initialize our constant
+    // registers to zap stale pointers, to avoid unnecessarily prolonging
+    // object lifetime and increasing GC pressure.
+    for (int i = 0; i < m_codeBlock->m_numVars; ++i)
+        emitStore(i, jsUndefined());
+}
+
+void JIT::emit_op_enter_with_activation(Instruction* currentInstruction)
+{
+    emit_op_enter(currentInstruction);
+
+    JITStubCall(this, cti_op_push_activation).call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_create_arguments(Instruction*)
+{
+    Jump argsNotCell = branch32(NotEqual, tagFor(RegisterFile::ArgumentsRegister, callFrameRegister), Imm32(JSValue::CellTag));
+    Jump argsNotNull = branchTestPtr(NonZero, payloadFor(RegisterFile::ArgumentsRegister, callFrameRegister));
+
+    // If we get here the arguments pointer is a null cell - i.e. arguments need lazy creation.
+    if (m_codeBlock->m_numParameters == 1)
+        JITStubCall(this, cti_op_create_arguments_no_params).call();
+    else
+        JITStubCall(this, cti_op_create_arguments).call();
+
+    argsNotCell.link(this);
+    argsNotNull.link(this);
+}
+    
+void JIT::emit_op_init_arguments(Instruction*)
+{
+    emitStore(RegisterFile::ArgumentsRegister, JSValue(), callFrameRegister);
+}
+
+void JIT::emit_op_convert_this(Instruction* currentInstruction)
+{
+    unsigned thisRegister = currentInstruction[1].u.operand;
+    
+    emitLoad(thisRegister, regT1, regT0);
+
+    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
+
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    addSlowCase(branchTest32(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
+
+    map(m_bytecodeIndex + OPCODE_LENGTH(op_convert_this), thisRegister, regT1, regT0);
+}
+
+void JIT::emitSlow_op_convert_this(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned thisRegister = currentInstruction[1].u.operand;
+
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+
+    JITStubCall stubCall(this, cti_op_convert_this);
+    stubCall.addArgument(regT1, regT0);
+    stubCall.call(thisRegister);
+}
+
+void JIT::emit_op_profile_will_call(Instruction* currentInstruction)
+{
+    peek(regT2, OBJECT_OFFSETOF(JITStackFrame, enabledProfilerReference) / sizeof (void*));
+    Jump noProfiler = branchTestPtr(Zero, Address(regT2));
+
+    JITStubCall stubCall(this, cti_op_profile_will_call);
+    stubCall.addArgument(currentInstruction[1].u.operand);
+    stubCall.call();
+    noProfiler.link(this);
+}
+
+void JIT::emit_op_profile_did_call(Instruction* currentInstruction)
+{
+    peek(regT2, OBJECT_OFFSETOF(JITStackFrame, enabledProfilerReference) / sizeof (void*));
+    Jump noProfiler = branchTestPtr(Zero, Address(regT2));
+
+    JITStubCall stubCall(this, cti_op_profile_did_call);
+    stubCall.addArgument(currentInstruction[1].u.operand);
+    stubCall.call();
+    noProfiler.link(this);
+}
+
+#else // USE(JSVALUE32_64)
+
 #define RECORD_JUMP_TARGET(targetOffset) \
    do { m_labels[m_bytecodeIndex + (targetOffset)].used(); } while (false)
 
+void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* globalData, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk)
+{
+#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+    // (2) The second function provides fast property access for string length
+    Label stringLengthBegin = align();
+
+    // Check eax is a string
+    Jump string_failureCases1 = emitJumpIfNotJSCell(regT0);
+    Jump string_failureCases2 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr));
+
+    // Checks out okay! - get the length from the Ustring.
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSString, m_value) + OBJECT_OFFSETOF(UString, m_rep)), regT0);
+    load32(Address(regT0, OBJECT_OFFSETOF(UString::Rep, len)), regT0);
+
+    Jump string_failureCases3 = branch32(Above, regT0, Imm32(JSImmediate::maxImmediateInt));
+
+    // regT0 contains a 64 bit value (is positive, is zero extended) so we don't need sign extend here.
+    emitFastArithIntToImmNoCheck(regT0, regT0);
+    
+    ret();
+#endif
+
+    // (3) Trampolines for the slow cases of op_call / op_call_eval / op_construct.
+    COMPILE_ASSERT(sizeof(CodeType) == 4, CodeTypeEnumMustBe32Bit);
+
+    // VirtualCallLink Trampoline
+    // regT0 holds callee, regT1 holds argCount.  regT2 will hold the FunctionExecutable.
+    Label virtualCallLinkBegin = align();
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
+
+    Jump isNativeFunc2 = branch32(Equal, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), Imm32(0));
+
+    Jump hasCodeBlock2 = branch32(GreaterThan, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), Imm32(0));
+    preserveReturnAddressAfterCall(regT3);
+    restoreArgumentReference();
+    Call callJSFunction2 = call();
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
+    emitGetJITStubArg(2, regT1); // argCount
+    restoreReturnAddressBeforeReturn(regT3);
+    hasCodeBlock2.link(this);
+
+    // Check argCount matches callee arity.
+    Jump arityCheckOkay2 = branch32(Equal, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), regT1);
+    preserveReturnAddressAfterCall(regT3);
+    emitPutJITStubArg(regT3, 1); // return address
+    restoreArgumentReference();
+    Call callArityCheck2 = call();
+    move(regT1, callFrameRegister);
+    emitGetJITStubArg(2, regT1); // argCount
+    restoreReturnAddressBeforeReturn(regT3);
+    arityCheckOkay2.link(this);
+
+    isNativeFunc2.link(this);
+
+    compileOpCallInitializeCallFrame();
+    preserveReturnAddressAfterCall(regT3);
+    emitPutJITStubArg(regT3, 1); // return address
+    restoreArgumentReference();
+    Call callLazyLinkCall = call();
+    restoreReturnAddressBeforeReturn(regT3);
+    jump(regT0);
+
+    // VirtualCall Trampoline
+    // regT0 holds callee, regT1 holds argCount.  regT2 will hold the FunctionExecutable.
+    Label virtualCallBegin = align();
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
+
+    Jump isNativeFunc3 = branch32(Equal, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), Imm32(0));
+
+    Jump hasCodeBlock3 = branch32(GreaterThan, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), Imm32(0));
+    preserveReturnAddressAfterCall(regT3);
+    restoreArgumentReference();
+    Call callJSFunction1 = call();
+    emitGetJITStubArg(2, regT1); // argCount
+    restoreReturnAddressBeforeReturn(regT3);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
+    hasCodeBlock3.link(this);
+    
+    // Check argCount matches callee arity.
+    Jump arityCheckOkay3 = branch32(Equal, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), regT1);
+    preserveReturnAddressAfterCall(regT3);
+    emitPutJITStubArg(regT3, 1); // return address
+    restoreArgumentReference();
+    Call callArityCheck1 = call();
+    move(regT1, callFrameRegister);
+    emitGetJITStubArg(2, regT1); // argCount
+    restoreReturnAddressBeforeReturn(regT3);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
+    arityCheckOkay3.link(this);
+
+    isNativeFunc3.link(this);
+
+    compileOpCallInitializeCallFrame();
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_jitCode)), regT0);
+    jump(regT0);
+
+    Label nativeCallThunk = align();
+    preserveReturnAddressAfterCall(regT0);
+    emitPutToCallFrameHeader(regT0, RegisterFile::ReturnPC); // Push return address
+
+    // Load caller frame's scope chain into this callframe so that whatever we call can
+    // get to its global data.
+    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT1);
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT1);
+    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
+    
+
+#if PLATFORM(X86_64)
+    emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, X86Registers::ecx);
+
+    // Allocate stack space for our arglist
+    subPtr(Imm32(sizeof(ArgList)), stackPointerRegister);
+    COMPILE_ASSERT((sizeof(ArgList) & 0xf) == 0, ArgList_should_by_16byte_aligned);
+    
+    // Set up arguments
+    subPtr(Imm32(1), X86Registers::ecx); // Don't include 'this' in argcount
+
+    // Push argcount
+    storePtr(X86Registers::ecx, Address(stackPointerRegister, OBJECT_OFFSETOF(ArgList, m_argCount)));
+
+    // Calculate the start of the callframe header, and store in edx
+    addPtr(Imm32(-RegisterFile::CallFrameHeaderSize * (int32_t)sizeof(Register)), callFrameRegister, X86Registers::edx);
+    
+    // Calculate start of arguments as callframe header - sizeof(Register) * argcount (ecx)
+    mul32(Imm32(sizeof(Register)), X86Registers::ecx, X86Registers::ecx);
+    subPtr(X86Registers::ecx, X86Registers::edx);
+
+    // push pointer to arguments
+    storePtr(X86Registers::edx, Address(stackPointerRegister, OBJECT_OFFSETOF(ArgList, m_args)));
+    
+    // ArgList is passed by reference so is stackPointerRegister
+    move(stackPointerRegister, X86Registers::ecx);
+    
+    // edx currently points to the first argument, edx-sizeof(Register) points to 'this'
+    loadPtr(Address(X86Registers::edx, -(int32_t)sizeof(Register)), X86Registers::edx);
+    
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86Registers::esi);
+
+    move(callFrameRegister, X86Registers::edi); 
+
+    call(Address(X86Registers::esi, OBJECT_OFFSETOF(JSFunction, m_data)));
+    
+    addPtr(Imm32(sizeof(ArgList)), stackPointerRegister);
+#elif PLATFORM(X86)
+    emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
+
+    /* We have two structs that we use to describe the stackframe we set up for our
+     * call to native code.  NativeCallFrameStructure describes the how we set up the stack
+     * in advance of the call.  NativeFunctionCalleeSignature describes the callframe
+     * as the native code expects it.  We do this as we are using the fastcall calling
+     * convention which results in the callee popping its arguments off the stack, but
+     * not the rest of the callframe so we need a nice way to ensure we increment the
+     * stack pointer by the right amount after the call.
+     */
+#if COMPILER(MSVC) || PLATFORM(LINUX)
+    struct NativeCallFrameStructure {
+      //  CallFrame* callFrame; // passed in EDX
+        JSObject* callee;
+        JSValue thisValue;
+        ArgList* argPointer;
+        ArgList args;
+        JSValue result;
+    };
+    struct NativeFunctionCalleeSignature {
+        JSObject* callee;
+        JSValue thisValue;
+        ArgList* argPointer;
+    };
+#else
+    struct NativeCallFrameStructure {
+      //  CallFrame* callFrame; // passed in ECX
+      //  JSObject* callee; // passed in EDX
+        JSValue thisValue;
+        ArgList* argPointer;
+        ArgList args;
+    };
+    struct NativeFunctionCalleeSignature {
+        JSValue thisValue;
+        ArgList* argPointer;
+    };
+#endif
+    const int NativeCallFrameSize = (sizeof(NativeCallFrameStructure) + 15) & ~15;
+    // Allocate system stack frame
+    subPtr(Imm32(NativeCallFrameSize), stackPointerRegister);
+
+    // Set up arguments
+    subPtr(Imm32(1), regT0); // Don't include 'this' in argcount
+
+    // push argcount
+    storePtr(regT0, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, args) + OBJECT_OFFSETOF(ArgList, m_argCount)));
+    
+    // Calculate the start of the callframe header, and store in regT1
+    addPtr(Imm32(-RegisterFile::CallFrameHeaderSize * (int)sizeof(Register)), callFrameRegister, regT1);
+    
+    // Calculate start of arguments as callframe header - sizeof(Register) * argcount (regT0)
+    mul32(Imm32(sizeof(Register)), regT0, regT0);
+    subPtr(regT0, regT1);
+    storePtr(regT1, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, args) + OBJECT_OFFSETOF(ArgList, m_args)));
+
+    // ArgList is passed by reference so is stackPointerRegister + 4 * sizeof(Register)
+    addPtr(Imm32(OBJECT_OFFSETOF(NativeCallFrameStructure, args)), stackPointerRegister, regT0);
+    storePtr(regT0, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, argPointer)));
+
+    // regT1 currently points to the first argument, regT1 - sizeof(Register) points to 'this'
+    loadPtr(Address(regT1, -(int)sizeof(Register)), regT1);
+    storePtr(regT1, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, thisValue)));
+
+#if COMPILER(MSVC) || PLATFORM(LINUX)
+    // ArgList is passed by reference so is stackPointerRegister + 4 * sizeof(Register)
+    addPtr(Imm32(OBJECT_OFFSETOF(NativeCallFrameStructure, result)), stackPointerRegister, X86Registers::ecx);
+
+    // Plant callee
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86Registers::eax);
+    storePtr(X86Registers::eax, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, callee)));
+
+    // Plant callframe
+    move(callFrameRegister, X86Registers::edx);
+
+    call(Address(X86Registers::eax, OBJECT_OFFSETOF(JSFunction, m_data)));
+
+    // JSValue is a non-POD type
+    loadPtr(Address(X86Registers::eax), X86Registers::eax);
+#else
+    // Plant callee
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86Registers::edx);
+
+    // Plant callframe
+    move(callFrameRegister, X86Registers::ecx);
+    call(Address(X86Registers::edx, OBJECT_OFFSETOF(JSFunction, m_data)));
+#endif
+
+    // We've put a few temporaries on the stack in addition to the actual arguments
+    // so pull them off now
+    addPtr(Imm32(NativeCallFrameSize - sizeof(NativeFunctionCalleeSignature)), stackPointerRegister);
+
+#elif PLATFORM(ARM) && !PLATFORM_ARM_ARCH(7)
+    emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
+
+    // Allocate stack space for our arglist
+    COMPILE_ASSERT((sizeof(ArgList) & 0x7) == 0, ArgList_should_by_8byte_aligned);
+    subPtr(Imm32(sizeof(ArgList)), stackPointerRegister);
+
+    // Set up arguments
+    subPtr(Imm32(1), regT0); // Don't include 'this' in argcount
+
+    // Push argcount
+    storePtr(regT0, Address(stackPointerRegister, OBJECT_OFFSETOF(ArgList, m_argCount)));
+
+    // Calculate the start of the callframe header, and store in regT1
+    move(callFrameRegister, regT1);
+    sub32(Imm32(RegisterFile::CallFrameHeaderSize * (int32_t)sizeof(Register)), regT1);
+
+    // Calculate start of arguments as callframe header - sizeof(Register) * argcount (regT1)
+    mul32(Imm32(sizeof(Register)), regT0, regT0);
+    subPtr(regT0, regT1);
+
+    // push pointer to arguments
+    storePtr(regT1, Address(stackPointerRegister, OBJECT_OFFSETOF(ArgList, m_args)));
+
+    // Setup arg3: regT1 currently points to the first argument, regT1-sizeof(Register) points to 'this'
+    loadPtr(Address(regT1, -(int32_t)sizeof(Register)), regT2);
+
+    // Setup arg2:
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, regT1);
+
+    // Setup arg1:
+    move(callFrameRegister, regT0);
+
+    // Setup arg4: This is a plain hack
+    move(stackPointerRegister, ARMRegisters::S0);
+
+    move(ctiReturnRegister, ARMRegisters::lr);
+    call(Address(regT1, OBJECT_OFFSETOF(JSFunction, m_data)));
+
+    addPtr(Imm32(sizeof(ArgList)), stackPointerRegister);
+
+#elif ENABLE(JIT_OPTIMIZE_NATIVE_CALL)
+#error "JIT_OPTIMIZE_NATIVE_CALL not yet supported on this platform."
+#else
+    breakpoint();
+#endif
+
+    // Check for an exception
+    loadPtr(&(globalData->exception), regT2);
+    Jump exceptionHandler = branchTestPtr(NonZero, regT2);
+
+    // Grab the return address.
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
+    
+    // Restore our caller's "r".
+    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
+    
+    // Return.
+    restoreReturnAddressBeforeReturn(regT1);
+    ret();
+
+    // Handle an exception
+    exceptionHandler.link(this);
+    // Grab the return address.
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
+    move(ImmPtr(&globalData->exceptionLocation), regT2);
+    storePtr(regT1, regT2);
+    move(ImmPtr(reinterpret_cast<void*>(ctiVMThrowTrampoline)), regT2);
+    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
+    poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof (void*));
+    restoreReturnAddressBeforeReturn(regT2);
+    ret();
+    
+
+#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+    Call string_failureCases1Call = makeTailRecursiveCall(string_failureCases1);
+    Call string_failureCases2Call = makeTailRecursiveCall(string_failureCases2);
+    Call string_failureCases3Call = makeTailRecursiveCall(string_failureCases3);
+#endif
+
+    // All trampolines constructed! copy the code, link up calls, and set the pointers on the Machine object.
+    LinkBuffer patchBuffer(this, m_globalData->executableAllocator.poolForSize(m_assembler.size()));
+
+#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+    patchBuffer.link(string_failureCases1Call, FunctionPtr(cti_op_get_by_id_string_fail));
+    patchBuffer.link(string_failureCases2Call, FunctionPtr(cti_op_get_by_id_string_fail));
+    patchBuffer.link(string_failureCases3Call, FunctionPtr(cti_op_get_by_id_string_fail));
+#endif
+    patchBuffer.link(callArityCheck1, FunctionPtr(cti_op_call_arityCheck));
+    patchBuffer.link(callJSFunction1, FunctionPtr(cti_op_call_JSFunction));
+#if ENABLE(JIT_OPTIMIZE_CALL)
+    patchBuffer.link(callArityCheck2, FunctionPtr(cti_op_call_arityCheck));
+    patchBuffer.link(callJSFunction2, FunctionPtr(cti_op_call_JSFunction));
+    patchBuffer.link(callLazyLinkCall, FunctionPtr(cti_vm_lazyLinkCall));
+#endif
+
+    CodeRef finalCode = patchBuffer.finalizeCode();
+    *executablePool = finalCode.m_executablePool;
+
+    *ctiVirtualCallLink = trampolineAt(finalCode, virtualCallLinkBegin);
+    *ctiVirtualCall = trampolineAt(finalCode, virtualCallBegin);
+    *ctiNativeCallThunk = trampolineAt(finalCode, nativeCallThunk);
+#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+    *ctiStringLengthTrampoline = trampolineAt(finalCode, stringLengthBegin);
+#else
+    UNUSED_PARAM(ctiStringLengthTrampoline);
+#endif
+}
+
 void JIT::emit_op_mov(Instruction* currentInstruction)
 {
     int dst = currentInstruction[1].u.operand;
@@ -62,7 +1814,7 @@ void JIT::emit_op_mov(Instruction* currentInstruction)
 void JIT::emit_op_end(Instruction* currentInstruction)
 {
     if (m_codeBlock->needsFullScopeChain())
-        JITStubCall(this, JITStubs::cti_op_end).call();
+        JITStubCall(this, cti_op_end).call();
     ASSERT(returnValueRegister != callFrameRegister);
     emitGetVirtualRegister(currentInstruction[1].u.operand, returnValueRegister);
     restoreReturnAddressBeforeReturn(Address(callFrameRegister, RegisterFile::ReturnPC * static_cast<int>(sizeof(Register))));
@@ -94,7 +1846,7 @@ void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
     if (isOperandConstantImmediateInt(op2)) {
         emitGetVirtualRegister(op1, regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
         int32_t op2imm = getConstantOperandImmediateInt(op2);
 #else
         int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
@@ -103,7 +1855,7 @@ void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
     } else if (isOperandConstantImmediateInt(op1)) {
         emitGetVirtualRegister(op2, regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
         int32_t op1imm = getConstantOperandImmediateInt(op1);
 #else
         int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
@@ -127,7 +1879,7 @@ void JIT::emit_op_loop_if_lesseq(Instruction* currentInstruction)
     if (isOperandConstantImmediateInt(op2)) {
         emitGetVirtualRegister(op1, regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
         int32_t op2imm = getConstantOperandImmediateInt(op2);
 #else
         int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
@@ -143,7 +1895,7 @@ void JIT::emit_op_loop_if_lesseq(Instruction* currentInstruction)
 
 void JIT::emit_op_new_object(Instruction* currentInstruction)
 {
-    JITStubCall(this, JITStubs::cti_op_new_object).call(currentInstruction[1].u.operand);
+    JITStubCall(this, cti_op_new_object).call(currentInstruction[1].u.operand);
 }
 
 void JIT::emit_op_instanceof(Instruction* currentInstruction)
@@ -197,8 +1949,8 @@ void JIT::emit_op_instanceof(Instruction* currentInstruction)
 
 void JIT::emit_op_new_func(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, JITStubs::cti_op_new_func);
-    stubCall.addArgument(ImmPtr(m_codeBlock->function(currentInstruction[2].u.operand)));
+    JITStubCall stubCall(this, cti_op_new_func);
+    stubCall.addArgument(ImmPtr(m_codeBlock->functionDecl(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
@@ -214,9 +1966,14 @@ void JIT::emit_op_call_eval(Instruction* currentInstruction)
 
 void JIT::emit_op_load_varargs(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, JITStubs::cti_op_load_varargs);
-    stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
-    stubCall.call(currentInstruction[1].u.operand);
+    int argCountDst = currentInstruction[1].u.operand;
+    int argsOffset = currentInstruction[2].u.operand;
+
+    JITStubCall stubCall(this, cti_op_load_varargs);
+    stubCall.addArgument(Imm32(argsOffset));
+    stubCall.call();
+    // Stores a naked int32 in the register file.
+    store32(returnValueRegister, Address(callFrameRegister, argCountDst * sizeof(Register)));
 }
 
 void JIT::emit_op_call_varargs(Instruction* currentInstruction)
@@ -273,26 +2030,21 @@ void JIT::emit_op_put_scoped_var(Instruction* currentInstruction)
 
 void JIT::emit_op_tear_off_activation(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, JITStubs::cti_op_tear_off_activation);
+    JITStubCall stubCall(this, cti_op_tear_off_activation);
     stubCall.addArgument(currentInstruction[1].u.operand, regT2);
     stubCall.call();
 }
 
 void JIT::emit_op_tear_off_arguments(Instruction*)
 {
-    JITStubCall(this, JITStubs::cti_op_tear_off_arguments).call();
+    JITStubCall(this, cti_op_tear_off_arguments).call();
 }
 
 void JIT::emit_op_ret(Instruction* currentInstruction)
 {
-#ifdef QT_BUILD_SCRIPT_LIB
-    JITStubCall stubCall(this, JITStubs::cti_op_debug_return);
-    stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
-    stubCall.call();
-#endif
     // We could JIT generate the deref, only calling out to C when the refcount hits zero.
     if (m_codeBlock->needsFullScopeChain())
-        JITStubCall(this, JITStubs::cti_op_ret_scopeChain).call();
+        JITStubCall(this, cti_op_ret_scopeChain).call();
 
     ASSERT(callFrameRegister != regT1);
     ASSERT(regT1 != returnValueRegister);
@@ -314,7 +2066,7 @@ void JIT::emit_op_ret(Instruction* currentInstruction)
 
 void JIT::emit_op_new_array(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, JITStubs::cti_op_new_array);
+    JITStubCall stubCall(this, cti_op_new_array);
     stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
     stubCall.addArgument(Imm32(currentInstruction[3].u.operand));
     stubCall.call(currentInstruction[1].u.operand);
@@ -322,7 +2074,7 @@ void JIT::emit_op_new_array(Instruction* currentInstruction)
 
 void JIT::emit_op_resolve(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, JITStubs::cti_op_resolve);
+    JITStubCall stubCall(this, cti_op_resolve);
     stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
@@ -355,20 +2107,12 @@ void JIT::emit_op_to_primitive(Instruction* currentInstruction)
 
 void JIT::emit_op_strcat(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, JITStubs::cti_op_strcat);
+    JITStubCall stubCall(this, cti_op_strcat);
     stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
     stubCall.addArgument(Imm32(currentInstruction[3].u.operand));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
-void JIT::emit_op_resolve_func(Instruction* currentInstruction)
-{
-    JITStubCall stubCall(this, JITStubs::cti_op_resolve_func);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[3].u.operand)));
-    stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
-    stubCall.call(currentInstruction[2].u.operand);
-}
-
 void JIT::emit_op_loop_if_true(Instruction* currentInstruction)
 {
     emitTimeoutCheck();
@@ -386,14 +2130,14 @@ void JIT::emit_op_loop_if_true(Instruction* currentInstruction)
 };
 void JIT::emit_op_resolve_base(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, JITStubs::cti_op_resolve_base);
+    JITStubCall stubCall(this, cti_op_resolve_base);
     stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
 void JIT::emit_op_resolve_skip(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, JITStubs::cti_op_resolve_skip);
+    JITStubCall stubCall(this, cti_op_resolve_skip);
     stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.addArgument(Imm32(currentInstruction[3].u.operand + m_codeBlock->needsFullScopeChain()));
     stubCall.call(currentInstruction[1].u.operand);
@@ -424,7 +2168,7 @@ void JIT::emit_op_resolve_global(Instruction* currentInstruction)
 
     // Slow case
     noMatch.link(this);
-    JITStubCall stubCall(this, JITStubs::cti_op_resolve_global);
+    JITStubCall stubCall(this, cti_op_resolve_global);
     stubCall.addArgument(ImmPtr(globalObject));
     stubCall.addArgument(ImmPtr(ident));
     stubCall.addArgument(Imm32(currentIndex));
@@ -540,7 +2284,7 @@ void JIT::emit_op_bitnot(Instruction* currentInstruction)
 {
     emitGetVirtualRegister(currentInstruction[2].u.operand, regT0);
     emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
     not32(regT0);
     emitFastArithIntToImmNoCheck(regT0, regT0);
 #else
@@ -551,7 +2295,7 @@ void JIT::emit_op_bitnot(Instruction* currentInstruction)
 
 void JIT::emit_op_resolve_with_base(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, JITStubs::cti_op_resolve_with_base);
+    JITStubCall stubCall(this, cti_op_resolve_with_base);
     stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[3].u.operand)));
     stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
     stubCall.call(currentInstruction[2].u.operand);
@@ -559,8 +2303,8 @@ void JIT::emit_op_resolve_with_base(Instruction* currentInstruction)
 
 void JIT::emit_op_new_func_exp(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, JITStubs::cti_op_new_func_exp);
-    stubCall.addArgument(ImmPtr(m_codeBlock->functionExpression(currentInstruction[2].u.operand)));
+    JITStubCall stubCall(this, cti_op_new_func_exp);
+    stubCall.addArgument(ImmPtr(m_codeBlock->functionExpr(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
@@ -601,7 +2345,7 @@ void JIT::emit_op_bitxor(Instruction* currentInstruction)
 
 void JIT::emit_op_new_regexp(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, JITStubs::cti_op_new_regexp);
+    JITStubCall stubCall(this, cti_op_new_regexp);
     stubCall.addArgument(ImmPtr(m_codeBlock->regexp(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
@@ -616,7 +2360,7 @@ void JIT::emit_op_bitor(Instruction* currentInstruction)
 
 void JIT::emit_op_throw(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, JITStubs::cti_op_throw);
+    JITStubCall stubCall(this, cti_op_throw);
     stubCall.addArgument(currentInstruction[1].u.operand, regT2);
     stubCall.call();
     ASSERT(regT0 == returnValueRegister);
@@ -629,7 +2373,7 @@ void JIT::emit_op_throw(Instruction* currentInstruction)
 
 void JIT::emit_op_next_pname(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, JITStubs::cti_op_next_pname);
+    JITStubCall stubCall(this, cti_op_next_pname);
     stubCall.addArgument(currentInstruction[2].u.operand, regT2);
     stubCall.call();
     Jump endOfIter = branchTestPtr(Zero, regT0);
@@ -640,14 +2384,37 @@ void JIT::emit_op_next_pname(Instruction* currentInstruction)
 
 void JIT::emit_op_push_scope(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, JITStubs::cti_op_push_scope);
+    JITStubCall stubCall(this, cti_op_push_scope);
     stubCall.addArgument(currentInstruction[1].u.operand, regT2);
     stubCall.call(currentInstruction[1].u.operand);
 }
 
 void JIT::emit_op_pop_scope(Instruction*)
 {
-    JITStubCall(this, JITStubs::cti_op_pop_scope).call();
+    JITStubCall(this, cti_op_pop_scope).call();
+}
+
+void JIT::compileOpStrictEq(Instruction* currentInstruction, CompileOpStrictEqType type)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned src1 = currentInstruction[2].u.operand;
+    unsigned src2 = currentInstruction[3].u.operand;
+
+    emitGetVirtualRegisters(src1, regT0, src2, regT1);
+
+    // Jump to a slow case if either operand is a number, or if both are JSCell*s.
+    move(regT0, regT2);
+    orPtr(regT1, regT2);
+    addSlowCase(emitJumpIfJSCell(regT2));
+    addSlowCase(emitJumpIfImmediateNumber(regT2));
+
+    if (type == OpStrictEq)
+        set32(Equal, regT1, regT0, regT0);
+    else
+        set32(NotEqual, regT1, regT0, regT0);
+    emitTagAsBoolImmediate(regT0);
+
+    emitPutVirtualRegister(dst);
 }
 
 void JIT::emit_op_stricteq(Instruction* currentInstruction)
@@ -678,7 +2445,7 @@ void JIT::emit_op_to_jsnumber(Instruction* currentInstruction)
 
 void JIT::emit_op_push_new_scope(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, JITStubs::cti_op_push_new_scope);
+    JITStubCall stubCall(this, cti_op_push_new_scope);
     stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.addArgument(currentInstruction[3].u.operand, regT2);
     stubCall.call(currentInstruction[1].u.operand);
@@ -689,16 +2456,11 @@ void JIT::emit_op_catch(Instruction* currentInstruction)
     killLastResultRegister(); // FIXME: Implicitly treat op_catch as a labeled statement, and remove this line of code.
     peek(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof (void*));
     emitPutVirtualRegister(currentInstruction[1].u.operand);
-#ifdef QT_BUILD_SCRIPT_LIB
-    JITStubCall stubCall(this, JITStubs::cti_op_debug_catch);
-    stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
-    stubCall.call();
-#endif
 }
 
 void JIT::emit_op_jmp_scopes(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, JITStubs::cti_op_jmp_scopes);
+    JITStubCall stubCall(this, cti_op_jmp_scopes);
     stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
     stubCall.call();
     addJump(jump(), currentInstruction[2].u.operand + 2);
@@ -716,7 +2478,7 @@ void JIT::emit_op_switch_imm(Instruction* currentInstruction)
     m_switches.append(SwitchRecord(jumpTable, m_bytecodeIndex, defaultOffset, SwitchRecord::Immediate));
     jumpTable->ctiOffsets.grow(jumpTable->branchOffsets.size());
 
-    JITStubCall stubCall(this, JITStubs::cti_op_switch_imm);
+    JITStubCall stubCall(this, cti_op_switch_imm);
     stubCall.addArgument(scrutinee, regT2);
     stubCall.addArgument(Imm32(tableIndex));
     stubCall.call();
@@ -734,7 +2496,7 @@ void JIT::emit_op_switch_char(Instruction* currentInstruction)
     m_switches.append(SwitchRecord(jumpTable, m_bytecodeIndex, defaultOffset, SwitchRecord::Character));
     jumpTable->ctiOffsets.grow(jumpTable->branchOffsets.size());
 
-    JITStubCall stubCall(this, JITStubs::cti_op_switch_char);
+    JITStubCall stubCall(this, cti_op_switch_char);
     stubCall.addArgument(scrutinee, regT2);
     stubCall.addArgument(Imm32(tableIndex));
     stubCall.call();
@@ -751,7 +2513,7 @@ void JIT::emit_op_switch_string(Instruction* currentInstruction)
     StringJumpTable* jumpTable = &m_codeBlock->stringSwitchJumpTable(tableIndex);
     m_switches.append(SwitchRecord(jumpTable, m_bytecodeIndex, defaultOffset));
 
-    JITStubCall stubCall(this, JITStubs::cti_op_switch_string);
+    JITStubCall stubCall(this, cti_op_switch_string);
     stubCall.addArgument(scrutinee, regT2);
     stubCall.addArgument(Imm32(tableIndex));
     stubCall.call();
@@ -760,7 +2522,7 @@ void JIT::emit_op_switch_string(Instruction* currentInstruction)
 
 void JIT::emit_op_new_error(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, JITStubs::cti_op_new_error);
+    JITStubCall stubCall(this, cti_op_new_error);
     stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
     stubCall.addArgument(ImmPtr(JSValue::encode(m_codeBlock->getConstant(currentInstruction[3].u.operand))));
     stubCall.addArgument(Imm32(m_bytecodeIndex));
@@ -769,11 +2531,10 @@ void JIT::emit_op_new_error(Instruction* currentInstruction)
 
 void JIT::emit_op_debug(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, JITStubs::cti_op_debug);
+    JITStubCall stubCall(this, cti_op_debug);
     stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
     stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
     stubCall.addArgument(Imm32(currentInstruction[3].u.operand));
-    stubCall.addArgument(Imm32(currentInstruction[4].u.operand));
     stubCall.call();
 }
 
@@ -847,16 +2608,16 @@ void JIT::emit_op_enter_with_activation(Instruction* currentInstruction)
     for (size_t j = 0; j < count; ++j)
         emitInitRegister(j);
 
-    JITStubCall(this, JITStubs::cti_op_push_activation).call(currentInstruction[1].u.operand);
+    JITStubCall(this, cti_op_push_activation).call(currentInstruction[1].u.operand);
 }
 
 void JIT::emit_op_create_arguments(Instruction*)
 {
     Jump argsCreated = branchTestPtr(NonZero, Address(callFrameRegister, sizeof(Register) * RegisterFile::ArgumentsRegister));
     if (m_codeBlock->m_numParameters == 1)
-        JITStubCall(this, JITStubs::cti_op_create_arguments_no_params).call();
+        JITStubCall(this, cti_op_create_arguments_no_params).call();
     else
-        JITStubCall(this, JITStubs::cti_op_create_arguments).call();
+        JITStubCall(this, cti_op_create_arguments).call();
     argsCreated.link(this);
 }
     
@@ -880,7 +2641,7 @@ void JIT::emit_op_profile_will_call(Instruction* currentInstruction)
     peek(regT1, OBJECT_OFFSETOF(JITStackFrame, enabledProfilerReference) / sizeof (void*));
     Jump noProfiler = branchTestPtr(Zero, Address(regT1));
 
-    JITStubCall stubCall(this, JITStubs::cti_op_profile_will_call);
+    JITStubCall stubCall(this, cti_op_profile_will_call);
     stubCall.addArgument(currentInstruction[1].u.operand, regT1);
     stubCall.call();
     noProfiler.link(this);
@@ -892,7 +2653,7 @@ void JIT::emit_op_profile_did_call(Instruction* currentInstruction)
     peek(regT1, OBJECT_OFFSETOF(JITStackFrame, enabledProfilerReference) / sizeof (void*));
     Jump noProfiler = branchTestPtr(Zero, Address(regT1));
 
-    JITStubCall stubCall(this, JITStubs::cti_op_profile_did_call);
+    JITStubCall stubCall(this, cti_op_profile_did_call);
     stubCall.addArgument(currentInstruction[1].u.operand, regT1);
     stubCall.call();
     noProfiler.link(this);
@@ -905,7 +2666,7 @@ void JIT::emitSlow_op_convert_this(Instruction* currentInstruction, Vector<SlowC
 {
     linkSlowCase(iter);
     linkSlowCase(iter);
-    JITStubCall stubCall(this, JITStubs::cti_op_convert_this);
+    JITStubCall stubCall(this, cti_op_convert_this);
     stubCall.addArgument(regT0);
     stubCall.call(currentInstruction[1].u.operand);
 }
@@ -922,7 +2683,7 @@ void JIT::emitSlow_op_to_primitive(Instruction* currentInstruction, Vector<SlowC
 {
     linkSlowCase(iter);
 
-    JITStubCall stubCall(this, JITStubs::cti_op_to_primitive);
+    JITStubCall stubCall(this, cti_op_to_primitive);
     stubCall.addArgument(regT0);
     stubCall.call(currentInstruction[1].u.operand);
 }
@@ -938,7 +2699,7 @@ void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCas
     emitFastArithIntToImmNoCheck(regT1, regT1);
 
     notImm.link(this);
-    JITStubCall stubCall(this, JITStubs::cti_op_get_by_val);
+    JITStubCall stubCall(this, cti_op_get_by_val);
     stubCall.addArgument(regT0);
     stubCall.addArgument(regT1);
     stubCall.call(currentInstruction[1].u.operand);
@@ -964,14 +2725,14 @@ void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowC
     unsigned target = currentInstruction[3].u.operand;
     if (isOperandConstantImmediateInt(op2)) {
         linkSlowCase(iter);
-        JITStubCall stubCall(this, JITStubs::cti_op_loop_if_less);
+        JITStubCall stubCall(this, cti_op_loop_if_less);
         stubCall.addArgument(regT0);
         stubCall.addArgument(op2, regT2);
         stubCall.call();
         emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
     } else if (isOperandConstantImmediateInt(op1)) {
         linkSlowCase(iter);
-        JITStubCall stubCall(this, JITStubs::cti_op_loop_if_less);
+        JITStubCall stubCall(this, cti_op_loop_if_less);
         stubCall.addArgument(op1, regT2);
         stubCall.addArgument(regT0);
         stubCall.call();
@@ -979,7 +2740,7 @@ void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowC
     } else {
         linkSlowCase(iter);
         linkSlowCase(iter);
-        JITStubCall stubCall(this, JITStubs::cti_op_loop_if_less);
+        JITStubCall stubCall(this, cti_op_loop_if_less);
         stubCall.addArgument(regT0);
         stubCall.addArgument(regT1);
         stubCall.call();
@@ -993,7 +2754,7 @@ void JIT::emitSlow_op_loop_if_lesseq(Instruction* currentInstruction, Vector<Slo
     unsigned target = currentInstruction[3].u.operand;
     if (isOperandConstantImmediateInt(op2)) {
         linkSlowCase(iter);
-        JITStubCall stubCall(this, JITStubs::cti_op_loop_if_lesseq);
+        JITStubCall stubCall(this, cti_op_loop_if_lesseq);
         stubCall.addArgument(regT0);
         stubCall.addArgument(currentInstruction[2].u.operand, regT2);
         stubCall.call();
@@ -1001,7 +2762,7 @@ void JIT::emitSlow_op_loop_if_lesseq(Instruction* currentInstruction, Vector<Slo
     } else {
         linkSlowCase(iter);
         linkSlowCase(iter);
-        JITStubCall stubCall(this, JITStubs::cti_op_loop_if_lesseq);
+        JITStubCall stubCall(this, cti_op_loop_if_lesseq);
         stubCall.addArgument(regT0);
         stubCall.addArgument(regT1);
         stubCall.call();
@@ -1018,7 +2779,7 @@ void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCas
     emitFastArithIntToImmNoCheck(regT1, regT1);
 
     notImm.link(this); {
-        JITStubCall stubCall(this, JITStubs::cti_op_put_by_val);
+        JITStubCall stubCall(this, cti_op_put_by_val);
         stubCall.addArgument(regT0);
         stubCall.addArgument(regT1);
         stubCall.addArgument(currentInstruction[3].u.operand, regT2);
@@ -1029,7 +2790,7 @@ void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCas
     // slow cases for immediate int accesses to arrays
     linkSlowCase(iter);
     linkSlowCase(iter); {
-        JITStubCall stubCall(this, JITStubs::cti_op_put_by_val_array);
+        JITStubCall stubCall(this, cti_op_put_by_val_array);
         stubCall.addArgument(regT0);
         stubCall.addArgument(regT1);
         stubCall.addArgument(currentInstruction[3].u.operand, regT2);
@@ -1040,7 +2801,7 @@ void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCas
 void JIT::emitSlow_op_loop_if_true(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
     linkSlowCase(iter);
-    JITStubCall stubCall(this, JITStubs::cti_op_jtrue);
+    JITStubCall stubCall(this, cti_op_jtrue);
     stubCall.addArgument(regT0);
     stubCall.call();
     emitJumpSlowToHot(branchTest32(NonZero, regT0), currentInstruction[2].u.operand + 2);
@@ -1050,7 +2811,7 @@ void JIT::emitSlow_op_not(Instruction* currentInstruction, Vector<SlowCaseEntry>
 {
     linkSlowCase(iter);
     xorPtr(Imm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool)), regT0);
-    JITStubCall stubCall(this, JITStubs::cti_op_not);
+    JITStubCall stubCall(this, cti_op_not);
     stubCall.addArgument(regT0);
     stubCall.call(currentInstruction[1].u.operand);
 }
@@ -1058,7 +2819,7 @@ void JIT::emitSlow_op_not(Instruction* currentInstruction, Vector<SlowCaseEntry>
 void JIT::emitSlow_op_jfalse(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
     linkSlowCase(iter);
-    JITStubCall stubCall(this, JITStubs::cti_op_jtrue);
+    JITStubCall stubCall(this, cti_op_jtrue);
     stubCall.addArgument(regT0);
     stubCall.call();
     emitJumpSlowToHot(branchTest32(Zero, regT0), currentInstruction[2].u.operand + 2); // inverted!
@@ -1067,7 +2828,7 @@ void JIT::emitSlow_op_jfalse(Instruction* currentInstruction, Vector<SlowCaseEnt
 void JIT::emitSlow_op_bitnot(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
     linkSlowCase(iter);
-    JITStubCall stubCall(this, JITStubs::cti_op_bitnot);
+    JITStubCall stubCall(this, cti_op_bitnot);
     stubCall.addArgument(regT0);
     stubCall.call(currentInstruction[1].u.operand);
 }
@@ -1075,7 +2836,7 @@ void JIT::emitSlow_op_bitnot(Instruction* currentInstruction, Vector<SlowCaseEnt
 void JIT::emitSlow_op_jtrue(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
     linkSlowCase(iter);
-    JITStubCall stubCall(this, JITStubs::cti_op_jtrue);
+    JITStubCall stubCall(this, cti_op_jtrue);
     stubCall.addArgument(regT0);
     stubCall.call();
     emitJumpSlowToHot(branchTest32(NonZero, regT0), currentInstruction[2].u.operand + 2);
@@ -1084,7 +2845,7 @@ void JIT::emitSlow_op_jtrue(Instruction* currentInstruction, Vector<SlowCaseEntr
 void JIT::emitSlow_op_bitxor(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
     linkSlowCase(iter);
-    JITStubCall stubCall(this, JITStubs::cti_op_bitxor);
+    JITStubCall stubCall(this, cti_op_bitxor);
     stubCall.addArgument(regT0);
     stubCall.addArgument(regT1);
     stubCall.call(currentInstruction[1].u.operand);
@@ -1093,7 +2854,7 @@ void JIT::emitSlow_op_bitxor(Instruction* currentInstruction, Vector<SlowCaseEnt
 void JIT::emitSlow_op_bitor(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
     linkSlowCase(iter);
-    JITStubCall stubCall(this, JITStubs::cti_op_bitor);
+    JITStubCall stubCall(this, cti_op_bitor);
     stubCall.addArgument(regT0);
     stubCall.addArgument(regT1);
     stubCall.call(currentInstruction[1].u.operand);
@@ -1102,26 +2863,31 @@ void JIT::emitSlow_op_bitor(Instruction* currentInstruction, Vector<SlowCaseEntr
 void JIT::emitSlow_op_eq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
     linkSlowCase(iter);
-    JITStubCall stubCall(this, JITStubs::cti_op_eq);
+    JITStubCall stubCall(this, cti_op_eq);
     stubCall.addArgument(regT0);
     stubCall.addArgument(regT1);
-    stubCall.call(currentInstruction[1].u.operand);
+    stubCall.call();
+    emitTagAsBoolImmediate(regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
 }
 
 void JIT::emitSlow_op_neq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
     linkSlowCase(iter);
-    JITStubCall stubCall(this, JITStubs::cti_op_neq);
+    JITStubCall stubCall(this, cti_op_eq);
     stubCall.addArgument(regT0);
     stubCall.addArgument(regT1);
-    stubCall.call(currentInstruction[1].u.operand);
+    stubCall.call();
+    xor32(Imm32(0x1), regT0);
+    emitTagAsBoolImmediate(regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
 }
 
 void JIT::emitSlow_op_stricteq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
     linkSlowCase(iter);
     linkSlowCase(iter);
-    JITStubCall stubCall(this, JITStubs::cti_op_stricteq);
+    JITStubCall stubCall(this, cti_op_stricteq);
     stubCall.addArgument(regT0);
     stubCall.addArgument(regT1);
     stubCall.call(currentInstruction[1].u.operand);
@@ -1131,7 +2897,7 @@ void JIT::emitSlow_op_nstricteq(Instruction* currentInstruction, Vector<SlowCase
 {
     linkSlowCase(iter);
     linkSlowCase(iter);
-    JITStubCall stubCall(this, JITStubs::cti_op_nstricteq);
+    JITStubCall stubCall(this, cti_op_nstricteq);
     stubCall.addArgument(regT0);
     stubCall.addArgument(regT1);
     stubCall.call(currentInstruction[1].u.operand);
@@ -1144,7 +2910,7 @@ void JIT::emitSlow_op_instanceof(Instruction* currentInstruction, Vector<SlowCas
     linkSlowCase(iter);
     linkSlowCase(iter);
     linkSlowCase(iter);
-    JITStubCall stubCall(this, JITStubs::cti_op_instanceof);
+    JITStubCall stubCall(this, cti_op_instanceof);
     stubCall.addArgument(currentInstruction[2].u.operand, regT2);
     stubCall.addArgument(currentInstruction[3].u.operand, regT2);
     stubCall.addArgument(currentInstruction[4].u.operand, regT2);
@@ -1176,11 +2942,12 @@ void JIT::emitSlow_op_to_jsnumber(Instruction* currentInstruction, Vector<SlowCa
     linkSlowCaseIfNotJSCell(iter, currentInstruction[2].u.operand);
     linkSlowCase(iter);
 
-    JITStubCall stubCall(this, JITStubs::cti_op_to_jsnumber);
+    JITStubCall stubCall(this, cti_op_to_jsnumber);
     stubCall.addArgument(regT0);
     stubCall.call(currentInstruction[1].u.operand);
 }
 
+#endif // USE(JSVALUE32_64)
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp
index c1e5c29..08b3096 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -47,11 +47,920 @@ using namespace std;
 
 namespace JSC {
 
+#if USE(JSVALUE32_64)
+
+void JIT::emit_op_put_by_index(Instruction* currentInstruction)
+{
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned value = currentInstruction[3].u.operand;
+
+    JITStubCall stubCall(this, cti_op_put_by_index);
+    stubCall.addArgument(base);
+    stubCall.addArgument(Imm32(property));
+    stubCall.addArgument(value);
+    stubCall.call();
+}
+
+void JIT::emit_op_put_getter(Instruction* currentInstruction)
+{
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned function = currentInstruction[3].u.operand;
+
+    JITStubCall stubCall(this, cti_op_put_getter);
+    stubCall.addArgument(base);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
+    stubCall.addArgument(function);
+    stubCall.call();
+}
+
+void JIT::emit_op_put_setter(Instruction* currentInstruction)
+{
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned function = currentInstruction[3].u.operand;
+
+    JITStubCall stubCall(this, cti_op_put_setter);
+    stubCall.addArgument(base);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
+    stubCall.addArgument(function);
+    stubCall.call();
+}
+
+void JIT::emit_op_del_by_id(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+
+    JITStubCall stubCall(this, cti_op_del_by_id);
+    stubCall.addArgument(base);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
+    stubCall.call(dst);
+}
+
+
+#if !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+
+/* ------------------------------ BEGIN: !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
+
+// Treat these as nops - the call will be handed as a regular get_by_id/op_call pair.
+void JIT::emit_op_method_check(Instruction*) {}
+void JIT::emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&) { ASSERT_NOT_REACHED(); }
+#if ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
+#error "JIT_OPTIMIZE_METHOD_CALLS requires JIT_OPTIMIZE_PROPERTY_ACCESS"
+#endif
+
+void JIT::emit_op_get_by_val(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+
+    JITStubCall stubCall(this, cti_op_get_by_val);
+    stubCall.addArgument(base);
+    stubCall.addArgument(property);
+    stubCall.call(dst);
+}
+
+void JIT::emitSlow_op_get_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&)
+{
+    ASSERT_NOT_REACHED();
+}
+
+void JIT::emit_op_put_by_val(Instruction* currentInstruction)
+{
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned value = currentInstruction[3].u.operand;
+
+    JITStubCall stubCall(this, cti_op_put_by_val);
+    stubCall.addArgument(base);
+    stubCall.addArgument(property);
+    stubCall.addArgument(value);
+    stubCall.call();
+}
+
+void JIT::emitSlow_op_put_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&)
+{
+    ASSERT_NOT_REACHED();
+}
+
+void JIT::emit_op_get_by_id(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int ident = currentInstruction[3].u.operand;
+
+    JITStubCall stubCall(this, cti_op_get_by_id_generic);
+    stubCall.addArgument(base);
+    stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
+    stubCall.call(dst);
+
+    m_propertyAccessInstructionIndex++;
+}
+
+void JIT::emitSlow_op_get_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&)
+{
+    m_propertyAccessInstructionIndex++;
+    ASSERT_NOT_REACHED();
+}
+
+void JIT::emit_op_put_by_id(Instruction* currentInstruction)
+{
+    int base = currentInstruction[1].u.operand;
+    int ident = currentInstruction[2].u.operand;
+    int value = currentInstruction[3].u.operand;
+
+    JITStubCall stubCall(this, cti_op_put_by_id_generic);
+    stubCall.addArgument(base);
+    stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
+    stubCall.addArgument(value);
+    stubCall.call();
+
+    m_propertyAccessInstructionIndex++;
+}
+
+void JIT::emitSlow_op_put_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&)
+{
+    m_propertyAccessInstructionIndex++;
+    ASSERT_NOT_REACHED();
+}
+
+#else // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+
+/* ------------------------------ BEGIN: ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
+
+#if ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
+
+void JIT::emit_op_method_check(Instruction* currentInstruction)
+{
+    // Assert that the following instruction is a get_by_id.
+    ASSERT(m_interpreter->getOpcodeID((currentInstruction + OPCODE_LENGTH(op_method_check))->u.opcode) == op_get_by_id);
+
+    currentInstruction += OPCODE_LENGTH(op_method_check);
+
+    // Do the method check - check the object & its prototype's structure inline (this is the common case).
+    m_methodCallCompilationInfo.append(MethodCallCompilationInfo(m_propertyAccessInstructionIndex));
+    MethodCallCompilationInfo& info = m_methodCallCompilationInfo.last();
+
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+
+    emitLoad(base, regT1, regT0);
+    emitJumpSlowCaseIfNotJSCell(base, regT1);
+
+    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), info.structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+    DataLabelPtr protoStructureToCompare, protoObj = moveWithPatch(ImmPtr(0), regT2);
+    Jump protoStructureCheck = branchPtrWithPatch(NotEqual, Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), protoStructureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+
+    // This will be relinked to load the function without doing a load.
+    DataLabelPtr putFunction = moveWithPatch(ImmPtr(0), regT0);
+    move(Imm32(JSValue::CellTag), regT1);
+    Jump match = jump();
+
+    ASSERT(differenceBetween(info.structureToCompare, protoObj) == patchOffsetMethodCheckProtoObj);
+    ASSERT(differenceBetween(info.structureToCompare, protoStructureToCompare) == patchOffsetMethodCheckProtoStruct);
+    ASSERT(differenceBetween(info.structureToCompare, putFunction) == patchOffsetMethodCheckPutFunction);
+
+    // Link the failure cases here.
+    structureCheck.link(this);
+    protoStructureCheck.link(this);
+
+    // Do a regular(ish) get_by_id (the slow case will be link to
+    // cti_op_get_by_id_method_check instead of cti_op_get_by_id.
+    compileGetByIdHotPath();
+
+    match.link(this);
+    emitStore(dst, regT1, regT0);
+    map(m_bytecodeIndex + OPCODE_LENGTH(op_method_check), dst, regT1, regT0);
+
+    // We've already generated the following get_by_id, so make sure it's skipped over.
+    m_bytecodeIndex += OPCODE_LENGTH(op_get_by_id);
+}
+
+void JIT::emitSlow_op_method_check(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    currentInstruction += OPCODE_LENGTH(op_method_check);
+
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int ident = currentInstruction[3].u.operand;
+
+    compileGetByIdSlowCase(dst, base, &(m_codeBlock->identifier(ident)), iter, true);
+
+    // We've already generated the following get_by_id, so make sure it's skipped over.
+    m_bytecodeIndex += OPCODE_LENGTH(op_get_by_id);
+}
+
+#else //!ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
+
+// Treat these as nops - the call will be handed as a regular get_by_id/op_call pair.
+void JIT::emit_op_method_check(Instruction*) {}
+void JIT::emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&) { ASSERT_NOT_REACHED(); }
+
+#endif
+
+void JIT::emit_op_get_by_val(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+    
+    emitLoad2(base, regT1, regT0, property, regT3, regT2);
+
+    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    emitJumpSlowCaseIfNotJSCell(base, regT1);
+    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
+    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_fastAccessCutoff))));
+
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT0);
+    load32(BaseIndex(regT0, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), regT1); // tag
+    load32(BaseIndex(regT0, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT0); // payload
+    emitStore(dst, regT1, regT0);
+    map(m_bytecodeIndex + OPCODE_LENGTH(op_get_by_val), dst, regT1, regT0);
+}
+
+void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+
+    // The slow void JIT::emitSlow_that handles accesses to arrays (below) may jump back up to here. 
+    Label callGetByValJITStub(this);
+
+    linkSlowCase(iter); // property int32 check
+    linkSlowCaseIfNotJSCell(iter, base); // base cell check
+    linkSlowCase(iter); // base array check
+
+    JITStubCall stubCall(this, cti_op_get_by_val);
+    stubCall.addArgument(base);
+    stubCall.addArgument(property);
+    stubCall.call(dst);
+
+    emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_get_by_val));
+
+    linkSlowCase(iter); // array fast cut-off check
+
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT0);
+    branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(ArrayStorage, m_vectorLength)), callGetByValJITStub);
+
+    // Missed the fast region, but it is still in the vector.
+    load32(BaseIndex(regT0, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), regT1); // tag
+    load32(BaseIndex(regT0, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT0); // payload
+
+    // FIXME: Maybe we can optimize this comparison to JSValue().
+    Jump skip = branch32(NotEqual, regT0, Imm32(0));
+    branch32(Equal, regT1, Imm32(JSValue::CellTag), callGetByValJITStub);
+
+    skip.link(this);
+    emitStore(dst, regT1, regT0);
+}
+
+void JIT::emit_op_put_by_val(Instruction* currentInstruction)
+{
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned value = currentInstruction[3].u.operand;
+
+    emitLoad2(base, regT1, regT0, property, regT3, regT2);
+
+    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    emitJumpSlowCaseIfNotJSCell(base, regT1);
+    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
+
+    Jump inFastVector = branch32(Below, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_fastAccessCutoff)));
+
+    // Check if the access is within the vector.
+    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_vectorLength))));
+
+    // This is a write to the slow part of the vector; first, we have to check if this would be the first write to this location.
+    // FIXME: should be able to handle initial write to array; increment the the number of items in the array, and potentially update fast access cutoff. 
+    Jump skip = branch32(NotEqual, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), Imm32(JSValue::CellTag));
+    addSlowCase(branch32(Equal, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), Imm32(0)));
+    skip.link(this);
+
+    inFastVector.link(this);
+
+    emitLoad(value, regT1, regT0);
+    store32(regT0, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]))); // payload
+    store32(regT1, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4)); // tag
+}
+
+void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned value = currentInstruction[3].u.operand;
+
+    linkSlowCase(iter); // property int32 check
+    linkSlowCaseIfNotJSCell(iter, base); // base cell check
+    linkSlowCase(iter); // base not array check
+
+    JITStubCall stubPutByValCall(this, cti_op_put_by_val);
+    stubPutByValCall.addArgument(base);
+    stubPutByValCall.addArgument(property);
+    stubPutByValCall.addArgument(value);
+    stubPutByValCall.call();
+
+    emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_get_by_val));
+
+    // Slow cases for immediate int accesses to arrays.
+    linkSlowCase(iter); // in vector check
+    linkSlowCase(iter); // written to slot check
+
+    JITStubCall stubCall(this, cti_op_put_by_val_array);
+    stubCall.addArgument(regT1, regT0);
+    stubCall.addArgument(regT2);
+    stubCall.addArgument(value);
+    stubCall.call();
+}
+
+void JIT::emit_op_get_by_id(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    
+    emitLoad(base, regT1, regT0);
+    emitJumpSlowCaseIfNotJSCell(base, regT1);
+    compileGetByIdHotPath();
+    emitStore(dst, regT1, regT0);
+    map(m_bytecodeIndex + OPCODE_LENGTH(op_get_by_id), dst, regT1, regT0);
+}
+
+void JIT::compileGetByIdHotPath()
+{
+    // As for put_by_id, get_by_id requires the offset of the Structure and the offset of the access to be patched.
+    // Additionally, for get_by_id we need patch the offset of the branch to the slow case (we patch this to jump
+    // to array-length / prototype access tranpolines, and finally we also the the property-map access offset as a label
+    // to jump back to if one of these trampolies finds a match.
+    Label hotPathBegin(this);
+    m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].hotPathBegin = hotPathBegin;
+    m_propertyAccessInstructionIndex++;
+
+    DataLabelPtr structureToCompare;
+    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+    addSlowCase(structureCheck);
+    ASSERT(differenceBetween(hotPathBegin, structureToCompare) == patchOffsetGetByIdStructure);
+    ASSERT(differenceBetween(hotPathBegin, structureCheck) == patchOffsetGetByIdBranchToSlowCase);
+
+    Label externalLoad = loadPtrWithPatchToLEA(Address(regT0, OBJECT_OFFSETOF(JSObject, m_externalStorage)), regT2);
+    Label externalLoadComplete(this);
+    ASSERT(differenceBetween(hotPathBegin, externalLoad) == patchOffsetGetByIdExternalLoad);
+    ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthGetByIdExternalLoad);
+
+    DataLabel32 displacementLabel1 = loadPtrWithAddressOffsetPatch(Address(regT2, patchGetByIdDefaultOffset), regT0); // payload
+    ASSERT(differenceBetween(hotPathBegin, displacementLabel1) == patchOffsetGetByIdPropertyMapOffset1);
+    DataLabel32 displacementLabel2 = loadPtrWithAddressOffsetPatch(Address(regT2, patchGetByIdDefaultOffset), regT1); // tag
+    ASSERT(differenceBetween(hotPathBegin, displacementLabel2) == patchOffsetGetByIdPropertyMapOffset2);
+
+    Label putResult(this);
+    ASSERT(differenceBetween(hotPathBegin, putResult) == patchOffsetGetByIdPutResult);
+}
+
+void JIT::emitSlow_op_get_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int ident = currentInstruction[3].u.operand;
+
+    compileGetByIdSlowCase(dst, base, &(m_codeBlock->identifier(ident)), iter);
+}
+
+void JIT::compileGetByIdSlowCase(int dst, int base, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, bool isMethodCheck)
+{
+    // As for the hot path of get_by_id, above, we ensure that we can use an architecture specific offset
+    // so that we only need track one pointer into the slow case code - we track a pointer to the location
+    // of the call (which we can use to look up the patch information), but should a array-length or
+    // prototype access trampoline fail we want to bail out back to here.  To do so we can subtract back
+    // the distance from the call to the head of the slow case.
+    linkSlowCaseIfNotJSCell(iter, base);
+    linkSlowCase(iter);
+
+    Label coldPathBegin(this);
+
+    JITStubCall stubCall(this, isMethodCheck ? cti_op_get_by_id_method_check : cti_op_get_by_id);
+    stubCall.addArgument(regT1, regT0);
+    stubCall.addArgument(ImmPtr(ident));
+    Call call = stubCall.call(dst);
+
+    ASSERT(differenceBetween(coldPathBegin, call) == patchOffsetGetByIdSlowCaseCall);
+
+    // Track the location of the call; this will be used to recover patch information.
+    m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].callReturnLocation = call;
+    m_propertyAccessInstructionIndex++;
+}
+
+void JIT::emit_op_put_by_id(Instruction* currentInstruction)
+{
+    // In order to be able to patch both the Structure, and the object offset, we store one pointer,
+    // to just after the arguments have been loaded into registers 'hotPathBegin', and we generate code
+    // such that the Structure & offset are always at the same distance from this.
+
+    int base = currentInstruction[1].u.operand;
+    int value = currentInstruction[3].u.operand;
+
+    emitLoad2(base, regT1, regT0, value, regT3, regT2);
+
+    emitJumpSlowCaseIfNotJSCell(base, regT1);
+
+    Label hotPathBegin(this);
+    m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].hotPathBegin = hotPathBegin;
+    m_propertyAccessInstructionIndex++;
+
+    // It is important that the following instruction plants a 32bit immediate, in order that it can be patched over.
+    DataLabelPtr structureToCompare;
+    addSlowCase(branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure))));
+    ASSERT(differenceBetween(hotPathBegin, structureToCompare) == patchOffsetPutByIdStructure);
+
+    // Plant a load from a bogus ofset in the object's property map; we will patch this later, if it is to be used.
+    Label externalLoad = loadPtrWithPatchToLEA(Address(regT0, OBJECT_OFFSETOF(JSObject, m_externalStorage)), regT0);
+    Label externalLoadComplete(this);
+    ASSERT(differenceBetween(hotPathBegin, externalLoad) == patchOffsetPutByIdExternalLoad);
+    ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthPutByIdExternalLoad);
+
+    DataLabel32 displacementLabel1 = storePtrWithAddressOffsetPatch(regT2, Address(regT0, patchGetByIdDefaultOffset)); // payload
+    DataLabel32 displacementLabel2 = storePtrWithAddressOffsetPatch(regT3, Address(regT0, patchGetByIdDefaultOffset)); // tag
+    ASSERT(differenceBetween(hotPathBegin, displacementLabel1) == patchOffsetPutByIdPropertyMapOffset1);
+    ASSERT(differenceBetween(hotPathBegin, displacementLabel2) == patchOffsetPutByIdPropertyMapOffset2);
+}
+
+void JIT::emitSlow_op_put_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int base = currentInstruction[1].u.operand;
+    int ident = currentInstruction[2].u.operand;
+
+    linkSlowCaseIfNotJSCell(iter, base);
+    linkSlowCase(iter);
+
+    JITStubCall stubCall(this, cti_op_put_by_id);
+    stubCall.addArgument(regT1, regT0);
+    stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
+    stubCall.addArgument(regT3, regT2); 
+    Call call = stubCall.call();
+
+    // Track the location of the call; this will be used to recover patch information.
+    m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].callReturnLocation = call;
+    m_propertyAccessInstructionIndex++;
+}
+
+// Compile a store into an object's property storage.  May overwrite base.
+void JIT::compilePutDirectOffset(RegisterID base, RegisterID valueTag, RegisterID valuePayload, Structure* structure, size_t cachedOffset)
+{
+    int offset = cachedOffset;
+    if (structure->isUsingInlineStorage())
+        offset += OBJECT_OFFSETOF(JSObject, m_inlineStorage) /  sizeof(Register);
+    else
+        loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
+    emitStore(offset, valueTag, valuePayload, base);
+}
+
+// Compile a load from an object's property storage.  May overwrite base.
+void JIT::compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, Structure* structure, size_t cachedOffset)
+{
+    int offset = cachedOffset;
+    if (structure->isUsingInlineStorage())
+        offset += OBJECT_OFFSETOF(JSObject, m_inlineStorage) / sizeof(Register);
+    else
+        loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
+    emitLoad(offset, resultTag, resultPayload, base);
+}
+
+void JIT::compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID resultTag, RegisterID resultPayload, size_t cachedOffset)
+{
+    if (base->isUsingInlineStorage()) {
+        load32(reinterpret_cast<char*>(&base->m_inlineStorage[cachedOffset]), resultPayload);
+        load32(reinterpret_cast<char*>(&base->m_inlineStorage[cachedOffset]) + 4, resultTag);
+        return;
+    }
+
+    size_t offset = cachedOffset * sizeof(JSValue);
+
+    PropertyStorage* protoPropertyStorage = &base->m_externalStorage;
+    loadPtr(static_cast<void*>(protoPropertyStorage), temp);
+    load32(Address(temp, offset), resultPayload);
+    load32(Address(temp, offset + 4), resultTag);
+}
+
+void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress)
+{
+    // It is assumed that regT0 contains the basePayload and regT1 contains the baseTag.  The value can be found on the stack.
+
+    JumpList failureCases;
+    failureCases.append(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
+
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    failureCases.append(branchPtr(NotEqual, regT2, ImmPtr(oldStructure)));
+
+    // Verify that nothing in the prototype chain has a setter for this property. 
+    for (RefPtr<Structure>* it = chain->head(); *it; ++it) {
+        loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype)), regT2);
+        loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+        failureCases.append(branchPtr(NotEqual, regT2, ImmPtr(it->get())));
+    }
+
+    // Reallocate property storage if needed.
+    Call callTarget;
+    bool willNeedStorageRealloc = oldStructure->propertyStorageCapacity() != newStructure->propertyStorageCapacity();
+    if (willNeedStorageRealloc) {
+        // This trampoline was called to like a JIT stub; before we can can call again we need to
+        // remove the return address from the stack, to prevent the stack from becoming misaligned.
+        preserveReturnAddressAfterCall(regT3);
+ 
+        JITStubCall stubCall(this, cti_op_put_by_id_transition_realloc);
+        stubCall.skipArgument(); // base
+        stubCall.skipArgument(); // ident
+        stubCall.skipArgument(); // value
+        stubCall.addArgument(Imm32(oldStructure->propertyStorageCapacity()));
+        stubCall.addArgument(Imm32(newStructure->propertyStorageCapacity()));
+        stubCall.call(regT0);
+
+        restoreReturnAddressBeforeReturn(regT3);
+    }
+
+    sub32(Imm32(1), AbsoluteAddress(oldStructure->addressOfCount()));
+    add32(Imm32(1), AbsoluteAddress(newStructure->addressOfCount()));
+    storePtr(ImmPtr(newStructure), Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)));
+ 
+    load32(Address(stackPointerRegister, offsetof(struct JITStackFrame, args[2]) + sizeof(void*)), regT3);
+    load32(Address(stackPointerRegister, offsetof(struct JITStackFrame, args[2]) + sizeof(void*) + 4), regT2);
+
+    // Write the value
+    compilePutDirectOffset(regT0, regT2, regT3, newStructure, cachedOffset);
+
+    ret();
+    
+    ASSERT(!failureCases.empty());
+    failureCases.link(this);
+    restoreArgumentReferenceForTrampoline();
+    Call failureCall = tailRecursiveCall();
+
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+
+    patchBuffer.link(failureCall, FunctionPtr(cti_op_put_by_id_fail));
+
+    if (willNeedStorageRealloc) {
+        ASSERT(m_calls.size() == 1);
+        patchBuffer.link(m_calls[0].from, FunctionPtr(cti_op_put_by_id_transition_realloc));
+    }
+    
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    stubInfo->stubRoutine = entryLabel;
+    RepatchBuffer repatchBuffer(m_codeBlock);
+    repatchBuffer.relinkCallerToTrampoline(returnAddress, entryLabel);
+}
+
+void JIT::patchGetByIdSelf(CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ReturnAddressPtr returnAddress)
+{
+    RepatchBuffer repatchBuffer(codeBlock);
+
+    // We don't want to patch more than once - in future go to cti_op_get_by_id_generic.
+    // Should probably go to JITStubs::cti_op_get_by_id_fail, but that doesn't do anything interesting right now.
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_self_fail));
+
+    int offset = sizeof(JSValue) * cachedOffset;
+
+    // If we're patching to use inline storage, convert the initial load to a lea; this avoids the extra load
+    // and makes the subsequent load's offset automatically correct
+    if (structure->isUsingInlineStorage())
+        repatchBuffer.repatchLoadPtrToLEA(stubInfo->hotPathBegin.instructionAtOffset(patchOffsetGetByIdExternalLoad));
+
+    // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetGetByIdStructure), structure);
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset1), offset); // payload
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset2), offset + 4); // tag
+}
+
+void JIT::patchMethodCallProto(CodeBlock* codeBlock, MethodCallLinkInfo& methodCallLinkInfo, JSFunction* callee, Structure* structure, JSObject* proto, ReturnAddressPtr returnAddress)
+{
+    RepatchBuffer repatchBuffer(codeBlock);
+
+    ASSERT(!methodCallLinkInfo.cachedStructure);
+    methodCallLinkInfo.cachedStructure = structure;
+    structure->ref();
+
+    Structure* prototypeStructure = proto->structure();
+    ASSERT(!methodCallLinkInfo.cachedPrototypeStructure);
+    methodCallLinkInfo.cachedPrototypeStructure = prototypeStructure;
+    prototypeStructure->ref();
+
+    repatchBuffer.repatch(methodCallLinkInfo.structureLabel, structure);
+    repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckProtoObj), proto);
+    repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckProtoStruct), prototypeStructure);
+    repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckPutFunction), callee);
+
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id));
+}
+
+void JIT::patchPutByIdReplace(CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ReturnAddressPtr returnAddress)
+{
+    RepatchBuffer repatchBuffer(codeBlock);
+
+    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
+    // Should probably go to cti_op_put_by_id_fail, but that doesn't do anything interesting right now.
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_put_by_id_generic));
+
+    int offset = sizeof(JSValue) * cachedOffset;
+
+    // If we're patching to use inline storage, convert the initial load to a lea; this avoids the extra load
+    // and makes the subsequent load's offset automatically correct
+    if (structure->isUsingInlineStorage())
+        repatchBuffer.repatchLoadPtrToLEA(stubInfo->hotPathBegin.instructionAtOffset(patchOffsetPutByIdExternalLoad));
+
+    // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetPutByIdStructure), structure);
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetPutByIdPropertyMapOffset1), offset); // payload
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetPutByIdPropertyMapOffset2), offset + 4); // tag
+}
+
+void JIT::privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress)
+{
+    StructureStubInfo* stubInfo = &m_codeBlock->getStubInfo(returnAddress);
+    
+    // regT0 holds a JSCell*
+
+    // Check for array
+    Jump failureCases1 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr));
+
+    // Checks out okay! - get the length from the storage
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT2);
+    load32(Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_length)), regT2);
+
+    Jump failureCases2 = branch32(Above, regT2, Imm32(INT_MAX));
+    move(regT2, regT0);
+    move(Imm32(JSValue::Int32Tag), regT1);
+    Jump success = jump();
+
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+
+    // Use the patch information to link the failure cases back to the original slow case routine.
+    CodeLocationLabel slowCaseBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
+    patchBuffer.link(failureCases1, slowCaseBegin);
+    patchBuffer.link(failureCases2, slowCaseBegin);
+
+    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+
+    // Track the stub we have created so that it will be deleted later.
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    stubInfo->stubRoutine = entryLabel;
+
+    // Finally patch the jump to slow case back in the hot path to jump here instead.
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer(m_codeBlock);
+    repatchBuffer.relink(jumpLocation, entryLabel);
+
+    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_array_fail));
+}
+
+void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
+{
+    // regT0 holds a JSCell*
+
+    // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
+    // referencing the prototype object - let's speculatively load it's table nice and early!)
+    JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
+
+    Jump failureCases1 = checkStructure(regT0, structure);
+
+    // Check the prototype object's Structure had not changed.
+    Structure** prototypeStructureAddress = &(protoObject->m_structure);
+#if PLATFORM(X86_64)
+    move(ImmPtr(prototypeStructure), regT3);
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
+#else
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
+#endif
+
+    // Checks out okay! - getDirectOffset
+    compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
+
+    Jump success = jump();
+
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+
+    // Use the patch information to link the failure cases back to the original slow case routine.
+    CodeLocationLabel slowCaseBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
+    patchBuffer.link(failureCases1, slowCaseBegin);
+    patchBuffer.link(failureCases2, slowCaseBegin);
+
+    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+
+    // Track the stub we have created so that it will be deleted later.
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    stubInfo->stubRoutine = entryLabel;
+
+    // Finally patch the jump to slow case back in the hot path to jump here instead.
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer(m_codeBlock);
+    repatchBuffer.relink(jumpLocation, entryLabel);
+
+    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_proto_list));
+}
+
+
+void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, size_t cachedOffset)
+{
+    // regT0 holds a JSCell*
+    
+    Jump failureCase = checkStructure(regT0, structure);
+    compileGetDirectOffset(regT0, regT1, regT0, structure, cachedOffset);
+    Jump success = jump();
+
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+
+    // Use the patch information to link the failure cases back to the original slow case routine.
+    CodeLocationLabel lastProtoBegin = polymorphicStructures->list[currentIndex - 1].stubRoutine;
+    if (!lastProtoBegin)
+        lastProtoBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
+
+    patchBuffer.link(failureCase, lastProtoBegin);
+
+    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+
+    structure->ref();
+    polymorphicStructures->list[currentIndex].set(entryLabel, structure);
+
+    // Finally patch the jump to slow case back in the hot path to jump here instead.
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer(m_codeBlock);
+    repatchBuffer.relink(jumpLocation, entryLabel);
+}
+
+void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, CallFrame* callFrame)
+{
+    // regT0 holds a JSCell*
+    
+    // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
+    // referencing the prototype object - let's speculatively load it's table nice and early!)
+    JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
+
+    // Check eax is an object of the right Structure.
+    Jump failureCases1 = checkStructure(regT0, structure);
+
+    // Check the prototype object's Structure had not changed.
+    Structure** prototypeStructureAddress = &(protoObject->m_structure);
+#if PLATFORM(X86_64)
+    move(ImmPtr(prototypeStructure), regT3);
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
+#else
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
+#endif
+
+    compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
+
+    Jump success = jump();
+
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+
+    // Use the patch information to link the failure cases back to the original slow case routine.
+    CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
+    patchBuffer.link(failureCases1, lastProtoBegin);
+    patchBuffer.link(failureCases2, lastProtoBegin);
+
+    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+
+    structure->ref();
+    prototypeStructure->ref();
+    prototypeStructures->list[currentIndex].set(entryLabel, structure, prototypeStructure);
+
+    // Finally patch the jump to slow case back in the hot path to jump here instead.
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer(m_codeBlock);
+    repatchBuffer.relink(jumpLocation, entryLabel);
+}
+
+void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, CallFrame* callFrame)
+{
+    // regT0 holds a JSCell*
+    
+    ASSERT(count);
+    
+    JumpList bucketsOfFail;
+
+    // Check eax is an object of the right Structure.
+    bucketsOfFail.append(checkStructure(regT0, structure));
+
+    Structure* currStructure = structure;
+    RefPtr<Structure>* chainEntries = chain->head();
+    JSObject* protoObject = 0;
+    for (unsigned i = 0; i < count; ++i) {
+        protoObject = asObject(currStructure->prototypeForLookup(callFrame));
+        currStructure = chainEntries[i].get();
+
+        // Check the prototype object's Structure had not changed.
+        Structure** prototypeStructureAddress = &(protoObject->m_structure);
+#if PLATFORM(X86_64)
+        move(ImmPtr(currStructure), regT3);
+        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3));
+#else
+        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(currStructure)));
+#endif
+    }
+    ASSERT(protoObject);
+
+    compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
+    Jump success = jump();
+
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+
+    // Use the patch information to link the failure cases back to the original slow case routine.
+    CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
+
+    patchBuffer.link(bucketsOfFail, lastProtoBegin);
+
+    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+
+    // Track the stub we have created so that it will be deleted later.
+    structure->ref();
+    chain->ref();
+    prototypeStructures->list[currentIndex].set(entryLabel, structure, chain);
+
+    // Finally patch the jump to slow case back in the hot path to jump here instead.
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer(m_codeBlock);
+    repatchBuffer.relink(jumpLocation, entryLabel);
+}
+
+void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
+{
+    // regT0 holds a JSCell*
+    
+    ASSERT(count);
+    
+    JumpList bucketsOfFail;
+
+    // Check eax is an object of the right Structure.
+    bucketsOfFail.append(checkStructure(regT0, structure));
+
+    Structure* currStructure = structure;
+    RefPtr<Structure>* chainEntries = chain->head();
+    JSObject* protoObject = 0;
+    for (unsigned i = 0; i < count; ++i) {
+        protoObject = asObject(currStructure->prototypeForLookup(callFrame));
+        currStructure = chainEntries[i].get();
+
+        // Check the prototype object's Structure had not changed.
+        Structure** prototypeStructureAddress = &(protoObject->m_structure);
+#if PLATFORM(X86_64)
+        move(ImmPtr(currStructure), regT3);
+        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3));
+#else
+        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(currStructure)));
+#endif
+    }
+    ASSERT(protoObject);
+
+    compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
+    Jump success = jump();
+
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+
+    // Use the patch information to link the failure cases back to the original slow case routine.
+    patchBuffer.link(bucketsOfFail, stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall));
+
+    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+
+    // Track the stub we have created so that it will be deleted later.
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    stubInfo->stubRoutine = entryLabel;
+
+    // Finally patch the jump to slow case back in the hot path to jump here instead.
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer(m_codeBlock);
+    repatchBuffer.relink(jumpLocation, entryLabel);
+
+    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_proto_list));
+}
+
+/* ------------------------------ END: !ENABLE / ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
+
+#endif // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+
+#else // USE(JSVALUE32_64)
+
 void JIT::emit_op_get_by_val(Instruction* currentInstruction)
 {
     emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
     emitJumpSlowCaseIfNotImmediateInteger(regT1);
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
     // This is technically incorrect - we're zero-extending an int32.  On the hot path this doesn't matter.
     // We check the value as if it was a uint32 against the m_fastAccessCutoff - which will always fail if
     // number was signed since m_fastAccessCutoff is always less than intmax (since the total allocation
@@ -78,7 +987,7 @@ void JIT::emit_op_put_by_val(Instruction* currentInstruction)
 {
     emitGetVirtualRegisters(currentInstruction[1].u.operand, regT0, currentInstruction[2].u.operand, regT1);
     emitJumpSlowCaseIfNotImmediateInteger(regT1);
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
     // See comment in op_get_by_val.
     zeroExtend32ToPtr(regT1, regT1);
 #else
@@ -105,7 +1014,7 @@ void JIT::emit_op_put_by_val(Instruction* currentInstruction)
 
 void JIT::emit_op_put_by_index(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, JITStubs::cti_op_put_by_index);
+    JITStubCall stubCall(this, cti_op_put_by_index);
     stubCall.addArgument(currentInstruction[1].u.operand, regT2);
     stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
     stubCall.addArgument(currentInstruction[3].u.operand, regT2);
@@ -114,7 +1023,7 @@ void JIT::emit_op_put_by_index(Instruction* currentInstruction)
 
 void JIT::emit_op_put_getter(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, JITStubs::cti_op_put_getter);
+    JITStubCall stubCall(this, cti_op_put_getter);
     stubCall.addArgument(currentInstruction[1].u.operand, regT2);
     stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.addArgument(currentInstruction[3].u.operand, regT2);
@@ -123,7 +1032,7 @@ void JIT::emit_op_put_getter(Instruction* currentInstruction)
 
 void JIT::emit_op_put_setter(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, JITStubs::cti_op_put_setter);
+    JITStubCall stubCall(this, cti_op_put_setter);
     stubCall.addArgument(currentInstruction[1].u.operand, regT2);
     stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.addArgument(currentInstruction[3].u.operand, regT2);
@@ -132,7 +1041,7 @@ void JIT::emit_op_put_setter(Instruction* currentInstruction)
 
 void JIT::emit_op_del_by_id(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, JITStubs::cti_op_del_by_id);
+    JITStubCall stubCall(this, cti_op_del_by_id);
     stubCall.addArgument(currentInstruction[2].u.operand, regT2);
     stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[3].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
@@ -157,7 +1066,7 @@ void JIT::emit_op_get_by_id(Instruction* currentInstruction)
     Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
 
     emitGetVirtualRegister(baseVReg, regT0);
-    JITStubCall stubCall(this, JITStubs::cti_op_get_by_id_generic);
+    JITStubCall stubCall(this, cti_op_get_by_id_generic);
     stubCall.addArgument(regT0);
     stubCall.addArgument(ImmPtr(ident));
     stubCall.call(resultVReg);
@@ -178,7 +1087,7 @@ void JIT::emit_op_put_by_id(Instruction* currentInstruction)
 
     emitGetVirtualRegisters(baseVReg, regT0, valueVReg, regT1);
 
-    JITStubCall stubCall(this, JITStubs::cti_op_put_by_id_generic);
+    JITStubCall stubCall(this, cti_op_put_by_id_generic);
     stubCall.addArgument(regT0);
     stubCall.addArgument(ImmPtr(ident));
     stubCall.addArgument(regT1);
@@ -213,13 +1122,20 @@ void JIT::emit_op_method_check(Instruction* currentInstruction)
     // Do the method check - check the object & its prototype's structure inline (this is the common case).
     m_methodCallCompilationInfo.append(MethodCallCompilationInfo(m_propertyAccessInstructionIndex));
     MethodCallCompilationInfo& info = m_methodCallCompilationInfo.last();
+
     Jump notCell = emitJumpIfNotJSCell(regT0);
+
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequenceMethodCheck);
+
     Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), info.structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
     DataLabelPtr protoStructureToCompare, protoObj = moveWithPatch(ImmPtr(0), regT1);
     Jump protoStructureCheck = branchPtrWithPatch(NotEqual, Address(regT1, OBJECT_OFFSETOF(JSCell, m_structure)), protoStructureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
 
     // This will be relinked to load the function without doing a load.
     DataLabelPtr putFunction = moveWithPatch(ImmPtr(0), regT0);
+
+    END_UNINTERRUPTED_SEQUENCE(sequenceMethodCheck);
+
     Jump match = jump();
 
     ASSERT(differenceBetween(info.structureToCompare, protoObj) == patchOffsetMethodCheckProtoObj);
@@ -249,7 +1165,7 @@ void JIT::emitSlow_op_method_check(Instruction* currentInstruction, Vector<SlowC
     unsigned baseVReg = currentInstruction[2].u.operand;
     Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
 
-    compileGetByIdSlowCase(resultVReg, baseVReg, ident, iter, m_propertyAccessInstructionIndex++, true);
+    compileGetByIdSlowCase(resultVReg, baseVReg, ident, iter, true);
 
     // We've already generated the following get_by_id, so make sure it's skipped over.
     m_bytecodeIndex += OPCODE_LENGTH(op_get_by_id);
@@ -283,6 +1199,8 @@ void JIT::compileGetByIdHotPath(int, int baseVReg, Identifier*, unsigned propert
 
     emitJumpSlowCaseIfNotJSCell(regT0, baseVReg);
 
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequenceGetByIdHotPath);
+
     Label hotPathBegin(this);
     m_propertyAccessCompilationInfo[propertyAccessInstructionIndex].hotPathBegin = hotPathBegin;
 
@@ -301,6 +1219,9 @@ void JIT::compileGetByIdHotPath(int, int baseVReg, Identifier*, unsigned propert
     ASSERT(differenceBetween(hotPathBegin, displacementLabel) == patchOffsetGetByIdPropertyMapOffset);
 
     Label putResult(this);
+
+    END_UNINTERRUPTED_SEQUENCE(sequenceGetByIdHotPath);
+
     ASSERT(differenceBetween(hotPathBegin, putResult) == patchOffsetGetByIdPutResult);
 }
 
@@ -310,10 +1231,10 @@ void JIT::emitSlow_op_get_by_id(Instruction* currentInstruction, Vector<SlowCase
     unsigned baseVReg = currentInstruction[2].u.operand;
     Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
 
-    compileGetByIdSlowCase(resultVReg, baseVReg, ident, iter, m_propertyAccessInstructionIndex++, false);
+    compileGetByIdSlowCase(resultVReg, baseVReg, ident, iter, false);
 }
 
-void JIT::compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, unsigned propertyAccessInstructionIndex, bool isMethodCheck)
+void JIT::compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, bool isMethodCheck)
 {
     // As for the hot path of get_by_id, above, we ensure that we can use an architecture specific offset
     // so that we only need track one pointer into the slow case code - we track a pointer to the location
@@ -324,18 +1245,23 @@ void JIT::compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident
     linkSlowCaseIfNotJSCell(iter, baseVReg);
     linkSlowCase(iter);
 
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequenceGetByIdSlowCase);
+
 #ifndef NDEBUG
     Label coldPathBegin(this);
 #endif
-    JITStubCall stubCall(this, isMethodCheck ? JITStubs::cti_op_get_by_id_method_check : JITStubs::cti_op_get_by_id);
+    JITStubCall stubCall(this, isMethodCheck ? cti_op_get_by_id_method_check : cti_op_get_by_id);
     stubCall.addArgument(regT0);
     stubCall.addArgument(ImmPtr(ident));
     Call call = stubCall.call(resultVReg);
 
+    END_UNINTERRUPTED_SEQUENCE(sequenceGetByIdSlowCase);
+
     ASSERT(differenceBetween(coldPathBegin, call) == patchOffsetGetByIdSlowCaseCall);
 
     // Track the location of the call; this will be used to recover patch information.
-    m_propertyAccessCompilationInfo[propertyAccessInstructionIndex].callReturnLocation = call;
+    m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].callReturnLocation = call;
+    m_propertyAccessInstructionIndex++;
 }
 
 void JIT::emit_op_put_by_id(Instruction* currentInstruction)
@@ -354,6 +1280,8 @@ void JIT::emit_op_put_by_id(Instruction* currentInstruction)
     // Jump to a slow case if either the base object is an immediate, or if the Structure does not match.
     emitJumpSlowCaseIfNotJSCell(regT0, baseVReg);
 
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequencePutById);
+
     Label hotPathBegin(this);
     m_propertyAccessCompilationInfo[propertyAccessInstructionIndex].hotPathBegin = hotPathBegin;
 
@@ -369,6 +1297,9 @@ void JIT::emit_op_put_by_id(Instruction* currentInstruction)
     ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthPutByIdExternalLoad);
 
     DataLabel32 displacementLabel = storePtrWithAddressOffsetPatch(regT1, Address(regT0, patchGetByIdDefaultOffset));
+
+    END_UNINTERRUPTED_SEQUENCE(sequencePutById);
+
     ASSERT(differenceBetween(hotPathBegin, displacementLabel) == patchOffsetPutByIdPropertyMapOffset);
 }
 
@@ -382,7 +1313,7 @@ void JIT::emitSlow_op_put_by_id(Instruction* currentInstruction, Vector<SlowCase
     linkSlowCaseIfNotJSCell(iter, baseVReg);
     linkSlowCase(iter);
 
-    JITStubCall stubCall(this, JITStubs::cti_op_put_by_id);
+    JITStubCall stubCall(this, cti_op_put_by_id);
     stubCall.addArgument(regT0);
     stubCall.addArgument(ImmPtr(ident));
     stubCall.addArgument(regT1);
@@ -465,13 +1396,14 @@ void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure
         // remove the return address from the stack, to prevent the stack from becoming misaligned.
         preserveReturnAddressAfterCall(regT3);
  
-        JITStubCall stubCall(this, JITStubs::cti_op_put_by_id_transition_realloc);
-        stubCall.addArgument(regT0);
+        JITStubCall stubCall(this, cti_op_put_by_id_transition_realloc);
+        stubCall.skipArgument(); // base
+        stubCall.skipArgument(); // ident
+        stubCall.skipArgument(); // value
         stubCall.addArgument(Imm32(oldStructure->propertyStorageCapacity()));
         stubCall.addArgument(Imm32(newStructure->propertyStorageCapacity()));
-        stubCall.addArgument(regT1); // This argument is not used in the stub; we set it up on the stack so that it can be restored, below.
         stubCall.call(regT0);
-        emitGetJITStubArg(4, regT1);
+        emitGetJITStubArg(2, regT1);
 
         restoreReturnAddressBeforeReturn(regT3);
     }
@@ -494,11 +1426,11 @@ void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure
 
     LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
 
-    patchBuffer.link(failureCall, FunctionPtr(JITStubs::cti_op_put_by_id_fail));
+    patchBuffer.link(failureCall, FunctionPtr(cti_op_put_by_id_fail));
 
     if (willNeedStorageRealloc) {
         ASSERT(m_calls.size() == 1);
-        patchBuffer.link(m_calls[0].from, FunctionPtr(JITStubs::cti_op_put_by_id_transition_realloc));
+        patchBuffer.link(m_calls[0].from, FunctionPtr(cti_op_put_by_id_transition_realloc));
     }
     
     CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
@@ -512,8 +1444,8 @@ void JIT::patchGetByIdSelf(CodeBlock* codeBlock, StructureStubInfo* stubInfo, St
     RepatchBuffer repatchBuffer(codeBlock);
 
     // We don't want to patch more than once - in future go to cti_op_get_by_id_generic.
-    // Should probably go to JITStubs::cti_op_get_by_id_fail, but that doesn't do anything interesting right now.
-    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(JITStubs::cti_op_get_by_id_self_fail));
+    // Should probably go to cti_op_get_by_id_fail, but that doesn't do anything interesting right now.
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_self_fail));
 
     int offset = sizeof(JSValue) * cachedOffset;
 
@@ -527,7 +1459,7 @@ void JIT::patchGetByIdSelf(CodeBlock* codeBlock, StructureStubInfo* stubInfo, St
     repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset), offset);
 }
 
-void JIT::patchMethodCallProto(CodeBlock* codeBlock, MethodCallLinkInfo& methodCallLinkInfo, JSFunction* callee, Structure* structure, JSObject* proto)
+void JIT::patchMethodCallProto(CodeBlock* codeBlock, MethodCallLinkInfo& methodCallLinkInfo, JSFunction* callee, Structure* structure, JSObject* proto, ReturnAddressPtr returnAddress)
 {
     RepatchBuffer repatchBuffer(codeBlock);
 
@@ -544,6 +1476,8 @@ void JIT::patchMethodCallProto(CodeBlock* codeBlock, MethodCallLinkInfo& methodC
     repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckProtoObj), proto);
     repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckProtoStruct), prototypeStructure);
     repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckPutFunction), callee);
+
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id));
 }
 
 void JIT::patchPutByIdReplace(CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ReturnAddressPtr returnAddress)
@@ -551,8 +1485,8 @@ void JIT::patchPutByIdReplace(CodeBlock* codeBlock, StructureStubInfo* stubInfo,
     RepatchBuffer repatchBuffer(codeBlock);
 
     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
-    // Should probably go to JITStubs::cti_op_put_by_id_fail, but that doesn't do anything interesting right now.
-    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(JITStubs::cti_op_put_by_id_generic));
+    // Should probably go to cti_op_put_by_id_fail, but that doesn't do anything interesting right now.
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_put_by_id_generic));
 
     int offset = sizeof(JSValue) * cachedOffset;
 
@@ -602,7 +1536,7 @@ void JIT::privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress)
     repatchBuffer.relink(jumpLocation, entryLabel);
 
     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
-    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(JITStubs::cti_op_get_by_id_array_fail));
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_array_fail));
 }
 
 void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
@@ -648,7 +1582,7 @@ void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* str
     repatchBuffer.relink(jumpLocation, entryLabel);
 
     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
-    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(JITStubs::cti_op_get_by_id_proto_list));
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_proto_list));
 }
 
 void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, size_t cachedOffset)
@@ -827,13 +1761,15 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
     repatchBuffer.relink(jumpLocation, entryLabel);
 
     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
-    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(JITStubs::cti_op_get_by_id_proto_list));
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_proto_list));
 }
 
 /* ------------------------------ END: !ENABLE / ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
 
 #endif // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
 
+#endif // USE(JSVALUE32_64)
+
 } // namespace JSC
 
 #endif // ENABLE(JIT)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
index bc07178..cb5354b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
@@ -37,32 +37,40 @@ namespace JSC {
         JITStubCall(JIT* jit, JSObject* (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
             : m_jit(jit)
             , m_stub(reinterpret_cast<void*>(stub))
-            , m_returnType(Value)
-            , m_argumentIndex(1) // Index 0 is reserved for restoreArgumentReference();
+            , m_returnType(Cell)
+            , m_stackIndex(stackIndexStart)
         {
         }
 
         JITStubCall(JIT* jit, JSPropertyNameIterator* (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
             : m_jit(jit)
             , m_stub(reinterpret_cast<void*>(stub))
-            , m_returnType(Value)
-            , m_argumentIndex(1) // Index 0 is reserved for restoreArgumentReference();
+            , m_returnType(Cell)
+            , m_stackIndex(stackIndexStart)
         {
         }
 
         JITStubCall(JIT* jit, void* (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
             : m_jit(jit)
             , m_stub(reinterpret_cast<void*>(stub))
-            , m_returnType(Value)
-            , m_argumentIndex(1) // Index 0 is reserved for restoreArgumentReference();
+            , m_returnType(VoidPtr)
+            , m_stackIndex(stackIndexStart)
         {
         }
 
         JITStubCall(JIT* jit, int (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
             : m_jit(jit)
             , m_stub(reinterpret_cast<void*>(stub))
-            , m_returnType(Value)
-            , m_argumentIndex(1) // Index 0 is reserved for restoreArgumentReference();
+            , m_returnType(Int)
+            , m_stackIndex(stackIndexStart)
+        {
+        }
+
+        JITStubCall(JIT* jit, bool (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
+            : m_jit(jit)
+            , m_stub(reinterpret_cast<void*>(stub))
+            , m_returnType(Int)
+            , m_stackIndex(stackIndexStart)
         {
         }
 
@@ -70,30 +78,78 @@ namespace JSC {
             : m_jit(jit)
             , m_stub(reinterpret_cast<void*>(stub))
             , m_returnType(Void)
-            , m_argumentIndex(1) // Index 0 is reserved for restoreArgumentReference();
+            , m_stackIndex(stackIndexStart)
+        {
+        }
+
+#if USE(JSVALUE32_64)
+        JITStubCall(JIT* jit, EncodedJSValue (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
+            : m_jit(jit)
+            , m_stub(reinterpret_cast<void*>(stub))
+            , m_returnType(Value)
+            , m_stackIndex(stackIndexStart)
         {
         }
+#endif
 
         // Arguments are added first to last.
 
+        void skipArgument()
+        {
+            m_stackIndex += stackIndexStep;
+        }
+
         void addArgument(JIT::Imm32 argument)
         {
-            m_jit->poke(argument, m_argumentIndex);
-            ++m_argumentIndex;
+            m_jit->poke(argument, m_stackIndex);
+            m_stackIndex += stackIndexStep;
         }
 
         void addArgument(JIT::ImmPtr argument)
         {
-            m_jit->poke(argument, m_argumentIndex);
-            ++m_argumentIndex;
+            m_jit->poke(argument, m_stackIndex);
+            m_stackIndex += stackIndexStep;
         }
 
         void addArgument(JIT::RegisterID argument)
         {
-            m_jit->poke(argument, m_argumentIndex);
-            ++m_argumentIndex;
+            m_jit->poke(argument, m_stackIndex);
+            m_stackIndex += stackIndexStep;
+        }
+
+        void addArgument(const JSValue& value)
+        {
+            m_jit->poke(JIT::Imm32(value.payload()), m_stackIndex);
+            m_jit->poke(JIT::Imm32(value.tag()), m_stackIndex + 1);
+            m_stackIndex += stackIndexStep;
+        }
+
+        void addArgument(JIT::RegisterID tag, JIT::RegisterID payload)
+        {
+            m_jit->poke(payload, m_stackIndex);
+            m_jit->poke(tag, m_stackIndex + 1);
+            m_stackIndex += stackIndexStep;
+        }
+
+#if USE(JSVALUE32_64)
+        void addArgument(unsigned srcVirtualRegister)
+        {
+            if (m_jit->m_codeBlock->isConstantRegisterIndex(srcVirtualRegister)) {
+                addArgument(m_jit->getConstantOperand(srcVirtualRegister));
+                return;
+            }
+
+            m_jit->emitLoad(srcVirtualRegister, JIT::regT1, JIT::regT0);
+            addArgument(JIT::regT1, JIT::regT0);
         }
 
+        void getArgument(size_t argumentNumber, JIT::RegisterID tag, JIT::RegisterID payload)
+        {
+            size_t stackIndex = stackIndexStart + (argumentNumber * stackIndexStep);
+            m_jit->peek(payload, stackIndex);
+            m_jit->peek(tag, stackIndex + 1);
+        }
+#else
         void addArgument(unsigned src, JIT::RegisterID scratchRegister) // src is a virtual register.
         {
             if (m_jit->m_codeBlock->isConstantRegisterIndex(src))
@@ -104,6 +160,7 @@ namespace JSC {
             }
             m_jit->killLastResultRegister();
         }
+#endif
 
         JIT::Call call()
         {
@@ -121,21 +178,42 @@ namespace JSC {
                 m_jit->sampleInstruction(m_jit->m_codeBlock->instructions().begin() + m_jit->m_bytecodeIndex, false);
 #endif
 
+#if USE(JSVALUE32_64)
+            m_jit->unmap();
+#else
             m_jit->killLastResultRegister();
+#endif
             return call;
         }
 
+#if USE(JSVALUE32_64)
+        JIT::Call call(unsigned dst) // dst is a virtual register.
+        {
+            ASSERT(m_returnType == Value || m_returnType == Cell);
+            JIT::Call call = this->call();
+            if (m_returnType == Value)
+                m_jit->emitStore(dst, JIT::regT1, JIT::regT0);
+            else
+                m_jit->emitStoreCell(dst, JIT::returnValueRegister);
+            return call;
+        }
+#else
         JIT::Call call(unsigned dst) // dst is a virtual register.
         {
-            ASSERT(m_returnType == Value);
+            ASSERT(m_returnType == VoidPtr || m_returnType == Cell);
             JIT::Call call = this->call();
             m_jit->emitPutVirtualRegister(dst);
             return call;
         }
+#endif
 
-        JIT::Call call(JIT::RegisterID dst)
+        JIT::Call call(JIT::RegisterID dst) // dst is a machine register.
         {
-            ASSERT(m_returnType == Value);
+#if USE(JSVALUE32_64)
+            ASSERT(m_returnType == Value || m_returnType == VoidPtr || m_returnType == Int || m_returnType == Cell);
+#else
+            ASSERT(m_returnType == VoidPtr || m_returnType == Int || m_returnType == Cell);
+#endif
             JIT::Call call = this->call();
             if (dst != JIT::returnValueRegister)
                 m_jit->move(JIT::returnValueRegister, dst);
@@ -143,25 +221,13 @@ namespace JSC {
         }
 
     private:
+        static const size_t stackIndexStep = sizeof(EncodedJSValue) == 2 * sizeof(void*) ? 2 : 1;
+        static const size_t stackIndexStart = 1; // Index 0 is reserved for restoreArgumentReference().
+
         JIT* m_jit;
         void* m_stub;
-        enum { Value, Void } m_returnType;
-        size_t m_argumentIndex;
-    };
-
-    class CallEvalJITStub : public JITStubCall {
-    public:
-        CallEvalJITStub(JIT* jit, Instruction* instruction)
-            : JITStubCall(jit, JITStubs::cti_op_call_eval)
-        {
-            int callee = instruction[2].u.operand;
-            int argCount = instruction[3].u.operand;
-            int registerOffset = instruction[4].u.operand;
-
-            addArgument(callee, JIT::regT2);
-            addArgument(JIT::Imm32(registerOffset));
-            addArgument(JIT::Imm32(argCount));
-        }
+        enum { Void, VoidPtr, Int, Value, Cell } m_returnType;
+        size_t m_stackIndex;
     };
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
index 0a5eb07..4ab58d5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
@@ -56,36 +56,275 @@
 #include "RegExpPrototype.h"
 #include "Register.h"
 #include "SamplingTool.h"
+#include <stdarg.h>
 #include <stdio.h>
 
-#ifdef QT_BUILD_SCRIPT_LIB
-#include "bridge/qscriptobject_p.h"
-#endif
-
 using namespace std;
 
 namespace JSC {
 
-
 #if PLATFORM(DARWIN) || PLATFORM(WIN_OS)
 #define SYMBOL_STRING(name) "_" #name
 #else
 #define SYMBOL_STRING(name) #name
 #endif
 
-#if PLATFORM(DARWIN)
-    // Mach-O platform
-#define HIDE_SYMBOL(name) ".private_extern _" #name
-#elif PLATFORM(AIX)
-    // IBM's own file format
-#define HIDE_SYMBOL(name) ".lglobl " #name
-#elif PLATFORM(LINUX) || PLATFORM(FREEBSD) || PLATFORM(OPENBSD) || PLATFORM(SOLARIS) || (PLATFORM(HPUX) && PLATFORM(IA64)) || PLATFORM(SYMBIAN) || PLATFORM(NETBSD)
-    // ELF platform
-#define HIDE_SYMBOL(name) ".hidden " #name
-#else
-#define HIDE_SYMBOL(name)
+#if USE(JSVALUE32_64)
+
+#if COMPILER(GCC) && PLATFORM(X86)
+
+// These ASSERTs remind you that, if you change the layout of JITStackFrame, you
+// need to change the assembly trampolines below to match.
+COMPILE_ASSERT(offsetof(struct JITStackFrame, code) % 16 == 0x0, JITStackFrame_maintains_16byte_stack_alignment);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, savedEBX) == 0x3c, JITStackFrame_stub_argument_space_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, callFrame) == 0x58, JITStackFrame_callFrame_offset_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, code) == 0x50, JITStackFrame_code_offset_matches_ctiTrampoline);
+
+asm volatile (
+".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+SYMBOL_STRING(ctiTrampoline) ":" "\n"
+    "pushl %ebp" "\n"
+    "movl %esp, %ebp" "\n"
+    "pushl %esi" "\n"
+    "pushl %edi" "\n"
+    "pushl %ebx" "\n"
+    "subl $0x3c, %esp" "\n"
+    "movl $512, %esi" "\n"
+    "movl 0x58(%esp), %edi" "\n"
+    "call *0x50(%esp)" "\n"
+    "addl $0x3c, %esp" "\n"
+    "popl %ebx" "\n"
+    "popl %edi" "\n"
+    "popl %esi" "\n"
+    "popl %ebp" "\n"
+    "ret" "\n"
+);
+
+asm volatile (
+".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
+#if !USE(JIT_STUB_ARGUMENT_VA_LIST)
+    "movl %esp, %ecx" "\n"
+#endif
+    "call " SYMBOL_STRING(cti_vm_throw) "\n"
+    "addl $0x3c, %esp" "\n"
+    "popl %ebx" "\n"
+    "popl %edi" "\n"
+    "popl %esi" "\n"
+    "popl %ebp" "\n"
+    "ret" "\n"
+);
+    
+asm volatile (
+".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
+    "addl $0x3c, %esp" "\n"
+    "popl %ebx" "\n"
+    "popl %edi" "\n"
+    "popl %esi" "\n"
+    "popl %ebp" "\n"
+    "ret" "\n"
+);
+    
+#elif COMPILER(GCC) && PLATFORM(X86_64)
+
+#if USE(JIT_STUB_ARGUMENT_VA_LIST)
+#error "JIT_STUB_ARGUMENT_VA_LIST not supported on x86-64."
+#endif
+
+// These ASSERTs remind you that, if you change the layout of JITStackFrame, you
+// need to change the assembly trampolines below to match.
+COMPILE_ASSERT(offsetof(struct JITStackFrame, code) % 32 == 0x0, JITStackFrame_maintains_32byte_stack_alignment);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, savedRBX) == 0x48, JITStackFrame_stub_argument_space_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, callFrame) == 0x90, JITStackFrame_callFrame_offset_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, code) == 0x80, JITStackFrame_code_offset_matches_ctiTrampoline);
+
+asm volatile (
+".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+SYMBOL_STRING(ctiTrampoline) ":" "\n"
+    "pushq %rbp" "\n"
+    "movq %rsp, %rbp" "\n"
+    "pushq %r12" "\n"
+    "pushq %r13" "\n"
+    "pushq %r14" "\n"
+    "pushq %r15" "\n"
+    "pushq %rbx" "\n"
+    "subq $0x48, %rsp" "\n"
+    "movq $512, %r12" "\n"
+    "movq $0xFFFF000000000000, %r14" "\n"
+    "movq $0xFFFF000000000002, %r15" "\n"
+    "movq 0x90(%rsp), %r13" "\n"
+    "call *0x80(%rsp)" "\n"
+    "addq $0x48, %rsp" "\n"
+    "popq %rbx" "\n"
+    "popq %r15" "\n"
+    "popq %r14" "\n"
+    "popq %r13" "\n"
+    "popq %r12" "\n"
+    "popq %rbp" "\n"
+    "ret" "\n"
+);
+
+asm volatile (
+".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
+    "movq %rsp, %rdi" "\n"
+    "call " SYMBOL_STRING(cti_vm_throw) "\n"
+    "addq $0x48, %rsp" "\n"
+    "popq %rbx" "\n"
+    "popq %r15" "\n"
+    "popq %r14" "\n"
+    "popq %r13" "\n"
+    "popq %r12" "\n"
+    "popq %rbp" "\n"
+    "ret" "\n"
+);
+
+asm volatile (
+".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
+    "addq $0x48, %rsp" "\n"
+    "popq %rbx" "\n"
+    "popq %r15" "\n"
+    "popq %r14" "\n"
+    "popq %r13" "\n"
+    "popq %r12" "\n"
+    "popq %rbp" "\n"
+    "ret" "\n"
+);
+
+#elif COMPILER(GCC) && PLATFORM_ARM_ARCH(7)
+
+#if USE(JIT_STUB_ARGUMENT_VA_LIST)
+#error "JIT_STUB_ARGUMENT_VA_LIST not supported on ARMv7."
 #endif
 
+asm volatile (
+".text" "\n"
+".align 2" "\n"
+".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+".thumb" "\n"
+".thumb_func " SYMBOL_STRING(ctiTrampoline) "\n"
+SYMBOL_STRING(ctiTrampoline) ":" "\n"
+    "sub sp, sp, #0x3c" "\n"
+    "str lr, [sp, #0x20]" "\n"
+    "str r4, [sp, #0x24]" "\n"
+    "str r5, [sp, #0x28]" "\n"
+    "str r6, [sp, #0x2c]" "\n"
+    "str r1, [sp, #0x30]" "\n"
+    "str r2, [sp, #0x34]" "\n"
+    "str r3, [sp, #0x38]" "\n"
+    "cpy r5, r2" "\n"
+    "mov r6, #512" "\n"
+    "blx r0" "\n"
+    "ldr r6, [sp, #0x2c]" "\n"
+    "ldr r5, [sp, #0x28]" "\n"
+    "ldr r4, [sp, #0x24]" "\n"
+    "ldr lr, [sp, #0x20]" "\n"
+    "add sp, sp, #0x3c" "\n"
+    "bx lr" "\n"
+);
+
+asm volatile (
+".text" "\n"
+".align 2" "\n"
+".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+".thumb" "\n"
+".thumb_func " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
+    "cpy r0, sp" "\n"
+    "bl " SYMBOL_STRING(cti_vm_throw) "\n"
+    "ldr r6, [sp, #0x2c]" "\n"
+    "ldr r5, [sp, #0x28]" "\n"
+    "ldr r4, [sp, #0x24]" "\n"
+    "ldr lr, [sp, #0x20]" "\n"
+    "add sp, sp, #0x3c" "\n"
+    "bx lr" "\n"
+);
+
+asm volatile (
+".text" "\n"
+".align 2" "\n"
+".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+".thumb" "\n"
+".thumb_func " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
+    "ldr r6, [sp, #0x2c]" "\n"
+    "ldr r5, [sp, #0x28]" "\n"
+    "ldr r4, [sp, #0x24]" "\n"
+    "ldr lr, [sp, #0x20]" "\n"
+    "add sp, sp, #0x3c" "\n"
+    "bx lr" "\n"
+);
+
+#elif COMPILER(MSVC)
+
+#if USE(JIT_STUB_ARGUMENT_VA_LIST)
+#error "JIT_STUB_ARGUMENT_VA_LIST configuration not supported on MSVC."
+#endif
+
+// These ASSERTs remind you that, if you change the layout of JITStackFrame, you
+// need to change the assembly trampolines below to match.
+COMPILE_ASSERT(offsetof(struct JITStackFrame, code) % 16 == 0x0, JITStackFrame_maintains_16byte_stack_alignment);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, savedEBX) == 0x3c, JITStackFrame_stub_argument_space_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, callFrame) == 0x58, JITStackFrame_callFrame_offset_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, code) == 0x50, JITStackFrame_code_offset_matches_ctiTrampoline);
+
+extern "C" {
+
+    __declspec(naked) EncodedJSValue ctiTrampoline(void* code, RegisterFile*, CallFrame*, JSValue* exception, Profiler**, JSGlobalData*)
+    {
+        __asm {
+            push ebp;
+            mov ebp, esp;
+            push esi;
+            push edi;
+            push ebx;
+            sub esp, 0x3c;
+            mov esi, 512;
+            mov ecx, esp;
+            mov edi, [esp + 0x58];
+            call [esp + 0x50];
+            add esp, 0x3c;
+            pop ebx;
+            pop edi;
+            pop esi;
+            pop ebp;
+            ret;
+        }
+    }
+
+    __declspec(naked) void ctiVMThrowTrampoline()
+    {
+        __asm {
+            mov ecx, esp;
+            call cti_vm_throw;
+            add esp, 0x3c;
+            pop ebx;
+            pop edi;
+            pop esi;
+            pop ebp;
+            ret;
+        }
+    }
+
+    __declspec(naked) void ctiOpThrowNotCaught()
+    {
+        __asm {
+            add esp, 0x3c;
+            pop ebx;
+            pop edi;
+            pop esi;
+            pop ebp;
+            ret;
+        }
+    }
+}
+
+#endif // COMPILER(GCC) && PLATFORM(X86)
+
+#else // USE(JSVALUE32_64)
+
 #if COMPILER(GCC) && PLATFORM(X86)
 
 // These ASSERTs remind you that, if you change the layout of JITStackFrame, you
@@ -96,7 +335,6 @@ COMPILE_ASSERT(offsetof(struct JITStackFrame, savedEBX) == 0x1c, JITStackFrame_s
 
 asm volatile (
 ".globl " SYMBOL_STRING(ctiTrampoline) "\n"
-HIDE_SYMBOL(ctiTrampoline) "\n"
 SYMBOL_STRING(ctiTrampoline) ":" "\n"
     "pushl %ebp" "\n"
     "movl %esp, %ebp" "\n"
@@ -117,7 +355,6 @@ SYMBOL_STRING(ctiTrampoline) ":" "\n"
 
 asm volatile (
 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
-HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
 #if !USE(JIT_STUB_ARGUMENT_VA_LIST)
     "movl %esp, %ecx" "\n"
@@ -133,7 +370,6 @@ SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     
 asm volatile (
 ".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
-HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
 SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "addl $0x1c, %esp" "\n"
     "popl %ebx" "\n"
@@ -151,13 +387,12 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
 
 // These ASSERTs remind you that, if you change the layout of JITStackFrame, you
 // need to change the assembly trampolines below to match.
-COMPILE_ASSERT(offsetof(struct JITStackFrame, callFrame) == 0x90, JITStackFrame_callFrame_offset_matches_ctiTrampoline);
-COMPILE_ASSERT(offsetof(struct JITStackFrame, code) == 0x80, JITStackFrame_code_offset_matches_ctiTrampoline);
-COMPILE_ASSERT(offsetof(struct JITStackFrame, savedRBX) == 0x48, JITStackFrame_stub_argument_space_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, callFrame) == 0x58, JITStackFrame_callFrame_offset_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, code) == 0x48, JITStackFrame_code_offset_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, savedRBX) == 0x78, JITStackFrame_stub_argument_space_matches_ctiTrampoline);
 
 asm volatile (
 ".globl " SYMBOL_STRING(ctiTrampoline) "\n"
-HIDE_SYMBOL(ctiTrampoline) "\n"
 SYMBOL_STRING(ctiTrampoline) ":" "\n"
     "pushq %rbp" "\n"
     "movq %rsp, %rbp" "\n"
@@ -166,13 +401,20 @@ SYMBOL_STRING(ctiTrampoline) ":" "\n"
     "pushq %r14" "\n"
     "pushq %r15" "\n"
     "pushq %rbx" "\n"
+    // Form the JIT stubs area
+    "pushq %r9" "\n"
+    "pushq %r8" "\n"
+    "pushq %rcx" "\n"
+    "pushq %rdx" "\n"
+    "pushq %rsi" "\n"
+    "pushq %rdi" "\n"
     "subq $0x48, %rsp" "\n"
     "movq $512, %r12" "\n"
     "movq $0xFFFF000000000000, %r14" "\n"
     "movq $0xFFFF000000000002, %r15" "\n"
-    "movq 0x90(%rsp), %r13" "\n"
-    "call *0x80(%rsp)" "\n"
-    "addq $0x48, %rsp" "\n"
+    "movq %rdx, %r13" "\n"
+    "call *%rdi" "\n"
+    "addq $0x78, %rsp" "\n"
     "popq %rbx" "\n"
     "popq %r15" "\n"
     "popq %r14" "\n"
@@ -184,11 +426,10 @@ SYMBOL_STRING(ctiTrampoline) ":" "\n"
 
 asm volatile (
 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
-HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "movq %rsp, %rdi" "\n"
     "call " SYMBOL_STRING(cti_vm_throw) "\n"
-    "addq $0x48, %rsp" "\n"
+    "addq $0x78, %rsp" "\n"
     "popq %rbx" "\n"
     "popq %r15" "\n"
     "popq %r14" "\n"
@@ -200,9 +441,8 @@ SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
 
 asm volatile (
 ".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
-HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
 SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
-    "addq $0x48, %rsp" "\n"
+    "addq $0x78, %rsp" "\n"
     "popq %rbx" "\n"
     "popq %r15" "\n"
     "popq %r14" "\n"
@@ -222,7 +462,6 @@ asm volatile (
 ".text" "\n"
 ".align 2" "\n"
 ".globl " SYMBOL_STRING(ctiTrampoline) "\n"
-HIDE_SYMBOL(ctiTrampoline) "\n"
 ".thumb" "\n"
 ".thumb_func " SYMBOL_STRING(ctiTrampoline) "\n"
 SYMBOL_STRING(ctiTrampoline) ":" "\n"
@@ -249,7 +488,6 @@ asm volatile (
 ".text" "\n"
 ".align 2" "\n"
 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
-HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
 ".thumb" "\n"
 ".thumb_func " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
@@ -267,7 +505,6 @@ asm volatile (
 ".text" "\n"
 ".align 2" "\n"
 ".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
-HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
 ".thumb" "\n"
 ".thumb_func " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
 SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
@@ -279,6 +516,49 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "bx lr" "\n"
 );
 
+#elif COMPILER(GCC) && PLATFORM(ARM)
+
+asm volatile (
+".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+SYMBOL_STRING(ctiTrampoline) ":" "\n"
+    "stmdb sp!, {r1-r3}" "\n"
+    "stmdb sp!, {r4-r8, lr}" "\n"
+    "mov r6, pc" "\n"
+    "add r6, r6, #40" "\n"
+    "sub sp, sp, #32" "\n"
+    "ldr r4, [sp, #60]" "\n"
+    "mov r5, #512" "\n"
+    // r0 contains the code
+    "add r8, pc, #4" "\n"
+    "str r8, [sp, #-4]!" "\n"
+    "mov pc, r0" "\n"
+    "add sp, sp, #32" "\n"
+    "ldmia sp!, {r4-r8, lr}" "\n"
+    "add sp, sp, #12" "\n"
+    "mov pc, lr" "\n"
+
+    // the return instruction
+    "ldr pc, [sp], #4" "\n"
+);
+
+asm volatile (
+".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
+    "mov r0, sp" "\n"
+    "mov lr, r6" "\n"
+    "add r8, pc, #4" "\n"
+    "str r8, [sp, #-4]!" "\n"
+    "b " SYMBOL_STRING(cti_vm_throw) "\n"
+
+// Both has the same return sequence
+".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
+    "add sp, sp, #32" "\n"
+    "ldmia sp!, {r4-r8, lr}" "\n"
+    "add sp, sp, #12" "\n"
+    "mov pc, lr" "\n"
+);
+
 #elif COMPILER(MSVC)
 
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
@@ -319,7 +599,7 @@ extern "C" {
     {
         __asm {
             mov ecx, esp;
-            call JITStubs::cti_vm_throw;
+            call cti_vm_throw;
             add esp, 0x1c;
             pop ebx;
             pop edi;
@@ -342,7 +622,9 @@ extern "C" {
      }
 }
 
-#endif
+#endif // COMPILER(GCC) && PLATFORM(X86)
+
+#endif // USE(JSVALUE32_64)
 
 #if ENABLE(OPCODE_SAMPLING)
     #define CTI_SAMPLER stackFrame.globalData->interpreter->sampler()
@@ -352,7 +634,7 @@ extern "C" {
 
 JITThunks::JITThunks(JSGlobalData* globalData)
 {
-    JIT::compileCTIMachineTrampolines(globalData, &m_executablePool, &m_ctiArrayLengthTrampoline, &m_ctiStringLengthTrampoline, &m_ctiVirtualCallPreLink, &m_ctiVirtualCallLink, &m_ctiVirtualCall, &m_ctiNativeCallThunk);
+    JIT::compileCTIMachineTrampolines(globalData, &m_executablePool, &m_ctiStringLengthTrampoline, &m_ctiVirtualCallLink, &m_ctiVirtualCall, &m_ctiNativeCallThunk);
 
 #if PLATFORM_ARM_ARCH(7)
     // Unfortunate the arm compiler does not like the use of offsetof on JITStackFrame (since it contains non POD types),
@@ -375,7 +657,7 @@ JITThunks::JITThunks(JSGlobalData* globalData)
 
 #if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
 
-NEVER_INLINE void JITThunks::tryCachePutByID(CallFrame* callFrame, CodeBlock* codeBlock, ReturnAddressPtr returnAddress, JSValue baseValue, const PutPropertySlot& slot)
+NEVER_INLINE void JITThunks::tryCachePutByID(CallFrame* callFrame, CodeBlock* codeBlock, ReturnAddressPtr returnAddress, JSValue baseValue, const PutPropertySlot& slot, StructureStubInfo* stubInfo)
 {
     // The interpreter checks for recursion here; I do not believe this can occur in CTI.
 
@@ -384,7 +666,7 @@ NEVER_INLINE void JITThunks::tryCachePutByID(CallFrame* callFrame, CodeBlock* co
 
     // Uncacheable: give up.
     if (!slot.isCacheable()) {
-        ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(JITStubs::cti_op_put_by_id_generic));
+        ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_put_by_id_generic));
         return;
     }
     
@@ -392,25 +674,23 @@ NEVER_INLINE void JITThunks::tryCachePutByID(CallFrame* callFrame, CodeBlock* co
     Structure* structure = baseCell->structure();
 
     if (structure->isDictionary()) {
-        ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(JITStubs::cti_op_put_by_id_generic));
+        ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_put_by_id_generic));
         return;
     }
 
     // If baseCell != base, then baseCell must be a proxy for another object.
     if (baseCell != slot.base()) {
-        ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(JITStubs::cti_op_put_by_id_generic));
+        ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_put_by_id_generic));
         return;
     }
 
-    StructureStubInfo* stubInfo = &codeBlock->getStubInfo(returnAddress);
-
     // Cache hit: Specialize instruction and ref Structures.
 
     // Structure transition, cache transition info
     if (slot.type() == PutPropertySlot::NewProperty) {
         StructureChain* prototypeChain = structure->prototypeChain(callFrame);
         if (!prototypeChain->isCacheable()) {
-            ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(JITStubs::cti_op_put_by_id_generic));
+            ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_put_by_id_generic));
             return;
         }
         stubInfo->initPutByIdTransition(structure->previousID(), structure, prototypeChain);
@@ -423,14 +703,14 @@ NEVER_INLINE void JITThunks::tryCachePutByID(CallFrame* callFrame, CodeBlock* co
     JIT::patchPutByIdReplace(codeBlock, stubInfo, structure, slot.cachedOffset(), returnAddress);
 }
 
-NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* codeBlock, ReturnAddressPtr returnAddress, JSValue baseValue, const Identifier& propertyName, const PropertySlot& slot)
+NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* codeBlock, ReturnAddressPtr returnAddress, JSValue baseValue, const Identifier& propertyName, const PropertySlot& slot, StructureStubInfo* stubInfo)
 {
     // FIXME: Write a test that proves we need to check for recursion here just
     // like the interpreter does, then add a check for recursion.
 
     // FIXME: Cache property access for immediates.
     if (!baseValue.isCell()) {
-        ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(JITStubs::cti_op_get_by_id_generic));
+        ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_get_by_id_generic));
         return;
     }
     
@@ -450,7 +730,7 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
 
     // Uncacheable: give up.
     if (!slot.isCacheable()) {
-        ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(JITStubs::cti_op_get_by_id_generic));
+        ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_get_by_id_generic));
         return;
     }
 
@@ -458,15 +738,10 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
     Structure* structure = baseCell->structure();
 
     if (structure->isDictionary()) {
-        ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(JITStubs::cti_op_get_by_id_generic));
+        ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_get_by_id_generic));
         return;
     }
 
-    // In the interpreter the last structure is trapped here; in CTI we use the
-    // *_second method to achieve a similar (but not quite the same) effect.
-
-    StructureStubInfo* stubInfo = &codeBlock->getStubInfo(returnAddress);
-
     // Cache hit: Specialize instruction and ref Structures.
 
     if (slot.slotBase() == baseValue) {
@@ -495,20 +770,20 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
 
     size_t count = countPrototypeChainEntriesAndCheckForProxies(callFrame, baseValue, slot);
     if (!count) {
-        stubInfo->opcodeID = op_get_by_id_generic;
+        stubInfo->accessType = access_get_by_id_generic;
         return;
     }
 
     StructureChain* prototypeChain = structure->prototypeChain(callFrame);
     if (!prototypeChain->isCacheable()) {
-        ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(JITStubs::cti_op_get_by_id_generic));
+        ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_get_by_id_generic));
         return;
     }
     stubInfo->initGetByIdChain(structure, prototypeChain);
     JIT::compileGetByIdChain(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, prototypeChain, count, slot.cachedOffset(), returnAddress);
 }
 
-#endif
+#endif // ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
 
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
 #define SETUP_VA_LISTL_ARGS va_list vl_args; va_start(vl_args, args)
@@ -585,24 +860,22 @@ static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalD
 
 #define CHECK_FOR_EXCEPTION() \
     do { \
-        if (UNLIKELY(stackFrame.globalData->exception != JSValue())) \
+        if (UNLIKELY(stackFrame.globalData->exception)) \
             VM_THROW_EXCEPTION(); \
     } while (0)
 #define CHECK_FOR_EXCEPTION_AT_END() \
     do { \
-        if (UNLIKELY(stackFrame.globalData->exception != JSValue())) \
+        if (UNLIKELY(stackFrame.globalData->exception)) \
             VM_THROW_EXCEPTION_AT_END(); \
     } while (0)
 #define CHECK_FOR_EXCEPTION_VOID() \
     do { \
-        if (UNLIKELY(stackFrame.globalData->exception != JSValue())) { \
+        if (UNLIKELY(stackFrame.globalData->exception)) { \
             VM_THROW_EXCEPTION_AT_END(); \
             return; \
         } \
     } while (0)
 
-namespace JITStubs {
-
 #if PLATFORM_ARM_ARCH(7)
 
 #define DEFINE_STUB_FUNCTION(rtype, op) \
@@ -613,7 +886,6 @@ namespace JITStubs {
         ".text" "\n" \
         ".align 2" "\n" \
         ".globl " SYMBOL_STRING(cti_##op) "\n" \
-        HIDE_SYMBOL(cti_##op) "\n"             \
         ".thumb" "\n" \
         ".thumb_func " SYMBOL_STRING(cti_##op) "\n" \
         SYMBOL_STRING(cti_##op) ":" "\n" \
@@ -628,7 +900,7 @@ namespace JITStubs {
 #define DEFINE_STUB_FUNCTION(rtype, op) rtype JIT_STUB cti_##op(STUB_ARGS_DECLARATION)
 #endif
 
-DEFINE_STUB_FUNCTION(JSObject*, op_convert_this)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_convert_this)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
@@ -637,7 +909,7 @@ DEFINE_STUB_FUNCTION(JSObject*, op_convert_this)
 
     JSObject* result = v1.toThisObject(callFrame);
     CHECK_FOR_EXCEPTION_AT_END();
-    return result;
+    return JSValue::encode(result);
 }
 
 DEFINE_STUB_FUNCTION(void, op_end)
@@ -677,8 +949,8 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_add)
     }
 
     if (rightIsNumber & leftIsString) {
-        RefPtr<UString::Rep> value = v2.isInt32Fast() ?
-            concatenate(asString(v1)->value().rep(), v2.getInt32Fast()) :
+        RefPtr<UString::Rep> value = v2.isInt32() ?
+            concatenate(asString(v1)->value().rep(), v2.asInt32()) :
             concatenate(asString(v1)->value().rep(), right);
 
         if (UNLIKELY(!value)) {
@@ -711,14 +983,14 @@ DEFINE_STUB_FUNCTION(int, timeout_check)
     STUB_INIT_STACK_FRAME(stackFrame);
     
     JSGlobalData* globalData = stackFrame.globalData;
-    TimeoutChecker* timeoutChecker = globalData->timeoutChecker;
+    TimeoutChecker& timeoutChecker = globalData->timeoutChecker;
 
-    if (timeoutChecker->didTimeOut(stackFrame.callFrame)) {
+    if (timeoutChecker.didTimeOut(stackFrame.callFrame)) {
         globalData->exception = createInterruptedExecutionException(globalData);
         VM_THROW_EXCEPTION_AT_END();
     }
     
-    return timeoutChecker->ticksUntilNextCheck();
+    return timeoutChecker.ticksUntilNextCheck();
 }
 
 DEFINE_STUB_FUNCTION(void, register_file_check)
@@ -797,28 +1069,22 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_generic)
 DEFINE_STUB_FUNCTION(void, op_put_by_id)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
-
     CallFrame* callFrame = stackFrame.callFrame;
     Identifier& ident = stackFrame.args[1].identifier();
 
     PutPropertySlot slot;
     stackFrame.args[0].jsValue().put(callFrame, ident, stackFrame.args[2].jsValue(), slot);
 
-    ctiPatchCallByReturnAddress(callFrame->codeBlock(), STUB_RETURN_ADDRESS, FunctionPtr(cti_op_put_by_id_second));
+    CodeBlock* codeBlock = stackFrame.callFrame->codeBlock();
+    StructureStubInfo* stubInfo = &codeBlock->getStubInfo(STUB_RETURN_ADDRESS);
+    if (!stubInfo->seenOnce())
+        stubInfo->setSeen();
+    else
+        JITThunks::tryCachePutByID(callFrame, codeBlock, STUB_RETURN_ADDRESS, stackFrame.args[0].jsValue(), slot, stubInfo);
 
     CHECK_FOR_EXCEPTION_AT_END();
 }
 
-DEFINE_STUB_FUNCTION(void, op_put_by_id_second)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    PutPropertySlot slot;
-    stackFrame.args[0].jsValue().put(stackFrame.callFrame, stackFrame.args[1].identifier(), stackFrame.args[2].jsValue(), slot);
-    JITThunks::tryCachePutByID(stackFrame.callFrame, stackFrame.callFrame->codeBlock(), STUB_RETURN_ADDRESS, stackFrame.args[0].jsValue(), slot);
-    CHECK_FOR_EXCEPTION_AT_END();
-}
-
 DEFINE_STUB_FUNCTION(void, op_put_by_id_fail)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
@@ -832,36 +1098,19 @@ DEFINE_STUB_FUNCTION(void, op_put_by_id_fail)
     CHECK_FOR_EXCEPTION_AT_END();
 }
 
-
-DEFINE_STUB_FUNCTION(EncodedJSValue, op_put_by_id_transition_realloc)
+DEFINE_STUB_FUNCTION(JSObject*, op_put_by_id_transition_realloc)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
     JSValue baseValue = stackFrame.args[0].jsValue();
-    int32_t oldSize = stackFrame.args[1].int32();
-    int32_t newSize = stackFrame.args[2].int32();
+    int32_t oldSize = stackFrame.args[3].int32();
+    int32_t newSize = stackFrame.args[4].int32();
 
     ASSERT(baseValue.isObject());
-    asObject(baseValue)->allocatePropertyStorage(oldSize, newSize);
+    JSObject* base = asObject(baseValue);
+    base->allocatePropertyStorage(oldSize, newSize);
 
-    return JSValue::encode(baseValue);
-}
-
-DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    CallFrame* callFrame = stackFrame.callFrame;
-    Identifier& ident = stackFrame.args[1].identifier();
-
-    JSValue baseValue = stackFrame.args[0].jsValue();
-    PropertySlot slot(baseValue);
-    JSValue result = baseValue.get(callFrame, ident, slot);
-
-    ctiPatchCallByReturnAddress(callFrame->codeBlock(), STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_second));
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValue::encode(result);
+    return base;
 }
 
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check)
@@ -874,25 +1123,15 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check)
     JSValue baseValue = stackFrame.args[0].jsValue();
     PropertySlot slot(baseValue);
     JSValue result = baseValue.get(callFrame, ident, slot);
+    CHECK_FOR_EXCEPTION();
 
-    ctiPatchCallByReturnAddress(callFrame->codeBlock(), STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_method_check_second));
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValue::encode(result);
-}
-
-DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check_second)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    CallFrame* callFrame = stackFrame.callFrame;
-    Identifier& ident = stackFrame.args[1].identifier();
-
-    JSValue baseValue = stackFrame.args[0].jsValue();
-    PropertySlot slot(baseValue);
-    JSValue result = baseValue.get(callFrame, ident, slot);
+    CodeBlock* codeBlock = stackFrame.callFrame->codeBlock();
+    MethodCallLinkInfo& methodCallLinkInfo = codeBlock->getMethodCallLinkInfo(STUB_RETURN_ADDRESS);
 
-    CHECK_FOR_EXCEPTION();
+    if (!methodCallLinkInfo.seenOnce()) {
+        methodCallLinkInfo.setSeen();
+        return JSValue::encode(result);
+    }
 
     // If we successfully got something, then the base from which it is being accessed must
     // be an object.  (Assertion to ensure asObject() call below is safe, which comes after
@@ -923,33 +1162,33 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check_second)
 
         // The result fetched should always be the callee!
         ASSERT(result == JSValue(callee));
-        MethodCallLinkInfo& methodCallLinkInfo = callFrame->codeBlock()->getMethodCallLinkInfo(STUB_RETURN_ADDRESS);
 
         // Check to see if the function is on the object's prototype.  Patch up the code to optimize.
-        if (slot.slotBase() == structure->prototypeForLookup(callFrame))
-            JIT::patchMethodCallProto(callFrame->codeBlock(), methodCallLinkInfo, callee, structure, slotBaseObject);
+        if (slot.slotBase() == structure->prototypeForLookup(callFrame)) {
+            JIT::patchMethodCallProto(codeBlock, methodCallLinkInfo, callee, structure, slotBaseObject, STUB_RETURN_ADDRESS);
+            return JSValue::encode(result);
+        }
+
         // Check to see if the function is on the object itself.
         // Since we generate the method-check to check both the structure and a prototype-structure (since this
         // is the common case) we have a problem - we need to patch the prototype structure check to do something
         // useful.  We could try to nop it out altogether, but that's a little messy, so lets do something simpler
         // for now.  For now it performs a check on a special object on the global object only used for this
         // purpose.  The object is in no way exposed, and as such the check will always pass.
-        else if (slot.slotBase() == baseValue)
-            JIT::patchMethodCallProto(callFrame->codeBlock(), methodCallLinkInfo, callee, structure, callFrame->scopeChain()->globalObject()->methodCallDummy());
-
-        // For now let any other case be cached as a normal get_by_id.
+        if (slot.slotBase() == baseValue) {
+            JIT::patchMethodCallProto(codeBlock, methodCallLinkInfo, callee, structure, callFrame->scopeChain()->globalObject()->methodCallDummy(), STUB_RETURN_ADDRESS);
+            return JSValue::encode(result);
+        }
     }
 
     // Revert the get_by_id op back to being a regular get_by_id - allow it to cache like normal, if it needs to.
-    ctiPatchCallByReturnAddress(callFrame->codeBlock(), STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id));
-
+    ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id));
     return JSValue::encode(result);
 }
 
-DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_second)
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
-
     CallFrame* callFrame = stackFrame.callFrame;
     Identifier& ident = stackFrame.args[1].identifier();
 
@@ -957,7 +1196,12 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_second)
     PropertySlot slot(baseValue);
     JSValue result = baseValue.get(callFrame, ident, slot);
 
-    JITThunks::tryCacheGetByID(callFrame, callFrame->codeBlock(), STUB_RETURN_ADDRESS, baseValue, ident, slot);
+    CodeBlock* codeBlock = stackFrame.callFrame->codeBlock();
+    StructureStubInfo* stubInfo = &codeBlock->getStubInfo(STUB_RETURN_ADDRESS);
+    if (!stubInfo->seenOnce())
+        stubInfo->setSeen();
+    else
+        JITThunks::tryCacheGetByID(callFrame, codeBlock, STUB_RETURN_ADDRESS, baseValue, ident, slot, stubInfo);
 
     CHECK_FOR_EXCEPTION_AT_END();
     return JSValue::encode(result);
@@ -989,7 +1233,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_self_fail)
         PolymorphicAccessStructureList* polymorphicStructureList;
         int listIndex = 1;
 
-        if (stubInfo->opcodeID == op_get_by_id_self) {
+        if (stubInfo->accessType == access_get_by_id_self) {
             ASSERT(!stubInfo->stubRoutine);
             polymorphicStructureList = new PolymorphicAccessStructureList(CodeLocationLabel(), stubInfo->u.getByIdSelf.baseObjectStructure);
             stubInfo->initGetByIdSelfList(polymorphicStructureList, 2);
@@ -1013,18 +1257,18 @@ static PolymorphicAccessStructureList* getPolymorphicAccessStructureListSlot(Str
     PolymorphicAccessStructureList* prototypeStructureList = 0;
     listIndex = 1;
 
-    switch (stubInfo->opcodeID) {
-    case op_get_by_id_proto:
+    switch (stubInfo->accessType) {
+    case access_get_by_id_proto:
         prototypeStructureList = new PolymorphicAccessStructureList(stubInfo->stubRoutine, stubInfo->u.getByIdProto.baseObjectStructure, stubInfo->u.getByIdProto.prototypeStructure);
         stubInfo->stubRoutine = CodeLocationLabel();
         stubInfo->initGetByIdProtoList(prototypeStructureList, 2);
         break;
-    case op_get_by_id_chain:
+    case access_get_by_id_chain:
         prototypeStructureList = new PolymorphicAccessStructureList(stubInfo->stubRoutine, stubInfo->u.getByIdChain.baseObjectStructure, stubInfo->u.getByIdChain.chain);
         stubInfo->stubRoutine = CodeLocationLabel();
         stubInfo->initGetByIdProtoList(prototypeStructureList, 2);
         break;
-    case op_get_by_id_proto_list:
+    case access_get_by_id_proto_list:
         prototypeStructureList = stubInfo->u.getByIdProtoList.structureList;
         listIndex = stubInfo->u.getByIdProtoList.listSize;
         stubInfo->u.getByIdProtoList.listSize++;
@@ -1143,7 +1387,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_string_fail)
     return JSValue::encode(result);
 }
 
-#endif
+#endif // ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
 
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_instanceof)
 {
@@ -1223,7 +1467,7 @@ DEFINE_STUB_FUNCTION(JSObject*, op_new_func)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
-    return stackFrame.args[0].funcDeclNode()->makeFunction(stackFrame.callFrame, stackFrame.callFrame->scopeChain());
+    return stackFrame.args[0].function()->make(stackFrame.callFrame, stackFrame.callFrame->scopeChain());
 }
 
 DEFINE_STUB_FUNCTION(void*, op_call_JSFunction)
@@ -1237,11 +1481,11 @@ DEFINE_STUB_FUNCTION(void*, op_call_JSFunction)
 
     JSFunction* function = asFunction(stackFrame.args[0].jsValue());
     ASSERT(!function->isHostFunction());
-    FunctionBodyNode* body = function->body();
+    FunctionExecutable* executable = function->jsExecutable();
     ScopeChainNode* callDataScopeChain = function->scope().node();
-    body->jitCode(callDataScopeChain);
+    executable->jitCode(stackFrame.callFrame, callDataScopeChain);
 
-    return &(body->generatedBytecode());
+    return function;
 }
 
 DEFINE_STUB_FUNCTION(VoidPtrPair, op_call_arityCheck)
@@ -1249,8 +1493,9 @@ DEFINE_STUB_FUNCTION(VoidPtrPair, op_call_arityCheck)
     STUB_INIT_STACK_FRAME(stackFrame);
 
     CallFrame* callFrame = stackFrame.callFrame;
-    CodeBlock* newCodeBlock = stackFrame.args[3].codeBlock();
-    ASSERT(newCodeBlock->codeType() != NativeCode);
+    JSFunction* callee = asFunction(stackFrame.args[0].jsValue());
+    ASSERT(!callee->isHostFunction());
+    CodeBlock* newCodeBlock = &callee->jsExecutable()->generatedBytecode();
     int argCount = stackFrame.args[2].int32();
 
     ASSERT(argCount != newCodeBlock->m_numParameters);
@@ -1287,45 +1532,36 @@ DEFINE_STUB_FUNCTION(VoidPtrPair, op_call_arityCheck)
         callFrame->setCallerFrame(oldCallFrame);
     }
 
-    RETURN_POINTER_PAIR(newCodeBlock, callFrame);
-}
-
-DEFINE_STUB_FUNCTION(void*, vm_dontLazyLinkCall)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    JSGlobalData* globalData = stackFrame.globalData;
-    JSFunction* callee = asFunction(stackFrame.args[0].jsValue());
-
-    ctiPatchNearCallByReturnAddress(stackFrame.callFrame->callerFrame()->codeBlock(), stackFrame.args[1].returnAddress(), globalData->jitStubs.ctiVirtualCallLink());
-
-    return callee->body()->generatedJITCode().addressForCall().executableAddress();
+    RETURN_POINTER_PAIR(callee, callFrame);
 }
 
+#if ENABLE(JIT_OPTIMIZE_CALL)
 DEFINE_STUB_FUNCTION(void*, vm_lazyLinkCall)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
-
     JSFunction* callee = asFunction(stackFrame.args[0].jsValue());
-    JITCode& jitCode = callee->body()->generatedJITCode();
+    ExecutableBase* executable = callee->executable();
+    JITCode& jitCode = executable->generatedJITCode();
     
     CodeBlock* codeBlock = 0;
-    if (!callee->isHostFunction())
-        codeBlock = &callee->body()->bytecode(callee->scope().node());
-    else
-        codeBlock = &callee->body()->generatedBytecode();
-
+    if (!executable->isHostFunction())
+        codeBlock = &static_cast<FunctionExecutable*>(executable)->bytecode(stackFrame.callFrame, callee->scope().node());
     CallLinkInfo* callLinkInfo = &stackFrame.callFrame->callerFrame()->codeBlock()->getCallLinkInfo(stackFrame.args[1].returnAddress());
-    JIT::linkCall(callee, stackFrame.callFrame->callerFrame()->codeBlock(), codeBlock, jitCode, callLinkInfo, stackFrame.args[2].int32(), stackFrame.globalData);
+
+    if (!callLinkInfo->seenOnce())
+        callLinkInfo->setSeen();
+    else
+        JIT::linkCall(callee, stackFrame.callFrame->callerFrame()->codeBlock(), codeBlock, jitCode, callLinkInfo, stackFrame.args[2].int32(), stackFrame.globalData);
 
     return jitCode.addressForCall().executableAddress();
 }
+#endif // !ENABLE(JIT_OPTIMIZE_CALL)
 
 DEFINE_STUB_FUNCTION(JSObject*, op_push_activation)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSActivation* activation = new (stackFrame.globalData) JSActivation(stackFrame.callFrame, static_cast<FunctionBodyNode*>(stackFrame.callFrame->codeBlock()->ownerNode()));
+    JSActivation* activation = new (stackFrame.globalData) JSActivation(stackFrame.callFrame, static_cast<FunctionExecutable*>(stackFrame.callFrame->codeBlock()->ownerExecutable()));
     stackFrame.callFrame->setScopeChain(stackFrame.callFrame->scopeChain()->copy()->push(activation));
     return activation;
 }
@@ -1385,7 +1621,7 @@ DEFINE_STUB_FUNCTION(void, op_create_arguments)
 
     Arguments* arguments = new (stackFrame.globalData) Arguments(stackFrame.callFrame);
     stackFrame.callFrame->setCalleeArguments(arguments);
-    stackFrame.callFrame[RegisterFile::ArgumentsRegister] = arguments;
+    stackFrame.callFrame[RegisterFile::ArgumentsRegister] = JSValue(arguments);
 }
 
 DEFINE_STUB_FUNCTION(void, op_create_arguments_no_params)
@@ -1394,7 +1630,7 @@ DEFINE_STUB_FUNCTION(void, op_create_arguments_no_params)
 
     Arguments* arguments = new (stackFrame.globalData) Arguments(stackFrame.callFrame, Arguments::NoParameters);
     stackFrame.callFrame->setCalleeArguments(arguments);
-    stackFrame.callFrame[RegisterFile::ArgumentsRegister] = arguments;
+    stackFrame.callFrame[RegisterFile::ArgumentsRegister] = JSValue(arguments);
 }
 
 DEFINE_STUB_FUNCTION(void, op_tear_off_activation)
@@ -1497,11 +1733,7 @@ DEFINE_STUB_FUNCTION(JSObject*, op_construct_JSConstruct)
         structure = asObject(stackFrame.args[3].jsValue())->inheritorID();
     else
         structure = constructor->scope().node()->globalObject()->emptyObjectStructure();
-#ifdef QT_BUILD_SCRIPT_LIB
-    return new (stackFrame.globalData) QScriptObject(structure);
-#else
     return new (stackFrame.globalData) JSObject(structure);
-#endif
 }
 
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_construct_NotJSConstruct)
@@ -1550,8 +1782,8 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_val)
 
     JSValue result;
 
-    if (LIKELY(subscript.isUInt32Fast())) {
-        uint32_t i = subscript.getUInt32Fast();
+    if (LIKELY(subscript.isUInt32())) {
+        uint32_t i = subscript.asUInt32();
         if (isJSArray(globalData, baseValue)) {
             JSArray* jsArray = asArray(baseValue);
             if (jsArray->canGetIndex(i))
@@ -1589,8 +1821,8 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_val_string)
     
     JSValue result;
     
-    if (LIKELY(subscript.isUInt32Fast())) {
-        uint32_t i = subscript.getUInt32Fast();
+    if (LIKELY(subscript.isUInt32())) {
+        uint32_t i = subscript.asUInt32();
         if (isJSString(globalData, baseValue) && asString(baseValue)->canGetIndex(i))
             result = asString(baseValue)->getIndex(stackFrame.globalData, i);
         else {
@@ -1607,7 +1839,6 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_val_string)
     return JSValue::encode(result);
 }
     
-
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_val_byte_array)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
@@ -1620,8 +1851,8 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_val_byte_array)
     
     JSValue result;
 
-    if (LIKELY(subscript.isUInt32Fast())) {
-        uint32_t i = subscript.getUInt32Fast();
+    if (LIKELY(subscript.isUInt32())) {
+        uint32_t i = subscript.asUInt32();
         if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
             // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
             return JSValue::encode(asByteArray(baseValue)->getIndex(callFrame, i));
@@ -1639,50 +1870,6 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_val_byte_array)
     return JSValue::encode(result);
 }
 
-DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_func)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    CallFrame* callFrame = stackFrame.callFrame;
-    ScopeChainNode* scopeChain = callFrame->scopeChain();
-
-    ScopeChainIterator iter = scopeChain->begin();
-    ScopeChainIterator end = scopeChain->end();
-
-    // FIXME: add scopeDepthIsZero optimization
-
-    ASSERT(iter != end);
-
-    Identifier& ident = stackFrame.args[0].identifier();
-    JSObject* base;
-    do {
-        base = *iter;
-        PropertySlot slot(base);
-        if (base->getPropertySlot(callFrame, ident, slot)) {            
-            // ECMA 11.2.3 says that if we hit an activation the this value should be null.
-            // However, section 10.2.3 says that in the case where the value provided
-            // by the caller is null, the global object should be used. It also says
-            // that the section does not apply to internal functions, but for simplicity
-            // of implementation we use the global object anyway here. This guarantees
-            // that in host objects you always get a valid object for this.
-            // We also handle wrapper substitution for the global object at the same time.
-            JSObject* thisObj = base->toThisObject(callFrame);
-            JSValue result = slot.getValue(callFrame, ident);
-            CHECK_FOR_EXCEPTION_AT_END();
-
-            callFrame->registers()[stackFrame.args[1].int32()] = JSValue(thisObj);
-            return JSValue::encode(result);
-        }
-        ++iter;
-    } while (iter != end);
-
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
-    stackFrame.globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
-    VM_THROW_EXCEPTION_AT_END();
-    return JSValue::encode(JSValue());
-}
-
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_sub)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
@@ -1712,8 +1899,8 @@ DEFINE_STUB_FUNCTION(void, op_put_by_val)
     JSValue subscript = stackFrame.args[1].jsValue();
     JSValue value = stackFrame.args[2].jsValue();
 
-    if (LIKELY(subscript.isUInt32Fast())) {
-        uint32_t i = subscript.getUInt32Fast();
+    if (LIKELY(subscript.isUInt32())) {
+        uint32_t i = subscript.asUInt32();
         if (isJSArray(globalData, baseValue)) {
             JSArray* jsArray = asArray(baseValue);
             if (jsArray->canSetIndex(i))
@@ -1724,8 +1911,8 @@ DEFINE_STUB_FUNCTION(void, op_put_by_val)
             JSByteArray* jsByteArray = asByteArray(baseValue);
             ctiPatchCallByReturnAddress(callFrame->codeBlock(), STUB_RETURN_ADDRESS, FunctionPtr(cti_op_put_by_val_byte_array));
             // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
-            if (value.isInt32Fast()) {
-                jsByteArray->setIndex(i, value.getInt32Fast());
+            if (value.isInt32()) {
+                jsByteArray->setIndex(i, value.asInt32());
                 return;
             } else {
                 double dValue = 0;
@@ -1763,14 +1950,9 @@ DEFINE_STUB_FUNCTION(void, op_put_by_val_array)
     if (LIKELY(i >= 0))
         asArray(baseValue)->JSArray::put(callFrame, i, value);
     else {
-        // This should work since we're re-boxing an immediate unboxed in JIT code.
-        ASSERT(JSValue::makeInt32Fast(i));
-        Identifier property(callFrame, JSValue::makeInt32Fast(i).toString(callFrame));
-        // FIXME: can toString throw an exception here?
-        if (!stackFrame.globalData->exception) { // Don't put to an object if toString threw an exception.
-            PutPropertySlot slot;
-            baseValue.put(callFrame, property, value, slot);
-        }
+        Identifier property(callFrame, UString::from(i));
+        PutPropertySlot slot;
+        baseValue.put(callFrame, property, value, slot);
     }
 
     CHECK_FOR_EXCEPTION_AT_END();
@@ -1787,14 +1969,14 @@ DEFINE_STUB_FUNCTION(void, op_put_by_val_byte_array)
     JSValue subscript = stackFrame.args[1].jsValue();
     JSValue value = stackFrame.args[2].jsValue();
     
-    if (LIKELY(subscript.isUInt32Fast())) {
-        uint32_t i = subscript.getUInt32Fast();
+    if (LIKELY(subscript.isUInt32())) {
+        uint32_t i = subscript.asUInt32();
         if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
             JSByteArray* jsByteArray = asByteArray(baseValue);
             
             // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
-            if (value.isInt32Fast()) {
-                jsByteArray->setIndex(i, value.getInt32Fast());
+            if (value.isInt32()) {
+                jsByteArray->setIndex(i, value.asInt32());
                 return;
             } else {
                 double dValue = 0;                
@@ -1845,6 +2027,7 @@ DEFINE_STUB_FUNCTION(int, op_loop_if_true)
 DEFINE_STUB_FUNCTION(int, op_load_varargs)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
+
     CallFrame* callFrame = stackFrame.callFrame;
     RegisterFile* registerFile = stackFrame.registerFile;
     int argsOffset = stackFrame.args[0].int32();
@@ -1859,7 +2042,7 @@ DEFINE_STUB_FUNCTION(int, op_load_varargs)
             stackFrame.globalData->exception = createStackOverflowError(callFrame);
             VM_THROW_EXCEPTION();
         }
-        int32_t expectedParams = asFunction(callFrame->registers()[RegisterFile::Callee].jsValue())->body()->parameterCount();
+        int32_t expectedParams = callFrame->callee()->jsExecutable()->parameterCount();
         int32_t inplaceArgs = min(providedParams, expectedParams);
         
         Register* inplaceArgsDst = callFrame->registers() + argsOffset;
@@ -1991,7 +2174,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_global)
     STUB_INIT_STACK_FRAME(stackFrame);
 
     CallFrame* callFrame = stackFrame.callFrame;
-    JSGlobalObject* globalObject = asGlobalObject(stackFrame.args[0].jsValue());
+    JSGlobalObject* globalObject = stackFrame.args[0].globalObject();
     Identifier& ident = stackFrame.args[1].identifier();
     unsigned globalResolveInfoIndex = stackFrame.args[2].int32();
     ASSERT(globalObject->isGlobalObject());
@@ -2115,7 +2298,112 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_post_inc)
     return JSValue::encode(number);
 }
 
-DEFINE_STUB_FUNCTION(EncodedJSValue, op_eq)
+#if USE(JSVALUE32_64)
+
+DEFINE_STUB_FUNCTION(int, op_eq)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+
+    start:
+    if (src2.isUndefined()) {
+        return src1.isNull() || 
+               (src1.isCell() && asCell(src1)->structure()->typeInfo().masqueradesAsUndefined()) ||
+               src1.isUndefined();
+    }
+    
+    if (src2.isNull()) {
+        return src1.isUndefined() || 
+               (src1.isCell() && asCell(src1)->structure()->typeInfo().masqueradesAsUndefined()) ||
+               src1.isNull();
+    }
+
+    if (src1.isInt32()) {
+        if (src2.isDouble())
+            return src1.asInt32() == src2.asDouble();
+        double d = src2.toNumber(stackFrame.callFrame);
+        CHECK_FOR_EXCEPTION();
+        return src1.asInt32() == d;
+    }
+
+    if (src1.isDouble()) {
+        if (src2.isInt32())
+            return src1.asDouble() == src2.asInt32();
+        double d = src2.toNumber(stackFrame.callFrame);
+        CHECK_FOR_EXCEPTION();
+        return src1.asDouble() == d;
+    }
+
+    if (src1.isTrue()) {
+        if (src2.isFalse())
+            return false;
+        double d = src2.toNumber(stackFrame.callFrame);
+        CHECK_FOR_EXCEPTION();
+        return d == 1.0;
+    }
+
+    if (src1.isFalse()) {
+        if (src2.isTrue())
+            return false;
+        double d = src2.toNumber(stackFrame.callFrame);
+        CHECK_FOR_EXCEPTION();
+        return d == 0.0;
+    }
+    
+    if (src1.isUndefined())
+        return src2.isCell() && asCell(src2)->structure()->typeInfo().masqueradesAsUndefined();
+    
+    if (src1.isNull())
+        return src2.isCell() && asCell(src2)->structure()->typeInfo().masqueradesAsUndefined();
+
+    JSCell* cell1 = asCell(src1);
+
+    if (cell1->isString()) {
+        if (src2.isInt32())
+            return static_cast<JSString*>(cell1)->value().toDouble() == src2.asInt32();
+            
+        if (src2.isDouble())
+            return static_cast<JSString*>(cell1)->value().toDouble() == src2.asDouble();
+
+        if (src2.isTrue())
+            return static_cast<JSString*>(cell1)->value().toDouble() == 1.0;
+
+        if (src2.isFalse())
+            return static_cast<JSString*>(cell1)->value().toDouble() == 0.0;
+
+        JSCell* cell2 = asCell(src2);
+        if (cell2->isString())
+            return static_cast<JSString*>(cell1)->value() == static_cast<JSString*>(cell2)->value();
+
+        src2 = asObject(cell2)->toPrimitive(stackFrame.callFrame);
+        CHECK_FOR_EXCEPTION();
+        goto start;
+    }
+
+    if (src2.isObject())
+        return asObject(cell1) == asObject(src2);
+    src1 = asObject(cell1)->toPrimitive(stackFrame.callFrame);
+    CHECK_FOR_EXCEPTION();
+    goto start;
+}
+
+DEFINE_STUB_FUNCTION(int, op_eq_strings)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSString* string1 = stackFrame.args[0].jsString();
+    JSString* string2 = stackFrame.args[1].jsString();
+
+    ASSERT(string1->isString());
+    ASSERT(string2->isString());
+    return string1->value() == string2->value();
+}
+
+#else // USE(JSVALUE32_64)
+
+DEFINE_STUB_FUNCTION(int, op_eq)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
@@ -2124,12 +2412,13 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_eq)
 
     CallFrame* callFrame = stackFrame.callFrame;
 
-    ASSERT(!JSValue::areBothInt32Fast(src1, src2));
-    JSValue result = jsBoolean(JSValue::equalSlowCaseInline(callFrame, src1, src2));
+    bool result = JSValue::equalSlowCaseInline(callFrame, src1, src2);
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValue::encode(result);
+    return result;
 }
 
+#endif // USE(JSVALUE32_64)
+
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_lshift)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
@@ -2137,13 +2426,6 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_lshift)
     JSValue val = stackFrame.args[0].jsValue();
     JSValue shift = stackFrame.args[1].jsValue();
 
-    int32_t left;
-    uint32_t right;
-    if (JSValue::areBothInt32Fast(val, shift))
-        return JSValue::encode(jsNumber(stackFrame.globalData, val.getInt32Fast() << (shift.getInt32Fast() & 0x1f)));
-    if (val.numberToInt32(left) && shift.numberToUInt32(right))
-        return JSValue::encode(jsNumber(stackFrame.globalData, left << (right & 0x1f)));
-
     CallFrame* callFrame = stackFrame.callFrame;
     JSValue result = jsNumber(stackFrame.globalData, (val.toInt32(callFrame)) << (shift.toUInt32(callFrame) & 0x1f));
     CHECK_FOR_EXCEPTION_AT_END();
@@ -2157,11 +2439,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_bitand)
     JSValue src1 = stackFrame.args[0].jsValue();
     JSValue src2 = stackFrame.args[1].jsValue();
 
-    int32_t left;
-    int32_t right;
-    if (src1.numberToInt32(left) && src2.numberToInt32(right))
-        return JSValue::encode(jsNumber(stackFrame.globalData, left & right));
-
+    ASSERT(!src1.isInt32() || !src2.isInt32());
     CallFrame* callFrame = stackFrame.callFrame;
     JSValue result = jsNumber(stackFrame.globalData, src1.toInt32(callFrame) & src2.toInt32(callFrame));
     CHECK_FOR_EXCEPTION_AT_END();
@@ -2175,15 +2453,9 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_rshift)
     JSValue val = stackFrame.args[0].jsValue();
     JSValue shift = stackFrame.args[1].jsValue();
 
-    int32_t left;
-    uint32_t right;
-    if (JSFastMath::canDoFastRshift(val, shift))
-        return JSValue::encode(JSFastMath::rightShiftImmediateNumbers(val, shift));
-    if (val.numberToInt32(left) && shift.numberToUInt32(right))
-        return JSValue::encode(jsNumber(stackFrame.globalData, left >> (right & 0x1f)));
-
     CallFrame* callFrame = stackFrame.callFrame;
     JSValue result = jsNumber(stackFrame.globalData, (val.toInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
+
     CHECK_FOR_EXCEPTION_AT_END();
     return JSValue::encode(result);
 }
@@ -2194,10 +2466,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_bitnot)
 
     JSValue src = stackFrame.args[0].jsValue();
 
-    int value;
-    if (src.numberToInt32(value))
-        return JSValue::encode(jsNumber(stackFrame.globalData, ~value));
-
+    ASSERT(!src.isInt32());
     CallFrame* callFrame = stackFrame.callFrame;
     JSValue result = jsNumber(stackFrame.globalData, ~src.toInt32(callFrame));
     CHECK_FOR_EXCEPTION_AT_END();
@@ -2243,8 +2512,24 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_with_base)
 DEFINE_STUB_FUNCTION(JSObject*, op_new_func_exp)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    FunctionExecutable* function = stackFrame.args[0].function();
+    JSFunction* func = function->make(callFrame, callFrame->scopeChain());
 
-    return stackFrame.args[0].funcExprNode()->makeFunction(stackFrame.callFrame, stackFrame.callFrame->scopeChain());
+    /* 
+        The Identifier in a FunctionExpression can be referenced from inside
+        the FunctionExpression's FunctionBody to allow the function to call
+        itself recursively. However, unlike in a FunctionDeclaration, the
+        Identifier in a FunctionExpression cannot be referenced from and
+        does not affect the scope enclosing the FunctionExpression.
+     */
+    if (!function->name().isNull()) {
+        JSStaticScopeObject* functionScopeObject = new (callFrame) JSStaticScopeObject(callFrame, function->name(), func, ReadOnly | DontDelete);
+        func->scope().push(functionScopeObject);
+    }
+
+    return func;
 }
 
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_mod)
@@ -2271,21 +2556,6 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_less)
     return JSValue::encode(result);
 }
 
-DEFINE_STUB_FUNCTION(EncodedJSValue, op_neq)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    JSValue src1 = stackFrame.args[0].jsValue();
-    JSValue src2 = stackFrame.args[1].jsValue();
-
-    ASSERT(!JSValue::areBothInt32Fast(src1, src2));
-
-    CallFrame* callFrame = stackFrame.callFrame;
-    JSValue result = jsBoolean(!JSValue::equalSlowCaseInline(callFrame, src1, src2));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValue::encode(result);
-}
-
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_post_dec)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
@@ -2309,14 +2579,9 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_urshift)
     JSValue shift = stackFrame.args[1].jsValue();
 
     CallFrame* callFrame = stackFrame.callFrame;
-
-    if (JSFastMath::canDoFastUrshift(val, shift))
-        return JSValue::encode(JSFastMath::rightShiftImmediateNumbers(val, shift));
-    else {
-        JSValue result = jsNumber(stackFrame.globalData, (val.toUInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
-        CHECK_FOR_EXCEPTION_AT_END();
-        return JSValue::encode(result);
-    }
+    JSValue result = jsNumber(stackFrame.globalData, (val.toUInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
 }
 
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_bitxor)
@@ -2375,7 +2640,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_call_eval)
     if (thisValue == globalObject && funcVal == globalObject->evalFunction()) {
         JSValue exceptionValue;
         JSValue result = interpreter->callEval(callFrame, registerFile, argv, argCount, registerOffset, exceptionValue);
-        if (UNLIKELY(exceptionValue != JSValue())) {
+        if (UNLIKELY(exceptionValue)) {
             stackFrame.globalData->exception = exceptionValue;
             VM_THROW_EXCEPTION_AT_END();
         }
@@ -2613,8 +2878,8 @@ DEFINE_STUB_FUNCTION(void*, op_switch_imm)
     CallFrame* callFrame = stackFrame.callFrame;
     CodeBlock* codeBlock = callFrame->codeBlock();
 
-    if (scrutinee.isInt32Fast())
-        return codeBlock->immediateSwitchJumpTable(tableIndex).ctiForValue(scrutinee.getInt32Fast()).executableAddress();
+    if (scrutinee.isInt32())
+        return codeBlock->immediateSwitchJumpTable(tableIndex).ctiForValue(scrutinee.asInt32()).executableAddress();
     else {
         double value;
         int32_t intValue;
@@ -2724,7 +2989,7 @@ DEFINE_STUB_FUNCTION(JSObject*, op_new_error)
     unsigned bytecodeOffset = stackFrame.args[2].int32();
 
     unsigned lineNumber = codeBlock->lineNumberForBytecodeOffset(callFrame, bytecodeOffset);
-    return Error::create(callFrame, static_cast<ErrorType>(type), message.toString(callFrame), lineNumber, codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->sourceURL());
+    return Error::create(callFrame, static_cast<ErrorType>(type), message.toString(callFrame), lineNumber, codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->sourceURL());
 }
 
 DEFINE_STUB_FUNCTION(void, op_debug)
@@ -2736,36 +3001,10 @@ DEFINE_STUB_FUNCTION(void, op_debug)
     int debugHookID = stackFrame.args[0].int32();
     int firstLine = stackFrame.args[1].int32();
     int lastLine = stackFrame.args[2].int32();
-    int column = stackFrame.args[3].int32();
 
-    stackFrame.globalData->interpreter->debug(callFrame, static_cast<DebugHookID>(debugHookID), firstLine, lastLine, column);
+    stackFrame.globalData->interpreter->debug(callFrame, static_cast<DebugHookID>(debugHookID), firstLine, lastLine);
 }
 
-#ifdef QT_BUILD_SCRIPT_LIB
-DEFINE_STUB_FUNCTION(void, op_debug_catch)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-    CallFrame* callFrame = stackFrame.callFrame;
-    if (JSC::Debugger* debugger = callFrame->lexicalGlobalObject()->debugger() ) {
-        JSValue exceptionValue = callFrame->r(stackFrame.args[0].int32()).jsValue();
-        DebuggerCallFrame debuggerCallFrame(callFrame, exceptionValue);
-        debugger->exceptionCatch(debuggerCallFrame, callFrame->codeBlock()->ownerNode()->sourceID());
-    }
-}
-
-DEFINE_STUB_FUNCTION(void, op_debug_return)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-    CallFrame* callFrame = stackFrame.callFrame;
-    if (JSC::Debugger* debugger = callFrame->lexicalGlobalObject()->debugger() ) {
-        JSValue returnValue = callFrame->r(stackFrame.args[0].int32()).jsValue();
-        intptr_t sourceID = callFrame->codeBlock()->ownerNode()->sourceID();
-        debugger->functionExit(returnValue, sourceID);
-    }
-}
-
-#endif
-
 DEFINE_STUB_FUNCTION(EncodedJSValue, vm_throw)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
@@ -2794,8 +3033,6 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, vm_throw)
     return JSValue::encode(exceptionValue);
 }
 
-} // namespace JITStubs
-
 } // namespace JSC
 
 #endif // ENABLE(JIT)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h
index 325c3fd..1dbdeaa 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h
@@ -38,8 +38,11 @@
 
 namespace JSC {
 
+    struct StructureStubInfo;
+
     class CodeBlock;
     class ExecutablePool;
+    class FunctionExecutable;
     class Identifier;
     class JSGlobalData;
     class JSGlobalData;
@@ -51,8 +54,7 @@ namespace JSC {
     class PropertySlot;
     class PutPropertySlot;
     class RegisterFile;
-    class FuncDeclNode;
-    class FuncExprNode;
+    class JSGlobalObject;
     class RegExp;
 
     union JITStubArg {
@@ -64,17 +66,26 @@ namespace JSC {
         Identifier& identifier() { return *static_cast<Identifier*>(asPointer); }
         int32_t int32() { return asInt32; }
         CodeBlock* codeBlock() { return static_cast<CodeBlock*>(asPointer); }
-        FuncDeclNode* funcDeclNode() { return static_cast<FuncDeclNode*>(asPointer); }
-        FuncExprNode* funcExprNode() { return static_cast<FuncExprNode*>(asPointer); }
+        FunctionExecutable* function() { return static_cast<FunctionExecutable*>(asPointer); }
         RegExp* regExp() { return static_cast<RegExp*>(asPointer); }
         JSPropertyNameIterator* propertyNameIterator() { return static_cast<JSPropertyNameIterator*>(asPointer); }
+        JSGlobalObject* globalObject() { return static_cast<JSGlobalObject*>(asPointer); }
+        JSString* jsString() { return static_cast<JSString*>(asPointer); }
         ReturnAddressPtr returnAddress() { return ReturnAddressPtr(asPointer); }
     };
 
 #if PLATFORM(X86_64)
     struct JITStackFrame {
-        JITStubArg padding; // Unused
-        JITStubArg args[8];
+        void* reserved; // Unused
+        JITStubArg args[6];
+        void* padding[2]; // Maintain 32-byte stack alignment (possibly overkill).
+
+        void* code;
+        RegisterFile* registerFile;
+        CallFrame* callFrame;
+        JSValue* exception;
+        Profiler** enabledProfilerReference;
+        JSGlobalData* globalData;
 
         void* savedRBX;
         void* savedR15;
@@ -84,20 +95,20 @@ namespace JSC {
         void* savedRBP;
         void* savedRIP;
 
-        void* code;
-        RegisterFile* registerFile;
-        CallFrame* callFrame;
-        JSValue* exception;
-        Profiler** enabledProfilerReference;
-        JSGlobalData* globalData;
-
         // When JIT code makes a call, it pushes its return address just below the rest of the stack.
         ReturnAddressPtr* returnAddressSlot() { return reinterpret_cast<ReturnAddressPtr*>(this) - 1; }
     };
 #elif PLATFORM(X86)
+#if COMPILER(MSVC)
+#pragma pack(push)
+#pragma pack(4)
+#endif // COMPILER(MSVC)
     struct JITStackFrame {
-        JITStubArg padding; // Unused
+        void* reserved; // Unused
         JITStubArg args[6];
+#if USE(JSVALUE32_64)
+        void* padding[2]; // Maintain 16-byte stack alignment.
+#endif
 
         void* savedEBX;
         void* savedEDI;
@@ -115,10 +126,16 @@ namespace JSC {
         // When JIT code makes a call, it pushes its return address just below the rest of the stack.
         ReturnAddressPtr* returnAddressSlot() { return reinterpret_cast<ReturnAddressPtr*>(this) - 1; }
     };
+#if COMPILER(MSVC)
+#pragma pack(pop)
+#endif // COMPILER(MSVC)
 #elif PLATFORM_ARM_ARCH(7)
     struct JITStackFrame {
-        JITStubArg padding; // Unused
+        void* reserved; // Unused
         JITStubArg args[6];
+#if USE(JSVALUE32_64)
+        void* padding[2]; // Maintain 16-byte stack alignment.
+#endif
 
         ReturnAddressPtr thunkReturnAddress;
 
@@ -138,6 +155,27 @@ namespace JSC {
         
         ReturnAddressPtr* returnAddressSlot() { return &thunkReturnAddress; }
     };
+#elif PLATFORM(ARM)
+    struct JITStackFrame {
+        JITStubArg padding; // Unused
+        JITStubArg args[7];
+
+        void* preservedR4;
+        void* preservedR5;
+        void* preservedR6;
+        void* preservedR7;
+        void* preservedR8;
+        void* preservedLink;
+
+        RegisterFile* registerFile;
+        CallFrame* callFrame;
+        JSValue* exception;
+        Profiler** enabledProfilerReference;
+        JSGlobalData* globalData;
+
+        // When JIT code makes a call, it pushes its return address just below the rest of the stack.
+        ReturnAddressPtr* returnAddressSlot() { return reinterpret_cast<ReturnAddressPtr*>(this) - 1; }
+    };
 #else
 #error "JITStackFrame not defined for this platform."
 #endif
@@ -183,24 +221,16 @@ namespace JSC {
 
     extern "C" void ctiVMThrowTrampoline();
     extern "C" void ctiOpThrowNotCaught();
-    extern "C" EncodedJSValue ctiTrampoline(
-#if PLATFORM(X86_64)
-            // FIXME: (bug #22910) this will force all arguments onto the stack (regparm(0) does not appear to have any effect).
-            // We can allow register passing here, and move the writes of these values into the trampoline.
-            void*, void*, void*, void*, void*, void*,
-#endif
-            void* code, RegisterFile*, CallFrame*, JSValue* exception, Profiler**, JSGlobalData*);
+    extern "C" EncodedJSValue ctiTrampoline(void* code, RegisterFile*, CallFrame*, JSValue* exception, Profiler**, JSGlobalData*);
 
     class JITThunks {
     public:
         JITThunks(JSGlobalData*);
 
-        static void tryCacheGetByID(CallFrame*, CodeBlock*, ReturnAddressPtr returnAddress, JSValue baseValue, const Identifier& propertyName, const PropertySlot&);
-        static void tryCachePutByID(CallFrame*, CodeBlock*, ReturnAddressPtr returnAddress, JSValue baseValue, const PutPropertySlot&);
-        
-        MacroAssemblerCodePtr ctiArrayLengthTrampoline() { return m_ctiArrayLengthTrampoline; }
+        static void tryCacheGetByID(CallFrame*, CodeBlock*, ReturnAddressPtr returnAddress, JSValue baseValue, const Identifier& propertyName, const PropertySlot&, StructureStubInfo* stubInfo);
+        static void tryCachePutByID(CallFrame*, CodeBlock*, ReturnAddressPtr returnAddress, JSValue baseValue, const PutPropertySlot&, StructureStubInfo* stubInfo);
+
         MacroAssemblerCodePtr ctiStringLengthTrampoline() { return m_ctiStringLengthTrampoline; }
-        MacroAssemblerCodePtr ctiVirtualCallPreLink() { return m_ctiVirtualCallPreLink; }
         MacroAssemblerCodePtr ctiVirtualCallLink() { return m_ctiVirtualCallLink; }
         MacroAssemblerCodePtr ctiVirtualCall() { return m_ctiVirtualCall; }
         MacroAssemblerCodePtr ctiNativeCallThunk() { return m_ctiNativeCallThunk; }
@@ -208,68 +238,13 @@ namespace JSC {
     private:
         RefPtr<ExecutablePool> m_executablePool;
 
-        MacroAssemblerCodePtr m_ctiArrayLengthTrampoline;
         MacroAssemblerCodePtr m_ctiStringLengthTrampoline;
-        MacroAssemblerCodePtr m_ctiVirtualCallPreLink;
         MacroAssemblerCodePtr m_ctiVirtualCallLink;
         MacroAssemblerCodePtr m_ctiVirtualCall;
         MacroAssemblerCodePtr m_ctiNativeCallThunk;
     };
 
-namespace JITStubs { extern "C" {
-
-    void JIT_STUB cti_op_create_arguments(STUB_ARGS_DECLARATION);
-    void JIT_STUB cti_op_create_arguments_no_params(STUB_ARGS_DECLARATION);
-    void JIT_STUB cti_op_debug(STUB_ARGS_DECLARATION);
-#ifdef QT_BUILD_SCRIPT_LIB
-    void JIT_STUB cti_op_debug_catch(STUB_ARGS_DECLARATION);
-    void JIT_STUB cti_op_debug_return(STUB_ARGS_DECLARATION);
-#endif
-    void JIT_STUB cti_op_end(STUB_ARGS_DECLARATION);
-    void JIT_STUB cti_op_jmp_scopes(STUB_ARGS_DECLARATION);
-    void JIT_STUB cti_op_pop_scope(STUB_ARGS_DECLARATION);
-    void JIT_STUB cti_op_profile_did_call(STUB_ARGS_DECLARATION);
-    void JIT_STUB cti_op_profile_will_call(STUB_ARGS_DECLARATION);
-    void JIT_STUB cti_op_put_by_id(STUB_ARGS_DECLARATION);
-    void JIT_STUB cti_op_put_by_id_fail(STUB_ARGS_DECLARATION);
-    void JIT_STUB cti_op_put_by_id_generic(STUB_ARGS_DECLARATION);
-    void JIT_STUB cti_op_put_by_id_second(STUB_ARGS_DECLARATION);
-    void JIT_STUB cti_op_put_by_index(STUB_ARGS_DECLARATION);
-    void JIT_STUB cti_op_put_by_val(STUB_ARGS_DECLARATION);
-    void JIT_STUB cti_op_put_by_val_array(STUB_ARGS_DECLARATION);
-    void JIT_STUB cti_op_put_by_val_byte_array(STUB_ARGS_DECLARATION);
-    void JIT_STUB cti_op_put_getter(STUB_ARGS_DECLARATION);
-    void JIT_STUB cti_op_put_setter(STUB_ARGS_DECLARATION);
-    void JIT_STUB cti_op_ret_scopeChain(STUB_ARGS_DECLARATION);
-    void JIT_STUB cti_op_tear_off_activation(STUB_ARGS_DECLARATION);
-    void JIT_STUB cti_op_tear_off_arguments(STUB_ARGS_DECLARATION);
-    void JIT_STUB cti_register_file_check(STUB_ARGS_DECLARATION);
-    int JIT_STUB cti_op_jless(STUB_ARGS_DECLARATION);
-    int JIT_STUB cti_op_jlesseq(STUB_ARGS_DECLARATION);
-    int JIT_STUB cti_op_jtrue(STUB_ARGS_DECLARATION);
-    int JIT_STUB cti_op_load_varargs(STUB_ARGS_DECLARATION);
-    int JIT_STUB cti_op_loop_if_less(STUB_ARGS_DECLARATION);
-    int JIT_STUB cti_op_loop_if_lesseq(STUB_ARGS_DECLARATION);
-    int JIT_STUB cti_op_loop_if_true(STUB_ARGS_DECLARATION);
-    int JIT_STUB cti_timeout_check(STUB_ARGS_DECLARATION);
-    void* JIT_STUB cti_op_call_JSFunction(STUB_ARGS_DECLARATION);
-    void* JIT_STUB cti_op_switch_char(STUB_ARGS_DECLARATION);
-    void* JIT_STUB cti_op_switch_imm(STUB_ARGS_DECLARATION);
-    void* JIT_STUB cti_op_switch_string(STUB_ARGS_DECLARATION);
-    void* JIT_STUB cti_vm_dontLazyLinkCall(STUB_ARGS_DECLARATION);
-    void* JIT_STUB cti_vm_lazyLinkCall(STUB_ARGS_DECLARATION);
-    JSObject* JIT_STUB cti_op_construct_JSConstruct(STUB_ARGS_DECLARATION);
-    JSObject* JIT_STUB cti_op_convert_this(STUB_ARGS_DECLARATION);
-    JSObject* JIT_STUB cti_op_new_array(STUB_ARGS_DECLARATION);
-    JSObject* JIT_STUB cti_op_new_error(STUB_ARGS_DECLARATION);
-    JSObject* JIT_STUB cti_op_new_func(STUB_ARGS_DECLARATION);
-    JSObject* JIT_STUB cti_op_new_func_exp(STUB_ARGS_DECLARATION);
-    JSObject* JIT_STUB cti_op_new_object(STUB_ARGS_DECLARATION);
-    JSObject* JIT_STUB cti_op_new_regexp(STUB_ARGS_DECLARATION);
-    JSObject* JIT_STUB cti_op_push_activation(STUB_ARGS_DECLARATION);
-    JSObject* JIT_STUB cti_op_push_new_scope(STUB_ARGS_DECLARATION);
-    JSObject* JIT_STUB cti_op_push_scope(STUB_ARGS_DECLARATION);
-    JSPropertyNameIterator* JIT_STUB cti_op_get_pnames(STUB_ARGS_DECLARATION);
+extern "C" {
     EncodedJSValue JIT_STUB cti_op_add(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_bitand(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_bitnot(STUB_ARGS_DECLARATION);
@@ -278,25 +253,22 @@ namespace JITStubs { extern "C" {
     EncodedJSValue JIT_STUB cti_op_call_NotJSFunction(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_call_eval(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_construct_NotJSConstruct(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_convert_this(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_del_by_id(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_del_by_val(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_div(STUB_ARGS_DECLARATION);
-    EncodedJSValue JIT_STUB cti_op_eq(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_get_by_id(STUB_ARGS_DECLARATION);
-    EncodedJSValue JIT_STUB cti_op_get_by_id_method_check(STUB_ARGS_DECLARATION);
-    EncodedJSValue JIT_STUB cti_op_get_by_id_method_check_second(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_get_by_id_array_fail(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_get_by_id_generic(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_method_check(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_get_by_id_proto_fail(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_get_by_id_proto_list(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_get_by_id_proto_list_full(STUB_ARGS_DECLARATION);
-    EncodedJSValue JIT_STUB cti_op_get_by_id_second(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_get_by_id_self_fail(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_get_by_id_string_fail(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_get_by_val(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_get_by_val_byte_array(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_get_by_val_string(STUB_ARGS_DECLARATION);
-    EncodedJSValue JIT_STUB cti_op_put_by_id_transition_realloc(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_in(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_instanceof(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_is_boolean(STUB_ARGS_DECLARATION);
@@ -311,16 +283,18 @@ namespace JITStubs { extern "C" {
     EncodedJSValue JIT_STUB cti_op_mod(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_mul(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_negate(STUB_ARGS_DECLARATION);
-    EncodedJSValue JIT_STUB cti_op_neq(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_next_pname(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_not(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_nstricteq(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_post_dec(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_post_inc(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_pre_dec(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_pre_inc(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_resolve(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_resolve_base(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_resolve_global(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_resolve_skip(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_resolve_with_base(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_rshift(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_strcat(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_stricteq(STUB_ARGS_DECLARATION);
@@ -331,13 +305,58 @@ namespace JITStubs { extern "C" {
     EncodedJSValue JIT_STUB cti_op_typeof(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_urshift(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_vm_throw(STUB_ARGS_DECLARATION);
-    EncodedJSValue JIT_STUB cti_op_post_dec(STUB_ARGS_DECLARATION);
-    EncodedJSValue JIT_STUB cti_op_post_inc(STUB_ARGS_DECLARATION);
-    EncodedJSValue JIT_STUB cti_op_resolve_func(STUB_ARGS_DECLARATION);
-    EncodedJSValue JIT_STUB cti_op_resolve_with_base(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_construct_JSConstruct(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_new_array(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_new_error(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_new_func(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_new_func_exp(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_new_object(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_new_regexp(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_push_activation(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_push_new_scope(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_push_scope(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_put_by_id_transition_realloc(STUB_ARGS_DECLARATION);
+    JSPropertyNameIterator* JIT_STUB cti_op_get_pnames(STUB_ARGS_DECLARATION);
     VoidPtrPair JIT_STUB cti_op_call_arityCheck(STUB_ARGS_DECLARATION);
-
-}; } // extern "C" namespace JITStubs
+    int JIT_STUB cti_op_eq(STUB_ARGS_DECLARATION);
+#if USE(JSVALUE32_64)
+    int JIT_STUB cti_op_eq_strings(STUB_ARGS_DECLARATION);
+#endif
+    int JIT_STUB cti_op_jless(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_op_jlesseq(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_op_jtrue(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_op_load_varargs(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_op_loop_if_less(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_op_loop_if_lesseq(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_op_loop_if_true(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_timeout_check(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_create_arguments(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_create_arguments_no_params(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_debug(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_end(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_jmp_scopes(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_pop_scope(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_profile_did_call(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_profile_will_call(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_id(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_id_fail(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_id_generic(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_index(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_val(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_val_array(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_val_byte_array(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_getter(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_setter(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_ret_scopeChain(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_tear_off_activation(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_tear_off_arguments(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_register_file_check(STUB_ARGS_DECLARATION);
+    void* JIT_STUB cti_op_call_JSFunction(STUB_ARGS_DECLARATION);
+    void* JIT_STUB cti_op_switch_char(STUB_ARGS_DECLARATION);
+    void* JIT_STUB cti_op_switch_imm(STUB_ARGS_DECLARATION);
+    void* JIT_STUB cti_op_switch_string(STUB_ARGS_DECLARATION);
+    void* JIT_STUB cti_vm_lazyLinkCall(STUB_ARGS_DECLARATION);
+} // extern "C"
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jsc.cpp b/src/3rdparty/webkit/JavaScriptCore/jsc.cpp
index 190deff..92b1e58 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jsc.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jsc.cpp
@@ -443,14 +443,12 @@ static bool runWithScripts(GlobalObject* globalObject, const Vector<Script>& scr
     return success;
 }
 
-static
-#if !HAVE(READLINE)
-NO_RETURN
-#endif
-void runInteractive(GlobalObject* globalObject)
+#define RUNNING_FROM_XCODE 0
+
+static void runInteractive(GlobalObject* globalObject)
 {
     while (true) {
-#if HAVE(READLINE)
+#if HAVE(READLINE) && !RUNNING_FROM_XCODE
         char* line = readline(interactivePrompt);
         if (!line)
             break;
@@ -459,7 +457,7 @@ void runInteractive(GlobalObject* globalObject)
         Completion completion = evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(line, interpreterName));
         free(line);
 #else
-        puts(interactivePrompt);
+        printf("%s", interactivePrompt);
         Vector<char, 256> line;
         int c;
         while ((c = getchar()) != EOF) {
@@ -468,6 +466,8 @@ void runInteractive(GlobalObject* globalObject)
                 break;
             line.append(c);
         }
+        if (line.isEmpty())
+            break;
         line.append('\0');
         Completion completion = evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(line.data(), interpreterName));
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/os-win32/stdbool.h b/src/3rdparty/webkit/JavaScriptCore/os-win32/stdbool.h
index 8e7bace..fc8ee28 100644
--- a/src/3rdparty/webkit/JavaScriptCore/os-win32/stdbool.h
+++ b/src/3rdparty/webkit/JavaScriptCore/os-win32/stdbool.h
@@ -21,8 +21,8 @@
 #ifndef STDBOOL_WIN32_H
 #define STDBOOL_WIN32_H
 
-#if !PLATFORM(WIN_OS)
-#error "This stdbool.h file should only be compiled under Windows"
+#if !COMPILER(MSVC)
+#error "This stdbool.h file should only be compiled with MSVC"
 #endif
 
 #ifndef __cplusplus
diff --git a/src/3rdparty/webkit/JavaScriptCore/os-win32/stdint.h b/src/3rdparty/webkit/JavaScriptCore/os-win32/stdint.h
index efab2ae..1d8787e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/os-win32/stdint.h
+++ b/src/3rdparty/webkit/JavaScriptCore/os-win32/stdint.h
@@ -23,10 +23,11 @@
 
 #include <wtf/Platform.h>
 
-/* This file emulates enough of stdint.h on Windows to make JavaScriptCore and WebCore compile. */
+/* This file emulates enough of stdint.h on Windows to make JavaScriptCore and WebCore
+   compile using MSVC which does not ship with the stdint.h header. */
 
-#if !PLATFORM(WIN_OS)
-#error "This stdint.h file should only be compiled under Windows"
+#if !COMPILER(MSVC)
+#error "This stdint.h file should only be compiled with MSVC"
 #endif
 
 #include <limits.h>
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y b/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
index a3bf1fe..85fd163 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
@@ -25,18 +25,12 @@
 
 #include "config.h"
 
-#include <string.h>
-#include <stdlib.h>
-#include "JSValue.h"
 #include "JSObject.h"
-#include "NodeConstructors.h"
-#include "Lexer.h"
 #include "JSString.h"
-#include "JSGlobalData.h"
-#include "CommonIdentifiers.h"
+#include "NodeConstructors.h"
 #include "NodeInfo.h"
-#include "Parser.h"
-#include <wtf/FastMalloc.h>
+#include <stdlib.h>
+#include <string.h>
 #include <wtf/MathExtras.h>
 
 #define YYMALLOC fastMalloc
@@ -45,46 +39,44 @@
 #define YYMAXDEPTH 10000
 #define YYENABLE_NLS 0
 
-/* default values for bison */
+// Default values for bison.
 #define YYDEBUG 0 // Set to 1 to debug a parse error.
 #define jscyydebug 0 // Set to 1 to debug a parse error.
 #if !PLATFORM(DARWIN)
-    // avoid triggering warnings in older bison
+// Avoid triggering warnings in older bison by not setting this on the Darwin platform.
+// FIXME: Is this still needed?
 #define YYERROR_VERBOSE
 #endif
 
 int jscyylex(void* lvalp, void* llocp, void* globalPtr);
 int jscyyerror(const char*);
+
 static inline bool allowAutomaticSemicolon(JSC::Lexer&, int);
 
 #define GLOBAL_DATA static_cast<JSGlobalData*>(globalPtr)
-#define LEXER (GLOBAL_DATA->lexer)
-
-#define AUTO_SEMICOLON do { if (!allowAutomaticSemicolon(*LEXER, yychar)) YYABORT; } while (0)
-#define SET_EXCEPTION_LOCATION(node, start, divot, end) node->setExceptionSourceCode((divot), (divot) - (start), (end) - (divot))
-#define DBG(l, s, e) (l)->setLoc((s).first_line, (e).last_line, (s).first_column + 1)
+#define AUTO_SEMICOLON do { if (!allowAutomaticSemicolon(*GLOBAL_DATA->lexer, yychar)) YYABORT; } while (0)
 
 using namespace JSC;
 using namespace std;
 
-static ExpressionNode* makeAssignNode(void*, ExpressionNode* loc, Operator, ExpressionNode* expr, bool locHasAssignments, bool exprHasAssignments, int start, int divot, int end);
-static ExpressionNode* makePrefixNode(void*, ExpressionNode* expr, Operator, int start, int divot, int end);
-static ExpressionNode* makePostfixNode(void*, ExpressionNode* expr, Operator, int start, int divot, int end);
-static PropertyNode* makeGetterOrSetterPropertyNode(void*, const Identifier &getOrSet, const Identifier& name, ParameterNode*, FunctionBodyNode*, const SourceCode&);
-static ExpressionNodeInfo makeFunctionCallNode(void*, ExpressionNodeInfo func, ArgumentsNodeInfo, int start, int divot, int end);
-static ExpressionNode* makeTypeOfNode(void*, ExpressionNode*);
-static ExpressionNode* makeDeleteNode(void*, ExpressionNode*, int start, int divot, int end);
-static ExpressionNode* makeNegateNode(void*, ExpressionNode*);
-static NumberNode* makeNumberNode(void*, double);
-static ExpressionNode* makeBitwiseNotNode(void*, ExpressionNode*);
-static ExpressionNode* makeMultNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
-static ExpressionNode* makeDivNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
-static ExpressionNode* makeAddNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
-static ExpressionNode* makeSubNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
-static ExpressionNode* makeLeftShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
-static ExpressionNode* makeRightShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
-static StatementNode* makeVarStatementNode(void*, ExpressionNode*);
-static ExpressionNode* combineCommaNodes(void*, ExpressionNode* list, ExpressionNode* init);
+static ExpressionNode* makeAssignNode(JSGlobalData*, ExpressionNode* left, Operator, ExpressionNode* right, bool leftHasAssignments, bool rightHasAssignments, int start, int divot, int end);
+static ExpressionNode* makePrefixNode(JSGlobalData*, ExpressionNode*, Operator, int start, int divot, int end);
+static ExpressionNode* makePostfixNode(JSGlobalData*, ExpressionNode*, Operator, int start, int divot, int end);
+static PropertyNode* makeGetterOrSetterPropertyNode(JSGlobalData*, const Identifier& getOrSet, const Identifier& name, ParameterNode*, FunctionBodyNode*, const SourceCode&);
+static ExpressionNodeInfo makeFunctionCallNode(JSGlobalData*, ExpressionNodeInfo function, ArgumentsNodeInfo, int start, int divot, int end);
+static ExpressionNode* makeTypeOfNode(JSGlobalData*, ExpressionNode*);
+static ExpressionNode* makeDeleteNode(JSGlobalData*, ExpressionNode*, int start, int divot, int end);
+static ExpressionNode* makeNegateNode(JSGlobalData*, ExpressionNode*);
+static NumberNode* makeNumberNode(JSGlobalData*, double);
+static ExpressionNode* makeBitwiseNotNode(JSGlobalData*, ExpressionNode*);
+static ExpressionNode* makeMultNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+static ExpressionNode* makeDivNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+static ExpressionNode* makeAddNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+static ExpressionNode* makeSubNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+static ExpressionNode* makeLeftShiftNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+static ExpressionNode* makeRightShiftNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+static StatementNode* makeVarStatementNode(JSGlobalData*, ExpressionNode*);
+static ExpressionNode* combineCommaNodes(JSGlobalData*, ExpressionNode* list, ExpressionNode* init);
 
 #if COMPILER(MSVC)
 
@@ -97,17 +89,17 @@ static ExpressionNode* combineCommaNodes(void*, ExpressionNode* list, Expression
 #define YYPARSE_PARAM globalPtr
 #define YYLEX_PARAM globalPtr
 
-template <typename T> NodeDeclarationInfo<T> createNodeDeclarationInfo(T node, ParserArenaData<DeclarationStacks::VarStack>* varDecls, 
-                                                                       ParserArenaData<DeclarationStacks::FunctionStack>* funcDecls,
-                                                                       CodeFeatures info,
-                                                                       int numConstants) 
+template <typename T> inline NodeDeclarationInfo<T> createNodeDeclarationInfo(T node,
+    ParserArenaData<DeclarationStacks::VarStack>* varDecls,
+    ParserArenaData<DeclarationStacks::FunctionStack>* funcDecls,
+    CodeFeatures info, int numConstants) 
 {
     ASSERT((info & ~AllFeatures) == 0);
     NodeDeclarationInfo<T> result = { node, varDecls, funcDecls, info, numConstants };
     return result;
 }
 
-template <typename T> NodeInfo<T> createNodeInfo(T node, CodeFeatures info, int numConstants)
+template <typename T> inline NodeInfo<T> createNodeInfo(T node, CodeFeatures info, int numConstants)
 {
     ASSERT((info & ~AllFeatures) == 0);
     NodeInfo<T> result = { node, info, numConstants };
@@ -133,21 +125,20 @@ template <typename T> inline T mergeDeclarationLists(T decls1, T decls2)
     return decls1;
 }
 
-static void appendToVarDeclarationList(void* globalPtr, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, const Identifier& ident, unsigned attrs)
+static inline void appendToVarDeclarationList(JSGlobalData* globalData, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, const Identifier& ident, unsigned attrs)
 {
     if (!varDecls)
-        varDecls = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
-
-    varDecls->data.append(make_pair(ident, attrs));
+        varDecls = new (globalData) ParserArenaData<DeclarationStacks::VarStack>;
 
+    varDecls->data.append(make_pair(&ident, attrs));
 }
 
-static inline void appendToVarDeclarationList(void* globalPtr, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, ConstDeclNode* decl)
+static inline void appendToVarDeclarationList(JSGlobalData* globalData, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, ConstDeclNode* decl)
 {
     unsigned attrs = DeclarationStacks::IsConstant;
     if (decl->hasInitializer())
         attrs |= DeclarationStacks::HasInitializer;        
-    appendToVarDeclarationList(globalPtr, varDecls, decl->ident(), attrs);
+    appendToVarDeclarationList(globalData, varDecls, decl->ident(), attrs);
 }
 
 %}
@@ -155,7 +146,7 @@ static inline void appendToVarDeclarationList(void* globalPtr, ParserArenaData<D
 %union {
     int                 intValue;
     double              doubleValue;
-    Identifier*         ident;
+    const Identifier*   ident;
 
     // expression subtrees
     ExpressionNodeInfo  expressionNode;
@@ -184,6 +175,20 @@ static inline void appendToVarDeclarationList(void* globalPtr, ParserArenaData<D
     Operator            op;
 }
 
+%{
+
+template <typename T> inline void setStatementLocation(StatementNode* statement, const T& start, const T& end)
+{
+    statement->setLoc(start.first_line, end.last_line);
+}
+
+static inline void setExceptionLocation(ThrowableExpressionData* node, unsigned start, unsigned divot, unsigned end)
+{
+    node->setExceptionSourceCode(divot, divot - start, end - divot);
+}
+
+%}
+
 %start Program
 
 /* literals */
@@ -291,21 +296,25 @@ Literal:
   | NUMBER                              { $$ = createNodeInfo<ExpressionNode*>(makeNumberNode(GLOBAL_DATA, $1), 0, 1); }
   | STRING                              { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StringNode(GLOBAL_DATA, *$1), 0, 1); }
   | '/' /* regexp */                    {
-                                            Lexer& l = *LEXER;
-                                            if (!l.scanRegExp())
+                                            Lexer& l = *GLOBAL_DATA->lexer;
+                                            const Identifier* pattern;
+                                            const Identifier* flags;
+                                            if (!l.scanRegExp(pattern, flags))
                                                 YYABORT;
-                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, l.pattern(), l.flags());
-                                            int size = l.pattern().size() + 2; // + 2 for the two /'s
-                                            SET_EXCEPTION_LOCATION(node, @1.first_column, @1.first_column + size, @1.first_column + size);
+                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, *pattern, *flags);
+                                            int size = pattern->size() + 2; // + 2 for the two /'s
+                                            setExceptionLocation(node, @1.first_column, @1.first_column + size, @1.first_column + size);
                                             $$ = createNodeInfo<ExpressionNode*>(node, 0, 0);
                                         }
   | DIVEQUAL /* regexp with /= */       {
-                                            Lexer& l = *LEXER;
-                                            if (!l.scanRegExp())
+                                            Lexer& l = *GLOBAL_DATA->lexer;
+                                            const Identifier* pattern;
+                                            const Identifier* flags;
+                                            if (!l.scanRegExp(pattern, flags, '='))
                                                 YYABORT;
-                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, "=" + l.pattern(), l.flags());
-                                            int size = l.pattern().size() + 2; // + 2 for the two /'s
-                                            SET_EXCEPTION_LOCATION(node, @1.first_column, @1.first_column + size, @1.first_column + size);
+                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, *pattern, *flags);
+                                            int size = pattern->size() + 2; // + 2 for the two /'s
+                                            setExceptionLocation(node, @1.first_column, @1.first_column + size, @1.first_column + size);
                                             $$ = createNodeInfo<ExpressionNode*>(node, 0, 0);
                                         }
 ;
@@ -313,14 +322,14 @@ Literal:
 Property:
     IDENT ':' AssignmentExpr            { $$ = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *$1, $3.m_node, PropertyNode::Constant), $3.m_features, $3.m_numConstants); }
   | STRING ':' AssignmentExpr           { $$ = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *$1, $3.m_node, PropertyNode::Constant), $3.m_features, $3.m_numConstants); }
-  | NUMBER ':' AssignmentExpr           { $$ = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, Identifier(GLOBAL_DATA, UString::from($1)), $3.m_node, PropertyNode::Constant), $3.m_features, $3.m_numConstants); }
-  | IDENT IDENT '(' ')' OPENBRACE FunctionBody CLOSEBRACE    { $$ = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(globalPtr, *$1, *$2, 0, $6, LEXER->sourceCode($5, $7, @5.first_line)), ClosureFeature, 0); DBG($6, @5, @7); if (!$$.m_node) YYABORT; }
+  | NUMBER ':' AssignmentExpr           { $$ = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, $1, $3.m_node, PropertyNode::Constant), $3.m_features, $3.m_numConstants); }
+  | IDENT IDENT '(' ')' OPENBRACE FunctionBody CLOSEBRACE    { $$ = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(GLOBAL_DATA, *$1, *$2, 0, $6, GLOBAL_DATA->lexer->sourceCode($5, $7, @5.first_line)), ClosureFeature, 0); setStatementLocation($6, @5, @7); if (!$$.m_node) YYABORT; }
   | IDENT IDENT '(' FormalParameterList ')' OPENBRACE FunctionBody CLOSEBRACE
                                                              {
-                                                                 $$ = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(globalPtr, *$1, *$2, $4.m_node.head, $7, LEXER->sourceCode($6, $8, @6.first_line)), $4.m_features | ClosureFeature, 0); 
+                                                                 $$ = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(GLOBAL_DATA, *$1, *$2, $4.m_node.head, $7, GLOBAL_DATA->lexer->sourceCode($6, $8, @6.first_line)), $4.m_features | ClosureFeature, 0); 
                                                                  if ($4.m_features & ArgumentsFeature)
                                                                      $7->setUsesArguments(); 
-                                                                 DBG($7, @6, @8); 
+                                                                 setStatementLocation($7, @6, @8); 
                                                                  if (!$$.m_node) 
                                                                      YYABORT; 
                                                              }
@@ -385,15 +394,15 @@ MemberExpr:
     PrimaryExpr
   | FunctionExpr                        { $$ = createNodeInfo<ExpressionNode*>($1.m_node, $1.m_features, $1.m_numConstants); }
   | MemberExpr '[' Expr ']'             { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @4.last_column);
+                                          setExceptionLocation(node, @1.first_column, @1.last_column, @4.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); 
                                         }
   | MemberExpr '.' IDENT                { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @3.last_column);
+                                          setExceptionLocation(node, @1.first_column, @1.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features, $1.m_numConstants);
                                         }
   | NEW MemberExpr Arguments            { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, $2.m_node, $3.m_node);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @3.last_column);
+                                          setExceptionLocation(node, @1.first_column, @2.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $2.m_features | $3.m_features, $2.m_numConstants + $3.m_numConstants);
                                         }
 ;
@@ -401,15 +410,15 @@ MemberExpr:
 MemberExprNoBF:
     PrimaryExprNoBrace
   | MemberExprNoBF '[' Expr ']'         { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @4.last_column);
+                                          setExceptionLocation(node, @1.first_column, @1.last_column, @4.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); 
                                         }
   | MemberExprNoBF '.' IDENT            { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @3.last_column);
+                                          setExceptionLocation(node, @1.first_column, @1.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features, $1.m_numConstants);
                                         }
   | NEW MemberExpr Arguments            { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, $2.m_node, $3.m_node);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @3.last_column);
+                                          setExceptionLocation(node, @1.first_column, @2.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $2.m_features | $3.m_features, $2.m_numConstants + $3.m_numConstants);
                                         }
 ;
@@ -417,7 +426,7 @@ MemberExprNoBF:
 NewExpr:
     MemberExpr
   | NEW NewExpr                         { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, $2.m_node);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
+                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $2.m_features, $2.m_numConstants); 
                                         }
 ;
@@ -425,32 +434,32 @@ NewExpr:
 NewExprNoBF:
     MemberExprNoBF
   | NEW NewExpr                         { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, $2.m_node);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
+                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $2.m_features, $2.m_numConstants);
                                         }
 ;
 
 CallExpr:
-    MemberExpr Arguments                { $$ = makeFunctionCallNode(globalPtr, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
-  | CallExpr Arguments                  { $$ = makeFunctionCallNode(globalPtr, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
+    MemberExpr Arguments                { $$ = makeFunctionCallNode(GLOBAL_DATA, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
+  | CallExpr Arguments                  { $$ = makeFunctionCallNode(GLOBAL_DATA, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
   | CallExpr '[' Expr ']'               { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @4.last_column);
+                                          setExceptionLocation(node, @1.first_column, @1.last_column, @4.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); 
                                         }
   | CallExpr '.' IDENT                  { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @3.last_column);
+                                          setExceptionLocation(node, @1.first_column, @1.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features, $1.m_numConstants); }
 ;
 
 CallExprNoBF:
-    MemberExprNoBF Arguments            { $$ = makeFunctionCallNode(globalPtr, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
-  | CallExprNoBF Arguments              { $$ = makeFunctionCallNode(globalPtr, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
+    MemberExprNoBF Arguments            { $$ = makeFunctionCallNode(GLOBAL_DATA, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
+  | CallExprNoBF Arguments              { $$ = makeFunctionCallNode(GLOBAL_DATA, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
   | CallExprNoBF '[' Expr ']'           { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @4.last_column);
+                                          setExceptionLocation(node, @1.first_column, @1.last_column, @4.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); 
                                         }
   | CallExprNoBF '.' IDENT              { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @3.last_column);
+                                          setExceptionLocation(node, @1.first_column, @1.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features, $1.m_numConstants); 
                                         }
 ;
@@ -568,10 +577,10 @@ RelationalExpr:
   | RelationalExpr LE ShiftExpr         { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | RelationalExpr GE ShiftExpr         { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | RelationalExpr INSTANCEOF ShiftExpr { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @3.first_column, @3.last_column);  
+                                          setExceptionLocation(node, @1.first_column, @3.first_column, @3.last_column);  
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | RelationalExpr INTOKEN ShiftExpr    { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @3.first_column, @3.last_column);  
+                                          setExceptionLocation(node, @1.first_column, @3.first_column, @3.last_column);  
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
@@ -583,7 +592,7 @@ RelationalExprNoIn:
   | RelationalExprNoIn GE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | RelationalExprNoIn INSTANCEOF ShiftExpr
                                         { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @3.first_column, @3.last_column);  
+                                          setExceptionLocation(node, @1.first_column, @3.first_column, @3.last_column);  
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
@@ -595,11 +604,11 @@ RelationalExprNoBF:
   | RelationalExprNoBF GE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | RelationalExprNoBF INSTANCEOF ShiftExpr
                                         { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @3.first_column, @3.last_column);  
+                                          setExceptionLocation(node, @1.first_column, @3.first_column, @3.last_column);  
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | RelationalExprNoBF INTOKEN ShiftExpr 
                                         { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @3.first_column, @3.last_column);  
+                                          setExceptionLocation(node, @1.first_column, @3.first_column, @3.last_column);  
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
@@ -810,17 +819,17 @@ Statement:
 ;
 
 Block:
-    OPENBRACE CLOSEBRACE                             { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, 0), 0, 0, 0, 0);
-                                          DBG($$.m_node, @1, @2); }
-  | OPENBRACE SourceElements CLOSEBRACE              { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, $2.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
-                                          DBG($$.m_node, @1, @3); }
+    OPENBRACE CLOSEBRACE                { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, 0), 0, 0, 0, 0);
+                                          setStatementLocation($$.m_node, @1, @2); }
+  | OPENBRACE SourceElements CLOSEBRACE { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, $2.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
+                                          setStatementLocation($$.m_node, @1, @3); }
 ;
 
 VariableStatement:
     VAR VariableDeclarationList ';'     { $$ = createNodeDeclarationInfo<StatementNode*>(makeVarStatementNode(GLOBAL_DATA, $2.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
-                                          DBG($$.m_node, @1, @3); }
+                                          setStatementLocation($$.m_node, @1, @3); }
   | VAR VariableDeclarationList error   { $$ = createNodeDeclarationInfo<StatementNode*>(makeVarStatementNode(GLOBAL_DATA, $2.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
-                                          DBG($$.m_node, @1, @2);
+                                          setStatementLocation($$.m_node, @1, @2);
                                           AUTO_SEMICOLON; }
 ;
 
@@ -833,7 +842,7 @@ VariableDeclarationList:
                                           $$.m_numConstants = 0;
                                         }
   | IDENT Initializer                   { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$1, $2.m_node, $2.m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.first_column + 1, @2.last_column);
+                                          setExceptionLocation(node, @1.first_column, @2.first_column + 1, @2.last_column);
                                           $$.m_node = node;
                                           $$.m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$1, DeclarationStacks::HasInitializer);
@@ -851,7 +860,7 @@ VariableDeclarationList:
                                         }
   | VariableDeclarationList ',' IDENT Initializer
                                         { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$3, $4.m_node, $4.m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, @3.first_column, @4.first_column + 1, @4.last_column);
+                                          setExceptionLocation(node, @3.first_column, @4.first_column + 1, @4.last_column);
                                           $$.m_node = combineCommaNodes(GLOBAL_DATA, $1.m_node, node);
                                           $$.m_varDeclarations = $1.m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$3, DeclarationStacks::HasInitializer);
@@ -870,7 +879,7 @@ VariableDeclarationListNoIn:
                                           $$.m_numConstants = 0;
                                         }
   | IDENT InitializerNoIn               { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$1, $2.m_node, $2.m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.first_column + 1, @2.last_column);
+                                          setExceptionLocation(node, @1.first_column, @2.first_column + 1, @2.last_column);
                                           $$.m_node = node;
                                           $$.m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$1, DeclarationStacks::HasInitializer);
@@ -888,7 +897,7 @@ VariableDeclarationListNoIn:
                                         }
   | VariableDeclarationListNoIn ',' IDENT InitializerNoIn
                                         { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$3, $4.m_node, $4.m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, @3.first_column, @4.first_column + 1, @4.last_column);
+                                          setExceptionLocation(node, @3.first_column, @4.first_column + 1, @4.last_column);
                                           $$.m_node = combineCommaNodes(GLOBAL_DATA, $1.m_node, node);
                                           $$.m_varDeclarations = $1.m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$3, DeclarationStacks::HasInitializer);
@@ -900,10 +909,10 @@ VariableDeclarationListNoIn:
 
 ConstStatement:
     CONSTTOKEN ConstDeclarationList ';' { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, $2.m_node.head), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
-                                          DBG($$.m_node, @1, @3); }
+                                          setStatementLocation($$.m_node, @1, @3); }
   | CONSTTOKEN ConstDeclarationList error
                                         { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, $2.m_node.head), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
-                                          DBG($$.m_node, @1, @2); AUTO_SEMICOLON; }
+                                          setStatementLocation($$.m_node, @1, @2); AUTO_SEMICOLON; }
 ;
 
 ConstDeclarationList:
@@ -945,36 +954,36 @@ EmptyStatement:
 
 ExprStatement:
     ExprNoBF ';'                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, $1.m_node), 0, 0, $1.m_features, $1.m_numConstants);
-                                          DBG($$.m_node, @1, @2); }
+                                          setStatementLocation($$.m_node, @1, @2); }
   | ExprNoBF error                      { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, $1.m_node), 0, 0, $1.m_features, $1.m_numConstants);
-                                          DBG($$.m_node, @1, @1); AUTO_SEMICOLON; }
+                                          setStatementLocation($$.m_node, @1, @1); AUTO_SEMICOLON; }
 ;
 
 IfStatement:
     IF '(' Expr ')' Statement %prec IF_WITHOUT_ELSE
                                         { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfNode(GLOBAL_DATA, $3.m_node, $5.m_node), $5.m_varDeclarations, $5.m_funcDeclarations, $3.m_features | $5.m_features, $3.m_numConstants + $5.m_numConstants);
-                                          DBG($$.m_node, @1, @4); }
+                                          setStatementLocation($$.m_node, @1, @4); }
   | IF '(' Expr ')' Statement ELSE Statement
                                         { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfElseNode(GLOBAL_DATA, $3.m_node, $5.m_node, $7.m_node), 
                                                                                          mergeDeclarationLists($5.m_varDeclarations, $7.m_varDeclarations),
                                                                                          mergeDeclarationLists($5.m_funcDeclarations, $7.m_funcDeclarations),
                                                                                          $3.m_features | $5.m_features | $7.m_features,
                                                                                          $3.m_numConstants + $5.m_numConstants + $7.m_numConstants); 
-                                          DBG($$.m_node, @1, @4); }
+                                          setStatementLocation($$.m_node, @1, @4); }
 ;
 
 IterationStatement:
     DO Statement WHILE '(' Expr ')' ';'    { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, $2.m_node, $5.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features | $5.m_features, $2.m_numConstants + $5.m_numConstants);
-                                             DBG($$.m_node, @1, @3); }
+                                             setStatementLocation($$.m_node, @1, @3); }
   | DO Statement WHILE '(' Expr ')' error  { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, $2.m_node, $5.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features | $5.m_features, $2.m_numConstants + $5.m_numConstants);
-                                             DBG($$.m_node, @1, @3); } // Always performs automatic semicolon insertion.
+                                             setStatementLocation($$.m_node, @1, @3); } // Always performs automatic semicolon insertion.
   | WHILE '(' Expr ')' Statement        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WhileNode(GLOBAL_DATA, $3.m_node, $5.m_node), $5.m_varDeclarations, $5.m_funcDeclarations, $3.m_features | $5.m_features, $3.m_numConstants + $5.m_numConstants);
-                                          DBG($$.m_node, @1, @4); }
+                                          setStatementLocation($$.m_node, @1, @4); }
   | FOR '(' ExprNoInOpt ';' ExprOpt ';' ExprOpt ')' Statement
                                         { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, $3.m_node, $5.m_node, $7.m_node, $9.m_node, false), $9.m_varDeclarations, $9.m_funcDeclarations, 
                                                                                          $3.m_features | $5.m_features | $7.m_features | $9.m_features,
                                                                                          $3.m_numConstants + $5.m_numConstants + $7.m_numConstants + $9.m_numConstants);
-                                          DBG($$.m_node, @1, @8); 
+                                          setStatementLocation($$.m_node, @1, @8); 
                                         }
   | FOR '(' VAR VariableDeclarationListNoIn ';' ExprOpt ';' ExprOpt ')' Statement
                                         { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, $4.m_node, $6.m_node, $8.m_node, $10.m_node, true),
@@ -982,30 +991,30 @@ IterationStatement:
                                                                                          mergeDeclarationLists($4.m_funcDeclarations, $10.m_funcDeclarations),
                                                                                          $4.m_features | $6.m_features | $8.m_features | $10.m_features,
                                                                                          $4.m_numConstants + $6.m_numConstants + $8.m_numConstants + $10.m_numConstants);
-                                          DBG($$.m_node, @1, @9); }
+                                          setStatementLocation($$.m_node, @1, @9); }
   | FOR '(' LeftHandSideExpr INTOKEN Expr ')' Statement
                                         {
                                             ForInNode* node = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, $3.m_node, $5.m_node, $7.m_node);
-                                            SET_EXCEPTION_LOCATION(node, @3.first_column, @3.last_column, @5.last_column);
+                                            setExceptionLocation(node, @3.first_column, @3.last_column, @5.last_column);
                                             $$ = createNodeDeclarationInfo<StatementNode*>(node, $7.m_varDeclarations, $7.m_funcDeclarations,
                                                                                            $3.m_features | $5.m_features | $7.m_features,
                                                                                            $3.m_numConstants + $5.m_numConstants + $7.m_numConstants);
-                                            DBG($$.m_node, @1, @6);
+                                            setStatementLocation($$.m_node, @1, @6);
                                         }
   | FOR '(' VAR IDENT INTOKEN Expr ')' Statement
                                         { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *$4, 0, $6.m_node, $8.m_node, @5.first_column, @5.first_column - @4.first_column, @6.last_column - @5.first_column);
-                                          SET_EXCEPTION_LOCATION(forIn, @4.first_column, @5.first_column + 1, @6.last_column);
+                                          setExceptionLocation(forIn, @4.first_column, @5.first_column + 1, @6.last_column);
                                           appendToVarDeclarationList(GLOBAL_DATA, $8.m_varDeclarations, *$4, DeclarationStacks::HasInitializer);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(forIn, $8.m_varDeclarations, $8.m_funcDeclarations, ((*$4 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $6.m_features | $8.m_features, $6.m_numConstants + $8.m_numConstants);
-                                          DBG($$.m_node, @1, @7); }
+                                          setStatementLocation($$.m_node, @1, @7); }
   | FOR '(' VAR IDENT InitializerNoIn INTOKEN Expr ')' Statement
                                         { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *$4, $5.m_node, $7.m_node, $9.m_node, @5.first_column, @5.first_column - @4.first_column, @5.last_column - @5.first_column);
-                                          SET_EXCEPTION_LOCATION(forIn, @4.first_column, @6.first_column + 1, @7.last_column);
+                                          setExceptionLocation(forIn, @4.first_column, @6.first_column + 1, @7.last_column);
                                           appendToVarDeclarationList(GLOBAL_DATA, $9.m_varDeclarations, *$4, DeclarationStacks::HasInitializer);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(forIn, $9.m_varDeclarations, $9.m_funcDeclarations,
                                                                                          ((*$4 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $5.m_features | $7.m_features | $9.m_features,
                                                                                          $5.m_numConstants + $7.m_numConstants + $9.m_numConstants);
-                                          DBG($$.m_node, @1, @8); }
+                                          setStatementLocation($$.m_node, @1, @8); }
 ;
 
 ExprOpt:
@@ -1020,63 +1029,63 @@ ExprNoInOpt:
 
 ContinueStatement:
     CONTINUE ';'                        { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column); 
+                                          setExceptionLocation(node, @1.first_column, @1.last_column, @1.last_column); 
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
-                                          DBG($$.m_node, @1, @2); }
+                                          setStatementLocation($$.m_node, @1, @2); }
   | CONTINUE error                      { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column); 
+                                          setExceptionLocation(node, @1.first_column, @1.last_column, @1.last_column); 
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
-                                          DBG($$.m_node, @1, @1); AUTO_SEMICOLON; }
+                                          setStatementLocation($$.m_node, @1, @1); AUTO_SEMICOLON; }
   | CONTINUE IDENT ';'                  { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *$2);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column); 
+                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column); 
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
-                                          DBG($$.m_node, @1, @3); }
+                                          setStatementLocation($$.m_node, @1, @3); }
   | CONTINUE IDENT error                { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *$2);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column); 
+                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column); 
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
-                                          DBG($$.m_node, @1, @2); AUTO_SEMICOLON; }
+                                          setStatementLocation($$.m_node, @1, @2); AUTO_SEMICOLON; }
 ;
 
 BreakStatement:
     BREAK ';'                           { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG($$.m_node, @1, @2); }
+                                          setExceptionLocation(node, @1.first_column, @1.last_column, @1.last_column);
+                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation($$.m_node, @1, @2); }
   | BREAK error                         { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA), 0, 0, 0, 0); DBG($$.m_node, @1, @1); AUTO_SEMICOLON; }
+                                          setExceptionLocation(node, @1.first_column, @1.last_column, @1.last_column);
+                                          $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA), 0, 0, 0, 0); setStatementLocation($$.m_node, @1, @1); AUTO_SEMICOLON; }
   | BREAK IDENT ';'                     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *$2);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG($$.m_node, @1, @3); }
+                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column);
+                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation($$.m_node, @1, @3); }
   | BREAK IDENT error                   { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *$2);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *$2), 0, 0, 0, 0); DBG($$.m_node, @1, @2); AUTO_SEMICOLON; }
+                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column);
+                                          $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *$2), 0, 0, 0, 0); setStatementLocation($$.m_node, @1, @2); AUTO_SEMICOLON; }
 ;
 
 ReturnStatement:
     RETURN ';'                          { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column); 
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG($$.m_node, @1, @2); }
+                                          setExceptionLocation(node, @1.first_column, @1.last_column, @1.last_column); 
+                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation($$.m_node, @1, @2); }
   | RETURN error                        { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column); 
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG($$.m_node, @1, @1); AUTO_SEMICOLON; }
+                                          setExceptionLocation(node, @1.first_column, @1.last_column, @1.last_column); 
+                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation($$.m_node, @1, @1); AUTO_SEMICOLON; }
   | RETURN Expr ';'                     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, $2.m_node); 
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); DBG($$.m_node, @1, @3); }
+                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column);
+                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); setStatementLocation($$.m_node, @1, @3); }
   | RETURN Expr error                   { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, $2.m_node); 
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column); 
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); DBG($$.m_node, @1, @2); AUTO_SEMICOLON; }
+                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column); 
+                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); setStatementLocation($$.m_node, @1, @2); AUTO_SEMICOLON; }
 ;
 
 WithStatement:
     WITH '(' Expr ')' Statement         { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WithNode(GLOBAL_DATA, $3.m_node, $5.m_node, @3.last_column, @3.last_column - @3.first_column),
                                                                                          $5.m_varDeclarations, $5.m_funcDeclarations, $3.m_features | $5.m_features | WithFeature, $3.m_numConstants + $5.m_numConstants);
-                                          DBG($$.m_node, @1, @4); }
+                                          setStatementLocation($$.m_node, @1, @4); }
 ;
 
 SwitchStatement:
     SWITCH '(' Expr ')' CaseBlock       { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) SwitchNode(GLOBAL_DATA, $3.m_node, $5.m_node), $5.m_varDeclarations, $5.m_funcDeclarations,
                                                                                          $3.m_features | $5.m_features, $3.m_numConstants + $5.m_numConstants);
-                                          DBG($$.m_node, @1, @4); }
+                                          setStatementLocation($$.m_node, @1, @4); }
 ;
 
 CaseBlock:
@@ -1090,7 +1099,7 @@ CaseBlock:
 ;
 
 CaseClausesOpt:
-/* nothing */                       { $$.m_node.head = 0; $$.m_node.tail = 0; $$.m_varDeclarations = 0; $$.m_funcDeclarations = 0; $$.m_features = 0; $$.m_numConstants = 0; }
+  /* nothing */                         { $$.m_node.head = 0; $$.m_node.tail = 0; $$.m_varDeclarations = 0; $$.m_funcDeclarations = 0; $$.m_features = 0; $$.m_numConstants = 0; }
   | CaseClauses
 ;
 
@@ -1122,18 +1131,18 @@ DefaultClause:
 
 LabelledStatement:
     IDENT ':' Statement                 { LabelNode* node = new (GLOBAL_DATA) LabelNode(GLOBAL_DATA, *$1, $3.m_node);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
+                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, $3.m_varDeclarations, $3.m_funcDeclarations, $3.m_features, $3.m_numConstants); }
 ;
 
 ThrowStatement:
     THROW Expr ';'                      { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, $2.m_node);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); DBG($$.m_node, @1, @2);
+                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column);
+                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); setStatementLocation($$.m_node, @1, @2);
                                         }
   | THROW Expr error                    { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, $2.m_node);
-                                          SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); DBG($$.m_node, @1, @2); AUTO_SEMICOLON; 
+                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column);
+                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); setStatementLocation($$.m_node, @1, @2); AUTO_SEMICOLON; 
                                         }
 ;
 
@@ -1143,57 +1152,57 @@ TryStatement:
                                                                                          mergeDeclarationLists($2.m_funcDeclarations, $4.m_funcDeclarations),
                                                                                          $2.m_features | $4.m_features,
                                                                                          $2.m_numConstants + $4.m_numConstants);
-                                          DBG($$.m_node, @1, @2); }
+                                          setStatementLocation($$.m_node, @1, @2); }
   | TRY Block CATCH '(' IDENT ')' Block { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, $2.m_node, *$5, ($7.m_features & EvalFeature) != 0, $7.m_node, 0),
                                                                                          mergeDeclarationLists($2.m_varDeclarations, $7.m_varDeclarations),
                                                                                          mergeDeclarationLists($2.m_funcDeclarations, $7.m_funcDeclarations),
                                                                                          $2.m_features | $7.m_features | CatchFeature,
                                                                                          $2.m_numConstants + $7.m_numConstants);
-                                          DBG($$.m_node, @1, @2); }
+                                          setStatementLocation($$.m_node, @1, @2); }
   | TRY Block CATCH '(' IDENT ')' Block FINALLY Block
                                         { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, $2.m_node, *$5, ($7.m_features & EvalFeature) != 0, $7.m_node, $9.m_node),
                                                                                          mergeDeclarationLists(mergeDeclarationLists($2.m_varDeclarations, $7.m_varDeclarations), $9.m_varDeclarations),
                                                                                          mergeDeclarationLists(mergeDeclarationLists($2.m_funcDeclarations, $7.m_funcDeclarations), $9.m_funcDeclarations),
                                                                                          $2.m_features | $7.m_features | $9.m_features | CatchFeature,
                                                                                          $2.m_numConstants + $7.m_numConstants + $9.m_numConstants);
-                                          DBG($$.m_node, @1, @2); }
+                                          setStatementLocation($$.m_node, @1, @2); }
 ;
 
 DebuggerStatement:
     DEBUGGER ';'                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
-                                          DBG($$.m_node, @1, @2); }
+                                          setStatementLocation($$.m_node, @1, @2); }
   | DEBUGGER error                      { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
-                                          DBG($$.m_node, @1, @1); AUTO_SEMICOLON; }
+                                          setStatementLocation($$.m_node, @1, @1); AUTO_SEMICOLON; }
 ;
 
 FunctionDeclaration:
-    FUNCTION IDENT '(' ')' OPENBRACE FunctionBody CLOSEBRACE { $$ = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *$2, $6, LEXER->sourceCode($5, $7, @5.first_line)), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*$2 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | ClosureFeature, 0); DBG($6, @5, @7); $$.m_funcDeclarations->data.append(static_cast<FuncDeclNode*>($$.m_node)); }
+    FUNCTION IDENT '(' ')' OPENBRACE FunctionBody CLOSEBRACE { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) FuncDeclNode(GLOBAL_DATA, *$2, $6, GLOBAL_DATA->lexer->sourceCode($5, $7, @5.first_line)), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*$2 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | ClosureFeature, 0); setStatementLocation($6, @5, @7); $$.m_funcDeclarations->data.append(static_cast<FuncDeclNode*>($$.m_node)->body()); }
   | FUNCTION IDENT '(' FormalParameterList ')' OPENBRACE FunctionBody CLOSEBRACE
-      { 
-          $$ = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *$2, $7, LEXER->sourceCode($6, $8, @6.first_line), $4.m_node.head), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*$2 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $4.m_features | ClosureFeature, 0); 
+      {
+          $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) FuncDeclNode(GLOBAL_DATA, *$2, $7, GLOBAL_DATA->lexer->sourceCode($6, $8, @6.first_line), $4.m_node.head), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*$2 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $4.m_features | ClosureFeature, 0);
           if ($4.m_features & ArgumentsFeature)
-              $7->setUsesArguments(); 
-          DBG($7, @6, @8);
-          $$.m_funcDeclarations->data.append(static_cast<FuncDeclNode*>($$.m_node));
+              $7->setUsesArguments();
+          setStatementLocation($7, @6, @8);
+          $$.m_funcDeclarations->data.append(static_cast<FuncDeclNode*>($$.m_node)->body());
       }
 ;
 
 FunctionExpr:
-    FUNCTION '(' ')' OPENBRACE FunctionBody CLOSEBRACE { $$ = createNodeInfo(new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, $5, LEXER->sourceCode($4, $6, @4.first_line)), ClosureFeature, 0); DBG($5, @4, @6); }
-    | FUNCTION '(' FormalParameterList ')' OPENBRACE FunctionBody CLOSEBRACE 
-      { 
-          $$ = createNodeInfo(new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, $6, LEXER->sourceCode($5, $7, @5.first_line), $3.m_node.head), $3.m_features | ClosureFeature, 0); 
-          if ($3.m_features & ArgumentsFeature) 
+    FUNCTION '(' ')' OPENBRACE FunctionBody CLOSEBRACE { $$ = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, $5, GLOBAL_DATA->lexer->sourceCode($4, $6, @4.first_line)), ClosureFeature, 0); setStatementLocation($5, @4, @6); }
+    | FUNCTION '(' FormalParameterList ')' OPENBRACE FunctionBody CLOSEBRACE
+      {
+          $$ = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, $6, GLOBAL_DATA->lexer->sourceCode($5, $7, @5.first_line), $3.m_node.head), $3.m_features | ClosureFeature, 0);
+          if ($3.m_features & ArgumentsFeature)
               $6->setUsesArguments();
-          DBG($6, @5, @7); 
+          setStatementLocation($6, @5, @7);
       }
-  | FUNCTION IDENT '(' ')' OPENBRACE FunctionBody CLOSEBRACE { $$ = createNodeInfo(new FuncExprNode(GLOBAL_DATA, *$2, $6, LEXER->sourceCode($5, $7, @5.first_line)), ClosureFeature, 0); DBG($6, @5, @7); }
-  | FUNCTION IDENT '(' FormalParameterList ')' OPENBRACE FunctionBody CLOSEBRACE 
-      { 
-          $$ = createNodeInfo(new FuncExprNode(GLOBAL_DATA, *$2, $7, LEXER->sourceCode($6, $8, @6.first_line), $4.m_node.head), $4.m_features | ClosureFeature, 0); 
+  | FUNCTION IDENT '(' ')' OPENBRACE FunctionBody CLOSEBRACE { $$ = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, *$2, $6, GLOBAL_DATA->lexer->sourceCode($5, $7, @5.first_line)), ClosureFeature, 0); setStatementLocation($6, @5, @7); }
+  | FUNCTION IDENT '(' FormalParameterList ')' OPENBRACE FunctionBody CLOSEBRACE
+      {
+          $$ = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, *$2, $7, GLOBAL_DATA->lexer->sourceCode($6, $8, @6.first_line), $4.m_node.head), $4.m_features | ClosureFeature, 0); 
           if ($4.m_features & ArgumentsFeature)
               $7->setUsesArguments();
-          DBG($7, @6, @8); 
+          setStatementLocation($7, @6, @8);
       }
 ;
 
@@ -1241,8 +1250,8 @@ Literal_NoNode:
   | FALSETOKEN
   | NUMBER { }
   | STRING { }
-  | '/' /* regexp */ { Lexer& l = *LEXER; if (!l.scanRegExp()) YYABORT; }
-  | DIVEQUAL /* regexp with /= */ { Lexer& l = *LEXER; if (!l.scanRegExp()) YYABORT; }
+  | '/' /* regexp */ { if (!GLOBAL_DATA->lexer->skipRegExp()) YYABORT; }
+  | DIVEQUAL /* regexp with /= */ { if (!GLOBAL_DATA->lexer->skipRegExp()) YYABORT; }
 ;
 
 Property_NoNode:
@@ -1824,26 +1833,28 @@ SourceElements_NoNode:
 
 %%
 
-static ExpressionNode* makeAssignNode(void* globalPtr, ExpressionNode* loc, Operator op, ExpressionNode* expr, bool locHasAssignments, bool exprHasAssignments, int start, int divot, int end)
+#undef GLOBAL_DATA
+
+static ExpressionNode* makeAssignNode(JSGlobalData* globalData, ExpressionNode* loc, Operator op, ExpressionNode* expr, bool locHasAssignments, bool exprHasAssignments, int start, int divot, int end)
 {
     if (!loc->isLocation())
-        return new (GLOBAL_DATA) AssignErrorNode(GLOBAL_DATA, loc, op, expr, divot, divot - start, end - divot);
+        return new (globalData) AssignErrorNode(globalData, loc, op, expr, divot, divot - start, end - divot);
 
     if (loc->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(loc);
         if (op == OpEqual) {
-            AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, resolve->identifier(), expr, exprHasAssignments);
-            SET_EXCEPTION_LOCATION(node, start, divot, end);
+            AssignResolveNode* node = new (globalData) AssignResolveNode(globalData, resolve->identifier(), expr, exprHasAssignments);
+            setExceptionLocation(node, start, divot, end);
             return node;
         } else
-            return new (GLOBAL_DATA) ReadModifyResolveNode(GLOBAL_DATA, resolve->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
+            return new (globalData) ReadModifyResolveNode(globalData, resolve->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
     }
     if (loc->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(loc);
         if (op == OpEqual)
-            return new (GLOBAL_DATA) AssignBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), expr, locHasAssignments, exprHasAssignments, bracket->divot(), bracket->divot() - start, end - bracket->divot());
+            return new (globalData) AssignBracketNode(globalData, bracket->base(), bracket->subscript(), expr, locHasAssignments, exprHasAssignments, bracket->divot(), bracket->divot() - start, end - bracket->divot());
         else {
-            ReadModifyBracketNode* node = new (GLOBAL_DATA) ReadModifyBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, expr, locHasAssignments, exprHasAssignments, divot, divot - start, end - divot);
+            ReadModifyBracketNode* node = new (globalData) ReadModifyBracketNode(globalData, bracket->base(), bracket->subscript(), op, expr, locHasAssignments, exprHasAssignments, divot, divot - start, end - divot);
             node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
             return node;
         }
@@ -1851,117 +1862,117 @@ static ExpressionNode* makeAssignNode(void* globalPtr, ExpressionNode* loc, Oper
     ASSERT(loc->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(loc);
     if (op == OpEqual)
-        return new (GLOBAL_DATA) AssignDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), expr, exprHasAssignments, dot->divot(), dot->divot() - start, end - dot->divot());
+        return new (globalData) AssignDotNode(globalData, dot->base(), dot->identifier(), expr, exprHasAssignments, dot->divot(), dot->divot() - start, end - dot->divot());
 
-    ReadModifyDotNode* node = new (GLOBAL_DATA) ReadModifyDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
+    ReadModifyDotNode* node = new (globalData) ReadModifyDotNode(globalData, dot->base(), dot->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return node;
 }
 
-static ExpressionNode* makePrefixNode(void* globalPtr, ExpressionNode* expr, Operator op, int start, int divot, int end)
+static ExpressionNode* makePrefixNode(JSGlobalData* globalData, ExpressionNode* expr, Operator op, int start, int divot, int end)
 {
     if (!expr->isLocation())
-        return new (GLOBAL_DATA) PrefixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
+        return new (globalData) PrefixErrorNode(globalData, expr, op, divot, divot - start, end - divot);
     
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (GLOBAL_DATA) PrefixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
+        return new (globalData) PrefixResolveNode(globalData, resolve->identifier(), op, divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PrefixBracketNode* node = new (GLOBAL_DATA) PrefixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
+        PrefixBracketNode* node = new (globalData) PrefixBracketNode(globalData, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->startOffset());
         return node;
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PrefixDotNode* node = new (GLOBAL_DATA) PrefixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
+    PrefixDotNode* node = new (globalData) PrefixDotNode(globalData, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->startOffset());
     return node;
 }
 
-static ExpressionNode* makePostfixNode(void* globalPtr, ExpressionNode* expr, Operator op, int start, int divot, int end)
+static ExpressionNode* makePostfixNode(JSGlobalData* globalData, ExpressionNode* expr, Operator op, int start, int divot, int end)
 { 
     if (!expr->isLocation())
-        return new (GLOBAL_DATA) PostfixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
+        return new (globalData) PostfixErrorNode(globalData, expr, op, divot, divot - start, end - divot);
     
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (GLOBAL_DATA) PostfixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
+        return new (globalData) PostfixResolveNode(globalData, resolve->identifier(), op, divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PostfixBracketNode* node = new (GLOBAL_DATA) PostfixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
+        PostfixBracketNode* node = new (globalData) PostfixBracketNode(globalData, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
         return node;
         
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PostfixDotNode* node = new (GLOBAL_DATA) PostfixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
+    PostfixDotNode* node = new (globalData) PostfixDotNode(globalData, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return node;
 }
 
-static ExpressionNodeInfo makeFunctionCallNode(void* globalPtr, ExpressionNodeInfo func, ArgumentsNodeInfo args, int start, int divot, int end)
+static ExpressionNodeInfo makeFunctionCallNode(JSGlobalData* globalData, ExpressionNodeInfo func, ArgumentsNodeInfo args, int start, int divot, int end)
 {
     CodeFeatures features = func.m_features | args.m_features;
     int numConstants = func.m_numConstants + args.m_numConstants;
     if (!func.m_node->isLocation())
-        return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) FunctionCallValueNode(GLOBAL_DATA, func.m_node, args.m_node, divot, divot - start, end - divot), features, numConstants);
+        return createNodeInfo<ExpressionNode*>(new (globalData) FunctionCallValueNode(globalData, func.m_node, args.m_node, divot, divot - start, end - divot), features, numConstants);
     if (func.m_node->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(func.m_node);
         const Identifier& identifier = resolve->identifier();
-        if (identifier == GLOBAL_DATA->propertyNames->eval)
-            return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EvalFunctionCallNode(GLOBAL_DATA, args.m_node, divot, divot - start, end - divot), EvalFeature | features, numConstants);
-        return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) FunctionCallResolveNode(GLOBAL_DATA, identifier, args.m_node, divot, divot - start, end - divot), features, numConstants);
+        if (identifier == globalData->propertyNames->eval)
+            return createNodeInfo<ExpressionNode*>(new (globalData) EvalFunctionCallNode(globalData, args.m_node, divot, divot - start, end - divot), EvalFeature | features, numConstants);
+        return createNodeInfo<ExpressionNode*>(new (globalData) FunctionCallResolveNode(globalData, identifier, args.m_node, divot, divot - start, end - divot), features, numConstants);
     }
     if (func.m_node->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(func.m_node);
-        FunctionCallBracketNode* node = new (GLOBAL_DATA) FunctionCallBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), args.m_node, divot, divot - start, end - divot);
+        FunctionCallBracketNode* node = new (globalData) FunctionCallBracketNode(globalData, bracket->base(), bracket->subscript(), args.m_node, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
         return createNodeInfo<ExpressionNode*>(node, features, numConstants);
     }
     ASSERT(func.m_node->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(func.m_node);
     FunctionCallDotNode* node;
-    if (dot->identifier() == GLOBAL_DATA->propertyNames->call)
-        node = new (GLOBAL_DATA) CallFunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
-    else if (dot->identifier() == GLOBAL_DATA->propertyNames->apply)
-        node = new (GLOBAL_DATA) ApplyFunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+    if (dot->identifier() == globalData->propertyNames->call)
+        node = new (globalData) CallFunctionCallDotNode(globalData, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+    else if (dot->identifier() == globalData->propertyNames->apply)
+        node = new (globalData) ApplyFunctionCallDotNode(globalData, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
     else
-        node = new (GLOBAL_DATA) FunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+        node = new (globalData) FunctionCallDotNode(globalData, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return createNodeInfo<ExpressionNode*>(node, features, numConstants);
 }
 
-static ExpressionNode* makeTypeOfNode(void* globalPtr, ExpressionNode* expr)
+static ExpressionNode* makeTypeOfNode(JSGlobalData* globalData, ExpressionNode* expr)
 {
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (GLOBAL_DATA) TypeOfResolveNode(GLOBAL_DATA, resolve->identifier());
+        return new (globalData) TypeOfResolveNode(globalData, resolve->identifier());
     }
-    return new (GLOBAL_DATA) TypeOfValueNode(GLOBAL_DATA, expr);
+    return new (globalData) TypeOfValueNode(globalData, expr);
 }
 
-static ExpressionNode* makeDeleteNode(void* globalPtr, ExpressionNode* expr, int start, int divot, int end)
+static ExpressionNode* makeDeleteNode(JSGlobalData* globalData, ExpressionNode* expr, int start, int divot, int end)
 {
     if (!expr->isLocation())
-        return new (GLOBAL_DATA) DeleteValueNode(GLOBAL_DATA, expr);
+        return new (globalData) DeleteValueNode(globalData, expr);
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (GLOBAL_DATA) DeleteResolveNode(GLOBAL_DATA, resolve->identifier(), divot, divot - start, end - divot);
+        return new (globalData) DeleteResolveNode(globalData, resolve->identifier(), divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        return new (GLOBAL_DATA) DeleteBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), divot, divot - start, end - divot);
+        return new (globalData) DeleteBracketNode(globalData, bracket->base(), bracket->subscript(), divot, divot - start, end - divot);
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    return new (GLOBAL_DATA) DeleteDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), divot, divot - start, end - divot);
+    return new (globalData) DeleteDotNode(globalData, dot->base(), dot->identifier(), divot, divot - start, end - divot);
 }
 
-static PropertyNode* makeGetterOrSetterPropertyNode(void* globalPtr, const Identifier& getOrSet, const Identifier& name, ParameterNode* params, FunctionBodyNode* body, const SourceCode& source)
+static PropertyNode* makeGetterOrSetterPropertyNode(JSGlobalData* globalData, const Identifier& getOrSet, const Identifier& name, ParameterNode* params, FunctionBodyNode* body, const SourceCode& source)
 {
     PropertyNode::Type type;
     if (getOrSet == "get")
@@ -1970,10 +1981,10 @@ static PropertyNode* makeGetterOrSetterPropertyNode(void* globalPtr, const Ident
         type = PropertyNode::Setter;
     else
         return 0;
-    return new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, name, new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, body, source, params), type);
+    return new (globalData) PropertyNode(globalData, name, new (globalData) FuncExprNode(globalData, globalData->propertyNames->nullIdentifier, body, source, params), type);
 }
 
-static ExpressionNode* makeNegateNode(void* globalPtr, ExpressionNode* n)
+static ExpressionNode* makeNegateNode(JSGlobalData* globalData, ExpressionNode* n)
 {
     if (n->isNumber()) {
         NumberNode* number = static_cast<NumberNode*>(n);
@@ -1984,92 +1995,92 @@ static ExpressionNode* makeNegateNode(void* globalPtr, ExpressionNode* n)
         }
     }
 
-    return new (GLOBAL_DATA) NegateNode(GLOBAL_DATA, n);
+    return new (globalData) NegateNode(globalData, n);
 }
 
-static NumberNode* makeNumberNode(void* globalPtr, double d)
+static NumberNode* makeNumberNode(JSGlobalData* globalData, double d)
 {
-    return new (GLOBAL_DATA) NumberNode(GLOBAL_DATA, d);
+    return new (globalData) NumberNode(globalData, d);
 }
 
-static ExpressionNode* makeBitwiseNotNode(void* globalPtr, ExpressionNode* expr)
+static ExpressionNode* makeBitwiseNotNode(JSGlobalData* globalData, ExpressionNode* expr)
 {
     if (expr->isNumber())
-        return makeNumberNode(globalPtr, ~toInt32(static_cast<NumberNode*>(expr)->value()));
-    return new (GLOBAL_DATA) BitwiseNotNode(GLOBAL_DATA, expr);
+        return makeNumberNode(globalData, ~toInt32(static_cast<NumberNode*>(expr)->value()));
+    return new (globalData) BitwiseNotNode(globalData, expr);
 }
 
-static ExpressionNode* makeMultNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+static ExpressionNode* makeMultNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     expr1 = expr1->stripUnaryPlus();
     expr2 = expr2->stripUnaryPlus();
 
     if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() * static_cast<NumberNode*>(expr2)->value());
+        return makeNumberNode(globalData, static_cast<NumberNode*>(expr1)->value() * static_cast<NumberNode*>(expr2)->value());
 
     if (expr1->isNumber() && static_cast<NumberNode*>(expr1)->value() == 1)
-        return new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, expr2);
+        return new (globalData) UnaryPlusNode(globalData, expr2);
 
     if (expr2->isNumber() && static_cast<NumberNode*>(expr2)->value() == 1)
-        return new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, expr1);
+        return new (globalData) UnaryPlusNode(globalData, expr1);
 
-    return new (GLOBAL_DATA) MultNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (globalData) MultNode(globalData, expr1, expr2, rightHasAssignments);
 }
 
-static ExpressionNode* makeDivNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+static ExpressionNode* makeDivNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     expr1 = expr1->stripUnaryPlus();
     expr2 = expr2->stripUnaryPlus();
 
     if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() / static_cast<NumberNode*>(expr2)->value());
-    return new (GLOBAL_DATA) DivNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+        return makeNumberNode(globalData, static_cast<NumberNode*>(expr1)->value() / static_cast<NumberNode*>(expr2)->value());
+    return new (globalData) DivNode(globalData, expr1, expr2, rightHasAssignments);
 }
 
-static ExpressionNode* makeAddNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+static ExpressionNode* makeAddNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() + static_cast<NumberNode*>(expr2)->value());
-    return new (GLOBAL_DATA) AddNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+        return makeNumberNode(globalData, static_cast<NumberNode*>(expr1)->value() + static_cast<NumberNode*>(expr2)->value());
+    return new (globalData) AddNode(globalData, expr1, expr2, rightHasAssignments);
 }
 
-static ExpressionNode* makeSubNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+static ExpressionNode* makeSubNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     expr1 = expr1->stripUnaryPlus();
     expr2 = expr2->stripUnaryPlus();
 
     if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() - static_cast<NumberNode*>(expr2)->value());
-    return new (GLOBAL_DATA) SubNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+        return makeNumberNode(globalData, static_cast<NumberNode*>(expr1)->value() - static_cast<NumberNode*>(expr2)->value());
+    return new (globalData) SubNode(globalData, expr1, expr2, rightHasAssignments);
 }
 
-static ExpressionNode* makeLeftShiftNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+static ExpressionNode* makeLeftShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalPtr, toInt32(static_cast<NumberNode*>(expr1)->value()) << (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new (GLOBAL_DATA) LeftShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+        return makeNumberNode(globalData, toInt32(static_cast<NumberNode*>(expr1)->value()) << (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
+    return new (globalData) LeftShiftNode(globalData, expr1, expr2, rightHasAssignments);
 }
 
-static ExpressionNode* makeRightShiftNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+static ExpressionNode* makeRightShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalPtr, toInt32(static_cast<NumberNode*>(expr1)->value()) >> (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new (GLOBAL_DATA) RightShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+        return makeNumberNode(globalData, toInt32(static_cast<NumberNode*>(expr1)->value()) >> (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
+    return new (globalData) RightShiftNode(globalData, expr1, expr2, rightHasAssignments);
 }
 
-/* called by yyparse on error */
-int yyerror(const char *)
+// Called by yyparse on error.
+int yyerror(const char*)
 {
     return 1;
 }
 
-/* may we automatically insert a semicolon ? */
+// May we automatically insert a semicolon?
 static bool allowAutomaticSemicolon(Lexer& lexer, int yychar)
 {
     return yychar == CLOSEBRACE || yychar == 0 || lexer.prevTerminator();
 }
 
-static ExpressionNode* combineCommaNodes(void* globalPtr, ExpressionNode* list, ExpressionNode* init)
+static ExpressionNode* combineCommaNodes(JSGlobalData* globalData, ExpressionNode* list, ExpressionNode* init)
 {
     if (!list)
         return init;
@@ -2077,17 +2088,15 @@ static ExpressionNode* combineCommaNodes(void* globalPtr, ExpressionNode* list,
         static_cast<CommaNode*>(list)->append(init);
         return list;
     }
-    return new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, list, init);
+    return new (globalData) CommaNode(globalData, list, init);
 }
 
 // We turn variable declarations into either assignments or empty
 // statements (which later get stripped out), because the actual
 // declaration work is hoisted up to the start of the function body
-static StatementNode* makeVarStatementNode(void* globalPtr, ExpressionNode* expr)
+static StatementNode* makeVarStatementNode(JSGlobalData* globalData, ExpressionNode* expr)
 {
     if (!expr)
-        return new (GLOBAL_DATA) EmptyStatementNode(GLOBAL_DATA);
-    return new (GLOBAL_DATA) VarStatementNode(GLOBAL_DATA, expr);
+        return new (globalData) EmptyStatementNode(globalData);
+    return new (globalData) VarStatementNode(globalData, expr);
 }
-
-#undef GLOBAL_DATA
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp
index c36763c..785b219 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp
@@ -59,7 +59,6 @@ static const UChar byteOrderMark = 0xFEFF;
 Lexer::Lexer(JSGlobalData* globalData)
     : m_isReparsing(false)
     , m_globalData(globalData)
-    , m_startColumnNumberCorrection(0)
     , m_keywordTable(JSC::mainTable)
 {
     m_buffer8.reserveInitialCapacity(initialReadBufferCapacity);
@@ -142,8 +141,10 @@ ALWAYS_INLINE void Lexer::shift4()
     m_code += 4;
 }
 
-void Lexer::setCode(const SourceCode& source)
+void Lexer::setCode(const SourceCode& source, ParserArena& arena)
 {
+    m_arena = &arena.identifierArena();
+
     m_lineNumber = source.firstLine();
     m_delimited = false;
     m_lastToken = -1;
@@ -202,14 +203,12 @@ void Lexer::shiftLineTerminator()
     else
         shift1();
 
-    m_startColumnNumberCorrection = currentOffset();
     ++m_lineNumber;
 }
 
-ALWAYS_INLINE Identifier* Lexer::makeIdentifier(const UChar* characters, size_t length)
+ALWAYS_INLINE const Identifier* Lexer::makeIdentifier(const UChar* characters, size_t length)
 {
-    m_identifiers.append(Identifier(m_globalData, characters, length));
-    return &m_identifiers.last();
+    return &m_arena->makeIdentifier(m_globalData, characters, length);
 }
 
 inline bool Lexer::lastTokenWasRestrKeyword() const
@@ -295,15 +294,11 @@ start:
     int startOffset = currentOffset();
 
     if (m_current == -1) {
-#ifndef QT_BUILD_SCRIPT_LIB /* the parser takes cate about automatic semicolon.
-                              this might add incorrect semicolons */
-        //m_delimited and m_isReparsing are now useless
         if (!m_terminator && !m_delimited && !m_isReparsing) {
             // automatic semicolon insertion if program incomplete
             token = ';';
             goto doneSemicolon;
         }
-#endif
         return 0;
     }
 
@@ -899,11 +894,11 @@ doneString:
     // Fall through into returnToken.
 
 returnToken: {
-    llocp->first_line = m_lineNumber;
-    llocp->last_line = m_lineNumber;
-
-    llocp->first_column = startOffset - m_startColumnNumberCorrection;
-    llocp->last_column = currentOffset() - m_startColumnNumberCorrection;
+    int lineNumber = m_lineNumber;
+    llocp->first_line = lineNumber;
+    llocp->last_line = lineNumber;
+    llocp->first_column = startOffset;
+    llocp->last_column = currentOffset();
 
     m_lastToken = token;
     return token;
@@ -914,48 +909,110 @@ returnError:
     return -1;
 }
 
-bool Lexer::scanRegExp()
+bool Lexer::scanRegExp(const Identifier*& pattern, const Identifier*& flags, UChar patternPrefix)
 {
     ASSERT(m_buffer16.isEmpty());
 
     bool lastWasEscape = false;
     bool inBrackets = false;
 
+    if (patternPrefix) {
+        ASSERT(!isLineTerminator(patternPrefix));
+        ASSERT(patternPrefix != '/');
+        ASSERT(patternPrefix != '[');
+        record16(patternPrefix);
+    }
+
     while (true) {
-        if (isLineTerminator(m_current) || m_current == -1)
-            return false;
-        if (m_current != '/' || lastWasEscape || inBrackets) {
-            // keep track of '[' and ']'
-            if (!lastWasEscape) {
-                if (m_current == '[' && !inBrackets)
-                    inBrackets = true;
-                if (m_current == ']' && inBrackets)
-                    inBrackets = false;
-            }
-            record16(m_current);
-            lastWasEscape = !lastWasEscape && m_current == '\\';
-        } else { // end of regexp
-            m_pattern = UString(m_buffer16);
+        int current = m_current;
+
+        if (isLineTerminator(current) || current == -1) {
             m_buffer16.resize(0);
-            shift1();
-            break;
+            return false;
         }
+
         shift1();
+
+        if (current == '/' && !lastWasEscape && !inBrackets)
+            break;
+
+        record16(current);
+
+        if (lastWasEscape) {
+            lastWasEscape = false;
+            continue;
+        }
+
+        switch (current) {
+        case '[':
+            inBrackets = true;
+            break;
+        case ']':
+            inBrackets = false;
+            break;
+        case '\\':
+            lastWasEscape = true;
+            break;
+        }
     }
 
+    pattern = makeIdentifier(m_buffer16.data(), m_buffer16.size());
+    m_buffer16.resize(0);
+
     while (isIdentPart(m_current)) {
         record16(m_current);
         shift1();
     }
-    m_flags = UString(m_buffer16);
+
+    flags = makeIdentifier(m_buffer16.data(), m_buffer16.size());
     m_buffer16.resize(0);
 
     return true;
 }
 
+bool Lexer::skipRegExp()
+{
+    bool lastWasEscape = false;
+    bool inBrackets = false;
+
+    while (true) {
+        int current = m_current;
+
+        if (isLineTerminator(current) || current == -1)
+            return false;
+
+        shift1();
+
+        if (current == '/' && !lastWasEscape && !inBrackets)
+            break;
+
+        if (lastWasEscape) {
+            lastWasEscape = false;
+            continue;
+        }
+
+        switch (current) {
+        case '[':
+            inBrackets = true;
+            break;
+        case ']':
+            inBrackets = false;
+            break;
+        case '\\':
+            lastWasEscape = true;
+            break;
+        }
+    }
+
+    while (isIdentPart(m_current))
+        shift1();
+
+    return true;
+}
+
 void Lexer::clear()
 {
-    m_identifiers.clear();
+    m_arena = 0;
     m_codeWithoutBOMs.clear();
 
     Vector<char> newBuffer8;
@@ -967,9 +1024,6 @@ void Lexer::clear()
     m_buffer16.swap(newBuffer16);
 
     m_isReparsing = false;
-
-    m_pattern = UString();
-    m_flags = UString();
 }
 
 SourceCode Lexer::sourceCode(int openBrace, int closeBrace, int firstLine)
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.h b/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.h
index 0ef6dd4..174e05a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.h
@@ -23,6 +23,7 @@
 #define Lexer_h
 
 #include "Lookup.h"
+#include "ParserArena.h"
 #include "SourceCode.h"
 #include <wtf/ASCIICType.h>
 #include <wtf/SegmentedVector.h>
@@ -42,7 +43,7 @@ namespace JSC {
         static UChar convertUnicode(int c1, int c2, int c3, int c4);
 
         // Functions to set up parsing.
-        void setCode(const SourceCode&);
+        void setCode(const SourceCode&, ParserArena&);
         void setIsReparsing() { m_isReparsing = true; }
 
         // Functions for the parser itself.
@@ -50,9 +51,8 @@ namespace JSC {
         int lineNumber() const { return m_lineNumber; }
         bool prevTerminator() const { return m_terminator; }
         SourceCode sourceCode(int openBrace, int closeBrace, int firstLine);
-        bool scanRegExp();
-        const UString& pattern() const { return m_pattern; }
-        const UString& flags() const { return m_flags; }
+        bool scanRegExp(const Identifier*& pattern, const Identifier*& flags, UChar patternPrefix = 0);
+        bool skipRegExp();
 
         // Functions for use after parsing.
         bool sawError() const { return m_error; }
@@ -79,18 +79,13 @@ namespace JSC {
         int currentOffset() const;
         const UChar* currentCharacter() const;
 
-        JSC::Identifier* makeIdentifier(const UChar* buffer, size_t length);
+        const Identifier* makeIdentifier(const UChar* characters, size_t length);
 
         bool lastTokenWasRestrKeyword() const;
 
         static const size_t initialReadBufferCapacity = 32;
-        static const size_t initialIdentifierTableCapacity = 64;
 
         int m_lineNumber;
-        // this variable is supposed to keep index of last new line character ('\n' or '\r\n'or '\n\r'...)
-        // it is importent to calculate correct first_column in parser
-        int m_startColumnNumberCorrection;
-
 
         Vector<char> m_buffer8;
         Vector<UChar> m_buffer16;
@@ -112,13 +107,10 @@ namespace JSC {
         int m_next2;
         int m_next3;
         
-        WTF::SegmentedVector<JSC::Identifier, initialIdentifierTableCapacity> m_identifiers;
+        IdentifierArena* m_arena;
 
         JSGlobalData* m_globalData;
 
-        UString m_pattern;
-        UString m_flags;
-
         const HashTable m_keywordTable;
 
         Vector<UChar> m_codeWithoutBOMs;
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/NodeConstructors.h b/src/3rdparty/webkit/JavaScriptCore/parser/NodeConstructors.h
index a4374d3..dd3b981 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/NodeConstructors.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/NodeConstructors.h
@@ -27,6 +27,16 @@
 
 namespace JSC {
 
+    inline void* ParserArenaFreeable::operator new(size_t size, JSGlobalData* globalData)
+    {
+        return globalData->parser->arena().allocateFreeable(size);
+    }
+
+    inline void* ParserArenaDeletable::operator new(size_t size, JSGlobalData* globalData)
+    {
+        return globalData->parser->arena().allocateDeletable(size);
+    }
+
     inline ParserArenaRefCounted::ParserArenaRefCounted(JSGlobalData* globalData)
     {
         globalData->parser->arena().derefWithArena(adoptRef(this));
@@ -46,7 +56,6 @@ namespace JSC {
     inline StatementNode::StatementNode(JSGlobalData* globalData)
         : Node(globalData)
         , m_lastLine(-1)
-        , m_column(-1)
     {
     }
 
@@ -61,19 +70,19 @@ namespace JSC {
     {
     }
 
-    inline NumberNode::NumberNode(JSGlobalData* globalData, double v)
+    inline NumberNode::NumberNode(JSGlobalData* globalData, double value)
         : ExpressionNode(globalData, ResultType::numberType())
-        , m_double(v)
+        , m_value(value)
     {
     }
 
-    inline StringNode::StringNode(JSGlobalData* globalData, const Identifier& v)
+    inline StringNode::StringNode(JSGlobalData* globalData, const Identifier& value)
         : ExpressionNode(globalData, ResultType::stringType())
-        , m_value(v)
+        , m_value(value)
     {
     }
 
-    inline RegExpNode::RegExpNode(JSGlobalData* globalData, const UString& pattern, const UString& flags)
+    inline RegExpNode::RegExpNode(JSGlobalData* globalData, const Identifier& pattern, const Identifier& flags)
         : ExpressionNode(globalData)
         , m_pattern(pattern)
         , m_flags(flags)
@@ -138,6 +147,13 @@ namespace JSC {
     {
     }
 
+    inline PropertyNode::PropertyNode(JSGlobalData* globalData, double name, ExpressionNode* assign, Type type)
+        : m_name(globalData->parser->arena().identifierArena().makeNumericIdentifier(globalData, name))
+        , m_assign(assign)
+        , m_type(type)
+    {
+    }
+
     inline PropertyListNode::PropertyListNode(JSGlobalData* globalData, PropertyNode* node)
         : Node(globalData)
         , m_node(node)
@@ -725,6 +741,7 @@ namespace JSC {
 
     inline ContinueNode::ContinueNode(JSGlobalData* globalData)
         : StatementNode(globalData)
+        , m_ident(globalData->propertyNames->nullIdentifier)
     {
     }
 
@@ -736,6 +753,7 @@ namespace JSC {
     
     inline BreakNode::BreakNode(JSGlobalData* globalData)
         : StatementNode(globalData)
+        , m_ident(globalData->propertyNames->nullIdentifier)
     {
     }
 
@@ -798,32 +816,22 @@ namespace JSC {
 
     inline FuncExprNode::FuncExprNode(JSGlobalData* globalData, const Identifier& ident, FunctionBodyNode* body, const SourceCode& source, ParameterNode* parameter)
         : ExpressionNode(globalData)
-        , ParserArenaRefCounted(globalData)
-        , m_ident(ident)
         , m_body(body)
     {
-        m_body->finishParsing(source, parameter);
+        m_body->finishParsing(source, parameter, ident);
     }
 
     inline FuncDeclNode::FuncDeclNode(JSGlobalData* globalData, const Identifier& ident, FunctionBodyNode* body, const SourceCode& source, ParameterNode* parameter)
         : StatementNode(globalData)
-        , ParserArenaRefCounted(globalData)
-        , m_ident(ident)
         , m_body(body)
     {
-        m_body->finishParsing(source, parameter);
-    }
-
-    inline CaseClauseNode::CaseClauseNode(JSGlobalData*, ExpressionNode* expr)
-        : m_expr(expr)
-    {
+        m_body->finishParsing(source, parameter, ident);
     }
 
-    inline CaseClauseNode::CaseClauseNode(JSGlobalData*, ExpressionNode* expr, SourceElements* children)
+    inline CaseClauseNode::CaseClauseNode(JSGlobalData*, ExpressionNode* expr, SourceElements* statements)
         : m_expr(expr)
+        , m_statements(statements)
     {
-        if (children)
-            children->releaseContentsIntoVector(m_children);
     }
 
     inline ClauseListNode::ClauseListNode(JSGlobalData*, CaseClauseNode* clause)
@@ -861,15 +869,15 @@ namespace JSC {
     {
     }
 
-    inline BlockNode::BlockNode(JSGlobalData* globalData, SourceElements* children)
+    inline BlockNode::BlockNode(JSGlobalData* globalData, SourceElements* statements)
         : StatementNode(globalData)
+        , m_statements(statements)
     {
-        if (children)
-            children->releaseContentsIntoVector(m_children);
     }
 
     inline ForInNode::ForInNode(JSGlobalData* globalData, ExpressionNode* l, ExpressionNode* expr, StatementNode* statement)
         : StatementNode(globalData)
+        , m_ident(globalData->propertyNames->nullIdentifier)
         , m_init(0)
         , m_lexpr(l)
         , m_expr(expr)
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
index 9d9fe72..14a398a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
@@ -49,7 +49,28 @@ using namespace WTF;
 
 namespace JSC {
 
-static void substitute(UString& string, const UString& substring);
+/*
+    Details of the emitBytecode function.
+
+    Return value: The register holding the production's value.
+             dst: An optional parameter specifying the most efficient destination at
+                  which to store the production's value. The callee must honor dst.
+
+    The dst argument provides for a crude form of copy propagation. For example,
+
+        x = 1
+
+    becomes
+    
+        load r[x], 1
+    
+    instead of 
+
+        load r0, 1
+        mov r[x], r0
+    
+    because the assignment node, "x =", passes r[x] as dst to the number node, "1".
+*/
 
 // ------------------------------ ThrowableExpressionData --------------------------------
 
@@ -63,31 +84,35 @@ static void substitute(UString& string, const UString& substring)
     string = newString;
 }
 
-RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType e, const char* msg)
+RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* message)
 {
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    RegisterID* exception = generator.emitNewError(generator.newTemporary(), e, jsString(generator.globalData(), msg));
+    RegisterID* exception = generator.emitNewError(generator.newTemporary(), type, jsString(generator.globalData(), message));
     generator.emitThrow(exception);
     return exception;
 }
 
-RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType e, const char* msg, const Identifier& label)
+RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* messageTemplate, const UString& label)
 {
-    UString message = msg;
-    substitute(message, label.ustring());
+    UString message = messageTemplate;
+    substitute(message, label);
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    RegisterID* exception = generator.emitNewError(generator.newTemporary(), e, jsString(generator.globalData(), message));
+    RegisterID* exception = generator.emitNewError(generator.newTemporary(), type, jsString(generator.globalData(), message));
     generator.emitThrow(exception);
     return exception;
 }
 
+inline RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* messageTemplate, const Identifier& label)
+{
+    return emitThrowError(generator, type, messageTemplate, label.ustring());
+}
+
 // ------------------------------ StatementNode --------------------------------
 
-void StatementNode::setLoc(int firstLine, int lastLine, int column)
+void StatementNode::setLoc(int firstLine, int lastLine)
 {
     m_line = firstLine;
     m_lastLine = lastLine;
-    m_column = column;
 }
 
 // ------------------------------ SourceElements --------------------------------
@@ -99,6 +124,18 @@ void SourceElements::append(StatementNode* statement)
     m_statements.append(statement);
 }
 
+inline StatementNode* SourceElements::singleStatement() const
+{
+    size_t size = m_statements.size();
+    return size == 1 ? m_statements[0] : 0;
+}
+
+inline StatementNode* SourceElements::lastStatement() const
+{
+    size_t size = m_statements.size();
+    return size ? m_statements[size - 1] : 0;
+}
+
 // ------------------------------ NullNode -------------------------------------
 
 RegisterID* NullNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
@@ -123,7 +160,7 @@ RegisterID* NumberNode::emitBytecode(BytecodeGenerator& generator, RegisterID* d
 {
     if (dst == generator.ignoredResult())
         return 0;
-    return generator.emitLoad(dst, m_double);
+    return generator.emitLoad(dst, m_value);
 }
 
 // ------------------------------ StringNode -----------------------------------
@@ -139,9 +176,9 @@ RegisterID* StringNode::emitBytecode(BytecodeGenerator& generator, RegisterID* d
 
 RegisterID* RegExpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegExp> regExp = RegExp::create(generator.globalData(), m_pattern, m_flags);
+    RefPtr<RegExp> regExp = RegExp::create(generator.globalData(), m_pattern.ustring(), m_flags.ustring());
     if (!regExp->isValid())
-        return emitThrowError(generator, SyntaxError, ("Invalid regular expression: " + UString(regExp->errorMessage())).UTF8String().c_str());
+        return emitThrowError(generator, SyntaxError, "Invalid regular expression: %s", regExp->errorMessage());
     if (dst == generator.ignoredResult())
         return 0;
     return generator.emitNewRegExp(generator.finalDestination(dst), regExp.get());
@@ -356,7 +393,7 @@ RegisterID* FunctionCallResolveNode::emitBytecode(BytecodeGenerator& generator,
     RefPtr<RegisterID> thisRegister = generator.newTemporary();
     int identifierStart = divot() - startOffset();
     generator.emitExpressionInfo(identifierStart + m_ident.size(), m_ident.size(), 0);
-    generator.emitResolveFunction(thisRegister.get(), func.get(), m_ident);
+    generator.emitResolveWithBase(thisRegister.get(), func.get(), m_ident);
     return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
 }
 
@@ -376,11 +413,12 @@ RegisterID* FunctionCallBracketNode::emitBytecode(BytecodeGenerator& generator,
 
 RegisterID* FunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    RefPtr<RegisterID> function = generator.tempDestination(dst);
+    RefPtr<RegisterID> thisRegister = generator.newTemporary();
+    generator.emitNode(thisRegister.get(), m_base);
     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
     generator.emitMethodCheck();
-    RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
-    RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
+    generator.emitGetById(function.get(), thisRegister.get(), m_ident);
     return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
 }
 
@@ -596,7 +634,9 @@ RegisterID* PostfixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterI
 
 RegisterID* PostfixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
-    return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus ? "Postfix ++ operator applied to value that is not a reference." : "Postfix -- operator applied to value that is not a reference.");
+    return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus
+        ? "Postfix ++ operator applied to value that is not a reference."
+        : "Postfix -- operator applied to value that is not a reference.");
 }
 
 // ------------------------------ DeleteResolveNode -----------------------------------
@@ -758,7 +798,9 @@ RegisterID* PrefixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID
 
 RegisterID* PrefixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
-    return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus ? "Prefix ++ operator applied to value that is not a reference." : "Prefix -- operator applied to value that is not a reference.");
+    return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus
+        ? "Prefix ++ operator applied to value that is not a reference."
+        : "Prefix -- operator applied to value that is not a reference.");
 }
 
 // ------------------------------ Unary Operation Nodes -----------------------------------
@@ -1205,7 +1247,13 @@ RegisterID* ConstDeclNode::emitCodeSingle(BytecodeGenerator& generator)
 
         return generator.emitNode(local, m_init);
     }
-    
+
+    if (generator.codeType() != EvalCode) {
+        if (m_init)
+            return generator.emitNode(m_init);
+        else
+            return generator.emitResolve(generator.newTemporary(), m_ident);
+    }
     // FIXME: While this code should only be hit in eval code, it will potentially
     // assign to the wrong base if m_ident exists in an intervening dynamic scope.
     RefPtr<RegisterID> base = generator.emitResolveBase(generator.newTemporary(), m_ident);
@@ -1226,24 +1274,30 @@ RegisterID* ConstDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID
 
 RegisterID* ConstStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
     return generator.emitNode(m_next);
 }
 
-// ------------------------------ Helper functions for handling Vectors of StatementNode -------------------------------
+// ------------------------------ SourceElements -------------------------------
 
-static inline void statementListEmitCode(const StatementVector& statements, BytecodeGenerator& generator, RegisterID* dst)
+inline void SourceElements::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    size_t size = statements.size();
+    size_t size = m_statements.size();
     for (size_t i = 0; i < size; ++i)
-        generator.emitNode(dst, statements[i]);
+        generator.emitNode(dst, m_statements[i]);
 }
 
 // ------------------------------ BlockNode ------------------------------------
 
+inline StatementNode* BlockNode::lastStatement() const
+{
+    return m_statements ? m_statements->lastStatement() : 0;
+}
+
 RegisterID* BlockNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    statementListEmitCode(m_children, generator, dst);
+    if (m_statements)
+        m_statements->emitBytecode(generator, dst);
     return 0;
 }
 
@@ -1251,7 +1305,7 @@ RegisterID* BlockNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 
 RegisterID* EmptyStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
     return dst;
 }
 
@@ -1259,7 +1313,7 @@ RegisterID* EmptyStatementNode::emitBytecode(BytecodeGenerator& generator, Regis
 
 RegisterID* DebuggerStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitDebugHook(DidReachBreakpoint, firstLine(), lastLine(), column());
+    generator.emitDebugHook(DidReachBreakpoint, firstLine(), lastLine());
     return dst;
 }
 
@@ -1268,7 +1322,7 @@ RegisterID* DebuggerStatementNode::emitBytecode(BytecodeGenerator& generator, Re
 RegisterID* ExprStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     ASSERT(m_expr);
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column()); 
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine()); 
     return generator.emitNode(dst, m_expr);
 }
 
@@ -1277,7 +1331,7 @@ RegisterID* ExprStatementNode::emitBytecode(BytecodeGenerator& generator, Regist
 RegisterID* VarStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
     ASSERT(m_expr);
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
     return generator.emitNode(m_expr);
 }
 
@@ -1285,7 +1339,7 @@ RegisterID* VarStatementNode::emitBytecode(BytecodeGenerator& generator, Registe
 
 RegisterID* IfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
     
     RefPtr<Label> afterThen = generator.newLabel();
 
@@ -1303,7 +1357,7 @@ RegisterID* IfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 
 RegisterID* IfElseNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
     
     RefPtr<Label> beforeElse = generator.newLabel();
     RefPtr<Label> afterElse = generator.newLabel();
@@ -1333,14 +1387,12 @@ RegisterID* DoWhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID*
     RefPtr<Label> topOfLoop = generator.newLabel();
     generator.emitLabel(topOfLoop.get());
 
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
    
     RefPtr<RegisterID> result = generator.emitNode(dst, m_statement);
 
     generator.emitLabel(scope->continueTarget());
-#ifndef QT_BUILD_SCRIPT_LIB
-    generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo(), column());
-#endif
+    generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo());
     RegisterID* cond = generator.emitNode(m_expr);
     generator.emitJumpIfTrue(cond, topOfLoop.get());
 
@@ -1353,9 +1405,7 @@ RegisterID* DoWhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID*
 RegisterID* WhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
-#ifdef QT_BUILD_SCRIPT_LIB
-    generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo(), column());
-#endif
+
     generator.emitJump(scope->continueTarget());
 
     RefPtr<Label> topOfLoop = generator.newLabel();
@@ -1364,9 +1414,7 @@ RegisterID* WhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
     generator.emitNode(dst, m_statement);
 
     generator.emitLabel(scope->continueTarget());
-#ifndef QT_BUILD_SCRIPT_LIB
-    generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo(), column());
-#endif
+    generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo());
     RegisterID* cond = generator.emitNode(m_expr);
     generator.emitJumpIfTrue(cond, topOfLoop.get());
 
@@ -1380,12 +1428,9 @@ RegisterID* WhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 
 RegisterID* ForNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    if (dst == generator.ignoredResult())
-        dst = 0;
-
     RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
 
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
 
     if (m_expr1)
         generator.emitNode(generator.ignoredResult(), m_expr1);
@@ -1399,9 +1444,7 @@ RegisterID* ForNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
     RefPtr<RegisterID> result = generator.emitNode(dst, m_statement);
 
     generator.emitLabel(scope->continueTarget());
-#ifndef QT_BUILD_SCRIPT_LIB
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
-#endif
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
     if (m_expr3)
         generator.emitNode(generator.ignoredResult(), m_expr3);
 
@@ -1427,7 +1470,7 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 
     RefPtr<Label> continueTarget = generator.newLabel(); 
 
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
 
     if (m_init)
         generator.emitNode(generator.ignoredResult(), m_init);
@@ -1475,9 +1518,7 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 
     generator.emitLabel(scope->continueTarget());
     generator.emitNextPropertyName(propertyName, iter.get(), loopStart.get());
-#ifndef QT_BUILD_SCRIPT_LIB
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
-#endif
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
     generator.emitLabel(scope->breakTarget());
     return dst;
 }
@@ -1487,7 +1528,7 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 // ECMA 12.7
 RegisterID* ContinueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
     
     LabelScope* scope = generator.continueTarget(m_ident);
 
@@ -1505,7 +1546,7 @@ RegisterID* ContinueNode::emitBytecode(BytecodeGenerator& generator, RegisterID*
 // ECMA 12.8
 RegisterID* BreakNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
     
     LabelScope* scope = generator.breakTarget(m_ident);
     
@@ -1522,7 +1563,7 @@ RegisterID* BreakNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 
 RegisterID* ReturnNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
     if (generator.codeType() != FunctionCode)
         return emitThrowError(generator, SyntaxError, "Invalid return statement.");
 
@@ -1539,7 +1580,7 @@ RegisterID* ReturnNode::emitBytecode(BytecodeGenerator& generator, RegisterID* d
         generator.emitJumpScopes(l0.get(), 0);
         generator.emitLabel(l0.get());
     }
-    generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine(), column());
+    generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine());
     return generator.emitReturn(r0);
 }
 
@@ -1547,7 +1588,7 @@ RegisterID* ReturnNode::emitBytecode(BytecodeGenerator& generator, RegisterID* d
 
 RegisterID* WithNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
     
     RefPtr<RegisterID> scope = generator.newTemporary();
     generator.emitNode(scope.get(), m_expr); // scope must be protected until popped
@@ -1558,6 +1599,14 @@ RegisterID* WithNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst
     return result;
 }
 
+// ------------------------------ CaseClauseNode --------------------------------
+
+inline void CaseClauseNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (m_statements)
+        m_statements->emitBytecode(generator, dst);
+}
+
 // ------------------------------ CaseBlockNode --------------------------------
 
 enum SwitchKind { 
@@ -1574,13 +1623,11 @@ static void processClauseList(ClauseListNode* list, Vector<ExpressionNode*, 8>&
         literalVector.append(clauseExpression);
         if (clauseExpression->isNumber()) {
             double value = static_cast<NumberNode*>(clauseExpression)->value();
-            JSValue jsValue = JSValue::makeInt32Fast(static_cast<int32_t>(value));
-            if ((typeForTable & ~SwitchNumber) || !jsValue || (jsValue.getInt32Fast() != value)) {
+            int32_t intVal = static_cast<int32_t>(value);
+            if ((typeForTable & ~SwitchNumber) || (intVal != value)) {
                 typeForTable = SwitchNeither;
                 break;
             }
-            int32_t intVal = static_cast<int32_t>(value);
-            ASSERT(intVal == value);
             if (intVal < min_num)
                 min_num = intVal;
             if (intVal > max_num)
@@ -1679,17 +1726,17 @@ RegisterID* CaseBlockNode::emitBytecodeForBlock(BytecodeGenerator& generator, Re
     size_t i = 0;
     for (ClauseListNode* list = m_list1; list; list = list->getNext()) {
         generator.emitLabel(labelVector[i++].get());
-        statementListEmitCode(list->getClause()->children(), generator, dst);
+        list->getClause()->emitBytecode(generator, dst);
     }
 
     if (m_defaultClause) {
         generator.emitLabel(defaultLabel.get());
-        statementListEmitCode(m_defaultClause->children(), generator, dst);
+        m_defaultClause->emitBytecode(generator, dst);
     }
 
     for (ClauseListNode* list = m_list2; list; list = list->getNext()) {
         generator.emitLabel(labelVector[i++].get());
-        statementListEmitCode(list->getClause()->children(), generator, dst);
+        list->getClause()->emitBytecode(generator, dst);
     }
     if (!m_defaultClause)
         generator.emitLabel(defaultLabel.get());
@@ -1706,7 +1753,7 @@ RegisterID* CaseBlockNode::emitBytecodeForBlock(BytecodeGenerator& generator, Re
 
 RegisterID* SwitchNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
     
     RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Switch);
 
@@ -1721,7 +1768,7 @@ RegisterID* SwitchNode::emitBytecode(BytecodeGenerator& generator, RegisterID* d
 
 RegisterID* LabelNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
 
     if (generator.breakTarget(m_name))
         return emitThrowError(generator, SyntaxError, "Duplicate label: %s.", m_name);
@@ -1737,7 +1784,7 @@ RegisterID* LabelNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 
 RegisterID* ThrowNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
 
     if (dst == generator.ignoredResult())
         dst = 0;
@@ -1751,12 +1798,12 @@ RegisterID* ThrowNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 
 RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-#ifndef QT_BUILD_SCRIPT_LIB
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
-#endif
+    // NOTE: The catch and finally blocks must be labeled explicitly, so the
+    // optimizer knows they may be jumped to from anywhere.
+
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
 
     RefPtr<Label> tryStartLabel = generator.newLabel();
-    RefPtr<Label> tryEndLabel = generator.newLabel();
     RefPtr<Label> finallyStart;
     RefPtr<RegisterID> finallyReturnAddr;
     if (m_finallyBlock) {
@@ -1764,14 +1811,19 @@ RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
         finallyReturnAddr = generator.newTemporary();
         generator.pushFinallyContext(finallyStart.get(), finallyReturnAddr.get());
     }
+
     generator.emitLabel(tryStartLabel.get());
     generator.emitNode(dst, m_tryBlock);
-    generator.emitLabel(tryEndLabel.get());
 
     if (m_catchBlock) {
-        RefPtr<Label> handlerEndLabel = generator.newLabel();
-        generator.emitJump(handlerEndLabel.get());
-        RefPtr<RegisterID> exceptionRegister = generator.emitCatch(generator.newTemporary(), tryStartLabel.get(), tryEndLabel.get());
+        RefPtr<Label> catchEndLabel = generator.newLabel();
+        
+        // Normal path: jump over the catch block.
+        generator.emitJump(catchEndLabel.get());
+
+        // Uncaught exception path: the catch block.
+        RefPtr<Label> here = generator.emitLabel(generator.newLabel().get());
+        RefPtr<RegisterID> exceptionRegister = generator.emitCatch(generator.newTemporary(), tryStartLabel.get(), here.get());
         if (m_catchHasEval) {
             RefPtr<RegisterID> dynamicScopeObject = generator.emitNewObject(generator.newTemporary());
             generator.emitPutById(dynamicScopeObject.get(), m_exceptionIdent, exceptionRegister.get());
@@ -1781,7 +1833,7 @@ RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
             generator.emitPushNewScope(exceptionRegister.get(), m_exceptionIdent, exceptionRegister.get());
         generator.emitNode(dst, m_catchBlock);
         generator.emitPopScope();
-        generator.emitLabel(handlerEndLabel.get());
+        generator.emitLabel(catchEndLabel.get());
     }
 
     if (m_finallyBlock) {
@@ -1792,21 +1844,18 @@ RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
         // approach to not clobbering anything important
         RefPtr<RegisterID> highestUsedRegister = generator.highestUsedRegister();
         RefPtr<Label> finallyEndLabel = generator.newLabel();
+
+        // Normal path: invoke the finally block, then jump over it.
         generator.emitJumpSubroutine(finallyReturnAddr.get(), finallyStart.get());
-        // Use a label to record the subtle fact that sret will return to the
-        // next instruction. sret is the only way to jump without an explicit label.
-        generator.emitLabel(generator.newLabel().get());
         generator.emitJump(finallyEndLabel.get());
 
-        // Finally block for exception path
-        RefPtr<RegisterID> tempExceptionRegister = generator.emitCatch(generator.newTemporary(), tryStartLabel.get(), generator.emitLabel(generator.newLabel().get()).get());
+        // Uncaught exception path: invoke the finally block, then re-throw the exception.
+        RefPtr<Label> here = generator.emitLabel(generator.newLabel().get());
+        RefPtr<RegisterID> tempExceptionRegister = generator.emitCatch(generator.newTemporary(), tryStartLabel.get(), here.get());
         generator.emitJumpSubroutine(finallyReturnAddr.get(), finallyStart.get());
-        // Use a label to record the subtle fact that sret will return to the
-        // next instruction. sret is the only way to jump without an explicit label.
-        generator.emitLabel(generator.newLabel().get());
         generator.emitThrow(tempExceptionRegister.get());
 
-        // emit the finally block itself
+        // The finally block.
         generator.emitLabel(finallyStart.get());
         generator.emitNode(dst, m_finallyBlock);
         generator.emitSubroutineReturn(finallyReturnAddr.get());
@@ -1819,27 +1868,15 @@ RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 
 // -----------------------------ScopeNodeData ---------------------------
 
-ScopeNodeData::ScopeNodeData(ParserArena& arena, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, int numConstants)
+ScopeNodeData::ScopeNodeData(ParserArena& arena, SourceElements* statements, VarStack* varStack, FunctionStack* funcStack, int numConstants)
     : m_numConstants(numConstants)
+    , m_statements(statements)
 {
     m_arena.swap(arena);
     if (varStack)
         m_varStack.swap(*varStack);
     if (funcStack)
         m_functionStack.swap(*funcStack);
-    if (children)
-        children->releaseContentsIntoVector(m_children);
-}
-
-void ScopeNodeData::mark()
-{
-    FunctionStack::iterator end = m_functionStack.end();
-    for (FunctionStack::iterator ptr = m_functionStack.begin(); ptr != end; ++ptr) {
-        FunctionBodyNode* body = (*ptr)->body();
-        if (!body->isGenerated())
-            continue;
-        body->generatedBytecode().mark();
-    }
 }
 
 // ------------------------------ ScopeNode -----------------------------
@@ -1868,6 +1905,17 @@ ScopeNode::ScopeNode(JSGlobalData* globalData, const SourceCode& source, SourceE
 #endif
 }
 
+inline void ScopeNode::emitStatementsBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (m_data->m_statements)
+        m_data->m_statements->emitBytecode(generator, dst);
+}
+
+StatementNode* ScopeNode::singleStatement() const
+{
+    return m_data->m_statements ? m_data->m_statements->singleStatement() : 0;
+}
+
 // ------------------------------ ProgramNode -----------------------------
 
 inline ProgramNode::ProgramNode(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
@@ -1888,41 +1936,17 @@ PassRefPtr<ProgramNode> ProgramNode::create(JSGlobalData* globalData, SourceElem
 
 RegisterID* ProgramNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
-    generator.emitDebugHook(WillExecuteProgram, firstLine(), lastLine(), column());
+    generator.emitDebugHook(WillExecuteProgram, firstLine(), lastLine());
 
     RefPtr<RegisterID> dstRegister = generator.newTemporary();
     generator.emitLoad(dstRegister.get(), jsUndefined());
-    statementListEmitCode(children(), generator, dstRegister.get());
+    emitStatementsBytecode(generator, dstRegister.get());
 
-    generator.emitDebugHook(DidExecuteProgram, firstLine(), lastLine(), column());
+    generator.emitDebugHook(DidExecuteProgram, firstLine(), lastLine());
     generator.emitEnd(dstRegister.get());
     return 0;
 }
 
-void ProgramNode::generateBytecode(ScopeChainNode* scopeChainNode)
-{
-    ScopeChain scopeChain(scopeChainNode);
-    JSGlobalObject* globalObject = scopeChain.globalObject();
-    
-    m_code.set(new ProgramCodeBlock(this, GlobalCode, globalObject, source().provider()));
-    
-    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(this, globalObject->debugger(), scopeChain, &globalObject->symbolTable(), m_code.get()));
-    generator->generate();
-
-    destroyData();
-}
-
-#if ENABLE(JIT)
-void ProgramNode::generateJITCode(ScopeChainNode* scopeChainNode)
-{
-    bytecode(scopeChainNode);
-    ASSERT(m_code);
-    ASSERT(!m_jitCode);
-    JIT::compile(scopeChainNode->globalData, m_code.get());
-    ASSERT(m_jitCode);
-}
-#endif
-
 // ------------------------------ EvalNode -----------------------------
 
 inline EvalNode::EvalNode(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
@@ -1943,135 +1967,46 @@ PassRefPtr<EvalNode> EvalNode::create(JSGlobalData* globalData, SourceElements*
 
 RegisterID* EvalNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
-    generator.emitDebugHook(WillExecuteProgram, firstLine(), lastLine(), column());
+    generator.emitDebugHook(WillExecuteProgram, firstLine(), lastLine());
 
     RefPtr<RegisterID> dstRegister = generator.newTemporary();
     generator.emitLoad(dstRegister.get(), jsUndefined());
-    statementListEmitCode(children(), generator, dstRegister.get());
+    emitStatementsBytecode(generator, dstRegister.get());
 
-    generator.emitDebugHook(DidExecuteProgram, firstLine(), lastLine(), column());
+    generator.emitDebugHook(DidExecuteProgram, firstLine(), lastLine());
     generator.emitEnd(dstRegister.get());
     return 0;
 }
 
-void EvalNode::generateBytecode(ScopeChainNode* scopeChainNode)
-{
-    ScopeChain scopeChain(scopeChainNode);
-    JSGlobalObject* globalObject = scopeChain.globalObject();
-
-    m_code.set(new EvalCodeBlock(this, globalObject, source().provider(), scopeChain.localDepth()));
-
-    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(this, globalObject->debugger(), scopeChain, &m_code->symbolTable(), m_code.get()));
-    generator->generate();
-
-    // Eval code needs to hang on to its declaration stacks to keep declaration info alive until Interpreter::execute time,
-    // so the entire ScopeNodeData cannot be destoyed.
-    children().clear();
-}
-
-EvalCodeBlock& EvalNode::bytecodeForExceptionInfoReparse(ScopeChainNode* scopeChainNode, CodeBlock* codeBlockBeingRegeneratedFrom)
-{
-    ASSERT(!m_code);
-
-    ScopeChain scopeChain(scopeChainNode);
-    JSGlobalObject* globalObject = scopeChain.globalObject();
-
-    m_code.set(new EvalCodeBlock(this, globalObject, source().provider(), scopeChain.localDepth()));
-
-    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(this, globalObject->debugger(), scopeChain, &m_code->symbolTable(), m_code.get()));
-    generator->setRegeneratingForExceptionInfo(codeBlockBeingRegeneratedFrom);
-    generator->generate();
-
-    return *m_code;
-}
-
-void EvalNode::mark()
-{
-    // We don't need to mark our own CodeBlock as the JSGlobalObject takes care of that
-    data()->mark();
-}
+// ------------------------------ FunctionBodyNode -----------------------------
 
-#if ENABLE(JIT)
-void EvalNode::generateJITCode(ScopeChainNode* scopeChainNode)
+FunctionParameters::FunctionParameters(ParameterNode* firstParameter)
 {
-    bytecode(scopeChainNode);
-    ASSERT(m_code);
-    ASSERT(!m_jitCode);
-    JIT::compile(scopeChainNode->globalData, m_code.get());
-    ASSERT(m_jitCode);
+    for (ParameterNode* parameter = firstParameter; parameter; parameter = parameter->nextParam())
+        append(parameter->ident());
 }
-#endif
-
-// ------------------------------ FunctionBodyNode -----------------------------
 
 inline FunctionBodyNode::FunctionBodyNode(JSGlobalData* globalData)
     : ScopeNode(globalData)
-    , m_parameters(0)
-    , m_parameterCount(0)
 {
-#ifdef QT_BUILD_SCRIPT_LIB
-    sourceToken = globalData->scriptpool->objectRegister();
-#endif
 }
 
 inline FunctionBodyNode::FunctionBodyNode(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
     : ScopeNode(globalData, sourceCode, children, varStack, funcStack, features, numConstants)
-    , m_parameters(0)
-    , m_parameterCount(0)
 {
-#ifdef QT_BUILD_SCRIPT_LIB
-    sourceToken = globalData->scriptpool->objectRegister();
-#endif
 }
 
-FunctionBodyNode::~FunctionBodyNode()
+void FunctionBodyNode::finishParsing(const SourceCode& source, ParameterNode* firstParameter, const Identifier& ident)
 {
-#ifdef QT_BUILD_SCRIPT_LIB
-    if (sourceToken) delete sourceToken;
-#endif
-    for (size_t i = 0; i < m_parameterCount; ++i)
-        m_parameters[i].~Identifier();
-    fastFree(m_parameters);
-}
-
-void FunctionBodyNode::finishParsing(const SourceCode& source, ParameterNode* firstParameter)
-{
-    Vector<Identifier> parameters;
-    for (ParameterNode* parameter = firstParameter; parameter; parameter = parameter->nextParam())
-        parameters.append(parameter->ident());
-    size_t count = parameters.size();
-
     setSource(source);
-    finishParsing(parameters.releaseBuffer(), count);
+    finishParsing(FunctionParameters::create(firstParameter), ident);
 }
 
-void FunctionBodyNode::finishParsing(Identifier* parameters, size_t parameterCount)
+void FunctionBodyNode::finishParsing(PassRefPtr<FunctionParameters> parameters, const Identifier& ident)
 {
     ASSERT(!source().isNull());
     m_parameters = parameters;
-    m_parameterCount = parameterCount;
-}
-
-void FunctionBodyNode::mark()
-{
-    if (m_code)
-        m_code->mark();
-}
-
-#if ENABLE(JIT)
-PassRefPtr<FunctionBodyNode> FunctionBodyNode::createNativeThunk(JSGlobalData* globalData)
-{
-    RefPtr<FunctionBodyNode> body = new FunctionBodyNode(globalData);
-    globalData->parser->arena().reset();
-    body->m_code.set(new CodeBlock(body.get()));
-    body->m_jitCode = JITCode(JITCode::HostFunction(globalData->jitStubs.ctiNativeCallThunk()));
-    return body.release();
-}
-#endif
-
-bool FunctionBodyNode::isHostFunction() const
-{
-    return m_code && m_code->codeType() == NativeCode;
+    m_ident = ident;
 }
 
 FunctionBodyNode* FunctionBodyNode::create(JSGlobalData* globalData)
@@ -2090,94 +2025,25 @@ PassRefPtr<FunctionBodyNode> FunctionBodyNode::create(JSGlobalData* globalData,
     return node.release();
 }
 
-void FunctionBodyNode::generateBytecode(ScopeChainNode* scopeChainNode)
-{
-    // This branch is only necessary since you can still create a non-stub FunctionBodyNode by
-    // calling Parser::parse<FunctionBodyNode>().   
-    if (!data())
-        scopeChainNode->globalData->parser->reparseInPlace(scopeChainNode->globalData, this);
-    ASSERT(data());
-
-    ScopeChain scopeChain(scopeChainNode);
-    JSGlobalObject* globalObject = scopeChain.globalObject();
-
-    m_code.set(new CodeBlock(this, FunctionCode, source().provider(), source().startOffset()));
-
-    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(this, globalObject->debugger(), scopeChain, &m_code->symbolTable(), m_code.get()));
-    generator->generate();
-
-    destroyData();
-}
-
-#if ENABLE(JIT)
-void FunctionBodyNode::generateJITCode(ScopeChainNode* scopeChainNode)
-{
-    bytecode(scopeChainNode);
-    ASSERT(m_code);
-    ASSERT(!m_jitCode);
-    JIT::compile(scopeChainNode->globalData, m_code.get());
-    ASSERT(m_jitCode);
-}
-#endif
-
-CodeBlock& FunctionBodyNode::bytecodeForExceptionInfoReparse(ScopeChainNode* scopeChainNode, CodeBlock* codeBlockBeingRegeneratedFrom)
-{
-    ASSERT(!m_code);
-
-    ScopeChain scopeChain(scopeChainNode);
-    JSGlobalObject* globalObject = scopeChain.globalObject();
-
-    m_code.set(new CodeBlock(this, FunctionCode, source().provider(), source().startOffset()));
-
-    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(this, globalObject->debugger(), scopeChain, &m_code->symbolTable(), m_code.get()));
-    generator->setRegeneratingForExceptionInfo(codeBlockBeingRegeneratedFrom);
-    generator->generate();
-
-    return *m_code;
-}
-
 RegisterID* FunctionBodyNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
-    generator.emitDebugHook(DidEnterCallFrame, firstLine(), lastLine(), column());
-    statementListEmitCode(children(), generator, generator.ignoredResult());
-    if (children().size() && children().last()->isBlock()) {
-        BlockNode* blockNode = static_cast<BlockNode*>(children().last());
-        if (blockNode->children().size() && blockNode->children().last()->isReturnNode())
+    generator.emitDebugHook(DidEnterCallFrame, firstLine(), lastLine());
+    emitStatementsBytecode(generator, generator.ignoredResult());
+    StatementNode* singleStatement = this->singleStatement();
+    if (singleStatement && singleStatement->isBlock()) {
+        StatementNode* lastStatementInBlock = static_cast<BlockNode*>(singleStatement)->lastStatement();
+        if (lastStatementInBlock && lastStatementInBlock->isReturnNode())
             return 0;
     }
 
     RegisterID* r0 = generator.emitLoad(0, jsUndefined());
-    generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine(), column());
+    generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine());
     generator.emitReturn(r0);
     return 0;
 }
 
-UString FunctionBodyNode::paramString() const
-{
-    UString s("");
-    for (size_t pos = 0; pos < m_parameterCount; ++pos) {
-        if (!s.isEmpty())
-            s += ", ";
-        s += parameters()[pos].ustring();
-    }
-
-    return s;
-}
-
-Identifier* FunctionBodyNode::copyParameters()
-{
-    Identifier* parameters = static_cast<Identifier*>(fastMalloc(m_parameterCount * sizeof(Identifier)));
-    VectorCopier<false, Identifier>::uninitializedCopy(m_parameters, m_parameters + m_parameterCount, parameters);
-    return parameters;
-}
-
 // ------------------------------ FuncDeclNode ---------------------------------
 
-JSFunction* FuncDeclNode::makeFunction(ExecState* exec, ScopeChainNode* scopeChain)
-{
-    return new (exec) JSFunction(exec, m_ident, m_body.get(), scopeChain);
-}
-
 RegisterID* FuncDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     if (dst == generator.ignoredResult())
@@ -2192,24 +2058,4 @@ RegisterID* FuncExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID*
     return generator.emitNewFunctionExpression(generator.finalDestination(dst), this);
 }
 
-JSFunction* FuncExprNode::makeFunction(ExecState* exec, ScopeChainNode* scopeChain)
-{
-    JSFunction* func = new (exec) JSFunction(exec, m_ident, m_body.get(), scopeChain);
-
-    /* 
-        The Identifier in a FunctionExpression can be referenced from inside
-        the FunctionExpression's FunctionBody to allow the function to call
-        itself recursively. However, unlike in a FunctionDeclaration, the
-        Identifier in a FunctionExpression cannot be referenced from and
-        does not affect the scope enclosing the FunctionExpression.
-     */
-
-    if (!m_ident.isNull()) {
-        JSStaticScopeObject* functionScopeObject = new (exec) JSStaticScopeObject(exec, m_ident, func, ReadOnly | DontDelete);
-        func->scope().push(functionScopeObject);
-    }
-
-    return func;
-}
-
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h
index 185cede..be84c4a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h
@@ -34,25 +34,17 @@
 #include "SourceCode.h"
 #include "SymbolTable.h"
 #include <wtf/MathExtras.h>
-#include <wtf/OwnPtr.h>
-
-#ifdef QT_BUILD_SCRIPT_LIB
-#include "SourcePoolQt.h"
-#endif
 
 namespace JSC {
 
     class ArgumentListNode;
-    class CodeBlock;
     class BytecodeGenerator;
-    class FuncDeclNode;
-    class EvalCodeBlock;
-    class JSFunction;
-    class ProgramCodeBlock;
+    class FunctionBodyNode;
     class PropertyListNode;
     class ReadModifyResolveNode;
     class RegisterID;
     class ScopeChainNode;
+    class ScopeNode;
 
     typedef unsigned CodeFeatures;
 
@@ -90,8 +82,8 @@ namespace JSC {
 
     namespace DeclarationStacks {
         enum VarAttrs { IsConstant = 1, HasInitializer = 2 };
-        typedef Vector<std::pair<Identifier, unsigned> > VarStack;
-        typedef Vector<FuncDeclNode*> FunctionStack;
+        typedef Vector<std::pair<const Identifier*, unsigned> > VarStack;
+        typedef Vector<FunctionBodyNode*> FunctionStack;
     }
 
     struct SwitchInfo {
@@ -100,24 +92,23 @@ namespace JSC {
         SwitchType switchType;
     };
 
-    class ParserArenaDeletable {
-    protected:
-        ParserArenaDeletable() { }
+    class ParserArenaFreeable {
+    public:
+        // ParserArenaFreeable objects are are freed when the arena is deleted.
+        // Destructors are not called. Clients must not call delete on such objects.
+        void* operator new(size_t, JSGlobalData*);
+    };
 
+    class ParserArenaDeletable {
     public:
         virtual ~ParserArenaDeletable() { }
 
-        // Objects created with this version of new are deleted when the arena is deleted.
+        // ParserArenaDeletable objects are deleted when the arena is deleted.
+        // Clients must not call delete directly on such objects.
         void* operator new(size_t, JSGlobalData*);
-
-        // Objects created with this version of new are not deleted when the arena is deleted.
-        // Other arrangements must be made.
-        void* operator new(size_t);
-
-        void operator delete(void*);
     };
 
-    class ParserArenaRefCounted : public RefCountedCustomAllocated<ParserArenaRefCounted> {
+    class ParserArenaRefCounted : public RefCounted<ParserArenaRefCounted> {
     protected:
         ParserArenaRefCounted(JSGlobalData*);
 
@@ -128,34 +119,14 @@ namespace JSC {
         }
     };
 
-    class Node : public ParserArenaDeletable {
+    class Node : public ParserArenaFreeable {
     protected:
         Node(JSGlobalData*);
 
     public:
-        /*
-            Return value: The register holding the production's value.
-                     dst: An optional parameter specifying the most efficient
-                          destination at which to store the production's value.
-                          The callee must honor dst.
-
-            dst provides for a crude form of copy propagation. For example,
+        virtual ~Node() { }
 
-            x = 1
-
-            becomes
-            
-            load r[x], 1
-            
-            instead of 
-
-            load r0, 1
-            mov r[x], r0
-            
-            because the assignment node, "x =", passes r[x] as dst to the number
-            node, "1".
-        */
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* dst = 0) = 0;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* destination = 0) = 0;
 
         int lineNo() const { return m_line; }
 
@@ -164,9 +135,10 @@ namespace JSC {
     };
 
     class ExpressionNode : public Node {
-    public:
+    protected:
         ExpressionNode(JSGlobalData*, ResultType = ResultType::unknownType());
 
+    public:
         virtual bool isNumber() const { return false; }
         virtual bool isString() const { return false; }
         virtual bool isNull() const { return false; }
@@ -184,21 +156,18 @@ namespace JSC {
 
         ResultType resultDescriptor() const { return m_resultType; }
 
-        // This needs to be in public in order to compile using GCC 3.x 
-        typedef enum { EvalOperator, FunctionCall } CallerType;
-
     private:
         ResultType m_resultType;
     };
 
     class StatementNode : public Node {
-    public:
+    protected:
         StatementNode(JSGlobalData*);
 
-        void setLoc(int line0, int line1, int column);
+    public:
+        void setLoc(int firstLine, int lastLine);
         int firstLine() const { return lineNo(); }
         int lastLine() const { return m_lastLine; }
-        int column() const { return m_column; }
 
         virtual bool isEmptyStatement() const { return false; }
         virtual bool isReturnNode() const { return false; }
@@ -208,7 +177,6 @@ namespace JSC {
 
     private:
         int m_lastLine;
-        int m_column;
     };
 
     class NullNode : public ExpressionNode {
@@ -235,10 +203,10 @@ namespace JSC {
 
     class NumberNode : public ExpressionNode {
     public:
-        NumberNode(JSGlobalData*, double v);
+        NumberNode(JSGlobalData*, double value);
 
-        double value() const { return m_double; }
-        void setValue(double d) { m_double = d; }
+        double value() const { return m_value; }
+        void setValue(double value) { m_value = value; }
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -246,22 +214,23 @@ namespace JSC {
         virtual bool isNumber() const { return true; }
         virtual bool isPure(BytecodeGenerator&) const { return true; }
 
-        double m_double;
+        double m_value;
     };
 
     class StringNode : public ExpressionNode {
     public:
-        StringNode(JSGlobalData*, const Identifier& v);
+        StringNode(JSGlobalData*, const Identifier&);
 
         const Identifier& value() { return m_value; }
-        virtual bool isPure(BytecodeGenerator&) const { return true; }
 
     private:
+        virtual bool isPure(BytecodeGenerator&) const { return true; }
+
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
         
         virtual bool isString() const { return true; }
 
-        Identifier m_value;
+        const Identifier& m_value;
     };
     
     class ThrowableExpressionData {
@@ -292,8 +261,9 @@ namespace JSC {
         uint16_t endOffset() const { return m_endOffset; }
 
     protected:
-        RegisterID* emitThrowError(BytecodeGenerator&, ErrorType, const char* msg);
-        RegisterID* emitThrowError(BytecodeGenerator&, ErrorType, const char* msg, const Identifier&);
+        RegisterID* emitThrowError(BytecodeGenerator&, ErrorType, const char* message);
+        RegisterID* emitThrowError(BytecodeGenerator&, ErrorType, const char* message, const UString&);
+        RegisterID* emitThrowError(BytecodeGenerator&, ErrorType, const char* message, const Identifier&);
 
     private:
         uint32_t m_divot;
@@ -304,8 +274,7 @@ namespace JSC {
     class ThrowableSubExpressionData : public ThrowableExpressionData {
     public:
         ThrowableSubExpressionData()
-            : ThrowableExpressionData()
-            , m_subexpressionDivotOffset(0)
+            : m_subexpressionDivotOffset(0)
             , m_subexpressionEndOffset(0)
         {
         }
@@ -334,8 +303,7 @@ namespace JSC {
     class ThrowablePrefixedSubExpressionData : public ThrowableExpressionData {
     public:
         ThrowablePrefixedSubExpressionData()
-            : ThrowableExpressionData()
-            , m_subexpressionDivotOffset(0)
+            : m_subexpressionDivotOffset(0)
             , m_subexpressionStartOffset(0)
         {
         }
@@ -363,13 +331,13 @@ namespace JSC {
 
     class RegExpNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        RegExpNode(JSGlobalData*, const UString& pattern, const UString& flags);
+        RegExpNode(JSGlobalData*, const Identifier& pattern, const Identifier& flags);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        UString m_pattern;
-        UString m_flags;
+        const Identifier& m_pattern;
+        const Identifier& m_flags;
     };
 
     class ThisNode : public ExpressionNode {
@@ -393,11 +361,11 @@ namespace JSC {
         virtual bool isLocation() const { return true; }
         virtual bool isResolveNode() const { return true; }
 
-        Identifier m_ident;
+        const Identifier& m_ident;
         int32_t m_startOffset;
     };
 
-    class ElementNode : public ParserArenaDeletable {
+    class ElementNode : public ParserArenaFreeable {
     public:
         ElementNode(JSGlobalData*, int elision, ExpressionNode*);
         ElementNode(JSGlobalData*, ElementNode*, int elision, ExpressionNode*);
@@ -430,17 +398,18 @@ namespace JSC {
         bool m_optional;
     };
 
-    class PropertyNode : public ParserArenaDeletable {
+    class PropertyNode : public ParserArenaFreeable {
     public:
         enum Type { Constant, Getter, Setter };
 
         PropertyNode(JSGlobalData*, const Identifier& name, ExpressionNode* value, Type);
+        PropertyNode(JSGlobalData*, double name, ExpressionNode* value, Type);
 
         const Identifier& name() const { return m_name; }
 
     private:
         friend class PropertyListNode;
-        Identifier m_name;
+        const Identifier& m_name;
         ExpressionNode* m_assign;
         Type m_type;
     };
@@ -500,7 +469,7 @@ namespace JSC {
         virtual bool isDotAccessorNode() const { return true; }
 
         ExpressionNode* m_base;
-        Identifier m_ident;
+        const Identifier& m_ident;
     };
 
     class ArgumentListNode : public Node {
@@ -515,7 +484,7 @@ namespace JSC {
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
 
-    class ArgumentsNode : public ParserArenaDeletable {
+    class ArgumentsNode : public ParserArenaFreeable {
     public:
         ArgumentsNode(JSGlobalData*);
         ArgumentsNode(JSGlobalData*, ArgumentListNode*);
@@ -563,7 +532,7 @@ namespace JSC {
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        Identifier m_ident;
+        const Identifier& m_ident;
         ArgumentsNode* m_args;
         size_t m_index; // Used by LocalVarFunctionCallNode.
         size_t m_scopeDepth; // Used by ScopedVarFunctionCallNode and NonLocalVarFunctionCallNode
@@ -590,7 +559,7 @@ namespace JSC {
 
     protected:
         ExpressionNode* m_base;
-        const Identifier m_ident;
+        const Identifier& m_ident;
         ArgumentsNode* m_args;
     };
 
@@ -615,7 +584,7 @@ namespace JSC {
         PrePostResolveNode(JSGlobalData*, const Identifier&, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     protected:
-        const Identifier m_ident;
+        const Identifier& m_ident;
     };
 
     class PostfixResolveNode : public PrePostResolveNode {
@@ -648,7 +617,7 @@ namespace JSC {
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
         ExpressionNode* m_base;
-        Identifier m_ident;
+        const Identifier& m_ident;
         Operator m_operator;
     };
 
@@ -670,7 +639,7 @@ namespace JSC {
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        Identifier m_ident;
+        const Identifier& m_ident;
     };
 
     class DeleteBracketNode : public ExpressionNode, public ThrowableExpressionData {
@@ -692,7 +661,7 @@ namespace JSC {
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
         ExpressionNode* m_base;
-        Identifier m_ident;
+        const Identifier& m_ident;
     };
 
     class DeleteValueNode : public ExpressionNode {
@@ -724,7 +693,7 @@ namespace JSC {
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        Identifier m_ident;
+        const Identifier& m_ident;
     };
 
     class TypeOfValueNode : public ExpressionNode {
@@ -767,7 +736,7 @@ namespace JSC {
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
         ExpressionNode* m_base;
-        Identifier m_ident;
+        const Identifier& m_ident;
         Operator m_operator;
     };
 
@@ -826,7 +795,7 @@ namespace JSC {
         BinaryOpNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
         BinaryOpNode(JSGlobalData*, ResultType, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
 
-        RegisterID* emitStrcat(BytecodeGenerator& generator, RegisterID* dst, RegisterID* lhs = 0, ReadModifyResolveNode* emitExpressionInfoForMe = 0);
+        RegisterID* emitStrcat(BytecodeGenerator& generator, RegisterID* destination, RegisterID* lhs = 0, ReadModifyResolveNode* emitExpressionInfoForMe = 0);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -1009,7 +978,7 @@ namespace JSC {
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        Identifier m_ident;
+        const Identifier& m_ident;
         ExpressionNode* m_right;
         size_t m_index; // Used by ReadModifyLocalVarNode.
         Operator m_operator;
@@ -1023,7 +992,7 @@ namespace JSC {
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        Identifier m_ident;
+        const Identifier& m_ident;
         ExpressionNode* m_right;
         size_t m_index; // Used by ReadModifyLocalVarNode.
         bool m_rightHasAssignments;
@@ -1066,7 +1035,7 @@ namespace JSC {
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
         ExpressionNode* m_base;
-        Identifier m_ident;
+        const Identifier& m_ident;
         ExpressionNode* m_right;
         bool m_rightHasAssignments;
     };
@@ -1079,7 +1048,7 @@ namespace JSC {
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
         ExpressionNode* m_base;
-        Identifier m_ident;
+        const Identifier& m_ident;
         ExpressionNode* m_right;
         Operator m_operator : 31;
         bool m_rightHasAssignments : 1;
@@ -1099,10 +1068,12 @@ namespace JSC {
     
     typedef Vector<ExpressionNode*, 8> ExpressionVector;
 
-    class CommaNode : public ExpressionNode {
+    class CommaNode : public ExpressionNode, public ParserArenaDeletable {
     public:
         CommaNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2);
 
+        using ParserArenaDeletable::operator new;
+
         void append(ExpressionNode* expr) { m_expressions.append(expr); }
 
     private:
@@ -1123,7 +1094,7 @@ namespace JSC {
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
         virtual RegisterID* emitCodeSingle(BytecodeGenerator&);
 
-        Identifier m_ident;
+        const Identifier& m_ident;
 
     public:
         ConstDeclNode* m_next;
@@ -1142,36 +1113,33 @@ namespace JSC {
         ConstDeclNode* m_next;
     };
 
-    typedef Vector<StatementNode*> StatementVector;
-
     class SourceElements : public ParserArenaDeletable {
     public:
         SourceElements(JSGlobalData*);
 
         void append(StatementNode*);
-        void releaseContentsIntoVector(StatementVector& destination)
-        {
-            ASSERT(destination.isEmpty());
-            m_statements.swap(destination);
-            destination.shrinkToFit();
-        }
+
+        StatementNode* singleStatement() const;
+        StatementNode* lastStatement() const;
+
+        void emitBytecode(BytecodeGenerator&, RegisterID* destination);
 
     private:
-        StatementVector m_statements;
+        Vector<StatementNode*> m_statements;
     };
 
     class BlockNode : public StatementNode {
     public:
-        BlockNode(JSGlobalData*, SourceElements* children);
+        BlockNode(JSGlobalData*, SourceElements* = 0);
 
-        StatementVector& children() { return m_children; }
+        StatementNode* lastStatement() const;
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
         virtual bool isBlock() const { return true; }
 
-        StatementVector m_children;
+        SourceElements* m_statements;
     };
 
     class EmptyStatementNode : public StatementNode {
@@ -1281,7 +1249,7 @@ namespace JSC {
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        Identifier m_ident;
+        const Identifier& m_ident;
         ExpressionNode* m_init;
         ExpressionNode* m_lexpr;
         ExpressionNode* m_expr;
@@ -1297,7 +1265,7 @@ namespace JSC {
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        Identifier m_ident;
+        const Identifier& m_ident;
     };
 
     class BreakNode : public StatementNode, public ThrowableExpressionData {
@@ -1308,7 +1276,7 @@ namespace JSC {
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        Identifier m_ident;
+        const Identifier& m_ident;
     };
 
     class ReturnNode : public StatementNode, public ThrowableExpressionData {
@@ -1343,7 +1311,7 @@ namespace JSC {
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        Identifier m_name;
+        const Identifier& m_name;
         StatementNode* m_statement;
     };
 
@@ -1362,16 +1330,16 @@ namespace JSC {
         TryNode(JSGlobalData*, StatementNode* tryBlock, const Identifier& exceptionIdent, bool catchHasEval, StatementNode* catchBlock, StatementNode* finallyBlock);
 
     private:
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* dst = 0);
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
         StatementNode* m_tryBlock;
-        Identifier m_exceptionIdent;
+        const Identifier& m_exceptionIdent;
         StatementNode* m_catchBlock;
         StatementNode* m_finallyBlock;
         bool m_catchHasEval;
     };
 
-    class ParameterNode : public ParserArenaDeletable {
+    class ParameterNode : public ParserArenaFreeable {
     public:
         ParameterNode(JSGlobalData*, const Identifier&);
         ParameterNode(JSGlobalData*, ParameterNode*, const Identifier&);
@@ -1380,11 +1348,11 @@ namespace JSC {
         ParameterNode* nextParam() const { return m_next; }
 
     private:
-        Identifier m_ident;
+        const Identifier& m_ident;
         ParameterNode* m_next;
     };
 
-    struct ScopeNodeData {
+    struct ScopeNodeData : FastAllocBase {
         typedef DeclarationStacks::VarStack VarStack;
         typedef DeclarationStacks::FunctionStack FunctionStack;
 
@@ -1394,9 +1362,7 @@ namespace JSC {
         VarStack m_varStack;
         FunctionStack m_functionStack;
         int m_numConstants;
-        StatementVector m_children;
-
-        void mark();
+        SourceElements* m_statements;
     };
 
     class ScopeNode : public StatementNode, public ParserArenaRefCounted {
@@ -1407,6 +1373,8 @@ namespace JSC {
         ScopeNode(JSGlobalData*);
         ScopeNode(JSGlobalData*, const SourceCode&, SourceElements*, VarStack*, FunctionStack*, CodeFeatures, int numConstants);
 
+        using ParserArenaRefCounted::operator new;
+
         void adoptData(std::auto_ptr<ScopeNodeData> data)
         {
             ASSERT(!data->m_arena.contains(this));
@@ -1432,8 +1400,6 @@ namespace JSC {
         VarStack& varStack() { ASSERT(m_data); return m_data->m_varStack; }
         FunctionStack& functionStack() { ASSERT(m_data); return m_data->m_functionStack; }
 
-        StatementVector& children() { ASSERT(m_data); return m_data->m_children; }
-
         int neededConstants()
         {
             ASSERT(m_data);
@@ -1442,33 +1408,13 @@ namespace JSC {
             return m_data->m_numConstants + 2;
         }
 
-        virtual void mark() { }
+        StatementNode* singleStatement() const;
 
-#if ENABLE(JIT)
-        JITCode& generatedJITCode()
-        {
-            ASSERT(m_jitCode);
-            return m_jitCode;
-        }
-
-        ExecutablePool* getExecutablePool()
-        {
-            return m_jitCode.getExecutablePool();
-        }
-
-        void setJITCode(const JITCode jitCode)
-        {
-            m_jitCode = jitCode;
-        }
-#endif
+        void emitStatementsBytecode(BytecodeGenerator&, RegisterID* destination);
 
     protected:
         void setSource(const SourceCode& source) { m_source = source; }
 
-#if ENABLE(JIT)
-        JITCode m_jitCode;
-#endif
-
     private:
         OwnPtr<ScopeNodeData> m_data;
         CodeFeatures m_features;
@@ -1479,190 +1425,99 @@ namespace JSC {
     public:
         static PassRefPtr<ProgramNode> create(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
 
-        ProgramCodeBlock& bytecode(ScopeChainNode* scopeChain) 
-        {
-            if (!m_code)
-                generateBytecode(scopeChain);
-            return *m_code;
-        }
-
-#if ENABLE(JIT)
-        JITCode& jitCode(ScopeChainNode* scopeChain)
-        {
-            if (!m_jitCode)
-                generateJITCode(scopeChain);
-            return m_jitCode;
-        }
-#endif
+        static const bool scopeIsFunction = false;
 
     private:
         ProgramNode(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
 
-        void generateBytecode(ScopeChainNode*);
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
-
-#if ENABLE(JIT)
-        void generateJITCode(ScopeChainNode*);
-#endif
-
-        OwnPtr<ProgramCodeBlock> m_code;
     };
 
     class EvalNode : public ScopeNode {
     public:
         static PassRefPtr<EvalNode> create(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
 
-        EvalCodeBlock& bytecode(ScopeChainNode* scopeChain) 
-        {
-            if (!m_code)
-                generateBytecode(scopeChain);
-            return *m_code;
-        }
-
-        EvalCodeBlock& bytecodeForExceptionInfoReparse(ScopeChainNode*, CodeBlock*);
-
-        virtual void mark();
-
-#if ENABLE(JIT)
-        JITCode& jitCode(ScopeChainNode* scopeChain)
-        {
-            if (!m_jitCode)
-                generateJITCode(scopeChain);
-            return m_jitCode;
-        }
-#endif
+        static const bool scopeIsFunction = false;
 
     private:
         EvalNode(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
 
-        void generateBytecode(ScopeChainNode*);
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+    };
 
-#if ENABLE(JIT)
-        void generateJITCode(ScopeChainNode*);
-#endif
-        
-        OwnPtr<EvalCodeBlock> m_code;
+    class FunctionParameters : public Vector<Identifier>, public RefCounted<FunctionParameters> {
+    public:
+        static PassRefPtr<FunctionParameters> create(ParameterNode* firstParameter) { return adoptRef(new FunctionParameters(firstParameter)); }
+
+    private:
+        FunctionParameters(ParameterNode*);
     };
 
     class FunctionBodyNode : public ScopeNode {
-        friend class JIT;
     public:
-#if ENABLE(JIT)
-        static PassRefPtr<FunctionBodyNode> createNativeThunk(JSGlobalData*);
-#endif
         static FunctionBodyNode* create(JSGlobalData*);
         static PassRefPtr<FunctionBodyNode> create(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
-        virtual ~FunctionBodyNode();
 
-        const Identifier* parameters() const { return m_parameters; }
-        size_t parameterCount() const { return m_parameterCount; }
-        UString paramString() const ;
-        Identifier* copyParameters();
+        FunctionParameters* parameters() const { return m_parameters.get(); }
+        size_t parameterCount() const { return m_parameters->size(); }
 
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        bool isGenerated() const
-        {
-            return m_code;
-        }
-
-        bool isHostFunction() const;
-
-        virtual void mark();
-
-        void finishParsing(const SourceCode&, ParameterNode*);
-        void finishParsing(Identifier* parameters, size_t parameterCount);
+        void finishParsing(const SourceCode&, ParameterNode*, const Identifier&);
+        void finishParsing(PassRefPtr<FunctionParameters>, const Identifier&);
         
-        UString toSourceString() const { return source().toString(); }
+        const Identifier& ident() { return m_ident; }
 
-        CodeBlock& bytecodeForExceptionInfoReparse(ScopeChainNode*, CodeBlock*);
-#if ENABLE(JIT)
-        JITCode& jitCode(ScopeChainNode* scopeChain)
-        {
-            if (!m_jitCode)
-                generateJITCode(scopeChain);
-            return m_jitCode;
-        }
-#endif
+        static const bool scopeIsFunction = true;
 
-        CodeBlock& bytecode(ScopeChainNode* scopeChain) 
-        {
-            ASSERT(scopeChain);
-            if (!m_code)
-                generateBytecode(scopeChain);
-            return *m_code;
-        }
-        
-        CodeBlock& generatedBytecode()
-        {
-            ASSERT(m_code);
-            return *m_code;
-        }
-        
     private:
         FunctionBodyNode(JSGlobalData*);
         FunctionBodyNode(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
 
-        void generateBytecode(ScopeChainNode*);
-#if ENABLE(JIT)
-        void generateJITCode(ScopeChainNode*);
-#endif
-        Identifier* m_parameters;
-        size_t m_parameterCount;
-        OwnPtr<CodeBlock> m_code;
-#ifdef QT_BUILD_SCRIPT_LIB
-        SourcePool::SourcePoolToken* sourceToken;
-#endif
+        Identifier m_ident;
+        RefPtr<FunctionParameters> m_parameters;
     };
 
-    class FuncExprNode : public ExpressionNode, public ParserArenaRefCounted {
+    class FuncExprNode : public ExpressionNode {
     public:
         FuncExprNode(JSGlobalData*, const Identifier&, FunctionBodyNode* body, const SourceCode& source, ParameterNode* parameter = 0);
 
-        JSFunction* makeFunction(ExecState*, ScopeChainNode*);
-
-        FunctionBodyNode* body() { return m_body.get(); }
+        FunctionBodyNode* body() { return m_body; }
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
         virtual bool isFuncExprNode() const { return true; } 
 
-        Identifier m_ident;
-        RefPtr<FunctionBodyNode> m_body;
+        FunctionBodyNode* m_body;
     };
 
-    class FuncDeclNode : public StatementNode, public ParserArenaRefCounted {
+    class FuncDeclNode : public StatementNode {
     public:
         FuncDeclNode(JSGlobalData*, const Identifier&, FunctionBodyNode*, const SourceCode&, ParameterNode* = 0);
 
-        JSFunction* makeFunction(ExecState*, ScopeChainNode*);
-
-        Identifier m_ident;
-
-        FunctionBodyNode* body() { return m_body.get(); }
+        FunctionBodyNode* body() { return m_body; }
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        RefPtr<FunctionBodyNode> m_body;
+        FunctionBodyNode* m_body;
     };
 
-    class CaseClauseNode : public ParserArenaDeletable {
+    class CaseClauseNode : public ParserArenaFreeable {
     public:
-        CaseClauseNode(JSGlobalData*, ExpressionNode*);
-        CaseClauseNode(JSGlobalData*, ExpressionNode*, SourceElements*);
+        CaseClauseNode(JSGlobalData*, ExpressionNode*, SourceElements* = 0);
 
         ExpressionNode* expr() const { return m_expr; }
-        StatementVector& children() { return m_children; }
+
+        void emitBytecode(BytecodeGenerator&, RegisterID* destination);
 
     private:
         ExpressionNode* m_expr;
-        StatementVector m_children;
+        SourceElements* m_statements;
     };
 
-    class ClauseListNode : public ParserArenaDeletable {
+    class ClauseListNode : public ParserArenaFreeable {
     public:
         ClauseListNode(JSGlobalData*, CaseClauseNode*);
         ClauseListNode(JSGlobalData*, ClauseListNode*, CaseClauseNode*);
@@ -1675,11 +1530,11 @@ namespace JSC {
         ClauseListNode* m_next;
     };
 
-    class CaseBlockNode : public ParserArenaDeletable {
+    class CaseBlockNode : public ParserArenaFreeable {
     public:
         CaseBlockNode(JSGlobalData*, ClauseListNode* list1, CaseClauseNode* defaultClause, ClauseListNode* list2);
 
-        RegisterID* emitBytecodeForBlock(BytecodeGenerator&, RegisterID* input, RegisterID* dst = 0);
+        RegisterID* emitBytecodeForBlock(BytecodeGenerator&, RegisterID* input, RegisterID* destination);
 
     private:
         SwitchInfo::SwitchType tryOptimizedSwitch(Vector<ExpressionNode*, 8>& literalVector, int32_t& min_num, int32_t& max_num);
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Parser.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/Parser.cpp
index 96f4ae6..4c046d0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Parser.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Parser.cpp
@@ -53,7 +53,7 @@ void Parser::parse(JSGlobalData* globalData, int* errLine, UString* errMsg)
     *errMsg = 0;
 
     Lexer& lexer = *globalData->lexer;
-    lexer.setCode(*m_source);
+    lexer.setCode(*m_source, m_arena);
 
     int parseError = jscyyparse(globalData);
     bool lexError = lexer.sawError();
@@ -67,33 +67,6 @@ void Parser::parse(JSGlobalData* globalData, int* errLine, UString* errMsg)
     }
 }
 
-void Parser::reparseInPlace(JSGlobalData* globalData, FunctionBodyNode* functionBodyNode)
-{
-    ASSERT(!functionBodyNode->data());
-
-    m_source = &functionBodyNode->source();
-    globalData->lexer->setIsReparsing();
-    parse(globalData, 0, 0);
-    ASSERT(m_sourceElements);
-
-    functionBodyNode->adoptData(std::auto_ptr<ScopeNodeData>(new ScopeNodeData(globalData->parser->arena(),
-        m_sourceElements,
-        m_varDeclarations ? &m_varDeclarations->data : 0, 
-        m_funcDeclarations ? &m_funcDeclarations->data : 0,
-        m_numConstants)));
-    bool usesArguments = functionBodyNode->usesArguments();
-    functionBodyNode->setFeatures(m_features);
-    if (usesArguments && !functionBodyNode->usesArguments())
-        functionBodyNode->setUsesArguments();
-
-    ASSERT(globalData->parser->arena().isEmpty());
-
-    m_source = 0;
-    m_sourceElements = 0;
-    m_varDeclarations = 0;
-    m_funcDeclarations = 0;
-}
-
 void Parser::didFinishParsing(SourceElements* sourceElements, ParserArenaData<DeclarationStacks::VarStack>* varStack, 
                               ParserArenaData<DeclarationStacks::FunctionStack>* funcStack, CodeFeatures features, int lastLine, int numConstants)
 {
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Parser.h b/src/3rdparty/webkit/JavaScriptCore/parser/Parser.h
index 5a182a6..894f709 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Parser.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Parser.h
@@ -24,7 +24,11 @@
 #define Parser_h
 
 #include "Debugger.h"
+#include "Executable.h"
+#include "JSGlobalObject.h"
+#include "Lexer.h"
 #include "Nodes.h"
+#include "ParserArena.h"
 #include "SourceProvider.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
@@ -41,9 +45,8 @@ namespace JSC {
 
     class Parser : public Noncopyable {
     public:
-        template <class ParsedNode> PassRefPtr<ParsedNode> parse(ExecState*, Debugger*, const SourceCode&, int* errLine = 0, UString* errMsg = 0);
-        template <class ParsedNode> PassRefPtr<ParsedNode> reparse(JSGlobalData*, ParsedNode*);
-        void reparseInPlace(JSGlobalData*, FunctionBodyNode*);
+        template <class ParsedNode>
+        PassRefPtr<ParsedNode> parse(JSGlobalData* globalData, Debugger*, ExecState*, const SourceCode& source, int* errLine = 0, UString* errMsg = 0);
 
         void didFinishParsing(SourceElements*, ParserArenaData<DeclarationStacks::VarStack>*, 
                               ParserArenaData<DeclarationStacks::FunctionStack>*, CodeFeatures features, int lastLine, int numConstants);
@@ -63,57 +66,35 @@ namespace JSC {
         int m_numConstants;
     };
 
-    template <class ParsedNode> PassRefPtr<ParsedNode> Parser::parse(ExecState* exec, Debugger* debugger, const SourceCode& source, int* errLine, UString* errMsg)
+    template <class ParsedNode>
+    PassRefPtr<ParsedNode> Parser::parse(JSGlobalData* globalData, Debugger* debugger, ExecState* debuggerExecState, const SourceCode& source, int* errLine, UString* errMsg)
     {
         m_source = &source;
-        parse(&exec->globalData(), errLine, errMsg);
-        RefPtr<ParsedNode> result;
-        if (m_sourceElements) {
-            result = ParsedNode::create(&exec->globalData(),
-                                         m_sourceElements,
-                                         m_varDeclarations ? &m_varDeclarations->data : 0, 
-                                         m_funcDeclarations ? &m_funcDeclarations->data : 0,
-                                         *m_source,
-                                         m_features,
-                                         m_numConstants);
-            int column = m_source->startOffset(); //is it good way to find column number?
-            result->setLoc(m_source->firstLine(), m_lastLine, column);
-        }
+        if (ParsedNode::scopeIsFunction)
+            globalData->lexer->setIsReparsing();
+        parse(globalData, errLine, errMsg);
 
-        m_arena.reset();
-
-        m_source = 0;
-        m_varDeclarations = 0;
-        m_funcDeclarations = 0;
-
-        if (debugger)
-            debugger->sourceParsed(exec, source, *errLine, *errMsg);
-        return result.release();
-    }
-
-    template <class ParsedNode> PassRefPtr<ParsedNode> Parser::reparse(JSGlobalData* globalData, ParsedNode* oldParsedNode)
-    {
-        m_source = &oldParsedNode->source();
-        parse(globalData, 0, 0);
         RefPtr<ParsedNode> result;
         if (m_sourceElements) {
             result = ParsedNode::create(globalData,
-                                        m_sourceElements,
-                                        m_varDeclarations ? &m_varDeclarations->data : 0, 
-                                        m_funcDeclarations ? &m_funcDeclarations->data : 0,
-                                        *m_source,
-                                        oldParsedNode->features(),
-                                        m_numConstants);
-            int column = m_source->startOffset(); //is it good way to find column number?
-            result->setLoc(m_source->firstLine(), m_lastLine, column);
+            m_sourceElements,
+            m_varDeclarations ? &m_varDeclarations->data : 0,
+            m_funcDeclarations ? &m_funcDeclarations->data : 0,
+            source,
+            m_features,
+            m_numConstants);
+            result->setLoc(m_source->firstLine(), m_lastLine);
         }
 
         m_arena.reset();
 
         m_source = 0;
+        m_sourceElements = 0;
         m_varDeclarations = 0;
         m_funcDeclarations = 0;
 
+        if (debugger && !ParsedNode::scopeIsFunction)
+            debugger->sourceParsed(debuggerExecState, source, *errLine, *errMsg);
         return result.release();
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/ParserArena.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/ParserArena.cpp
index 78c5196..a8e8159 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/ParserArena.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/ParserArena.cpp
@@ -24,16 +24,45 @@
  */
 
 #include "config.h"
-#include "Parser.h"
 #include "ParserArena.h"
 
 #include "Nodes.h"
 
 namespace JSC {
 
+ParserArena::ParserArena()
+    : m_freeableMemory(0)
+    , m_freeablePoolEnd(0)
+    , m_identifierArena(new IdentifierArena)
+{
+}
+
+inline void* ParserArena::freeablePool()
+{
+    ASSERT(m_freeablePoolEnd);
+    return m_freeablePoolEnd - freeablePoolSize;
+}
+
+inline void ParserArena::deallocateObjects()
+{
+    if (m_freeablePoolEnd)
+        fastFree(freeablePool());
+
+    size_t size = m_freeablePools.size();
+    for (size_t i = 0; i < size; ++i)
+        fastFree(m_freeablePools[i]);
+
+    size = m_deletableObjects.size();
+    for (size_t i = 0; i < size; ++i) {
+        ParserArenaDeletable* object = m_deletableObjects[i];
+        object->~ParserArenaDeletable();
+        fastFree(object);
+    }
+}
+
 ParserArena::~ParserArena()
 {
-    deleteAllValues(m_deletableObjects);
+    deallocateObjects();
 }
 
 bool ParserArena::contains(ParserArenaRefCounted* object) const
@@ -53,26 +82,43 @@ void ParserArena::removeLast()
 
 void ParserArena::reset()
 {
-    deleteAllValues(m_deletableObjects);
-    m_deletableObjects.shrink(0);
-    m_refCountedObjects.shrink(0);
+    // Since this code path is used only when parsing fails, it's not bothering to reuse
+    // any of the memory the arena allocated. We could improve that later if we want to
+    // efficiently reuse the same arena.
+
+    deallocateObjects();
+
+    m_freeableMemory = 0;
+    m_freeablePoolEnd = 0;
+    m_identifierArena->clear();
+    m_freeablePools.clear();
+    m_deletableObjects.clear();
+    m_refCountedObjects.clear();
 }
 
-void* ParserArenaDeletable::operator new(size_t size, JSGlobalData* globalData)
+void ParserArena::allocateFreeablePool()
 {
-    ParserArenaDeletable* deletable = static_cast<ParserArenaDeletable*>(fastMalloc(size));
-    globalData->parser->arena().deleteWithArena(deletable);
-    return deletable;
+    if (m_freeablePoolEnd)
+        m_freeablePools.append(freeablePool());
+
+    char* pool = static_cast<char*>(fastMalloc(freeablePoolSize));
+    m_freeableMemory = pool;
+    m_freeablePoolEnd = pool + freeablePoolSize;
+    ASSERT(freeablePool() == pool);
 }
 
-void* ParserArenaDeletable::operator new(size_t size)
+bool ParserArena::isEmpty() const
 {
-    return fastMalloc(size);
+    return !m_freeablePoolEnd
+        && m_identifierArena->isEmpty()
+        && m_freeablePools.isEmpty()
+        && m_deletableObjects.isEmpty()
+        && m_refCountedObjects.isEmpty();
 }
 
-void ParserArenaDeletable::operator delete(void* p)
+void ParserArena::derefWithArena(PassRefPtr<ParserArenaRefCounted> object)
 {
-    fastFree(p);
+    m_refCountedObjects.append(object);
 }
 
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/ParserArena.h b/src/3rdparty/webkit/JavaScriptCore/parser/ParserArena.h
index 66c8529..2fd4fc1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/ParserArena.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/ParserArena.h
@@ -26,35 +26,101 @@
 #ifndef ParserArena_h
 #define ParserArena_h
 
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefPtr.h>
-#include <wtf/Vector.h>
+#include "Identifier.h"
+#include <wtf/SegmentedVector.h>
 
 namespace JSC {
 
     class ParserArenaDeletable;
     class ParserArenaRefCounted;
 
-    class ParserArena {
+    class IdentifierArena {
     public:
+        ALWAYS_INLINE const Identifier& makeIdentifier(JSGlobalData*, const UChar* characters, size_t length);
+        const Identifier& makeNumericIdentifier(JSGlobalData*, double number);
+
+        void clear() { m_identifiers.clear(); }
+        bool isEmpty() const { return m_identifiers.isEmpty(); }
+
+    private:
+        typedef SegmentedVector<Identifier, 64> IdentifierVector;
+        IdentifierVector m_identifiers;
+    };
+
+    ALWAYS_INLINE const Identifier& IdentifierArena::makeIdentifier(JSGlobalData* globalData, const UChar* characters, size_t length)
+    {
+        m_identifiers.append(Identifier(globalData, characters, length));
+        return m_identifiers.last();
+    }
+
+    inline const Identifier& IdentifierArena::makeNumericIdentifier(JSGlobalData* globalData, double number)
+    {
+        m_identifiers.append(Identifier(globalData, UString::from(number)));
+        return m_identifiers.last();
+    }
+
+    class ParserArena : Noncopyable {
+    public:
+        ParserArena();
+        ~ParserArena();
+
         void swap(ParserArena& otherArena)
         {
+            std::swap(m_freeableMemory, otherArena.m_freeableMemory);
+            std::swap(m_freeablePoolEnd, otherArena.m_freeablePoolEnd);
+            m_identifierArena.swap(otherArena.m_identifierArena);
+            m_freeablePools.swap(otherArena.m_freeablePools);
             m_deletableObjects.swap(otherArena.m_deletableObjects);
             m_refCountedObjects.swap(otherArena.m_refCountedObjects);
         }
-        ~ParserArena();
 
-        void deleteWithArena(ParserArenaDeletable* object) { m_deletableObjects.append(object); }
-        void derefWithArena(PassRefPtr<ParserArenaRefCounted> object) { m_refCountedObjects.append(object); }
+        void* allocateFreeable(size_t size)
+        {
+            ASSERT(size);
+            ASSERT(size <= freeablePoolSize);
+            size_t alignedSize = alignSize(size);
+            ASSERT(alignedSize <= freeablePoolSize);
+            if (UNLIKELY(static_cast<size_t>(m_freeablePoolEnd - m_freeableMemory) < alignedSize))
+                allocateFreeablePool();
+            void* block = m_freeableMemory;
+            m_freeableMemory += alignedSize;
+            return block;
+        }
+
+        void* allocateDeletable(size_t size)
+        {
+            ParserArenaDeletable* deletable = static_cast<ParserArenaDeletable*>(fastMalloc(size));
+            m_deletableObjects.append(deletable);
+            return deletable;
+        }
 
+        void derefWithArena(PassRefPtr<ParserArenaRefCounted>);
         bool contains(ParserArenaRefCounted*) const;
         ParserArenaRefCounted* last() const;
         void removeLast();
 
-        bool isEmpty() const { return m_deletableObjects.isEmpty() && m_refCountedObjects.isEmpty(); }
+        bool isEmpty() const;
         void reset();
 
+        IdentifierArena& identifierArena() { return *m_identifierArena; }
+
     private:
+        static const size_t freeablePoolSize = 8000;
+
+        static size_t alignSize(size_t size)
+        {
+            return (size + sizeof(WTF::AllocAlignmentInteger) - 1) & ~(sizeof(WTF::AllocAlignmentInteger) - 1);
+        }
+
+        void* freeablePool();
+        void allocateFreeablePool();
+        void deallocateObjects();
+
+        char* m_freeableMemory;
+        char* m_freeablePoolEnd;
+
+        OwnPtr<IdentifierArena> m_identifierArena;
+        Vector<void*> m_freeablePools;
         Vector<ParserArenaDeletable*> m_deletableObjects;
         Vector<RefPtr<ParserArenaRefCounted> > m_refCountedObjects;
     };
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/SourceCode.h b/src/3rdparty/webkit/JavaScriptCore/parser/SourceCode.h
index 305b804..84360b8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/SourceCode.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/SourceCode.h
@@ -47,11 +47,7 @@ namespace JSC {
             : m_provider(provider)
             , m_startChar(0)
             , m_endChar(m_provider->length())
-#ifdef QT_BUILD_SCRIPT_LIB
-            , m_firstLine(firstLine)
-#else
             , m_firstLine(std::max(firstLine, 1))
-#endif
         {
         }
 
@@ -59,11 +55,7 @@ namespace JSC {
             : m_provider(provider)
             , m_startChar(start)
             , m_endChar(end)
-#ifdef QT_BUILD_SCRIPT_LIB
-            , m_firstLine(firstLine)
-#else
             , m_firstLine(std::max(firstLine, 1))
-#endif
         {
         }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/SourcePoolQt.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/SourcePoolQt.cpp
deleted file mode 100644
index 4fc859f..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/parser/SourcePoolQt.cpp
+++ /dev/null
@@ -1,109 +0,0 @@
-/*
-    Copyright (C) 2008, 2009 Nokia Corporation and/or its subsidiary(-ies)
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-#include "SourcePoolQt.h"
-
-
-#ifdef QT_BUILD_SCRIPT_LIB
-
-#include "SourceCode.h"
-#include "Debugger.h"
-
-
-namespace JSC {
-
-    void SourcePool::startEvaluating(const SourceCode& source)
-    {
-        int id = source.provider()->asID();
-
-        codes.insert(id,source.toString());
-
-        currentScript.push(id);
-        scriptRef.insert(id,ScriptActivCount());
-
-        if (debug)
-            debug->scriptLoad(id,source.toString(),source.provider()->url(),source.firstLine());
-    }
-
-
-    void SourcePool::stopEvaluating(const SourceCode& source)
-    {
-        int id = source.provider()->asID();
-        currentScript.pop();
-
-        if (scriptRef.contains(id)) {
-            ScriptActivCount info = scriptRef.take(id);
-            if (info.getCount()) {
-                //we can't remove info from scriptRef
-                info.isActive = false;
-                scriptRef.insert(id,info);
-            } else {
-                //we are unloading source code
-                if (debug)
-                    debug->scriptUnload(id);
-            }
-        }
-    }
-
-    SourcePool::SourcePoolToken* SourcePool::objectRegister()
-    {
-        if (currentScript.isEmpty()) {
-            return 0;
-        }
-
-        int id = currentScript.top();
-
-        SourcePoolToken* token = new SourcePoolToken(id,this);
-
-        ScriptActivCount info = scriptRef.take(id);
-
-        info.incCount();
-        scriptRef.insert(id,info);
-        return token;
-    }
-
-    void SourcePool::objectUnregister(const SourcePool::SourcePoolToken *token)
-    {
-        int id = token->id;
-
-        ScriptActivCount info = scriptRef.take(id);
-        info.decCount();
-        if (info.isActive) {
-            scriptRef.insert(id,info);
-        } else {
-            if (info.getCount() == 0) {
-                //remove from scriptRef (script is not active and there is no objects connected)
-                if(debug)
-                    debug->scriptUnload(id);
-            } else {
-                scriptRef.insert(id,info);
-            }
-        }
-
-    }
-
-
-    void SourcePool::setDebugger(JSC::Debugger *debugger) { this->debug = debugger; }
-    Debugger* SourcePool::debugger() { return debug; }
-
-} //namespace JSC
-
-
-#endif //QT_BUILD_SCRIPT_LIB
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/SourcePoolQt.h b/src/3rdparty/webkit/JavaScriptCore/parser/SourcePoolQt.h
deleted file mode 100644
index da58edb..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/parser/SourcePoolQt.h
+++ /dev/null
@@ -1,93 +0,0 @@
-/*
-    Copyright (C) 2008, 2009 Nokia Corporation and/or its subsidiary(-ies)
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-#ifndef SOURCEPOOL_H
-#define SOURCEPOOL_H
-
-#ifdef QT_BUILD_SCRIPT_LIB
-
-#include "qhash.h"
-#include "qstack.h"
-#include "qdebug.h"
-#include <stdint.h>
-
-namespace JSC {
-
-    QT_USE_NAMESPACE
-
-    class SourceCode;
-    class Debugger;
-
-    class SourcePool
-    {
-        class ScriptActivCount
-        {
-            int count;
-        public:
-            void incCount()
-            {
-                count++;
-            };
-            void decCount()
-            {
-                count--;
-            };
-            int getCount() const
-            {
-                return count;
-            };
-            bool isActive;
-            ScriptActivCount() : count(0), isActive(true) {}
-        };
-        QStack<intptr_t> currentScript;
-        QHash<unsigned, ScriptActivCount> scriptRef;
-        QHash<int, QString> codes;  //debug
-        Debugger *debug;
-
-        friend class SourcePoolToken;
-    public:
-        class SourcePoolToken
-        {
-            unsigned id;
-            SourcePool *ptr;
-            SourcePoolToken(unsigned scriptId, SourcePool *scriptPool) : id(scriptId),ptr(scriptPool) {}
-            SourcePoolToken(const SourcePoolToken&) : id(0), ptr(0) {}  //private - do not use - will crash
-        public:
-            ~SourcePoolToken() { ptr->objectUnregister(this); }
-            friend class SourcePool;
-        };
-
-        SourcePool() : debug(0) {}
-
-        void startEvaluating(const SourceCode& source);
-        void stopEvaluating(const SourceCode& source);
-        SourcePoolToken* objectRegister();
-
-        void setDebugger(Debugger *debugger);
-        Debugger* debugger();
-
-    private:
-        void objectUnregister(const SourcePoolToken *token);
-    };
-
-} //namespace JSC
-
-
-#endif  //QT_BUILD_SCRIPT_LIB
-
-#endif // SOURCEPOOL_H
diff --git a/src/3rdparty/webkit/JavaScriptCore/pcre/dftables b/src/3rdparty/webkit/JavaScriptCore/pcre/dftables
index 8a2d140..1f0ea01 100755
--- a/src/3rdparty/webkit/JavaScriptCore/pcre/dftables
+++ b/src/3rdparty/webkit/JavaScriptCore/pcre/dftables
@@ -244,7 +244,7 @@ sub readHeaderValues()
  
     my ($fh, $tempFile) = tempfile(
         basename($0) . "-XXXXXXXX",
-        DIR => File::Spec->tmpdir,
+        DIR => File::Spec->tmpdir(),
         SUFFIX => ".in",
         UNLINK => 0,
     );
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.cpp
index 1a061cb..dc68ecb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.cpp
@@ -27,6 +27,7 @@
 #include "ProfileGenerator.h"
 
 #include "CallFrame.h"
+#include "CodeBlock.h"
 #include "JSGlobalObject.h"
 #include "JSStringRef.h"
 #include "JSFunction.h"
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.h b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.h
index cccb502..82149b3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.h
@@ -33,11 +33,11 @@
 
 namespace JSC {
 
-    class CallIdentifier;
     class ExecState;
     class Profile;
     class ProfileNode;
     class UString;
+    struct CallIdentifier;    
 
     class ProfileGenerator : public RefCounted<ProfileGenerator>  {
     public:
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.cpp
index e103fd1..6f72e08 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.cpp
@@ -31,6 +31,7 @@
 
 #include "CommonIdentifiers.h"
 #include "CallFrame.h"
+#include "CodeBlock.h"
 #include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "Nodes.h"
@@ -134,26 +135,27 @@ void Profiler::didExecute(ExecState* exec, const UString& sourceURL, int startin
     dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::didExecute, createCallIdentifier(&exec->globalData(), JSValue(), sourceURL, startingLineNumber), exec->lexicalGlobalObject()->profileGroup());
 }
 
-CallIdentifier Profiler::createCallIdentifier(JSGlobalData* globalData, JSValue function, const UString& defaultSourceURL, int defaultLineNumber)
+CallIdentifier Profiler::createCallIdentifier(JSGlobalData* globalData, JSValue functionValue, const UString& defaultSourceURL, int defaultLineNumber)
 {
-    if (!function)
+    if (!functionValue)
         return CallIdentifier(GlobalCodeExecution, defaultSourceURL, defaultLineNumber);
-    if (!function.isObject())
+    if (!functionValue.isObject())
         return CallIdentifier("(unknown)", defaultSourceURL, defaultLineNumber);
-    if (asObject(function)->inherits(&JSFunction::info)) {
-        JSFunction* func = asFunction(function);
-        if (!func->isHostFunction())
-            return createCallIdentifierFromFunctionImp(globalData, func);
+    if (asObject(functionValue)->inherits(&JSFunction::info)) {
+        JSFunction* function = asFunction(functionValue);
+        if (!function->executable()->isHostFunction())
+            return createCallIdentifierFromFunctionImp(globalData, function);
     }
-    if (asObject(function)->inherits(&InternalFunction::info))
-        return CallIdentifier(static_cast<InternalFunction*>(asObject(function))->name(globalData), defaultSourceURL, defaultLineNumber);
-    return CallIdentifier("(" + asObject(function)->className() + " object)", defaultSourceURL, defaultLineNumber);
+    if (asObject(functionValue)->inherits(&InternalFunction::info))
+        return CallIdentifier(static_cast<InternalFunction*>(asObject(functionValue))->name(globalData), defaultSourceURL, defaultLineNumber);
+    return CallIdentifier("(" + asObject(functionValue)->className() + " object)", defaultSourceURL, defaultLineNumber);
 }
 
 CallIdentifier createCallIdentifierFromFunctionImp(JSGlobalData* globalData, JSFunction* function)
 {
+    ASSERT(!function->isHostFunction());
     const UString& name = function->calculatedDisplayName(globalData);
-    return CallIdentifier(name.isEmpty() ? AnonymousFunction : name, function->body()->sourceURL(), function->body()->lineNo());
+    return CallIdentifier(name.isEmpty() ? AnonymousFunction : name, function->jsExecutable()->sourceURL(), function->jsExecutable()->lineNo());
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.h b/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.h
index 869f419..21621bf 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.h
@@ -36,13 +36,13 @@
 
 namespace JSC {
 
-    class CallIdentifier;
     class ExecState;
     class JSGlobalData;
     class JSObject;
     class JSValue;
     class ProfileGenerator;
     class UString;
+    struct CallIdentifier;    
 
     class Profiler : public FastAllocBase {
     public:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.cpp
index 0b5d958..ab2b5d7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.cpp
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -37,16 +37,12 @@ void ArgList::getSlice(int startIndex, ArgList& result) const
     result = ArgList(m_args + startIndex, m_argCount - startIndex);
 }
 
-void MarkedArgumentBuffer::markLists(ListSet& markSet)
+void MarkedArgumentBuffer::markLists(MarkStack& markStack, ListSet& markSet)
 {
     ListSet::iterator end = markSet.end();
     for (ListSet::iterator it = markSet.begin(); it != end; ++it) {
         MarkedArgumentBuffer* list = *it;
-
-        iterator end2 = list->end();
-        for (iterator it2 = list->begin(); it2 != end2; ++it2)
-            if (!(*it2).marked())
-                (*it2).mark();
+        markStack.appendValues(reinterpret_cast<JSValue*>(list->m_buffer), list->m_size);
     }
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.h
index 0899e85..3227770 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.h
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 2007, 2008, 2009 Apple Computer, Inc.
+ *  Copyright (C) 2003, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -22,15 +22,15 @@
 #ifndef ArgList_h
 #define ArgList_h
 
-#include "JSImmediate.h"
 #include "Register.h"
-
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/Vector.h>
 
 namespace JSC {
-    
+
+    class MarkStack;
+
     class MarkedArgumentBuffer : public Noncopyable {
     private:
         static const unsigned inlineCapacity = 8;
@@ -136,7 +136,7 @@ namespace JSC {
         const_iterator begin() const { return m_buffer; }
         const_iterator end() const { return m_buffer + m_size; }
 
-        static void markLists(ListSet&);
+        static void markLists(MarkStack&, ListSet&);
 
     private:
         void slowAppend(JSValue);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.cpp
index 7cb4fe9..86a8f0a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.cpp
@@ -1,7 +1,7 @@
 /*
  *  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
  *  Copyright (C) 2007 Maks Orlovich
  *
@@ -43,30 +43,22 @@ Arguments::~Arguments()
         delete [] d->extraArguments;
 }
 
-void Arguments::mark()
+void Arguments::markChildren(MarkStack& markStack)
 {
-    JSObject::mark();
+    JSObject::markChildren(markStack);
 
-    if (d->registerArray) {
-        for (unsigned i = 0; i < d->numParameters; ++i) {
-            if (!d->registerArray[i].marked())
-                d->registerArray[i].mark();
-        }
-    }
+    if (d->registerArray)
+        markStack.appendValues(reinterpret_cast<JSValue*>(d->registerArray.get()), d->numParameters);
 
     if (d->extraArguments) {
         unsigned numExtraArguments = d->numArguments - d->numParameters;
-        for (unsigned i = 0; i < numExtraArguments; ++i) {
-            if (!d->extraArguments[i].marked())
-                d->extraArguments[i].mark();
-        }
+        markStack.appendValues(reinterpret_cast<JSValue*>(d->extraArguments), numExtraArguments);
     }
 
-    if (!d->callee->marked())
-        d->callee->mark();
+    markStack.append(d->callee);
 
-    if (d->activation && !d->activation->marked())
-        d->activation->mark();
+    if (d->activation)
+        markStack.append(d->activation);
 }
 
 void Arguments::copyToRegisters(ExecState* exec, Register* buffer, uint32_t maxSize)
@@ -187,6 +179,31 @@ bool Arguments::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return JSObject::getOwnPropertySlot(exec, propertyName, slot);
 }
 
+bool Arguments::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    bool isArrayIndex;
+    unsigned i = propertyName.toArrayIndex(&isArrayIndex);
+    if (isArrayIndex && i < d->numArguments && (!d->deletedArguments || !d->deletedArguments[i])) {
+        if (i < d->numParameters) {
+            descriptor.setDescriptor(d->registers[d->firstParameterIndex + i].jsValue(), DontEnum);
+        } else
+            descriptor.setDescriptor(d->extraArguments[i - d->numParameters].jsValue(), DontEnum);
+        return true;
+    }
+    
+    if (propertyName == exec->propertyNames().length && LIKELY(!d->overrodeLength)) {
+        descriptor.setDescriptor(jsNumber(exec, d->numArguments), DontEnum);
+        return true;
+    }
+    
+    if (propertyName == exec->propertyNames().callee && LIKELY(!d->overrodeCallee)) {
+        descriptor.setDescriptor(d->callee, DontEnum);
+        return true;
+    }
+    
+    return JSObject::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
 void Arguments::put(ExecState* exec, unsigned i, JSValue value, PutPropertySlot& slot)
 {
     if (i < d->numArguments && (!d->deletedArguments || !d->deletedArguments[i])) {
@@ -227,7 +244,7 @@ void Arguments::put(ExecState* exec, const Identifier& propertyName, JSValue val
     JSObject::put(exec, propertyName, value, slot);
 }
 
-bool Arguments::deleteProperty(ExecState* exec, unsigned i, bool checkDontDelete)
+bool Arguments::deleteProperty(ExecState* exec, unsigned i) 
 {
     if (i < d->numArguments) {
         if (!d->deletedArguments) {
@@ -240,10 +257,10 @@ bool Arguments::deleteProperty(ExecState* exec, unsigned i, bool checkDontDelete
         }
     }
 
-    return JSObject::deleteProperty(exec, Identifier(exec, UString::from(i)), checkDontDelete);
+    return JSObject::deleteProperty(exec, Identifier(exec, UString::from(i)));
 }
 
-bool Arguments::deleteProperty(ExecState* exec, const Identifier& propertyName, bool checkDontDelete)
+bool Arguments::deleteProperty(ExecState* exec, const Identifier& propertyName) 
 {
     bool isArrayIndex;
     unsigned i = propertyName.toArrayIndex(&isArrayIndex);
@@ -268,17 +285,7 @@ bool Arguments::deleteProperty(ExecState* exec, const Identifier& propertyName,
         return true;
     }
 
-    return JSObject::deleteProperty(exec, propertyName, checkDontDelete);
-}
-
-bool Arguments::getPropertyAttributes(ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
-{
-    if ((propertyName == exec->propertyNames().length)
-        || (propertyName == exec->propertyNames().callee)) {
-        attributes = DontEnum;
-        return true;
-    }
-    return JSObject::getPropertyAttributes(exec, propertyName, attributes);
+    return JSObject::deleteProperty(exec, propertyName);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h
index dc54dac..5be84a2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
  *  Copyright (C) 2007 Maks Orlovich
  *
@@ -28,6 +28,8 @@
 #include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "Interpreter.h"
+#include "ObjectConstructor.h"
+#include "PrototypeFunction.h"
 
 namespace JSC {
 
@@ -45,7 +47,7 @@ namespace JSC {
         OwnArrayPtr<bool> deletedArguments;
         Register extraArgumentsFixedBuffer[4];
 
-        JSObject* callee;
+        JSFunction* callee;
         bool overrodeLength : 1;
         bool overrodeCallee : 1;
     };
@@ -61,7 +63,7 @@ namespace JSC {
 
         static const ClassInfo info;
 
-        virtual void mark();
+        virtual void markChildren(MarkStack&);
 
         void fillArgList(ExecState*, MarkedArgumentBuffer&);
 
@@ -87,14 +89,14 @@ namespace JSC {
         }
 
     private:
-        void getArgumentsData(CallFrame*, JSObject*&, ptrdiff_t& firstParameterIndex, Register*& argv, int& argc);
+        void getArgumentsData(CallFrame*, JSFunction*&, ptrdiff_t& firstParameterIndex, Register*& argv, int& argc);
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual void put(ExecState*, unsigned propertyName, JSValue, PutPropertySlot&);
-        virtual bool deleteProperty(ExecState*, const Identifier& propertyName, bool checkDontDelete = true);
-        virtual bool deleteProperty(ExecState*, unsigned propertyName, bool checkDontDelete = true);
-        virtual bool getPropertyAttributes(ExecState*, const Identifier& propertyName, unsigned& attributes) const;
+        virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
+        virtual bool deleteProperty(ExecState*, unsigned propertyName);
 
         virtual const ClassInfo* classInfo() const { return &info; }
 
@@ -111,42 +113,33 @@ namespace JSC {
         return static_cast<Arguments*>(asObject(value));
     }
 
-    ALWAYS_INLINE void Arguments::getArgumentsData(CallFrame* callFrame, JSObject*& callee, ptrdiff_t& firstParameterIndex, Register*& argv, int& argc)
+    ALWAYS_INLINE void Arguments::getArgumentsData(CallFrame* callFrame, JSFunction*& function, ptrdiff_t& firstParameterIndex, Register*& argv, int& argc)
     {
-        callee = callFrame->callee();
-
-        int numParameters;
-        if (callee->isObject(&JSFunction::info)) {
-            CodeBlock* codeBlock =  &JSC::asFunction(callee)->body()->generatedBytecode();
-            numParameters = codeBlock->m_numParameters;
-        } else {
-            numParameters = 0;
-        }
+        function = callFrame->callee();
+
+        int numParameters = function->jsExecutable()->parameterCount();
         argc = callFrame->argumentCount();
 
         if (argc <= numParameters)
-            argv = callFrame->registers() - RegisterFile::CallFrameHeaderSize - numParameters + 1; // + 1 to skip "this"
+            argv = callFrame->registers() - RegisterFile::CallFrameHeaderSize - numParameters;
         else
-            argv = callFrame->registers() - RegisterFile::CallFrameHeaderSize - numParameters - argc + 1; // + 1 to skip "this"
+            argv = callFrame->registers() - RegisterFile::CallFrameHeaderSize - numParameters - argc;
 
         argc -= 1; // - 1 to skip "this"
-        firstParameterIndex = -RegisterFile::CallFrameHeaderSize - numParameters + 1; // + 1 to skip "this"
+        firstParameterIndex = -RegisterFile::CallFrameHeaderSize - numParameters;
     }
 
     inline Arguments::Arguments(CallFrame* callFrame)
         : JSObject(callFrame->lexicalGlobalObject()->argumentsStructure())
         , d(new ArgumentsData)
     {
-        JSObject* callee;
+        JSFunction* callee;
         ptrdiff_t firstParameterIndex;
         Register* argv;
         int numArguments;
         getArgumentsData(callFrame, callee, firstParameterIndex, argv, numArguments);
 
-        if (callee->isObject(&JSFunction::info))
-            d->numParameters = JSC::asFunction(callee)->body()->parameterCount();
-        else
-            d->numParameters = 0;
+        d->numParameters = callee->jsExecutable()->parameterCount();
         d->firstParameterIndex = firstParameterIndex;
         d->numArguments = numArguments;
 
@@ -177,8 +170,7 @@ namespace JSC {
         : JSObject(callFrame->lexicalGlobalObject()->argumentsStructure())
         , d(new ArgumentsData)
     {
-        if (callFrame->callee() && callFrame->callee()->isObject(&JSC::JSFunction::info))
-            ASSERT(!asFunction(callFrame->callee())->body()->parameterCount());
+        ASSERT(!callFrame->callee()->jsExecutable()->parameterCount());
 
         unsigned numArguments = callFrame->argumentCount() - 1;
 
@@ -193,8 +185,6 @@ namespace JSC {
             extraArguments = d->extraArgumentsFixedBuffer;
 
         Register* argv = callFrame->registers() - RegisterFile::CallFrameHeaderSize - numArguments - 1;
-        if (callFrame->callee() && !callFrame->callee()->isObject(&JSC::JSFunction::info))
-            ++argv; // ### off-by-one issue with native functions
         for (unsigned i = 0; i < numArguments; ++i)
             extraArguments[i] = argv[i];
 
@@ -226,8 +216,8 @@ namespace JSC {
     {
         ASSERT(!d()->registerArray);
 
-        size_t numParametersMinusThis = d()->functionBody->generatedBytecode().m_numParameters - 1;
-        size_t numVars = d()->functionBody->generatedBytecode().m_numVars;
+        size_t numParametersMinusThis = d()->functionExecutable->generatedBytecode().m_numParameters - 1;
+        size_t numVars = d()->functionExecutable->generatedBytecode().m_numVars;
         size_t numLocals = numVars + numParametersMinusThis;
 
         if (!numLocals)
@@ -242,6 +232,14 @@ namespace JSC {
             static_cast<Arguments*>(arguments)->setActivation(this);
     }
 
+    ALWAYS_INLINE Arguments* Register::arguments() const
+    {
+        if (jsValue() == JSValue())
+            return 0;
+        return asArguments(jsValue());
+    }
+    
+
 } // namespace JSC
 
 #endif // Arguments_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayConstructor.cpp
index e96bdfc..c60cb0e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayConstructor.cpp
@@ -25,15 +25,19 @@
 #include "ArrayConstructor.h"
 
 #include "ArrayPrototype.h"
+#include "Error.h"
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "Lookup.h"
+#include "PrototypeFunction.h"
 
 namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(ArrayConstructor);
+    
+static JSValue JSC_HOST_CALL arrayConstructorIsArray(ExecState*, JSObject*, JSValue, const ArgList&);
 
-ArrayConstructor::ArrayConstructor(ExecState* exec, PassRefPtr<Structure> structure, ArrayPrototype* arrayPrototype)
+ArrayConstructor::ArrayConstructor(ExecState* exec, PassRefPtr<Structure> structure, ArrayPrototype* arrayPrototype, Structure* prototypeFunctionStructure)
     : InternalFunction(&exec->globalData(), structure, Identifier(exec, arrayPrototype->classInfo()->className))
 {
     // ECMA 15.4.3.1 Array.prototype
@@ -41,6 +45,9 @@ ArrayConstructor::ArrayConstructor(ExecState* exec, PassRefPtr<Structure> struct
 
     // no. of arguments for constructor
     putDirectWithoutTransition(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly | DontEnum | DontDelete);
+
+    // ES5
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().isArray, arrayConstructorIsArray), DontEnum);
 }
 
 static JSObject* constructArrayWithSizeQuirk(ExecState* exec, const ArgList& args)
@@ -82,4 +89,9 @@ CallType ArrayConstructor::getCallData(CallData& callData)
     return CallTypeHost;
 }
 
+JSValue JSC_HOST_CALL arrayConstructorIsArray(ExecState*, JSObject*, JSValue, const ArgList& args)
+{
+    return jsBoolean(args.at(0).inherits(&JSArray::info));
+}
+
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayConstructor.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayConstructor.h
index 8300d8c..2b79510 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayConstructor.h
@@ -29,7 +29,7 @@ namespace JSC {
 
     class ArrayConstructor : public InternalFunction {
     public:
-        ArrayConstructor(ExecState*, PassRefPtr<Structure>, ArrayPrototype*);
+        ArrayConstructor(ExecState*, PassRefPtr<Structure>, ArrayPrototype*, Structure*);
 
         virtual ConstructType getConstructData(ConstructData&);
         virtual CallType getCallData(CallData&);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp
index 807e59a..e1b1f34 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp
@@ -67,7 +67,7 @@ static JSValue JSC_HOST_CALL arrayProtoFuncLastIndexOf(ExecState*, JSObject*, JS
 
 namespace JSC {
 
-static inline bool isNumericCompareFunction(CallType callType, const CallData& callData)
+static inline bool isNumericCompareFunction(ExecState* exec, CallType callType, const CallData& callData)
 {
     if (callType != CallTypeJS)
         return false;
@@ -75,10 +75,10 @@ static inline bool isNumericCompareFunction(CallType callType, const CallData& c
 #if ENABLE(JIT)
     // If the JIT is enabled then we need to preserve the invariant that every
     // function with a CodeBlock also has JIT code.
-    callData.js.functionBody->jitCode(callData.js.scopeChain);
-    CodeBlock& codeBlock = callData.js.functionBody->generatedBytecode();
+    callData.js.functionExecutable->jitCode(exec, callData.js.scopeChain);
+    CodeBlock& codeBlock = callData.js.functionExecutable->generatedBytecode();
 #else
-    CodeBlock& codeBlock = callData.js.functionBody->bytecode(callData.js.scopeChain);
+    CodeBlock& codeBlock = callData.js.functionExecutable->bytecode(exec, callData.js.scopeChain);
 #endif
 
     return codeBlock.isNumericCompareFunction();
@@ -125,6 +125,11 @@ bool ArrayPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticFunctionSlot<JSArray>(exec, ExecState::arrayTable(exec), this, propertyName, slot);
 }
 
+bool ArrayPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSArray>(exec, ExecState::arrayTable(exec), this, propertyName, descriptor);
+}
+
 // ------------------------------ Array Functions ----------------------------
 
 // Helper function
@@ -144,7 +149,7 @@ static void putProperty(ExecState* exec, JSObject* obj, const Identifier& proper
 
 JSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&JSArray::info))
+    if (!thisValue.inherits(&JSArray::info))
         return throwError(exec, TypeError);
     JSObject* thisObj = asArray(thisValue);
 
@@ -190,7 +195,7 @@ JSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec, JSObject*, JSValue
 
 JSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&JSArray::info))
+    if (!thisValue.inherits(&JSArray::info))
         return throwError(exec, TypeError);
     JSObject* thisObj = asArray(thisValue);
 
@@ -298,7 +303,7 @@ JSValue JSC_HOST_CALL arrayProtoFuncConcat(ExecState* exec, JSObject*, JSValue t
     ArgList::const_iterator it = args.begin();
     ArgList::const_iterator end = args.end();
     while (1) {
-        if (curArg.isObject(&JSArray::info)) {
+        if (curArg.inherits(&JSArray::info)) {
             unsigned length = curArg.get(exec, exec->propertyNames().length).toUInt32(exec);
             JSObject* curObject = curArg.toObject(exec);
             for (unsigned k = 0; k < length; ++k) {
@@ -456,7 +461,7 @@ JSValue JSC_HOST_CALL arrayProtoFuncSort(ExecState* exec, JSObject*, JSValue thi
     CallType callType = function.getCallData(callData);
 
     if (thisObj->classInfo() == &JSArray::info) {
-        if (isNumericCompareFunction(callType, callData))
+        if (isNumericCompareFunction(exec, callType, callData))
             asArray(thisObj)->sortNumeric(exec, function, callType, callData);
         else if (callType != CallTypeNone)
             asArray(thisObj)->sort(exec, function, callType, callData);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.h
index 2165089..6f7ed12 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.h
@@ -31,6 +31,7 @@ namespace JSC {
         explicit ArrayPrototype(PassRefPtr<Structure>);
 
         bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h
index cfd55fe..5f3e5f0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h
@@ -31,6 +31,11 @@ namespace JSC {
 
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
+        
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        {
+            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames));
+        }
     };
 
     BooleanObject* asBooleanObject(JSValue);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanPrototype.cpp
index 703a568..cf4fbd7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanPrototype.cpp
@@ -59,7 +59,7 @@ JSValue JSC_HOST_CALL booleanProtoFuncToString(ExecState* exec, JSObject*, JSVal
     if (thisValue == jsBoolean(true))
         return jsNontrivialString(exec, "true");
 
-    if (!thisValue.isObject(&BooleanObject::info))
+    if (!thisValue.inherits(&BooleanObject::info))
         return throwError(exec, TypeError);
 
     if (asBooleanObject(thisValue)->internalValue() == jsBoolean(false))
@@ -74,7 +74,7 @@ JSValue JSC_HOST_CALL booleanProtoFuncValueOf(ExecState* exec, JSObject*, JSValu
     if (thisValue.isBoolean())
         return thisValue;
 
-    if (!thisValue.isObject(&BooleanObject::info))
+    if (!thisValue.inherits(&BooleanObject::info))
         return throwError(exec, TypeError);
 
     return asBooleanObject(thisValue)->internalValue();
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/CallData.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/CallData.cpp
index c89ebf8..62e42fe 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/CallData.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/CallData.cpp
@@ -27,32 +27,9 @@
 #include "CallData.h"
 
 #include "JSFunction.h"
-#include "JSGlobalObject.h"
-
-#ifdef QT_BUILD_SCRIPT_LIB
-#include "Debugger.h"
-#include "DebuggerCallFrame.h"
-#endif
 
 namespace JSC {
 
-#ifdef QT_BUILD_SCRIPT_LIB
-JSValue JSC::NativeFuncWrapper::operator() (ExecState* exec, JSObject* jsobj, JSValue thisValue, const ArgList& argList) const
-{
-    Debugger* debugger = exec->lexicalGlobalObject()->debugger();
-    if (debugger)
-        debugger->callEvent(DebuggerCallFrame(exec), -1, -1);
-
-    JSValue returnValue = ptr(exec, jsobj, thisValue, argList);
-
-    if (debugger)
-        debugger->functionExit(returnValue, -1);
-
-    return returnValue;
-}
-#endif
-
-
 JSValue call(ExecState* exec, JSValue functionObject, CallType callType, const CallData& callData, JSValue thisValue, const ArgList& args)
 {
     if (callType == CallTypeHost)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/CallData.h b/src/3rdparty/webkit/JavaScriptCore/runtime/CallData.h
index 541779c..24c19f9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/CallData.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/CallData.h
@@ -35,7 +35,7 @@ namespace JSC {
 
     class ArgList;
     class ExecState;
-    class FunctionBodyNode;
+    class FunctionExecutable;
     class JSObject;
     class JSValue;
     class ScopeChainNode;
@@ -48,38 +48,12 @@ namespace JSC {
 
     typedef JSValue (JSC_HOST_CALL *NativeFunction)(ExecState*, JSObject*, JSValue thisValue, const ArgList&);
 
-#ifdef QT_BUILD_SCRIPT_LIB
-    class NativeFuncWrapper
-    {
-        NativeFunction ptr;
-    public:
-        inline NativeFuncWrapper& operator=(NativeFunction func)
-        {
-            ptr = func;
-            return *this;
-        }
-        inline operator NativeFunction() const {return ptr;}
-        inline operator bool() const {return ptr;}
-       
-        JSValue operator()(ExecState* exec, JSObject* jsobj, JSValue thisValue, const ArgList& argList) const;
-    };
-#endif
-
-#if defined(QT_BUILD_SCRIPT_LIB) && PLATFORM(SOLARIS)
-    struct
-#else
-    union
-#endif
-    CallData {
+    union CallData {
         struct {
-#ifndef QT_BUILD_SCRIPT_LIB
             NativeFunction function;
-#else
-            NativeFuncWrapper function;
-#endif
         } native;
         struct {
-            FunctionBodyNode* functionBody;
+            FunctionExecutable* functionExecutable;
             ScopeChainNode* scopeChain;
         } js;
     };
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ClassInfo.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ClassInfo.h
index 097fb09..acec4e7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ClassInfo.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ClassInfo.h
@@ -27,7 +27,7 @@
 
 namespace JSC {
 
-    struct HashEntry;
+    class HashEntry;
     struct HashTable;
 
     struct ClassInfo {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
index d7fbce8..9fac2e3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *  Copyright (C) 2007 Eric Seidel <eric@webkit.org>
  *
  *  This library is free software; you can redistribute it and/or
@@ -23,16 +23,20 @@
 
 #include "ArgList.h"
 #include "CallFrame.h"
+#include "CodeBlock.h"
 #include "CollectorHeapIterator.h"
 #include "Interpreter.h"
+#include "JSArray.h"
 #include "JSGlobalObject.h"
 #include "JSLock.h"
 #include "JSONObject.h"
 #include "JSString.h"
 #include "JSValue.h"
+#include "MarkStack.h"
 #include "Nodes.h"
 #include "Tracing.h"
 #include <algorithm>
+#include <limits.h>
 #include <setjmp.h>
 #include <stdlib.h>
 #include <wtf/FastMalloc.h>
@@ -56,11 +60,18 @@
 #elif PLATFORM(WIN_OS)
 
 #include <windows.h>
+#include <malloc.h>
+
+#elif PLATFORM(HAIKU)
+
+#include <OS.h>
 
 #elif PLATFORM(UNIX)
 
 #include <stdlib.h>
+#if !PLATFORM(HAIKU)
 #include <sys/mman.h>
+#endif
 #include <unistd.h>
 
 #if defined(QT_LINUXBASE)
@@ -98,7 +109,6 @@ extern int *__libc_stack_end;
 
 #endif
 
-#define DEBUG_COLLECTOR 0
 #define COLLECT_ON_EVERY_ALLOCATION 0
 
 using std::max;
@@ -107,7 +117,6 @@ namespace JSC {
 
 // tunable parameters
 
-const size_t SPARE_EMPTY_BLOCKS = 2;
 const size_t GROWTH_FACTOR = 2;
 const size_t LOW_WATER_FACTOR = 4;
 const size_t ALLOCATIONS_PER_COLLECTION = 4000;
@@ -120,8 +129,6 @@ const size_t MAX_NUM_BLOCKS = 256; // Max size of collector heap set to 16 MB
 static RHeap* userChunk = 0;
 #endif
 
-static void freeHeap(CollectorHeap*);
-
 #if ENABLE(JSC_MULTIPLE_THREADS)
 
 #if PLATFORM(DARWIN)
@@ -210,8 +217,8 @@ void Heap::destroy()
 
     ASSERT(!primaryHeap.numLiveObjects);
 
-    freeHeap(&primaryHeap);
-    freeHeap(&numberHeap);
+    freeBlocks(&primaryHeap);
+    freeBlocks(&numberHeap);
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
     if (m_currentThreadRegistrar) {
@@ -231,11 +238,9 @@ void Heap::destroy()
 }
 
 template <HeapType heapType>
-static NEVER_INLINE CollectorBlock* allocateBlock()
+NEVER_INLINE CollectorBlock* Heap::allocateBlock()
 {
-    // Disable the use of vm_map for the Qt build on Darwin, because when compiled on 10.4
-    // it crashes on 10.5
-#if PLATFORM(DARWIN) && !PLATFORM(QT)
+#if PLATFORM(DARWIN)
     vm_address_t address = 0;
     // FIXME: tag the region as a JavaScriptCore heap when we get a registered VM tag: <rdar://problem/6054788>.
     vm_map(current_task(), &address, BLOCK_SIZE, BLOCK_OFFSET_MASK, VM_FLAGS_ANYWHERE | VM_TAG_FOR_COLLECTOR_MEMORY, MEMORY_OBJECT_NULL, 0, FALSE, VM_PROT_DEFAULT, VM_PROT_DEFAULT, VM_INHERIT_DEFAULT);
@@ -248,8 +253,12 @@ static NEVER_INLINE CollectorBlock* allocateBlock()
 
     memset(reinterpret_cast<void*>(address), 0, BLOCK_SIZE);
 #elif PLATFORM(WIN_OS)
-     // windows virtual address granularity is naturally 64k
-    LPVOID address = VirtualAlloc(NULL, BLOCK_SIZE, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
+#if COMPILER(MINGW)
+    void* address = __mingw_aligned_malloc(BLOCK_SIZE, BLOCK_SIZE);
+#else
+    void* address = _aligned_malloc(BLOCK_SIZE, BLOCK_SIZE);
+#endif
+    memset(address, 0, BLOCK_SIZE);
 #elif HAVE(POSIX_MEMALIGN)
     void* address;
     posix_memalign(&address, BLOCK_SIZE, BLOCK_SIZE);
@@ -281,20 +290,56 @@ static NEVER_INLINE CollectorBlock* allocateBlock()
     address += adjust;
     memset(reinterpret_cast<void*>(address), 0, BLOCK_SIZE);
 #endif
-    reinterpret_cast<CollectorBlock*>(address)->type = heapType;
-    return reinterpret_cast<CollectorBlock*>(address);
+
+    CollectorBlock* block = reinterpret_cast<CollectorBlock*>(address);
+    block->freeList = block->cells;
+    block->heap = this;
+    block->type = heapType;
+
+    CollectorHeap& heap = heapType == PrimaryHeap ? primaryHeap : numberHeap;
+    size_t numBlocks = heap.numBlocks;
+    if (heap.usedBlocks == numBlocks) {
+        static const size_t maxNumBlocks = ULONG_MAX / sizeof(CollectorBlock*) / GROWTH_FACTOR;
+        if (numBlocks > maxNumBlocks)
+            CRASH();
+        numBlocks = max(MIN_ARRAY_SIZE, numBlocks * GROWTH_FACTOR);
+        heap.numBlocks = numBlocks;
+        heap.blocks = static_cast<CollectorBlock**>(fastRealloc(heap.blocks, numBlocks * sizeof(CollectorBlock*)));
+    }
+    heap.blocks[heap.usedBlocks++] = block;
+
+    return block;
+}
+
+template <HeapType heapType>
+NEVER_INLINE void Heap::freeBlock(size_t block)
+{
+    CollectorHeap& heap = heapType == PrimaryHeap ? primaryHeap : numberHeap;
+
+    freeBlock(heap.blocks[block]);
+
+    // swap with the last block so we compact as we go
+    heap.blocks[block] = heap.blocks[heap.usedBlocks - 1];
+    heap.usedBlocks--;
+
+    if (heap.numBlocks > MIN_ARRAY_SIZE && heap.usedBlocks < heap.numBlocks / LOW_WATER_FACTOR) {
+        heap.numBlocks = heap.numBlocks / GROWTH_FACTOR; 
+        heap.blocks = static_cast<CollectorBlock**>(fastRealloc(heap.blocks, heap.numBlocks * sizeof(CollectorBlock*)));
+    }
 }
 
-static void freeBlock(CollectorBlock* block)
+NEVER_INLINE void Heap::freeBlock(CollectorBlock* block)
 {
-    // Disable the use of vm_deallocate for the Qt build on Darwin, because when compiled on 10.4
-    // it crashes on 10.5
-#if PLATFORM(DARWIN) && !PLATFORM(QT)
+#if PLATFORM(DARWIN)    
     vm_deallocate(current_task(), reinterpret_cast<vm_address_t>(block), BLOCK_SIZE);
 #elif PLATFORM(SYMBIAN)
     userChunk->Free(reinterpret_cast<TAny*>(block));
 #elif PLATFORM(WIN_OS)
-    VirtualFree(block, 0, MEM_RELEASE);
+#if COMPILER(MINGW)
+    __mingw_aligned_free(block);
+#else
+    _aligned_free(block);
+#endif
 #elif HAVE(POSIX_MEMALIGN)
     free(block);
 #else
@@ -302,7 +347,7 @@ static void freeBlock(CollectorBlock* block)
 #endif
 }
 
-static void freeHeap(CollectorHeap* heap)
+void Heap::freeBlocks(CollectorHeap* heap)
 {
     for (size_t i = 0; i < heap->usedBlocks; ++i)
         if (heap->blocks[i])
@@ -395,38 +440,23 @@ collect:
 #ifndef NDEBUG
             heap.operationInProgress = NoOperation;
 #endif
-            bool collected = collect();
+            bool foundGarbage = collect();
+            numLiveObjects = heap.numLiveObjects;
+            usedBlocks = heap.usedBlocks;
+            i = heap.firstBlockWithPossibleSpace;
 #ifndef NDEBUG
             heap.operationInProgress = Allocation;
 #endif
-            if (collected) {
-                numLiveObjects = heap.numLiveObjects;
-                usedBlocks = heap.usedBlocks;
-                i = heap.firstBlockWithPossibleSpace;
+            if (foundGarbage)
                 goto scan;
-            }
-        }
-  
-        // didn't find a block, and GC didn't reclaim anything, need to allocate a new block
-        size_t numBlocks = heap.numBlocks;
-        if (usedBlocks == numBlocks) {
-            static const size_t maxNumBlocks = ULONG_MAX / sizeof(CollectorBlock*) / GROWTH_FACTOR;
-            if (numBlocks > maxNumBlocks)
-                CRASH();
-            numBlocks = max(MIN_ARRAY_SIZE, numBlocks * GROWTH_FACTOR);
-            heap.numBlocks = numBlocks;
-            heap.blocks = static_cast<CollectorBlock**>(fastRealloc(heap.blocks, numBlocks * sizeof(CollectorBlock*)));
         }
 
+        // didn't find a block, and GC didn't reclaim anything, need to allocate a new block
         targetBlock = reinterpret_cast<Block*>(allocateBlock<heapType>());
-        targetBlock->freeList = targetBlock->cells;
-        targetBlock->heap = this;
+        heap.firstBlockWithPossibleSpace = heap.usedBlocks - 1;
         targetBlockUsedCells = 0;
-        heap.blocks[usedBlocks] = reinterpret_cast<CollectorBlock*>(targetBlock);
-        heap.usedBlocks = usedBlocks + 1;
-        heap.firstBlockWithPossibleSpace = usedBlocks;
     }
-  
+
     // find a free spot in the block and detach it from the free list
     Cell* newCell = targetBlock->freeList;
 
@@ -510,47 +540,31 @@ static void* getStackBase(void* previousFrame)
     }
 }
 #endif
-#if PLATFORM(HPUX)
-struct hpux_get_stack_base_data
-{
-    pthread_t thread;
-    _pthread_stack_info info;
-};
 
-static void *hpux_get_stack_base_internal(void *d)
+#if PLATFORM(QNX)
+static inline void *currentThreadStackBaseQNX()
 {
-    hpux_get_stack_base_data *data = static_cast<hpux_get_stack_base_data *>(d);
-
-    // _pthread_stack_info_np requires the target thread to be suspended
-    // in order to get information about it
-    pthread_suspend(data->thread);
-
-    // _pthread_stack_info_np returns an errno code in case of failure
-    // or zero on success
-    if (_pthread_stack_info_np(data->thread, &data->info)) {
-        // failed
-        return 0;
+    static void* stackBase = 0;
+    static size_t stackSize = 0;
+    static pthread_t stackThread;
+    pthread_t thread = pthread_self();
+    if (stackBase == 0 || thread != stackThread) {
+        struct _debug_thread_info threadInfo;
+        memset(&threadInfo, 0, sizeof(threadInfo));
+        threadInfo.tid = pthread_self();
+        int fd = open("/proc/self", O_RDONLY);
+        if (fd == -1) {
+            LOG_ERROR("Unable to open /proc/self (errno: %d)", errno);
+            return 0;
+        }
+        devctl(fd, DCMD_PROC_TIDSTATUS, &threadInfo, sizeof(threadInfo), 0);
+        close(fd);
+        stackBase = reinterpret_cast<void*>(threadInfo.stkbase);
+        stackSize = threadInfo.stksize;
+        ASSERT(stackBase);
+        stackThread = thread;
     }
-
-    pthread_continue(data->thread);
-    return data;
-}
-
-static void *hpux_get_stack_base()
-{
-    hpux_get_stack_base_data data;
-    data.thread = pthread_self();
-
-    // We cannot get the stack information for the current thread
-    // So we start a new thread to get that information and return it to us
-    pthread_t other;
-    pthread_create(&other, 0, hpux_get_stack_base_internal, &data);
-
-    void *result;
-    pthread_join(other, &result);
-    if (result)
-       return data.info.stk_stack_base;
-    return 0;
+    return static_cast<char*>(stackBase) + stackSize;
 }
 #endif
 
@@ -579,24 +593,12 @@ static inline void* currentThreadStackBase()
           : "=r" (pTib)
         );
     return static_cast<void*>(pTib->StackBase);
-#elif PLATFORM(HPUX)
-    return hpux_get_stack_base();
+#elif PLATFORM(QNX)
+    return currentThreadStackBaseQNX();
 #elif PLATFORM(SOLARIS)
     stack_t s;
     thr_stksegment(&s);
     return s.ss_sp;
-#elif PLATFORM(AIX)
-    pthread_t thread = pthread_self();
-    struct __pthrdsinfo threadinfo;
-    char regbuf[256];
-    int regbufsize = sizeof regbuf;
-
-    if (pthread_getthrds_np(&thread, PTHRDSINFO_QUERY_ALL,
-                            &threadinfo, sizeof threadinfo,
-                            &regbuf, &regbufsize) == 0)
-        return threadinfo.__pi_stackaddr;
-
-    return 0;
 #elif PLATFORM(OPENBSD)
     pthread_t thread = pthread_self();
     stack_t stack;
@@ -611,6 +613,10 @@ static inline void* currentThreadStackBase()
         stackBase = (void*)info.iBase;
     }
     return (void*)stackBase;
+#elif PLATFORM(HAIKU)
+    thread_info threadInfo;
+    get_thread_info(find_thread(NULL), &threadInfo);
+    return threadInfo.stack_end;
 #elif PLATFORM(UNIX)
 #ifdef UCLIBC_USE_PROC_SELF_MAPS
     // Read /proc/self/maps and locate the line whose address
@@ -648,24 +654,6 @@ static inline void* currentThreadStackBase()
     static pthread_t stackThread;
     pthread_t thread = pthread_self();
     if (stackBase == 0 || thread != stackThread) {
-#if PLATFORM(QNX)
-        int fd;
-        struct _debug_thread_info tinfo;
-        memset(&tinfo, 0, sizeof(tinfo));
-        tinfo.tid = pthread_self();
-        fd = open("/proc/self", O_RDONLY);
-        if (fd == -1) {
-#ifndef NDEBUG
-            perror("Unable to open /proc/self:");
-#endif
-            return 0;
-        }
-        devctl(fd, DCMD_PROC_TIDSTATUS, &tinfo, sizeof(tinfo), NULL);
-        close(fd);
-        stackBase = (void*)tinfo.stkbase;
-        stackSize = tinfo.stksize;
-        ASSERT(stackBase);
-#else
 #if defined(QT_LINUXBASE)
         // LinuxBase is missing pthread_getattr_np - resolve it once at runtime instead
         // see http://bugs.linuxbase.org/show_bug.cgi?id=2364
@@ -690,7 +678,6 @@ static inline void* currentThreadStackBase()
         (void)rc; // FIXME: Deal with error code somehow? Seems fatal.
         ASSERT(stackBase);
         pthread_attr_destroy(&sattr);
-#endif
         stackThread = thread;
     }
     return static_cast<char*>(stackBase) + stackSize;
@@ -731,6 +718,8 @@ void Heap::makeUsableFromMultipleThreads()
 
 void Heap::registerThread()
 {
+    ASSERT(!m_globalData->mainThreadOnly || isMainThread());
+
     if (!m_currentThreadRegistrar || pthread_getspecific(m_currentThreadRegistrar))
         return;
 
@@ -787,7 +776,7 @@ void Heap::registerThread()
 // cell size needs to be a power of two for this to be valid
 #define IS_HALF_CELL_ALIGNED(p) (((intptr_t)(p) & (CELL_MASK >> 1)) == 0)
 
-void Heap::markConservatively(void* start, void* end)
+void Heap::markConservatively(MarkStack& markStack, void* start, void* end)
 {
     if (start > end) {
         void* tmp = start;
@@ -827,10 +816,9 @@ void Heap::markConservatively(void* start, void* end)
             // Mark the primary heap
             for (size_t block = 0; block < usedPrimaryBlocks; block++) {
                 if ((primaryBlocks[block] == blockAddr) & (offset <= lastCellOffset)) {
-                    if (reinterpret_cast<CollectorCell*>(xAsBits)->u.freeCell.zeroIfFree != 0) {
-                        JSCell* imp = reinterpret_cast<JSCell*>(xAsBits);
-                        if (!imp->marked())
-                            imp->mark();
+                    if (reinterpret_cast<CollectorCell*>(xAsBits)->u.freeCell.zeroIfFree) {
+                        markStack.append(reinterpret_cast<JSCell*>(xAsBits));
+                        markStack.drain();
                     }
                     break;
                 }
@@ -841,15 +829,15 @@ void Heap::markConservatively(void* start, void* end)
     }
 }
 
-void NEVER_INLINE Heap::markCurrentThreadConservativelyInternal()
+void NEVER_INLINE Heap::markCurrentThreadConservativelyInternal(MarkStack& markStack)
 {
     void* dummy;
     void* stackPointer = &dummy;
     void* stackBase = currentThreadStackBase();
-    markConservatively(stackPointer, stackBase);
+    markConservatively(markStack, stackPointer, stackBase);
 }
 
-void Heap::markCurrentThreadConservatively()
+void Heap::markCurrentThreadConservatively(MarkStack& markStack)
 {
     // setjmp forces volatile registers onto the stack
     jmp_buf registers;
@@ -862,7 +850,7 @@ void Heap::markCurrentThreadConservatively()
 #pragma warning(pop)
 #endif
 
-    markCurrentThreadConservativelyInternal();
+    markCurrentThreadConservativelyInternal(markStack);
 }
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
@@ -994,7 +982,7 @@ static inline void* otherThreadStackPointer(const PlatformThreadRegisters& regs)
 #endif
 }
 
-void Heap::markOtherThreadConservatively(Thread* thread)
+void Heap::markOtherThreadConservatively(MarkStack& markStack, Thread* thread)
 {
     suspendThread(thread->platformThread);
 
@@ -1002,19 +990,19 @@ void Heap::markOtherThreadConservatively(Thread* thread)
     size_t regSize = getPlatformThreadRegisters(thread->platformThread, regs);
 
     // mark the thread's registers
-    markConservatively(static_cast<void*>(&regs), static_cast<void*>(reinterpret_cast<char*>(&regs) + regSize));
+    markConservatively(markStack, static_cast<void*>(&regs), static_cast<void*>(reinterpret_cast<char*>(&regs) + regSize));
 
     void* stackPointer = otherThreadStackPointer(regs);
-    markConservatively(stackPointer, thread->stackBase);
+    markConservatively(markStack, stackPointer, thread->stackBase);
 
     resumeThread(thread->platformThread);
 }
 
 #endif
 
-void Heap::markStackObjectsConservatively()
+void Heap::markStackObjectsConservatively(MarkStack& markStack)
 {
-    markCurrentThreadConservatively();
+    markCurrentThreadConservatively(markStack);
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
 
@@ -1024,7 +1012,7 @@ void Heap::markStackObjectsConservatively()
 
 #ifndef NDEBUG
         // Forbid malloc during the mark phase. Marking a thread suspends it, so 
-        // a malloc inside mark() would risk a deadlock with a thread that had been 
+        // a malloc inside markChildren() would risk a deadlock with a thread that had been 
         // suspended while holding the malloc lock.
         fastMallocForbid();
 #endif
@@ -1032,7 +1020,7 @@ void Heap::markStackObjectsConservatively()
         // and since this is a shared heap, they are real locks.
         for (Thread* thread = m_registeredThreads; thread; thread = thread->next) {
             if (!pthread_equal(thread->posixThread, pthread_self()))
-                markOtherThreadConservatively(thread);
+                markOtherThreadConservatively(markStack, thread);
         }
 #ifndef NDEBUG
         fastMallocAllow();
@@ -1085,23 +1073,15 @@ void Heap::unprotect(JSValue k)
         m_protectedValuesMutex->unlock();
 }
 
-Heap* Heap::heap(JSValue v)
-{
-    if (!v.isCell())
-        return 0;
-    return Heap::cellBlock(v.asCell())->heap;
-}
-
-void Heap::markProtectedObjects()
+void Heap::markProtectedObjects(MarkStack& markStack)
 {
     if (m_protectedValuesMutex)
         m_protectedValuesMutex->lock();
 
     ProtectCountSet::iterator end = m_protectedValues.end();
     for (ProtectCountSet::iterator it = m_protectedValues.begin(); it != end; ++it) {
-        JSCell* val = it->first;
-        if (!val->marked())
-            val->mark();
+        markStack.append(it->first);
+        markStack.drain();
     }
 
     if (m_protectedValuesMutex)
@@ -1179,34 +1159,37 @@ template <HeapType heapType> size_t Heap::sweep()
         curBlock->freeList = freeList;
         curBlock->marked.clearAll();
         
-        if (usedCells == 0) {
-            emptyBlocks++;
-            if (emptyBlocks > SPARE_EMPTY_BLOCKS) {
-#if !DEBUG_COLLECTOR
-                freeBlock(reinterpret_cast<CollectorBlock*>(curBlock));
-#endif
-                // swap with the last block so we compact as we go
-                heap.blocks[block] = heap.blocks[heap.usedBlocks - 1];
-                heap.usedBlocks--;
-                block--; // Don't move forward a step in this case
-                
-                if (heap.numBlocks > MIN_ARRAY_SIZE && heap.usedBlocks < heap.numBlocks / LOW_WATER_FACTOR) {
-                    heap.numBlocks = heap.numBlocks / GROWTH_FACTOR; 
-                    heap.blocks = static_cast<CollectorBlock**>(fastRealloc(heap.blocks, heap.numBlocks * sizeof(CollectorBlock*)));
-                }
-            }
-        }
+        if (!usedCells)
+            ++emptyBlocks;
     }
     
     if (heap.numLiveObjects != numLiveObjects)
         heap.firstBlockWithPossibleSpace = 0;
-        
+    
     heap.numLiveObjects = numLiveObjects;
     heap.numLiveObjectsAtLastCollect = numLiveObjects;
     heap.extraCost = 0;
+    
+    if (!emptyBlocks)
+        return numLiveObjects;
+
+    size_t neededCells = 1.25f * (numLiveObjects + max(ALLOCATIONS_PER_COLLECTION, numLiveObjects));
+    size_t neededBlocks = (neededCells + HeapConstants<heapType>::cellsPerBlock - 1) / HeapConstants<heapType>::cellsPerBlock;
+    for (size_t block = 0; block < heap.usedBlocks; block++) {
+        if (heap.usedBlocks <= neededBlocks)
+            break;
+
+        Block* curBlock = reinterpret_cast<Block*>(heap.blocks[block]);
+        if (curBlock->usedCells)
+            continue;
+
+        freeBlock<heapType>(block);
+        block--; // Don't move forward a step in this case
+    }
+
     return numLiveObjects;
 }
-    
+
 bool Heap::collect()
 {
 #ifndef NDEBUG
@@ -1225,24 +1208,22 @@ bool Heap::collect()
     numberHeap.operationInProgress = Collection;
 
     // MARK: first mark all referenced objects recursively starting out from the set of root objects
-
-    markStackObjectsConservatively();
-    markProtectedObjects();
-#if QT_BUILD_SCRIPT_LIB
-    if (m_globalData->clientData)
-        m_globalData->clientData->mark();
-#endif
+    MarkStack& markStack = m_globalData->markStack;
+    markStackObjectsConservatively(markStack);
+    markProtectedObjects(markStack);
     if (m_markListSet && m_markListSet->size())
-        MarkedArgumentBuffer::markLists(*m_markListSet);
-    if (m_globalData->exception && !m_globalData->exception.marked())
-        m_globalData->exception.mark();
-    m_globalData->interpreter->registerFile().markCallFrames(this);
-    m_globalData->smallStrings.mark();
-    if (m_globalData->scopeNodeBeingReparsed)
-        m_globalData->scopeNodeBeingReparsed->mark();
+        MarkedArgumentBuffer::markLists(markStack, *m_markListSet);
+    if (m_globalData->exception)
+        markStack.append(m_globalData->exception);
+    m_globalData->interpreter->registerFile().markCallFrames(markStack, this);
+    m_globalData->smallStrings.markChildren(markStack);
+    if (m_globalData->functionCodeBlockBeingReparsed)
+        m_globalData->functionCodeBlockBeingReparsed->markAggregate(markStack);
     if (m_globalData->firstStringifierToMark)
-        JSONObject::markStringifiers(m_globalData->firstStringifierToMark);
+        JSONObject::markStringifiers(markStack, m_globalData->firstStringifierToMark);
 
+    markStack.drain();
+    markStack.compact();
     JAVASCRIPTCORE_GC_MARKED();
 
     size_t originalLiveObjects = primaryHeap.numLiveObjects + numberHeap.numLiveObjects;
@@ -1332,12 +1313,14 @@ static const char* typeName(JSCell* cell)
 {
     if (cell->isString())
         return "string";
+#if USE(JSVALUE32)
     if (cell->isNumber())
         return "number";
+#endif
     if (cell->isGetterSetter())
         return "gettersetter";
     ASSERT(cell->isObject());
-    const ClassInfo* info = static_cast<JSObject*>(cell)->classInfo();
+    const ClassInfo* info = cell->classInfo();
     return info ? info->className : "Object";
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h
index 852ac59..2dc3264 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h
@@ -39,11 +39,12 @@
 
 namespace JSC {
 
-    class MarkedArgumentBuffer;
     class CollectorBlock;
     class JSCell;
     class JSGlobalData;
     class JSValue;
+    class MarkedArgumentBuffer;
+    class MarkStack;
 
     enum OperationInProgress { NoOperation, Allocation, Collection };
     enum HeapType { PrimaryHeap, NumberHeap };
@@ -100,6 +101,7 @@ namespace JSC {
         void unprotect(JSValue);
 
         static Heap* heap(JSValue); // 0 for immediate values
+        static Heap* heap(JSCell*);
 
         size_t globalObjectCount();
         size_t protectedObjectCount();
@@ -111,7 +113,7 @@ namespace JSC {
         static bool isCellMarked(const JSCell*);
         static void markCell(JSCell*);
 
-        void markConservatively(void* start, void* end);
+        void markConservatively(MarkStack&, void* start, void* end);
 
         HashSet<MarkedArgumentBuffer*>& markListSet() { if (!m_markListSet) m_markListSet = new HashSet<MarkedArgumentBuffer*>; return *m_markListSet; }
 
@@ -132,12 +134,17 @@ namespace JSC {
         Heap(JSGlobalData*);
         ~Heap();
 
+        template <HeapType heapType> NEVER_INLINE CollectorBlock* allocateBlock();
+        template <HeapType heapType> NEVER_INLINE void freeBlock(size_t);
+        NEVER_INLINE void freeBlock(CollectorBlock*);
+        void freeBlocks(CollectorHeap*);
+
         void recordExtraCost(size_t);
-        void markProtectedObjects();
-        void markCurrentThreadConservatively();
-        void markCurrentThreadConservativelyInternal();
-        void markOtherThreadConservatively(Thread*);
-        void markStackObjectsConservatively();
+        void markProtectedObjects(MarkStack&);
+        void markCurrentThreadConservatively(MarkStack&);
+        void markCurrentThreadConservativelyInternal(MarkStack&);
+        void markOtherThreadConservatively(MarkStack&, Thread*);
+        void markStackObjectsConservatively(MarkStack&);
 
         typedef HashCountedSet<JSCell*> ProtectCountSet;
 
@@ -167,9 +174,14 @@ namespace JSC {
     template<size_t bytesPerWord> struct CellSize;
 
     // cell size needs to be a power of two for certain optimizations in collector.cpp
-    template<> struct CellSize<sizeof(uint32_t)> { static const size_t m_value = 32; }; // 32-bit
-    template<> struct CellSize<sizeof(uint64_t)> { static const size_t m_value = 64; }; // 64-bit
-    const size_t BLOCK_SIZE = 16 * 4096; // 64k
+#if USE(JSVALUE32)
+    template<> struct CellSize<sizeof(uint32_t)> { static const size_t m_value = 32; };
+#else
+    template<> struct CellSize<sizeof(uint32_t)> { static const size_t m_value = 64; };
+#endif
+    template<> struct CellSize<sizeof(uint64_t)> { static const size_t m_value = 64; };
+
+    const size_t BLOCK_SIZE = 64 * 4096; // 256k
 
     // derived constants
     const size_t BLOCK_OFFSET_MASK = BLOCK_SIZE - 1;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.h b/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.h
index 7b275bd..8493d73 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.h
@@ -37,16 +37,23 @@
     macro(callee) \
     macro(caller) \
     macro(compile) \
+    macro(configurable) \
     macro(constructor) \
+    macro(enumerable) \
     macro(eval) \
     macro(exec) \
     macro(fromCharCode) \
     macro(global) \
+    macro(get) \
+    macro(getPrototypeOf) \
+    macro(getOwnPropertyDescriptor) \
     macro(hasOwnProperty) \
     macro(ignoreCase) \
     macro(index) \
     macro(input) \
+    macro(isArray) \
     macro(isPrototypeOf) \
+    macro(keys) \
     macro(length) \
     macro(message) \
     macro(multiline) \
@@ -55,6 +62,7 @@
     macro(parse) \
     macro(propertyIsEnumerable) \
     macro(prototype) \
+    macro(set) \
     macro(source) \
     macro(test) \
     macro(toExponential) \
@@ -65,7 +73,9 @@
     macro(toPrecision) \
     macro(toString) \
     macro(UTC) \
+    macro(value) \
     macro(valueOf) \
+    macro(writable) \
     macro(displayName)
 
 namespace JSC {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.cpp
index 04c9a2e..f36de54 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.cpp
@@ -31,55 +31,39 @@
 #include "Debugger.h"
 #include <stdio.h>
 
-#ifdef QT_BUILD_SCRIPT_LIB
-#include "DebuggerCallFrame.h"
-#include "SourcePoolQt.h"
-#endif
-
-#if !PLATFORM(WIN_OS)
-#include <unistd.h>
-#endif
-
 namespace JSC {
 
 Completion checkSyntax(ExecState* exec, const SourceCode& source)
 {
     JSLock lock(exec);
 
-    int errLine;
-    UString errMsg;
+    ProgramExecutable program(source);
+    JSObject* error = program.checkSyntax(exec);
+    if (error)
+        return Completion(Throw, error);
 
-    RefPtr<ProgramNode> progNode = exec->globalData().parser->parse<ProgramNode>(exec, exec->dynamicGlobalObject()->debugger(), source, &errLine, &errMsg);
-    if (!progNode)
-        return Completion(Throw, Error::create(exec, SyntaxError, errMsg, errLine, source.provider()->asID(), source.provider()->url()));
     return Completion(Normal);
 }
 
 Completion evaluate(ExecState* exec, ScopeChain& scopeChain, const SourceCode& source, JSValue thisValue)
 {
     JSLock lock(exec);
-    
-    intptr_t sourceId = source.provider()->asID();
-    int errLine;
-    UString errMsg;
-    RefPtr<ProgramNode> programNode = exec->globalData().parser->parse<ProgramNode>(exec, exec->dynamicGlobalObject()->debugger(), source, &errLine, &errMsg);
 
-    if (!programNode) {
-        JSValue error = Error::create(exec, SyntaxError, errMsg, errLine, sourceId, source.provider()->url());
+    ProgramExecutable program(source);
+    JSObject* error = program.compile(exec, scopeChain.node());
+    if (error)
         return Completion(Throw, error);
-    }
 
     JSObject* thisObj = (!thisValue || thisValue.isUndefinedOrNull()) ? exec->dynamicGlobalObject() : thisValue.toObject(exec);
 
     JSValue exception;
-    JSValue result = exec->interpreter()->execute(programNode.get(), exec, scopeChain.node(), thisObj, &exception);
+    JSValue result = exec->interpreter()->execute(&program, exec, scopeChain.node(), thisObj, &exception);
 
     if (exception) {
         if (exception.isObject() && asObject(exception)->isWatchdogException())
             return Completion(Interrupted, exception);
         return Completion(Throw, exception);
     }
-
     return Completion(Normal, result);
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ConstructData.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ConstructData.cpp
index 3dfc918..7ee59d7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ConstructData.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ConstructData.cpp
@@ -28,38 +28,15 @@
 
 #include "JSFunction.h"
 
-
-#ifdef QT_BUILD_SCRIPT_LIB
-#include "Debugger.h"
-#include "DebuggerCallFrame.h"
-#include "JSGlobalObject.h"
-#endif
-
 namespace JSC {
 
-#ifdef QT_BUILD_SCRIPT_LIB
-JSObject* JSC::NativeConstrWrapper::operator() (ExecState* exec, JSObject* jsobj, const ArgList& argList) const
-{
-    Debugger* debugger = exec->lexicalGlobalObject()->debugger();
-    if (debugger)
-        debugger->callEvent(DebuggerCallFrame(exec), -1, -1);
-
-    JSObject* returnValue = ptr(exec, jsobj, argList);
-
-    if ((debugger) && (callDebuggerFunctionExit))
-        debugger->functionExit(JSValue(returnValue), -1);
-
-    return returnValue;
-}
-#endif
-
-JSObject* construct(ExecState* exec, JSValue callee, ConstructType constructType, const ConstructData& constructData, const ArgList& args)
+JSObject* construct(ExecState* exec, JSValue object, ConstructType constructType, const ConstructData& constructData, const ArgList& args)
 {
     if (constructType == ConstructTypeHost)
-        return constructData.native.function(exec, asObject(callee), args);
+        return constructData.native.function(exec, asObject(object), args);
     ASSERT(constructType == ConstructTypeJS);
     // FIXME: Can this be done more efficiently using the constructData?
-    return asFunction(callee)->construct(exec, args);
+    return asFunction(object)->construct(exec, args);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ConstructData.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ConstructData.h
index 477399c..6b954a6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ConstructData.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ConstructData.h
@@ -33,7 +33,7 @@ namespace JSC {
 
     class ArgList;
     class ExecState;
-    class FunctionBodyNode;
+    class FunctionExecutable;
     class JSObject;
     class JSValue;
     class ScopeChainNode;
@@ -46,45 +46,12 @@ namespace JSC {
 
     typedef JSObject* (*NativeConstructor)(ExecState*, JSObject*, const ArgList&);
 
-#ifdef QT_BUILD_SCRIPT_LIB
-    class NativeConstrWrapper
-    {
-        NativeConstructor ptr;
-        //Hack. If this variable is true and if debugger is attached at the end of
-        //operator() execution functionExit event will be created (in most cases it will be default)
-        //This variable was created because of FunctionWrapper::proxyCall method that change result
-        //on fly. Event shuld be created with original value so the method should call it itself.
-        bool callDebuggerFunctionExit;
-    public:
-        inline NativeConstrWrapper& operator=(NativeConstructor func)
-        {
-            callDebuggerFunctionExit = true;
-            ptr = func;
-            return *this;
-        }
-        inline operator NativeConstructor() const {return ptr;}
-        inline operator bool() const {return ptr;}
-
-        inline void doNotCallDebuggerFunctionExit() {callDebuggerFunctionExit = false;}
-        JSObject* operator()(ExecState*, JSObject*, const ArgList&) const;
-    };
-#endif
-
-#if defined(QT_BUILD_SCRIPT_LIB) && PLATFORM(SOLARIS)
-    struct
-#else
-    union
-#endif
-    ConstructData {
+    union ConstructData {
         struct {
-#ifndef QT_BUILD_SCRIPT_LIB
             NativeConstructor function;
-#else
-            NativeConstrWrapper function;
-#endif
         } native;
         struct {
-            FunctionBodyNode* functionBody;
+            FunctionExecutable* functionExecutable;
             ScopeChainNode* scopeChain;
         } js;
     };
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConstructor.cpp
index 6d7d934..1879c3f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConstructor.cpp
@@ -36,7 +36,7 @@
 #include <wtf/MathExtras.h>
 
 #if PLATFORM(WINCE) && !PLATFORM(QT)
-extern "C" time_t time(time_t* timer); //provided by libce
+extern "C" time_t time(time_t* timer); // Provided by libce.
 #endif
 
 #if HAVE(SYS_TIME_H)
@@ -51,8 +51,6 @@ using namespace WTF;
 
 namespace JSC {
 
-// TODO: MakeTime (15.9.11.1) etc. ?
-
 ASSERT_CLASS_FITS_IN_CELL(DateConstructor);
 
 static JSValue JSC_HOST_CALL dateParse(ExecState*, JSObject*, JSValue, const ArgList&);
@@ -81,7 +79,7 @@ JSObject* constructDate(ExecState* exec, const ArgList& args)
     if (numArgs == 0) // new Date() ECMA 15.9.3.3
         value = getCurrentUTCTime();
     else if (numArgs == 1) {
-        if (args.at(0).isObject(&DateInstance::info))
+        if (args.at(0).inherits(&DateInstance::info))
             value = asDateInstance(args.at(0))->internalNumber();
         else {
             JSValue primitive = args.at(0).toPrimitive(exec);
@@ -100,17 +98,17 @@ JSObject* constructDate(ExecState* exec, const ArgList& args)
                 || (numArgs >= 7 && isnan(args.at(6).toNumber(exec))))
             value = NaN;
         else {
-          GregorianDateTime t;
-          int year = args.at(0).toInt32(exec);
-          t.year = (year >= 0 && year <= 99) ? year : year - 1900;
-          t.month = args.at(1).toInt32(exec);
-          t.monthDay = (numArgs >= 3) ? args.at(2).toInt32(exec) : 1;
-          t.hour = args.at(3).toInt32(exec);
-          t.minute = args.at(4).toInt32(exec);
-          t.second = args.at(5).toInt32(exec);
-          t.isDST = -1;
-          double ms = (numArgs >= 7) ? args.at(6).toNumber(exec) : 0;
-          value = gregorianDateTimeToMS(t, ms, false);
+            GregorianDateTime t;
+            int year = args.at(0).toInt32(exec);
+            t.year = (year >= 0 && year <= 99) ? year : year - 1900;
+            t.month = args.at(1).toInt32(exec);
+            t.monthDay = (numArgs >= 3) ? args.at(2).toInt32(exec) : 1;
+            t.hour = args.at(3).toInt32(exec);
+            t.minute = args.at(4).toInt32(exec);
+            t.second = args.at(5).toInt32(exec);
+            t.isDST = -1;
+            double ms = (numArgs >= 7) ? args.at(6).toNumber(exec) : 0;
+            value = gregorianDateTimeToMS(t, ms, false);
         }
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.cpp
index e2482f4..c6f7dec 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.cpp
@@ -198,8 +198,8 @@ static JSCell* formatLocaleDate(ExecState* exec, const GregorianDateTime& gdt, L
 {
 #if HAVE(LANGINFO_H)
     static const nl_item formats[] = { D_T_FMT, D_FMT, T_FMT };
-#elif PLATFORM(WINCE) && !PLATFORM(QT)
-    // strftime() we are using does not support #
+#elif (PLATFORM(WINCE) && !PLATFORM(QT)) || PLATFORM(SYMBIAN)
+     // strftime() does not support '#' on WinCE or Symbian
     static const char* const formatStrings[] = { "%c", "%x", "%X" };
 #else
     static const char* const formatStrings[] = { "%#c", "%#x", "%X" };
@@ -407,11 +407,17 @@ bool DatePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticFunctionSlot<JSObject>(exec, ExecState::dateTable(exec), this, propertyName, slot);
 }
 
+
+bool DatePrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, ExecState::dateTable(exec), this, propertyName, descriptor);
+}
+
 // Functions
 
 JSValue JSC_HOST_CALL dateProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -428,7 +434,7 @@ JSValue JSC_HOST_CALL dateProtoFuncToString(ExecState* exec, JSObject*, JSValue
 
 JSValue JSC_HOST_CALL dateProtoFuncToUTCString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -445,7 +451,7 @@ JSValue JSC_HOST_CALL dateProtoFuncToUTCString(ExecState* exec, JSObject*, JSVal
 
 JSValue JSC_HOST_CALL dateProtoFuncToISOString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
     
     const bool utc = true;
@@ -457,17 +463,17 @@ JSValue JSC_HOST_CALL dateProtoFuncToISOString(ExecState* exec, JSObject*, JSVal
     
     GregorianDateTime t;
     thisDateObj->msToGregorianDateTime(milli, utc, t);
-    // Maximum amount of space we need in buffer: 6 (max. digits in year) + 2 * 5 (2 characters each for month, day, hour, minute, second)
-    // 6 for formatting and one for null termination = 23.  We add one extra character to allow us to force null termination.
-    char buffer[24];
-    snprintf(buffer, sizeof(buffer) - 1, "%04d-%02d-%02dT%02d:%02d:%02dZ", 1900 + t.year, t.month + 1, t.monthDay, t.hour, t.minute, t.second);
+    // Maximum amount of space we need in buffer: 6 (max. digits in year) + 2 * 5 (2 characters each for month, day, hour, minute, second) + 4 (. + 3 digits for milliseconds)
+    // 6 for formatting and one for null termination = 27.  We add one extra character to allow us to force null termination.
+    char buffer[28];
+    snprintf(buffer, sizeof(buffer) - 1, "%04d-%02d-%02dT%02d:%02d:%02d.%03dZ", 1900 + t.year, t.month + 1, t.monthDay, t.hour, t.minute, t.second, static_cast<int>(fmod(milli, 1000)));
     buffer[sizeof(buffer) - 1] = 0;
     return jsNontrivialString(exec, buffer);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToDateString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -484,7 +490,7 @@ JSValue JSC_HOST_CALL dateProtoFuncToDateString(ExecState* exec, JSObject*, JSVa
 
 JSValue JSC_HOST_CALL dateProtoFuncToTimeString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -501,7 +507,7 @@ JSValue JSC_HOST_CALL dateProtoFuncToTimeString(ExecState* exec, JSObject*, JSVa
 
 JSValue JSC_HOST_CALL dateProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -514,7 +520,7 @@ JSValue JSC_HOST_CALL dateProtoFuncToLocaleString(ExecState* exec, JSObject*, JS
 
 JSValue JSC_HOST_CALL dateProtoFuncToLocaleDateString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -527,7 +533,7 @@ JSValue JSC_HOST_CALL dateProtoFuncToLocaleDateString(ExecState* exec, JSObject*
 
 JSValue JSC_HOST_CALL dateProtoFuncToLocaleTimeString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -540,7 +546,7 @@ JSValue JSC_HOST_CALL dateProtoFuncToLocaleTimeString(ExecState* exec, JSObject*
 
 JSValue JSC_HOST_CALL dateProtoFuncGetTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -553,7 +559,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetTime(ExecState* exec, JSObject*, JSValue t
 
 JSValue JSC_HOST_CALL dateProtoFuncGetFullYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -570,7 +576,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetFullYear(ExecState* exec, JSObject*, JSVal
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -587,7 +593,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState* exec, JSObject*, JS
 
 JSValue JSC_HOST_CALL dateProtoFuncToGMTString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -604,7 +610,7 @@ JSValue JSC_HOST_CALL dateProtoFuncToGMTString(ExecState* exec, JSObject*, JSVal
 
 JSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -621,7 +627,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState* exec, JSObject*, JSValue
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -638,7 +644,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState* exec, JSObject*, JSVal
 
 JSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -655,7 +661,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState* exec, JSObject*, JSValue t
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -672,7 +678,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState* exec, JSObject*, JSValu
 
 JSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -689,7 +695,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState* exec, JSObject*, JSValue th
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -706,7 +712,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState* exec, JSObject*, JSValue
 
 JSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -723,7 +729,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState* exec, JSObject*, JSValue
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -740,7 +746,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState* exec, JSObject*, JSVal
 
 JSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -757,7 +763,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState* exec, JSObject*, JSValu
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -774,7 +780,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState* exec, JSObject*, JSV
 
 JSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -791,7 +797,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState* exec, JSObject*, JSValu
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -808,7 +814,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState* exec, JSObject*, JSV
 
 JSValue JSC_HOST_CALL dateProtoFuncGetMilliSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -823,7 +829,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetMilliSeconds(ExecState* exec, JSObject*, J
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCMilliseconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -838,7 +844,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCMilliseconds(ExecState* exec, JSObject*
 
 JSValue JSC_HOST_CALL dateProtoFuncGetTimezoneOffset(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -855,7 +861,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetTimezoneOffset(ExecState* exec, JSObject*,
 
 JSValue JSC_HOST_CALL dateProtoFuncSetTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -868,7 +874,7 @@ JSValue JSC_HOST_CALL dateProtoFuncSetTime(ExecState* exec, JSObject*, JSValue t
 
 static JSValue setNewValueFromTimeArgs(ExecState* exec, JSValue thisValue, const ArgList& args, int numArgsToUse, bool inputIsUTC)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue);
@@ -899,7 +905,7 @@ static JSValue setNewValueFromTimeArgs(ExecState* exec, JSValue thisValue, const
 
 static JSValue setNewValueFromDateArgs(ExecState* exec, JSValue thisValue, const ArgList& args, int numArgsToUse, bool inputIsUTC)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue);
@@ -1020,7 +1026,7 @@ JSValue JSC_HOST_CALL dateProtoFuncSetUTCFullYear(ExecState* exec, JSObject*, JS
 
 JSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -1062,7 +1068,7 @@ JSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValue t
 
 JSValue JSC_HOST_CALL dateProtoFuncGetYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h
index 5f4d0ec..12fabda 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h
@@ -32,13 +32,14 @@ namespace JSC {
         DatePrototype(ExecState*, PassRefPtr<Structure>);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType));
+            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultGetPropertyNames));
         }
     };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Error.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Error.cpp
index 1aa9034..ddd4bc4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Error.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Error.cpp
@@ -83,11 +83,11 @@ JSObject* Error::create(ExecState* exec, ErrorType type, const UString& message,
     JSObject* error = construct(exec, constructor, constructType, constructData, args);
 
     if (lineNumber != -1)
-        error->putWithAttributes(exec, Identifier(exec, JSC_ERROR_LINENUMBER_PROPERTYNAME), jsNumber(exec, lineNumber), ReadOnly | DontDelete);
+        error->putWithAttributes(exec, Identifier(exec, "line"), jsNumber(exec, lineNumber), ReadOnly | DontDelete);
     if (sourceID != -1)
         error->putWithAttributes(exec, Identifier(exec, "sourceId"), jsNumber(exec, sourceID), ReadOnly | DontDelete);
     if (!sourceURL.isNull())
-        error->putWithAttributes(exec, Identifier(exec, JSC_ERROR_FILENAME_PROPERTYNAME), jsString(exec, sourceURL), ReadOnly | DontDelete);
+        error->putWithAttributes(exec, Identifier(exec, "sourceURL"), jsString(exec, sourceURL), ReadOnly | DontDelete);
 
     return error;
 }
@@ -97,6 +97,12 @@ JSObject* Error::create(ExecState* exec, ErrorType type, const char* message)
     return create(exec, type, message, -1, -1, NULL);
 }
 
+JSObject* throwError(ExecState* exec, JSObject* error)
+{
+    exec->setException(error);
+    return error;
+}
+
 JSObject* throwError(ExecState* exec, ErrorType type)
 {
     JSObject* error = Error::create(exec, type, UString(), -1, -1, NULL);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Error.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Error.h
index fb864ee..e959cff 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Error.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Error.h
@@ -59,14 +59,7 @@ namespace JSC {
     JSObject* throwError(ExecState*, ErrorType, const UString& message);
     JSObject* throwError(ExecState*, ErrorType, const char* message);
     JSObject* throwError(ExecState*, ErrorType);
-
-#ifdef QT_BUILD_SCRIPT_LIB
-#  define JSC_ERROR_FILENAME_PROPERTYNAME "fileName"
-#  define JSC_ERROR_LINENUMBER_PROPERTYNAME "lineNumber"
-#else
-#  define JSC_ERROR_FILENAME_PROPERTYNAME "sourceURL"
-#  define JSC_ERROR_LINENUMBER_PROPERTYNAME "line"
-#endif
+    JSObject* throwError(ExecState*, JSObject*);
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp
index e63594c..cc18b95 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp
@@ -74,7 +74,7 @@ JSValue createUndefinedVariableError(ExecState* exec, const Identifier& ident, u
     int line = codeBlock->expressionRangeForBytecodeOffset(exec, bytecodeOffset, divotPoint, startOffset, endOffset);
     UString message = "Can't find variable: ";
     message.append(ident.ustring());
-    JSObject* exception = Error::create(exec, ReferenceError, message, line, codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->sourceURL());
+    JSObject* exception = Error::create(exec, ReferenceError, message, line, codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->sourceURL());
     exception->putWithAttributes(exec, Identifier(exec, expressionBeginOffsetPropertyName), jsNumber(exec, divotPoint - startOffset), ReadOnly | DontDelete);
     exception->putWithAttributes(exec, Identifier(exec, expressionCaretOffsetPropertyName), jsNumber(exec, divotPoint), ReadOnly | DontDelete);
     exception->putWithAttributes(exec, Identifier(exec, expressionEndOffsetPropertyName), jsNumber(exec, divotPoint + endOffset), ReadOnly | DontDelete);
@@ -136,7 +136,7 @@ JSObject* createInvalidParamError(ExecState* exec, const char* op, JSValue value
     int divotPoint = 0;
     int line = codeBlock->expressionRangeForBytecodeOffset(exec, bytecodeOffset, divotPoint, startOffset, endOffset);
     UString errorMessage = createErrorMessage(exec, codeBlock, line, divotPoint, divotPoint + endOffset, value, message);
-    JSObject* exception = Error::create(exec, TypeError, errorMessage, line, codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->sourceURL());
+    JSObject* exception = Error::create(exec, TypeError, errorMessage, line, codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->sourceURL());
     exception->putWithAttributes(exec, Identifier(exec, expressionBeginOffsetPropertyName), jsNumber(exec, divotPoint - startOffset), ReadOnly | DontDelete);
     exception->putWithAttributes(exec, Identifier(exec, expressionCaretOffsetPropertyName), jsNumber(exec, divotPoint), ReadOnly | DontDelete);
     exception->putWithAttributes(exec, Identifier(exec, expressionEndOffsetPropertyName), jsNumber(exec, divotPoint + endOffset), ReadOnly | DontDelete);
@@ -157,7 +157,7 @@ JSObject* createNotAConstructorError(ExecState* exec, JSValue value, unsigned by
         startPoint++;
     
     UString errorMessage = createErrorMessage(exec, codeBlock, line, startPoint, divotPoint, value, "not a constructor");
-    JSObject* exception = Error::create(exec, TypeError, errorMessage, line, codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->sourceURL());
+    JSObject* exception = Error::create(exec, TypeError, errorMessage, line, codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->sourceURL());
     exception->putWithAttributes(exec, Identifier(exec, expressionBeginOffsetPropertyName), jsNumber(exec, divotPoint - startOffset), ReadOnly | DontDelete);
     exception->putWithAttributes(exec, Identifier(exec, expressionCaretOffsetPropertyName), jsNumber(exec, divotPoint), ReadOnly | DontDelete);
     exception->putWithAttributes(exec, Identifier(exec, expressionEndOffsetPropertyName), jsNumber(exec, divotPoint + endOffset), ReadOnly | DontDelete);
@@ -171,7 +171,7 @@ JSValue createNotAFunctionError(ExecState* exec, JSValue value, unsigned bytecod
     int divotPoint = 0;
     int line = codeBlock->expressionRangeForBytecodeOffset(exec, bytecodeOffset, divotPoint, startOffset, endOffset);
     UString errorMessage = createErrorMessage(exec, codeBlock, line, divotPoint - startOffset, divotPoint, value, "not a function");
-    JSObject* exception = Error::create(exec, TypeError, errorMessage, line, codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->sourceURL());    
+    JSObject* exception = Error::create(exec, TypeError, errorMessage, line, codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->sourceURL());    
     exception->putWithAttributes(exec, Identifier(exec, expressionBeginOffsetPropertyName), jsNumber(exec, divotPoint - startOffset), ReadOnly | DontDelete);
     exception->putWithAttributes(exec, Identifier(exec, expressionCaretOffsetPropertyName), jsNumber(exec, divotPoint), ReadOnly | DontDelete);
     exception->putWithAttributes(exec, Identifier(exec, expressionEndOffsetPropertyName), jsNumber(exec, divotPoint + endOffset), ReadOnly | DontDelete);
@@ -201,7 +201,7 @@ JSObject* createNotAnObjectError(ExecState* exec, JSNotAnObjectErrorStub* error,
     int divotPoint = 0;
     int line = codeBlock->expressionRangeForBytecodeOffset(exec, bytecodeOffset, divotPoint, startOffset, endOffset);
     UString errorMessage = createErrorMessage(exec, codeBlock, line, divotPoint - startOffset, divotPoint, error->isNull() ? jsNull() : jsUndefined(), "not an object");
-    JSObject* exception = Error::create(exec, TypeError, errorMessage, line, codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->sourceURL());
+    JSObject* exception = Error::create(exec, TypeError, errorMessage, line, codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->sourceURL());
     exception->putWithAttributes(exec, Identifier(exec, expressionBeginOffsetPropertyName), jsNumber(exec, divotPoint - startOffset), ReadOnly | DontDelete);
     exception->putWithAttributes(exec, Identifier(exec, expressionCaretOffsetPropertyName), jsNumber(exec, divotPoint), ReadOnly | DontDelete);
     exception->putWithAttributes(exec, Identifier(exec, expressionEndOffsetPropertyName), jsNumber(exec, divotPoint + endOffset), ReadOnly | DontDelete);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h
index 09d99dc..4c5bec1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h
@@ -29,20 +29,19 @@
 #ifndef ExceptionHelpers_h
 #define ExceptionHelpers_h
 
-#include "JSImmediate.h"
 
 namespace JSC {
 
     class CodeBlock;
     class ExecState;
     class Identifier;
-    class Instruction;
     class JSGlobalData;
     class JSNotAnObjectErrorStub;
     class JSObject;
     class JSValue;
     class Node;
-
+    struct Instruction;
+    
     JSValue createInterruptedExecutionException(JSGlobalData*);
     JSValue createStackOverflowError(ExecState*);
     JSValue createUndefinedVariableError(ExecState*, const Identifier&, unsigned bytecodeOffset, CodeBlock*);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Executable.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Executable.cpp
new file mode 100644
index 0000000..5e79794
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Executable.cpp
@@ -0,0 +1,280 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "Executable.h"
+
+#include "BytecodeGenerator.h"
+#include "CodeBlock.h"
+#include "JIT.h"
+#include "Parser.h"
+#include "Vector.h"
+
+namespace JSC {
+
+#if ENABLE(JIT)
+NativeExecutable::~NativeExecutable()
+{
+}
+#endif
+
+VPtrHackExecutable::~VPtrHackExecutable()
+{
+}
+
+EvalExecutable::~EvalExecutable()
+{
+    delete m_evalCodeBlock;
+}
+
+ProgramExecutable::~ProgramExecutable()
+{
+    delete m_programCodeBlock;
+}
+
+FunctionExecutable::~FunctionExecutable()
+{
+    delete m_codeBlock;
+}
+
+JSObject* EvalExecutable::compile(ExecState* exec, ScopeChainNode* scopeChainNode)
+{
+    int errLine;
+    UString errMsg;
+    RefPtr<EvalNode> evalNode = exec->globalData().parser->parse<EvalNode>(&exec->globalData(), exec->lexicalGlobalObject()->debugger(), exec, m_source, &errLine, &errMsg);
+    if (!evalNode)
+        return Error::create(exec, SyntaxError, errMsg, errLine, m_source.provider()->asID(), m_source.provider()->url());
+    recordParse(evalNode->features(), evalNode->lineNo(), evalNode->lastLine());
+
+    ScopeChain scopeChain(scopeChainNode);
+    JSGlobalObject* globalObject = scopeChain.globalObject();
+
+    ASSERT(!m_evalCodeBlock);
+    m_evalCodeBlock = new EvalCodeBlock(this, globalObject, source().provider(), scopeChain.localDepth());
+    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(evalNode.get(), globalObject->debugger(), scopeChain, m_evalCodeBlock->symbolTable(), m_evalCodeBlock));
+    generator->generate();
+    
+    evalNode->destroyData();
+    return 0;
+}
+
+JSObject* ProgramExecutable::checkSyntax(ExecState* exec)
+{
+    int errLine;
+    UString errMsg;
+    RefPtr<ProgramNode> programNode = exec->globalData().parser->parse<ProgramNode>(&exec->globalData(), exec->lexicalGlobalObject()->debugger(), exec, m_source, &errLine, &errMsg);
+    if (!programNode)
+        return Error::create(exec, SyntaxError, errMsg, errLine, m_source.provider()->asID(), m_source.provider()->url());
+    return 0;
+}
+
+JSObject* ProgramExecutable::compile(ExecState* exec, ScopeChainNode* scopeChainNode)
+{
+    int errLine;
+    UString errMsg;
+    RefPtr<ProgramNode> programNode = exec->globalData().parser->parse<ProgramNode>(&exec->globalData(), exec->lexicalGlobalObject()->debugger(), exec, m_source, &errLine, &errMsg);
+    if (!programNode)
+        return Error::create(exec, SyntaxError, errMsg, errLine, m_source.provider()->asID(), m_source.provider()->url());
+    recordParse(programNode->features(), programNode->lineNo(), programNode->lastLine());
+
+    ScopeChain scopeChain(scopeChainNode);
+    JSGlobalObject* globalObject = scopeChain.globalObject();
+    
+    ASSERT(!m_programCodeBlock);
+    m_programCodeBlock = new ProgramCodeBlock(this, GlobalCode, globalObject, source().provider());
+    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(programNode.get(), globalObject->debugger(), scopeChain, &globalObject->symbolTable(), m_programCodeBlock));
+    generator->generate();
+
+    programNode->destroyData();
+    return 0;
+}
+
+void FunctionExecutable::compile(ExecState*, ScopeChainNode* scopeChainNode)
+{
+    JSGlobalData* globalData = scopeChainNode->globalData;
+    RefPtr<FunctionBodyNode> body = globalData->parser->parse<FunctionBodyNode>(globalData, 0, 0, m_source);
+    if (m_forceUsesArguments)
+        body->setUsesArguments();
+    body->finishParsing(m_parameters, m_name);
+    recordParse(body->features(), body->lineNo(), body->lastLine());
+
+    ScopeChain scopeChain(scopeChainNode);
+    JSGlobalObject* globalObject = scopeChain.globalObject();
+
+    ASSERT(!m_codeBlock);
+    m_codeBlock = new FunctionCodeBlock(this, FunctionCode, source().provider(), source().startOffset());
+    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(body.get(), globalObject->debugger(), scopeChain, m_codeBlock->symbolTable(), m_codeBlock));
+    generator->generate();
+    m_numParameters = m_codeBlock->m_numParameters;
+    ASSERT(m_numParameters);
+    m_numVariables = m_codeBlock->m_numVars;
+
+    body->destroyData();
+}
+
+#if ENABLE(JIT)
+
+void EvalExecutable::generateJITCode(ExecState* exec, ScopeChainNode* scopeChainNode)
+{
+    CodeBlock* codeBlock = &bytecode(exec, scopeChainNode);
+    m_jitCode = JIT::compile(scopeChainNode->globalData, codeBlock);
+
+#if !ENABLE(OPCODE_SAMPLING)
+    if (!BytecodeGenerator::dumpsGeneratedCode())
+        codeBlock->discardBytecode();
+#endif
+}
+
+void ProgramExecutable::generateJITCode(ExecState* exec, ScopeChainNode* scopeChainNode)
+{
+    CodeBlock* codeBlock = &bytecode(exec, scopeChainNode);
+    m_jitCode = JIT::compile(scopeChainNode->globalData, codeBlock);
+
+#if !ENABLE(OPCODE_SAMPLING)
+    if (!BytecodeGenerator::dumpsGeneratedCode())
+        codeBlock->discardBytecode();
+#endif
+}
+
+void FunctionExecutable::generateJITCode(ExecState* exec, ScopeChainNode* scopeChainNode)
+{
+    CodeBlock* codeBlock = &bytecode(exec, scopeChainNode);
+    m_jitCode = JIT::compile(scopeChainNode->globalData, codeBlock);
+
+#if !ENABLE(OPCODE_SAMPLING)
+    if (!BytecodeGenerator::dumpsGeneratedCode())
+        codeBlock->discardBytecode();
+#endif
+}
+
+#endif
+
+void FunctionExecutable::markAggregate(MarkStack& markStack)
+{
+    if (m_codeBlock)
+        m_codeBlock->markAggregate(markStack);
+}
+
+ExceptionInfo* FunctionExecutable::reparseExceptionInfo(JSGlobalData* globalData, ScopeChainNode* scopeChainNode, CodeBlock* codeBlock)
+{
+    RefPtr<FunctionBodyNode> newFunctionBody = globalData->parser->parse<FunctionBodyNode>(globalData, 0, 0, m_source);
+    if (m_forceUsesArguments)
+        newFunctionBody->setUsesArguments();
+    newFunctionBody->finishParsing(m_parameters, m_name);
+
+    ScopeChain scopeChain(scopeChainNode);
+    JSGlobalObject* globalObject = scopeChain.globalObject();
+
+    OwnPtr<CodeBlock> newCodeBlock(new FunctionCodeBlock(this, FunctionCode, source().provider(), source().startOffset()));
+    globalData->functionCodeBlockBeingReparsed = newCodeBlock.get();
+
+    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(newFunctionBody.get(), globalObject->debugger(), scopeChain, newCodeBlock->symbolTable(), newCodeBlock.get()));
+    generator->setRegeneratingForExceptionInfo(static_cast<FunctionCodeBlock*>(codeBlock));
+    generator->generate();
+
+    ASSERT(newCodeBlock->instructionCount() == codeBlock->instructionCount());
+
+#if ENABLE(JIT)
+    JITCode newJITCode = JIT::compile(globalData, newCodeBlock.get());
+    ASSERT(newJITCode.size() == generatedJITCode().size());
+#endif
+
+    globalData->functionCodeBlockBeingReparsed = 0;
+
+    return newCodeBlock->extractExceptionInfo();
+}
+
+ExceptionInfo* EvalExecutable::reparseExceptionInfo(JSGlobalData* globalData, ScopeChainNode* scopeChainNode, CodeBlock* codeBlock)
+{
+    RefPtr<EvalNode> newEvalBody = globalData->parser->parse<EvalNode>(globalData, 0, 0, m_source);
+
+    ScopeChain scopeChain(scopeChainNode);
+    JSGlobalObject* globalObject = scopeChain.globalObject();
+
+    OwnPtr<EvalCodeBlock> newCodeBlock(new EvalCodeBlock(this, globalObject, source().provider(), scopeChain.localDepth()));
+
+    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(newEvalBody.get(), globalObject->debugger(), scopeChain, newCodeBlock->symbolTable(), newCodeBlock.get()));
+    generator->setRegeneratingForExceptionInfo(static_cast<EvalCodeBlock*>(codeBlock));
+    generator->generate();
+
+    ASSERT(newCodeBlock->instructionCount() == codeBlock->instructionCount());
+
+#if ENABLE(JIT)
+    JITCode newJITCode = JIT::compile(globalData, newCodeBlock.get());
+    ASSERT(newJITCode.size() == generatedJITCode().size());
+#endif
+
+    return newCodeBlock->extractExceptionInfo();
+}
+
+void FunctionExecutable::recompile(ExecState*)
+{
+    delete m_codeBlock;
+    m_codeBlock = 0;
+    m_numParameters = NUM_PARAMETERS_NOT_COMPILED;
+#if ENABLE(JIT)
+    m_jitCode = JITCode();
+#endif
+}
+
+PassRefPtr<FunctionExecutable> FunctionExecutable::fromGlobalCode(const Identifier& functionName, ExecState* exec, Debugger* debugger, const SourceCode& source, int* errLine, UString* errMsg)
+{
+    RefPtr<ProgramNode> program = exec->globalData().parser->parse<ProgramNode>(&exec->globalData(), debugger, exec, source, errLine, errMsg);
+    if (!program)
+        return 0;
+
+    StatementNode* exprStatement = program->singleStatement();
+    ASSERT(exprStatement);
+    ASSERT(exprStatement->isExprStatement());
+    if (!exprStatement || !exprStatement->isExprStatement())
+        return 0;
+
+    ExpressionNode* funcExpr = static_cast<ExprStatementNode*>(exprStatement)->expr();
+    ASSERT(funcExpr);
+    ASSERT(funcExpr->isFuncExprNode());
+    if (!funcExpr || !funcExpr->isFuncExprNode())
+        return 0;
+
+    FunctionBodyNode* body = static_cast<FuncExprNode*>(funcExpr)->body();
+    ASSERT(body);
+    return FunctionExecutable::create(functionName, body->source(), body->usesArguments(), body->parameters(), body->lineNo(), body->lastLine());
+}
+
+UString FunctionExecutable::paramString() const
+{
+    FunctionParameters& parameters = *m_parameters;
+    UString s("");
+    for (size_t pos = 0; pos < parameters.size(); ++pos) {
+        if (!s.isEmpty())
+            s += ", ";
+        s += parameters[pos].ustring();
+    }
+
+    return s;
+}
+
+};
+
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Executable.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Executable.h
new file mode 100644
index 0000000..d437d46
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Executable.h
@@ -0,0 +1,314 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef Executable_h
+#define Executable_h
+
+#include "JSFunction.h"
+#include "Nodes.h"
+
+namespace JSC {
+
+    class CodeBlock;
+    class Debugger;
+    class EvalCodeBlock;
+    class ProgramCodeBlock;
+    class ScopeChainNode;
+
+    struct ExceptionInfo;
+
+    class ExecutableBase : public RefCounted<ExecutableBase> {
+        friend class JIT;
+
+    protected:
+        static const int NUM_PARAMETERS_IS_HOST = 0;
+        static const int NUM_PARAMETERS_NOT_COMPILED = -1;
+    
+    public:
+        ExecutableBase(int numParameters)
+            : m_numParameters(numParameters)
+        {
+        }
+
+        virtual ~ExecutableBase() {}
+
+        bool isHostFunction() const { return m_numParameters == NUM_PARAMETERS_IS_HOST; }
+
+    protected:
+        int m_numParameters;
+
+#if ENABLE(JIT)
+    public:
+        JITCode& generatedJITCode()
+        {
+            ASSERT(m_jitCode);
+            return m_jitCode;
+        }
+
+        ExecutablePool* getExecutablePool()
+        {
+            return m_jitCode.getExecutablePool();
+        }
+
+    protected:
+        JITCode m_jitCode;
+#endif
+    };
+
+#if ENABLE(JIT)
+    class NativeExecutable : public ExecutableBase {
+    public:
+        NativeExecutable(ExecState* exec)
+            : ExecutableBase(NUM_PARAMETERS_IS_HOST)
+        {
+            m_jitCode = JITCode(JITCode::HostFunction(exec->globalData().jitStubs.ctiNativeCallThunk()));
+        }
+
+        ~NativeExecutable();
+    };
+#endif
+
+    class VPtrHackExecutable : public ExecutableBase {
+    public:
+        VPtrHackExecutable()
+            : ExecutableBase(NUM_PARAMETERS_IS_HOST)
+        {
+        }
+
+        ~VPtrHackExecutable();
+    };
+
+    class ScriptExecutable : public ExecutableBase {
+    public:
+        ScriptExecutable(const SourceCode& source)
+            : ExecutableBase(NUM_PARAMETERS_NOT_COMPILED)
+            , m_source(source)
+            , m_features(0)
+        {
+        }
+
+        const SourceCode& source() { return m_source; }
+        intptr_t sourceID() const { return m_source.provider()->asID(); }
+        const UString& sourceURL() const { return m_source.provider()->url(); }
+        int lineNo() const { return m_firstLine; }
+        int lastLine() const { return m_lastLine; }
+
+        bool usesEval() const { return m_features & EvalFeature; }
+        bool usesArguments() const { return m_features & ArgumentsFeature; }
+        bool needsActivation() const { return m_features & (EvalFeature | ClosureFeature | WithFeature | CatchFeature); }
+
+        virtual ExceptionInfo* reparseExceptionInfo(JSGlobalData*, ScopeChainNode*, CodeBlock*) = 0;
+
+    protected:
+        void recordParse(CodeFeatures features, int firstLine, int lastLine)
+        {
+            m_features = features;
+            m_firstLine = firstLine;
+            m_lastLine = lastLine;
+        }
+
+        SourceCode m_source;
+        CodeFeatures m_features;
+        int m_firstLine;
+        int m_lastLine;
+    };
+
+    class EvalExecutable : public ScriptExecutable {
+    public:
+        EvalExecutable(const SourceCode& source)
+            : ScriptExecutable(source)
+            , m_evalCodeBlock(0)
+        {
+        }
+
+        ~EvalExecutable();
+
+        EvalCodeBlock& bytecode(ExecState* exec, ScopeChainNode* scopeChainNode)
+        {
+            if (!m_evalCodeBlock) {
+                JSObject* error = compile(exec, scopeChainNode);
+                ASSERT_UNUSED(!error, error);
+            }
+            return *m_evalCodeBlock;
+        }
+
+        JSObject* compile(ExecState*, ScopeChainNode*);
+
+        ExceptionInfo* reparseExceptionInfo(JSGlobalData*, ScopeChainNode*, CodeBlock*);
+        static PassRefPtr<EvalExecutable> create(const SourceCode& source) { return adoptRef(new EvalExecutable(source)); }
+
+    private:
+        EvalCodeBlock* m_evalCodeBlock;
+
+#if ENABLE(JIT)
+    public:
+        JITCode& jitCode(ExecState* exec, ScopeChainNode* scopeChainNode)
+        {
+            if (!m_jitCode)
+                generateJITCode(exec, scopeChainNode);
+            return m_jitCode;
+        }
+
+    private:
+        void generateJITCode(ExecState*, ScopeChainNode*);
+#endif
+    };
+
+    class ProgramExecutable : public ScriptExecutable {
+    public:
+        ProgramExecutable(const SourceCode& source)
+            : ScriptExecutable(source)
+            , m_programCodeBlock(0)
+        {
+        }
+        
+        ~ProgramExecutable();
+
+        ProgramCodeBlock& bytecode(ExecState* exec, ScopeChainNode* scopeChainNode)
+        {
+            if (!m_programCodeBlock) {
+                JSObject* error = compile(exec, scopeChainNode);
+                ASSERT_UNUSED(!error, error);
+            }
+            return *m_programCodeBlock;
+        }
+
+        JSObject* checkSyntax(ExecState*);
+        JSObject* compile(ExecState*, ScopeChainNode*);
+
+        // CodeBlocks for program code are transient and therefore do not gain from from throwing out there exception information.
+        ExceptionInfo* reparseExceptionInfo(JSGlobalData*, ScopeChainNode*, CodeBlock*) { ASSERT_NOT_REACHED(); return 0; }
+
+    private:
+        ProgramCodeBlock* m_programCodeBlock;
+
+#if ENABLE(JIT)
+    public:
+        JITCode& jitCode(ExecState* exec, ScopeChainNode* scopeChainNode)
+        {
+            if (!m_jitCode)
+                generateJITCode(exec, scopeChainNode);
+            return m_jitCode;
+        }
+
+    private:
+        void generateJITCode(ExecState*, ScopeChainNode*);
+#endif
+    };
+
+    class FunctionExecutable : public ScriptExecutable {
+        friend class JIT;
+    public:
+        static PassRefPtr<FunctionExecutable> create(const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, int firstLine, int lastLine)
+        {
+            return adoptRef(new FunctionExecutable(name, source, forceUsesArguments, parameters, firstLine, lastLine));
+        }
+
+        ~FunctionExecutable();
+
+        JSFunction* make(ExecState* exec, ScopeChainNode* scopeChain)
+        {
+            return new (exec) JSFunction(exec, this, scopeChain);
+        }
+
+        CodeBlock& bytecode(ExecState* exec, ScopeChainNode* scopeChainNode) 
+        {
+            ASSERT(scopeChainNode);
+            if (!m_codeBlock)
+                compile(exec, scopeChainNode);
+            return *m_codeBlock;
+        }
+
+        bool isGenerated() const
+        {
+            return m_codeBlock;
+        }
+
+        CodeBlock& generatedBytecode()
+        {
+            ASSERT(m_codeBlock);
+            return *m_codeBlock;
+        }
+
+        const Identifier& name() { return m_name; }
+        size_t parameterCount() const { return m_parameters->size(); }
+        size_t variableCount() const { return m_numVariables; }
+        UString paramString() const;
+
+        void recompile(ExecState*);
+        ExceptionInfo* reparseExceptionInfo(JSGlobalData*, ScopeChainNode*, CodeBlock*);
+        void markAggregate(MarkStack& markStack);
+        static PassRefPtr<FunctionExecutable> fromGlobalCode(const Identifier&, ExecState*, Debugger*, const SourceCode&, int* errLine = 0, UString* errMsg = 0);
+
+    private:
+        FunctionExecutable(const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, int firstLine, int lastLine)
+            : ScriptExecutable(source)
+            , m_forceUsesArguments(forceUsesArguments)
+            , m_parameters(parameters)
+            , m_codeBlock(0)
+            , m_name(name)
+            , m_numVariables(0)
+        {
+            m_firstLine = firstLine;
+            m_lastLine = lastLine;
+        }
+
+        void compile(ExecState*, ScopeChainNode*);
+
+        bool m_forceUsesArguments;
+        RefPtr<FunctionParameters> m_parameters;
+        CodeBlock* m_codeBlock;
+        Identifier m_name;
+        size_t m_numVariables;
+
+#if ENABLE(JIT)
+    public:
+        JITCode& jitCode(ExecState* exec, ScopeChainNode* scopeChainNode)
+        {
+            if (!m_jitCode)
+                generateJITCode(exec, scopeChainNode);
+            return m_jitCode;
+        }
+
+    private:
+        void generateJITCode(ExecState*, ScopeChainNode*);
+#endif
+    };
+
+    inline FunctionExecutable* JSFunction::jsExecutable() const
+    {
+        ASSERT(!isHostFunctionNonInline());
+        return static_cast<FunctionExecutable*>(m_executable.get());
+    }
+
+    inline bool JSFunction::isHostFunction() const
+    {
+        ASSERT(m_executable);
+        return m_executable->isHostFunction();
+    }
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.cpp
index f4f5cc8..d5eb20f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.cpp
@@ -66,32 +66,6 @@ CallType FunctionConstructor::getCallData(CallData& callData)
     return CallTypeHost;
 }
 
-FunctionBodyNode* extractFunctionBody(ProgramNode* program)
-{
-    if (!program)
-        return 0;
-
-    StatementVector& children = program->children();
-    if (children.size() != 1)
-        return 0;
-
-    StatementNode* exprStatement = children[0];
-    ASSERT(exprStatement);
-    ASSERT(exprStatement->isExprStatement());
-    if (!exprStatement || !exprStatement->isExprStatement())
-        return 0;
-
-    ExpressionNode* funcExpr = static_cast<ExprStatementNode*>(exprStatement)->expr();
-    ASSERT(funcExpr);
-    ASSERT(funcExpr->isFuncExprNode());
-    if (!funcExpr || !funcExpr->isFuncExprNode())
-        return 0;
-
-    FunctionBodyNode* body = static_cast<FuncExprNode*>(funcExpr)->body();
-    ASSERT(body);
-    return body;
-}
-
 // ECMA 15.3.2 The Function Constructor
 JSObject* constructFunction(ExecState* exec, const ArgList& args, const Identifier& functionName, const UString& sourceURL, int lineNumber)
 {
@@ -113,15 +87,13 @@ JSObject* constructFunction(ExecState* exec, const ArgList& args, const Identifi
     int errLine;
     UString errMsg;
     SourceCode source = makeSource(program, sourceURL, lineNumber);
-    RefPtr<ProgramNode> programNode = exec->globalData().parser->parse<ProgramNode>(exec, exec->dynamicGlobalObject()->debugger(), source, &errLine, &errMsg);
-
-    FunctionBodyNode* body = extractFunctionBody(programNode.get());
-    if (!body)
+    RefPtr<FunctionExecutable> function = FunctionExecutable::fromGlobalCode(functionName, exec, exec->dynamicGlobalObject()->debugger(), source, &errLine, &errMsg);
+    if (!function)
         return throwError(exec, SyntaxError, errMsg, errLine, source.provider()->asID(), source.provider()->url());
 
     JSGlobalObject* globalObject = exec->lexicalGlobalObject();
     ScopeChain scopeChain(globalObject, globalObject->globalData(), exec->globalThisValue());
-    return new (exec) JSFunction(exec, functionName, body, scopeChain.node());
+    return new (exec) JSFunction(exec, function, scopeChain.node());
 }
 
 // ECMA 15.3.2 The Function Constructor
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.h b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.h
index 124b354..e8486dc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.h
@@ -26,8 +26,6 @@
 namespace JSC {
 
     class FunctionPrototype;
-    class ProgramNode;
-    class FunctionBodyNode;
 
     class FunctionConstructor : public InternalFunction {
     public:
@@ -41,8 +39,6 @@ namespace JSC {
     JSObject* constructFunction(ExecState*, const ArgList&, const Identifier& functionName, const UString& sourceURL, int lineNumber);
     JSObject* constructFunction(ExecState*, const ArgList&);
 
-    FunctionBodyNode* extractFunctionBody(ProgramNode*);
-
 } // namespace JSC
 
 #endif // FunctionConstructor_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.cpp
index ff8e57b..1dad31a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.cpp
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -84,25 +84,22 @@ static inline void insertSemicolonIfNeeded(UString& functionBody)
 
 JSValue JSC_HOST_CALL functionProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (thisValue.isObject(&JSFunction::info)) {
+    if (thisValue.inherits(&JSFunction::info)) {
         JSFunction* function = asFunction(thisValue);
         if (!function->isHostFunction()) {
-            UString functionBody = function->body()->toSourceString();
-            insertSemicolonIfNeeded(functionBody);
-            return jsString(exec, "function " + function->name(&exec->globalData()) + "(" + function->body()->paramString() + ") " + functionBody);
+            FunctionExecutable* executable = function->jsExecutable();
+            UString sourceString = executable->source().toString();
+            insertSemicolonIfNeeded(sourceString);
+            return jsString(exec, "function " + function->name(&exec->globalData()) + "(" + executable->paramString() + ") " + sourceString);
         }
     }
 
-    if (thisValue.isObject(&InternalFunction::info)) {
+    if (thisValue.inherits(&InternalFunction::info)) {
         InternalFunction* function = asInternalFunction(thisValue);
         return jsString(exec, "function " + function->name(&exec->globalData()) + "() {\n    [native code]\n}");
     }
 
-#ifdef QT_BUILD_SCRIPT_LIB  //same error message as in the old engine, and in mozilla
-    return throwError(exec, TypeError, "Function.prototype.toString called on incompatible object");
-#else
     return throwError(exec, TypeError);
-#endif
 }
 
 JSValue JSC_HOST_CALL functionProtoFuncApply(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h
index 607ddab..469191e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h
@@ -34,7 +34,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue proto)
         {
-            return Structure::create(proto, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot));
+            return Structure::create(proto, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames));
         }
 
     private:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.cpp
index cd1b40a..7e54053 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.cpp
@@ -1,7 +1,7 @@
 /*
  *  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2004, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2004, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -28,52 +28,14 @@
 
 namespace JSC {
 
-void GetterSetter::mark()
+void GetterSetter::markChildren(MarkStack& markStack)
 {
-    JSCell::mark();
+    JSCell::markChildren(markStack);
 
-    if (m_getter && !m_getter->marked())
-        m_getter->mark();
-    if (m_setter && !m_setter->marked())
-        m_setter->mark();
-}
-
-JSValue GetterSetter::toPrimitive(ExecState*, PreferredPrimitiveType) const
-{
-    ASSERT_NOT_REACHED();
-    return jsNull();
-}
-
-bool GetterSetter::getPrimitiveNumber(ExecState*, double& number, JSValue& value)
-{
-    ASSERT_NOT_REACHED();
-    number = 0;
-    value = JSValue();
-    return true;
-}
-
-bool GetterSetter::toBoolean(ExecState*) const
-{
-    ASSERT_NOT_REACHED();
-    return false;
-}
-
-double GetterSetter::toNumber(ExecState*) const
-{
-    ASSERT_NOT_REACHED();
-    return 0.0;
-}
-
-UString GetterSetter::toString(ExecState*) const
-{
-    ASSERT_NOT_REACHED();
-    return UString::null();
-}
-
-JSObject* GetterSetter::toObject(ExecState* exec) const
-{
-    ASSERT_NOT_REACHED();
-    return jsNull().toObject(exec);
+    if (m_getter)
+        markStack.append(m_getter);
+    if (m_setter)
+        markStack.append(m_setter);
 }
 
 bool GetterSetter::isGetterSetter() const
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h b/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h
index e6b74a1..73dd854 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h
@@ -1,7 +1,7 @@
 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -25,6 +25,8 @@
 
 #include "JSCell.h"
 
+#include "CallFrame.h"
+
 namespace JSC {
 
     class JSObject;
@@ -33,30 +35,26 @@ namespace JSC {
     // for a property.
     class GetterSetter : public JSCell {
     public:
-        GetterSetter()
-            : JSCell(0)
+        GetterSetter(ExecState* exec)
+            : JSCell(exec->globalData().getterSetterStructure.get())
             , m_getter(0)
             , m_setter(0)
         {
         }
 
-        virtual void mark();
+        virtual void markChildren(MarkStack&);
 
         JSObject* getter() const { return m_getter; }
         void setGetter(JSObject* getter) { m_getter = getter; }
         JSObject* setter() const { return m_setter; }
         void setSetter(JSObject* setter) { m_setter = setter; }
-
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        {
+            return Structure::create(prototype, TypeInfo(GetterSetterType));
+        }
     private:
         virtual bool isGetterSetter() const;
 
-        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
-        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue& value);
-        virtual bool toBoolean(ExecState*) const;
-        virtual double toNumber(ExecState*) const;
-        virtual UString toString(ExecState*) const;
-        virtual JSObject* toObject(ExecState*) const;
-
         JSObject* m_getter;
         JSObject* m_setter;  
     };
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/GlobalEvalFunction.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/GlobalEvalFunction.cpp
index b0d4c25..3074f95 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/GlobalEvalFunction.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/GlobalEvalFunction.cpp
@@ -1,7 +1,7 @@
 /*
  *  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
  *  Copyright (C) 2007 Maks Orlovich
  *
@@ -39,11 +39,10 @@ GlobalEvalFunction::GlobalEvalFunction(ExecState* exec, PassRefPtr<Structure> st
     ASSERT_ARG(cachedGlobalObject, cachedGlobalObject);
 }
 
-void GlobalEvalFunction::mark()
+void GlobalEvalFunction::markChildren(MarkStack& markStack)
 {
-    PrototypeFunction::mark();
-    if (!m_cachedGlobalObject->marked())
-        m_cachedGlobalObject->mark();
+    PrototypeFunction::markChildren(markStack);
+    markStack.append(m_cachedGlobalObject);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/GlobalEvalFunction.h b/src/3rdparty/webkit/JavaScriptCore/runtime/GlobalEvalFunction.h
index 49b1847..c56b0dc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/GlobalEvalFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/GlobalEvalFunction.h
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
  *  Copyright (C) 2007 Maks Orlovich
  *
@@ -35,8 +35,13 @@ namespace JSC {
         GlobalEvalFunction(ExecState*, PassRefPtr<Structure>, int len, const Identifier&, NativeFunction, JSGlobalObject* expectedThisObject);
         JSGlobalObject* cachedGlobalObject() const { return m_cachedGlobalObject; }
 
+        static PassRefPtr<Structure> createStructure(JSValue prototype) 
+        { 
+            return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance | HasStandardGetOwnPropertySlot));
+        }
+
     private:
-        virtual void mark();
+        virtual void markChildren(MarkStack&);
 
         JSGlobalObject* m_cachedGlobalObject;
     };
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.h
index 631cf42..2249179 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.h
@@ -54,6 +54,8 @@ namespace JSC {
         const char* ascii() const { return _ustring.ascii(); }
         
         static Identifier from(ExecState* exec, unsigned y) { return Identifier(exec, UString::from(y)); }
+        static Identifier from(ExecState* exec, int y) { return Identifier(exec, UString::from(y)); }
+        static Identifier from(ExecState* exec, double y) { return Identifier(exec, UString::from(y)); }
         
         bool isNull() const { return _ustring.isNull(); }
         bool isEmpty() const { return _ustring.isEmpty(); }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/InitializeThreading.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/InitializeThreading.cpp
index a0620e7..fea89f8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/InitializeThreading.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/InitializeThreading.cpp
@@ -29,7 +29,6 @@
 #include "config.h"
 #include "InitializeThreading.h"
 
-#include "JSImmediate.h"
 #include "Collector.h"
 #include "dtoa.h"
 #include "Identifier.h"
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h b/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h
index 310644c..37077f6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h
@@ -42,7 +42,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | HasStandardGetOwnPropertySlot)); 
+            return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | HasStandardGetOwnPropertySlot | HasDefaultMark)); 
         }
 
     protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSAPIValueWrapper.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSAPIValueWrapper.cpp
new file mode 100644
index 0000000..e83724a
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSAPIValueWrapper.cpp
@@ -0,0 +1,31 @@
+/*
+ *  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2004, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "JSAPIValueWrapper.h"
+
+#include "NumberObject.h"
+#include "UString.h"
+
+namespace JSC {
+
+} // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSAPIValueWrapper.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSAPIValueWrapper.h
new file mode 100644
index 0000000..88a8493
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSAPIValueWrapper.h
@@ -0,0 +1,64 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003, 2004, 2005, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef JSAPIValueWrapper_h
+#define JSAPIValueWrapper_h
+
+#include <wtf/Platform.h>
+
+#include "JSCell.h"
+#include "CallFrame.h"
+
+namespace JSC {
+
+    class JSAPIValueWrapper : public JSCell {
+        friend JSValue jsAPIValueWrapper(ExecState*, JSValue);
+    public:
+        JSValue value() const { return m_value; }
+
+        virtual bool isAPIValueWrapper() const { return true; }
+
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        {
+            return Structure::create(prototype, TypeInfo(CompoundType));
+        }
+
+        
+    private:
+        JSAPIValueWrapper(ExecState* exec, JSValue value)
+            : JSCell(exec->globalData().apiWrapperStructure.get())
+            , m_value(value)
+        {
+            ASSERT(!value.isCell());
+        }
+
+        JSValue m_value;
+    };
+
+    inline JSValue jsAPIValueWrapper(ExecState* exec, JSValue value)
+    {
+        return new (exec) JSAPIValueWrapper(exec, value);
+    }
+
+} // namespace JSC
+
+#endif // JSAPIValueWrapper_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.cpp
index 184a9cb..779c3e5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -39,8 +39,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSActivation);
 
 const ClassInfo JSActivation::info = { "JSActivation", 0, 0, 0 };
 
-JSActivation::JSActivation(CallFrame* callFrame, PassRefPtr<FunctionBodyNode> functionBody)
-    : Base(callFrame->globalData().activationStructure, new JSActivationData(functionBody, callFrame->registers()))
+JSActivation::JSActivation(CallFrame* callFrame, PassRefPtr<FunctionExecutable> functionExecutable)
+    : Base(callFrame->globalData().activationStructure, new JSActivationData(functionExecutable, callFrame->registers()))
 {
 }
 
@@ -49,35 +49,23 @@ JSActivation::~JSActivation()
     delete d();
 }
 
-void JSActivation::mark()
+void JSActivation::markChildren(MarkStack& markStack)
 {
-    Base::mark();
+    Base::markChildren(markStack);
 
     Register* registerArray = d()->registerArray.get();
     if (!registerArray)
         return;
 
-    size_t numParametersMinusThis = d()->functionBody->generatedBytecode().m_numParameters - 1;
+    size_t numParametersMinusThis = d()->functionExecutable->parameterCount();
 
-    size_t i = 0;
-    size_t count = numParametersMinusThis; 
-    for ( ; i < count; ++i) {
-        Register& r = registerArray[i];
-        if (!r.marked())
-            r.mark();
-    }
+    size_t count = numParametersMinusThis;
+    markStack.appendValues(registerArray, count);
 
-    size_t numVars = d()->functionBody->generatedBytecode().m_numVars;
+    size_t numVars = d()->functionExecutable->variableCount();
 
     // Skip the call frame, which sits between the parameters and vars.
-    i += RegisterFile::CallFrameHeaderSize;
-    count += RegisterFile::CallFrameHeaderSize + numVars;
-
-    for ( ; i < count; ++i) {
-        Register& r = registerArray[i];
-        if (r.jsValue() && !r.marked())
-            r.mark();
-    }
+    markStack.appendValues(registerArray + count + RegisterFile::CallFrameHeaderSize, numVars, MayContainNullValues);
 }
 
 bool JSActivation::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -133,12 +121,12 @@ void JSActivation::putWithAttributes(ExecState* exec, const Identifier& property
     JSObject::putWithAttributes(exec, propertyName, value, attributes, true, slot);
 }
 
-bool JSActivation::deleteProperty(ExecState* exec, const Identifier& propertyName, bool checkDontDelete)
+bool JSActivation::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
     if (propertyName == exec->propertyNames().arguments)
         return false;
 
-    return Base::deleteProperty(exec, propertyName, checkDontDelete);
+    return Base::deleteProperty(exec, propertyName);
 }
 
 JSObject* JSActivation::toThisObject(ExecState* exec) const
@@ -148,14 +136,14 @@ JSObject* JSActivation::toThisObject(ExecState* exec) const
 
 bool JSActivation::isDynamicScope() const
 {
-    return d()->functionBody->usesEval();
+    return d()->functionExecutable->usesEval();
 }
 
 JSValue JSActivation::argumentsGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSActivation* activation = asActivation(slot.slotBase());
 
-    if (activation->d()->functionBody->usesArguments()) {
+    if (activation->d()->functionExecutable->usesArguments()) {
         PropertySlot slot;
         activation->symbolTableGet(exec->propertyNames().arguments, slot);
         return slot.getValue(exec, exec->propertyNames().arguments);
@@ -168,7 +156,7 @@ JSValue JSActivation::argumentsGetter(ExecState* exec, const Identifier&, const
         arguments->copyRegisters();
         callFrame->setCalleeArguments(arguments);
     }
-    ASSERT(arguments->isObject(&Arguments::info));
+    ASSERT(arguments->inherits(&Arguments::info));
 
     return arguments;
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h
index b48ef25..640b91a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -43,10 +43,10 @@ namespace JSC {
     class JSActivation : public JSVariableObject {
         typedef JSVariableObject Base;
     public:
-        JSActivation(CallFrame*, PassRefPtr<FunctionBodyNode>);
+        JSActivation(CallFrame*, PassRefPtr<FunctionExecutable>);
         virtual ~JSActivation();
 
-        virtual void mark();
+        virtual void markChildren(MarkStack&);
 
         virtual bool isDynamicScope() const;
 
@@ -57,7 +57,7 @@ namespace JSC {
         virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
 
         virtual void putWithAttributes(ExecState*, const Identifier&, JSValue, unsigned attributes);
-        virtual bool deleteProperty(ExecState*, const Identifier& propertyName, bool checkDontDelete = true);
+        virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
 
         virtual JSObject* toThisObject(ExecState*) const;
 
@@ -70,13 +70,20 @@ namespace JSC {
 
     private:
         struct JSActivationData : public JSVariableObjectData {
-            JSActivationData(PassRefPtr<FunctionBodyNode> functionBody, Register* registers)
-                : JSVariableObjectData(&functionBody->generatedBytecode().symbolTable(), registers)
-                , functionBody(functionBody)
+            JSActivationData(PassRefPtr<FunctionExecutable> _functionExecutable, Register* registers)
+                : JSVariableObjectData(_functionExecutable->generatedBytecode().symbolTable(), registers)
+                , functionExecutable(_functionExecutable)
             {
+                // We have to manually ref and deref the symbol table as JSVariableObjectData
+                // doesn't know about SharedSymbolTable
+                functionExecutable->generatedBytecode().sharedSymbolTable()->ref();
+            }
+            ~JSActivationData()
+            {
+                static_cast<SharedSymbolTable*>(symbolTable)->deref();
             }
 
-            RefPtr<FunctionBodyNode> functionBody;
+            RefPtr<FunctionExecutable> functionExecutable;
         };
         
         static JSValue argumentsGetter(ExecState*, const Identifier&, const PropertySlot&);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
index a8207e3..1fcca81 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *  Copyright (C) 2003 Peter Kelly (pmk@post.com)
  *  Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
@@ -25,6 +25,8 @@
 
 #include "ArrayPrototype.h"
 #include "CachedCall.h"
+#include "Error.h"
+#include "Executable.h"
 #include "PropertyNameArray.h"
 #include <wtf/AVLTree.h>
 #include <wtf/Assertions.h>
@@ -134,9 +136,9 @@ JSArray::JSArray(PassRefPtr<Structure> structure)
     unsigned initialCapacity = 0;
 
     m_storage = static_cast<ArrayStorage*>(fastZeroedMalloc(storageSize(initialCapacity)));
-    m_fastAccessCutoff = 0;
     m_storage->m_vectorLength = initialCapacity;
-    m_storage->m_length = 0;
+
+    m_fastAccessCutoff = 0;
 
     checkConsistency();
 }
@@ -146,40 +148,45 @@ JSArray::JSArray(PassRefPtr<Structure> structure, unsigned initialLength)
 {
     unsigned initialCapacity = min(initialLength, MIN_SPARSE_ARRAY_INDEX);
 
-    m_storage = static_cast<ArrayStorage*>(fastZeroedMalloc(storageSize(initialCapacity)));
-    m_fastAccessCutoff = 0;
-    m_storage->m_vectorLength = initialCapacity;
+    m_storage = static_cast<ArrayStorage*>(fastMalloc(storageSize(initialCapacity)));
     m_storage->m_length = initialLength;
+    m_storage->m_vectorLength = initialCapacity;
+    m_storage->m_numValuesInVector = 0;
+    m_storage->m_sparseValueMap = 0;
+    m_storage->lazyCreationData = 0;
 
-    Heap::heap(this)->reportExtraMemoryCost(initialCapacity * sizeof(JSValue));
+    JSValue* vector = m_storage->m_vector;
+    for (size_t i = 0; i < initialCapacity; ++i)
+        vector[i] = JSValue();
+
+    m_fastAccessCutoff = 0;
 
     checkConsistency();
+
+    Heap::heap(this)->reportExtraMemoryCost(initialCapacity * sizeof(JSValue));
 }
 
 JSArray::JSArray(PassRefPtr<Structure> structure, const ArgList& list)
     : JSObject(structure)
 {
-    unsigned length = list.size();
+    unsigned initialCapacity = list.size();
 
-    m_fastAccessCutoff = length;
-
-    ArrayStorage* storage = static_cast<ArrayStorage*>(fastMalloc(storageSize(length)));
-
-    storage->m_vectorLength = length;
-    storage->m_numValuesInVector = length;
-    storage->m_sparseValueMap = 0;
-    storage->m_length = length;
+    m_storage = static_cast<ArrayStorage*>(fastMalloc(storageSize(initialCapacity)));
+    m_storage->m_length = initialCapacity;
+    m_storage->m_vectorLength = initialCapacity;
+    m_storage->m_numValuesInVector = initialCapacity;
+    m_storage->m_sparseValueMap = 0;
 
     size_t i = 0;
     ArgList::const_iterator end = list.end();
     for (ArgList::const_iterator it = list.begin(); it != end; ++it, ++i)
-        storage->m_vector[i] = *it;
+        m_storage->m_vector[i] = *it;
 
-    m_storage = storage;
-
-    Heap::heap(this)->reportExtraMemoryCost(storageSize(length));
+    m_fastAccessCutoff = initialCapacity;
 
     checkConsistency();
+
+    Heap::heap(this)->reportExtraMemoryCost(storageSize(initialCapacity));
 }
 
 JSArray::~JSArray()
@@ -234,6 +241,37 @@ bool JSArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName
     return JSObject::getOwnPropertySlot(exec, propertyName, slot);
 }
 
+bool JSArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    if (propertyName == exec->propertyNames().length) {
+        descriptor.setDescriptor(jsNumber(exec, length()), DontDelete | DontEnum);
+        return true;
+    }
+    
+    bool isArrayIndex;
+    unsigned i = propertyName.toArrayIndex(&isArrayIndex);
+    if (isArrayIndex) {
+        if (i >= m_storage->m_length)
+            return false;
+        if (i < m_storage->m_vectorLength) {
+            JSValue value = m_storage->m_vector[i];
+            if (value) {
+                descriptor.setDescriptor(value, 0);
+                return true;
+            }
+        } else if (SparseArrayValueMap* map = m_storage->m_sparseValueMap) {
+            if (i >= MIN_SPARSE_ARRAY_INDEX) {
+                SparseArrayValueMap::iterator it = map->find(i);
+                if (it != map->end()) {
+                    descriptor.setDescriptor(it->second, 0);
+                    return true;
+                }
+            }
+        }
+    }
+    return JSObject::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
 // ECMA 15.4.5.1
 void JSArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
@@ -343,8 +381,7 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
         }
     }
 
-    storage = static_cast<ArrayStorage*>(tryFastRealloc(storage, storageSize(newVectorLength)));
-    if (!storage) {
+    if (!tryFastRealloc(storage, storageSize(newVectorLength)).getValue(storage)) {
         throwOutOfMemoryError(exec);
         return;
     }
@@ -375,20 +412,20 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
     checkConsistency();
 }
 
-bool JSArray::deleteProperty(ExecState* exec, const Identifier& propertyName, bool checkDontDelete)
+bool JSArray::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
     bool isArrayIndex;
     unsigned i = propertyName.toArrayIndex(&isArrayIndex);
     if (isArrayIndex)
-        return deleteProperty(exec, i, checkDontDelete);
+        return deleteProperty(exec, i);
 
     if (propertyName == exec->propertyNames().length)
         return false;
 
-    return JSObject::deleteProperty(exec, propertyName, checkDontDelete);
+    return JSObject::deleteProperty(exec, propertyName);
 }
 
-bool JSArray::deleteProperty(ExecState* exec, unsigned i, bool checkDontDelete)
+bool JSArray::deleteProperty(ExecState* exec, unsigned i)
 {
     checkConsistency();
 
@@ -422,12 +459,12 @@ bool JSArray::deleteProperty(ExecState* exec, unsigned i, bool checkDontDelete)
     checkConsistency();
 
     if (i > MAX_ARRAY_INDEX)
-        return deleteProperty(exec, Identifier::from(exec, i), checkDontDelete);
+        return deleteProperty(exec, Identifier::from(exec, i));
 
     return false;
 }
 
-void JSArray::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     // FIXME: Filling PropertyNameArray with an identifier for every integer
     // is incredibly inefficient for large arrays. We need a different approach,
@@ -447,7 +484,7 @@ void JSArray::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames
             propertyNames.add(Identifier::from(exec, it->first));
     }
 
-    JSObject::getPropertyNames(exec, propertyNames, listedAttributes);
+    JSObject::getOwnPropertyNames(exec, propertyNames);
 }
 
 bool JSArray::increaseVectorLength(unsigned newLength)
@@ -462,8 +499,7 @@ bool JSArray::increaseVectorLength(unsigned newLength)
     ASSERT(newLength <= MAX_STORAGE_VECTOR_INDEX);
     unsigned newVectorLength = increasedVectorLength(newLength);
 
-    storage = static_cast<ArrayStorage*>(tryFastRealloc(storage, storageSize(newVectorLength)));
-    if (!storage)
+    if (!tryFastRealloc(storage, storageSize(newVectorLength)).getValue(storage))
         return false;
 
     Heap::heap(this)->reportExtraMemoryCost(storageSize(newVectorLength) - storageSize(vectorLength));
@@ -596,27 +632,9 @@ void JSArray::push(ExecState* exec, JSValue value)
     putSlowCase(exec, m_storage->m_length++, value);
 }
 
-void JSArray::mark()
+void JSArray::markChildren(MarkStack& markStack)
 {
-    JSObject::mark();
-
-    ArrayStorage* storage = m_storage;
-
-    unsigned usedVectorLength = min(storage->m_length, storage->m_vectorLength);
-    for (unsigned i = 0; i < usedVectorLength; ++i) {
-        JSValue value = storage->m_vector[i];
-        if (value && !value.marked())
-            value.mark();
-    }
-
-    if (SparseArrayValueMap* map = storage->m_sparseValueMap) {
-        SparseArrayValueMap::iterator end = map->end();
-        for (SparseArrayValueMap::iterator it = map->begin(); it != end; ++it) {
-            JSValue value = it->second;
-            if (!value.marked())
-                value.mark();
-        }
-    }
+    markChildrenDirect(markStack);
 }
 
 static int compareNumbersForQSort(const void* a, const void* b)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h
index 73e1711..4f2f86a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -38,6 +38,7 @@ namespace JSC {
 
     class JSArray : public JSObject {
         friend class JIT;
+        friend class Walker;
 
     public:
         explicit JSArray(PassRefPtr<Structure>);
@@ -47,6 +48,7 @@ namespace JSC {
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
         virtual void put(ExecState*, unsigned propertyName, JSValue); // FIXME: Make protected and add setItem.
 
         static JS_EXPORTDATA const ClassInfo info;
@@ -82,13 +84,15 @@ namespace JSC {
         {
             return Structure::create(prototype, TypeInfo(ObjectType));
         }
+        
+        inline void markChildrenDirect(MarkStack& markStack);
 
     protected:
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
-        virtual bool deleteProperty(ExecState*, const Identifier& propertyName, bool checkDontDelete = true);
-        virtual bool deleteProperty(ExecState*, unsigned propertyName, bool checkDontDelete = true);
-        virtual void getPropertyNames(ExecState*, PropertyNameArray&, unsigned listedAttributes = Structure::Prototype);
-        virtual void mark();
+        virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
+        virtual bool deleteProperty(ExecState*, unsigned propertyName);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
+        virtual void markChildren(MarkStack&);
 
         void* lazyCreationData();
         void setLazyCreationData(void*);
@@ -117,14 +121,104 @@ namespace JSC {
     JSArray* constructArray(ExecState*, JSValue singleItemValue);
     JSArray* constructArray(ExecState*, const ArgList& values);
 
+    inline JSArray* asArray(JSCell* cell)
+    {
+        ASSERT(cell->inherits(&JSArray::info));
+        return static_cast<JSArray*>(cell);
+    }
+
     inline JSArray* asArray(JSValue value)
     {
-        ASSERT(asObject(value)->inherits(&JSArray::info));
-        return static_cast<JSArray*>(asObject(value));
+        return asArray(value.asCell());
     }
 
-    inline bool isJSArray(JSGlobalData* globalData, JSValue v) { return v.isCell() && v.asCell()->vptr() == globalData->jsArrayVPtr; }
+    inline bool isJSArray(JSGlobalData* globalData, JSValue v)
+    {
+        return v.isCell() && v.asCell()->vptr() == globalData->jsArrayVPtr;
+    }
+    inline bool isJSArray(JSGlobalData* globalData, JSCell* cell) { return cell->vptr() == globalData->jsArrayVPtr; }
 
+    inline void JSArray::markChildrenDirect(MarkStack& markStack)
+    {
+        JSObject::markChildrenDirect(markStack);
+        
+        ArrayStorage* storage = m_storage;
+
+        unsigned usedVectorLength = std::min(storage->m_length, storage->m_vectorLength);
+        markStack.appendValues(storage->m_vector, usedVectorLength, MayContainNullValues);
+
+        if (SparseArrayValueMap* map = storage->m_sparseValueMap) {
+            SparseArrayValueMap::iterator end = map->end();
+            for (SparseArrayValueMap::iterator it = map->begin(); it != end; ++it)
+                markStack.append(it->second);
+        }
+    }
+
+    inline void MarkStack::markChildren(JSCell* cell)
+    {
+        ASSERT(Heap::isCellMarked(cell));
+        if (cell->structure()->typeInfo().hasDefaultMark()) {
+#ifdef NDEBUG
+            asObject(cell)->markChildrenDirect(*this);
+#else
+            ASSERT(!m_isCheckingForDefaultMarkViolation);
+            m_isCheckingForDefaultMarkViolation = true;
+            cell->markChildren(*this);
+            ASSERT(m_isCheckingForDefaultMarkViolation);
+            m_isCheckingForDefaultMarkViolation = false;
+#endif
+            return;
+        }
+        if (cell->vptr() == m_jsArrayVPtr) {
+            asArray(cell)->markChildrenDirect(*this);
+            return;
+        }
+        cell->markChildren(*this);
+    }
+
+    inline void MarkStack::drain()
+    {
+        while (!m_markSets.isEmpty() || !m_values.isEmpty()) {
+            while (!m_markSets.isEmpty() && m_values.size() < 50) {
+                ASSERT(!m_markSets.isEmpty());
+                MarkSet& current = m_markSets.last();
+                ASSERT(current.m_values);
+                JSValue* end = current.m_end;
+                ASSERT(current.m_values);
+                ASSERT(current.m_values != end);
+            findNextUnmarkedNullValue:
+                ASSERT(current.m_values != end);
+                JSValue value = *current.m_values;
+                current.m_values++;
+
+                JSCell* cell;
+                if (!value || !value.isCell() || Heap::isCellMarked(cell = value.asCell())) {
+                    if (current.m_values == end) {
+                        m_markSets.removeLast();
+                        continue;
+                    }
+                    goto findNextUnmarkedNullValue;
+                }
+
+                Heap::markCell(cell);
+                if (cell->structure()->typeInfo().type() < CompoundType) {
+                    if (current.m_values == end) {
+                        m_markSets.removeLast();
+                        continue;
+                    }
+                    goto findNextUnmarkedNullValue;
+                }
+
+                if (current.m_values == end)
+                    m_markSets.removeLast();
+
+                markChildren(cell);
+            }
+            while (!m_values.isEmpty())
+                markChildren(m_values.removeLast());
+        }
+    }
+    
 } // namespace JSC
 
 #endif // JSArray_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp
index d00b69c..421c440 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp
@@ -45,7 +45,7 @@ JSByteArray::JSByteArray(ExecState* exec, PassRefPtr<Structure> structure, ByteA
     
 PassRefPtr<Structure> JSByteArray::createStructure(JSValue prototype)
 {
-    PassRefPtr<Structure> result = Structure::create(prototype, TypeInfo(ObjectType));
+    PassRefPtr<Structure> result = Structure::create(prototype, TypeInfo(ObjectType, HasDefaultMark));
     return result;
 }
 
@@ -59,7 +59,18 @@ bool JSByteArray::getOwnPropertySlot(ExecState* exec, const Identifier& property
     }
     return JSObject::getOwnPropertySlot(exec, propertyName, slot);
 }
-    
+
+bool JSByteArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && canAccessIndex(index)) {
+        descriptor.setDescriptor(getIndex(exec, index), DontDelete);
+        return true;
+    }
+    return JSObject::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
 bool JSByteArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
 {
     if (canAccessIndex(propertyName)) {
@@ -85,12 +96,12 @@ void JSByteArray::put(ExecState* exec, unsigned propertyName, JSValue value)
     setIndex(exec, propertyName, value);
 }
 
-void JSByteArray::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSByteArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     unsigned length = m_storage->length();
     for (unsigned i = 0; i < length; ++i)
         propertyNames.add(Identifier::from(exec, i));
-    JSObject::getPropertyNames(exec, propertyNames, listedAttributes);
+    JSObject::getOwnPropertyNames(exec, propertyNames);
 }
 
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h
index c43c3ea..016c677 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h
@@ -33,7 +33,7 @@
 namespace JSC {
 
     class JSByteArray : public JSObject {
-        friend class VPtrSet;
+        friend struct VPtrSet;
     public:
         bool canAccessIndex(unsigned i) { return i < m_storage->length(); }
         JSValue getIndex(ExecState* exec, unsigned i)
@@ -78,10 +78,11 @@ namespace JSC {
         
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
         virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
         virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
         virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
 
-        virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, unsigned listedAttributes = Structure::Prototype);
+        virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
 
         virtual const ClassInfo* classInfo() const { return m_classInfo; }
         static const ClassInfo s_defaultInfo;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp
index 10a91f7..aa93252 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp
@@ -90,16 +90,6 @@ bool JSCell::getUInt32(uint32_t&) const
     return false;
 }
 
-bool JSCell::getTruncatedInt32(int32_t&) const
-{
-    return false;
-}
-
-bool JSCell::getTruncatedUInt32(uint32_t&) const
-{
-    return false;
-}
-
 bool JSCell::getString(UString&stringValue) const
 {
     if (!isString())
@@ -115,7 +105,7 @@ UString JSCell::getString() const
 
 JSObject* JSCell::getObject()
 {
-    return isObject() ? static_cast<JSObject*>(this) : 0;
+    return isObject() ? asObject(this) : 0;
 }
 
 const JSObject* JSCell::getObject() const
@@ -167,14 +157,14 @@ void JSCell::put(ExecState* exec, unsigned identifier, JSValue value)
     toObject(exec)->put(exec, identifier, value);
 }
 
-bool JSCell::deleteProperty(ExecState* exec, const Identifier& identifier, bool checkDontDelete)
+bool JSCell::deleteProperty(ExecState* exec, const Identifier& identifier)
 {
-    return toObject(exec)->deleteProperty(exec, identifier, checkDontDelete);
+    return toObject(exec)->deleteProperty(exec, identifier);
 }
 
-bool JSCell::deleteProperty(ExecState* exec, unsigned identifier, bool checkDontDelete)
+bool JSCell::deleteProperty(ExecState* exec, unsigned identifier)
 {
-    return toObject(exec)->deleteProperty(exec, identifier, checkDontDelete);
+    return toObject(exec)->deleteProperty(exec, identifier);
 }
 
 JSObject* JSCell::toThisObject(ExecState* exec) const
@@ -207,4 +197,40 @@ bool JSCell::isGetterSetter() const
     return false;
 }
 
+JSValue JSCell::toPrimitive(ExecState*, PreferredPrimitiveType) const
+{
+    ASSERT_NOT_REACHED();
+    return JSValue();
+}
+
+bool JSCell::getPrimitiveNumber(ExecState*, double&, JSValue&)
+{
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+bool JSCell::toBoolean(ExecState*) const
+{
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+double JSCell::toNumber(ExecState*) const
+{
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+UString JSCell::toString(ExecState*) const
+{
+    ASSERT_NOT_REACHED();
+    return UString();
+}
+
+JSObject* JSCell::toObject(ExecState*) const
+{
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h
index 4743baf..503c6c4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h
@@ -1,7 +1,7 @@
 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2003, 2004, 2005, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2004, 2005, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -23,11 +23,12 @@
 #ifndef JSCell_h
 #define JSCell_h
 
-#include <wtf/Noncopyable.h>
-#include "Structure.h"
-#include "JSValue.h"
-#include "JSImmediate.h"
 #include "Collector.h"
+#include "JSImmediate.h"
+#include "JSValue.h"
+#include "MarkStack.h"
+#include "Structure.h"
+#include <wtf/Noncopyable.h>
 
 namespace JSC {
 
@@ -40,19 +41,24 @@ namespace JSC {
         friend class JSPropertyNameIterator;
         friend class JSString;
         friend class JSValue;
-        friend class VPtrSet;
+        friend class JSAPIValueWrapper;
+        friend struct VPtrSet;
 
     private:
         explicit JSCell(Structure*);
+        JSCell(); // Only used for initializing Collector blocks.
         virtual ~JSCell();
 
     public:
         // Querying the type.
+#if USE(JSVALUE32)
         bool isNumber() const;
+#endif
         bool isString() const;
         bool isObject() const;
         virtual bool isGetterSetter() const;
-        virtual bool isObject(const ClassInfo*) const;
+        bool inherits(const ClassInfo*) const;
+        virtual bool isAPIValueWrapper() const { return false; }
 
         Structure* structure() const;
 
@@ -68,30 +74,28 @@ namespace JSC {
         // Extracting integer values.
         // FIXME: remove these methods, can check isNumberCell in JSValue && then call asNumberCell::*.
         virtual bool getUInt32(uint32_t&) const;
-        virtual bool getTruncatedInt32(int32_t&) const;
-        virtual bool getTruncatedUInt32(uint32_t&) const;
 
         // Basic conversions.
-        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const = 0;
-        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue&) = 0;
-        virtual bool toBoolean(ExecState*) const = 0;
-        virtual double toNumber(ExecState*) const = 0;
-        virtual UString toString(ExecState*) const = 0;
-        virtual JSObject* toObject(ExecState*) const = 0;
+        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
+        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue&);
+        virtual bool toBoolean(ExecState*) const;
+        virtual double toNumber(ExecState*) const;
+        virtual UString toString(ExecState*) const;
+        virtual JSObject* toObject(ExecState*) const;
 
         // Garbage collection.
         void* operator new(size_t, ExecState*);
         void* operator new(size_t, JSGlobalData*);
         void* operator new(size_t, void* placementNewDestination) { return placementNewDestination; }
-        virtual void mark();
-        bool marked() const;
+
+        virtual void markChildren(MarkStack&);
 
         // Object operations, with the toObject operation included.
         virtual const ClassInfo* classInfo() const;
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual void put(ExecState*, unsigned propertyName, JSValue);
-        virtual bool deleteProperty(ExecState*, const Identifier& propertyName, bool checkDontDelete = true);
-        virtual bool deleteProperty(ExecState*, unsigned propertyName, bool checkDontDelete = true);
+        virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
+        virtual bool deleteProperty(ExecState*, unsigned propertyName);
 
         virtual JSObject* toThisObject(ExecState*) const;
         virtual UString toThisString(ExecState*) const;
@@ -108,6 +112,7 @@ namespace JSC {
         Structure* m_structure;
     };
 
+    // FIXME: We should deprecate this and just use JSValue::asCell() instead.
     JSCell* asCell(JSValue);
 
     inline JSCell* asCell(JSValue value)
@@ -120,14 +125,21 @@ namespace JSC {
     {
     }
 
+    // Only used for initializing Collector blocks.
+    inline JSCell::JSCell()
+    {
+    }
+
     inline JSCell::~JSCell()
     {
     }
 
+#if USE(JSVALUE32)
     inline bool JSCell::isNumber() const
     {
         return Heap::isNumber(const_cast<JSCell*>(this));
     }
+#endif
 
     inline bool JSCell::isObject() const
     {
@@ -144,20 +156,8 @@ namespace JSC {
         return m_structure;
     }
 
-    inline bool JSCell::marked() const
+    inline void JSCell::markChildren(MarkStack&)
     {
-        return Heap::isCellMarked(this);
-    }
-
-    inline void JSCell::mark()
-    {
-        return Heap::markCell(this);
-    }
-
-    ALWAYS_INLINE JSCell* JSValue::asCell() const
-    {
-        ASSERT(isCell());
-        return m_ptr;
     }
 
     inline void* JSCell::operator new(size_t size, JSGlobalData* globalData)
@@ -173,126 +173,190 @@ namespace JSC {
 
     inline bool JSValue::isString() const
     {
-        return !JSImmediate::isImmediate(asValue()) && asCell()->isString();
+        return isCell() && asCell()->isString();
     }
 
     inline bool JSValue::isGetterSetter() const
     {
-        return !JSImmediate::isImmediate(asValue()) && asCell()->isGetterSetter();
+        return isCell() && asCell()->isGetterSetter();
     }
 
     inline bool JSValue::isObject() const
     {
-        return !JSImmediate::isImmediate(asValue()) && asCell()->isObject();
+        return isCell() && asCell()->isObject();
     }
 
     inline bool JSValue::getString(UString& s) const
     {
-        return !JSImmediate::isImmediate(asValue()) && asCell()->getString(s);
+        return isCell() && asCell()->getString(s);
     }
 
     inline UString JSValue::getString() const
     {
-        return JSImmediate::isImmediate(asValue()) ? UString() : asCell()->getString();
+        return isCell() ? asCell()->getString() : UString();
     }
 
     inline JSObject* JSValue::getObject() const
     {
-        return JSImmediate::isImmediate(asValue()) ? 0 : asCell()->getObject();
+        return isCell() ? asCell()->getObject() : 0;
     }
 
     inline CallType JSValue::getCallData(CallData& callData)
     {
-        return JSImmediate::isImmediate(asValue()) ? CallTypeNone : asCell()->getCallData(callData);
+        return isCell() ? asCell()->getCallData(callData) : CallTypeNone;
     }
 
     inline ConstructType JSValue::getConstructData(ConstructData& constructData)
     {
-        return JSImmediate::isImmediate(asValue()) ? ConstructTypeNone : asCell()->getConstructData(constructData);
+        return isCell() ? asCell()->getConstructData(constructData) : ConstructTypeNone;
     }
 
     ALWAYS_INLINE bool JSValue::getUInt32(uint32_t& v) const
     {
-        return JSImmediate::isImmediate(asValue()) ? JSImmediate::getUInt32(asValue(), v) : asCell()->getUInt32(v);
+        if (isInt32()) {
+            int32_t i = asInt32();
+            v = static_cast<uint32_t>(i);
+            return i >= 0;
+        }
+        if (isDouble()) {
+            double d = asDouble();
+            v = static_cast<uint32_t>(d);
+            return v == d;
+        }
+        return false;
     }
 
-    ALWAYS_INLINE bool JSValue::getTruncatedInt32(int32_t& v) const
+#if !USE(JSVALUE32_64)
+    ALWAYS_INLINE JSCell* JSValue::asCell() const
     {
-        return JSImmediate::isImmediate(asValue()) ? JSImmediate::getTruncatedInt32(asValue(), v) : asCell()->getTruncatedInt32(v);
+        ASSERT(isCell());
+        return m_ptr;
     }
+#endif // !USE(JSVALUE32_64)
 
-    inline bool JSValue::getTruncatedUInt32(uint32_t& v) const
+    inline JSValue JSValue::toPrimitive(ExecState* exec, PreferredPrimitiveType preferredType) const
     {
-        return JSImmediate::isImmediate(asValue()) ? JSImmediate::getTruncatedUInt32(asValue(), v) : asCell()->getTruncatedUInt32(v);
+        return isCell() ? asCell()->toPrimitive(exec, preferredType) : asValue();
     }
 
-    inline void JSValue::mark()
+    inline bool JSValue::getPrimitiveNumber(ExecState* exec, double& number, JSValue& value)
     {
-        asCell()->mark(); // callers should check !marked() before calling mark(), so this should only be called with cells
+        if (isInt32()) {
+            number = asInt32();
+            value = *this;
+            return true;
+        }
+        if (isDouble()) {
+            number = asDouble();
+            value = *this;
+            return true;
+        }
+        if (isCell())
+            return asCell()->getPrimitiveNumber(exec, number, value);
+        if (isTrue()) {
+            number = 1.0;
+            value = *this;
+            return true;
+        }
+        if (isFalse() || isNull()) {
+            number = 0.0;
+            value = *this;
+            return true;
+        }
+        ASSERT(isUndefined());
+        number = nonInlineNaN();
+        value = *this;
+        return true;
     }
 
-    inline bool JSValue::marked() const
+    inline bool JSValue::toBoolean(ExecState* exec) const
     {
-        return JSImmediate::isImmediate(asValue()) || asCell()->marked();
+        if (isInt32())
+            return asInt32() != 0;
+        if (isDouble())
+            return asDouble() > 0.0 || asDouble() < 0.0; // false for NaN
+        if (isCell())
+            return asCell()->toBoolean(exec);
+        return isTrue(); // false, null, and undefined all convert to false.
     }
 
-    inline JSValue JSValue::toPrimitive(ExecState* exec, PreferredPrimitiveType preferredType) const
+    ALWAYS_INLINE double JSValue::toNumber(ExecState* exec) const
     {
-        return JSImmediate::isImmediate(asValue()) ? asValue() : asCell()->toPrimitive(exec, preferredType);
+        if (isInt32())
+            return asInt32();
+        if (isDouble())
+            return asDouble();
+        if (isCell())
+            return asCell()->toNumber(exec);
+        if (isTrue())
+            return 1.0;
+        return isUndefined() ? nonInlineNaN() : 0; // null and false both convert to 0.
     }
 
-    inline bool JSValue::getPrimitiveNumber(ExecState* exec, double& number, JSValue& value)
+    inline bool JSValue::needsThisConversion() const
     {
-        if (JSImmediate::isImmediate(asValue())) {
-            number = JSImmediate::toDouble(asValue());
-            value = asValue();
+        if (UNLIKELY(!isCell()))
             return true;
-        }
-        return asCell()->getPrimitiveNumber(exec, number, value);
+        return asCell()->structure()->typeInfo().needsThisConversion();
     }
 
-    inline bool JSValue::toBoolean(ExecState* exec) const
+    inline UString JSValue::toThisString(ExecState* exec) const
     {
-        return JSImmediate::isImmediate(asValue()) ? JSImmediate::toBoolean(asValue()) : asCell()->toBoolean(exec);
+        return isCell() ? asCell()->toThisString(exec) : toString(exec);
     }
 
-    ALWAYS_INLINE double JSValue::toNumber(ExecState* exec) const
+    inline JSValue JSValue::getJSNumber()
     {
-        return JSImmediate::isImmediate(asValue()) ? JSImmediate::toDouble(asValue()) : asCell()->toNumber(exec);
+        if (isInt32() || isDouble())
+            return *this;
+        if (isCell())
+            return asCell()->getJSNumber();
+        return JSValue();
     }
 
-    inline UString JSValue::toString(ExecState* exec) const
+    inline JSObject* JSValue::toObject(ExecState* exec) const
     {
-        return JSImmediate::isImmediate(asValue()) ? JSImmediate::toString(asValue()) : asCell()->toString(exec);
+        return isCell() ? asCell()->toObject(exec) : toObjectSlowCase(exec);
     }
 
-    inline JSObject* JSValue::toObject(ExecState* exec) const
+    inline JSObject* JSValue::toThisObject(ExecState* exec) const
     {
-        return JSImmediate::isImmediate(asValue()) ? JSImmediate::toObject(asValue(), exec) : asCell()->toObject(exec);
+        return isCell() ? asCell()->toThisObject(exec) : toThisObjectSlowCase(exec);
     }
 
-    inline JSObject* JSValue::toThisObject(ExecState* exec) const
+    ALWAYS_INLINE void MarkStack::append(JSCell* cell)
     {
-        if (UNLIKELY(JSImmediate::isImmediate(asValue())))
-            return JSImmediate::toThisObject(asValue(), exec);
-        return asCell()->toThisObject(exec);
+        ASSERT(!m_isCheckingForDefaultMarkViolation);
+        ASSERT(cell);
+        if (Heap::isCellMarked(cell))
+            return;
+        Heap::markCell(cell);
+        if (cell->structure()->typeInfo().type() >= CompoundType)
+            m_values.append(cell);
     }
 
-    inline bool JSValue::needsThisConversion() const
+    ALWAYS_INLINE void MarkStack::append(JSValue value)
     {
-        if (UNLIKELY(JSImmediate::isImmediate(asValue())))
-            return true;
-        return asCell()->structure()->typeInfo().needsThisConversion();
+        ASSERT(value);
+        if (value.isCell())
+            append(value.asCell());
     }
 
-    inline UString JSValue::toThisString(ExecState* exec) const
+    inline void Structure::markAggregate(MarkStack& markStack)
     {
-        return JSImmediate::isImmediate(asValue()) ? JSImmediate::toString(asValue()) : asCell()->toThisString(exec);
+        markStack.append(m_prototype);
     }
 
-    inline JSValue JSValue::getJSNumber()
+    inline Heap* Heap::heap(JSValue v)
+    {
+        if (!v.isCell())
+            return 0;
+        return heap(v.asCell());
+    }
+
+    inline Heap* Heap::heap(JSCell* c)
     {
-        return JSImmediate::isNumber(asValue()) ? asValue() : JSImmediate::isImmediate(asValue()) ? JSValue() : asCell()->getJSNumber();
+        return cellBlock(c)->heap;
     }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.cpp
index c8e137e..899518e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.cpp
@@ -1,7 +1,7 @@
 /*
  *  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
  *  Copyright (C) 2007 Maks Orlovich
  *
@@ -45,12 +45,21 @@ ASSERT_CLASS_FITS_IN_CELL(JSFunction);
 
 const ClassInfo JSFunction::info = { "Function", &InternalFunction::info, 0, 0 };
 
+bool JSFunction::isHostFunctionNonInline() const
+{
+    return isHostFunction();
+}
+
+JSFunction::JSFunction(PassRefPtr<Structure> structure)
+    : Base(structure)
+    , m_executable(adoptRef(new VPtrHackExecutable()))
+{
+}
+
 JSFunction::JSFunction(ExecState* exec, PassRefPtr<Structure> structure, int length, const Identifier& name, NativeFunction func)
     : Base(&exec->globalData(), structure, name)
 #if ENABLE(JIT)
-    , m_body(FunctionBodyNode::createNativeThunk(&exec->globalData()))
-#else
-    , m_body(0)
+    , m_executable(adoptRef(new NativeExecutable(exec)))
 #endif
 {
 #if ENABLE(JIT)
@@ -63,32 +72,35 @@ JSFunction::JSFunction(ExecState* exec, PassRefPtr<Structure> structure, int len
 #endif
 }
 
-JSFunction::JSFunction(ExecState* exec, const Identifier& name, FunctionBodyNode* body, ScopeChainNode* scopeChainNode)
-    : Base(&exec->globalData(), exec->lexicalGlobalObject()->functionStructure(), name)
-    , m_body(body)
+JSFunction::JSFunction(ExecState* exec, PassRefPtr<FunctionExecutable> executable, ScopeChainNode* scopeChainNode)
+    : Base(&exec->globalData(), exec->lexicalGlobalObject()->functionStructure(), executable->name())
+    , m_executable(executable)
 {
     setScopeChain(scopeChainNode);
 }
 
 JSFunction::~JSFunction()
 {
-#if ENABLE(JIT) 
     // JIT code for other functions may have had calls linked directly to the code for this function; these links
     // are based on a check for the this pointer value for this JSFunction - which will no longer be valid once
     // this memory is freed and may be reused (potentially for another, different JSFunction).
-    if (m_body && m_body->isGenerated())
-        m_body->generatedBytecode().unlinkCallers();
+    if (!isHostFunction()) {
+#if ENABLE(JIT_OPTIMIZE_CALL)
+        ASSERT(m_executable);
+        if (jsExecutable()->isGenerated())
+            jsExecutable()->generatedBytecode().unlinkCallers();
 #endif
-    if (!isHostFunction())
-        scopeChain().~ScopeChain();
+        scopeChain().~ScopeChain(); // FIXME: Don't we need to do this in the interpreter too?
+    }
 }
 
-void JSFunction::mark()
+void JSFunction::markChildren(MarkStack& markStack)
 {
-    Base::mark();
-    m_body->mark();
-    if (!isHostFunction())
-        scopeChain().mark();
+    Base::markChildren(markStack);
+    if (!isHostFunction()) {
+        jsExecutable()->markAggregate(markStack);
+        scopeChain().markAggregate(markStack);
+    }
 }
 
 CallType JSFunction::getCallData(CallData& callData)
@@ -97,7 +109,7 @@ CallType JSFunction::getCallData(CallData& callData)
         callData.native.function = nativeFunction();
         return CallTypeHost;
     }
-    callData.js.functionBody = m_body.get();
+    callData.js.functionExecutable = jsExecutable();
     callData.js.scopeChain = scopeChain().node();
     return CallTypeJS;
 }
@@ -105,7 +117,7 @@ CallType JSFunction::getCallData(CallData& callData)
 JSValue JSFunction::call(ExecState* exec, JSValue thisValue, const ArgList& args)
 {
     ASSERT(!isHostFunction());
-    return exec->interpreter()->execute(m_body.get(), exec, this, thisValue.toThisObject(exec), args, scopeChain().node(), exec->exceptionSlot());
+    return exec->interpreter()->execute(jsExecutable(), exec, this, thisValue.toThisObject(exec), args, scopeChain().node(), exec->exceptionSlot());
 }
 
 JSValue JSFunction::argumentsGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -126,7 +138,7 @@ JSValue JSFunction::lengthGetter(ExecState* exec, const Identifier&, const Prope
 {
     JSFunction* thisObj = asFunction(slot.slotBase());
     ASSERT(!thisObj->isHostFunction());
-    return jsNumber(exec, thisObj->m_body->parameterCount());
+    return jsNumber(exec, thisObj->jsExecutable()->parameterCount());
 }
 
 bool JSFunction::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -165,6 +177,35 @@ bool JSFunction::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return Base::getOwnPropertySlot(exec, propertyName, slot);
 }
 
+    bool JSFunction::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+    {
+        if (isHostFunction())
+            return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+        
+        if (propertyName == exec->propertyNames().prototype) {
+            PropertySlot slot;
+            getOwnPropertySlot(exec, propertyName, slot);
+            return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+        }
+        
+        if (propertyName == exec->propertyNames().arguments) {
+            descriptor.setDescriptor(exec->interpreter()->retrieveArguments(exec, this), ReadOnly | DontEnum | DontDelete);
+            return true;
+        }
+        
+        if (propertyName == exec->propertyNames().length) {
+            descriptor.setDescriptor(jsNumber(exec, jsExecutable()->parameterCount()), ReadOnly | DontEnum | DontDelete);
+            return true;
+        }
+        
+        if (propertyName == exec->propertyNames().caller) {
+            descriptor.setDescriptor(exec->interpreter()->retrieveCaller(exec, this), ReadOnly | DontEnum | DontDelete);
+            return true;
+        }
+        
+        return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+    }
+    
 void JSFunction::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (isHostFunction()) {
@@ -176,13 +217,13 @@ void JSFunction::put(ExecState* exec, const Identifier& propertyName, JSValue va
     Base::put(exec, propertyName, value, slot);
 }
 
-bool JSFunction::deleteProperty(ExecState* exec, const Identifier& propertyName, bool checkDontDelete)
+bool JSFunction::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
     if (isHostFunction())
-        return Base::deleteProperty(exec, propertyName, checkDontDelete);
+        return Base::deleteProperty(exec, propertyName);
     if (propertyName == exec->propertyNames().arguments || propertyName == exec->propertyNames().length)
         return false;
-    return Base::deleteProperty(exec, propertyName, checkDontDelete);
+    return Base::deleteProperty(exec, propertyName);
 }
 
 // ECMA 13.2.2 [[Construct]]
@@ -190,7 +231,7 @@ ConstructType JSFunction::getConstructData(ConstructData& constructData)
 {
     if (isHostFunction())
         return ConstructTypeNone;
-    constructData.js.functionBody = m_body.get();
+    constructData.js.functionExecutable = jsExecutable();
     constructData.js.scopeChain = scopeChain().node();
     return ConstructTypeJS;
 }
@@ -206,7 +247,7 @@ JSObject* JSFunction::construct(ExecState* exec, const ArgList& args)
         structure = exec->lexicalGlobalObject()->emptyObjectStructure();
     JSObject* thisObj = new (exec) JSObject(structure);
 
-    JSValue result = exec->interpreter()->execute(m_body.get(), exec, this, thisObj, args, scopeChain().node(), exec->exceptionSlot());
+    JSValue result = exec->interpreter()->execute(jsExecutable(), exec, this, thisObj, args, scopeChain().node(), exec->exceptionSlot());
     if (exec->hadException() || !result.isObject())
         return thisObj;
     return asObject(result);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h
index 5ddd97c..019d83b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h
@@ -25,38 +25,25 @@
 #define JSFunction_h
 
 #include "InternalFunction.h"
-#include "JSVariableObject.h"
-#include "SymbolTable.h"
-#include "Nodes.h"
-#include "JSObject.h"
 
 namespace JSC {
 
-    class FunctionBodyNode;
+    class ExecutableBase;
+    class FunctionExecutable;
     class FunctionPrototype;
     class JSActivation;
     class JSGlobalObject;
 
     class JSFunction : public InternalFunction {
         friend class JIT;
-        friend class VPtrSet;
+        friend struct VPtrSet;
 
         typedef InternalFunction Base;
 
-        JSFunction(PassRefPtr<Structure> structure)
-            : InternalFunction(structure)
-        {
-            clearScopeChain();
-        }
-
     public:
         JSFunction(ExecState*, PassRefPtr<Structure>, int length, const Identifier&, NativeFunction);
-        JSFunction(ExecState*, const Identifier&, FunctionBodyNode*, ScopeChainNode*);
-        ~JSFunction();
-
-        virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
-        virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
-        virtual bool deleteProperty(ExecState*, const Identifier& propertyName, bool checkDontDelete = true);
+        JSFunction(ExecState*, PassRefPtr<FunctionExecutable>, ScopeChainNode*);
+        virtual ~JSFunction();
 
         JSObject* construct(ExecState*, const ArgList&);
         JSValue call(ExecState*, JSValue thisValue, const ArgList&);
@@ -64,11 +51,11 @@ namespace JSC {
         void setScope(const ScopeChain& scopeChain) { setScopeChain(scopeChain); }
         ScopeChain& scope() { return scopeChain(); }
 
-        void setBody(FunctionBodyNode* body) { m_body = body; }
-        void setBody(PassRefPtr<FunctionBodyNode> body) { m_body = body; }
-        FunctionBodyNode* body() const { return m_body.get(); }
+        ExecutableBase* executable() const { return m_executable.get(); }
 
-        virtual void mark();
+        // To call either of these methods include Executable.h
+        inline bool isHostFunction() const;
+        FunctionExecutable* jsExecutable() const;
 
         static JS_EXPORTDATA const ClassInfo info;
 
@@ -77,11 +64,6 @@ namespace JSC {
             return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance)); 
         }
 
-#if ENABLE(JIT)
-        bool isHostFunction() const { return m_body && m_body->isHostFunction(); }
-#else
-        bool isHostFunction() const { return false; }
-#endif
         NativeFunction nativeFunction()
         {
             return *reinterpret_cast<NativeFunction*>(m_data);
@@ -91,31 +73,42 @@ namespace JSC {
         virtual CallType getCallData(CallData&);
 
     private:
+        JSFunction(PassRefPtr<Structure>);
+
+        bool isHostFunctionNonInline() const;
+
+        virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+        virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
+        virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
+
+        virtual void markChildren(MarkStack&);
+
         virtual const ClassInfo* classInfo() const { return &info; }
 
         static JSValue argumentsGetter(ExecState*, const Identifier&, const PropertySlot&);
         static JSValue callerGetter(ExecState*, const Identifier&, const PropertySlot&);
         static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
 
-        RefPtr<FunctionBodyNode> m_body;
+        RefPtr<ExecutableBase> m_executable;
         ScopeChain& scopeChain()
         {
-            ASSERT(!isHostFunction());
+            ASSERT(!isHostFunctionNonInline());
             return *reinterpret_cast<ScopeChain*>(m_data);
         }
         void clearScopeChain()
         {
-            ASSERT(!isHostFunction());
+            ASSERT(!isHostFunctionNonInline());
             new (m_data) ScopeChain(NoScopeChain());
         }
         void setScopeChain(ScopeChainNode* sc)
         {
-            ASSERT(!isHostFunction());
+            ASSERT(!isHostFunctionNonInline());
             new (m_data) ScopeChain(sc);
         }
         void setScopeChain(const ScopeChain& sc)
         {
-            ASSERT(!isHostFunction());
+            ASSERT(!isHostFunctionNonInline());
             *reinterpret_cast<ScopeChain*>(m_data) = sc;
         }
         void setNativeFunction(NativeFunction func)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.cpp
index 85d881e..99e266f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.cpp
@@ -33,14 +33,17 @@
 #include "Collector.h"
 #include "CommonIdentifiers.h"
 #include "FunctionConstructor.h"
+#include "GetterSetter.h"
 #include "Interpreter.h"
 #include "JSActivation.h"
+#include "JSAPIValueWrapper.h"
 #include "JSArray.h"
 #include "JSByteArray.h"
 #include "JSClassRef.h"
 #include "JSFunction.h"
 #include "JSLock.h"
 #include "JSNotAnObject.h"
+#include "JSPropertyNameIterator.h"
 #include "JSStaticScopeObject.h"
 #include "Parser.h"
 #include "Lexer.h"
@@ -118,7 +121,10 @@ JSGlobalData::JSGlobalData(bool isShared, const VPtrSet& vptrSet)
     , stringStructure(JSString::createStructure(jsNull()))
     , notAnObjectErrorStubStructure(JSNotAnObjectErrorStub::createStructure(jsNull()))
     , notAnObjectStructure(JSNotAnObject::createStructure(jsNull()))
-#if !USE(ALTERNATE_JSIMMEDIATE)
+    , propertyNameIteratorStructure(JSPropertyNameIterator::createStructure(jsNull()))
+    , getterSetterStructure(GetterSetter::createStructure(jsNull()))
+    , apiWrapperStructure(JSAPIValueWrapper::createStructure(jsNull()))
+#if USE(JSVALUE32)
     , numberStructure(JSNumberCell::createStructure(jsNull()))
 #endif
     , jsArrayVPtr(vptrSet.jsArrayVPtr)
@@ -134,17 +140,17 @@ JSGlobalData::JSGlobalData(bool isShared, const VPtrSet& vptrSet)
 #if ENABLE(JIT)
     , jitStubs(this)
 #endif
-    , timeoutChecker(new TimeoutChecker)
     , heap(this)
     , initializingLazyNumericCompareFunction(false)
     , head(0)
     , dynamicGlobalObject(0)
-    , scopeNodeBeingReparsed(0)
+    , functionCodeBlockBeingReparsed(0)
     , firstStringifierToMark(0)
-{
-#ifdef QT_BUILD_SCRIPT_LIB
-    scriptpool = new SourcePool();
+    , markStack(vptrSet.jsArrayVPtr)
+#ifndef NDEBUG
+    , mainThreadOnly(false)
 #endif
+{
 #if PLATFORM(MAC)
     startProfilerServerIfNeeded();
 #endif
@@ -180,7 +186,6 @@ JSGlobalData::~JSGlobalData()
 
     delete parser;
     delete lexer;
-    delete timeoutChecker;
 
     deleteAllValues(opaqueJSClassData);
 
@@ -190,10 +195,6 @@ JSGlobalData::~JSGlobalData()
     deleteIdentifierTable(identifierTable);
 
     delete clientData;
-#ifdef QT_BUILD_SCRIPT_LIB
-    if (scriptpool)
-        delete scriptpool;
-#endif
 }
 
 PassRefPtr<JSGlobalData> JSGlobalData::create(bool isShared)
@@ -238,9 +239,8 @@ const Vector<Instruction>& JSGlobalData::numericCompareFunction(ExecState* exec)
 {
     if (!lazyNumericCompareFunction.size() && !initializingLazyNumericCompareFunction) {
         initializingLazyNumericCompareFunction = true;
-        RefPtr<ProgramNode> programNode = parser->parse<ProgramNode>(exec, 0, makeSource(UString("(function (v1, v2) { return v1 - v2; })")), 0, 0);
-        RefPtr<FunctionBodyNode> functionBody = extractFunctionBody(programNode.get());
-        lazyNumericCompareFunction = functionBody->bytecode(exec->scopeChain()).instructions();
+        RefPtr<FunctionExecutable> function = FunctionExecutable::fromGlobalCode(Identifier(exec, "numericCompare"), exec, 0, makeSource(UString("(function (v1, v2) { return v1 - v2; })")), 0, 0);
+        lazyNumericCompareFunction = function->bytecode(exec, exec->scopeChain()).instructions();
         initializingLazyNumericCompareFunction = false;
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.h
index fb557af..d547fac 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.h
@@ -33,45 +33,39 @@
 #include "ExecutableAllocator.h"
 #include "JITStubs.h"
 #include "JSValue.h"
+#include "MarkStack.h"
+#include "NumericStrings.h"
 #include "SmallStrings.h"
 #include "TimeoutChecker.h"
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
 #include <wtf/RefCounted.h>
 
-#ifdef QT_BUILD_SCRIPT_LIB
-#include "SourcePoolQt.h"
-#endif
-
 struct OpaqueJSClass;
 struct OpaqueJSClassContextData;
 
 namespace JSC {
 
+    class CodeBlock;
     class CommonIdentifiers;
-    class FunctionBodyNode;
     class IdentifierTable;
-    class Instruction;
     class Interpreter;
     class JSGlobalObject;
     class JSObject;
     class Lexer;
     class Parser;
-    class ScopeNode;
     class Stringifier;
     class Structure;
     class UString;
 
     struct HashTable;
+    struct Instruction;    
     struct VPtrSet;
 
     class JSGlobalData : public RefCounted<JSGlobalData> {
     public:
         struct ClientData {
             virtual ~ClientData() = 0;
-#ifdef QT_BUILD_SCRIPT_LIB
-            virtual void mark() {}
-#endif
         };
 
         static bool sharedInstanceExists();
@@ -104,7 +98,11 @@ namespace JSC {
         RefPtr<Structure> stringStructure;
         RefPtr<Structure> notAnObjectErrorStubStructure;
         RefPtr<Structure> notAnObjectStructure;
-#if !USE(ALTERNATE_JSIMMEDIATE)
+        RefPtr<Structure> propertyNameIteratorStructure;
+        RefPtr<Structure> getterSetterStructure;
+        RefPtr<Structure> apiWrapperStructure;
+
+#if USE(JSVALUE32)
         RefPtr<Structure> numberStructure;
 #endif
 
@@ -117,6 +115,7 @@ namespace JSC {
         CommonIdentifiers* propertyNames;
         const MarkedArgumentBuffer* emptyList; // Lists are supposed to be allocated on the stack to have their elements properly marked, which is not the case here - but this list has nothing to mark.
         SmallStrings smallStrings;
+        NumericStrings numericStrings;
 
 #if ENABLE(ASSEMBLER)
         ExecutableAllocator executableAllocator;
@@ -125,13 +124,10 @@ namespace JSC {
         Lexer* lexer;
         Parser* parser;
         Interpreter* interpreter;
-#ifdef QT_BUILD_SCRIPT_LIB
-        SourcePool* scriptpool;
-#endif
 #if ENABLE(JIT)
         JITThunks jitStubs;
 #endif
-        TimeoutChecker* timeoutChecker;
+        TimeoutChecker timeoutChecker;
         Heap heap;
 
         JSValue exception;
@@ -150,9 +146,15 @@ namespace JSC {
 
         HashSet<JSObject*> arrayVisitedElements;
 
-        ScopeNode* scopeNodeBeingReparsed;
+        CodeBlock* functionCodeBlockBeingReparsed;
         Stringifier* firstStringifierToMark;
 
+        MarkStack markStack;
+
+#ifndef NDEBUG
+        bool mainThreadOnly;
+#endif
+
     private:
         JSGlobalData(bool isShared, const VPtrSet&);
         static JSGlobalData*& sharedInstanceInternal();
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
index 55286d3..3a1909d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -80,16 +80,16 @@ static const int initialTickCountThreshold = 255;
 // Preferred number of milliseconds between each timeout check
 static const int preferredScriptCheckTimeInterval = 1000;
 
-static inline void markIfNeeded(JSValue v)
+static inline void markIfNeeded(MarkStack& markStack, JSValue v)
 {
-    if (v && !v.marked())
-        v.mark();
+    if (v)
+        markStack.append(v);
 }
 
-static inline void markIfNeeded(const RefPtr<Structure>& s)
+static inline void markIfNeeded(MarkStack& markStack, const RefPtr<Structure>& s)
 {
     if (s)
-        s->mark();
+        s->markAggregate(markStack);
 }
 
 JSGlobalObject::~JSGlobalObject()
@@ -112,8 +112,8 @@ JSGlobalObject::~JSGlobalObject()
     if (headObject == this)
         headObject = 0;
 
-    HashSet<ProgramCodeBlock*>::const_iterator end = codeBlocks().end();
-    for (HashSet<ProgramCodeBlock*>::const_iterator it = codeBlocks().begin(); it != end; ++it)
+    HashSet<GlobalCodeBlock*>::const_iterator end = codeBlocks().end();
+    for (HashSet<GlobalCodeBlock*>::const_iterator it = codeBlocks().begin(); it != end; ++it)
         (*it)->clearGlobalObject();
         
     RegisterFile& registerFile = globalData()->interpreter->registerFile();
@@ -256,9 +256,9 @@ void JSGlobalObject::reset(JSValue prototype)
 
     // Constructors
 
-    JSCell* objectConstructor = new (exec) ObjectConstructor(exec, ObjectConstructor::createStructure(d()->functionPrototype), d()->objectPrototype);
+    JSCell* objectConstructor = new (exec) ObjectConstructor(exec, ObjectConstructor::createStructure(d()->functionPrototype), d()->objectPrototype, d()->prototypeFunctionStructure.get());
     JSCell* functionConstructor = new (exec) FunctionConstructor(exec, FunctionConstructor::createStructure(d()->functionPrototype), d()->functionPrototype);
-    JSCell* arrayConstructor = new (exec) ArrayConstructor(exec, ArrayConstructor::createStructure(d()->functionPrototype), d()->arrayPrototype);
+    JSCell* arrayConstructor = new (exec) ArrayConstructor(exec, ArrayConstructor::createStructure(d()->functionPrototype), d()->arrayPrototype, d()->prototypeFunctionStructure.get());
     JSCell* stringConstructor = new (exec) StringConstructor(exec, StringConstructor::createStructure(d()->functionPrototype), d()->prototypeFunctionStructure.get(), d()->stringPrototype);
     JSCell* booleanConstructor = new (exec) BooleanConstructor(exec, BooleanConstructor::createStructure(d()->functionPrototype), d()->booleanPrototype);
     JSCell* numberConstructor = new (exec) NumberConstructor(exec, NumberConstructor::createStructure(d()->functionPrototype), d()->numberPrototype);
@@ -307,12 +307,12 @@ void JSGlobalObject::reset(JSValue prototype)
     putDirectFunctionWithoutTransition(Identifier(exec, "Date"), dateConstructor, DontEnum);
     putDirectFunctionWithoutTransition(Identifier(exec, "RegExp"), d()->regExpConstructor, DontEnum);
     putDirectFunctionWithoutTransition(Identifier(exec, "Error"), d()->errorConstructor, DontEnum);
-    putDirectFunctionWithoutTransition(Identifier(exec, "EvalError"), d()->evalErrorConstructor, DontEnum);
-    putDirectFunctionWithoutTransition(Identifier(exec, "RangeError"), d()->rangeErrorConstructor, DontEnum);
-    putDirectFunctionWithoutTransition(Identifier(exec, "ReferenceError"), d()->referenceErrorConstructor, DontEnum);
-    putDirectFunctionWithoutTransition(Identifier(exec, "SyntaxError"), d()->syntaxErrorConstructor, DontEnum);
-    putDirectFunctionWithoutTransition(Identifier(exec, "TypeError"), d()->typeErrorConstructor, DontEnum);
-    putDirectFunctionWithoutTransition(Identifier(exec, "URIError"), d()->URIErrorConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(Identifier(exec, "EvalError"), d()->evalErrorConstructor);
+    putDirectFunctionWithoutTransition(Identifier(exec, "RangeError"), d()->rangeErrorConstructor);
+    putDirectFunctionWithoutTransition(Identifier(exec, "ReferenceError"), d()->referenceErrorConstructor);
+    putDirectFunctionWithoutTransition(Identifier(exec, "SyntaxError"), d()->syntaxErrorConstructor);
+    putDirectFunctionWithoutTransition(Identifier(exec, "TypeError"), d()->typeErrorConstructor);
+    putDirectFunctionWithoutTransition(Identifier(exec, "URIError"), d()->URIErrorConstructor);
 
     // Set global values.
     GlobalPropertyInfo staticGlobals[] = {
@@ -340,10 +340,8 @@ void JSGlobalObject::reset(JSValue prototype)
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "encodeURI"), globalFuncEncodeURI), DontEnum);
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "encodeURIComponent"), globalFuncEncodeURIComponent), DontEnum);
 #ifndef NDEBUG
-#ifndef QT_BUILD_SCRIPT_LIB
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "jscprint"), globalFuncJSCPrint), DontEnum);
 #endif
-#endif
 
     resetPrototype(prototype);
 }
@@ -359,43 +357,43 @@ void JSGlobalObject::resetPrototype(JSValue prototype)
         oldLastInPrototypeChain->setPrototype(objectPrototype);
 }
 
-void JSGlobalObject::mark()
+void JSGlobalObject::markChildren(MarkStack& markStack)
 {
-    JSVariableObject::mark();
+    JSVariableObject::markChildren(markStack);
     
-    HashSet<ProgramCodeBlock*>::const_iterator end = codeBlocks().end();
-    for (HashSet<ProgramCodeBlock*>::const_iterator it = codeBlocks().begin(); it != end; ++it)
-        (*it)->mark();
+    HashSet<GlobalCodeBlock*>::const_iterator end = codeBlocks().end();
+    for (HashSet<GlobalCodeBlock*>::const_iterator it = codeBlocks().begin(); it != end; ++it)
+        (*it)->markAggregate(markStack);
 
     RegisterFile& registerFile = globalData()->interpreter->registerFile();
     if (registerFile.globalObject() == this)
-        registerFile.markGlobals(&globalData()->heap);
-
-    markIfNeeded(d()->regExpConstructor);
-    markIfNeeded(d()->errorConstructor);
-    markIfNeeded(d()->evalErrorConstructor);
-    markIfNeeded(d()->rangeErrorConstructor);
-    markIfNeeded(d()->referenceErrorConstructor);
-    markIfNeeded(d()->syntaxErrorConstructor);
-    markIfNeeded(d()->typeErrorConstructor);
-    markIfNeeded(d()->URIErrorConstructor);
-
-    markIfNeeded(d()->evalFunction);
-    markIfNeeded(d()->callFunction);
-    markIfNeeded(d()->applyFunction);
-
-    markIfNeeded(d()->objectPrototype);
-    markIfNeeded(d()->functionPrototype);
-    markIfNeeded(d()->arrayPrototype);
-    markIfNeeded(d()->booleanPrototype);
-    markIfNeeded(d()->stringPrototype);
-    markIfNeeded(d()->numberPrototype);
-    markIfNeeded(d()->datePrototype);
-    markIfNeeded(d()->regExpPrototype);
-
-    markIfNeeded(d()->methodCallDummy);
-
-    markIfNeeded(d()->errorStructure);
+        registerFile.markGlobals(markStack, &globalData()->heap);
+
+    markIfNeeded(markStack, d()->regExpConstructor);
+    markIfNeeded(markStack, d()->errorConstructor);
+    markIfNeeded(markStack, d()->evalErrorConstructor);
+    markIfNeeded(markStack, d()->rangeErrorConstructor);
+    markIfNeeded(markStack, d()->referenceErrorConstructor);
+    markIfNeeded(markStack, d()->syntaxErrorConstructor);
+    markIfNeeded(markStack, d()->typeErrorConstructor);
+    markIfNeeded(markStack, d()->URIErrorConstructor);
+
+    markIfNeeded(markStack, d()->evalFunction);
+    markIfNeeded(markStack, d()->callFunction);
+    markIfNeeded(markStack, d()->applyFunction);
+
+    markIfNeeded(markStack, d()->objectPrototype);
+    markIfNeeded(markStack, d()->functionPrototype);
+    markIfNeeded(markStack, d()->arrayPrototype);
+    markIfNeeded(markStack, d()->booleanPrototype);
+    markIfNeeded(markStack, d()->stringPrototype);
+    markIfNeeded(markStack, d()->numberPrototype);
+    markIfNeeded(markStack, d()->datePrototype);
+    markIfNeeded(markStack, d()->regExpPrototype);
+
+    markIfNeeded(markStack, d()->methodCallDummy);
+
+    markIfNeeded(markStack, d()->errorStructure);
 
     // No need to mark the other structures, because their prototypes are all
     // guaranteed to be referenced elsewhere.
@@ -405,11 +403,7 @@ void JSGlobalObject::mark()
         return;
 
     size_t size = d()->registerArraySize;
-    for (size_t i = 0; i < size; ++i) {
-        Register& r = registerArray[i];
-        if (!r.marked())
-            r.mark();
-    }
+    markStack.appendValues(reinterpret_cast<JSValue*>(registerArray), size);
 }
 
 ExecState* JSGlobalObject::globalExec()
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
index 98e9b68..d1150cc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 2007 Eric Seidel <eric@webkit.org>
- *  Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -27,14 +27,9 @@
 #include "NativeFunctionWrapper.h"
 #include "NumberPrototype.h"
 #include "StringPrototype.h"
-#include "StructureChain.h"
 #include <wtf/HashSet.h>
 #include <wtf/OwnPtr.h>
 
-#ifdef QT_BUILD_SCRIPT_LIB
-#include "SourcePoolQt.h"
-#endif
-
 namespace JSC {
 
     class ArrayPrototype;
@@ -43,6 +38,7 @@ namespace JSC {
     class Debugger;
     class ErrorConstructor;
     class FunctionPrototype;
+    class GlobalCodeBlock;
     class GlobalEvalFunction;
     class NativeErrorConstructor;
     class ProgramCodeBlock;
@@ -149,7 +145,7 @@ namespace JSC {
 
             RefPtr<JSGlobalData> globalData;
 
-            HashSet<ProgramCodeBlock*> codeBlocks;
+            HashSet<GlobalCodeBlock*> codeBlocks;
         };
 
     public:
@@ -171,9 +167,10 @@ namespace JSC {
     public:
         virtual ~JSGlobalObject();
 
-        virtual void mark();
+        virtual void markChildren(MarkStack&);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
         virtual bool hasOwnPropertyForWrite(ExecState*, const Identifier&);
         virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
         virtual void putWithAttributes(ExecState*, const Identifier& propertyName, JSValue value, unsigned attributes);
@@ -231,13 +228,7 @@ namespace JSC {
         unsigned profileGroup() const { return d()->profileGroup; }
 
         Debugger* debugger() const { return d()->debugger; }
-        void setDebugger(Debugger* debugger)
-        {
-#ifdef QT_BUILD_SCRIPT_LIB
-            globalData()->scriptpool->setDebugger(debugger);
-#endif
-            d()->debugger = debugger;
-        }
+        void setDebugger(Debugger* debugger) { d()->debugger = debugger; }
         
         virtual bool supportsProfiling() const { return false; }
         
@@ -257,7 +248,7 @@ namespace JSC {
 
         virtual bool isDynamicScope() const;
 
-        HashSet<ProgramCodeBlock*>& codeBlocks() { return d()->codeBlocks; }
+        HashSet<GlobalCodeBlock*>& codeBlocks() { return d()->codeBlocks; }
 
         void copyGlobalsFrom(RegisterFile&);
         void copyGlobalsTo(RegisterFile&);
@@ -336,6 +327,13 @@ namespace JSC {
         return symbolTableGet(propertyName, slot);
     }
 
+    inline bool JSGlobalObject::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+    {
+        if (symbolTableGet(propertyName, descriptor))
+            return true;
+        return JSVariableObject::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+    }
+
     inline bool JSGlobalObject::hasOwnPropertyForWrite(ExecState* exec, const Identifier& propertyName)
     {
         PropertySlot slot;
@@ -358,11 +356,16 @@ namespace JSC {
         if (typeInfo().type() == ObjectType)
             return m_prototype;
 
+#if USE(JSVALUE32)
         if (typeInfo().type() == StringType)
             return exec->lexicalGlobalObject()->stringPrototype();
 
         ASSERT(typeInfo().type() == NumberType);
         return exec->lexicalGlobalObject()->numberPrototype();
+#else
+        ASSERT(typeInfo().type() == StringType);
+        return exec->lexicalGlobalObject()->stringPrototype();
+#endif
     }
 
     inline StructureChain* Structure::prototypeChain(ExecState* exec) const
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
index 85f92f2..b11070f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
@@ -286,16 +286,12 @@ JSValue JSC_HOST_CALL globalFuncEval(ExecState* exec, JSObject* function, JSValu
     if (JSValue parsedObject = preparser.tryLiteralParse())
         return parsedObject;
 
-    int errLine;
-    UString errMsg;
+    EvalExecutable eval(makeSource(s));
+    JSObject* error = eval.compile(exec, static_cast<JSGlobalObject*>(unwrappedObject)->globalScopeChain().node());
+    if (error)
+        return throwError(exec, error);
 
-    SourceCode source = makeSource(s);
-    RefPtr<EvalNode> evalNode = exec->globalData().parser->parse<EvalNode>(exec, exec->dynamicGlobalObject()->debugger(), source, &errLine, &errMsg);
-
-    if (!evalNode)
-        return throwError(exec, SyntaxError, errMsg, errLine, source.provider()->asID(), NULL);
-
-    return exec->interpreter()->execute(evalNode.get(), exec, thisObject, static_cast<JSGlobalObject*>(unwrappedObject)->globalScopeChain().node(), exec->exceptionSlot());
+    return exec->interpreter()->execute(&eval, exec, thisObject, static_cast<JSGlobalObject*>(unwrappedObject)->globalScopeChain().node(), exec->exceptionSlot());
 }
 
 JSValue JSC_HOST_CALL globalFuncParseInt(ExecState* exec, JSObject*, JSValue, const ArgList& args)
@@ -303,14 +299,18 @@ JSValue JSC_HOST_CALL globalFuncParseInt(ExecState* exec, JSObject*, JSValue, co
     JSValue value = args.at(0);
     int32_t radix = args.at(1).toInt32(exec);
 
-    if (value.isNumber() && (radix == 0 || radix == 10)) {
-        if (value.isInt32Fast())
-            return value;
-        double d = value.uncheckedGetNumber();
+    if (radix != 0 && radix != 10)
+        return jsNumber(exec, parseInt(value.toString(exec), radix));
+
+    if (value.isInt32())
+        return value;
+
+    if (value.isDouble()) {
+        double d = value.asDouble();
         if (isfinite(d))
             return jsNumber(exec, (d > 0) ? floor(d) : ceil(d));
         if (isnan(d) || isinf(d))
-            return jsNaN(&exec->globalData());
+            return jsNaN(exec);
         return jsNumber(exec, 0);
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.cpp
index 201e56c..846238d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.cpp
@@ -21,83 +21,6 @@
 #include "config.h"
 #include "JSImmediate.h"
 
-#include "BooleanConstructor.h"
-#include "BooleanPrototype.h"
-#include "Error.h"
-#include "ExceptionHelpers.h"
-#include "JSGlobalObject.h"
-#include "JSNotAnObject.h"
-#include "NumberConstructor.h"
-#include "NumberPrototype.h"
-
 namespace JSC {
 
-JSObject* JSImmediate::toThisObject(JSValue v, ExecState* exec)
-{
-    ASSERT(isImmediate(v));
-    if (isNumber(v))
-        return constructNumber(exec, v);
-    if (isBoolean(v))
-        return constructBooleanFromImmediateBoolean(exec, v);
-    ASSERT(v.isUndefinedOrNull());
-    return exec->globalThisValue();
-}
-
-JSObject* JSImmediate::toObject(JSValue v, ExecState* exec)
-{
-    ASSERT(isImmediate(v));
-    if (isNumber(v))
-        return constructNumber(exec, v);
-    if (isBoolean(v))
-        return constructBooleanFromImmediateBoolean(exec, v);
-    
-    JSNotAnObjectErrorStub* exception = createNotAnObjectErrorStub(exec, v.isNull());
-    exec->setException(exception);
-    return new (exec) JSNotAnObject(exec, exception);
-}
-
-JSObject* JSImmediate::prototype(JSValue v, ExecState* exec)
-{
-    ASSERT(isImmediate(v));
-    if (isNumber(v))
-        return exec->lexicalGlobalObject()->numberPrototype();
-    if (isBoolean(v))
-        return exec->lexicalGlobalObject()->booleanPrototype();
-
-    JSNotAnObjectErrorStub* exception = createNotAnObjectErrorStub(exec, v.isNull());
-    exec->setException(exception);
-    return new (exec) JSNotAnObject(exec, exception);
-}
-
-UString JSImmediate::toString(JSValue v)
-{
-    ASSERT(isImmediate(v));
-    if (isIntegerNumber(v))
-        return UString::from(getTruncatedInt32(v));
-#if USE(ALTERNATE_JSIMMEDIATE)
-    if (isNumber(v)) {
-        ASSERT(isDoubleNumber(v));
-        double value = doubleValue(v);
-        if (value == 0.0) // +0.0 or -0.0
-            return "0";
-        return UString::from(value);
-    }
-#else
-        ASSERT(!isNumber(v));
-#endif
-    if (jsBoolean(false) == v)
-        return "false";
-    if (jsBoolean(true) == v)
-        return "true";
-    if (v.isNull())
-        return "null";
-    ASSERT(v.isUndefined());
-    return "undefined";
-}
-
-NEVER_INLINE double JSImmediate::nonInlineNaN()
-{
-    return std::numeric_limits<double>::quiet_NaN();
-}
-
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.h
index e7d7847..4ed35fc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.h
@@ -22,6 +22,10 @@
 #ifndef JSImmediate_h
 #define JSImmediate_h
 
+#include <wtf/Platform.h>
+
+#if !USE(JSVALUE32_64)
+
 #include <wtf/Assertions.h>
 #include <wtf/AlwaysInline.h>
 #include <wtf/MathExtras.h>
@@ -42,7 +46,7 @@ namespace JSC {
     class JSObject;
     class UString;
 
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
     inline intptr_t reinterpretDoubleToIntptr(double value)
     {
         return WTF::bitwise_cast<intptr_t>(value);
@@ -98,7 +102,7 @@ namespace JSC {
 
     /*
      * On 64-bit platforms, we support an alternative encoding form for immediates, if
-     * USE(ALTERNATE_JSIMMEDIATE) is defined.  When this format is used, double precision
+     * USE(JSVALUE64) is defined.  When this format is used, double precision
      * floating point values may also be encoded as JSImmediates.
      *
      * The encoding makes use of unused NaN space in the IEEE754 representation.  Any value
@@ -130,11 +134,7 @@ namespace JSC {
      */
 
     class JSImmediate {
-#ifdef QT_BUILD_SCRIPT_LIB
-    public: // QtScript needs isImmediate() and from() functions
-#else
     private:
-#endif
         friend class JIT;
         friend class JSValue;
         friend class JSFastMath;
@@ -159,7 +159,7 @@ namespace JSC {
         friend JSValue jsNumber(JSGlobalData* globalData, long long i);
         friend JSValue jsNumber(JSGlobalData* globalData, unsigned long long i);
 
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
         // If all bits in the mask are set, this indicates an integer number,
         // if any but not all are set this value is a double precision number.
         static const intptr_t TagTypeNumber = 0xffff000000000000ll;
@@ -181,7 +181,7 @@ namespace JSC {
         static const intptr_t FullTagTypeUndefined = TagBitTypeOther | ExtendedTagBitUndefined;
         static const intptr_t FullTagTypeNull      = TagBitTypeOther;
 
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
         static const int32_t IntegerPayloadShift  = 0;
 #else
         static const int32_t IntegerPayloadShift  = 1;
@@ -204,15 +204,15 @@ namespace JSC {
 
         static ALWAYS_INLINE bool isIntegerNumber(JSValue v)
         {
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
             return (rawValue(v) & TagTypeNumber) == TagTypeNumber;
 #else
             return isNumber(v);
 #endif
         }
 
-#if USE(ALTERNATE_JSIMMEDIATE)
-        static ALWAYS_INLINE bool isDoubleNumber(JSValue v)
+#if USE(JSVALUE64)
+        static ALWAYS_INLINE bool isDouble(JSValue v)
         {
             return isNumber(v) && !isIntegerNumber(v);
         }
@@ -260,7 +260,7 @@ namespace JSC {
 
         static ALWAYS_INLINE bool areBothImmediateIntegerNumbers(JSValue v1, JSValue v2)
         {
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
             return (rawValue(v1) & rawValue(v2) & TagTypeNumber) == TagTypeNumber;
 #else
             return rawValue(v1) & rawValue(v2) & TagTypeNumber;
@@ -269,9 +269,6 @@ namespace JSC {
 
         static double toDouble(JSValue);
         static bool toBoolean(JSValue);
-        static JSObject* toObject(JSValue, ExecState*);
-        static JSObject* toThisObject(JSValue, ExecState*);
-        static UString toString(JSValue);
 
         static bool getUInt32(JSValue, uint32_t&);
         static bool getTruncatedInt32(JSValue, int32_t&);
@@ -287,10 +284,8 @@ namespace JSC {
         static JSValue zeroImmediate();
         static JSValue oneImmediate();
 
-        static JSObject* prototype(JSValue, ExecState*);
-
     private:
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
         static const int minImmediateInt = ((-INT_MAX) - 1);
         static const int maxImmediateInt = INT_MAX;
 #else
@@ -304,10 +299,10 @@ namespace JSC {
             return JSValue::makeImmediate(integer);
         }
 
-        // With USE(ALTERNATE_JSIMMEDIATE) we want the argument to be zero extended, so the
+        // With USE(JSVALUE64) we want the argument to be zero extended, so the
         // integer doesn't interfere with the tag bits in the upper word.  In the default encoding,
         // if intptr_t id larger then int32_t we sign extend the value through the upper word.
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
         static ALWAYS_INLINE JSValue makeInt(uint32_t value)
 #else
         static ALWAYS_INLINE JSValue makeInt(int32_t value)
@@ -316,7 +311,7 @@ namespace JSC {
             return makeValue((static_cast<intptr_t>(value) << IntegerPayloadShift) | TagTypeNumber);
         }
         
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
         static ALWAYS_INLINE JSValue makeDouble(double value)
         {
             return makeValue(reinterpretDoubleToIntptr(value) + DoubleEncodeOffset);
@@ -341,7 +336,7 @@ namespace JSC {
         template<typename T>
         static JSValue fromNumberOutsideIntegerRange(T);
 
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
         static ALWAYS_INLINE double doubleValue(JSValue v)
         {
             return reinterpretIntptrToDouble(rawValue(v) - DoubleEncodeOffset);
@@ -367,8 +362,6 @@ namespace JSC {
         {
             return v.immediateValue();
         }
-
-        static double nonInlineNaN();
     };
 
     ALWAYS_INLINE JSValue JSImmediate::trueImmediate() { return makeBool(true); }
@@ -378,7 +371,7 @@ namespace JSC {
     ALWAYS_INLINE JSValue JSImmediate::zeroImmediate() { return makeInt(0); }
     ALWAYS_INLINE JSValue JSImmediate::oneImmediate() { return makeInt(1); }
 
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
     inline bool doubleToBoolean(double value)
     {
         return value < 0.0 || value > 0.0;
@@ -405,7 +398,7 @@ namespace JSC {
         return intValue(v);
     }
 
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
     template<typename T>
     inline JSValue JSImmediate::fromNumberOutsideIntegerRange(T value)
     {
@@ -446,7 +439,7 @@ namespace JSC {
 
     ALWAYS_INLINE JSValue JSImmediate::from(int i)
     {
-#if !USE(ALTERNATE_JSIMMEDIATE)
+#if !USE(JSVALUE64)
         if ((i < minImmediateInt) | (i > maxImmediateInt))
             return fromNumberOutsideIntegerRange(i);
 #endif
@@ -512,9 +505,9 @@ namespace JSC {
         if (isIntegerNumber(v))
             return intValue(v);
 
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
         if (isNumber(v)) {
-            ASSERT(isDoubleNumber(v));
+            ASSERT(isDouble(v));
             return doubleValue(v);
         }
 #else
@@ -545,12 +538,6 @@ namespace JSC {
         return getUInt32(v, i);
     }
 
-    // These are identical logic to the JSValue functions above, and faster than jsNumber(number).toInt32().
-    int32_t toInt32(double);
-    uint32_t toUInt32(double);
-    int32_t toInt32SlowCase(double, bool& ok);
-    uint32_t toUInt32SlowCase(double, bool& ok);
-
     inline JSValue::JSValue(JSNullTag)
     {
         *this = JSImmediate::nullImmediate();
@@ -581,6 +568,16 @@ namespace JSC {
         return JSImmediate::isBoolean(asValue());
     }
 
+    inline bool JSValue::isTrue() const
+    {
+        return asValue() == JSImmediate::trueImmediate();
+    }
+
+    inline bool JSValue::isFalse() const
+    {
+        return asValue() == JSImmediate::falseImmediate();
+    }
+
     inline bool JSValue::getBoolean(bool& v) const
     {
         if (JSImmediate::isBoolean(asValue())) {
@@ -596,99 +593,33 @@ namespace JSC {
         return asValue() == jsBoolean(true);
     }
 
-    ALWAYS_INLINE int32_t JSValue::toInt32(ExecState* exec) const
-    {
-        int32_t i;
-        if (getTruncatedInt32(i))
-            return i;
-        bool ignored;
-        return toInt32SlowCase(toNumber(exec), ignored);
-    }
-
-    inline uint32_t JSValue::toUInt32(ExecState* exec) const
-    {
-        uint32_t i;
-        if (getTruncatedUInt32(i))
-            return i;
-        bool ignored;
-        return toUInt32SlowCase(toNumber(exec), ignored);
-    }
-
-    inline int32_t toInt32(double val)
-    {
-        if (!(val >= -2147483648.0 && val < 2147483648.0)) {
-            bool ignored;
-            return toInt32SlowCase(val, ignored);
-        }
-        return static_cast<int32_t>(val);
-    }
-
-    inline uint32_t toUInt32(double val)
-    {
-        if (!(val >= 0.0 && val < 4294967296.0)) {
-            bool ignored;
-            return toUInt32SlowCase(val, ignored);
-        }
-        return static_cast<uint32_t>(val);
-    }
-
-    inline int32_t JSValue::toInt32(ExecState* exec, bool& ok) const
-    {
-        int32_t i;
-        if (getTruncatedInt32(i)) {
-            ok = true;
-            return i;
-        }
-        return toInt32SlowCase(toNumber(exec), ok);
-    }
-
-    inline uint32_t JSValue::toUInt32(ExecState* exec, bool& ok) const
-    {
-        uint32_t i;
-        if (getTruncatedUInt32(i)) {
-            ok = true;
-            return i;
-        }
-        return toUInt32SlowCase(toNumber(exec), ok);
-    }
-
     inline bool JSValue::isCell() const
     {
         return !JSImmediate::isImmediate(asValue());
     }
 
-    inline bool JSValue::isInt32Fast() const
+    inline bool JSValue::isInt32() const
     {
         return JSImmediate::isIntegerNumber(asValue());
     }
 
-    inline int32_t JSValue::getInt32Fast() const
+    inline int32_t JSValue::asInt32() const
     {
-        ASSERT(isInt32Fast());
+        ASSERT(isInt32());
         return JSImmediate::getTruncatedInt32(asValue());
     }
 
-    inline bool JSValue::isUInt32Fast() const
+    inline bool JSValue::isUInt32() const
     {
         return JSImmediate::isPositiveIntegerNumber(asValue());
     }
 
-    inline uint32_t JSValue::getUInt32Fast() const
+    inline uint32_t JSValue::asUInt32() const
     {
-        ASSERT(isUInt32Fast());
+        ASSERT(isUInt32());
         return JSImmediate::getTruncatedUInt32(asValue());
     }
 
-    inline JSValue JSValue::makeInt32Fast(int32_t i)
-    {
-        return JSImmediate::from(i);
-    }
-
-    inline bool JSValue::areBothInt32Fast(JSValue v1, JSValue v2)
-    {
-        return JSImmediate::areBothImmediateIntegerNumbers(v1, v2);
-    }
-
     class JSFastMath {
     public:
         static ALWAYS_INLINE bool canDoFastBitwiseOperations(JSValue v1, JSValue v2)
@@ -739,7 +670,7 @@ namespace JSC {
         static ALWAYS_INLINE JSValue rightShiftImmediateNumbers(JSValue val, JSValue shift)
         {
             ASSERT(canDoFastRshift(val, shift) || canDoFastUrshift(val, shift));
-#if USE(ALTERNATE_JSIMMEDIATE)
+#if USE(JSVALUE64)
             return JSImmediate::makeValue(static_cast<intptr_t>(static_cast<uint32_t>(static_cast<int32_t>(JSImmediate::rawValue(val)) >> ((JSImmediate::rawValue(shift) >> JSImmediate::IntegerPayloadShift) & 0x1f))) | JSImmediate::TagTypeNumber);
 #else
             return JSImmediate::makeValue((JSImmediate::rawValue(val) >> ((JSImmediate::rawValue(shift) >> JSImmediate::IntegerPayloadShift) & 0x1f)) | JSImmediate::TagTypeNumber);
@@ -787,4 +718,6 @@ namespace JSC {
 
 } // namespace JSC
 
+#endif // !USE(JSVALUE32_64)
+
 #endif // JSImmediate_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.cpp
index fb9cfe8..c36dc10 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -74,11 +74,10 @@ JSObject* JSNotAnObject::toObject(ExecState* exec) const
 }
 
 // Marking
-void JSNotAnObject::mark()
+void JSNotAnObject::markChildren(MarkStack& markStack)
 {
-    JSCell::mark();
-    if (!m_exception->marked())
-        m_exception->mark();
+    JSObject::markChildren(markStack);
+    markStack.append(m_exception);
 }
 
 // JSObject methods
@@ -94,6 +93,12 @@ bool JSNotAnObject::getOwnPropertySlot(ExecState* exec, unsigned, PropertySlot&)
     return false;
 }
 
+bool JSNotAnObject::getOwnPropertyDescriptor(ExecState* exec, const Identifier&, PropertyDescriptor&)
+{
+    ASSERT_UNUSED(exec, exec->hadException() && exec->exception() == m_exception);
+    return false;
+}
+
 void JSNotAnObject::put(ExecState* exec, const Identifier& , JSValue, PutPropertySlot&)
 {
     ASSERT_UNUSED(exec, exec->hadException() && exec->exception() == m_exception);
@@ -116,7 +121,7 @@ bool JSNotAnObject::deleteProperty(ExecState* exec, unsigned)
     return false;
 }
 
-void JSNotAnObject::getPropertyNames(ExecState* exec, PropertyNameArray&, unsigned)
+void JSNotAnObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray&)
 {
     ASSERT_UNUSED(exec, exec->hadException() && exec->exception() == m_exception);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h
index 0aca63b..0d9aca6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -75,11 +75,12 @@ namespace JSC {
         virtual JSObject* toObject(ExecState*) const;
 
         // Marking
-        virtual void mark();
+        virtual void markChildren(MarkStack&);
 
         // JSObject methods
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual void put(ExecState*, unsigned propertyName, JSValue);
@@ -87,7 +88,7 @@ namespace JSC {
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual bool deleteProperty(ExecState*, unsigned propertyName);
 
-        virtual void getPropertyNames(ExecState*, PropertyNameArray&, unsigned listedAttributes = Structure::Prototype);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
 
         JSNotAnObjectErrorStub* m_exception;
     };
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.cpp
index 669440b..f1009b9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.cpp
@@ -23,13 +23,13 @@
 #include "config.h"
 #include "JSNumberCell.h"
 
+#if USE(JSVALUE32)
+
 #include "NumberObject.h"
 #include "UString.h"
 
 namespace JSC {
 
-#if !USE(ALTERNATE_JSIMMEDIATE)
-
 JSValue JSNumberCell::toPrimitive(ExecState*, PreferredPrimitiveType) const
 {
     return const_cast<JSNumberCell*>(this);
@@ -54,15 +54,11 @@ double JSNumberCell::toNumber(ExecState*) const
 
 UString JSNumberCell::toString(ExecState*) const
 {
-    if (m_value == 0.0) // +0.0 or -0.0
-        return "0";
     return UString::from(m_value);
 }
 
 UString JSNumberCell::toThisString(ExecState*) const
 {
-    if (m_value == 0.0) // +0.0 or -0.0
-        return "0";
     return UString::from(m_value);
 }
 
@@ -82,22 +78,6 @@ bool JSNumberCell::getUInt32(uint32_t& uint32) const
     return uint32 == m_value;
 }
 
-bool JSNumberCell::getTruncatedInt32(int32_t& int32) const
-{
-    if (!(m_value >= -2147483648.0 && m_value < 2147483648.0))
-        return false;
-    int32 = static_cast<int32_t>(m_value);
-    return true;
-}
-
-bool JSNumberCell::getTruncatedUInt32(uint32_t& uint32) const
-{
-    if (!(m_value >= 0.0 && m_value < 4294967296.0))
-        return false;
-    uint32 = static_cast<uint32_t>(m_value);
-    return true;
-}
-
 JSValue JSNumberCell::getJSNumber()
 {
     return this;
@@ -113,25 +93,21 @@ JSValue jsNumberCell(JSGlobalData* globalData, double d)
     return new (globalData) JSNumberCell(globalData, d);
 }
 
-JSValue jsAPIMangledNumber(ExecState* exec, double d)
-{
-    return new (exec) JSNumberCell(JSNumberCell::APIMangled, d);
-}
+} // namespace JSC
 
-#else
+#else // USE(JSVALUE32)
 
-JSValue jsNumberCell(ExecState*, double)
-{
-    ASSERT_NOT_REACHED();
-    return JSValue();
-}
+// Keep our exported symbols lists happy.
+namespace JSC {
+
+JSValue jsNumberCell(ExecState*, double);
 
-JSValue jsAPIMangledNumber(ExecState*, double)
+JSValue jsNumberCell(ExecState*, double)
 {
     ASSERT_NOT_REACHED();
     return JSValue();
 }
 
-#endif
-
 } // namespace JSC
+
+#endif // USE(JSVALUE32)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h
index a35e210..6a48081 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h
@@ -35,10 +35,8 @@ namespace JSC {
     extern const double NaN;
     extern const double Inf;
 
+#if USE(JSVALUE32)
     JSValue jsNumberCell(ExecState*, double);
-    JSValue jsAPIMangledNumber(ExecState*, double);
-
-#if !USE(ALTERNATE_JSIMMEDIATE)
 
     class Identifier;
     class JSCell;
@@ -53,7 +51,7 @@ namespace JSC {
         friend class JIT;
         friend JSValue jsNumberCell(JSGlobalData*, double);
         friend JSValue jsNumberCell(ExecState*, double);
-        friend JSValue jsAPIMangledNumber(ExecState*, double);
+
     public:
         double value() const { return m_value; }
 
@@ -68,9 +66,6 @@ namespace JSC {
         virtual JSObject* toThisObject(ExecState*) const;
         virtual JSValue getJSNumber();
 
-        static const uintptr_t JSAPIMangledMagicNumber = 0xbbadbeef;
-        bool isAPIMangledNumber() const { return m_structure == reinterpret_cast<Structure*>(JSAPIMangledMagicNumber); }
-
         void* operator new(size_t size, ExecState* exec)
         {
     #ifdef JAVASCRIPTCORE_BUILDING_ALL_IN_ONE_FILE
@@ -89,7 +84,7 @@ namespace JSC {
     #endif
         }
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(NumberType, NeedsThisConversion)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(NumberType, NeedsThisConversion | HasDefaultMark)); }
 
     private:
         JSNumberCell(JSGlobalData* globalData, double value)
@@ -104,16 +99,7 @@ namespace JSC {
         {
         }
 
-        enum APIMangledTag { APIMangled };
-        JSNumberCell(APIMangledTag, double value)
-            : JSCell(reinterpret_cast<Structure*>(JSAPIMangledMagicNumber))
-            , m_value(value)
-        {
-        }
-
         virtual bool getUInt32(uint32_t&) const;
-        virtual bool getTruncatedInt32(int32_t&) const;
-        virtual bool getTruncatedUInt32(uint32_t&) const;
 
         double m_value;
     };
@@ -131,7 +117,6 @@ namespace JSC {
         return static_cast<JSNumberCell*>(v.asCell());
     }
 
-
     inline JSValue::JSValue(ExecState* exec, double d)
     {
         JSValue v = JSImmediate::from(d);
@@ -192,59 +177,30 @@ namespace JSC {
         *this = v ? v : jsNumberCell(globalData, i);
     }
 
-    inline JSValue::JSValue(JSGlobalData* globalData, long i)
-    {
-        JSValue v = JSImmediate::from(i);
-        *this = v ? v : jsNumberCell(globalData, i);
-    }
-
-    inline JSValue::JSValue(JSGlobalData* globalData, unsigned long i)
-    {
-        JSValue v = JSImmediate::from(i);
-        *this = v ? v : jsNumberCell(globalData, i);
-    }
-
-    inline JSValue::JSValue(JSGlobalData* globalData, long long i)
-    {
-        JSValue v = JSImmediate::from(i);
-        *this = v ? v : jsNumberCell(globalData, static_cast<double>(i));
-    }
-
-    inline JSValue::JSValue(JSGlobalData* globalData, unsigned long long i)
-    {
-        JSValue v = JSImmediate::from(i);
-        *this = v ? v : jsNumberCell(globalData, static_cast<double>(i));
-    }
-
-    inline bool JSValue::isDoubleNumber() const
+    inline bool JSValue::isDouble() const
     {
         return isNumberCell(asValue());
     }
 
-    inline double JSValue::getDoubleNumber() const
+    inline double JSValue::asDouble() const
     {
         return asNumberCell(asValue())->value();
     }
 
     inline bool JSValue::isNumber() const
     {
-        return JSImmediate::isNumber(asValue()) || isDoubleNumber();
+        return JSImmediate::isNumber(asValue()) || isDouble();
     }
 
     inline double JSValue::uncheckedGetNumber() const
     {
         ASSERT(isNumber());
-        return JSImmediate::isImmediate(asValue()) ? JSImmediate::toDouble(asValue()) : getDoubleNumber();
+        return JSImmediate::isImmediate(asValue()) ? JSImmediate::toDouble(asValue()) : asDouble();
     }
 
-    inline bool JSValue::isAPIMangledNumber()
-    {
-        ASSERT(isNumber());
-        return JSImmediate::isImmediate(asValue()) ? false : asNumberCell(asValue())->isAPIMangledNumber();
-    }
-
-#else
+#endif // USE(JSVALUE32)
 
+#if USE(JSVALUE64)
     inline JSValue::JSValue(ExecState*, double d)
     {
         JSValue v = JSImmediate::from(d);
@@ -315,40 +271,12 @@ namespace JSC {
         *this = v;
     }
 
-    inline JSValue::JSValue(JSGlobalData*, long i)
-    {
-        JSValue v = JSImmediate::from(i);
-        ASSERT(v);
-        *this = v;
-    }
-
-    inline JSValue::JSValue(JSGlobalData*, unsigned long i)
+    inline bool JSValue::isDouble() const
     {
-        JSValue v = JSImmediate::from(i);
-        ASSERT(v);
-        *this = v;
-    }
-
-    inline JSValue::JSValue(JSGlobalData*, long long i)
-    {
-        JSValue v = JSImmediate::from(static_cast<double>(i));
-        ASSERT(v);
-        *this = v;
+        return JSImmediate::isDouble(asValue());
     }
 
-    inline JSValue::JSValue(JSGlobalData*, unsigned long long i)
-    {
-        JSValue v = JSImmediate::from(static_cast<double>(i));
-        ASSERT(v);
-        *this = v;
-    }
-
-    inline bool JSValue::isDoubleNumber() const
-    {
-        return JSImmediate::isDoubleNumber(asValue());
-    }
-
-    inline double JSValue::getDoubleNumber() const
+    inline double JSValue::asDouble() const
     {
         return JSImmediate::doubleValue(asValue());
     }
@@ -364,7 +292,9 @@ namespace JSC {
         return JSImmediate::toDouble(asValue());
     }
 
-#endif
+#endif // USE(JSVALUE64)
+
+#if USE(JSVALUE32) || USE(JSVALUE64)
 
     inline JSValue::JSValue(ExecState*, char i)
     {
@@ -390,30 +320,6 @@ namespace JSC {
         *this = JSImmediate::from(i);
     }
 
-    inline JSValue::JSValue(JSGlobalData*, char i)
-    {
-        ASSERT(JSImmediate::from(i));
-        *this = JSImmediate::from(i);
-    }
-
-    inline JSValue::JSValue(JSGlobalData*, unsigned char i)
-    {
-        ASSERT(JSImmediate::from(i));
-        *this = JSImmediate::from(i);
-    }
-
-    inline JSValue::JSValue(JSGlobalData*, short i)
-    {
-        ASSERT(JSImmediate::from(i));
-        *this = JSImmediate::from(i);
-    }
-
-    inline JSValue::JSValue(JSGlobalData*, unsigned short i)
-    {
-        ASSERT(JSImmediate::from(i));
-        *this = JSImmediate::from(i);
-    }
-
     inline JSValue jsNaN(ExecState* exec)
     {
         return jsNumber(exec, NaN);
@@ -433,23 +339,10 @@ namespace JSC {
 
     inline bool JSValue::getNumber(double &result) const
     {
-        if (isInt32Fast())
-            result = getInt32Fast();
-        else if (LIKELY(isDoubleNumber()))
-            result = getDoubleNumber();
-        else {
-            ASSERT(!isNumber());
-            return false;
-        }
-        return true;
-    }
-
-    inline bool JSValue::numberToInt32(int32_t& arg)
-    {
-        if (isInt32Fast())
-            arg = getInt32Fast();
-        else if (LIKELY(isDoubleNumber()))
-            arg = JSC::toInt32(getDoubleNumber());
+        if (isInt32())
+            result = asInt32();
+        else if (LIKELY(isDouble()))
+            result = asDouble();
         else {
             ASSERT(!isNumber());
             return false;
@@ -457,23 +350,7 @@ namespace JSC {
         return true;
     }
 
-    inline bool JSValue::numberToUInt32(uint32_t& arg)
-    {
-        if (isUInt32Fast())
-            arg = getUInt32Fast();
-        else if (LIKELY(isDoubleNumber()))
-            arg = JSC::toUInt32(getDoubleNumber());
-        else if (isInt32Fast()) {
-            // FIXME: I think this case can be merged with the uint case; toUInt32SlowCase
-            // on a negative value is equivalent to simple static_casting.
-            bool ignored;
-            arg = toUInt32SlowCase(getInt32Fast(), ignored);
-        } else {
-            ASSERT(!isNumber());
-            return false;
-        }
-        return true;
-    }
+#endif // USE(JSVALUE32) || USE(JSVALUE64)
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.cpp
index bbbe3af..297d457 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.cpp
@@ -67,7 +67,7 @@ public:
     ~Stringifier();
     JSValue stringify(JSValue);
 
-    void mark();
+    void markAggregate(MarkStack&);
 
 private:
     typedef UString StringBuilder;
@@ -120,38 +120,47 @@ private:
 
 // ------------------------------ helper functions --------------------------------
 
-static inline JSValue unwrapBoxedPrimitive(JSValue value)
+static inline JSValue unwrapBoxedPrimitive(ExecState* exec, JSValue value)
 {
     if (!value.isObject())
         return value;
-    if (!asObject(value)->inherits(&NumberObject::info) && !asObject(value)->inherits(&StringObject::info) && !asObject(value)->inherits(&BooleanObject::info))
-        return value;
-    return static_cast<JSWrapperObject*>(asObject(value))->internalValue();
+    JSObject* object = asObject(value);
+    if (object->inherits(&NumberObject::info))
+        return jsNumber(exec, object->toNumber(exec));
+    if (object->inherits(&StringObject::info))
+        return jsString(exec, object->toString(exec));
+    if (object->inherits(&BooleanObject::info))
+        return object->toPrimitive(exec);
+    return value;
 }
 
-static inline UString gap(JSValue space)
+static inline UString gap(ExecState* exec, JSValue space)
 {
-    space = unwrapBoxedPrimitive(space);
+    const int maxGapLength = 10;
+    space = unwrapBoxedPrimitive(exec, space);
 
     // If the space value is a number, create a gap string with that number of spaces.
     double spaceCount;
     if (space.getNumber(spaceCount)) {
-        const int maxSpaceCount = 100;
         int count;
-        if (spaceCount > maxSpaceCount)
-            count = maxSpaceCount;
+        if (spaceCount > maxGapLength)
+            count = maxGapLength;
         else if (!(spaceCount > 0))
             count = 0;
         else
             count = static_cast<int>(spaceCount);
-        UChar spaces[maxSpaceCount];
+        UChar spaces[maxGapLength];
         for (int i = 0; i < count; ++i)
             spaces[i] = ' ';
         return UString(spaces, count);
     }
 
     // If the space value is a string, use it as the gap string, otherwise use no gap string.
-    return space.getString();
+    UString spaces = space.getString();
+    if (spaces.size() > maxGapLength) {
+        spaces = spaces.substr(0, maxGapLength);
+    }
+    return spaces;
 }
 
 // ------------------------------ PropertyNameForFunctionCall --------------------------------
@@ -187,7 +196,7 @@ Stringifier::Stringifier(ExecState* exec, JSValue replacer, JSValue space)
     , m_usingArrayReplacer(false)
     , m_arrayReplacerPropertyNames(exec)
     , m_replacerCallType(CallTypeNone)
-    , m_gap(gap(space))
+    , m_gap(gap(exec, space))
 {
     exec->globalData().firstStringifierToMark = this;
 
@@ -202,12 +211,27 @@ Stringifier::Stringifier(ExecState* exec, JSValue replacer, JSValue space)
             JSValue name = array->get(exec, i);
             if (exec->hadException())
                 break;
+
             UString propertyName;
-            if (!name.getString(propertyName))
+            if (name.getString(propertyName)) {
+                m_arrayReplacerPropertyNames.add(Identifier(exec, propertyName));
                 continue;
-            if (exec->hadException())
-                return;
-            m_arrayReplacerPropertyNames.add(Identifier(exec, propertyName));
+            }
+
+            double value = 0;
+            if (name.getNumber(value)) {
+                m_arrayReplacerPropertyNames.add(Identifier::from(exec, value));
+                continue;
+            }
+
+            if (name.isObject()) {
+                if (!asObject(name)->inherits(&NumberObject::info) && !asObject(name)->inherits(&StringObject::info))
+                    continue;
+                propertyName = name.toString(exec);
+                if (exec->hadException())
+                    break;
+                m_arrayReplacerPropertyNames.add(Identifier(exec, propertyName));
+            }
         }
         return;
     }
@@ -221,15 +245,12 @@ Stringifier::~Stringifier()
     m_exec->globalData().firstStringifierToMark = m_nextStringifierToMark;
 }
 
-void Stringifier::mark()
+void Stringifier::markAggregate(MarkStack& markStack)
 {
     for (Stringifier* stringifier = this; stringifier; stringifier = stringifier->m_nextStringifierToMark) {
         size_t size = m_holderStack.size();
-        for (size_t i = 0; i < size; ++i) {
-            JSObject* object = m_holderStack[i].object();
-            if (!object->marked())
-                object->mark();
-        }
+        for (size_t i = 0; i < size; ++i)
+            markStack.append(m_holderStack[i].object());
     }
 }
 
@@ -339,8 +360,6 @@ Stringifier::StringifyResult Stringifier::appendStringifiedValue(StringBuilder&
     value = toJSON(value, propertyName);
     if (m_exec->hadException())
         return StringifyFailed;
-    if (value.isUndefined() && !holder->inherits(&JSArray::info))
-        return StringifyFailedDueToUndefinedValue;
 
     // Call the replacer function.
     if (m_replacerCallType != CallTypeNone) {
@@ -351,12 +370,18 @@ Stringifier::StringifyResult Stringifier::appendStringifiedValue(StringBuilder&
             return StringifyFailed;
     }
 
+    if (value.isUndefined() && !holder->inherits(&JSArray::info))
+        return StringifyFailedDueToUndefinedValue;
+
     if (value.isNull()) {
         builder.append("null");
         return StringifySucceeded;
     }
 
-    value = unwrapBoxedPrimitive(value);
+    value = unwrapBoxedPrimitive(m_exec, value);
+
+    if (m_exec->hadException())
+        return StringifyFailed;
 
     if (value.isBoolean()) {
         builder.append(value.getBoolean() ? "true" : "false");
@@ -383,9 +408,18 @@ Stringifier::StringifyResult Stringifier::appendStringifiedValue(StringBuilder&
 
     JSObject* object = asObject(value);
 
+    CallData callData;
+    if (object->getCallData(callData) != CallTypeNone) {
+        if (holder->inherits(&JSArray::info)) {
+            builder.append("null");
+            return StringifySucceeded;
+        }
+        return StringifyFailedDueToUndefinedValue;
+    }
+
     // Handle cycle detection, and put the holder on the stack.
     if (!m_holderCycleDetector.add(object).second) {
-        throwError(m_exec, TypeError);
+        throwError(m_exec, TypeError, "JSON.stringify cannot serialize cyclic structures.");
         return StringifyFailed;
     }
     bool holderStackWasEmpty = m_holderStack.isEmpty();
@@ -394,7 +428,7 @@ Stringifier::StringifyResult Stringifier::appendStringifiedValue(StringBuilder&
         return StringifySucceeded;
 
     // If this is the outermost call, then loop to handle everything on the holder stack.
-    TimeoutChecker localTimeoutChecker(*m_exec->globalData().timeoutChecker);
+    TimeoutChecker localTimeoutChecker(m_exec->globalData().timeoutChecker);
     localTimeoutChecker.reset();
     unsigned tickCount = localTimeoutChecker.ticksUntilNextCheck();
     do {
@@ -574,18 +608,17 @@ const ClassInfo JSONObject::info = { "JSON", 0, 0, ExecState::jsonTable };
 
 bool JSONObject::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    const HashEntry* entry = ExecState::jsonTable(exec)->entry(exec, propertyName);
-    if (!entry)
-        return JSObject::getOwnPropertySlot(exec, propertyName, slot);
+    return getStaticFunctionSlot<JSObject>(exec, ExecState::jsonTable(exec), this, propertyName, slot);
+}
 
-    ASSERT(entry->attributes() & Function);
-    setUpStaticFunctionSlot(exec, entry, this, propertyName, slot);
-    return true;
+bool JSONObject::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, ExecState::jsonTable(exec), this, propertyName, descriptor);
 }
 
-void JSONObject::markStringifiers(Stringifier* stringifier)
+void JSONObject::markStringifiers(MarkStack& markStack, Stringifier* stringifier)
 {
-    stringifier->mark();
+    stringifier->markAggregate(markStack);
 }
 
 class Walker {
@@ -599,11 +632,11 @@ public:
     }
     JSValue walk(JSValue unfiltered);
 private:
-    JSValue callReviver(JSValue property, JSValue unfiltered)
+    JSValue callReviver(JSObject* thisObj, JSValue property, JSValue unfiltered)
     {
         JSValue args[] = { property, unfiltered };
         ArgList argList(args, 2);
-        return call(m_exec, m_function, m_callType, m_callData, jsNull(), argList);
+        return call(m_exec, m_function, m_callType, m_callData, thisObj, argList);
     }
 
     friend class Holder;
@@ -613,7 +646,10 @@ private:
     CallType m_callType;
     CallData m_callData;
 };
-    
+
+// We clamp recursion well beyond anything reasonable, but we also have a timeout check
+// to guard against "infinite" execution by inserting arbitrarily large objects.
+static const unsigned maximumFilterRecursion = 40000;
 enum WalkerState { StateUnknown, ArrayStartState, ArrayStartVisitMember, ArrayEndVisitMember, 
                                  ObjectStartState, ObjectStartVisitMember, ObjectEndVisitMember };
 NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
@@ -627,12 +663,21 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
     WalkerState state = StateUnknown;
     JSValue inValue = unfiltered;
     JSValue outValue = jsNull();
+    
+    TimeoutChecker localTimeoutChecker(m_exec->globalData().timeoutChecker);
+    localTimeoutChecker.reset();
+    unsigned tickCount = localTimeoutChecker.ticksUntilNextCheck();
     while (1) {
         switch (state) {
             arrayStartState:
             case ArrayStartState: {
                 ASSERT(inValue.isObject());
-                ASSERT(isJSArray(&m_exec->globalData(), asObject(inValue)));
+                ASSERT(isJSArray(&m_exec->globalData(), asObject(inValue)) || asObject(inValue)->inherits(&JSArray::info));
+                if (objectStack.size() + arrayStack.size() > maximumFilterRecursion) {
+                    m_exec->setException(createStackOverflowError(m_exec));
+                    return jsUndefined();
+                }
+
                 JSArray* array = asArray(inValue);
                 arrayStack.append(array);
                 indexStack.append(0);
@@ -640,6 +685,14 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
             }
             arrayStartVisitMember:
             case ArrayStartVisitMember: {
+                if (!--tickCount) {
+                    if (localTimeoutChecker.didTimeOut(m_exec)) {
+                        m_exec->setException(createInterruptedExecutionException(&m_exec->globalData()));
+                        return jsUndefined();
+                    }
+                    tickCount = localTimeoutChecker.ticksUntilNextCheck();
+                }
+
                 JSArray* array = arrayStack.last();
                 uint32_t index = indexStack.last();
                 if (index == array->length()) {
@@ -648,7 +701,16 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
                     indexStack.removeLast();
                     break;
                 }
-                inValue = array->getIndex(index);
+                if (isJSArray(&m_exec->globalData(), array) && array->canGetIndex(index))
+                    inValue = array->getIndex(index);
+                else {
+                    PropertySlot slot;
+                    if (array->getOwnPropertySlot(m_exec, index, slot))
+                        inValue = slot.getValue(m_exec, index);
+                    else
+                        inValue = jsUndefined();
+                }
+                    
                 if (inValue.isObject()) {
                     stateStack.append(ArrayEndVisitMember);
                     goto stateUnknown;
@@ -658,7 +720,15 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
             }
             case ArrayEndVisitMember: {
                 JSArray* array = arrayStack.last();
-                array->setIndex(indexStack.last(), callReviver(jsString(m_exec, UString::from(indexStack.last())), outValue));
+                JSValue filteredValue = callReviver(array, jsString(m_exec, UString::from(indexStack.last())), outValue);
+                if (filteredValue.isUndefined())
+                    array->deleteProperty(m_exec, indexStack.last());
+                else {
+                    if (isJSArray(&m_exec->globalData(), array) && array->canSetIndex(indexStack.last()))
+                        array->setIndex(indexStack.last(), filteredValue);
+                    else
+                        array->put(m_exec, indexStack.last(), filteredValue);
+                }
                 if (m_exec->hadException())
                     return jsNull();
                 indexStack.last()++;
@@ -667,7 +737,12 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
             objectStartState:
             case ObjectStartState: {
                 ASSERT(inValue.isObject());
-                ASSERT(!isJSArray(&m_exec->globalData(), asObject(inValue)));
+                ASSERT(!isJSArray(&m_exec->globalData(), asObject(inValue)) && !asObject(inValue)->inherits(&JSArray::info));
+                if (objectStack.size() + arrayStack.size() > maximumFilterRecursion) {
+                    m_exec->setException(createStackOverflowError(m_exec));
+                    return jsUndefined();
+                }
+
                 JSObject* object = asObject(inValue);
                 objectStack.append(object);
                 indexStack.append(0);
@@ -677,6 +752,14 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
             }
             objectStartVisitMember:
             case ObjectStartVisitMember: {
+                if (!--tickCount) {
+                    if (localTimeoutChecker.didTimeOut(m_exec)) {
+                        m_exec->setException(createInterruptedExecutionException(&m_exec->globalData()));
+                        return jsUndefined();
+                    }
+                    tickCount = localTimeoutChecker.ticksUntilNextCheck();
+                }
+
                 JSObject* object = objectStack.last();
                 uint32_t index = indexStack.last();
                 PropertyNameArray& properties = propertyStack.last();
@@ -688,9 +771,15 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
                     break;
                 }
                 PropertySlot slot;
-                object->getOwnPropertySlot(m_exec, properties[index], slot);
-                inValue = slot.getValue(m_exec, properties[index]);
-                ASSERT(!m_exec->hadException());
+                if (object->getOwnPropertySlot(m_exec, properties[index], slot))
+                    inValue = slot.getValue(m_exec, properties[index]);
+                else
+                    inValue = jsUndefined();
+
+                // The holder may be modified by the reviver function so any lookup may throw
+                if (m_exec->hadException())
+                    return jsNull();
+
                 if (inValue.isObject()) {
                     stateStack.append(ObjectEndVisitMember);
                     goto stateUnknown;
@@ -702,7 +791,11 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
                 JSObject* object = objectStack.last();
                 Identifier prop = propertyStack.last()[indexStack.last()];
                 PutPropertySlot slot;
-                object->put(m_exec, prop, callReviver(jsString(m_exec, prop.ustring()), outValue), slot);
+                JSValue filteredValue = callReviver(object, jsString(m_exec, prop.ustring()), outValue);
+                if (filteredValue.isUndefined())
+                    object->deleteProperty(m_exec, prop);
+                else
+                    object->put(m_exec, prop, filteredValue, slot);
                 if (m_exec->hadException())
                     return jsNull();
                 indexStack.last()++;
@@ -714,16 +807,29 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
                     outValue = inValue;
                     break;
                 }
-                if (isJSArray(&m_exec->globalData(), asObject(inValue)))
+                JSObject* object = asObject(inValue);
+                if (isJSArray(&m_exec->globalData(), object) || object->inherits(&JSArray::info))
                     goto arrayStartState;
                 goto objectStartState;
         }
         if (stateStack.isEmpty())
             break;
+
         state = stateStack.last();
         stateStack.removeLast();
+
+        if (!--tickCount) {
+            if (localTimeoutChecker.didTimeOut(m_exec)) {
+                m_exec->setException(createInterruptedExecutionException(&m_exec->globalData()));
+                return jsUndefined();
+            }
+            tickCount = localTimeoutChecker.ticksUntilNextCheck();
+        }
     }
-    return callReviver(jsEmptyString(m_exec), outValue);
+    JSObject* finalHolder = constructEmptyObject(m_exec);
+    PutPropertySlot slot;
+    finalHolder->put(m_exec, m_exec->globalData().propertyNames->emptyIdentifier, outValue, slot);
+    return callReviver(finalHolder, jsEmptyString(m_exec), outValue);
 }
 
 // ECMA-262 v5 15.12.2
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.h
index 8d5364a..0705a69 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.h
@@ -41,13 +41,14 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType));
+            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultMark | HasDefaultGetPropertyNames));
         }
 
-        static void markStringifiers(Stringifier*);
+        static void markStringifiers(MarkStack&, Stringifier*);
 
     private:
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
index ded842d..f910603 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
@@ -1,7 +1,7 @@
 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *  Copyright (C) 2007 Eric Seidel (eric@webkit.org)
  *
  *  This library is free software; you can redistribute it and/or
@@ -30,6 +30,7 @@
 #include "JSGlobalObject.h"
 #include "NativeErrorConstructor.h"
 #include "ObjectPrototype.h"
+#include "PropertyDescriptor.h"
 #include "PropertyNameArray.h"
 #include "Lookup.h"
 #include "Nodes.h"
@@ -37,48 +38,22 @@
 #include <math.h>
 #include <wtf/Assertions.h>
 
-#define JSOBJECT_MARK_TRACING 0
-
-#if JSOBJECT_MARK_TRACING
-
-#define JSOBJECT_MARK_BEGIN() \
-    static int markStackDepth = 0; \
-    for (int i = 0; i < markStackDepth; i++) \
-        putchar('-'); \
-    printf("%s (%p)\n", className().UTF8String().c_str(), this); \
-    markStackDepth++; \
-
-#define JSOBJECT_MARK_END() \
-    markStackDepth--;
-
-#else // JSOBJECT_MARK_TRACING
-
-#define JSOBJECT_MARK_BEGIN()
-#define JSOBJECT_MARK_END()
-
-#endif // JSOBJECT_MARK_TRACING
-
 namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(JSObject);
 
-void JSObject::mark()
+void JSObject::markChildren(MarkStack& markStack)
 {
-    JSOBJECT_MARK_BEGIN();
-
-    JSCell::mark();
-    m_structure->mark();
-
-    PropertyStorage storage = propertyStorage();
+#ifndef NDEBUG
+    bool wasCheckingForDefaultMarkViolation = markStack.m_isCheckingForDefaultMarkViolation;
+    markStack.m_isCheckingForDefaultMarkViolation = false;
+#endif
 
-    size_t storageSize = m_structure->propertyStorageSize();
-    for (size_t i = 0; i < storageSize; ++i) {
-        JSValue v = JSValue::decode(storage[i]);
-        if (!v.marked())
-            v.mark();
-    }
+    markChildrenDirect(markStack);
 
-    JSOBJECT_MARK_END();
+#ifndef NDEBUG
+    markStack.m_isCheckingForDefaultMarkViolation = wasCheckingForDefaultMarkViolation;
+#endif
 }
 
 UString JSObject::className() const
@@ -204,12 +179,12 @@ bool JSObject::hasProperty(ExecState* exec, unsigned propertyName) const
 }
 
 // ECMA 8.6.2.5
-bool JSObject::deleteProperty(ExecState* exec, const Identifier& propertyName, bool checkDontDelete)
+bool JSObject::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
     unsigned attributes;
     JSCell* specificValue;
     if (m_structure->get(propertyName, attributes, specificValue) != WTF::notFound) {
-        if ((attributes & DontDelete) && checkDontDelete)
+        if ((attributes & DontDelete))
             return false;
         removeDirect(propertyName);
         return true;
@@ -217,7 +192,7 @@ bool JSObject::deleteProperty(ExecState* exec, const Identifier& propertyName, b
 
     // Look in the static hashtable of properties
     const HashEntry* entry = findPropertyHashEntry(exec, propertyName);
-    if (entry && (entry->attributes() & DontDelete) && checkDontDelete)
+    if (entry && entry->attributes() & DontDelete)
         return false; // this builtin property can't be deleted
 
     // FIXME: Should the code here actually do some deletion?
@@ -230,9 +205,9 @@ bool JSObject::hasOwnProperty(ExecState* exec, const Identifier& propertyName) c
     return const_cast<JSObject*>(this)->getOwnPropertySlot(exec, propertyName, slot);
 }
 
-bool JSObject::deleteProperty(ExecState* exec, unsigned propertyName, bool checkDontDelete)
+bool JSObject::deleteProperty(ExecState* exec, unsigned propertyName)
 {
-    return deleteProperty(exec, Identifier::from(exec, propertyName), checkDontDelete);
+    return deleteProperty(exec, Identifier::from(exec, propertyName));
 }
 
 static ALWAYS_INLINE JSValue callDefaultValueFunction(ExecState* exec, const JSObject* object, const Identifier& propertyName)
@@ -310,7 +285,7 @@ void JSObject::defineGetter(ExecState* exec, const Identifier& propertyName, JSO
     }
 
     PutPropertySlot slot;
-    GetterSetter* getterSetter = new (exec) GetterSetter;
+    GetterSetter* getterSetter = new (exec) GetterSetter(exec);
     putDirectInternal(exec->globalData(), propertyName, getterSetter, Getter, true, slot);
 
     // putDirect will change our Structure if we add a new property. For
@@ -337,7 +312,7 @@ void JSObject::defineSetter(ExecState* exec, const Identifier& propertyName, JSO
     }
 
     PutPropertySlot slot;
-    GetterSetter* getterSetter = new (exec) GetterSetter;
+    GetterSetter* getterSetter = new (exec) GetterSetter(exec);
     putDirectInternal(exec->globalData(), propertyName, getterSetter, Setter, true, slot);
 
     // putDirect will change our Structure if we add a new property. For
@@ -447,9 +422,14 @@ bool JSObject::getPropertySpecificValue(ExecState*, const Identifier& propertyNa
     return false;
 }
 
-void JSObject::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames,  unsigned listedAttributes)
+void JSObject::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    m_structure->getEnumerablePropertyNames(exec, propertyNames, this);
+}
+
+void JSObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
-    m_structure->getPropertyNames(exec, propertyNames, this, listedAttributes);
+    m_structure->getOwnEnumerablePropertyNames(exec, propertyNames, this);
 }
 
 bool JSObject::toBoolean(ExecState*) const
@@ -524,12 +504,7 @@ NEVER_INLINE void JSObject::fillGetterPropertySlot(PropertySlot& slot, JSValue*
 
 Structure* JSObject::createInheritorID()
 {
-#ifdef QT_BUILD_SCRIPT_LIB
-    // ### QtScript needs the hasOwnProperty() calls etc. for QScriptObject
-    m_inheritorID = Structure::create(this, TypeInfo(ObjectType, ImplementsHasInstance));
-#else
     m_inheritorID = JSObject::createStructure(this);
-#endif
     return m_inheritorID.get();
 }
 
@@ -543,4 +518,27 @@ JSObject* constructEmptyObject(ExecState* exec)
     return new (exec) JSObject(exec->lexicalGlobalObject()->emptyObjectStructure());
 }
 
+bool JSObject::getOwnPropertyDescriptor(ExecState*, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    unsigned attributes = 0;
+    JSCell* cell = 0;
+    size_t offset = m_structure->get(propertyName, attributes, cell);
+    if (offset == WTF::notFound)
+        return false;
+    descriptor.setDescriptor(getDirectOffset(offset), attributes);
+    return true;
+}
+
+bool JSObject::getPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    JSObject* object = this;
+    while (true) {
+        if (object->getOwnPropertyDescriptor(exec, propertyName, descriptor))
+            return true;
+        JSValue prototype = object->prototype();
+        if (!prototype.isObject())
+            return false;
+        object = asObject(prototype);
+    }
+}
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
index 15b7957..bdc949b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
@@ -1,7 +1,7 @@
 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -27,12 +27,15 @@
 #include "ClassInfo.h"
 #include "CommonIdentifiers.h"
 #include "CallFrame.h"
+#include "JSCell.h"
 #include "JSNumberCell.h"
+#include "MarkStack.h"
 #include "PropertySlot.h"
 #include "PutPropertySlot.h"
 #include "ScopeChain.h"
 #include "Structure.h"
 #include "JSGlobalData.h"
+#include <wtf/StdLibExtras.h>
 
 namespace JSC {
 
@@ -42,11 +45,12 @@ namespace JSC {
             return value.asCell();
         return 0;
     }
-
+    
+    class HashEntry;
     class InternalFunction;
+    class PropertyDescriptor;
     class PropertyNameArray;
     class Structure;
-    struct HashEntry;
     struct HashTable;
 
     // ECMA 262-3 8.6.1
@@ -72,14 +76,13 @@ namespace JSC {
     public:
         explicit JSObject(PassRefPtr<Structure>);
 
-        virtual void mark();
+        virtual void markChildren(MarkStack&);
+        ALWAYS_INLINE void markChildrenDirect(MarkStack& markStack);
 
         // The inline virtual destructor cannot be the first virtual function declared
         // in the class as it results in the vtable being generated as a weak symbol
         virtual ~JSObject();
 
-        bool inherits(const ClassInfo* classInfo) const { return JSCell::isObject(classInfo); }
-
         JSValue prototype() const;
         void setPrototype(JSValue prototype);
         
@@ -93,9 +96,11 @@ namespace JSC {
 
         bool getPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         bool getPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
+        bool getPropertyDescriptor(ExecState*, const Identifier& propertyName, PropertyDescriptor&);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
         virtual void put(ExecState*, const Identifier& propertyName, JSValue value, PutPropertySlot&);
         virtual void put(ExecState*, unsigned propertyName, JSValue value);
@@ -110,13 +115,15 @@ namespace JSC {
         bool hasProperty(ExecState*, unsigned propertyName) const;
         bool hasOwnProperty(ExecState*, const Identifier& propertyName) const;
 
-        virtual bool deleteProperty(ExecState*, const Identifier& propertyName, bool checkDontDelete = true);
-        virtual bool deleteProperty(ExecState*, unsigned propertyName, bool checkDontDelete = true);
+        virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
+        virtual bool deleteProperty(ExecState*, unsigned propertyName);
 
         virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
 
         virtual bool hasInstance(ExecState*, JSValue, JSValue prototypeProperty);
-        virtual void getPropertyNames(ExecState*, PropertyNameArray&, unsigned listedAttributes = Structure::Prototype);
+
+        virtual void getPropertyNames(ExecState*, PropertyNameArray&);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
 
         virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType = NoPreference) const;
         virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue& value);
@@ -194,15 +201,38 @@ namespace JSC {
         void allocatePropertyStorageInline(size_t oldSize, size_t newSize);
         bool isUsingInlineStorage() const { return m_structure->isUsingInlineStorage(); }
 
-        static const size_t inlineStorageCapacity = 3;
+        static const size_t inlineStorageCapacity = sizeof(EncodedJSValue) == 2 * sizeof(void*) ? 4 : 3;
         static const size_t nonInlineBaseStorageCapacity = 16;
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot));
+            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames));
+        }
+
+    protected:
+        void addAnonymousSlots(unsigned count);
+        void putAnonymousValue(unsigned index, JSValue value)
+        {
+            *locationForOffset(index) = value;
+        }
+        JSValue getAnonymousValue(unsigned index)
+        {
+            return *locationForOffset(index);
         }
 
     private:
+        // Nobody should ever ask any of these questions on something already known to be a JSObject.
+        using JSCell::isAPIValueWrapper;
+        using JSCell::isGetterSetter;
+        using JSCell::toObject;
+        void getObject();
+        void getString();
+        void isObject();
+        void isString();
+#if USE(JSVALUE32)
+        void isNumber();
+#endif
+
         ConstPropertyStorage propertyStorage() const { return (isUsingInlineStorage() ? m_inlineStorage : m_externalStorage); }
         PropertyStorage propertyStorage() { return (isUsingInlineStorage() ? m_inlineStorage : m_externalStorage); }
 
@@ -225,22 +255,25 @@ namespace JSC {
         const HashEntry* findPropertyHashEntry(ExecState*, const Identifier& propertyName) const;
         Structure* createInheritorID();
 
-        RefPtr<Structure> m_inheritorID;
-
         union {
             PropertyStorage m_externalStorage;
             EncodedJSValue m_inlineStorage[inlineStorageCapacity];
         };
-    };
 
-    JSObject* asObject(JSValue);
+        RefPtr<Structure> m_inheritorID;
+    };
+    
+JSObject* constructEmptyObject(ExecState*);
 
-    JSObject* constructEmptyObject(ExecState*);
+inline JSObject* asObject(JSCell* cell)
+{
+    ASSERT(cell->isObject());
+    return static_cast<JSObject*>(cell);
+}
 
 inline JSObject* asObject(JSValue value)
 {
-    ASSERT(asCell(value)->isObject());
-    return static_cast<JSObject*>(asCell(value));
+    return asObject(value.asCell());
 }
 
 inline JSObject::JSObject(PassRefPtr<Structure> structure)
@@ -250,6 +283,9 @@ inline JSObject::JSObject(PassRefPtr<Structure> structure)
     ASSERT(m_structure->propertyStorageCapacity() == inlineStorageCapacity);
     ASSERT(m_structure->isEmpty());
     ASSERT(prototype().isNull() || Heap::heap(this) == Heap::heap(prototype()));
+#if USE(JSVALUE64) || USE(JSVALUE32_64)
+    ASSERT(OBJECT_OFFSETOF(JSObject, m_inlineStorage) % sizeof(double) == 0);
+#endif
 }
 
 inline JSObject::~JSObject()
@@ -290,7 +326,7 @@ inline bool Structure::isUsingInlineStorage() const
     return (propertyStorageCapacity() == JSObject::inlineStorageCapacity);
 }
 
-inline bool JSCell::isObject(const ClassInfo* info) const
+inline bool JSCell::inherits(const ClassInfo* info) const
 {
     for (const ClassInfo* ci = classInfo(); ci; ci = ci->parentClass) {
         if (ci == info)
@@ -299,10 +335,10 @@ inline bool JSCell::isObject(const ClassInfo* info) const
     return false;
 }
 
-// this method is here to be after the inline declaration of JSCell::isObject
-inline bool JSValue::isObject(const ClassInfo* classInfo) const
+// this method is here to be after the inline declaration of JSCell::inherits
+inline bool JSValue::inherits(const ClassInfo* classInfo) const
 {
-    return isCell() && asCell()->isObject(classInfo);
+    return isCell() && asCell()->inherits(classInfo);
 }
 
 ALWAYS_INLINE bool JSObject::inlineGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -451,7 +487,18 @@ inline void JSObject::putDirectInternal(const Identifier& propertyName, JSValue
         return;
     }
 
+    // If we have a specific function, we may have got to this point if there is
+    // already a transition with the correct property name and attributes, but
+    // specialized to a different function.  In this case we just want to give up
+    // and despecialize the transition.
+    // In this case we clear the value of specificFunction which will result
+    // in us adding a non-specific transition, and any subsequent lookup in
+    // Structure::addPropertyTransitionToExistingStructure will just use that.
+    if (specificFunction && m_structure->hasTransition(propertyName, attributes))
+        specificFunction = 0;
+
     RefPtr<Structure> structure = Structure::addPropertyTransition(m_structure, propertyName, attributes, specificFunction, offset);
+
     if (currentCapacity != structure->propertyStorageCapacity())
         allocatePropertyStorage(currentCapacity, structure->propertyStorageCapacity());
 
@@ -477,6 +524,17 @@ inline void JSObject::putDirectInternal(JSGlobalData& globalData, const Identifi
     putDirectInternal(propertyName, value, attributes, false, slot, getJSFunction(globalData, value));
 }
 
+inline void JSObject::addAnonymousSlots(unsigned count)
+{
+    size_t currentCapacity = m_structure->propertyStorageCapacity();
+    RefPtr<Structure> structure = Structure::addAnonymousSlotsTransition(m_structure, count);
+
+    if (currentCapacity != structure->propertyStorageCapacity())
+        allocatePropertyStorage(currentCapacity, structure->propertyStorageCapacity());
+
+    setStructure(structure.release());
+}
+
 inline void JSObject::putDirect(const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot)
 {
     ASSERT(value);
@@ -541,7 +599,7 @@ inline JSValue JSValue::get(ExecState* exec, const Identifier& propertyName) con
 inline JSValue JSValue::get(ExecState* exec, const Identifier& propertyName, PropertySlot& slot) const
 {
     if (UNLIKELY(!isCell())) {
-        JSObject* prototype = JSImmediate::prototype(asValue(), exec);
+        JSObject* prototype = synthesizePrototype(exec);
         if (propertyName == exec->propertyNames().underscoreProto)
             return prototype;
         if (!prototype->getPropertySlot(exec, propertyName, slot))
@@ -552,8 +610,7 @@ inline JSValue JSValue::get(ExecState* exec, const Identifier& propertyName, Pro
     while (true) {
         if (cell->fastGetOwnPropertySlot(exec, propertyName, slot))
             return slot.getValue(exec, propertyName);
-        ASSERT(cell->isObject());
-        JSValue prototype = static_cast<JSObject*>(cell)->prototype();
+        JSValue prototype = asObject(cell)->prototype();
         if (!prototype.isObject())
             return jsUndefined();
         cell = asObject(prototype);
@@ -569,7 +626,7 @@ inline JSValue JSValue::get(ExecState* exec, unsigned propertyName) const
 inline JSValue JSValue::get(ExecState* exec, unsigned propertyName, PropertySlot& slot) const
 {
     if (UNLIKELY(!isCell())) {
-        JSObject* prototype = JSImmediate::prototype(asValue(), exec);
+        JSObject* prototype = synthesizePrototype(exec);
         if (!prototype->getPropertySlot(exec, propertyName, slot))
             return jsUndefined();
         return slot.getValue(exec, propertyName);
@@ -578,8 +635,7 @@ inline JSValue JSValue::get(ExecState* exec, unsigned propertyName, PropertySlot
     while (true) {
         if (cell->getOwnPropertySlot(exec, propertyName, slot))
             return slot.getValue(exec, propertyName);
-        ASSERT(cell->isObject());
-        JSValue prototype = static_cast<JSObject*>(cell)->prototype();
+        JSValue prototype = asObject(cell)->prototype();
         if (!prototype.isObject())
             return jsUndefined();
         cell = prototype.asCell();
@@ -589,7 +645,7 @@ inline JSValue JSValue::get(ExecState* exec, unsigned propertyName, PropertySlot
 inline void JSValue::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (UNLIKELY(!isCell())) {
-        JSImmediate::toObject(asValue(), exec)->put(exec, propertyName, value, slot);
+        synthesizeObject(exec)->put(exec, propertyName, value, slot);
         return;
     }
     asCell()->put(exec, propertyName, value, slot);
@@ -598,7 +654,7 @@ inline void JSValue::put(ExecState* exec, const Identifier& propertyName, JSValu
 inline void JSValue::put(ExecState* exec, unsigned propertyName, JSValue value)
 {
     if (UNLIKELY(!isCell())) {
-        JSImmediate::toObject(asValue(), exec)->put(exec, propertyName, value);
+        synthesizeObject(exec)->put(exec, propertyName, value);
         return;
     }
     asCell()->put(exec, propertyName, value);
@@ -624,6 +680,17 @@ ALWAYS_INLINE void JSObject::allocatePropertyStorageInline(size_t oldSize, size_
     m_externalStorage = newPropertyStorage;
 }
 
+ALWAYS_INLINE void JSObject::markChildrenDirect(MarkStack& markStack)
+{
+    JSCell::markChildren(markStack);
+
+    m_structure->markAggregate(markStack);
+    
+    PropertyStorage storage = propertyStorage();
+    size_t storageSize = m_structure->propertyStorageSize();
+    markStack.appendValues(reinterpret_cast<JSValue*>(storage), storageSize);
+}
+
 } // namespace JSC
 
 #endif // JSObject_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
index 8c7b53d..e08a3d9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -37,47 +37,11 @@ JSPropertyNameIterator::~JSPropertyNameIterator()
 {
 }
 
-JSValue JSPropertyNameIterator::toPrimitive(ExecState*, PreferredPrimitiveType) const
+void JSPropertyNameIterator::markChildren(MarkStack& markStack)
 {
-    ASSERT_NOT_REACHED();
-    return JSValue();
-}
-
-bool JSPropertyNameIterator::getPrimitiveNumber(ExecState*, double&, JSValue&)
-{
-    ASSERT_NOT_REACHED();
-    return false;
-}
-
-bool JSPropertyNameIterator::toBoolean(ExecState*) const
-{
-    ASSERT_NOT_REACHED();
-    return false;
-}
-
-double JSPropertyNameIterator::toNumber(ExecState*) const
-{
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-UString JSPropertyNameIterator::toString(ExecState*) const
-{
-    ASSERT_NOT_REACHED();
-    return "";
-}
-
-JSObject* JSPropertyNameIterator::toObject(ExecState*) const
-{
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-void JSPropertyNameIterator::mark()
-{
-    JSCell::mark();
-    if (m_object && !m_object->marked())
-        m_object->mark();
+    JSCell::markChildren(markStack);
+    if (m_object)
+        markStack.append(m_object);
 }
 
 void JSPropertyNameIterator::invalidate()
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h
index 9817c07..d2849a8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -44,21 +44,18 @@ namespace JSC {
 
         virtual ~JSPropertyNameIterator();
 
-        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
-        virtual bool getPrimitiveNumber(ExecState*, double&, JSValue&);
-        virtual bool toBoolean(ExecState*) const;
-        virtual double toNumber(ExecState*) const;
-        virtual UString toString(ExecState*) const;
-        virtual JSObject* toObject(ExecState*) const;
-
-        virtual void mark();
+        virtual void markChildren(MarkStack&);
 
         JSValue next(ExecState*);
         void invalidate();
-
+        
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        {
+            return Structure::create(prototype, TypeInfo(CompoundType));
+        }
     private:
-        JSPropertyNameIterator();
-        JSPropertyNameIterator(JSObject*, PassRefPtr<PropertyNameArrayData> propertyNameArrayData);
+        JSPropertyNameIterator(ExecState*);
+        JSPropertyNameIterator(ExecState*, JSObject*, PassRefPtr<PropertyNameArrayData> propertyNameArrayData);
 
         JSObject* m_object;
         RefPtr<PropertyNameArrayData> m_data;
@@ -66,16 +63,16 @@ namespace JSC {
         PropertyNameArrayData::const_iterator m_end;
     };
 
-inline JSPropertyNameIterator::JSPropertyNameIterator()
-    : JSCell(0)
+inline JSPropertyNameIterator::JSPropertyNameIterator(ExecState* exec)
+    : JSCell(exec->globalData().propertyNameIteratorStructure.get())
     , m_object(0)
     , m_position(0)
     , m_end(0)
 {
 }
 
-inline JSPropertyNameIterator::JSPropertyNameIterator(JSObject* object, PassRefPtr<PropertyNameArrayData> propertyNameArrayData)
-    : JSCell(0)
+inline JSPropertyNameIterator::JSPropertyNameIterator(ExecState* exec, JSObject* object, PassRefPtr<PropertyNameArrayData> propertyNameArrayData)
+    : JSCell(exec->globalData().propertyNameIteratorStructure.get())
     , m_object(object)
     , m_data(propertyNameArrayData)
     , m_position(m_data->begin())
@@ -86,12 +83,12 @@ inline JSPropertyNameIterator::JSPropertyNameIterator(JSObject* object, PassRefP
 inline JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSValue v)
 {
     if (v.isUndefinedOrNull())
-        return new (exec) JSPropertyNameIterator;
+        return new (exec) JSPropertyNameIterator(exec);
 
     JSObject* o = v.toObject(exec);
     PropertyNameArray propertyNames(exec);
     o->getPropertyNames(exec, propertyNames);
-    return new (exec) JSPropertyNameIterator(o, propertyNames.releaseData());
+    return new (exec) JSPropertyNameIterator(exec, o, propertyNames.releaseData());
 }
 
 inline JSValue JSPropertyNameIterator::next(ExecState* exec)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.cpp
index 85907c8..a877ec6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,12 +31,10 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(JSStaticScopeObject);
 
-void JSStaticScopeObject::mark()
+void JSStaticScopeObject::markChildren(MarkStack& markStack)
 {
-    JSVariableObject::mark();
-    
-    if (!d()->registerStore.marked())
-        d()->registerStore.mark();
+    JSVariableObject::markChildren(markStack);
+    markStack.append(d()->registerStore.jsValue());
 }
 
 JSObject* JSStaticScopeObject::toThisObject(ExecState* exec) const
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h
index 2caf540..5eb0e4b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -50,7 +50,7 @@ namespace JSC{
             symbolTable().add(ident.ustring().rep(), SymbolTableEntry(-1, attributes));
         }
         virtual ~JSStaticScopeObject();
-        virtual void mark();
+        virtual void markChildren(MarkStack&);
         bool isDynamicScope() const;
         virtual JSObject* toThisObject(ExecState*) const;
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp
index e1fc66d..91ddaeb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp
@@ -103,30 +103,42 @@ bool JSString::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNam
     return true;
 }
 
-bool JSString::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
-{
-    // The semantics here are really getPropertySlot, not getOwnPropertySlot.
-    // This function should only be called by JSValue::get.
-    if (getStringPropertySlot(exec, propertyName, slot))
-        return true;
-    return JSString::getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
-}
-
-bool JSString::getStringPropertyAttributes(ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
+bool JSString::getStringPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
     if (propertyName == exec->propertyNames().length) {
-        attributes = DontEnum | DontDelete | ReadOnly;
+        descriptor.setDescriptor(jsNumber(exec, m_value.size()), DontEnum | DontDelete | ReadOnly);
         return true;
     }
+    
     bool isStrictUInt32;
     unsigned i = propertyName.toStrictUInt32(&isStrictUInt32);
     if (isStrictUInt32 && i < static_cast<unsigned>(m_value.size())) {
-        attributes = DontDelete | ReadOnly;
+        descriptor.setDescriptor(jsSingleCharacterSubstring(exec, m_value, i), DontDelete | ReadOnly);
         return true;
     }
+    
     return false;
 }
 
+bool JSString::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    if (getStringPropertyDescriptor(exec, propertyName, descriptor))
+        return true;
+    if (propertyName != exec->propertyNames().underscoreProto)
+        return false;
+    descriptor.setDescriptor(exec->lexicalGlobalObject()->stringPrototype(), DontEnum);
+    return true;
+}
+
+bool JSString::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    // The semantics here are really getPropertySlot, not getOwnPropertySlot.
+    // This function should only be called by JSValue::get.
+    if (getStringPropertySlot(exec, propertyName, slot))
+        return true;
+    return JSString::getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
+}
+
 JSString* jsString(JSGlobalData* globalData, const UString& s)
 {
     int size = s.size();
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h
index 6db9322..1e46551 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h
@@ -23,10 +23,11 @@
 #ifndef JSString_h
 #define JSString_h
 
-#include "CommonIdentifiers.h"
 #include "CallFrame.h"
+#include "CommonIdentifiers.h"
 #include "Identifier.h"
 #include "JSNumberCell.h"
+#include "PropertyDescriptor.h"
 #include "PropertySlot.h"
 
 namespace JSC {
@@ -60,7 +61,7 @@ namespace JSC {
 
     class JSString : public JSCell {
         friend class JIT;
-        friend class VPtrSet;
+        friend struct VPtrSet;
 
     public:
         JSString(JSGlobalData* globalData, const UString& value)
@@ -86,13 +87,12 @@ namespace JSC {
 
         bool getStringPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         bool getStringPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
-
-        bool getStringPropertyAttributes(ExecState*, const Identifier& propertyName, unsigned&) const;
+        bool getStringPropertyDescriptor(ExecState*, const Identifier& propertyName, PropertyDescriptor&);
 
         bool canGetIndex(unsigned i) { return i < static_cast<unsigned>(m_value.size()); }
         JSString* getIndex(JSGlobalData*, unsigned);
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(StringType, NeedsThisConversion)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(StringType, NeedsThisConversion | HasDefaultMark)); }
 
     private:
         enum VPtrStealingHackType { VPtrStealingHack };
@@ -115,6 +115,7 @@ namespace JSC {
         // Actually getPropertySlot, not getOwnPropertySlot (see JSCell).
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
         UString m_value;
     };
@@ -210,7 +211,27 @@ namespace JSC {
 
     inline JSString* JSValue::toThisJSString(ExecState* exec)
     {
-        return JSImmediate::isImmediate(asValue()) ? jsString(exec, JSImmediate::toString(asValue())) : asCell()->toThisJSString(exec);
+        return isCell() ? asCell()->toThisJSString(exec) : jsString(exec, toString(exec));
+    }
+
+    inline UString JSValue::toString(ExecState* exec) const
+    {
+        if (isString())
+            return static_cast<JSString*>(asCell())->value();
+        if (isInt32())
+            return exec->globalData().numericStrings.add(asInt32());
+        if (isDouble())
+            return exec->globalData().numericStrings.add(asDouble());
+        if (isTrue())
+            return "true";
+        if (isFalse())
+            return "false";
+        if (isNull())
+            return "null";
+        if (isUndefined())
+            return "undefined";
+        ASSERT(isCell());
+        return asCell()->toString(exec);
     }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSType.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSType.h
index 68f2890..882b218 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSType.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSType.h
@@ -33,8 +33,10 @@ namespace JSC {
         NumberType        = 3,
         NullType          = 4,
         StringType        = 5,
-        ObjectType        = 6,
-        GetterSetterType  = 7
+        // The CompoundType value must come before any JSType that may have children
+        CompoundType      = 6,
+        ObjectType        = 7,
+        GetterSetterType  = 8
     };
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSTypeInfo.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSTypeInfo.h
index bea188b..279510b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSTypeInfo.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSTypeInfo.h
@@ -27,6 +27,9 @@
 #ifndef JSTypeInfo_h
 #define JSTypeInfo_h
 
+// This file would be called TypeInfo.h, but that conflicts with <typeinfo.h>
+// in the STL on systems without case-sensitive file systems. 
+
 #include "JSType.h"
 
 namespace JSC {
@@ -38,6 +41,8 @@ namespace JSC {
     static const unsigned ImplementsDefaultHasInstance = 1 << 3;
     static const unsigned NeedsThisConversion = 1 << 4;
     static const unsigned HasStandardGetOwnPropertySlot = 1 << 5;
+    static const unsigned HasDefaultMark = 1 << 6;
+    static const unsigned HasDefaultGetPropertyNames = 1 << 7;
 
     class TypeInfo {
         friend class JIT;
@@ -59,7 +64,8 @@ namespace JSC {
         bool overridesHasInstance() const { return m_flags & OverridesHasInstance; }
         bool needsThisConversion() const { return m_flags & NeedsThisConversion; }
         bool hasStandardGetOwnPropertySlot() const { return m_flags & HasStandardGetOwnPropertySlot; }
-
+        bool hasDefaultMark() const { return m_flags & HasDefaultMark; }
+        bool hasDefaultGetPropertyNames() const { return m_flags & HasDefaultGetPropertyNames; }
         unsigned flags() const { return m_flags; }
 
     private:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp
index 885914d..39a4093 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp
@@ -23,8 +23,15 @@
 #include "config.h"
 #include "JSValue.h"
 
+#include "BooleanConstructor.h"
+#include "BooleanPrototype.h"
+#include "ExceptionHelpers.h"
+#include "JSGlobalObject.h"
 #include "JSFunction.h"
+#include "JSNotAnObject.h"
+#include "NumberObject.h"
 #include <wtf/MathExtras.h>
+#include <wtf/StringExtras.h>
 
 namespace JSC {
 
@@ -33,19 +40,97 @@ static const double D32 = 4294967296.0;
 // ECMA 9.4
 double JSValue::toInteger(ExecState* exec) const
 {
-    if (isInt32Fast())
-        return getInt32Fast();
+    if (isInt32())
+        return asInt32();
     double d = toNumber(exec);
     return isnan(d) ? 0.0 : trunc(d);
 }
 
 double JSValue::toIntegerPreserveNaN(ExecState* exec) const
 {
-    if (isInt32Fast())
-        return getInt32Fast();
+    if (isInt32())
+        return asInt32();
     return trunc(toNumber(exec));
 }
 
+JSObject* JSValue::toObjectSlowCase(ExecState* exec) const
+{
+    ASSERT(!isCell());
+
+    if (isInt32() || isDouble())
+        return constructNumber(exec, asValue());
+    if (isTrue() || isFalse())
+        return constructBooleanFromImmediateBoolean(exec, asValue());
+    ASSERT(isUndefinedOrNull());
+    JSNotAnObjectErrorStub* exception = createNotAnObjectErrorStub(exec, isNull());
+    exec->setException(exception);
+    return new (exec) JSNotAnObject(exec, exception);
+}
+
+JSObject* JSValue::toThisObjectSlowCase(ExecState* exec) const
+{
+    ASSERT(!isCell());
+
+    if (isInt32() || isDouble())
+        return constructNumber(exec, asValue());
+    if (isTrue() || isFalse())
+        return constructBooleanFromImmediateBoolean(exec, asValue());
+    ASSERT(isUndefinedOrNull());
+    return exec->globalThisValue();
+}
+
+JSObject* JSValue::synthesizeObject(ExecState* exec) const
+{
+    ASSERT(!isCell());
+    if (isNumber())
+        return constructNumber(exec, asValue());
+    if (isBoolean())
+        return constructBooleanFromImmediateBoolean(exec, asValue());
+    
+    JSNotAnObjectErrorStub* exception = createNotAnObjectErrorStub(exec, isNull());
+    exec->setException(exception);
+    return new (exec) JSNotAnObject(exec, exception);
+}
+
+JSObject* JSValue::synthesizePrototype(ExecState* exec) const
+{
+    ASSERT(!isCell());
+    if (isNumber())
+        return exec->lexicalGlobalObject()->numberPrototype();
+    if (isBoolean())
+        return exec->lexicalGlobalObject()->booleanPrototype();
+
+    JSNotAnObjectErrorStub* exception = createNotAnObjectErrorStub(exec, isNull());
+    exec->setException(exception);
+    return new (exec) JSNotAnObject(exec, exception);
+}
+
+#ifndef NDEBUG
+char* JSValue::description()
+{
+    static const size_t size = 32;
+    static char description[size];
+    if (isInt32())
+        snprintf(description, size, "Int32: %d", asInt32());
+    else if (isDouble())
+        snprintf(description, size, "Double: %lf", asDouble());
+    else if (isCell())
+        snprintf(description, size, "Cell: %p", asCell());
+    else if (isTrue())
+        snprintf(description, size, "True");
+    else if (isFalse())
+        snprintf(description, size, "False");
+    else if (isNull())
+        snprintf(description, size, "Null");
+    else {
+        ASSERT(isUndefined());
+        snprintf(description, size, "Undefined");
+    }
+
+    return description;
+}
+#endif
+
 int32_t toInt32SlowCase(double d, bool& ok)
 {
     ok = true;
@@ -84,4 +169,9 @@ uint32_t toUInt32SlowCase(double d, bool& ok)
     return static_cast<uint32_t>(d32);
 }
 
+NEVER_INLINE double nonInlineNaN()
+{
+    return std::numeric_limits<double>::quiet_NaN();
+}
+
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h
index 391425c..58e74b1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h
@@ -1,7 +1,7 @@
 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2003, 2004, 2005, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2004, 2005, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -20,16 +20,18 @@
  *
  */
 
-#include <stddef.h> // for size_t
-#include <stdint.h>
-
 #ifndef JSValue_h
 #define JSValue_h
 
 #include "CallData.h"
 #include "ConstructData.h"
-#include <wtf/HashTraits.h>
+#include <math.h>
+#include <stddef.h> // for size_t
+#include <stdint.h>
 #include <wtf/AlwaysInline.h>
+#include <wtf/Assertions.h>
+#include <wtf/HashTraits.h>
+#include <wtf/MathExtras.h>
 
 namespace JSC {
 
@@ -48,31 +50,37 @@ namespace JSC {
 
     enum PreferredPrimitiveType { NoPreference, PreferNumber, PreferString };
 
+#if USE(JSVALUE32_64)
+    typedef int64_t EncodedJSValue;
+#else
     typedef void* EncodedJSValue;
+#endif
+
+    double nonInlineNaN();
+    int32_t toInt32SlowCase(double, bool& ok);
+    uint32_t toUInt32SlowCase(double, bool& ok);
 
     class JSValue {
         friend class JSImmediate;
-        friend struct JSValueHashTraits;
-
-        static JSValue makeImmediate(intptr_t value)
-        {
-            return JSValue(reinterpret_cast<JSCell*>(value));
-        }
+        friend struct EncodedJSValueHashTraits;
+        friend class JIT;
+        friend class JITStubs;
+        friend class JITStubCall;
 
-        intptr_t immediateValue()
-        {
-            return reinterpret_cast<intptr_t>(m_ptr);
-        }
-        
     public:
+        static EncodedJSValue encode(JSValue value);
+        static JSValue decode(EncodedJSValue ptr);
+#if !USE(JSVALUE32_64)
+    private:
+        static JSValue makeImmediate(intptr_t value);
+        intptr_t immediateValue();
+    public:
+#endif
         enum JSNullTag { JSNull };
         enum JSUndefinedTag { JSUndefined };
         enum JSTrueTag { JSTrue };
         enum JSFalseTag { JSFalse };
 
-        static EncodedJSValue encode(JSValue value);
-        static JSValue decode(EncodedJSValue ptr);
-
         JSValue();
         JSValue(JSNullTag);
         JSValue(JSUndefinedTag);
@@ -94,20 +102,22 @@ namespace JSC {
         JSValue(ExecState*, long long);
         JSValue(ExecState*, unsigned long long);
         JSValue(JSGlobalData*, double);
-        JSValue(JSGlobalData*, char);
-        JSValue(JSGlobalData*, unsigned char);
-        JSValue(JSGlobalData*, short);
-        JSValue(JSGlobalData*, unsigned short);
         JSValue(JSGlobalData*, int);
         JSValue(JSGlobalData*, unsigned);
-        JSValue(JSGlobalData*, long);
-        JSValue(JSGlobalData*, unsigned long);
-        JSValue(JSGlobalData*, long long);
-        JSValue(JSGlobalData*, unsigned long long);
 
         operator bool() const;
-        bool operator==(const JSValue other) const;
-        bool operator!=(const JSValue other) const;
+        bool operator==(const JSValue& other) const;
+        bool operator!=(const JSValue& other) const;
+
+        bool isInt32() const;
+        bool isUInt32() const;
+        bool isDouble() const;
+        bool isTrue() const;
+        bool isFalse() const;
+
+        int32_t asInt32() const;
+        uint32_t asUInt32() const;
+        double asDouble() const;
 
         // Querying the type.
         bool isUndefined() const;
@@ -118,7 +128,7 @@ namespace JSC {
         bool isString() const;
         bool isGetterSetter() const;
         bool isObject() const;
-        bool isObject(const ClassInfo*) const;
+        bool inherits(const ClassInfo*) const;
         
         // Extracting the value.
         bool getBoolean(bool&) const;
@@ -134,8 +144,6 @@ namespace JSC {
 
         // Extracting integer values.
         bool getUInt32(uint32_t&) const;
-        bool getTruncatedInt32(int32_t&) const;
-        bool getTruncatedUInt32(uint32_t&) const;
         
         // Basic conversions.
         JSValue toPrimitive(ExecState*, PreferredPrimitiveType = NoPreference) const;
@@ -151,38 +159,17 @@ namespace JSC {
         JSObject* toObject(ExecState*) const;
 
         // Integer conversions.
-        // 'x.numberToInt32(output)' is equivalent to 'x.isNumber() && x.toInt32(output)'
         double toInteger(ExecState*) const;
         double toIntegerPreserveNaN(ExecState*) const;
         int32_t toInt32(ExecState*) const;
         int32_t toInt32(ExecState*, bool& ok) const;
-        bool numberToInt32(int32_t& arg);
         uint32_t toUInt32(ExecState*) const;
         uint32_t toUInt32(ExecState*, bool& ok) const;
-        bool numberToUInt32(uint32_t& arg);
-
-        // Fast integer operations; these values return results where the value is trivially available
-        // in a convenient form, for use in optimizations.  No assumptions should be made based on the
-        // results of these operations, for example !isInt32Fast() does not necessarily indicate the
-        // result of getNumber will not be 0.
-        bool isInt32Fast() const;
-        int32_t getInt32Fast() const;
-        bool isUInt32Fast() const;
-        uint32_t getUInt32Fast() const;
-        static JSValue makeInt32Fast(int32_t);
-        static bool areBothInt32Fast(JSValue, JSValue);
 
         // Floating point conversions (this is a convenience method for webcore;
         // signle precision float is not a representation used in JS or JSC).
         float toFloat(ExecState* exec) const { return static_cast<float>(toNumber(exec)); }
 
-        // API Mangled Numbers
-        bool isAPIMangledNumber();
-
-        // Garbage collection.
-        void mark();
-        bool marked() const;
-
         // Object operations, with the toObject operation included.
         JSValue get(ExecState*, const Identifier& propertyName) const;
         JSValue get(ExecState*, const Identifier& propertyName, PropertySlot&) const;
@@ -208,22 +195,72 @@ namespace JSC {
         bool isCell() const;
         JSCell* asCell() const;
 
+#ifndef NDEBUG
+        char* description();
+#endif
+
     private:
         enum HashTableDeletedValueTag { HashTableDeletedValue };
         JSValue(HashTableDeletedValueTag);
 
         inline const JSValue asValue() const { return *this; }
+        JSObject* toObjectSlowCase(ExecState*) const;
+        JSObject* toThisObjectSlowCase(ExecState*) const;
+
+        enum { Int32Tag =        0xffffffff };
+        enum { CellTag =         0xfffffffe };
+        enum { TrueTag =         0xfffffffd };
+        enum { FalseTag =        0xfffffffc };
+        enum { NullTag =         0xfffffffb };
+        enum { UndefinedTag =    0xfffffffa };
+        enum { DeletedValueTag = 0xfffffff9 };
+
+        enum { LowestTag =  DeletedValueTag };
+
+        uint32_t tag() const;
+        int32_t payload() const;
+
+        JSObject* synthesizePrototype(ExecState*) const;
+        JSObject* synthesizeObject(ExecState*) const;
+
+#if USE(JSVALUE32_64)
+        union {
+            EncodedJSValue asEncodedJSValue;
+            double asDouble;
+#if PLATFORM(BIG_ENDIAN)
+            struct {
+                int32_t tag;
+                int32_t payload;
+            } asBits;
+#else
+            struct {
+                int32_t payload;
+                int32_t tag;
+            } asBits;
+#endif
+        } u;
+#else // USE(JSVALUE32_64)
+        JSCell* m_ptr;
+#endif // USE(JSVALUE32_64)
+    };
 
-        bool isDoubleNumber() const;
-        double getDoubleNumber() const;
+#if USE(JSVALUE32_64)
+    typedef IntHash<EncodedJSValue> EncodedJSValueHash;
 
-        JSCell* m_ptr;
+    struct EncodedJSValueHashTraits : HashTraits<EncodedJSValue> {
+        static const bool emptyValueIsZero = false;
+        static EncodedJSValue emptyValue() { return JSValue::encode(JSValue()); }
+        static void constructDeletedValue(EncodedJSValue& slot) { slot = JSValue::encode(JSValue(JSValue::HashTableDeletedValue)); }
+        static bool isDeletedValue(EncodedJSValue value) { return value == JSValue::encode(JSValue(JSValue::HashTableDeletedValue)); }
     };
+#else
+    typedef PtrHash<EncodedJSValue> EncodedJSValueHash;
 
-    struct JSValueHashTraits : HashTraits<EncodedJSValue> {
+    struct EncodedJSValueHashTraits : HashTraits<EncodedJSValue> {
         static void constructDeletedValue(EncodedJSValue& slot) { slot = JSValue::encode(JSValue(JSValue::HashTableDeletedValue)); }
         static bool isDeletedValue(EncodedJSValue value) { return value == JSValue::encode(JSValue(JSValue::HashTableDeletedValue)); }
     };
+#endif
 
     // Stand-alone helper functions.
     inline JSValue jsNull()
@@ -301,61 +338,396 @@ namespace JSC {
         return JSValue(globalData, d);
     }
 
-    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, char i)
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, int i)
     {
         return JSValue(globalData, i);
     }
 
-    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, unsigned char i)
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, unsigned i)
     {
         return JSValue(globalData, i);
     }
 
-    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, short i)
+    inline bool operator==(const JSValue a, const JSCell* b) { return a == JSValue(b); }
+    inline bool operator==(const JSCell* a, const JSValue b) { return JSValue(a) == b; }
+
+    inline bool operator!=(const JSValue a, const JSCell* b) { return a != JSValue(b); }
+    inline bool operator!=(const JSCell* a, const JSValue b) { return JSValue(a) != b; }
+
+    inline int32_t toInt32(double val)
     {
-        return JSValue(globalData, i);
+        if (!(val >= -2147483648.0 && val < 2147483648.0)) {
+            bool ignored;
+            return toInt32SlowCase(val, ignored);
+        }
+        return static_cast<int32_t>(val);
     }
 
-    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, unsigned short i)
+    inline uint32_t toUInt32(double val)
     {
-        return JSValue(globalData, i);
+        if (!(val >= 0.0 && val < 4294967296.0)) {
+            bool ignored;
+            return toUInt32SlowCase(val, ignored);
+        }
+        return static_cast<uint32_t>(val);
     }
 
-    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, int i)
+    ALWAYS_INLINE int32_t JSValue::toInt32(ExecState* exec) const
     {
-        return JSValue(globalData, i);
+        if (isInt32())
+            return asInt32();
+        bool ignored;
+        return toInt32SlowCase(toNumber(exec), ignored);
     }
 
-    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, unsigned i)
+    inline uint32_t JSValue::toUInt32(ExecState* exec) const
     {
-        return JSValue(globalData, i);
+        if (isUInt32())
+            return asInt32();
+        bool ignored;
+        return toUInt32SlowCase(toNumber(exec), ignored);
     }
 
-    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, long i)
+    inline int32_t JSValue::toInt32(ExecState* exec, bool& ok) const
     {
-        return JSValue(globalData, i);
+        if (isInt32()) {
+            ok = true;
+            return asInt32();
+        }
+        return toInt32SlowCase(toNumber(exec), ok);
     }
 
-    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, unsigned long i)
+    inline uint32_t JSValue::toUInt32(ExecState* exec, bool& ok) const
     {
-        return JSValue(globalData, i);
+        if (isUInt32()) {
+            ok = true;
+            return asInt32();
+        }
+        return toUInt32SlowCase(toNumber(exec), ok);
     }
 
-    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, long long i)
+#if USE(JSVALUE32_64)
+    inline JSValue jsNaN(ExecState* exec)
     {
-        return JSValue(globalData, i);
+        return JSValue(exec, nonInlineNaN());
     }
 
-    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, unsigned long long i)
+    // JSValue member functions.
+    inline EncodedJSValue JSValue::encode(JSValue value)
     {
-        return JSValue(globalData, i);
+        return value.u.asEncodedJSValue;
     }
 
-    inline bool operator==(const JSValue a, const JSCell* b) { return a == JSValue(b); }
-    inline bool operator==(const JSCell* a, const JSValue b) { return JSValue(a) == b; }
+    inline JSValue JSValue::decode(EncodedJSValue encodedJSValue)
+    {
+        JSValue v;
+        v.u.asEncodedJSValue = encodedJSValue;
+        return v;
+    }
 
-    inline bool operator!=(const JSValue a, const JSCell* b) { return a != JSValue(b); }
-    inline bool operator!=(const JSCell* a, const JSValue b) { return JSValue(a) != b; }
+    inline JSValue::JSValue()
+    {
+        u.asBits.tag = CellTag;
+        u.asBits.payload = 0;
+    }
+
+    inline JSValue::JSValue(JSNullTag)
+    {
+        u.asBits.tag = NullTag;
+        u.asBits.payload = 0;
+    }
+    
+    inline JSValue::JSValue(JSUndefinedTag)
+    {
+        u.asBits.tag = UndefinedTag;
+        u.asBits.payload = 0;
+    }
+    
+    inline JSValue::JSValue(JSTrueTag)
+    {
+        u.asBits.tag = TrueTag;
+        u.asBits.payload = 0;
+    }
+    
+    inline JSValue::JSValue(JSFalseTag)
+    {
+        u.asBits.tag = FalseTag;
+        u.asBits.payload = 0;
+    }
+
+    inline JSValue::JSValue(HashTableDeletedValueTag)
+    {
+        u.asBits.tag = DeletedValueTag;
+        u.asBits.payload = 0;
+    }
+
+    inline JSValue::JSValue(JSCell* ptr)
+    {
+        u.asBits.tag = CellTag;
+        u.asBits.payload = reinterpret_cast<int32_t>(ptr);
+    }
+
+    inline JSValue::JSValue(const JSCell* ptr)
+    {
+        u.asBits.tag = CellTag;
+        u.asBits.payload = reinterpret_cast<int32_t>(const_cast<JSCell*>(ptr));
+    }
+
+    inline JSValue::operator bool() const
+    {
+        return u.asBits.payload || tag() != CellTag;
+    }
+
+    inline bool JSValue::operator==(const JSValue& other) const
+    {
+        return u.asEncodedJSValue == other.u.asEncodedJSValue;
+    }
+
+    inline bool JSValue::operator!=(const JSValue& other) const
+    {
+        return u.asEncodedJSValue != other.u.asEncodedJSValue;
+    }
+
+    inline bool JSValue::isUndefined() const
+    {
+        return tag() == UndefinedTag;
+    }
+
+    inline bool JSValue::isNull() const
+    {
+        return tag() == NullTag;
+    }
+
+    inline bool JSValue::isUndefinedOrNull() const
+    {
+        return isUndefined() || isNull();
+    }
+
+    inline bool JSValue::isCell() const
+    {
+        return tag() == CellTag;
+    }
+
+    inline bool JSValue::isInt32() const
+    {
+        return tag() == Int32Tag;
+    }
+
+    inline bool JSValue::isUInt32() const
+    {
+        return tag() == Int32Tag && asInt32() > -1;
+    }
+
+    inline bool JSValue::isDouble() const
+    {
+        return tag() < LowestTag;
+    }
+
+    inline bool JSValue::isTrue() const
+    {
+        return tag() == TrueTag;
+    }
+
+    inline bool JSValue::isFalse() const
+    {
+        return tag() == FalseTag;
+    }
+
+    inline uint32_t JSValue::tag() const
+    {
+        return u.asBits.tag;
+    }
+    
+    inline int32_t JSValue::payload() const
+    {
+        return u.asBits.payload;
+    }
+    
+    inline int32_t JSValue::asInt32() const
+    {
+        ASSERT(isInt32());
+        return u.asBits.payload;
+    }
+    
+    inline uint32_t JSValue::asUInt32() const
+    {
+        ASSERT(isUInt32());
+        return u.asBits.payload;
+    }
+    
+    inline double JSValue::asDouble() const
+    {
+        ASSERT(isDouble());
+        return u.asDouble;
+    }
+    
+    ALWAYS_INLINE JSCell* JSValue::asCell() const
+    {
+        ASSERT(isCell());
+        return reinterpret_cast<JSCell*>(u.asBits.payload);
+    }
+
+    inline JSValue::JSValue(ExecState* exec, double d)
+    {
+        const int32_t asInt32 = static_cast<int32_t>(d);
+        if (asInt32 != d || (!asInt32 && signbit(d))) { // true for -0.0
+            u.asDouble = d;
+            return;
+        }
+        *this = JSValue(exec, static_cast<int32_t>(d));
+    }
+
+    inline JSValue::JSValue(ExecState* exec, char i)
+    {
+        *this = JSValue(exec, static_cast<int32_t>(i));
+    }
+
+    inline JSValue::JSValue(ExecState* exec, unsigned char i)
+    {
+        *this = JSValue(exec, static_cast<int32_t>(i));
+    }
+
+    inline JSValue::JSValue(ExecState* exec, short i)
+    {
+        *this = JSValue(exec, static_cast<int32_t>(i));
+    }
+
+    inline JSValue::JSValue(ExecState* exec, unsigned short i)
+    {
+        *this = JSValue(exec, static_cast<int32_t>(i));
+    }
+
+    inline JSValue::JSValue(ExecState*, int i)
+    {
+        u.asBits.tag = Int32Tag;
+        u.asBits.payload = i;
+    }
+
+    inline JSValue::JSValue(ExecState* exec, unsigned i)
+    {
+        if (static_cast<int32_t>(i) < 0) {
+            *this = JSValue(exec, static_cast<double>(i));
+            return;
+        }
+        *this = JSValue(exec, static_cast<int32_t>(i));
+    }
+
+    inline JSValue::JSValue(ExecState* exec, long i)
+    {
+        if (static_cast<int32_t>(i) != i) {
+            *this = JSValue(exec, static_cast<double>(i));
+            return;
+        }
+        *this = JSValue(exec, static_cast<int32_t>(i));
+    }
+
+    inline JSValue::JSValue(ExecState* exec, unsigned long i)
+    {
+        if (static_cast<uint32_t>(i) != i) {
+            *this = JSValue(exec, static_cast<double>(i));
+            return;
+        }
+        *this = JSValue(exec, static_cast<uint32_t>(i));
+    }
+
+    inline JSValue::JSValue(ExecState* exec, long long i)
+    {
+        if (static_cast<int32_t>(i) != i) {
+            *this = JSValue(exec, static_cast<double>(i));
+            return;
+        }
+        *this = JSValue(exec, static_cast<int32_t>(i));
+    }
+
+    inline JSValue::JSValue(ExecState* exec, unsigned long long i)
+    {
+        if (static_cast<uint32_t>(i) != i) {
+            *this = JSValue(exec, static_cast<double>(i));
+            return;
+        }
+        *this = JSValue(exec, static_cast<uint32_t>(i));
+    }
+
+    inline JSValue::JSValue(JSGlobalData* globalData, double d)
+    {
+        const int32_t asInt32 = static_cast<int32_t>(d);
+        if (asInt32 != d || (!asInt32 && signbit(d))) { // true for -0.0
+            u.asDouble = d;
+            return;
+        }
+        *this = JSValue(globalData, static_cast<int32_t>(d));
+    }
+    
+    inline JSValue::JSValue(JSGlobalData*, int i)
+    {
+        u.asBits.tag = Int32Tag;
+        u.asBits.payload = i;
+    }
+    
+    inline JSValue::JSValue(JSGlobalData* globalData, unsigned i)
+    {
+        if (static_cast<int32_t>(i) < 0) {
+            *this = JSValue(globalData, static_cast<double>(i));
+            return;
+        }
+        *this = JSValue(globalData, static_cast<int32_t>(i));
+    }
+
+    inline bool JSValue::isNumber() const
+    {
+        return isInt32() || isDouble();
+    }
+
+    inline bool JSValue::isBoolean() const
+    {
+        return isTrue() || isFalse();
+    }
+
+    inline bool JSValue::getBoolean(bool& v) const
+    {
+        if (isTrue()) {
+            v = true;
+            return true;
+        }
+        if (isFalse()) {
+            v = false;
+            return true;
+        }
+        
+        return false;
+    }
+
+    inline bool JSValue::getBoolean() const
+    {
+        ASSERT(isBoolean());
+        return tag() == TrueTag;
+    }
+
+    inline double JSValue::uncheckedGetNumber() const
+    {
+        ASSERT(isNumber());
+        return isInt32() ? asInt32() : asDouble();
+    }
+
+    ALWAYS_INLINE JSValue JSValue::toJSNumber(ExecState* exec) const
+    {
+        return isNumber() ? asValue() : jsNumber(exec, this->toNumber(exec));
+    }
+
+    inline bool JSValue::getNumber(double& result) const
+    {
+        if (isInt32()) {
+            result = asInt32();
+            return true;
+        }
+        if (isDouble()) {
+            result = asDouble();
+            return true;
+        }
+        return false;
+    }
+
+#else // USE(JSVALUE32_64)
 
     // JSValue member functions.
     inline EncodedJSValue JSValue::encode(JSValue value)
@@ -368,6 +740,16 @@ namespace JSC {
         return JSValue(reinterpret_cast<JSCell*>(ptr));
     }
 
+    inline JSValue JSValue::makeImmediate(intptr_t value)
+    {
+        return JSValue(reinterpret_cast<JSCell*>(value));
+    }
+
+    inline intptr_t JSValue::immediateValue()
+    {
+        return reinterpret_cast<intptr_t>(m_ptr);
+    }
+    
     // 0x0 can never occur naturally because it has a tag of 00, indicating a pointer value, but a payload of 0x0, which is in the (invalid) zero page.
     inline JSValue::JSValue()
         : m_ptr(0)
@@ -395,12 +777,12 @@ namespace JSC {
         return m_ptr;
     }
 
-    inline bool JSValue::operator==(const JSValue other) const
+    inline bool JSValue::operator==(const JSValue& other) const
     {
         return m_ptr == other.m_ptr;
     }
 
-    inline bool JSValue::operator!=(const JSValue other) const
+    inline bool JSValue::operator!=(const JSValue& other) const
     {
         return m_ptr != other.m_ptr;
     }
@@ -414,6 +796,7 @@ namespace JSC {
     {
         return asValue() == jsNull();
     }
+#endif // USE(JSVALUE32_64)
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.cpp
index 78993b6..6586393 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.cpp
@@ -30,26 +30,27 @@
 #include "JSVariableObject.h"
 
 #include "PropertyNameArray.h"
+#include "PropertyDescriptor.h"
 
 namespace JSC {
 
-bool JSVariableObject::deleteProperty(ExecState* exec, const Identifier& propertyName, bool checkDontDelete)
+bool JSVariableObject::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
     if (symbolTable().contains(propertyName.ustring().rep()))
         return false;
 
-    return JSObject::deleteProperty(exec, propertyName, checkDontDelete);
+    return JSObject::deleteProperty(exec, propertyName);
 }
 
-void JSVariableObject::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSVariableObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     SymbolTable::const_iterator end = symbolTable().end();
     for (SymbolTable::const_iterator it = symbolTable().begin(); it != end; ++it) {
-        if ((listedAttributes & Structure::NonEnumerable) || !(it->second.getAttributes() & DontEnum))
+        if (!(it->second.getAttributes() & DontEnum))
             propertyNames.add(Identifier(exec, it->first.get()));
     }
     
-    JSObject::getPropertyNames(exec, propertyNames, listedAttributes);
+    JSObject::getOwnPropertyNames(exec, propertyNames);
 }
 
 bool JSVariableObject::getPropertyAttributes(ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
@@ -67,4 +68,14 @@ bool JSVariableObject::isVariableObject() const
     return true;
 }
 
+bool JSVariableObject::symbolTableGet(const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    SymbolTableEntry entry = symbolTable().inlineGet(propertyName.ustring().rep());
+    if (!entry.isNull()) {
+        descriptor.setDescriptor(registerAt(entry.getIndex()).jsValue(), entry.getAttributes() | DontDelete);
+        return true;
+    }
+    return false;
+}
+
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h
index 310efb1..7c80d36 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h
@@ -48,8 +48,8 @@ namespace JSC {
 
         virtual void putWithAttributes(ExecState*, const Identifier&, JSValue, unsigned attributes) = 0;
 
-        virtual bool deleteProperty(ExecState*, const Identifier&, bool checkDontDelete = true);
-        virtual void getPropertyNames(ExecState*, PropertyNameArray&, unsigned listedAttributes = Structure::Prototype);
+        virtual bool deleteProperty(ExecState*, const Identifier&);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
         
         virtual bool isVariableObject() const;
         virtual bool isDynamicScope() const = 0;
@@ -58,6 +58,11 @@ namespace JSC {
 
         Register& registerAt(int index) const { return d->registers[index]; }
 
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        {
+            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark));
+        }
+        
     protected:
         // Subclasses of JSVariableObject can subclass this struct to add data
         // without increasing their own size (since there's a hard limit on the
@@ -89,6 +94,7 @@ namespace JSC {
         void setRegisters(Register* r, Register* registerArray);
 
         bool symbolTableGet(const Identifier&, PropertySlot&);
+        bool symbolTableGet(const Identifier&, PropertyDescriptor&);
         bool symbolTableGet(const Identifier&, PropertySlot&, bool& slotIsWriteable);
         bool symbolTablePut(const Identifier&, JSValue);
         bool symbolTablePutWithAttributes(const Identifier&, JSValue, unsigned attributes);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.cpp
index fb57018..2c39f5c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.cpp
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 2006 Maks Orlovich
- *  Copyright (C) 2006 Apple Computer, Inc.
+ *  Copyright (C) 2006, 2009 Apple, Inc.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -26,11 +26,11 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(JSWrapperObject);
 
-void JSWrapperObject::mark() 
+void JSWrapperObject::markChildren(MarkStack& markStack) 
 {
-    JSObject::mark();
-    if (m_internalValue && !m_internalValue.marked())
-        m_internalValue.mark();
+    JSObject::markChildren(markStack);
+    if (m_internalValue)
+        markStack.append(m_internalValue);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h
index 2a2e3c6..b56a58d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h
@@ -25,7 +25,7 @@
 #include "JSObject.h"
 
 namespace JSC {
-    
+
     // This class is used as a base for classes such as String,
     // Number, Boolean and Date which are wrappers for primitive types.
     class JSWrapperObject : public JSObject {
@@ -35,23 +35,31 @@ namespace JSC {
     public:
         JSValue internalValue() const { return m_internalValue; }
         void setInternalValue(JSValue);
-        
-        virtual void mark();
-        
+
+        static PassRefPtr<Structure> createStructure(JSValue prototype) 
+        { 
+            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultGetPropertyNames | HasDefaultMark));
+        }
+
     private:
+        virtual void markChildren(MarkStack&);
+        
         JSValue m_internalValue;
     };
-    
+
     inline JSWrapperObject::JSWrapperObject(PassRefPtr<Structure> structure)
         : JSObject(structure)
     {
+        addAnonymousSlots(1);
+        putAnonymousValue(0, jsNull());
     }
-    
+
     inline void JSWrapperObject::setInternalValue(JSValue value)
     {
         ASSERT(value);
         ASSERT(!value.isObject());
         m_internalValue = value;
+        putAnonymousValue(0, value);
     }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.cpp
index 798013a..d242282 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.cpp
@@ -129,7 +129,8 @@ template <LiteralParser::ParserMode mode> static inline bool isSafeStringCharact
     return (c >= ' ' && (mode == LiteralParser::StrictJSON || c <= 0xff) && c != '\\' && c != '"') || c == '\t';
 }
 
-template <LiteralParser::ParserMode mode> LiteralParser::TokenType LiteralParser::Lexer::lexString(LiteralParserToken& token)
+// "inline" is required here to help WINSCW compiler resolve specialized argument in templated functions.
+template <LiteralParser::ParserMode mode> inline LiteralParser::TokenType LiteralParser::Lexer::lexString(LiteralParserToken& token)
 {
     ++m_ptr;
     const UChar* runStart;
@@ -294,7 +295,10 @@ JSValue LiteralParser::parse(ParserState initialState)
             }
             doParseArrayStartExpression:
             case DoParseArrayStartExpression: {
+                TokenType lastToken = m_lexer.currentToken().type;
                 if (m_lexer.next() == TokRBracket) {
+                    if (lastToken == TokComma)
+                        return JSValue();
                     m_lexer.next();
                     lastValue = objectStack.last();
                     objectStack.removeLast();
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.h b/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.h
index bceee7c..0f8072b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.h
@@ -89,7 +89,7 @@ namespace JSC {
             
         private:
             TokenType lex(LiteralParserToken&);
-            template <ParserMode parserMode> TokenType lexString(LiteralParserToken&);
+            template <ParserMode mode> TokenType lexString(LiteralParserToken&);
             TokenType lexNumber(LiteralParserToken&);
             LiteralParserToken m_currentToken;
             UString m_string;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h
index 167f2bc..4d70689 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h
@@ -51,7 +51,7 @@ namespace JSC {
     typedef PropertySlot::GetValueFunc GetFunction;
     typedef void (*PutFunction)(ExecState*, JSObject* baseObject, JSValue value);
 
-    class HashEntry {
+    class HashEntry : public FastAllocBase {
     public:
         void initialize(UString::Rep* key, unsigned char attributes, intptr_t v1, intptr_t v2)
         {
@@ -186,6 +186,24 @@ namespace JSC {
         return true;
     }
 
+    template <class ThisImp, class ParentImp>
+    inline bool getStaticPropertyDescriptor(ExecState* exec, const HashTable* table, ThisImp* thisObj, const Identifier& propertyName, PropertyDescriptor& descriptor)
+    {
+        const HashEntry* entry = table->entry(exec, propertyName);
+        
+        if (!entry) // not found, forward to parent
+            return thisObj->ParentImp::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+ 
+        PropertySlot slot;
+        if (entry->attributes() & Function)
+            setUpStaticFunctionSlot(exec, entry, thisObj, propertyName, slot);
+        else
+            slot.setCustom(thisObj, entry->propertyGetter());
+
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+
     /**
      * Simplified version of getStaticPropertySlot in case there are only functions.
      * Using this instead of getStaticPropertySlot allows 'this' to avoid implementing
@@ -204,6 +222,27 @@ namespace JSC {
         setUpStaticFunctionSlot(exec, entry, thisObj, propertyName, slot);
         return true;
     }
+    
+    /**
+     * Simplified version of getStaticPropertyDescriptor in case there are only functions.
+     * Using this instead of getStaticPropertyDescriptor allows 'this' to avoid implementing
+     * a dummy getValueProperty.
+     */
+    template <class ParentImp>
+    inline bool getStaticFunctionDescriptor(ExecState* exec, const HashTable* table, JSObject* thisObj, const Identifier& propertyName, PropertyDescriptor& descriptor)
+    {
+        if (static_cast<ParentImp*>(thisObj)->ParentImp::getOwnPropertyDescriptor(exec, propertyName, descriptor))
+            return true;
+        
+        const HashEntry* entry = table->entry(exec, propertyName);
+        if (!entry)
+            return false;
+        
+        PropertySlot slot;
+        setUpStaticFunctionSlot(exec, entry, thisObj, propertyName, slot);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
 
     /**
      * Simplified version of getStaticPropertySlot in case there are no functions, only "values".
@@ -224,6 +263,25 @@ namespace JSC {
     }
 
     /**
+     * Simplified version of getStaticPropertyDescriptor in case there are no functions, only "values".
+     * Using this instead of getStaticPropertyDescriptor removes the need for a FuncImp class.
+     */
+    template <class ThisImp, class ParentImp>
+    inline bool getStaticValueDescriptor(ExecState* exec, const HashTable* table, ThisImp* thisObj, const Identifier& propertyName, PropertyDescriptor& descriptor)
+    {
+        const HashEntry* entry = table->entry(exec, propertyName);
+        
+        if (!entry) // not found, forward to parent
+            return thisObj->ParentImp::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+        
+        ASSERT(!(entry->attributes() & Function));
+        PropertySlot slot;
+        slot.setCustom(thisObj, entry->propertyGetter());
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+
+    /**
      * This one is for "put".
      * It looks up a hash entry for the property to be set.  If an entry
      * is found it sets the value and returns true, else it returns false.
diff --git a/src/3rdparty/webkit/WebCore/page/Geoposition.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStack.cpp
index 8f7a5c8..a350c35 100644
--- a/src/3rdparty/webkit/WebCore/page/Geoposition.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStack.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -24,13 +24,17 @@
  */
 
 #include "config.h"
-#include "Geoposition.h"
+#include "MarkStack.h"
 
-namespace WebCore {
+namespace JSC {
 
-String Geoposition::toString() const
+size_t MarkStack::s_pageSize = 0;
+
+void MarkStack::compact()
 {
-    return "position(" + m_coordinates->toString() + String::format(", %.lld)", m_timestamp);
+    ASSERT(s_pageSize);
+    m_values.shrinkAllocation(s_pageSize);
+    m_markSets.shrinkAllocation(s_pageSize);
 }
 
-} // namespace WebCore
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStack.h b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStack.h
new file mode 100644
index 0000000..5bc85fa
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStack.h
@@ -0,0 +1,187 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef MarkStack_h
+#define MarkStack_h
+
+#include "JSValue.h"
+#include <wtf/Noncopyable.h>
+
+namespace JSC {
+
+    class JSGlobalData;
+    class Register;
+    
+    enum MarkSetProperties { MayContainNullValues, NoNullValues };
+    
+    class MarkStack : Noncopyable {
+    public:
+        MarkStack(void* jsArrayVPtr)
+            : m_jsArrayVPtr(jsArrayVPtr)
+#ifndef NDEBUG
+            , m_isCheckingForDefaultMarkViolation(false)
+#endif
+        {
+        }
+
+        ALWAYS_INLINE void append(JSValue);
+        ALWAYS_INLINE void append(JSCell*);
+        
+        ALWAYS_INLINE void appendValues(Register* values, size_t count, MarkSetProperties properties = NoNullValues)
+        {
+            appendValues(reinterpret_cast<JSValue*>(values), count, properties);
+        }
+
+        ALWAYS_INLINE void appendValues(JSValue* values, size_t count, MarkSetProperties properties = NoNullValues)
+        {
+            if (count)
+                m_markSets.append(MarkSet(values, values + count, properties));
+        }
+
+        inline void drain();
+        void compact();
+
+        ~MarkStack()
+        {
+            ASSERT(m_markSets.isEmpty());
+            ASSERT(m_values.isEmpty());
+        }
+
+    private:
+        void markChildren(JSCell*);
+
+        struct MarkSet {
+            MarkSet(JSValue* values, JSValue* end, MarkSetProperties properties)
+                : m_values(values)
+                , m_end(end)
+                , m_properties(properties)
+            {
+                ASSERT(values);
+            }
+            JSValue* m_values;
+            JSValue* m_end;
+            MarkSetProperties m_properties;
+        };
+
+        static void* allocateStack(size_t size);
+        static void releaseStack(void* addr, size_t size);
+
+        static void initializePagesize();
+        static size_t pageSize()
+        {
+            if (!s_pageSize)
+                initializePagesize();
+            return s_pageSize;
+        }
+
+        template <typename T> struct MarkStackArray {
+            MarkStackArray()
+                : m_top(0)
+                , m_allocated(MarkStack::pageSize())
+                , m_capacity(m_allocated / sizeof(T))
+            {
+                m_data = reinterpret_cast<T*>(allocateStack(m_allocated));
+            }
+
+            ~MarkStackArray()
+            {
+                releaseStack(m_data, m_allocated);
+            }
+
+            void expand()
+            {
+                size_t oldAllocation = m_allocated;
+                m_allocated *= 2;
+                m_capacity = m_allocated / sizeof(T);
+                void* newData = allocateStack(m_allocated);
+                memcpy(newData, m_data, oldAllocation);
+                releaseStack(m_data, oldAllocation);
+                m_data = reinterpret_cast<T*>(newData);
+            }
+
+            inline void append(const T& v)
+            {
+                if (m_top == m_capacity)
+                    expand();
+                m_data[m_top++] = v;
+            }
+
+            inline T removeLast()
+            {
+                ASSERT(m_top);
+                return m_data[--m_top];
+            }
+            
+            inline T& last()
+            {
+                ASSERT(m_top);
+                return m_data[m_top - 1];
+            }
+
+            inline bool isEmpty()
+            {
+                return m_top == 0;
+            }
+
+            inline size_t size() { return m_top; }
+
+            inline void shrinkAllocation(size_t size)
+            {
+                ASSERT(size <= m_allocated);
+                ASSERT(0 == (size % MarkStack::pageSize()));
+                if (size == m_allocated)
+                    return;
+#if PLATFORM(WIN)
+                // We cannot release a part of a region with VirtualFree.  To get around this,
+                // we'll release the entire region and reallocate the size that we want.
+                releaseStack(m_data, m_allocated);
+                m_data = reinterpret_cast<T*>(allocateStack(size));
+#else
+                releaseStack(reinterpret_cast<char*>(m_data) + size, m_allocated - size);
+#endif
+                m_allocated = size;
+                m_capacity = m_allocated / sizeof(T);
+            }
+
+        private:
+            size_t m_top;
+            size_t m_allocated;
+            size_t m_capacity;
+            T* m_data;
+        };
+
+        void* m_jsArrayVPtr;
+        MarkStackArray<MarkSet> m_markSets;
+        MarkStackArray<JSCell*> m_values;
+        static size_t s_pageSize;
+
+#ifndef NDEBUG
+    public:
+        bool m_isCheckingForDefaultMarkViolation;
+#endif
+    };
+}
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackPosix.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackPosix.cpp
new file mode 100644
index 0000000..8e78ff3
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackPosix.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+
+#include "MarkStack.h"
+
+#include <unistd.h>
+#include <sys/mman.h>
+
+namespace JSC {
+
+void MarkStack::initializePagesize()
+{
+    MarkStack::s_pageSize = getpagesize();
+}
+
+void* MarkStack::allocateStack(size_t size)
+{
+    return mmap(0, size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0);
+}
+void MarkStack::releaseStack(void* addr, size_t size)
+{
+    munmap(addr, size);
+}
+
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackWin.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackWin.cpp
new file mode 100644
index 0000000..1fdd06a
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackWin.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+
+#include "MarkStack.h"
+
+#include "windows.h"
+
+namespace JSC {
+
+void MarkStack::initializePagesize()
+{
+    SYSTEM_INFO system_info;
+    GetSystemInfo(&system_info);
+    MarkStack::s_pageSize = system_info.dwPageSize;
+}
+
+void* MarkStack::allocateStack(size_t size)
+{
+    return VirtualAlloc(0, size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
+}
+void MarkStack::releaseStack(void* addr, size_t)
+{
+    // According to http://msdn.microsoft.com/en-us/library/aa366892(VS.85).aspx,
+    // dwSize must be 0 if dwFreeType is MEM_RELEASE.
+    VirtualFree(addr, 0, MEM_RELEASE);
+}
+
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.cpp
index 2572bc9..36771ab 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.cpp
@@ -103,14 +103,12 @@ MathObject::MathObject(ExecState* exec, PassRefPtr<Structure> structure)
 
 bool MathObject::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot &slot)
 {
-    const HashEntry* entry = ExecState::mathTable(exec)->entry(exec, propertyName);
-
-    if (!entry)
-        return JSObject::getOwnPropertySlot(exec, propertyName, slot);
+    return getStaticFunctionSlot<JSObject>(exec, ExecState::mathTable(exec), this, propertyName, slot);
+}
 
-    ASSERT(entry->attributes() & Function);
-    setUpStaticFunctionSlot(exec, entry, this, propertyName, slot);
-    return true;
+bool MathObject::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, ExecState::mathTable(exec), this, propertyName, descriptor);
 }
 
 // ------------------------------ Functions --------------------------------
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h
index 3557d1e..a2e065f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h
@@ -30,13 +30,14 @@ namespace JSC {
         MathObject(ExecState*, PassRefPtr<Structure>);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType));
+            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultMark | HasDefaultGetPropertyNames));
         }
     };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NativeErrorPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/NativeErrorPrototype.cpp
index 650a0fd..84190a0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NativeErrorPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NativeErrorPrototype.cpp
@@ -30,11 +30,7 @@ namespace JSC {
 ASSERT_CLASS_FITS_IN_CELL(NativeErrorPrototype);
 
 NativeErrorPrototype::NativeErrorPrototype(ExecState* exec, PassRefPtr<Structure> structure, const UString& name, const UString& message)
-#ifdef QT_BUILD_SCRIPT_LIB
-    : ErrorInstance(structure)
-#else
     : JSObject(structure)
-#endif
 {
     putDirect(exec->propertyNames().name, jsString(exec, name), 0);
     putDirect(exec->propertyNames().message, jsString(exec, message), 0);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NativeErrorPrototype.h b/src/3rdparty/webkit/JavaScriptCore/runtime/NativeErrorPrototype.h
index 48a9d7e..77bfe8a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NativeErrorPrototype.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NativeErrorPrototype.h
@@ -22,19 +22,10 @@
 #define NativeErrorPrototype_h
 
 #include "JSObject.h"
-#ifdef QT_BUILD_SCRIPT_LIB
-#include "ErrorInstance.h"
-#endif
 
 namespace JSC {
 
-    class NativeErrorPrototype :
-#ifdef QT_BUILD_SCRIPT_LIB    //According to ECMAScript Specification 15.11.7, errors must have the "Error" class
-        public ErrorInstance
-#else
-        public JSObject
-#endif
-    {
+    class NativeErrorPrototype : public JSObject {
     public:
         NativeErrorPrototype(ExecState*, PassRefPtr<Structure>, const UString& name, const UString& message);
     };
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.cpp
index 2840bf0..a95106d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.cpp
@@ -68,6 +68,11 @@ bool NumberConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<NumberConstructor, InternalFunction>(exec, ExecState::numberTable(exec), this, propertyName, slot);
 }
 
+bool NumberConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<NumberConstructor, InternalFunction>(exec, ExecState::numberTable(exec), this, propertyName, descriptor);
+}
+
 static JSValue numberConstructorNaNValue(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNaN(exec);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h
index b1224ec..710ac86 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h
@@ -32,13 +32,14 @@ namespace JSC {
         NumberConstructor(ExecState*, PassRefPtr<Structure>, NumberPrototype*);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
         JSValue getValueProperty(ExecState*, int token) const;
 
         static const ClassInfo info;
 
         static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+            return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | HasDefaultMark | HasDefaultGetPropertyNames)); 
         }
 
         enum { NaNValue, NegInfinity, PosInfinity, MaxValue, MinValue };
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h
index d354b9b..f502bee 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h
@@ -30,7 +30,17 @@ namespace JSC {
         explicit NumberObject(PassRefPtr<Structure>);
 
         static const ClassInfo info;
-
+#if USE(JSVALUE32)
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        {
+            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultGetPropertyNames));
+        }
+#else
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        {
+            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames));
+        }
+#endif
     private:
         virtual const ClassInfo* classInfo() const { return &info; }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumericStrings.h b/src/3rdparty/webkit/JavaScriptCore/runtime/NumericStrings.h
new file mode 100644
index 0000000..c0696a4
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumericStrings.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef NumericStrings_h
+#define NumericStrings_h
+
+#include "UString.h"
+#include <wtf/HashFunctions.h>
+
+namespace JSC {
+
+    class NumericStrings {
+    public:
+        UString add(double d)
+        {
+            CacheEntry<double>& entry = lookup(d);
+            if (d == entry.key && !entry.value.isNull())
+                return entry.value;
+            entry.key = d;
+            entry.value = UString::from(d);
+            return entry.value;
+        }
+
+        UString add(int i)
+        {
+            CacheEntry<int>& entry = lookup(i);
+            if (i == entry.key && !entry.value.isNull())
+                return entry.value;
+            entry.key = i;
+            entry.value = UString::from(i);
+            return entry.value;
+        }
+
+    private:
+        static const size_t cacheSize = 64;
+
+        template<typename T>
+        struct CacheEntry {
+            T key;
+            UString value;
+        };
+
+        CacheEntry<double>& lookup(double d) { return doubleCache[WTF::FloatHash<double>::hash(d) & (cacheSize - 1)]; }
+        CacheEntry<int>& lookup(int i) { return intCache[WTF::IntHash<int>::hash(i) & (cacheSize - 1)]; }
+
+        CacheEntry<double> doubleCache[cacheSize];
+        CacheEntry<int> intCache[cacheSize];
+    };
+
+} // namespace JSC
+
+#endif // NumericStrings_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp
index cf1790f..fd45c45 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp
@@ -21,22 +21,35 @@
 #include "config.h"
 #include "ObjectConstructor.h"
 
+#include "Error.h"
 #include "JSFunction.h"
+#include "JSArray.h"
 #include "JSGlobalObject.h"
 #include "ObjectPrototype.h"
+#include "PropertyDescriptor.h"
+#include "PropertyNameArray.h"
+#include "PrototypeFunction.h"
 
 namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(ObjectConstructor);
 
-ObjectConstructor::ObjectConstructor(ExecState* exec, PassRefPtr<Structure> structure, ObjectPrototype* objectPrototype)
-    : InternalFunction(&exec->globalData(), structure, Identifier(exec, "Object"))
+static JSValue JSC_HOST_CALL objectConstructorGetPrototypeOf(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectConstructorGetOwnPropertyDescriptor(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectConstructorKeys(ExecState*, JSObject*, JSValue, const ArgList&);
+
+ObjectConstructor::ObjectConstructor(ExecState* exec, PassRefPtr<Structure> structure, ObjectPrototype* objectPrototype, Structure* prototypeFunctionStructure)
+: InternalFunction(&exec->globalData(), structure, Identifier(exec, "Object"))
 {
     // ECMA 15.2.3.1
     putDirectWithoutTransition(exec->propertyNames().prototype, objectPrototype, DontEnum | DontDelete | ReadOnly);
-
+    
     // no. of arguments for constructor
     putDirectWithoutTransition(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly | DontEnum | DontDelete);
+    
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().getPrototypeOf, objectConstructorGetPrototypeOf), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 2, exec->propertyNames().getOwnPropertyDescriptor, objectConstructorGetOwnPropertyDescriptor), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().keys, objectConstructorKeys), DontEnum);
 }
 
 // ECMA 15.2.2
@@ -70,4 +83,54 @@ CallType ObjectConstructor::getCallData(CallData& callData)
     return CallTypeHost;
 }
 
+JSValue JSC_HOST_CALL objectConstructorGetPrototypeOf(ExecState* exec, JSObject*, JSValue, const ArgList& args)
+{
+    if (!args.at(0).isObject())
+        return throwError(exec, TypeError, "Requested prototype of a value that is not an object.");
+    return asObject(args.at(0))->prototype();
+}
+
+JSValue JSC_HOST_CALL objectConstructorGetOwnPropertyDescriptor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
+{
+    if (!args.at(0).isObject())
+        return throwError(exec, TypeError, "Requested property descriptor of a value that is not an object.");
+    UString propertyName = args.at(1).toString(exec);
+    if (exec->hadException())
+        return jsNull();
+    JSObject* object = asObject(args.at(0));
+    PropertyDescriptor descriptor;
+    if (!object->getOwnPropertyDescriptor(exec, Identifier(exec, propertyName), descriptor))
+        return jsUndefined();
+    if (exec->hadException())
+        return jsUndefined();
+    ASSERT(descriptor.isValid());
+
+    JSObject* description = constructEmptyObject(exec);
+    if (!descriptor.hasAccessors()) {
+        description->putDirect(exec->propertyNames().value, descriptor.value(), 0);
+        description->putDirect(exec->propertyNames().writable, jsBoolean(descriptor.writable()), 0);
+    } else {
+        description->putDirect(exec->propertyNames().get, descriptor.getter(), 0);
+        description->putDirect(exec->propertyNames().set, descriptor.setter(), 0);
+    }
+    
+    description->putDirect(exec->propertyNames().enumerable, jsBoolean(descriptor.enumerable()), 0);
+    description->putDirect(exec->propertyNames().configurable, jsBoolean(descriptor.configurable()), 0);
+
+    return description;
+}
+
+JSValue JSC_HOST_CALL objectConstructorKeys(ExecState* exec, JSObject*, JSValue, const ArgList& args)
+{
+    if (!args.at(0).isObject())
+        return throwError(exec, TypeError, "Requested keys of a value that is not an object.");
+    PropertyNameArray properties(exec);
+    asObject(args.at(0))->getOwnPropertyNames(exec, properties);
+    JSArray* keys = constructEmptyArray(exec);
+    size_t numProperties = properties.size();
+    for (size_t i = 0; i < numProperties; i++)
+        keys->push(exec, jsOwnedString(exec, properties[i].ustring()));
+    return keys;
+}
+
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.h
index f8c058a..9373781 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.h
@@ -29,7 +29,7 @@ namespace JSC {
 
     class ObjectConstructor : public InternalFunction {
     public:
-        ObjectConstructor(ExecState*, PassRefPtr<Structure>, ObjectPrototype*);
+        ObjectConstructor(ExecState*, PassRefPtr<Structure>, ObjectPrototype*, Structure* prototypeFunctionStructure);
 
     private:
         virtual ConstructType getConstructData(ConstructData&);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.cpp
index 98e4713..fccc44a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.cpp
@@ -42,6 +42,7 @@ static JSValue JSC_HOST_CALL objectProtoFuncToLocaleString(ExecState*, JSObject*
 
 ObjectPrototype::ObjectPrototype(ExecState* exec, PassRefPtr<Structure> stucture, Structure* prototypeFunctionStructure)
     : JSObject(stucture)
+    , m_hasNoPropertiesWithUInt32Names(true)
 {
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, objectProtoFuncToString), DontEnum);
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().toLocaleString, objectProtoFuncToLocaleString), DontEnum);
@@ -57,6 +58,24 @@ ObjectPrototype::ObjectPrototype(ExecState* exec, PassRefPtr<Structure> stucture
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().__lookupSetter__, objectProtoFuncLookupSetter), DontEnum);
 }
 
+void ObjectPrototype::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    JSObject::put(exec, propertyName, value, slot);
+
+    if (m_hasNoPropertiesWithUInt32Names) {
+        bool isUInt32;
+        propertyName.toStrictUInt32(&isUInt32);
+        m_hasNoPropertiesWithUInt32Names = !isUInt32;
+    }
+}
+
+bool ObjectPrototype::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    if (m_hasNoPropertiesWithUInt32Names)
+        return false;
+    return JSObject::getOwnPropertySlot(exec, propertyName, slot);
+}
+
 // ------------------------------ Functions --------------------------------
 
 // ECMA 15.2.4.2, 15.2.4.4, 15.2.4.5, 15.2.4.7
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.h
index 7790ae0..6dd3c28 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.h
@@ -28,6 +28,12 @@ namespace JSC {
     class ObjectPrototype : public JSObject {
     public:
         ObjectPrototype(ExecState*, PassRefPtr<Structure>, Structure* prototypeFunctionStructure);
+
+    private:
+        virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
+        virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
+
+        bool m_hasNoPropertiesWithUInt32Names;
     };
 
     JSValue JSC_HOST_CALL objectProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h
index acfc6c2..5da9e38 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h
@@ -38,7 +38,7 @@ namespace JSC {
     // ECMA 11.9.3
     inline bool JSValue::equal(ExecState* exec, JSValue v1, JSValue v2)
     {
-        if (JSImmediate::areBothImmediateIntegerNumbers(v1, v2))
+        if (v1.isInt32() && v2.isInt32())
             return v1 == v2;
 
         return equalSlowCase(exec, v1, v2);
@@ -46,8 +46,6 @@ namespace JSC {
 
     ALWAYS_INLINE bool JSValue::equalSlowCaseInline(ExecState* exec, JSValue v1, JSValue v2)
     {
-        ASSERT(!JSImmediate::areBothImmediateIntegerNumbers(v1, v2));
-
         do {
             if (v1.isNumber() && v2.isNumber())
                 return v1.uncheckedGetNumber() == v2.uncheckedGetNumber();
@@ -60,13 +58,13 @@ namespace JSC {
             if (v1.isUndefinedOrNull()) {
                 if (v2.isUndefinedOrNull())
                     return true;
-                if (JSImmediate::isImmediate(v2))
+                if (!v2.isCell())
                     return false;
                 return v2.asCell()->structure()->typeInfo().masqueradesAsUndefined();
             }
 
             if (v2.isUndefinedOrNull()) {
-                if (JSImmediate::isImmediate(v1))
+                if (!v1.isCell())
                     return false;
                 return v1.asCell()->structure()->typeInfo().masqueradesAsUndefined();
             }
@@ -78,7 +76,7 @@ namespace JSC {
                 if (exec->hadException())
                     return false;
                 v1 = p1;
-                if (JSImmediate::areBothImmediateIntegerNumbers(v1, v2))
+                if (v1.isInt32() && v2.isInt32())
                     return v1 == v2;
                 continue;
             }
@@ -88,7 +86,7 @@ namespace JSC {
                 if (exec->hadException())
                     return false;
                 v2 = p2;
-                if (JSImmediate::areBothImmediateIntegerNumbers(v1, v2))
+                if (v1.isInt32() && v2.isInt32())
                     return v1 == v2;
                 continue;
             }
@@ -114,7 +112,7 @@ namespace JSC {
     // ECMA 11.9.3
     ALWAYS_INLINE bool JSValue::strictEqualSlowCaseInline(JSValue v1, JSValue v2)
     {
-        ASSERT(!JSImmediate::isEitherImmediate(v1, v2));
+        ASSERT(v1.isCell() && v2.isCell());
 
         if (v1.asCell()->isString() && v2.asCell()->isString())
             return asString(v1)->value() == asString(v2)->value();
@@ -124,13 +122,13 @@ namespace JSC {
 
     inline bool JSValue::strictEqual(JSValue v1, JSValue v2)
     {
-        if (JSImmediate::areBothImmediateIntegerNumbers(v1, v2))
+        if (v1.isInt32() && v2.isInt32())
             return v1 == v2;
 
         if (v1.isNumber() && v2.isNumber())
             return v1.uncheckedGetNumber() == v2.uncheckedGetNumber();
 
-        if (JSImmediate::isEitherImmediate(v1, v2))
+        if (!v1.isCell() || !v2.isCell())
             return v1 == v2;
 
         return strictEqualSlowCaseInline(v1, v2);
@@ -138,8 +136,8 @@ namespace JSC {
 
     inline bool jsLess(CallFrame* callFrame, JSValue v1, JSValue v2)
     {
-        if (JSValue::areBothInt32Fast(v1, v2))
-            return v1.getInt32Fast() < v2.getInt32Fast();
+        if (v1.isInt32() && v2.isInt32())
+            return v1.asInt32() < v2.asInt32();
 
         double n1;
         double n2;
@@ -163,8 +161,8 @@ namespace JSC {
 
     inline bool jsLessEq(CallFrame* callFrame, JSValue v1, JSValue v2)
     {
-        if (JSValue::areBothInt32Fast(v1, v2))
-            return v1.getInt32Fast() <= v2.getInt32Fast();
+        if (v1.isInt32() && v2.isInt32())
+            return v1.asInt32() <= v2.asInt32();
 
         double n1;
         double n2;
@@ -213,8 +211,8 @@ namespace JSC {
         }
 
         if (rightIsNumber & leftIsString) {
-            RefPtr<UString::Rep> value = v2.isInt32Fast() ?
-                concatenate(asString(v1)->value().rep(), v2.getInt32Fast()) :
+            RefPtr<UString::Rep> value = v2.isInt32() ?
+                concatenate(asString(v1)->value().rep(), v2.asInt32()) :
                 concatenate(asString(v1)->value().rep(), right);
 
             if (!value)
@@ -310,20 +308,13 @@ namespace JSC {
             resultRep = UString::Rep::createEmptyBuffer(bufferSize);
         UString result(resultRep);
 
-        // Loop over the openards, writing them into the output buffer.
+        // Loop over the operands, writing them into the output buffer.
         for (unsigned i = 0; i < count; ++i) {
             JSValue v = strings[i].jsValue();
             if (LIKELY(v.isString()))
                 result.append(asString(v)->value());
-            else if (v.isInt32Fast())
-                result.appendNumeric(v.getInt32Fast());
-            else {
-                double d;
-                if (v.getNumber(d))
-                    result.appendNumeric(d);
-                else
-                    result.append(v.toString(callFrame));
-            }
+            else
+                result.append(v.toString(callFrame));
         }
 
         return jsString(callFrame, result);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.cpp
new file mode 100644
index 0000000..d892e0a
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.cpp
@@ -0,0 +1,103 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+
+#include "config.h"
+
+#include "PropertyDescriptor.h"
+
+#include "GetterSetter.h"
+#include "JSObject.h"
+
+namespace JSC {
+bool PropertyDescriptor::writable() const
+{
+    ASSERT(!hasAccessors());
+    return !(m_attributes & ReadOnly);
+}
+
+bool PropertyDescriptor::enumerable() const
+{
+    ASSERT(isValid());
+    return !(m_attributes & DontEnum);
+}
+
+bool PropertyDescriptor::configurable() const
+{
+    ASSERT(isValid());
+    return !(m_attributes & DontDelete);
+}
+
+bool PropertyDescriptor::hasAccessors() const
+{
+    return !!(m_attributes & (Getter | Setter));
+}
+
+void PropertyDescriptor::setUndefined()
+{
+    m_value = jsUndefined();
+    m_attributes = ReadOnly | DontDelete | DontEnum;
+}
+
+JSValue PropertyDescriptor::getter() const
+{
+    ASSERT(hasAccessors());
+    if (!m_getter)
+        return jsUndefined();
+    return m_getter;
+}
+
+JSValue PropertyDescriptor::setter() const
+{
+    ASSERT(hasAccessors());
+    if (!m_setter)
+        return jsUndefined();
+    return m_setter;
+}
+
+void PropertyDescriptor::setDescriptor(JSValue value, unsigned attributes)
+{
+    ASSERT(value);
+    if (attributes & (Getter | Setter)) {
+        GetterSetter* accessor = asGetterSetter(value);
+        m_getter = accessor->getter();
+        m_setter = accessor->setter();
+        ASSERT(m_getter || m_setter);
+    } else {
+        m_value = value;
+    }
+    m_attributes = attributes;
+}
+
+void PropertyDescriptor::setAccessorDescriptor(JSValue getter, JSValue setter, unsigned attributes)
+{
+    ASSERT(attributes & (Getter | Setter));
+    ASSERT(getter || setter);
+    m_attributes = attributes;
+    m_getter = getter;
+    m_setter = setter;
+}
+
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.h b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.h
new file mode 100644
index 0000000..ad7c056
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef PropertyDescriptor_h
+#define PropertyDescriptor_h
+
+#include "JSValue.h"
+
+namespace JSC {
+    class PropertyDescriptor {
+    public:
+        PropertyDescriptor()
+            : m_attributes(0)
+        {
+        }
+        bool writable() const;
+        bool enumerable() const;
+        bool configurable() const;
+        bool hasAccessors() const;
+        unsigned attributes() const { return m_attributes; }
+#ifndef NDEBUG
+        bool isValid() const { return m_value || ((m_getter || m_setter) && hasAccessors()); }
+#endif
+        JSValue value() const { ASSERT(m_value); return m_value; }
+        JSValue getter() const;
+        JSValue setter() const;
+        void setUndefined();
+        void setDescriptor(JSValue value, unsigned attributes);
+        void setAccessorDescriptor(JSValue getter, JSValue setter, unsigned attributes);
+    private:
+        // May be a getter/setter
+        JSValue m_value;
+        JSValue m_getter;
+        JSValue m_setter;
+        unsigned m_attributes;
+    };
+}
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyMapHashTable.h b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyMapHashTable.h
index 44dc2b8..5b63f79 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyMapHashTable.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyMapHashTable.h
@@ -61,6 +61,7 @@ namespace JSC {
         unsigned size;
         unsigned keyCount;
         unsigned deletedSentinelCount;
+        unsigned anonymousSlotCount;
         unsigned lastIndexUsed;
         Vector<unsigned>* deletedOffsets;
         unsigned entryIndices[1];
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.h b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.h
index 67ee9c8..b4382f4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.h
@@ -24,7 +24,6 @@
 #include "CallFrame.h"
 #include "Identifier.h"
 #include "Structure.h"
-#include "StructureChain.h"
 #include <wtf/HashSet.h>
 #include <wtf/Vector.h>
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.cpp
index 36fa5d8..a0a2f48 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.cpp
@@ -23,7 +23,6 @@
 
 #include "JSFunction.h"
 #include "JSGlobalObject.h"
-#include "JSObject.h"
 
 namespace JSC {
 
@@ -39,7 +38,7 @@ JSValue PropertySlot::functionGetter(ExecState* exec, const Identifier&, const P
         return callData.native.function(exec, slot.m_data.getterFunc, slot.slotBase(), exec->emptyList());
     ASSERT(callType == CallTypeJS);
     // FIXME: Can this be done more efficiently using the callData?
-    return static_cast<JSFunction*>(slot.m_data.getterFunc)->call(exec, slot.slotBase(), exec->emptyList());
+    return asFunction(slot.m_data.getterFunc)->call(exec, slot.slotBase(), exec->emptyList());
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.h b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.h
index da0d152..15d9034 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.h
@@ -23,7 +23,6 @@
 
 #include "Identifier.h"
 #include "JSValue.h"
-#include "JSImmediate.h"
 #include "Register.h"
 #include <wtf/Assertions.h>
 #include <wtf/NotFound.h>
@@ -39,16 +38,16 @@ namespace JSC {
     class PropertySlot {
     public:
         PropertySlot()
-            : m_offset(WTF::notFound)
         {
             clearBase();
+            clearOffset();
             clearValue();
         }
 
         explicit PropertySlot(const JSValue base)
             : m_slotBase(base)
-            , m_offset(WTF::notFound)
         {
+            clearOffset();
             clearValue();
         }
 
@@ -82,8 +81,9 @@ namespace JSC {
         void setValueSlot(JSValue* valueSlot) 
         {
             ASSERT(valueSlot);
-            m_getValue = JSC_VALUE_SLOT_MARKER;
             clearBase();
+            clearOffset();
+            m_getValue = JSC_VALUE_SLOT_MARKER;
             m_data.valueSlot = valueSlot;
         }
         
@@ -107,8 +107,9 @@ namespace JSC {
         void setValue(JSValue value)
         {
             ASSERT(value);
-            m_getValue = JSC_VALUE_SLOT_MARKER;
             clearBase();
+            clearOffset();
+            m_getValue = JSC_VALUE_SLOT_MARKER;
             m_value = value;
             m_data.valueSlot = &m_value;
         }
@@ -116,8 +117,9 @@ namespace JSC {
         void setRegisterSlot(Register* registerSlot)
         {
             ASSERT(registerSlot);
-            m_getValue = JSC_REGISTER_SLOT_MARKER;
             clearBase();
+            clearOffset();
+            m_getValue = JSC_REGISTER_SLOT_MARKER;
             m_data.registerSlot = registerSlot;
         }
 
@@ -147,13 +149,11 @@ namespace JSC {
         
         void setUndefined()
         {
-            clearBase();
             setValue(jsUndefined());
         }
 
         JSValue slotBase() const
         {
-            ASSERT(m_slotBase);
             return m_slotBase;
         }
 
@@ -178,6 +178,13 @@ namespace JSC {
 #endif
         }
 
+        void clearOffset()
+        {
+            // Clear offset even in release builds, in case this PropertySlot has been used before.
+            // (For other data members, we don't need to clear anything because reuse would meaningfully overwrite them.)
+            m_offset = WTF::notFound;
+        }
+
         unsigned index() const { return m_data.index; }
 
     private:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Protect.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Protect.h
index 6e7984c..224164d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Protect.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Protect.h
@@ -98,7 +98,7 @@ namespace JSC {
         
         JSValue get() const { return m_value; }
         operator JSValue() const { return m_value; }
-        //JSValue operator->() const { return m_value; }
+        JSValue operator->() const { return m_value; }
         
         operator bool() const { return m_value; }
         bool operator!() const { return !m_value; }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.cpp
index b366b58..7dd4a8f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.cpp
@@ -72,35 +72,12 @@ inline RegExp::RegExp(JSGlobalData* globalData, const UString& pattern, const US
 {
     // NOTE: The global flag is handled on a case-by-case basis by functions like
     // String::match and RegExpObject::match.
-#ifndef QT_BUILD_SCRIPT_LIB
     if (flags.find('g') != -1)
         m_flagBits |= Global;
     if (flags.find('i') != -1)
         m_flagBits |= IgnoreCase;
     if (flags.find('m') != -1)
         m_flagBits |= Multiline;
-#else //Invalid flags should throw a SyntaxError (ECMA Script 15.10.4.1)
-    static const char flagError[] = "invalid regular expression flag";
-    for (int i = 0; i < flags.size(); i++) {
-        switch (flags.data()[i]) {
-        case 'g':
-            m_flagBits |= Global;
-            break;
-        case 'i':
-            m_flagBits |= IgnoreCase;
-            break;
-        case 'm':
-            m_flagBits |= Multiline;
-            break;
-        default:
-            m_constructionError = flagError;
-#if !ENABLE(YARR)
-            m_regExp = 0;
-#endif
-            return;
-        }
-    }
-#endif
 
     compile(globalData);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
index e468521..1c95175 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
@@ -23,6 +23,7 @@
 #include "RegExpConstructor.h"
 
 #include "ArrayPrototype.h"
+#include "Error.h"
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "JSString.h"
@@ -89,7 +90,7 @@ const ClassInfo RegExpConstructor::info = { "Function", &InternalFunction::info,
 @end
 */
 
-struct RegExpConstructorPrivate {
+struct RegExpConstructorPrivate : FastAllocBase {
     // Global search cache / settings
     RegExpConstructorPrivate()
         : lastNumSubPatterns(0)
@@ -233,6 +234,11 @@ bool RegExpConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<RegExpConstructor, InternalFunction>(exec, ExecState::regExpConstructorTable(exec), this, propertyName, slot);
 }
 
+bool RegExpConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<RegExpConstructor, InternalFunction>(exec, ExecState::regExpConstructorTable(exec), this, propertyName, descriptor);
+}
+
 JSValue regExpConstructorDollar1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 1);
@@ -329,7 +335,7 @@ JSObject* constructRegExp(ExecState* exec, const ArgList& args)
     JSValue arg0 = args.at(0);
     JSValue arg1 = args.at(1);
 
-    if (arg0.isObject(&RegExpObject::info)) {
+    if (arg0.inherits(&RegExpObject::info)) {
         if (!arg1.isUndefined())
             return throwError(exec, TypeError, "Cannot supply flags when constructing one RegExp from another.");
         return asObject(arg0);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h
index 6823f3f..4b06b51 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h
@@ -36,11 +36,12 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance));
+            return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance | HasDefaultMark | HasDefaultGetPropertyNames));
         }
 
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
         static const ClassInfo info;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpMatchesArray.h b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpMatchesArray.h
index cbba85a..829f7cf 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpMatchesArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpMatchesArray.h
@@ -44,6 +44,13 @@ namespace JSC {
             return JSArray::getOwnPropertySlot(exec, propertyName, slot);
         }
 
+        virtual bool getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+        {
+            if (lazyCreationData())
+                fillArrayInstance(exec);
+            return JSArray::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+        }
+
         virtual void put(ExecState* exec, const Identifier& propertyName, JSValue v, PutPropertySlot& slot)
         {
             if (lazyCreationData())
@@ -58,25 +65,25 @@ namespace JSC {
             JSArray::put(exec, propertyName, v);
         }
 
-        virtual bool deleteProperty(ExecState* exec, const Identifier& propertyName, bool checkDontDelete = true)
+        virtual bool deleteProperty(ExecState* exec, const Identifier& propertyName)
         {
             if (lazyCreationData())
                 fillArrayInstance(exec);
-            return JSArray::deleteProperty(exec, propertyName, checkDontDelete);
+            return JSArray::deleteProperty(exec, propertyName);
         }
 
-        virtual bool deleteProperty(ExecState* exec, unsigned propertyName, bool checkDontDelete = true)
+        virtual bool deleteProperty(ExecState* exec, unsigned propertyName)
         {
             if (lazyCreationData())
                 fillArrayInstance(exec);
-            return JSArray::deleteProperty(exec, propertyName, checkDontDelete);
+            return JSArray::deleteProperty(exec, propertyName);
         }
 
-        virtual void getPropertyNames(ExecState* exec, PropertyNameArray& arr, unsigned listedAttributes)
+        virtual void getOwnPropertyNames(ExecState* exec, PropertyNameArray& arr)
         {
             if (lazyCreationData())
                 fillArrayInstance(exec);
-            JSArray::getPropertyNames(exec, arr, listedAttributes);
+            JSArray::getOwnPropertyNames(exec, arr);
         }
 
         void fillArrayInstance(ExecState*);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp
index 687844e..9d9dd7d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp
@@ -72,6 +72,11 @@ bool RegExpObject::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<RegExpObject, JSObject>(exec, ExecState::regExpTable(exec), this, propertyName, slot);
 }
 
+bool RegExpObject::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<RegExpObject, JSObject>(exec, ExecState::regExpTable(exec), this, propertyName, descriptor);
+}
+
 JSValue regExpObjectGlobal(ExecState*, const Identifier&, const PropertySlot& slot)
 {
     return jsBoolean(asRegExpObject(slot.slotBase())->regExp()->global());
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
index fac9978..67113b6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
@@ -41,6 +41,7 @@ namespace JSC {
         JSValue exec(ExecState*, const ArgList&);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
 
         virtual const ClassInfo* classInfo() const { return &info; }
@@ -48,7 +49,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType));
+            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultMark | HasDefaultGetPropertyNames));
         }
 
     private:
@@ -56,7 +57,7 @@ namespace JSC {
 
         virtual CallType getCallData(CallData&);
 
-        struct RegExpObjectData {
+        struct RegExpObjectData : FastAllocBase {
             RegExpObjectData(PassRefPtr<RegExp> regExp, double lastIndex)
                 : regExp(regExp)
                 , lastIndex(lastIndex)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpPrototype.cpp
index e507016..30420e9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpPrototype.cpp
@@ -22,6 +22,7 @@
 #include "RegExpPrototype.h"
 
 #include "ArrayPrototype.h"
+#include "Error.h"
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "JSObject.h"
@@ -58,28 +59,28 @@ RegExpPrototype::RegExpPrototype(ExecState* exec, PassRefPtr<Structure> structur
     
 JSValue JSC_HOST_CALL regExpProtoFuncTest(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue.isObject(&RegExpObject::info))
+    if (!thisValue.inherits(&RegExpObject::info))
         return throwError(exec, TypeError);
     return asRegExpObject(thisValue)->test(exec, args);
 }
 
 JSValue JSC_HOST_CALL regExpProtoFuncExec(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue.isObject(&RegExpObject::info))
+    if (!thisValue.inherits(&RegExpObject::info))
         return throwError(exec, TypeError);
     return asRegExpObject(thisValue)->exec(exec, args);
 }
 
 JSValue JSC_HOST_CALL regExpProtoFuncCompile(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue.isObject(&RegExpObject::info))
+    if (!thisValue.inherits(&RegExpObject::info))
         return throwError(exec, TypeError);
 
     RefPtr<RegExp> regExp;
     JSValue arg0 = args.at(0);
     JSValue arg1 = args.at(1);
     
-    if (arg0.isObject(&RegExpObject::info)) {
+    if (arg0.inherits(&RegExpObject::info)) {
         if (!arg1.isUndefined())
             return throwError(exec, TypeError, "Cannot supply flags when constructing one RegExp from another.");
         regExp = asRegExpObject(arg0)->regExp();
@@ -99,17 +100,13 @@ JSValue JSC_HOST_CALL regExpProtoFuncCompile(ExecState* exec, JSObject*, JSValue
 
 JSValue JSC_HOST_CALL regExpProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue.isObject(&RegExpObject::info)) {
-        if (thisValue.isObject(&RegExpPrototype::info))
+    if (!thisValue.inherits(&RegExpObject::info)) {
+        if (thisValue.inherits(&RegExpPrototype::info))
             return jsNontrivialString(exec, "//");
         return throwError(exec, TypeError);
     }
 
     UString result = "/" + asRegExpObject(thisValue)->get(exec, exec->propertyNames().source).toString(exec);
-#ifdef QT_BUILD_SCRIPT_LIB
-    if (result.size() == 1)
-        result.append("(?:)");
-#endif
     result.append('/');
     if (asRegExpObject(thisValue)->get(exec, exec->propertyNames().global).toBoolean(exec))
         result.append('g');
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.cpp
index 5c2edab..960c525 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.cpp
@@ -56,7 +56,7 @@ int ScopeChain::localDepth() const
     int scopeDepth = 0;
     ScopeChainIterator iter = this->begin();
     ScopeChainIterator end = this->end();
-    while (!(*iter)->isObject(&JSActivation::info)) {
+    while (!(*iter)->inherits(&JSActivation::info)) {
         ++iter;
         if (iter == end)
             break;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h
index 17aff24..c5e16c9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2003, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2008, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -28,6 +28,7 @@ namespace JSC {
     class JSGlobalData;
     class JSGlobalObject;
     class JSObject;
+    class MarkStack;
     class ScopeChainIterator;
     
     class ScopeChainNode : public FastAllocBase {
@@ -204,7 +205,7 @@ namespace JSC {
         
         JSGlobalObject* globalObject() const { return m_node->globalObject(); }
 
-        void mark() const;
+        void markAggregate(MarkStack&) const;
 
         // Caution: this should only be used if the codeblock this is being used
         // with needs a full scope chain, otherwise this returns the depth of
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChainMark.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChainMark.h
index b80b8ef..984d101 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChainMark.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChainMark.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2003, 2006, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -25,13 +25,10 @@
 
 namespace JSC {
 
-    inline void ScopeChain::mark() const
+    inline void ScopeChain::markAggregate(MarkStack& markStack) const
     {
-        for (ScopeChainNode* n = m_node; n; n = n->next) {
-            JSObject* o = n->object;
-            if (!o->marked())
-                o->mark();
-        }
+        for (ScopeChainNode* n = m_node; n; n = n->next)
+            markStack.append(n->object);
     }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.cpp
index 9d1f01a..04701cb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.cpp
@@ -82,13 +82,13 @@ SmallStrings::~SmallStrings()
 {
 }
 
-void SmallStrings::mark()
+void SmallStrings::markChildren(MarkStack& markStack)
 {
-    if (m_emptyString && !m_emptyString->marked())
-        m_emptyString->mark();
+    if (m_emptyString)
+        markStack.append(m_emptyString);
     for (unsigned i = 0; i < numCharactersToStore; ++i) {
-        if (m_singleCharacterStrings[i] && !m_singleCharacterStrings[i]->marked())
-            m_singleCharacterStrings[i]->mark();
+        if (m_singleCharacterStrings[i])
+            markStack.append(m_singleCharacterStrings[i]);
     }
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.h b/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.h
index f0dd8df..efecbb0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -33,7 +33,7 @@ namespace JSC {
 
     class JSGlobalData;
     class JSString;
-
+    class MarkStack;
     class SmallStringsStorage;
 
     class SmallStrings : public Noncopyable {
@@ -56,7 +56,7 @@ namespace JSC {
 
         UString::Rep* singleCharacterStringRep(unsigned char character);
 
-        void mark();
+        void markChildren(MarkStack&);
 
         unsigned count() const;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.cpp
index 4745a98..465435c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.cpp
@@ -61,6 +61,13 @@ bool StringObject::getOwnPropertySlot(ExecState* exec, unsigned propertyName, Pr
     return JSObject::getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
+bool StringObject::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    if (internalValue()->getStringPropertyDescriptor(exec, propertyName, descriptor))
+        return true;    
+    return JSObject::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
 void StringObject::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (propertyName == exec->propertyNames().length)
@@ -68,45 +75,19 @@ void StringObject::put(ExecState* exec, const Identifier& propertyName, JSValue
     JSObject::put(exec, propertyName, value, slot);
 }
 
-bool StringObject::deleteProperty(ExecState* exec, const Identifier& propertyName, bool checkDontDelete)
+bool StringObject::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
     if (propertyName == exec->propertyNames().length)
         return false;
-    bool isStrictUInt32;
-    unsigned i = propertyName.toStrictUInt32(&isStrictUInt32);
-    if (isStrictUInt32 && internalValue()->canGetIndex(i))
-        return false;
-    return JSObject::deleteProperty(exec, propertyName, checkDontDelete);
+    return JSObject::deleteProperty(exec, propertyName);
 }
 
-void StringObject::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void StringObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     int size = internalValue()->value().size();
     for (int i = 0; i < size; ++i)
         propertyNames.add(Identifier(exec, UString::from(i)));
-    return JSObject::getPropertyNames(exec, propertyNames, listedAttributes);
-}
-
-bool StringObject::getPropertyAttributes(ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
-{
-    if (internalValue()->getStringPropertyAttributes(exec, propertyName, attributes))
-        return true;
-    return JSObject::getPropertyAttributes(exec, propertyName, attributes);
-}
-
-UString StringObject::toString(ExecState*) const
-{
-    return internalValue()->value();
-}
-
-UString StringObject::toThisString(ExecState*) const
-{
-    return internalValue()->value();
-}
-
-JSString* StringObject::toThisJSString(ExecState*)
-{
-    return internalValue();
+    return JSObject::getOwnPropertyNames(exec, propertyNames);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h
index fdeb2c1..5a889da 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h
@@ -35,11 +35,11 @@ namespace JSC {
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
         virtual void put(ExecState* exec, const Identifier& propertyName, JSValue, PutPropertySlot&);
-        virtual bool deleteProperty(ExecState*, const Identifier& propertyName, bool checkDontDelete = true);
-        virtual void getPropertyNames(ExecState*, PropertyNameArray&, unsigned listedAttributes = Structure::Prototype);
-        virtual bool getPropertyAttributes(ExecState*, const Identifier& propertyName, unsigned& attributes) const;
+        virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
 
         virtual const ClassInfo* classInfo() const { return &info; }
         static const JS_EXPORTDATA ClassInfo info;
@@ -53,11 +53,6 @@ namespace JSC {
 
     protected:
         StringObject(PassRefPtr<Structure>, JSString*);
-
-    private:
-        virtual UString toString(ExecState*) const;
-        virtual UString toThisString(ExecState*) const;
-        virtual JSString* toThisJSString(ExecState*);
   };
 
     StringObject* asStringObject(JSValue);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
index bc5c0a5..1d2e03f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
@@ -44,7 +44,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, MasqueradesAsUndefined)); 
+            return Structure::create(proto, TypeInfo(ObjectType, MasqueradesAsUndefined | HasDefaultMark)); 
         }
 
         virtual bool toBoolean(ExecState*) const { return false; }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp
index ceb6b1e..c9a32b6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp
@@ -23,6 +23,8 @@
 #include "StringPrototype.h"
 
 #include "CachedCall.h"
+#include "Error.h"
+#include "Executable.h"
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "ObjectPrototype.h"
@@ -131,6 +133,11 @@ bool StringPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticFunctionSlot<StringObject>(exec, ExecState::stringTable(exec), this, propertyName, slot);
 }
 
+bool StringPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<StringObject>(exec, ExecState::stringTable(exec), this, propertyName, descriptor);
+}
+
 // ------------------------------ Functions --------------------------
 
 static inline UString substituteBackreferences(const UString& replacement, const UString& source, const int* ovector, RegExp* reg)
@@ -220,7 +227,7 @@ JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue
     if (callType == CallTypeNone)
         replacementString = replacement.toString(exec);
 
-    if (pattern.isObject(&RegExpObject::info)) {
+    if (pattern.inherits(&RegExpObject::info)) {
         RegExp* reg = asRegExpObject(pattern)->regExp();
         bool global = reg->global();
 
@@ -365,7 +372,7 @@ JSValue JSC_HOST_CALL stringProtoFuncToString(ExecState* exec, JSObject*, JSValu
     if (thisValue.isString())
         return thisValue;
 
-    if (thisValue.isObject(&StringObject::info))
+    if (thisValue.inherits(&StringObject::info))
         return asStringObject(thisValue)->internalValue();
 
     return throwError(exec, TypeError);
@@ -376,8 +383,8 @@ JSValue JSC_HOST_CALL stringProtoFuncCharAt(ExecState* exec, JSObject*, JSValue
     UString s = thisValue.toThisString(exec);
     unsigned len = s.size();
     JSValue a0 = args.at(0);
-    if (a0.isUInt32Fast()) {
-        uint32_t i = a0.getUInt32Fast();
+    if (a0.isUInt32()) {
+        uint32_t i = a0.asUInt32();
         if (i < len)
             return jsSingleCharacterSubstring(exec, s, i);
         return jsEmptyString(exec);
@@ -393,8 +400,8 @@ JSValue JSC_HOST_CALL stringProtoFuncCharCodeAt(ExecState* exec, JSObject*, JSVa
     UString s = thisValue.toThisString(exec);
     unsigned len = s.size();
     JSValue a0 = args.at(0);
-    if (a0.isUInt32Fast()) {
-        uint32_t i = a0.getUInt32Fast();
+    if (a0.isUInt32()) {
+        uint32_t i = a0.asUInt32();
         if (i < len)
             return jsNumber(exec, s.data()[i]);
         return jsNaN(exec);
@@ -426,8 +433,8 @@ JSValue JSC_HOST_CALL stringProtoFuncIndexOf(ExecState* exec, JSObject*, JSValue
     int pos;
     if (a1.isUndefined())
         pos = 0;
-    else if (a1.isUInt32Fast())
-        pos = min<uint32_t>(a1.getUInt32Fast(), len);
+    else if (a1.isUInt32())
+        pos = min<uint32_t>(a1.asUInt32(), len);
     else {
         double dpos = a1.toInteger(exec);
         if (dpos < 0)
@@ -466,7 +473,7 @@ JSValue JSC_HOST_CALL stringProtoFuncMatch(ExecState* exec, JSObject*, JSValue t
     UString u = s;
     RefPtr<RegExp> reg;
     RegExpObject* imp = 0;
-    if (a0.isObject(&RegExpObject::info))
+    if (a0.inherits(&RegExpObject::info))
         reg = asRegExpObject(a0)->regExp();
     else {
         /*
@@ -516,7 +523,7 @@ JSValue JSC_HOST_CALL stringProtoFuncSearch(ExecState* exec, JSObject*, JSValue
 
     UString u = s;
     RefPtr<RegExp> reg;
-    if (a0.isObject(&RegExpObject::info))
+    if (a0.inherits(&RegExpObject::info))
         reg = asRegExpObject(a0)->regExp();
     else { 
         /*
@@ -568,7 +575,7 @@ JSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec, JSObject*, JSValue t
     unsigned i = 0;
     int p0 = 0;
     unsigned limit = a1.isUndefined() ? 0xFFFFFFFFU : a1.toUInt32(exec);
-    if (a0.isObject(&RegExpObject::info)) {
+    if (a0.inherits(&RegExpObject::info)) {
         RegExp* reg = asRegExpObject(a0)->regExp();
         if (s.isEmpty() && reg->match(s, 0) >= 0) {
             // empty string matched by regexp -> empty array
@@ -821,8 +828,8 @@ JSValue JSC_HOST_CALL stringProtoFuncFontsize(ExecState* exec, JSObject*, JSValu
     if (a0.getUInt32(smallInteger) && smallInteger <= 9) {
         unsigned stringSize = s.size();
         unsigned bufferSize = 22 + stringSize;
-        UChar* buffer = static_cast<UChar*>(tryFastMalloc(bufferSize * sizeof(UChar)));
-        if (!buffer)
+        UChar* buffer;
+        if (!tryFastMalloc(bufferSize * sizeof(UChar)).getValue(buffer))
             return jsUndefined();
         buffer[0] = '<';
         buffer[1] = 'f';
@@ -869,8 +876,8 @@ JSValue JSC_HOST_CALL stringProtoFuncLink(ExecState* exec, JSObject*, JSValue th
     unsigned linkTextSize = linkText.size();
     unsigned stringSize = s.size();
     unsigned bufferSize = 15 + linkTextSize + stringSize;
-    UChar* buffer = static_cast<UChar*>(tryFastMalloc(bufferSize * sizeof(UChar)));
-    if (!buffer)
+    UChar* buffer;
+    if (!tryFastMalloc(bufferSize * sizeof(UChar)).getValue(buffer))
         return jsUndefined();
     buffer[0] = '<';
     buffer[1] = 'a';
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.h
index 6f5344e..580e13d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.h
@@ -32,6 +32,7 @@ namespace JSC {
         StringPrototype(ExecState*, PassRefPtr<Structure>);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
index 38c086e..34c27b7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -130,14 +130,11 @@ Structure::Structure(JSValue prototype, const TypeInfo& typeInfo)
     , m_isDictionary(false)
     , m_isPinnedPropertyTable(false)
     , m_hasGetterSetterProperties(false)
-    , m_usingSingleTransitionSlot(true)
     , m_attributesInPrevious(0)
 {
     ASSERT(m_prototype);
     ASSERT(m_prototype.isObject() || m_prototype.isNull());
 
-    m_transitions.singleTransition = 0;
-
 #ifndef NDEBUG
 #if ENABLE(JSC_MULTIPLE_THREADS)
     MutexLocker protect(ignoreSetMutex);
@@ -156,20 +153,16 @@ Structure::Structure(JSValue prototype, const TypeInfo& typeInfo)
 Structure::~Structure()
 {
     if (m_previous) {
-        if (m_previous->m_usingSingleTransitionSlot) {
-            m_previous->m_transitions.singleTransition = 0;
-        } else {
-            ASSERT(m_previous->m_transitions.table->contains(make_pair(m_nameInPrevious.get(), make_pair(m_attributesInPrevious, m_specificValueInPrevious))));
-            m_previous->m_transitions.table->remove(make_pair<RefPtr<UString::Rep>, std::pair<unsigned,JSCell*> >(m_nameInPrevious.get(), make_pair(m_attributesInPrevious, m_specificValueInPrevious)));
-        }
+        if (m_nameInPrevious)
+            m_previous->table.remove(make_pair(m_nameInPrevious.get(), m_attributesInPrevious), m_specificValueInPrevious);
+        else
+            m_previous->table.removeAnonymousSlotTransition(m_anonymousSlotsInPrevious);
+
     }
 
     if (m_cachedPropertyNameArrayData)
         m_cachedPropertyNameArrayData->setCachedStructure(0);
 
-    if (!m_usingSingleTransitionSlot)
-        delete m_transitions.table;
-
     if (m_propertyTable) {
         unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
         for (unsigned i = 1; i <= entryCount; i++) {
@@ -279,15 +272,25 @@ void Structure::materializePropertyMap()
 
     for (ptrdiff_t i = structures.size() - 2; i >= 0; --i) {
         structure = structures[i];
+        if (!structure->m_nameInPrevious) {
+            m_propertyTable->anonymousSlotCount += structure->m_anonymousSlotsInPrevious;
+            continue;
+        }
         structure->m_nameInPrevious->ref();
         PropertyMapEntry entry(structure->m_nameInPrevious.get(), structure->m_offset, structure->m_attributesInPrevious, structure->m_specificValueInPrevious, ++m_propertyTable->lastIndexUsed);
         insertIntoPropertyMapHashTable(entry);
     }
 }
 
-void Structure::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, JSObject* baseObject, unsigned listedAttributes)
+void Structure::getOwnEnumerablePropertyNames(ExecState* exec, PropertyNameArray& propertyNames, JSObject* baseObject)
 {
-    bool shouldCache = propertyNames.shouldCache() && !(propertyNames.size() || m_isDictionary) && (listedAttributes & Prototype);
+    getEnumerableNamesFromPropertyTable(propertyNames);
+    getEnumerableNamesFromClassInfoTable(exec, baseObject->classInfo(), propertyNames);
+}
+
+void Structure::getEnumerablePropertyNames(ExecState* exec, PropertyNameArray& propertyNames, JSObject* baseObject)
+{
+    bool shouldCache = propertyNames.shouldCache() && !(propertyNames.size() || m_isDictionary);
 
     if (shouldCache && m_cachedPropertyNameArrayData) {
         if (m_cachedPropertyNameArrayData->cachedPrototypeChain() == prototypeChain(exec)) {
@@ -296,15 +299,23 @@ void Structure::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNam
         }
         clearEnumerationCache();
     }
-    bool includeNonEnumerable = false;
-    if (listedAttributes & NonEnumerable)
-        includeNonEnumerable = true;
-    getNamesFromPropertyTable(propertyNames, includeNonEnumerable);
-    getNamesFromClassInfoTable(exec, baseObject->classInfo(), propertyNames, includeNonEnumerable);
 
-    if ((listedAttributes & Prototype) && m_prototype.isObject()) {
+    baseObject->getOwnPropertyNames(exec, propertyNames);
+
+    if (m_prototype.isObject()) {
         propertyNames.setShouldCache(false); // No need for our prototypes to waste memory on caching, since they're not being enumerated directly.
-        asObject(m_prototype)->getPropertyNames(exec, propertyNames);
+        JSObject* prototype = asObject(m_prototype);
+        while(1) {
+            if (!prototype->structure()->typeInfo().hasDefaultGetPropertyNames()) {
+                prototype->getPropertyNames(exec, propertyNames);
+                break;
+            }
+            prototype->getOwnPropertyNames(exec, propertyNames);
+            JSValue nextProto = prototype->prototype();
+            if (!nextProto.isObject())
+                break;
+            prototype = asObject(nextProto);
+        }
     }
 
     if (shouldCache) {
@@ -383,22 +394,10 @@ PassRefPtr<Structure> Structure::addPropertyTransitionToExistingStructure(Struct
     ASSERT(!structure->m_isDictionary);
     ASSERT(structure->typeInfo().type() == ObjectType);
 
-    if (structure->m_usingSingleTransitionSlot) {
-        Structure* existingTransition = structure->m_transitions.singleTransition;
-        if (existingTransition && existingTransition->m_nameInPrevious.get() == propertyName.ustring().rep()
-            && existingTransition->m_attributesInPrevious == attributes
-            && existingTransition->m_specificValueInPrevious == specificValue) {
-
-            ASSERT(structure->m_transitions.singleTransition->m_offset != noOffset);
-            offset = structure->m_transitions.singleTransition->m_offset;
-            return existingTransition;
-        }
-    } else {
-        if (Structure* existingTransition = structure->m_transitions.table->get(make_pair<RefPtr<UString::Rep>, std::pair<unsigned, JSCell*> >(propertyName.ustring().rep(), make_pair(attributes, specificValue)))) {
-            ASSERT(existingTransition->m_offset != noOffset);
-            offset = existingTransition->m_offset;
-            return existingTransition;
-        }
+    if (Structure* existingTransition = structure->table.get(make_pair(propertyName.ustring().rep(), attributes), specificValue)) {
+        ASSERT(existingTransition->m_offset != noOffset);
+        offset = existingTransition->m_offset;
+        return existingTransition;
     }
 
     return 0;
@@ -449,19 +448,7 @@ PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, con
 
     transition->m_offset = offset;
 
-    if (structure->m_usingSingleTransitionSlot) {
-        if (!structure->m_transitions.singleTransition) {
-            structure->m_transitions.singleTransition = transition.get();
-            return transition.release();
-        }
-
-        Structure* existingTransition = structure->m_transitions.singleTransition;
-        structure->m_usingSingleTransitionSlot = false;
-        StructureTransitionTable* transitionTable = new StructureTransitionTable;
-        structure->m_transitions.table = transitionTable;
-        transitionTable->add(make_pair<RefPtr<UString::Rep>, std::pair<unsigned, JSCell*> >(existingTransition->m_nameInPrevious.get(), make_pair(existingTransition->m_attributesInPrevious, existingTransition->m_specificValueInPrevious)), existingTransition);
-    }
-    structure->m_transitions.table->add(make_pair<RefPtr<UString::Rep>, std::pair<unsigned, JSCell*> >(propertyName.ustring().rep(), make_pair(attributes, specificValue)), transition.get());
+    structure->table.add(make_pair(propertyName.ustring().rep(), attributes), transition.get(), specificValue);
     return transition.release();
 }
 
@@ -511,6 +498,47 @@ PassRefPtr<Structure> Structure::despecifyFunctionTransition(Structure* structur
     return transition.release();
 }
 
+PassRefPtr<Structure> Structure::addAnonymousSlotsTransition(Structure* structure, unsigned count)
+{
+    if (Structure* transition = structure->table.getAnonymousSlotTransition(count)) {
+        ASSERT(transition->storedPrototype() == structure->storedPrototype());
+        return transition;
+    }
+    ASSERT(count);
+    ASSERT(count < ((1<<6) - 2));
+    RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo());
+    
+    transition->m_cachedPrototypeChain = structure->m_cachedPrototypeChain;
+    transition->m_previous = structure;
+    transition->m_nameInPrevious = 0;
+    transition->m_attributesInPrevious = 0;
+    transition->m_anonymousSlotsInPrevious = count;
+    transition->m_specificValueInPrevious = 0;
+    transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
+    transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
+
+    if (structure->m_propertyTable) {
+        if (structure->m_isPinnedPropertyTable)
+            transition->m_propertyTable = structure->copyPropertyTable();
+        else {
+            transition->m_propertyTable = structure->m_propertyTable;
+            structure->m_propertyTable = 0;
+        }
+    } else {
+        if (structure->m_previous)
+            transition->materializePropertyMap();
+        else
+            transition->createPropertyMapHashTable();
+    }
+
+    transition->addAnonymousSlots(count);
+    if (transition->propertyStorageSize() > transition->propertyStorageCapacity())
+        transition->growPropertyStorageCapacity();
+
+    structure->table.addAnonymousSlotTransition(count, transition.get());
+    return transition.release();    
+}
+
 PassRefPtr<Structure> Structure::getterSetterTransition(Structure* structure)
 {
     RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo());
@@ -560,8 +588,6 @@ PassRefPtr<Structure> Structure::fromDictionaryTransition(Structure* structure)
 
 size_t Structure::addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes, JSCell* specificValue)
 {
-    ASSERT(!m_transitions.singleTransition);
-
     materializePropertyMapIfNecessary();
 
     m_isPinnedPropertyTable = true;
@@ -574,7 +600,6 @@ size_t Structure::addPropertyWithoutTransition(const Identifier& propertyName, u
 
 size_t Structure::removePropertyWithoutTransition(const Identifier& propertyName)
 {
-    ASSERT(!m_transitions.singleTransition);
     ASSERT(m_isDictionary);
 
     materializePropertyMapIfNecessary();
@@ -638,6 +663,7 @@ PropertyMapHashTable* Structure::copyPropertyTable()
     if (m_propertyTable->deletedOffsets)
         newTable->deletedOffsets = new Vector<unsigned>(*m_propertyTable->deletedOffsets);
 
+    newTable->anonymousSlotCount = m_propertyTable->anonymousSlotCount;
     return newTable;
 }
 
@@ -817,7 +843,7 @@ size_t Structure::put(const Identifier& propertyName, unsigned attributes, JSCel
         newOffset = m_propertyTable->deletedOffsets->last();
         m_propertyTable->deletedOffsets->removeLast();
     } else
-        newOffset = m_propertyTable->keyCount;
+        newOffset = m_propertyTable->keyCount + m_propertyTable->anonymousSlotCount;
     m_propertyTable->entries()[entryIndex - 1].offset = newOffset;
 
     ++m_propertyTable->keyCount;
@@ -829,6 +855,16 @@ size_t Structure::put(const Identifier& propertyName, unsigned attributes, JSCel
     return newOffset;
 }
 
+void Structure::addAnonymousSlots(unsigned count)
+{
+    m_propertyTable->anonymousSlotCount += count;
+}
+
+bool Structure::hasTransition(UString::Rep* rep, unsigned attributes)
+{
+    return table.hasTransition(make_pair(rep, attributes));
+}
+
 size_t Structure::remove(const Identifier& propertyName)
 {
     ASSERT(!propertyName.isNull());
@@ -982,6 +1018,7 @@ void Structure::rehashPropertyMapHashTable(unsigned newTableSize)
     m_propertyTable = static_cast<PropertyMapHashTable*>(fastZeroedMalloc(PropertyMapHashTable::allocationSize(newTableSize)));
     m_propertyTable->size = newTableSize;
     m_propertyTable->sizeMask = newTableSize - 1;
+    m_propertyTable->anonymousSlotCount = oldTable->anonymousSlotCount;
 
     unsigned lastIndexUsed = 0;
     unsigned entryCount = oldTable->keyCount + oldTable->deletedSentinelCount;
@@ -1010,7 +1047,7 @@ static int comparePropertyMapEntryIndices(const void* a, const void* b)
     return 0;
 }
 
-void Structure::getNamesFromPropertyTable(PropertyNameArray& propertyNames, bool includeNonEnumerable)
+void Structure::getEnumerableNamesFromPropertyTable(PropertyNameArray& propertyNames)
 {
     materializePropertyMapIfNecessary();
     if (!m_propertyTable)
@@ -1021,8 +1058,7 @@ void Structure::getNamesFromPropertyTable(PropertyNameArray& propertyNames, bool
         int i = 0;
         unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
         for (unsigned k = 1; k <= entryCount; k++) {
-            if (m_propertyTable->entries()[k].key
-                    && (includeNonEnumerable || !(m_propertyTable->entries()[k].attributes & DontEnum))) {
+            if (m_propertyTable->entries()[k].key && !(m_propertyTable->entries()[k].attributes & DontEnum)) {
                 PropertyMapEntry* value = &m_propertyTable->entries()[k];
                 int j;
                 for (j = i - 1; j >= 0 && a[j]->index > value->index; --j)
@@ -1049,8 +1085,7 @@ void Structure::getNamesFromPropertyTable(PropertyNameArray& propertyNames, bool
     PropertyMapEntry** p = sortedEnumerables.data();
     unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
     for (unsigned i = 1; i <= entryCount; i++) {
-        if (m_propertyTable->entries()[i].key
-                && (includeNonEnumerable || !(m_propertyTable->entries()[i].attributes & DontEnum)))
+        if (m_propertyTable->entries()[i].key && !(m_propertyTable->entries()[i].attributes & DontEnum))
             *p++ = &m_propertyTable->entries()[i];
     }
 
@@ -1069,7 +1104,7 @@ void Structure::getNamesFromPropertyTable(PropertyNameArray& propertyNames, bool
     }
 }
 
-void Structure::getNamesFromClassInfoTable(ExecState* exec, const ClassInfo* classInfo, PropertyNameArray& propertyNames, bool includeNonEnumerable)
+void Structure::getEnumerableNamesFromClassInfoTable(ExecState* exec, const ClassInfo* classInfo, PropertyNameArray& propertyNames)
 {
     // Add properties from the static hashtables of properties
     for (; classInfo; classInfo = classInfo->parentClass) {
@@ -1082,7 +1117,7 @@ void Structure::getNamesFromClassInfoTable(ExecState* exec, const ClassInfo* cla
         int hashSizeMask = table->compactSize - 1;
         const HashEntry* entry = table->table;
         for (int i = 0; i <= hashSizeMask; ++i, ++entry) {
-            if (entry->key() && (includeNonEnumerable || !(entry->attributes() & DontEnum)))
+            if (entry->key() && !(entry->attributes() & DontEnum))
                 propertyNames.add(entry->key());
         }
     }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
index ca4552b..f7cb04b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,6 +30,7 @@
 #include "JSType.h"
 #include "JSValue.h"
 #include "PropertyMapHashTable.h"
+#include "StructureChain.h"
 #include "StructureTransitionTable.h"
 #include "JSTypeInfo.h"
 #include "UString.h"
@@ -44,18 +45,14 @@
 
 namespace JSC {
 
+    class MarkStack;
     class PropertyNameArray;
     class PropertyNameArrayData;
-    class StructureChain;
 
     class Structure : public RefCounted<Structure> {
     public:
-        enum ListedAttribute {
-            NonEnumerable = 1 << 1,
-            Prototype = 1 << 2
-        };
-
         friend class JIT;
+        friend class StructureTransitionTable;
         static PassRefPtr<Structure> create(JSValue prototype, const TypeInfo& typeInfo)
         {
             return adoptRef(new Structure(prototype, typeInfo));
@@ -70,18 +67,15 @@ namespace JSC {
         static PassRefPtr<Structure> addPropertyTransitionToExistingStructure(Structure*, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset);
         static PassRefPtr<Structure> removePropertyTransition(Structure*, const Identifier& propertyName, size_t& offset);
         static PassRefPtr<Structure> changePrototypeTransition(Structure*, JSValue prototype);
-        static PassRefPtr<Structure> despecifyFunctionTransition(Structure*, const Identifier&);        
+        static PassRefPtr<Structure> despecifyFunctionTransition(Structure*, const Identifier&);
+        static PassRefPtr<Structure> addAnonymousSlotsTransition(Structure*, unsigned count);
         static PassRefPtr<Structure> getterSetterTransition(Structure*);
         static PassRefPtr<Structure> toDictionaryTransition(Structure*);
         static PassRefPtr<Structure> fromDictionaryTransition(Structure*);
 
         ~Structure();
 
-        void mark()
-        {
-            if (!m_prototype.marked())
-                m_prototype.mark();
-        }
+        void markAggregate(MarkStack&);
 
         // These should be used with caution.  
         size_t addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
@@ -100,7 +94,7 @@ namespace JSC {
 
         void growPropertyStorageCapacity();
         size_t propertyStorageCapacity() const { return m_propertyStorageCapacity; }
-        size_t propertyStorageSize() const { return m_propertyTable ? m_propertyTable->keyCount + (m_propertyTable->deletedOffsets ? m_propertyTable->deletedOffsets->size() : 0) : m_offset + 1; }
+        size_t propertyStorageSize() const { return m_propertyTable ? m_propertyTable->keyCount + m_propertyTable->anonymousSlotCount + (m_propertyTable->deletedOffsets ? m_propertyTable->deletedOffsets->size() : 0) : m_offset + 1; }
         bool isUsingInlineStorage() const;
 
         size_t get(const Identifier& propertyName);
@@ -108,10 +102,20 @@ namespace JSC {
         size_t get(const Identifier& propertyName, unsigned& attributes, JSCell*& specificValue)
         {
             ASSERT(!propertyName.isNull());
-            return get(propertyName._ustring.rep(), attributes, specificValue);
+            return get(propertyName.ustring().rep(), attributes, specificValue);
+        }
+        bool transitionedFor(const JSCell* specificValue)
+        {
+            return m_specificValueInPrevious == specificValue;
+        }
+        bool hasTransition(UString::Rep*, unsigned attributes);
+        bool hasTransition(const Identifier& propertyName, unsigned attributes)
+        {
+            return hasTransition(propertyName._ustring.rep(), attributes);
         }
 
-        void getPropertyNames(ExecState*, PropertyNameArray&, JSObject*, unsigned listedAttributes = Prototype);
+        void getEnumerablePropertyNames(ExecState*, PropertyNameArray&, JSObject*);
+        void getOwnEnumerablePropertyNames(ExecState*, PropertyNameArray&, JSObject*);
 
         bool hasGetterSetterProperties() const { return m_hasGetterSetterProperties; }
         void setHasGetterSetterProperties(bool hasGetterSetterProperties) { m_hasGetterSetterProperties = hasGetterSetterProperties; }
@@ -126,8 +130,9 @@ namespace JSC {
 
         size_t put(const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
         size_t remove(const Identifier& propertyName);
-        void getNamesFromPropertyTable(PropertyNameArray&, bool includeNonEnumerable = false);
-        void getNamesFromClassInfoTable(ExecState*, const ClassInfo*, PropertyNameArray&, bool includeNonEnumerable = false);
+        void addAnonymousSlots(unsigned slotCount);
+        void getEnumerableNamesFromPropertyTable(PropertyNameArray&);
+        void getEnumerableNamesFromClassInfoTable(ExecState*, const ClassInfo*, PropertyNameArray&);
 
         void expandPropertyMapHashTable();
         void rehashPropertyMapHashTable();
@@ -171,13 +176,10 @@ namespace JSC {
 
         RefPtr<Structure> m_previous;
         RefPtr<UString::Rep> m_nameInPrevious;
-
-        union {
-            Structure* singleTransition;
-            StructureTransitionTable* table;
-        } m_transitions;
         JSCell* m_specificValueInPrevious;
 
+        StructureTransitionTable table;
+
         RefPtr<PropertyNameArrayData> m_cachedPropertyNameArrayData;
 
         PropertyMapHashTable* m_propertyTable;
@@ -188,8 +190,15 @@ namespace JSC {
         bool m_isDictionary : 1;
         bool m_isPinnedPropertyTable : 1;
         bool m_hasGetterSetterProperties : 1;
-        bool m_usingSingleTransitionSlot : 1;
+#if COMPILER(WINSCW)
+        // Workaround for Symbian WINSCW compiler that cannot resolve unsigned type of the declared 
+        // bitfield, when used as argument in make_pair() function calls in structure.ccp.
+        // This bitfield optimization is insignificant for the Symbian emulator target.
+        unsigned m_attributesInPrevious;
+#else
         unsigned m_attributesInPrevious : 7;
+#endif
+        unsigned m_anonymousSlotsInPrevious : 6;
     };
 
     inline size_t Structure::get(const Identifier& propertyName)
@@ -236,7 +245,58 @@ namespace JSC {
                 return m_propertyTable->entries()[entryIndex - 1].offset;
         }
     }
+    
+    bool StructureTransitionTable::contains(const StructureTransitionTableHash::Key& key, JSCell* specificValue)
+    {
+        if (usingSingleTransitionSlot()) {
+            Structure* existingTransition = singleTransition();
+            return existingTransition && existingTransition->m_nameInPrevious.get() == key.first
+                   && existingTransition->m_attributesInPrevious == key.second
+                   && (existingTransition->m_specificValueInPrevious == specificValue || existingTransition->m_specificValueInPrevious == 0);
+        }
+        TransitionTable::iterator find = table()->find(key);
+        if (find == table()->end())
+            return false;
 
+        return find->second.first || find->second.second->transitionedFor(specificValue);
+    }
+
+    Structure* StructureTransitionTable::get(const StructureTransitionTableHash::Key& key, JSCell* specificValue) const
+    {
+        if (usingSingleTransitionSlot()) {
+            Structure* existingTransition = singleTransition();
+            if (existingTransition && existingTransition->m_nameInPrevious.get() == key.first
+                && existingTransition->m_attributesInPrevious == key.second
+                && (existingTransition->m_specificValueInPrevious == specificValue || existingTransition->m_specificValueInPrevious == 0))
+                return existingTransition;
+            return 0;
+        }
+
+        Transition transition = table()->get(key);
+        if (transition.second && transition.second->transitionedFor(specificValue))
+            return transition.second;
+        return transition.first;
+    }
+
+    bool StructureTransitionTable::hasTransition(const StructureTransitionTableHash::Key& key) const
+    {
+        if (usingSingleTransitionSlot()) {
+            Structure* transition = singleTransition();
+            return transition && transition->m_nameInPrevious == key.first
+            && transition->m_attributesInPrevious == key.second;
+        }
+        return table()->contains(key);
+    }
+    
+    void StructureTransitionTable::reifySingleTransition()
+    {
+        ASSERT(usingSingleTransitionSlot());
+        Structure* existingTransition = singleTransition();
+        TransitionTable* transitionTable = new TransitionTable;
+        setTransitionTable(transitionTable);
+        if (existingTransition)
+            add(make_pair(existingTransition->m_nameInPrevious.get(), existingTransition->m_attributesInPrevious), existingTransition, existingTransition->m_specificValueInPrevious);
+    }
 } // namespace JSC
 
 #endif // Structure_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.cpp
index acebc86..eb57a5ac 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.cpp
@@ -25,7 +25,6 @@
 
 #include "config.h"
 #include "StructureChain.h"
-#include "Structure.h"
 
 #include "JSObject.h"
 #include "Structure.h"
@@ -47,17 +46,14 @@ StructureChain::StructureChain(Structure* head)
     m_vector[i] = 0;
 }
 
-PassRefPtr<StructureChain> StructureChain::create(Structure* head)
-{
-    return adoptRef(new StructureChain(head));
-}
-
 bool StructureChain::isCacheable() const
 {
     uint32_t i = 0;
     
     while (m_vector[i]) {
-        if (m_vector[i++]->isDictionary())
+        if (m_vector[i]->isDictionary())
+            return false;
+        if (!m_vector[i++]->typeInfo().hasDefaultGetPropertyNames())
             return false;
     }
     return true;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.h
index 5990e17..c48749d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.h
@@ -37,7 +37,7 @@ namespace JSC {
 
     class StructureChain : public RefCounted<StructureChain> {
     public:
-        static PassRefPtr<StructureChain> create(Structure* head);
+        static PassRefPtr<StructureChain> create(Structure* head) { return adoptRef(new StructureChain(head)); }
         RefPtr<Structure>* head() { return m_vector.get(); }
         bool isCacheable() const;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureTransitionTable.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureTransitionTable.h
index 804cbeb..0fa7b73 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureTransitionTable.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureTransitionTable.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,6 +30,8 @@
 #include <wtf/HashFunctions.h>
 #include <wtf/HashMap.h>
 #include <wtf/HashTraits.h>
+#include <wtf/PtrAndFlags.h>
+#include <wtf/OwnPtr.h>
 #include <wtf/RefPtr.h>
 
 namespace JSC {
@@ -37,7 +39,7 @@ namespace JSC {
     class Structure;
 
     struct StructureTransitionTableHash {
-        typedef std::pair<RefPtr<UString::Rep>, std::pair<unsigned, JSCell*> > Key;
+        typedef std::pair<RefPtr<UString::Rep>, unsigned> Key;
         static unsigned hash(const Key& p)
         {
             return p.first->computedHash();
@@ -53,20 +55,159 @@ namespace JSC {
 
     struct StructureTransitionTableHashTraits {
         typedef WTF::HashTraits<RefPtr<UString::Rep> > FirstTraits;
-        typedef WTF::GenericHashTraits<unsigned> SecondFirstTraits;
-        typedef WTF::GenericHashTraits<JSCell*> SecondSecondTraits;
-        typedef std::pair<FirstTraits::TraitType, std::pair<SecondFirstTraits::TraitType, SecondSecondTraits::TraitType> > TraitType;
+        typedef WTF::GenericHashTraits<unsigned> SecondTraits;
+        typedef std::pair<FirstTraits::TraitType, SecondTraits::TraitType > TraitType;
 
-        static const bool emptyValueIsZero = FirstTraits::emptyValueIsZero && SecondFirstTraits::emptyValueIsZero && SecondSecondTraits::emptyValueIsZero;
-        static TraitType emptyValue() { return std::make_pair(FirstTraits::emptyValue(), std::make_pair(SecondFirstTraits::emptyValue(), SecondSecondTraits::emptyValue())); }
+        static const bool emptyValueIsZero = FirstTraits::emptyValueIsZero && SecondTraits::emptyValueIsZero;
+        static TraitType emptyValue() { return std::make_pair(FirstTraits::emptyValue(), SecondTraits::emptyValue()); }
 
-        static const bool needsDestruction = FirstTraits::needsDestruction || SecondFirstTraits::needsDestruction || SecondSecondTraits::needsDestruction;
+        static const bool needsDestruction = FirstTraits::needsDestruction || SecondTraits::needsDestruction;
 
         static void constructDeletedValue(TraitType& slot) { FirstTraits::constructDeletedValue(slot.first); }
         static bool isDeletedValue(const TraitType& value) { return FirstTraits::isDeletedValue(value.first); }
     };
 
-    typedef HashMap<StructureTransitionTableHash::Key, Structure*, StructureTransitionTableHash, StructureTransitionTableHashTraits> StructureTransitionTable;
+    class StructureTransitionTable {
+        typedef std::pair<Structure*, Structure*> Transition;
+        struct TransitionTable : public HashMap<StructureTransitionTableHash::Key, Transition, StructureTransitionTableHash, StructureTransitionTableHashTraits> {
+            typedef HashMap<unsigned, Structure*> AnonymousSlotMap;
+
+            void addSlotTransition(unsigned count, Structure* structure)
+            {
+                ASSERT(!getSlotTransition(count));
+                if (!m_anonymousSlotTable)
+                    m_anonymousSlotTable.set(new AnonymousSlotMap);
+                m_anonymousSlotTable->add(count, structure);
+            }
+
+            void removeSlotTransition(unsigned count)
+            {
+                ASSERT(getSlotTransition(count));
+                m_anonymousSlotTable->remove(count);
+            }
+
+            Structure* getSlotTransition(unsigned count)
+            {
+                if (!m_anonymousSlotTable)
+                    return 0;
+
+                AnonymousSlotMap::iterator find = m_anonymousSlotTable->find(count);
+                if (find == m_anonymousSlotTable->end())
+                    return 0;
+                return find->second;
+            }
+        private:
+            OwnPtr<AnonymousSlotMap> m_anonymousSlotTable;
+        };
+    public:
+        StructureTransitionTable() {
+            m_transitions.m_singleTransition.set(0);
+            m_transitions.m_singleTransition.setFlag(usingSingleSlot);
+        }
+
+        ~StructureTransitionTable() {
+            if (!usingSingleTransitionSlot())
+                delete table();
+        }
+
+        // The contains and get methods accept imprecise matches, so if an unspecialised transition exists
+        // for the given key they will consider that transition to be a match.  If a specialised transition
+        // exists and it matches the provided specificValue, get will return the specific transition.
+        inline bool contains(const StructureTransitionTableHash::Key&, JSCell* specificValue);
+        inline Structure* get(const StructureTransitionTableHash::Key&, JSCell* specificValue) const;
+        inline bool hasTransition(const StructureTransitionTableHash::Key& key) const;
+        void remove(const StructureTransitionTableHash::Key& key, JSCell* specificValue)
+        {
+            if (usingSingleTransitionSlot()) {
+                ASSERT(contains(key, specificValue));
+                setSingleTransition(0);
+                return;
+            }
+            TransitionTable::iterator find = table()->find(key);
+            if (!specificValue)
+                find->second.first = 0;
+            else
+                find->second.second = 0;
+            if (!find->second.first && !find->second.second)
+                table()->remove(find);
+        }
+        void add(const StructureTransitionTableHash::Key& key, Structure* structure, JSCell* specificValue)
+        {
+            if (usingSingleTransitionSlot()) {
+                if (!singleTransition()) {
+                    setSingleTransition(structure);
+                    return;
+                }
+                reifySingleTransition();
+            }
+            if (!specificValue) {
+                TransitionTable::iterator find = table()->find(key);
+                if (find == table()->end())
+                    table()->add(key, Transition(structure, 0));
+                else
+                    find->second.first = structure;
+            } else {
+                // If we're adding a transition to a specific value, then there cannot be
+                // an existing transition
+                ASSERT(!table()->contains(key));
+                table()->add(key, Transition(0, structure));
+            }
+        }
+
+        Structure* getAnonymousSlotTransition(unsigned count)
+        {
+            if (usingSingleTransitionSlot())
+                return 0;
+            return table()->getSlotTransition(count);
+        }
+
+        void addAnonymousSlotTransition(unsigned count, Structure* structure)
+        {
+            if (usingSingleTransitionSlot())
+                reifySingleTransition();
+            ASSERT(!table()->getSlotTransition(count));
+            table()->addSlotTransition(count, structure);
+        }
+        
+        void removeAnonymousSlotTransition(unsigned count)
+        {
+            ASSERT(!usingSingleTransitionSlot());
+            table()->removeSlotTransition(count);
+        }
+    private:
+        TransitionTable* table() const { ASSERT(!usingSingleTransitionSlot()); return m_transitions.m_table; }
+        Structure* singleTransition() const {
+            ASSERT(usingSingleTransitionSlot());
+            return m_transitions.m_singleTransition.get();
+        }
+        bool usingSingleTransitionSlot() const { return m_transitions.m_singleTransition.isFlagSet(usingSingleSlot); }
+        void setSingleTransition(Structure* structure)
+        { 
+            ASSERT(usingSingleTransitionSlot());
+            m_transitions.m_singleTransition.set(structure);
+        }
+
+        void setTransitionTable(TransitionTable* table)
+        {
+            ASSERT(usingSingleTransitionSlot());
+#ifndef NDEBUG
+            setSingleTransition(0);
+#endif
+            m_transitions.m_table = table;
+            // This implicitly clears the flag that indicates we're using a single transition
+            ASSERT(!usingSingleTransitionSlot());
+        }
+        inline void reifySingleTransition();
+
+        enum UsingSingleSlot {
+            usingSingleSlot
+        };
+        // Last bit indicates whether we are using the single transition optimisation
+        union {
+            TransitionTable* m_table;
+            PtrAndFlagsBase<Structure, UsingSingleSlot> m_singleTransition;
+        } m_transitions;
+    };
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/SymbolTable.h b/src/3rdparty/webkit/JavaScriptCore/runtime/SymbolTable.h
index c00f95a..f5e2669 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/SymbolTable.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/SymbolTable.h
@@ -121,6 +121,10 @@ namespace JSC {
 
     typedef HashMap<RefPtr<UString::Rep>, SymbolTableEntry, IdentifierRepHash, HashTraits<RefPtr<UString::Rep> >, SymbolTableIndexHashTraits> SymbolTable;
 
+    class SharedSymbolTable : public SymbolTable, public RefCounted<SharedSymbolTable>
+    {
+    };
+    
 } // namespace JSC
 
 #endif // SymbolTable_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.cpp
index 045a33a..30ba6e9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.cpp
@@ -56,8 +56,8 @@ namespace JSC {
 // Number of ticks before the first timeout check is done.
 static const int ticksUntilFirstCheck = 1024;
 
-// Default number of milliseconds between each timeout check.
-static const int defaultIntervalBetweenChecks = 1000;
+// Number of milliseconds between each timeout check.
+static const int intervalBetweenChecks = 1000;
 
 // Returns the time the current thread has spent executing, in milliseconds.
 static inline unsigned getCPUTime()
@@ -104,15 +104,10 @@ static inline unsigned getCPUTime()
 TimeoutChecker::TimeoutChecker()
     : m_timeoutInterval(0)
     , m_startCount(0)
-    , m_intervalBetweenChecks(defaultIntervalBetweenChecks)
 {
     reset();
 }
 
-TimeoutChecker::~TimeoutChecker()
-{
-}
-
 void TimeoutChecker::reset()
 {
     m_ticksUntilNextCheck = ticksUntilFirstCheck;
@@ -140,7 +135,7 @@ bool TimeoutChecker::didTimeOut(ExecState* exec)
     
     // Adjust the tick threshold so we get the next checkTimeout call in the
     // interval specified in intervalBetweenChecks.
-    m_ticksUntilNextCheck = static_cast<unsigned>((static_cast<float>(m_intervalBetweenChecks) / timeDiff) * m_ticksUntilNextCheck);
+    m_ticksUntilNextCheck = static_cast<unsigned>((static_cast<float>(intervalBetweenChecks) / timeDiff) * m_ticksUntilNextCheck);
     // If the new threshold is 0 reset it to the default threshold. This can happen if the timeDiff is higher than the
     // preferred script check time interval.
     if (m_ticksUntilNextCheck == 0)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.h b/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.h
index 1680d6d..7bfa6d0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.h
@@ -38,10 +38,8 @@ namespace JSC {
     class TimeoutChecker {
     public:
         TimeoutChecker();
-        virtual ~TimeoutChecker();
 
         void setTimeoutInterval(unsigned timeoutInterval) { m_timeoutInterval = timeoutInterval; }
-        void setCheckInterval(unsigned checkInterval) { if (checkInterval) m_intervalBetweenChecks = checkInterval; }
         
         unsigned ticksUntilNextCheck() { return m_ticksUntilNextCheck; }
         
@@ -60,7 +58,7 @@ namespace JSC {
 
         void reset();
 
-        virtual bool didTimeOut(ExecState*);
+        bool didTimeOut(ExecState*);
 
     private:
         unsigned m_timeoutInterval;
@@ -68,7 +66,6 @@ namespace JSC {
         unsigned m_timeExecuting;
         unsigned m_startCount;
         unsigned m_ticksUntilNextCheck;
-        unsigned m_intervalBetweenChecks;
     };
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Tracing.d b/src/3rdparty/webkit/JavaScriptCore/runtime/Tracing.d
deleted file mode 100644
index b9efaff..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Tracing.d
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-provider JavaScriptCore
-{
-    probe gc__begin();
-    probe gc__marked();
-    probe gc__end(int, int);
-    
-    probe profile__will_execute(int, char*, char*, int);
-    probe profile__did_execute(int, char*, char*, int);
-};
-
-#pragma D attributes Unstable/Unstable/Common provider JavaScriptCore provider
-#pragma D attributes Private/Private/Unknown provider JavaScriptCore module
-#pragma D attributes Private/Private/Unknown provider JavaScriptCore function
-#pragma D attributes Unstable/Unstable/Common provider JavaScriptCore name
-#pragma D attributes Unstable/Unstable/Common provider JavaScriptCore args
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/UString.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/UString.cpp
index fa19932..e66ca93 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/UString.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/UString.cpp
@@ -32,12 +32,14 @@
 #include <ctype.h>
 #include <float.h>
 #include <limits.h>
+#include <limits>
 #include <math.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <wtf/ASCIICType.h>
 #include <wtf/Assertions.h>
 #include <wtf/MathExtras.h>
+#include <wtf/StringExtras.h>
 #include <wtf/Vector.h>
 #include <wtf/unicode/UTF8.h>
 #include <wtf/StringExtras.h>
@@ -69,20 +71,20 @@ static const int minLengthToShare = 10;
 static inline size_t overflowIndicator() { return std::numeric_limits<size_t>::max(); }
 static inline size_t maxUChars() { return std::numeric_limits<size_t>::max() / sizeof(UChar); }
 
-static inline UChar* allocChars(size_t length)
+static inline PossiblyNull<UChar*> allocChars(size_t length)
 {
     ASSERT(length);
     if (length > maxUChars())
         return 0;
-    return static_cast<UChar*>(tryFastMalloc(sizeof(UChar) * length));
+    return tryFastMalloc(sizeof(UChar) * length);
 }
 
-static inline UChar* reallocChars(UChar* buffer, size_t length)
+static inline PossiblyNull<UChar*> reallocChars(UChar* buffer, size_t length)
 {
     ASSERT(length);
     if (length > maxUChars())
         return 0;
-    return static_cast<UChar*>(tryFastRealloc(buffer, sizeof(UChar) * length));
+    return tryFastRealloc(buffer, sizeof(UChar) * length);
 }
 
 static inline void copyChars(UChar* destination, const UChar* source, unsigned numCharacters)
@@ -481,8 +483,7 @@ static inline bool expandCapacity(UString::Rep* rep, int requiredLength)
     if (requiredLength > base->capacity) {
         size_t newCapacity = expandedSize(requiredLength, base->preCapacity);
         UChar* oldBuf = base->buf;
-        base->buf = reallocChars(base->buf, newCapacity);
-        if (!base->buf) {
+        if (!reallocChars(base->buf, newCapacity).getValue(base->buf)) {
             base->buf = oldBuf;
             return false;
         }
@@ -513,8 +514,7 @@ bool UString::Rep::reserveCapacity(int capacity)
 
     size_t newCapacity = expandedSize(capacity, base->preCapacity);
     UChar* oldBuf = base->buf;
-    base->buf = reallocChars(base->buf, newCapacity);
-    if (!base->buf) {
+    if (!reallocChars(base->buf, newCapacity).getValue(base->buf)) {
         base->buf = oldBuf;
         return false;
     }
@@ -541,8 +541,8 @@ void UString::expandPreCapacity(int requiredPreCap)
         size_t newCapacity = expandedSize(requiredPreCap, base->capacity);
         int delta = newCapacity - base->capacity - base->preCapacity;
 
-        UChar* newBuf = allocChars(newCapacity);
-        if (!newBuf) {
+        UChar* newBuf;
+        if (!allocChars(newCapacity).getValue(newBuf)) {
             makeNull();
             return;
         }
@@ -567,8 +567,8 @@ static PassRefPtr<UString::Rep> createRep(const char* c)
         return &UString::Rep::empty();
 
     size_t length = strlen(c);
-    UChar* d = allocChars(length);
-    if (!d)
+    UChar* d;
+    if (!allocChars(length).getValue(d))
         return &UString::Rep::null();
     else {
         for (size_t i = 0; i < length; i++)
@@ -657,8 +657,8 @@ static ALWAYS_INLINE PassRefPtr<UString::Rep> concatenate(PassRefPtr<UString::Re
     } else {
         // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
         size_t newCapacity = expandedSize(length, 0);
-        UChar* d = allocChars(newCapacity);
-        if (!d)
+        UChar* d;
+        if (!allocChars(newCapacity).getValue(d))
             rep = &UString::Rep::null();
         else {
             copyChars(d, rep->data(), thisSize);
@@ -713,8 +713,8 @@ static ALWAYS_INLINE PassRefPtr<UString::Rep> concatenate(PassRefPtr<UString::Re
     } else {
         // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
         size_t newCapacity = expandedSize(length, 0);
-        UChar* d = allocChars(newCapacity);
-        if (!d)
+        UChar* d;
+        if (!allocChars(newCapacity).getValue(d))
             rep = &UString::Rep::null();
         else {
             copyChars(d, rep->data(), thisSize);
@@ -801,8 +801,8 @@ PassRefPtr<UString::Rep> concatenate(UString::Rep* a, UString::Rep* b)
 
     // a does not qualify for append, and b does not qualify for prepend, gotta make a whole new string
     size_t newCapacity = expandedSize(length, 0);
-    UChar* d = allocChars(newCapacity);
-    if (!d)
+    UChar* d;
+    if (!allocChars(newCapacity).getValue(d))
         return 0;
     copyChars(d, a->data(), aSize);
     copyChars(d + aSize, b->data(), bSize);
@@ -943,8 +943,7 @@ UString UString::from(int i)
     return UString(p, static_cast<int>(end - p));
 }
 
-#if PLATFORM(WIN_OS) && PLATFORM(X86_64) && COMPILER(MSVC)
-UString UString::from(int64_t i)
+UString UString::from(long long i)
 {
     UChar buf[1 + sizeof(i) * 3];
     UChar* end = buf + sizeof(buf) / sizeof(UChar);
@@ -952,9 +951,13 @@ UString UString::from(int64_t i)
 
     if (i == 0)
         *--p = '0';
-    else if (i == LLONG_MIN) {
+    else if (i == std::numeric_limits<long long>::min()) {
         char minBuf[1 + sizeof(i) * 3];
-        snprintf(minBuf, sizeof(minBuf) - 1, "%I64d", LLONG_MIN);
+#if PLATFORM(WIN_OS)
+        snprintf(minBuf, sizeof(minBuf) - 1, "%I64d", std::numeric_limits<long long>::min());
+#else
+        snprintf(minBuf, sizeof(minBuf) - 1, "%lld", std::numeric_limits<long long>::min());
+#endif
         return UString(minBuf);
     } else {
         bool negative = false;
@@ -972,7 +975,6 @@ UString UString::from(int64_t i)
 
     return UString(p, static_cast<int>(end - p));
 }
-#endif
 
 UString UString::from(unsigned int u)
 {
@@ -1026,6 +1028,8 @@ UString UString::from(double d)
     // avoid ever printing -NaN, in JS conceptually there is only one NaN value
     if (isnan(d))
         return "NaN";
+    if (!d)
+        return "0"; // -0 -> "0"
 
     char buf[80];
     int decimalPoint;
@@ -1108,8 +1112,8 @@ UString UString::spliceSubstringsWithSeparators(const Range* substringRanges, in
     if (totalLength == 0)
         return "";
 
-    UChar* buffer = allocChars(totalLength);
-    if (!buffer)
+    UChar* buffer;
+    if (!allocChars(totalLength).getValue(buffer))
         return null();
 
     int maxCount = max(rangeCount, separatorCount);
@@ -1137,8 +1141,8 @@ UString UString::replaceRange(int rangeStart, int rangeLength, const UString& re
     if (totalLength == 0)
         return "";
 
-    UChar* buffer = allocChars(totalLength);
-    if (!buffer)
+    UChar* buffer;
+    if (!allocChars(totalLength).getValue(buffer))
         return null();
 
     copyChars(buffer, data(), rangeStart);
@@ -1185,8 +1189,8 @@ UString& UString::append(const UString &t)
     } else {
         // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
         size_t newCapacity = expandedSize(length, 0);
-        UChar* d = allocChars(newCapacity);
-        if (!d)
+        UChar* d;
+        if (!allocChars(newCapacity).getValue(d))
             makeNull();
         else {
             copyChars(d, data(), thisSize);
@@ -1208,18 +1212,6 @@ UString& UString::append(const UChar* tData, int tSize)
     return *this;
 }
 
-UString& UString::appendNumeric(int i)
-{
-    m_rep = concatenate(rep(), i);
-    return *this;
-}
-
-UString& UString::appendNumeric(double d)
-{
-    m_rep = concatenate(rep(), d);
-    return *this;
-}
-
 UString& UString::append(const char* t)
 {
     m_rep = concatenate(m_rep.release(), t);
@@ -1238,8 +1230,8 @@ UString& UString::append(UChar c)
     if (length == 0) {
         // this is empty - must make a new m_rep because we don't want to pollute the shared empty one 
         size_t newCapacity = expandedSize(1, 0);
-        UChar* d = allocChars(newCapacity);
-        if (!d)
+        UChar* d;
+        if (!allocChars(newCapacity).getValue(d))
             makeNull();
         else {
             d[0] = c;
@@ -1266,8 +1258,8 @@ UString& UString::append(UChar c)
     } else {
         // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
         size_t newCapacity = expandedSize(length + 1, 0);
-        UChar* d = allocChars(newCapacity);
-        if (!d)
+        UChar* d;
+        if (!allocChars(newCapacity).getValue(d))
             makeNull();
         else {
             copyChars(d, data(), length);
@@ -1345,8 +1337,7 @@ UString& UString::operator=(const char* c)
         m_rep->_hash = 0;
         m_rep->len = l;
     } else {
-        d = allocChars(l);
-        if (!d) {
+        if (!allocChars(l).getValue(d)) {
             makeNull();
             return *this;
         }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h b/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h
index ab64f52..c4dad2a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h
@@ -77,7 +77,6 @@ namespace JSC {
         friend class JIT;
 
     public:
-
         typedef CrossThreadRefCounted<OwnFastMallocPtr<UChar> > SharedUChar;
         struct BaseString;
         struct Rep : Noncopyable {
@@ -92,7 +91,8 @@ namespace JSC {
             {
                 // Guard against integer overflow
                 if (size < (std::numeric_limits<size_t>::max() / sizeof(UChar))) {
-                    if (void * buf = tryFastMalloc(size * sizeof(UChar)))
+                    void* buf = 0;
+                    if (tryFastMalloc(size * sizeof(UChar)).getValue(buf))
                         return adoptRef(new BaseString(static_cast<UChar*>(buf), 0, size));
                 }
                 return adoptRef(new BaseString(0, 0, 0));
@@ -257,9 +257,7 @@ namespace JSC {
         }
 
         static UString from(int);
-#if PLATFORM(WIN_OS) && PLATFORM(X86_64) && COMPILER(MSVC)
-        static UString from(int64_t i);
-#endif
+        static UString from(long long);
         static UString from(unsigned int);
         static UString from(long);
         static UString from(double);
@@ -289,8 +287,6 @@ namespace JSC {
         UString& append(UChar);
         UString& append(char c) { return append(static_cast<UChar>(static_cast<unsigned char>(c))); }
         UString& append(const UChar*, int size);
-        UString& appendNumeric(int);
-        UString& appendNumeric(double);
 
         bool getCString(CStringBuffer&) const;
 
@@ -365,20 +361,6 @@ namespace JSC {
             return m_rep->reserveCapacity(capacity);
         }
 
-#if PLATFORM(QT)
-        operator QT_PREPEND_NAMESPACE(QString)() const
-        {
-            QT_USE_NAMESPACE;
-            return QString(reinterpret_cast<const QChar*>(this->data()), this->size());
-        }
-
-        UString(const QT_PREPEND_NAMESPACE(QString)& str)
-        {
-            *this = JSC::UString(reinterpret_cast<const UChar*>(str.constData()), str.length());
-        }
-#endif
-
-
     private:
         void expandCapacity(int requiredLength);
         void expandPreCapacity(int requiredPreCap);
@@ -546,20 +528,6 @@ namespace JSC {
         return capacityDelta;
     }
 
-#if PLATFORM(QT)
-
-        inline UString operator+(const char* s1, const UString& s2)
-        {
-            return operator+(UString(s1), s2);
-        }
-
-        inline UString operator+(const UString& s1, const char* s2)
-        {
-            return operator+(s1, UString(s2));
-        }
-
-#endif
-
     struct IdentifierRepHash : PtrHash<RefPtr<JSC::UString::Rep> > {
         static unsigned hash(const RefPtr<JSC::UString::Rep>& key) { return key->computedHash(); }
         static unsigned hash(JSC::UString::Rep* key) { return key->computedHash(); }
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.cpp b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.cpp
index e2e8aba..e62add3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.cpp
@@ -42,8 +42,8 @@ void Generator::generateEnter()
 {
 #if PLATFORM(X86)
     // On x86 edi & esi are callee preserved registers.
-    push(X86::edi);
-    push(X86::esi);
+    push(X86Registers::edi);
+    push(X86Registers::esi);
     
 #if COMPILER(MSVC)
     // Move the arguments into registers.
@@ -72,8 +72,8 @@ void Generator::generateReturnSuccess()
     
     // Restore callee save registers.
 #if PLATFORM(X86)
-    pop(X86::esi);
-    pop(X86::edi);
+    pop(X86Registers::esi);
+    pop(X86Registers::edi);
 #endif
     ret();
 }
@@ -111,8 +111,8 @@ void Generator::generateReturnFailure()
     move(Imm32(-1), returnRegister);
 
 #if PLATFORM(X86)
-    pop(X86::esi);
-    pop(X86::edi);
+    pop(X86Registers::esi);
+    pop(X86Registers::edi);
 #endif
     ret();
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.h b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.h
index 8562cac..294c3d0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.h
@@ -63,26 +63,26 @@ namespace JSC {
         }
 
 #if PLATFORM(X86)
-        static const RegisterID input = X86::eax;
-        static const RegisterID index = X86::edx;
-        static const RegisterID length = X86::ecx;
-        static const RegisterID output = X86::edi;
+        static const RegisterID input = X86Registers::eax;
+        static const RegisterID index = X86Registers::edx;
+        static const RegisterID length = X86Registers::ecx;
+        static const RegisterID output = X86Registers::edi;
 
-        static const RegisterID character = X86::esi;
-        static const RegisterID repeatCount = X86::ebx; // How many times the current atom repeats in the current match.
+        static const RegisterID character = X86Registers::esi;
+        static const RegisterID repeatCount = X86Registers::ebx; // How many times the current atom repeats in the current match.
 
-        static const RegisterID returnRegister = X86::eax;
+        static const RegisterID returnRegister = X86Registers::eax;
 #endif
 #if PLATFORM(X86_64)
-        static const RegisterID input = X86::edi;
-        static const RegisterID index = X86::esi;
-        static const RegisterID length = X86::edx;
-        static const RegisterID output = X86::ecx;
+        static const RegisterID input = X86Registers::edi;
+        static const RegisterID index = X86Registers::esi;
+        static const RegisterID length = X86Registers::edx;
+        static const RegisterID output = X86Registers::ecx;
 
-        static const RegisterID character = X86::eax;
-        static const RegisterID repeatCount = X86::ebx; // How many times the current atom repeats in the current match.
+        static const RegisterID character = X86Registers::eax;
+        static const RegisterID repeatCount = X86Registers::ebx; // How many times the current atom repeats in the current match.
 
-        static const RegisterID returnRegister = X86::eax;
+        static const RegisterID returnRegister = X86Registers::eax;
 #endif
 
         void generateEnter();
diff --git a/src/3rdparty/webkit/JavaScriptCore/wscript b/src/3rdparty/webkit/JavaScriptCore/wscript
new file mode 100644
index 0000000..9dd37c9
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wscript
@@ -0,0 +1,103 @@
+#! /usr/bin/env python
+
+# Copyright (C) 2009 Kevin Ollivier  All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+# EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+# PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+#
+# JavaScriptCore build script for the waf build system
+
+import commands
+
+from settings import *
+
+jscore_excludes = ['jsc.cpp', 'ucptable.cpp', 'GOwnPtr.cpp']
+jscore_excludes.extend(get_excludes(jscore_dir, ['*CF.cpp']))
+
+sources = []
+
+jscore_excludes.extend(get_excludes(jscore_dir, ['*Win.cpp', '*None.cpp']))
+
+if building_on_win32:
+    jscore_excludes += ['ExecutableAllocatorPosix.cpp', 'MarkStackPosix.cpp']
+    sources += ['jit/ExecutableAllocatorWin.cpp', 'runtime/MarkStackWin.cpp']
+else:
+    jscore_excludes.append('JSStringRefBSTR.cpp')
+
+def generate_jscore_derived_sources():
+    # build the derived sources
+    js_dir = jscore_dir
+    if building_on_win32:
+        js_dir = get_output('cygpath --unix "%s"' % js_dir)
+    derived_sources_dir = os.path.join(jscore_dir, 'DerivedSources')
+    if not os.path.exists(derived_sources_dir):
+        os.mkdir(derived_sources_dir)
+
+    olddir = os.getcwd()
+    os.chdir(derived_sources_dir)
+
+    command = 'make -f %s/DerivedSources.make JavaScriptCore=%s BUILT_PRODUCTS_DIR=%s all FEATURE_DEFINES="%s"' % (js_dir, js_dir, js_dir, ' '.join(feature_defines))
+    os.system(command)
+    os.chdir(olddir)
+
+def set_options(opt):
+    common_set_options(opt)
+
+def configure(conf):
+    common_configure(conf)
+    generate_jscore_derived_sources()
+    
+def build(bld):
+    import Options
+
+    full_dirs = get_dirs_for_features(jscore_dir, features=[build_port], dirs=jscore_dirs)
+
+    includes = common_includes + full_dirs
+
+    # 1. A simple program
+    jscore = bld.new_task_gen(
+        features = 'cxx cstaticlib',
+        includes = '. .. assembler wrec DerivedSources ForwardingHeaders ' + ' '.join(includes),
+        source = sources,
+        target = 'jscore',
+        uselib = 'WX ICU ' + get_config(),
+        uselib_local = '',
+        install_path = output_dir)
+
+    jscore.find_sources_in_dirs(full_dirs, excludes = jscore_excludes)  
+        
+    obj = bld.new_task_gen(
+        features = 'cxx cprogram',
+        includes = '. .. assembler wrec DerivedSources ForwardingHeaders ' + ' '.join(includes),
+        source = 'jsc.cpp',
+        target = 'jsc',
+        uselib = 'WX ICU ' + get_config(),
+        uselib_local = 'jscore',
+        install_path = output_dir,
+        )
+        
+    # we'll get an error if exceptions are on because of an unwind error when using __try
+    if building_on_win32:
+        flags = obj.env.CXXFLAGS
+        flags.remove('/EHsc')
+        obj.env.CXXFLAGS = flags
+
+    bld.install_files(os.path.join(output_dir, 'JavaScriptCore'), 'API/*.h')
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.cpp
index 54daf23..819ed9a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.cpp
@@ -72,10 +72,7 @@ static void vprintf_stderr_common(const char* format, va_list args)
         CFRelease(cfFormat);
     } else
 #elif COMPILER(MSVC) && !defined(WINCEBASIC)
-# if !defined(_WIN32_WCE) || (_WIN32_WCE >= 0x600)
-    if (IsDebuggerPresent())
-# endif
-    {
+    if (IsDebuggerPresent()) {
         size_t size = 1024;
 
         do {
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.h
index d691357..59efd84 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.h
@@ -144,11 +144,7 @@ void WTFLogVerbose(const char* file, int line, const char* function, WTFLogChann
 #if ASSERT_DISABLED
 
 #define ASSERT(assertion) ((void)0)
-#if COMPILER(MSVC7) || COMPILER(WINSCW)
-#define ASSERT_WITH_MESSAGE(assertion) ((void)0)
-#else
 #define ASSERT_WITH_MESSAGE(assertion, ...) ((void)0)
-#endif /* COMPILER(MSVC7) */
 #define ASSERT_NOT_REACHED() ((void)0)
 #define ASSERT_UNUSED(variable, assertion) ((void)variable)
 
@@ -160,7 +156,7 @@ void WTFLogVerbose(const char* file, int line, const char* function, WTFLogChann
         CRASH(); \
     } \
 while (0)
-#if COMPILER(MSVC7) || COMPILER(WINSCW)
+#if COMPILER(MSVC7)
 #define ASSERT_WITH_MESSAGE(assertion) ((void)0)
 #else
 #define ASSERT_WITH_MESSAGE(assertion, ...) do \
@@ -203,7 +199,7 @@ while (0)
 
 /* FATAL */
 
-#if FATAL_DISABLED && !COMPILER(MSVC7) && !COMPILER(WINSCW)
+#if FATAL_DISABLED
 #define FATAL(...) ((void)0)
 #elif COMPILER(MSVC7)
 #define FATAL() ((void)0)
@@ -216,9 +212,9 @@ while (0)
 
 /* LOG_ERROR */
 
-#if ERROR_DISABLED && !COMPILER(MSVC7) && !COMPILER(WINSCW)
+#if ERROR_DISABLED
 #define LOG_ERROR(...) ((void)0)
-#elif COMPILER(MSVC7) || COMPILER(WINSCW)
+#elif COMPILER(MSVC7)
 #define LOG_ERROR() ((void)0)
 #else
 #define LOG_ERROR(...) WTFReportError(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, __VA_ARGS__)
@@ -226,9 +222,9 @@ while (0)
 
 /* LOG */
 
-#if LOG_DISABLED && !COMPILER(MSVC7) && !COMPILER(WINSCW)
+#if LOG_DISABLED
 #define LOG(channel, ...) ((void)0)
-#elif COMPILER(MSVC7) || COMPILER(WINSCW)
+#elif COMPILER(MSVC7)
 #define LOG() ((void)0)
 #else
 #define LOG(channel, ...) WTFLog(&JOIN_LOG_CHANNEL_WITH_PREFIX(LOG_CHANNEL_PREFIX, channel), __VA_ARGS__)
@@ -238,9 +234,9 @@ while (0)
 
 /* LOG_VERBOSE */
 
-#if LOG_DISABLED && !COMPILER(MSVC7) && !COMPILER(WINSCW)
+#if LOG_DISABLED
 #define LOG_VERBOSE(channel, ...) ((void)0)
-#elif COMPILER(MSVC7) || COMPILER(WINSCW)
+#elif COMPILER(MSVC7)
 #define LOG_VERBOSE(channel) ((void)0)
 #else
 #define LOG_VERBOSE(channel, ...) WTFLogVerbose(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, &JOIN_LOG_CHANNEL_WITH_PREFIX(LOG_CHANNEL_PREFIX, channel), __VA_ARGS__)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ByteArray.h b/src/3rdparty/webkit/JavaScriptCore/wtf/ByteArray.h
index 96e9cc2..f5f5ded 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ByteArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ByteArray.h
@@ -45,6 +45,13 @@ namespace WTF {
             m_data[index] = static_cast<unsigned char>(value + 0.5);
         }
 
+        void set(unsigned index, unsigned char value)
+        {
+            if (index >= m_size)
+                return;
+            m_data[index] = value;
+        }
+
         bool get(unsigned index, unsigned char& result) const
         {
             if (index >= m_size)
@@ -53,6 +60,12 @@ namespace WTF {
             return true;
         }
 
+        unsigned char get(unsigned index) const
+        {
+            ASSERT(index < m_size);
+            return m_data[index];
+        }
+
         unsigned char* data() { return m_data; }
 
         void deref()
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.cpp
index 73c2c5c..a3d5290 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
  * Copyright (C) 2008 Google Inc. All rights reserved.
+ * Copyright (C) 2007-2009 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -33,6 +34,7 @@
 #include "CurrentTime.h"
 
 #if PLATFORM(WIN_OS)
+
 // Windows is first since we want to use hires timers, despite PLATFORM(CF)
 // being defined.
 // If defined, WIN32_LEAN_AND_MEAN disables timeBeginPeriod/timeEndPeriod.
@@ -40,13 +42,17 @@
 #include <windows.h>
 #include <math.h>
 #include <stdint.h>
-#if HAVE(SYS_TIMEB_H)
+#include <time.h>
+
+#if USE(QUERY_PERFORMANCE_COUNTER)
+#if PLATFORM(WINCE)
+extern "C" time_t mktime(struct tm *t);
+#else
 #include <sys/timeb.h>
-#endif
-#if !PLATFORM(WINCE)
 #include <sys/types.h>
 #endif
-#include <time.h>
+#endif
+
 #elif PLATFORM(CF)
 #include <CoreFoundation/CFDate.h>
 #elif PLATFORM(GTK)
@@ -63,6 +69,8 @@ const double msPerSecond = 1000.0;
 
 #if PLATFORM(WIN_OS)
 
+#if USE(QUERY_PERFORMANCE_COUNTER)
+
 static LARGE_INTEGER qpcFrequency;
 static bool syncedTime;
 
@@ -188,6 +196,55 @@ double currentTime()
     return utc / 1000.0;
 }
 
+#else
+
+static double currentSystemTime()
+{
+    FILETIME ft;
+    GetCurrentFT(&ft);
+
+    // As per Windows documentation for FILETIME, copy the resulting FILETIME structure to a
+    // ULARGE_INTEGER structure using memcpy (using memcpy instead of direct assignment can
+    // prevent alignment faults on 64-bit Windows).
+
+    ULARGE_INTEGER t;
+    memcpy(&t, &ft, sizeof(t));
+
+    // Windows file times are in 100s of nanoseconds.
+    // To convert to seconds, we have to divide by 10,000,000, which is more quickly
+    // done by multiplying by 0.0000001.
+
+    // Between January 1, 1601 and January 1, 1970, there were 369 complete years,
+    // of which 89 were leap years (1700, 1800, and 1900 were not leap years).
+    // That is a total of 134774 days, which is 11644473600 seconds.
+
+    return t.QuadPart * 0.0000001 - 11644473600.0;
+}
+
+double currentTime()
+{
+    static bool init = false;
+    static double lastTime;
+    static DWORD lastTickCount;
+    if (!init) {
+        lastTime = currentSystemTime();
+        lastTickCount = GetTickCount();
+        init = true;
+        return lastTime;
+    }
+
+    DWORD tickCountNow = GetTickCount();
+    DWORD elapsed = tickCountNow - lastTickCount;
+    double timeNow = lastTime + (double)elapsed / 1000.;
+    if (elapsed >= 0x7FFFFFFF) {
+        lastTime = timeNow;
+        lastTickCount = tickCountNow;
+    }
+    return timeNow;
+}
+
+#endif // USE(QUERY_PERFORMANCE_COUNTER)
+
 #elif PLATFORM(CF)
 
 double currentTime()
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.cpp
index 0b76649..6a5b22f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.cpp
@@ -65,6 +65,11 @@
 #include <notify.h>
 #endif
 
+#if PLATFORM(WINCE) && !PLATFORM(QT)
+extern "C" size_t strftime(char * const s, const size_t maxsize, const char * const format, const struct tm * const t);
+extern "C" struct tm * localtime(const time_t *timer);
+#endif
+
 #if HAVE(SYS_TIME_H)
 #include <sys/time.h>
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/DisallowCType.h b/src/3rdparty/webkit/JavaScriptCore/wtf/DisallowCType.h
index 5dccb0e..436f7f2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/DisallowCType.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/DisallowCType.h
@@ -54,21 +54,21 @@
 #undef tolower
 #undef toupper
 
-#define isalnum WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define isalpha WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define isascii WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define isblank WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define iscntrl WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define isdigit WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define isgraph WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define islower WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define isprint WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define ispunct WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define isspace WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define isupper WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define isxdigit WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define toascii WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define tolower WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
-#define toupper WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define isalnum isalnum_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define isalpha isalpha_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define isascii isascii_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define isblank isblank_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define iscntrl iscntrl_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define isdigit isdigit_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define isgraph isgraph_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define islower islower_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define isprint isprint_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define ispunct ispunct_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define isspace isspace_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define isupper isupper_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define isxdigit isxdigit_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define toascii toascii_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define tolower tolower_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
+#define toupper toupper_WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h
 
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/FastAllocBase.h b/src/3rdparty/webkit/JavaScriptCore/wtf/FastAllocBase.h
index 9fcbbc1..81b1de0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/FastAllocBase.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/FastAllocBase.h
@@ -301,6 +301,16 @@ namespace WTF {
         fastFree(p);
     }
 
+    template <typename T>
+    inline void fastDeleteSkippingDestructor(T* p)
+    {
+        if (!p)
+            return;
+
+        fastMallocMatchValidateFree(p, Internal::AllocTypeFastNew);
+        fastFree(p);
+    }
+
     namespace Internal {
         // This is a support template for fastDeleteArray.
         // This handles the case wherein T has a trivial dtor.
@@ -397,7 +407,7 @@ namespace WTF {
 
 } // namespace WTF
 
-// Using WTF::FastAllocBase to avoid using FastAllocBase's explicit qualification by WTF::.
 using WTF::FastAllocBase;
+using WTF::fastDeleteSkippingDestructor;
 
 #endif // FastAllocBase_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp
index c855a41..afb0220 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp
@@ -1,6 +1,6 @@
 // Copyright (c) 2005, 2007, Google Inc.
 // All rights reserved.
-// Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+// Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
 // 
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
@@ -89,12 +89,20 @@
 #endif
 #endif
 
-#if !defined(USE_SYSTEM_MALLOC) && defined(NDEBUG)
+#if !(defined(USE_SYSTEM_MALLOC) && USE_SYSTEM_MALLOC) && defined(NDEBUG)
 #define FORCE_SYSTEM_MALLOC 0
 #else
 #define FORCE_SYSTEM_MALLOC 1
 #endif
 
+// Use a background thread to periodically scavenge memory to release back to the system
+// https://bugs.webkit.org/show_bug.cgi?id=27900: don't turn this on for Tiger until we have figured out why it caused a crash.
+#if defined(BUILDING_ON_TIGER)
+#define USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY 0
+#else
+#define USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY 1
+#endif
+
 #ifndef NDEBUG
 namespace WTF {
 
@@ -170,10 +178,10 @@ void* fastZeroedMalloc(size_t n)
     return result;
 }
     
-void* tryFastZeroedMalloc(size_t n) 
+TryMallocReturnValue tryFastZeroedMalloc(size_t n) 
 {
-    void* result = tryFastMalloc(n);
-    if (!result)
+    void* result;
+    if (!tryFastMalloc(n).getValue(result))
         return 0;
     memset(result, 0, n);
     return result;
@@ -192,7 +200,7 @@ void* tryFastZeroedMalloc(size_t n)
 
 namespace WTF {
 
-void* tryFastMalloc(size_t n) 
+TryMallocReturnValue tryFastMalloc(size_t n) 
 {
     ASSERT(!isForbidden());
 
@@ -218,7 +226,9 @@ void* fastMalloc(size_t n)
     ASSERT(!isForbidden());
 
 #if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
-    void* result = tryFastMalloc(n);
+    TryMallocReturnValue returnValue = tryFastMalloc(n);
+    void* result;
+    returnValue.getValue(result);
 #else
     void* result = malloc(n);
 #endif
@@ -228,7 +238,7 @@ void* fastMalloc(size_t n)
     return result;
 }
 
-void* tryFastCalloc(size_t n_elements, size_t element_size)
+TryMallocReturnValue tryFastCalloc(size_t n_elements, size_t element_size)
 {
     ASSERT(!isForbidden());
 
@@ -256,7 +266,9 @@ void* fastCalloc(size_t n_elements, size_t element_size)
     ASSERT(!isForbidden());
 
 #if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
-    void* result = tryFastCalloc(n_elements, element_size);
+    TryMallocReturnValue returnValue = tryFastCalloc(n_elements, element_size);
+    void* result;
+    returnValue.getValue(result);
 #else
     void* result = calloc(n_elements, element_size);
 #endif
@@ -283,7 +295,7 @@ void fastFree(void* p)
 #endif
 }
 
-void* tryFastRealloc(void* p, size_t n)
+TryMallocReturnValue tryFastRealloc(void* p, size_t n)
 {
     ASSERT(!isForbidden());
 
@@ -315,7 +327,9 @@ void* fastRealloc(void* p, size_t n)
     ASSERT(!isForbidden());
 
 #if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
-    void* result = tryFastRealloc(p, n);
+    TryMallocReturnValue returnValue = tryFastRealloc(p, n);
+    void* result;
+    returnValue.getValue(result);
 #else
     void* result = realloc(p, n);
 #endif
@@ -531,7 +545,7 @@ static const size_t kNumClasses = 68;
 static const size_t kPageMapBigAllocationThreshold = 128 << 20;
 
 // Minimum number of pages to fetch from system at a time.  Must be
-// significantly bigger than kBlockSize to amortize system-call
+// significantly bigger than kPageSize to amortize system-call
 // overhead, and also to reduce external fragementation.  Also, we
 // should keep this value big because various incarnations of Linux
 // have small limits on the number of mmap() regions per
@@ -1187,6 +1201,32 @@ template <> class MapSelector<32> {
 // contiguous runs of pages (called a "span").
 // -------------------------------------------------------------------------
 
+#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
+// The central page heap collects spans of memory that have been deleted but are still committed until they are released
+// back to the system.  We use a background thread to periodically scan the list of free spans and release some back to the
+// system.  Every 5 seconds, the background thread wakes up and does the following:
+// - Check if we needed to commit memory in the last 5 seconds.  If so, skip this scavenge because it's a sign that we are short
+// of free committed pages and so we should not release them back to the system yet.
+// - Otherwise, go through the list of free spans (from largest to smallest) and release up to a fraction of the free committed pages
+// back to the system.
+// - If the number of free committed pages reaches kMinimumFreeCommittedPageCount, we can stop the scavenging and block the
+// scavenging thread until the number of free committed pages goes above kMinimumFreeCommittedPageCount.
+
+// Background thread wakes up every 5 seconds to scavenge as long as there is memory available to return to the system.
+static const int kScavengeTimerDelayInSeconds = 5;
+
+// Number of free committed pages that we want to keep around.
+static const size_t kMinimumFreeCommittedPageCount = 512;
+
+// During a scavenge, we'll release up to a fraction of the free committed pages.
+#if PLATFORM(WIN)
+// We are slightly less aggressive in releasing memory on Windows due to performance reasons.
+static const int kMaxScavengeAmountFactor = 3;
+#else
+static const int kMaxScavengeAmountFactor = 2;
+#endif
+#endif
+
 class TCMalloc_PageHeap {
  public:
   void init();
@@ -1286,6 +1326,14 @@ class TCMalloc_PageHeap {
   // Bytes allocated from system
   uint64_t system_bytes_;
 
+#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
+  // Number of pages kept in free lists that are still committed.
+  Length free_committed_pages_;
+
+  // Number of pages that we committed in the last scavenge wait interval.
+  Length pages_committed_since_last_scavenge_;
+#endif
+
   bool GrowHeap(Length n);
 
   // REQUIRES   span->length >= n
@@ -1308,9 +1356,11 @@ class TCMalloc_PageHeap {
   // span of exactly the specified length.  Else, returns NULL.
   Span* AllocLarge(Length n);
 
+#if !USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
   // Incrementally release some memory to the system.
   // IncrementalScavenge(n) is called whenever n pages are freed.
   void IncrementalScavenge(Length n);
+#endif
 
   // Number of pages to deallocate before doing more scavenging
   int64_t scavenge_counter_;
@@ -1321,6 +1371,24 @@ class TCMalloc_PageHeap {
 #if defined(WTF_CHANGES) && PLATFORM(DARWIN)
   friend class FastMallocZone;
 #endif
+
+#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
+  static NO_RETURN void* runScavengerThread(void*);
+
+  NO_RETURN void scavengerThread();
+
+  void scavenge();
+
+  inline bool shouldContinueScavenging() const;
+
+  pthread_mutex_t m_scavengeMutex;
+
+  pthread_cond_t m_scavengeCondition;
+
+  // Keeps track of whether the background thread is actively scavenging memory every kScavengeTimerDelayInSeconds, or
+  // it's blocked waiting for more pages to be deleted.
+  bool m_scavengeThreadActive;
+#endif  // USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
 };
 
 void TCMalloc_PageHeap::init()
@@ -1329,6 +1397,12 @@ void TCMalloc_PageHeap::init()
   pagemap_cache_ = PageMapCache(0);
   free_pages_ = 0;
   system_bytes_ = 0;
+
+#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
+  free_committed_pages_ = 0;
+  pages_committed_since_last_scavenge_ = 0;
+#endif  // USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
+
   scavenge_counter_ = 0;
   // Start scavenging at kMaxPages list
   scavenge_index_ = kMaxPages-1;
@@ -1339,8 +1413,68 @@ void TCMalloc_PageHeap::init()
     DLL_Init(&free_[i].normal);
     DLL_Init(&free_[i].returned);
   }
+
+#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
+  pthread_mutex_init(&m_scavengeMutex, 0);
+  pthread_cond_init(&m_scavengeCondition, 0);
+  m_scavengeThreadActive = true;
+  pthread_t thread;
+  pthread_create(&thread, 0, runScavengerThread, this);
+#endif  // USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
+}
+
+#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
+void* TCMalloc_PageHeap::runScavengerThread(void* context)
+{
+  static_cast<TCMalloc_PageHeap*>(context)->scavengerThread();
+#if COMPILER(MSVC)
+  // Without this, Visual Studio will complain that this method does not return a value.
+  return 0;
+#endif
 }
 
+void TCMalloc_PageHeap::scavenge() 
+{
+    // If we have to commit memory in the last 5 seconds, it means we don't have enough free committed pages
+    // for the amount of allocations that we do.  So hold off on releasing memory back to the system.
+    if (pages_committed_since_last_scavenge_ > 0) {
+        pages_committed_since_last_scavenge_ = 0;
+        return;
+    }
+    Length pagesDecommitted = 0;
+    for (int i = kMaxPages; i >= 0; i--) {
+        SpanList* slist = (static_cast<size_t>(i) == kMaxPages) ? &large_ : &free_[i];
+        if (!DLL_IsEmpty(&slist->normal)) {
+            // Release the last span on the normal portion of this list
+            Span* s = slist->normal.prev; 
+            // Only decommit up to a fraction of the free committed pages if pages_allocated_since_last_scavenge_ > 0.
+            if ((pagesDecommitted + s->length) * kMaxScavengeAmountFactor > free_committed_pages_)
+                continue;
+            DLL_Remove(s);
+            TCMalloc_SystemRelease(reinterpret_cast<void*>(s->start << kPageShift),
+                                   static_cast<size_t>(s->length << kPageShift));
+            if (!s->decommitted) {
+                pagesDecommitted += s->length;
+                s->decommitted = true;
+            }
+            DLL_Prepend(&slist->returned, s);
+            // We can stop scavenging if the number of free committed pages left is less than or equal to the minimum number we want to keep around.
+            if (free_committed_pages_ <= kMinimumFreeCommittedPageCount + pagesDecommitted)
+                break;
+        }
+    }
+    pages_committed_since_last_scavenge_ = 0;
+    ASSERT(free_committed_pages_ >= pagesDecommitted);
+    free_committed_pages_ -= pagesDecommitted;
+}
+
+inline bool TCMalloc_PageHeap::shouldContinueScavenging() const 
+{
+    return free_committed_pages_ > kMinimumFreeCommittedPageCount; 
+}
+
+#endif  // USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
+
 inline Span* TCMalloc_PageHeap::New(Length n) {
   ASSERT(Check());
   ASSERT(n > 0);
@@ -1366,7 +1500,18 @@ inline Span* TCMalloc_PageHeap::New(Length n) {
     if (result->decommitted) {
         TCMalloc_SystemCommit(reinterpret_cast<void*>(result->start << kPageShift), static_cast<size_t>(n << kPageShift));
         result->decommitted = false;
+#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
+        pages_committed_since_last_scavenge_ += n;
+#endif
+    }
+#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
+    else {
+        // The newly allocated memory is from a span that's in the normal span list (already committed).  Update the
+        // free committed pages count.
+        ASSERT(free_committed_pages_ >= n);
+        free_committed_pages_ -= n;
     }
+#endif  // USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
     ASSERT(Check());
     free_pages_ -= n;
     return result;
@@ -1426,7 +1571,18 @@ Span* TCMalloc_PageHeap::AllocLarge(Length n) {
     if (best->decommitted) {
         TCMalloc_SystemCommit(reinterpret_cast<void*>(best->start << kPageShift), static_cast<size_t>(n << kPageShift));
         best->decommitted = false;
+#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
+        pages_committed_since_last_scavenge_ += n;
+#endif
+    }
+#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
+    else {
+        // The newly allocated memory is from a span that's in the normal span list (already committed).  Update the
+        // free committed pages count.
+        ASSERT(free_committed_pages_ >= n);
+        free_committed_pages_ -= n;
     }
+#endif  // USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
     ASSERT(Check());
     free_pages_ -= n;
     return best;
@@ -1508,6 +1664,10 @@ inline void TCMalloc_PageHeap::Delete(Span* span) {
   // necessary.  We do not bother resetting the stale pagemap
   // entries for the pieces we are merging together because we only
   // care about the pagemap entries for the boundaries.
+#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
+  // Track the total size of the neighboring free spans that are committed.
+  Length neighboringCommittedSpansLength = 0;
+#endif
   const PageID p = span->start;
   const Length n = span->length;
   Span* prev = GetDescriptor(p-1);
@@ -1515,6 +1675,10 @@ inline void TCMalloc_PageHeap::Delete(Span* span) {
     // Merge preceding span into this span
     ASSERT(prev->start + prev->length == p);
     const Length len = prev->length;
+#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
+    if (!prev->decommitted)
+        neighboringCommittedSpansLength += len;
+#endif
     mergeDecommittedStates(span, prev);
     DLL_Remove(prev);
     DeleteSpan(prev);
@@ -1528,6 +1692,10 @@ inline void TCMalloc_PageHeap::Delete(Span* span) {
     // Merge next span into this span
     ASSERT(next->start == p+n);
     const Length len = next->length;
+#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
+    if (!next->decommitted)
+        neighboringCommittedSpansLength += len;
+#endif
     mergeDecommittedStates(span, next);
     DLL_Remove(next);
     DeleteSpan(next);
@@ -1551,10 +1719,27 @@ inline void TCMalloc_PageHeap::Delete(Span* span) {
   }
   free_pages_ += n;
 
+#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
+  if (span->decommitted) {
+      // If the merged span is decommitted, that means we decommitted any neighboring spans that were
+      // committed.  Update the free committed pages count.
+      free_committed_pages_ -= neighboringCommittedSpansLength;
+  } else {
+      // If the merged span remains committed, add the deleted span's size to the free committed pages count.
+      free_committed_pages_ += n;
+  }
+
+  // Make sure the scavenge thread becomes active if we have enough freed pages to release some back to the system.
+  if (!m_scavengeThreadActive && shouldContinueScavenging())
+      pthread_cond_signal(&m_scavengeCondition);
+#else
   IncrementalScavenge(n);
+#endif
+
   ASSERT(Check());
 }
 
+#if !USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
 void TCMalloc_PageHeap::IncrementalScavenge(Length n) {
   // Fast path; not yet time to release memory
   scavenge_counter_ -= n;
@@ -1592,6 +1777,7 @@ void TCMalloc_PageHeap::IncrementalScavenge(Length n) {
   // Nothing to scavenge, delay for a while
   scavenge_counter_ = kDefaultReleaseDelay;
 }
+#endif
 
 void TCMalloc_PageHeap::RegisterSizeClass(Span* span, size_t sc) {
   // Associate span object with all interior pages as well
@@ -1703,6 +1889,10 @@ bool TCMalloc_PageHeap::GrowHeap(Length n) {
   }
   ask = actual_size >> kPageShift;
 
+#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
+  pages_committed_since_last_scavenge_ += ask;
+#endif
+
   uint64_t old_system_bytes = system_bytes_;
   system_bytes_ += (ask << kPageShift);
   const PageID p = reinterpret_cast<uintptr_t>(ptr) >> kPageShift;
@@ -2083,6 +2273,34 @@ static inline TCMalloc_PageHeap* getPageHeap()
 
 #define pageheap getPageHeap()
 
+#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
+#if PLATFORM(WIN)
+static void sleep(unsigned seconds)
+{
+    ::Sleep(seconds * 1000);
+}
+#endif
+
+void TCMalloc_PageHeap::scavengerThread()
+{
+  while (1) {
+      if (!shouldContinueScavenging()) {
+          pthread_mutex_lock(&m_scavengeMutex);
+          m_scavengeThreadActive = false;
+          // Block until there are enough freed pages to release back to the system.
+          pthread_cond_wait(&m_scavengeCondition, &m_scavengeMutex);
+          m_scavengeThreadActive = true;
+          pthread_mutex_unlock(&m_scavengeMutex);
+      }
+      sleep(kScavengeTimerDelayInSeconds);
+      {
+          SpinLockHolder h(&pageheap_lock);
+          pageheap->scavenge();
+      }
+  }
+}
+#endif
+
 // If TLS is available, we also store a copy
 // of the per-thread object in a __thread variable
 // since __thread variables are faster to read
@@ -3364,7 +3582,7 @@ void* fastMalloc(size_t size)
     return malloc<true>(size);
 }
 
-void* tryFastMalloc(size_t size)
+TryMallocReturnValue tryFastMalloc(size_t size)
 {
     return malloc<false>(size);
 }
@@ -3425,7 +3643,7 @@ void* fastCalloc(size_t n, size_t elem_size)
     return calloc<true>(n, elem_size);
 }
 
-void* tryFastCalloc(size_t n, size_t elem_size)
+TryMallocReturnValue tryFastCalloc(size_t n, size_t elem_size)
 {
     return calloc<false>(n, elem_size);
 }
@@ -3489,7 +3707,7 @@ void* fastRealloc(void* old_ptr, size_t new_size)
     return realloc<true>(old_ptr, new_size);
 }
 
-void* tryFastRealloc(void* old_ptr, size_t new_size)
+TryMallocReturnValue tryFastRealloc(void* old_ptr, size_t new_size)
 {
     return realloc<false>(old_ptr, new_size);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h
index 61ebe32..b23e7b0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -22,24 +22,56 @@
 #define WTF_FastMalloc_h
 
 #include "Platform.h"
+#include "PossiblyNull.h"
 #include <stdlib.h>
 #include <new>
 
 namespace WTF {
 
     // These functions call CRASH() if an allocation fails.
-    void* fastMalloc(size_t n);
-    void* fastZeroedMalloc(size_t n);
-    void* fastCalloc(size_t n_elements, size_t element_size);
-    void* fastRealloc(void* p, size_t n);
+    void* fastMalloc(size_t);
+    void* fastZeroedMalloc(size_t);
+    void* fastCalloc(size_t numElements, size_t elementSize);
+    void* fastRealloc(void*, size_t);
+
+    struct TryMallocReturnValue {
+        TryMallocReturnValue(void* data)
+            : m_data(data)
+        {
+        }
+        TryMallocReturnValue(const TryMallocReturnValue& source)
+            : m_data(source.m_data)
+        {
+            source.m_data = 0;
+        }
+        ~TryMallocReturnValue() { ASSERT(!m_data); }
+        template <typename T> bool getValue(T& data) WARN_UNUSED_RETURN;
+        template <typename T> operator PossiblyNull<T>()
+        { 
+            T value; 
+            getValue(value); 
+            return PossiblyNull<T>(value);
+        } 
+    private:
+        mutable void* m_data;
+    };
+    
+    template <typename T> bool TryMallocReturnValue::getValue(T& data)
+    {
+        union u { void* data; T target; } res;
+        res.data = m_data;
+        data = res.target;
+        bool returnValue = !!m_data;
+        m_data = 0;
+        return returnValue;
+    }
 
-    // These functions return NULL if an allocation fails.
-    void* tryFastMalloc(size_t n);
-    void* tryFastZeroedMalloc(size_t n);
-    void* tryFastCalloc(size_t n_elements, size_t element_size);
-    void* tryFastRealloc(void* p, size_t n);
+    TryMallocReturnValue tryFastMalloc(size_t n);
+    TryMallocReturnValue tryFastZeroedMalloc(size_t n);
+    TryMallocReturnValue tryFastCalloc(size_t n_elements, size_t element_size);
+    TryMallocReturnValue tryFastRealloc(void* p, size_t n);
 
-    void fastFree(void* p);
+    void fastFree(void*);
 
 #ifndef NDEBUG    
     void fastMallocForbid();
@@ -172,22 +204,24 @@ using WTF::fastMallocAllow;
 #define WTF_PRIVATE_INLINE inline
 #endif
 
-#ifndef _CRTDBG_MAP_ALLOC
+#if !defined(_CRTDBG_MAP_ALLOC) && !(defined(USE_SYSTEM_MALLOC) && USE_SYSTEM_MALLOC)
 
-#if !defined(USE_SYSTEM_MALLOC) || !(USE_SYSTEM_MALLOC)
-WTF_PRIVATE_INLINE void* operator new(size_t s) { return fastMalloc(s); }
-WTF_PRIVATE_INLINE void operator delete(void* p) { fastFree(p); }
-WTF_PRIVATE_INLINE void* operator new[](size_t s) { return fastMalloc(s); }
-WTF_PRIVATE_INLINE void operator delete[](void* p) { fastFree(p); }
+// The nothrow functions here are actually not all that helpful, because fastMalloc will
+// call CRASH() rather than returning 0, and returning 0 is what nothrow is all about.
+// But since WebKit code never uses exceptions or nothrow at all, this is probably OK.
+// Long term we will adopt FastAllocBase.h everywhere, and and replace this with
+// debug-only code to make sure we don't use the system malloc via the default operator
+// new by accident.
 
-#if PLATFORM(WINCE)
-WTF_PRIVATE_INLINE void* operator new(size_t s, const std::nothrow_t&) throw() { return fastMalloc(s); }
+WTF_PRIVATE_INLINE void* operator new(size_t size) { return fastMalloc(size); }
+WTF_PRIVATE_INLINE void* operator new(size_t size, const std::nothrow_t&) throw() { return fastMalloc(size); }
+WTF_PRIVATE_INLINE void operator delete(void* p) { fastFree(p); }
 WTF_PRIVATE_INLINE void operator delete(void* p, const std::nothrow_t&) throw() { fastFree(p); }
-WTF_PRIVATE_INLINE void* operator new[](size_t s, const std::nothrow_t&) throw() { return fastMalloc(s); }
+WTF_PRIVATE_INLINE void* operator new[](size_t size) { return fastMalloc(size); }
+WTF_PRIVATE_INLINE void* operator new[](size_t size, const std::nothrow_t&) throw() { return fastMalloc(size); }
+WTF_PRIVATE_INLINE void operator delete[](void* p) { fastFree(p); }
 WTF_PRIVATE_INLINE void operator delete[](void* p, const std::nothrow_t&) throw() { fastFree(p); }
-#endif
-#endif
 
-#endif // _CRTDBG_MAP_ALLOC
+#endif
 
 #endif /* WTF_FastMalloc_h */
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h b/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h
index 8ff9170..3de5ee6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h
@@ -178,10 +178,7 @@ namespace WTF {
     HashMap<T, U, V, W, X>::inlineAdd(const KeyType& key, const MappedType& mapped) 
     {
         typedef HashMapTranslator<ValueType, ValueTraits, HashFunctions> TranslatorType;
-        pair<typename HashTableType::iterator, bool> p = m_impl.template add<KeyType, MappedType, TranslatorType>(key, mapped);
-	typename HashMap<T, U, V, W, X>::iterator temp = p.first;
-        return make_pair<typename HashMap<T, U, V, W, X>::iterator, bool>(temp, p.second);
-//      return m_impl.template add<KeyType, MappedType, TranslatorType>(key, mapped);
+        return m_impl.template add<KeyType, MappedType, TranslatorType>(key, mapped);
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/HashSet.h b/src/3rdparty/webkit/JavaScriptCore/wtf/HashSet.h
index ec809e5..f4e2cf7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/HashSet.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/HashSet.h
@@ -29,6 +29,8 @@ namespace WTF {
     template<typename Value, typename HashFunctions, typename Traits> class HashSet;
     template<typename Value, typename HashFunctions, typename Traits>
     void deleteAllValues(const HashSet<Value, HashFunctions, Traits>&);
+    template<typename Value, typename HashFunctions, typename Traits>
+    void fastDeleteAllValues(const HashSet<Value, HashFunctions, Traits>&);
 
     template<typename T> struct IdentityExtractor;
 
@@ -91,6 +93,7 @@ namespace WTF {
 
     private:
         friend void deleteAllValues<>(const HashSet&);
+        friend void fastDeleteAllValues<>(const HashSet&);
 
         HashTableType m_impl;
     };
@@ -204,12 +207,7 @@ namespace WTF {
     template<typename T, typename U, typename V>
     pair<typename HashSet<T, U, V>::iterator, bool> HashSet<T, U, V>::add(const ValueType& value)
     {
-        pair<typename HashTable<T, T, IdentityExtractor<T>, U, V, V>::iterator, bool> p = m_impl.add(value);
-        typename HashSet<T, U, V>::iterator temp = p.first;
-        pair<typename HashSet<T, U, V>::iterator, bool> p2 = make_pair<typename HashSet<T, U, V>::iterator, bool>(temp, p.second);
- //       p2.first = p.first;
- //       p2.second = p.second;
-        return p2;
+        return m_impl.add(value);
     }
 
     template<typename Value, typename HashFunctions, typename Traits>
@@ -218,8 +216,7 @@ namespace WTF {
     HashSet<Value, HashFunctions, Traits>::add(const T& value)
     {
         typedef HashSetTranslatorAdapter<ValueType, ValueTraits, T, HashTranslator> Adapter;
-        pair<typename HashTableType::iterator, bool> p = m_impl.template addPassingHashCode<T, T, Adapter>(value, value);
-	return make_pair<iterator, bool>(p.first, p.second);
+        return m_impl.template addPassingHashCode<T, T, Adapter>(value, value);
     }
 
     template<typename T, typename U, typename V>
@@ -257,6 +254,21 @@ namespace WTF {
     {
         deleteAllValues<typename HashSet<T, U, V>::ValueType>(collection.m_impl);
     }
+
+    template<typename ValueType, typename HashTableType>
+    void fastDeleteAllValues(HashTableType& collection)
+    {
+        typedef typename HashTableType::const_iterator iterator;
+        iterator end = collection.end();
+        for (iterator it = collection.begin(); it != end; ++it)
+            fastDelete(*it);
+    }
+
+    template<typename T, typename U, typename V>
+    inline void fastDeleteAllValues(const HashSet<T, U, V>& collection)
+    {
+        fastDeleteAllValues<typename HashSet<T, U, V>::ValueType>(collection.m_impl);
+    }
     
     template<typename T, typename U, typename V, typename W>
     inline void copyToVector(const HashSet<T, U, V>& collection, W& vector)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.cpp
index 3c19b7a..e999094 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.cpp
@@ -29,9 +29,9 @@
 #include "config.h"
 #include "MainThread.h"
 
+#include "StdLibExtras.h"
 #include "CurrentTime.h"
 #include "Deque.h"
-#include "StdLibExtras.h"
 #include "Threading.h"
 
 namespace WTF {
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.h b/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.h
index b8305b5..01ce804 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.h
@@ -34,9 +34,7 @@ namespace WTF {
 
 class Mutex;
 
-extern "C" {
-    typedef void MainThreadFunction(void*);
-}
+typedef void MainThreadFunction(void*);
 
 void callOnMainThread(MainThreadFunction*, void* context);
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/MessageQueue.h b/src/3rdparty/webkit/JavaScriptCore/wtf/MessageQueue.h
index 070b76c..12291cc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/MessageQueue.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/MessageQueue.h
@@ -41,7 +41,7 @@ namespace WTF {
     enum MessageQueueWaitResult {
         MessageQueueTerminated,       // Queue was destroyed while waiting for message.
         MessageQueueTimeout,          // Timeout was specified and it expired.
-        MessageQueueMessageReceived   // A message was successfully received and returned.
+        MessageQueueMessageReceived,  // A message was successfully received and returned.
     };
 
     template<typename DataType>
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Noncopyable.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Noncopyable.h
index c50c9d8..60a46e2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Noncopyable.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Noncopyable.h
@@ -28,7 +28,7 @@
 
 namespace WTFNoncopyable {
 
-    class Noncopyable {
+    class Noncopyable : public FastAllocBase {
         Noncopyable(const Noncopyable&);
         Noncopyable& operator=(const Noncopyable&);
     protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/PassRefPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/PassRefPtr.h
index d80ed62..ae398d3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/PassRefPtr.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/PassRefPtr.h
@@ -28,11 +28,34 @@ namespace WTF {
     template<typename T> class RefPtr;
     template<typename T> class PassRefPtr;
     template <typename T> PassRefPtr<T> adoptRef(T*);
+    
+    // Remove inline for winscw compiler to prevent the compiler agressively resolving 
+    // T::deref(), which will fail compiling when PassRefPtr<T> is used as class member 
+    // or function arguments before T is defined.
+    template<typename T> 
+#if !COMPILER(WINSCW)
+    inline 
+#endif
+    void derefIfNotNull(T* ptr)
+    {
+        if (UNLIKELY(ptr != 0))
+            ptr->deref();
+    }
+
+    template<typename T>
+#if !COMPILER(WINSCW)
+    inline
+#endif
+    void refIfNotNull(T* ptr)
+    {
+        if (UNLIKELY(ptr != 0))
+            ptr->ref();
+    }
 
     template<typename T> class PassRefPtr {
     public:
         PassRefPtr() : m_ptr(0) {}
-        PassRefPtr(T* ptr) : m_ptr(ptr) { if (ptr) ptr->ref(); }
+        PassRefPtr(T* ptr) : m_ptr(ptr) { refIfNotNull(ptr); }
         // It somewhat breaks the type system to allow transfer of ownership out of
         // a const PassRefPtr. However, it makes it much easier to work with PassRefPtr
         // temporaries, and we don't really have a need to use real const PassRefPtrs 
@@ -40,14 +63,14 @@ namespace WTF {
         PassRefPtr(const PassRefPtr& o) : m_ptr(o.releaseRef()) {}
         template <typename U> PassRefPtr(const PassRefPtr<U>& o) : m_ptr(o.releaseRef()) { }
 
-        ALWAYS_INLINE ~PassRefPtr() { if (UNLIKELY(m_ptr != 0)) m_ptr->deref(); }
-        
+        ALWAYS_INLINE ~PassRefPtr() { derefIfNotNull(m_ptr); }
+
         template <class U> 
-        PassRefPtr(const RefPtr<U>& o) : m_ptr(o.get()) { if (T* ptr = m_ptr) ptr->ref(); }
+        PassRefPtr(const RefPtr<U>& o) : m_ptr(o.get()) { T* ptr = m_ptr; refIfNotNull(ptr); }
         
         T* get() const { return m_ptr; }
 
-        void clear() { if (T* ptr = m_ptr) ptr->deref(); m_ptr = 0; }
+        void clear() { T* ptr = m_ptr; derefIfNotNull(ptr); m_ptr = 0; }
         T* releaseRef() const { T* tmp = m_ptr; m_ptr = 0; return tmp; }
 
         T& operator*() const { return *m_ptr; }
@@ -56,12 +79,10 @@ namespace WTF {
         bool operator!() const { return !m_ptr; }
 
         // This conversion operator allows implicit conversion to bool but not to other integer types.
-#if COMPILER(WINSCW)
-        operator bool() const { return m_ptr; }
-#else
-        typedef T* PassRefPtr::*UnspecifiedBoolType;
+        // Parenthesis is needed for winscw compiler to resolve class qualifier in this case.
+        typedef T* (PassRefPtr::*UnspecifiedBoolType);
         operator UnspecifiedBoolType() const { return m_ptr ? &PassRefPtr::m_ptr : 0; }
-#endif
+
         PassRefPtr& operator=(T*);
         PassRefPtr& operator=(const PassRefPtr&);
         template <typename U> PassRefPtr& operator=(const PassRefPtr<U>&);
@@ -77,23 +98,19 @@ namespace WTF {
     template <typename T> template <typename U> inline PassRefPtr<T>& PassRefPtr<T>::operator=(const RefPtr<U>& o) 
     {
         T* optr = o.get();
-        if (optr)
-            optr->ref();
+        refIfNotNull(optr);
         T* ptr = m_ptr;
         m_ptr = optr;
-        if (ptr)
-            ptr->deref();
+        derefIfNotNull(ptr);
         return *this;
     }
     
     template <typename T> inline PassRefPtr<T>& PassRefPtr<T>::operator=(T* optr)
     {
-        if (optr)
-            optr->ref();
+        refIfNotNull(optr);
         T* ptr = m_ptr;
         m_ptr = optr;
-        if (ptr)
-            ptr->deref();
+        derefIfNotNull(ptr);
         return *this;
     }
 
@@ -101,8 +118,7 @@ namespace WTF {
     {
         T* ptr = m_ptr;
         m_ptr = ref.releaseRef();
-        if (ptr)
-            ptr->deref();
+        derefIfNotNull(ptr);
         return *this;
     }
     
@@ -110,8 +126,7 @@ namespace WTF {
     {
         T* ptr = m_ptr;
         m_ptr = ref.releaseRef();
-        if (ptr)
-            ptr->deref();
+        derefIfNotNull(ptr);
         return *this;
     }
     
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
index fa37d55..65b1570 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
@@ -94,23 +94,6 @@
 #define WTF_PLATFORM_SOLARIS 1
 #endif
 
-/* PLATFORM(AIX) */
-/* Operating system level dependencies for AIX that should be used */
-/* regardless of operating environment */
-#if defined(_AIX)
-#define WTF_PLATFORM_AIX 1
-#endif
-
-/* PLATFORM(HPUX) */
-/* Operating system level dependencies for HP-UX that should be used */
-/* regardless of operating environment */
-#if defined(hpux) || defined(__hpux)
-#define WTF_PLATFORM_HPUX 1
-#ifndef MAP_ANON
-#define MAP_ANON MAP_ANONYMOUS
-#endif
-#endif
-
 #if defined (__SYMBIAN32__)
 /* we are cross-compiling, it is not really windows */
 #undef WTF_PLATFORM_WIN_OS
@@ -140,12 +123,11 @@
    || PLATFORM(FREEBSD)    \
    || PLATFORM(SYMBIAN)    \
    || PLATFORM(NETBSD)     \
-   || PLATFORM(SOLARIS)    \
-   || PLATFORM(HPUX)       \
    || defined(unix)        \
    || defined(__unix)      \
    || defined(__unix__)    \
-   || PLATFORM(AIX)        \
+   || defined(_AIX)        \
+   || defined(__HAIKU__)   \
    || defined(__QNXNTO__)
 #define WTF_PLATFORM_UNIX 1
 #endif
@@ -171,6 +153,8 @@
 #define WTF_PLATFORM_WX 1
 #elif defined(BUILDING_GTK__)
 #define WTF_PLATFORM_GTK 1
+#elif defined(BUILDING_HAIKU__)
+#define WTF_PLATFORM_HAIKU 1
 #elif PLATFORM(DARWIN)
 #define WTF_PLATFORM_MAC 1
 #elif PLATFORM(WIN_OS)
@@ -217,7 +201,7 @@
 
 /* Makes PLATFORM(WIN) default to PLATFORM(CAIRO) */
 /* FIXME: This should be changed from a blacklist to a whitelist */
-#if !PLATFORM(MAC) && !PLATFORM(QT) && !PLATFORM(WX) && !PLATFORM(CHROMIUM) && !PLATFORM(WINCE)
+#if !PLATFORM(MAC) && !PLATFORM(QT) && !PLATFORM(WX) && !PLATFORM(CHROMIUM) && !PLATFORM(WINCE) && !PLATFORM(HAIKU)
 #define WTF_PLATFORM_CAIRO 1
 #endif
 
@@ -248,12 +232,9 @@
 #define WTF_PLATFORM_ARM 1
 #if defined(__ARMEB__)
 #define WTF_PLATFORM_BIG_ENDIAN 1
-#elif !defined(__ARM_EABI__) && !defined(__ARMEB__) && !defined(__VFP_FP__)
+#elif !defined(__ARM_EABI__) && !defined(__EABI__) && !defined(__VFP_FP__)
 #define WTF_PLATFORM_MIDDLE_ENDIAN 1
 #endif
-#if !defined(__ARM_EABI__)
-#define WTF_PLATFORM_FORCE_PACK 1
-#endif
 #define ARM_ARCH_VERSION 3
 #if defined(__ARM_ARCH_4__) || defined(__ARM_ARCH_4T__)
 #undef ARM_ARCH_VERSION
@@ -299,35 +280,11 @@
 #endif
 
 /* PLATFORM(SPARC64) */
-#if defined(__sparc64__)
+#if defined(__sparc__) && defined(__arch64__) || defined (__sparcv9)
 #define WTF_PLATFORM_SPARC64 1
 #define WTF_PLATFORM_BIG_ENDIAN 1
 #endif
 
-/* PLATFORM(HPPA) */
-/* a.k.a. PA-RISC */
-#if defined(__hppa) || defined(__hppa__)
-#define WTF_PLATFORM_HPPA 1
-#define WTF_PLATFORM_BIG_ENDIAN 1
-#endif
-
-/* PLATFORM(IA64) */
-/* a.k.a. Itanium Processor Family, IPF */
-#if defined(__ia64) || defined(__ia64__) || defined(_M_IA64)
-#define WTF_PLATFORM_IA64 1
-
-/* Itanium can be both big- and little-endian
-   we need to determine at compile time which one it is.
-    - HP's aCC compiler only compiles big-endian (so HP-UXi is always big-endian)
-    - GCC defines __BIG_ENDIAN__ for us (default on HP-UX)
-    - Linux is usually little-endian
-    - I've never seen AIX or Windows on IA-64, but they should be little-endian too
-*/
-#if defined(__BIG_ENDIAN__) || defined(__HP_aCC)
-# define WTF_PLATFORM_BIG_ENDIAN 1
-#endif
-#endif
-
 /* PLATFORM(WINCE) && PLATFORM(QT)
    We can not determine the endianess at compile time. For
    Qt for Windows CE the endianess is specified in the
@@ -386,28 +343,15 @@
 #define WTF_COMPILER_WINSCW 1
 #endif
 
-/* COMPILER(SUNCC) */
-/* This is the Sun CC compiler, also known as Sun Studio or Sun Pro */
-#if defined(__SUNPRO_CC) || defined(__SUNPRO_C)
-#define WTF_COMPILER_SUNCC 1
-#endif
-
-/* COMPILER(XLC) */
-/* IBM Visual Age C/C++ compiler, a.k.a. xlC */
-#if defined(__xlC__)
-#define WTF_COMPILER_XLC 1
-#endif
-
-/* COMPILER(ACC) */
-/* HP's aC++/ANSI C compiler, a.k.a. aCC */
-#if defined(__HP_aCC)
-#define WTF_COMPILER_ACC
-#endif
-
 #if (PLATFORM(IPHONE) || PLATFORM(MAC) || PLATFORM(WIN)) && !defined(ENABLE_JSC_MULTIPLE_THREADS)
 #define ENABLE_JSC_MULTIPLE_THREADS 1
 #endif
 
+/* On Windows, use QueryPerformanceCounter by default */
+#if PLATFORM(WIN_OS)
+#define WTF_USE_QUERY_PERFORMANCE_COUNTER  1
+#endif
+
 #if PLATFORM(WINCE) && !PLATFORM(QT)
 #undef ENABLE_JSC_MULTIPLE_THREADS
 #define ENABLE_JSC_MULTIPLE_THREADS        0
@@ -438,6 +382,8 @@
 /* for Unicode, KDE uses Qt */
 #if PLATFORM(KDE) || PLATFORM(QT)
 #define WTF_USE_QT4_UNICODE 1
+#elif PLATFORM(WINCE)
+#define WTF_USE_WINCE_UNICODE 1
 #elif PLATFORM(GTK)
 /* The GTK+ Unicode backend is configurable */
 #else
@@ -465,7 +411,10 @@
 #if PLATFORM(IPHONE)
 #define WTF_PLATFORM_CF 1
 #define WTF_USE_PTHREADS 1
+#define ENABLE_CONTEXT_MENUS 0
+#define ENABLE_DRAG_SUPPORT 0
 #define ENABLE_FTPDIR 1
+#define ENABLE_INSPECTOR 0
 #define ENABLE_MAC_JAVA_BRIDGE 0
 #define ENABLE_ICONDATABASE 0
 #define ENABLE_GEOLOCATION 1
@@ -480,8 +429,6 @@
 
 #if PLATFORM(WX)
 #define ENABLE_ASSEMBLER 1
-#define WTF_USE_CURL 1
-#define WTF_USE_PTHREADS 1
 #endif
 
 #if PLATFORM(GTK)
@@ -490,6 +437,14 @@
 #endif
 #endif
 
+#if PLATFORM(HAIKU)
+#define HAVE_POSIX_MEMALIGN 1
+#define WTF_USE_CURL 1
+#define WTF_USE_PTHREADS 1
+#define USE_SYSTEM_MALLOC 1
+#define ENABLE_NETSCAPE_PLUGIN_API 0
+#endif
+
 #if !defined(HAVE_ACCESSIBILITY)
 #if PLATFORM(IPHONE) || PLATFORM(MAC) || PLATFORM(WIN) || PLATFORM(GTK) || PLATFORM(CHROMIUM)
 #define HAVE_ACCESSIBILITY 1
@@ -501,7 +456,7 @@
 #endif
 
 #if !PLATFORM(WIN_OS) && !PLATFORM(SOLARIS) && !PLATFORM(QNX) \
-    && !PLATFORM(SYMBIAN) && !COMPILER(RVCT) && !PLATFORM(AIX) && !PLATFORM(HPUX)
+    && !PLATFORM(SYMBIAN) && !PLATFORM(HAIKU) && !COMPILER(RVCT)
 #define HAVE_TM_GMTOFF 1
 #define HAVE_TM_ZONE 1
 #define HAVE_TIMEGM 1
@@ -565,7 +520,10 @@
 /* FIXME: is this actually used or do other platforms generate their own config.h? */
 
 #define HAVE_ERRNO_H 1
+/* As long as Haiku doesn't have a complete support of locale this will be disabled. */
+#if !PLATFORM(HAIKU)
 #define HAVE_LANGINFO_H 1
+#endif
 #define HAVE_MMAP 1
 #define HAVE_SBRK 1
 #define HAVE_STRINGS_H 1
@@ -598,10 +556,22 @@
 #define ENABLE_FTPDIR 1
 #endif
 
+#if !defined(ENABLE_CONTEXT_MENUS)
+#define ENABLE_CONTEXT_MENUS 1
+#endif
+
+#if !defined(ENABLE_DRAG_SUPPORT)
+#define ENABLE_DRAG_SUPPORT 1
+#endif
+
 #if !defined(ENABLE_DASHBOARD_SUPPORT)
 #define ENABLE_DASHBOARD_SUPPORT 0
 #endif
 
+#if !defined(ENABLE_INSPECTOR)
+#define ENABLE_INSPECTOR 1
+#endif
+
 #if !defined(ENABLE_MAC_JAVA_BRIDGE)
 #define ENABLE_MAC_JAVA_BRIDGE 0
 #endif
@@ -629,6 +599,10 @@
 #define ENABLE_GEOLOCATION 0
 #endif
 
+#if !defined(ENABLE_NOTIFICATIONS)
+#define ENABLE_NOTIFICATIONS 0
+#endif
+
 #if !defined(ENABLE_TEXT_CARET)
 #define ENABLE_TEXT_CARET 1
 #endif
@@ -637,9 +611,19 @@
 #define ENABLE_ON_FIRST_TEXTAREA_FOCUS_SELECT_ALL 0
 #endif
 
-#if !defined(WTF_USE_ALTERNATE_JSIMMEDIATE) && PLATFORM(X86_64) && PLATFORM(MAC)
-#define WTF_USE_ALTERNATE_JSIMMEDIATE 1
+#if !defined(WTF_USE_JSVALUE64) && !defined(WTF_USE_JSVALUE32) && !defined(WTF_USE_JSVALUE32_64)
+#if PLATFORM(X86_64) && (PLATFORM(DARWIN) || PLATFORM(LINUX))
+#define WTF_USE_JSVALUE64 1
+#elif PLATFORM(ARM) || PLATFORM(PPC64)
+#define WTF_USE_JSVALUE32 1
+#elif PLATFORM(WIN_OS) && COMPILER(MINGW)
+/* Using JSVALUE32_64 causes padding/alignement issues for JITStubArg
+on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
+#define WTF_USE_JSVALUE32 1
+#else
+#define WTF_USE_JSVALUE32_64 1
 #endif
+#endif /* !defined(WTF_USE_JSVALUE64) && !defined(WTF_USE_JSVALUE32) && !defined(WTF_USE_JSVALUE32_64) */
 
 #if !defined(ENABLE_REPAINT_THROTTLING)
 #define ENABLE_REPAINT_THROTTLING 0
@@ -663,18 +647,20 @@
     #define ENABLE_JIT 1
 #endif
 
-#if PLATFORM(X86) && PLATFORM(QT)
-#if PLATFORM(WIN_OS) && COMPILER(MINGW) && GCC_VERSION >= 40100
+#if PLATFORM(QT)
+#if PLATFORM(X86) && PLATFORM(WIN_OS) && COMPILER(MINGW) && GCC_VERSION >= 40100
     #define ENABLE_JIT 1
     #define WTF_USE_JIT_STUB_ARGUMENT_VA_LIST 1
-#elif PLATFORM(WIN_OS) && COMPILER(MSVC)
+#elif PLATFORM(X86) && PLATFORM(WIN_OS) && COMPILER(MSVC)
     #define ENABLE_JIT 1
     #define WTF_USE_JIT_STUB_ARGUMENT_REGISTER 1
-#elif PLATFORM(LINUX) && GCC_VERSION >= 40100
+#elif PLATFORM(X86) && PLATFORM(LINUX) && GCC_VERSION >= 40100
     #define ENABLE_JIT 1
     #define WTF_USE_JIT_STUB_ARGUMENT_VA_LIST 1
+#elif PLATFORM(ARM) && !PLATFORM_ARM_ARCH(7) && PLATFORM(LINUX)
+    #define ENABLE_JIT 1
 #endif
-#endif /* PLATFORM(QT) && PLATFORM(X86) */
+#endif /* PLATFORM(QT) */
 
 #endif /* !defined(ENABLE_JIT) */
 
@@ -688,9 +674,6 @@
 #ifndef ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS
 #define ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS 1
 #endif
-#ifndef ENABLE_JIT_OPTIMIZE_ARITHMETIC
-#define ENABLE_JIT_OPTIMIZE_ARITHMETIC 1
-#endif
 #ifndef ENABLE_JIT_OPTIMIZE_METHOD_CALLS
 #define ENABLE_JIT_OPTIMIZE_METHOD_CALLS 1
 #endif
@@ -727,10 +710,11 @@
 #define ENABLE_YARR_JIT 1
 #endif
 
-#if PLATFORM(X86) && PLATFORM(QT)
-#if (PLATFORM(WIN_OS) && COMPILER(MINGW) && GCC_VERSION >= 40100) \
- || (PLATFORM(WIN_OS) && COMPILER(MSVC)) \
- || (PLATFORM(LINUX) && GCC_VERSION >= 40100)
+#if PLATFORM(QT)
+#if (PLATFORM(X86) && PLATFORM(WIN_OS) && COMPILER(MINGW) && GCC_VERSION >= 40100) \
+ || (PLATFORM(X86) && PLATFORM(WIN_OS) && COMPILER(MSVC)) \
+ || (PLATFORM(X86) && PLATFORM(LINUX) && GCC_VERSION >= 40100) \
+ || (PLATFORM(ARM) && !PLATFORM_ARM_ARCH(7) && PLATFORM(LINUX))
 #define ENABLE_YARR 1
 #define ENABLE_YARR_JIT 1
 #endif
@@ -748,7 +732,7 @@
 #endif
 /* Setting this flag prevents the assembler from using RWX memory; this may improve
    security but currectly comes at a significant performance cost. */
-#if PLATFORM(ARM)
+#if PLATFORM(IPHONE)
 #define ENABLE_ASSEMBLER_WX_EXCLUSIVE 1
 #else
 #define ENABLE_ASSEMBLER_WX_EXCLUSIVE 0
@@ -758,10 +742,6 @@
 #define ENABLE_PAN_SCROLLING 1
 #endif
 
-#if !defined(ENABLE_ACTIVEX_TYPE_CONVERSION_WMPLAYER)
-#define ENABLE_ACTIVEX_TYPE_CONVERSION_WMPLAYER 1
-#endif
-
 /* Use the QtXmlStreamReader implementation for XMLTokenizer */
 #if PLATFORM(QT)
 #if !ENABLE(XSLT)
@@ -784,4 +764,13 @@
 #define WTF_USE_ACCELERATED_COMPOSITING 1
 #endif
 
+#if COMPILER(GCC)
+#define WARN_UNUSED_RETURN __attribute__ ((warn_unused_result))
+#else
+#define WARN_UNUSED_RETURN
+#endif
+
+/* Set up a define for a common error that is intended to cause a build error -- thus the space after Error. */
+#define WTF_PLATFORM_CFNETWORK Error USE_macro_should_be_used_with_CFNETWORK
+
 #endif /* WTF_Platform_h */
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/PossiblyNull.h b/src/3rdparty/webkit/JavaScriptCore/wtf/PossiblyNull.h
new file mode 100644
index 0000000..79c4d82
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/PossiblyNull.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PossiblyNull_h
+#define PossiblyNull_h
+
+#include "Assertions.h"
+
+namespace WTF {
+
+template <typename T> struct PossiblyNull {
+    PossiblyNull(T data)
+        : m_data(data)
+    {
+    }
+    PossiblyNull(const PossiblyNull<T>& source)
+        : m_data(source.m_data)
+    {
+        source.m_data = 0;
+    }
+    ~PossiblyNull() { ASSERT(!m_data); }
+    bool getValue(T& out) WARN_UNUSED_RETURN;
+private:
+    mutable T m_data;
+};
+
+template <typename T> bool PossiblyNull<T>::getValue(T& out)
+{
+    out = m_data;
+    bool result = !!m_data;
+    m_data = 0;
+    return result;
+}
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/PtrAndFlags.h b/src/3rdparty/webkit/JavaScriptCore/wtf/PtrAndFlags.h
index f4527df..5d0bd2a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/PtrAndFlags.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/PtrAndFlags.h
@@ -34,10 +34,8 @@
 #include <wtf/Assertions.h>
 
 namespace WTF {
-    template<class T, typename FlagEnum> class PtrAndFlags {
+    template<class T, typename FlagEnum> class PtrAndFlagsBase {
     public:
-        PtrAndFlags() : m_ptrAndFlags(0) {}
-
         bool isFlagSet(FlagEnum flagNumber) const { ASSERT(flagNumber < 2); return m_ptrAndFlags & (1 << flagNumber); }
         void setFlag(FlagEnum flagNumber) { ASSERT(flagNumber < 2); m_ptrAndFlags |= (1 << flagNumber);}
         void clearFlag(FlagEnum flagNumber) { ASSERT(flagNumber < 2); m_ptrAndFlags &= ~(1 << flagNumber);}
@@ -51,14 +49,31 @@ namespace WTF {
 #endif
         }
 
-    private:
+        bool operator!() const { return !get(); }
+        T* operator->() const { return reinterpret_cast<T*>(m_ptrAndFlags & ~3); }
+
+    protected:
         intptr_t m_ptrAndFlags;
 #ifndef NDEBUG
         void* m_leaksPtr; // Only used to allow tools like leaks on OSX to detect that the memory is referenced.
 #endif
     };
+
+    template<class T, typename FlagEnum> class PtrAndFlags : public PtrAndFlagsBase<T, FlagEnum> {
+    public:
+        PtrAndFlags()
+        {
+            PtrAndFlagsBase<T, FlagEnum>::m_ptrAndFlags = 0;
+        }
+        PtrAndFlags(T* ptr)
+        {
+            PtrAndFlagsBase<T, FlagEnum>::m_ptrAndFlags = 0;
+            set(ptr);
+        }
+    };
 } // namespace WTF
 
+using WTF::PtrAndFlagsBase;
 using WTF::PtrAndFlags;
 
 #endif // PtrAndFlags_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtr.h
index 74cd0ea..77835ad 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtr.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtr.h
@@ -36,8 +36,8 @@ namespace WTF {
     template <typename T> class RefPtr : public FastAllocBase {
     public:
         RefPtr() : m_ptr(0) { }
-        RefPtr(T* ptr) : m_ptr(ptr) { if (ptr) ptr->ref(); }
-        RefPtr(const RefPtr& o) : m_ptr(o.m_ptr) { if (T* ptr = m_ptr) ptr->ref(); }
+        RefPtr(T* ptr) : m_ptr(ptr) { refIfNotNull(ptr); }
+        RefPtr(const RefPtr& o) : m_ptr(o.m_ptr) { T* ptr = m_ptr; refIfNotNull(ptr); }
         // see comment in PassRefPtr.h for why this takes const reference
         template <typename U> RefPtr(const PassRefPtr<U>&);
 
@@ -48,13 +48,13 @@ namespace WTF {
         RefPtr(HashTableDeletedValueType) : m_ptr(hashTableDeletedValue()) { }
         bool isHashTableDeletedValue() const { return m_ptr == hashTableDeletedValue(); }
 
-        ~RefPtr() { if (T* ptr = m_ptr) ptr->deref(); }
+        ~RefPtr() { T* ptr = m_ptr; derefIfNotNull(ptr); }
         
         template <typename U> RefPtr(const RefPtr<U>& o) : m_ptr(o.get()) { if (T* ptr = m_ptr) ptr->ref(); }
         
         T* get() const { return m_ptr; }
         
-        void clear() { if (T* ptr = m_ptr) ptr->deref(); m_ptr = 0; }
+        void clear() { T* ptr = m_ptr; derefIfNotNull(ptr); m_ptr = 0; }
         PassRefPtr<T> release() { PassRefPtr<T> tmp = adoptRef(m_ptr); m_ptr = 0; return tmp; }
 
         T& operator*() const { return *m_ptr; }
@@ -92,35 +92,29 @@ namespace WTF {
     template <typename T> inline RefPtr<T>& RefPtr<T>::operator=(const RefPtr<T>& o)
     {
         T* optr = o.get();
-        if (optr)
-            optr->ref();
+        refIfNotNull(optr);
         T* ptr = m_ptr;
         m_ptr = optr;
-        if (ptr)
-            ptr->deref();
+        derefIfNotNull(ptr);
         return *this;
     }
     
     template <typename T> template <typename U> inline RefPtr<T>& RefPtr<T>::operator=(const RefPtr<U>& o)
     {
         T* optr = o.get();
-        if (optr)
-            optr->ref();
+        refIfNotNull(optr);
         T* ptr = m_ptr;
         m_ptr = optr;
-        if (ptr)
-            ptr->deref();
+        derefIfNotNull(ptr);
         return *this;
     }
     
     template <typename T> inline RefPtr<T>& RefPtr<T>::operator=(T* optr)
     {
-        if (optr)
-            optr->ref();
+        refIfNotNull(optr);
         T* ptr = m_ptr;
         m_ptr = optr;
-        if (ptr)
-            ptr->deref();
+        derefIfNotNull(ptr);
         return *this;
     }
 
@@ -128,8 +122,7 @@ namespace WTF {
     {
         T* ptr = m_ptr;
         m_ptr = o.releaseRef();
-        if (ptr)
-            ptr->deref();
+        derefIfNotNull(ptr);
         return *this;
     }
 
@@ -137,8 +130,7 @@ namespace WTF {
     {
         T* ptr = m_ptr;
         m_ptr = o.releaseRef();
-        if (ptr)
-            ptr->deref();
+        derefIfNotNull(ptr);
         return *this;
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtrHashMap.h b/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtrHashMap.h
index b3ccd3a..9433025 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtrHashMap.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtrHashMap.h
@@ -42,7 +42,7 @@ namespace WTF {
     };
 
     template<typename T, typename MappedArg, typename HashArg, typename KeyTraitsArg, typename MappedTraitsArg>
-    class RefPtrHashMap {
+    class HashMap<RefPtr<T>, MappedArg, HashArg, KeyTraitsArg, MappedTraitsArg> : public FastAllocBase {
     private:
         typedef KeyTraitsArg KeyTraits;
         typedef MappedTraitsArg MappedTraits;
@@ -67,7 +67,7 @@ namespace WTF {
         typedef HashTableIteratorAdapter<HashTableType, ValueType> iterator;
         typedef HashTableConstIteratorAdapter<HashTableType, ValueType> const_iterator;
 
-        void swap(RefPtrHashMap&);
+        void swap(HashMap&);
 
         int size() const;
         int capacity() const;
@@ -115,123 +115,109 @@ namespace WTF {
 
         HashTableType m_impl;
     };
-    template<typename T, typename MappedArg, typename HashArg, typename KeyTraitsArg, typename MappedTraitsArg>
-    class HashMap<RefPtr<T>, MappedArg, HashArg, KeyTraitsArg, MappedTraitsArg> :
-        public RefPtrHashMap<T, MappedArg, HashArg, KeyTraitsArg, MappedTraitsArg>
-    {
-    };
     
     template<typename T, typename U, typename V, typename W, typename X>
-    inline void RefPtrHashMap<T, U, V, W, X>::swap(RefPtrHashMap& other)
+    inline void HashMap<RefPtr<T>, U, V, W, X>::swap(HashMap& other)
     {
         m_impl.swap(other.m_impl); 
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
-    inline int RefPtrHashMap<T, U, V, W, X>::size() const
+    inline int HashMap<RefPtr<T>, U, V, W, X>::size() const
     {
         return m_impl.size(); 
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
-    inline int RefPtrHashMap<T, U, V, W, X>::capacity() const
+    inline int HashMap<RefPtr<T>, U, V, W, X>::capacity() const
     { 
         return m_impl.capacity(); 
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
-    inline bool RefPtrHashMap<T, U, V, W, X>::isEmpty() const
+    inline bool HashMap<RefPtr<T>, U, V, W, X>::isEmpty() const
     {
         return m_impl.isEmpty();
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
-    inline typename RefPtrHashMap<T, U, V, W, X>::iterator RefPtrHashMap<T, U, V, W, X>::begin()
+    inline typename HashMap<RefPtr<T>, U, V, W, X>::iterator HashMap<RefPtr<T>, U, V, W, X>::begin()
     {
         return m_impl.begin();
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
-    inline typename RefPtrHashMap<T, U, V, W, X>::iterator RefPtrHashMap<T, U, V, W, X>::end()
+    inline typename HashMap<RefPtr<T>, U, V, W, X>::iterator HashMap<RefPtr<T>, U, V, W, X>::end()
     {
         return m_impl.end();
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
-    inline typename RefPtrHashMap<T, U, V, W, X>::const_iterator RefPtrHashMap<T, U, V, W, X>::begin() const
+    inline typename HashMap<RefPtr<T>, U, V, W, X>::const_iterator HashMap<RefPtr<T>, U, V, W, X>::begin() const
     {
         return m_impl.begin();
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
-    inline typename RefPtrHashMap<T, U, V, W, X>::const_iterator RefPtrHashMap<T, U, V, W, X>::end() const
+    inline typename HashMap<RefPtr<T>, U, V, W, X>::const_iterator HashMap<RefPtr<T>, U, V, W, X>::end() const
     {
         return m_impl.end();
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
-    inline typename RefPtrHashMap<T, U, V, W, X>::iterator RefPtrHashMap<T, U, V, W, X>::find(const KeyType& key)
+    inline typename HashMap<RefPtr<T>, U, V, W, X>::iterator HashMap<RefPtr<T>, U, V, W, X>::find(const KeyType& key)
     {
         return m_impl.find(key);
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
-    inline typename RefPtrHashMap<T, U, V, W, X>::iterator RefPtrHashMap<T, U, V, W, X>::find(RawKeyType key)
+    inline typename HashMap<RefPtr<T>, U, V, W, X>::iterator HashMap<RefPtr<T>, U, V, W, X>::find(RawKeyType key)
     {
         return m_impl.template find<RawKeyType, RawKeyTranslator>(key);
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
-    inline typename RefPtrHashMap<T, U, V, W, X>::const_iterator RefPtrHashMap<T, U, V, W, X>::find(const KeyType& key) const
+    inline typename HashMap<RefPtr<T>, U, V, W, X>::const_iterator HashMap<RefPtr<T>, U, V, W, X>::find(const KeyType& key) const
     {
         return m_impl.find(key);
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
-    inline typename RefPtrHashMap<T, U, V, W, X>::const_iterator RefPtrHashMap<T, U, V, W, X>::find(RawKeyType key) const
+    inline typename HashMap<RefPtr<T>, U, V, W, X>::const_iterator HashMap<RefPtr<T>, U, V, W, X>::find(RawKeyType key) const
     {
         return m_impl.template find<RawKeyType, RawKeyTranslator>(key);
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
-    inline bool RefPtrHashMap<T, U, V, W, X>::contains(const KeyType& key) const
+    inline bool HashMap<RefPtr<T>, U, V, W, X>::contains(const KeyType& key) const
     {
         return m_impl.contains(key);
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
-    inline bool RefPtrHashMap<T, U, V, W, X>::contains(RawKeyType key) const
+    inline bool HashMap<RefPtr<T>, U, V, W, X>::contains(RawKeyType key) const
     {
         return m_impl.template contains<RawKeyType, RawKeyTranslator>(key);
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
-    inline pair<typename RefPtrHashMap<T, U, V, W, X>::iterator, bool>
-    RefPtrHashMap<T, U, V, W, X>::inlineAdd(const KeyType& key, const MappedType& mapped) 
+    inline pair<typename HashMap<RefPtr<T>, U, V, W, X>::iterator, bool>
+    HashMap<RefPtr<T>, U, V, W, X>::inlineAdd(const KeyType& key, const MappedType& mapped) 
     {
         typedef HashMapTranslator<ValueType, ValueTraits, HashFunctions> TranslatorType;
-        pair<typename HashTableType::iterator, bool> p = m_impl.template add<KeyType, MappedType, TranslatorType>(key, mapped);
-//        typename RefPtrHashMap<T, U, V, W, X>::iterator temp = p.first;
-        return make_pair<typename RefPtrHashMap<T, U, V, W, X>::iterator, bool>(
-            typename RefPtrHashMap<T, U, V, W, X>::iterator(p.first), p.second);
-
-//        return m_impl.template add<KeyType, MappedType, TranslatorType>(key, mapped);
+        return m_impl.template add<KeyType, MappedType, TranslatorType>(key, mapped);
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
-    inline pair<typename RefPtrHashMap<T, U, V, W, X>::iterator, bool>
-    RefPtrHashMap<T, U, V, W, X>::inlineAdd(RawKeyType key, const MappedType& mapped) 
+    inline pair<typename HashMap<RefPtr<T>, U, V, W, X>::iterator, bool>
+    HashMap<RefPtr<T>, U, V, W, X>::inlineAdd(RawKeyType key, const MappedType& mapped) 
     {
-        pair<typename HashTableType::iterator, bool> p = m_impl.template add<RawKeyType, MappedType, RawKeyTranslator>(key, mapped);
-        return make_pair<typename RefPtrHashMap<T, U, V, W, X>::iterator, bool>(
-            typename RefPtrHashMap<T, U, V, W, X>::iterator(p.first), p.second);
-
- //       return m_impl.template add<RawKeyType, MappedType, RawKeyTranslator>(key, mapped);
+        return m_impl.template add<RawKeyType, MappedType, RawKeyTranslator>(key, mapped);
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
-    pair<typename RefPtrHashMap<T, U, V, W, X>::iterator, bool>
-    RefPtrHashMap<T, U, V, W, X>::set(const KeyType& key, const MappedType& mapped) 
+    pair<typename HashMap<RefPtr<T>, U, V, W, X>::iterator, bool>
+    HashMap<RefPtr<T>, U, V, W, X>::set(const KeyType& key, const MappedType& mapped) 
     {
         pair<iterator, bool> result = inlineAdd(key, mapped);
         if (!result.second) {
@@ -242,8 +228,8 @@ namespace WTF {
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
-    pair<typename RefPtrHashMap<T, U, V, W, X>::iterator, bool>
-    RefPtrHashMap<T, U, V, W, X>::set(RawKeyType key, const MappedType& mapped) 
+    pair<typename HashMap<RefPtr<T>, U, V, W, X>::iterator, bool>
+    HashMap<RefPtr<T>, U, V, W, X>::set(RawKeyType key, const MappedType& mapped) 
     {
         pair<iterator, bool> result = inlineAdd(key, mapped);
         if (!result.second) {
@@ -254,22 +240,22 @@ namespace WTF {
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
-    pair<typename RefPtrHashMap<T, U, V, W, X>::iterator, bool>
-    RefPtrHashMap<T, U, V, W, X>::add(const KeyType& key, const MappedType& mapped)
+    pair<typename HashMap<RefPtr<T>, U, V, W, X>::iterator, bool>
+    HashMap<RefPtr<T>, U, V, W, X>::add(const KeyType& key, const MappedType& mapped)
     {
         return inlineAdd(key, mapped);
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
-    pair<typename RefPtrHashMap<T, U, V, W, X>::iterator, bool>
-    RefPtrHashMap<T, U, V, W, X>::add(RawKeyType key, const MappedType& mapped)
+    pair<typename HashMap<RefPtr<T>, U, V, W, X>::iterator, bool>
+    HashMap<RefPtr<T>, U, V, W, X>::add(RawKeyType key, const MappedType& mapped)
     {
         return inlineAdd(key, mapped);
     }
 
     template<typename T, typename U, typename V, typename W, typename MappedTraits>
-    typename RefPtrHashMap<T, U, V, W, MappedTraits>::MappedType
-    RefPtrHashMap<T, U, V, W, MappedTraits>::get(const KeyType& key) const
+    typename HashMap<RefPtr<T>, U, V, W, MappedTraits>::MappedType
+    HashMap<RefPtr<T>, U, V, W, MappedTraits>::get(const KeyType& key) const
     {
         ValueType* entry = const_cast<HashTableType&>(m_impl).lookup(key);
         if (!entry)
@@ -278,8 +264,8 @@ namespace WTF {
     }
 
     template<typename T, typename U, typename V, typename W, typename MappedTraits>
-    typename RefPtrHashMap<T, U, V, W, MappedTraits>::MappedType
-    inline RefPtrHashMap<T, U, V, W, MappedTraits>::inlineGet(RawKeyType key) const
+    typename HashMap<RefPtr<T>, U, V, W, MappedTraits>::MappedType
+    inline HashMap<RefPtr<T>, U, V, W, MappedTraits>::inlineGet(RawKeyType key) const
     {
         ValueType* entry = const_cast<HashTableType&>(m_impl).template lookup<RawKeyType, RawKeyTranslator>(key);
         if (!entry)
@@ -288,14 +274,14 @@ namespace WTF {
     }
 
     template<typename T, typename U, typename V, typename W, typename MappedTraits>
-    typename RefPtrHashMap<T, U, V, W, MappedTraits>::MappedType
-    RefPtrHashMap<T, U, V, W, MappedTraits>::get(RawKeyType key) const
+    typename HashMap<RefPtr<T>, U, V, W, MappedTraits>::MappedType
+    HashMap<RefPtr<T>, U, V, W, MappedTraits>::get(RawKeyType key) const
     {
         return inlineGet(key);
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
-    inline void RefPtrHashMap<T, U, V, W, X>::remove(iterator it)
+    inline void HashMap<RefPtr<T>, U, V, W, X>::remove(iterator it)
     {
         if (it.m_impl == m_impl.end())
             return;
@@ -304,45 +290,45 @@ namespace WTF {
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
-    inline void RefPtrHashMap<T, U, V, W, X>::remove(const KeyType& key)
+    inline void HashMap<RefPtr<T>, U, V, W, X>::remove(const KeyType& key)
     {
         remove(find(key));
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
-    inline void RefPtrHashMap<T, U, V, W, X>::remove(RawKeyType key)
+    inline void HashMap<RefPtr<T>, U, V, W, X>::remove(RawKeyType key)
     {
         remove(find(key));
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
-    inline void RefPtrHashMap<T, U, V, W, X>::clear()
+    inline void HashMap<RefPtr<T>, U, V, W, X>::clear()
     {
         m_impl.clear();
     }
 
     template<typename T, typename U, typename V, typename W, typename MappedTraits>
-    typename RefPtrHashMap<T, U, V, W, MappedTraits>::MappedType
-    RefPtrHashMap<T, U, V, W, MappedTraits>::take(const KeyType& key)
+    typename HashMap<RefPtr<T>, U, V, W, MappedTraits>::MappedType
+    HashMap<RefPtr<T>, U, V, W, MappedTraits>::take(const KeyType& key)
     {
         // This can probably be made more efficient to avoid ref/deref churn.
         iterator it = find(key);
         if (it == end())
             return MappedTraits::emptyValue();
-        typename RefPtrHashMap<T, U, V, W, MappedTraits>::MappedType result = it->second;
+        typename HashMap<RefPtr<T>, U, V, W, MappedTraits>::MappedType result = it->second;
         remove(it);
         return result;
     }
 
     template<typename T, typename U, typename V, typename W, typename MappedTraits>
-    typename RefPtrHashMap<T, U, V, W, MappedTraits>::MappedType
-    RefPtrHashMap<T, U, V, W, MappedTraits>::take(RawKeyType key)
+    typename HashMap<RefPtr<T>, U, V, W, MappedTraits>::MappedType
+    HashMap<RefPtr<T>, U, V, W, MappedTraits>::take(RawKeyType key)
     {
         // This can probably be made more efficient to avoid ref/deref churn.
         iterator it = find(key);
         if (it == end())
             return MappedTraits::emptyValue();
-        typename RefPtrHashMap<T, U, V, W, MappedTraits>::MappedType result = it->second;
+        typename HashMap<RefPtr<T>, U, V, W, MappedTraits>::MappedType result = it->second;
         remove(it);
         return result;
     }
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/SegmentedVector.h b/src/3rdparty/webkit/JavaScriptCore/wtf/SegmentedVector.h
index 065c19c..b1cbc4d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/SegmentedVector.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/SegmentedVector.h
@@ -116,6 +116,7 @@ namespace WTF {
         }
 
         size_t size() const { return m_size; }
+        bool isEmpty() const { return !size(); }
 
         T& at(size_t index)
         {
@@ -249,4 +250,6 @@ namespace WTF {
 
 } // namespace WTF
 
+using WTF::SegmentedVector;
+
 #endif // SegmentedVector_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/StdLibExtras.h b/src/3rdparty/webkit/JavaScriptCore/wtf/StdLibExtras.h
index afc5e8a..d21d1ff 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/StdLibExtras.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/StdLibExtras.h
@@ -41,6 +41,11 @@
     static type& name = *new type arguments
 #endif
 
+// OBJECT_OFFSETOF: Like the C++ offsetof macro, but you can use it with classes.
+// The magic number 0x4000 is insignificant. We use it to avoid using NULL, since
+// NULL can cause compiler problems, especially in cases of multiple inheritance.
+#define OBJECT_OFFSETOF(class, field) (reinterpret_cast<ptrdiff_t>(&(reinterpret_cast<class*>(0x4000)->field)) - 0x4000)
+
 namespace WTF {
 
     /*
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h b/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h
index 1c23390..559e3f2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h
@@ -85,4 +85,20 @@ inline int strcasecmp(const char* s1, const char* s2)
 
 #endif
 
+#if PLATFORM(WIN_OS) || PLATFORM(LINUX)
+
+inline char* strnstr(const char* buffer, const char* target, size_t bufferLength)
+{
+    size_t targetLength = strlen(target);
+    if (targetLength == 0)
+        return const_cast<char*>(buffer);
+    for (const char* start = buffer; *start && start + targetLength <= buffer + bufferLength; start++) {
+        if (*start == *target && strncmp(start + 1, target + 1, targetLength - 1) == 0)
+            return const_cast<char*>(start);
+    }
+    return 0;
+}
+
+#endif
+
 #endif // WTF_StringExtras_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.cpp
index 478ce63..659bb0e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.cpp
@@ -31,6 +31,14 @@
 // Author: Sanjay Ghemawat
 
 #include "config.h"
+#include "TCSystemAlloc.h"
+
+#include <algorithm>
+#include <fcntl.h>
+#include "Assertions.h"
+#include "TCSpinLock.h"
+#include "UnusedParam.h"
+
 #if HAVE(STDINT_H)
 #include <stdint.h>
 #elif HAVE(INTTYPES_H)
@@ -38,6 +46,7 @@
 #else
 #include <sys/types.h>
 #endif
+
 #if PLATFORM(WIN_OS)
 #include "windows.h"
 #else
@@ -45,16 +54,13 @@
 #include <unistd.h>
 #include <sys/mman.h>
 #endif
-#include <fcntl.h>
-#include "Assertions.h"
-#include "TCSystemAlloc.h"
-#include "TCSpinLock.h"
-#include "UnusedParam.h"
 
 #ifndef MAP_ANONYMOUS
 #define MAP_ANONYMOUS MAP_ANON
 #endif
 
+using namespace std;
+
 // Structure for discovering alignment
 union MemoryAligner {
   void*  p;
@@ -441,6 +447,32 @@ void TCMalloc_SystemRelease(void* start, size_t length)
   ASSERT_UNUSED(newAddress, newAddress == start || newAddress == reinterpret_cast<void*>(MAP_FAILED));
 }
 
+#elif HAVE(VIRTUALALLOC)
+
+void TCMalloc_SystemRelease(void* start, size_t length)
+{
+    if (VirtualFree(start, length, MEM_DECOMMIT))
+        return;
+
+    // The decommit may fail if the memory region consists of allocations
+    // from more than one call to VirtualAlloc.  In this case, fall back to
+    // using VirtualQuery to retrieve the allocation boundaries and decommit
+    // them each individually.
+
+    char* ptr = static_cast<char*>(start);
+    char* end = ptr + length;
+    MEMORY_BASIC_INFORMATION info;
+    while (ptr < end) {
+        size_t resultSize = VirtualQuery(ptr, &info, sizeof(info));
+        ASSERT_UNUSED(resultSize, resultSize == sizeof(info));
+
+        size_t decommitSize = min<size_t>(info.RegionSize, end - ptr);
+        BOOL success = VirtualFree(ptr, decommitSize, MEM_DECOMMIT);
+        ASSERT_UNUSED(success, success);
+        ptr += decommitSize;
+    }
+}
+
 #else
 
 // Platforms that don't support returning memory use an empty inline version of TCMalloc_SystemRelease
@@ -457,8 +489,28 @@ void TCMalloc_SystemCommit(void* start, size_t length)
 
 #elif HAVE(VIRTUALALLOC)
 
-void TCMalloc_SystemCommit(void*, size_t)
+void TCMalloc_SystemCommit(void* start, size_t length)
 {
+    if (VirtualAlloc(start, length, MEM_COMMIT, PAGE_READWRITE) == start)
+        return;
+
+    // The commit may fail if the memory region consists of allocations
+    // from more than one call to VirtualAlloc.  In this case, fall back to
+    // using VirtualQuery to retrieve the allocation boundaries and commit them
+    // each individually.
+
+    char* ptr = static_cast<char*>(start);
+    char* end = ptr + length;
+    MEMORY_BASIC_INFORMATION info;
+    while (ptr < end) {
+        size_t resultSize = VirtualQuery(ptr, &info, sizeof(info));
+        ASSERT_UNUSED(resultSize, resultSize == sizeof(info));
+
+        size_t commitSize = min<size_t>(info.RegionSize, end - ptr);
+        void* newAddress = VirtualAlloc(ptr, commitSize, MEM_COMMIT, PAGE_READWRITE);
+        ASSERT_UNUSED(newAddress, newAddress == ptr);
+        ptr += commitSize;
+    }
 }
 
 #else
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.h b/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.h
index 8e3a01a..1c67788 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.h
@@ -64,7 +64,7 @@ extern void TCMalloc_SystemRelease(void* start, size_t length);
 
 extern void TCMalloc_SystemCommit(void* start, size_t length);
 
-#if !HAVE(MADV_FREE_REUSE) && !HAVE(MADV_DONTNEED) && !HAVE(MMAP)
+#if !HAVE(MADV_FREE_REUSE) && !HAVE(MADV_DONTNEED) && !HAVE(MMAP) && !HAVE(VIRTUALALLOC)
 inline void TCMalloc_SystemRelease(void*, size_t) { }
 #endif
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecific.h b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecific.h
index 4d5d2f7..b6f5fd3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecific.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecific.h
@@ -79,10 +79,13 @@ private:
 #if USE(PTHREADS) || PLATFORM(QT) || PLATFORM(WIN_OS)
     struct Data : Noncopyable {
         Data(T* value, ThreadSpecific<T>* owner) : value(value), owner(owner) {}
+#if PLATFORM(QT)
+        ~Data() { owner->destroy(this); }
+#endif
 
         T* value;
         ThreadSpecific<T>* owner;
-#if !USE(PTHREADS)
+#if !USE(PTHREADS) && !PLATFORM(QT)
         void (*destructor)(void*);
 #endif
     };
@@ -136,9 +139,7 @@ inline ThreadSpecific<T>::ThreadSpecific()
 template<typename T>
 inline ThreadSpecific<T>::~ThreadSpecific()
 {
-    Data* data = static_cast<Data*>(m_key.localData());
-    if (data)
-        data->destructor(data);
+    // Does not invoke destructor functions. QThreadStorage will do it
 }
 
 template<typename T>
@@ -153,7 +154,6 @@ inline void ThreadSpecific<T>::set(T* ptr)
 {
     ASSERT(!get());
     Data* data = new Data(ptr, this);
-    data->destructor = &ThreadSpecific<T>::destroy;
     m_key.setLocalData(data);
 }
 
@@ -218,21 +218,27 @@ inline void ThreadSpecific<T>::destroy(void* ptr)
     // Some pthreads implementations zero out the pointer before calling destroy(), so we temporarily reset it.
     pthread_setspecific(data->owner->m_key, ptr);
 #endif
-    
+#if PLATFORM(QT)
+    // See comment as above
+    data->owner->m_key.setLocalData(data);
+#endif
+
     data->value->~T();
     fastFree(data->value);
 
 #if USE(PTHREADS)
     pthread_setspecific(data->owner->m_key, 0);
 #elif PLATFORM(QT)
-    data->owner->m_key.setLocalData(0);
+    // Do nothing here
 #elif PLATFORM(WIN_OS)
     TlsSetValue(tlsKeys()[data->owner->m_index], 0);
 #else
 #error ThreadSpecific is not implemented for this platform.
 #endif
 
+#if !PLATFORM(QT)
     delete data;
+#endif
 }
 
 template<typename T>
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.h
index 6578151..5154545 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.h
@@ -59,6 +59,8 @@
 #ifndef Threading_h
 #define Threading_h
 
+#include "Platform.h"
+
 #if PLATFORM(WINCE)
 #include <windows.h>
 #endif
@@ -213,23 +215,23 @@ private:
 #define WTF_USE_LOCKFREE_THREADSAFESHARED 1
 
 #if COMPILER(MINGW) || COMPILER(MSVC7) || PLATFORM(WINCE)
-inline void atomicIncrement(int* addend) { InterlockedIncrement(reinterpret_cast<long*>(addend)); }
+inline int atomicIncrement(int* addend) { return InterlockedIncrement(reinterpret_cast<long*>(addend)); }
 inline int atomicDecrement(int* addend) { return InterlockedDecrement(reinterpret_cast<long*>(addend)); }
 #else
-inline void atomicIncrement(int volatile* addend) { InterlockedIncrement(reinterpret_cast<long volatile*>(addend)); }
+inline int atomicIncrement(int volatile* addend) { return InterlockedIncrement(reinterpret_cast<long volatile*>(addend)); }
 inline int atomicDecrement(int volatile* addend) { return InterlockedDecrement(reinterpret_cast<long volatile*>(addend)); }
 #endif
 
 #elif PLATFORM(DARWIN)
 #define WTF_USE_LOCKFREE_THREADSAFESHARED 1
 
-inline void atomicIncrement(int volatile* addend) { OSAtomicIncrement32Barrier(const_cast<int*>(addend)); }
+inline int atomicIncrement(int volatile* addend) { return OSAtomicIncrement32Barrier(const_cast<int*>(addend)); }
 inline int atomicDecrement(int volatile* addend) { return OSAtomicDecrement32Barrier(const_cast<int*>(addend)); }
 
-#elif COMPILER(GCC)
+#elif COMPILER(GCC) && !PLATFORM(SPARC64) // sizeof(_Atomic_word) != sizeof(int) on sparc64 gcc
 #define WTF_USE_LOCKFREE_THREADSAFESHARED 1
 
-inline void atomicIncrement(int volatile* addend) { __gnu_cxx::__atomic_add(addend, 1); }
+inline int atomicIncrement(int volatile* addend) { return __gnu_cxx::__exchange_and_add(addend, 1) + 1; }
 inline int atomicDecrement(int volatile* addend) { return __gnu_cxx::__exchange_and_add(addend, -1) - 1; }
 
 #endif
@@ -323,6 +325,11 @@ using WTF::ThreadCondition;
 using WTF::ThreadIdentifier;
 using WTF::ThreadSafeShared;
 
+#if USE(LOCKFREE_THREADSAFESHARED)
+using WTF::atomicDecrement;
+using WTF::atomicIncrement;
+#endif
+
 using WTF::createThread;
 using WTF::currentThread;
 using WTF::isMainThread;
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp
index d0e6df8..c241bd9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp
@@ -39,8 +39,11 @@
 #include "StdLibExtras.h"
 #include "UnusedParam.h"
 #include <errno.h>
+
+#if !COMPILER(MSVC)
 #include <limits.h>
 #include <sys/time.h>
+#endif
 
 #if PLATFORM(ANDROID)
 #include "jni_utility.h"
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.h b/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.h
index 56659a8..6ce6a3e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.h
@@ -70,30 +70,30 @@ namespace WTF {
     template <> struct IsPod<long double>        { static const bool value = true; };
     template <typename P> struct IsPod<P*>       { static const bool value = true; };
 
-    // Avoid "possible loss of data" warning when using Microsoft's C++ compiler
-    // by not converting int's to doubles.
-    template<bool performCheck, typename U> class CheckedIsConvertibleToDouble;
-    template<typename U> class CheckedIsConvertibleToDouble<false, U> {
-    public:
-        static const bool value = false;
-    };
-
-    template<typename U> class CheckedIsConvertibleToDouble<true, U> {
-        typedef char YesType;
-        struct NoType {
-            char padding[8];
+    template<typename T> class IsConvertibleToInteger {
+        // Avoid "possible loss of data" warning when using Microsoft's C++ compiler
+        // by not converting int's to doubles.
+        template<bool performCheck, typename U> class IsConvertibleToDouble;
+        template<typename U> class IsConvertibleToDouble<false, U> {
+        public:
+            static const bool value = false;
         };
 
-        static YesType floatCheck(long double);
-        static NoType floatCheck(...);
-        static U& t;
-    public:
-        static const bool value = sizeof(floatCheck(t)) == sizeof(YesType);
-    };
+        template<typename U> class IsConvertibleToDouble<true, U> {
+            typedef char YesType;
+            struct NoType {
+                char padding[8];
+            };
+
+            static YesType floatCheck(long double);
+            static NoType floatCheck(...);
+            static T& t;
+        public:
+            static const bool value = sizeof(floatCheck(t)) == sizeof(YesType);
+        };
 
-    template<typename T> class IsConvertibleToInteger {
     public:
-        static const bool value = IsInteger<T>::value || CheckedIsConvertibleToDouble<!IsInteger<T>::value, T>::value;
+        static const bool value = IsInteger<T>::value || IsConvertibleToDouble<!IsInteger<T>::value, T>::value;
     };
 
     template <typename T, typename U> struct IsSameType {
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
index 7decc4a..7cba4e4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
@@ -45,7 +45,7 @@ namespace WTF {
         #define WTF_ALIGN_OF(type) __alignof(type)
         #define WTF_ALIGNED(variable_type, variable, n) __declspec(align(n)) variable_type variable
     #else
-        #define WTF_ALIGN_OF(type)   0
+        #error WTF_ALIGN macros need alignment control.
     #endif
 
     #if COMPILER(GCC) && (((__GNUC__ * 100) + __GNUC_MINOR__) >= 303)
@@ -54,7 +54,6 @@ namespace WTF {
         typedef char AlignedBufferChar; 
     #endif
 
-    #ifdef WTF_ALIGNED
     template <size_t size, size_t alignment> struct AlignedBuffer;
     template <size_t size> struct AlignedBuffer<size, 1> { AlignedBufferChar buffer[size]; };
     template <size_t size> struct AlignedBuffer<size, 2> { WTF_ALIGNED(AlignedBufferChar, buffer[size], 2);  };
@@ -63,18 +62,6 @@ namespace WTF {
     template <size_t size> struct AlignedBuffer<size, 16> { WTF_ALIGNED(AlignedBufferChar, buffer[size], 16); };
     template <size_t size> struct AlignedBuffer<size, 32> { WTF_ALIGNED(AlignedBufferChar, buffer[size], 32); };
     template <size_t size> struct AlignedBuffer<size, 64> { WTF_ALIGNED(AlignedBufferChar, buffer[size], 64); };
-    #else
-    template <size_t size, size_t> struct AlignedBuffer
-    {
-        AlignedBufferChar oversizebuffer[size + 64];
-        AlignedBufferChar *buffer()
-        {
-            AlignedBufferChar *ptr = oversizebuffer;
-            ptr += 64 - (reinterpret_cast<size_t>(ptr) & 0x3f);
-            return ptr;
-        }
-    };
-    #endif
 
     template <bool needsDestruction, typename T>
     class VectorDestructor;
@@ -129,7 +116,7 @@ namespace WTF {
     template<typename T>
     struct VectorMover<false, T>
     {
-        static void move(T* src, const T* srcEnd, T* dst)
+        static void move(const T* src, const T* srcEnd, T* dst)
         {
             while (src != srcEnd) {
                 new (dst) T(*src);
@@ -138,7 +125,7 @@ namespace WTF {
                 ++src;
             }
         }
-        static void moveOverlapping(T* src, const T* srcEnd, T* dst)
+        static void moveOverlapping(const T* src, const T* srcEnd, T* dst)
         {
             if (src > dst)
                 move(src, srcEnd, dst);
@@ -157,11 +144,11 @@ namespace WTF {
     template<typename T>
     struct VectorMover<true, T>
     {
-        static void move(T* src, const T* srcEnd, T* dst) 
+        static void move(const T* src, const T* srcEnd, T* dst) 
         {
             memcpy(dst, src, reinterpret_cast<const char*>(srcEnd) - reinterpret_cast<const char*>(src));
         }
-        static void moveOverlapping(T* src, const T* srcEnd, T* dst) 
+        static void moveOverlapping(const T* src, const T* srcEnd, T* dst) 
         {
             memmove(dst, src, reinterpret_cast<const char*>(srcEnd) - reinterpret_cast<const char*>(src));
         }
@@ -254,12 +241,12 @@ namespace WTF {
             VectorInitializer<VectorTraits<T>::needsInitialization, VectorTraits<T>::canInitializeWithMemset, T>::initialize(begin, end);
         }
 
-        static void move(T* src, const T* srcEnd, T* dst)
+        static void move(const T* src, const T* srcEnd, T* dst)
         {
             VectorMover<VectorTraits<T>::canMoveWithMemcpy, T>::move(src, srcEnd, dst);
         }
 
-        static void moveOverlapping(T* src, const T* srcEnd, T* dst)
+        static void moveOverlapping(const T* src, const T* srcEnd, T* dst)
         {
             VectorMover<VectorTraits<T>::canMoveWithMemcpy, T>::moveOverlapping(src, srcEnd, dst);
         }
@@ -441,11 +428,7 @@ namespace WTF {
         using Base::m_capacity;
 
         static const size_t m_inlineBufferSize = inlineCapacity * sizeof(T);
-        #ifdef WTF_ALIGNED
         T* inlineBuffer() { return reinterpret_cast<T*>(m_inlineBuffer.buffer); }
-        #else
-        T* inlineBuffer() { return reinterpret_cast<T*>(m_inlineBuffer.buffer()); }
-        #endif
 
         AlignedBuffer<m_inlineBufferSize, WTF_ALIGN_OF(T)> m_inlineBuffer;
     };
@@ -585,7 +568,6 @@ namespace WTF {
     };
 
 #if PLATFORM(QT)
-    QT_USE_NAMESPACE
     template<typename T>
     QDataStream& operator<<(QDataStream& stream, const Vector<T>& data)
     {
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/VectorTraits.h b/src/3rdparty/webkit/JavaScriptCore/wtf/VectorTraits.h
index 7974b9a..eb4c279 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/VectorTraits.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/VectorTraits.h
@@ -21,6 +21,7 @@
 #ifndef WTF_VectorTraits_h
 #define WTF_VectorTraits_h
 
+#include "OwnPtr.h"
 #include "RefPtr.h"
 #include "TypeTraits.h"
 #include <utility>
@@ -71,11 +72,14 @@ namespace WTF {
         static const bool canCompareWithMemcmp = true;
     };
 
-    // we know RefPtr is simple enough that initializing to 0 and moving with memcpy
+    // we know OwnPtr and RefPtr are simple enough that initializing to 0 and moving with memcpy
     // (and then not destructing the original) will totally work
     template<typename P>
     struct VectorTraits<RefPtr<P> > : SimpleClassVectorTraits { };
-    
+
+    template<typename P>
+    struct VectorTraits<OwnPtr<P> > : SimpleClassVectorTraits { };
+
     template<typename P>
     struct VectorTraits<std::auto_ptr<P> > : SimpleClassVectorTraits { };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/qt/MainThreadQt.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/qt/MainThreadQt.cpp
index 0ac2717..7b2d0f2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/qt/MainThreadQt.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/qt/MainThreadQt.cpp
@@ -37,8 +37,6 @@
 
 namespace WTF {
 
-QT_USE_NAMESPACE
-
 class MainThreadInvoker : public QObject {
     Q_OBJECT
 public:
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/qt/ThreadingQt.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/qt/ThreadingQt.cpp
index 5a84764..1fdd2bb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/qt/ThreadingQt.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/qt/ThreadingQt.cpp
@@ -41,8 +41,6 @@
 
 namespace WTF {
 
-QT_USE_NAMESPACE
-
 class ThreadPrivate : public QThread {
 public:
     ThreadPrivate(ThreadFunction entryPoint, void* data);
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Unicode.h b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Unicode.h
index f86a9b7..d59439d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Unicode.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Unicode.h
@@ -1,6 +1,7 @@
 /*
  *  Copyright (C) 2006 George Staikos <staikos@kde.org>
  *  Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007-2009 Torch Mobile, Inc.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -30,6 +31,8 @@
 #include <wtf/unicode/icu/UnicodeIcu.h>
 #elif USE(GLIB_UNICODE)
 #include <wtf/unicode/glib/UnicodeGLib.h>
+#elif USE(WINCE_UNICODE)
+#include <wtf/unicode/wince/UnicodeWince.h>
 #else
 #error "Unknown Unicode implementation"
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
index 65b3e79..bdf2028 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
@@ -58,7 +58,7 @@ QT_END_NAMESPACE
 #endif
 
 // ugly hack to make UChar compatible with JSChar in API/JSStringRef.h
-#if defined(Q_OS_WIN)
+#if defined(Q_OS_WIN) || COMPILER(WINSCW)
 typedef wchar_t UChar;
 #else
 typedef uint16_t UChar;
@@ -108,8 +108,6 @@ typedef uint32_t UChar32;
 namespace WTF {
 namespace Unicode {
 
-QT_USE_NAMESPACE
-
 enum Direction {
     LeftToRight = QChar::DirL,
     RightToLeft = QChar::DirR,
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/wince/UnicodeWince.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/wince/UnicodeWince.cpp
new file mode 100644
index 0000000..966f2a1
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/wince/UnicodeWince.cpp
@@ -0,0 +1,175 @@
+/*
+ *  Copyright (C) 2006 George Staikos <staikos@kde.org>
+ *  Copyright (C) 2006 Alexey Proskuryakov <ap@nypop.com>
+ *  Copyright (C) 2007-2009 Torch Mobile, Inc.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "UnicodeWince.h"
+
+#include <wchar.h>
+
+namespace WTF {
+namespace Unicode {
+
+wchar_t toLower(wchar_t c)
+{
+    return towlower(c);
+}
+
+wchar_t toUpper(wchar_t c)
+{
+    return towupper(c);
+}
+
+wchar_t foldCase(wchar_t c)
+{
+    return towlower(c);
+}
+
+bool isPrintableChar(wchar_t c)
+{
+    return !!iswprint(c);
+}
+
+bool isSpace(wchar_t c)
+{
+    return !!iswspace(c);
+}
+
+bool isLetter(wchar_t c)
+{
+    return !!iswalpha(c);
+}
+
+bool isUpper(wchar_t c)
+{
+    return !!iswupper(c);
+}
+
+bool isLower(wchar_t c)
+{
+    return !!iswlower(c);
+}
+
+bool isDigit(wchar_t c)
+{
+    return !!iswdigit(c);
+}
+
+bool isPunct(wchar_t c)
+{
+    return !!iswpunct(c);
+}
+
+int toLower(wchar_t* result, int resultLength, const wchar_t* source, int sourceLength, bool* isError)
+{
+    const UChar* sourceIterator = source;
+    const UChar* sourceEnd = source + sourceLength;
+    UChar* resultIterator = result;
+    UChar* resultEnd = result + resultLength;
+
+    int remainingCharacters = 0;
+    if (sourceLength <= resultLength)
+        while (sourceIterator < sourceEnd)
+            *resultIterator++ = towlower(*sourceIterator++);
+    else
+        while (resultIterator < resultEnd)
+            *resultIterator++ = towlower(*sourceIterator++);
+
+    if (sourceIterator < sourceEnd)
+        remainingCharacters += sourceEnd - sourceIterator;
+    *isError = (remainingCharacters != 0);
+    if (resultIterator < resultEnd)
+        *resultIterator = 0;
+
+    return (resultIterator - result) + remainingCharacters;
+}
+
+int toUpper(wchar_t* result, int resultLength, const wchar_t* source, int sourceLength, bool* isError)
+{
+    const UChar* sourceIterator = source;
+    const UChar* sourceEnd = source + sourceLength;
+    UChar* resultIterator = result;
+    UChar* resultEnd = result + resultLength;
+
+    int remainingCharacters = 0;
+    if (sourceLength <= resultLength)
+        while (sourceIterator < sourceEnd)
+            *resultIterator++ = towupper(*sourceIterator++);
+    else
+        while (resultIterator < resultEnd)
+            *resultIterator++ = towupper(*sourceIterator++);
+
+    if (sourceIterator < sourceEnd)
+        remainingCharacters += sourceEnd - sourceIterator;
+    *isError = (remainingCharacters != 0);
+    if (resultIterator < resultEnd)
+        *resultIterator = 0;
+
+    return (resultIterator - result) + remainingCharacters;
+}
+
+int foldCase(wchar_t* result, int resultLength, const wchar_t* source, int sourceLength, bool* isError)
+{
+    *isError = false;
+    if (resultLength < sourceLength) {
+        *isError = true;
+        return sourceLength;
+    }
+    for (int i = 0; i < sourceLength; ++i)
+        result[i] = foldCase(source[i]);
+    return sourceLength;
+}
+
+wchar_t toTitleCase(wchar_t c)
+{
+    return towupper(c);
+}
+
+Direction direction(UChar32 c)
+{
+    return static_cast<Direction>(UnicodeCE::direction(c));
+}
+
+CharCategory category(unsigned int c)
+{
+    return static_cast<CharCategory>(TO_MASK((__int8) UnicodeCE::category(c)));
+}
+
+DecompositionType decompositionType(UChar32 c)
+{
+    return static_cast<DecompositionType>(UnicodeCE::decompositionType(c));
+}
+
+unsigned char combiningClass(UChar32 c)
+{
+    return UnicodeCE::combiningClass(c);
+}
+
+wchar_t mirroredChar(UChar32 c)
+{
+    return UnicodeCE::mirroredChar(c);
+}
+
+int digitValue(wchar_t c)
+{
+    return UnicodeCE::digitValue(c);
+}
+
+} // namespace Unicode
+} // namespace WTF
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/wince/UnicodeWince.h b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/wince/UnicodeWince.h
new file mode 100644
index 0000000..db656ec
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/wince/UnicodeWince.h
@@ -0,0 +1,216 @@
+/*
+ *  Copyright (C) 2006 George Staikos <staikos@kde.org>
+ *  Copyright (C) 2006 Alexey Proskuryakov <ap@nypop.com>
+ *  Copyright (C) 2007 Apple Computer, Inc. All rights reserved.
+ *  Copyright (C) 2007-2009 Torch Mobile, Inc.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef UNICODE_WINCE_H
+#define UNICODE_WINCE_H
+
+#include "ce_unicode.h"
+
+#define TO_MASK(x) (1 << (x))
+
+// some defines from ICU needed one or two places
+
+#define U16_IS_LEAD(c) (((c) & 0xfffffc00) == 0xd800)
+#define U16_IS_TRAIL(c) (((c) & 0xfffffc00) == 0xdc00)
+#define U16_SURROGATE_OFFSET ((0xd800 << 10UL) + 0xdc00 - 0x10000)
+#define U16_GET_SUPPLEMENTARY(lead, trail) \
+    (((UChar32)(lead) << 10UL) + (UChar32)(trail) - U16_SURROGATE_OFFSET)
+
+#define U16_LEAD(supplementary) (UChar)(((supplementary) >> 10) + 0xd7c0)
+#define U16_TRAIL(supplementary) (UChar)(((supplementary) & 0x3ff) | 0xdc00)
+
+#define U_IS_SURROGATE(c) (((c) & 0xfffff800) == 0xd800)
+#define U16_IS_SURROGATE(c) U_IS_SURROGATE(c)
+#define U16_IS_SURROGATE_LEAD(c) (((c) & 0x400) == 0)
+
+#define U16_NEXT(s, i, length, c) { \
+    (c)=(s)[(i)++]; \
+    if (U16_IS_LEAD(c)) { \
+        uint16_t __c2; \
+        if ((i) < (length) && U16_IS_TRAIL(__c2 = (s)[(i)])) { \
+            ++(i); \
+            (c) = U16_GET_SUPPLEMENTARY((c), __c2); \
+        } \
+    } \
+}
+
+#define U16_PREV(s, start, i, c) { \
+    (c)=(s)[--(i)]; \
+    if (U16_IS_TRAIL(c)) { \
+        uint16_t __c2; \
+        if ((i) > (start) && U16_IS_LEAD(__c2 = (s)[(i) - 1])) { \
+            --(i); \
+            (c) = U16_GET_SUPPLEMENTARY(__c2, (c)); \
+        } \
+    } \
+}
+
+#define U16_IS_SINGLE(c) !U_IS_SURROGATE(c)
+
+namespace WTF {
+
+    namespace Unicode {
+
+        enum Direction {
+            LeftToRight = UnicodeCE::U_LEFT_TO_RIGHT,
+            RightToLeft = UnicodeCE::U_RIGHT_TO_LEFT,
+            EuropeanNumber = UnicodeCE::U_EUROPEAN_NUMBER,
+            EuropeanNumberSeparator = UnicodeCE::U_EUROPEAN_NUMBER_SEPARATOR,
+            EuropeanNumberTerminator = UnicodeCE::U_EUROPEAN_NUMBER_TERMINATOR,
+            ArabicNumber = UnicodeCE::U_ARABIC_NUMBER,
+            CommonNumberSeparator = UnicodeCE::U_COMMON_NUMBER_SEPARATOR,
+            BlockSeparator = UnicodeCE::U_BLOCK_SEPARATOR,
+            SegmentSeparator = UnicodeCE::U_SEGMENT_SEPARATOR,
+            WhiteSpaceNeutral = UnicodeCE::U_WHITE_SPACE_NEUTRAL,
+            OtherNeutral = UnicodeCE::U_OTHER_NEUTRAL,
+            LeftToRightEmbedding = UnicodeCE::U_LEFT_TO_RIGHT_EMBEDDING,
+            LeftToRightOverride = UnicodeCE::U_LEFT_TO_RIGHT_OVERRIDE,
+            RightToLeftArabic = UnicodeCE::U_RIGHT_TO_LEFT_ARABIC,
+            RightToLeftEmbedding = UnicodeCE::U_RIGHT_TO_LEFT_EMBEDDING,
+            RightToLeftOverride = UnicodeCE::U_RIGHT_TO_LEFT_OVERRIDE,
+            PopDirectionalFormat = UnicodeCE::U_POP_DIRECTIONAL_FORMAT,
+            NonSpacingMark = UnicodeCE::U_DIR_NON_SPACING_MARK,
+            BoundaryNeutral = UnicodeCE::U_BOUNDARY_NEUTRAL
+        };
+
+        enum DecompositionType {
+          DecompositionNone = UnicodeCE::U_DT_NONE,
+          DecompositionCanonical = UnicodeCE::U_DT_CANONICAL,
+          DecompositionCompat = UnicodeCE::U_DT_COMPAT,
+          DecompositionCircle = UnicodeCE::U_DT_CIRCLE,
+          DecompositionFinal = UnicodeCE::U_DT_FINAL,
+          DecompositionFont = UnicodeCE::U_DT_FONT,
+          DecompositionFraction = UnicodeCE::U_DT_FRACTION,
+          DecompositionInitial = UnicodeCE::U_DT_INITIAL,
+          DecompositionIsolated = UnicodeCE::U_DT_ISOLATED,
+          DecompositionMedial = UnicodeCE::U_DT_MEDIAL,
+          DecompositionNarrow = UnicodeCE::U_DT_NARROW,
+          DecompositionNoBreak = UnicodeCE::U_DT_NOBREAK,
+          DecompositionSmall = UnicodeCE::U_DT_SMALL,
+          DecompositionSquare = UnicodeCE::U_DT_SQUARE,
+          DecompositionSub = UnicodeCE::U_DT_SUB,
+          DecompositionSuper = UnicodeCE::U_DT_SUPER,
+          DecompositionVertical = UnicodeCE::U_DT_VERTICAL,
+          DecompositionWide = UnicodeCE::U_DT_WIDE,
+        };
+
+        enum CharCategory {
+          NoCategory =  0,
+          Other_NotAssigned = TO_MASK(UnicodeCE::U_GENERAL_OTHER_TYPES),
+          Letter_Uppercase = TO_MASK(UnicodeCE::U_UPPERCASE_LETTER),
+          Letter_Lowercase = TO_MASK(UnicodeCE::U_LOWERCASE_LETTER),
+          Letter_Titlecase = TO_MASK(UnicodeCE::U_TITLECASE_LETTER),
+          Letter_Modifier = TO_MASK(UnicodeCE::U_MODIFIER_LETTER),
+          Letter_Other = TO_MASK(UnicodeCE::U_OTHER_LETTER),
+
+          Mark_NonSpacing = TO_MASK(UnicodeCE::U_NON_SPACING_MARK),
+          Mark_Enclosing = TO_MASK(UnicodeCE::U_ENCLOSING_MARK),
+          Mark_SpacingCombining = TO_MASK(UnicodeCE::U_COMBINING_SPACING_MARK),
+
+          Number_DecimalDigit = TO_MASK(UnicodeCE::U_DECIMAL_DIGIT_NUMBER),
+          Number_Letter = TO_MASK(UnicodeCE::U_LETTER_NUMBER),
+          Number_Other = TO_MASK(UnicodeCE::U_OTHER_NUMBER),
+
+          Separator_Space = TO_MASK(UnicodeCE::U_SPACE_SEPARATOR),
+          Separator_Line = TO_MASK(UnicodeCE::U_LINE_SEPARATOR),
+          Separator_Paragraph = TO_MASK(UnicodeCE::U_PARAGRAPH_SEPARATOR),
+
+          Other_Control = TO_MASK(UnicodeCE::U_CONTROL_CHAR),
+          Other_Format = TO_MASK(UnicodeCE::U_FORMAT_CHAR),
+          Other_PrivateUse = TO_MASK(UnicodeCE::U_PRIVATE_USE_CHAR),
+          Other_Surrogate = TO_MASK(UnicodeCE::U_SURROGATE),
+
+          Punctuation_Dash = TO_MASK(UnicodeCE::U_DASH_PUNCTUATION),
+          Punctuation_Open = TO_MASK(UnicodeCE::U_START_PUNCTUATION),
+          Punctuation_Close = TO_MASK(UnicodeCE::U_END_PUNCTUATION),
+          Punctuation_Connector = TO_MASK(UnicodeCE::U_CONNECTOR_PUNCTUATION),
+          Punctuation_Other = TO_MASK(UnicodeCE::U_OTHER_PUNCTUATION),
+
+          Symbol_Math = TO_MASK(UnicodeCE::U_MATH_SYMBOL),
+          Symbol_Currency = TO_MASK(UnicodeCE::U_CURRENCY_SYMBOL),
+          Symbol_Modifier = TO_MASK(UnicodeCE::U_MODIFIER_SYMBOL),
+          Symbol_Other = TO_MASK(UnicodeCE::U_OTHER_SYMBOL),
+
+          Punctuation_InitialQuote = TO_MASK(UnicodeCE::U_INITIAL_PUNCTUATION),
+          Punctuation_FinalQuote = TO_MASK(UnicodeCE::U_FINAL_PUNCTUATION)
+        };
+
+        CharCategory category(unsigned int);
+
+        bool isSpace(wchar_t);
+        bool isLetter(wchar_t);
+        bool isPrintableChar(wchar_t);
+        bool isUpper(wchar_t);
+        bool isLower(wchar_t);
+        bool isPunct(wchar_t);
+        bool isDigit(wchar_t);
+        inline bool isSeparatorSpace(wchar_t c) { return category(c) == Separator_Space; }
+        inline bool isHighSurrogate(wchar_t c) { return (c & 0xfc00) == 0xd800; }
+        inline bool isLowSurrogate(wchar_t c) { return (c & 0xfc00) == 0xdc00; }
+
+        wchar_t toLower(wchar_t);
+        wchar_t toUpper(wchar_t);
+        wchar_t foldCase(wchar_t);
+        wchar_t toTitleCase(wchar_t);
+        int toLower(wchar_t* result, int resultLength, const wchar_t* source, int sourceLength, bool* isError);
+        int toUpper(wchar_t* result, int resultLength, const wchar_t* source, int sourceLength, bool* isError);
+        int foldCase(UChar* result, int resultLength, const wchar_t* source, int sourceLength, bool* isError);
+
+        int digitValue(wchar_t);
+
+        wchar_t mirroredChar(UChar32);
+        unsigned char combiningClass(UChar32);
+        DecompositionType decompositionType(UChar32);
+        Direction direction(UChar32);
+        inline bool isArabicChar(UChar32)
+        {
+            return false; // FIXME: implement!
+        }
+
+        inline bool hasLineBreakingPropertyComplexContext(UChar32)
+        {
+            return false; // FIXME: implement!
+        }
+
+        inline int umemcasecmp(const wchar_t* a, const wchar_t* b, int len)
+        {
+            for (int i = 0; i < len; ++i) {
+                wchar_t c1 = foldCase(a[i]);
+                wchar_t c2 = foldCase(b[i]);
+                if (c1 != c2)
+                    return c1 - c2;
+            }
+            return 0;
+        }
+
+        inline UChar32 surrogateToUcs4(wchar_t high, wchar_t low)
+        {
+            return (UChar32(high) << 10) + low - 0x35fdc00;
+        }
+
+    }   // namespace Unicode
+
+}   // namespace WTF
+
+#endif
+// vim: ts=2 sw=2 et
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp
index b0aae65..aafea3c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -90,7 +90,7 @@ public:
             : term(0)
         {
         }
-        
+
         void* operator new(size_t, void* where)
         {
             return where;
@@ -124,7 +124,7 @@ public:
                 subpatternBackup[i] = output[(firstSubpatternId << 1) + i];
                 output[(firstSubpatternId << 1) + i] = -1;
             }
-            
+
             new(getDisjunctionContext(term)) DisjunctionContext();
         }
 
@@ -138,7 +138,7 @@ public:
             for (unsigned i = 0; i < (numNestedSubpatterns << 1); ++i)
                 output[(firstSubpatternId << 1) + i] = subpatternBackup[i];
         }
-        
+
         DisjunctionContext* getDisjunctionContext(ByteTerm& term)
         {
             return reinterpret_cast<DisjunctionContext*>(&(subpatternBackup[term.atom.parenthesesDisjunction->m_numSubpatterns << 1]));
@@ -208,7 +208,7 @@ public:
                 return input[pos - 1];
             return -1;
         }
-        
+
         unsigned getPos()
         {
             return pos;
@@ -218,7 +218,7 @@ public:
         {
             pos = p;
         }
-        
+
         bool atStart()
         {
             return pos == 0;
@@ -284,7 +284,7 @@ public:
     {
         if (input.atEnd())
             return false;
-        
+
         int ch = input.read();
 
         if (pattern->m_ignoreCase ? ((Unicode::toLower(testChar) == ch) || (Unicode::toUpper(testChar) == ch)) : (testChar == ch)) {
@@ -341,7 +341,7 @@ public:
                 return false;
             }
         }
-        
+
         return true;
     }
 
@@ -606,10 +606,10 @@ public:
 
             if (matchDisjunction(term.atom.parenthesesDisjunction, context->getDisjunctionContext(term), true))
                 return true;
-            
+
             resetMatches(term, context);
-            freeParenthesesDisjunctionContext(context);
             popParenthesesDisjunctionContext(backTrack);
+            freeParenthesesDisjunctionContext(context);
         }
 
         return false;
@@ -910,8 +910,8 @@ public:
                 }
             } else {
                 resetMatches(term, context);
-                freeParenthesesDisjunctionContext(context);
                 popParenthesesDisjunctionContext(backTrack);
+                freeParenthesesDisjunctionContext(context);
             }
 
             if (backTrack->matchAmount) {
@@ -946,11 +946,11 @@ public:
                     }
                     return true;
                 }
-                
+
                 // pop a match off the stack
                 resetMatches(term, context);
-                freeParenthesesDisjunctionContext(context);
                 popParenthesesDisjunctionContext(backTrack);
+                freeParenthesesDisjunctionContext(context);
             }
 
             return false;
@@ -1266,37 +1266,37 @@ public:
     ByteCompiler(RegexPattern& pattern)
         : m_pattern(pattern)
     {
-        bodyDisjunction = 0;
-        currentAlternativeIndex = 0;
+        m_bodyDisjunction = 0;
+        m_currentAlternativeIndex = 0;
     }
-    
+
     BytecodePattern* compile()
     {
         regexBegin(m_pattern.m_numSubpatterns, m_pattern.m_body->m_callFrameSize);
         emitDisjunction(m_pattern.m_body);
         regexEnd();
 
-        return new BytecodePattern(bodyDisjunction, m_allParenthesesInfo, m_pattern);
+        return new BytecodePattern(m_bodyDisjunction, m_allParenthesesInfo, m_pattern);
     }
-    
+
     void checkInput(unsigned count)
     {
-        bodyDisjunction->terms.append(ByteTerm::CheckInput(count));
+        m_bodyDisjunction->terms.append(ByteTerm::CheckInput(count));
     }
 
     void assertionBOL(int inputPosition)
     {
-        bodyDisjunction->terms.append(ByteTerm::BOL(inputPosition));
+        m_bodyDisjunction->terms.append(ByteTerm::BOL(inputPosition));
     }
 
     void assertionEOL(int inputPosition)
     {
-        bodyDisjunction->terms.append(ByteTerm::EOL(inputPosition));
+        m_bodyDisjunction->terms.append(ByteTerm::EOL(inputPosition));
     }
 
     void assertionWordBoundary(bool invert, int inputPosition)
     {
-        bodyDisjunction->terms.append(ByteTerm::WordBoundary(invert, inputPosition));
+        m_bodyDisjunction->terms.append(ByteTerm::WordBoundary(invert, inputPosition));
     }
 
     void atomPatternCharacter(UChar ch, int inputPosition, unsigned frameLocation, unsigned quantityCount, QuantifierType quantityType)
@@ -1304,60 +1304,60 @@ public:
         if (m_pattern.m_ignoreCase) {
             UChar lo = Unicode::toLower(ch);
             UChar hi = Unicode::toUpper(ch);
-            
+
             if (lo != hi) {
-                bodyDisjunction->terms.append(ByteTerm(lo, hi, inputPosition, frameLocation, quantityCount, quantityType));
+                m_bodyDisjunction->terms.append(ByteTerm(lo, hi, inputPosition, frameLocation, quantityCount, quantityType));
                 return;
             }
         }
 
-        bodyDisjunction->terms.append(ByteTerm(ch, inputPosition, frameLocation, quantityCount, quantityType));
+        m_bodyDisjunction->terms.append(ByteTerm(ch, inputPosition, frameLocation, quantityCount, quantityType));
     }
-    
+
     void atomCharacterClass(CharacterClass* characterClass, bool invert, int inputPosition, unsigned frameLocation, unsigned quantityCount, QuantifierType quantityType)
     {
-        bodyDisjunction->terms.append(ByteTerm(characterClass, invert, inputPosition));
+        m_bodyDisjunction->terms.append(ByteTerm(characterClass, invert, inputPosition));
 
-        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].atom.quantityCount = quantityCount;
-        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].atom.quantityType = quantityType;
-        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].atom.quantityCount = quantityCount;
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].atom.quantityType = quantityType;
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
     }
 
     void atomBackReference(unsigned subpatternId, int inputPosition, unsigned frameLocation, unsigned quantityCount, QuantifierType quantityType)
     {
         ASSERT(subpatternId);
 
-        bodyDisjunction->terms.append(ByteTerm::BackReference(subpatternId, inputPosition));
+        m_bodyDisjunction->terms.append(ByteTerm::BackReference(subpatternId, inputPosition));
 
-        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].atom.quantityCount = quantityCount;
-        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].atom.quantityType = quantityType;
-        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].atom.quantityCount = quantityCount;
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].atom.quantityType = quantityType;
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
     }
 
     void atomParenthesesSubpatternBegin(unsigned subpatternId, bool capture, int inputPosition, unsigned frameLocation, unsigned alternativeFrameLocation)
     {
-        int beginTerm = bodyDisjunction->terms.size();
+        int beginTerm = m_bodyDisjunction->terms.size();
 
-        bodyDisjunction->terms.append(ByteTerm(ByteTerm::TypeParenthesesSubpatternOnceBegin, subpatternId, capture, inputPosition));
-        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
-        bodyDisjunction->terms.append(ByteTerm::AlternativeBegin());
-        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = alternativeFrameLocation;
+        m_bodyDisjunction->terms.append(ByteTerm(ByteTerm::TypeParenthesesSubpatternOnceBegin, subpatternId, capture, inputPosition));
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
+        m_bodyDisjunction->terms.append(ByteTerm::AlternativeBegin());
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].frameLocation = alternativeFrameLocation;
 
-        m_parenthesesStack.append(ParenthesesStackEntry(beginTerm, currentAlternativeIndex));
-        currentAlternativeIndex = beginTerm + 1;
+        m_parenthesesStack.append(ParenthesesStackEntry(beginTerm, m_currentAlternativeIndex));
+        m_currentAlternativeIndex = beginTerm + 1;
     }
 
     void atomParentheticalAssertionBegin(unsigned subpatternId, bool invert, unsigned frameLocation, unsigned alternativeFrameLocation)
     {
-        int beginTerm = bodyDisjunction->terms.size();
+        int beginTerm = m_bodyDisjunction->terms.size();
 
-        bodyDisjunction->terms.append(ByteTerm(ByteTerm::TypeParentheticalAssertionBegin, subpatternId, invert, 0));
-        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
-        bodyDisjunction->terms.append(ByteTerm::AlternativeBegin());
-        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = alternativeFrameLocation;
+        m_bodyDisjunction->terms.append(ByteTerm(ByteTerm::TypeParentheticalAssertionBegin, subpatternId, invert, 0));
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
+        m_bodyDisjunction->terms.append(ByteTerm::AlternativeBegin());
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].frameLocation = alternativeFrameLocation;
 
-        m_parenthesesStack.append(ParenthesesStackEntry(beginTerm, currentAlternativeIndex));
-        currentAlternativeIndex = beginTerm + 1;
+        m_parenthesesStack.append(ParenthesesStackEntry(beginTerm, m_currentAlternativeIndex));
+        m_currentAlternativeIndex = beginTerm + 1;
     }
 
     unsigned popParenthesesStack()
@@ -1365,12 +1365,12 @@ public:
         ASSERT(m_parenthesesStack.size());
         int stackEnd = m_parenthesesStack.size() - 1;
         unsigned beginTerm = m_parenthesesStack[stackEnd].beginTerm;
-        currentAlternativeIndex = m_parenthesesStack[stackEnd].savedAlternativeIndex;
+        m_currentAlternativeIndex = m_parenthesesStack[stackEnd].savedAlternativeIndex;
         m_parenthesesStack.shrink(stackEnd);
 
-        ASSERT(beginTerm < bodyDisjunction->terms.size());
-        ASSERT(currentAlternativeIndex < bodyDisjunction->terms.size());
-        
+        ASSERT(beginTerm < m_bodyDisjunction->terms.size());
+        ASSERT(m_currentAlternativeIndex < m_bodyDisjunction->terms.size());
+
         return beginTerm;
     }
 
@@ -1387,25 +1387,25 @@ public:
     void closeAlternative(int beginTerm)
     {
         int origBeginTerm = beginTerm;
-        ASSERT(bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeAlternativeBegin);
-        int endIndex = bodyDisjunction->terms.size();
+        ASSERT(m_bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeAlternativeBegin);
+        int endIndex = m_bodyDisjunction->terms.size();
 
-        unsigned frameLocation = bodyDisjunction->terms[beginTerm].frameLocation;
+        unsigned frameLocation = m_bodyDisjunction->terms[beginTerm].frameLocation;
 
-        if (!bodyDisjunction->terms[beginTerm].alternative.next)
-            bodyDisjunction->terms.remove(beginTerm);
+        if (!m_bodyDisjunction->terms[beginTerm].alternative.next)
+            m_bodyDisjunction->terms.remove(beginTerm);
         else {
-            while (bodyDisjunction->terms[beginTerm].alternative.next) {
-                beginTerm += bodyDisjunction->terms[beginTerm].alternative.next;
-                ASSERT(bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeAlternativeDisjunction);
-                bodyDisjunction->terms[beginTerm].alternative.end = endIndex - beginTerm;
-                bodyDisjunction->terms[beginTerm].frameLocation = frameLocation;
+            while (m_bodyDisjunction->terms[beginTerm].alternative.next) {
+                beginTerm += m_bodyDisjunction->terms[beginTerm].alternative.next;
+                ASSERT(m_bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeAlternativeDisjunction);
+                m_bodyDisjunction->terms[beginTerm].alternative.end = endIndex - beginTerm;
+                m_bodyDisjunction->terms[beginTerm].frameLocation = frameLocation;
             }
-            
-            bodyDisjunction->terms[beginTerm].alternative.next = origBeginTerm - beginTerm;
 
-            bodyDisjunction->terms.append(ByteTerm::AlternativeEnd());
-            bodyDisjunction->terms[endIndex].frameLocation = frameLocation;
+            m_bodyDisjunction->terms[beginTerm].alternative.next = origBeginTerm - beginTerm;
+
+            m_bodyDisjunction->terms.append(ByteTerm::AlternativeEnd());
+            m_bodyDisjunction->terms[endIndex].frameLocation = frameLocation;
         }
     }
 
@@ -1413,46 +1413,46 @@ public:
     {
         int beginTerm = 0;
         int origBeginTerm = 0;
-        ASSERT(bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeBodyAlternativeBegin);
-        int endIndex = bodyDisjunction->terms.size();
+        ASSERT(m_bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeBodyAlternativeBegin);
+        int endIndex = m_bodyDisjunction->terms.size();
 
-        unsigned frameLocation = bodyDisjunction->terms[beginTerm].frameLocation;
+        unsigned frameLocation = m_bodyDisjunction->terms[beginTerm].frameLocation;
 
-        while (bodyDisjunction->terms[beginTerm].alternative.next) {
-            beginTerm += bodyDisjunction->terms[beginTerm].alternative.next;
-            ASSERT(bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeBodyAlternativeDisjunction);
-            bodyDisjunction->terms[beginTerm].alternative.end = endIndex - beginTerm;
-            bodyDisjunction->terms[beginTerm].frameLocation = frameLocation;
+        while (m_bodyDisjunction->terms[beginTerm].alternative.next) {
+            beginTerm += m_bodyDisjunction->terms[beginTerm].alternative.next;
+            ASSERT(m_bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeBodyAlternativeDisjunction);
+            m_bodyDisjunction->terms[beginTerm].alternative.end = endIndex - beginTerm;
+            m_bodyDisjunction->terms[beginTerm].frameLocation = frameLocation;
         }
-        
-        bodyDisjunction->terms[beginTerm].alternative.next = origBeginTerm - beginTerm;
 
-        bodyDisjunction->terms.append(ByteTerm::BodyAlternativeEnd());
-        bodyDisjunction->terms[endIndex].frameLocation = frameLocation;
+        m_bodyDisjunction->terms[beginTerm].alternative.next = origBeginTerm - beginTerm;
+
+        m_bodyDisjunction->terms.append(ByteTerm::BodyAlternativeEnd());
+        m_bodyDisjunction->terms[endIndex].frameLocation = frameLocation;
     }
 
     void atomParenthesesEnd(bool doInline, unsigned lastSubpatternId, int inputPosition, unsigned frameLocation, unsigned quantityCount, QuantifierType quantityType, unsigned callFrameSize = 0)
     {
         unsigned beginTerm = popParenthesesStack();
         closeAlternative(beginTerm + 1);
-        unsigned endTerm = bodyDisjunction->terms.size();
+        unsigned endTerm = m_bodyDisjunction->terms.size();
 
-        bool isAssertion = bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeParentheticalAssertionBegin;
-        bool invertOrCapture = bodyDisjunction->terms[beginTerm].invertOrCapture;
-        unsigned subpatternId = bodyDisjunction->terms[beginTerm].atom.subpatternId;
+        bool isAssertion = m_bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeParentheticalAssertionBegin;
+        bool invertOrCapture = m_bodyDisjunction->terms[beginTerm].invertOrCapture;
+        unsigned subpatternId = m_bodyDisjunction->terms[beginTerm].atom.subpatternId;
 
-        bodyDisjunction->terms.append(ByteTerm(isAssertion ? ByteTerm::TypeParentheticalAssertionEnd : ByteTerm::TypeParenthesesSubpatternOnceEnd, subpatternId, invertOrCapture, inputPosition));
-        bodyDisjunction->terms[beginTerm].atom.parenthesesWidth = endTerm - beginTerm;
-        bodyDisjunction->terms[endTerm].atom.parenthesesWidth = endTerm - beginTerm;
-        bodyDisjunction->terms[endTerm].frameLocation = frameLocation;
+        m_bodyDisjunction->terms.append(ByteTerm(isAssertion ? ByteTerm::TypeParentheticalAssertionEnd : ByteTerm::TypeParenthesesSubpatternOnceEnd, subpatternId, invertOrCapture, inputPosition));
+        m_bodyDisjunction->terms[beginTerm].atom.parenthesesWidth = endTerm - beginTerm;
+        m_bodyDisjunction->terms[endTerm].atom.parenthesesWidth = endTerm - beginTerm;
+        m_bodyDisjunction->terms[endTerm].frameLocation = frameLocation;
 
         if (doInline) {
-            bodyDisjunction->terms[beginTerm].atom.quantityCount = quantityCount;
-            bodyDisjunction->terms[beginTerm].atom.quantityType = quantityType;
-            bodyDisjunction->terms[endTerm].atom.quantityCount = quantityCount;
-            bodyDisjunction->terms[endTerm].atom.quantityType = quantityType;
+            m_bodyDisjunction->terms[beginTerm].atom.quantityCount = quantityCount;
+            m_bodyDisjunction->terms[beginTerm].atom.quantityType = quantityType;
+            m_bodyDisjunction->terms[endTerm].atom.quantityCount = quantityCount;
+            m_bodyDisjunction->terms[endTerm].atom.quantityType = quantityType;
         } else {
-            ByteTerm& parenthesesBegin = bodyDisjunction->terms[beginTerm];
+            ByteTerm& parenthesesBegin = m_bodyDisjunction->terms[beginTerm];
             ASSERT(parenthesesBegin.type == ByteTerm::TypeParenthesesSubpatternOnceBegin);
 
             bool invertOrCapture = parenthesesBegin.invertOrCapture;
@@ -1463,26 +1463,26 @@ public:
 
             parenthesesDisjunction->terms.append(ByteTerm::SubpatternBegin());
             for (unsigned termInParentheses = beginTerm + 1; termInParentheses < endTerm; ++termInParentheses)
-                parenthesesDisjunction->terms.append(bodyDisjunction->terms[termInParentheses]);
+                parenthesesDisjunction->terms.append(m_bodyDisjunction->terms[termInParentheses]);
             parenthesesDisjunction->terms.append(ByteTerm::SubpatternEnd());
 
-            bodyDisjunction->terms.shrink(beginTerm);
+            m_bodyDisjunction->terms.shrink(beginTerm);
 
             m_allParenthesesInfo.append(parenthesesDisjunction);
-            bodyDisjunction->terms.append(ByteTerm(ByteTerm::TypeParenthesesSubpattern, subpatternId, parenthesesDisjunction, invertOrCapture, inputPosition));
+            m_bodyDisjunction->terms.append(ByteTerm(ByteTerm::TypeParenthesesSubpattern, subpatternId, parenthesesDisjunction, invertOrCapture, inputPosition));
 
-            bodyDisjunction->terms[beginTerm].atom.quantityCount = quantityCount;
-            bodyDisjunction->terms[beginTerm].atom.quantityType = quantityType;
-            bodyDisjunction->terms[beginTerm].frameLocation = frameLocation;
+            m_bodyDisjunction->terms[beginTerm].atom.quantityCount = quantityCount;
+            m_bodyDisjunction->terms[beginTerm].atom.quantityType = quantityType;
+            m_bodyDisjunction->terms[beginTerm].frameLocation = frameLocation;
         }
     }
 
     void regexBegin(unsigned numSubpatterns, unsigned callFrameSize)
     {
-        bodyDisjunction = new ByteDisjunction(numSubpatterns, callFrameSize);
-        bodyDisjunction->terms.append(ByteTerm::BodyAlternativeBegin());
-        bodyDisjunction->terms[0].frameLocation = 0;
-        currentAlternativeIndex = 0;
+        m_bodyDisjunction = new ByteDisjunction(numSubpatterns, callFrameSize);
+        m_bodyDisjunction->terms.append(ByteTerm::BodyAlternativeBegin());
+        m_bodyDisjunction->terms[0].frameLocation = 0;
+        m_currentAlternativeIndex = 0;
     }
 
     void regexEnd()
@@ -1492,27 +1492,27 @@ public:
 
     void alterantiveBodyDisjunction()
     {
-        int newAlternativeIndex = bodyDisjunction->terms.size();
-        bodyDisjunction->terms[currentAlternativeIndex].alternative.next = newAlternativeIndex - currentAlternativeIndex;
-        bodyDisjunction->terms.append(ByteTerm::BodyAlternativeDisjunction());
+        int newAlternativeIndex = m_bodyDisjunction->terms.size();
+        m_bodyDisjunction->terms[m_currentAlternativeIndex].alternative.next = newAlternativeIndex - m_currentAlternativeIndex;
+        m_bodyDisjunction->terms.append(ByteTerm::BodyAlternativeDisjunction());
 
-        currentAlternativeIndex = newAlternativeIndex;
+        m_currentAlternativeIndex = newAlternativeIndex;
     }
 
     void alterantiveDisjunction()
     {
-        int newAlternativeIndex = bodyDisjunction->terms.size();
-        bodyDisjunction->terms[currentAlternativeIndex].alternative.next = newAlternativeIndex - currentAlternativeIndex;
-        bodyDisjunction->terms.append(ByteTerm::AlternativeDisjunction());
+        int newAlternativeIndex = m_bodyDisjunction->terms.size();
+        m_bodyDisjunction->terms[m_currentAlternativeIndex].alternative.next = newAlternativeIndex - m_currentAlternativeIndex;
+        m_bodyDisjunction->terms.append(ByteTerm::AlternativeDisjunction());
 
-        currentAlternativeIndex = newAlternativeIndex;
+        m_currentAlternativeIndex = newAlternativeIndex;
     }
 
     void emitDisjunction(PatternDisjunction* disjunction, unsigned inputCountAlreadyChecked = 0, unsigned parenthesesInputCountAlreadyChecked = 0)
     {
         for (unsigned alt = 0; alt < disjunction->m_alternatives.size(); ++alt) {
             unsigned currentCountAlreadyChecked = inputCountAlreadyChecked;
-        
+
             if (alt) {
                 if (disjunction == m_pattern.m_body)
                     alterantiveBodyDisjunction();
@@ -1586,7 +1586,7 @@ public:
 
                 case PatternTerm::TypeParentheticalAssertion: {
                     unsigned alternativeFrameLocation = term.inputPosition + RegexStackSpaceForBackTrackInfoParentheticalAssertion;
-                    
+
                     atomParentheticalAssertionBegin(term.parentheses.subpatternId, term.invertOrCapture, term.frameLocation, alternativeFrameLocation);
                     emitDisjunction(term.parentheses.disjunction, currentCountAlreadyChecked, 0);
                     atomParenthesesEnd(true, term.parentheses.lastSubpatternId, 0, term.frameLocation, term.quantityCount, term.quantityType);
@@ -1599,8 +1599,8 @@ public:
 
 private:
     RegexPattern& m_pattern;
-    ByteDisjunction* bodyDisjunction;
-    unsigned currentAlternativeIndex;
+    ByteDisjunction* m_bodyDisjunction;
+    unsigned m_currentAlternativeIndex;
     Vector<ParenthesesStackEntry> m_parenthesesStack;
     Vector<ByteDisjunction*> m_allParenthesesInfo;
 };
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.h b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.h
index a8c122a..48c9a5e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.h
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.h
@@ -280,7 +280,7 @@ struct ByteTerm {
     }
 };
 
-class ByteDisjunction {
+class ByteDisjunction : public FastAllocBase {
 public:
     ByteDisjunction(unsigned numSubpatterns, unsigned frameSize)
         : m_numSubpatterns(numSubpatterns)
@@ -293,7 +293,7 @@ public:
     unsigned m_frameSize;
 };
 
-struct BytecodePattern {
+struct BytecodePattern : FastAllocBase {
     BytecodePattern(ByteDisjunction* body, Vector<ByteDisjunction*> allParenthesesInfo, RegexPattern& pattern)
         : m_body(body)
         , m_ignoreCase(pattern.m_ignoreCase)
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
index 663a524..16b1ecc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
@@ -45,35 +45,35 @@ class RegexGenerator : private MacroAssembler {
     friend void jitCompileRegex(JSGlobalData* globalData, RegexCodeBlock& jitObject, const UString& pattern, unsigned& numSubpatterns, const char*& error, bool ignoreCase, bool multiline);
 
 #if PLATFORM(ARM)
-    static const RegisterID input = ARM::r0;
-    static const RegisterID index = ARM::r1;
-    static const RegisterID length = ARM::r2;
-    static const RegisterID output = ARM::r4;
+    static const RegisterID input = ARMRegisters::r0;
+    static const RegisterID index = ARMRegisters::r1;
+    static const RegisterID length = ARMRegisters::r2;
+    static const RegisterID output = ARMRegisters::r4;
 
-    static const RegisterID regT0 = ARM::r5;
-    static const RegisterID regT1 = ARM::r6;
+    static const RegisterID regT0 = ARMRegisters::r5;
+    static const RegisterID regT1 = ARMRegisters::r6;
 
-    static const RegisterID returnRegister = ARM::r0;
+    static const RegisterID returnRegister = ARMRegisters::r0;
 #elif PLATFORM(X86)
-    static const RegisterID input = X86::eax;
-    static const RegisterID index = X86::edx;
-    static const RegisterID length = X86::ecx;
-    static const RegisterID output = X86::edi;
+    static const RegisterID input = X86Registers::eax;
+    static const RegisterID index = X86Registers::edx;
+    static const RegisterID length = X86Registers::ecx;
+    static const RegisterID output = X86Registers::edi;
 
-    static const RegisterID regT0 = X86::ebx;
-    static const RegisterID regT1 = X86::esi;
+    static const RegisterID regT0 = X86Registers::ebx;
+    static const RegisterID regT1 = X86Registers::esi;
 
-    static const RegisterID returnRegister = X86::eax;
+    static const RegisterID returnRegister = X86Registers::eax;
 #elif PLATFORM(X86_64)
-    static const RegisterID input = X86::edi;
-    static const RegisterID index = X86::esi;
-    static const RegisterID length = X86::edx;
-    static const RegisterID output = X86::ecx;
+    static const RegisterID input = X86Registers::edi;
+    static const RegisterID index = X86Registers::esi;
+    static const RegisterID length = X86Registers::edx;
+    static const RegisterID output = X86Registers::ecx;
 
-    static const RegisterID regT0 = X86::eax;
-    static const RegisterID regT1 = X86::ebx;
+    static const RegisterID regT0 = X86Registers::eax;
+    static const RegisterID regT1 = X86Registers::ebx;
 
-    static const RegisterID returnRegister = X86::eax;
+    static const RegisterID returnRegister = X86Registers::eax;
 #endif
 
     void optimizeAlternative(PatternAlternative* alternative)
@@ -1289,50 +1289,50 @@ class RegexGenerator : private MacroAssembler {
     void generateEnter()
     {
 #if PLATFORM(X86_64)
-        push(X86::ebp);
-        move(stackPointerRegister, X86::ebp);
-        push(X86::ebx);
+        push(X86Registers::ebp);
+        move(stackPointerRegister, X86Registers::ebp);
+        push(X86Registers::ebx);
 #elif PLATFORM(X86)
-        push(X86::ebp);
-        move(stackPointerRegister, X86::ebp);
+        push(X86Registers::ebp);
+        move(stackPointerRegister, X86Registers::ebp);
         // TODO: do we need spill registers to fill the output pointer if there are no sub captures?
-        push(X86::ebx);
-        push(X86::edi);
-        push(X86::esi);
+        push(X86Registers::ebx);
+        push(X86Registers::edi);
+        push(X86Registers::esi);
         // load output into edi (2 = saved ebp + return address).
     #if COMPILER(MSVC)
-        loadPtr(Address(X86::ebp, 2 * sizeof(void*)), input);
-        loadPtr(Address(X86::ebp, 3 * sizeof(void*)), index);
-        loadPtr(Address(X86::ebp, 4 * sizeof(void*)), length);
-        loadPtr(Address(X86::ebp, 5 * sizeof(void*)), output);
+        loadPtr(Address(X86Registers::ebp, 2 * sizeof(void*)), input);
+        loadPtr(Address(X86Registers::ebp, 3 * sizeof(void*)), index);
+        loadPtr(Address(X86Registers::ebp, 4 * sizeof(void*)), length);
+        loadPtr(Address(X86Registers::ebp, 5 * sizeof(void*)), output);
     #else
-        loadPtr(Address(X86::ebp, 2 * sizeof(void*)), output);
+        loadPtr(Address(X86Registers::ebp, 2 * sizeof(void*)), output);
     #endif
 #elif PLATFORM(ARM)
 #if !PLATFORM_ARM_ARCH(7)
-        push(ARM::lr);
+        push(ARMRegisters::lr);
 #endif
-        push(ARM::r4);
-        push(ARM::r5);
-        push(ARM::r6);
-        move(ARM::r3, output);
+        push(ARMRegisters::r4);
+        push(ARMRegisters::r5);
+        push(ARMRegisters::r6);
+        move(ARMRegisters::r3, output);
 #endif
     }
 
     void generateReturn()
     {
 #if PLATFORM(X86_64)
-        pop(X86::ebx);
-        pop(X86::ebp);
+        pop(X86Registers::ebx);
+        pop(X86Registers::ebp);
 #elif PLATFORM(X86)
-        pop(X86::esi);
-        pop(X86::edi);
-        pop(X86::ebx);
-        pop(X86::ebp);
+        pop(X86Registers::esi);
+        pop(X86Registers::edi);
+        pop(X86Registers::ebx);
+        pop(X86Registers::ebp);
 #elif PLATFORM(ARM)
-        pop(ARM::r6);
-        pop(ARM::r5);
-        pop(ARM::r4);
+        pop(ARMRegisters::r6);
+        pop(ARMRegisters::r5);
+        pop(ARMRegisters::r4);
 #endif
         ret();
     }
diff --git a/src/3rdparty/webkit/VERSION b/src/3rdparty/webkit/VERSION
index 6834134..eb7083a 100644
--- a/src/3rdparty/webkit/VERSION
+++ b/src/3rdparty/webkit/VERSION
@@ -4,8 +4,8 @@ This is a snapshot of the Qt port of WebKit from
 
 The commit imported was from the
 
-        qtwebkit-4.6-snapshot-29072009 branch/tag
+        qtwebkit-4.6-snapshot-18092009 branch/tag
 
 and has the sha1 checksum
 
-        07fbaeddfade72be1d0d7e7f2b947e5d3c183f4a
+        15c07fb8d7fa5e93c939aa7eb21c06e19c754cee
diff --git a/src/3rdparty/webkit/WebCore/ChangeLog b/src/3rdparty/webkit/WebCore/ChangeLog
index 7fc69b4..8a278ce 100644
--- a/src/3rdparty/webkit/WebCore/ChangeLog
+++ b/src/3rdparty/webkit/WebCore/ChangeLog
@@ -1,3 +1,21876 @@
+2009-09-16  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29306
+        
+        Fixes an issue where an attack that contains accented characters can
+        bypass the XSSAuditor.
+        
+        XSSAuditor::decodeURL used the wrong length for the input string. 
+        When the input string was decoded, the decoded result was truncated.
+        Hence, XSSAuditor was comparing the source code of the script to the 
+        truncated input parameters.
+
+        Test: http/tests/security/xssAuditor/img-onerror-accented-char.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::decodeURL):
+
+2009-09-16  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Explore allowing pages with unload handlers into the Page Cache
+        https://bugs.webkit.org/show_bug.cgi?id=29021
+
+        No new tests. (All previous tests continue to pass)
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading): If the document is in the page cache, don't fire the unload event.
+
+2009-09-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Teach ScheduledAction::execute about isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=27703
+
+        We now save a handle to the original context.  We use that handle to
+        call the timeout in the right context / world.
+
+        Tests: http/tests/security/isolatedWorld/window-setTimeout-function.html
+               http/tests/security/isolatedWorld/window-setTimeout-string.html
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScheduledAction.h:
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+
+2009-09-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Teach ScheduledAction::execute about isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=27703
+
+        We now save a handle to the original context.  We use that handle to
+        call the timeout in the right context / world.
+
+        Tests: http/tests/security/isolatedWorld/window-setTimeout-function.html
+               http/tests/security/isolatedWorld/window-setTimeout-string.html
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScheduledAction.h:
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+
+2009-09-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add some groups to the xcode project to make the bindings/js/ group
+        a little nicer.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29320
+        JS callback objects should store the global object
+
+        This just changes the callback objects to store the global object instead
+        of the frame. A follow up patch will change them to store the 'current' 
+        global object instead of the lexical or dynamic.
+
+        * DerivedSources.make: Remove unused VoidCallback.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::JSCustomPositionCallback):
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionCallback.h:
+        (WebCore::JSCustomPositionCallback::create):
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::JSCustomPositionErrorCallback):
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.h:
+        (WebCore::JSCustomPositionErrorCallback::create):
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::JSCustomSQLStatementCallback):
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.h:
+        (WebCore::JSCustomSQLStatementCallback::create):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback):
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.h:
+        (WebCore::JSCustomSQLStatementErrorCallback::create):
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::Data::Data):
+        (WebCore::JSCustomSQLTransactionCallback::Data::globalObject):
+        (WebCore::JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback):
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.h:
+        (WebCore::JSCustomSQLTransactionCallback::create):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback):
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
+        (WebCore::JSCustomSQLTransactionErrorCallback::create):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::JSCustomVoidCallback):
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.h:
+        (WebCore::JSCustomVoidCallback::create):
+        * bindings/js/JSDatabaseCustom.cpp:
+        (WebCore::JSDatabase::changeVersion):
+        (WebCore::createTransaction):
+        (WebCore::JSDatabase::transaction):
+        (WebCore::JSDatabase::readTransaction):
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::createPositionCallback):
+        (WebCore::createPositionErrorCallback):
+        (WebCore::JSGeolocation::getCurrentPosition):
+        (WebCore::JSGeolocation::watchPosition):
+        * bindings/js/JSSQLTransactionCustom.cpp:
+        (WebCore::JSSQLTransaction::executeSql):
+
+2009-09-15  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        <input maxlength=> should restrict only values specified by users.
+        https://bugs.webkit.org/show_bug.cgi?id=21271
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::setValueFromRenderer):
+        (WebCore::InputElement::sanitizeValue):
+        (WebCore::InputElement::sanitizeUserInputValue): Rename from constrainValue().
+        (WebCore::InputElement::handleBeforeTextInsertedEvent):
+        (WebCore::InputElement::updateValueIfNeeded):
+        * dom/InputElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::value):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::sanitizeValue):
+        * html/HTMLInputElement.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::constrainValue):
+        * wml/WMLInputElement.h:
+        (WebCore::WMLInputElement::sanitizeValue):
+
+2009-09-16  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Reorganizing helper functions in htmlediting.h to group them by type of object they return/operate upon.
+        https://bugs.webkit.org/show_bug.cgi?id=29319
+
+        * editing/IndentOutdentCommand.cpp:
+        Removed implementation of isAtUnsplittableElement.
+
+        * editing/IndentOutdentCommand.h:
+        Removed member function isAtUnsplittableElement, because it was not class specific and belonged logically among the helper functions.
+
+        * editing/htmlediting.cpp:
+        (WebCore::isAtUnsplittableElement): added. The code was taken from IndentOutdentCommand.
+
+        * editing/htmlediting.h:
+        Reordered functions to group them by type of object returned or operate upon.
+        Added comments.
+        Added isAtUnsplittableElement declaration.
+
+2009-09-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig and Anders Carlsson.
+
+        Removed some vestigial and potentially crashy code that makes consolidating
+        event listeners hard.
+
+        * dom/Node.cpp:
+        (WebCore::Node::addEventListener): No need to limit when event listeners
+        can be added. Other EventTargets don't do this.
+        
+        Also, check for null when accessing document(). Technically, the JS bindings
+        do this check for us, but let's not rely on that.
+
+2009-09-16  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        <rdar://problem/7155710>
+        HTML selects on windows cause containing window to become inactive when opened
+        
+        Redo the way we handle events when a popup menu is shown, based on
+        http://blogs.msdn.com/oldnewthing/archive/2004/08/20/217684.aspx
+        
+        Since a non-active window can't capture the mouse, we use the owning window 
+        (the WebView) as the capture window. We then run a recursive message pump that 
+        forwards all mouse and keyboard events to the popup menu.
+        
+        * platform/PopupMenu.h:
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::PopupMenu):
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::hide):
+        (WebCore::PopupMenu::wndProc):
+
+2009-09-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Ada Chan.
+
+        Speculative fix for
+        <rdar://problem/6937089> Crashes at RenderWidget::destroy()
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::destroy): Avoid calling renderArena() if node()
+        is null. Add two assertions that can help determine how this crash
+        happens (in particular, whether node() becomes null during destroy() or
+        it is null before destroy() is called).
+
+2009-09-16  Beth Dakin  <bdakin@apple.com>
+
+        Speculative build fix.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+2009-09-16  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/7083741> Implement a CSS extension to 
+        adjust sub-pixel anti-aliasing for text
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=29291
+
+        Added tests:
+        * fast/css/font-smoothing.html: Added.
+        * fast/css/parsing-webkit-font-smoothing.html: Added.
+
+        This patch adds a new CSS property called -webkit-font-smoothing 
+        that accepts the following as valid input: auto | none | 
+        antialiased | subpixel-antialiased
+
+        Return appropriate computed style for -webkit-font-smoothing
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+        Add a case for CSSPropertyWebkitFontSmoothing, and accept valid 
+        input.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+
+        Add mappings for FontSmoothing to the right CSS values.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator FontSmoothing):
+
+        Add -webkit-font-smoothing
+        * css/CSSPropertyNames.in:
+
+        Set fontSmoothing on the FontDescription.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+        Add antialiased and subpixel-antialiased as possible new CSS 
+        values.
+        * css/CSSValueKeywords.in:
+        Store the font smoothing CSS value in the FontDescription.
+        * platform/graphics/FontDescription.h:
+        (WebCore::FontDescription::FontDescription):
+        (WebCore::FontDescription::fontSmoothing):
+        (WebCore::FontDescription::setFontSmoothing):
+        (WebCore::FontDescription::operator==):
+
+        Call setShouldAntialias() and setShouldUseSmoothing() appropriately 
+        based on the CSS fontSmoothing() value.
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs):
+
+        New function fontSmoothing()
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::fontSmoothing):
+
+        New enum FontSmoothing.
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-09-16  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Remove style property if empty string is entered.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29163
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype._onmouseout): fixed null pointer exception
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.applyStyleText): if styletext to apply is empty it will return an array to confirm the property removal
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.):
+        (WebInspector.StylePropertyTreeElement.prototype):
+
+2009-09-16  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Always reset m_implicitShorthand to false after parsing
+        background-repeat style property otherwise properties
+        following after it may be erroneously marked as implicit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28972
+        https://bugs.webkit.org/show_bug.cgi?id=28973
+
+        Test: fast/backgrounds/repeat/margin-shorthand.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+
+2009-09-16  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Incorrect behavior of XMLHttpRequest::getAllResponseHeaders and
+        XMLHttpRequest::getResponseHeader in the
+        HEADERS_RECEIVED readyState.
+        https://bugs.webkit.org/show_bug.cgi?id=29121
+
+        Tests: http/tests/xmlhttprequest/getAllResponseHeaders.html
+               http/tests/xmlhttprequest/getResponseHeader.html
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::getAllResponseHeaders):
+        (WebCore::XMLHttpRequest::getResponseHeader):
+        Changed the minimum valid state from LOADING to HEADERS_RECEIVED.
+
+2009-09-16  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix style violation in V8AbstractEventListener.
+        https://bugs.webkit.org/show_bug.cgi?id=29303
+
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::operator==):
+
+2009-09-16  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Add Watch Expression support to inspector
+        https://bugs.webkit.org/show_bug.cgi?id=27514
+
+        Manual test added.
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype.evalInInspectedWindow):
+        (WebInspector.ConsoleView.prototype._enterKeyPressed):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype.update.callback):
+        (WebInspector.ObjectPropertiesSection.prototype.update):
+        (WebInspector.ObjectPropertiesSection.prototype.updateProperties):
+        (WebInspector.ObjectPropertiesSection.CompareProperties):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate.callback):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        (WebInspector.ScriptsPanel.prototype._callFrameSelected):
+        * inspector/front-end/WatchExpressionsSidebarPane.js: Added.
+        (WebInspector.WatchExpressionsSidebarPane):
+        (WebInspector.WatchExpressionsSidebarPane.prototype.refreshExpressions):
+        (WebInspector.WatchExpressionsSection):
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        (WebInspector.WatchExpressionsSection.prototype.addExpression):
+        (WebInspector.WatchExpressionsSection.prototype.updateExpression):
+        (WebInspector.WatchExpressionsSection.prototype.findAddedTreeElement):
+        (WebInspector.WatchExpressionsSection.prototype.loadSavedExpressions):
+        (WebInspector.WatchExpressionsSection.prototype.saveExpressions):
+        (WebInspector.WatchExpressionsSection.CompareProperties):
+        (WebInspector.WatchExpressionTreeElement):
+        (WebInspector.WatchExpressionTreeElement.prototype.update):
+        (WebInspector.WatchExpressionTreeElement.prototype._deleteButtonClicked):
+        (WebInspector.WatchExpressionTreeElement.prototype.startEditing):
+        (WebInspector.WatchExpressionTreeElement.prototype.editingCancelled):
+        (WebInspector.WatchExpressionTreeElement.prototype.applyExpression):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * manual-tests/inspector/debugger-watch-expressions.html: Added.
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(INSPECTOR)
+        https://bugs.webkit.org/show_bug.cgi?id=29260
+
+        Reviewed by David Kilzer.
+
+        No new tests. (No change in default behavior.)
+
+        * DerivedSources.make: Use new WebCore.Inspector.exp file if ENABLE_DRAG_SUPPORT.
+        * WebCore.base.exp: Move Inspector only exports to WebCore.Inspector.exp.
+        * WebCore.xcodeproj/project.pbxproj: Add WebCore.Inspector.exp.
+        * bindings/js/JSDOMWindowBase.cpp: Use ENABLE(INSPECTOR) where applicable.
+        (WebCore::JSDOMWindowBase::supportsProfiling):
+        * bindings/js/JSInspectedObjectWrapper.cpp: Wrap entire file in ENABLE(INSPECTOR).
+        * bindings/js/JSInspectorBackendCustom.cpp: Ditto.
+        * bindings/js/JSInspectorCallbackWrapper.cpp: Ditto.
+        * bindings/js/ScriptObject.cpp: Use ENABLE(INSPECTOR) where applicable.
+        * bindings/js/ScriptObject.h: Ditto.
+        * bindings/js/ScriptObjectQuarantine.cpp: Wrap entire file in ENABLE(INSPECTOR).
+        * dom/Document.cpp: Use ENABLE(INSPECTOR) where applicable.
+        (WebCore::Document::recalcStyle):
+        (WebCore::Document::addMessage):
+        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
+        (WebCore::Document::scriptImported):
+        * dom/Document.h: Ditto.
+        * dom/Node.cpp: Ditto.
+        (WebCore::Node::dispatchGenericEvent):
+        * dom/ScriptExecutionContext.h: Ditto.
+        (WebCore::):
+        * html/HTMLDocument.cpp: Ditto.
+        (WebCore::HTMLDocument::createTokenizer):
+        * html/HTMLTokenizer.cpp: Ditto.
+        (WebCore::HTMLTokenizer::write):
+        * inspector/ConsoleMessage.cpp: Ditto.
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::isEqual):
+        * inspector/ConsoleMessage.h: Ditto.
+        * inspector/DOMDispatchTimelineItem.cpp: Wrap entire file in ENABLE(INSPECTOR).
+        * inspector/InspectorBackend.cpp: Ditto.
+        * inspector/InspectorController.cpp: Ditto.
+        * inspector/InspectorDOMAgent.cpp: Ditto.
+        * inspector/InspectorDOMStorageResource.cpp: Ditto.
+        * inspector/InspectorDatabaseResource.cpp: Ditto.
+        * inspector/InspectorFrontend.cpp: Ditto.
+        * inspector/InspectorResource.cpp: Ditto.
+        * inspector/InspectorTimelineAgent.cpp: Ditto.
+        * inspector/TimelineItem.cpp: Ditto.
+        * loader/FrameLoader.cpp: Use ENABLE(INSPECTOR) where applicable.
+        (WebCore::FrameLoader::detachFromParent):
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
+        (WebCore::FrameLoader::loadedResourceFromMemoryCache):
+        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
+        (WebCore::FrameLoader::dispatchDidCommitLoad):
+        (WebCore::FrameLoader::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::FrameLoader::dispatchWillSendRequest):
+        (WebCore::FrameLoader::dispatchDidReceiveResponse):
+        (WebCore::FrameLoader::dispatchDidReceiveContentLength):
+        (WebCore::FrameLoader::dispatchDidFinishLoading):
+        * page/Chrome.cpp: Ditto.
+        (WebCore::Chrome::mouseDidMoveOverElement):
+        * page/Console.cpp: Ditto.
+        (WebCore::Console::addMessage):
+        (WebCore::Console::count):
+        (WebCore::Console::profile):
+        (WebCore::Console::profileEnd):
+        (WebCore::Console::time):
+        (WebCore::Console::timeEnd):
+        (WebCore::Console::group):
+        (WebCore::Console::groupEnd):
+        * page/ContextMenuController.cpp: Ditto.
+        (WebCore::ContextMenuController::handleContextMenuEvent):
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * page/DOMWindow.cpp: Ditto.
+        (WebCore::DOMWindow::sessionStorage):
+        (WebCore::DOMWindow::localStorage):
+        * page/EventHandler.cpp: Ditto.
+        (WebCore::EventHandler::handleMousePressEvent):
+        * page/FrameView.cpp: Ditto.
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::paintContents):
+        * page/FrameView.h: Ditto.
+        * page/Page.cpp: Ditto.
+        (WebCore::Page::Page):
+        (WebCore::Page::~Page):
+        * page/Page.h: Ditto.
+        * platform/ContextMenu.cpp: Ditto.
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+        * platform/ContextMenuItem.h: Ditto.
+        (WebCore::):
+        * storage/Database.cpp: Ditto.
+        (WebCore::Database::openDatabase):
+        * workers/WorkerContext.cpp: Ditto.
+        (WebCore::WorkerContext::importScripts):
+        * xml/XMLHttpRequest.cpp: Ditto.
+        (WebCore::XMLHttpRequest::didFinishLoading):
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(CONTEXT_MENUS)
+        https://bugs.webkit.org/show_bug.cgi?id=29225
+
+        Reviewed by David Kilzer.
+
+        No new tests. (No change in default behavior.)
+
+        * DerivedSources.make: Use new WebCore.ContextMenus.exp file if ENABLE_CONTEXT_MENUS.
+        * WebCore.base.exp: Move ContextMenu only exports to WebCore.ContextMenus.exp.
+        * WebCore.xcodeproj/project.pbxproj: Add WebCore.ContextMenus.exp.
+        * dom/Node.cpp: Use ENABLE(CONTEXT_MENUS) where applicable.
+        (WebCore::Node::defaultEventHandler):
+        * loader/EmptyClients.h: Ditto.
+        * page/ContextMenuController.cpp: Wrap entire file in ENABLE(CONTEXT_MENUS).
+        * page/EventHandler.cpp: Use ENABLE(CONTEXT_MENUS) where applicable.
+        * page/EventHandler.h: Ditto.
+        * page/Page.cpp: Ditto.
+        (WebCore::Page::Page):
+        * page/Page.h: Ditto.
+        * page/mac/EventHandlerMac.mm: Ditto.
+        * page/mac/WebCoreViewFactory.h: Ditto.
+        * platform/ContextMenu.cpp: Wrap entire file in ENABLE(CONTEXT_MENUS).
+        * platform/LocalizedStrings.h: Use ENABLE(CONTEXT_MENUS) where applicable.
+        * platform/mac/ContextMenuItemMac.mm: Wrap entire file in ENABLE(CONTEXT_MENUS).
+        * platform/mac/ContextMenuMac.mm: Ditto.
+        * platform/mac/LocalizedStringsMac.mm: Use ENABLE(CONTEXT_MENUS) where applicable.
+        * svg/graphics/SVGImage.cpp: Ditto.
+        (WebCore::SVGImage::dataChanged):
+
+2009-09-16  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Clean up invalidation for repainting.  Hoist the dirty rect intersection test in ScrollViewMac up
+        into ScrollView so that all platforms do it.
+        
+        Patch deferred repaints in FrameView::repaintContentRectangle to only add the visible portion of
+        the rectangle for repainting.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::repaintContentRectangle):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::repaintContentRectangle):
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::platformRepaintContentRectangle):
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(DRAG_SUPPORT)
+        https://bugs.webkit.org/show_bug.cgi?id=29233
+
+        Reviewed by David Kilzer.
+
+        No new tests. (No change in default behavior.)
+
+        * DerivedSources.make: Use new WebCore.DragSupport.exp file if ENABLE_DRAG_SUPPORT.
+        * WebCore.base.exp: Move Drag Support only exports to WebCore.DragSupport.exp.
+        * WebCore.xcodeproj/project.pbxproj: Add WebCore.DragSupport.exp.
+        * dom/Clipboard.h: Use ENABLE(DRAG_SUPPORT) where applicable.
+        * loader/EmptyClients.h: Ditto.
+        * page/DragController.cpp: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * page/EventHandler.cpp: Use ENABLE(DRAG_SUPPORT) where applicable.
+        (WebCore::EventHandler::EventHandler):
+        (WebCore::EventHandler::clear):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseReleaseEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        * page/EventHandler.h: Ditto.
+        * page/Page.cpp: Ditto.
+        (WebCore::Page::Page):
+        * page/Page.h: Ditto.
+        * page/mac/DragControllerMac.mm: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * page/mac/EventHandlerMac.mm: Use ENABLE(DRAG_SUPPORT) where applicable.
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+        * platform/DragData.cpp: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * platform/DragImage.cpp: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * platform/mac/ClipboardMac.h: Use ENABLE(DRAG_SUPPORT) where applicable.
+        * platform/mac/ClipboardMac.mm: Ditto.
+        * platform/mac/DragDataMac.mm: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * platform/mac/DragImageMac.mm: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * rendering/RenderLayer.cpp: Use ENABLE(DRAG_SUPPORT) where applicable.
+        (WebCore::RenderLayer::autoscroll):
+        * rendering/RenderObject.cpp: Ditto.
+        * rendering/RenderObject.h: Ditto.
+        * svg/graphics/SVGImage.cpp: Ditto.
+        (WebCore::SVGImage::dataChanged):
+
+2009-09-16  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxMSW build fix after adding support for high resolution times in Win.
+
+        * page/Settings.cpp:
+        * page/Settings.h:
+
+2009-09-16  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Added operator==() to event listeners. This fixes V8 bindings
+        build broken in http://trac.webkit.org/changeset/48402.
+        https://bugs.webkit.org/show_bug.cgi?id=29298
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener): Now
+        uses JSEventListenerType.
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::operator==): Only compares
+        pointers since we create at most one wrapper for a JS object.
+
+2009-09-16  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Crash when visiting http://flipper.googlelabs.com/
+        https://bugs.webkit.org/show_bug.cgi?id=29293
+
+        Check type for being null or empty before looking it up in the
+        hash of supported types.
+
+        Tested by http/tests/loading/redirect-with-no-location-crash.html
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType):
+
+2009-09-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Removed the notion of "disconnected nodes with event listeners" because
+        it was vestigial. The reference cycle it tried to solve was solved another
+        way in https://bugs.webkit.org/show_bug.cgi?id=21260.
+
+        * dom/Document.cpp:
+        (WebCore::Document::removeAllEventListeners):
+        * dom/Document.h:
+        * dom/Node.cpp:
+        (WebCore::Node::~Node):
+        (WebCore::Node::insertedIntoDocument):
+        (WebCore::Node::removedFromDocument):
+        (WebCore::Node::willMoveToNewOwnerDocument):
+        (WebCore::Node::didMoveToNewOwnerDocument):
+        (WebCore::Node::addEventListener):
+        (WebCore::Node::removeEventListener):
+        (WebCore::Node::clearAttributeEventListener):
+
+2009-09-15  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        WAI-ARIA: add support for ranges, including the progressbar, slider, and spinbutton roles
+        https://bugs.webkit.org/show_bug.cgi?id=28841
+
+        Allow certain ARIA roles to change value with AXIncrement and AXDecrement. 
+        Consolidate increment/decrement/changeValue methods. 
+
+        Test: accessibility/aria-slider-value-change.html
+
+        * accessibility/AccessibilityObject.cpp:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::increment):
+        (WebCore::AccessibilityRenderObject::decrement):
+        (WebCore::AccessibilityRenderObject::changeValueByPercent):
+        (WebCore::AccessibilityRenderObject::setValue):
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/AccessibilitySlider.cpp:
+        * accessibility/AccessibilitySlider.h:
+        * dom/Element.cpp:
+        (WebCore::Element::updateAfterAttributeChanged):
+
+2009-09-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed the jsEventListeners set from JSDOMGlobalObject, to simplify
+        creation and destruction of JSDOMGlobalObject and event listeners.
+        
+        Added an abstract operator==() to EventListener, to replace the
+        jsEventListeners set's role in determining if two event listeners are
+        equal from the DOM's perspective.
+        
+        Added a type field to EventListener, and casting operations, to support
+        operator==() and other abstract operations.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSDesktopNotificationsCustom.cpp:
+        (WebCore::JSNotification::addEventListener):
+        (WebCore::):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::~JSEventListener):
+        (WebCore::JSEventListener::markJSFunction):
+        (WebCore::JSEventListener::handleEvent):
+        (WebCore::JSEventListener::reportError):
+        (WebCore::JSEventListener::operator==):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::cast):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/objc/ObjCEventListener.h:
+        (WebCore::ObjCEventListener::cast):
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::ObjCEventListener):
+        (WebCore::ObjCEventListener::operator==):
+        * dom/EventListener.h:
+        (WebCore::EventListener::):
+        (WebCore::EventListener::type):
+        (WebCore::EventListener::EventListener):
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::addEventListener):
+        (WebCore::MessagePort::removeEventListener):
+        * dom/Node.cpp:
+        (WebCore::Node::removeEventListener):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::mainFrameDocument):
+        (WebCore::InspectorDOMAgent::operator==):
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::InspectorDOMAgent::cast):
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::cast):
+        (WebCore::ImageEventListener::ImageEventListener):
+        (WebCore::ImageEventListener::operator==):
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::addEventListener):
+        (WebCore::DOMApplicationCache::removeEventListener):
+        * notifications/Notification.cpp:
+        (WebCore::Notification::removeEventListener):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::removeEventListener):
+        * page/EventSource.cpp:
+        (WebCore::EventSource::addEventListener):
+        (WebCore::EventSource::removeEventListener):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::cast):
+        (WebCore::ConditionEventListener::ConditionEventListener):
+        (WebCore::ConditionEventListener::operator==):
+        (WebCore::ConditionEventListener::handleEvent):
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::addEventListener):
+        (WebCore::AbstractWorker::removeEventListener):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::addEventListener):
+        (WebCore::WorkerContext::removeEventListener):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::addEventListener):
+        (WebCore::XMLHttpRequest::removeEventListener):
+        * xml/XMLHttpRequestUpload.cpp:
+        (WebCore::XMLHttpRequestUpload::addEventListener):
+        (WebCore::XMLHttpRequestUpload::removeEventListener):
+
+2009-09-15  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Added ENABLE_MATHML to feature defines
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-09-14  Andrew Richards  <randrew@gmail.com>
+
+        Reviewed by Sam Weinig.
+
+        Document.elementFromPoint() and Document.caretRangeFromPoint() erroneously returning null at points visible only after scrolling.
+        https://bugs.webkit.org/show_bug.cgi?id=29245
+
+        Use visibleContentRect() instead of boundsRect() when checking hit point bounds on viewport.
+
+        * dom/Document.cpp:
+        (WebCore::Document::elementFromPoint):
+        (WebCore::Document::caretRangeFromPoint):
+
+2009-09-15  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Eric Seidel
+
+        http://bugs.webkit.org/show_bug.cgi?id=26660
+
+        Chromium Windows: When rotated, the baseline for a span of complex
+        script is completely misaligned with that of the adjacent 
+        simple script text. It's fixed by not applying the baseline offset for
+        the Skia code path.
+
+        Test: transforms/2d/hindi-rotated.html
+
+        * platform/graphics/chromium/UniscribeHelper.cpp:
+        (WebCore::UniscribeHelper::draw):
+
+2009-09-15  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Pass the PopupMenu pointer to CreateWindowEx and then get it from the LPCREATESTRUCT in
+        the WM_CREATE handler. This way we don't have to first create an zero size window and then size it.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::PopupMenuWndProc):
+
+2009-09-15  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Darin Adler.
+
+        MessageEvent should not be cancelable by default
+        https://bugs.webkit.org/show_bug.cgi?id=27846
+
+        * dom/MessageEvent.cpp:
+        (WebCore::MessageEvent::MessageEvent):
+        Changed constructor to set cancelable=false by default, per the HTML5 spec.
+
+2009-09-15  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by George Staikos.
+
+        Fix SVG path parsing error if a command starts with dot '.'
+        https://bugs.webkit.org/show_bug.cgi?id=29123
+
+        * svg/SVGParserUtilities.cpp:
+        (WebCore::SVGPathParser::parseSVG):
+
+2009-09-15  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Implement conditional breakpoints in the Web Inspector frontend.
+        https://bugs.webkit.org/show_bug.cgi?id=28908
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/Breakpoint.js:
+        (WebInspector.Breakpoint.prototype.set condition):
+        * inspector/front-end/Popup.js: Added.
+        (WebInspector.Popup):
+        (WebInspector.Popup.prototype.show):
+        (WebInspector.Popup.prototype.hide):
+        (WebInspector.Popup.prototype.get visible):
+        (WebInspector.Popup.prototype.set element):
+        (WebInspector.Popup.prototype.get element):
+        (WebInspector.Popup.prototype.positionElement):
+        (WebInspector.Popup.prototype.set anchor):
+        (WebInspector.Popup.prototype.get anchor):
+        (WebInspector.Popup.prototype.set autoHide):
+        (WebInspector.Popup.prototype._checkNotVisible):
+        (WebInspector.Popup.prototype._keyEventHandler):
+        (WebInspector.Popup.prototype._mouseDownEventHandler):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.revealLine):
+        (WebInspector.SourceFrame.prototype._loaded):
+        (WebInspector.SourceFrame.prototype._documentContextMenu):
+        (WebInspector.SourceFrame.prototype._documentMouseDown):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition.committed):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition.dismissed):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition):
+        (WebInspector.SourceFrame.prototype._showBreakpointConditionPopup):
+        (WebInspector.SourceFrame.prototype._createPopupElement):
+        (WebInspector.SourceFrame.prototype._addBreakpointToSource):
+        (WebInspector.SourceFrame.prototype._removeBreakpointFromSource):
+        (WebInspector.SourceFrame.prototype._drawBreakpointImagesIfNeeded.drawBreakpoint):
+        (WebInspector.SourceFrame.prototype._drawBreakpointImagesIfNeeded):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.set currentFocusElement):
+        (WebInspector.set currentPanel):
+        (WebInspector.loaded):
+        (WebInspector.contextMenu):
+        (WebInspector.elementDragStart):
+        (WebInspector.updateResource):
+        (WebInspector.drawLoadingPieChart):
+        (WebInspector.linkifyURLAsNode):
+        (WebInspector.startEditing.getContent):
+        (WebInspector.startEditing.editingCancelled):
+        (WebInspector.startEditing.editingCommitted):
+        * inspector/front-end/utilities.js:
+        (Element.prototype.positionAt):
+        (Element.prototype.offsetRelativeToWindow):
+
+2009-09-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Page cache should support pages with unload handlers as an experiment.
+        <rdar://problem/7196485> and https://bugs.webkit.org/show_bug.cgi?id=29021
+
+        For the experiment, only allow pages with unload handlers into the Page Cache on
+        Mac and Windows.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+
+2009-09-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the change in r48376 to do a null-check to fix a crashing test.
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+
+2009-09-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7047282> Safari crashes at WebCore::RenderMenuList::adjustInnerStyle() + 436
+        
+        Avoid a crash when a mouse event handler on a <select> changes the select from a popup
+        to a list (by setting the 'size' property) inside the event handler.
+
+        Test: fast/forms/select-change-popup-to-listbox-in-event-handler.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+
+2009-09-14  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        More PopupMenu cleanup.
+        
+        * platform/PopupMenu.h:
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        Call registerClass.
+        
+        (WebCore::PopupMenu::registerClass):
+        Make this a private static member function so it can refer to PopupMenuWndProc.
+        
+        (WebCore::PopupMenu::PopupMenuWndProc):
+        Try to get the PopupMenu and call its wndProc member function.
+        
+        (WebCore::PopupMenu::wndProc):
+        Make this a member function.
+
+2009-09-14  Brady Eidson  <beidson@apple.com>
+
+        Not reviewed, maybe should've been:
+
+        Cleaning up more Windows-specific fallout from the fix for:
+        <rdar://problem/7174050> and https://bugs.webkit.org/show_bug.cgi?id=29160
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::WebCoreSynchronousLoader::load): Don't allow empty CFStrings as the stored credentials,
+          as related checks all look at nullity when they really mean to be looking for emptiness. 
+
+2009-09-14  Anders Carlsson  <andersca@apple.com>
+
+        Speculative Qt build fix.
+        
+        * platform/qt/QWebPopup.cpp:
+        (WebCore::QWebPopup::hidePopup):
+
+2009-09-14  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix RenderThemeChromiumWin::determineClassicState so that classic_state
+        matches the state values (and you get a single classic_state value
+        for a given {part,state} value. This change will be tested by a 
+        chromium patch that will land after this.
+
+        This will be tested by code landing downstream on Chromium.org; the
+        code does not execute on webkit.org.
+
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::determineClassicState):
+        (WebCore::RenderThemeChromiumWin::getThemeData):
+
+2009-09-14  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29138
+        Simplify popup menu handling.
+
+        * platform/PopupMenuClient.h:
+        Rename hidePopup to popupDidHide.
+        
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::handleKeyEvent):        
+        (WebCore::PopupListBox::abandon):
+        (WebCore::PopupListBox::acceptIndex):
+        Call popupDidHide instead of hidePopup.
+        
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenu::menuUnmapped):
+        Ditto.
+        
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenu::show):
+        Ditto.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::hide):
+        Call popupDidHide.
+        
+        (WebCore::PopupWndProc):
+        Call PopupMenu::hide.
+        
+        * platform/wx/PopupMenuWx.cpp:
+        (WebCore::PopupMenu::OnMenuItemSelected):
+        Call popupDidHide.
+        
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::hidePopup):
+        (WebCore::RenderMenuList::popupDidHide):
+        * rendering/RenderMenuList.h:
+        Set the "popup is visible" flag in popupDidHide.
+        
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::hidePopup):
+        (WebCore::RenderTextControlSingleLine::popupDidHide):
+        * rendering/RenderTextControlSingleLine.h:
+        Ditto.
+
+2009-09-14  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by David Hyatt.
+
+        - Fix <rdar://problem/7182275>.
+
+        Make sure that the newly created scrollbar's style is up to date.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::~PopupMenu):
+        Call setParent so that the scrollbar's parts are torn down correctly.
+        
+        (WebCore::PopupMenu::show):
+        Call styleChanged.
+
+2009-09-11  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://problem/7197644> WebKit should broadcast an MSAA event when
+        jumping to a named anchor
+
+        https://bugs.webkit.org/show_bug.cgi?id=28899
+
+        Reviewed by Adam Roben.
+
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::):
+        Added declaration for handleScrolledToAnchor(). Added a new entry to
+        the enum of accessibility notifications.
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::firstAccessibleObjectFromNode):
+        Code moved from AccessibilityRenderObject::internalLinkElement() and
+        refactored slightly; walks the tree until it finds a Node (with a
+        renderer) whose accessibility is not ignored.
+
+        * accessibility/AccessibilityObject.h:
+        Added a declaration for firstAccessibleObjectFromNode().
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::internalLinkElement):
+        Code moved to AccessibilityObject::firstAccessibleObjectFromNode().
+
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::handleScrolledToAnchor):
+        Stubbed.
+
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::handleScrolledToAnchor):
+        Stubbed.
+
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        Add a default case that returns early for notifications that Mac
+        doesn't handle.
+        (WebCore::AXObjectCache::handleScrolledToAnchor):
+        Stubbed.
+
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::handleScrolledToAnchor):
+        Post an AXScrolledToAnchor notification for the first accessible from
+        the anchor Node.
+        (WebCore::AXObjectCache::postPlatformNotification):
+        If the notification is AXFocusedUIElementChanged, fire an
+        EVENT_OBJECT_FOCUS. If the notification is AXScrolledToAnchor, fire
+        EVENT_SYSTEM_SCROLLINGSTART, matching Firefox.
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        Code moved to postPlatformNotification().
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollToAnchor):
+        Call AXObjectCache::handleScrolledToAnchor().
+
+2009-09-14  Anthony Ricaud  <rik@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Cookies are not inspectable after reloading a page
+        https://bugs.webkit.org/show_bug.cgi?id=29222
+
+        Create the cookieTreeElement on initialization instead of when the view is shown.
+        Reset the selected element of the sidebar on reset.
+
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel):
+        (WebInspector.StoragePanel.prototype.show):
+        (WebInspector.StoragePanel.prototype.reset):
+
+
+2009-09-14  Brady Eidson  <beidson@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::receivedCredential):
+        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge):
+        (WebCore::WebCoreSynchronousLoader::load):
+
+2009-09-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Safari 4 cannot be used to update firmware on Linksys routers.
+        <rdar://problem/7174050> and https://bugs.webkit.org/show_bug.cgi?id=29160
+
+        In http://trac.webkit.org/changeset/42483, we disabled CFNetwork's session credential storage and 
+        implemented our own in WebCore.
+
+        One feature we lost is that CFNetwork would automatically send previously authenticated credentials
+        with new connections when the paths match, as allowed by RFC 2617 for HTTP Basic and Digest Authentication.  
+
+        Even though it's optional for User Agents to do this, (some?) Linksys routers rely on this behavior for
+        HTTP Basic Authentication.  So now WebCore's CredentialStorage will track URL paths for Basic credentials.
+
+        We're not making this enhancement for Digest at this time, since we don't know of anything that broke
+        due to the change in Digest behavior.
+
+        Test: http/tests/loading/basic-credentials-sent-automatically.html
+              http/tests/loading/basic-auth-resend-wrong-credentials.html
+
+        * WebCore.base.exp:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        * platform/network/Credential.cpp:
+        (WebCore::Credential::isEmpty):
+        * platform/network/Credential.h:
+
+        Add a slightly more full featured CredentialStore that will track URL paths a credential belongs to:
+        * platform/network/CredentialStorage.cpp: Added.
+        (WebCore::protectionSpaceToCredentialMap):
+        (WebCore::originToDefaultCredentialMap):
+        (WebCore::originStringFromURL):
+        (WebCore::CredentialStorage::set):
+        (WebCore::CredentialStorage::get):
+        (WebCore::CredentialStorage::getDefaultAuthenticationCredential):
+        * platform/network/CredentialStorage.h: Added.
+
+        Allow ProtectionSpace to be a hash key:
+        * platform/network/ProtectionSpace.cpp:
+        (WebCore::ProtectionSpace::ProtectionSpace):
+        * platform/network/ProtectionSpace.h:
+        (WebCore::ProtectionSpace::ProtectionSpace):
+        (WebCore::ProtectionSpace::isHashTableDeletedValue):
+        * platform/network/ProtectionSpaceHash.h: Added.
+        (WebCore::ProtectionSpaceHash::hash):
+        (WebCore::ProtectionSpaceHash::equal):
+
+        Allow ResourceHandles to remember the initial credential they used:
+        * platform/network/ResourceHandleInternal.h:
+
+        Allow mutable ResourceRequests to update their platform object if HTTP header fields change:
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::addHTTPHeaderField):
+
+        Remove WebCoreCredentialStorage:
+        * platform/network/cf/AuthenticationCF.cpp:
+        * platform/network/cf/AuthenticationCF.h:
+        * platform/network/mac/AuthenticationMac.h:
+        * platform/network/mac/AuthenticationMac.mm:
+
+        Change ResourceHandleCFNet to try to use stored credentials on new connections, if appropriate:
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Only try the ProtectionSpace key'ed
+          Credential if it does not match the initially used Credential.
+        (WebCore::ResourceHandle::receivedCredential):
+        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge): Only try the ProtectionSpace key'ed
+          Credential if it does not match the initially used Credential.
+        (WebCore::WebCoreSynchronousLoader::load):
+
+        Change ResourceHandleMac to try to use stored credentials on new connections, if appropriate:
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Only try the ProtectionSpace key'ed
+          Credential if it does not match the initially used Credential.
+        (WebCore::ResourceHandle::receivedCredential):
+        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Only try the 
+          ProtectionSpace key'ed Credential if it does not match the initially used Credential.
+        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]):
+
+        Add base64-ability to CString:
+        * platform/text/CString.cpp:
+        (WebCore::CStringBuffer::base64Encode):
+        (WebCore::CString::base64Encode):
+        * platform/text/CString.h:
+        (WebCore::CStringBuffer::create):
+        (WebCore::CStringBuffer::CStringBuffer):
+
+2009-09-12  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix <rdar://problem/6954546> Crashes in WebCore::RenderPart::setWidget below FrameLoader::loadPlugin.
+
+        The calls to FrameLoader::requestObject within RenderPartObject::updateWidget can result in a plug-in
+        being initialized.  This can run cause arbitrary JavaScript to run and may result in the RenderPartObject
+        being detached from the render tree and destroyed, causing a crash like <rdar://problem/6954546>.
+
+        No test is possible until <rdar://problem/7090444> is fixed.
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::updateWidget): Ensure that we stay alive for the duration of plug-in initialization.
+
+2009-09-12  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Add RenderWidgetProtector to simplify protecting a RenderWidget from destruction for the
+        duration of a function.  Deploy it within RenderWidget.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::setWidgetGeometry):
+        (WebCore::RenderWidget::updateWidgetPosition): Use a RefPtr rather than explicitly
+        ref'ing and deref'ing the node.
+        * rendering/RenderWidget.h:
+        * rendering/RenderWidgetProtector.h:
+        (WebCore::RenderWidgetProtector::RenderWidgetProtector):
+        (WebCore::RenderWidgetProtector::~RenderWidgetProtector):
+
+2009-09-14  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        CodeGenerator.pm needs some cleaning up
+        https://bugs.webkit.org/show_bug.cgi?id=29238
+
+        * bindings/scripts/CodeGenerator.pm:
+        (FindParentsRecursively): Removed; its functionality is now handled in
+        AddMethodsConstantsAndAttributesFromParentClasses.
+        (ForAllParents): New function that visits an interface's ancestors and
+        invokes a callback for each one.
+        (AddMethodsConstantsAndAttributesFromParentClasses): Simplified by using
+        ForAllParents.
+        (GetMethodsAndAttributesFromParentClasses): Ditto.
+        (IDLFileForInterface): Factored out previous calls to ScanDirectory into
+        this new function, which returns the filename containing a given IDL
+        interface definition.
+        (ParseInterface): Simplified by using IDLFileForInterface.
+        (ScanDirectory): Removed in lieu of IDLFileForInterface.
+        * bindings/scripts/CodeGeneratorV8.pm: Drop call to
+        FindParentsRecursively and get the list of parents from the
+        AddMethodsConstantsAndAttributesFromParentClasses call instead.
+
+2009-09-14  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Assert hit when dropping a file in QtLauncher
+        https://bugs.webkit.org/show_bug.cgi?id=29242
+
+        Qt's implementation of DropData::asURL does not return a URL encoded string
+        as expected.
+
+        * platform/qt/DragDataQt.cpp:
+        (WebCore::DragData::asURL):
+
+2009-09-13  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, file was missed during TLS.cpp removal.
+
+        * page/wx/FrameWx.cpp: Added.
+        (WebCore::Frame::dragImageForSelection):
+
+2009-09-13  Anthony Ricaud  <rik@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Web Inspector: Add "New Style Rule" to the localizedStrings
+        https://bugs.webkit.org/show_bug.cgi?id=29237
+
+        * English.lproj/localizedStrings.js:
+
+2009-09-13  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Implement filesystem functions.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29196
+
+        * platform/wx/FileSystemWx.cpp:
+        (WebCore::fileExists):
+        (WebCore::deleteFile):
+        (WebCore::deleteEmptyDirectory):
+        (WebCore::getFileSize):
+        (WebCore::getFileModificationTime):
+        (WebCore::makeAllDirectories):
+        (WebCore::pathByAppendingComponent):
+        (WebCore::homeDirectoryPath):
+        (WebCore::directoryName):
+
+2009-09-12  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes for wx 2.9.
+
+        * platform/wx/ScrollbarThemeWx.cpp:
+        * platform/wx/wxcode/gtk/scrollbar_render.cpp:
+        (wxGetGdkWindowForDC):
+
+2009-09-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        [ES5] Implement Object.keys
+        https://bugs.webkit.org/show_bug.cgi?id=29170
+
+        Switch from getPropertyNames to getOwnPropertyNames, and provide custom
+        getPropertyNames to DOMWindow, DOMWindowShell and QuarantinedObjectWrapper
+        in order to ensure correct semantics are maintained.
+
+        Test: fast/js/Object-keys.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getOwnPropertyNames):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::getOwnPropertyNames):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::getOwnPropertyNames):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::getOwnPropertyNames):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::getPropertyNames):
+        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyNames):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::getOwnPropertyNames):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::getPropertyNames):
+        (JSC::RuntimeObjectImp::getOwnPropertyNames):
+        * bridge/runtime_object.h:
+
+2009-09-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29219
+        Document.elementFromPoint() should take page scroll into consideration
+
+        Test: fast/dom/elementFromPoint-relative-to-viewport.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::elementFromPoint):
+        (WebCore::Document::caretRangeFromPoint):
+
+2009-09-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29217
+        Document.caretRangeFromPoint should take the scroll offset into account before hit testing
+
+        In accordance with the CSSOM View Module spec, Document.caretRangeFromPoint should interpret
+        the point passed to it as relative to the viewport, not the document.
+
+        Test: fast/dom/Document/CaretRangeFromPoint/hittest-relative-to-viewport.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::caretRangeFromPoint):
+
+2009-09-11  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added some manual tests to show WebGL in action
+        https://bugs.webkit.org/show_bug.cgi?id=29215
+
+        * manual-tests/webgl: Added.
+        * manual-tests/webgl/Earth.html: Added.
+        * manual-tests/webgl/ManyPlanetsDeep.html: Added.
+        * manual-tests/webgl/SpinningBox.html: Added.
+        * manual-tests/webgl/TeapotPerPixel.html: Added.
+        * manual-tests/webgl/TeapotPerVertex.html: Added.
+        * manual-tests/webgl/resources: Added.
+        * manual-tests/webgl/resources/CanvasMatrix.js: Added.
+        * manual-tests/webgl/resources/earthmap1k.jpg: Added.
+        * manual-tests/webgl/resources/mars500x250.png: Added.
+        * manual-tests/webgl/resources/teapot.obj: Added.
+        * manual-tests/webgl/resources/utils3d.js: Added.
+ 
+2009-09-10  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        aria definition role spelled wrong "defintion"
+        https://bugs.webkit.org/show_bug.cgi?id=28840
+
+        Test: accessibility/aria-slider-value-change.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::RoleEntry::):
+
+2009-09-11  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fixes an assert in Node::isFocusable which was causing crashes in certain cases.
+        https://bugs.webkit.org/show_bug.cgi?id=29210
+
+        * dom/Node.cpp:
+        (WebCore::Node::isFocusable):
+
+2009-09-11  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added variants to uniform* and vertexAttrib* calls which take sequence<> in place of CanvasArray
+        https://bugs.webkit.org/show_bug.cgi?id=29139
+        
+        I also added a data() call to each of the CanvasArray subclasses to give back a types pointer
+        to the baseAddress().
+
+        * Configurations/FeatureDefines.xcconfig:
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        (WebCore::toArray):
+        (WebCore::):
+        (WebCore::dataFunctionf):
+        (WebCore::dataFunctioni):
+        (WebCore::dataFunctionMatrix):
+        (WebCore::JSCanvasRenderingContext3D::uniform1fv):
+        (WebCore::JSCanvasRenderingContext3D::uniform1iv):
+        (WebCore::JSCanvasRenderingContext3D::uniform2fv):
+        (WebCore::JSCanvasRenderingContext3D::uniform2iv):
+        (WebCore::JSCanvasRenderingContext3D::uniform3fv):
+        (WebCore::JSCanvasRenderingContext3D::uniform3iv):
+        (WebCore::JSCanvasRenderingContext3D::uniform4fv):
+        (WebCore::JSCanvasRenderingContext3D::uniform4iv):
+        (WebCore::JSCanvasRenderingContext3D::uniformMatrix2fv):
+        (WebCore::JSCanvasRenderingContext3D::uniformMatrix3fv):
+        (WebCore::JSCanvasRenderingContext3D::uniformMatrix4fv):
+        (WebCore::JSCanvasRenderingContext3D::vertexAttrib1fv):
+        (WebCore::JSCanvasRenderingContext3D::vertexAttrib2fv):
+        (WebCore::JSCanvasRenderingContext3D::vertexAttrib3fv):
+        (WebCore::JSCanvasRenderingContext3D::vertexAttrib4fv):
+        * html/canvas/CanvasByteArray.h:
+        (WebCore::CanvasByteArray::data):
+        * html/canvas/CanvasFloatArray.h:
+        (WebCore::CanvasFloatArray::data):
+        * html/canvas/CanvasIntArray.h:
+        (WebCore::CanvasIntArray::data):
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::uniform1fv):
+        (WebCore::CanvasRenderingContext3D::uniform1iv):
+        (WebCore::CanvasRenderingContext3D::uniform2fv):
+        (WebCore::CanvasRenderingContext3D::uniform2iv):
+        (WebCore::CanvasRenderingContext3D::uniform3fv):
+        (WebCore::CanvasRenderingContext3D::uniform3iv):
+        (WebCore::CanvasRenderingContext3D::uniform4fv):
+        (WebCore::CanvasRenderingContext3D::uniform4iv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix2fv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix3fv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix4fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib1fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib2fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib3fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib4fv):
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * html/canvas/CanvasShortArray.h:
+        (WebCore::CanvasShortArray::data):
+        * html/canvas/CanvasUnsignedByteArray.h:
+        (WebCore::CanvasUnsignedByteArray::data):
+        * html/canvas/CanvasUnsignedIntArray.h:
+        (WebCore::CanvasUnsignedIntArray::data):
+        * html/canvas/CanvasUnsignedShortArray.h:
+        (WebCore::CanvasUnsignedShortArray::data):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::uniform1fv):
+        (WebCore::GraphicsContext3D::uniform2fv):
+        (WebCore::GraphicsContext3D::uniform3fv):
+        (WebCore::GraphicsContext3D::uniform4fv):
+        (WebCore::GraphicsContext3D::uniform1iv):
+        (WebCore::GraphicsContext3D::uniform2iv):
+        (WebCore::GraphicsContext3D::uniform3iv):
+        (WebCore::GraphicsContext3D::uniform4iv):
+        (WebCore::GraphicsContext3D::uniformMatrix2fv):
+        (WebCore::GraphicsContext3D::uniformMatrix3fv):
+        (WebCore::GraphicsContext3D::uniformMatrix4fv):
+        (WebCore::GraphicsContext3D::vertexAttrib1fv):
+        (WebCore::GraphicsContext3D::vertexAttrib2fv):
+        (WebCore::GraphicsContext3D::vertexAttrib3fv):
+        (WebCore::GraphicsContext3D::vertexAttrib4fv):
+
+2009-09-11  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ENABLE(WEB_SOCKETS) guards.
+        https://bugs.webkit.org/show_bug.cgi?id=29174
+
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+
+2009-09-11  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r48229.
+        http://trac.webkit.org/changeset/48229
+
+        * WebCore.base.exp:
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::Clipboard):
+        (WebCore::Clipboard::sourceOperation):
+        * page/DragController.cpp:
+        (WebCore::DragController::DragController):
+        (WebCore::DragController::dragExited):
+        (WebCore::DragController::performDrag):
+        (WebCore::DragController::dragEnteredOrUpdated):
+        (WebCore::DragController::tryDHTMLDrag):
+        (WebCore::DragController::startDrag):
+        * page/DragController.h:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateDragAndDrop):
+        (WebCore::EventHandler::dragSourceMovedTo):
+        (WebCore::EventHandler::handleDrag):
+        * page/EventHandler.h:
+
+2009-09-11  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Fix the build.
+
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+
+2009-09-11  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Antti Koivisto.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27456
+        Added support for static validation of url in
+        ValidityState, for url state inputs.
+        From HTML5 specs:
+        http://www.whatwg.org/specs/web-apps/current-work/#url-state
+
+        Test: fast/forms/ValidityState-typeMismatch-url.html
+
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+
+2009-09-11  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Revert r47992: Expose functions to change the focus ring color for
+        Linux Chromium.
+
+        As Darin Fisher has pointed out, there is a better way to do this.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29207
+        Add checks for using WebCore JS context on secondary threads
+
+        * bindings/js/JSDOMWindowBase.cpp: (WebCore::JSDOMWindowBase::commonJSGlobalData):
+        Set the new debug-only mainThreadOnly flag.
+
+2009-09-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        The inspector should have scope bars.
+        https://bugs.webkit.org/show_bug.cgi?id=14353
+        
+        Add scope bars to the console, so the user can choose which category
+        of messages they want to see (All, Errors, Warnings, Logs), and they
+        can choose from one or more of {Errors, Warnings, Logs}.
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.createFilterElement):
+        (WebInspector.ConsoleView):
+        (WebInspector.ConsoleView.prototype._updateFilter):
+        (WebInspector.ConsoleView.prototype.filter):
+        (WebInspector.ConsoleView.prototype.attach):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-09-11  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Complex text doesn't show up with text stroking
+        https://bugs.webkit.org/show_bug.cgi?id=28707
+
+        Added extra NULL checks for HDC. This is the second fix for issue 28707,
+        and the fix is similar to http://trac.webkit.org/changeset/45482.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::drawComplexText):
+        * platform/graphics/chromium/UniscribeHelper.cpp:
+        (WebCore::UniscribeHelper::draw):
+
+2009-09-11  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Make ElementTimeControl methods return void and not throw.
+        https://bugs.webkit.org/show_bug.cgi?id=28831
+
+        SVG 1.1 erratum:
+        http://www.w3.org/2003/01/REC-SVG11-20030114-errata#elementtimecontrol-interface
+
+        Test: svg/dom/smil-methods.svg
+
+        * svg/ElementTimeControl.h: Change return type from bool to void and remove exception argument.
+        * svg/ElementTimeControl.idl: Change return type from bool to void and remove raises claus.
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::beginElement): Change return type from bool to void and remove exception argument.
+        (WebCore::SVGAnimationElement::beginElementAt): Ditto.
+        (WebCore::SVGAnimationElement::endElement): Ditto.
+        (WebCore::SVGAnimationElement::endElementAt): Ditto.
+        * svg/SVGAnimationElement.h: Ditto.
+
+2009-09-11  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added support for texImage2D which takes CanvasArray
+        https://bugs.webkit.org/show_bug.cgi?id=29191
+
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext3D::texImage2D):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::texImage2D):
+
+2009-09-11  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Allow WebKit clients to opt out of high resolution timers on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=29192
+
+        * page/Settings.cpp:
+        (WebCore::Settings::setShouldUseHighResolutionTimers): Added.
+        * page/Settings.h: Added getter/setter for shouldUseHighResolutionTimers.
+        (WebCore::Settings::shouldUseHighResolutionTimers): Added.
+        * platform/win/SharedTimerWin.cpp:
+        (WebCore::setSharedTimerFireTime): Don't run high resolution timer code if it is disabled.
+
+2009-09-11  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [v8] Share persistent context handles between events        
+        Change events to use a single ref-counted shared persistent handle
+        to the context in which to run, rather than create a new
+        persistent handle for each new event which puts pressure on the
+        gc.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=29077
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/SharedPersistent.h: Added.
+        (WebCore::SharedPersistent::set):
+        (WebCore::SharedPersistent::get):
+        (WebCore::SharedPersistent::disposeHandle):
+        (WebCore::SharedPersistent::create):
+        (WebCore::SharedPersistent::SharedPersistent):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        (WebCore::V8IsolatedWorld::~V8IsolatedWorld):
+        * bindings/v8/V8IsolatedWorld.h:
+        (WebCore::V8IsolatedWorld::context):
+        (WebCore::V8IsolatedWorld::shared_context):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::createWrapperFromCacheSlowCase):
+        (WebCore::V8Proxy::isContextInitialized):
+        (WebCore::V8Proxy::updateDocumentWrapperCache):
+        (WebCore::V8Proxy::clearDocumentWrapperCache):
+        (WebCore::V8Proxy::disposeContextHandles):
+        (WebCore::V8Proxy::clearForClose):
+        (WebCore::V8Proxy::clearForNavigation):
+        (WebCore::V8Proxy::setSecurityToken):
+        (WebCore::V8Proxy::updateDocument):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        (WebCore::V8Proxy::shared_context):
+        (WebCore::V8Proxy::mainWorldContext):
+        (WebCore::V8Proxy::setContextDebugId):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::context):
+        (WebCore::V8Proxy::shared_context):
+
+2009-09-11  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by David Levin.
+
+        Create a real handle (one which would save an object from GC).
+        https://bugs.webkit.org/show_bug.cgi?id=29150
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8ExternalString):
+
+2009-09-11  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by David Levin.
+
+        Inline WebCore::v8String as it only invokes WebCore::v8ExternalString.
+        https://bugs.webkit.org/show_bug.cgi?id=29152
+
+        * bindings/v8/V8Binding.cpp:
+        * bindings/v8/V8Binding.h:
+        (WebCore::v8String):
+
+2009-09-11  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Changed URLs from qtsoftware.com to qt.nokia.com, as part of a general
+        renaming.
+
+        * ChangeLog-2009-06-16:
+
+2009-09-11  Thiago Macieira  <thiago.macieira@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Use LIBS_PRIVATE on Qt/Mac.
+
+        On the Mac, it means "-framework ApplicationServices -framework Carbon
+        -framework AppKit" are no longer part of the default LIBS in Qt
+        applications. This required a lot of fixes where we used Mac-specific
+        code in Qt.
+
+        * WebCore.pro:
+
+2009-09-11  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Remove duplicated WK_{u,l}cfirst subs from CodeGeneratorV8.pm
+        https://bugs.webkit.org/show_bug.cgi?id=29165
+
+        * bindings/scripts/CodeGeneratorV8.pm: Remove WK_ucfirst and
+        WK_lcfirst, and call the ones in CodeGenerator.pm instead.
+
+2009-09-11  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29132
+        Symbian winscw compiler fails compiling WebCore/text/RegularExpression.cpp.
+
+        Add RegularExpression class qualifier before Private.
+
+        * platform/text/RegularExpression.cpp:
+
+2009-09-11  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29131
+        Use a different variadic macro format for Symbian compiler.
+        
+        Use arg... instead of ellipsis in variadic macro.        
+
+        * platform/StaticConstructors.h:
+
+2009-09-11  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28806
+
+        [Qt] Make the WebInspector available as a QWidget.
+
+        * WebCore.pro:
+
+2009-09-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed fix for the Web Inspector with the Qt build.
+
+        Re-generate the Qt resource file by running
+        WebKitTools/Scripts/generate-qt-inspector-resource
+
+        * inspector/front-end/WebKit.qrc:
+
+2009-09-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build, remove stray semicolon from function definition.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::buffered):
+
+2009-09-10  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Detect mixed content
+        https://bugs.webkit.org/show_bug.cgi?id=29003
+
+        Detect some basic kinds of mixed content (HTTP content loaded into an
+        HTTPS context).  This new detection logic isn't perfect, but it's a
+        place to start.
+
+        Tests: http/tests/security/mixedContent/about-blank-iframe-in-main-frame.html
+               http/tests/security/mixedContent/data-url-iframe-in-main-frame.html
+               http/tests/security/mixedContent/data-url-script-in-iframe.html
+               http/tests/security/mixedContent/insecure-css-in-iframe.html
+               http/tests/security/mixedContent/insecure-css-in-main-frame.html
+               http/tests/security/mixedContent/insecure-iframe-in-iframe.html
+               http/tests/security/mixedContent/insecure-iframe-in-main-frame.html
+               http/tests/security/mixedContent/insecure-image-in-iframe.html
+               http/tests/security/mixedContent/insecure-image-in-main-frame.html
+               http/tests/security/mixedContent/insecure-script-in-iframe.html
+               http/tests/security/mixedContent/redirect-http-to-https-iframe-in-main-frame.html
+               http/tests/security/mixedContent/redirect-http-to-https-script-in-iframe.html
+               http/tests/security/mixedContent/redirect-https-to-http-iframe-in-main-frame.html
+               http/tests/security/mixedContent/redirect-https-to-http-script-in-iframe.html
+
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::canRequest):
+        (WebCore::DocLoader::requestResource):
+        (WebCore::DocLoader::checkCacheObjectStatus):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::isMixedContent):
+        (WebCore::FrameLoader::checkIfDisplayInsecureContent):
+        (WebCore::FrameLoader::checkIfRunInsecureContent):
+        * loader/FrameLoader.h:
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::willSendRequest):
+
+2009-09-10  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Windows build.
+
+        Restore platform/mock to the header search path after it was removed in r48270.
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+
+2009-09-08  Timothy Hatcher  <timothy@apple.com>
+
+        Web Inspector: Move the option to create a new style rule under the Styles' gear menu.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29039
+
+        Reviewed by Sam Weinig.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane): Add "New Style Rule" option to the gear menu.
+        (WebInspector.StylesSidebarPane.prototype._update): Check instanceof BlankStylePropertiesSection instead.
+        (WebInspector.StylesSidebarPane.prototype._changeSetting): Added. Keeps the color format setting selected
+        while calling the correct action.
+        (WebInspector.StylesSidebarPane.prototype._createNewRule): Creates a new section and edits the selector.
+        (WebInspector.StylesSidebarPane.prototype.addBlankSection): Insert the section in a cleaner way.
+        (WebInspector.StylesSidebarPane.prototype.removeSection): Added. Removes the passed in section.
+        (WebInspector.StylesSidebarPane.prototype.appropriateSelectorForNode): Return an empty string if there is no node.
+        (WebInspector.StylePropertiesSection.prototype.expand): Removed the check for _blank.
+        (WebInspector.StylePropertiesSection.prototype.startEditingSelector): No need for the context, the original selector
+        is remembered by the editing code.
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCancelled): Do nothing. The original text is already
+        restored by the editing code.
+        (WebInspector.BlankStylePropertiesSection): Call the StylePropertiesSection constructor with appropriate data.
+        Remove event listener code.
+        (WebInspector.BlankStylePropertiesSection.prototype.expand): Added. Does nothing to prevent expanding.
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted.callback): Correctly construct the
+        WebInspector.CSSStyleDeclaration. Call editingSelectorCancelled instead of editingCancelled.
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted): Renamed from editingCommitted to
+        override the base class.
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCancelled): Remove the section.
+        (WebInspector.BlankStylePropertiesSection.prototype.makeNormal): Removed event listener code. Removed the delete lines
+        since they were doing nothing (deleting nonexistent properties that exist only on the prototype.) Change prototypes at
+        the end to correctly swtich to a real StylePropertiesSection.
+        * inspector/front-end/inspector.js:
+        (WebInspector.startEditing.editingCancelled): Ceck for null/undefined callbacks.
+        (WebInspector.startEditing.editingCommitted): Ditto.
+
+2009-09-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Fix comparison between signed and unsigned integer warnings
+        https://bugs.webkit.org/show_bug.cgi?id=29162
+
+        No functional change.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::findMethodIndex):
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedImageMIMETypes):
+        (WebCore::initializeSupportedImageMIMETypesForEncoding):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::duration):
+        (WebCore::ImageDecoderQt::imageAtIndex):
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::fetchInfo):
+
+2009-09-10  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Build fix for GTK+ after r48267.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::buffered):
+
+2009-09-08  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Remove unneeded define for ActiveX.
+        https://bugs.webkit.org/show_bug.cgi?id=29054
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::createClassIdToTypeMap):
+        (WebCore::serviceTypeForClassId):
+        (WebCore::RenderPartObject::updateWidget):
+
+2009-09-10  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Don't copy IDL files in to the built framework.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-10  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Implment Range.expand().
+        https://bugs.webkit.org/show_bug.cgi?id=27632
+
+        Test: fast/dom/Range/range-expand.html
+
+        * dom/Range.cpp:
+        (WebCore::Range::expand):
+        * dom/Range.h:
+        * dom/Range.idl:
+
+2009-09-10  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebSocket API implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=28038
+        
+        Add build systems for GNUmakefile.am, WebCore.xcodeproj and
+        WebCore.vcproj.
+        Add websockets directory and WebSocket.idl in qt build system.
+        Tests will be landed once the code is completed and functional.
+
+        * DerivedSources.cpp:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::webSocket):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toWebSocket):
+        * dom/EventTarget.h:
+        * page/DOMWindow.idl:
+        * websockets/WebSocket.cpp:
+        (WebCore::ProcessWebSocketEventTask::create):
+        (WebCore::ProcessWebSocketEventTask::performTask):
+        (WebCore::ProcessWebSocketEventTask::ProcessWebSocketEventTask):
+        (WebCore::isValidProtocolString):
+        (WebCore::WebSocket::connect):
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::close):
+        (WebCore::WebSocket::bufferedAmount):
+        (WebCore::WebSocket::addEventListener):
+        (WebCore::WebSocket::removeEventListener):
+        (WebCore::WebSocket::dispatchEvent):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+        (WebCore::WebSocket::dispatchOpenEvent):
+        (WebCore::WebSocket::dispatchMessageEvent):
+        (WebCore::WebSocket::dispatchCloseEvent):
+        * websockets/WebSocket.h:
+        (WebCore::WebSocket::create):
+        (WebCore::WebSocket::):
+        (WebCore::WebSocket::setOnopen):
+        (WebCore::WebSocket::onopen):
+        (WebCore::WebSocket::setOnmessage):
+        (WebCore::WebSocket::onmessage):
+        (WebCore::WebSocket::setOnclose):
+        (WebCore::WebSocket::onclose):
+        (WebCore::WebSocket::toWebSocket):
+        (WebCore::WebSocket::eventListeners):
+        (WebCore::WebSocket::refEventTarget):
+        (WebCore::WebSocket::derefEventTarget):
+        * websockets/WebSocketChannel.cpp: Added.
+        * websockets/WebSocketChannel.h: Added.
+        * websockets/WebSocketChannelClient.h: Added.
+        * websockets/WebSocketHandshake.cpp: Added.
+        * websockets/WebSocketHandshake.h: Added.
+
+2009-09-10  Albert J. Wong  <ajwong@chromium.org>
+
+        No review, windows build fix only.
+        
+        Spurious semicolon causing parse error in chromium build on windows.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::buffered):
+
+2009-09-10  Albert J. Wong  <ajwong@chromium.org>
+
+        No review, build fix only.
+
+        Adding in a missed include from the last patch that is breaking the
+        chromium build.
+
+        * rendering/RenderThemeChromiumMac.mm: include TimeRanges.h
+
+2009-09-10  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        HTMLMediaElement buffered attribute should report a list of time ranges
+        https://bugs.webkit.org/show_bug.cgi?id=29041
+
+        Changed MediaPlayerPrivateInterface and MediaPlayer's definition to
+        report a list of buffered time ranges as WebCore::TimeRanges. This
+        change also got rid of the maxTimeBuffered() method.
+
+        No new tests since this is a API change.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::percentLoaded):
+        Use MediaPlaier::buffered() instead of maxTimeBuffered().
+        (WebCore::HTMLMediaElement::buffered):
+        ditto.
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::buffered):
+        Use MediaPlayerPrivateInterface::buffered() instead of maxTimeBuffered().
+        (WebCore::MediaPlayer::buffered):
+        ditto.
+        * platform/graphics/MediaPlayer.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/MediaPlayerPrivate.h:
+        ditto.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        Implements PassRefPtr<TimeRanges> buffered();
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::buffered):
+        Implementation of buffered().
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        Implements PassRefPtr<TimeRanegs> buffered().
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        Implements PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/wince/MediaPlayerPrivateWince.h:
+        ditto.
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+        Use buffered() instead of maxTimeBuffered().
+        * rendering/RenderThemeChromiumSkia.cpp:
+        ditto.
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMediaSliderTrack):
+        ditto.
+
+2009-09-10  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Make bindings generators more aware of IDL dependencies
+        https://bugs.webkit.org/show_bug.cgi?id=29114
+
+        Make the JS and ObjC bindings generators able to output dependency
+        rules for DerivedSources.make to consume.  These rules make a given
+        generated binding class file header, JSWhatever.h, depend on Whatever's
+        ancestor interfaces.
+
+        * DerivedSources.make: Pass --write-dependencies to generate-bindings.pl
+        when generating JS and ObjC bindings.  Include dependency fies that are
+        generated due to that.
+        * bindings/scripts/CodeGenerator.pm: Make
+        AddMethodsConstantsAndAttributesFromParentClasses accumulate a list of
+        the ancestor interfaces that were visited.
+        * bindings/scripts/CodeGeneratorJS.pm: Optionally write out a dependency
+        file.
+        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
+        * bindings/scripts/generate-bindings.pl: Add a --write-dependencies
+        option.
+
+2009-09-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez and Dan Winship.
+
+        Give all requests to libsoup, to let it queue, and schedule them
+        itself, instead of throttling the number of requests in WebCore.
+
+        * platform/network/ResourceRequestBase.cpp:
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::initializeMaximumHTTPConnectionCountPerHost):
+
+2009-09-10  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Make XMLHttpRequest.send handle File object.
+        https://bugs.webkit.org/show_bug.cgi?id=28924
+
+        Test: http/tests/local/send-dragged-file.html
+
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-09-10  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Use fastNew and fastDelete instead of operator new and delete for CSSSelector class. 
+        https://bugs.webkit.org/show_bug.cgi?id=25930
+
+        Change using of operator new to fastNew and operator delete to
+        fastDeleteSkippingDestructor for CSSSelector class to avoid mismatched function call.
+
+        This change fixes valgrind's 'mismatched free' notification.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::~CSSParser):
+        (WebCore::CSSParser::createFloatingSelector):
+        * css/CSSSelectorList.cpp:
+        (WebCore::CSSSelectorList::adoptSelectorVector):
+
+2009-09-10  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Geolocation does not correctly handle reentrant calls from callbacks.
+        https://bugs.webkit.org/show_bug.cgi?id=29040
+
+        Tests: fast/dom/Geolocation/reentrant-error.html
+               fast/dom/Geolocation/reentrant-success.html
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::handleError): Modified. Call sendError directly, clearing notifier lists before making callback.
+        (WebCore::Geolocation::makeSuccessCallbacks): Modified. Call sendPosition directly, clearing notifier lists before making callback.
+        * page/Geolocation.h: Modified. Deleted sendErrorToXX and sendPositionToXXX methods.
+
+2009-09-10  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fixes issue where focused elements did not get blur and focus events when the window was blurred and focused.
+        https://bugs.webkit.org/show_bug.cgi?id=27105
+
+        Test: fast/events/blur-focus-window-should-blur-focus-element.html
+
+        * page/FocusController.cpp:
+        (WebCore::dispatchEventsOnWindowAndFocusedNode):
+        (WebCore::FocusController::setFocused):
+        (WebCore::FocusController::setActive):
+
+2009-09-10  Adam Roben  <aroben@apple.com>
+
+        Make the play/pause button in <video> controls indicate the button's
+        action, not the movie state
+
+        This matches the Mac behavior, iTunes, and many other media players.
+
+        No test possible.
+
+        Fixes <http://webkit.org/b/29126> Play/pause button in <video>
+        controls shows the wrong image
+
+        Reviewed by Eric Carlson.
+
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart): Reversed when
+        we show the play vs. pause artwork, so that the button reflects what
+        will happen when you click it, rather than the current state of the
+        movie.
+
+2009-09-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Geolocation Coordinates::toString() prints bogus values for unspecified properties.
+        https://bugs.webkit.org/show_bug.cgi?id=29080
+
+        Test: fast/dom/Geolocation/position-string.html
+
+        * GNUmakefile.am: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCore.gypi: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCore.pro: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCore.vcproj/WebCore.vcproj: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCore.xcodeproj/project.pbxproj: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCoreSources.bkl: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * page/Coordinates.cpp: Removed.
+        * page/Coordinates.h: Modified. Removes toString method.
+        * page/Coordinates.idl: Modified. Removes toString method.
+        * page/Geoposition.cpp: Removed.
+        * page/Geoposition.h: Modified. Removes toString method.
+        * page/Geoposition.idl: Modified. Removes toString method.
+
+2009-09-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Correctly applies the Geolocation timeout property.
+        https://bugs.webkit.org/show_bug.cgi?id=27256
+
+        If a timeout is specified, the timer is started as soon as the location acquistion process starts.
+        If a position fix is not obtained within the timeout interval, the position request is cancelled
+        and the error callback (if specified) is invoked. If a position fix is obtained within the timeout
+        interval, the timer is stopped. Permissions are then requested from the user if required. See
+        http://www.w3.org/TR/geolocation-API/#position-options.
+
+        Note that this logic means that the time required to obtain permissions from the user is not
+        included in the timeout interval.
+
+        Tests: fast/dom/Geolocation/timeout.html
+               fast/dom/Geolocation/timeout-zero.html
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::GeoNotifier::GeoNotifier): Modified. Takes Geolocation object as parameter.
+        (WebCore::Geolocation::GeoNotifier::hasZeroTimeout): Added. Determines whether this request has a zero timeout.
+        (WebCore::Geolocation::GeoNotifier::startTimerIfNeeded): Renamed from startTimer. Starts the timer if a timeout was specified.
+        (WebCore::Geolocation::GeoNotifier::timerFired): Modified. Calls the error callback if specified, and reports the timeout to the Geolocation object.
+        (WebCore::Geolocation::getCurrentPosition): Modified. Calls maybeStartTimer when starting the location acquisition process.
+        (WebCore::Geolocation::watchPosition): Modified. Calls maybeStartTimer when starting the location acquisition process.
+        (WebCore::Geolocation::requestTimedOut): Added. Cancels a request when it times out.
+        (WebCore::Geolocation::setIsAllowed): Modified. No longer starts timers.
+        (WebCore::Geolocation::sendPosition): Modified. No longer stops timers.
+        (WebCore::Geolocation::stopTimer): Added. Stops the timers for a vector of notifiers.
+        (WebCore::Geolocation::stopTimersForOneShots): Added. Stops the timers for all one-shots.
+        (WebCore::Geolocation::stopTimersForWatchers): Added. Stops the timers for all watchers.
+        (WebCore::Geolocation::stopTimers): Added. Stops the timers for all requests.
+        (WebCore::Geolocation::geolocationServicePositionChanged): Modfified. Stops the timers for all requests.
+        * page/Geolocation.h: Modified.
+        (WebCore::Geolocation::GeoNotifier::create): Modified. Takes Geolocation object as parameter.
+
+2009-09-09  Chris Fleizach  <cfleizach@apple.com>
+
+        AX notifications should be an ENUM type instead of strings
+        https://bugs.webkit.org/show_bug.cgi?id=28963
+
+        Build fix for Qt.
+
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::postNotification):
+        (WebCore::AXObjectCache::postPlatformNotification):
+
+2009-09-08  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        AX notifications should be an ENUM type instead of strings
+        https://bugs.webkit.org/show_bug.cgi?id=28963
+
+        Moves AX notifications over to an ENUM type instead of
+        using the actual string values that are used on OS X.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::postNotification):
+        (WebCore::AXObjectCache::selectedChildrenChanged):
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::handleActiveDescendantChanged):
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        * dom/Element.cpp:
+        (WebCore::Element::updateAfterAttributeChanged):
+        * editing/Editor.cpp:
+        (WebCore::Editor::respondToChangedContents):
+        * editing/mac/SelectionControllerMac.mm:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setChecked):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setInnerTextValue):
+
+2009-09-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Missing checkout for getSVGDocument()
+        https://bugs.webkit.org/show_bug.cgi?id=29064
+
+        The V8 code generator didn't understand SVGCheckSecurityDocument.
+
+        Tests: http/tests/security/xss-DENIED-getSVGDocument-iframe.html
+               http/tests/security/xss-DENIED-getSVGDocument-object.html
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-09-09  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Make SVGStyleElement inherit from SVGLangSpace
+        https://bugs.webkit.org/show_bug.cgi?id=29058
+
+        Required by SVG 1.1 Second Edition:
+        http://dev.w3.org/SVG/profiles/1.1F2/publish/styling.html#InterfaceSVGStyleElement
+
+        Test: svg/dom/SVGStyleElement/style-langspace.html
+
+        * svg/SVGStyleElement.cpp: Drop methods xmlspace and setXmlspace.
+        (WebCore::SVGStyleElement::SVGStyleElement): Add SVGLangSpace()
+        initializer.
+        (WebCore::SVGStyleElement::parseMappedAttribute): Call
+        parseMappedAttribute on SVGLangSpace.
+        * svg/SVGStyleElement.h: Drop xmlspace and setXmlspace declarations.
+        * svg/SVGStyleElement.idl: Drop xmlspace attribute and add SVGLangSpace
+        as a superinterface.
+
+2009-09-09  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by David Levin.
+
+        Remove unnecessary includes and forward declarations in V8Proxy.h
+
+        https://bugs.webkit.org/show_bug.cgi?id=29111
+
+        * bindings/v8/V8Proxy.h:
+
+2009-07-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Add more position constructors
+        positionBeforeNode, positionAfterNode
+        firstPositionInNode, lastPositionInNode
+        https://bugs.webkit.org/show_bug.cgi?id=25494
+
+        I also added a lastOffsetInNode and deployed it to a couple places.
+
+        There are no callers to these new constructors yet, but those
+        will be coming in future patches.
+
+        * dom/Position.cpp:
+        (WebCore::Position::computeOffsetInContainerNode):
+        * dom/Position.h:
+        (WebCore::positionBeforeNode):
+        (WebCore::positionAfterNode):
+        (WebCore::lastOffsetInNode):
+        (WebCore::firstPositionInNode):
+        (WebCore::lastPositionInNode):
+        * editing/ApplyStyleCommand.cpp:
+        * editing/TextIterator.cpp:
+        (WebCore::SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator):
+        * editing/htmlediting.cpp:
+        (WebCore::lastOffsetForEditing):
+
+2009-04-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename positionBeforeNode to positionInParentBeforeNode
+        and positionAfterNode to positionInParentAfterNode
+        in preparation for adding a positionBeforeNode
+        which returns a neighbor-anchored position.
+        https://bugs.webkit.org/show_bug.cgi?id=25494
+
+        No functional changes, thus no tests.
+
+        * dom/PositionConstructors.h:
+        (WebCore::positionInParentBeforeNode):
+        (WebCore::positionInParentAfterNode):
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::operator Position):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyInlineStyle):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::positionOutsideTabSpan):
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph):
+        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary):
+        * editing/CreateLinkCommand.cpp:
+        (WebCore::CreateLinkCommand::doApply):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::DeleteButtonController::deleteTarget):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::initializeStartEnd):
+        (WebCore::updatePositionForNodeRemoval):
+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::doApply):
+        * editing/InsertListCommand.cpp:
+        (WebCore::InsertListCommand::doApply):
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::input):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::positionAtStartOfInsertedContent):
+        (WebCore::ReplaceSelectionCommand::doApply):
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries):
+        * editing/htmlediting.cpp:
+        (WebCore::firstEditablePositionAfterPositionInRoot):
+        (WebCore::lastEditablePositionBeforePositionInRoot):
+        (WebCore::rangeCompliantEquivalent):
+        (WebCore::positionBeforeContainingSpecialElement):
+        (WebCore::positionAfterContainingSpecialElement):
+        (WebCore::positionBeforeTabSpan):
+
+2009-04-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Re-organize position creation functions in preparation for adding more
+        https://bugs.webkit.org/show_bug.cgi?id=25494
+
+        Make position functions inline to avoid ref-churn.
+        Remove startPosition/endPosition as they were only used in one place.
+
+        No functional changes, thus no tests.
+
+        * dom/Position.cpp:
+        * dom/Position.h:
+        (WebCore::positionBeforeNode):
+        (WebCore::positionAfterNode):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::moveTo):
+        * editing/TypingCommand.cpp:
+        * editing/htmlediting.cpp:
+        * editing/htmlediting.h:
+        (WebCore::firstDeepEditingPositionForNode):
+        (WebCore::lastDeepEditingPositionForNode):
+        * rendering/RenderObject.cpp:
+
+2009-09-09  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+        
+        [wx] Add wxSize conversions for IntSize.
+        https://bugs.webkit.org/show_bug.cgi?id=29104
+
+        * platform/graphics/IntSize.h:
+        * platform/graphics/wx/IntSizeWx.cpp: Added.
+        (WebCore::IntSize::IntSize):
+        (WebCore::IntSize::operator wxSize):
+
+2009-09-09  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by David Levin.
+        
+        Chromium uses its own config.h file that was forked from webkit's config.h.
+        By merging in Chromium's defines, Chromium would again be able to use webkit's
+        config.h.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28882 
+
+        * config.h: Added chromium-specific defines. 
+
+2009-09-09  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Initialize DataTransfer's effectAllowed and dropEffect properties correctly
+        according to HTML5 spec (sec. 7.9.2-7.9.3).
+        https://bugs.webkit.org/show_bug.cgi?id=26700
+        - At the start of a drag operation, the value of effectAllowed should be
+          the string "uninitialized".
+        - At end of dragstart handler, if effectAllowed hasn't been set yet, it
+          should be set to "copy".
+        - on dragenter and dragover event, dropEffect should be initialized to a
+          default value based on the value of effectAllowed.
+        - at end of dragenter and dragover the dropEffect should be set to "none"
+          if the value set by the handler doesn't match the effectAllowed.
+        - on dragleave event, dropEffect should be "none".
+        - on drop event, dropEffect should be the previously negotiated value.
+
+        Test: fast/events/drag-dropeffect.html
+
+        * WebCore.base.exp:
+            Added a parameter to EventHandler::dragSourceMovedTo.
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::Clipboard):
+            Initialize m_effectAllowed to "uninitialized".
+        (WebCore::Clipboard::sourceOperation):
+            Treat "uninitialized" as meaning no value has been set.
+        * page/DragController.cpp:
+        (WebCore::DragController::DragController):
+            Initialize new member m_destinationDragOperation.
+        (WebCore::DragController::dragExited):
+            Set m_destinationDragOperation to none on dragExit.
+        (WebCore::DragController::performDrag):
+            Set m_destinationDragOperation to current dropEffect.
+        (WebCore::DragController::dragEnteredOrUpdated):
+            Make sure to clear the operation if drag source doesn't allow it.
+        (WebCore::DragController::tryDHTMLDrag):
+            Set a default value for the dst drag op before sending dragEnter/Over.
+        (WebCore::DragController::startDrag):
+            Clear m_destinationDragOperation at start of drag.
+        * page/DragController.h:
+        (WebCore::DragController::destinationDragOperation):
+            Added new member m_destinationDragOperation, and its public getter.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateDragAndDrop):
+            dropEffect should be 'none' during dropleave handler, per spec.
+        (WebCore::EventHandler::dragSourceMovedTo):
+            Added DragOperation parameter, so the handler sees the current dropEffect.
+        (WebCore::EventHandler::handleDrag):
+            Assume DragOperationEvery for non-DHTML drags.
+        * page/EventHandler.h:
+            Added DragOperation parameter to dragSourceMovedTo().
+
+2009-09-09  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        1. Adding support/bindings for read-only transactions.
+        2. Disallowing the SQLITE_*_VIEW and REINDEX operations in the
+        private browsing mode.
+        3. Adding an authorizer test.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28918
+
+        Test: storage/test-authorizer.html
+
+        * bindings/js/JSDatabaseCustom.cpp:
+        (WebCore::createTransaction): Parses all arguments and executes a
+        transaction.
+        (WebCore::JSDatabase::transaction): Refactored to use
+        createTransaction().
+        (WebCore::JSDatabase::readTransaction): Added to execute read-only
+        transactions using createTransaction().
+        * bindings/v8/custom/V8CustomBinding.h: Added the binding for
+        Database::readTransaction().
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        (WebCore::createTransaction): Parses all arguments and executes a
+        transaction.
+        (WebCore::transaction): Refactored to use createTransaction().
+        (WebCore::readTransaction): Added to execute read-only
+        transactions using createTransaction().
+        * storage/Database.cpp:
+        (WebCore::Database::transaction): Added support for read-only
+        transactions.
+        * storage/Database.h: Added support for read-only transactions.
+        * storage/Database.idl: Added support for read-only transactions.
+        * storage/DatabaseAuthorizer.cpp:
+        (WebCore::DatabaseAuthorizer::createTempTable): Make it obvious
+        that the statement will be denied in private browsing mode and
+        read-only transactions.
+        (WebCore::DatabaseAuthorizer::dropTempTable): Same.
+        (WebCore::DatabaseAuthorizer::createTempIndex): Same.
+        (WebCore::DatabaseAuthorizer::dropTempIndex): Same.
+        (WebCore::DatabaseAuthorizer::createTempTrigger): Same.
+        (WebCore::DatabaseAuthorizer::dropTempTrigger): Same.
+        (WebCore::DatabaseAuthorizer::createView): Deny in private
+        browsing mode and read-only transactions.
+        (WebCore::DatabaseAuthorizer::createTempView): Same.
+        (WebCore::DatabaseAuthorizer::dropView): Same.
+        (WebCore::DatabaseAuthorizer::dropTempView): Same.
+        (WebCore::DatabaseAuthorizer::allowReindex): Same.
+        * storage/DatabaseAuthorizer.h:
+        * storage/SQLTransaction.cpp: Added support for read-only
+        transactions.
+        (WebCore::SQLTransaction::create):
+        (WebCore::SQLTransaction::SQLTransaction):
+        (WebCore::SQLTransaction::executeSQL):
+        (WebCore::SQLTransaction::acquireLock):
+        * storage/SQLTransaction.h:
+        * storage/SQLTransactionCoordinator.cpp:
+        (WebCore::SQLTransactionCoordinator::acquireLock): Added a new
+        parameter in preparation for a change that will allow multiple
+        read-only transactions on the same DB to run concurrently.
+        * storage/SQLTransactionCoordinator.h:
+
+2009-09-09  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29102, add support for user stylesheet injection.  This is similar
+        to user script injection but allows for user stylesheets to be added.  The stylesheets are applied immediately
+        to all Frames in the PageGroup.
+
+        Added userscripts/simple-stylesheet.html test case.
+
+        * WebCore.base.exp:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::CSSStyleSelector):
+        * css/CSSStyleSelector.h:
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::attach):
+        (WebCore::Document::pageGroupUserSheets):
+        (WebCore::Document::clearPageGroupUserSheets):
+        (WebCore::Document::recalcStyleSelector):
+        * dom/Document.h:
+        * loader/PlaceholderDocument.cpp:
+        (WebCore::PlaceholderDocument::attach):
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::addUserStyleSheet):
+        (WebCore::PageGroup::removeUserContentForWorld):
+        (WebCore::PageGroup::removeAllUserContent):
+        * page/PageGroup.h:
+        (WebCore::PageGroup::userStyleSheets):
+        * page/UserStyleSheet.h: Added.
+        (WebCore::UserStyleSheet::UserStyleSheet):
+        (WebCore::UserStyleSheet::source):
+        (WebCore::UserStyleSheet::url):
+        (WebCore::UserStyleSheet::patterns):
+        (WebCore::UserStyleSheet::worldID):
+        * page/UserStyleSheetTypes.h: Added.
+
+2009-09-09  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] CSS Style -webkit-box-shadow is not rendered correctly on
+        Qt platform
+        https://bugs.webkit.org/show_bug.cgi?id=23291
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+         Added the ability to draw shadows for all these curves.
+
+2009-09-09  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Add the qwebgraphicsitem.cpp to the build system.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28862
+
+        * WebCore.pro:
+
+2009-09-09  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx port] Move functions in TemporaryLinkStubs.cpp out to files where
+        they belong.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29088
+
+        * editing/wx/EditorWx.cpp:
+        (WebCore::Editor::showColorPanel):
+        (WebCore::Editor::showFontPanel):
+        (WebCore::Editor::showStylesPanel):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::clearPlatformShadow):
+        (WebCore::GraphicsContext::beginTransparencyLayer):
+        (WebCore::GraphicsContext::endTransparencyLayer):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::strokeRect):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::GraphicsContext::setMiterLimit):
+        (WebCore::GraphicsContext::setAlpha):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        * platform/graphics/wx/IconWx.cpp: Added.
+        (WebCore::Icon::~Icon):
+        (WebCore::Icon::createIconForFile):
+        (WebCore::Icon::createIconForFiles):
+        (WebCore::Icon::paint):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::Image::loadPlatformResource):
+        (WebCore::Image::drawPattern):
+        * platform/wx/CursorWx.cpp:
+        (WebCore::moveCursor):
+        * platform/wx/FileChooserWx.cpp: Added.
+        (WebCore::FileChooser::basenameForWidth):
+        * platform/wx/KURLWx.cpp: Added.
+        (WebCore::KURL::fileSystemPath):
+        * platform/wx/SSLKeyGeneratorWx.cpp: Added.
+        (WebCore::getSupportedKeySizes):
+        (WebCore::signedPublicKeyAndChallengeString):
+        * platform/wx/SearchPopupMenuWx.cpp: Added.
+        (WebCore::SearchPopupMenu::SearchPopupMenu):
+        (WebCore::SearchPopupMenu::saveRecentSearches):
+        (WebCore::SearchPopupMenu::loadRecentSearches):
+        (WebCore::SearchPopupMenu::enabled):
+        * platform/wx/SharedBufferWx.cpp: Added.
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+        * platform/wx/SystemTimeWx.cpp: Added.
+        (WebCore::userIdleTime):
+        * platform/wx/TemporaryLinkStubs.cpp: Removed.
+        * platform/wx/TextBreakIteratorInternalICUWx.cpp: Added.
+        (WebCore::currentSearchLocaleID):
+        (WebCore::currentTextBreakLocaleID):
+        * platform/wx/WidgetWx.cpp:
+        (WebCore::Widget::setIsSelected):
+
+2009-09-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Geolocation incorrectly calls error callback in case of exception in success callback.
+        https://bugs.webkit.org/show_bug.cgi?id=27255
+
+        Test: fast/dom/Geolocation/callback-exception.html
+
+        * bindings/js/JSCustomPositionCallback.cpp: Modified.
+        (WebCore::JSCustomPositionCallback::handleEvent): Modified. Removed raisedException out param.
+        * bindings/js/JSCustomPositionCallback.h: Modified. Removed raisedException out param from handleEvent method and made handleEvent private.
+        * bindings/js/JSCustomPositionErrorCallback.h: Modified. Made handleEvent private.
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::sendPosition): Modified. No longer call error callback in case of exception in success callback.
+        * page/PositionCallback.h: Modified. Removed raisedException out param from handleEvent method.
+
+2009-09-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        When Geolocation permission is denied, stops watches as well as one-shots.
+        https://bugs.webkit.org/show_bug.cgi?id=28305.
+
+        Tests: fast/dom/Geolocation/watch.html
+               fast/dom/Geolocation/permission-denied-stops-watches.html
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::setIsAllowed): Modified. Marks the permission error as fatal.
+        (WebCore::Geolocation::handleError): Modified. If the error is fatal, stops watchers as well as one-shots.
+        * page/PositionError.h: Modified.
+        (WebCore::PositionError::setIsFatal): Added. Marks an error as fatal.
+        (WebCore::PositionError::isFatal): Added. Determines whether an error is fatal.
+
+2009-09-09  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 28964 -  [Chromium] ChromiumDataObject should have getter/setter interface
+
+        Added getter/setter methods and trivial inline implementations for each.
+        (Note that they are not yet actually used.)
+        Once the Chromium code is changed to use them instead of directly accessing the
+        member variables, the member variables should be made private and cleaned up.
+
+        No new tests (no functional behavior changed).
+
+        * platform/chromium/ChromiumDataObject.h:
+        (WebCore::ChromiumDataObject::mainURL):
+        (WebCore::ChromiumDataObject::setMainURL):
+        (WebCore::ChromiumDataObject::mainURLTitle):
+        (WebCore::ChromiumDataObject::setMainURLTitle):
+        (WebCore::ChromiumDataObject::textPlain):
+        (WebCore::ChromiumDataObject::setTextPlain):
+        (WebCore::ChromiumDataObject::textHTML):
+        (WebCore::ChromiumDataObject::setTextHTML):
+        (WebCore::ChromiumDataObject::htmlBaseURL):
+        (WebCore::ChromiumDataObject::setHTMLBaseURL):
+        (WebCore::ChromiumDataObject::content):
+        (WebCore::ChromiumDataObject::releaseContent):
+        (WebCore::ChromiumDataObject::setContent):
+        (WebCore::ChromiumDataObject::contentFileExtension):
+        (WebCore::ChromiumDataObject::setContentFileExtension):
+        (WebCore::ChromiumDataObject::contentFileName):
+        (WebCore::ChromiumDataObject::setContentFileName):
+        (WebCore::ChromiumDataObject::fileNames):
+        (WebCore::ChromiumDataObject::setFileNames):
+        (WebCore::ChromiumDataObject::takeFileNames):
+
+2009-09-08  Pat Bradley  <vincent.bradley@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] locale date displays incorrect date format in symbian.
+        https://bugs.webkit.org/show_bug.cgi?id=29032
+
+        strftime() in Symbian does not support #
+        Layout tests cannot be run on Symbian yet, so they are not updated.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+
+2009-09-09  Rohini Ananth <rohini.ananth@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        NPAPI Plugin NPP_AsFile not working on Qt Webkit
+        https://bugs.webkit.org/show_bug.cgi?id=29068
+
+        * platform/qt/FileSystemQt.cpp:
+        (WebCore::openTemporaryFile)
+        Autoremove property of QTemporaryFile has been set to false. Hence closeFile() just closes and does not delete the file.
+        This solves the deletion of created temp file in PluginStream::destroyStream() before passing to plugin in NPP_AsFile.
+
+2009-09-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Remove a few incorrect changes I left in.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-09-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Support numeric index getters in bindings
+        https://bugs.webkit.org/show_bug.cgi?id=29067
+
+        Add HasNumericIndexGetter to indicate a non-custom getter that
+        returns a number.  The numeric index getter also uses PropertySlot's
+        setValue rather than setCustomIndex to avoid an additional indirect
+        call.
+
+        * bindings/js/JSCanvasByteArrayCustom.cpp:
+        * bindings/js/JSCanvasFloatArrayCustom.cpp:
+        * bindings/js/JSCanvasIntArrayCustom.cpp:
+        * bindings/js/JSCanvasShortArrayCustom.cpp:
+        * bindings/js/JSCanvasUnsignedByteArrayCustom.cpp:
+        * bindings/js/JSCanvasUnsignedIntArrayCustom.cpp:
+        * bindings/js/JSCanvasUnsignedShortArrayCustom.cpp:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * html/canvas/CanvasByteArray.h:
+        (WebCore::CanvasByteArray::item):
+        * html/canvas/CanvasByteArray.idl:
+        * html/canvas/CanvasFloatArray.h:
+        (WebCore::CanvasFloatArray::get):
+        (WebCore::CanvasFloatArray::item):
+        * html/canvas/CanvasFloatArray.idl:
+        * html/canvas/CanvasIntArray.h:
+        (WebCore::CanvasIntArray::get):
+        (WebCore::CanvasIntArray::item):
+        * html/canvas/CanvasIntArray.idl:
+        * html/canvas/CanvasPixelArray.idl:
+        * html/canvas/CanvasShortArray.h:
+        (WebCore::CanvasShortArray::get):
+        (WebCore::CanvasShortArray::item):
+        * html/canvas/CanvasShortArray.idl:
+        * html/canvas/CanvasUnsignedByteArray.h:
+        (WebCore::CanvasUnsignedByteArray::get):
+        (WebCore::CanvasUnsignedByteArray::item):
+        * html/canvas/CanvasUnsignedByteArray.idl:
+        * html/canvas/CanvasUnsignedIntArray.h:
+        (WebCore::CanvasUnsignedIntArray::get):
+        (WebCore::CanvasUnsignedIntArray::item):
+        * html/canvas/CanvasUnsignedIntArray.idl:
+        * html/canvas/CanvasUnsignedShortArray.h:
+        (WebCore::CanvasUnsignedShortArray::item):
+        * html/canvas/CanvasUnsignedShortArray.idl:
+
+2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix for 2.8.
+
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+
+2009-09-08  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        In Mac Chromium, clicking below the last line of an editable area (textarea or
+        contenteditable) should put the caret at the end of the last line, as in Mac Safari.
+
+        Tests: LayoutTests/editing/selection/click-in-margins-inside-editable-div.html
+               LayoutTests/editing/selection/click-in-padding-with-multiple-line-boxes.html
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Change #if PLATFORM_MAC to be Mac-Chrome-inclusive.
+
+2009-09-08  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Make sure not to do an early return when a data URL stylesheet successfully loads.  We need to still
+        clear the old cached sheet out of all existing Frames.  Fixes the data URL stylesheet layout test failure.
+
+        * page/Page.cpp:
+        (WebCore::Page::userStyleSheetLocationChanged):
+
+2009-09-08  Sam Weinig  <sam@webkit.org>
+
+        Fix windows build.
+
+        * dom/Document.idl:
+
+2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        More robust wx build fix for 2.9.
+
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+
+2009-09-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27046
+        Implement CSSOM DocumentView.caretRangeFromPoint
+
+        Tests: fast/dom/Document/CaretRangeFromPoint/basic.html
+               fast/dom/Document/CaretRangeFromPoint/replace-element.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::caretRangeFromPoint):
+        * dom/Document.h:
+        * dom/Document.idl:
+
+2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, generate derived sources earlier in order to make sure
+        they're found by the build system when generating the list of sources to build.
+
+        * wscript:
+
+2009-09-08  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        <iterator> include in V8Proxy.h is spurious and causing ObjC compile issues for Chromium.
+
+        Test: Chromium mac canary build is fixed.
+
+        * bindings/v8/V8Proxy.h: Remove <iterator> include.
+
+2009-09-08  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed attempt to fix the GTK+ build.
+
+        * GNUmakefile.am:
+
+2009-09-04  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28987, make the Document cache the page's user stylesheet in
+        parsed form.  Allows the sheet to survive across destruction/re-creation of the CSSStyleSelector.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::CSSStyleSelector):
+        * css/CSSStyleSelector.h:
+        * dom/Document.cpp:
+        (WebCore::Document::attach):
+        (WebCore::Document::pageUserSheet):
+        (WebCore::Document::clearPageUserSheet):
+        (WebCore::Document::recalcStyleSelector):
+        * dom/Document.h:
+        * loader/PlaceholderDocument.cpp:
+        (WebCore::PlaceholderDocument::attach):
+        * page/Page.cpp:
+        (WebCore::Page::userStyleSheetLocationChanged):
+        * page/Settings.cpp:
+        (WebCore::Settings::setUserStyleSheetLocation):
+
+2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Unreviewed buildfix.
+
+        Fix Qt build after 48167, by adding the new cpp/h files
+        added to WebCore.gypi to WebCore.pro as well.
+
+        * WebCore.pro:
+
+2009-09-08  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        should not pass URI fragments to libsoup
+        https://bugs.webkit.org/show_bug.cgi?id=28687
+
+        Strip the fragment from the URI before passing it to soup, since
+        it forwards it to servers in some cases (like when using a proxy)
+        which confuses them and makes them return 403/404.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::startHttp):
+        (WebCore::):
+
+2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Add QGraphicsScene events support to the Qt platform events.
+
+        * platform/PlatformMouseEvent.h:
+        * platform/PlatformWheelEvent.h:
+        * platform/qt/PlatformMouseEventQt.cpp:
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/qt/WheelEventQt.cpp:
+        (WebCore::PlatformWheelEvent::applyDelta):
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+2009-09-08  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Cleanup: remove a few deprecated methods.
+        https://bugs.webkit.org/show_bug.cgi?id=28960
+
+        No new tests, just syntactic sugar.
+
+        * platform/network/chromium/ResourceRequest.h:
+        * platform/network/chromium/ResourceResponse.h:
+
+2009-09-08  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28981
+
+        [Qt] make npapi.h compile in winscw compiler.
+
+        Add XP_SYMBIAN macro to identify Symbian OS; this macro should be used for Symbian
+        specific changes in npapi.h.
+        Undefine XP_WIN when building for Symbian to avoid including Windows specific code.
+
+        * bridge/npapi.h:
+
+2009-09-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Web Inspector assertion failure related to marking
+        https://bugs.webkit.org/show_bug.cgi?id=28997
+
+        When wrapping the callback the JSInspectorCallbackWrapper creator was using
+        inheritorID for the prototype structure which is unsafe for anything other
+        than a pure JS object.  Instead we now create a new structure, which while
+        inefficient is not problematic as this code is not hit frequently.
+
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::JSInspectorCallbackWrapper::wrap):
+
+2009-09-08  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add missing extension to the file entry in WebCore.vcproj.
+
+        * WebCore.vcproj/WebCore.vcproj: Added "cpp".
+
+2009-09-08  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        dataTransfer.types() should not return Files if file list is empty in the clipboard.
+        https://bugs.webkit.org/show_bug.cgi?id=28891
+
+        We change the behavior to handle the empty file list in order to match the spec.
+
+        Tested by clipboard-file-access.html.
+
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::addHTMLClipboardTypesForCocoaType):
+        (WebCore::ClipboardMac::types):
+
+2009-09-08  Steve VanDeBogart  <vandebo@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Handle middle click in Chromium like QT
+        https://bugs.webkit.org/show_bug.cgi?id=28696
+
+        Tested by middle-click-onpaste.html.
+
+        * platform/Pasteboard.h:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::getData):
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::Pasteboard):
+        (WebCore::Pasteboard::isSelectionMode):
+        (WebCore::Pasteboard::setSelectionMode):
+        (WebCore::Pasteboard::canSmartReplace):
+        (WebCore::Pasteboard::plainText):
+        (WebCore::Pasteboard::documentFragment):
+        * platform/chromium/PasteboardPrivate.h:
+        (WebCore::PasteboardPrivate::):
+
+2009-09-08  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Eric Seidel.
+
+        WebInspector: Adds a timeline agent to InspectorController that collects
+        high-level timing data about event dispatch, layout, painting and HTML
+        parsing and makes it available to Inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=25503
+
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+        * dom/Document.h:
+        (WebCore::Document::inspectorTimelineAgent):
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchGenericEvent):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * inspector/DOMDispatchTimelineItem.cpp: Added.
+        (WebCore::DOMDispatchTimelineItem::DOMDispatchTimelineItem):
+        (WebCore::DOMDispatchTimelineItem::convertToScriptObject):
+        * inspector/DOMDispatchTimelineItem.h: Added.
+        (WebCore::DOMDispatchTimelineItem::~DOMDispatchTimelineItem):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::enableTimeline):
+        (WebCore::InspectorBackend::disableTimeline):
+        (WebCore::InspectorBackend::timelineEnabled):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::enableTimeline):
+        (WebCore::InspectorController::disableTimeline):
+        (WebCore::InspectorController::timelineEnabled):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::timelineAgent):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::timelineWasEnabled):
+        (WebCore::InspectorFrontend::timelineWasDisabled):
+        (WebCore::InspectorFrontend::addItemToTimeline):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorTimelineAgent.cpp: Added.
+        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::~InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::willLayout):
+        (WebCore::InspectorTimelineAgent::didLayout):
+        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::didPaint):
+        (WebCore::InspectorTimelineAgent::willWriteHTML):
+        (WebCore::InspectorTimelineAgent::didWriteHTML):
+        (WebCore::InspectorTimelineAgent::reset):
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        (WebCore::InspectorTimelineAgent::currentTimeInMilliseconds):
+        (WebCore::InspectorTimelineAgent::sessionTimeInMilliseconds):
+        * inspector/InspectorTimelineAgent.h: Added.
+        * inspector/TimelineItem.cpp: Added.
+        (WebCore::TimelineItem::TimelineItem):
+        (WebCore::TimelineItem::addToTimeline):
+        (WebCore::TimelineItem::convertToScriptObject):
+        (WebCore::TimelineItem::convertChildrenToScriptArray):
+        (WebCore::TimelineItem::addChildItem):
+        * inspector/TimelineItem.h: Added.
+        (WebCore::):
+        (WebCore::TimelineItem::~TimelineItem):
+        (WebCore::TimelineItem::previous):
+        (WebCore::TimelineItem::releasePrevious):
+        (WebCore::TimelineItem::setEndTime):
+        (WebCore::TimelineItem::type):
+        * inspector/front-end/TimelineAgent.js: Added.
+        (WebInspector.TimelineAgent):
+        (WebInspector.addItemToTimeline):
+        (WebInspector.timelineWasEnabled):
+        (WebInspector.timelineWasDisabled):
+        * inspector/front-end/inspector.html:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::paintContents):
+        * page/FrameView.h:
+        (WebCore::FrameView::inspectorTimelineAgent):
+        * page/Page.cpp:
+        (WebCore::Page::inspectorTimelineAgent):
+        * page/Page.h:
+
+2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix unused variable warnings
+        https://bugs.webkit.org/show_bug.cgi?id=29018
+
+        No functional change, no tests.
+
+        * history/qt/HistoryItemQt.cpp:
+        (WebCore::HistoryItem::restoreState):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::putImageData):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintMenuList):
+
+2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Use the declaration order in initializer lists
+        https://bugs.webkit.org/show_bug.cgi?id=29017
+
+        No functional change, no new tests.
+
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+
+2009-09-08  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement ValidityState::typeMismatch() for <input type=number>.
+        https://bugs.webkit.org/show_bug.cgi?id=28934
+
+        Test: fast/forms/ValidityState-typeMismatch-number.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::formStringToDouble):
+        * html/HTMLInputElement.h:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+        * html/ValidityState.h:
+
+2009-09-08  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] Another attempt of a buildfix.
+
+        * GNUmakefile.am: Modified. Remove some extra IDL files added in r48153.
+
+2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make cursor set cleaner in QtWebKit Api: eliminate SetCursorEvent hack.
+        https://bugs.webkit.org/show_bug.cgi?id=28865
+
+        Save the QCursor as a property in WidgetQt::setCursor
+        and actually change the cursor in QWebView::event() by making use
+        of the QEvent::DynamicPropertyChange event type.
+        When unsetCursor() is called on the QWidget we can fallback to
+        the cursor set by WebCore.
+
+        Patch by Kenneth Rohde Christiansen <kenneth@webkit.org> and
+                 Antonio Gomes <antonio.gomes@openbossa.org> on 2009-09-07
+
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::setCursor):
+
+2009-09-08  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] Buildfix for build error introduced in r48150.
+
+        * GNUmakefile.am: Modified. Added missing IDL files.
+
+2009-09-08  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Buildfix. Build error caused by r48150.
+
+        * WebCore.pro: missing IDL files added
+
+2009-09-07  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Update Canvas 3D implementation to match spec
+        https://bugs.webkit.org/show_bug.cgi?id=29010
+
+        This adds several new CanvasXXXArray classes each of which has a custom constructor
+        and custom getters and setters. Also changed CanvasRenderingContext3D and GraphicsContext3D
+        to match the new and changed API.
+
+        * DerivedSources.make:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCanvasArrayBufferConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasArrayBufferConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasByteArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasByteArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasByteArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasFloatArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasFloatArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasFloatArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasIntArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasIntArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasIntArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext3D::bufferData):
+        (WebCore::JSCanvasRenderingContext3D::bufferSubData):
+        (WebCore::JSCanvasRenderingContext3D::texImage2D):
+        (WebCore::JSCanvasRenderingContext3D::texSubImage2D):
+        * bindings/js/JSCanvasShortArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasShortArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasShortArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedByteArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedByteArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedIntArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedIntArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedShortArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedShortArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::canvasArrayBuffer):
+        (WebCore::JSDOMWindow::canvasByteArray):
+        (WebCore::JSDOMWindow::canvasUnsignedByteArray):
+        (WebCore::JSDOMWindow::canvasIntArray):
+        (WebCore::JSDOMWindow::canvasUnsignedIntArray):
+        (WebCore::JSDOMWindow::canvasShortArray):
+        (WebCore::JSDOMWindow::canvasUnsignedShortArray):
+        (WebCore::JSDOMWindow::canvasFloatArray):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        (WebCore::HTMLCanvasElement::paint):
+        * html/canvas/CanvasArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasArray.idl: Added.
+        * html/canvas/CanvasArrayBuffer.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasArrayBuffer.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasArrayBuffer.idl: Added.
+        * html/canvas/CanvasByteArray.cpp:
+        * html/canvas/CanvasByteArray.h:
+        * html/canvas/CanvasByteArray.idl:
+        * html/canvas/CanvasFloatArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasFloatArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasFloatArray.idl: Added.
+        * html/canvas/CanvasIntArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasIntArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasIntArray.idl: Added.
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::CanvasRenderingContext3D):
+        (WebCore::CanvasRenderingContext3D::markContextChanged):
+        (WebCore::CanvasRenderingContext3D::beginPaint):
+        (WebCore::CanvasRenderingContext3D::endPaint):
+        (WebCore::CanvasRenderingContext3D::reshape):
+        (WebCore::CanvasRenderingContext3D::sizeInBytes):
+        (WebCore::CanvasRenderingContext3D::bindTexture):
+        (WebCore::CanvasRenderingContext3D::bufferData):
+        (WebCore::CanvasRenderingContext3D::bufferSubData):
+        (WebCore::CanvasRenderingContext3D::checkFramebufferStatus):
+        (WebCore::CanvasRenderingContext3D::clear):
+        (WebCore::CanvasRenderingContext3D::createBuffer):
+        (WebCore::CanvasRenderingContext3D::createFramebuffer):
+        (WebCore::CanvasRenderingContext3D::createTexture):
+        (WebCore::CanvasRenderingContext3D::createProgram):
+        (WebCore::CanvasRenderingContext3D::createRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::createShader):
+        (WebCore::CanvasRenderingContext3D::deleteBuffer):
+        (WebCore::CanvasRenderingContext3D::deleteFramebuffer):
+        (WebCore::CanvasRenderingContext3D::deleteProgram):
+        (WebCore::CanvasRenderingContext3D::deleteRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::deleteShader):
+        (WebCore::CanvasRenderingContext3D::deleteTexture):
+        (WebCore::CanvasRenderingContext3D::drawArrays):
+        (WebCore::CanvasRenderingContext3D::drawElements):
+        (WebCore::CanvasRenderingContext3D::getBoolean):
+        (WebCore::CanvasRenderingContext3D::getBooleanv):
+        (WebCore::CanvasRenderingContext3D::getBufferParameteri):
+        (WebCore::CanvasRenderingContext3D::getBufferParameteriv):
+        (WebCore::CanvasRenderingContext3D::getFloat):
+        (WebCore::CanvasRenderingContext3D::getFloatv):
+        (WebCore::CanvasRenderingContext3D::getFramebufferAttachmentParameteri):
+        (WebCore::CanvasRenderingContext3D::getFramebufferAttachmentParameteriv):
+        (WebCore::CanvasRenderingContext3D::getInteger):
+        (WebCore::CanvasRenderingContext3D::getIntegerv):
+        (WebCore::CanvasRenderingContext3D::getProgrami):
+        (WebCore::CanvasRenderingContext3D::getProgramiv):
+        (WebCore::CanvasRenderingContext3D::getProgramInfoLog):
+        (WebCore::CanvasRenderingContext3D::getRenderbufferParameteri):
+        (WebCore::CanvasRenderingContext3D::getRenderbufferParameteriv):
+        (WebCore::CanvasRenderingContext3D::getShaderi):
+        (WebCore::CanvasRenderingContext3D::getShaderiv):
+        (WebCore::CanvasRenderingContext3D::getShaderInfoLog):
+        (WebCore::CanvasRenderingContext3D::getShaderSource):
+        (WebCore::CanvasRenderingContext3D::getTexParameterf):
+        (WebCore::CanvasRenderingContext3D::getTexParameterfv):
+        (WebCore::CanvasRenderingContext3D::getTexParameteri):
+        (WebCore::CanvasRenderingContext3D::getTexParameteriv):
+        (WebCore::CanvasRenderingContext3D::getUniformf):
+        (WebCore::CanvasRenderingContext3D::getUniformfv):
+        (WebCore::CanvasRenderingContext3D::getUniformi):
+        (WebCore::CanvasRenderingContext3D::getUniformiv):
+        (WebCore::CanvasRenderingContext3D::getUniformLocation):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribf):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribfv):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribi):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribiv):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribOffset):
+        (WebCore::CanvasRenderingContext3D::texImage2D):
+        (WebCore::CanvasRenderingContext3D::texParameterf):
+        (WebCore::CanvasRenderingContext3D::texParameteri):
+        (WebCore::CanvasRenderingContext3D::texSubImage2D):
+        (WebCore::CanvasRenderingContext3D::uniform1f):
+        (WebCore::CanvasRenderingContext3D::uniform1fv):
+        (WebCore::CanvasRenderingContext3D::uniform1i):
+        (WebCore::CanvasRenderingContext3D::uniform1iv):
+        (WebCore::CanvasRenderingContext3D::uniform2f):
+        (WebCore::CanvasRenderingContext3D::uniform2fv):
+        (WebCore::CanvasRenderingContext3D::uniform2i):
+        (WebCore::CanvasRenderingContext3D::uniform2iv):
+        (WebCore::CanvasRenderingContext3D::uniform3f):
+        (WebCore::CanvasRenderingContext3D::uniform3fv):
+        (WebCore::CanvasRenderingContext3D::uniform3i):
+        (WebCore::CanvasRenderingContext3D::uniform3iv):
+        (WebCore::CanvasRenderingContext3D::uniform4f):
+        (WebCore::CanvasRenderingContext3D::uniform4fv):
+        (WebCore::CanvasRenderingContext3D::uniform4i):
+        (WebCore::CanvasRenderingContext3D::uniform4iv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix2fv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix3fv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix4fv):
+        (WebCore::CanvasRenderingContext3D::useProgram):
+        (WebCore::CanvasRenderingContext3D::validateProgram):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib1f):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib1fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib2f):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib2fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib3f):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib3fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib4f):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib4fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttribPointer):
+        (WebCore::CanvasRenderingContext3D::viewport):
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * html/canvas/CanvasShortArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasShortArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasShortArray.idl: Added.
+        * html/canvas/CanvasTexture.cpp:
+        (WebCore::CanvasTexture::CanvasTexture):
+        * html/canvas/CanvasTexture.h:
+        (WebCore::CanvasTexture::isCubeMapRWrapModeInitialized):
+        (WebCore::CanvasTexture::setCubeMapRWrapModeInitialized):
+        * html/canvas/CanvasUnsignedByteArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedByteArray.h: Added with properties svn:eol-style and svn:mime-type.
+         * html/canvas/CanvasUnsignedByteArray.idl: Added.
+        * html/canvas/CanvasUnsignedIntArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedIntArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedIntArray.idl: Added.
+        * html/canvas/CanvasUnsignedShortArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedShortArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedShortArray.idl: Added.
+        * page/DOMWindow.idl:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::beginPaint):
+        (WebCore::GraphicsContext3D::endPaint):
+        (WebCore::GraphicsContext3D::bindTexture):
+        (WebCore::GraphicsContext3D::bufferData):
+        (WebCore::GraphicsContext3D::bufferSubData):
+        (WebCore::GraphicsContext3D::checkFramebufferStatus):
+        (WebCore::GraphicsContext3D::drawArrays):
+        (WebCore::GraphicsContext3D::drawElements):
+        (WebCore::GraphicsContext3D::texParameterf):
+        (WebCore::GraphicsContext3D::texParameteri):
+        (WebCore::GraphicsContext3D::uniform1f):
+        (WebCore::GraphicsContext3D::uniform1fv):
+        (WebCore::GraphicsContext3D::uniform2f):
+        (WebCore::GraphicsContext3D::uniform2fv):
+        (WebCore::GraphicsContext3D::uniform3f):
+        (WebCore::GraphicsContext3D::uniform3fv):
+        (WebCore::GraphicsContext3D::uniform4f):
+        (WebCore::GraphicsContext3D::uniform4fv):
+        (WebCore::GraphicsContext3D::uniform1i):
+        (WebCore::GraphicsContext3D::uniform1iv):
+        (WebCore::GraphicsContext3D::uniform2i):
+        (WebCore::GraphicsContext3D::uniform2iv):
+        (WebCore::GraphicsContext3D::uniform3i):
+        (WebCore::GraphicsContext3D::uniform3iv):
+        (WebCore::GraphicsContext3D::uniform4i):
+        (WebCore::GraphicsContext3D::uniform4iv):
+        (WebCore::GraphicsContext3D::uniformMatrix2fv):
+        (WebCore::GraphicsContext3D::uniformMatrix3fv):
+        (WebCore::GraphicsContext3D::uniformMatrix4fv):
+        (WebCore::GraphicsContext3D::vertexAttrib1f):
+        (WebCore::GraphicsContext3D::vertexAttrib1fv):
+        (WebCore::GraphicsContext3D::vertexAttrib2f):
+        (WebCore::GraphicsContext3D::vertexAttrib2fv):
+        (WebCore::GraphicsContext3D::vertexAttrib3f):
+        (WebCore::GraphicsContext3D::vertexAttrib3fv):
+        (WebCore::GraphicsContext3D::vertexAttrib4f):
+        (WebCore::GraphicsContext3D::vertexAttrib4fv):
+        (WebCore::GraphicsContext3D::vertexAttribPointer):
+        (WebCore::GraphicsContext3D::getBoolean):
+        (WebCore::GraphicsContext3D::getBooleanv):
+        (WebCore::GraphicsContext3D::getFloat):
+        (WebCore::GraphicsContext3D::getFloatv):
+        (WebCore::GraphicsContext3D::getInteger):
+        (WebCore::GraphicsContext3D::getIntegerv):
+        (WebCore::GraphicsContext3D::getBufferParameteri):
+        (WebCore::GraphicsContext3D::getBufferParameteriv):
+        (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteri):
+        (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteriv):
+        (WebCore::GraphicsContext3D::getProgrami):
+        (WebCore::GraphicsContext3D::getProgramiv):
+        (WebCore::GraphicsContext3D::getRenderbufferParameteri):
+        (WebCore::GraphicsContext3D::getRenderbufferParameteriv):
+        (WebCore::GraphicsContext3D::getShaderi):
+        (WebCore::GraphicsContext3D::getShaderiv):
+        (WebCore::GraphicsContext3D::getTexParameterf):
+        (WebCore::GraphicsContext3D::getTexParameterfv):
+        (WebCore::GraphicsContext3D::getTexParameteri):
+        (WebCore::GraphicsContext3D::getTexParameteriv):
+        (WebCore::GraphicsContext3D::getUniformf):
+        (WebCore::GraphicsContext3D::getUniformfv):
+        (WebCore::GraphicsContext3D::getUniformi):
+        (WebCore::GraphicsContext3D::getUniformiv):
+        (WebCore::GraphicsContext3D::getVertexAttribf):
+        (WebCore::GraphicsContext3D::getVertexAttribfv):
+        (WebCore::GraphicsContext3D::getVertexAttribi):
+        (WebCore::GraphicsContext3D::getVertexAttribiv):
+        (WebCore::GraphicsContext3D::getVertexAttribOffset):
+        (WebCore::GraphicsContext3D::texImage2D):
+        (WebCore::GraphicsContext3D::texSubImage2D):
+        (WebCore::GraphicsContext3D::sizeInBytes):
+
+2009-09-08  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Make m_windowVisible more consistent with the actual visibility of the inspector.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+
+2009-09-07  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed speculative build fix for Snow Leopard.
+
+        * platform/GeolocationService.cpp:
+        (WebCore::createGeolocationServiceNull):
+
+2009-09-07  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Adds a mock Geolocation service. This will be used to provide predictable behavior of the
+        Geolocation API for use in LayoutTests. Later changes will integrate the the mock
+        Geolocation service with DumpRenderTree.
+        https://bugs.webkit.org/show_bug.cgi?id=28264
+
+        The mock Geolocation service returns a fixed position or error. This position or error can be
+        set through static methods on the GeolocationService class. The position or error is shared
+        between all instances of the mock Geolocation service.
+
+        Implementation details.
+        The GeolocationService object maintains a pointer to a factory function which it uses to create
+        Geolocation service instances. Each platform implementing Geolocation sets this pointer
+        to the factory function for their platform's implementation. When the mock Geolocation service
+        is activated, the factory function pointer is reset to the factory function for the mock service.
+
+        Test: fast/dom/Geolocation/error.html
+
+        * WebCore.base.exp: Modified. Exports GeolocationServiceMock methods.
+        * GNUMakefile.am: Modified. Added GeolocationServiceMock files.
+        * WebCore.gypi: Modified. Added GeolocationServiceMock files.
+        * WebCore.pro: Modified. Added GeolocationServiceMock files.
+        * WebCore.vcproj/WebCore.vcproj: Modified. Added GeolocationServiceMock files.
+        * WebCore.vcproj/WebCoreCommon.vsprops: Modified. Added mock directory to includes.
+        * WebCore.xcodeproj/project.pbxproj: Modified. Added GeolocationServiceMock files and exports some headers.
+        * WebCoreSources.bkl: Modified. Added GeolocationServiceMock files.
+        * page/ChromeClient.h: Modified. Fixed comment.
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::setIsAllowed): Modified. Fixed error string.
+        * platform/GeolocationService.cpp: Modified.
+        (WebCore::createGeolocationServiceNull): Added. Returns null in place of a Geolocation service. Used to avoid link errors on platforms where Geolocation is not implemented.
+        (WebCore::GeolocationService::create): Added. Uses the factory function pointer to create a Geolocation service implementation.
+        (WebCore::GeolocationService::useMock): Added. Configures the GeolocationServie to use the mock implementation.
+        * platform/GeolocationService.h: Modified.
+        * platform/mock: Added.
+        * platform/mock/GeolocationServiceMock.cpp: Added.
+        (WebCore::GeolocationServiceMock::create): Added. Creates a GeolocationServiceMock object.
+        (WebCore::GeolocationServiceMock::GeolocationServiceMock): Added. Constructor.
+        (WebCore::GeolocationServiceMock::~GeolocationServiceMock): Added. Destructor.
+        (WebCore::GeolocationServiceMock::setPosition): Added. Sets the position that will be returned by the object.
+        (WebCore::GeolocationServiceMock::setError): Added. Sets the error that will be returned by the object.
+        (WebCore::GeolocationServiceMock::startUpdating): Added. GeolocationService implementation. Starts the service.
+        (WebCore::GeolocationServiceMock::stopUpdating): Added. GeolocationService implementation. Stops the service.
+        (WebCore::GeolocationServiceMock::timerFired): Added. Used to provide an asynchronous callback when the service is started.
+        (WebCore::GeolocationServiceMock::makeGeolocationCallbackFromAllInstances): Added. Used to call back when the position or error is updated.
+        (WebCore::GeolocationServiceMock::makeGeolocationCallback): Added. Used to call back when the service starts.
+        (WebCore::GeolocationServiceMock::initStatics): Added. Initializes statics members with constructors.
+        (WebCore::GeolocationServiceMock::cleanUpStatics): Added. Cleans up static members with constructors.
+        * platform/mock/GeolocationServiceMock.h: Added.
+        (WebCore::GeolocationServiceMock::lastPosition): Added. Returns the fixed position.
+        (WebCore::GeolocationServiceMock::lastError): Added. Returns the fixed error.
+        * platform/gtk/GeolocationServiceGtk.cpp: Modified.
+        (WebCore::GeolocationServiceGtk::create): Added. Creates an instance of GeolocationServiceGtk.
+        * platform/gtk/GeolocationServiceGtk.h: Modified.
+        * platform/mac/GeolocationServiceMac.h: Modified.
+        * platform/mac/GeolocationServiceMac.mm: Modified.
+        (WebCore::GeolocationServiceMac::create): Added. Creates an instance of GeolocationServiceMac.
+
+2009-09-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28985
+
+        We need to be slightly more careful about how we pick up a script
+        execution context.  In particular, we were getting the wrong document
+        for frames that had been navigated somewhere else.
+
+        In the long term, we should think about a better algorithm for
+        computing the script context.
+
+        Fixes LayoutTests/http/tests/xmlhttprequest/detaching-frame-2.html
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::retrieveFrame):
+
+2009-09-07  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix for 2.8 compilation.
+
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Unreviewed build fix.
+
+        Reverting r48121 to fix Windows build errors.
+
+        * DerivedSources.cpp:
+        * GNUmakefile.am:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * dom/EventTarget.cpp:
+        * dom/EventTarget.h:
+        * page/DOMWindow.idl:
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::connect):
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::close):
+        (WebCore::WebSocket::bufferedAmount):
+        (WebCore::WebSocket::addEventListener):
+        (WebCore::WebSocket::removeEventListener):
+        (WebCore::WebSocket::dispatchEvent):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+        (WebCore::WebSocket::dispatchOpenEvent):
+        (WebCore::WebSocket::dispatchMessageEvent):
+        (WebCore::WebSocket::dispatchCloseEvent):
+        * websockets/WebSocket.h:
+        (WebCore::WebSocket::create):
+        (WebCore::WebSocket::):
+        (WebCore::WebSocket::setOnopen):
+        (WebCore::WebSocket::onopen):
+        (WebCore::WebSocket::setOnmessage):
+        (WebCore::WebSocket::onmessage):
+        (WebCore::WebSocket::setOnclose):
+        (WebCore::WebSocket::onclose):
+        (WebCore::WebSocket::toWebSocket):
+        (WebCore::WebSocket::refEventTarget):
+        (WebCore::WebSocket::derefEventTarget):
+        * websockets/WebSocketChannel.cpp: Removed.
+        * websockets/WebSocketChannel.h: Removed.
+        * websockets/WebSocketChannelClient.h: Removed.
+        * websockets/WebSocketHandshake.cpp: Removed.
+        * websockets/WebSocketHandshake.h: Removed.
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Unreviewed speculative build fix.
+
+        Reverted previous build fix as it didn't fix the problem.
+
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toEventTarget):
+
+2009-09-07  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed, build fix.
+
+        [Qt] Fix build after SHARED_WORKERS are enabled by default (r48131)
+
+        * WebCore.pro:
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Unreviewed build fix.
+
+        Temporarily removed depenency between JSEventTarget.cpp and WebSocket.h in an attempt to fix a windows build break.
+
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toEventTarget):
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Enable SHARED_WORKERS by default.
+        https://bugs.webkit.org/show_bug.cgi?id=28959
+
+        Tests (enabled in a separate patch):
+               fast/workers/shared-worker-constructor.html
+               fast/workers/shared-worker-context-gc.html
+               fast/workers/shared-worker-event-listener.html
+               fast/workers/shared-worker-exception.html
+               fast/workers/shared-worker-frame-lifecycle.html
+               fast/workers/shared-worker-gc.html
+               fast/workers/shared-worker-lifecycle.html
+               fast/workers/shared-worker-load-error.html
+               fast/workers/shared-worker-location.html
+               fast/workers/shared-worker-navigator.html
+               fast/workers/shared-worker-replace-global-constructor.html
+               fast/workers/shared-worker-replace-self.html
+               fast/workers/shared-worker-shared.html
+               fast/workers/shared-worker-simple.html
+               http/tests/workers/shared-worker-importScripts.html
+               http/tests/workers/shared-worker-redirect.html
+               http/tests/xmlhttprequest/workers/shared-worker-close.html
+               http/tests/xmlhttprequest/workers/shared-worker-methods-async.html
+               http/tests/xmlhttprequest/workers/shared-worker-methods.html
+               http/tests/xmlhttprequest/workers/shared-worker-xhr-file-not-found.html
+
+        * config.h: Removed some whitespace/touched the file to force a full rebuild on the build-bots.
+        * Configurations/FeatureDefines.xcconfig:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+        * dom/DOMWindow.idl: Removed unnecessary whitespace to force a rebuild on the build-bots to pickup the flag change.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerScriptLoader::load):
+        Clean up bitrot in SharedWorker code - DenyCrossOriginRedirect is now DenyCrossOriginRequests.
+        * workers/SharedWorkerContext.cpp:
+        (WebCore::SharedWorkerContext::dispatchConnect):
+        Clean up bitrot - updated SharedWorker code to reflect new MessageEvent API.
+
+2009-09-07  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        Add new file to sources list.
+
+        * GNUmakefile.am:
+
+2009-09-07  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes for wx SVN trunk. 
+
+        * config.h:
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::RenderThemeWx::paintButton):
+        * platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp:
+        (WebCore::drawTextWithSpacing):
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+
+2009-09-07  Chris Hills <chaz@chaz6.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Use direct includes for Phonon, not the pretty ones
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+
+2009-09-07  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebSocket API implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=28038
+        
+        Add build systems only for GNUmakefile.am and WebCore.xcodeproj now.
+        Other build systems will be updated once the code is functional.
+        Tests will be landed once the code is completed and functional.
+
+        * DerivedSources.cpp:
+        * GNUmakefile.am:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::webSocket):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toWebSocket):
+        * dom/EventTarget.h:
+        * page/DOMWindow.idl:
+        * websockets/WebSocket.cpp:
+        (WebCore::ProcessWebSocketEventTask::create):
+        (WebCore::ProcessWebSocketEventTask::performTask):
+        (WebCore::ProcessWebSocketEventTask::ProcessWebSocketEventTask):
+        (WebCore::isValidProtocolString):
+        (WebCore::WebSocket::connect):
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::close):
+        (WebCore::WebSocket::bufferedAmount):
+        (WebCore::WebSocket::addEventListener):
+        (WebCore::WebSocket::removeEventListener):
+        (WebCore::WebSocket::dispatchEvent):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+        (WebCore::WebSocket::dispatchOpenEvent):
+        (WebCore::WebSocket::dispatchMessageEvent):
+        (WebCore::WebSocket::dispatchCloseEvent):
+        * websockets/WebSocket.h:
+        (WebCore::WebSocket::create):
+        (WebCore::WebSocket::):
+        (WebCore::WebSocket::setOnopen):
+        (WebCore::WebSocket::onopen):
+        (WebCore::WebSocket::setOnmessage):
+        (WebCore::WebSocket::onmessage):
+        (WebCore::WebSocket::setOnclose):
+        (WebCore::WebSocket::onclose):
+        (WebCore::WebSocket::toWebSocket):
+        (WebCore::WebSocket::eventListeners):
+        (WebCore::WebSocket::refEventTarget):
+        (WebCore::WebSocket::derefEventTarget):
+        * websockets/WebSocketChannel.cpp: Added.
+        * websockets/WebSocketChannel.h: Added.
+        * websockets/WebSocketChannelClient.h: Added.
+        * websockets/WebSocketHandshake.cpp: Added.
+        * websockets/WebSocketHandshake.h: Added.
+
+2009-09-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26854
+        [GTK] Needs API to allow more control over outgoing requests
+
+        Add infrastructure required to provide the new
+        WebKitNetworkResponse object in our API.
+
+        * GNUmakefile.am: Add new files to the build.
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::updateFromSoupMessage):
+        * platform/network/soup/ResourceResponse.h:
+        * platform/network/soup/ResourceResponseSoup.cpp: Added.
+        (WebCore::ResourceResponse::toSoupMessage):
+
+2009-09-07  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Cleanup document/frame null-checking in V8DOMWindowCustom.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=29009
+
+        Be consistent in document and frame null checks.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::V8Custom::ClearTimeoutImpl):
+
+2009-09-07  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [Soup] Limit the number of connections
+        https://bugs.webkit.org/show_bug.cgi?id=18431
+
+        Increase the maximum number of per host and total connections to
+        similar values than those used by the other modern browsers. Seems
+        to significantly improve page loading time in many cases.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ensureSessionIsInitialized):
+
+2009-09-07  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Various minor chromium appcache modifications.
+        https://bugs.webkit.org/show_bug.cgi?id=28960
+
+        No new tests.
+
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
+          Fix a null pointer exception.
+        (WebCore::ACCESSOR_GETTER):
+        * platform/network/chromium/ResourceRequest.h:
+          Switch from appCache 'context' to 'host' terminology.
+          Note: leaving the old deprecated accessors in place until the matching
+          change in chrome is landed to use the new accessors.
+        (WebCore::ResourceRequest::ResourceRequest):
+        (WebCore::ResourceRequest::appCacheHostID):
+        (WebCore::ResourceRequest::setAppCacheHostID):
+        (WebCore::ResourceRequest::appCacheContextID):
+        (WebCore::ResourceRequest::setAppCacheContextID):
+        * platform/network/chromium/ResourceResponse.h:
+          Add an appCacheManifestURL getter/setter.
+          Drop the 'get' prefix from the appCacheID getter.
+          Note: leaving the old deprecated 'get' prefixed accessor in place until the matching
+          change in chrome is landed to use the new accessor.
+        (WebCore::ResourceResponse::appCacheID):
+        (WebCore::ResourceResponse::appCacheManifestURL):
+        (WebCore::ResourceResponse::setAppCacheManifestURL):
+        (WebCore::ResourceResponse::getAppCacheID):
+
+2009-09-07  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28359
+        Cleanup: Undo some accidental changes around DOMApplicationCache.
+        - Restore support for constructing a DOMApplicationCache object with a null frame ptr.
+        - Return a non-null object for window.applicationCache when the feature is disabled.
+        - Simplify the swapCache method.
+
+        Test: http/tests/appcache/disabled.html
+
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::DOMApplicationCache):
+        (WebCore::DOMApplicationCache::swapCache):
+        (WebCore::DOMApplicationCache::scriptExecutionContext):
+        * loader/appcache/DOMApplicationCache.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::applicationCache):
+
+2009-09-06  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        hostname and host are mixed up when manipulating anchor elements.
+        https://bugs.webkit.org/show_bug.cgi?id=28954
+
+        handle the case of port 0.
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::host):
+
+2009-09-06  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Make hidden elements not focusable.
+
+        Clean up supportsFocus and isFocusable.
+        supportsFocus now strictly means that the node can be focused by default.
+        This is true for links, form controls and content editable elements for example.
+        isFocusable means that the user can actually focus it.
+        All (2) calls to supportsFocus have been updated to take this into account.
+        
+        Make a elements without href work correctly as well.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27099
+
+        Tests: fast/events/click-focus-anchor.html
+               fast/events/tab-focus-anchor.html
+               fast/events/tab-focus-hidden.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::focus):
+        * dom/Node.cpp:
+        (WebCore::Node::supportsFocus):
+        (WebCore::Node::isFocusable):
+        * dom/Node.h:
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::supportsFocus):
+        (WebCore::HTMLAnchorElement::isMouseFocusable):
+        (WebCore::HTMLAnchorElement::isKeyboardFocusable):
+        * html/HTMLAnchorElement.h:
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::supportsFocus):
+        * html/HTMLAreaElement.h:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::supportsFocus):
+        * html/HTMLElement.h:
+        * html/HTMLFieldSetElement.cpp:
+        (WebCore::HTMLFieldSetElement::supportsFocus):
+        * html/HTMLFieldSetElement.h:
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::supportsFocus):
+        (WebCore::HTMLFormControlElement::isFocusable):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::supportsFocus):
+        * html/HTMLFrameElementBase.h:
+        * html/HTMLLegendElement.cpp:
+        (WebCore::HTMLLegendElement::supportsFocus):
+        * html/HTMLLegendElement.h:
+        * html/HTMLOptGroupElement.cpp:
+        (WebCore::HTMLOptGroupElement::supportsFocus):
+        (WebCore::HTMLOptGroupElement::isFocusable):
+        * html/HTMLOptGroupElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::supportsFocus):
+        (WebCore::HTMLOptionElement::isFocusable):
+        * html/HTMLOptionElement.h:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::dispatchMouseEvent):
+        * page/FocusController.cpp:
+        (WebCore::FocusController::advanceFocus):
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::supportsFocus):
+        (WebCore::SVGAElement::isFocusable):
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::supportsFocus):
+        * wml/WMLAElement.h:
+        * wml/WMLFormControlElement.cpp:
+        (WebCore::WMLFormControlElement::supportsFocus):
+        (WebCore::WMLFormControlElement::isFocusable):
+        * wml/WMLFormControlElement.h:
+
+2009-09-06  Joel Stanley  <joel@jms.id.au>
+
+        Reviewed by Dimitri Glazkov.
+
+        Expose functions to set the caret blink interval for Linux Chromium.
+        Default value is set to that of RenderTheme::caretBlankInterval().
+        Uses caretBlinkIntervalInternal to avoid overriding
+        RenderThemeChromiumSkia::caretBlankInterval to preserve the disabling
+        of blinking caret required for layout tests.
+        https://bugs.webkit.org/show_bug.cgi?id=28931
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
+        (WebCore::RenderThemeChromiumLinux::setCaretBlinkInterval):
+        (WebCore::RenderThemeChromiumLinux::caretBlinkIntervalInternal):
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-06  Ada Chan  <adachan@apple.com>
+
+        Remove an extra </File> in WebCore.vcproj.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-09-06  Timothy Hatcher  <timothy@apple.com>
+
+        Adds a persistent setting for color format in the Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28889
+
+        Reviewed by Dan Bernstein.
+
+        * English.lproj/localizedStrings.js: New strings.
+        * inspector/front-end/Color.js: Minor style fixes.
+        (WebInspector.Color.prototype.toString): Added. Replaces the individual
+        "toFoo" functions. Takes a optional arguments for the color format to return.
+        * inspector/front-end/Images/paneSettingsButtons.png: Added.
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._changeColorFormat): Update the sections to show
+        the new color format.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor.changeColorDisplay):
+        Use the new toString function on Color.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor): Use the persistent setting
+        to format colors by default. Add a tooltip for the color swatch.
+        * inspector/front-end/inspector.css: New styles for the settings menu.
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded): Initilize the colorFormat preference.
+
+2009-09-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Remove Qt v4.6 check from the prefetchDNS implementation
+        https://bugs.webkit.org/show_bug.cgi?id=28993
+
+        * platform/network/qt/DnsPrefetchHelper.cpp:
+        * platform/network/qt/DnsPrefetchHelper.h:
+
+2009-09-06  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Drop <definition-src> support
+        https://bugs.webkit.org/show_bug.cgi?id=28991
+
+        http://dev.w3.org/SVG/profiles/1.1F2/publish/changes.html#FontsChapter
+
+        * DerivedSources.cpp: Remove references to definition-src.
+        * DerivedSources.make: Ditto.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/objc/DOM.mm:
+        (WebCore::createElementClassMap): Ditto.
+        * bindings/objc/DOMSVG.h: Ditto.
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Ditto.
+        * bindings/v8/V8DOMWrapper.cpp: Ditto.
+        * bindings/v8/V8Index.cpp: Ditto.
+        * bindings/v8/V8Index.h: Ditto.
+        * svg/SVGAllInOne.cpp: Ditto.
+        * svg/SVGDefinitionSrcElement.cpp: Removed.
+        * svg/SVGDefinitionSrcElement.h: Removed.
+        * svg/SVGDefinitionSrcElement.idl: Removed.
+        * svg/SVGFontFaceElement.cpp:
+        (WebCore::SVGFontFaceElement::rebuildFontFace): Don't search for
+        definition-src child.
+        * svg/svgtags.in: Remove definition-src.
+
+2009-09-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Roll out http://trac.webkit.org/changeset/48094, because the
+        logic of retrieving default caret blink interval was incorrect (non-existent)
+        and caused layout test flakiness.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-05  Jian Li  <jianli@chromium.org>
+
+        Reviewed by NOBODY (Chromium reliability build break).
+
+        Back up partial change in r48072 in order to fix chromium reliability build break.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+
+2009-09-05  Nicolas Weber  <thakis@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28975
+        Fix file upload on chrome/mac. Images that have "Hide Extension" set,
+        such as screenshots by default, can now be uploaded to sites such as
+        imgur.com.
+
+        * platform/FileSystem.h:
+        Add pathGetDisplayFileName().
+        * platform/chromium/FileChooserChromium.cpp:
+        (WebCore::FileChooser::basenameForWidth):
+        Call pathGetDisplayFileName() instead of pathGetFileName().
+        * platform/chromium/FileSystemChromiumLinux.cpp:
+        (WebCore::pathGetDisplayFileName):
+        Implement pathGetDisplayFileName() by delegating to pathGetFileName().
+        * platform/chromium/FileSystemChromiumMac.mm:
+        (WebCore::pathGetFileName):
+        Now returns a real filename instead of a presentational one, which
+        fixes the problem addressed by this change.
+        (WebCore::pathGetDisplayFileName):
+        New function that returns a presentational filename; does what
+        pathGetDisplayFileName() did prior to this patch.
+        * platform/chromium/FileSystemChromiumWin.cpp:
+        (WebCore::pathGetDisplayFileName):
+        Implement pathGetDisplayFileName() by delegating to pathGetFileName().
+
+2009-09-05  Joel Stanley  <joel@jms.id.au>
+
+        Reviewed by David Levin.
+
+        Expose functions to set the caret blink interval for Linux Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=28931
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::setCaretBlinkInterval):
+        (WebCore::RenderThemeChromiumLinux::caretBlinkInterval):
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-04  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Prevent UI freeze in case when too many timers are in the timer queue.
+        https://bugs.webkit.org/show_bug.cgi?id=23865
+
+        The fix measures the elapsed time while executing timers. If we have too many
+        timers and it takes significant time to fire, quit the loop and reschedule.
+        This lets the run loop process user input (close the window for example).
+
+        * platform/ThreadTimers.h:
+        * platform/ThreadTimers.cpp:
+        (WebCore::ThreadTimers::sharedTimerFiredInternal):
+        (WebCore::ThreadTimers::fireTimersInNestedEventLoop):
+        Removed functions and members used before to grab a list of all expired timers.
+        Now we fetch one by one, measuring time and quitting the loop if it takes too long.
+        * platform/Timer.cpp:
+        (WebCore::TimerBase::isActive):
+        (WebCore::TimerBase::setNextFireTime):
+        Since timers are now fired one by one, there is no need to keep track of updated timers.
+        * manual-tests/input-starved-by-timers.html: Manual test that attempts to freeze browser by
+        creating of enough timers. It then keeps UI frozen and after 10 seconds starts to drain the timers
+        so the browser un-freezes. This is instead of a regular layout test because we don't have a way
+        to inject an input events via regular run loop in DRT - instead they are directly dispatched by
+        eventSender, which does not reproduce the UI freeze that happens with real input.
+
+2009-09-04  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/7201063>
+        
+        Detach any custom scrollbars before detaching the document.
+        
+        * page/Frame.cpp:
+        (WebCore::Frame::setView):
+
+2009-09-04  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+                Unreviewed, build fix.
+
+                Remove remaining references to UserStyleSheetLoader after r48075.
+
+                * WebCore.gypi:
+                * WebCore.xcodeproj/project.pbxproj:
+                * page/qt/FrameQt.cpp:
+                * page/wince/FrameWince.cpp:
+
+2009-09-04  Michelangelo De Simone  <micdesim@gmail.com>
+
+                Reviewed by David Levin.
+
+                https://bugs.webkit.org/show_bug.cgi?id=28988
+                Minor fix: "novalidate" attribute renamed in "noValidate", according to
+                HTML5 specs:
+                http://www.whatwg.org/specs/web-apps/current-work/#dom-fs-novalidate
+
+                * html/HTMLFormElement.cpp:
+                (WebCore::HTMLFormElement::noValidate):
+                (WebCore::HTMLFormElement::setNoValidate):
+                * html/HTMLFormElement.h:
+                * html/HTMLFormElement.idl:
+
+2009-09-04  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Remove unused line of code from WorkerContext
+        https://bugs.webkit.org/show_bug.cgi?id=28990
+
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::importScripts):
+
+2009-09-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix assertion seen when running buildbot.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure): Create the structure without
+        the HasDefaultMark bit since this has a custom mark function.
+
+2009-09-04  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28984, remove the remote stylesheet loader on Mac/Qt.
+        Make sure the other code path (now used by everybody) can handle data URLs.
+
+        As per the post on webkit-dev, the ability to work remotely isn't working properly anyway (it doesn't
+        hold up the pending sheet count, so you'd just FOUC on every Web page), and it's extremely unlikely
+        that anybody is relying on this support.
+        
+        Tor Arne agreed it was ok to disable (he enabled it on the Qt side), and only Mac/Qt were using this
+        code.
+
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::userStyleSheet):
+        * dom/Document.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+        * loader/UserStyleSheetLoader.cpp: Removed.
+        * loader/UserStyleSheetLoader.h: Removed.
+        * page/Frame.cpp:
+        (WebCore::Frame::reapplyStyles):
+        * page/Frame.h:
+        * page/Page.cpp:
+        (WebCore::Page::userStyleSheetLocationChanged):
+        (WebCore::Page::userStyleSheet):
+        * page/mac/FrameMac.mm:
+        * page/qt/FrameQt.cpp:
+
+2009-09-04  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Add "sampling profiler" preference, simplify data display when it's set.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28969
+
+        * inspector/front-end/ProfileDataGridTree.js:
+        (WebInspector.ProfileDataGridNode.prototype.get data.formatMilliseconds):
+        (WebInspector.ProfileDataGridNode.prototype.get data):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView):
+        * inspector/front-end/inspector.js:
+
+2009-09-04  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Run-time exception in onmessage handler is not forwarded to the worker object.
+        https://bugs.webkit.org/show_bug.cgi?id=28980
+
+        Tested by worker-close.html.
+
+        * bindings/v8/ScriptFunctionCall.cpp:
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::getScriptExecutionContext):
+        (WebCore::reportException):
+        * bindings/v8/V8Utilities.h:
+        (WebCore::getScriptExecutionContext):
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-09-04  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Remove unused m_sheet variable and setCSSStyleSheet methods.
+
+        * dom/Document.cpp:
+        * dom/Document.h:
+
+2009-09-04  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by David Hyatt and Adele Peterson.
+
+        (Based on a patch from Adele).
+        
+        Fix <rdar://problem/7185875>.
+        
+        * page/Frame.cpp:
+        (WebCore::Frame::setView):
+        Detach any custom scroll bars from the old view.
+        
+        * page/FrameView.cpp:
+        (WebCore::FrameView::detachCustomScrollbars):
+        Simplify the check (and make it work when body is null) by just checking that the scroll bar owner is
+        not a RenderPart object.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroy):
+        ASSERT that frame() is not null here and also add a null check so that release builds won't crash.
+
+2009-09-04  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Make m_userStyleSheetLoader in Frame an OwnPtr.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::~Frame):
+        * page/Frame.h:
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::setUserStyleSheetLocation):
+        (WebCore::Frame::setUserStyleSheet):
+
+2009-09-04  Timothy Hatcher  <timothy@apple.com>
+
+        Show color swatches in the Web Inspector before the color text so clicking them will not
+        shift the swatch. Also makes multiple swatches in the single property toggle the color format.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28978
+
+        Reviewed by Darin Adler.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle): Some refactoring to consolidate
+        the processing we do on the property value. This eliminated the old nickname code, since the new
+        WebInspector.Color class handles this. We could also simplify the color regex since more
+        is handled by the Color class. Also no longer uses innerHTML for the linkify code.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processValue): Helper function to
+        process a value given a regex and processor functions. 
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.linkifyURL): Make an anchor for the
+        URL with "url()" syntax surrounding it.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor): Makes a color, if
+        there was an exception just return a text node.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor.changeColorDisplay.changeTo):
+        Moved from later in the file.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor.changeColorDisplay): Ditto.
+        * inspector/front-end/inspector.css:
+
+2009-09-04  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28614
+
+        Account for scrollbar state changes that occur during layout.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+
+        Perform a layout prior to checking whether the scrollbar modes are
+        off, on, or automatic.  The modes may change during layout.
+
+        * WebCore.base.exp:
+        * WebCore.order:
+        * page/Frame.cpp:
+        (WebCore::Frame::createView):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::resetScrollbars):
+        (WebCore::FrameView::layout):
+        * page/FrameView.h:
+        * platform/ScrollView.h:
+
+        Eliminate duplicated (and incorrect) scrollbar mode tracking between
+        FrameView and ScrollView.
+
+2009-09-04  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        hostname and host are mixed up when manipulating anchor elements.
+        https://bugs.webkit.org/show_bug.cgi?id=28954
+
+        Swapped the implementation of host and hostname, and made sure not to return
+        the port number if it is default for the given protocol. 
+        FireFox also avoids returning the protocol number if it is default.
+
+        Test: fast/dom/Element/hostname-host.html
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::host):
+        (WebCore::HTMLAnchorElement::hostname):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::isDefaultPortForProtocol):
+        * page/SecurityOrigin.h:
+
+2009-09-04  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler and Steve Falkenburg.
+
+        Fix <rdar://problem/7192902>.
+
+        Add the necessary plumbing for having QTMovieWin use WebCore timers.
+        
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::TaskTimer::initialize):
+        Create the timer and call QTMovieWin::setTaskTimerFuncs.
+        
+        (WebCore::TaskTimer::setTaskTimerDelay):
+        Start the timer.
+        
+        (WebCore::TaskTimer::stopTaskTimer):
+        Stop the timer.
+        
+        (WebCore::TaskTimer::fired):
+        Call QTMovieWin::taskTimerFired().
+        
+        (WebCore::MediaPlayerPrivate::load):
+        Initialize the Task timer.
+        
+        * platform/graphics/win/QTMovieWin.cpp:
+        (updateTaskTimer):
+        Call the global stopTaskTimer function and setTaskTimerDelay.
+        
+        (QTMovieWin::taskTimerFired):
+        Make this a member function.
+        
+        (QTMovieWin::setTaskTimerFuncs):
+        Set the global function pointers.
+        
+        (QTMovieWin::initializeQuickTime):
+        (DllMain):
+        No need to use the QT shared timer.
+        * platform/graphics/win/QTMovieWin.h:
+
+2009-09-04  Tony Chang  <tony@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix Chromium Win compile.  Missing return statement in
+        WebCore::RenderThemeChromiumSkia::paintSliderThumb.
+        https://bugs.webkit.org/show_bug.cgi?id=28974
+
+        No new tests, build fix.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintSliderThumb):
+
+2009-09-04  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Rolling out http://trac.webkit.org/changeset/48035, because it broke
+        the build.
+        https://bugs.webkit.org/show_bug.cgi?id=28696
+
+2009-09-04  Anders Carlsson  <andersca@apple.com>
+
+        Fix vcproj file.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-09-03  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28890, make simple user script injection work.
+        
+        This patch adds new API for adding and removing user scripts from page groups.  User scripts
+        are bundled together in isolated worlds (you can have multiple scripts together in the same
+        world).
+
+        Added userscripts/ directory for holding new tests (along with a simple test of script injection).
+
+        * WebCore.base.exp:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        * bindings/js/ScriptController.h:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        * bindings/v8/ScriptController.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::finishedParsing):
+        (WebCore::FrameLoader::dispatchDocumentElementAvailable):
+        * page/Frame.cpp:
+        (WebCore::Frame::injectUserScripts):
+        (WebCore::Frame::injectUserScriptsForWorld):
+        * page/Frame.h:
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::~PageGroup):
+        (WebCore::PageGroup::addUserScript):
+        (WebCore::PageGroup::removeUserContentForWorld):
+        (WebCore::PageGroup::removeAllUserContent):
+        * page/PageGroup.h:
+        (WebCore::PageGroup::userScripts):
+        * page/UserScript.h: Added.
+        (WebCore::UserScript::UserScript):
+        (WebCore::UserScript::source):
+        (WebCore::UserScript::url):
+        (WebCore::UserScript::patterns):
+        (WebCore::UserScript::worldID):
+        (WebCore::UserScript::injectionTime):
+        * page/UserScriptTypes.h: Added.
+        (WebCore::):
+
+2009-09-04  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26402
+        Crashes when using a detached DocumentType node
+
+        Test: fast/dom/DOMImplementation/detached-doctype.html
+
+        DocumentType nodes are the only one that can have null document(), and they can never have
+        children, so they are a degenerate case for NodeLists.
+
+        * dom/Node.cpp:
+        (WebCore::Node::childNodes): Don't try register node list with document if there's no
+        document. Since there are no changes possible for a DocumentType's node list, this is not
+        necessary.
+        (WebCore::Node::registerDynamicNodeList): Ditto.
+        (WebCore::Node::unregisterDynamicNodeList): Ditto. I couldn't find a scenario where this
+        was invoked for a DocumentType node, but I also couldn't prove that it can't be (the
+        de-registration code path that I saw taken was via Node destructor, and that already has
+        a null check for document).
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener): Bail out if there is no document (just as we already do
+        if there is no window).
+        (WebCore::JSNode::removeEventListener): Ditto.
+
+2009-09-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] loadFinished never emitted
+        https://bugs.webkit.org/show_bug.cgi?id=28935
+
+        Do not report errors right away from
+        ResourceHandle::start. Instead return true and schedule an error
+        to be reported in the handle later. Otherwise WebCore gets
+        confused and thinks the resource never finished loading, making it
+        not emit the finished status.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::startHttp):
+        (WebCore::):
+
+2009-09-04  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Eric Seidel.
+
+        [V8] DOM Storage bindings: Event Handler should create StorageEvents
+        https://bugs.webkit.org/show_bug.cgi?id=28942
+        
+        Tests:
+        Causes the following tests that were failing with V8 to pass:
+        * storage/domstorage/localstorage/onstorage-attribute-setwindow.html
+        * storage/domstorage/localstorage/complex-keys.html
+        * storage/domstorage/localstorage/onstorage-attribute-markup.html
+        * storage/domstorage/localstorage/simple-events.html
+        * storage/domstorage/localstorage/onstorage-attribute-set-attribute.html
+        * storage/domstorage/localstorage/index-get-and-set.html
+        * storage/domstorage/sessionstorage/onstorage-attribute-setwindow.html
+        * storage/domstorage/sessionstorage/onstorage-attribute-markup.html
+        * storage/domstorage/sessionstorage/simple-events.html
+        * storage/domstorage/sessionstorage/onstorage-attribute-set-attribute.html
+        * storage/domstorage/sessionstorage/index-get-and-set.html
+
+        Code changes:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventToV8Object):  Create StorageEvents.
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        (WebCore::storageGetter): Check if we are retrieving the length property and return the number of items in the object rather than a property named length when invoking the getItem() member of local/sessionStorage.
+
+2009-09-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28911
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleView.prototype._formatarray):
+        (WebInspector.ConsoleView.prototype._formatnode):
+        * inspector/front-end/DOMAgent.js:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.dispatch):
+        * inspector/front-end/InjectedScriptAccess.js: Added.
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane.prototype.update):
+        (WebInspector.MetricsSidebarPane.prototype.editingCommitted):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype.update):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.applyExpression):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/inspector.html:
+
+2009-09-04  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement <input type="range"> for Chromium Linux by painting
+        the slider and the thumb using skia.
+        https://bugs.webkit.org/show_bug.cgi?id=28928
+
+        Covered by existing tests (we're currently hitting an assert for them).
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::adjustSliderThumbSize):
+        * rendering/RenderThemeChromiumLinux.h:
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::drawVertLine):
+        (WebCore::drawHorizLine):
+        (WebCore::drawBox):
+        (WebCore::RenderThemeChromiumSkia::paintSliderTrack):
+        (WebCore::RenderThemeChromiumSkia::paintSliderThumb):
+        * rendering/RenderThemeChromiumSkia.h:
+
+2009-09-04  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        - Implement <input type=color> as a text field.
+        - ValidityState::typeMismatch supports for type=color.
+        https://bugs.webkit.org/show_bug.cgi?id=28966
+
+        Tests: fast/forms/ValidityState-patternMismatch-unsupported.html
+               fast/forms/ValidityState-typeMismatch-color.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueMissing):
+        (WebCore::HTMLInputElement::patternMismatch):
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::formControlType):
+        (WebCore::HTMLInputElement::saveFormControlState):
+        (WebCore::HTMLInputElement::restoreFormControlState):
+        (WebCore::HTMLInputElement::accessKeyAction):
+        (WebCore::HTMLInputElement::rendererIsNeeded):
+        (WebCore::HTMLInputElement::createRenderer):
+        (WebCore::HTMLInputElement::appendFormData):
+        (WebCore::HTMLInputElement::valueWithDefault):
+        (WebCore::HTMLInputElement::storesValueSeparateFromAttribute):
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        (WebCore::HTMLInputElement::isRequiredFormControl):
+        (WebCore::HTMLInputElement::dataList):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::):
+        (WebCore::HTMLInputElement::isTextField):
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+        (WebCore::ValidityState::isValidColorString):
+        * html/ValidityState.h:
+
+2009-09-04  Mads Ager  <ager@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Crash when updating document cache
+        https://bugs.webkit.org/show_bug.cgi?id=28965
+
+        Initialization of a V8 JavaScript context can fail.  When that
+        happens, do not attempt to update the document wrapper cache.
+
+        This code path is exercised by http/tests/security/javascriptURL/javascriptURL-in-new-iframe.html.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::updateDocument):
+
+2009-09-04  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Two bugs:
+
+        https://bugs.webkit.org/show_bug.cgi?id=25489
+        CSS property background-position is now serialized in shorthand string as
+        background-position-x background-position-y, as the specification requires
+        (See http://www.w3.org/TR/2008/WD-css3-background-20080910/#the-background-position).
+        
+
+        https://bugs.webkit.org/show_bug.cgi?id=26541
+        CSS background-color is now be serialized before other background properties, 
+        as CSS specification requires (See http://dev.w3.org/csswg/cssom/#css-value).  
+
+        An existing layout test that accepted wrong order and skipped position test 
+        had to be modified.
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
+
+2009-09-03  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add support for HTMLTextAreaElement.textLength
+        https://bugs.webkit.org/show_bug.cgi?id=28929
+
+        Test: fast/forms/textarea-textlength.html
+
+        * html/HTMLTextAreaElement.h:
+        (WebCore::HTMLTextAreaElement::textLength):
+        * html/HTMLTextAreaElement.idl:
+
+2009-09-03  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7180197>, https://bugs.webkit.org/show_bug.cgi?id=28822
+        REGRESSION(r31231): Creating document with current document's DOCTYPE causes crashes
+
+        Test: fast/dom/DOMImplementation/createDocument-with-used-doctype.html
+
+        * dom/DOMImplementation.cpp: (WebCore::DOMImplementation::createDocument): Even though we
+        cannot raise an exception immediately out of fear of breaking Acid3, we shouldn't use a
+        DocumentType node in two documents.
+
+2009-09-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Page Cache should support pages with Frames.
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        Tests: fast/events/pageshow-pagehide-on-back-cached-with-frames.html
+               fast/loader/frames-with-unload-handlers-in-page-cache.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+
+2009-09-03  Steve VanDeBogart  <vandebo@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Handle middle click in Chromium like QT
+        https://bugs.webkit.org/show_bug.cgi?id=28696
+
+        Tested by middle-click-onpaste.html.
+
+        * platform/Pasteboard.h:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::getData):
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::Pasteboard):
+        (WebCore::Pasteboard::isSelectionMode):
+        (WebCore::Pasteboard::setSelectionMode):
+        (WebCore::Pasteboard::canSmartReplace):
+        (WebCore::Pasteboard::plainText):
+        (WebCore::Pasteboard::documentFragment):
+        * platform/chromium/PasteboardPrivate.h:
+        (WebCore::PasteboardPrivate::):
+
+2009-09-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        More partial work towards "Page Cache should support pages with Frames"
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        Fix a bug where subframes weren't asked if they were cacheable.
+
+        No new tests, especially since page caching for frames isn't turned on yet.
+        A layout test will come in my next patch, which enables frames in the page cache.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+
+2009-09-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by eric@webkit.org.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24696
+
+        Added mixed content methods to FrameLoaderClient.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::didDisplayInsecureContent):
+        (WebCore::EmptyFrameLoaderClient::didRunInsecureContent):
+        * loader/FrameLoaderClient.h:
+
+2009-09-03  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Frames support
+        https://bugs.webkit.org/show_bug.cgi?id=19041
+
+        * page/wx/EventHandlerWx.cpp:
+        (WebCore::EventHandler::passMousePressEventToSubframe):
+        (WebCore::EventHandler::passMouseMoveEventToSubframe):
+        (WebCore::EventHandler::passMouseReleaseEventToSubframe):
+        (WebCore::EventHandler::passWheelEventToWidget):
+        (WebCore::EventHandler::tabsToAllControls):
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+        (WebCore::EventHandler::passMouseDownEventToWidget):
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::nativeWindowForRenderObject):
+        (WebCore::RenderThemeWx::paintButton):
+        (WebCore::RenderThemeWx::paintTextField):
+        (WebCore::RenderThemeWx::paintMenuList):
+        (WebCore::RenderThemeWx::paintMenuListButton):
+        * platform/wx/ScrollbarThemeWx.cpp: Added.
+        (WebCore::ScrollbarTheme::nativeTheme):
+        (WebCore::ScrollbarThemeWx::~ScrollbarThemeWx):
+        (WebCore::ScrollbarThemeWx::scrollbarThickness):
+        (WebCore::ScrollbarThemeWx::hasThumb):
+        (WebCore::ScrollbarThemeWx::buttonSize):
+        (WebCore::ScrollbarThemeWx::backButtonRect):
+        (WebCore::ScrollbarThemeWx::forwardButtonRect):
+        (WebCore::ScrollbarThemeWx::trackRect):
+        (WebCore::ScrollbarThemeWx::paintScrollCorner):
+        (WebCore::ScrollbarThemeWx::paint):
+        * platform/wx/ScrollbarThemeWx.h: Added.
+        (WebCore::ScrollbarThemeWx::hasButtons):
+        * platform/wx/TemporaryLinkStubs.cpp:
+        * platform/wx/wxcode/gtk/scrollbar_render.cpp: Added.
+        (wxStyleForPart):
+        (GetButtonWidget):
+        (wxGetGdkWindowForDC):
+        (wxRenderer_DrawScrollbar):
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp: Added.
+        (wxScrollbarPartToHIPressedState):
+        (wxRenderer_DrawScrollbar):
+        * platform/wx/wxcode/scrollbar_render.h: Added.
+        (calcThumbStartAndLength):
+        * platform/wx/wxcode/win/non-kerned-drawing.cpp:
+        (WebCore::drawTextWithSpacing):
+        * platform/wx/wxcode/win/scrollbar_render.cpp: Added.
+        (GraphicsHDC::GraphicsHDC):
+        (GraphicsHDC::~GraphicsHDC):
+        (GraphicsHDC::operator HDC):
+        (getTSStateForPart):
+        (wxRenderer_DrawScrollbar):
+        * webcore-wx.bkl:
+
+2009-09-03  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Page content is not displayed in case of HTTP status error
+        https://bugs.webkit.org/show_bug.cgi?id=28949
+
+        If the server sent content, show it to the user instead of an error,
+        even if the HTTP status code is not success.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::forwardData):
+        (WebCore::QNetworkReplyHandler::resetState):
+        * platform/network/qt/QNetworkReplyHandler.h:
+
+2009-09-03  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Need to update v8 bindings to support passing multiple ports to postMessage()
+        https://bugs.webkit.org/show_bug.cgi?id=28839
+
+        Added support for passing MessagePortArray to v8 bindings.
+
+        New tests that now pass with V8:
+               fast/events/message-port-multi.html
+               fast/workers/worker-context-multi-port.html
+               fast/workers/worker-multi-port.html
+
+        * WebCore.gypi:
+        Added V8MessageEventCustom.cpp and V8MessagePortCustom.h
+        * bindings/v8/custom/V8CustomBinding.h:
+        Added custom postMessage() handlers for various classes.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::DOMWindowPostMessage):
+        Added custom handler that supports MessagePortArray.
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        (WebCore::DedicatedWorkerContextPostMessage):
+        Added custom handler that supports MessagePortArray.
+        * bindings/v8/custom/V8MessageEventCustom.cpp: Added.
+        (WebCore::MessageEventPorts):
+        Added getter for ports attribute.
+        (WebCore::MessageEventInitMessageEvent):
+        Added custom handler that supports MessagePortArray.
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::MessagePortPostMessage):
+        Added custom handler that supports MessagePortArray.
+        (WebCore::getMessagePortArray):
+        Added helper function that supports converting from a sequence-like object to a MessagePortArray.
+        * bindings/v8/custom/V8MessagePortCustom.h: Added.
+        Added declaration for getMessagePortArray().
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::WorkerPostMessage):
+        Added custom handler that supports MessagePortArray.
+
+2009-09-03  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Sam Weinig.
+
+        Need to update JS bindings and IDL files to support multiple message ports in postMessage()
+        https://bugs.webkit.org/show_bug.cgi?id=28460
+
+        Added new toJSSequence() API which validates that a JSValue meets the WebIDL criteria for a sequence.
+
+        Tests: fast/events/message-port-multi.html
+               fast/workers/worker-context-multi-port.html
+               fast/workers/worker-multi-port.html
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        Added JSMessagePortCustom.h and JSMessageEventCustom.cpp.
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::toJSSequence):
+        Added toJSSequence() API to do validation on sequence-like objects per WebIDL.
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::postMessage):
+        Added custom handler for postMessage() that handles being passed MessagePortArrays.
+        * bindings/js/JSDedicatedWorkerContextCustom.cpp:
+        (WebCore::JSDedicatedWorkerContext::postMessage):
+        Added custom handler for postMessage() that handles being passed MessagePortArrays.
+        * bindings/js/JSMessageEventCustom.cpp: Added.
+        (WebCore::JSMessageEvent::ports):
+        Added custom ports() getter that converts from MessagePortArray to JSArray.
+        (WebCore::JSMessageEvent::initMessageEvent):
+        Added support for passing a MessagePortArray.
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::postMessage):
+        Added custom handler for postMessage() that handles being passed MessagePortArray.
+        (WebCore::fillMessagePortArray):
+        New helper routine that validates/converts from a JS sequence o a WebCore::MessagePortArray.
+        * bindings/js/JSMessagePortCustom.h: Added.
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::postMessage):
+        Added custom handler for postMessage() that handles being passed MessagePortArray.
+        * dom/MessageEvent.cpp:
+        * dom/MessageEvent.h:
+        (WebCore::MessageEvent::ports):
+        Changed ports() to return a MessagePortArray* since this value can be null.
+        * dom/MessageEvent.idl:
+        Updated IDL to match HTML5 spec (now accepts MessagePortArrays instead of a solitary MessagePort).
+        * dom/MessagePort.cpp:
+        * dom/MessagePort.h:
+        * dom/MessagePort.idl:
+        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
+        * workers/DedicatedWorkerContext.cpp:
+        * workers/DedicatedWorkerContext.h:
+        * workers/DedicatedWorkerContext.idl:
+        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
+        * workers/Worker.cpp:
+        * workers/Worker.h:
+        * workers/Worker.idl:
+        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
+
+2009-09-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Do not query non-function call frames for function name.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28799
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.CallFrameProxy):
+        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain):
+
+2009-09-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Crash after typing "clear" and pressing return in inspector console.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28684
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._clearConsoleMessages):
+        (InjectedScript._inspectObject):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+
+2009-09-03  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Squeezed out some performance from string conversion.
+        https://bugs.webkit.org/show_bug.cgi?id=28945
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::WebCoreStringResource::WebCoreStringResource):
+        (WebCore::WebCoreStringResource::~WebCoreStringResource):
+        (WebCore::WebCoreStringResource::data):
+        (WebCore::WebCoreStringResource::length):
+        (WebCore::WebCoreStringResource::atomicString):
+        (WebCore::WebCoreStringResource::string):
+        Avoid calling virtual length method. Be more explicit with
+        external memory computation. Avoid function calls in data and
+        length.
+        (WebCore::):
+        (WebCore::v8StringToWebCoreString):
+        (WebCore::v8StringToAtomicWebCoreString):
+        (WebCore::v8NonStringValueToWebCoreString):
+        (WebCore::v8NonStringValueToAtomicWebCoreString):
+        Avoid extra calls of WebCoreStringResource::toString. When
+        AtomicString is computed pass it immediately when constructing
+        WebCoreStringResource. Use inline buffer for small strings.
+        * bindings/v8/V8Binding.h:
+        (WebCore::v8ValueToWebCoreString):
+        (WebCore::v8ValueToAtomicWebCoreString):
+        (WebCore::toString):
+        Inline dispatch of string vs. non-string values.
+
+2009-09-03  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Inlined common case of V8IsolatedWorld::getEntered to speed
+        up V8Proxy lookup.
+        https://bugs.webkit.org/show_bug.cgi?id=28946
+
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::getEnteredImpl):
+        * bindings/v8/V8IsolatedWorld.h:
+        (WebCore::V8IsolatedWorld::getEntered):
+
+2009-09-03  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix a regression bug that maxLength doesn't work for IME input.
+        https://bugs.webkit.org/show_bug.cgi?id=25253
+
+        Tests: fast/forms/input-maxlength-ime-completed.html
+               fast/forms/input-maxlength-ime-preedit.html
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::handleBeforeTextInsertedEvent):
+        * dom/InputElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-09-03  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Make SVGStyleElement title/media/type setters do something
+        https://bugs.webkit.org/show_bug.cgi?id=28828
+
+        Test: svg/dom/style-reflect.html
+
+        * svg/SVGStyleElement.cpp:
+        (WebCore::SVGStyleElement::setXmlspace): Actually change the attribute.
+        (WebCore::SVGStyleElement::setType): Ditto.
+        (WebCore::SVGStyleElement::setMedia): Ditto.
+        (WebCore::SVGStyleElement::setTitle): Ditto.
+
+2009-09-03  Ben Murdoch  <benm@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=28872
+        
+        Fixes a bug where handleEvent() in the V8 Custom SQL Statement Error binding would not return the correct result to WebCore after invoking the callback.
+
+        Test: storage/statement-error-callback.html
+
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
+        (WebCore::V8CustomSQLStatementErrorCallback::handleEvent): Return true from handleEvent() if the callback raised an exception or the callback itself returned true.
+
+2009-09-03  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding three font-specific files to WebCore:
+        FontCustomPlatformData.cpp, FontCustomPlatformData.h,
+        and FontPlatformData.h
+        https://bugs.webkit.org/show_bug.cgi?id=28131
+
+        * platform/graphics/haiku/FontCustomPlatformData.cpp: Added.
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/haiku/FontCustomPlatformData.h: Added.
+        (WebCore::FontCustomPlatformData::FontCustomPlatformData):
+        * platform/graphics/haiku/FontPlatformData.h: Added.
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::font):
+        (WebCore::FontPlatformData::size):
+        (WebCore::FontPlatformData::bold):
+        (WebCore::FontPlatformData::oblique):
+        (WebCore::FontPlatformData::hashTableDeletedFontValue):
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        More partial work towards "Page Cache should support pages with Frames"
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        No new tests. (No change in behavior, current tests pass).
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::stopLoading): Adopt the new enum form for FrameLoader::stopLoading().
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading): Take an enum to decide whether to dispatch no unload events,
+          only unload, or unload and pagehide.
+        (WebCore::FrameLoader::closeURL):
+        (WebCore::FrameLoader::scheduleRedirection):
+        (WebCore::FrameLoader::cachePageForHistoryItem): Call pageHidden().
+        (WebCore::FrameLoader::pageHidden): Add to dispatch the pagehide event to all frames in the case
+          where a page is added to the PageCache.
+        * loader/FrameLoader.h:
+
+        * loader/FrameLoaderTypes.h: Add an UnloadEventPolicy enum.
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        More partial work towards "Page Cache should support pages with Frames"
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        - More CachedFrame destruction work.
+        - Including related Frame and FrameLoader changes and cleanup.
+
+        No new tests. (No change in behavior, current tests pass).
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore): Rebuild up the whole FrameTree when restoring.
+        (WebCore::CachedFrame::CachedFrame): Tear down the entire FrameTree when caching.
+        (WebCore::CachedFrame::destroy): For child frames that are being destroyed while in
+          the PageCache, do lightweight cleanup to:
+          A - Prevent referring to a stale Page object.
+          B - Prevent World Leaks of WebKit objects.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopAllLoaders): stopAllLoaders() should never be called on Frames that are
+          in the PageCache. ASSERT that fact.
+        (WebCore::FrameLoader::open): Remove a bogus release-build workaround, as the comment right above it
+          explains it is not effective, and it'd be better to see the crash locally instead of downstream.
+        (WebCore::FrameLoader::closeAndRemoveChild): Make sure the owner element has a page pointer before
+          referencing it.
+        (WebCore::FrameLoader::detachFromParent): Use the new detachViewsAndDocumentLoader() call
+        (WebCore::FrameLoader::detachViewsAndDocumentLoader): Does lightweight cleanup of client (WebKit) objects.
+        * loader/FrameLoader.h:
+
+        * page/Frame.cpp:
+        (WebCore::Frame::detachFromPage): Simply clear the Page pointer without doing any other work.
+        (WebCore::Frame::pageDestroyed): Use the new detachFromPage().
+        * page/Frame.h:
+
+2009-09-02  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Dimitri Glazkov
+
+        [Chromium] Add 'icu::' qualifier in preparation for ICU upgrade to 4.2
+        in Chromium. This is to fix a new file added in r28742 since the
+        last patch for this issue.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28410
+
+        No change in the test result.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::TextRunWalker::getNormalizedTextRun):
+
+2009-09-02  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Correct a typo to fix bustage, caused by r47991.
+        https://bugs.webkit.org/show_bug.cgi?id=27933
+
+        * platform/graphics/skia/ImageBufferSkia.cpp: Changed "Unpremultipled" to "Unmultiplied".
+
+2009-09-02  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Add a missing include to fix bustage, caused by r47991.
+        https://bugs.webkit.org/show_bug.cgi?id=27933
+
+        * platform/graphics/skia/ImageBufferSkia.cpp: Added SkColorPriv include.
+
+2009-09-02  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Implement file support for DragData.
+        https://bugs.webkit.org/show_bug.cgi?id=28896
+
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::DragData::containsURL):
+        (WebCore::DragData::asURL):
+        (WebCore::DragData::containsCompatibleContent):
+
+2009-09-02  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Protect libcurl shared data with Mutex objects via curl_set_share_opt.
+        https://bugs.webkit.org/show_bug.cgi?id=28920
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::sharedResourceMutex):
+        (WebCore::curl_lock_callback):
+        (WebCore::curl_unlock_callback):
+        (WebCore::ResourceHandleManager::ResourceHandleManager):
+
+2009-09-02  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Expose functions to change the focus ring color for Linux Chromium
+
+        https://bugs.webkit.org/show_bug.cgi?id=28887
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
+        (WebCore::RenderThemeChromiumLinux::setFocusRingColor):
+        (WebCore::RenderThemeChromiumLinux::platformFocusRingColor):
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-02  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        SVG Filter premultiplied color support for getImageDate/putImageData
+        [https://bugs.webkit.org/show_bug.cgi?id=27933]
+
+        Patch to get premultiplied color support for Skia on getImageDate/putImageData.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+        (WebCore::putImageData):
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Forget to rename openInFrameloader() to open(), which was requested in Darin's review of my last patch.
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore):
+        (WebCore::CachedFrame::open):
+        * history/CachedFrame.h:
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::restore):
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        In http://trac.webkit.org/changeset/47943 I added new header dependencies to FrameLoader.h.
+        Removing them is a little trouble, but worth it going forward.
+        The pattern of creating a "CachedFrameBase" as the interface CachedFrame provides to FrameLoader
+        was suggested by Darin Adler.
+
+        No new tests. (No change in behavior)
+
+        Make CachedFrame inherit privately from CachedFrameBase, which becomes the interface FrameLoader uses:
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::CachedFrameBase):
+        (WebCore::CachedFrameBase::~CachedFrameBase):
+        (WebCore::CachedFrameBase::restore):
+        (WebCore::CachedFrame::CachedFrame):
+        (WebCore::CachedFrame::openInFrameLoader):
+        * history/CachedFrame.h:
+        (WebCore::CachedFrameBase::document):
+        (WebCore::CachedFrameBase::view):
+        (WebCore::CachedFrameBase::domWindow):
+        (WebCore::CachedFrame::create):
+        (WebCore::CachedFrame::documentLoader):
+        (WebCore::CachedFrame::mousePressNode):
+
+        Call the new ::openInFrameLoader() method on the CachedFrame, as CachedFrameBase is now the only
+        thing capable of interacting with FrameLoader::open(CachedFrameBase):
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::restore):
+        * history/CachedPage.h:
+        (WebCore::CachedPage::documentLoader):
+
+        Make ::open(CachedFrame) public, and change it to ::open(CachedFrameBase):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::open):
+        * loader/FrameLoader.h:
+
+2009-09-02  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Cannot pres Enter to escape from bulleted list when <ul> is a child of <li>.
+        https://bugs.webkit.org/show_bug.cgi?id=24866
+
+        This patch modifies breakOutOfEmptyListItem to break out of a properly nested list
+        (a list to break out of is inside another list item).
+
+        When the empty list item appears at the end of another list item, WebKit breaks out of
+        the outer list item, and adds new item below the outer list item.
+        Otherwise, WebKit breaks out of the the inner list item and inserts new paragraph.
+
+        Test: editing/execCommand/break-out-of-empty-list-item.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem):
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        More partial work towards "Page Cache should support pages with Frames"
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        This patch is primarily about the "CachedFrame tree" and making slightly different decisions
+        based on whether a CachedFrame is the main frame or a subframe.
+
+        - Store whether a CachedFrame represents the main frame or a subframe.
+        - "Chop off the frame tree" for the main frame when creating its CachedFrame, as main frames 
+          are reused and need to start new page loads with an empty frame tree.
+        - Reattach the frame tree to the main frame when restoring it.
+        - open() the cached subframes in their respective loaders when restoring.
+        - Properly clear() and destroy() cached subframes.
+        - When committing to a new page load, and after caching the previous page, only clear the
+          FrameView for the main frame.
+
+        Note that all of above will eventually be necessary as I continue to land this work in pieces,
+        but doesn't actually change any behavior right now because we still refuse to even *try* to
+        cache pages with frames.
+
+        No new tests. No change in behavior, and current tests continue to pass.
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::CachedFrame):
+        (WebCore::CachedFrame::restore):
+        (WebCore::CachedFrame::clear):
+        (WebCore::CachedFrame::destroy):
+        * history/CachedFrame.h:
+        (WebCore::CachedFrame::isMainFrame):
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::clear):
+        (WebCore::FrameLoader::open):
+        * loader/FrameLoader.h:
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        No review, build fix.
+
+        http://trac.webkit.org/changeset/47976 broke the build.  
+        Let's try compiling before we land things, shall we?
+
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData): Order the initialization list correctly.
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        waf build fixes for Windows/MSVC.
+
+        * wscript:
+
+2009-09-02  Ben Murdoch  <benm@google.com>
+
+        Unreviewed build fix for Chromium.
+
+        Missed #including V8Proxy.h in WebCore/bindings/v8/V8Binding.cpp.
+
+        * bindings/v8/V8Binding.cpp: add V8Proxy.h as an include
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        waf build fix, don't define symbols we now grab from other sources.
+
+        * platform/wx/TemporaryLinkStubs.cpp:
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fixes for PluginViewNone.cpp and a wx build fix for PluginView.cpp.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::stop):
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::platformDestroy):
+
+2009-09-02  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by Eric Seidel.
+
+        Fix the build failure of WebKit for Linux/Qt when WML is enabled
+
+        No test cases needed since this just fixes the build problem.
+
+        * wml/WMLElement.cpp:
+        (WebCore::WMLElement::create):
+        * wml/WMLTableElement.cpp:
+        (WebCore::WMLTableElement::joinSuperflousColumns):
+        (WebCore::WMLTableElement::padWithEmptyColumns):
+
+2009-09-02 Yong Li <yong.li@torchmobile.com>
+
+        Reviewed by Adam Barth.
+
+        WINCE PORT: use shared buffer for custom font data
+        https://bugs.webkit.org/show_bug.cgi?id=27734
+
+        Refactored by Joe Mason <joe.mason@torchmobile.com>
+
+        * loader/CachedFont.cpp:
+        add WINCE to platforms using cached custom data
+        * platform/graphics/opentype/OpenTypeUtilities.cpp:
+        (WebCore::renameFont): implement for WinCE
+        * platform/graphics/opentype/OpenTypeUtilities.h:
+        build fixes
+        * platform/graphics/wince/FontCustomPlatformData.cpp:
+        (WebCore::setCustomFontCache): add accessor
+        (WebCore::createFontCustomPlatformData): change param to SharedBuffer
+        * platform/graphics/wince/FontCustomPlatformData.h:
+        update function signatures 
+ 
+2009-09-02 Yong Li <yong.li@torchmobile.com>
+
+        Reviewed by Adam Barth.
+
+        WINCE PORT: font-related build fixes and minor bugfixes
+        https://bugs.webkit.org/show_bug.cgi?id=27734
+
+        * platform/graphics/FontCache.h: declare functions added in https://bugs.webkit.org/show_bug.cgi?id=27509
+        * platform/graphics/GlyphPageTreeNode.cpp:
+        (WebCore::GlyphPageTreeNode::initializePage): fix ambiguous overload error in min/max on Windows
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData): initialize member vars
+        * platform/graphics/SimpleFontData.h: disable unused members on Wince to save space 
+
+2009-09-02  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Another pass at releasing the storage mutex.
+        https://bugs.webkit.org/show_bug.cgi?id=28904
+
+        Another pass at releasing the storage mutex (when applicable) when we finish
+        executing JavaScript.  http://dev.w3.org/html5/spec/Overview.html#storage-mutex
+        describes the required behavior.
+
+        As it turns out, https://bugs.webkit.org/show_bug.cgi?id=28789 didn't solve
+        the problem correctly.  First of all, I missed that events and timeouts go
+        through a different call path.  Second of all, I didn't consider recursion
+        correctly.  Third of all, my check to see if LocalStorage is alive actually
+        instantiates it if it isn't yet.  Fourth, I forgot DOM_STORAGE guards around
+        it.  So I'm reverting that change completely and doing it more cleanly.
+        Unfortunately, the solution isn't as portable (and thus I've left out the JSC
+        implementation for now).
+
+        NOTE: This change now tracks recursion on function callbacks in V8.  I ran this
+        by Mads Ager and Mike Belshe and they seemed to think adding the checks were
+        fine.  Most callbacks are asynchronous and thus wouldn't be nested.  The few
+        scenareos where you can have nested callbacks probably should have always been
+        protected by a recursion guard.
+
+        Unfortunately, this can't be tested without a hook added to the layout test
+        controllers since the lock is (by design) not supposed to be observable by
+        JavaScript.  https://bugs.webkit.org/show_bug.cgi?id=28906
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): revert
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): revert
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::runScript):
+            Add releaseStorageMutex call.  A small amount of clean up.
+        (WebCore::V8Proxy::callFunction):
+            Add releaseStorageMutex call.  A small amount of clean up.
+        (WebCore::V8Proxy::releaseStorageMutex):
+            Check to see if localStorage has been instantiated.  If so, tell it to
+            unlock all storage areas.
+        * bindings/v8/V8Proxy.h:
+        * page/PageGroup.h:
+        (WebCore::PageGroup::hasLocalStorage):  Make hasLocalStorage public.
+
+2009-09-02  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Barth.
+
+        WINCE PORT: Implement ImageBuffer for WINCE
+        Implement Image interface with a light class BufferedImage
+        for rendering ImageBuffer
+        https://bugs.webkit.org/show_bug.cgi?id=28167
+
+        * platform/graphics/wince/ImageBufferData.h: Added.
+        * platform/graphics/wince/ImageBufferWince.cpp: Added.
+
+2009-08-31  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Join the various PluginView destructors into one shared implementation
+
+        https://bugs.webkit.org/show_bug.cgi?id=27706
+
+        The Qt port used to delete the platform plugin widget as the last step.
+        Now this is done before cleaning up the script objects and unloading the
+        plugin package, similar to how the Win port does it.
+
+        * plugins/PluginView.cpp:
+        * plugins/PluginViewNone.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/mac/PluginViewMac.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        * plugins/win/PluginViewWin.cpp:
+
+2009-08-31  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Share PluginView::init() between ports
+
+        https://bugs.webkit.org/show_bug.cgi?id=27706
+
+        The port-spesific bits are moved to platformStart(), which now returns
+        a bool based on the success of the platformStart.
+
+        m_hasPendingGeometryChange is now initialized in the initializer list
+        instead of in PluginViewQt's init()
+
+        PluginViewMac (currently used only by the Qt port) used to manually call
+        stop() in the case where an unsupported drawing or event model was detected.
+        This was wrong, as the m_status and m_isStarted fields should be used to
+        guard against doing operations on a plugin in this intermediate state.
+
+        * plugins/PluginView.cpp:
+        * plugins/PluginView.h:
+        * plugins/PluginViewNone.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/mac/PluginViewMac.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        * plugins/win/PluginViewWin.cpp:
+
+2009-09-02  Ben Murdoch  <benm@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=28737
+        
+        Update JavaScript bindings in JSC and V8 for SQLTransaction to throw exceptions in the right places.
+
+        * bindings/js/JSSQLTransactionCustom.cpp:
+        (WebCore::JSSQLTransaction::executeSql): Throw an exception if no parameters are passed to executeSql().
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8ValueToWebCoreString): Catch an exception if thrown from toString().
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Allow "arrayish objects" to be passed to executeSql.
+
+2009-09-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Migrate Databases tab to InjectedScript /
+        serialized interaction.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28873
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+        * inspector/front-end/Database.js:
+        (WebInspector.Database.prototype.isDB):
+        (WebInspector.Database.prototype.runWithTableNames.sortingCallback):
+        (WebInspector.Database.prototype.runWithTableNames):
+        (WebInspector.Database.prototype.executeSql):
+        (WebInspector.Database.prototype.executeSql.errorCallback):
+        (WebInspector.Database.prototype.executeSql.queryTransaction):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView.prototype._enterKeyPressed):
+        (WebInspector.DatabaseQueryView.prototype._queryFinished):
+        * inspector/front-end/DatabaseTableView.js:
+        (WebInspector.DatabaseTableView):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.selectDatabase):
+        (WebInspector.StoragePanel.prototype.updateDatabaseTables.withTableNames):
+        (WebInspector.StoragePanel.prototype.updateDatabaseTables):
+        (WebInspector.DatabaseSidebarTreeElement.prototype.onpopulate.withTableNames):
+        (WebInspector.DatabaseSidebarTreeElement.prototype.onpopulate):
+
+2009-09-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed (trivial followup fix). 
+        
+        Web Inspector: Trivial follow up fix to r47944.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28800
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::nodeForId):
+
+2009-09-01  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Fixed a bug in handling of isReadOnly, where textareas were casted to HTMLInputElements.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isReadOnly):
+
+2009-09-01  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28047
+        add utility method to enable logging messages for inspector development
+
+        manual test case added (see below)
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype.toMessageElement):
+        (WebInspector.ConsoleMessage.prototype.toString):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.log):
+        * manual-tests/inspector/webinspector-log.html: Added.
+        * page/Console.cpp:
+        (WebCore::printMessageSourceAndLevelPrefix):
+        * page/Console.h:
+        (WebCore::):
+
+2009-09-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21990
+        When a rare EUC-JP character is present, explicitly (and correctly) labelled EUC-JP document
+        is mistreated as Shift_JIS
+
+        <rdar://problem/5828506> Safari should not try auto-detecting if charset information exists
+
+        WebKit used to unconditionally auto-detect document encoding if it was one of Japanese ones.
+        This didn't really match any browser, and did cause problems on some sites.
+
+        Our detector is very quick to label an EUC-JP page as Shift_JIS if it notices a byte that
+        cannot be part of EUC-JP source. However, such bytes do appear in Web pages sometimes,
+        especially in comments. Also, some valid EUC-JP sequences are not known to it.
+
+        Some pages that are fixed by this change:
+
+        <rdar://problem/5934750> Encoding in incorrect at http://cocodeparis.blog45.fc2.com/. This
+        page has incorrect encoding in title, so no browser displays it 100% fine. We now match
+        Firefox and IE.
+
+        <rdar://problem/6007713> The web page http://www.sf.us.emb-japan.go.jp/top.htm is garbled
+        in Safari. There is a stray byte in comments that was makes charset detector think it can't
+        be EUC-JP.
+
+        <rdar://problem/6965711> A Japanese web page www.nippontv.studiolegend.tv is garbled in
+        Safari. Many comments on this page are encoded as Shift_JIS - IE magically displays that
+        fine in View Source mode (it doesn't seem to have an ability to switch between EUC-JP and
+        Shift_JIS in normal HTML view though).
+
+        Test: fast/encoding/japanese-encoding-mix.html
+
+        * loader/TextResourceDecoder.cpp: (WebCore::TextResourceDecoder::decode): Only invoke auto-
+        detection if there is no solid charset information yet.
+
+2009-09-01  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] FileList cannot be accessed via index in Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=28883
+
+        Tested by clipboard-file-access.html.
+
+        * WebCore.gypi:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8FileListCustom.cpp: Added.
+
+2009-08-31  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Remove the workaround added in r47316.
+
+        Reviewed by Sam Weinig.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::AXObjectCache):
+
+        * accessibility/AXObjectCache.h:
+        Remove the Document argument to the AXObjectCache constructor and the
+        m_document member variable, and replace the no-parameter
+        handleFocusedUIElementChanged() with the two-parameter GTK function.
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (fallbackObject):
+        Don't pass a null Document when constructing the AXObjectCache.
+
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        Get the document from the RenderObject; m_document was removed.
+
+        * dom/Document.cpp:
+        (WebCore::Document::axObjectCache):
+        Don't pass the Document when constructing the AXObjectCache.
+        (WebCore::Document::setFocusedNode):
+        Pass the old and new focused RenderObjects when calling
+        handleFocusedUIElementChanged().
+
+2009-09-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Check that InspectorDOMAgent and InspectorFrontend are not null
+        before accessing them in InspectorBackend. They may be null if
+        InspectorController is closed before an asynchronous operation is
+        started.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28800
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getCookies):
+        (WebCore::InspectorBackend::getChildNodes):
+        (WebCore::InspectorBackend::setAttribute):
+        (WebCore::InspectorBackend::removeAttribute):
+        (WebCore::InspectorBackend::setTextNodeValue):
+        (WebCore::InspectorBackend::highlight):
+        (WebCore::InspectorBackend::nodeForId):
+        (WebCore::InspectorBackend::pushNodePathToFrontend):
+        (WebCore::InspectorBackend::addNodesToSearchResult):
+        (WebCore::InspectorBackend::selectDatabase):
+        (WebCore::InspectorBackend::selectDOMStorage):
+        (WebCore::InspectorBackend::inspectorDOMAgent):
+        (WebCore::InspectorBackend::inspectorFrontend):
+        * inspector/InspectorBackend.h:
+
+2009-09-01  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Page Cache should support pages with frames
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        Things learned in the full task that this patch addresses:
+        - The notions of clearing a CachedFrame and destroying a CachedFrame were two concepts that 
+          needed to be managed separately.
+        - Once we start restoring pages with multiple CachedFrames, we'll have to be calling
+          FrameLoader::open(CachedFrame&) multiple times with different CachedFrames, and this process
+          will be guided by the CachedFrames themselves.
+
+        No new tests. (No change in behavior, current layout tests pass)
+        
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::CachedFrame):
+        (WebCore::CachedFrame::~CachedFrame):
+        (WebCore::CachedFrame::clear): Only clear pointers out.
+        (WebCore::CachedFrame::destroy): Perform the destructive cleanup work here - Things that shouldn't
+          occur simply by navigating back to a page with a CachedFrame.
+        * history/CachedFrame.h:
+
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::~CachedPage):
+        (WebCore::CachedPage::restore): Call clear() after restoring.
+        (WebCore::CachedPage::clear):
+        (WebCore::CachedPage::destroy):
+        * history/CachedPage.h:
+
+        * history/PageCache.cpp:
+        (WebCore::PageCache::releaseAutoreleasedPagesNow): destroy() CachedPages that are being pruned,
+          instead of clearing them.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::commitProvisionalLoad): Let the CachedPage clear() itself after restoring.
+        (WebCore::FrameLoader::open): Don't ::open() the CachedFrame, as the CachedPage does that now.
+        * loader/FrameLoader.h:  Add the friending so CachedPage and CachedFrame can better guide the process.
+          Even though CachedFrame::restore() isn't used for now, it will be soon.
+
+2009-09-01  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by David Levin.
+
+        Add a "lowMemoryNotification" method to the V8 ScriptController class.
+        This is needed in order to allow the host application (Android Web browser in this case)
+        to call the v8::V8::LowMemoryNotification() method added to V8 in
+        http://code.google.com/p/v8/source/detail?spec=svn2777&r=2725
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28776
+
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::lowMemoryNotification):
+        * bindings/v8/ScriptController.h:
+
+2009-09-01  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        V8 Bindings for WebSocket API.
+        https://bugs.webkit.org/show_bug.cgi?id=28844
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8WebSocketCustom.cpp: Added.
+
+2009-09-01  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed (build fix).
+
+        Missed a "." -> "->" conversion.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
+
+2009-09-01  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed (build fix).
+
+        Try to fix Qt build, take 2.  The Qt code had what looks like a
+        broken virtual function override.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
+        (WebCore::ImageDecoderQt::setData):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-09-01  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Uninitialized variable in XSSAuditor
+        https://bugs.webkit.org/show_bug.cgi?id=28874
+
+        One ought to initialize variables before use even when it doesn't
+        matter.  No behavior change.
+
+        * page/XSSAuditor.h:
+        (WebCore::XSSAuditor::CachingURLCanonicalizer::CachingURLCanonicalizer):
+
+2009-09-01  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed (build fix).
+
+        Try to fix Qt build.
+
+        * platform/graphics/ImageSource.cpp:
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Eliminate most of ImageSourceQt.cpp in favor of ImageSource.cpp.
+
+        * WebCore.pro:
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::frameHasAlphaAtIndex):
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        (WebCore::ImageSource::createFrameAtIndex):
+        (WebCore::ImageSource::frameHasAlphaAtIndex):
+        (WebCore::ImageSource::frameIsCompleteAtIndex):
+
+2009-09-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Make InjectedScript self-contained (move necessary
+        methods from utilities.js into InjectedScript).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28871
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.generateStylesheet):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._ensureCommandLineAPIInstalled.inspectObject):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+        (InjectedScript.pushNodeToFrontend):
+        (InjectedScript.createProxyObject):
+        (Object.type):
+        (Object.hasProperties):
+        (Object.className):
+        (String.prototype.escapeCharacters):
+        * inspector/front-end/utilities.js:
+
+2009-09-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: console log message repeat count double.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28856
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._evaluateOn):
+
+2009-09-01  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        [Gtk] Fix DATALIST build
+        https://bugs.webkit.org/show_bug.cgi?id=28826
+
+        Add ENABLE_DATALIST to FEATURE_DEFINES.
+
+        * GNUmakefile.am:
+
+2009-09-01  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        SVGSVGElement suspend methods argument/return types incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=28860
+
+        Also fix the style of the argument names.
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::suspendRedraw):
+        (WebCore::SVGSVGElement::unsuspendRedraw):
+        * svg/SVGSVGElement.h:
+
+2009-09-01  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix bug 28808:  [Skia] Fix flaky layout test svg/dynamic-updates/SVGClipPathElement-dom-clipPathUnits-attr.html [DEBUG]
+        (https://bugs.webkit.org/show_bug.cgi?id=28808)
+
+        The bug fix adds an explicit check for the validity of the path when it is 
+        transformed into local coordinates. 
+        This was the most suitable place I could find that didn't cause an inordinate 
+        amount of refactoring. Also, it seems pertinent and may also catch other cases 
+        that are not limited to clipping paths.
+
+        TEST: existing svg/dynamic-updates/SVGClipPathElement-dom-clipPathUnits-attr.html
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp: make isPathSkiaSafe accessible
+        (WebCore::):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::currentPathInLocalCoordinates): check Skia safety of path
+
+2009-09-01  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Combining Diacritical Marks (U+0300..) are not handled correctly.
+        https://bugs.webkit.org/show_bug.cgi?id=28742 
+
+        Normalize (NFC) a TextRun when the run contains combining diacritical marks
+        so that Skia can pick a correct glyph without relying on GSUB table in a font.
+        This change is for Chromium Linux.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::TextRunWalker::getTextRun): Added.
+        (WebCore::TextRunWalker::getNormalizedTextRun): Added.
+
+        This function is called when the run contains U+0300..U+036F and converts characters in
+        the run to the combined form (NFC) using ICU.
+
+2009-09-01  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Inlined fast paths of V8DOMWrapper::convertNodeToV8Object and
+        V8Proxy::createWrapperFromCache.
+        https://bugs.webkit.org/show_bug.cgi?id=28848
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertDocumentToV8Object): Special
+        function for document wrapping.
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object): Slow case of
+        wrapping a new node.
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertNodeToV8Object): Extracted fast
+        path from V8DOMWrapper.cpp.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::createWrapperFromCacheSlowCase):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::createWrapperFromCache): Extracted fast path
+        from V8Proxy.cpp.
+
+2009-09-01  Eric Seidel  <eric@webkit.org>
+
+        No review, windows build fix only.  Clearly I should have read the patch closer. :(
+
+        Allow excluding certain plugins from loading
+        https://bugs.webkit.org/show_bug.cgi?id=28677
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::refresh):
+
+2009-09-01  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Implement conditional breakpoints in the Web Inspector backend
+        and add frontend JavaScript stubs.
+        https://bugs.webkit.org/show_bug.cgi?id=28846
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::profiles):
+        (WebCore::InspectorBackend::addBreakpoint):
+        (WebCore::InspectorBackend::updateBreakpoint):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::BreakpointInfo::condition):
+        (WebCore::JavaScriptDebugServer::BreakpointInfo::setCondition):
+        (WebCore::JavaScriptDebugServer::addBreakpoint):
+        (WebCore::JavaScriptDebugServer::breakpointInfo):
+        (WebCore::JavaScriptDebugServer::updateBreakpoint):
+        (WebCore::JavaScriptDebugServer::updateBreakpointInfo):
+        (WebCore::JavaScriptDebugServer::removeBreakpoint):
+        (WebCore::JavaScriptDebugServer::hasBreakpoint):
+        (WebCore::JavaScriptDebugServer::clearBreakpoints):
+        * inspector/JavaScriptDebugServer.h:
+        (WebCore::JavaScriptDebugServer::BreakpointInfo::BreakpointInfo):
+        * inspector/front-end/Breakpoint.js:
+        (WebInspector.Breakpoint):
+        (WebInspector.Breakpoint.prototype.get id):
+        (WebInspector.Breakpoint.prototype.get condition):
+        (WebInspector.Breakpoint.prototype.set condition):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype._breakpointEnableChanged):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.addScript):
+
+2009-09-01  Marius Renn  <damarvy@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added delegate to PluginDatabase to disable loading certain plugins.
+        This is useful when you want to load from the standard plugin
+        directory, but want to exclude certain plugins. Plugins may be
+        excluded early on by name, so that no plugin code is executed (which
+        may have caused a crash).
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::PluginDatabase):
+        (WebCore::PluginDatabase::refresh):
+        * plugins/PluginDatabase.h:
+        (WebCore::PluginDatabase::setClient):
+        * plugins/PluginDatabaseClient.h: Added.
+        (WebCore::PluginDatabaseClient::~PluginDatabaseClient):
+
+2009-08-31  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Sam Weinig
+
+        * WebCore.base.exp: Removed an unneeded symbol export.
+
+2009-08-31  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28466
+        When downloading a file, two GET requests are sent to the HTTP server
+
+        Can't think of a way to test this.
+
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::releaseResources): only nullify the
+        handle's client when it is the ResourceLoader, to support the case
+        in which a download API uses a different client
+
+2009-08-31  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Text Fields and Text Areas are reported as read-only by inspect32.exe.
+        https://bugs.webkit.org/show_bug.cgi?id=28854
+
+        Added another case in AcccessibiltyRenderObject::isReadOnly to test if text fields
+        and texts areas are read-only.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isReadOnly):
+        (WebCore::AccessibilityRenderObject::canSetValueAttribute):
+
+2009-08-31  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        fast/workers/worker-lifecycle.html crashes intermittently on snowleopard
+        https://bugs.webkit.org/show_bug.cgi?id=28795
+
+        Changed WorkerContext::close() to no longer stop the worker thread.
+        It is now the parent's responsibility to shut down the worker thread when it is notified that the context is closed.
+
+        * workers/AbstractWorker.cpp:
+        Updated dispatchScriptErrorEvent to pass-through the "handled" value from dispatchEvent(), to allow event handlers added with addEventListener() to mark events as handled.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::workerContextClosed):
+        Now shuts down the worker thread when notified that the context is closed.
+        (WebCore::SharedWorkerProxy::close):
+        Now handles being invoked when the context is already in the process of shutting down.
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::close):
+        No longer calls WorkerThread::stop() to avoid race conditions with shutting down the thread while the parent is still interacting with it.
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::isClosing):
+        isClosing() is now public so WorkerRunLoop can call it to determine whether to process tasks.
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerExceptionTask::performTask):
+        Error events should still be delivered even if the worker thread is closing.
+        Also fixed problem where error events were not dispatched if error handlers were added via addEventListener().
+        (WebCore::WorkerTerminateTask::create):
+        New task that invokes terminateWorkerContext() on the parent thread when the context is closed.
+        (WebCore::WorkerTerminateTask::WorkerTerminateTask):
+        (WebCore::WorkerTerminateTask::performTask):
+        (WebCore::WorkerMessagingProxy::workerContextClosed):
+        Now fires off a WorkerTerminateTask to shut down the thread when the context is closed.
+        * workers/WorkerMessagingProxy.h:
+        WorkerMessagingProxy now overrides workerContextClosed().
+        * workers/WorkerRunLoop.cpp:
+        (WebCore::WorkerRunLoop::runInMode):
+        Now drops tasks on the floor if the WorkerContext is closing.
+
+2009-08-31  Ojan Vafai  <ojan@chromium.org>
+
+        Not reviewed (build fix)
+
+        Build fix for Chromium to match r49707.
+
+        * bindings/v8/ScriptCallFrame.cpp:
+        (WebCore::ScriptCallFrame::ScriptCallFrame):
+        * bindings/v8/ScriptSourceCode.h:
+        (WebCore::ScriptSourceCode::ScriptSourceCode):
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::KURL):
+        (WebCore::blankURL):
+
+2009-08-31  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28858
+        Element.baseURI parses xml:base attribute incorrectly
+
+        Test: fast/dom/base-attribute-parsing.xhtml
+
+        * dom/Element.cpp: (WebCore::Element::baseURI): Avoid assertion failure (no change in
+        release mode).
+
+2009-08-31  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reverting http://trac.webkit.org/changeset/47904, because it caused
+        layout test failure.
+
+        Test: fast/dom/Window/new-window-opener.html
+
+2009-08-31  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28852
+        Rename KURL single argument constructor to avoid confusion
+
+        * platform/KURL.h: The constructor that used to be single argument should now be invoked
+        as KURL(ParsedURLString, myString).
+
+        * WebCore.base.exp:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        * bindings/js/ScriptCallFrame.cpp:
+        (WebCore::ScriptCallFrame::ScriptCallFrame):
+        * bindings/v8/NPV8Object.cpp:
+        (_NPN_EvaluateHelper):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        * css/CSSCursorImageValue.cpp:
+        (WebCore::isSVGCursorIdentifier):
+        * css/CSSImageValue.cpp:
+        (WebCore::CSSImageValue::cachedImage):
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::insertedIntoParent):
+        * css/StyleBase.cpp:
+        (WebCore::StyleBase::baseURL):
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+        * dom/Element.cpp:
+        (WebCore::Element::baseURI):
+        * editing/markup.cpp:
+        (WebCore::completeURLs):
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::url):
+        (WebCore::HistoryItem::originalURL):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::createCached):
+        * loader/Cache.cpp:
+        (WebCore::Cache::revalidateResource):
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::requestResource):
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::getSubresources):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::init):
+        (WebCore::FrameLoader::iconURL):
+        (WebCore::FrameLoader::scheduleLocationChange):
+        (WebCore::FrameLoader::redirectionTimerFired):
+        (WebCore::FrameLoader::loadURLIntoChildFrame):
+        (WebCore::FrameLoader::startRedirectionTimer):
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::resourceForURL):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::startLoadingEntry):
+        (WebCore::ApplicationCacheGroup::addEntry):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::cacheGroupForURL):
+        (WebCore::ApplicationCacheStorage::fallbackCacheGroupForURL):
+        (WebCore::ApplicationCacheStorage::loadCache):
+        (WebCore::ApplicationCacheStorage::manifestURLs):
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::createResource):
+        (WebCore::LegacyWebArchive::create):
+        * loader/loader.cpp:
+        (WebCore::Loader::load):
+        * notifications/NotificationCenter.h:
+        (WebCore::NotificationCenter::createHTMLNotification):
+        * platform/KURL.cpp:
+        (WebCore::KURL::KURL):
+        (WebCore::blankURL):
+        * platform/KURLHash.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::setData):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovie):
+        * platform/network/cf/ResourceErrorCF.cpp:
+        (WebCore::ResourceError::operator CFErrorRef):
+        * platform/network/cf/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/chromium/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::handleLocalReceiveResponse):
+        (WebCore::headerCallback):
+        * platform/network/curl/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/mac/ResourceErrorMac.mm:
+        (WebCore::ResourceError::operator NSError*):
+        * platform/network/mac/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/qt/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/soup/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::filesystemPathFromUrlOrTitle):
+        (WebCore::ClipboardWin::setData):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged):
+        * xml/XSLImportRule.cpp:
+        (WebCore::XSLImportRule::loadSheet):
+        * xml/XSLTProcessor.cpp:
+        (WebCore::docLoaderFunc):
+        Adapt to the change everywhere the single argument constructor was used. I did a very
+        cursory check of whether these locations were using this constructor properly, and didn't
+        notice any obvious mistakes. The new explicit name will hopefully suggest checking this
+        better when refactoring any such code.
+
+2009-08-31  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=28635 [CSS3 
+        Backgrounds and Borders] Add support for 2-keyword values for 
+        background-repeat
+
+        This patch allows background-repeat to take two values by making 
+        background-repeat just like background-position internally. There 
+        is a little extra legwork for background-repeat because the spec 
+        indicates that its computed value should be equivalent to how it 
+        was specified. I keep track of the specified thing by setting the 
+        implicit flag whenever background-repeat is defined with only one 
+        value (since internally, we now store this as 2 values.)
+        
+        Here we can't access the implicit flag, so for backwards-
+        compatibility's sake, we always return one value when that makes 
+        sense.
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::fillRepeatToCSSValue):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+        Here we check for the implicit flag and return one value when it is 
+        set.
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
+        (WebCore::CSSMutableStyleDeclaration::getLayeredShorthandValue):
+        (WebCore::CSSMutableStyleDeclaration::cssText):
+
+        Add support for CSSPropertyBackgroundRepeatX and 
+        CSSPropertyBackgroundRepeatY
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseFillShorthand):
+        (WebCore::CSSParser::parseFillRepeat):
+        (WebCore::CSSParser::parseFillProperty):
+        * css/CSSParser.h:
+
+        Get rid of mappings to RepeatXFill and RepeatYFill since we don't 
+        need those parts of the EFillRepeat enum anymore.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EFillRepeat):
+
+        Add CSSPropertyBackgroundRepeatX and CSSPropertyBackgroundRepeatY
+        * css/CSSPropertyLonghand.cpp:
+        (WebCore::initShorthandMap):
+
+        Add background-repeat-x and -y.
+        * css/CSSPropertyNames.in:
+
+        Break repeat into x and y.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        (WebCore::CSSStyleSelector::mapFillRepeatX):
+        (WebCore::CSSStyleSelector::mapFillRepeatY):
+        * css/CSSStyleSelector.h:
+
+        There is no more RepeatXFill. Instead, look for 
+        fillLayer->repeatX() == RepeatFill
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
+
+        Break m_repeat into m_repeatX and m_repeatY
+        * rendering/style/FillLayer.cpp:
+        (WebCore::FillLayer::FillLayer):
+        (WebCore::FillLayer::operator=):
+        (WebCore::FillLayer::operator==):
+        (WebCore::FillLayer::fillUnsetProperties):
+        (WebCore::FillLayer::cullEmptyLayers):
+        * rendering/style/FillLayer.h:
+        (WebCore::FillLayer::repeatX):
+        (WebCore::FillLayer::repeatY):
+        (WebCore::FillLayer::isRepeatXSet):
+        (WebCore::FillLayer::isRepeatYSet):
+        (WebCore::FillLayer::setRepeatX):
+        (WebCore::FillLayer::setRepeatY):
+        (WebCore::FillLayer::clearRepeatX):
+        (WebCore::FillLayer::clearRepeatY):
+        (WebCore::FillLayer::initialFillRepeatX):
+        (WebCore::FillLayer::initialFillRepeatY):
+
+        Again, break backgroundRepeat into backgroundRepeatX and 
+        backgroundRepeatY
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::backgroundRepeatX):
+        (WebCore::InheritedFlags::backgroundRepeatY):
+        (WebCore::InheritedFlags::maskRepeatX):
+        (WebCore::InheritedFlags::maskRepeatY):
+
+        We don't need RepeatXFill or RepeatYFill. Now that we store two 
+        values, they are represented by Repeat-NoRepeat and NoRepeat-
+        Repeat, respectively.
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-08-31  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Compositing layer size needs to take into account software reflections on children.
+        https://bugs.webkit.org/show_bug.cgi?id=28837
+        
+        When computing the bounds of a composited layer, take software-rendered
+        reflections into account.
+
+        Test: compositing/reflections/reflection-in-composited.html
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+
+2009-08-31  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28614
+
+        Perform a layout prior to checking whether the scrollbar modes are
+        off, on, or automatic.  The modes may change during layout.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+
+2009-08-31  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector Request Headers Should Show Data Sent With Request
+        https://bugs.webkit.org/show_bug.cgi?id=22920
+
+        Manual test added - see below.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::updateRequest):
+        (WebCore::InspectorResource::createScriptObject):
+        (WebCore::InspectorResource::updateScriptObject):
+        * inspector/InspectorResource.h:
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView):
+        (WebInspector.ResourceView.prototype._refreshURL):
+        (WebInspector.ResourceView.prototype._refreshQueryString):
+        (WebInspector.ResourceView.prototype._refreshFormData):
+        (WebInspector.ResourceView.prototype._refreshRequestPayload):
+        (WebInspector.ResourceView.prototype._refreshParms):
+        (WebInspector.ResourceView.prototype._toggleURLdecoding):
+        (WebInspector.ResourceView.prototype._getHeaderValue):
+        (WebInspector.ResourceView.prototype._refreshRequestHeaders):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.addResource):
+        (WebInspector.updateResource):
+        * manual-tests/inspector/display-form-data.html: Added.
+
+2009-08-31  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: pass call frames into the frontend as a part of
+        pausedScript event.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28847
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didPause):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::pausedScript):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.debuggerPaused):
+        * inspector/front-end/inspector.js:
+        (WebInspector.pausedScript):
+
+2009-08-31  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Un-blacklist Silverlight on Mac
+
+        Does not seem to crash anymore, probably due to how we now handle
+        drawing and event model handshake better.
+
+        * plugins/mac/PluginPackageMac.cpp:
+        (WebCore::PluginPackage::isPluginBlacklisted):
+
+2009-08-31  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28827
+        SVGSVGElement.unsuspendRedraw() shouldn't throw
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::unsuspendRedraw):
+        * svg/SVGSVGElement.h:
+        * svg/SVGSVGElement.idl:
+
+2009-08-31  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        - Change the reutrn type of HTMLInputElement::list so that it
+          conforms to the standard.
+        - Add HTMLInputElement::dataList()
+        https://bugs.webkit.org/show_bug.cgi?id=28769
+
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::list):
+        (WebCore::HTMLInputElement::dataList):
+        (WebCore::HTMLInputElement::selectedOption):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+
+2009-08-31  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        Remove ASSERT(frame) in ResourceHandle::start (ResourceHandleCurl.cpp)
+        https://bugs.webkit.org/show_bug.cgi?id=28802
+
+        Remove ASSERT because the frame could be null if the
+        ResourceHandle is not associated with any frame, e.g. if we are
+        downloading a file.
+        If the frame is not null but the page is null this must be an
+        attempted load from an onUnload handler, so let's just block it.
+
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::ResourceHandle::start):
+
+2009-08-31  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Build fix for platforms which don't enable DOM_STORAGE.
+        https://bugs.webkit.org/show_bug.cgi?id=28834
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+
+2009-08-29  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=28829
+        Crash in AccessibilityRenderObject::activeDescendant when trying to set aria-activedescendant to something without a renderer
+
+        Test: accessibility/aria-activedescendant-crash.html
+
+        * accessibility/AccessibilityRenderObject.cpp: (WebCore::AccessibilityRenderObject::activeDescendant): Nil check.
+
+2009-08-28  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Gtk Build broken for OSX Quartz
+        https://bugs.webkit.org/show_bug.cgi?id=28727
+
+        Check for XP_UNIX instead of GTK or X11 to ease building of the Gtk
+        port in Mac and Unix/Linux.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::getValueStatic):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::init):
+
+2009-08-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix positioning error when a compositing, absolutely-positioned element has an ancestor with opacity.
+        https://bugs.webkit.org/show_bug.cgi?id=28754
+        
+        For absolutely-positioned layers, convertToLayerCoords() jumps to the positioned
+        ancestor, since the layer x and y are relative to that ancestor. However, this could
+        skip over the ancestorLayer, thus giving the wrong result.
+        
+        Fix by duplicating the enclosingPositionedAncestor() logic in convertToLayerCoords(),
+        and checking for ancestorLayer along the way. If found, compute offset of both to
+        the enclosingPositionedAncestor() and subtract.
+        
+        This also fixes a positioning bug with abs. positioned elements in reflections,
+        so there is a new reflection test with a pixel result.
+
+        Tests: compositing/geometry/abs-position-inside-opacity.html
+               fast/reflections/abs-position-in-reflection.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::isPositionedContainer):
+        (WebCore::RenderLayer::enclosingPositionedAncestor):
+        (WebCore::RenderLayer::enclosingTransformedAncestor):
+        (WebCore::RenderLayer::convertToLayerCoords):
+
+2009-08-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe
+
+        Wrap WebkitCSSTransformValues in the correct class of DOM wrapper.
+        https://bugs.webkit.org/show_bug.cgi?id=27727
+
+        When fetching the DOM wrapper for a WebkitCSSTransformValue (which is a kind of 
+        CSSValueList), we need to ask the value list whether it's a WebkitCSSTransformValue,
+        because there is not a unique enum value for WebkitCSSTransformValue.
+
+        * bindings/objc/DOMCSS.mm:
+        (kitClass):
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Jan Michael Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28308
+        Fix some warnings introduced by r47381.
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::convertCMYKToRGBA):
+        (WebCore::convertRGBToRGBA):
+
+2009-08-28  Ada Chan  <adachan@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21442
+        Make sure filesystemPathFromUrlOrTitle() returns a string with length
+        <= MAX_PATH - 1.
+
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::filesystemPathFromUrlOrTitle):
+
+2009-08-28  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding Chromium's VFS for Linux and Mac.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28750
+
+        * WebCore.gypi:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/sql/chromium/SQLiteFileSystemChromium.cpp:
+        (WebCore::SQLiteFileSystem::openDatabase):
+        (WebCore::SQLiteFileSystem::deleteDatabaseFile):
+        * platform/sql/chromium/SQLiteFileSystemChromiumLinux.cpp: Removed.
+        * platform/sql/chromium/SQLiteFileSystemChromiumMac.cpp: Removed.
+        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp: Added.
+        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:
+
+2009-08-28  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Made bindings use Node::setOnEvent functions for Node descendants
+        instead of Node::setAttributeEventListener.
+
+        Node::setAttributeEventListener is an internal function and
+        doesn't do the forwarding to DOM window that is required for some
+        HTML elements.
+        https://bugs.webkit.org/show_bug.cgi?id=28709
+
+        Tests added in http://trac.webkit.org/changeset/47326 now pass with V8.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        Now generates EventListener accessors for Node descendants instead
+        of using custom callbacks.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getEventListener): Moved from V8NodeCustom.cpp.
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertEventListenerToV8Object): Fixed a bug in
+        signature.
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::createHiddenDependency):
+        (WebCore::removeHiddenDependency):
+        Changed signature to accept Handle instead of Local.
+        * bindings/v8/V8Utilities.h:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Removed custom callbacks for EventListener accessors.
+
+2009-08-28  Ben Murdoch  <benm@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=28803
+        
+        Implements V8CustomVoidCallback reporting any exceptions that were thrown from the callback function.
+
+        * bindings/v8/custom/V8CustomVoidCallback.cpp:
+        (WebCore::invokeCallback): Checks if the callback raised an exception and reports it to WebCore if so.
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Not reviewed (build fix).
+
+        * platform/graphics/qt/ImageDecoderQt.cpp: Accidentally added some spaces.
+        (WebCore::ImageDecoder::create):
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        * platform/graphics/qt/ImageDecoderQt.h: Make constructor public so factory function can access it (this seemed better than making ImageDecoder a friend).
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Move ImageDecoder creation function to a factory function on
+        ImageDecoder.  This is arguably where it makes the most sense anyway,
+        and it will (soon) allow ImageSourceQt.cpp to have one less dedicated
+        function.
+
+        * platform/graphics/ImageSource.cpp:
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoder::create):
+        * platform/graphics/qt/ImageDecoderQt.h:
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        (WebCore::ImageSource::setData):
+        * platform/image-decoders/ImageDecoder.cpp:
+        * platform/image-decoders/ImageDecoder.h:
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28785
+        Combine duplicated code from ImageDecoder*.cpp into the main
+        ImageDecoder.cpp.
+
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::zeroFill):
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::setSize):
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::RGBA32Buffer::setStatus):
+        (WebCore::RGBA32Buffer::operator=):
+        (WebCore::RGBA32Buffer::width):
+        (WebCore::RGBA32Buffer::height):
+        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
+        * platform/image-decoders/haiku/ImageDecoderHaiku.cpp:
+        * platform/image-decoders/wx/ImageDecoderWx.cpp:
+
+2009-08-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25889
+        [GTK] scrollbar policy for main frame is not implementable
+
+        Override setScrollbarModes to correctly forward scrollbar modes
+        policy changes to client code, via a new platform-specific method,
+        scrollbarsPolicyDidChange.
+
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::scrollbarsPolicyDidChange):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::createScrollbar):
+        * platform/ScrollView.h:
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::setScrollbarModes):
+
+2009-08-28  Cédric Luthi <cedric.luthi@gmail.com>
+
+        Reviewed by Tor Arne Vestbø
+
+        [Qt/Mac] Un-blacklist the QuickTime plugin
+
+        https://bugs.webkit.org/show_bug.cgi?id=28768
+
+        Now that the drawing model is properly negotiated, there is no need the
+        blacklist the QuickTime plugin anymore.
+
+        This revealed a bug in PluginView::performRequest: it should not initiate a
+        request if the plugin has been stopped, which is what happens when a plugin
+        only supports the QuickDraw drawing model.
+
+        * plugins/PluginView.cpp:
+        * plugins/mac/PluginPackageMac.cpp:
+
+2009-08-28  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Set DOM agent document to 0 in InspectorController::close to
+        make DOM agent remove DOM listeners from the inspected document.
+
+        Replace windowVisible checks with m_frontend checks to as inspector
+        window lives in a different process in Chromium while frontend proxy
+        is in the inspected page process.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28800
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::inspect):
+        (WebCore::InspectorController::addConsoleMessage):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::pruneResources):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
+        (WebCore::InspectorController::scriptImported):
+        (WebCore::InspectorController::didOpenDatabase):
+        (WebCore::InspectorController::didUseDOMStorage):
+        (WebCore::InspectorController::addProfile):
+        * inspector/InspectorController.h:
+
+2009-08-28  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Remove dependency of SummaryBar on WebInspector.resourceCategories.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28801
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.toolbarItemClass.get categories):
+        * inspector/front-end/SummaryBar.js:
+        (WebInspector.SummaryBar):
+        (WebInspector.SummaryBar.prototype.update):
+
+2009-08-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed (patching in l18n change that was missing due to
+        the git binary diff format).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28429
+
+        * English.lproj/localizedStrings.js:
+
+2009-08-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Make XSSAuditor go fast
+        https://bugs.webkit.org/show_bug.cgi?id=28667
+
+        Make the XSSAuditor go faster by implementing two optimizations:
+
+        1) We avoid canonicalizing scripts that are larger than the page's URL.
+           This saves a bunch of time for large inline scripts.
+
+        2) We memoize canonicalizing the page's URL because it's silly to
+           canonicalize repeated for each inline event listener.
+
+        These optimizations have a measurable affect on the intl1 page cycler.
+
+        No behavior change.
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::MemoizingURLCanonicalizer::canonicalizeURL):
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        (WebCore::XSSAuditor::canLoadObject):
+        (WebCore::XSSAuditor::canSetBaseElementURL):
+        (WebCore::XSSAuditor::decodeURL):
+        (WebCore::XSSAuditor::findInRequest):
+        * page/XSSAuditor.h:
+
+2009-08-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        Removed ASSERT_NOT_REACHED, because indeed this ASSERT is reached in
+        fast/canvas/change-context.html. And it's alright to reach it.
+
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Removed assertion.
+
+2009-08-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Not reviewed.  Build fix for http://trac.webkit.org/changeset/47840
+
+        Peter's change forgot one m_decoder->
+
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::frameSizeAtIndex):
+
+2009-08-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [V8] Add NULL-check, since the context ain't changeable no more, and
+        thus getContext could return 0.
+
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Added NULL-check.
+
+2009-08-27  Noel Gordon  <noel.gordon@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        dataTransfer.types() should include type "Files" when files are present in the clipboard.
+        https://bugs.webkit.org/show_bug.cgi?id=28780
+
+        Add dataTransfer type "Files" to the chromium port.  Add eseidel's
+        patch for same for the mac port.
+
+        * platform/chromium/ClipboardChromium.cpp:
+
+2009-08-27  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Removed GL_ from all constants, and gl prefix from all calls
+        https://bugs.webkit.org/show_bug.cgi?id=28773
+
+        This was done for the external API in CanvasRenderingContext3D and
+        the internal API in GraphicsContext3D.
+
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        * html/canvas/CanvasRenderingContext3D.h:
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+
+2009-08-27  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Qt and Gtk build fixes. Not reviewed.
+
+        Add CanvasRenderingContext3D.idl to the build scripts.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+
+2009-08-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Release the storage mutex whenever leaving JavaScript execution.
+        https://bugs.webkit.org/show_bug.cgi?id=28789
+
+        http://dev.w3.org/html5/spec/Overview.html#storage-mutex describes the
+        required behavior.  After we leave JavaScript, we must be sure the storage
+        mutex has been released.  At the end of evaluate(), if localStorage has been
+        instantiated, tell it to release any locks that may be applicable.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+
+2009-08-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28753
+        <rdar://problem/7173448> Excessive number of threads (and a crash)
+
+        Coalesce DNS prefetch requests to reduce strain on CFHost. Currently, the algorithm is as follows:
+        - when resolver is idle, the first few requests are sent immediately (they may or may not
+        hit the wire);
+        - if there are a few requests in flight already, coalesce all requests for one second;
+        - to avoid pathological cases with lots of links to different sites on a page, only ask
+        CFHost about a handful of names (dropping the rest).
+
+        Coalescing reduces the number of requests dramatically, as prefetchDNS is called for each
+        link, and these tend to have identical host name.
+
+        * platform/network/cf/DNSCFNet.cpp:
+        (WebCore::DNSResolveQueue::DNSResolveQueue):
+        (WebCore::DNSResolveQueue::shared):
+        (WebCore::DNSResolveQueue::add):
+        (WebCore::DNSResolveQueue::decrementRequestCount):
+        (WebCore::DNSResolveQueue::fired):
+        (WebCore::clientCallback):
+        (WebCore::DNSResolveQueue::resolve):
+        (WebCore::prefetchDNS):
+
+2009-08-27  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Final patch for Canvas 3D support
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        This hooks everything up and provides a working implementation of
+        Canvas 3D. I plumb the creation of the 3D canvas down to GraphicsLayer,
+        passing the opaque context and texture pointers so a Canvas3DLayer can be
+        created (more on that later). It also plumbs changes to the 3D canvas so
+        that Canvas3DLayer can recomposite the results.
+        
+        A 3D Canvas element needs a RenderLayer and compositing layer to render.
+        This is because it renders to an off-screen texture in the GPU and then
+        hands it to a Canvas3DLayer, which is a subclass of CAOpenGLLayer, to
+        render that texture as a 3D quad. This keeps everything in GPU memory to 
+        maximize performance. When a CanvasRenderingContext3D is created it 
+        forces a style recalc which creates the RenderLayer and compositing 
+        layer if needed. 
+        
+        I repurposed an existing flag which was put in place for animation to accomplish 
+        this. This flag is passed to setNeedsStyleRecalc(), and I renamed it from 
+        AnimationStyleChange to SyntheticStyleChange. It essentially says that you need
+        to do a complete style recalc, even though the style itself has not really
+        changed.
+        
+        This patch also fixes a couple of bugs discovered when testing with 3d-canvas
+        turned on. I also added a constructor DOMWindow.idl for CanvasRenderingContext3D.
+        This is needed when making a JS wrapper for the object so the prototype 
+        property can be set.
+
+        Test: fast/canvas/change-context.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext3D::glDrawElements):
+        * bindings/js/JSCanvasRenderingContextCustom.cpp:
+        (WebCore::toJS):
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle):
+        * dom/Node.cpp:
+        (WebCore::Node::setNeedsStyleRecalc):
+        * dom/Node.h:
+        (WebCore::):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        (WebCore::HTMLCanvasElement::is3D):
+        * html/HTMLCanvasElement.h:
+        * html/canvas/CanvasBuffer.cpp:
+        (WebCore::CanvasBuffer::create):
+        (WebCore::CanvasBuffer::CanvasBuffer):
+        (WebCore::CanvasBuffer::_deleteObject):
+        * html/canvas/CanvasBuffer.h:
+        * html/canvas/CanvasFramebuffer.cpp:
+        (WebCore::CanvasFramebuffer::create):
+        (WebCore::CanvasFramebuffer::CanvasFramebuffer):
+        (WebCore::CanvasFramebuffer::_deleteObject):
+        * html/canvas/CanvasFramebuffer.h:
+        * html/canvas/CanvasObject.cpp:
+        (WebCore::CanvasObject::CanvasObject):
+        (WebCore::CanvasObject::~CanvasObject):
+        (WebCore::CanvasObject::deleteObject):
+        * html/canvas/CanvasObject.h:
+        (WebCore::CanvasObject::context):
+        * html/canvas/CanvasProgram.cpp:
+        (WebCore::CanvasProgram::create):
+        (WebCore::CanvasProgram::CanvasProgram):
+        (WebCore::CanvasProgram::_deleteObject):
+        * html/canvas/CanvasProgram.h:
+        * html/canvas/CanvasRenderbuffer.cpp:
+        (WebCore::CanvasRenderbuffer::create):
+        (WebCore::CanvasRenderbuffer::CanvasRenderbuffer):
+        (WebCore::CanvasRenderbuffer::_deleteObject):
+        * html/canvas/CanvasRenderbuffer.h:
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::createBuffer):
+        (WebCore::CanvasRenderingContext3D::createFramebuffer):
+        (WebCore::CanvasRenderingContext3D::createTexture):
+        (WebCore::CanvasRenderingContext3D::createProgram):
+        (WebCore::CanvasRenderingContext3D::createRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::createShader):
+        * html/canvas/CanvasRenderingContext3D.h:
+        (WebCore::CanvasRenderingContext3D::graphicsContext3D):
+        * html/canvas/CanvasShader.cpp:
+        (WebCore::CanvasShader::create):
+        (WebCore::CanvasShader::CanvasShader):
+        (WebCore::CanvasShader::_deleteObject):
+        * html/canvas/CanvasShader.h:
+        * html/canvas/CanvasTexture.cpp:
+        (WebCore::CanvasTexture::create):
+        (WebCore::CanvasTexture::CanvasTexture):
+        (WebCore::CanvasTexture::_deleteObject):
+        * html/canvas/CanvasTexture.h:
+        * page/DOMWindow.idl:
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::setNeedsStyleRecalc):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateAnimationTimer):
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        (WebCore::AnimationControllerPrivate::pauseAnimationAtTime):
+        (WebCore::AnimationControllerPrivate::pauseTransitionAtTime):
+        (WebCore::AnimationController::cancelAnimations):
+        * platform/graphics/GraphicsContext3D.h:
+        (WebCore::GraphicsContext3D::platformGraphicsContext3D):
+        (WebCore::GraphicsContext3D::platformTexture):
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::setContentsToGraphicsContext3D):
+        (WebCore::GraphicsLayer::setGraphicsContext3DNeedsDisplay):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        (WebCore::GraphicsContext3D::reshape):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        (WebCore::GraphicsLayerCA::):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
+        (WebCore::GraphicsLayerCA::commitLayerChanges):
+        (WebCore::GraphicsLayerCA::updateContentsGraphicsContext3D):
+        (WebCore::GraphicsLayerCA::setContentsToGraphicsContext3D):
+        (WebCore::GraphicsLayerCA::setGraphicsContext3DNeedsDisplay):
+        * rendering/RenderHTMLCanvas.cpp:
+        (WebCore::RenderHTMLCanvas::requiresLayer):
+        * rendering/RenderHTMLCanvas.h:
+        (WebCore::RenderHTMLCanvas::isCanvas):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
+        (WebCore::RenderLayerBacking::canUseDirectCompositing):
+        (WebCore::RenderLayerBacking::rendererContentChanged):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
+        (WebCore::RenderLayerCompositor::requiresCompositingForCanvas):
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isCanvas):
+
+2009-08-27  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28751
+        Clean up ImageDecoder*.cpp a bit.
+
+        * platform/image-decoders/ImageDecoder.cpp: Put functions in the same
+          order as in the header file.  Also, since there's already an anonymous
+          namespace in this file, use it to enclose the local helper functions.
+        (WebCore::):
+        (WebCore::ImageDecoder::upperBoundScaledX):
+        (WebCore::ImageDecoder::lowerBoundScaledX):
+        (WebCore::ImageDecoder::scaledY):
+        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
+        (WebCore::RGBA32Buffer::width): Style fix.
+        (WebCore::RGBA32Buffer::height): Style fix.
+        * platform/image-decoders/haiku/ImageDecoderHaiku.cpp:
+        (WebCore::RGBA32Buffer::copyBitmapData): Ensure m_size is set correctly.
+        (WebCore::RGBA32Buffer::asNewNativeImage): Remove unneeded temp.
+        (WebCore::RGBA32Buffer::operator=): Simplify.
+        * platform/image-decoders/wx/ImageDecoderWx.cpp:
+        (WebCore::RGBA32Buffer::asNewNativeImage): Try and collect spaced-out temps under loop comment to show they're all related.  Use size_t for iterating over elements of a Vector.
+        (WebCore::RGBA32Buffer::width): Style fix.
+        (WebCore::RGBA32Buffer::height): Style fix.
+
+2009-08-27  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28751
+        Clean up ImageSource.* in preparation for more fixes on bug 27965.
+
+        * platform/graphics/ImageSource.cpp: Put functions in the same order as in header file.
+        (WebCore::ImageSource::isSizeAvailable): Shorten.
+        (WebCore::ImageSource::size): Shorten.
+        (WebCore::ImageSource::frameSizeAtIndex): Shorten.
+        (WebCore::ImageSource::repetitionCount): Shorten.
+        (WebCore::ImageSource::frameIsCompleteAtIndex):
+        * platform/graphics/ImageSource.h: Shorten #ifdef section a bit by sharing common typedefs.
+
+2009-08-27  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28785
+        Add ImageDecoder.cpp to various build files so platforms will be able to
+        use it.  Move an ENABLE to not cover the whole file, in preparation for
+        adding a bunch of code.  Simplify #ifdefs in ImageDecoder.h to be "Skia
+        vs. everyone else", which also gives new platforms a reasonable default
+        behavior.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCoreSources.bkl:
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::getAddr):
+
+2009-08-27  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Kilzer.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28784
+        
+        Add an exported method to flush pending repaints.
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layoutIfNeededRecursive):
+        (WebCore::FrameView::flushDeferredRepaints):
+        * page/FrameView.h:
+
+2009-08-27  Noel Gordon  <noel.gordon@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Expose files from the pasteboard in drop events.
+        https://bugs.webkit.org/show_bug.cgi?id=28782
+
+        Update chromium port to expose dataTransfer.files() as per
+        HTML5 drag drop (Aug 2009 edition).
+
+        * platform/chromium/ClipboardChromium.cpp:
+
+2009-08-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Dmitry Glazkov.
+
+        ScriptState now keeps explicit Handle of devtools front-end
+        utility context instead of trying to retrieve it from inspected
+        Frame.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28772
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/ScriptScope.cpp:
+        (WebCore::ScriptScope::ScriptScope):
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::ScriptState::ScriptState):
+        (WebCore::ScriptState::~ScriptState):
+        (WebCore::scriptStateFromPage):
+        * bindings/v8/ScriptState.h:
+        (WebCore::ScriptState::context):
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::~ScriptValue):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::frontendScriptState):
+
+2009-08-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Console won't close.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28778
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._updateModifiedNodes):
+        * inspector/front-end/utilities.js:
+        (Node.prototype.isAncestor):
+
+2009-08-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Fix a typo in files() causing image drags to have junk file arrays.
+        https://bugs.webkit.org/show_bug.cgi?id=28755
+
+        Test: editing/pasteboard/files-during-page-drags.html
+
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::ClipboardMac::files):
+
+2009-08-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Not reviewed.  Build fix for Chromium.
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-08-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * DerivedSources.cpp: Added JSPageTransitionEvent.cpp to DerivedSources.cpp.
+
+2009-08-26  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28758
+        <rdar://problem/6440869> Implement pageshow and pagehide events for b/f cache (28758)
+
+        Tests: fast/events/pageshow-pagehide-on-back-cached.html
+               fast/events/pageshow-pagehide-on-back-uncached.html
+               fast/events/pageshow-pagehide.html
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::stopLoading): Dispatch pagehide event
+        (this function is called both when a document goes away, and when it goes to b/f cache).
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents): Dispatch pagehide right before unload.
+        (WebCore::DOMWindow::dispatchPageTransitionEvent): Do what it takes to add a new event handler
+        that can be installed on Window object.
+        (WebCore::DOMWindow::onpagehide): Ditto.
+        (WebCore::DOMWindow::setOnpagehide): Ditto.
+        (WebCore::DOMWindow::onpageshow): Ditto.
+        (WebCore::DOMWindow::setOnpageshow): Ditto.
+
+        * history/CachedFrame.cpp: (WebCore::CachedFrame::restore): Dispatch pageshow for a page
+        that isn't being restored from cache.
+
+        * dom/PageTransitionEvent.cpp: Added.
+        (WebCore::PageTransitionEvent::PageTransitionEvent):
+        (WebCore::PageTransitionEvent::~PageTransitionEvent):
+        (WebCore::PageTransitionEvent::initPageTransitionEvent):
+        * dom/PageTransitionEvent.h: Added.
+        (WebCore::PageTransitionEvent::create):
+        (WebCore::PageTransitionEvent::isPageTransitionEvent):
+        (WebCore::PageTransitionEvent::persisted):
+        * dom/PageTransitionEvent.idl: Added.
+        Add event class implementation.
+
+        * html/HTMLBodyElement.cpp: (WebCore::HTMLBodyElement::parseMappedAttribute): Support
+        inline listener definition (note that adding listeners to document.body programmatically
+        is not supported, matching Firefox).
+
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose): Dispatch pageshow event right before load event.
+        (WebCore::Document::dispatchPageTransitionEvent): Do what it takes to add a new event for
+        Docuemnt.
+        (WebCore::Document::createEvent): Ditto.
+
+        * dom/Document.h: Added dispatchPageTransitionEvent.
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSEventCustom.cpp: (WebCore::toJS):
+        * dom/Event.cpp: (WebCore::Event::isPageTransitionEvent):
+        * dom/Event.h:
+        * dom/EventNames.h:
+        * html/HTMLAttributeNames.in:
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        Do what it takes to add a new event type.
+
+2009-08-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by NOBODY (build fix).
+
+        Adding missing file from previous commit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28740
+
+        * inspector/front-end/SummaryBar.js: Added.
+        (WebInspector.SummaryBar):
+        (WebInspector.SummaryBar.prototype.get calculator):
+        (WebInspector.SummaryBar.prototype.set calculator):
+        (WebInspector.SummaryBar.prototype.reset):
+        (WebInspector.SummaryBar.prototype.update):
+        (WebInspector.SummaryBar.prototype._drawSwatch.drawSwatchSquare):
+        (WebInspector.SummaryBar.prototype._drawSwatch):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph.var):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph.drawPill):
+        (WebInspector.SummaryBar.prototype._fadeOutRect):
+        (WebInspector.SummaryBar.prototype._makeLegendElement):
+
+2009-08-27  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Factor out Factor out summary bar from Resources panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28740
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype._updateSummaryGraph):
+        (WebInspector.ResourcesPanel.prototype._updateDividersLabelBarPosition):
+        (WebInspector.ResourcesPanel.prototype._changeSortingFunction):
+        * inspector/front-end/SummaryBar.js: Added.
+        (WebInspector.SummaryBar):
+        (WebInspector.SummaryBar.prototype.get calculator):
+        (WebInspector.SummaryBar.prototype.set calculator):
+        (WebInspector.SummaryBar.prototype.reset):
+        (WebInspector.SummaryBar.prototype.update):
+        (WebInspector.SummaryBar.prototype._drawSwatch.drawSwatchSquare):
+        (WebInspector.SummaryBar.prototype._drawSwatch):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph.var):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph.drawPill):
+        (WebInspector.SummaryBar.prototype._fadeOutRect):
+        (WebInspector.SummaryBar.prototype._makeLegendElement):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-08-26  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Start adding heap profiler to Inspector (hidden behind a flag.)
+
+        https://bugs.webkit.org/show_bug.cgi?id=28429
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
+        (WebInspector.ProfilesPanel.prototype.reset):
+        (WebInspector.ProfilesPanel.prototype.addProfile):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        (WebInspector.ProfilesPanel.prototype._snapshotClicked):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js: added Preferences.heapProfilerPresent flag.
+
+2009-08-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Metrics sidebar editing is broken.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28434
+
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane.prototype.update):
+
+2009-08-27  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28767
+
+        Make KURLGoogle.cpp's decodeURLEscapeSequences decode %00 to match
+        KURL.cpp.  This makes the XSSAuditor tests pass when using KURLGoogle.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::decodeURLEscapeSequences):
+
+2009-08-27  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Build fix, missing functions after r47763.
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::localizedMediaControlElementString):
+        (WebCore::localizedMediaControlElementHelpText):
+        (WebCore::localizedMediaTimeDescription):
+
+2009-08-26  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Removing trailing whitespaces from all storage classes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28075
+
+        * storage/ChangeVersionWrapper.cpp:
+        * storage/Database.cpp:
+        * storage/Database.h:
+        * storage/DatabaseDetails.h:
+        * storage/DatabaseThread.cpp:
+        * storage/DatabaseTracker.cpp:
+        * storage/DatabaseTracker.h:
+        * storage/LocalStorageTask.cpp:
+        * storage/LocalStorageTask.h:
+        * storage/LocalStorageThread.cpp:
+        * storage/LocalStorageThread.h:
+        * storage/OriginQuotaManager.cpp:
+        * storage/OriginUsageRecord.cpp:
+        * storage/OriginUsageRecord.h:
+        * storage/SQLError.h:
+        * storage/SQLResultSetRowList.h:
+        * storage/SQLStatement.cpp:
+        * storage/SQLStatement.h:
+        * storage/SQLStatementCallback.h:
+        * storage/SQLStatementErrorCallback.h:
+        * storage/SQLTransaction.cpp:
+        * storage/SQLTransaction.h:
+        * storage/SQLTransactionCallback.h:
+        * storage/SQLTransactionErrorCallback.h:
+        * storage/Storage.cpp:
+        * storage/Storage.h:
+        * storage/StorageArea.h:
+        * storage/StorageAreaImpl.cpp:
+        * storage/StorageAreaImpl.h:
+        * storage/StorageAreaSync.cpp:
+        * storage/StorageAreaSync.h:
+        * storage/StorageEvent.cpp:
+        * storage/StorageEvent.h:
+        * storage/StorageMap.cpp:
+        * storage/StorageMap.h:
+        * storage/StorageNamespaceImpl.cpp:
+        * storage/StorageSyncManager.cpp:
+        * storage/StorageSyncManager.h:
+
+2009-08-26  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28763, flickering when opacity changes.
+
+        Make opacity changes from < 1 to 1 and from 1 to < 1 cause a relayout to happen.  We need
+        to do this in order for overflow information to be properly recomputed.
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+
+2009-08-26  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        HTMLMediaElement sometimes loses events
+        https://bugs.webkit.org/show_bug.cgi?id=28762
+        <rdar://problem/7172437>
+
+        A media element triggers the resource selection algorithm if 
+        play() is called when the networkState attribute is NETWORK_EMPTY, but
+        it also immediately queues 'play' and either 'waiting' or 'playing' events.
+        One of the steps in preparing to load is to flush pending events, so those 
+        events were lost if the load timer fired quickly enough. Fixed by deleting
+        pending events before scheduling the load timer.
+
+        Test: media/audio-play-event.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::scheduleLoad):
+            Do nothing if the load timer is already scheduled. Call prepareForLoad so queue of 
+            pending events is flushed immediately.
+        (WebCore::HTMLMediaElement::scheduleNextSourceChild):
+            New, start the load timer without flushing pending events.
+        (WebCore::HTMLMediaElement::load):
+            Call prepareForLoad();
+        (WebCore::HTMLMediaElement::prepareForLoad):
+            New, load setup code moved from loadInternal.
+        (WebCore::HTMLMediaElement::loadInternal):
+            Moved some setup code to prepareForLoad so it can be invoked immediately before
+            arming the load timer.
+        (WebCore::HTMLMediaElement::setNetworkState):
+            Call scheduleNextSourceChild instead of scheduleLoad as the later now clears
+            pending events.
+        * html/HTMLMediaElement.h:
+            Declare scheduleNextSourceChild.
+
+2009-08-26  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28751
+        Switch ICO decoder from a Vector of raw pointers to a Vector of
+        OwnPtrs now that that is possible.  Makes code slightly simpler.
+
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::decodeAtIndex):
+        (WebCore::ICOImageDecoder::processDirectory):
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+
+2009-08-26  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28718, image inside relpositioned inline doesn't paint.
+        Make sure vertical overflow is still computed across self-painting layers, even though it isn't
+        propagated to parents.
+
+        Added fast/repaint/rel-positioned-inline-with-overflow.html
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeVerticalOverflow):
+
+2009-08-26  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        ResourceRequestBase::*[Aa]llowHTTPCookies shouldn't mention http.
+        https://bugs.webkit.org/show_bug.cgi?id=28735
+
+        Renaming the method to imply its wider implications of affecting cookies
+        over any protocol that supports them.
+
+        No change in functionality so no new tests.
+
+        * WebCore.order:
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
+        (WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest):
+        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight):
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::adopt):
+        (WebCore::ResourceRequestBase::copyData):
+        (WebCore::ResourceRequestBase::allowCookies):
+        (WebCore::ResourceRequestBase::setAllowCookies):
+        (WebCore::equalIgnoringHeaderFields):
+        * platform/network/ResourceRequestBase.h:
+        (WebCore::ResourceRequestBase::ResourceRequestBase):
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::updateFromSoupMessage):
+
+2009-08-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Made RenderInline::clippedOverflowRectForRepaint() actually include
+        overflow.
+
+        Test: fast/repaint/inline-overflow.html
+
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::linesVisibleOverflowBoundingBox): Added. Returns
+            the bounding box of all lines’ visible overflow boxes (under the
+            assumption that the first and last lines determine the top and
+            bottom, respectively).
+        (WebCore::RenderInline::clippedOverflowRectForRepaint): Changed to use
+            linesVisibleOverflowBoundingBox() instead of linesBoundingBox().
+        * rendering/RenderInline.h:
+
+2009-08-26  John Gregg  <johnnyg@google.com>
+
+        Reviewed by David Levin.
+
+        minor style correction and include fix for notifications
+        https://bugs.webkit.org/show_bug.cgi?id=28745
+
+        No change in behavior, so no tests.
+
+        * bindings/js/JSDesktopNotificationsCustom.cpp: add include of Error.h
+        * notifications/Notification.cpp: change enum style to InterCaps
+        (WebCore::Notification::Notification):
+        * notifications/NotificationPresenter.h:
+        (WebCore::NotificationPresenter::):
+
+2009-08-25  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        postMessage() spec now supports sending arrays of ports
+        https://bugs.webkit.org/show_bug.cgi?id=26902
+
+        Added support for sending multiple ports at once via postMessage(). JS bindings will be updated in an upcoming patch.
+
+        No new tests, since the new functionality is not exposed via new JS bindings yet, so the old tests suffice.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        Mark MessagePort.h and MessagePortChannel.h as private since they are used by WebKit now.
+        * dom/MessageEvent.cpp:
+        Updated APIs to support passing MessagePortArrays.
+        (WebCore::MessageEvent::MessageEvent):
+        (WebCore::MessageEvent::initMessageEvent):
+        (WebCore::MessageEvent::messagePort):
+        * dom/MessageEvent.h:
+        (WebCore::MessageEvent::create):
+        Now accepts a MessagePortArray parameter instead of a single MessagePort.
+        (WebCore::MessageEvent::ports):
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::postMessage):
+        (WebCore::MessagePort::dispatchMessages):
+        (WebCore::MessagePort::disentanglePorts):
+        Added new static function to extract a MessagePortChannelArray from a MessagePortArray.
+        (WebCore::MessagePort::entanglePorts):
+        Added new static function to generate a MessagePortArray (entangled ports) from a MessagePortChannelArray.
+        * dom/MessagePort.h:
+        * dom/MessagePortChannel.cpp:
+        EventData now contains a MessagePortChannelArray field instead of a single MessagePortChannel.
+        (WebCore::MessagePortChannel::EventData::create):
+        (WebCore::MessagePortChannel::EventData::EventData):
+        * dom/MessagePortChannel.h:
+        (WebCore::MessagePortChannel::EventData::channels):
+        * page/DOMWindow.cpp:
+        (WebCore::PostMessageTimer::PostMessageTimer):
+        (WebCore::PostMessageTimer::event):
+        (WebCore::DOMWindow::postMessage):
+        Now accepts a MessagePortArray parameter instead of a single MessagePort.
+        * page/DOMWindow.h:
+        * workers/DedicatedWorkerContext.cpp:
+        (WebCore::DedicatedWorkerContext::postMessage):
+        Now accepts a MessagePortArray parameter instead of a single MessagePort.
+        (WebCore::DedicatedWorkerContext::dispatchMessage):
+        * workers/DedicatedWorkerContext.h:
+        * workers/Worker.cpp:
+        (WebCore::Worker::postMessage):
+        Now accepts a MessagePortArray parameter instead of a single MessagePort.
+        (WebCore::Worker::dispatchMessage):
+        * workers/Worker.h:
+        * workers/WorkerContextProxy.h:
+        * workers/WorkerMessagingProxy.cpp:
+        Updated WorkerObjectProxy and WorkerContextProxy API implementations to support sending multiple MessagePorts.
+        (WebCore::MessageWorkerContextTask::create):
+        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
+        (WebCore::MessageWorkerContextTask::performTask):
+        (WebCore::MessageWorkerTask::create):
+        (WebCore::MessageWorkerTask::MessageWorkerTask):
+        (WebCore::MessageWorkerTask::performTask):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerObjectProxy.h:
+        Updated WorkerObjectProxy and WorkerContextProxy APIs to support sending multiple MessagePorts.
+
+2009-08-26  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        SocketStreamHandle interface for WebSocket API
+        https://bugs.webkit.org/show_bug.cgi?id=28037
+
+        Add build systems only for GNUmakefile.am and WebCore.xcodeproj.now.
+        Other build systems will be updated once the code is functional.
+        Tests will be landed once this code is complete and functional.
+
+        * GNUmakefile.am:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/network/SocketStreamErrorBase.cpp: Added.
+        * platform/network/SocketStreamErrorBase.h: Added.
+        * platform/network/SocketStreamHandleBase.cpp: Added.
+        * platform/network/SocketStreamHandleBase.h: Added.
+        * platform/network/SocketStreamHandleClient.h: Added.
+        * platform/network/cf/SocketStreamError.h: Added.
+        * platform/network/cf/SocketStreamHandle.h: Added.
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Added.
+        * platform/network/soup/SocketStreamError.h: Added.
+        * platform/network/soup/SocketStreamHandle.h: Added.
+        * platform/network/soup/SocketStreamHandleSoup.cpp: Added.
+
+2009-08-26  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] setTimeout does not convert non-string argument to string
+        https://bugs.webkit.org/show_bug.cgi?id=28739
+
+        Convert non-string argument to setTimeout to string in the V8
+        bindings.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+
+2009-08-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [ES5] Implement getOwnPropertyDescriptor
+        https://bugs.webkit.org/show_bug.cgi?id=28724
+
+        Implement the WebCore side of getOwnPropertyDescriptor.  This
+        requires a custom implementation of getOwnPropertyDescriptor
+        for every class with a custom implementation of getOwnPropertySlot.
+
+        The bindings generator has been updated to generate appropriate
+        versions of getOwnPropertyDescriptor for the general case where
+        a custom getOwnPropertyDescriptor is not needed.  ES5 is vague
+        about how getOwnPropertyDescriptor should work in the context of
+        "host" functions with polymorphic [[GetOwnProperty]], so it seems
+        okay that occasionally we "guess" what attributes -- eg. determining
+        whether a property is writable.
+
+        Test: fast/js/getOwnPropertyDescriptor.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getOwnPropertyDescriptor):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::getOwnPropertyDescriptor):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSHTMLAppletElementCustom.cpp:
+        (WebCore::JSHTMLAppletElement::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSHTMLEmbedElementCustom.cpp:
+        (WebCore::JSHTMLEmbedElement::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSHTMLObjectElementCustom.cpp:
+        (WebCore::JSHTMLObjectElement::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSNamedNodesCollection.cpp:
+        (WebCore::JSNamedNodesCollection::getOwnPropertyDescriptor):
+        * bindings/js/JSNamedNodesCollection.h:
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::runtimeObjectCustomGetOwnPropertyDescriptor):
+        * bindings/js/JSPluginElementFunctions.h:
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyDescriptor):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::getOwnPropertyDescriptorDelegate):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.h:
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcFallbackObjectImp::getOwnPropertyDescriptor):
+        * bridge/runtime.h:
+        (JSC::Bindings::Instance::getOwnPropertyDescriptor):
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::getOwnPropertyDescriptor):
+        * bridge/runtime_array.h:
+        * bridge/runtime_method.cpp:
+        (JSC::RuntimeMethod::getOwnPropertyDescriptor):
+        * bridge/runtime_method.h:
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::getOwnPropertyDescriptor):
+        * bridge/runtime_object.h:
+
+2009-08-26  Vincent Untz <vuntz@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        GObject checks for NULL (and not 0) in g_object_get, so use that
+        as we were already doing elsewhere to make the compiler happy.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+
+2009-08-26  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        RenderThemeMac.mm has incorrect casting for media control element.
+        https://bugs.webkit.org/show_bug.cgi?id=28730
+
+        MediaControlMuteButtonElement was incorrectly casted to
+        MediaControlPlayButtonElement. This is corrected in this patch.
+
+        No new tests because this is code cleanup and is already covered by existing
+        media layout tests.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMediaMuteButton):
+
+2009-08-26  Robert Sesek  <rsesek@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Multi-value select boxes cannot do non-contiguous selection on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=28670
+
+        Change the condition regarding the key modifier check for non-contiguous
+        selection on a multi-value list from just PLATFORM(MAC) to
+        PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN)).
+
+        No new tests. This patch only changes the condition on which a certain mouse
+        event modifier key is used.
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
+
+2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        r47744 causes media/video-controls-with-mutation-event-handler.html to crash
+        https://bugs.webkit.org/show_bug.cgi?id=28732
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlVolumeSliderElement::MediaControlVolumeSliderElement):
+            Don't call setAttribute from the construtor, any registered mutation event 
+            listener will cause a crash.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createVolumeSlider):
+            Set the maxAttr here instead of in the constructor.
+
+2009-08-25  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Brady Eidson.
+
+        Timers from cached pages fire instantly rather than the after the specified timeout delay
+        https://bugs.webkit.org/show_bug.cgi?id=28683
+
+        Test: fast/dom/Window/timer-resume-on-navigation-back.html
+
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::restore): Remove duplicated Frame::restore() call, since
+            it should be done only once in FrameLoader::open(cachedFrame)
+        * page/DOMTimer.cpp: Added a debug-only flag and ASSERT to catch out-of-order suspense/restore.
+        (WebCore::DOMTimer::DOMTimer): Ditto.
+        (WebCore::DOMTimer::suspend): Ditto.
+        (WebCore::DOMTimer::resume): Ditto.
+        * page/DOMTimer.h: Ditto.
+
+2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Setting the volume of a media element has no effect if called too early
+        https://bugs.webkit.org/show_bug.cgi?id=28731
+
+        * manual-tests/audio-volume.html: 
+            Added.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::setRate):
+            Don't bail if metadata hasn't been loaded, it is fine to set rate and/or
+            volume as soon as the movie has been created.
+
+2009-08-25  David Levin  <levin@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        DocumentThreadableLoader::getShouldUseCredentialStorage should allow for synchronous callbacks from SubresourceLoader::create.
+        https://bugs.webkit.org/show_bug.cgi?id=28728
+
+        Test: This code path is exercised while running xhr layout tests in chromium.
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::getShouldUseCredentialStorage): When called
+        back synchronously, the loader is 0, so the assert is changed to allow for that.
+        (WebCore::DocumentThreadableLoader::loadRequest): Synchronous callbacks may be
+        done before SubresourceLoader::create finishes, so ensure that any previous loader
+        -- from a preflight request -- is cleared before calling SubresourceLoader::create.
+
+2009-08-25  Mark Rowe  <mrowe@apple.com>
+
+        Stop installing IDL files in to the framework.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-08-25  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Support for HTMLInputElement::list and HTMLInputElement::selectedOption.
+        https://bugs.webkit.org/show_bug.cgi?id=27756
+
+        Tests: fast/forms/input-list.html
+               fast/forms/input-selectedoption.html
+
+        * html/HTMLAttributeNames.in:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::list):
+        (WebCore::HTMLInputElement::selectedOption):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+
+2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <video> and <audio> controller should be accessible (edit)
+        https://bugs.webkit.org/show_bug.cgi?id=28081
+
+        Test: accessibility/media-element.html
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+            Add AccessibilityMediaControls.cpp/.h
+
+        * accessibility/AXObjectCache.cpp:
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::getOrCreate):
+            Create AccessibilityMediaControl. Update Copyright
+
+        * accessibility/AccessibilityMediaControls.cpp:
+        * accessibility/AccessibilityMediaControls.h:
+            Added.
+
+        * accessibility/AccessibilityObject.cpp:
+        * accessibility/AccessibilityObject.h:
+            Add isMediaTimeline. Update Copyright.
+
+        * accessibility/AccessibilitySlider.h:
+            Make constructor protected instead of private so AccessibilityMediaTimeline can
+            call it.
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+            Add NSAccessibilityValueDescriptionAttribute to range attributes. 
+        (-[AccessibilityObjectWrapper subrole]):
+            Return NSAccessibilityTimelineSubrole for AccessibilityMediaTimeline.
+
+        * dom/Node.h:
+            add isMediaControlElement.
+
+        * page/mac/WebCoreViewFactory.h:
+        * platform/LocalizedStrings.h:
+        * platform/mac/LocalizedStringsMac.mm:
+        (WebCore::localizedMediaControlElementString): 
+        (WebCore::localizedMediaControlElementHelpText):
+        (WebCore::localizedMediaTimeDescription): 
+            New, return localized media controller strings.
+
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::mediaElementLoadingStateText):
+        (WebCore::mediaElementLiveBroadcastStateText):
+            Move inside of "#if ENABLE(VIDEO)"
+        (WebCore::localizedMediaControlElementString):
+        (WebCore::localizedMediaControlElementHelpText):
+        (WebCore::localizedMediaTimeDescription):
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlElement::MediaControlElement):
+            Initialize m_displayType.
+        (WebCore::MediaControlElement::MediaControlElement):
+        (WebCore::MediaControlStatusDisplayElement::MediaControlStatusDisplayElement):
+            Fix style.
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+            Set m_displayType based on pseudo style ID.
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+            rename local "o" to "object".
+        (WebCore::MediaControlMuteButtonElement::MediaControlMuteButtonElement):
+        (WebCore::MediaControlPlayButtonElement::MediaControlPlayButtonElement):
+        (WebCore::MediaControlSeekButtonElement::MediaControlSeekButtonElement):
+        (WebCore::MediaControlRewindButtonElement::MediaControlRewindButtonElement):
+        (WebCore::MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeButtonElement):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+        (WebCore::MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+            Update for MediaControlInputElement constructor change.
+        (WebCore::MediaControlTimeDisplayElement::formatTime):
+            New, moved here from RenderMedia so AccessibilityMediaTimeDisplay can use it.
+        (WebCore::MediaControlTimeDisplayElement::setCurrentValue):
+            New, set text to current time.
+        * rendering/MediaControlElements.h:
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::updateControls):
+            Create controls in tab order.
+        (WebCore::RenderMedia::formatTime):
+            Moved to MediaControlTimeDisplayElement::formatTime.
+        (WebCore::RenderMedia::updateTimeDisplay):
+            Call MediaControlTimeDisplayElement::setCurrentValue.
+        * rendering/RenderMedia.h:
+
+2009-08-25  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Fix Canvas layout test failures in Chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=28720
+
+        The previous fix r47757 does not handle the V8 object conversion correctly.
+
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-08-25  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Fix compiling errors in Chromium build caused by Canvas3D changes from r47752.
+        https://bugs.webkit.org/show_bug.cgi?id=28717
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-08-25  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] Implement media volume slider for chromium
+        https://bugs.webkit.org/show_bug.cgi?id=28715
+
+        Provided the implementation of the volume slider and its container for
+        chromium port. With this change there will be a usable volume control
+        slider for chromium theme.
+
+        No new tests since this is covered by existing media layout tests.
+
+        * css/mediaControlsChromium.css: CSS style for the volume slider.
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::mediaSliderThumbImage): Returns the image for slider thumb.
+        (WebCore::mediaVolumeSliderThumbImage): Returns the image for volume slider thumb.
+        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderTrack): Paints the track with one vertical white line.
+        (WebCore::RenderThemeChromiumSkia::adjustSliderThumbSize): Adjusts thumb sizes according to the images.
+        (WebCore::RenderThemeChromiumSkia::paintMediaSliderThumb): Paints slider thumb image.
+        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderThumb): Paints volume slider thumb image.
+
+2009-08-25  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Missed checking in 2 Canvas3D files
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        * bindings/js/JSCanvasRenderingContextCustom.cpp: Implements toJS to do proper subclass binding
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp: Argument marshaling for 3D calls
+
+2009-08-25  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Exception from JavaScript propagates to main script
+        https://bugs.webkit.org/show_bug.cgi?id=26433
+
+        Make sure that exceptions thrown both at compile time and at
+        runtime in javascript URLs are isolated from the main script.
+
+        Test: fast/dom/javascript-url-exception-isolation.html
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+
+2009-08-25  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Added all new Canvas3D files to the build
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        This also hooks up CanvasRenderingContext as the common base class for
+        CanvasRenderingContext2D and CanvasRenderingContext3D. And it adds a bit
+        of logic throughout to support the new CanvasRenderingContext3D object.
+        But nothing is hooked up yet.
+
+        * DerivedSources.make:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore/GNUmakefile.am:
+        * WebCore/WebCore.gypi:
+        * WebCore/WebCoreSources.bkl:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext2D::strokeStyle):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeStyle):
+        (WebCore::JSCanvasRenderingContext2D::fillStyle):
+        (WebCore::JSCanvasRenderingContext2D::setFillStyle):
+        (WebCore::JSCanvasRenderingContext2D::setFillColor):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeColor):
+        (WebCore::JSCanvasRenderingContext2D::strokeRect):
+        (WebCore::JSCanvasRenderingContext2D::drawImage):
+        (WebCore::JSCanvasRenderingContext2D::drawImageFromRect):
+        (WebCore::JSCanvasRenderingContext2D::setShadow):
+        (WebCore::JSCanvasRenderingContext2D::createPattern):
+        (WebCore::JSCanvasRenderingContext2D::putImageData):
+        (WebCore::JSCanvasRenderingContext2D::fillText):
+        (WebCore::JSCanvasRenderingContext2D::strokeText):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::isObservableThroughDOM):
+        * bindings/js/JSDocumentCustom.cpp:
+        * bindings/js/JSHTMLCanvasElementCustom.cpp:
+        (WebCore::JSHTMLCanvasElement::markChildren):
+        * dom/Document.cpp:
+        (WebCore::Document::getCSSCanvasContext):
+        * dom/Document.h:
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        (WebCore::HTMLCanvasElement::willDraw):
+        (WebCore::HTMLCanvasElement::reset):
+        (WebCore::HTMLCanvasElement::paint):
+        (WebCore::HTMLCanvasElement::is3D):
+        (WebCore::HTMLCanvasElement::context3D):
+        (WebCore::HTMLCanvasElement::texture3D):
+        * html/HTMLCanvasElement.h:
+        (WebCore::HTMLCanvasElement::renderingContext):
+        * html/canvas/CanvasObject.cpp:
+        (WebCore::CanvasObject::~CanvasObject):
+        * html/canvas/CanvasRenderingContext.idl:
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::CanvasRenderingContext2D):
+        (WebCore::CanvasRenderingContext2D::~CanvasRenderingContext2D):
+        * html/canvas/CanvasRenderingContext2D.h:
+        (WebCore::CanvasRenderingContext2D::is2d):
+        * html/canvas/CanvasRenderingContext2D.idl:
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        * html/canvas/CanvasRenderingContext3D.idl:
+
+2009-08-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        REGRESSION (r47630): fast/repaint/background-generated.html is failing
+        https://bugs.webkit.org/show_bug.cgi?id=28704
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateFillTileSize): Handle SizeNone.
+        * rendering/style/FillLayer.cpp:
+        (WebCore::FillLayer::FillLayer): Initialize the size type to SizeNone.
+        * rendering/style/FillLayer.h:
+        (WebCore::FillSize::FillSize): Changed assignment to initialization and
+            removed redundant assignment to size.
+
+2009-08-25  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Complex text doesn't show up with text stroking
+        https://bugs.webkit.org/show_bug.cgi?id=28707
+
+        Skip the NULL check of m_hdc if Windows GDI is not in use.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::drawComplexText):
+
+2009-08-25  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        Media controls panel does not have a volume control slider
+        https://bugs.webkit.org/show_bug.cgi?id=28241
+
+        Introduced "-webkit-media-controls-volume-slider",
+        "-webkit-media-controls-volume-slider-container" and the supporting
+        implementation. Also added appearances of "media-volume-slider" and
+        "media-volume-slider-container".
+
+        The implementation of the controls are in WebCore::MediaControlElements.
+        Logic to trigger the display of the volume controls are in WebCore::RenderMedia.
+
+        No new tests since this change doesn't have theme implementation and the
+        volume slider is disabled by default.
+
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySlider::orientation): Marks that volume slider is vertical.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Added corresponding CSS values.
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType): ditto.
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::): ditto.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): ditto.
+        * css/CSSValueKeywords.in: ditto.
+        * css/mediaControls.css: Makes the volume slider disabled by default.
+        * platform/ThemeTypes.h: Defines theme parts for volume slider and its container.
+        (WebCore::):
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlVolumeSliderContainerElement::MediaControlVolumeSliderContainerElement):
+        (WebCore::MediaControlVolumeSliderContainerElement::styleForElement):
+        Adjust the CSS values for "display", "postion", "left" and "top" according to member variables.
+        (WebCore::MediaControlVolumeSliderContainerElement::setVisible): Affects the "display" CSS value.
+        (WebCore::MediaControlVolumeSliderContainerElement::setPosition): Affects the "left" and "top" CSS values.
+        (WebCore::MediaControlVolumeSliderContainerElement::hitTest): Hit testing this element.
+        (WebCore::MediaControlVolumeSliderElement::MediaControlVolumeSliderElement):
+        (WebCore::MediaControlVolumeSliderElement::defaultEventHandler): Modifies the volume using the slider value, allows dragging.
+        * rendering/MediaControlElements.h:
+        (WebCore::): Added definition for MediaControlVolumeSliderElement and MediaControlVolumeSliderContainerElement.
+        (WebCore::MediaControlVolumeSliderContainerElement::isVisible): Inline getter.
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::styleDidChange): Updates styles for volume container and volume slider.
+        (WebCore::RenderMedia::createVolumeSliderContainer): Creates volume slider container and attach to panel.
+        (WebCore::RenderMedia::createVolumeSlider): Creates volume slider and attach to volume slider container.
+        (WebCore::RenderMedia::updateControls): Updates volume container and volume slider.
+        (WebCore::RenderMedia::updateVolumeSliderContainer): Sets the visibility and position of volume slider container and its child.
+        (WebCore::RenderMedia::forwardEvent):
+        Hit testing the volume slider container and volume slider to toggle the visibility and forward events to slider.
+        * rendering/RenderMedia.h:
+        Added definition for RenderMedia::updateVolumeSliderContainer().
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart): Not implemented.
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::createThumbStyle): Makes volume slider vertical.
+        (WebCore::RenderSlider::thumbRect): ditto.
+        (WebCore::RenderSlider::mouseEventIsInThumb): ditto.
+        (WebCore::RenderSlider::setValueForPosition): ditto.
+        (WebCore::RenderSlider::positionForOffset): ditto.
+        (WebCore::RenderSlider::currentPosition): ditto.
+        (WebCore::RenderSlider::trackSize): ditto.
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle): Adjust style for volume slider thumb.
+        (WebCore::RenderTheme::paint): Paints volume control parts using theme.
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::paintMediaVolumeSliderContainer): Naive implementation to be overridden.
+        (WebCore::RenderTheme::paintMediaVolumeSliderTrack): ditto.
+        (WebCore::RenderTheme::paintMediaVolumeSliderThumb): ditto.
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::): Constants for volume control parts.
+
+2009-08-25  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt/Mac] Use CONFIG+=build_all only when building libraries
+
+        If no configuration is specified when building WebKit we pass the
+        debug_and_release option to QMake which results in Makefiles for
+        both configurations being generated.
+
+        Previously we built both of these configurations by default, for
+        all targets (both the QtWebKit framework/dyldlib and the various
+        executables such as QtLauncher and tests). This makes sense for
+        the libraries, which get the _debug suffix and can be loaded on
+        demand by setting the DYLD_IMAGE_SUFFIX, but for executables we
+        ended up building the same executable twice.
+
+        We now only build one instance of each executable, and since this
+        is a developer build we build the debug-version. Passing either
+        --debug or --release to build-webkit will override this, and
+        even in the default case the release version can still be built
+        by running 'make release' in the the build directory of each
+        target.
+
+        * WebCore.pro:
+
+2009-08-25  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28690
+        Build failure in webkitgtk+-1.1.3
+
+        Do not use deprecated function to unref a pixbuf.
+
+        * platform/gtk/CursorGtk.cpp:
+        (WebCore::Cursor::Cursor):
+
+2009-08-24  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix Bug 27827 "[Chromium] Functions Keys don't work in google spreadsheet".
+        <https://bugs.webkit.org/show_bug.cgi?id=27827>.
+
+        Because of the lack of mappings from GDK key-codes to WebKit key-codes,
+        Chromium cannot send valid key-codes to JavaScript when a user types
+        function keys. This change just copies the mappings from 'KeyEventGtk.cpp'.
+
+        To write layout tests for this issue, added mappings from function-key
+        names to platform-specific key-codes to EventSendingController objects
+        so that eventSender.keyDown() can send function-key events without using
+        platform-specific key codes. (Unfortunately, this eventSender.keyDown() change
+        is only for Mac. So this change adds this new test to Skipped tests for other
+        platforms to prevent this change from crashing the build trees.)
+
+        Test: fast/events/keydown-function-keys.html
+
+       * platform/chromium/KeyCodeConversionGtk.cpp: Add mappings from GDK key-codes
+        to WebKit key-code for function keys.
+        (WebCore::windowsKeyCodeForKeyEvent):
+
+2009-08-24  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Simon Fraser.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28698
+        Avoid unnecessary transformations for the window resizer rect.
+
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::setFrameRect):
+
+2009-08-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        <rdar://problem/7161900> REGRESSION: 100 MB membuster leak on windows due to 47391
+        (DNS prefetching support)
+
+        * platform/network/cf/DNSCFNet.cpp: (WebCore::prefetchDNS): Use a run loop from secondary
+        thread on Windows, because there isn't one on main one.
+
+2009-08-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28374
+        Cross-scheme requests should not be blocked by appcache rules
+
+        Test: http/tests/appcache/different-scheme.html
+
+        * loader/appcache/ApplicationCacheHost.cpp:
+        (WebCore::ApplicationCacheHost::shouldLoadResourceFromApplicationCache):
+        Resources with different schemes can never be loaded from appcache.
+
+2009-08-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler and Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28688
+        REGRESSION(r24994): Cannot create a frame with a javascript URL
+
+        Test: http/tests/security/javascriptURL/javascriptURL-in-new-iframe.html
+
+        * bindings/js/JSAttrCustom.cpp: (WebCore::JSAttr::setValue):
+        * bindings/js/JSElementCustom.cpp: (WebCore::allowSettingSrcToJavascriptURL):
+        * bindings/js/JSHTMLFrameElementCustom.cpp: (WebCore::allowSettingJavascriptURL):
+        * bindings/js/JSHTMLIFrameElementCustom.cpp: (WebCore::JSHTMLIFrameElement::setSrc):
+        Omit the checks if there is no document in frame yet.
+
+2009-08-24  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix crash in fast/css/rem-dynamic-scaling.html due to a freed
+        RenderStyle being accessed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28681
+
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle): Make currentStyle a RefPtr.
+
+2009-08-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/5743105> Long freezing during loading and selecting text
+        of a large table
+        https://bugs.webkit.org/show_bug.cgi?id=14918
+
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setSelection): Added calls to
+            beginDeferredRepaints() and endDeferredRepaints() around the
+            invalidation of the selection, in order to better coalesce multiple
+            invalid rectangles.
+
+2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Simplify findTreeElement code, get rid of potential infinite loop.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28680
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.updateBreadcrumb):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.findTreeElement):
+        * inspector/front-end/treeoutline.js:
+        (TreeOutline.prototype.getCachedTreeElement):
+        (TreeOutline.prototype.findTreeElement):
+        * inspector/front-end/utilities.js:
+        (isAncestorNode):
+        ():
+
+2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Do expand local scope when hitting the break
+
+        https://bugs.webkit.org/show_bug.cgi?id=28678
+
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+
+2009-08-24  Ada Chan  <adachan@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        Make sure we use the current FrameView's frame rect when
+        going back to a cached page.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28659
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::open):
+
+2009-08-24  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Darin Adler.
+
+        Modifying <text rotate=""> doesn't clear the corresponding SVGAnimatedNumberList
+        https://bugs.webkit.org/show_bug.cgi?id=28673
+
+        Test: svg/dom/text-rotate-live.html
+
+        * svg/SVGNumberList.cpp:
+        (WebCore::SVGNumberList::parse): Clear the list before adding the parsed
+        numbers.
+
+2009-08-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by NOBODY (build fix)
+
+        Turn off ENABLE_3D_CANVAS in the xconfig files.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Only expand local scope when hitting the break
+
+        https://bugs.webkit.org/show_bug.cgi?id=28678
+
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+
+2009-08-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        background-size fails to parse if a single length/percentage/auto is followed by a comma
+        https://bugs.webkit.org/show_bug.cgi?id=28674
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFillSize): Added an allowComma parameter,
+            which is set to false when this method consumes a comma. Moved
+            handling of 'contain' and 'cover' from parseFillProperty into this
+            method.
+        (WebCore::CSSParser::parseFillProperty): Set allowComma to true before
+            processing the next value, and pass allowComma to parseFillSize.
+        * css/CSSParser.h:
+
+2009-08-17  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Support for cursors that are images
+        https://bugs.webkit.org/show_bug.cgi?id=28346
+
+        Added support for cursors which are images for CursorGtk. Added
+        a manual test for this.
+
+        * manual-tests/gtk/cursor-image.html: Added.
+        * manual-tests/gtk/resources/redcursor.cur: Added.
+        * platform/gtk/CursorGtk.cpp:
+        (WebCore::Cursor::Cursor):
+
+2009-08-24  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Integrate GStreamer video with the graphics backend
+        https://bugs.webkit.org/show_bug.cgi?id=16356
+
+        Improves GStreamer backend implementation of MediaPlayerPrivate class.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateErrorCallback): Send proper MediaPlayer
+        error for different GStreamer errors to MediaPlayerPrivate.
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Move static
+        initialization boolean to a better place.
+        (WebCore::MediaPlayerPrivate::play):
+        (WebCore::MediaPlayerPrivate::pause):
+        (WebCore::MediaPlayerPrivate::duration): Return if error occured, do not
+        consider the source as stream if duration query failed.
+        (WebCore::MediaPlayerPrivate::currentTime): Return if error occured, use
+        an early return.
+        (WebCore::MediaPlayerPrivate::seek): Return if error occured.
+        (WebCore::MediaPlayerPrivate::setEndTime): Remove implementation since this
+        function doesn't seem to be used anywhere in WebCore.
+        (WebCore::MediaPlayerPrivate::paused):
+        (WebCore::MediaPlayerPrivate::seeking):
+        (WebCore::MediaPlayerPrivate::setRate): Seek to current time when rate is set.
+        (WebCore::MediaPlayerPrivate::maxTimeBuffered): Return if error occured.
+        (WebCore::MediaPlayerPrivate::maxTimeSeekable): Ditto.
+        (WebCore::MediaPlayerPrivate::maxTimeLoaded): Ditto.
+        (WebCore::MediaPlayerPrivate::bytesLoaded):
+        (WebCore::MediaPlayerPrivate::totalBytesKnown):
+        (WebCore::MediaPlayerPrivate::totalBytes): Ditto.
+        (WebCore::MediaPlayerPrivate::updateStates): Return if error occured, update
+        after seek ended with a successful change
+        (WebCore::MediaPlayerPrivate::didEnd): Do not pause the playbin when end is reached.
+        (WebCore::MediaPlayerPrivate::loadingFailed): Update network state with the given error.
+        (WebCore::mimeTypeCache): Gather supported mime types from GStreamer.
+        (WebCore::MediaPlayerPrivate::getSupportedTypes):
+        (WebCore::MediaPlayerPrivate::supportsType):
+        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
+        (WebCore::MediaPlayerPrivate::supportsFullscreen): First step towards fullscreen
+        support.
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin): Use playbin2 instead of playbin,
+        do not set playbin's audio sink.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_idle_func): Use C++ casts, decrease reference count of async
+        queue at the end of the idle function.
+        (webkit_video_sink_render): Increase reference count of async queue.
+        (webkit_video_sink_stop): Remove any idle functions with the sink as data.
+
+2009-08-23  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Remaining new files for Canvas3D
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        * bindings/js/JSHTMLCanvasElementCustom.cpp: Added Canvas3D method behind an ifdef
+        * html/canvas/CanvasByteArray.cpp: Added. Efficient array of bytes for passing to GL functions
+        * html/canvas/CanvasByteArray.h: Added.
+        * html/canvas/CanvasByteArray.idl: Added.
+        * html/canvas/CanvasNumberArray.cpp: Added. Efficient array of 32 bit floats for passing to GL functions
+        * html/canvas/CanvasNumberArray.h: Added.
+        * html/canvas/CanvasNumberArray.idl: Added.
+
+2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Migrate call frames interaction to the InjectedScript-based schema.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28408
+
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype.update):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleTextMessage):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype.get domWindow):
+        (InspectorController.openInInspectedWindow):
+        (InspectorController.getCallFrames):
+        (InspectorController.evaluateInCallFrame):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.reset):
+        (WebInspector.ElementsPanel.prototype.generateStylesheet):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+        (InjectedScript._evaluateOn):
+        (InjectedScript.openInInspectedWindow):
+        (InjectedScript.getCallFrames):
+        (InjectedScript.evaluateInCallFrame):
+        (InjectedScript._callFrameForId):
+        (InjectedScript._objectForId):
+        (InjectedScript.CallFrameProxy):
+        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype._update):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectPropertyProxy):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane):
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+        (WebInspector.ScopeVariableTreeElement.prototype.onattach):
+        (WebInspector.ScopeVariableTreeElement.prototype.onexpand):
+        (WebInspector.ScopeVariableTreeElement.prototype.oncollapse):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        (WebInspector.ScriptsPanel.prototype.variablesInSelectedCallFrame):
+        (WebInspector.ScriptsPanel.prototype.debuggerPaused.callback):
+        (WebInspector.ScriptsPanel.prototype.debuggerPaused):
+
+2009-08-24  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add support for the placeholder attribute and DOM property of the textarea element.
+        https://bugs.webkit.org/show_bug.cgi?id=21248
+
+        A DOM node for an INPUT element doesn't have a flag for placeholder
+        visibility anymore.  This patch also fixes a bug that a renderer
+        doesn't reflect a corresponding DOM value change.
+
+        Tests: fast/forms/textarea-placeholder-dom-property.html
+               fast/forms/textarea-placeholder-pseudo-style.html
+               fast/forms/textarea-placeholder-set-attribute.html
+               fast/forms/textarea-placeholder-set-value.html
+
+        * css/html.css: Add the default style for placeholder of textarea.
+        * dom/InputElement.cpp: Cleanup for m_placeholderShouldBeVisible removal
+        (WebCore::InputElement::dispatchFocusEvent):
+        (WebCore::InputElement::dispatchBlurEvent):
+        (WebCore::InputElement::placeholderShouldBeVisible):
+        (WebCore::InputElement::updatePlaceholderVisibility):
+        (WebCore::InputElement::setValueFromRenderer):
+        (WebCore::InputElementData::InputElementData):
+        * dom/InputElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::dispatchFocusEvent):
+        (WebCore::HTMLInputElement::dispatchBlurEvent):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::placeholderShouldBeVisible):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::updatePlaceholderVisibility):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        (WebCore::HTMLTextAreaElement::setValue):
+        (WebCore::HTMLTextAreaElement::placeholderShouldBeVisible):
+        (WebCore::HTMLTextAreaElement::updatePlaceholderVisibility):
+        (WebCore::HTMLTextAreaElement::dispatchFocusEvent):
+        (WebCore::HTMLTextAreaElement::dispatchBlurEvent):
+        * html/HTMLTextAreaElement.h:
+        * html/HTMLTextAreaElement.idl:
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::RenderTextControl):
+        (WebCore::RenderTextControl::styleDidChange):
+        (WebCore::RenderTextControl::setInnerTextStyle):
+        (WebCore::RenderTextControl::updatePlaceholderVisibility):
+        * rendering/RenderTextControl.h:
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::RenderTextControlMultiLine):
+        (WebCore::RenderTextControlMultiLine::nodeAtPoint):
+        (WebCore::RenderTextControlMultiLine::updateFromElement):
+        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
+        (WebCore::RenderTextControlMultiLine::textBaseStyle):
+        * rendering/RenderTextControlMultiLine.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
+        (WebCore::RenderTextControlSingleLine::textBaseStyle):
+        (WebCore::RenderTextControlSingleLine::updateFromElement):
+        (WebCore::RenderTextControlSingleLine::createInnerTextStyle):
+        * rendering/RenderTextControlSingleLine.h:
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::dispatchFocusEvent):
+        (WebCore::WMLInputElement::dispatchBlurEvent):
+        (WebCore::WMLInputElement::setValue):
+        (WebCore::WMLInputElement::placeholderShouldBeVisible):
+
+2009-08-23  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Code clean-up and build fix for filters enabled builds. Moved SVGNames.h
+        into #if ENABLE(SVG) for Document.cpp and added SVGNames.h to the other
+        files. They are needed there after r47688.
+
+        * dom/Document.cpp:
+        * svg/SVGComponentTransferFunctionElement.h:
+        * svg/SVGFELightElement.h:
+        * svg/SVGFEMergeNodeElement.h:
+        * svg/SVGFilterPrimitiveStandardAttributes.h:
+
+2009-08-23  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed, build fix for make distcheck on GTK+.
+
+        * GNUmakefile.am: Added files needed for the build.
+        * bindings/js/JSDOMWindowCustom.cpp: Protect SharedWorker include
+        with #if clause.
+        * bindings/js/JSEventTarget.cpp: Dito.
+        * dom/Document.cpp: Dito.
+        * loader/FrameLoader.cpp: Dito.
+
+2009-08-23  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Throws an Error on "null"
+        https://bugs.webkit.org/show_bug.cgi?id=28665
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+
+2009-08-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: REGRESSION Formatting Function in Console is Abbreviated Too Often
+
+        https://bugs.webkit.org/show_bug.cgi?id=28666
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getProperties):
+        (InjectedScript.createProxyObject):
+
+2009-08-22  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] BitmapImage::getGdkPixbuf does not handle alpha channels properly
+        https://bugs.webkit.org/show_bug.cgi?id=28345
+
+        When doing the conversion between cairo_surface_t* and GdkPixbuf*
+        account for the differences in the respective formats' in-memory
+        image format.
+
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::getCairoSurfacePixel):
+        (WebCore::getGdkPixbufPixel):
+        (WebCore::BitmapImage::getGdkPixbuf):
+
+2009-08-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Make DOM classes start with a reference count of 1, like all other RefCounted
+        
+        Next step: Element, HTMLElement, HTMLAnchorElement, HTMLAppletElement,
+        HTMLAreaElement, HTMLEmbedElement, HTMLFrameElement, HTMLIFrameElement,
+        HTMLObjectElement, HTMLPlugInElement, HTMLPlugInImageElement.
+
+        * DerivedSources.make: Fix error seen every time we build by escaping the $
+        in the build rule, since you have to use $$ for that in make.
+
+        * WebCore.base.exp: Updated.
+
+        * bindings/objc/DOM.mm:
+        Added now-needed include of SVGNames.h.
+
+        * dom/Document.cpp: Added now-needed include of SVGNames.h.
+        (WebCore::Document::createElement): Use create instead of new.
+
+        * dom/Element.cpp:
+        (WebCore::Element::Element): Added ConstructionType argument so the caller
+        can determine whether this starts with a reference count of either 0 or 1.
+        Later we will remove this again once they are all 1.
+        (WebCore::Element::create): Added.
+
+        * dom/Element.h: Added create and made constructor protected.
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::StyledElement): Added ConstructionType argument.
+        * dom/StyledElement.h: Made many functions protected or private, including
+        the constructor.
+
+        * dom/make_names.pl: Use create to create the base elements HTMLElement,
+        SVGElement, and WMLElement.
+
+        * editing/CreateLinkCommand.cpp:
+        (WebCore::CreateLinkCommand::doApply): Use create instead of new.
+        * editing/UnlinkCommand.cpp:
+        (WebCore::UnlinkCommand::doApply): Ditto.
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::create): Added.
+        * html/HTMLAnchorElement.h: Made constructor protected and added create.
+        Also made m_rootEditableElementForSelectionOnMouseDown a RefPtr.
+
+        * html/HTMLAppletElement.cpp:
+        (WebCore::HTMLAppletElement::create): Added.
+        * html/HTMLAppletElement.h: Made constructor private and added create.
+
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::create): Added.
+        * html/HTMLAreaElement.h: Made constructor private and added create.
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::create): Added.
+        * html/HTMLElement.h: Made constructor protected and added create.
+        Made other functions protected and private. Also added inline
+        definition of constructor.
+
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::create): Added.
+        * html/HTMLEmbedElement.h: Made constructor private and added create.
+        Made other functions private.
+
+        * html/HTMLFrameElement.cpp:
+        (WebCore::HTMLFrameElement::create): Added.
+        (WebCore::HTMLFrameElement::parseMappedAttribute):
+        * html/HTMLFrameElement.h: Made constructor private and added create.
+        Made other functions private.
+
+        * html/HTMLFrameElementBase.h: Made functions protected and private.
+
+        * html/HTMLFrameOwnerElement.cpp:
+        (WebCore::HTMLFrameOwnerElement::HTMLFrameOwnerElement): Pass
+        CreateElement so reference count starts at 1.
+
+        * html/HTMLFrameOwnerElement.h: Made functions protected and private.
+
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::create): Added.
+        * html/HTMLIFrameElement.h: Made constructor private and added create.
+        Made other functions private.
+
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::create): Added.
+        (WebCore::HTMLObjectElement::containsJavaApplet): Changed while loop
+        into a for loop and tweaked formatting.
+
+        * html/HTMLObjectElement.h: Made constructor private and added create.
+        Made other functions private.
+
+        * html/HTMLPlugInElement.h: Made constructor protected.
+        Made other functions protected and private.
+
+        * html/HTMLPlugInImageElement.h: Made constructor and another function
+        protected.
+
+        * html/HTMLTagNames.in: Removed createWithNew from all classes that
+        now have create functions. Moved conditional noscript to a separate
+        paragraph.
+
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::addSpanWithClassName): Use create.
+        (WebCore::HTMLViewSourceDocument::addLink): Ditto.
+        * page/DragController.cpp:
+        (WebCore::documentFragmentFromDragData): Ditto.
+
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::SVGElement): Pass CreateElementZeroRefCount
+        so reference count still starts at 0. Will change this class later.
+        (WebCore::SVGElement::create): Added.
+        * svg/SVGElement.h: Added create, made constructor protected, and
+        made other functions protected and private. Removed unneeded
+        SVGNames.h include.
+
+        * svg/SVGExternalResourcesRequired.h: Added now-needed SVGNames.h
+        include.
+
+        * svg/SVGStopElement.h: Added now-needed SVGNames.h include.
+        Made functions private.
+
+        * wml/WMLElement.cpp:
+        (WebCore::WMLElement::WMLElement): Pass CreateElementZeroRefCount
+        so reference count still starts at 0. Will change this class later.
+        (WebCore::WMLElement::create): Added.
+        * wml/WMLElement.h: Added create and made constructor protected.
+
+        * wml/WMLTagNames.in: Removed createWithNew from WMLElement.
+
+2009-08-22  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for <rdar://problem/7161656> Crash in RenderObject::destroy when using custom scrollbars
+
+        Custom scrollbars normally get detached when a document gets detached.  In this case, a crash was happening when the document had gone into the page cache 
+        and then was getting destroyed without proper scrollbar teardown.  This change makes custom scrollbars get detached when the document enters the cache.
+
+        I couldn't figure out a way to reliably cause this to happen in DRT, since the reproducible case relies on the cache being purged at a particular time.
+
+        * history/CachedFrame.cpp: (WebCore::CachedFrame::CachedFrame): Detach custom scrollbars when the CachedFrame is created.  
+          They'll get reattached when the document comes out of the page cache.
+        * page/FrameView.cpp: (WebCore::FrameView::~FrameView): Added some asserts to catch this problem earlier in debug builds.
+
+2009-08-22  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Make sure self-collapsing blocks that clear floats are still able to collapse their bottom margins with
+        the bottom of their parent blocks.  The old code prevented all collapsing, but all CSS2.1 states is that:
+        "An element that has had clearance applied to it never collapses its top margin with its parent block's bottom margin."
+        
+        The implication is that the bottom margin can still collapse, and the block-inside-inline form of
+        fast/block/margin-collapse/025.html (added as fast/block/margin-collapse/block-inside-inline/025.html) depends
+        on it to get comparable results.
+
+        Added block-inside-inline tests (a whole slew of them) in fast/block/margin-collapse/block-inside-inline/
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::MarginInfo::MarginInfo):
+        (WebCore::RenderBlock::collapseMargins):
+        (WebCore::RenderBlock::clearFloatsIfNeeded):
+        (WebCore::RenderBlock::handleBottomOfBlock):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::MarginInfo::clearMargin):
+        (WebCore::RenderBlock::MarginInfo::canCollapseBottomWithChildren):
+
+2009-08-22  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Need to implement ARIA role="listitem" and role="list"
+        https://bugs.webkit.org/show_bug.cgi?id=28606
+
+        Test: platform/mac-snowleopard/accessibility/aria-list-and-listitem.html
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        * accessibility/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::isUnorderedList):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::RoleEntry::):
+
+2009-08-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Clean up fill image geometry calculation
+        https://bugs.webkit.org/show_bug.cgi?id=28652
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateFillTileSize): Renamed
+            calculateBackgroundSize() to this. Replaced separate scaledWidth and
+            scaledHeight parameters with a single scaledSize parameter. Renamed
+            parameters and local variables.
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry): Changed
+            to use CSS3 Backgrounds and Borders terminology in comments and
+            local variable names. Renamed, clarified and consolidated some local
+            variables.
+        * rendering/RenderBoxModelObject.h: Made calculateFillTileSize() private.
+
+2009-08-22  Chris Marrin  <cmarrin@apple.com>
+
+        Unreviewed, build fix.
+
+        Backing out http://trac.webkit.org/changeset/47669
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        * html/canvas/CanvasRenderingContext2D.h:
+
+2009-08-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        Backing out http://trac.webkit.org/changeset/47671 in preparation of
+        rolling out http://trac.webkit.org/changeset/47669.
+
+2009-08-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Anders Carlsson.
+
+        Build fix, add CanvasRenderingContext to build systems.
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        * DerivedSources.make: Added CanvasRenderinContext.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+
+2009-08-21  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        New files implementing GL buffer wrappers, and support to make them platform independent
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        * html/canvas/CanvasBuffer.cpp: Added. Wrapper around GL Buffer object
+        * html/canvas/CanvasBuffer.h: Added.
+        * html/canvas/CanvasBuffer.idl: Added.
+        * html/canvas/CanvasFramebuffer.cpp: Added. Wrapper around GL Framebuffer object
+        * html/canvas/CanvasFramebuffer.h: Added.
+        * html/canvas/CanvasFramebuffer.idl: Added.
+        * html/canvas/CanvasObject.h: Expose m_context
+        * html/canvas/CanvasProgram.cpp: Added. Wrapper around GL Program object
+        * html/canvas/CanvasProgram.h: Added.
+        * html/canvas/CanvasProgram.idl: Added.
+        * html/canvas/CanvasRenderbuffer.cpp: Added. Wrapper around GL Renderbuffer object
+        * html/canvas/CanvasRenderbuffer.h: Added.
+        * html/canvas/CanvasRenderbuffer.idl: Added.
+        * html/canvas/CanvasRenderingContext3D.cpp: Move m_objects hash table from GraphicsContext3D to here
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasShader.cpp: Added. Wrapper around GL Shader object
+        * html/canvas/CanvasShader.h: Added.
+        * html/canvas/CanvasShader.idl: Added.
+        * html/canvas/CanvasTexture.cpp: Added. Wrapper around GL Texture object
+        * html/canvas/CanvasTexture.h: Added.
+        * html/canvas/CanvasTexture.idl: Added.
+        * platform/graphics/GraphicsContext3D.cpp: Removed.
+        * platform/graphics/GraphicsContext3D.h: Move m_objects hash table from here to CanvasRenderingContext3D
+        * platform/graphics/mac/GraphicsContext3DMac.cpp: Implement platform dependent code for GL object creation/destruction
+
+2009-08-21  Darin Adler  <darin@apple.com>
+
+        * WebCore.vcproj/build-generated-files.sh:
+        * make-generated-sources.sh:
+        Removed obsolete code to set up CREATE_HASH_TABLE.
+
+2009-08-21  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/7162322> Custom style sheet ignored if UAC is enabled 
+
+        * platform/win/SharedBufferWin.cpp: (WebCore::SharedBuffer::createWithContentsOfFile): 
+        No need to open the file with write access.  Only read access is needed.
+
+2009-08-21  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7161454> Leaks seen during http/tests/xmlhttprequest/cross-origin-no-authorization.html
+
+        Also fixes leaks seen on appcache tests.
+
+        * platform/network/mac/ResourceHandleMac.mm: (WebCore::ResourceHandle::cancel): Work around
+        something that's likely a CFNetwork issue. Note that on Windows, there is no matching API
+        to call, and we do not think that the leak occurs there anyway.
+
+2009-08-21  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28650
+        Remove cross-thread code from CrossOriginPreflightResultCache.
+        Removed mutexes, atomic initializer and string copy.
+
+        No new tests, the worker tests cover this.
+
+        * loader/CrossOriginPreflightResultCache.cpp:
+        (WebCore::addToAccessControlAllowList):
+        (WebCore::CrossOriginPreflightResultCache::shared):
+        (WebCore::CrossOriginPreflightResultCache::appendEntry):
+        (WebCore::CrossOriginPreflightResultCache::canSkipPreflight):
+        (WebCore::CrossOriginPreflightResultCache::empty):
+        * loader/CrossOriginPreflightResultCache.h:
+
+2009-08-21  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        Buildfix after http://trac.webkit.org/changeset/47655.
+
+        * html/HTMLFormControlElement.h:
+
+2009-08-19  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Improve Cookie DataGrid to Show Hidden Data
+        https://bugs.webkit.org/show_bug.cgi?id=28269
+
+          Removed Custom Bindings
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        * inspector/InspectorBackend.cpp:
+
+          Made Non-Custom Bindings in the Backend
+
+        (WebCore::InspectorBackend::getCookies):
+        (WebCore::InspectorBackend::deleteCookie):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::deleteCookie):
+        * inspector/InspectorController.h:
+
+          Build the Cookie ScriptObjects, handles using document.cookie in
+          case the platform hasn't implemented raw cookie access.
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getCookies):
+        (WebCore::InspectorDOMAgent::buildObjectForCookie):
+        (WebCore::InspectorDOMAgent::buildArrayForCookies):
+        * inspector/InspectorDOMAgent.h:
+
+          Complete the Asynchronous Calls
+
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didGetCookies):
+        * inspector/InspectorFrontend.h:
+
+          Asynchronous Functions to get Cookie Data
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.Cookies.getCookiesAsync):
+        (WebInspector.Cookies.buildCookiesFromString): fallback behavior
+
+          Refactor to use the Asynchronous Functions
+
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.get statusBarItems):
+        (WebInspector.CookieItemsView.prototype.update.callback):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype.simpleDataGridForCookies):
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
+
+          Cleaned/Commented Related Code
+
+        (InspectorController.searchCanceled):
+        * inspector/front-end/InjectedScript.js:
+        * platform/Cookie.h:
+        * English.lproj/localizedStrings.js: the new strings that were supposed to have gone in last time
+
+2009-08-21  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28145
+        Add support for novalidate/formnovalidate attribute, from HTML5 specs:
+        http://www.whatwg.org/specs/web-apps/current-work/#attr-fs-novalidate
+
+        Tests: fast/forms/formnovalidate-attribute.html
+               fast/forms/novalidate-attribute.html
+
+        * html/HTMLAttributeNames.in: added novalidate, formnovalidate
+        * html/HTMLButtonElement.idl: formnovalidate attribute exposed
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::formNoValidate): attribute getter
+        (WebCore::HTMLFormControlElement::setFormNoValidate): attribute setter
+        * html/HTMLFormControlElement.h:
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::novalidate): attribute getter
+        (WebCore::HTMLFormElement::setNovalidate): attribute setter
+        * html/HTMLFormElement.h:
+        * html/HTMLFormElement.idl: novalidate attribute exposed
+        * html/HTMLInputElement.idl: formNoValidate attribute exposed
+
+2009-08-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Rendering changes to complete
+        [CSS3 Backgrounds and Borders] Add support for the "contain" value for
+        background-size
+        https://bugs.webkit.org/show_bug.cgi?id=27573
+        and
+        [CSS3 Backgrounds and Borders] Add support for the "cover" value for
+        background-size
+        https://bugs.webkit.org/show_bug.cgi?id=27574
+
+        Test: fast/backgrounds/size/contain-and-cover.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateBackgroundSize):
+        * rendering/RenderObject.cpp:
+        (WebCore::mustRepaintFillLayers):
+
+2009-08-21  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27452
+        Add support for checkValidity() method and invalid event, from HTML5
+        specs:
+        http://www.whatwg.org/specs/web-apps/current-work/#dom-form-checkvalidity
+
+        Tests: fast/events/invalid-001.html
+               fast/events/invalid-002.html
+               fast/events/invalid-003.html
+               fast/events/invalid-004.html
+               fast/events/invalid-005.html
+               fast/forms/checkValidity-001.html
+               fast/forms/checkValidity-002.html
+               fast/forms/checkValidity-003.html
+               fast/forms/checkValidity-004.html
+
+        * dom/Document.idl: oninvalid event handler
+        * dom/Element.idl: ditto
+        * dom/EventNames.h: added invalid event
+        * dom/Node.cpp:
+        (WebCore::Node::oninvalid): ditto
+        (WebCore::Node::setOninvalid): ditto
+        * dom/Node.h: ditto
+        * html/HTMLAttributeNames.in: oninvalid attribute
+        * html/HTMLButtonElement.idl: added checkValidity() method
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute): parses oninvalid
+        * html/HTMLFieldSetElement.idl: added checkValidity() method
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::checkValidity): checkValidity()
+        implementation
+        * html/HTMLFormControlElement.h:
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::checkValidity): checkValidity() implementation
+        for form elements
+        * html/HTMLFormElement.h: checkValidity() definition
+        * html/HTMLFormElement.idl: added checkValidity() method
+        * html/HTMLInputElement.idl: added checkValidity() method
+        * html/HTMLSelectElement.idl: added checkValidity() method
+        * html/HTMLTextAreaElement.idl: added checkValidity() method
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::oninvalid): oninvalid event handler
+        (WebCore::DOMWindow::setOninvalid): ditto
+        * page/DOMWindow.h: ditto
+        * page/DOMWindow.idl: ditto
+
+2009-08-21  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        The CSS part of https://bugs.webkit.org/show_bug.cgi?id=27571 [CSS3 
+        Backgrounds and Borders] Add support for the "round" value for 
+        background-repeat
+        -and-
+        https://bugs.webkit.org/show_bug.cgi?id=27570 [CSS3 Backgrounds and 
+        Borders] Add support for the "space" value for background-repeat
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFillProperty):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EFillRepeat):
+        * css/CSSValueKeywords.in:
+        * rendering/style/FillLayer.h:
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-08-21  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        New files for Canvas 3D feature
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        This is all the new files for implementing Canvas 3D. None of them are hooked up and
+        are not even included in the build yet. This incorporates the reviews from Simon
+        and Ollie for these files.
+
+        * bindings/js/JSCanvasNumberArrayCustom.cpp: Added. Custom JS binding to do implicit conversion from JS Array
+        * html/CanvasObject.cpp: Added. Base class for all GL object containers
+        * html/CanvasObject.h: Added.
+        * html/CanvasRenderingContext.cpp: Added. Base class for CanvasRenderingContext2D and CanvasRenderingContext3D
+        * html/CanvasRenderingContext.h: Added.
+        * html/CanvasRenderingContext.idl: Added.
+        * html/CanvasRenderingContext3D.cpp: Added. 3D context returned from Canvas.getContext()
+        * html/CanvasRenderingContext3D.h: Added.
+        * html/CanvasRenderingContext3D.idl: Added.
+        * platform/graphics/GraphicsContext3D.cpp: Added. Platform interface between CanvasRenderingContext3D and 3D graphics engine
+        * platform/graphics/GraphicsContext3D.h: Added.
+        * platform/graphics/mac/Canvas3DLayer.h: Added. CALayer subclass to composite 3D canvas
+        * platform/graphics/mac/Canvas3DLayer.mm: Added.
+        * platform/graphics/mac/GraphicsContext3DMac.cpp: Added. Mac specific interface (OpenGL based)
+
+2009-08-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        No Review.
+
+        Another Windows build fix.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::diffTextDecorations):
+
+2009-08-21  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28625, focus rings don't respect the non-strict mode
+        line box shrinking quirk.  Make sure outlines don't extend outside the lineTop and lineBottom
+        of the root line box.
+
+        Covered by existing tests.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addFocusRingRects):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::addFocusRingRects):
+        (WebCore::RenderInline::paintOutline):
+
+2009-08-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        No Review.
+
+        Windows build fix.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::setTextDecorationProperty): Made it static
+        (WebCore::diffTextDecorations): Made it static
+
+2009-08-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        execCommand("Underline") uses CSS even when styleWithCSS has been turned off
+        https://bugs.webkit.org/show_bug.cgi?id=23892
+
+        This patch adds support for u and s in StyleChange and addInlineStyleIfNeeded so that
+        WebKit does not use CSS to decorate texts when styleWithCSS is set to false.
+
+        * css/CSSValueList.cpp:
+        (WebCore::CSSValueList::copy): Added.
+        * css/CSSValueList.h: Added copy.
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::applyUnderline):
+        (WebCore::StyleChange::applyLineThrough):
+        (WebCore::StyleChange::StyleChange): Added a boolean trimTextDecorations argument.
+        (WebCore::StyleChange::init): Ditto.
+        (WebCore::StyleChange::extractTextStyles): Handles text decorations.
+        (WebCore::getPropertiesNotInComputedStyle): Handles text decorations properly.
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded): Adds u and s if needed.
+
+2009-08-21  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Rename "Databases" Panel as "Storage"
+        https://bugs.webkit.org/show_bug.cgi?id=28620
+
+          Updated enum from "DatabasesPanel" to "StoragePanel" and wherever it was used.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::specialPanelForJSName): string to display StoragePanel can be either "databases" or "storage"
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::showPanel):
+
+          Updated All Direct Access from WebInspector.panels.databases to WebInspector.panels.storage,
+          any DatabasesPanel constructors and appropriate function names.
+
+        * inspector/front-end/DOMStorageDataGrid.js:
+        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode):
+        (WebInspector.DOMStorageDataGrid.prototype._startEditing):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCancelled):
+        (WebInspector.DOMStorageDataGrid.prototype.deleteSelectedRow):
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView.prototype._queryFinished):
+        * inspector/front-end/DatabaseTableView.js:
+        (WebInspector.DatabaseTableView.prototype._queryFinished):
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels): updated string that comes from hiddenPanels to be "databases" or "storage"
+        (WebInspector.showStoragePanel):
+        (WebInspector.selectDatabase):
+        (WebInspector.selectDOMStorage):
+        (WebInspector.addDatabase):
+        (WebInspector.addDOMStorage):
+
+          Renamed some files and Updated Accordingly.
+
+        * inspector/front-end/StoragePanel.js: Renamed from WebCore/inspector/front-end/DatabasesPanel.js.
+        * inspector/front-end/Images/storageIcon.png: Renamed from WebCore/inspector/front-end/Images/databasesIcon.png.
+        * inspector/front-end/WebKit.qrc: use new file names
+        * inspector/front-end/inspector.css: use new images name and class names
+        * inspector/front-end/inspector.html: use new file name
+        * WebCore.gypi: use new file names
+
+          Miscellaneous Updates.
+
+        * English.lproj/localizedStrings.js: Updated Tooltip from "Databases" to "Storage"
+
+2009-08-21  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        [Haiku] Adding three font-specific files to WebCore:
+        FontCacheHaiku.cpp, FontHaiku.cpp, and SimpleFontDataHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28131
+
+        * platform/graphics/haiku/FontCacheHaiku.cpp: Added.
+        (WebCore::FontCache::platformInit):
+        (WebCore::FontCache::getFontDataForCharacters):
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        (WebCore::FontCache::createFontPlatformData):
+        (WebCore::FontCache::getTraitsInFamily):
+        * platform/graphics/haiku/FontHaiku.cpp: Added.
+        (charUnicodeToUTF8HACK):
+        (WebCore::Font::canReturnFallbackFontsForComplexText):
+        (WebCore::Font::drawGlyphs):
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::Font::selectionRectForComplexText):
+        (WebCore::Font::offsetForPositionForComplexText):
+        * platform/graphics/haiku/SimpleFontDataHaiku.cpp: Added.
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        (WebCore::SimpleFontData::platformDestroy):
+        (WebCore::SimpleFontData::smallCapsFontData):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+
+2009-08-21  Philippe Beauchamp  <philippe.beauchamp@gmail.com>
+
+        Reviewed by Adam Roben.
+
+        Middle click panning icon is offset by 3 pixels
+        https://bugs.webkit.org/show_bug.cgi?id=28611
+
+        * platform/ScrollView.cpp:
+        panIconSizeLength initialized to 20 instead of 16 to match icon dimension (2 pixels offset)
+        * platform/win/CursorWin.cpp:
+        (WebCore::middlePanningCursor):
+        Hotspot initialized to (8,8) instead of (7,7) (one pixel offset)
+        
+2009-08-21  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Remove inspector resources for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=28610
+
+        Based on an idea from Simon Hausmann.
+
+        * WebCore.pro:
+
+2009-08-21  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Inspector: Remove Unused Variable
+        https://bugs.webkit.org/show_bug.cgi?id=28616
+
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype._checkWarning):
+
+2009-08-21  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Console Array Formatter Shows Extra Properties
+        https://bugs.webkit.org/show_bug.cgi?id=28615
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._formatarray): do not ignore hasOwnProperties
+
+2009-08-21  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        The CSS part of https://bugs.webkit.org/show_bug.cgi?id=27574 [CSS3 
+        Backgrounds and Borders] Add support for the "contain" value for 
+        background-size
+        -and-
+        https://bugs.webkit.org/show_bug.cgi?id=27573 [CSS3 Backgrounds and 
+        Borders] Add support for the "cover" value for background-size
+
+        Return contain or cover when appropriate, and otherwise do what we 
+        used to do.
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+        Accept contain and cover as valid values for background-size.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFillProperty):
+
+        Handle setting the size and the sizeLength if appropriate.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::mapFillSize):
+
+        Added new keywords contain and cover.
+        * css/CSSValueKeywords.in:
+
+        Use just sizeLength instead of size to match old behavior.
+        * page/animation/AnimationBase.cpp:
+        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateBackgroundSize):
+        * rendering/RenderObject.cpp:
+        (WebCore::mustRepaintFillLayers):
+
+        The variable m_sizeType is an EBackgroundSize, and m_sizeLength is 
+        a LengthSize (the equivalent of what m_size used to be). I got rid 
+        of m_sizeSet and made isSizeSet() dynamic. I also defined a new 
+        struct, FillSize that can be used to set or get m_size and 
+        m_sizeLength both at once. 
+        * rendering/style/FillLayer.cpp:
+        (WebCore::FillLayer::FillLayer):
+        (WebCore::FillLayer::operator=):
+        (WebCore::FillLayer::operator==):
+        (WebCore::FillLayer::fillUnsetProperties):
+        * rendering/style/FillLayer.h:
+        (WebCore::FillSize::FillSize):
+        (WebCore::FillSize::operator==):
+        (WebCore::FillSize::operator!=):
+        (WebCore::FillLayer::sizeLength):
+        (WebCore::FillLayer::size):
+        (WebCore::FillLayer::isSizeSet):
+        (WebCore::FillLayer::setSizeType):
+        (WebCore::FillLayer::setSizeLength):
+        (WebCore::FillLayer::setSize):
+        (WebCore::FillLayer::clearSize):
+        (WebCore::FillLayer::initialFillSizeType):
+        (WebCore::FillLayer::initialFillSizeLength):
+        (WebCore::FillLayer::initialFillSize):
+
+        This is all boiler-plate stuff to adjust to the new size() vs. 
+        sizeType() vs. sizeLength() distinction.
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::backgroundSizeType):
+        (WebCore::InheritedFlags::backgroundSizeLength):
+        (WebCore::InheritedFlags::maskSize):
+        (WebCore::InheritedFlags::setBackgroundSize):
+        (WebCore::InheritedFlags::setBackgroundSizeLength):
+        (WebCore::InheritedFlags::setMaskSize):
+
+        Definition for EBackgroundSizeType.
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-08-21  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Not reviewed, build fix after r47580.
+
+        [Qt] Adjust the files.
+
+        * inspector/front-end/WebKit.qrc:
+
+2009-08-20  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Enable various "grouping" ARIA roles
+        https://bugs.webkit.org/show_bug.cgi?id=28486
+
+        Test: platform/mac/accessibility/aria-grouping-roles.html
+
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        * page/mac/WebCoreViewFactory.h:
+        * platform/LocalizedStrings.h:
+        * platform/mac/LocalizedStringsMac.mm:
+
+2009-08-20  David Levin  <levin@chromium.org>
+
+        Unreviewed trivial comment fix.
+
+        Update a bug link in a comment due to bugzilla amnesia.
+
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::setResourceToRevalidate):
+
+2009-08-20  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by David Levin.
+
+        HTML5 media elements do not fire waiting events correctly
+        https://bugs.webkit.org/show_bug.cgi?id=28335
+
+        Fire the waiting event before seeking, and fix a case where firing of
+        the seeked event is missed when the ready state is changed during
+        a seek.
+
+        Added video-waiting-seeking.html into manual tests because not
+        all platforms allow seeking into non-buffered ranges.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setReadyState): add support for
+        waiting event when seeking.
+        (WebCore::HTMLMediaElement::finishSeek): send seeked event
+        whenever seeking finishes.
+        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged): dispatch to
+        new function.
+        * html/HTMLMediaElement.h:
+        * manual-tests/video-waiting-seeking.html: Added.
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Fix more cases of
+        <rdar://problem/7154521> Lots of "<Error>: doClip: empty path." spew in
+        the console with certain content
+
+        If the border box is empty, simply avoid painting instead of trying to
+        clip to the empty path.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+
+2009-08-20  Jeremy Orlow  <jorlow@chromium.org>
+
+        Build fix.  Forgot a svn add for a patch I landed.  :-(
+
+        * storage/SQLTransactionClient.cpp: Added.
+        (WebCore::SQLTransactionClient::didCommitTransaction):
+        (WebCore::SQLTransactionClient::didExecuteStatement):
+        (WebCore::SQLTransactionClient::didExceedQuota):
+        * storage/SQLTransactionClient.h: Added.
+
+2009-08-20  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Added a client to SQLTransaction. In addition to being a place to
+        get notifications about certain events in a transaction, it is
+        also an abstraction layer that allows us to plug in different
+        implementations for each port for how transactions interract with
+        the main DB. For example, WebCore's default implementation will
+        make direct calls to DatabaseTracker's methods. At the same time,
+        Chromium's implementation will send IPCs to the browser process
+        whenever a transaction needs something from the main DB.
+
+        All storage tests pass.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27967
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/Database.cpp:
+        (WebCore::Database::transactionClient):
+        * storage/Database.h:
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        * storage/DatabaseThread.h:
+        (WebCore::DatabaseThread::transactionClient):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::runCurrentStatement):
+        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
+        (WebCore::SQLTransaction::postflightAndCommit):
+        * storage/SQLTransactionClient.cpp: Added.
+        * storage/SQLTransactionClient.h: Added.
+
+2009-08-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        Fix of <https://bugs.webkit.org/show_bug.cgi?id=24793>
+        Auto scroll speed is faster than in IE, Firefox.
+        
+        Changed pan scrolling speed to match Firefox's algorithm.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::adjustedScrollDelta):
+        (WebCore::RenderLayer::panScrollFromPoint):
+
+2009-08-20  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix for assert in Chromium page cycler:  drawRect() was re-using
+        an SkPaint, but not resetting it before calling
+        PlatformGraphicsSkia::setupPaintForFilling() a second time.  This
+        CL fixes drawRect(), and re-enables the assert.
+        http://bugs.webkit.org/show_bug.cgi?id=28172
+        http://crbug.com/19797
+
+        Covered by Chromium page cycler tests.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::drawRect):
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-20  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7159016> Popup menus don't disappear when you click outside the window.
+        
+        Revert r47535 which introduced this.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupWndProc):
+
+2009-08-20  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Crashes on sites with lots of images
+        https://bugs.webkit.org/show_bug.cgi?id=28473
+
+        The problem is that m_resourceToRevalidate::m_isBeingRevalidated is false while
+        CachedResource is still referring to it, so it may get deleted before
+        Cache::revalidationSucceeded calls CachedResource::clearResourceToRevalidate.
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::revalidateResource): Added assert to verify the resource
+        being revalidated is physically in the cache.
+        (WebCore::Cache::revalidationSucceeded): Changed to do one call to switch from the revalidating
+        resource to the revalidated resource.  This allows for proper lifetime management of the
+        revalidated resource. Added assert to verify that the revalidatingResource is in the cache.
+        (WebCore::Cache::pruneDeadResources): Don't remove items from the cache that are in the
+        process of being validated (or else they can get added twice: Once through the normal mechanism
+        and then again during revalidateResource).
+
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::CachedResource):
+        (WebCore::CachedResource::isSafeToMakePurgeable):
+        Changed m_isBeingRevalidated to m_proxyResource to allow finding out
+        who the validating resource (or proxy) is.
+
+        (WebCore::CachedResource::~CachedResource): Removed code to handle m_resourceToRevalidate
+        being non-zero because this shouldn't be possible due to checks in canDelete. Added asserts
+        as well.
+        (WebCore::CachedResource::setResourceToRevalidate): Adjusted for the change to m_proxyResource
+        and added a comment about the assert.
+        (WebCore::CachedResource::clearResourceToRevalidate):
+        Only clean up the resourceToRevalidate if it hasn't gotten a new proxy resource.
+        * loader/CachedResource.h:
+        (WebCore::CachedResource::setInCache): Don't clear m_proxyResource because the resource
+        is still being referred to by it and the code it robust to this being switched to a new proxy
+        resource without it being cleared first.
+        (WebCore::CachedResource::canDelete): Changed m_isBeingRevalidated to m_proxyResource.
+
+2009-08-20  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix "Chromium RTL autocomplete popup is not layout correctly".
+        https://bugs.webkit.org/show_bug.cgi?id=27889
+
+        The complete fix of the issue consists 2 parts: the patch in webkit
+        and the patch in Chromium's own code.
+
+        This webkit patch only affects Chromium autofill. It
+        1. introduces a new flag in WebCore::PopupContainerSettings to
+           distinguish whether the width of the drop-down should be restricted
+           or not.
+           For autofill, the width of the drop-down is restricted to
+           be the same as that of the input field (the new flag is set in
+           Chromium's own code). But width is not restricted for <select> (same as before).
+        2. introduce a new flag in WebCore::PopContainerSettings to
+           indicate what heuristics to use when displaying text in drop-down menu.
+           For autofill, use drop-down item's directionality to display drop-down items.
+           Previously, drop-down item is displayed in the its first strong
+           directional character's directionality.
+           (drop-down item's directionality is set in Chromium's own code.
+           It is set the same as the directionality of the element. 
+           For autofill, it is the same directionality as that of the input field.)
+           For <select>, still use the text's first strong directional character's
+           directionality to display the text.
+
+
+        Since the patch only affects the chromium client, not webcore part or
+        other clients. No automatic tests is possible.
+
+        * manual-tests/autofill-popup-width-and-item-direction.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::):
+        (WebCore::PopupListBox::paintRow): If list box width is restricted and 
+        an item is longer to fit in a list box, truncate it and draw part of the text and append ellipses.
+        (WebCore::PopupListBox::layout): Restrict width of list box if applicable.
+        * platform/chromium/PopupMenuChromium.h: 
+        (WebCore::PopupItem::PopupItem): style change.
+        (WebCore::PopupContainerSettings::): Add 2 new flags in PopupContainerSetting to 
+        distinguish whether to restrict width of list box and 
+        in what directionality to display the text in drop-down.
+
+2009-08-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Fix of <https://bugs.webkit.org/show_bug.cgi?id=28504>. 
+        Pan Scrolling can scroll while showing the middlePanScroll icon.
+        
+        Fixed an off by one error between RenderLayer::panScrollFromPoint and EventHandler::updatePanScrollState. 
+        In RenderLayer::panScrollFromPoint, we were setting the icon to be an arrow if the difference between the start
+        of the pan scroll and the current mouseposition is > 15. However, in EventHandler::updatePanScrollState, we would
+        set our amount to scroll to 0 only if the difference in mouse position is < 15. I made this check a <= 15, to fix
+        the off by one error.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::panScrollFromPoint):
+
+2009-08-20  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Pull the code in layoutBlockChildren for handling a normal flow block child into a helper method,
+        layoutBlockChild.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::layoutBlockChild):
+        * rendering/RenderBlock.h:
+
+2009-08-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Made subframeForHitTargetNode a public static method, so WebView can call it
+        during hit testing.
+
+        * page/EventHandler.cpp:
+        (WebCore::subframeForHitTestResult):
+        (WebCore::EventHandler::subframeForTargetNode):
+        * page/EventHandler.h:
+
+2009-08-20  Brent Fulgham  <bfulgham@webkit.org>
+
+        Rubberstamped by Kevin Ollivier.
+
+        Check for null bundle before attempting to use it.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::certificatePath): Add null check on return of
+          CFBundleGetBundleWithIdentifier.
+
+2009-08-20  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28497, images and inline replaced elements don't propagate overflow properly on a line.
+
+        Added fast/repaint/inline-block-overflow.html and updated another test.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        (WebCore::InlineFlowBox::computeVerticalOverflow):
+        Make sure to still propagate the border box of the replaced element as layout overflow when overflow clip is set on the
+        replaced element.  Make sure to use the InlineBox x/y positions instead of the RenderBox x/y, since the position of the
+        RenderBox has not been updated to the new values yet.
+        
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint):
+        Don't use the root line box's overflow.  Use the actual line box overflow values instead.  In the case of an inline
+        with a layer, our overflow didn't propagate to the root line, so we always need to use our values.
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::layout):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::layout):
+        Make sure to clear shadow overflow when doing layout of replaced elements, so that we don't leave a stale overflow
+        value around if a box-shadow goes away.
+
+2009-08-20  Dmitry Titov  <dimich@chromium.org>
+
+        Another attempt to fix Chromium build.
+
+        * WebCore.gypi: now use the correct name of the image file.
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Make the Windows build even fixeder
+
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::flush):
+
+2009-08-20  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, Chromium build fix.
+
+        * WebCore.gypi: add new Webinspector image files (localStorage.png and sessionStorage.png)
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Windows build fix after the last change
+
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContext::GraphicsContext):
+        (WebCore::GraphicsContext::releaseWindowsContext):
+        (WebCore::GraphicsContext::drawWindowsBitmap):
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Replace many manually-released CFTypeRefs with RetainPtrs
+        https://bugs.webkit.org/show_bug.cgi?id=28498
+
+        * platform/graphics/cg/ColorCG.cpp:
+        (WebCore::createCGColor):
+        * platform/graphics/cg/GradientCG.cpp:
+        (WebCore::Gradient::platformGradient):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::platformContext):
+        (WebCore::GraphicsContext::applyStrokePattern):
+        (WebCore::GraphicsContext::applyFillPattern):
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::setURLForRect):
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContextPlatformPrivate::~GraphicsContextPlatformPrivate):
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::setData):
+        (WebCore::ImageSource::isSizeAvailable):
+        (WebCore::ImageSource::frameSizeAtIndex):
+        (WebCore::ImageSource::repetitionCount):
+        (WebCore::ImageSource::createFrameAtIndex):
+        (WebCore::ImageSource::frameDurationAtIndex):
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        (WebCore::PDFDocumentImage::dataChanged):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::createScratchContext):
+        (WebCore::Path::contains):
+        * platform/graphics/mac/FontCustomPlatformData.cpp:
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/mac/ImageMac.mm:
+        (WebCore::BitmapImage::getTIFFRepresentation):
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::cocoaTypeFromMIMEType):
+        (WebCore::MIMETypeFromCocoaType):
+        * platform/mac/WebCoreNSStringExtras.mm:
+        (stringEncodingForResource):
+        * platform/network/mac/FormDataStreamMac.mm:
+        (WebCore::advanceCurrentStream):
+        (WebCore::setHTTPBody):
+        * platform/text/mac/TextCodecMac.cpp:
+        (WebCore::TextCodecMac::encode):
+
+2009-08-20  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Output actual values of counters in showTree
+        https://bugs.webkit.org/show_bug.cgi?id=28481
+
+        No new tests because this patch just improves debugging outputs.
+
+        * rendering/CounterNode.cpp:
+        (WebCore::showTreeAndMark):
+
+2009-08-20  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Add file missed in last check-in.
+
+        * html/HTMLAttributeNames.in:
+
+2009-08-19  Timothy Hatcher  <timothy@apple.com>
+
+        Adds new icons to the Web Inspector for Local Storage,
+        Session Storage and Cookies.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28470
+
+        Reviewed by Eric Seidel.
+
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.addDOMStorage):
+        (WebInspector.DOMStorageSidebarTreeElement):
+        * inspector/front-end/Images/cookie.png:
+        * inspector/front-end/Images/domStorage.png: Removed.
+        * inspector/front-end/Images/localStorage.png: Added.
+        * inspector/front-end/Images/sessionStorage.png: Added.
+        * inspector/front-end/inspector.css:
+
+2009-08-20  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        HTML5 media elements must fire 'loadend' progress event
+        https://bugs.webkit.org/show_bug.cgi?id=28419
+
+        * dom/EventNames.h:
+            Define loadend.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute):
+            Deal with onloadend.
+        (WebCore::HTMLMediaElement::loadInternal):
+            Post 'loadend' immediately after 'abort'.
+        (WebCore::HTMLMediaElement::noneSupported):
+            Post 'loadend' immediately after 'error'.
+        (WebCore::HTMLMediaElement::mediaEngineError):
+            Ditto.
+        (WebCore::HTMLMediaElement::setNetworkState):
+            Post 'loadend' immediately after 'load'.
+        (WebCore::HTMLMediaElement::userCancelledLoad):
+            Post 'loadend' immediately after 'abort'.
+
+2009-08-20  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        REGESSION(r45316), Crash: WebKit crashes in Google Sites when indenting a table
+        https://bugs.webkit.org/show_bug.cgi?id=28474
+
+        This patch fixes a crash when indenting at right after a table.
+        The bug was caused by Node* blockNode = enclosingBlock(endOfCurrentParagraph.deepEquivalent().node());
+        where node() is equal to blockNode. Because blockNode is the enclosing block node, this patch changes it to
+        enclosingBlock(endOfCurrentParagraph.deepEquivalent().node()->parentNode());
+
+        Test: editing/execCommand/indent-right-after-table.html
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::indentRegion): Fixed so that blockNode != endOfCurrentParagraph.deepEquivalent().node()
+
+2009-08-20  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by David Levin.
+
+        Render disabled mute button during an error or if no audio is present.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28475
+
+        Covered by existing layout tests:
+        media/video-controls-visible-audio-only.html
+        media/video-no-audio.html
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton):
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7154605> Loading page with 1px wide <select> makes the
+        toolbar go blank
+        and
+        <rdar://problem/7154521> Lots of "<Error>: doClip: empty path." spew in
+        the console with certain content
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMenuListButtonGradients): Return early
+        if the rectangle is empty. Use RenderStyle::getBorderRadiiForRect() to
+        adjust the radii in case the sides of the rectangle are smaller than sum
+        of the radii, so that the gradient background matches the border (which
+        already uses getBorderRadiiForRect()). Check if bottomGradient is empty
+        to avoid clipping to an empty path.
+        (WebCore::RenderThemeMac::paintMenuListButton): Moved a
+        GraphicContext::save() down to avoid a save/restore imbalance in the
+        early return case.
+
+        * rendering/RenderThemeSafari.cpp: Made the same changes.
+        (WebCore::RenderThemeSafari::paintMenuListButtonGradients):
+        (WebCore::RenderThemeSafari::paintMenuListButton):
+
+2009-08-20  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk][REGRESSION] XHR test failures after r45558
+        https://bugs.webkit.org/show_bug.cgi?id=27143
+
+        Disable sniffing if it's explicitly requested. Updated patch
+        originally by Gustavo Noronha.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::statusWillBeHandledBySoup):
+        (WebCore::gotHeadersCallback):
+        (WebCore::contentSniffedCallback):
+        (WebCore::gotChunkCallback):
+        (WebCore::startHttp):
+
+2009-08-20  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Swap the pixels since QImage expect ARGB while ImageData
+        stores them as RGBA.
+
+        This fixes the fast/canvas/canvas-copyPixels.html test.
+
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::putImageData):
+
+2009-08-20  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by David Levin.
+
+        [v8] Use atomic string caching for createElement
+        Extend atomic string caching to createElement.  Fix a bug in idl
+        parser that caused incorrect parsing if a function argument
+        attribute list contained a comma.
+        https://bugs.webkit.org/show_bug.cgi?id=28449
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/scripts/IDLParser.pm:
+        * bindings/v8/V8Binding.h:
+        (WebCore::v8ValueToAtomicWebCoreStringWithNullCheck):
+        * dom/Document.idl:
+
+2009-08-20  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Not reviewed, build fix after r47515.
+
+        [Qt] There is no Phonon::MediaObject::hasAudio() function.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio): Assume true.
+
+2009-08-20  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28483
+        The V8 ScriptController's cleanupScriptObjectsForPlugin should take a
+        Widget* instead of void* to avoid the need for manual casting to Widget*
+        at the callsite.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::cleanupScriptObjectsForPlugin):
+        * bindings/v8/ScriptController.h:
+
+2009-08-19  David Levin  <levin@chromium.org>
+
+        Unreviewed speculative build fix for qt.
+
+        * page/OriginAccessEntry.cpp:
+
+2009-08-19  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24853: Provide a way for WebKit clients to
+        specify a more granular policy for cross-origin XHR access.
+
+        Tests: http/tests/xmlhttprequest/origin-whitelisting-all.html
+               http/tests/xmlhttprequest/origin-whitelisting-exact-match.html
+               http/tests/xmlhttprequest/origin-whitelisting-https.html
+               http/tests/xmlhttprequest/origin-whitelisting-ip-addresses-with-subdomains.html
+               http/tests/xmlhttprequest/origin-whitelisting-ip-addresses.html
+               http/tests/xmlhttprequest/origin-whitelisting-subdomains.html
+
+        * WebCore.base.exp: Export methods to manipulate origin access whitelists to enable
+        testing via layout tests.
+
+        * WebCore.xcodeproj/project.pbxproj: Add OriginAccessEntry.*
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCoreSources.blk: Ditto.
+
+        * page/SecurityOrigin.h: Implement origin access whitelists.
+        (WebCore::originAccessMap): Static getter for access whitelists.
+        (WebCore::SecurityOrigin::canRequest): Modify request checking logic to check whitelists.
+        (WebCore::SecurityOrigin::whiteListAccessFromOrigin): Add an entry to a whitelist.
+        (WebCore::SecurityOrigin::resetOriginAccessWhiteLists): Clear all the whitelists.
+
+        * page/OriginAccessEntry.h: Added. An entry in an origin access whitelist.
+        * page/OriginAccessEntry.cpp: Ditto.
+
+2009-08-19  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Non-precomp headers build fix.
+
+        * platform/image-decoders/ImageDecoder.cpp:
+
+2009-08-19  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Disable a bad SKIA assert
+        https://bugs.webkit.org/show_bug.cgi?id=28482
+
+        In http://trac.webkit.org/changeset/47386/ an assert was "fixed" in SKIA code. 
+        When this was pulled into Chromium, it started breaking the page cycler. 
+        Disable it again until we can figure out what's going on.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-19  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        queryCommandState('underline') returns false if the selected text is also bold and italic
+        https://bugs.webkit.org/show_bug.cgi?id=11022
+
+        This patch modifies stateStrikethrough and stateUnderline to use the value -webkit-text-decorations-in-effect
+        instead of text-decoration.  Because text-decoration only retrieves explicit styling at the node on which
+        the query was sent, we need to use -webkit-text-decorations-in-effect to include decorations added by ancestors
+        and also u, s, and strike tags.
+
+        Test: editing/style/text-decoration-state.html
+
+        * editing/EditorCommand.cpp:
+        (WebCore::stateStrikethrough): Use -webkit-test-decorations-in-effect instead of text-decoration.
+        (WebCore::stateUnderline): Ditto.
+
+2009-08-19  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - Fix <rdar://problem/7155710>
+        HTML selects on windows cause containing window to become inactive when opened.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        Pass SWP_NOACTIVATE to SetWindowPos, remove AW_ACTIVATE from AnimateWindow and pass
+        SW_SHOWNOACTIVATE to ShowWindow.
+        
+        (WebCore::PopupWndProc):
+        Prevent mouse activation from activating the window.
+
+2009-08-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Images flash as you hover them on http://www.atebits.com/scribbles/
+        <rdar://problem/7143958>
+        
+        Tag images with the device colorspace with the colorspace of the main display, rather than
+        GenericRGB, so that composited images color-match those rendered via Core Graphics.
+        
+        Covered by LayoutTests/compositing/color-matching/image-color-matching.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setContentsToImage):
+
+2009-08-19  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by David Hyatt and Dan Bernstein.
+
+        - Fix <rdar://problem/7152589> Stylable scrollbar corners aren't working.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        Initialize m_scrollCorner.
+
+        (WebCore::FrameView::~FrameView):
+        Assert that m_scrollCorner is null.
+
+        (WebCore::FrameView::detachCustomScrollbars):
+        Destroy m_scrollCorner.
+
+        (WebCore::FrameView::invalidateScrollCorner):
+        Invalidate the scroll corner.
+        
+        (WebCore::FrameView::updateScrollCorner):
+        Create/destroy the scroll corner.
+        
+        (WebCore::FrameView::paintScrollCorner):
+        Paint the scroll corner.
+        
+        * page/FrameView.h:
+        (WebCore::FrameView::isFrameViewScrollCorner):
+        Return whether a RenderScrollbarPart is the frame view scroll corner.
+        
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+        Go ahead and update the scroll corner.
+        
+        (WebCore::ScrollView::setScrollbarsSuppressed):
+        Pass the scroll corner rect to invalidateRect.
+        
+        (WebCore::ScrollView::scrollCornerRect):
+        Return the scroll corner rect.
+        
+        * platform/ScrollView.h:
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::imageChanged):
+        If this scrollbar part is the frame view scroll corner, invalidate it.
+
+2009-08-19  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        SVG feComponentTransfer needs to be implemented
+        [https://bugs.webkit.org/show_bug.cgi?id=27768]
+
+        Implementation of SVG Filter feComponentTransfer.
+
+        There is already a test case
+        Test: svg/W3C-SVG-1.1/filters-comptran-01-b.svg
+
+        * platform/graphics/filters/FEComponentTransfer.cpp:
+        (WebCore::identity):
+        (WebCore::table):
+        (WebCore::discrete):
+        (WebCore::linear):
+        (WebCore::gamma):
+        (WebCore::FEComponentTransfer::apply):
+
+2009-08-19  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        <rdar://problem/7141522> Incorrect layout of product table at henry.com
+
+        Test: fast/block/basic/quirk-percent-height-table-cell.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcPercentageHeight): Tweak the quirk that allows
+        percentage-height children of auto-height blocks to look for an ancestor
+        with non-auto height and compute their height based on it. The change is
+        that if that ancestor is a table cell, it is ignored and the percent
+        height computes to zero (just like in strict mode). This matches Firefox
+        and IE.
+
+2009-08-19  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add 'icu::' qualifier when refering to ICU C++ names to the other
+        file with this issue missed in the previous check-in.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28410
+
+        No change in the test result.
+
+        * platform/graphics/chromium/FontUtilsChromiumWin.cpp:
+        (WebCore::):
+
+2009-08-19  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed (build fix for Skia).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawLine):
+
+2009-08-19  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [CAIRO] Remove setFont indirection
+        https://bugs.webkit.org/show_bug.cgi?id=28453
+
+        Remove the indirection and just set the font in Font::drawGlyphs.
+
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/gtk/FontPlatformData.h:
+        (WebCore::FontPlatformData::scaledFont):
+        * platform/graphics/gtk/FontPlatformDataGtk.cpp:
+        (WebCore::FontPlatformData::~FontPlatformData):
+        * platform/graphics/gtk/FontPlatformDataPango.cpp:
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        * platform/graphics/win/FontPlatformData.h:
+        * platform/graphics/win/FontPlatformDataCairoWin.cpp:
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+
+2009-08-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: When adding style selector, generate default name based
+        on id / class / type.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28468
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.appropriateSelectorForNode):
+
+2009-08-19  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Rename combinedOverflow to visibleOverflow, since that's what it actually represents.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::nodeAtPoint):
+        (WebCore::InlineFlowBox::paint):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::topvisibleOverflow):
+        (WebCore::InlineFlowBox::bottomvisibleOverflow):
+        (WebCore::InlineFlowBox::leftvisibleOverflow):
+        (WebCore::InlineFlowBox::rightvisibleOverflow):
+        (WebCore::InlineFlowBox::visibleOverflowRect):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::floatRect):
+        (WebCore::RenderBlock::nodeAtPoint):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::matchedEndLine):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::clippedOverflowRectForRepaint):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::visibleOverflowRect):
+        (WebCore::RenderBox::topvisibleOverflow):
+        (WebCore::RenderBox::bottomvisibleOverflow):
+        (WebCore::RenderBox::leftvisibleOverflow):
+        (WebCore::RenderBox::rightvisibleOverflow):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::localBoundingBox):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint):
+        (WebCore::RenderLineBoxList::hitTest):
+        * rendering/RenderOverflow.h:
+        (WebCore::RenderOverflow::visibleOverflowRect):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::shouldPaint):
+        (WebCore::RenderReplaced::clippedOverflowRectForRepaint):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        (WebCore::RenderTable::paint):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
+
+2009-08-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Sound button appears in controller with movies that have no audio
+        https://bugs.webkit.org/show_bug.cgi?id=28464
+
+        Test: media/video-no-audio.html
+
+        * html/HTMLMediaElement.cpp:
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::hasAudio):
+            Added hasAudio.
+
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::hasAudio):
+        (WebCore::MediaPlayer::hasVideo):
+            Make const.
+        (WebCore::MediaPlayer::hasAudio):
+            Added hasAudio.
+
+        * platform/graphics/MediaPlayerPrivate.h:
+            Add hasAudio.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+            Ditto.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+            Ditto.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+            Ditto.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+            Ditto.
+
+        * platform/graphics/win/QTMovieWin.h:
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::hasAudio):
+            Ditto.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlMuteButtonElement::disabled):
+            New, return true if media element doesn't have audio.
+        (WebCore::MediaControlMuteButtonElement::rendererIsNeeded):
+            Renderer is not needed if element has no audio.
+        * rendering/MediaControlElements.h:
+        (WebCore::MediaControlInputElement::disabled):
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::getMediaUIPartStateFlags):
+            Return MediaUIPartDisabledFlag if node is disabled.
+            
+
+2009-08-19  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27357
+        Removed the two unnecessary overridden willValidate() methods introduced
+        in r47444.
+
+        * html/HTMLKeygenElement.h:
+        * html/HTMLObjectElement.h:
+
+2009-08-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Allow dumping dangling nodes to the console.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28458
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        * inspector/InspectorBackend.cpp:
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::clearConsoleMessages):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::releaseDanglingNodes):
+        (WebCore::InspectorDOMAgent::startListening):
+        (WebCore::InspectorDOMAgent::stopListening):
+        (WebCore::InspectorDOMAgent::handleEvent):
+        (WebCore::InspectorDOMAgent::bind):
+        (WebCore::InspectorDOMAgent::unbind):
+        (WebCore::InspectorDOMAgent::pushDocumentToFrontend):
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::discardBindings):
+        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::setDetachedRoot):
+        (WebCore::InspectorFrontend::childNodeCountUpdated):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._formatnode):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype._setDetachedRoot):
+        (WebInspector.DOMAgent.prototype._childNodeCountUpdated):
+        (WebInspector.setDetachedRoot):
+        (WebInspector.childNodeCountUpdated):
+        (InspectorController.pushNodeToFrontend):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.pushNodeToFrontend):
+        (InjectedScript.createProxyObject):
+
+2009-08-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27464
+        Implement application cache online whitelist wildcard flag
+
+        Test: http/tests/appcache/whitelist-wildcard.html
+
+        A "*" in NETWORK section means that network loading needn't be blocked.
+
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::isURLInOnlineWhitelist):
+        * loader/appcache/ApplicationCache.h:
+        (WebCore::ApplicationCache::setAllowsAllNetworkRequests):
+        (WebCore::ApplicationCache::allowsAllNetworkRequests):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::openDatabase):
+        (WebCore::ApplicationCacheStorage::store):
+        (WebCore::ApplicationCacheStorage::loadCache):
+        * loader/appcache/ManifestParser.cpp:
+        (WebCore::parseManifest):
+        * loader/appcache/ManifestParser.h:
+
+2009-08-19  Brady Eidson <beidson@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        <rdar://problem/7042555> Loading certain pages on Tiger will start a spurious download
+        
+        Get rid of method swizzling entirely. This created problems when lower level
+        Foundation code would call into our own swizzled method.
+        
+        * platform/network/mac/ResourceHandleMac.mm: 
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): 
+        * platform/network/mac/WebCoreURLResponse.h:
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (-[NSURLResponse adjustMIMETypeIfNecessary]):
+
+2009-08-19  Adam Roben  <aroben@apple.com>
+
+        Fix linker warnings on Windows
+
+        Reviewed by Anders Carlsson.
+
+        Fixes <http://webkit.org/b/28462> WebCore causes linker warnings on
+        Windows about multiply-defined JSHTMLDataListElement symbols
+
+        * WebCore.vcproj/WebCore.vcproj: Exclude JSHTMLDataListElement.cpp
+        from the build (just like we do for the other generated bindings
+        files) so that we don't get warnings about multiply-defined symbols in
+        JSHTMLDataListElement.cpp and DerivedSources.cpp. Also removed
+        duplicate versions of JSSVGElementWrapperFactory.cpp, and let VS
+        reorder a few files.
+
+2009-08-19  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Eric Seidel
+
+        Add 'icu::' qualifier when refering to ICU C++ names.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28410
+
+        No change in the test result.
+
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
+        (WebCore::fontContainsCharacter):
+
+2009-08-19  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Cleanup from my patch thet rewrote overflow.  Remove unused member variables from RenderTableSection and
+        move the addition of overflow from children into a separate pass after the height of the section has been
+        set.  This prevents the RenderOverflow struct from being aggressively allocated for all table sections.
+        (Not a a correctness issue, just a memory issue.)
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::RenderTableSection):
+        (WebCore::RenderTableSection::layoutRows):
+        * rendering/RenderTableSection.h:
+
+2009-08-19  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Remove bogus dependency rules for built sources that derive
+        from HTMLTagNames.in, HTMLAttributeNames.in and xmlattrs.in. The
+        header files should be generated regardless of whether the source
+        file changed or not. We should only rely on the *.in files being
+        changed.
+
+        * GNUmakefile.am:
+
+2009-08-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        convert FormatBlock candidate tag list from if chain to hash lookup
+        https://bugs.webkit.org/show_bug.cgi?id=28448
+
+        No behavior change, just cleanup.
+
+        * editing/htmlediting.cpp:
+        (WebCore::validBlockTag):
+        * editing/htmlediting.h:
+
+2009-08-19  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Update GraphicsContextSkia's version of drawLine to make use of the shared
+        adjustLineToPixelBoundaries function and elimination overlapping code.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawLine):
+
+2009-08-18  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Style fixes based on cpp_style.py and WebKit Style guide for
+        GraphicsContextSkia.cpp
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::drawFocusRing):
+        (WebCore::GraphicsContext::roundToDevicePixels):
+        (WebCore::GraphicsContext::setLineDash):
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2009-08-18  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28446
+        Custom request headers shouldn't be sent with cross-origin preflight request
+
+        Tests: http/tests/xmlhttprequest/access-control-preflight-headers-async.html
+               http/tests/xmlhttprequest/access-control-preflight-headers-sync.html
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight):
+        Don't copy headers to OPTIONS request. The spec is vague about this, but the intention was
+        that they shouldn't be sent, and Firefox doesn't send them.
+
+2009-08-18  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        V8 Bindings for Desktop Notifications feature.
+        https://bugs.webkit.org/show_bug.cgi?id=28271
+
+        * WebCore.gypi: 
+        added notification files to build (all still behind a flag that's not on)
+        * bindings/scripts/CodeGeneratorV8.pm:
+        added special case in DOMWindow/AppCache style for named event handlers
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp: Added.
+        * notifications/Notification.h:
+        made event handler routines public (as they are in DOMWindow, eg) for
+        binding access.
+        * notifications/NotificationCenter.idl:
+        needed to make methods V8Custom to support different behaviors in 
+        worker/page context in chromium. 
+        * workers/WorkerThread.h:
+        (WebCore::WorkerThread::getNotificationPresenter):
+        (WebCore::WorkerThread::setNotificationPresenter):
+        needed to make these methods public as well so chromium can inject
+        the notification presenter into the worker thread.
+
+2009-08-13  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - Implement HTML5 nav element
+        https://bugs.webkit.org/show_bug.cgi?id=27937
+
+        <nav> should behave essentially the same as <div> for parsing
+        etc. This is implemented by the changes below.
+        
+        Tests: fast/html/nav-element.html
+
+        * css/html.css:
+        * editing/htmlediting.cpp:
+        (WebCore::validBlockTag):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::tagPriority):
+        (WebCore::blockTagList):
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::getNode):
+        * html/HTMLTagNames.in:
+
+2009-08-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adele Peterson, David Hyatt and Dan Bernstein.
+
+        - Fix <rdar://problem/7152727>
+
+        If a page has custom scroll bars, they will not update correctly when the window is activated/deactivated.
+        
+        * page/FrameView.cpp:
+        (WebCore::FrameView::hasCustomScrollbars):
+        Check if the frame view or any of its subviews have custom scroll bars.
+        
+        (WebCore::FrameView::updateControlTints):
+        Go ahead and update control tints if the frame view has custom scroll bars.
+        
+        * page/FrameView.h:
+
+2009-08-18  Mark Rowe  <mrowe@apple.com>
+
+        Roll out r47477 as it introduced assertion failures and crashes on the build bots.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/Database.cpp:
+        * storage/Database.h:
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        * storage/DatabaseThread.h:
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::runCurrentStatement):
+        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
+        (WebCore::SQLTransaction::postflightAndCommit):
+        * storage/SQLTransactionClient.cpp: Removed.
+        * storage/SQLTransactionClient.h: Removed.
+
+2009-08-18  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding the SharedTimer file for WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=28126
+
+        * platform/haiku/SharedTimerHaiku.cpp: Added.
+        (WebCore::):
+        (WebCore::SharedTimerHaiku::SharedTimerHaiku):
+        (WebCore::SharedTimerHaiku::~SharedTimerHaiku):
+        (WebCore::SharedTimerHaiku::instance):
+        (WebCore::SharedTimerHaiku::start):
+        (WebCore::SharedTimerHaiku::stop):
+        (WebCore::SharedTimerHaiku::Filter):
+        (WebCore::setSharedTimerFiredFunction):
+        (WebCore::setSharedTimerFireTime):
+        (WebCore::stopSharedTimer):
+
+2009-08-18  Mark Rowe  <mrowe@apple.com>
+
+        Release build fix.
+
+        * xml/XMLHttpRequest.cpp: Sprinkle some #ifndef NDEBUG around.
+        (WebCore::XMLHttpRequest::XMLHttpRequest):
+        (WebCore::XMLHttpRequest::~XMLHttpRequest):
+
+2009-08-18  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28412: Leak of WebCore::XMLHttpRequest object during layout tests.
+
+        No new tests: Already covered by existing tests.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::XMLHttpRequest): Add instrumentation for this kind of leak.
+        (WebCore::XMLHttpRequest::~XMLHttpRequest): Ditto.
+        (WebCore::XMLHttpRequest::createRequest): Only setPendingActivity() if we actually started a request. Also,
+        restore a call to nonCacheRequestInFlight() that got lost in a recent refactor.
+
+2009-08-18  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Added a client to SQLTransaction. In addition to being a place to
+        get notifications about certain events in a transaction, it is
+        also an abstraction layer that allows us to plug in different
+        implementations for each port for how transactions interract with
+        the main DB. For example, WebCore's default implementation will
+        make direct calls to DatabaseTracker's methods. At the same time,
+        Chromium's implementation will send IPCs to the browser process
+        whenever a transaction needs something from the main DB.
+
+        All storage tests pass.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27967
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/Database.cpp:
+        (WebCore::Database::transactionClient):
+        * storage/Database.h:
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        * storage/DatabaseThread.h:
+        (WebCore::DatabaseThread::transactionClient):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::runCurrentStatement):
+        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
+        (WebCore::SQLTransaction::postflightAndCommit):
+        * storage/SQLTransactionClient.cpp: Added.
+        * storage/SQLTransactionClient.h: Added.
+
+2009-08-18  Julie Parent  <jparent@chromium.org>
+
+        Not reviewed, build fix for Chromium.
+
+        Final change for v8 corresponding to http://trac.webkit.org/changeset/47469.
+
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp: Added missing using statment
+
+2009-08-18  Julie Parent  <jparent@chromium.org>
+
+        Not reviewed, build fix for Chromium.
+
+       More corresponding changes to V8 from http://trac.webkit.org/changeset/47469.
+
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER): Use srcAttr instead of the src function.
+
+2009-08-18  Julie Parent  <jparent@chromium.org>
+
+        Not reviewed, build fix for Chromium.
+
+        Make corresponding changes to V8 from http://trac.webkit.org/changeset/47469.
+
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER): Use srcAttr instead of the src function.
+
+2009-08-18  Dan Bernstein  <mitz@apple.com>
+
+        Build fix.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::getIdentifierValue):
+
+2009-08-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        More work on making DOM classes start with reference count of 1
+        https://bugs.webkit.org/show_bug.cgi?id=28068
+
+        Some related clean-up and preparation steps so the subsequent
+        patches will be as small as possible.
+
+        * WebCore.base.exp: Sorted this file.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+        Use nameAttr instead of the name function.
+
+        * bindings/js/JSHTMLFrameElementCustom.cpp:
+        (WebCore::JSHTMLFrameElement::setSrc):
+        Use srcAttr instead of the src function.
+
+        * bindings/js/JSHTMLIFrameElementCustom.cpp:
+        (WebCore::JSHTMLIFrameElement::setSrc):
+        Use srcAttr instead of the src function.
+
+        * bindings/objc/DOM.mm: Sorted includes.
+        * dom/Document.cpp: Ditto.
+
+        * dom/StyledElement.cpp: Made invalidateStyleAttribute inline.
+        * dom/StyledElement.h: Ditto.
+
+        * dom/make_names.pl: Changed default of createWithNew to 0.
+        Eventually all elements will be created with create instead of new.
+
+        * html/HTMLTagNames.in:
+        * svg/svgtags.in:
+        * wml/WMLTagNames.in:
+        Added createWithNew for every tag. We'll remove it as we convert
+        element classes to use create.
+
+        * html/HTMLAppletElement.h: Removed unneeded forward declarations.
+        * html/HTMLFrameElement.h: Ditto.
+
+        * html/HTMLEmbedElement.cpp: Removed many attribute get and
+        set functions.
+        * html/HTMLEmbedElement.h: Ditto.
+        * html/HTMLIFrameElement.cpp: Ditto.
+        * html/HTMLIFrameElement.h: Ditto.
+        * html/HTMLObjectElement.cpp: Ditto.
+        * html/HTMLObjectElement.h: Ditto.
+        * html/HTMLPlugInElement.cpp: Ditto.
+        * html/HTMLPlugInElement.h: Ditto.
+
+        * html/HTMLFrameElementBase.cpp: Removed many attribute get and
+        set functions.
+        (WebCore::HTMLFrameElementBase::location): Changed to use
+        srcAttr instead of src.
+        * html/HTMLFrameElementBase.h: Removed many attribute get and set
+        functions.
+
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocument::replaceMediaElementTimerFired):
+        Use srcAttr and typeAttr instead of setSrc and setType.
+        * loader/PluginDocument.cpp:
+        (WebCore::PluginTokenizer::createDocumentStructure): Ditto.
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::updateWidget): Use nameAttr instead
+        of name -- this avoids an extra AtomicString round trip and a little
+        ref count churn too.
+
+2009-08-18  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        SharedWorkers need to support loading.
+        https://bugs.webkit.org/show_bug.cgi?id=28342
+
+        Added loader support to shared workers, and refactored worker tests to also test SharedWorkers
+
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::postTaskToLoader):
+        Forwards load requests to an arbitrary document from the list of worker's documents.
+        (WebCore::SharedWorkerProxy::postTaskForModeToWorkerContext):
+        Posts responses back to the shared worker thread.
+
+2009-08-18  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        StyleChange::init needs clean up before fixing the bug 23892
+        https://bugs.webkit.org/show_bug.cgi?id=27749
+
+        This patch simplifies StyleChange::init by removing the iteration on CSS properties,
+        and adding functions reconcileTextDecorationProperties and extractTextStyle to handle the style.
+
+        Because there is a bug in how text decorations are processes in getPropertiesNotInComputedStyle,
+        this patch simplifies the treatment in order to preserve the original behavior of WebKit.
+        However, the current implementation is not best (adds redundant text-decorations) and we should fix it later.
+
+        No test is added since there is no change in behavior.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::init): Uses getPropertiesNotInComputedStyle instead of iterating through the properties
+        (WebCore::StyleChange::reconcileTextDecorationProperties): Removes -webkit-text-decorations-in-effects and redundant "none"
+        (WebCore::getIdentifierValue): Obtains the identifier of a CSSPrimitiveValue
+        (WebCore::StyleChange::extractTextStyles): Converts properties in style to m_apply* and removes the property
+        (WebCore::getPropertiesNotInComputedStyle): Fixed a bug with how text decorations are treated
+
+2009-08-18  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fixing a DB file naming bug in Chromium. The origin should come
+        before the DB name in the file name.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28331
+
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::fullPathForDatabase):
+
+2009-08-18  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding four image-specific files to WebCore:
+        IconHaiku.cpp, ImageBufferData.h, ImageBufferHaiku.cpp, ImageHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28130
+
+        * platform/graphics/Icon.h:
+        * platform/graphics/haiku/IconHaiku.cpp: Added.
+        (WebCore::Icon::~Icon):
+        (WebCore::Icon::createIconForFile):
+        (WebCore::Icon::createIconForFiles):
+        (WebCore::Icon::paint):
+        * platform/graphics/haiku/ImageBufferData.h: Added.
+        * platform/graphics/haiku/ImageBufferHaiku.cpp: Added.
+        (WebCore::ImageBufferData::ImageBufferData):
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::ImageBuffer::~ImageBuffer):
+        (WebCore::ImageBuffer::context):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        (WebCore::ImageBuffer::toDataURL):
+        (WebCore::ImageBuffer::image):
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+        * platform/graphics/haiku/ImageHaiku.cpp: Added.
+        (WebCore::FrameData::clear):
+        (WebCore::Image::loadPlatformResource):
+        (WebCore::BitmapImage::initPlatformData):
+        (WebCore::BitmapImage::invalidatePlatformData):
+        (WebCore::BitmapImage::draw):
+        (WebCore::Image::drawPattern):
+        (WebCore::BitmapImage::checkForSolidColor):
+        (WebCore::BitmapImage::getBBitmap):
+
+2009-08-18  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27575 [CSS3 
+        Backgrounds and Borders] Drop the prefix from background-size
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseFillProperty):
+        (WebCore::cssPropertyID):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
+        (WebCore::ensurePropertyMap):
+
+2009-08-18  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        SharedWorkers need to forward exceptions to parent documents
+        https://bugs.webkit.org/show_bug.cgi?id=28320
+
+        Changed SharedWorkerProxy to have individual mutexes (so workers can interact with their parent documents without contention).
+
+        Updated SharedWorkerProxy to forward exceptions/console messages to all parent documents.
+
+        * bindings/js/JSSharedWorkerConstructor.cpp:
+        Cleaned up bitrot - added missing include.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::postExceptionTask):
+        Callback used to deliver exceptions to a document.
+        (WebCore::SharedWorkerProxy::postExceptionToWorkerObject):
+        Forwards exceptions to all parent documents for presentation to the user.
+        (WebCore::postConsoleMessageTask):
+        (WebCore::SharedWorkerProxy::postConsoleMessageToWorkerObject):
+        Forwards console messages to all parent documents for presentation to the user.
+        (WebCore::SharedWorkerProxy::addToWorkerDocuments):
+        Grabs the mutex before accessing workerDocuments.
+        (WebCore::SharedWorkerProxy::documentDetached):
+        Grabs the mutex before accessing workerDocuments.
+
+2009-08-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/7135588> HTMLMediaElement should ask WebPolicyLoadDelegate before loading resource
+        
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::isSafeToLoadURL):
+        Call FrameLoaderClient::shouldLoadMediaElementURL.
+        
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::shouldLoadMediaElementURL):
+        Return true by default.
+
+2009-08-18  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        openDatabase() should not execute any SQL statement on the
+        database it's trying to open, unless there are no other open
+        handles to the same database. Otherwise, we might run into a
+        deadlock.
+
+        Test: storage/open-database-while-transaction-in-progress.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=28207
+
+        * storage/Database.cpp:
+        (WebCore::Database::performOpenAndVerify):
+
+2009-08-18  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        SVG Filter feBlend implementation missing
+        [https://bugs.webkit.org/show_bug.cgi?id=28133]
+
+        Implementation of SVG Filter feBlend.
+
+        FilterEffect.cp needed changes to optimize the rendering. With the old code
+        we drew a subEffect on the current FilterEffect by drawImage, got the PixelArray,
+        cleared the drawing area, drew the next FilterEffect with drawImage and picked this
+        PixelArray again. This was unefficient and slow. Now we calculate the requested area
+        of the subEffect and ask the FilterEffect's ImageBuffer for the PixelArray directly,
+        without any drawing operations on GraphicsContext.
+
+        There is already a test case
+        Test: svg/W3C-SVG-1.1/filters-blend-01-b.svg
+
+        * html/canvas/CanvasPixelArray.h:
+        (WebCore::CanvasPixelArray::set):
+        (WebCore::CanvasPixelArray::get):
+        * platform/graphics/filters/FEBlend.cpp:
+        (WebCore::unknown):
+        (WebCore::normal):
+        (WebCore::multiply):
+        (WebCore::screen):
+        (WebCore::darken):
+        (WebCore::lighten):
+        (WebCore::FEBlend::apply):
+        * platform/graphics/filters/FEBlend.h:
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::calculateDrawingIntRect):
+        * platform/graphics/filters/FilterEffect.h:
+
+2009-08-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Fix array formatter followup: node formatter.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28427
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._format):
+
+2009-08-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Metrics sidebar broken
+
+        https://bugs.webkit.org/show_bug.cgi?id=28434
+
+        * inspector/front-end/MetricsSidebarPane.js:
+
+2009-08-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28432
+        String::createCFString() returns a non-retained empty string
+
+        No known change in functionality, so no test.
+
+        * platform/text/cf/StringCF.cpp: (WebCore::String::createCFString): Retain the CFSTR result.
+    
+2009-08-18  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix of <https://bugs.webkit.org/show_bug.cgi?id=28326> DRT on Windows doesn't support 
+        LayoutTestController::setQuota or print a callback on UIDelegate::exceededDatabaseQuota.
+        
+        Removed an early return that can cause deleteOrigin or deleteAllDatabases to fail when
+        it doesn't have to.
+
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::deleteOrigin):
+
+2009-08-18  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27357
+        Support for :valid and :invalid CSS selectors, from HTML5 specs.
+        http://www.whatwg.org/specs/web-apps/current-work/#selector-valid
+
+        Tests: fast/css/pseudo-invalid-001.html
+               fast/css/pseudo-invalid-002.html
+               fast/css/pseudo-valid-001.html
+               fast/css/pseudo-valid-002.html
+               fast/css/pseudo-valid-003.html
+               fast/css/pseudo-valid-004.html
+               fast/css/pseudo-valid-005.html
+               fast/css/pseudo-valid-006.html
+               fast/css/pseudo-valid-007.html
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType): extracts new pseudo-classes
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithElement): Make sure we don't share style between
+form controls that have different validity states.
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): applies
+        style associated to new pseudo-classes
+        * dom/Element.h:
+        (WebCore::Element::willValidate): pushed up in hierarchy
+        (WebCore::Element::isValidFormControlElement): checks for valid form
+        control elements (wraps ValidityState::valid())
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::willValidate): minor clean up
+        (WebCore::HTMLFormControlElement::isValidFormControlElement): ditto
+        * html/HTMLFormControlElement.h:
+        * html/HTMLKeygenElement.h:
+        (WebCore::HTMLKeygenElement::willValidate): added
+        * html/HTMLObjectElement.h:
+        (WebCore::HTMLObjectElement::willValidate): added
+        * html/HTMLObjectElement.idl:
+
+2009-08-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Fix array formatter.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28427
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._formatarray):
+
+2009-08-17  Joe Mason  <joe.mason@torchmobile.com>
+
+        Reviewed by George Staikos
+
+        Replace repeated string of PLATFORM(FOO) with a single define
+        https://bugs.webkit.org/show_bug.cgi?id=27734
+
+        * loader/CachedFont.cpp:
+        (WebCore::CachedFont::~CachedFont):
+        (WebCore::CachedFont::ensureCustomFontData):
+        (WebCore::CachedFont::platformDataFromCustomData):
+        (WebCore::CachedFont::allClientsRemoved):
+
+2009-08-16  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20329, shadows and reflections incorrectly
+        considered part of scrollable overflow.
+
+        This patch takes the engine's concept of overflow and splits it into two types:
+        layout overflow and visual overflow.
+        
+        Layout overflow is about other boxes that spill out of an enclosing box,  For example,
+        in the inline flow case a tall image could spill out of a line box. Examples of 
+        visual overflow are shadows, text stroke (and eventually outline and
+        border-image).
+
+        Three objects tracked overflow before this patch: RenderBlock had 
+        m_overflowLeft/Top/Width/Height variables.  RootInlineBox had an Overflow*
+        that also had four overflow values.  Finally RenderReplaced elements tracked shadow/reflection
+        overflow using a map that cached four values.
+        
+        This patch takes all of these different overflow models and unifies them into a single
+        new class called RenderOverflow.   This class is now a member variable in RenderBox and
+        InlineFlowBoxes.  It is only allocated if overflow actually exists.  Instead of tracking
+        four values, it tracks eight: left/top/right/bottom for layout overflow and 
+        left/top/right/bottom for visual overflow.
+        
+        Overflow computation is now done after layout is finished rather than during layout
+        (when child objects can be churning and moving around).  A number of layout tests progressed
+        by deferring overflow computation to a separate pass.
+        
+        All inline flow boxes now track overflow (and not just the root line box).  This allows
+        repainting of line boxes to actually be tight and bail early if the overflow rect of a box
+        doesn't intersect.  The old code always visited all object on a line if the root line box
+        intersected at all.
+        
+        Line box overflow no longer propagates across self-painting layers.  This fixes a number of
+        issues with incorrect scrollbars appearing when relative positioned inlines were used in a page.
+        
+        Layer bounds have been modified to exclude visual overflow.  The width/height members only really
+        have one reason for continued existence, and that is that they happen to be used in repaint()
+        when an overflow clip object's height isn't accurate.  In this case, the bounds should exclude
+        visual overflow anyway, so this change tightens that repaint up.
+        
+        Root lines have renamed m_selectionTop/Bottom to m_lineTop/Bottom and positionForPoint methods have
+        been changed to use these instead of relying on overflow (which was totally wrong).
+
+        Significant changes have been made to the "almost strict mode" line box quirk where objects with no
+        text children have no effect on the height of a line.  Instead of making the height() of the objects
+        variable and dependent on overflow, the objects now have their full height and get placed on
+        the baseline properly.  They simply don't contribute to overflow above lineTop/Bottom.
+        
+        Reflections are no longer considered overflow of any kind.  Because reflections have their own layers,
+        it is not necessary to treat them as visual or layout overflow in the RenderObject tree.  The end result
+        of not incorporating them into RenderOverflow is that they have no effect on scrolling.  transparencyClipBox
+        has been extended to support fully reflecting the entire clip box when a reflection exists.  This fixes
+        numerous repaint bugs in transparent objects with reflections when the transparent objects had self-painting
+        sublayers.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::getUpperLeftCorner):
+        * editing/visible_units.cpp:
+        (WebCore::previousLinePosition):
+        (WebCore::nextLinePosition):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::adjustViewSize):
+        (WebCore::FrameView::adjustPageHeight):
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::height):
+        * rendering/InlineBox.h:
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::adjustPosition):
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+        (WebCore::InlineFlowBox::computeVerticalOverflow):
+        (WebCore::InlineFlowBox::nodeAtPoint):
+        (WebCore::InlineFlowBox::paint):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::InlineFlowBox):
+        (WebCore::InlineFlowBox::topCombinedOverflow):
+        (WebCore::InlineFlowBox::bottomCombinedOverflow):
+        (WebCore::InlineFlowBox::leftCombinedOverflow):
+        (WebCore::InlineFlowBox::rightCombinedOverflow):
+        (WebCore::InlineFlowBox::combinedOverflowRect):
+        (WebCore::InlineFlowBox::topLayoutOverflow):
+        (WebCore::InlineFlowBox::bottomLayoutOverflow):
+        (WebCore::InlineFlowBox::leftLayoutOverflow):
+        (WebCore::InlineFlowBox::rightLayoutOverflow):
+        (WebCore::InlineFlowBox::layoutOverflowRect):
+        (WebCore::InlineFlowBox::topVisualOverflow):
+        (WebCore::InlineFlowBox::bottomVisualOverflow):
+        (WebCore::InlineFlowBox::leftVisualOverflow):
+        (WebCore::InlineFlowBox::rightVisualOverflow):
+        (WebCore::InlineFlowBox::visualOverflowRect):
+        (WebCore::InlineFlowBox::setHorizontalOverflowPositions):
+        (WebCore::InlineFlowBox::setVerticalOverflowPositions):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paint):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::RenderBlock):
+        (WebCore::RenderBlock::layout):
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::addOverflowFromBlockChildren):
+        (WebCore::RenderBlock::handleBottomOfBlock):
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::fillInlineSelectionGaps):
+        (WebCore::RenderBlock::floatRect):
+        (WebCore::RenderBlock::lowestPosition):
+        (WebCore::RenderBlock::rightmostPosition):
+        (WebCore::RenderBlock::leftmostPosition):
+        (WebCore::RenderBlock::addOverhangingFloats):
+        (WebCore::RenderBlock::nodeAtPoint):
+        (WebCore::RenderBlock::positionForPointWithInlineChildren):
+        (WebCore::RenderBlock::layoutColumns):
+        (WebCore::getHeightForLineCount):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
+        (WebCore::RenderBlock::computeVerticalPositionsForLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::matchedEndLine):
+        (WebCore::RenderBlock::addOverflowFromInlineChildren):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::destroy):
+        (WebCore::RenderBox::clippedOverflowRectForRepaint):
+        (WebCore::RenderBox::localCaretRect):
+        (WebCore::RenderBox::addShadowAndReflectionOverflow):
+        (WebCore::RenderBox::addOverflowFromChild):
+        (WebCore::RenderBox::addLayoutOverflow):
+        (WebCore::RenderBox::addVisualOverflow):
+        (WebCore::RenderBox::clearLayoutOverflow):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::combinedOverflowRect):
+        (WebCore::RenderBox::topCombinedOverflow):
+        (WebCore::RenderBox::bottomCombinedOverflow):
+        (WebCore::RenderBox::leftCombinedOverflow):
+        (WebCore::RenderBox::rightCombinedOverflow):
+        (WebCore::RenderBox::layoutOverflowRect):
+        (WebCore::RenderBox::topLayoutOverflow):
+        (WebCore::RenderBox::bottomLayoutOverflow):
+        (WebCore::RenderBox::leftLayoutOverflow):
+        (WebCore::RenderBox::rightLayoutOverflow):
+        (WebCore::RenderBox::visualOverflowRect):
+        (WebCore::RenderBox::topVisualOverflow):
+        (WebCore::RenderBox::bottomVisualOverflow):
+        (WebCore::RenderBox::leftVisualOverflow):
+        (WebCore::RenderBox::rightVisualOverflow):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        (WebCore::RenderLayer::localBoundingBox):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateRootLayerPosition):
+        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint):
+        (WebCore::RenderLineBoxList::hitTest):
+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::positionListMarker):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        * rendering/RenderObject.h:
+        * rendering/RenderOverflow.h: Added.
+        (WebCore::RenderOverflow::RenderOverflow):
+        (WebCore::RenderOverflow::topLayoutOverflow):
+        (WebCore::RenderOverflow::bottomLayoutOverflow):
+        (WebCore::RenderOverflow::leftLayoutOverflow):
+        (WebCore::RenderOverflow::rightLayoutOverflow):
+        (WebCore::RenderOverflow::topVisualOverflow):
+        (WebCore::RenderOverflow::bottomVisualOverflow):
+        (WebCore::RenderOverflow::leftVisualOverflow):
+        (WebCore::RenderOverflow::rightVisualOverflow):
+        (WebCore::RenderOverflow::setTopLayoutOverflow):
+        (WebCore::RenderOverflow::setBottomLayoutOverflow):
+        (WebCore::RenderOverflow::setLeftLayoutOverflow):
+        (WebCore::RenderOverflow::setRightLayoutOverflow):
+        (WebCore::RenderOverflow::setTopVisualOverflow):
+        (WebCore::RenderOverflow::setBottomVisualOverflow):
+        (WebCore::RenderOverflow::setLeftVisualOverflow):
+        (WebCore::RenderOverflow::setRightVisualOverflow):
+        (WebCore::RenderOverflow::layoutOverflowRect):
+        (WebCore::RenderOverflow::visualOverflowRect):
+        (WebCore::RenderOverflow::combinedOverflowRect):
+        (WebCore::RenderOverflow::move):
+        (WebCore::RenderOverflow::addLayoutOverflow):
+        (WebCore::RenderOverflow::addVisualOverflow):
+        (WebCore::RenderOverflow::resetLayoutOverflow):
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::layout):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::~RenderReplaced):
+        (WebCore::RenderReplaced::layout):
+        (WebCore::RenderReplaced::shouldPaint):
+        (WebCore::RenderReplaced::positionForPoint):
+        (WebCore::RenderReplaced::clippedOverflowRectForRepaint):
+        * rendering/RenderReplaced.h:
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::layout):
+        (WebCore::RenderScrollbarPart::paintIntoRect):
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::layout):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        (WebCore::RenderTable::paint):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layoutRows):
+        * rendering/RenderTableSection.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::positionForPoint):
+        (WebCore::RenderText::localCaretRect):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::layout):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::addHighlightOverflow):
+        (WebCore::RootInlineBox::adjustPosition):
+        (WebCore::RootInlineBox::verticallyAlignBoxes):
+        (WebCore::RootInlineBox::selectionTop):
+        * rendering/RootInlineBox.h:
+        (WebCore::RootInlineBox::RootInlineBox):
+        (WebCore::RootInlineBox::nextRootBox):
+        (WebCore::RootInlineBox::prevRootBox):
+        (WebCore::RootInlineBox::lineTop):
+        (WebCore::RootInlineBox::lineBottom):
+        (WebCore::RootInlineBox::selectionBottom):
+        (WebCore::RootInlineBox::selectionHeight):
+        (WebCore::RootInlineBox::floats):
+        (WebCore::RootInlineBox::floatsPtr):
+        (WebCore::RootInlineBox::setLineTopBottomPositions):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::layoutInlineBoxes):
+
+2009-08-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28431
+        <rdar://problem/7137610> Application Cache doesn't work with HTTP authentication
+
+        Test: http/tests/appcache/auth.html
+
+        * loader/appcache/ApplicationCacheGroup.h:
+        (WebCore::ApplicationCacheGroup::shouldUseCredentialStorage): If appcache is enabled,
+        always allow it to use stored credentials (we can't ask WebKit client, and maybe we
+        shouldn't ask it, because it's not a document that's loading these resources).
+
+2009-08-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by John Sullivan and David Hyatt.
+
+        Fix <rdar://problem/7147996>
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setHasHorizontalScrollbar):
+        (WebCore::ScrollView::setHasVerticalScrollbar):
+        Update the style of the scroll bars.
+        
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::RenderScrollbar):
+        Calculate the size of the scrollbar and set it as the frame size.
+
+2009-08-18  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        HTMLMediaElement should fire 'progress' event before 'load'
+        https://bugs.webkit.org/show_bug.cgi?id=28314
+
+        Test: media/progress-event-at-least-one.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setNetworkState):
+            Schedule 'progress' event before 'load'.
+
+2009-08-18  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28415
+        Set svn:eol-style CRLF on all .sln and .vcproj files that don't already
+        have it.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/WebCoreGenerated.vcproj:
+
+2009-08-18  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Need to extend DumpRenderTree to expose number of worker threads
+        https://bugs.webkit.org/show_bug.cgi?id=28292
+
+        Expose WorkerThread::workerThreadCount() for DumpRenderTree so we can write worker lifecycle tests.
+
+        Tests: fast/workers/shared-worker-lifecycle.html-disabled
+               fast/workers/worker-lifecycle.html
+
+        * WebCore.base.exp:
+        Exported WorkerThread::workerThreadCount().
+        * WebCore.xcodeproj/project.pbxproj:
+        * workers/WorkerThread.cpp:
+        Added tracking of the number of worker threads.
+        (WebCore::threadCountMutex):
+        (WebCore::WorkerThread::workerThreadCount):
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::~WorkerThread):
+        * workers/WorkerThread.h:
+
+2009-08-18  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Unreviewed, build fix.
+
+        [Qt] Add new files I forgot to add in r47424.
+
+2009-08-18  Markus Goetz <Markus.Goetz@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Implement prefetchDNS() function.
+
+        * WebCore.pro:
+        * platform/qt/TemporaryLinkStubs.cpp:
+
+2009-08-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Support for parsing <datalist> element and generating HTMLDataListElement nodes.
+        https://bugs.webkit.org/show_bug.cgi?id=26915
+
+        Tests: fast/forms/datalist-nonoption-child.html
+               fast/forms/datalist.html
+
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * css/html.css:
+        * html/CollectionType.h:
+        (WebCore::):
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::itemAfter):
+        * html/HTMLDataListElement.cpp: Added.
+        (WebCore::HTMLDataListElement::HTMLDataListElement):
+        (WebCore::HTMLDataListElement::~HTMLDataListElement):
+        (WebCore::HTMLDataListElement::checkDTD):
+        (WebCore::HTMLDataListElement::options):
+        * html/HTMLDataListElement.h: Added.
+        * html/HTMLDataListElement.idl: Added.
+        * html/HTMLElement.cpp:
+        (WebCore::inlineTagList):
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::isAffectedByResidualStyle):
+        * html/HTMLTagNames.in:
+
+2009-08-17  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        -webkit-box-orient:horizontal doesn't work on <button> tag
+        https://bugs.webkit.org/show_bug.cgi?id=34445
+
+        Make a flexible button's anonymous child flexible and pass the
+        parent's box-orient to the anonymous child.
+
+        Also, added a renderName for anonymous flexible boxes.
+
+        Test: fast/flexbox/box-orient-button.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::createAnonymousBlock):
+        * rendering/RenderBlock.h:
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::addChild):
+        (WebCore::RenderButton::setupInnerStyle):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::renderName):
+
+2009-08-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+        
+        Render -webkit-mask via compositing layers when possible
+        https://bugs.webkit.org/show_bug.cgi?id=28414
+        
+        Implement accelerated compositing of -webkit-mask, when combined
+        with already-composited content.
+        
+        RenderLayerBacking now creates an additional GraphicsLayer for the mask contents,
+        and sets this as the mask on another GraphicsLayer via the setMaskLayer() method.
+        GraphicsLayerCA then applies the mask using -[CALayer setMask:].
+        
+        The enum values for GraphicsLayerPaintingPhase were renamed to avoid the
+        confusion with "mask", and a new value, GraphicsLayerPaintMask, was added which
+        indicates that just the mask is painting.
+        
+        When painting the composited mask, we need to paint with the normal compositing
+        mode rather than CompositeDestinationIn, so InlineFlowBox and RenderBox now consult
+        layer()->hasCompositedMask() to pick the mode. If the mask is composited, they no longer
+        need to make transparency layers.
+        
+        We no longer have to throw video rendering into software because of masks.
+        
+        When a masked element has composited descendants, that element needs to
+        become composited so that the mask can be applied via compositing.
+
+        Tests: compositing/masks/masked-ancestor.html
+               compositing/masks/simple-composited-mask.html
+
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::GraphicsLayer):
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::maskLayer):
+        (WebCore::GraphicsLayer::setMaskLayer):
+        (WebCore::GraphicsLayer::paintingPhase):
+        (WebCore::GraphicsLayer::setPaintingPhase):
+        * platform/graphics/GraphicsLayerClient.h:
+        (WebCore::):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        (WebCore::GraphicsLayerCA::):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setMaskLayer):
+        (WebCore::GraphicsLayerCA::recursiveCommitChanges):
+        (WebCore::GraphicsLayerCA::commitLayerChanges):
+        (WebCore::GraphicsLayerCA::updateMaskLayer):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintMask):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintMaskImages):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hasCompositedMask):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::hasCompositedMask):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::~RenderLayerBacking):
+        (WebCore::RenderLayerBacking::destroyGraphicsLayer):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::updateForegroundLayer):
+        (WebCore::RenderLayerBacking::updateMaskLayer):
+        (WebCore::RenderLayerBacking::paintingPhaseForPrimaryLayer):
+        (WebCore::RenderLayerBacking::setContentsNeedDisplay):
+        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        (WebCore::RenderLayerBacking::paintContents):
+        * rendering/RenderLayerBacking.h:
+        (WebCore::RenderLayerBacking::hasMaskLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering):
+        (WebCore::RenderLayerCompositor::requiresCompositingWhenDescendantsAreCompositing):
+        * rendering/RenderLayerCompositor.h:
+
+2009-08-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Layer content misplaced with compositing, z-index and overflow
+        https://bugs.webkit.org/show_bug.cgi?id=28361
+        
+        The foreground GraphicsLayer (used to render element foreground when the element has 
+        negative z-order children) was misplaced when there is a clipping layer (which clips
+        children). The foreground layer is parented under the clipping layer so that the foreground
+        depth-sorts with the layer's children, so its geometry needs to be computed relative to
+        that clipping layer.
+        
+        Also clarified some FIXME comments, and corrected a debug-only layer name.
+
+        Test: compositing/geometry/clipping-foreground.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::updateSublayerList):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::updateForegroundLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+
+2009-08-17  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix leaks of SVGElementInstance seen during regression tests.
+
+        r47313 made TreeShared types start with a ref-count of 1, but SVGElementInstance was mistakenly
+        not updated to have a create method that adopted the initial reference.  This lead to the instances
+        of SVGElementInstance allocated by SVGUseElement being leaked.
+
+        * svg/SVGElementInstance.h:
+        (WebCore::SVGElementInstance::create):
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::buildPendingResource):
+        (WebCore::SVGUseElement::buildInstanceTree):
+        (WebCore::SVGUseElement::handleDeepUseReferencing):
+
+2009-08-17  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Some cleanup towards https://bugs.webkit.org/show_bug.cgi?id=13631
+        Page Cache should support pages with frames.
+
+        - Re-factor all remaining page cache code out of DocumentLoader, as CachedPage/CacheFrame loads
+          are solely the responsibility of FrameLoader.
+        - Enhance some page cache related Logging to help development.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::identifierForInitialRequest):
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::DocumentLoader):
+        * loader/DocumentLoader.h:
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::commitProvisionalLoad):
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::FrameLoader::loadProvisionalItemFromCachedPage):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::isLoadingFromCachedPage):
+
+2009-08-17  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Moved implementation of isAfterContent to RenderObject
+        (as inline method to avoid potential performance regressions).
+
+        BUG 28376 -  [Cleanup] isAfterContent() implemented twice, should be member of RenderObject
+        (https://bugs.webkit.org/show_bug.cgi?id=28376)
+
+        * rendering/RenderBox.cpp:
+        * rendering/RenderBox.h:
+        * rendering/RenderInline.cpp:
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isAfterContent):
+
+2009-08-17  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Assertion failure in WebCore::RenderHTMLCanvas::layout
+        https://bugs.webkit.org/show_bug.cgi?id=12052
+
+        Don't handle run-in if the element is not a block element.
+
+        Test: fast/runin/nonblock-runin.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::handleRunInChild):
+
+2009-08-17  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Fix createImageData to raise the NOT_SUPPORTED_ERR exception when
+        either of the arguments are not finite.
+
+        According to
+        http://www.whatwg.org/specs/web-apps/current-work/#pixel-manipulation:
+        "If any of the arguments to createImageData() or getImageData() are
+        infinite or NaN, or if the createImageData()  method is invoked with
+        only one argument but that argument is null, the method must instead
+        raise a NOT_SUPPORTED_ERR  exception."
+
+        Test: http://philip.html5.org/tests/canvas/suite/tests/2d.imageData.create.nonfinite.html
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::createImageData):
+        * html/canvas/CanvasRenderingContext2D.h:
+        * html/canvas/CanvasRenderingContext2D.idl:
+
+2009-08-17  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Add a way to release the storage lock
+        https://bugs.webkit.org/show_bug.cgi?id=28411
+
+        Two scripts within the same origin that are accessing LocalStorage must not do
+        it simultaneously, according to the spec.  There are some cases, however, where
+        a script might want to override this behavior.  navigator.getStorageUpdates()
+        was added for this reason:
+        http://dev.w3.org/html5/spec/Overview.html#manually-releasing-the-storage-mutex
+
+        Add this function to navigator and hook it up to DOM Storage.
+
+        * page/Navigator.cpp:
+        (WebCore::Navigator::getStorageUpdates):
+        * page/Navigator.h:
+        * page/Navigator.idl:
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::unlock):
+        * storage/StorageNamespaceImpl.h:
+
+2009-08-17  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        CFNetwork isn't present in the framework search path on Mac OS X so we can't directly include its headers.
+        We include CoreServices.h, the umbrella framework that contains CFNetwork, from the prefix header which
+        results in the CFNetwork headers being included on Mac OS X.  CoreServices.h doesn't include CFNetwork.h on
+        Windows though so we explicitly include this header from the prefix header when on Windows.
+
+        * WebCorePrefix.h:
+        * platform/network/cf/DNSCFNet.cpp: Remove #include that is no longer needed.
+
+2009-08-17  Alexey Proskuryakov  <ap@apple.com>
+
+        Trying a better build fix (the previous one broke Leopard bots, although it did build for me).
+
+        * platform/network/cf/DNSCFNet.cpp: Include CFNetwork/CFNetwork.h instead.
+
+2009-08-17  Alexey Proskuryakov  <ap@apple.com>
+
+        Trying to fix Windows build.
+
+        * platform/network/cf/DNSCFNet.cpp: Include CFNetwork/CFHost.h.
+
+2009-08-17  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Steve Falkenburg.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27323
+        Only add Cygwin to the path when it isn't already there.  This avoids
+        causing problems for people who purposefully have non-Cygwin versions of
+        executables like svn in front of the Cygwin ones in their paths.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/WebCoreGenerated.vcproj:
+
+2009-08-17  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28401
+        Add support for DNS prefetching with CFNetwork
+
+        This is just an optimization, no behavior change, so no tests.
+
+        * platform/network/cf/DNSCFNet.cpp:
+        (WebCore::clientCallback):
+        (WebCore::prefetchDNS):
+        Use async CFHostStartInfoResolution() for implementation.
+
+2009-08-17  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28313: Combine ThreadableLoaderOptions::crossOriginRequestPolicy and
+        ThreadableLoaderOptions::crossOriginRedirectPolicy since they are always set the same way.
+
+        Also, tightened up behavior of XMLHttpRequest with cross-origin redirects and access control. We have not implemented
+        redirects access control, so we should never redirect across origins. But in two edge cases, we were:
+
+        * Asynchronous XHR: Script on origin A requests resource from origin B. Server redirects (without sending access control
+          authorization headers) to a resource on origin A.
+        * Synchronous XHR: Script on origin A requests resource from origin B. Server redirects (without sending access control
+          authorization headers) to another resource on origin B (this time sending access control authorization headers).
+
+        Test: http/tests/xmlhttprequest/access-control-and-redirects.html
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::willSendRequest): Refactor redirect checking code into shared location.
+        (WebCore::DocumentThreadableLoader::loadRequest): Ditto.
+        (WebCore::DocumentThreadableLoader::isAllowedRedirect): Ditto.
+        * loader/DocumentThreadableLoader.h:
+        * loader/ThreadableLoader.h:
+        (WebCore::ThreadableLoaderOptions::ThreadableLoaderOptions): Remove ThreadableLoaderOptions::crossOriginRedirectPolicy.
+        * page/EventSource.cpp:
+        (WebCore::EventSource::connect): Ditto.
+        * workers/Worker.cpp: Ditto.
+        (WebCore::Worker::Worker): Ditto.
+        * workers/WorkerContext.cpp: Ditto.
+        (WebCore::WorkerContext::importScripts): Ditto.
+        * workers/WorkerScriptLoader.cpp:
+        (WebCore::WorkerScriptLoader::loadSynchronously): Ditto.
+        (WebCore::WorkerScriptLoader::loadAsynchronously): Ditto.
+        * workers/WorkerScriptLoader.h: 
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::createRequest): Ditto.
+
+2009-08-17  Adam Langley  <agl@google.com>
+
+        Reviewed by Dan Bernstein (relanding of r47157).
+
+        Fix a typo in platform/graphics/skia/PlatformContextSkia.cpp
+
+        https://bugs.webkit.org/show_bug.cgi?id=28172
+
+        This was originally fixed in r47157, however it triggered a bug in
+        Skia which caused Chromium Linux to fail layout tests in debug mode.
+        It was reverted in r47189 while we sorted it out.
+
+        The Skia bug was fixed in Skia's r321 [1] and rolled into Chromium in
+        Chromium's r23523. This is a reland of the original patch.
+
+        No new tests because it's a just typo fix.
+
+        [1] http://code.google.com/p/skia/source/detail?r=321
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Protect ResourceHandle for g_file_query_info_async call, using the
+        same technique we already use for HTTP requests that take the soup
+        path.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandleInternal::~ResourceHandleInternal):
+        (WebCore::ResourceHandle::~ResourceHandle):
+        (WebCore::finishedCallback):
+        (WebCore::):
+
+2009-08-17  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r47255): MediaWiki's (including Wikipedia) navigation pane
+        appears below the main content
+        https://bugs.webkit.org/show_bug.cgi?id=28350
+
+        A particular version of the MediaWiki software detects WebKit through
+        user agent sniffing and imports a style sheet called KHTMLFixes.css,
+        which contains a single rule that was meant to work around some KHTML
+        bug, but currently has the sole effect of causing the float containing
+        the main article content to extend all the way to the left and thus push
+        down the left navigation pane.
+
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::setCSSStyleSheet): If site specific hacks are
+        enabled, check if the imported style sheet is the MediaWiki
+        KHTMLFixes.css. If so, remove the offending rule.
+
+2009-08-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Kevin Ollivier.
+
+        Correct crash when processing local cancelled requests.
+
+        No new tests. Existing fast/images/favicon-as-image.html
+        displays the problem.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::writeCallback): Add check for m_cancelled after
+          performing local-file processing.
+        (WebCore::ResourceHandleManager::downloadTimerCallback): Add
+          check for m_cancelled after performing local-file processing.
+
+2009-08-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Reverts 47371, since it breaks GTK+.
+
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::setData):
+        * platform/image-decoders/ImageDecoder.cpp: Removed.
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::ImageDecoder):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::convertCMYKToRGBA):
+        (WebCore::convertRGBToRGBA):
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+
+2009-08-17  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Allow image decoders to down-sample the image directly
+        to scaled output buffer. This can be enabled/disabled by
+        macro ENABLE(IMAGE_DECODER_DOWN_SAMPLING).
+        Only JPEG and PNG decoders are modified to support it now.
+        https://bugs.webkit.org/show_bug.cgi?id=28308
+
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::setData):
+        * platform/image-decoders/ImageDecoder.cpp: Added.
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::ImageDecoder):
+        (WebCore::ImageDecoder::setMaxNumPixels):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::convertCMYKToRGBA):
+        (WebCore::convertRGBToRGBA):
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        (WebCore::JPEGImageDecoder::setSize):
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+
+2009-08-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix: fix float literals to avoid casting warnings.
+
+        * rendering/MediaControlElements.cpp:
+
+2009-08-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Use OwnPtrs for GraphicsLayers
+        https://bugs.webkit.org/show_bug.cgi?id=28399
+
+        Convert RenderLayerBacking and RenderLayerCompositor to use OwnPtrs
+        for their references to GraphicsLayers.
+
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayer::create):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::RenderLayerBacking):
+        (WebCore::RenderLayerBacking::createGraphicsLayer):
+        (WebCore::RenderLayerBacking::destroyGraphicsLayer):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::updateInternalHierarchy):
+        (WebCore::RenderLayerBacking::updateClippingLayers):
+        (WebCore::RenderLayerBacking::updateForegroundLayer):
+        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
+        * rendering/RenderLayerBacking.h:
+        (WebCore::RenderLayerBacking::graphicsLayer):
+        (WebCore::RenderLayerBacking::clippingLayer):
+        (WebCore::RenderLayerBacking::ancestorClippingLayer):
+        (WebCore::RenderLayerBacking::foregroundLayer):
+        (WebCore::RenderLayerBacking::parentForSublayers):
+        (WebCore::RenderLayerBacking::childForSuperlayers):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::~RenderLayerCompositor):
+        (WebCore::RenderLayerCompositor::rootPlatformLayer):
+        (WebCore::RenderLayerCompositor::didMoveOnscreen):
+        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
+        (WebCore::RenderLayerCompositor::destroyRootPlatformLayer):
+        * rendering/RenderLayerCompositor.h:
+
+2009-08-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Reset InjectedScript styles cache on document change.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28390
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::resetInjectedScript):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setDocument):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._reset):
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * rendering/MediaControlElements.cpp: Removed unneeded include of CString.h,
+        resorted includes, renamed "doc" to "document" and fixed formatting.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed functions now unneeded due to use of Reflect to create
+        language bindings.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityParentForImageMap):
+        Get at usemap attribute directly.
+
+        * editing/DeleteButtonController.cpp:
+        (WebCore::DeleteButtonController::createDeletionUI):
+        Get at id attribute directly.
+        * editing/EditorCommand.cpp:
+        (WebCore::executeInsertHorizontalRule): Ditto.
+
+        * html/HTMLDocument.cpp:
+        (WebCore::HTMLDocument::dir): Get at dir attribute of body directly.
+        (WebCore::HTMLDocument::setDir): Ditto.
+
+        * html/HTMLElement.cpp: Deleted unused functions.
+        * html/HTMLElement.h: Ditto.
+
+        * html/HTMLImageElement.cpp: Deleted unused functions.
+        (WebCore::HTMLImageElement::alt): Changed to return const AtomicString&.
+        (WebCore::HTMLImageElement::addSubresourceAttributeURLs): Changed to
+        get at usemap attribute directly, but added a FIXME because although
+        it is what the old code did, it looks to not be entirely correct.
+
+        * html/HTMLImageElement.h: Deleted unused functions.
+
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::altDisplayString): Get at alt attribute directly.
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::imageMap): Get at usemap attribute directly.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::createGraphicsLayer): Get at id attribute
+        directly.
+        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer): Removed
+        explicit HTMLNames namespace qualification.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode): Removed unneeded calls
+        to RefPtr::get.
+
+2009-08-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Discard DOM Node bindings on any document change.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28389
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setDocument):
+
+2009-08-13  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Improve Cookie DataGrid to Show Hidden Data
+        https://bugs.webkit.org/show_bug.cgi?id=28269
+
+        * English.lproj/localizedStrings.js: DataGrid Headers "Name", "Value", "Size", ...
+        * WebCore.gypi: added missing files
+
+          Implemented Bindings for InspectorController.deleteCookie(name)
+
+        * inspector/InspectorBackend.idl:
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::cookies):
+        (WebCore::JSInspectorBackend::deleteCookie):
+
+          v8 Bindings Stubs
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+          Removed WebInspector.Cookie
+
+        * inspector/front-end/Cookie.js: Removed.
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/WebKit.qrc:
+
+          Improved DataGrid and Kept Fallback Behavior for Platforms that don't
+          yet provide access to raw cookies.
+
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.get statusBarItems):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype.buildCookies):
+        (WebInspector.CookieItemsView.prototype.dataGridForCookies):
+        (WebInspector.CookieItemsView.prototype.fallbackUpdate.callback):
+        (WebInspector.CookieItemsView.prototype.fallbackUpdate):
+        (WebInspector.CookieItemsView.prototype.fallbackBuildCookiesFromString):
+        (WebInspector.CookieItemsView.prototype.fallbackDataGridForCookies):
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
+
+          Interaction with the page through Injected Script (for fallback behavior)
+
+        * inspector/front-end/DOMAgent.js:
+        (InspectorController.getCookies):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.setStyleProperty): style fix
+        (InjectedScript.getCookies):
+
+          Allow alignment of text inside DataGrids.
+
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid):
+        (WebInspector.DataGridNode.prototype.createCell):
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.dataGridForDOMStorage):
+        * inspector/front-end/inspector.css:
+
+          Added deleteCookie(., ., String name)
+          Modified getRawCookies to return a bool to know if its implemented
+
+        * platform/CookieJar.h:
+
+
+          Implemented deleteCookie for Macs
+
+        * platform/mac/CookieJar.mm:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+
+          Stub Implementations for Other Platforms
+
+        * platform/haiku/CookieJarHaiku.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/curl/CookieJarCurl.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/win/CookieJarWin.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+
+2009-08-17  Adam Treat  <adam.treat@torchmobile.com>
+
+        Blind build fix for Leopard.
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::adjustLineToPixelBoundaries):
+
+2009-08-13  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Style fixes based on cpp_style.py and WebKit Style guide for
+        GraphicsContextCG.cpp
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::drawEllipse):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::applyStrokePattern):
+        (WebCore::GraphicsContext::drawPath):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::clipToImageBuffer):
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::GraphicsContext::roundToDevicePixels):
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::setURLForRect):
+        (WebCore::GraphicsContext::setImageInterpolationQuality):
+        (WebCore::GraphicsContext::imageInterpolationQuality):
+        (WebCore::GraphicsContext::setPlatformTextDrawingMode):
+        (WebCore::GraphicsContext::setCompositeOperation):
+
+2009-08-13  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Style fixes based on cpp_style.py and WebKit Style guide for
+        GraphicsContext.cpp/h, GraphicsContextCairo.cpp and GraphicsContextQt.cpp.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::save):
+        (WebCore::GraphicsContext::restore):
+        (GraphicsContext::drawText):
+        (GraphicsContext::initFocusRing):
+        (GraphicsContext::focusRingBoundingRect):
+        (GraphicsContext::drawImage):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::toCairoOperator):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Change HTMLAreaElement to use OwnArrayPtr
+        https://bugs.webkit.org/show_bug.cgi?id=28386
+
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::HTMLAreaElement): Removed unneeded initializer.
+        (WebCore::HTMLAreaElement::~HTMLAreaElement): Removed unneeded delete call.
+        (WebCore::HTMLAreaElement::parseMappedAttribute): Use the set function
+        instead of deletion followed by assignment.
+        * html/HTMLAreaElement.h: Use OwnArrayPtr.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Fix Windows build.
+
+        * dom/make_names.pl: Add back cast to (void*) needed on Windows.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Move noResize from HTMLFrameElementBase to HTMLFrameElement
+        https://bugs.webkit.org/show_bug.cgi?id=28384
+
+        * html/HTMLFrameElement.cpp:
+        (WebCore::HTMLFrameElement::HTMLFrameElement): Initialize m_noResize.
+        (WebCore::HTMLFrameElement::parseMappedAttribute): Set m_noResize to true
+        here if noresizeAttr is changed. This code was moved here from
+        HTMLFrameElementBase, but I added some FIXME comments.
+        (WebCore::HTMLFrameElement::setNoResize): Set the attribute based on
+        boolean argument. Moved here from HTMLFrameElementBase.
+
+        * html/HTMLFrameElement.h: Moved noResize, setNoResize, and m_noResize
+        here from HTMLFrameElementBase.
+
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::HTMLFrameElementBase): Removed m_noResize.
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute): Removed code to parse
+        noresizeAttr.
+
+        * html/HTMLFrameElementBase.h: Removed noResize, setNoResize, and m_noResize.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Tweak HTMLFrameElementBase so that m_URL can be private
+        https://bugs.webkit.org/show_bug.cgi?id=28385
+
+        * html/HTMLFrameElement.cpp:
+        (WebCore::HTMLFrameElement::rendererIsNeeded): Removed m_URL argument.
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::isURLAllowed): Use m_URL instead of
+        taking an argument.
+        (WebCore::HTMLFrameElementBase::openURL): Removed m_URL argument.
+        * html/HTMLFrameElementBase.h: Removed argument from isURLAllowed function.
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::rendererIsNeeded): Removed m_URL argument.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        HTMLViewSourceDocument should use smart pointers
+        https://bugs.webkit.org/show_bug.cgi?id=28378
+
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::HTMLViewSourceDocument): Don't initialize
+        pointers any more since RefPtr starts 0 by default.
+        (WebCore::HTMLViewSourceDocument::createContainingTable): Use more specific
+        types for local variables.
+        (WebCore::HTMLViewSourceDocument::addSpanWithClassName): Return a PassRefPtr,
+        and use a RefPtr of a more specific type for a local variable.
+        (WebCore::HTMLViewSourceDocument::addLine): Use more specific types for local
+        variables, and use RefPtr as well.
+        (WebCore::HTMLViewSourceDocument::addLink): Return a PassRefPtr, and use a
+        RefPtr of a more specific type for a local variable.
+
+        * html/HTMLViewSourceDocument.h: Change return types to PassRefPtr and
+        data member types to RefPtr.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        DOM attribute getter/setter functions should use const AtomicString& type
+        https://bugs.webkit.org/show_bug.cgi?id=25425
+
+        Convert 4 more classes. These are classes I am going to make other changes
+        to soon, so it's good to have this use of Reflect in the IDL out of the way.
+
+        * html/HTMLEmbedElement.idl: Use Reflect for many attributes.
+        * html/HTMLFrameElement.idl: Ditto.
+        * html/HTMLIFrameElement.idl: Ditto.
+        * html/HTMLObjectElement.idl: Ditto.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Script to create element factory needs changes to accommodate calling create
+        https://bugs.webkit.org/show_bug.cgi?id=28379
+
+        * dom/make_names.pl: Tweak formatting. Remove lots of unneeded quotes
+        around names used inside {}. Added new createWithNew property for tags
+        that makes the factory use a create function instead of calling new.
+        Renamed functions with initialize in their name to have default in their
+        name, since they return an array full of default values and don't themselves
+        initialize anything.
+
+2009-08-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        StyledElement should use ASCIICType instead of having its own toHex function
+        https://bugs.webkit.org/show_bug.cgi?id=28377
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::addCSSColor): Use isASCIIHexDigit and toASCIIHexValue.
+
+2009-08-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        execCommand("InsertHorizontalRule") inserts a broken <hr> element
+        https://bugs.webkit.org/show_bug.cgi?id=28375
+
+        * editing/EditorCommand.cpp:
+        (WebCore::executeInsertHorizontalRule): Create an HTMLHRElement
+        instead of just an HTMLElement.
+
+2009-08-16  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] <option> element & 'onpick' events - history navigation is broken
+        https://bugs.webkit.org/show_bug.cgi?id=28371
+
+        After selecting an option element with an 'onpick' event associated with a 'go' task,
+        the navigation is executed. When going back in history, the same 'onpick' event is fired
+        again. Fix that problem, add wml/option-element-onpick-recursion.html covering the bug.
+
+        Test: wml/option-element-onpick-recursion.html
+
+        * wml/WMLOptionElement.cpp:
+        (WebCore::WMLOptionElement::handleIntrinsicEventIfNeeded):
+        * wml/WMLSelectElement.cpp:
+        (WebCore::WMLSelectElement::WMLSelectElement):
+        (WebCore::WMLSelectElement::selectInitialOptions):
+        * wml/WMLSelectElement.h:
+        (WebCore::WMLSelectElement::initialized):
+
+2009-08-16  Anthony Ricaud  <rik@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector Resource filtering: keyboard Navigation always uses ALL resources
+        https://bugs.webkit.org/show_bug.cgi?id=28231
+        
+        Determine if a resource is selectable on user action.
+        
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.get selectable):
+
+2009-08-16  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/28355> Replace MAX()/MIN() macros with type-safe std::max()/min() templates
+
+        Reviewed by Dan Bernstein.
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (AXAttributeStringSetSpelling): Changed MIN() to min().
+        * platform/graphics/mac/FontMacATSUI.mm:
+        (WebCore::Font::selectionRectForComplexText): Changed MAX() to
+        max() and MIN() to min().
+        (WebCore::Font::floatWidthForComplexText): Ditto.
+        * platform/graphics/mac/SimpleFontDataMac.mm: Added using
+        std::max statement.
+        (WebCore::SimpleFontData::platformInit): Changed MAX() to max().
+        * platform/text/mac/TextCodecMac.cpp:
+        (WebCore::TextCodecMac::decode): Changed MIN() to min().
+
+2009-08-16  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] Cleanup WMLIntrinsicEventHandling code
+        https://bugs.webkit.org/show_bug.cgi?id=28358
+
+        Remove superflous "Event* evt" parameter from executeTask() methods. It's a leftover from the initial WML merge.
+
+        * wml/WMLAnchorElement.cpp:
+        (WebCore::WMLAnchorElement::defaultEventHandler):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::defaultEventHandler):
+        * wml/WMLGoElement.cpp:
+        (WebCore::WMLGoElement::executeTask):
+        * wml/WMLGoElement.h:
+        * wml/WMLIntrinsicEventHandler.cpp:
+        (WebCore::WMLIntrinsicEventHandler::triggerIntrinsicEvent):
+        * wml/WMLPrevElement.cpp:
+        (WebCore::WMLPrevElement::executeTask):
+        * wml/WMLPrevElement.h:
+        * wml/WMLRefreshElement.cpp:
+        (WebCore::WMLRefreshElement::executeTask):
+        * wml/WMLRefreshElement.h:
+        * wml/WMLTaskElement.h:
+
+2009-08-16  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: A handful of DOMAgent-related fixes and cleanups.
+
+        - renamed elementId to nodeId in operations on nodes.
+        - added load listeners to frame owners in InspectorDOMAgent.
+        - removed InspectorController::inspectedWindowScriptObjectCleared event.
+        - preserved isViaInspector flag for 'via inspector' marker to survive styles update.
+        - removed contentDocument-related logic from ElementsPanel since it is handled in
+            the InspectorDOMAgent.
+        - removed DOM listeners unregistration and corresponding events from InspectorController.
+        - made this.styles 'private' in ElementsPanel.
+        - added TODO for the handleCopy processing.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28356
+
+        * WebCore.order:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getChildNodes):
+        (WebCore::InspectorBackend::setTextNodeValue):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::startListening):
+        (WebCore::InspectorDOMAgent::stopListening):
+        (WebCore::InspectorDOMAgent::handleEvent):
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::getChildNodes):
+        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
+        (WebCore::InspectorDOMAgent::setTextNodeValue):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
+        (WebCore::InspectorDOMAgent::innerParentNode):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorFrontend.cpp:
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMDocument.prototype.addEventListener):
+        (WebInspector.DOMDocument.prototype.removeEventListener):
+        (WebInspector.DOMDocument.prototype._fireDomEvent):
+        (WebInspector.DOMAgent.prototype.getChildNodesAsync.mycallback):
+        (WebInspector.DOMAgent.prototype.getChildNodesAsync):
+        (WebInspector.DOMAgent.prototype._setChildNodes):
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        (WebInspector.childNodeInserted):
+        (WebInspector.childNodeRemoved):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype.reset):
+        (WebInspector.ElementsPanel.prototype.addStyleChange):
+        (WebInspector.ElementsPanel.prototype.removeStyleChange):
+        (WebInspector.ElementsPanel.prototype._updateModifiedNodes):
+        (WebInspector.ElementsPanel.prototype.updateBreadcrumb):
+        (WebInspector.ElementsPanel.prototype.handleCopyEvent):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.set rootDOMNode):
+        (WebInspector.ElementsTreeOutline.prototype.findTreeElement):
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren.updateChildrenOfNode):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren):
+        (WebInspector.ElementsTreeElement.prototype.onexpand):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.addStyleSelector):
+        (InjectedScript._serializeRule):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection):
+        * inspector/front-end/inspector.js:
+        (WebInspector.set hoveredDOMNode):
+        * inspector/front-end/treeoutline.js:
+        (TreeOutline.prototype.findTreeElement):
+        * inspector/front-end/utilities.js:
+        (Node.prototype.enclosingNodeOrSelfWithNodeNameInArray):
+        (Node.prototype.enclosingNodeOrSelfWithClass):
+        (isAncestorNode):
+        (firstCommonNodeAncestor):
+        (traverseNextNode):
+        (traversePreviousNode):
+        ():
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
+        * page/android/InspectorControllerAndroid.cpp:
+
+2009-08-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Optimize updateFillImages() to not add/remove clients every time
+        https://bugs.webkit.org/show_bug.cgi?id=28334
+
+        Optimize the case where old and new just have a single layer pointing to the same (or no)
+        image.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::updateFillImages):
+
+2009-08-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Implement animations of multiple text-shadows and -webkit-box-shadows.
+        https://bugs.webkit.org/show_bug.cgi?id=28266
+        
+        Test: transitions/multiple-shadow-transitions.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::PropertyWrapperShadow::equals):
+        (WebCore::PropertyWrapperShadow::blend):
+
+2009-08-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Make transitions work for position and size of multiple backgrounds and masks.
+        https://bugs.webkit.org/show_bug.cgi?id=28266
+        
+        Make background-position, background-size, -webkit-mask-position and -webkit-mask-size
+        properties animatable with multiple backgrounds, rather than just animating the first one.
+
+        Tests: transitions/multiple-background-size-transitions.html
+               transitions/multiple-background-transitions.html
+               transitions/multiple-mask-transitions.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::FillLayerPropertyWrapperBase::FillLayerPropertyWrapperBase):
+        (WebCore::FillLayerPropertyWrapperBase::~FillLayerPropertyWrapperBase):
+        (WebCore::FillLayerPropertyWrapperGetter::FillLayerPropertyWrapperGetter):
+        (WebCore::FillLayerPropertyWrapperGetter::equals):
+        (WebCore::FillLayerPropertyWrapper::FillLayerPropertyWrapper):
+        (WebCore::FillLayerPropertyWrapper::blend):
+        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
+        (WebCore::FillLayersPropertyWrapper::equals):
+        (WebCore::FillLayersPropertyWrapper::blend):
+        (WebCore::ensurePropertyMap):
+        * rendering/style/FillLayer.h:
+        (WebCore::FillLayer::setXPosition):
+        (WebCore::FillLayer::setYPosition):
+        (WebCore::FillLayer::setSize):
+
+2009-08-15  George Staikos  <george.staikos@torchmobile.com>
+
+        Reviewed by Jan Alonzo.
+
+        Don't crash in fieldset code when WML is enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=28012
+
+        Test: fast/wml/html-fieldset-crash.html
+
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::findLegend): ++brackets
+
+2009-08-15  Sam Weinig  <sam@webkit.org>
+
+        Try and enable EventSource on Windows.
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+
+2009-08-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Setting attribute event listeners to the body does not set them on the window
+        https://bugs.webkit.org/show_bug.cgi?id=28343
+
+        Tests: fast/dom/Window/HTMLBodyElement-window-eventListener-attributes.html
+               fast/dom/Window/HTMLFrameSetElement-window-eventListener-attributes.html
+
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::setOnblur): Use setWindowAttributeEventListener instead of setAttributeEventListener.
+        (WebCore::HTMLBodyElement::setOnerror): Ditto.
+        (WebCore::HTMLBodyElement::setOnfocus): Ditto.
+        (WebCore::HTMLBodyElement::setOnload): Ditto.
+        (WebCore::HTMLBodyElement::setOnbeforeunload): Ditto.
+        (WebCore::HTMLBodyElement::setOnmessage): Ditto.
+        (WebCore::HTMLBodyElement::setOnoffline): Ditto.
+        (WebCore::HTMLBodyElement::setOnonline): Ditto.
+        (WebCore::HTMLBodyElement::setOnresize): Ditto.
+        (WebCore::HTMLBodyElement::setOnstorage): Ditto.
+        (WebCore::HTMLBodyElement::setOnunload): Ditto.
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::setOnblur): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnerror): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnfocus): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnload): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnbeforeunload): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnmessage): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnoffline): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnonline): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnresize): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnstorage): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnunload): Ditto.
+
+2009-08-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix up some IDL comments.
+
+        * html/HTMLBodyElement.idl:
+        * html/HTMLFrameSetElement.idl:
+
+2009-08-15  Adam Bergkvist  <adam.bergkvist@ericsson.com>
+
+        Reviewed by Sam Weinig.
+
+        Added implementation of the EventSource object that enables
+        server-sent events from HTML5.
+        http://dev.w3.org/html5/eventsource/
+        https://bugs.webkit.org/show_bug.cgi?id=14997
+
+        Tests: fast/eventsource/eventsource-attribute-listeners.html
+               fast/eventsource/eventsource-constructor.html
+               http/tests/eventsource/eventsource-bad-mime-type.html
+               http/tests/eventsource/eventsource-parse-event-stream.html
+               http/tests/eventsource/eventsource-reconnect.html
+               http/tests/eventsource/eventsource-status-code-states.html
+               http/tests/eventsource/workers/eventsource-simple.html
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::eventSource):
+        * bindings/js/JSEventSourceConstructor.cpp: Added.
+        (WebCore::):
+        (WebCore::JSEventSourceConstructor::JSEventSourceConstructor):
+        (WebCore::constructEventSource):
+        (WebCore::JSEventSourceConstructor::getConstructData):
+        * bindings/js/JSEventSourceConstructor.h: Added.
+        (WebCore::JSEventSourceConstructor::classInfo):
+        * bindings/js/JSEventSourceCustom.cpp: Added.
+        (WebCore::JSEventSource::markChildren):
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::eventSource):
+        * dom/EventNames.h:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toEventSource):
+        * dom/EventTarget.h:
+        * page/DOMWindow.idl:
+        * page/EventSource.cpp: Added.
+        (WebCore::EventSource::EventSource):
+        (WebCore::EventSource::~EventSource):
+        (WebCore::EventSource::connect):
+        (WebCore::EventSource::endRequest):
+        (WebCore::EventSource::scheduleReconnect):
+        (WebCore::EventSource::reconnectTimerFired):
+        (WebCore::EventSource::url):
+        (WebCore::EventSource::readyState):
+        (WebCore::EventSource::close):
+        (WebCore::EventSource::scriptExecutionContext):
+        (WebCore::EventSource::addEventListener):
+        (WebCore::EventSource::removeEventListener):
+        (WebCore::EventSource::dispatchEvent):
+        (WebCore::EventSource::didReceiveResponse):
+        (WebCore::EventSource::didReceiveData):
+        (WebCore::EventSource::didFinishLoading):
+        (WebCore::EventSource::didFail):
+        (WebCore::EventSource::didFailRedirectCheck):
+        (WebCore::EventSource::parseEventStream):
+        (WebCore::EventSource::parseEventStreamLine):
+        (WebCore::EventSource::dispatchGenericEvent):
+        (WebCore::EventSource::dispatchMessageEvent):
+        (WebCore::EventSource::stop):
+        * page/EventSource.h: Added.
+        (WebCore::EventSource::create):
+        (WebCore::EventSource::):
+        (WebCore::EventSource::setOnopen):
+        (WebCore::EventSource::onopen):
+        (WebCore::EventSource::setOnmessage):
+        (WebCore::EventSource::onmessage):
+        (WebCore::EventSource::setOnerror):
+        (WebCore::EventSource::onerror):
+        (WebCore::EventSource::toEventSource):
+        (WebCore::EventSource::eventListeners):
+        (WebCore::EventSource::refEventTarget):
+        (WebCore::EventSource::derefEventTarget):
+        * page/EventSource.idl: Added.
+        * workers/WorkerContext.idl:
+
+2009-08-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Minor DOMAgent bugfixes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28177
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::nodeForId):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+
+2009-08-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Evaluating objects while on a breakpoint dumps string
+        representation instead of live object. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=28280
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions.this._evalInInspectedWindow):
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype._reportCompletions):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame.delayedEvaluation):
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        (WebInspector.ScriptsPanel.prototype.variablesInSelectedCallFrame):
+
+2009-08-15  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding two new files to WebCore/platform/haiku:
+        LocalizedStringsHaiku.cpp and LoggingHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28129
+
+        * platform/haiku/LocalizedStringsHaiku.cpp: Added.
+        (WebCore::submitButtonDefaultLabel):
+        (WebCore::inputElementAltText):
+        (WebCore::resetButtonDefaultLabel):
+        (WebCore::defaultLanguage):
+        (WebCore::searchableIndexIntroduction):
+        (WebCore::fileButtonChooseFileLabel):
+        (WebCore::fileButtonNoFileSelectedLabel):
+        (WebCore::contextMenuItemTagOpenLinkInNewWindow):
+        (WebCore::contextMenuItemTagDownloadLinkToDisk):
+        (WebCore::contextMenuItemTagCopyLinkToClipboard):
+        (WebCore::contextMenuItemTagOpenImageInNewWindow):
+        (WebCore::contextMenuItemTagDownloadImageToDisk):
+        (WebCore::contextMenuItemTagCopyImageToClipboard):
+        (WebCore::contextMenuItemTagOpenFrameInNewWindow):
+        (WebCore::contextMenuItemTagCopy):
+        (WebCore::contextMenuItemTagGoBack):
+        (WebCore::contextMenuItemTagGoForward):
+        (WebCore::contextMenuItemTagStop):
+        (WebCore::contextMenuItemTagReload):
+        (WebCore::contextMenuItemTagCut):
+        (WebCore::contextMenuItemTagPaste):
+        (WebCore::contextMenuItemTagNoGuessesFound):
+        (WebCore::contextMenuItemTagIgnoreSpelling):
+        (WebCore::contextMenuItemTagLearnSpelling):
+        (WebCore::contextMenuItemTagSearchWeb):
+        (WebCore::contextMenuItemTagLookUpInDictionary):
+        (WebCore::contextMenuItemTagOpenLink):
+        (WebCore::contextMenuItemTagIgnoreGrammar):
+        (WebCore::contextMenuItemTagSpellingMenu):
+        (WebCore::contextMenuItemTagShowSpellingPanel):
+        (WebCore::contextMenuItemTagCheckSpelling):
+        (WebCore::contextMenuItemTagCheckSpellingWhileTyping):
+        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
+        (WebCore::contextMenuItemTagFontMenu):
+        (WebCore::contextMenuItemTagBold):
+        (WebCore::contextMenuItemTagItalic):
+        (WebCore::contextMenuItemTagUnderline):
+        (WebCore::contextMenuItemTagOutline):
+        (WebCore::contextMenuItemTagWritingDirectionMenu):
+        (WebCore::contextMenuItemTagDefaultDirection):
+        (WebCore::contextMenuItemTagLeftToRight):
+        (WebCore::contextMenuItemTagRightToLeft):
+        (WebCore::contextMenuItemTagInspectElement):
+        (WebCore::searchMenuNoRecentSearchesText):
+        (WebCore::searchMenuRecentSearchesText):
+        (WebCore::searchMenuClearRecentSearchesText):
+        (WebCore::unknownFileSizeText):
+        (WebCore::AXWebAreaText):
+        (WebCore::AXLinkText):
+        (WebCore::AXListMarkerText):
+        (WebCore::AXImageMapText):
+        (WebCore::AXHeadingText):
+        (WebCore::imageTitle):
+        (WebCore::contextMenuItemTagTextDirectionMenu):
+        (WebCore::AXButtonActionVerb):
+        (WebCore::AXTextFieldActionVerb):
+        (WebCore::AXRadioButtonActionVerb):
+        (WebCore::AXCheckedCheckBoxActionVerb):
+        (WebCore::AXUncheckedCheckBoxActionVerb):
+        (WebCore::AXLinkActionVerb):
+        (WebCore::AXDefinitionListTermText):
+        (WebCore::AXDefinitionListDefinitionText):
+        * platform/haiku/LoggingHaiku.cpp: Added.
+        (WebCore::InitializeLoggingChannelsIfNecessary):
+
+2009-08-15  Darin Adler  <darin@apple.com>
+
+        Fix GTK build.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (fallbackObject): Pass 0 for document. Should be OK at least for now.
+
+2009-08-15  Darin Adler  <darin@apple.com>
+
+        Fix Qt build.
+
+        * dom/XMLTokenizerQt.cpp: Use create functions instead of calling new
+        directly to make CDATASection and Comment nodes.
+
+2009-08-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Make DOM classes start with a reference count of 1, like all other RefCounted
+        https://bugs.webkit.org/show_bug.cgi?id=28068
+
+        First half, everything except for element classes.
+
+        * GNUmakefile.am: Removed DocPtr.h.
+        * WebCore.gypi: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+
+        * dom/Attr.cpp:
+        (WebCore::Attr::Attr): Added a call to createTextChild here so callers don't
+        have to call it explicitly.
+        (WebCore::Attr::create): Added.
+        (WebCore::Attr::setValue): Changed to take AtomicString.
+        (WebCore::Attr::cloneNode): Use create.
+
+        * dom/Attr.h: Added a create function. Made the constructor private,
+        and a lot of other functions private as well.
+
+        * dom/Attribute.cpp:
+        (WebCore::Attribute::createAttrIfNeeded): Use Attr::create.
+
+        * dom/CDATASection.cpp:
+        (WebCore::CDATASection::create): Added.
+        (WebCore::CDATASection::cloneNode): Use create.
+        (WebCore::CDATASection::virtualCreate): Ditto.
+
+        * dom/CDATASection.h: Added a create function. Made everything private.
+        Removed unneeded destructor declaration.
+
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::CharacterData): Replaced the multiple constructors
+        with a single one that takes ConstructionType.
+
+        * dom/CharacterData.h: Made more functions be protected and private.
+        Made m_data be private.
+
+        * dom/Comment.cpp:
+        (WebCore::Comment::Comment): Got rid of an extra constructor.
+        (WebCore::Comment::create): Added.
+        (WebCore::Comment::cloneNode): Call create.
+
+        * dom/Comment.h: Added a create function. Made everything private.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::dispatchChildInsertionEvents): Use RefPtr instead of DocPtr.
+        (WebCore::dispatchChildRemovalEvents): Ditto.
+
+        * dom/ContainerNode.h: Made the constructor protected and passed
+        ConstructionType instead of an isElement boolean.
+
+        * dom/DocPtr.h: Removed.
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document): Simplified the code that sets m_document
+        since it's no longer a smart pointer.
+        (WebCore::Document::removedLastRef): Use explicit calls to selfOnlyRef
+        and selfOnlyDeref instead of a DocPtr in here.
+        (WebCore::Document::~Document): Simplified the code that sets m_document
+        since it's no longer a smart pointer.
+        (WebCore::Document::createDocumentFragment): Call create.
+        (WebCore::Document::createTextNode): Ditto.
+        (WebCore::Document::createComment): Ditto.
+        (WebCore::Document::createCDATASection): Ditto.
+        (WebCore::Document::createProcessingInstruction): Ditto.
+        (WebCore::Document::createEntityReference): Ditto.
+        (WebCore::Document::createEditingTextNode): Ditto.
+        (WebCore::Document::importNode): Call Attr::create.
+        (WebCore::Document::createAttributeNS): Ditto.
+
+        * dom/Document.h: Call adoptRef. Made a lot of functions private and
+        protected and sorted them so public functions come first.
+
+        * dom/DocumentFragment.cpp:
+        (WebCore::DocumentFragment::create): Added.
+        (WebCore::DocumentFragment::cloneNode): Call create.
+        * dom/DocumentFragment.h: Added create.
+
+        * dom/DocumentType.cpp:
+        (WebCore::DocumentType::DocumentType): Pass type to Node constructor.
+        (WebCore::DocumentType::cloneNode): Use create.
+        * dom/DocumentType.h:
+        (WebCore::DocumentType::create): Call adoptRef.
+
+        * dom/EditingText.cpp:
+        (WebCore::EditingText::create): Added.
+        * dom/EditingText.h: Added a create function. Made everything private.
+
+        * dom/Element.cpp:
+        (WebCore::Element::Element): Pass CreateElementZeroRefCount to preserve
+        the zero reference count behavior for classes derived from Element.
+
+        * dom/EntityReference.cpp:
+        (WebCore::EntityReference::create): Added.
+        (WebCore::EntityReference::cloneNode): Call create.
+        * dom/EntityReference.h: Added create. Made everything private.
+
+        * dom/Node.cpp:
+        (WebCore::Node::initialRefCount): Added. Inline helper function for
+        the constructor.
+        (WebCore::Node::isContainer): Ditto.
+        (WebCore::Node::isElement): Ditto.
+        (WebCore::Node::isText): Ditto.
+        (WebCore::Node::Node): Changed to take a construction type argument.
+        Since m_document is now a normal pointer, added a call to selfOnlyRef.
+        (WebCore::Node::~Node): Ditto, but selfOnlyDeref.
+        (WebCore::Node::setDocument): Added selfOnlyRef/Deref calls.
+        (WebCore::Node::appendTextContent): Use the data function instead of
+        calling nodeValue functions, which do the same thing in a roundabout way.
+
+        * dom/Node.h: Made the constructor protected and replaced the multiple
+        arguments iwth a single ConstructionType argument. Sorted the public
+        things first.
+
+        * dom/Notation.h: Made most things private.
+        * dom/Notation.cpp: Removed extra constructor.
+
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::create): Added.
+        (WebCore::ProcessingInstruction::cloneNode): Call create.
+        * dom/ProcessingInstruction.h: Added create function. Made many other
+        members private.
+
+        * dom/Range.cpp:
+        (WebCore::Range::processContents): Use DocumentFragment::create.
+
+        * dom/Text.cpp:
+        (WebCore::Text::Text): Updated for base class change.
+        (WebCore::Text::create): Added.
+        (WebCore::Text::splitText): Changed to not require access to m_data.
+        (WebCore::Text::cloneNode): Call create.
+        (WebCore::Text::createRenderer): Call dataImpl.
+        (WebCore::Text::attach): Call data.
+        (WebCore::Text::recalcStyle): Call dataImpl.
+        (WebCore::Text::virtualCreate): Call create.
+        (WebCore::Text::createWithLengthLimit): Call create.
+        (WebCore::Text::formatForDebugger): Call data.
+
+        * dom/Text.h: Added a create function. Made many other members private.
+        Renamed createNew to virtualCreate.
+
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::enterText): Call Text::create.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::cdataBlock): Call CDATASection::create.
+        (WebCore::XMLTokenizer::comment): Call Comment::create.
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::deleteInsignificantText):
+        Call data instead of string.
+
+        * editing/CreateLinkCommand.cpp:
+        (WebCore::CreateLinkCommand::doApply): Call Text::create.
+
+        * editing/EditorCommand.cpp:
+        (WebCore::executeInsertNode): Call DocumentFragment::create.
+
+        * editing/SplitTextNodeCommand.cpp:
+        (WebCore::SplitTextNodeCommand::doApply): Call Text::create.
+
+        * editing/markup.cpp:
+        (WebCore::appendStartMarkup): Call data instead of nodeValue.
+
+        * html/HTMLDocument.h:
+        (WebCore::HTMLDocument::create): Call adoptRef.
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::createContextualFragment): Call DocumentFragment::create.
+        (WebCore::replaceChildrenWithFragment): Call data instead of string.
+        (WebCore::replaceChildrenWithText): Call Text::create.
+        (WebCore::HTMLElement::setInnerText): Call DocumentFragment::create and
+        Text::create.
+        (WebCore::HTMLElement::setOuterText): Call Text::create.
+
+        * html/HTMLKeygenElement.cpp:
+        (WebCore::HTMLKeygenElement::HTMLKeygenElement): Call Text::create.
+
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::setText): Call Text::create.
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::textCreateErrorCheck): Call Text::create.
+        (WebCore::HTMLParser::commentCreateErrorCheck): Call Comment::create.
+        (WebCore::HTMLParser::handleIsindex): Call Text::create.
+
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::addText): Call Text::create.
+
+        * html/HTMLViewSourceDocument.h:
+        (WebCore::HTMLViewSourceDocument::create): Call adoptRef.
+
+        * loader/FTPDirectoryDocument.cpp:
+        (WebCore::FTPDirectoryTokenizer::appendEntry): Call Text::create.
+        (WebCore::FTPDirectoryTokenizer::createTDForFilename): Call Text::create.
+
+        * loader/FTPDirectoryDocument.h:
+        (WebCore::FTPDirectoryDocument::create): Call adoptRef.
+        * loader/ImageDocument.h:
+        (WebCore::ImageDocument::create): Ditto.
+        * loader/MediaDocument.h:
+        (WebCore::MediaDocument::create): Ditto.
+        * loader/PlaceholderDocument.h:
+        (WebCore::PlaceholderDocument::create): Ditto.
+        * loader/PluginDocument.h:
+        (WebCore::PluginDocument::create): Ditto.
+        * loader/TextDocument.h:
+        (WebCore::TextDocument::create): Ditto.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::didFinishLoading): Use RefPtr instead of DocPtr.
+        (WebCore::Loader::Host::didFail): Ditto.
+
+        * platform/TreeShared.h:
+        (WebCore::TreeShared::TreeShared): Added an initialRefCount argument,
+        defaulting to 1. Node still sometimes initializes it to 0 instead for now.
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::originalText): Use dataImpl instead of string.
+
+        * rendering/RenderTextFragment.cpp:
+        (WebCore::RenderTextFragment::originalText): Use dataImpl instead of string.
+        (WebCore::RenderTextFragment::previousCharacter): Ditto.
+
+        * svg/SVGDocument.h:
+        (WebCore::SVGDocument::create): Use adoptRef.
+
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::SVGElementInstance): Updated to take a
+        PassRefPtr.
+
+        * svg/SVGElementInstance.h: Made everything private.
+
+        * wml/WMLDocument.h:
+        (WebCore::WMLDocument::create): Called adoptRef.
+
+        * xml/XPathNamespace.cpp:
+        (WebCore::XPathNamespace::XPathNamespace): Take AtomicString arguments.
+        * xml/XPathNamespace.h: Made everything private.
+
+        * xml/XSLTProcessor.cpp:
+        (WebCore::createFragmentFromSource): Use DocumentFragment::create and
+        Text::create.
+
+2009-08-13  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Part of <rdar://problem/6218721> No MSAA focus events fired for Webkit
+        nightly (20866)
+
+        https://bugs.webkit.org/show_bug.cgi?id=20866
+
+        Reviewed by Oliver Hunt.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::AXObjectCache):
+        Changed to take a pointer to its owner document. This is used by
+        AXObjectCache::handleFocusedUIElementChanged().
+        (WebCore::AXObjectCache::focusedUIElementForPage):
+        Code moved from AccessibilityRenderObject::focusedUIElement(). Modified
+        to be a static function and to take a pointer to a Page.
+        (WebCore::AXObjectCache::platformGenerateAXID):
+        Moved the code to generate the next AXID from getAXID() to here. Added
+        a #if to make this non-WIN only, because Windows has its own
+        implementation.
+        (WebCore::AXObjectCache::getAXID):
+        Ensure that we generate a positive AXID, ranging from 1 to LONG_MAX.
+
+        * accessibility/AXObjectCache.h:
+        Add a declaration for Document and Page. Removed the declaration of
+        AccessibilityObject, because we include the header. Reordered the
+        declaration of Node alphabetically. Moved the typedef for AXID to
+        AccessibilityObject. Removed some trailing whitespace. Added a member
+        variable to hold a pointer to the owner Document.
+        (WebCore::AXObjectCache::AXObjectCache):
+        Changed to take a pointer to its owner Document.
+        (WebCore::AXObjectCache::focusedUIElementForPage):
+        Added; code moved from AccessiblityRenderObject::focusedUIElement().
+        Returns the focused element with respect to accessibility.
+        (WebCore::AXObjectCache::platformGenerateAXID):
+        Declare a function to generate an AXID.
+        (WebCore::AXObjectCache::objectFromAXID):
+        Return the AccessibilityObject with the given AXID.
+
+        * accessibility/AccessibilityObject.h:
+        Moved the typedef for AXID from AXObjectCache to here. Made the m_id
+        member use the typedef.
+        (WebCore::AccessibilityObject::axObjectID):
+        Changed the return type to use the typedef.
+        (WebCore::AccessibilityObject::setAXObjectID):
+        Changed the argument type to use the typedef.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        Removed some unneeded #includes.
+        (WebCore::AccessibilityRenderObject::focusedUIElement):
+        Moved the code to AXObjectCache::focusedUIElementForPage(), which we now
+        call.
+
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::platformGenerateAXID):
+        Ensure that we generate an AXID that is in the range 1 to LONG_MAX.
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        If the Document has no Page, return. If the Page has not focused
+        element (respecting accessibility), return. Assert that the
+        accessibility of the focused element is not ignored, and that the
+        object's AXID will be negative and fit into a LONG when negated.
+        Broadcast a focus event for the object.
+
+        * dom/Document.cpp:
+        (WebCore::Document::axObjectCache):
+        Pass this when creating the AXObjectCache.
+        (WebCore::Document::setFocusedNode):
+        Call AXObjectCache::handleFocusedUIElementChanged() on Windows.
+
+2009-08-14  Jiahua Huang  <jhuangjiahua@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        [gtk] Pasteboard/GtkClipboard can't handle the "text/html" target.
+        https://bugs.webkit.org/show_bug.cgi?id=27028
+
+        Remove the improper set of enum WebKitWebViewTargetInfo
+        by grabbing the target infos via m_helper.
+
+        * manual-tests/gtk/copy-htmltext.html: Added.
+        * platform/Pasteboard.h:
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::clipboard_get_contents_cb):
+        * platform/gtk/PasteboardHelper.h:
+
+2009-08-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix an assertion when bringing up the Inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=28318
+        
+        The fix for bug 28295 assumed that image clients count the number of times
+        addClient/removeClient is called. That was true for CachedResource clients,
+        but not StyleGeneratedImage clients, which pass the call onto CSSImageGeneratorValue.
+        
+        Fix by making CSSImageGeneratorValue count the number of times a client is
+        added/removed.
+
+        * css/CSSCanvasValue.cpp:
+        (WebCore::CSSCanvasValue::canvasChanged):
+        (WebCore::CSSCanvasValue::canvasResized):
+        * css/CSSImageGeneratorValue.cpp:
+        (WebCore::CSSImageGeneratorValue::addClient):
+        (WebCore::CSSImageGeneratorValue::removeClient):
+        (WebCore::CSSImageGeneratorValue::getImage):
+        * css/CSSImageGeneratorValue.h:
+
+2009-08-14  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Kevin Ollivier.
+
+        Correct libcurl crash when downloading local files.
+        https://bugs.webkit.org/show_bug.cgi?id=28312
+
+        No new tests. Test is covered by fast/encoding/char-encoding-mac.html.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::handleLocalReceiveResponse): New static function that
+          performs the local setting of valid URL and firing didReceiveResponse.
+          This code was moved from writeCallback.
+        (WebCore::writeCallback): Move local file handling to static function
+          (above) and use the function instead.
+        (WebCore::readCallback): Add check
+          for responseFired, and handle as a local file if it was not.
+
+2009-08-14  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        [Haiku] Fix RenderThemeHaiku build.
+        https://bugs.webkit.org/show_bug.cgi?id=28307
+
+        * platform/haiku/RenderThemeHaiku.cpp: Included RenderThemeHaiku.h
+        instead of RenderTheme.h.
+        (WebCore::RenderThemeHaiku::paintCheckbox): Removed the wrong 'virtual'
+        before the function.
+        (WebCore::RenderThemeHaiku::paintRadio): Removed the wrong 'virtual'
+        before the function.
+        * platform/haiku/RenderThemeHaiku.h: Corrected wrong function definitions.
+
+2009-08-14  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        [Haiku] Adding SharedBufferHaiku to WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=28309
+
+        * platform/haiku/SharedBufferHaiku.cpp: Added.
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+        * platform/haiku/TemporaryLinkStubs.cpp: Removed unnecessary headers
+        and functions.
+        (WebCore::signedPublicKeyAndChallengeString):
+        (WebCore::getSupportedKeySizes):
+
+2009-08-14  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Ensure we're getting the right v8 context in the V8 DOMWindowEvent custom getter.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28311
+
+        This should fix Chromium failing LayoutTests/fast/events/set-event-in-another-frame.html.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+
+2009-08-14  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        BUG 28134: Move the remaining parts of Access Control from XMLHttpRequest to ThreadableDocumentLoader.
+        https://bugs.webkit.org/show_bug.cgi?id=28134
+
+        No new tests added since Access Control was already well tested and this is a pure refactor.
+
+        * loader/DocumentThreadableLoader.cpp: Move a lot of the access control code from XHR in, preserving its
+        basic strategy. Also, modify the synchronous path to not be a special case, but reuse more of the async
+        path.
+
+        (WebCore::DocumentThreadableLoader::loadResourceSynchronously): Go through the async path and pass additional flags.
+        (WebCore::DocumentThreadableLoader::create): Group enum params into an options struct.
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader): Ditto.
+        (WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest): Brought mostly from XHR.
+        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight): Ditto.
+        (WebCore::DocumentThreadableLoader::willSendRequest): Handle preflight case.
+        (WebCore::DocumentThreadableLoader::didReceiveResponse): Ditto.
+        (WebCore::DocumentThreadableLoader::didFinishLoading): Ditto.
+        (WebCore::DocumentThreadableLoader::getShouldUseCredentialStorage): Ditto.
+        (WebCore::DocumentThreadableLoader::preflightSuccess): Preflight handling.
+        (WebCore::DocumentThreadableLoader::preflightFailure): Ditto.
+        (WebCore::DocumentThreadableLoader::loadRequest): Common request function that handles async/sync.
+        * loader/DocumentThreadableLoader.h: Group enum params into an options struct.
+        * loader/ThreadableLoader.cpp: Ditto.
+        (WebCore::ThreadableLoader::create): Ditto.
+        (WebCore::ThreadableLoader::loadResourceSynchronously): Ditto.
+        * loader/ThreadableLoader.h: Ditto.
+        (WebCore::ThreadableLoaderOptions::ThreadableLoaderOptions): Ditto.
+        * loader/WorkerThreadableLoader.cpp: Ditto.
+        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):Ditto.
+        (WebCore::WorkerThreadableLoader::loadResourceSynchronously): Ditto.
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge): Ditto.
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader): Ditto.
+        * loader/WorkerThreadableLoader.h: Ditto.
+        (WebCore::WorkerThreadableLoader::create): Ditto.
+        * platform/CrossThreadCopier.h: Allow ThreadableLoaderOptions to be copied across threads.
+        (WebCore::):
+        * workers/WorkerScriptLoader.cpp: More enum->struct grouping.
+        (WebCore::WorkerScriptLoader::loadSynchronously): More enum->struct grouping.
+        (WebCore::WorkerScriptLoader::loadAsynchronously): More enum->struct grouping.
+        * xml/XMLHttpRequest.cpp: Remove all the access control code and some supporting state.
+        (WebCore::XMLHttpRequest::XMLHttpRequest): Ditto.
+        (WebCore::XMLHttpRequest::createRequest): Ditto.
+        (WebCore::XMLHttpRequest::didFinishLoading): Ditto.
+        (WebCore::XMLHttpRequest::didReceiveResponse): Ditto.
+        (WebCore::XMLHttpRequest::didReceiveData): Ditto.
+        * xml/XMLHttpRequest.h: Ditto.
+
+2009-08-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Rename the confusing isObject(<class>) to inherits(<class>).
+        It still works on non-objects, returning false.
+
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toEventTarget):
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::createPositionCallback):
+        (WebCore::createPositionErrorCallback):
+        * bindings/js/JSNodeFilterCustom.cpp:
+        (WebCore::toNodeFilter):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::send):
+        * bindings/js/JSXSLTProcessorCustom.cpp:
+        (WebCore::JSXSLTProcessor::importStylesheet):
+        (WebCore::JSXSLTProcessor::transformToFragment):
+        (WebCore::JSXSLTProcessor::transformToDocument):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::callObjCFallbackObject):
+        * bridge/runtime_method.cpp:
+        (JSC::callRuntimeMethod):
+        Updated to new name, inherits, from old name, isObject.
+
+2009-08-14  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Allow Qt API to list and to remove URL schemes that were registered as
+        local URL schemes.
+        [Qt] Allow applications to register their own local URL scheme.
+        https://bugs.webkit.org/show_bug.cgi?id=28240
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::removeURLSchemeRegisteredAsLocal):
+        (WebCore::SecurityOrigin::localURLSchemes):
+        * page/SecurityOrigin.h:
+
+2009-08-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Wrap console objects late (in the frontend) so that injected
+        script was already in place.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28297
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addMessageToConsole):
+        (WebCore::InspectorController::startGroup):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::InspectorFrontend):
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        * inspector/InspectorFrontend.h:
+
+2009-08-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix logic in RenderObject::updateFillImages() that led to incorrect client
+        counts if an image was used twice in the background-image property.
+        https://bugs.webkit.org/show_bug.cgi?id=28295
+
+        Test: fast/backgrounds/multiple-backgrounds-assert.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::updateFillImages):
+        Simplify the logic to call addClient()/removeClient() for every background
+        image, but go through the new layers first to avoid removing all the
+        clients of an image.
+
+2009-08-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Devirtualise marking
+        https://bugs.webkit.org/show_bug.cgi?id=28294
+
+        Make sure we override the JSObject createStructure method on those
+        objects that have custom marking routines.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Follow-up to earlier work to remove dependencies on JavaScriptCore.
+
+        * ForwardingHeaders/parser/Parser.h: Removed.
+        * inspector/JavaScriptDebugServer.cpp: Removed now-unneeded includes
+        of Parser.h.
+
+2009-08-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        'box-orient: block-axis' behaves like 'box-orient: horizontal', causes
+        an assertion failure in debug builds
+        https://bugs.webkit.org/show_bug.cgi?id=28279
+
+        Test: fast/flexbox/block-axis.html
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::operator EBoxOrient): Map block-axis to
+        vertical.
+
+2009-08-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix crash when removing reflection on an absolutely-positioned image.
+        https://bugs.webkit.org/show_bug.cgi?id=28289
+        
+        Make sure we clean up the reflection layer when removing the reflection,
+        so that the RenderLayer tree does not contain pointers to deleted layers.
+
+        Test: fast/reflections/reflected-img-crash.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::~RenderLayer):
+        (WebCore::RenderLayer::styleChanged):
+        (WebCore::RenderLayer::removeReflection):
+        * rendering/RenderLayer.h:
+
+2009-08-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        misalignment because of float:left of <div> tag
+        https://bugs.webkit.org/show_bug.cgi?id=15869
+
+        One section of http://edgar.sec.gov site draws to the right of the rest
+        of the content
+        <rdar://problem/7135951>
+
+        Tests: fast/block/float/avoidance-percent-width-compat.html
+               fast/block/float/avoidance-percent-width-strict.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::getClearDelta): Changed to apply the same float
+            avoidance logic in strict mode and in compatibility mode, which
+            matches Firefox and IE. Changed to compute and use the computed
+            width of the child, instead of ignoring non-fixed widths.
+
+2009-08-13  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Geolocation PositionOptions does not use correct default values.
+        https://bugs.webkit.org/show_bug.cgi?id=27254
+
+        Sets the correct default values for the properties of the PositionOptions object
+        passed to Geolocation methods. See http://www.w3.org/TR/geolocation-API/.
+
+        Also adds checking to throw an exception if arguments of the incorrect type are
+        passed to Geolocation methods. Adds a layout test to test this. This test should
+        pass on all platforms where Geolocation is implemented.
+
+        Test: fast/dom/Geolocation/argument-types.html
+
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::createPositionCallback): Added. Creates the callback.
+        (WebCore::createPositionErrorCallback): Added. Creates the calback.
+        (WebCore::createPositionOptions): Added. Creates the PositionOptions object, setting defaults where required.
+        (WebCore::JSGeolocation::getCurrentPosition): Modified. Now uses above helper functions.
+        (WebCore::JSGeolocation::watchPosition): Modified. Now uses above helper functions.
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::GeoNotifier::GeoNotifier): Modified. Asserts that PositionOptions object is present.
+        (WebCore::Geolocation::GeoNotifier::startTimer): Modified. Only starts timer if timeout has been set.
+        * page/PositionOptions.h:
+        (WebCore::PositionOptions::create): Modified. Creates object with default values.
+        (WebCore::PositionOptions::timeout): Modified. Uses correct type.
+        (WebCore::PositionOptions::hasTimeout): Added. Determines whether a timeout has been set.
+        (WebCore::PositionOptions::setTimeout): Modified. Uses correct type.
+        (WebCore::PositionOptions::maximumAge): Modified. Uses correct type.
+        (WebCore::PositionOptions::setMaximumAge): Modified. Uses correct type.
+        (WebCore::PositionOptions::PositionOptions): Modified. Creates object with default values.
+
+2009-08-13  David Levin  <levin@chromium.org>
+
+        Unreviewed chromium build fix.
+
+        [Chromium] Let CodeGeneratorV8.pm know that RGBColor is ref-counted.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-08-13  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Merge error in SharedWorker code
+        https://bugs.webkit.org/show_bug.cgi?id=28277
+
+        Fixed merge error that prevents WebKit from compiling with SHARED_WORKERS enabled.
+        No new tests needed.
+
+        * workers/DefaultSharedWorkerRepository.cpp:
+        Removed duplicated functions.
+
+2009-08-13  Kyle Prete  <kylep@chromium.org>
+
+        Reviewed by Dave Levin.
+
+        Chromium: Show a "Playback Disabled" button on media error.
+        https://bugs.webkit.org/show_bug.cgi?id=28196
+        Use a disabled play button when the media file cannot be played.
+
+        No new tests needed. Covered by LayoutTests/media/video-empty-source.html
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton):
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Try and fix the Qt build.
+
+        * bridge/qt/qt_runtime.cpp:
+
+2009-08-13  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Drag and drop support
+        https://bugs.webkit.org/show_bug.cgi?id=23642
+
+        Utilizes functions that are being called upon drag and drop actions.
+        Uses different GTK clipboards that hold different types
+        of drag data - images, HTML markup, text, URL, URL label.
+        Also clears each clipboard before setting new data to it.
+
+        No new tests - despite some implementations, no new functionality
+        is added until implementations of the GTK drag and drop protocol
+        in WebKit part.
+
+        * platform/gtk/ClipboardGtk.cpp:
+        (WebCore::ClipboardGtk::ClipboardGtk):
+        (WebCore::ClipboardGtk::~ClipboardGtk):
+        (WebCore::getCachedImage):
+        (WebCore::ClipboardGtk::declareAndWriteDragImage):
+        (WebCore::ClipboardGtk::writeURL):
+        (WebCore::ClipboardGtk::writeRange):
+        * platform/gtk/ClipboardGtk.h: ClipboardGdk -> ClipboardGtk
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Levin.
+
+        JavaScriptCore tweaks to get ready for the parser arena
+        https://bugs.webkit.org/show_bug.cgi?id=28243
+
+        * ForwardingHeaders/runtime/CollectorHeapIterator.h: Removed.
+
+        * WebCore.xcodeproj/project.pbxproj: Exposed a couple header
+        files as Private that are now needed to compile Mac WebKit.
+
+        * bindings/js/JSAudioConstructor.cpp:
+        * bindings/js/JSDOMBinding.cpp:
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSHTMLInputElementCustom.cpp:
+        * bindings/js/JSHistoryCustom.cpp:
+        * bindings/js/JSImageConstructor.cpp:
+        * bindings/js/JSLazyEventListener.cpp:
+        * bindings/js/JSLocationCustom.cpp:
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        * bindings/js/JSOptionConstructor.cpp:
+        * bindings/js/JSWebSocketConstructor.cpp:
+        * bindings/js/JSWebSocketCustom.cpp:
+        * bindings/js/JSWorkerConstructor.cpp:
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        * bridge/jni/jni_jsobject.mm:
+        Updated includes.
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::sourceParsed):
+        Change to not assert if this is called with no listeners.
+        I don't think this was guaranteed before, and we now use
+        this code path when recompiling. Slightly less efficient,
+        but this is a one-time cost when turning on the debugger.
+        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
+        Change to call Debugger::recompileAllJSFunctions.
+
+2009-08-13  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        <rdar://problem/7138591> and https://bugs.webkit.org/show_bug.cgi?id=28260
+        onhashchange property cannot be set from javascript.
+
+        Test: fast/loader/onhashchange-attribute-listeners.html
+
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::onhashchange):
+        (WebCore::HTMLBodyElement::setOnhashchange):
+        * html/HTMLBodyElement.h:
+        * html/HTMLBodyElement.idl:
+
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::onhashchange):
+        (WebCore::HTMLFrameSetElement::setOnhashchange):
+        * html/HTMLFrameSetElement.h:
+        * html/HTMLFrameSetElement.idl:
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::onhashchange):
+        (WebCore::DOMWindow::setOnhashchange):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix leaks of RGBColor instances from below SVGColor::rgbColor.
+
+        * svg/SVGColor.cpp:
+        (WebCore::SVGColor::rgbColor): Return a PassRefPtr to ensure that the newly-allocated
+        RGBColor is cleaned up by the caller.
+        * svg/SVGColor.h:
+
+2009-08-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Migrate to DOMAgent (serialized access to DOM).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28177
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::highlightDOMNode):
+        (WebCore::JSInspectorBackend::nodeForId):
+        (WebCore::JSInspectorBackend::idForNode):
+        (WebCore::JSInspectorBackend::wrapObject):
+        (WebCore::JSInspectorBackend::unwrapObject):
+        (WebCore::JSInspectorBackend::pushNodePathToFrontend):
+        (WebCore::JSInspectorBackend::selectDatabase):
+        (WebCore::JSInspectorBackend::selectDOMStorage):
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/js/ScriptObjectQuarantine.h:
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::isObject):
+        * bindings/js/ScriptValue.h:
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/ScriptObjectQuarantine.h:
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::isObject):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::clearMessages):
+        (WebCore::InspectorBackend::loaded):
+        (WebCore::InspectorBackend::highlight):
+        (WebCore::InspectorBackend::nodeForId):
+        (WebCore::InspectorBackend::idForNode):
+        (WebCore::InspectorBackend::wrapObject):
+        (WebCore::InspectorBackend::unwrapObject):
+        (WebCore::InspectorBackend::pushNodePathToFrontend):
+        (WebCore::InspectorBackend::addNodesToSearchResult):
+        (WebCore::InspectorBackend::selectDatabase):
+        (WebCore::InspectorBackend::selectDOMStorage):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::focusNode):
+        (WebCore::InspectorController::addMessageToConsole):
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::startGroup):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::wrapObject):
+        (WebCore::InspectorController::unwrapObject):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setDocument):
+        (WebCore::InspectorDOMAgent::handleEvent):
+        (WebCore::InspectorDOMAgent::pushDocumentToFrontend):
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::nodeForId):
+        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
+        (WebCore::InspectorDOMAgent::innerParentElement):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::bind):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::clearConsoleMessages):
+        (WebCore::InspectorFrontend::updateFocusedNode):
+        (WebCore::InspectorFrontend::setDocument):
+        (WebCore::InspectorFrontend::selectDatabase):
+        (WebCore::InspectorFrontend::selectDOMStorage):
+        (WebCore::InspectorFrontend::addNodesToSearchResult):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.clearMessages):
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype._reportCompletions):
+        (WebInspector.ConsoleView.prototype._messagesClicked):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow.evalCallback):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleView.prototype._format):
+        (WebInspector.ConsoleView.prototype._formatfunction):
+        (WebInspector.ConsoleView.prototype._formatdate):
+        (WebInspector.ConsoleView.prototype._formatregexp):
+        (WebInspector.ConsoleView.prototype._formatnode):
+        (WebInspector.ConsoleView.prototype._formatobject):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        (WebInspector.DOMNode.prototype._renumber):
+        (WebInspector.DOMDocument):
+        (WebInspector.DOMAgent):
+        (WebInspector.DOMAgent.prototype.getChildNodesAsync):
+        (WebInspector.DOMAgent.prototype.setAttributeAsync):
+        (WebInspector.DOMAgent.prototype.removeAttributeAsync):
+        (WebInspector.DOMAgent.prototype.setTextNodeValueAsync):
+        (WebInspector.DOMAgent.prototype.nodeForId):
+        (WebInspector.DOMAgent.prototype._setDocument):
+        (WebInspector.DOMAgent.prototype._setChildNodes):
+        (WebInspector.DOMAgent.prototype._bindNodes):
+        (WebInspector.DOMAgent.prototype._childNodeInserted):
+        (WebInspector.CSSStyleDeclaration):
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        (WebInspector.setDocument):
+        (InspectorController.getStyles):
+        (InspectorController.getComputedStyle):
+        (InspectorController.getInlineStyle):
+        (InspectorController.applyStyleText):
+        (InspectorController.setStyleText):
+        (InspectorController.toggleStyleEnabled):
+        (InspectorController.applyStyleRuleText):
+        (InspectorController.addStyleSelector):
+        (InspectorController.setStyleProperty):
+        (InspectorController.getPrototypes):
+        (InspectorController.getProperties):
+        (InspectorController.setPropertyValue):
+        (InspectorController.evaluate):
+        (InspectorController.addInspectedNode):
+        (InspectorController.performSearch):
+        (InspectorController.searchCanceled):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        (WebInspector.ElementsPanel.prototype._updateMatchesCount):
+        (WebInspector.ElementsPanel.prototype._updateMatchesCountSoon):
+        (WebInspector.ElementsPanel.prototype.addNodesToSearchResult):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode.restoreHighlightToHoveredNode):
+        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode):
+        (WebInspector.ElementsTreeElement.prototype.updateChildren):
+        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.applyStyleRuleText):
+        (InjectedScript.addStyleSelector):
+        (InjectedScript._doesSelectorAffectNode):
+        (InjectedScript._serializeRule):
+        (InjectedScript._serializeStyle):
+        (InjectedScript.getProperties):
+        (InjectedScript.evaluate):
+        (InjectedScript.addInspectedNode):
+        (InjectedScript.performSearch.addNodesToResults):
+        (InjectedScript.performSearch.matchExactItems):
+        (InjectedScript.performSearch.matchExactId.addNodesToResults.call):
+        (InjectedScript.performSearch.matchExactId):
+        (InjectedScript.performSearch):
+        (InjectedScript.performSearch.matchExactTagNames):
+        (InjectedScript.performSearch.matchExactAttributeNames):
+        (InjectedScript.performSearch.matchPartialTagNames):
+        (InjectedScript.performSearch.matchStartOfTagNames):
+        (InjectedScript.performSearch.matchPartialTagNamesAndAttributeValues):
+        (InjectedScript.performSearch.matchPartialAttributeValues):
+        (InjectedScript.performSearch.matchStyleSelector):
+        (InjectedScript.performSearch.matchPlainText):
+        (InjectedScript.performSearch.matchXPathQuery):
+        (InjectedScript.performSearch.finishedSearching):
+        (InjectedScript.performSearch.processChunk):
+        (InjectedScript.searchCanceled):
+        (InjectedScript._ensureCommandLineAPIInstalled.inspectObject):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+        (InjectedScript._resolveObject):
+        (InjectedScript._nodeForId):
+        (InjectedScript._objectForId):
+        (InjectedScript._createProxyObject):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy):
+        (WebInspector.ObjectPropertyProxy):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
+        (WebInspector.PropertiesSidebarPane.prototype.update):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update.callback):
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCancelled):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted.callback):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/inspector.js:
+        (WebInspector._updateHoverHighlight):
+        (WebInspector.loaded):
+        (WebInspector.clearConsoleMessages):
+        (WebInspector.selectDatabase):
+        (WebInspector.selectDOMStorage):
+        (WebInspector.updateFocusedNode):
+        (WebInspector.addNodesToSearchResult):
+        * inspector/front-end/utilities.js:
+        (Object.proxyType):
+        * storage/Storage.h:
+        (WebCore::Storage::frame):
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix leaks of RGBColor instances from below CSSPrimitiveValue::getRGBColorValue.
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::getRGBColorValue): Return a PassRefPtr to ensure that the
+        newly-allocated RGBColor is cleaned up by the caller.
+        * css/CSSPrimitiveValue.h:
+
+2009-08-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        wrong font size when css font-family includes monospace
+        https://bugs.webkit.org/show_bug.cgi?id=19161
+
+        Firefox only uses fixed-width default size for exactly "font-family: monospace;".
+        WebKit has historically used fixed-width default size any time a
+        font-family includes monospace in the fallback list.
+
+        This patch corrects WebKit's behavior to match Firefox.
+        I also had to fix a bug in WebKit's font-family fallback behavior where
+        child elements would inherit parts of their parents fallback lists.
+
+        This patch is mostly just replacing all cases where we used to check for:
+        fontDescription.genericFontFamily() == MonospaceFamily
+        with:
+        fontDescription.useFixedDefaultSize()
+
+        Tests: fast/css/getComputedStyle/computed-style-font-family-monospace.html
+               fast/css/getComputedStyle/font-family-fallback-reset.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+           Deploy useFixedDefaultSize().  Also fix the bug where child
+           FontDescriptions would carry part of the parent font-family fallback list.
+        (WebCore::CSSStyleSelector::checkForGenericFamilyChange):
+           It's no longer alright to just check genericFontFamily(),
+           we have to check to make sure the changed style has a matching useFixedDefaultSize().
+        * platform/graphics/FontDescription.h:
+        (WebCore::FontDescription::useFixedDefaultSize):
+           Only use the fixed default size if we have one font family and it is "monospace".
+           "-webkit-monospace" is the internal representation of the CSS identifier "monospace".
+
+2009-08-13  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [v8] Fix atomic string externalization crash.
+        Atomic string externalization assumes that all non-empty strings
+        can be externalized which is untrue on 64-bit.  This change fixed
+        that.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28215
+
+        This bug causes loads of test crashes, no need to add new tests
+        specifically for this.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8StringToAtomicWebCoreString):
+
+2009-08-13  George Staikos  <george.staikos@torchmobile.com>
+
+        Rubberstamped by Darin Adler.
+
+        Use ASSERT_UNUSED instead of UNUSED_PARAM
+
+        * wml/WMLAnchorElement.cpp:
+        (WebCore::WMLAnchorElement::deregisterTask):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::deregisterTask):
+
+2009-08-13  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes a couple of bugs in SecurityOrigin::createFromDatabaseIdentifier.
+        https://bugs.webkit.org/show_bug.cgi?id=28262
+
+        No new tests possible.
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::createFromDatabaseIdentifier):
+
+2009-08-13  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [CAIRO] getImageData fails on a given rect bigger than the image rect
+
+        The destination image and the source image was mixed up on creating the
+        imageData.
+
+        This is just a clean up and doesn't affect the current behavior. It's not
+        possible to test this failure in a LayoutTest. Only canvas uses getImageData
+        at the moment and returns before calling getImageData, if the image rect does
+        not contain the requested rect.
+
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::getImageData):
+
+2009-08-13  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding RenderTheme to WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=28258
+
+        * platform/haiku/RenderThemeHaiku.cpp: Added.
+        (WebCore::RenderThemeHaiku::create):
+        (WebCore::RenderTheme::themeForPage):
+        (WebCore::RenderThemeHaiku::RenderThemeHaiku):
+        (WebCore::RenderThemeHaiku::~RenderThemeHaiku):
+        (WebCore::supportsFocus):
+        (WebCore::RenderThemeHaiku::supportsFocusRing):
+        (WebCore::RenderThemeHaiku::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeHaiku::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderThemeHaiku::platformActiveSelectionForegroundColor):
+        (WebCore::RenderThemeHaiku::platformInactiveSelectionForegroundColor):
+        (WebCore::RenderThemeHaiku::platformTextSearchHighlightColor):
+        (WebCore::RenderThemeHaiku::systemFont):
+        (WebCore::RenderThemeHaiku::paintCheckbox):
+        (WebCore::RenderThemeHaiku::setCheckboxSize):
+        (WebCore::RenderThemeHaiku::paintRadio):
+        (WebCore::RenderThemeHaiku::setRadioSize):
+        (WebCore::RenderThemeHaiku::adjustMenuListStyle):
+        (WebCore::RenderThemeHaiku::paintMenuList):
+        * platform/haiku/RenderThemeHaiku.h: Added.
+        (WebCore::RenderThemeHaiku::supportsHover):
+
+2009-08-13  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Remove the "m_point" code from ContextMenuHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28256
+
+        * platform/haiku/ContextMenuHaiku.cpp:
+        (WebCore::ContextMenuReceiver::ContextMenuReceiver):
+        (WebCore::ContextMenu::ContextMenu):
+        (WebCore::ContextMenu::appendItem):
+        (WebCore::ContextMenu::insertItem):
+
+2009-08-13  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Inspector: Show Hidden Cookie Data
+        https://bugs.webkit.org/show_bug.cgi?id=28185
+
+          Added new file Cookie.h to the WebCore XCode
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+          InspectorController.cookies() binding
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::cookies):
+        * inspector/InspectorBackend.idl:
+
+          Struct for static Cookie information
+          (name, value, path, domain, expires, httpOnly, secure, session)
+
+        * platform/Cookie.h: Added.
+        (WebCore::Cookie::Cookie):
+        
+          Getter for the a list of raw Cookies
+          getRawCookies(., ., out Vector<Cookie>)
+        
+        * platform/CookieJar.h:
+
+          Implementation of getRawCookies for the mac platform.
+
+        * platform/mac/CookieJar.mm:
+        (WebCore::getRawCookies):
+
+          Stub other CookieJar implementations to satisfy the interface.
+
+        * platform/haiku/CookieJarHaiku.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/curl/CookieJarCurl.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/win/CookieJarWin.cpp:
+        (WebCore::getRawCookies):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::getRawCookies):
+
+2009-08-13  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Add a new gesture in Web Inspector to remove breakpoints
+        https://bugs.webkit.org/show_bug.cgi?id=19131
+        
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._documentMouseDown):
+
+2009-08-13  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Symbian target components (library and executable files)
+        require Unique Identifiers (i.e., UID3).
+        These identifiers are defined in the respective project
+        file, conditionally for "symbian" platform.
+
+        * WebCore.pro:
+
+2009-08-13  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        wrong calculation of overflow size for flexbox and table
+        https://bugs.webkit.org/show_bug.cgi?id=28064
+
+        RenderFlexibleBox and RenderTable were using the width of overflow
+        to update height of overflow, so height became wrong value and
+        width was not updated. As the corresponding code of RenderBlock
+        was sane, I factored it out and used from RenderFlexibleBox and
+        RenderTable.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateOverflowWithShadowAndReflection): created from code of layoutBlock
+        (WebCore::RenderBlock::layoutBlock):
+        * rendering/RenderBlock.h:
+        * rendering/RenderFlexibleBox.cpp: use updateOverflowWithShadowAndReflection
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout): use updateOverflowWithShadowAndReflection
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Revert r47185, the fix for <https://bugs.webkit.org/show_bug.cgi?id=28185>, as it broke the
+        Windows build in a non-obvious manner.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * inspector/InspectorBackend.idl:
+        * platform/Cookie.h: Removed.
+        * platform/CookieJar.h:
+        * platform/haiku/CookieJarHaiku.cpp:
+        (WebCore::setCookies):
+        (WebCore::cookies):
+        * platform/mac/CookieJar.mm:
+        * platform/network/chromium/CookieJarChromium.cpp:
+        * platform/network/curl/CookieJarCurl.cpp:
+        * platform/network/soup/CookieJarSoup.cpp:
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        * platform/network/win/CookieJarWin.cpp:
+        * platform/qt/CookieJarQt.cpp:
+
+2009-08-13  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Not reviewed: build fix (for r47192), adding new file from
+        https://bugs.webkit.org/show_bug.cgi?id=28174
+
+        * inspector/front-end/StatusBarButton.js: Added.
+
+2009-08-13  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Introduced StatusBarButton class that encapsulates glyphs support.
+        Views updated accordingly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28174
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.get statusBarItems): Updated to retrieve DOM element from StatusBarButton instance (here and in similar getters below.)
+        (WebInspector.CookieItemsView.prototype.hide):
+        (WebInspector.CookieItemsView.prototype.update):
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView):
+        (WebInspector.DOMStorageItemsView.prototype.get statusBarItems):
+        (WebInspector.DOMStorageItemsView.prototype.hide):
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype.get statusBarItems):
+        (WebInspector.ElementsPanel.prototype.hide):
+        (WebInspector.ElementsPanel.prototype._nodeSearchButtonClicked):
+        * inspector/front-end/Panel.js:
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView):
+        (WebInspector.ProfileView.prototype.get statusBarItems):
+        (WebInspector.ProfileView.prototype._updatePercentButton):
+        (WebInspector.ProfileView.prototype._focusClicked):
+        (WebInspector.ProfileView.prototype._excludeClicked):
+        (WebInspector.ProfileView.prototype._resetClicked):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
+        (WebInspector.ProfilesPanel.prototype.setRecordingProfile):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.get statusBarItems):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype._toggleLargerResources):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.get statusBarItems):
+        (WebInspector.ScriptsPanel.prototype._updatePauseOnExceptionsButton):
+        (WebInspector.ScriptsPanel.prototype._updateDebuggerButtons):
+        * inspector/front-end/StatusBarButton.js: Added.
+        (WebInspector.StatusBarButton):
+        (WebInspector.StatusBarButton.prototype._clicked):
+        (WebInspector.StatusBarButton.prototype.get disabled):
+        (WebInspector.StatusBarButton.prototype.set disabled):
+        (WebInspector.StatusBarButton.prototype.get title):
+        (WebInspector.StatusBarButton.prototype.set title):
+        (WebInspector.StatusBarButton.prototype.get toggled):
+        (WebInspector.StatusBarButton.prototype.set toggled):
+        (WebInspector.StatusBarButton.prototype.get visible):
+        (WebInspector.StatusBarButton.prototype.set visible):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css: For uniformity, class names are always used to identify status bar buttons. Also, fixed "Reload" button style to use glyphs.
+        * inspector/front-end/inspector.html:
+
+2009-08-12  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add shadow support in GraphicsContext::fillRect().
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillRect): Paint shadow if necessary.
+        (WebCore::GraphicsContext::setPlatformShadow): Inverse y offset.
+
+2009-08-13  David Levin  <levin@chromium.org>
+
+        Unreviewed build fix for Chromium Linux.
+
+        Rollback r47157 as this broke debug tests of Chromium Linux.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-13  David Levin  <levin@chromium.org>
+
+        Unreviewed build fix for chromium.
+
+        The chromium build broke due to r47185 which added
+        a cookies array to inspector/InspectorBackend.idl.
+
+        * bindings/v8/custom/V8CustomBinding.h: Added the declaration for the cookies callback.
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL(InspectorBackendCookies)): Stubbed out an implementation
+         for the cookies callback.
+
+2009-08-12  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Show Hidden Cookie Data
+        https://bugs.webkit.org/show_bug.cgi?id=28185
+
+          Added new file Cookie.h to the WebCore XCode
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+          InspectorController.cookies() binding
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::cookies):
+        * inspector/InspectorBackend.idl:
+
+          Struct for static Cookie information
+          (name, value, path, domain, expires, httpOnly, secure, session)
+
+        * platform/Cookie.h: Added.
+        (WebCore::Cookie::Cookie):
+        
+          Getter for the a list of raw Cookies
+          getRawCookies(., ., out Vector<Cookie>)
+        
+        * platform/CookieJar.h:
+
+          Implementation of getRawCookies for the mac platform.
+
+        * platform/mac/CookieJar.mm:
+        (WebCore::getRawCookies):
+
+          Stub other CookieJar implementations to satisfy the interface.
+
+        * platform/haiku/CookieJarHaiku.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/curl/CookieJarCurl.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/win/CookieJarWin.cpp:
+        (WebCore::getRawCookies):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::getRawCookies):
+
+2009-08-08  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Cookies in Storage Panel
+        https://bugs.webkit.org/show_bug.cgi?id=27202
+
+          Data Structure for a Cookie. Just Key/Value for Now:
+
+        * inspector/front-end/Cookie.js: Added.
+        (WebInspector.Cookie):
+        (WebInspector.Cookie.prototype.get key):
+        (WebInspector.Cookie.prototype.set key):
+        (WebInspector.Cookie.prototype.get value):
+        (WebInspector.Cookie.prototype.set value):
+
+          A Storage View for Cookies.  Allows for Refresh/Delete:
+
+        * inspector/front-end/CookieItemsView.js: Added.
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.get statusBarItems): refresh and delete buttons
+        (WebInspector.CookieItemsView.prototype.show):
+        (WebInspector.CookieItemsView.prototype.hide):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype.buildCookies): parses the inspected window's document.cookie string
+        (WebInspector.CookieItemsView.prototype.dataGridForCookies): creates a datagrid for cookies
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked): attempt at deleting the cookie (not flawless)
+        (WebInspector.CookieItemsView.prototype._refreshButtonClicked): rebuild the datagrid
+
+          Include a SidebarSection Section in the Databases Panel:
+
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel):
+        (WebInspector.DatabasesPanel.prototype.show): calls populateInterface
+        (WebInspector.DatabasesPanel.prototype.populateInterface): adds cookies if they don't exist
+        (WebInspector.DatabasesPanel.prototype.reset): remove cookie specific parts
+        (WebInspector.DatabasesPanel.prototype.addCookies): add cookies sidebar tree element
+        (WebInspector.DatabasesPanel.prototype.showCookies): sets the visible view to a CookiesItemView
+        (WebInspector.CookieSidebarTreeElement):
+        (WebInspector.CookieSidebarTreeElement.prototype.onselect):
+        (WebInspector.CookieSidebarTreeElement.prototype.get mainTitle): just "Cookies" at the moment
+        (WebInspector.CookieSidebarTreeElement.prototype.set mainTitle):
+        (WebInspector.CookieSidebarTreeElement.prototype.get subtitle): no subtitle yet
+        (WebInspector.CookieSidebarTreeElement.prototype.set subtitle):
+
+          New "Cookies" Image for the Sidebar:
+
+        * inspector/front-end/Images/cookie.png: Added.
+        * inspector/front-end/inspector.css:
+
+          Include the Added Files where appropriate:
+
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2009-08-12  George Wright  <george.wright@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Add SQLTransactionCoordinator.[h,cpp] to WebCore.pro.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28246
+
+        * WebCore.pro:
+
+2009-08-12  George Staikos  <george.staikos@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Mark unused variables to avoid compile failures in -Werror.
+
+        * wml/WMLAnchorElement.cpp:
+        (WebCore::WMLAnchorElement::deregisterTask):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::deregisterTask):
+
+2009-08-12  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by Niko Zimmermann.
+
+        This is to add WCSS marquee support , which is defined by OMA and is an extension for CSS2, 
+        It extends CSS display with "display:-wap-marquee;-wap-marquee-dir:xxx;-wap-marquee-speed:xxx;-wap-marquee-style:xxx"
+        Minor fixes by Eric Seidel and George Staikos.
+        https://bugs.webkit.org/show_bug.cgi?id=23727
+
+        No new tests, the tests have already been landed at LayoutTests/fast/wcss/
+
+        * WebCore.pro:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+        * css/WCSSPropertyNames.in: Added.
+        * css/WCSSValueKeywords.in: Added.
+        * rendering/RenderMarquee.cpp:
+        (WebCore::RenderMarquee::start):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createObject):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-08-12  George Wright  <george.wright@torchmobile.com>
+
+        Reviewed by David Hyatt.
+
+        Update the canvas renderer's intrinsic size with the zoomed
+        lengths and ensure the intrinsic size is correct when setting
+        an initial style.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26908
+
+        Test: fast/canvas/canvas-zoom.html
+
+        * rendering/RenderHTMLCanvas.cpp:
+        (WebCore::RenderHTMLCanvas::canvasSizeChanged):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::styleDidChange):
+
+2009-08-12  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Fix regression for dragging the media controller thumb.
+        https://bugs.webkit.org/show_bug.cgi?id=28211
+
+        Modified the conditions for rejecting events on the media controller
+        to only rejecting mouse events not from the left button.
+
+        Test: media/controls-drag-timebar.html
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlTimelineElement::defaultEventHandler):
+
+2009-08-12  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fixing a deadlock caused by two transactions that run on two
+        different database handles for the same DB. Adding a per-DB thread
+        transaction coordinator that allows the DB thread to run only one
+        transaction per DB file at any given time.
+
+        Adding a regression test for this bug.
+
+        Test: storage/multiple-transactions-on-different-handles.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=27966
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * storage/Database.cpp:
+        (WebCore::Database::transactionCoordinator):
+        * storage/Database.h:
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        * storage/DatabaseThread.h:
+        (WebCore::DatabaseThread::transactionCoordinator):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::SQLTransaction):
+        (WebCore::SQLTransaction::debugStepName):
+        (WebCore::SQLTransaction::performNextStep):
+        (WebCore::SQLTransaction::aquireLock):
+        (WebCore::SQLTransaction::lockAquired):
+        (WebCore::SQLTransaction::cleanupAfterSuccessCallback):
+        (WebCore::SQLTransaction::cleanupAfterTransactionErrorCallback):
+        * storage/SQLTransaction.h:
+        * storage/SQLTransactionCoordinator.cpp: Added.
+        * storage/SQLTransactionCoordinator.h: Added.
+
+2009-08-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Custom properties on DOM objects are lost after GC (as demonstrated by the gc-9.html test)
+        https://bugs.webkit.org/show_bug.cgi?id=28194
+
+        * GNUmakefile.am: Added the two new source files.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+
+        * bindings/js/JSCSSRuleListCustom.cpp: Added.
+        (WebCore::JSCSSRuleList::markChildren): Call markDOMObjectWrapper
+        on rules in the list.
+
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::JSCSSStyleDeclaration::markChildren): Added. Call
+        markDOMObjectWrapper on the CSSValue objects that are owned by the
+        declaration as values of the properties.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::isObservableThroughDOM): Added code to handle some
+        cases where nodes are observable because they own objects that
+        in turn have custom properties.
+
+        * bindings/js/JSDOMBinding.h: Fix a typo in the header.
+
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::markChildren): Added call to markDOMObjectWrapper
+        for implementation and styleSheets.
+
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::JSElement::markChildren): Added. Calls markDOMObjectWrapper
+        for attributes and style.
+
+        * bindings/js/JSHTMLCanvasElementCustom.cpp: Added.
+        (WebCore::JSHTMLCanvasElement::markChildren): Call markDOMObjectWrapper
+        on the rendering context.
+
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::JSStyleSheet::markChildren): Call markDOMObjectWrapper on
+        items in the stylesheet.
+
+        * bindings/js/JSStyleSheetListCustom.cpp:
+        (WebCore::JSStyleSheetList::markChildren): Added. Calls
+        markDOMObjectWrapper on stylesheets in the list.
+
+        * css/CSSRuleList.idl: Added CustomMarkFunction.
+        * css/CSSStyleDeclaration.idl: Ditto.
+        * css/StyleSheetList.idl: Ditto.
+        * dom/Element.idl: Ditto.
+        * html/HTMLCanvasElement.idl: Ditto.
+
+        * dom/Element.h: Made everything private that could be.
+        Added access to the attributeMap that does returns
+        the existing map without doing any of the lazy-updating work. This
+        is needed to get at the existing attributes during garbage collection
+        without having side effects.
+
+        * html/HTMLCanvasElement.h: Cleaned up the header a bit, making
+        members private. Added renderingContext2D function for use in
+        JSHTMLCanvasElement::markChildren.
+
+2009-08-12  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Fixes two bugs about Pan Scrolling - Scrolling with middle mouse button doesn't 
+        work in Expanded view on reader.google.com, and Can enter auto scroll from a non-scrollable area.
+        https://bugs.webkit.org/show_bug.cgi?id=28023
+        https://bugs.webkit.org/show_bug.cgi?id=24794
+        
+        Added a new method to RenderBox seeing if the Box can be scrolled and actually has something to
+        scroll, and use that for pan scrolling.
+
+        Test: platform/win/fast/events/panScroll-nested-divs.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMouseDraggedEvent):
+        (WebCore::EventHandler::updateAutoscrollRenderer):
+        (WebCore::EventHandler::handleMousePressEvent):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::canBeScrolledAndHasScrollableArea):
+        * rendering/RenderBox.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollByRecursively):
+
+2009-08-12  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fix of <rdar://6728361> Mouse wheel scrolling on a page with expanded drop down 
+        list detaches drop down.
+
+        Added a function for Windows PopupMenu's to return their class name.
+
+         * platform/PopupMenu.h:
+         * platform/win/PopupMenuWin.cpp:
+         (WebCore::PopupMenu::popupClassName):
+
+2009-08-12  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        WINCE PORT: Color and Gradient
+        https://bugs.webkit.org/show_bug.cgi?id=27511
+
+        * platform/graphics/wince/ColorWince.cpp: Added.
+        * platform/graphics/wince/GradientWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        fix a typo in platform/graphics/skia/PlatformContextSkia.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28172
+
+        No new tests because it's a just typo fix.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-12  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27458
+        Support for the :default CSS pseudoclass, as per HTML5 spec.
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/interactive-elements.html#selector-default
+
+        Tests: fast/css/pseudo-default-001.html
+               fast/css/pseudo-default-002.html
+               fast/css/pseudo-default-003.html
+               fast/css/pseudo-default-004.html
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType): pseudoDefault
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithElement): sharing stuff is
+        aware that only one default button can be present in a form
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): applies
+        the :default CSS pseudoclass
+        * dom/Element.h:
+        (WebCore::Element::isDefaultButtonForForm): new method to determine
+        whether a FormControl is a default button for a given form
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::isDefaultButtonForForm): ditto
+        * html/HTMLFormControlElement.h:
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::defaultButton): extracts the default button
+        from the form
+        * html/HTMLFormElement.h:
+
+2009-08-12  David Levin  <levin@chromium.org>
+
+        No review, rolling out r47106.
+        https://bugs.webkit.org/show_bug.cgi?id=28215
+
+        This patch relied on a new version of v8 which is not available
+        in chromium yet.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8StringToAtomicWebCoreString):
+
+2009-08-12  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 26993 : Geolocation::requestPermission()
+        https://bugs.webkit.org/show_bug.cgi?id=26993
+
+        Second patch to allow the Geolocation permission request to chrome to be asynchronous
+        or synchronous. Fixes a bug where callbacks were called twice when permissions
+        are granted synchronously.
+
+        No new tests required.
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::setIsAllowed): Modified. Calls makeSuccessCallbacks() rather than geolocationServicePositionChanged().
+        (WebCore::Geolocation::geolocationServicePositionChanged): Modified. Updated logic to avoid repeated callbacks when permissions are granted synchronously.
+        (WebCore::Geolocation::makeSuccessCallbacks): Added. Calls success callbacks.
+        * page/Geolocation.h: Modified. Adds makeSuccessCallbacks().
+
+2009-08-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6952336>
+        CrashTracer: [USER] 3 crashes in Safari at com.apple.WebCore • WebCore::SecurityOrigin::canAccess const + 27
+
+        Make sure to set the security origin before calling dispatchWindowObjectAvailable.
+        
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+
+2009-08-12  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix [Chromium] drop down menu letter selection, skip selections
+        https://bugs.webkit.org/show_bug.cgi?id=28205
+
+        Not auto-testable since it is chromim platform specific code, and it involves sending a keyboard 
+        event to the popup, which is not possible (eventSender sends the key
+        events through webview, we want to go through the webwidget).
+
+        * manual-tests/keyboard_select_elements_with_same_beginning.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::isCharacterTypeEvent): style change.
+        (WebCore::PopupListBox::handleKeyEvent): typeAheadFind should be called only when the event is
+        a character type event to avoid calling twice for English.
+        (WebCore::PopupListBox::typeAheadFind): remove unnecessary checking of isCharacterTypeEvent() since the whole function is only called under that condition.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding GraphicsContext to WebCore/platform/graphics/haiku.
+        https://bugs.webkit.org/show_bug.cgi?id=28130
+
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp: Added.
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContextPlatformPrivate::~GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContext::GraphicsContext):
+        (WebCore::GraphicsContext::~GraphicsContext):
+        (WebCore::GraphicsContext::platformContext):
+        (WebCore::GraphicsContext::savePlatformState):
+        (WebCore::GraphicsContext::restorePlatformState):
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::drawEllipse):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::beginPath):
+        (WebCore::GraphicsContext::addPath):
+        (WebCore::GraphicsContext::clip):
+        (WebCore::GraphicsContext::drawFocusRing):
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
+        (WebCore::GraphicsContext::roundToDevicePixels):
+        (WebCore::GraphicsContext::beginTransparencyLayer):
+        (WebCore::GraphicsContext::endTransparencyLayer):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::strokeRect):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::GraphicsContext::setMiterLimit):
+        (WebCore::GraphicsContext::setAlpha):
+        (WebCore::GraphicsContext::setCompositeOperation):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipToImageBuffer):
+        (WebCore::GraphicsContext::getCTM):
+        (WebCore::GraphicsContext::translate):
+        (WebCore::GraphicsContext::origin):
+        (WebCore::GraphicsContext::rotate):
+        (WebCore::GraphicsContext::scale):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::concatCTM):
+        (WebCore::GraphicsContext::setPlatformShouldAntialias):
+        (WebCore::GraphicsContext::setImageInterpolationQuality):
+        (WebCore::GraphicsContext::setURLForRect):
+        (WebCore::GraphicsContext::setPlatformFont):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::getHaikuStrokeStyle):
+        (WebCore::GraphicsContext::setPlatformStrokeStyle):
+        (WebCore::GraphicsContext::setPlatformStrokeThickness):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+        (WebCore::GraphicsContext::clearPlatformShadow):
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Modifying WebCore/platform/graphics files to allow Haiku port.
+        https://bugs.webkit.org/show_bug.cgi?id=28128
+
+        * platform/graphics/BitmapImage.h: Adding getBBitmap() function.
+        * platform/graphics/Color.h: rgb_color is the Color struct in Haiku.
+        * platform/graphics/FloatPoint.h: BPoint is the Point class in Haiku.
+        * platform/graphics/FloatRect.h: BRect is the Rect class in Haiku.
+        * platform/graphics/GraphicsContext.cpp: 
+        * platform/graphics/GraphicsContext.h: BView is the PlatformGraphicsContext
+        class for Haiku. Adding getHaikuStrokeStyle() function.
+        * platform/graphics/Icon.h: Adding an empty Icon() constructor because
+        this class isn't implemented for the moment.
+        * platform/graphics/ImageSource.h: BBitmap is the native bitmap class 
+        for Haiku.
+        * platform/graphics/IntPoint.h: BPoint is the Point class in Haiku.
+        * platform/graphics/IntRect.h: BRect is the Rect class in Haiku.
+        * platform/graphics/IntSize.h: BSize is the Size class in Haiku.
+        * platform/graphics/Path.h: BRegion is the Path class in Haiku.
+        * platform/graphics/Pattern.h: Adding the GraphicsDef.h header and the 
+        native pattern type.
+        * platform/graphics/SimpleFontData.h: Adding Haiku's Font.h header.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding modification to the WebCore/platform/ files to allow
+        the Haiku port.
+        https://bugs.webkit.org/show_bug.cgi?id=28128
+
+        * platform/ContextMenuItem.h: BMenu is the PlatformMenuItemDescription
+        class of Haiku.
+        * platform/Cursor.h: BCursor is the Cursor class of Haiku.
+        * platform/DragData.h: Use a BMessage as DragDataRef.
+        * platform/DragImage.h: Use a BBitmap as DragImageRef.
+        * platform/PlatformKeyboardEvent.h: Use BMessage as event vehicle.
+        * platform/PlatformMenuDescription.h: BMenu is the 
+        PlatformMenuDescription class of Haiku.
+        * platform/PlatformMouseEvent.h: Use BMessage as event vehicle.
+        * platform/PlatformWheelEvent.h: Use BMessage as event vehicle.
+        * platform/PopupMenu.h: Adding a m_menu attribute for Haiku.
+        * platform/Widget.h: BView is the PlatformWidget class of Haiku.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Tiny modifications on WebCore files to allow Haiku port.
+        https://bugs.webkit.org/show_bug.cgi?id=28128
+
+        * bindings/js/ScriptControllerHaiku.cpp: Style cleanup.
+        * loader/CachedFont.cpp: Haiku behaves like Qt, Gtk, or Chromium,
+        so many PLATFORM(HAIKU) were added to these functions.
+        (WebCore::CachedFont::~CachedFont):
+        (WebCore::CachedFont::ensureCustomFontData):
+        (WebCore::CachedFont::platformDataFromCustomData):
+        (WebCore::CachedFont::allClientsRemoved):
+        * page/EventHandler.cpp: Like the mac and Qt port, Haiku doesn't need the
+        invertSenseOfTabsToLinks() function.
+        * page/haiku/DragControllerHaiku.cpp: Style cleanup.
+        * platform/image-decoders/ImageDecoder.h: For image decoding Haiku
+        behaves like Cairo or Wx, (not like Skia).
+        (WebCore::RGBA32Buffer::getAddr):
+        * platform/text/PlatformString.h: Adding the String(BString&) and BString()
+        methods specific to Haiku.
+        * platform/text/UnicodeRange.h: Haiku needs to include stdint.h.
+        * platform/text/haiku/TextBreakIteratorInternalICUHaiku.cpp:
+        (WebCore::currentSearchLocaleID): Missing function.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding the ScrollbarTheme files.
+        https://bugs.webkit.org/show_bug.cgi?id=28125
+
+        * platform/haiku/ScrollbarThemeHaiku.cpp: Added.
+        (buttonWidth):
+        (WebCore::ScrollbarTheme::nativeTheme):
+        (WebCore::ScrollbarThemeHaiku::ScrollbarThemeHaiku):
+        (WebCore::ScrollbarThemeHaiku::~ScrollbarThemeHaiku):
+        (WebCore::ScrollbarThemeHaiku::scrollbarThickness):
+        (WebCore::ScrollbarThemeHaiku::hasButtons):
+        (WebCore::ScrollbarThemeHaiku::hasThumb):
+        (WebCore::ScrollbarThemeHaiku::backButtonRect):
+        (WebCore::ScrollbarThemeHaiku::forwardButtonRect):
+        (WebCore::ScrollbarThemeHaiku::trackRect):
+        (WebCore::ScrollbarThemeHaiku::paintScrollbarBackground):
+        (WebCore::ScrollbarThemeHaiku::paintButton):
+        (WebCore::ScrollbarThemeHaiku::paintThumb):
+        * platform/haiku/ScrollbarThemeHaiku.h: Added.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding eight simple files to WebCore/platform/graphics/haiku.
+        https://bugs.webkit.org/show_bug.cgi?id=28122
+
+        * platform/graphics/haiku/ColorHaiku.cpp: Added.
+        (WebCore::Color::Color):
+        (WebCore::Color::operator rgb_color):
+        (WebCore::focusRingColor):
+        * platform/graphics/haiku/FloatPointHaiku.cpp: Added.
+        (WebCore::FloatPoint::FloatPoint):
+        (WebCore::FloatPoint::operator BPoint):
+        * platform/graphics/haiku/FloatRectHaiku.cpp: Added.
+        (WebCore::FloatRect::FloatRect):
+        (WebCore::FloatRect::operator BRect):
+        * platform/graphics/haiku/GradientHaiku.cpp: Added.
+        (WebCore::Gradient::platformDestroy):
+        (WebCore::Gradient::platformGradient):
+        (WebCore::Gradient::fill):
+        * platform/graphics/haiku/IntPointHaiku.cpp: Added.
+        (WebCore::IntPoint::IntPoint):
+        (WebCore::IntPoint::operator BPoint):
+        * platform/graphics/haiku/IntRectHaiku.cpp: Added.
+        (WebCore::IntRect::IntRect):
+        (WebCore::IntRect::operator BRect):
+        * platform/graphics/haiku/IntSizeHaiku.cpp: Added.
+        (WebCore::IntSize::IntSize):
+        (WebCore::IntSize::operator BSize):
+        * platform/graphics/haiku/PathHaiku.cpp: Added.
+        (WebCore::Path::Path):
+        (WebCore::Path::~Path):
+        (WebCore::Path::operator=):
+        (WebCore::Path::hasCurrentPoint):
+        (WebCore::Path::contains):
+        (WebCore::Path::translate):
+        (WebCore::Path::boundingRect):
+        (WebCore::Path::moveTo):
+        (WebCore::Path::addLineTo):
+        (WebCore::Path::addQuadCurveTo):
+        (WebCore::Path::addBezierCurveTo):
+        (WebCore::Path::addArcTo):
+        (WebCore::Path::closeSubpath):
+        (WebCore::Path::addArc):
+        (WebCore::Path::addRect):
+        (WebCore::Path::addEllipse):
+        (WebCore::Path::clear):
+        (WebCore::Path::isEmpty):
+        (WebCore::Path::debugString):
+        (WebCore::Path::apply):
+        (WebCore::Path::transform):
+        (WebCore::Path::strokeBoundingRect):
+
+2009-08-12  Lyon Chen  <lyon.chen@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: Implement Keygen for WINCE
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/KeygenWince.cpp: Added.
+
+2009-08-12  Brent Fulgham  <bfulgham@webkit.org>
+
+        Rubber-stamped by Kevin Ollivier.
+
+        Handle crash in wx due to null value passed to strlen in
+        the CString constructor.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::certificatePath):  Check for null return from getenv
+        and use default CString constructor instead.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        WINCE PORT: simple stubs to make it build for WINCE
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/DragDataWince.cpp: Added.
+        * platform/wince/DragImageWince.cpp: Added.
+        * platform/wince/EditorWince.cpp: Added.
+        * platform/wince/KURLWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCEPORT: FileSystem and FileChooser
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/FileChooserWince.cpp: Added.
+        * platform/wince/FileSystemWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        WINCE PORT: implement Cursor for WINCE. There's no real cursor on most
+        WinMob devices. We pass the cursor info to application, which so that 
+        can determine what to do.
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/CursorWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: MIMETypeRegistry
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/MIMETypeRegistryWince.cpp: Added.
+
+2009-08-12  Joe Mason  <joe.mason@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: Pasteboard and SearchPopupMenu
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/PasteboardWince.cpp: Added.
+        * platform/wince/SearchPopupMenuWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: Add SharedTimerWince.cpp and SystemTimeWince.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/SharedTimerWince.cpp: Added.
+        * platform/wince/SystemTimeWince.cpp: Added.
+
+2009-08-12  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28204
+        Allow C++ exceptions to be disabled in WebCore's V8 Mac build.
+
+        * WebCorePrefix.h:
+        Only undefine |try| and |catch| when building Objective-C[++],
+        leaving the C++ library definitions intact for C++.
+
+2009-08-12  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add a Custom Setter for DOMWindowEvent in the V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=27719
+
+        Tests: fast/events/set-event-in-another-frame.html
+               fast/events/set-event-to-null.html
+
+        * bindings/scripts/CodeGeneratorV8.pm: Clean up custom getter/setter code, 
+            as it currently doesn't support a custom getter 
+            and a v8-specific custom setter simultaneously.
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * page/DOMWindow.idl:
+
+2009-08-12  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Treat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Merge wx/ImageSourceWx.cpp into ImageSource.cpp.  No changes to
+        ImageSource.cpp were needed, so this just deletes ImageSourceWx.cpp.
+
+        * WebCore.gypi:
+        * WebCoreSources.bkl:
+        * platform/graphics/wx/ImageSourceWx.cpp: Removed.
+        * webcore-wx.bkl:
+
+2009-08-12  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Dave Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27933
+        Build fix after r47099.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+        (WebCore::putImageData):
+
+2009-08-08  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        WINCE PORT: Implement Path for WINCE. Most code can be
+        reused for other ports that don't have native path support
+        https://bugs.webkit.org/show_bug.cgi?id=28188
+
+        Written also by George Staikos (including quadCurve() and bezier())
+
+        * platform/graphics/wince/PathWince.cpp: Added.
+        * platform/graphics/wince/PlatformPathWince.cpp: Added.
+        * platform/graphics/wince/PlatformPathWince.h: Added.
+        * platform/graphics/wince/WinceGraphicsExtras.h: Added.
+
+2009-08-12  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        "Double-click to add" new style button does not always show up [quick fix]
+        https://bugs.webkit.org/show_bug.cgi?id=28187
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle):
+
+2009-08-12  Crystal Zhang <crystal.zhang@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: MediaPlayerProxy and MediaPlayerPrivate
+        https://bugs.webkit.org/show_bug.cgi?id=28178
+
+        * platform/graphics/wince/MediaPlayerPrivateWince.h: Added.
+        * platform/graphics/wince/MediaPlayerProxy.cpp: Added.
+        * platform/graphics/wince/MediaPlayerProxy.h: Added.
+
+2009-08-12  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        HTML 5 database and LocalStorage is not persistent on the Symbian port of QtWebKit
+        https://bugs.webkit.org/show_bug.cgi?id=28175
+
+        Call QDir::toNativeSeparators() before the path is passed to the OS.
+
+        Based on work by David Leong.
+        
+        * platform/qt/FileSystemQt.cpp:
+        (WebCore::pathByAppendingComponent):
+
+2009-08-12  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Minor build-fix for SVG Filter. Use getUnmultipliedImageData instead
+        of getImageData. This changed since r47099.
+
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply):
+
+2009-08-12  Viet-Trung Luu  <viettrungluu@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Explicitly set control tints for Chromium/Mac, since the controls'
+        NSCell(s) lack an NSView and hence their tint isn't updated
+        automatically when the application is activated/deactivated.
+        https://bugs.webkit.org/show_bug.cgi?id=28108
+        http://crbug.com/18199
+
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::updateNSCellControlTint):
+        (WebCore::RenderThemeChromiumMac::paintCheckbox):
+        (WebCore::RenderThemeChromiumMac::paintRadio):
+        (WebCore::RenderThemeChromiumMac::paintButton):
+        (WebCore::RenderThemeChromiumMac::paintMenuList):
+        (WebCore::RenderThemeChromiumMac::paintSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintSearchField):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsButton):
+
+2009-08-12  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix atomic string externalization crash.
+        Atomic string externalization assumes that all non-empty strings
+        can be externalized which is untrue on 64-bit.  This change fixed
+        that.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28215
+
+        This bug causes loads of test crashes, no need to add new tests
+        specifically for this.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8StringToAtomicWebCoreString):
+
+2009-08-12  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Fix box-shadow painting in r47103. The edge should not be blurry.
+        Also optimize by not having to save and restore painter state.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::fillRect):
+
+2009-08-12  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Adam Treat.
+
+        [Qt] Fix coding style in GraphicsContextQt.cpp
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::toQtCompositionMode):
+        (WebCore::toQtLineCap):
+        (WebCore::toQtLineJoin):
+        (WebCore::GraphicsContextPlatformPrivate::p):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::pen):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::clipPath):
+        (WebCore::GraphicsContext::drawFocusRing):
+        (WebCore::GraphicsContext::beginTransparencyLayer):
+        (WebCore::GraphicsContext::endTransparencyLayer):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::GraphicsContext::setMiterLimit):
+        (WebCore::GraphicsContext::setAlpha):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformStrokeStyle):
+        (WebCore::GraphicsContext::setPlatformStrokeThickness):
+
+2009-08-12  Szabo Carol  <carol.szabo@nokia.com>
+
+        Reviewed by Simon Hausmann and Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23291
+
+        [Qt] Partial support for -webkit-box-shadow. Blur is not support and
+        the shadow still does not go well with border radius.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::fillRect):
+
+2009-08-12  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        Use AM_V_GEN in a few more places, for less noisy builds.
+
+        * GNUmakefile.am:
+
+2009-08-12  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        SVG Filter premultiplied color support for getImageDate/putImageData
+        [https://bugs.webkit.org/show_bug.cgi?id=27933]
+
+        Some SVG Filters need premultiplied ImageData for the calculation. Therefore getImageData
+        and putImageData of ImageBuffer need support for premultiplied colors.
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::getImageData):
+        (WebCore::CanvasRenderingContext2D::putImageData):
+        * platform/graphics/ImageBuffer.h:
+        (WebCore::):
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::getImageData):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::putImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::getImageData):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::putImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::getImageData):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::putImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::putImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * platform/graphics/wx/ImageBufferWx.cpp:
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::applyMask):
+
+2009-08-12  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Changed Number.bytesToString to support low-resolution output.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28146
+
+        * inspector/front-end/utilities.js:
+        (Number.bytesToString):
+
+2009-08-12  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add support for hooking BeginPaint/EndPaint on 64Bit Windows
+
+        Webkit uses the runtime patching trick explained by "Feng Yuan" for
+        hooking these paint functions. It currently supports only 32bit assembly
+        code. This patch adds support for 64Bit version. Since inline-assemblies
+        are not supported for 64Bit, we have use a seperate .asm file.
+
+        * WebCore.pro:
+        * plugins/win/PaintHooks.asm: Added.
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::hookedBeginPaint):
+        (WebCore::PluginView::hookedEndPaint):
+        (WebCore::hook):
+
+2009-08-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make it harder to misuse try* allocation routines
+        https://bugs.webkit.org/show_bug.cgi?id=27469
+
+        Add forwarding header for PossiblyNull type, and add missing null check
+        to ImageBuffer creation.
+
+        * ForwardingHeaders/wtf/PossiblyNull.h: Added.
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+
+2009-08-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Restrict use of FuncDeclNode & FuncExprNode to the parser.
+        https://bugs.webkit.org/show_bug.cgi?id=28209
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
+            Function signature change.
+
+2009-08-11  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Treat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Merge skia/ImageSourceSkia.cpp into ImageSource.cpp.
+
+        * WebCore.gypi: Remove deleted file, plus a file that was deleted a while back.
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::setData): Use slightly shorter syntax.
+        (WebCore::ImageSource::filenameExtension): Use shorter syntax.
+        (WebCore::ImageSource::createFrameAtIndex): Remove redundant call, clarify comments, reject all empty images.
+        (WebCore::ImageSource::frameHasAlphaAtIndex): Clarify comments, use shorter syntax.
+        * platform/graphics/skia/ImageSourceSkia.cpp: Removed.
+
+2009-08-11  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        SharedWorkers do not exit when the last parent document exits
+        https://bugs.webkit.org/show_bug.cgi?id=28170
+
+        Prevents Documents from being suspended/placed in the page cache if they are associated with shared workers.
+
+        Added vector cache instead of nested hash tables for SharedWorker repository.
+
+        Added SharedWorkerRepository::documentDetached API.
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        Notifies SharedWorkerRepository when the document is closing.
+        * loader/FrameLoader.cpp:
+        Updated FrameLoader to not cache the Document if it is associated with a SharedWorker (since we can't suspend workers yet, we need to shut them down).
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::create):
+        (WebCore::SharedWorkerProxy::isClosing):
+        Renamed from closing().
+        (WebCore::SharedWorkerProxy::matches):
+        Added manual equality function to replace old hash lookup.
+        (WebCore::SharedWorkerProxy::isDocumentInWorkerDocuments):
+        Checks to see if a document is in the worker's list of documents. Used to determine if page is suspendable.
+        (WebCore::SharedWorkerProxy::SharedWorkerProxy):
+        (WebCore::SharedWorkerProxy::addToWorkerDocuments):
+        Added tracking of the worker's list of documents for lifecycle purposes.
+        (WebCore::SharedWorkerProxy::documentDetached):
+        Shuts down the proxy when the last associated document is detached.
+        (WebCore::SharedWorkerProxy::close):
+        Marks the proxy as closed so it is no longer shared with new instances.
+        (WebCore::SharedWorkerProxy::workerContextDestroyed):
+        Removes the proxy from the repository/frees the proxy when the associated SharedWorkerContext is destroyed.
+        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
+        closing()->isClosing()
+        (WebCore::SharedWorkerRepository::documentDetached):
+        (WebCore::SharedWorkerRepository::hasSharedWorkers):
+        Used by FrameLoader to determine if a page has shared workers and so cannot be suspended/cached.
+        (WebCore::DefaultSharedWorkerRepository::hasSharedWorkers):
+        (WebCore::DefaultSharedWorkerRepository::removeProxy):
+        Invoked by workerContextDestroyed() to remove a SharedWorkerProxy from the repository.
+        (WebCore::DefaultSharedWorkerRepository::documentDetached):
+        (WebCore::DefaultSharedWorkerRepository::connectToWorker):
+        (WebCore::DefaultSharedWorkerRepository::getProxy):
+        * workers/DefaultSharedWorkerRepository.h:
+        * workers/SharedWorkerRepository.h:
+
+2009-08-11  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 28200 - ListMarker should be included as part of the text value to parse
+        https://bugs.webkit.org/show_bug.cgi?id=28200
+
+        When returning text through the marker range attributes, the list marker text should
+        also be included. It isn't included by default because a TextIterator is used which
+        only looks at Nodes for text. A list marker does not have a corresponding node,
+        so its text is not returned through accessibility. That is, until now.
+
+        Test: platform/mac/accessibility/string-range-contains-listmarker.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::listMarkerTextForRange):
+        (WebCore::AccessibilityObject::stringForVisiblePositionRange):
+        * accessibility/AccessibilityObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper doAXAttributedStringForTextMarkerRange:]):
+        (-[AccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
+        * rendering/RenderListItem.h:
+
+        Make markerText() public so that accessibility code can access it.
+
+2009-08-11  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Treat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Move cairo/ImageSourceCairo.cpp to ImageSource.cpp in preparation for
+        merging most of the other ImageSource*.cpp files with it.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/graphics/ImageSource.cpp: Copied from WebCore/platform/graphics/cairo/ImageSourceCairo.cpp.
+        * platform/graphics/cairo/ImageSourceCairo.cpp: Removed.
+
+2009-08-10  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Cairo-based Windows port does not handle the https protocol.
+        https://bugs.webkit.org/show_bug.cgi?id=28171.
+
+        No new tests needed.  Existing https tests show this failure
+        for WinCairo builds.
+
+        * WebCore.vcproj/WebCoreCURL.vsprops: Add a few preprocessor
+          definitions for SSL support in cURL.
+        * platform/network/curl/ResourceHandleManager.h: Add new
+          certificate path member variable.
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::certificateBundlePath): New method to retrieve the
+          proper certificate resource bundle path.
+        (WebCore::ResourceHandleManager::initializeHandle): Check for
+          the resource bundle and use if available to activate SSL
+          support.
+
+2009-08-11  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Use Clipboard::create() instead of the constructor of Clipboard.
+        https://bugs.webkit.org/show_bug.cgi?id=28127
+
+        * editing/haiku/EditorHaiku.cpp:
+        (WebCore::Editor::newGeneralClipboard):
+        * page/haiku/EventHandlerHaiku.cpp:
+        (WebCore::EventHandler::passWheelEventToWidget):
+        (WebCore::EventHandler::createDraggingClipboard):
+        * platform/haiku/ClipboardHaiku.cpp: Style cleanup. There were many whitespace end of lines.
+        (WebCore::ClipboardHaiku::ClipboardHaiku):
+        (WebCore::ClipboardHaiku::clearAllData):
+        (WebCore::ClipboardHaiku::getData):
+        (WebCore::ClipboardHaiku::setData):
+        (WebCore::ClipboardHaiku::types):
+        (WebCore::ClipboardHaiku::dragLocation):
+        (WebCore::ClipboardHaiku::dragImage):
+        (WebCore::ClipboardHaiku::setDragImage):
+        (WebCore::ClipboardHaiku::dragImageElement):
+        (WebCore::ClipboardHaiku::createDragImage):
+        (WebCore::ClipboardHaiku::declareAndWriteDragImage):
+        (WebCore::ClipboardHaiku::writeURL):
+        (WebCore::ClipboardHaiku::writeRange):
+        (WebCore::ClipboardHaiku::hasData):
+        * platform/haiku/DragDataHaiku.cpp:
+        (WebCore::DragData::createClipboard):
+
+2009-08-11  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by NOBODY (build break).
+
+        Speculative GTK build fix
+
+        * GNUmakefile.am:
+        Added missing .idl file, and added notifications directory to IDL_PATH.
+
+2009-08-11  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by NOBODY (build break).
+
+        Speculative Windows build fix
+
+        * WebCore.vcproj/WebCore.vcproj:
+        Added missing build steps for non-debug targets.
+
+2009-08-11  Drew Wilson <atwilson@google.com>
+
+        Reviewed by NOBODY (build break)
+
+        Speculative build fix for Qt build.
+
+        * WebCore.pro: Added /notifications to include path
+
+2009-08-11  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Desktop Notifications API
+        https://bugs.webkit.org/show_bug.cgi?id=25463
+
+        Adds an implementation of desktop notifications, behind the compile-time
+        flag ENABLE(NOTIFICATIONS).  This code simply relays calls on the JavaScript
+        API through a NotificationProvider interface, which must provide the services
+        to actually notify the user and manage the desktop.  This provider is injected
+        into WebKit through the ChromeClient for normal page contexts and through the
+        WorkerThread for worker contexts.
+
+        A permissions API is defined on a per-origin basis, which allows a web page
+        to check if its origin is allowed to show desktop notifications, and to request
+        permission for its origin.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSDesktopNotificationsCustom.cpp: Added.
+        (WebCore::JSNotificationCenter::requestPermission):
+        (WebCore::JSNotification::addEventListener):
+        (WebCore::JSNotification::removeEventListener):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toNotification):
+        * dom/EventTarget.h:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::notificationPresenter):
+        * notifications: Added.
+        * notifications/Notification.cpp: Added.
+        (WebCore::Notification::Notification):
+        (WebCore::Notification::~Notification):
+        (WebCore::Notification::show):
+        (WebCore::Notification::cancel):
+        (WebCore::Notification::ondisplay):
+        (WebCore::Notification::setOndisplay):
+        (WebCore::Notification::onerror):
+        (WebCore::Notification::setOnerror):
+        (WebCore::Notification::onclose):
+        (WebCore::Notification::setOnclose):
+        (WebCore::Notification::getAttributeEventListener):
+        (WebCore::Notification::setAttributeEventListener):
+        (WebCore::Notification::clearAttributeEventListener):
+        (WebCore::Notification::dispatchDisplayEvent):
+        (WebCore::Notification::dispatchErrorEvent):
+        (WebCore::Notification::dispatchCloseEvent):
+        (WebCore::Notification::addEventListener):
+        (WebCore::Notification::removeEventListener):
+        (WebCore::Notification::handleEvent):
+        (WebCore::Notification::dispatchEvent):
+        * notifications/Notification.h: Added.
+        (WebCore::Notification::create):
+        (WebCore::Notification::isHTML):
+        (WebCore::Notification::url):
+        (WebCore::Notification::contents):
+        (WebCore::Notification::scriptExecutionContext):
+        (WebCore::Notification::toNotification):
+        (WebCore::Notification::refEventTarget):
+        (WebCore::Notification::derefEventTarget):
+        * notifications/Notification.idl: Added.
+        * notifications/NotificationCenter.cpp: Added.
+        (WebCore::NotificationCenter::NotificationCenter):
+        (WebCore::NotificationCenter::checkPermission):
+        (WebCore::NotificationCenter::requestPermission):
+        * notifications/NotificationCenter.h: Added.
+        (WebCore::NotificationCenter::create):
+        (WebCore::NotificationCenter::createHTMLNotification):
+        (WebCore::NotificationCenter::createNotification):
+        (WebCore::NotificationCenter::context):
+        (WebCore::NotificationCenter::presenter):
+        * notifications/NotificationCenter.idl: Added.
+        * notifications/NotificationContents.h: Added.
+        (WebCore::NotificationContents::NotificationContents):
+        (WebCore::NotificationContents::icon):
+        (WebCore::NotificationContents::title):
+        (WebCore::NotificationContents::body):
+        * notifications/NotificationPresenter.h: Added.
+        (WebCore::NotificationPresenter::):
+        (WebCore::NotificationPresenter::~NotificationPresenter):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::notificationPresenter):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::clear):
+        (WebCore::DOMWindow::webkitNotifications):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * page/Page.h:
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::~WorkerContext):
+        (WebCore::WorkerContext::webkitNotifications):
+        * workers/WorkerContext.h:
+        * workers/WorkerContext.idl:
+        * workers/WorkerThread.h:
+        (WebCore::WorkerThread::getNotificationPresenter):
+        (WebCore::WorkerThread::setNotificationPresenter):
+
+2009-08-11  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Console Drawer is Toggling instead of Staying Open
+        https://bugs.webkit.org/show_bug.cgi?id=28115
+
+        * inspector/front-end/Drawer.js:
+        (WebInspector.Drawer.prototype.showView): ensures the drawer will be open and showing the provided view
+        * inspector/front-end/inspector.js:
+        (WebInspector.showConsole): usees the new showView to guarantee the Drawer will be open
+        (WebInspector.showChanges): uses the new showView guarantee the Drawer will be open
+
+2009-08-11  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] WMLPageState is not allowed to store the active card, it needs to be done per document
+        https://bugs.webkit.org/show_bug.cgi?id=28180
+
+        Don't store the active WMLCardElement in WMLPageState, but in WMLDocument.
+        Otherwhise this may lead to crashes related to intrinsic event exeuction.
+
+        Unfortunately select elements aren't testable by the layout tests, so adding
+        a new manual test reproducing the crash.
+
+        * manual-tests/wml/select-onpick-event-crash.wml: Added.
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::determineActiveCard):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::defaultEventHandler):
+        * wml/WMLDocument.cpp:
+        (WebCore::WMLDocument::finishedParsing):
+        * wml/WMLDocument.h:
+        (WebCore::WMLDocument::activeCard):
+        * wml/WMLGoElement.cpp:
+        (WebCore::WMLGoElement::executeTask):
+        * wml/WMLPageState.cpp:
+        (WebCore::WMLPageState::WMLPageState):
+        * wml/WMLPageState.h:
+        * wml/WMLPrevElement.cpp:
+        (WebCore::WMLPrevElement::executeTask):
+        * wml/WMLRefreshElement.cpp:
+        (WebCore::WMLRefreshElement::executeTask):
+
+2009-08-07  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28073
+        Treat icons with no bit count and no color count as 256-color for
+        purposes of quality ranking.  Also fix a couple cases of a style
+        violation.
+
+        Test: fast/images/icon-0colors.html
+
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::processDirectory):
+        (WebCore::ICOImageDecoder::readDirectoryEntry):
+
+2009-08-11  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Need to refactor WorkerObjectProxy.
+        https://bugs.webkit.org/show_bug.cgi?id=28136
+
+        Added WorkerReportingProxy for reporting worker state (exceptions, console messages, thread exited) to the parent.
+
+        Existing tests are sufficient, as this is only a refactoring.
+
+        * GNUmakefile.am:
+        Added WorkerReportingProxy.h to build.
+        * WebCore.gypi:
+        Added WorkerReportingProxy.h to build.
+        * WebCore.vcproj/WebCore.vcproj:
+        Added WorkerReportingProxy.h to build.
+        * WebCore.xcodeproj/project.pbxproj:
+        Added WorkerReportingProxy.h to build.
+        * workers/DedicatedWorkerContext.cpp:
+        * workers/DedicatedWorkerContext.h:
+        Removed addMessage/forwardException() APIs - now handled by WorkerReportingProxy.
+        * workers/DedicatedWorkerThread.cpp:
+        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
+        Changed constructor to pass WorkerReportingProxy to base class.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        Updated SharedWorkerProxy to implement WorkerReportingProxy interface.
+        (WebCore::SharedWorkerProxy::postExceptionToWorkerObject):
+        (WebCore::SharedWorkerProxy::postConsoleMessageToWorkerObject):
+        (WebCore::SharedWorkerProxy::workerContextClosed):
+        (WebCore::SharedWorkerProxy::workerContextDestroyed):
+        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
+        Now passes in WorkerReportingProxy when creating SharedWorkerThread.
+        * workers/SharedWorkerContext.cpp:
+        * workers/SharedWorkerContext.h:
+        Removed addMessage/forwardException() APIs - now handled by WorkerReportingProxy.
+        * workers/SharedWorkerThread.cpp:
+        (WebCore::SharedWorkerThread::create):
+        (WebCore::SharedWorkerThread::SharedWorkerThread):
+        Passes WorkerReportingProxy to base class constructor.
+        * workers/SharedWorkerThread.h:
+        Constructor now takes a WorkerReportingProxy.
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::~WorkerContext):
+        Moved code that calls workerContextDestroyed() into base class so shared workers share this functionality.
+        (WebCore::WorkerContext::close):
+        Now notifies WorkerReportingProxy when the thread is closing.
+        (WebCore::WorkerContext::reportException):
+        Reports exceptions via WorkerReportingProxy.
+        (WebCore::WorkerContext::addMessage):
+        Reports console messages via WorkerReportingProxy.
+        * workers/WorkerContext.h:
+        * workers/WorkerObjectProxy.h:
+        (WebCore::WorkerObjectProxy::workerContextClosed):
+        Default empty implementation for dedicated workers.
+        * workers/WorkerReportingProxy.h: Added.
+        Base interface that contains APIs moved from WorkerObjectProxy.
+        (WebCore::WorkerReportingProxy::~WorkerReportingProxy):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::WorkerThread):
+        Updated constructor to accept a WorkerReportingProxy.
+        * workers/WorkerThread.h:
+        (WebCore::WorkerThread::workerReportingProxy):
+
+2009-08-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Fix the Qt build after r47022.
+
+        Use the new markChildren() pattern for marking aggregate/child objects.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObjectImp::markChildren):
+        (JSC::Bindings::QtInstance::markAggregate):
+        * bridge/qt/qt_instance.h:
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::markChildren):
+        * bridge/qt/qt_runtime.h:
+
+2009-08-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Fix the build on the Qt build bot by making the generated JS bindings
+        files depend on the code generator itself.
+
+        * WebCore.pro:
+
+2009-08-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig
+
+        Stack overflow crash in JavaScript garbage collector mark pass
+        https://bugs.webkit.org/show_bug.cgi?id=12216
+
+        Make WebCore use the new iterative marking logic.
+
+        Tests: fast/js/nested-object-gc.html
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::markChildren):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::markChildren):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::markDOMNodesForDocument):
+        (WebCore::markActiveObjectsForContext):
+        (WebCore::markDOMObjectWrapper):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::markChildren):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::markChildren):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::markChildren):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::markChildren):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSDedicatedWorkerContextCustom.cpp:
+        (WebCore::JSDedicatedWorkerContext::markChildren):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::markChildren):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::markJSFunction):
+        * bindings/js/JSEventListener.h:
+        * bindings/js/JSMessageChannelCustom.cpp:
+        (WebCore::JSMessageChannel::markChildren):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::markChildren):
+        * bindings/js/JSNavigatorCustom.cpp:
+        (WebCore::JSNavigator::markChildren):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::markAggregate):
+        * bindings/js/JSNodeFilterCondition.h:
+        * bindings/js/JSNodeFilterCustom.cpp:
+        (WebCore::JSNodeFilter::markChildren):
+        * bindings/js/JSNodeIteratorCustom.cpp:
+        (WebCore::JSNodeIterator::markChildren):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::markChildren):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::markChildren):
+        * bindings/js/JSSharedWorkerCustom.cpp:
+        (WebCore::JSSharedWorker::markChildren):
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::JSStyleSheet::markChildren):
+        * bindings/js/JSTreeWalkerCustom.cpp:
+        (WebCore::JSTreeWalker::markChildren):
+        * bindings/js/JSWebSocketCustom.cpp:
+        (WebCore::JSWebSocket::markChildren):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::markChildren):
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::markChildren):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::markChildren):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::markChildren):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/EventListener.h:
+        (WebCore::EventListener::markJSFunction):
+        (WebCore::markIfNotNull):
+        * dom/NodeFilter.h:
+        (WebCore::NodeFilter::markAggregate):
+        * dom/NodeFilterCondition.h:
+        (WebCore::NodeFilterCondition::markAggregate):
+        * dom/RegisteredEventListener.h:
+        (WebCore::markEventListeners):
+        * page/DOMWindow.h:
+        * workers/WorkerContext.h:
+
+2009-08-10  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Renamed all V8 NPN_ functions to _NPN_ to match JSC and make them "private".
+        https://bugs.webkit.org/show_bug.cgi?id=28089
+
+        Rename all the NPN_foo functions to _NPN_foo so that they can't directly be
+        called by mistake.  This roughly matches the way JSC does it, which is an
+        additional advantage.
+
+        * bindings/v8/NPV8Object.cpp:
+        (npCreateV8ScriptObject):
+        (_NPN_Invoke):
+        (_NPN_InvokeDefault):
+        (_NPN_Evaluate):
+        (_NPN_EvaluateHelper):
+        (_NPN_GetProperty):
+        (_NPN_SetProperty):
+        (_NPN_RemoveProperty):
+        (_NPN_HasProperty):
+        (_NPN_HasMethod):
+        (_NPN_SetException):
+        (_NPN_Enumerate):
+        (_NPN_Construct):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::clearScriptObjects):
+        (WebCore::ScriptController::createScriptInstanceForWidget):
+        (WebCore::ScriptController::cleanupScriptObjectsForPlugin):
+        * bindings/v8/V8NPObject.cpp:
+        (npObjectInvokeImpl):
+        (npObjectGetProperty):
+        (npObjectIndexedPropertyGetter):
+        (npObjectGetIndexedProperty):
+        (npObjectSetProperty):
+        (npObjectIndexedPropertySetter):
+        (npObjectSetIndexedProperty):
+        (weakNPObjectCallback):
+        (createV8ObjectForNPObject):
+        (forgetV8ObjectForNPObject):
+        * bindings/v8/V8NPUtils.cpp:
+        (getStringIdentifier):
+        * bindings/v8/npruntime.cpp:
+        * bindings/v8/npruntime_impl.h:
+
+2009-08-10  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Brady Eidson.
+
+        Change ___Storage.key() to match current spec behavior.
+        https://bugs.webkit.org/show_bug.cgi?id=28112
+
+        The current WebStorage spec says that ___Storage.key() should return null when
+        the index is out of bounds, rather than an exception.  A bunch of logic can be
+        simplified after this change.
+
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::getPropertyNames):
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        (WebCore::V8Custom::v8StorageNamedPropertyEnumerator):
+        * storage/Storage.cpp:
+        (WebCore::Storage::key):
+        * storage/Storage.h:
+        * storage/Storage.idl:
+        * storage/StorageArea.h:
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::key):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::key):
+        * storage/StorageMap.h:
+
+2009-08-07  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28087
+
+        Mods for a chrome specific impl of ApplicationCacheHost.
+
+        * The public section of the interface is the same, but we use
+        PLATFORM(CHROMIUM) to identify which parts of the private
+        section are shared. The chrome specific internals are encapsulated
+        in a seperate ApplicationCacheHostInternal class. WebCore common
+        code only contains a forward reference to this class.
+
+        * Cleanup a couple of stale comments.
+
+        * Have window.applicationCache return null to script when the
+        feature is disabled in the preferences.
+        
+        No new tests.
+
+        * loader/appcache/ApplicationCacheHost.cpp:
+        * loader/appcache/ApplicationCacheHost.h:
+        (WebCore::ApplicationCacheHost::documentLoader):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::applicationCache):
+
+2009-08-10  Crystal Zhang  <crystal.zhang@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Implement GraphicsContext::fillRoundRect() for WINCE port
+        https://bugs.webkit.org/show_bug.cgi?id=27842
+
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::rectCenterPoint):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::drawRoundCorner):
+
+2009-08-10  Anthony Ricaud  <rik@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector Resources / Graphs should support filtering
+        https://bugs.webkit.org/show_bug.cgi?id=20629
+
+        Introduces a filter bar for resources.
+
+        Thanks to Matt Lilek for the CSS scope bar.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.createFilterElement):
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.toolbarItemClass.categoryOrder.filter):
+        (WebInspector.ResourcesPanel.prototype._updateFilter):
+        (WebInspector.ResourcesPanel.prototype._updateSummaryGraph):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+
+2009-08-10  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build correction after http://trac.webkit.org/changeset/46978
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::initializeHandle):  Correct
+         deprecated removeRef to new removeFragmentIdentifier.
+
+2009-08-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        Background color formatting lost on enter
+        https://bugs.webkit.org/show_bug.cgi?id=20348
+
+        This patch makes background color be preserved during editing.
+        In particular, editingStyleAtPosition would include the background color when obtaining styles.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::): Added CSSPropertyBackgroundColor to editingStyleProperties
+
+2009-08-10  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Stop sending QEvent::CursorChange to Qt for mouse move.
+
+        Verify if the cursor didn't change in WidgetQt::setCursor,
+        just like the mac port does.
+
+        Thanks to Adriano Rezendo for spotting and debugging the
+        issue.
+
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::setCursor):
+
+2009-08-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28165
+        Application cache maximum size cannot be set before the database is opened
+
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::vacuumDatabaseFile): Open appcache database if it isn't
+        open yet.
+
+2009-08-10  Vitaly Repeshko  <vitalyr@quad.spb.corp.google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix memory leak in node event listeners. See http://crbug.com/17400.
+        https://bugs.webkit.org/show_bug.cgi?id=28156
+
+        * bindings/scripts/CodeGeneratorV8.pm: Custom event handler accessors now apply to all Node descendants.
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::isObjectListener): Added virtual method to detect listeners that have weak references to JS objects.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/V8ObjectEventListener.cpp:
+        * bindings/v8/V8ObjectEventListener.h:
+        (WebCore::V8ObjectEventListener::isObjectListener):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::removeHiddenDependency):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        * bindings/v8/custom/V8NodeCustom.cpp: Moved custom accessors from V8ElementCustom.cpp.
+        (WebCore::toEventType):
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::getEventListener): Made static.
+
+2009-08-10  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Cleanup DOM Storage namespace shutdown code + usage of security origin.
+        https://bugs.webkit.org/show_bug.cgi?id=28094
+
+        If a storage namespace is not explicitly closed, be sure to do so on
+        destruction of the object.  In addition, the close call should wait
+        on the background thread finishing its syncing.  (Not doing so is actually
+        a regression from the original LocalStorage code.)
+
+        There's no point to passing in the SecurityOrigin when copying a storage
+        area since what was passed in is exactly what is stored within each
+        storage area.  In addition, the non-copy constructor should take in a
+        PassRefPtr rather than a pointer since that pointer was only passed into
+        the constuctor for RefPtr's anyway.
+
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::StorageAreaImpl):
+        (WebCore::StorageAreaImpl::copy):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
+        (WebCore::StorageNamespaceImpl::~StorageNamespaceImpl):
+        (WebCore::StorageNamespaceImpl::copy):
+        (WebCore::StorageNamespaceImpl::close):
+        * storage/StorageNamespaceImpl.h:
+
+2009-08-10  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed, build fix.
+
+        Rename ref() to fragmentIdentifier() in the wml/ subdirectory.
+
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::determineActiveCard):
+        * wml/WMLGoElement.cpp:
+        (WebCore::WMLGoElement::executeTask):
+        * wml/WMLPageState.cpp:
+        (WebCore::WMLPageState::canAccessDeck):
+
+2009-08-10  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        Exclude JSMedia.cpp from build since it is included in DerivedSources.cpp.
+        Fixes linker warnings.        
+        
+        Corrected spelling of JSInspectorBackend.cpp.
+        
+        Other changes related to actually using a Visual Studio to open/save the vcproj file.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-08-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Remove a dead #define.
+
+        * bindings/js/JSDOMBinding.cpp:
+
+2009-08-10  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Update KURLGoogle for ref* method renames in
+        http://trac.webkit.org/changeset/46978.
+        https://bugs.webkit.org/show_bug.cgi?id=28084
+
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::ACCESSOR_SETTER): Renamed ref and setRef to fragmentIdentifier and
+            setFragmentIdentifier, respectively.
+        * platform/KURLGoogle.cpp: Ditto, plus all other ref* method names.
+
+2009-08-10  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        [Gtk] Unreviewed. Fix the nit as suggested by Darin in bug #28144
+        for r46989.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::finishedCallback):
+
+2009-08-10  John Kjellberg  <john.kjellberg@power.alstom.com>
+
+        Reviewed by Darin Adler.
+
+        Memory leak in error handling code for SOUP interface
+        https://bugs.webkit.org/show_bug.cgi?id=28144
+
+        Freed memory leaked in error handling code for soup requests.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::finishedCallback):
+        (WebCore::):
+
+2009-08-10  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Provide graceful handling of the situation when an embedder invokes
+        visited link update methods before a Page constructor has been called.
+        https://bugs.webkit.org/show_bug.cgi?id=28149
+
+        * page/Page.cpp:
+        (WebCore::Page::allVisitedStateChanged): Added a null-check for allPages.
+        (WebCore::Page::visitedStateChanged): Ditto.
+
+2009-08-10  Xan Lopez  <xlopez@igalia.com>
+
+        Fix GTK+ build.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
+
+2009-08-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Remove the redundant, Windows CE-only GlyphBuffer::advnaceData()
+
+        * platform/graphics/GlyphBuffer.h: Removed advanceData().
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::drawText): Changed to use advances(from)
+            instead of advanceData() + from.
+
+2009-08-10  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Remove workaround for older libsoup versions.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::fillResponseFromMessage):
+
+2009-08-10  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Let startHttp validate the URI instead of doing it, with potential
+        crashes, in ::start.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::startHttp):
+
+2009-08-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        When empty <input> is focused, getSelection() exposes shadow tree nodes
+        https://bugs.webkit.org/show_bug.cgi?id=15903
+
+        Test: fast/forms/shadow-tree-exposure.html
+
+        * page/DOMSelection.cpp:
+        (WebCore::selectionShadowAncestor): Added.
+        (WebCore::DOMSelection::anchorNode): Return the parent of the shadow
+        ancestor if the selection is in a shadow tree. Matches Firefox.
+        (WebCore::DOMSelection::anchorOffset): Return the index of the shadow
+        ancestor if the selection is in a shadow tree. Matches Firefox.
+        (WebCore::DOMSelection::focusNode): Ditto.
+        (WebCore::DOMSelection::focusOffset): Ditto.
+        (WebCore::DOMSelection::baseNode): More of the same, but since this
+        is a WebKit-invented property, it does not match Firefox.
+        (WebCore::DOMSelection::baseOffset): Ditto.
+        (WebCore::DOMSelection::extentNode): Ditto.
+        (WebCore::DOMSelection::extentOffset): Ditto.
+        (WebCore::DOMSelection::isCollapsed): Return true even when the
+        selection is a range, if the selection is in the shadow tree.
+        Matches Firefox. Also changed behavior when called and the frame
+        is gone to return true instead of false which makes more sense.
+        (WebCore::DOMSelection::empty): Use clear() just like the other
+        selection-clearing function in this file does.
+        (WebCore::DOMSelection::getRangeAt): Return a range that starts
+        and ends before the shadow ancestor. Matches Firefox.
+
+2009-08-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Make all status bar button images glyph-based.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28124
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        * inspector/front-end/Images/clearConsoleButtonGlyph.png: Added.
+        * inspector/front-end/Images/clearConsoleButtons.png: Removed.
+        * inspector/front-end/Images/consoleButtonGlyph.png: Added.
+        * inspector/front-end/Images/consoleButtons.png: Removed.
+        * inspector/front-end/Images/dockButtonGlyph.png: Added.
+        * inspector/front-end/Images/dockButtons.png: Removed.
+        * inspector/front-end/Images/enableButtons.png: Removed.
+        * inspector/front-end/Images/enableOutlineButtonGlyph.png: Added.
+        * inspector/front-end/Images/enableSolidButtonGlyph.png: Added.
+        * inspector/front-end/Images/excludeButtonGlyph.png: Added.
+        * inspector/front-end/Images/excludeButtons.png: Removed.
+        * inspector/front-end/Images/focusButtonGlyph.png: Added.
+        * inspector/front-end/Images/focusButtons.png: Removed.
+        * inspector/front-end/Images/largerResourcesButtonGlyph.png: Added.
+        * inspector/front-end/Images/largerResourcesButtons.png: Removed.
+        * inspector/front-end/Images/nodeSearchButtonGlyph.png: Added.
+        * inspector/front-end/Images/nodeSearchButtons.png: Removed.
+        * inspector/front-end/Images/pauseOnExceptionButtonGlyph.png: Added.
+        * inspector/front-end/Images/pauseOnExceptionButtons.png: Removed.
+        * inspector/front-end/Images/percentButtonGlyph.png: Added.
+        * inspector/front-end/Images/percentButtons.png: Removed.
+        * inspector/front-end/Images/recordButtonGlyph.png: Added.
+        * inspector/front-end/Images/recordButtons.png: Removed.
+        * inspector/front-end/Images/recordToggledButtonGlyph.png: Added.
+        * inspector/front-end/Images/reloadButtonGlyph.png: Added.
+        * inspector/front-end/Images/reloadButtons.png: Removed.
+        * inspector/front-end/Images/undockButtonGlyph.png: Added.
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.createStatusBarButton):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-08-07  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        KURL ref() methods should be fragmentIdentifier() methods 
+        https://bugs.webkit.org/show_bug.cgi?id=28084
+
+        In addition to the renames, also took the chance to replace all use of:
+        setRef(String());
+        with:
+        removeFragmentIdentifier();
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::fragmentIdentifier):
+        (WebCore::KURL::hasFragmentIdentifier):
+        (WebCore::KURL::setFragmentIdentifier):
+        (WebCore::KURL::removeFragmentIdentifier):
+        (WebCore::KURL::prettyURL):
+        (WebCore::equalIgnoringFragmentIdentifier):
+        * platform/KURL.h:
+
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::setHash): Rework with new names, and to use the new equalIgnoringNullity() method.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::internalLinkElement):
+        * css/CSSCursorImageValue.cpp:
+        (WebCore::isSVGCursorIdentifier):
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::isCurrentDocument):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::hash):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::isURLAllowed):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+        (WebCore::FrameLoader::gotoAnchor):
+        (WebCore::FrameLoader::scheduleLocationChange):
+        (WebCore::FrameLoader::scrollToAnchor):
+        (WebCore::FrameLoader::shouldReload):
+        (WebCore::FrameLoader::urlsMatchItem):
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::resourceForURL):
+        (WebCore::ApplicationCache::resourceForRequest):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::cacheForMainRequest):
+        (WebCore::ApplicationCacheGroup::fallbackCacheForMainRequest):
+        (WebCore::ApplicationCacheGroup::selectCache):
+        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource):
+        (WebCore::ApplicationCacheGroup::didReceiveResponse):
+        (WebCore::ApplicationCacheGroup::didFail):
+        (WebCore::ApplicationCacheGroup::addEntry):
+        * loader/appcache/ApplicationCacheResource.h:
+        (WebCore::ApplicationCacheResource::create):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::findOrCreateCacheGroup):
+        (WebCore::ApplicationCacheStorage::cacheGroupForURL):
+        (WebCore::ApplicationCacheStorage::fallbackCacheGroupForURL):
+        * loader/appcache/ManifestParser.cpp:
+        (WebCore::parseManifest):
+        * page/Location.cpp:
+        (WebCore::Location::hash):
+        * page/Page.cpp:
+        (WebCore::Page::goToItem):
+        * rendering/RenderPartObject.cpp:
+        (WebCore::isURLAllowed):
+        * workers/WorkerLocation.cpp:
+        (WebCore::WorkerLocation::hash):
+
+2009-08-10  Andy Shaw <andy.shaw@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix endless loop when the application is quit by a secondary thread during a sync xml http request.
+
+        Replace the m_finished state variable and the call to QCoreApplication::processEvents() with
+        a dedicated QEventLoop, that can be terminated from within WebCoreSynchronousLoader as well
+        as from Qt through its knowledge of globally registered eventloops.
+
+        There is no unit test for this bug as it would require exporting additional symbols and
+        introduce the synchronous loader as global variable just for the test.
+
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::WebCoreSynchronousLoader::didFinishLoading):
+        (WebCore::WebCoreSynchronousLoader::didFail):
+        (WebCore::WebCoreSynchronousLoader::waitForCompletion):
+
+2009-08-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Make properties inspection serialized.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28078
+
+        * inspector/front-end/DOMAgent.js:
+        (InspectorController.getPrototypes):
+        (InspectorController.getProperties):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getPrototypes):
+        (InjectedScript.getProperties):
+        (InjectedScript.setPropertyValue):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectRef):
+        (WebInspector.ObjectPropertyRef):
+        (WebInspector.ObjectPropertiesSection.prototype.onpopulate):
+        (WebInspector.ObjectPropertiesSection.prototype.update.callback):
+        (WebInspector.ObjectPropertiesSection.prototype.update):
+        (WebInspector.ObjectPropertiesSection.prototype._update):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate.callback):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onattach):
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
+        (WebInspector.PropertiesSidebarPane.prototype.update):
+
+2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] wml.css lacks <pre> support
+        https://bugs.webkit.org/show_bug.cgi?id=28135
+
+        Add <pre> support for WML.
+        Extended fast/wml/text-emphasis.wml to cover <pre> support.
+
+        * css/wml.css: <pre> section copied from html.css
+
+2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix non-WML enabled builds. Remove ENABLE(WML) guards around the switch cases 'FrameLoadTypeBackWMLDeckNotAccessible'.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::isBackForwardLoadType):
+        (WebCore::FrameLoader::restoreDocumentState):
+        (WebCore::FrameLoader::transitionToCommitted):
+        (WebCore::FrameLoader::loadItem):
+
+2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] Deck access control is completly broken
+        https://bugs.webkit.org/show_bug.cgi?id=27721
+
+        Rewrite WML deck access control, actually works now standalone and within LayoutTests.
+        Added several new layout tests covering local & remote access support.
+
+        In order to detect WML task execution failures from within the WML layout tests a new
+        method Console::lastWMLErrorMessage() has been added, returning the last recorded WML
+        error message. Change WML log messages to dump to InspectorClient, just like it's done
+        for HTML - we used to behave like JSMessageSource, which is wrong.
+
+        Tests: http/tests/wml/access-target-domain-deny.html
+               http/tests/wml/access-target-path-deny.html
+               http/tests/wml/access-target.html
+               wml/access-target-deny.html
+               wml/access-target.html
+
+        * inspector/ConsoleMessage.h:
+        (WebCore::ConsoleMessage::source): Added public method to fetch the message source type.
+        (WebCore::ConsoleMessage::message): Added public method to access the error message.
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::consoleMessages): Added for Console::lastWMLErrorMessage(), to be able to crawl through the list of dumped messages.
+        * loader/FrameLoader.cpp: Recognize 'FrameLoadTypeBackWMLDeckNotAccessible', all guarded by ENABLE(WML).
+        (WebCore::isBackForwardLoadType):
+        (WebCore::FrameLoader::restoreDocumentState):
+        (WebCore::FrameLoader::transitionToCommitted):
+        (WebCore::FrameLoader::loadItem):
+        * loader/FrameLoaderTypes.h:
+        (WebCore::): Add new load type 'FrameLoadTypeBackWMLDeckNotAccessible', behaving like FrameLoadTypeBack plus WML specific information.
+        * page/Console.cpp:
+        (WebCore::Console::addMessage): Don't dump WML messages using ChromeClient (as it's done for JSMessageSource), but go through InspectorController.
+        (WebCore::Console::lastWMLErrorMessage): Crawl InspectorController::consoleMssages() to look up the last WML error message, if present.
+        * page/Console.h:
+        * page/Console.idl: Add "[DontEnum] DOMString lastWMLErrorMessage()".
+        * wml/WMLAccessElement.cpp: Store path/domain as member variables and pass them to WMLPageState once in insertedIntoDocument().
+        (WebCore::WMLAccessElement::parseMappedAttribute):
+        (WebCore::WMLAccessElement::insertedIntoDocument):
+        * wml/WMLAccessElement.h:
+        * wml/WMLCardElement.cpp: Handle 'FrameLoadTypeBackWMLDeckNotAccessible' as deck-entry method. Report WML error in current deck.
+        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded):
+        * wml/WMLDocument.cpp: Enable deck-access control in finishedParsing. Take care of method name changes in WMLPageState.
+        (WebCore::WMLDocument::finishedParsing):
+        (WebCore::WMLDocument::initialize):
+        * wml/WMLErrorHandling.cpp: Never report 'WMLErrorDeckNotAccessible' messages through the tokenizer, that would alter the page into error state.
+        (WebCore::reportWMLError):
+        * wml/WMLPageState.cpp: Completly rewrote access path/domain parsing & deck-access control, strictly following the WML spec. All covered by tests.
+        (WebCore::WMLPageState::WMLPageState):
+        (WebCore::normalizedHostName):
+        (WebCore::hostFromURL):
+        (WebCore::urlForHistoryItem):
+        (WebCore::tryAccessHistoryURLs):
+        (WebCore::WMLPageState::processAccessControlData):
+        (WebCore::WMLPageState::resetAccessControlData):
+        (WebCore::WMLPageState::canAccessDeck):
+        (WebCore::WMLPageState::hostIsAllowedToAccess):
+        (WebCore::WMLPageState::pathIsAllowedToAccess):
+        * wml/WMLPageState.h:
+
+2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        FrameLoadType / WebFrameLoadType enums are out of sync
+        https://bugs.webkit.org/show_bug.cgi?id=28132
+
+        Modify FrameLoadType enum to match the order of WebFrameLoadType in WebFramePrivate.h / IWebFramePrivate.idl.
+        The mac/win public API exposes the old 'FrameLoadTypeReloadAllowingStaleData' value, which resides between
+        'FrameLoadTypeReload' and 'FrameLoadTypeSame'. Work around this problem, by assigning 'FrameLoadTypeSame = FrameLoadTypeReload + 2'.
+
+        Add a note to the FrameLoadType enum to keep it in sync with WebFramePrivate.h & IWebFramePrivate.idl.
+
+        * loader/FrameLoaderTypes.h:
+        (WebCore::):
+
+2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] manual-tests/wml/onevent-prev.wml crashes
+        https://bugs.webkit.org/show_bug.cgi?id=27722
+
+        Fix intrinsic event execution, leading to crashes.
+        First finish parsing the document, then execute the events. Not the other way round.
+        -> exposes bugs all over the WML layout tests, which relied on that quirk.
+
+        Fixes manual-tests/wml/onevent-prev.wml.
+
+        * wml/WMLDocument.cpp:
+        (WebCore::WMLDocument::WMLDocument):
+        (WebCore::WMLDocument::finishedParsing):
+        (WebCore::WMLDocument::initialize):
+        * wml/WMLDocument.h:
+
+2009-08-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Update WebCore.gyp to add ImageBuffer.cpp,
+        introduced by http://trac.webkit.org/changeset/46956.
+        https://bugs.webkit.org/show_bug.cgi?id=27844
+
+        * WebCore.gypi: Added ImageBuffer.cpp.
+
+2009-08-08  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Rubber-stamped by Jan Michael Alonzo.
+
+        Add [DontEnum] to WML specific initializeWMLPageState/resetWMLPageState methods, to assure
+        fast/dom/Window/window-properties.html doesn't show any differences when WML is enabled.
+
+        * dom/Document.idl:
+
+2009-08-08  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        SVG Filter need feColorMatrix implementation
+        [https://bugs.webkit.org/show_bug.cgi?id=27711]
+
+        Adds the filter effect feColorMatrix to SVG filters. 
+
+        There is already a test in the w3c directory.
+        Test: svg/W3C-SVG-1.1/filters-color-01-b.svg
+
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::matrix):
+        (WebCore::saturate):
+        (WebCore::huerotate):
+        (WebCore::luminance):
+        (WebCore::FEColorMatrix::apply):
+
+2009-08-08  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Build fix for Tiger.
+        https://bugs.webkit.org/show_bug.cgi?id=27844
+
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+
+2009-08-08  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        This is an initial implementation for linearRGB and sRGB support for all
+        platforms. Some platforms like Cg support different color spaces
+        natively, others like Qt, Cairo and Skia do not. This patch uses the
+        native implementation of platforms if possible and offers a common version
+        if not.
+
+        Different color spaces are used in SVG Filters. Nearly every Filter test 
+        case is a test for this patch and will be enabled, once Filters are enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=27844
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawTextInternal):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::createImageBuffer):
+        * platform/graphics/GeneratedImage.cpp:
+        (WebCore::GeneratedImage::drawPattern):
+        * platform/graphics/ImageBuffer.cpp: Added.
+        (WebCore::ImageBuffer::transformColorSpace):
+        * platform/graphics/ImageBuffer.h:
+        (WebCore::):
+        (WebCore::ImageBuffer::create):
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::OwnedBuffers::OwnedBuffers):
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::getEffectContext):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::strokeContains):
+        (WebCore::Path::strokeBoundingRect):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+        * platform/graphics/skia/SkiaUtils.cpp:
+        (WebCore::scratchContext):
+        * platform/graphics/wx/ImageBufferWx.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::paint):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::buildPattern):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::nativeImageForCurrentFrame):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::createMaskAndSwapContextForTextGradient):
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::prepareFilter):
+        (WebCore::SVGResourceFilter::applyFilter):
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::applyMask):
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
+
+2009-08-08  Xan Lopez  <xlopez@igalia.com>
+
+        Roll out r46928, since it wasn't done in accordance with the
+        agreed naming.
+
+        * bindings/gdom/GdomDOMObject.cpp: Removed.
+
+2009-08-08  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Enable accessibility in Gtk DRT
+        https://bugs.webkit.org/show_bug.cgi?id=25989
+
+        Add SPI to get the focused accessible element to be used by DRT.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_focused_element):
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.h:
+
+2009-08-07  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix - add html/canvas to the binding generator's include path
+
+        * GNUmakefile.am:
+
+2009-08-07  Oliver Hunt  <oliver@apple.com>
+
+        Another attempt to fix windows.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+
+2009-08-07  Oliver Hunt  <oliver@apple.com>
+
+        Windows build fix
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-08-07  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix - add html/canvas to the include path.
+
+        * GNUmakefile.am:
+
+2009-08-07  Adam Treat  <adam.treat@torchmobile.com>
+
+        Prospective build fix for Qt following r46937.
+
+        * WebCore.pro:
+
+2009-08-07  Yong Li  <yong.li@torchmobile.com>
+
+        WINCE PORT: store only width for GlyphBufferAdvance, to save space on low-memory devices
+        https://bugs.webkit.org/show_bug.cgi?id=27734
+
+        * platform/graphics/GlyphBuffer.h:
+        (WebCore::GlyphBuffer::advanceAt):
+        (WebCore::GlyphBuffer::advanceData):
+        (WebCore::GlyphBuffer::add):
+
+2009-08-07  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        WINCE PORT: pass unrecognized glyphs to GDI to handle
+        https://bugs.webkit.org/show_bug.cgi?id=27734
+
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::glyphDataForCharacter):
+
+2009-08-07  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Move Canvas related file to a subdirectories
+        https://bugs.webkit.org/show_bug.cgi?id=28026
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/CanvasGradient.cpp: Removed.
+        * html/CanvasGradient.h: Removed.
+        * html/CanvasGradient.idl: Removed.
+        * html/CanvasPattern.cpp: Removed.
+        * html/CanvasPattern.h: Removed.
+        * html/CanvasPattern.idl: Removed.
+        * html/CanvasPixelArray.cpp: Removed.
+        * html/CanvasPixelArray.h: Removed.
+        * html/CanvasPixelArray.idl: Removed.
+        * html/CanvasRenderingContext2D.cpp: Removed.
+        * html/CanvasRenderingContext2D.h: Removed.
+        * html/CanvasRenderingContext2D.idl: Removed.
+        * html/CanvasStyle.cpp: Removed.
+        * html/CanvasStyle.h: Removed.
+        * html/canvas: Added.
+        * html/canvas/CanvasGradient.cpp: Copied from WebCore/html/CanvasGradient.cpp.
+        * html/canvas/CanvasGradient.h: Copied from WebCore/html/CanvasGradient.h.
+        * html/canvas/CanvasGradient.idl: Copied from WebCore/html/CanvasGradient.idl.
+        * html/canvas/CanvasPattern.cpp: Copied from WebCore/html/CanvasPattern.cpp.
+        * html/canvas/CanvasPattern.h: Copied from WebCore/html/CanvasPattern.h.
+        * html/canvas/CanvasPattern.idl: Copied from WebCore/html/CanvasPattern.idl.
+        * html/canvas/CanvasPixelArray.cpp: Copied from WebCore/html/CanvasPixelArray.cpp.
+        * html/canvas/CanvasPixelArray.h: Copied from WebCore/html/CanvasPixelArray.h.
+        * html/canvas/CanvasPixelArray.idl: Copied from WebCore/html/CanvasPixelArray.idl.
+        * html/canvas/CanvasRenderingContext2D.cpp: Copied from WebCore/html/CanvasRenderingContext2D.cpp.
+        * html/canvas/CanvasRenderingContext2D.h: Copied from WebCore/html/CanvasRenderingContext2D.h.
+        * html/canvas/CanvasRenderingContext2D.idl: Copied from WebCore/html/CanvasRenderingContext2D.idl.
+        * html/canvas/CanvasStyle.cpp: Copied from WebCore/html/CanvasStyle.cpp.
+        * html/canvas/CanvasStyle.h: Copied from WebCore/html/CanvasStyle.h.
+
+2009-08-07  Szabo Carol  <carol.szabo@nokia.com>
+
+        Reviewed by David Hyatt.
+
+        QtWebkit ignores letter-spacing and word-spacing styles.
+        QtWebkit handles custom letter-spacing and word-spacing in the native QFont
+        class, but the values for these options are not not passed on from
+        the platform independent part of the Font class.
+        Fixed QtWebkit behavior by applying the options to QFont when it is
+        returned via Font::font()
+
+        http://bugs.webkit.org/show_bug.cgi?id=27988
+
+        LayoutTests:
+        fast/css/word-space-extra.html
+        css2.1/t1604-c542-letter-sp-00-b-a.html
+        css2.1/t1604-c541-word-sp-01-b-a.html
+        css1/text_properties/word_spacing.html
+        
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::font):
+
+2009-08-07  Nicolas Weber  <thakis@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Use correct highlight color for listboxes and completion popups.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28090
+
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        Rename activeListBoxSelectionBackgroundColor to
+        platformActiveListBoxSelectionBackgroundColor, so that it actually
+        overrides a virtual method.
+
+2009-08-07  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added a fourth bunch of Haiku-specific files for WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=26988
+
+        * platform/haiku/PasteboardHaiku.cpp: Added.
+        (WebCore::Pasteboard::Pasteboard):
+        (WebCore::Pasteboard::generalPasteboard):
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::canSmartReplace):
+        (WebCore::Pasteboard::plainText):
+        (WebCore::Pasteboard::documentFragment):
+        (WebCore::Pasteboard::writeURL):
+        (WebCore::Pasteboard::writeImage):
+        (WebCore::Pasteboard::clear):
+        * platform/haiku/PlatformKeyboardEventHaiku.cpp: Added.
+        (WebCore::keyIdentifierForHaikuKeyCode):
+        (WebCore::windowsKeyCodeForKeyEvent):
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):
+        (WebCore::PlatformKeyboardEvent::currentCapsLockState):
+        * platform/haiku/PlatformMouseEventHaiku.cpp: Added.
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/haiku/PlatformWheelEventHaiku.cpp: Added.
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+2009-08-07  Nicolas Weber  <thakis@chromium.org>
+
+        Teach WebKit how to decode jpegs in cmyk and ycck color spaces.
+        Heavily inspired by Firefox's take on this issue.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27909
+
+        Reviewed by Eric Seidel.
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageReader::decode):
+        Tell jpeglib to convert ycck to cmyk and keep cmyk.
+        (WebCore::convertCMYKToRGBA):
+        Added function to convert cmyk to rgb.
+        (WebCore::convertRGBToRGBA):
+        Extracted existing conversion logic into its own function.
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        Call convertCMYKToRGBA for cmyk images, convertRGBToRGBA for rgb
+        images.
+
+2009-08-07  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        SharedWorkers should be shared
+        https://bugs.webkit.org/show_bug.cgi?id=28058
+
+        Added tracking of shared workers to the SharedWorkerRepository.
+
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::create):
+        Changed SharedWorkerProxy to derive from ThreadSafeShared, as it needs to outlive the repository (if closed while some documents are still loading).
+        (WebCore::SharedWorkerProxy::thread):
+        (WebCore::SharedWorkerProxy::closing):
+        Added flag used to determine whether the worker has closed itself while loading.
+        (WebCore::SharedWorkerProxy::url):
+        (WebCore::SharedWorkerProxy::name):
+        Proxy now tracks worker URL and name to allow validity checks per section 4.8.3 of the WebWorkers spec.
+        (WebCore::SharedWorkerProxy::SharedWorkerProxy):
+        (WebCore::SharedWorkerProxy::addToDocumentSet):
+        Added API to track the document set for a worker to allow worker shutdown. Currently does nothing.
+        (WebCore::SharedWorkerScriptLoader::SharedWorkerScriptLoader):
+        Renamed SharedWorkerLoader to be SharedWorkerScriptLoader for clarity.
+        (WebCore::SharedWorkerScriptLoader::load):
+        (WebCore::SharedWorkerScriptLoader::notifyFinished):
+        (WebCore::DefaultSharedWorkerRepository::instance):
+        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
+        Now handles "worker already loaded" case.
+        (WebCore::SharedWorkerRepository::connect):
+        Delegates to DefaultSharedWorkerRepository::connectToWorker
+        (WebCore::DefaultSharedWorkerRepository::connectToWorker):
+        Added code to track the SharedWorkerProxy in a map, and to handle the "worker already loaded" case.
+        (WebCore::DefaultSharedWorkerRepository::getProxy):
+        Atomic get-or-create operation on the internal tracking HashMap.
+        * workers/DefaultSharedWorkerRepository.h:
+        * workers/SharedWorker.cpp:
+        (WebCore::SharedWorker::SharedWorker):
+        * workers/SharedWorkerRepository.h:
+        Removed instance() API and made constructor private to prevent instantiation.
+        (WebCore::SharedWorkerRepository::SharedWorkerRepository):
+
+2009-08-07  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added four Haiku-specific files for WebCore:
+        PopupMenuHaiku.cpp, ScreenHaiku.cpp,
+        SearchPopupMenuHaiku.cpp and SoundHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28080
+
+        * platform/haiku/PopupMenuHaiku.cpp: Added.
+        (WebCore::PopupMenu::PopupMenu):
+        (WebCore::PopupMenu::~PopupMenu):
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::hide):
+        (WebCore::PopupMenu::updateFromElement):
+        (WebCore::PopupMenu::itemWritingDirectionIsNatural):
+        * platform/haiku/ScreenHaiku.cpp: Added.
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+        (WebCore::screenIsMonochrome):
+        * platform/haiku/SearchPopupMenuHaiku.cpp: Added.
+        (WebCore::SearchPopupMenu::SearchPopupMenu):
+        (WebCore::SearchPopupMenu::saveRecentSearches):
+        (WebCore::SearchPopupMenu::loadRecentSearches):
+        (WebCore::SearchPopupMenu::enabled):
+        * platform/haiku/SoundHaiku.cpp: Added.
+        (WebCore::systemBeep):
+
+2009-08-07  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added two Haiku-specific files to WebCore:
+        TemporaryLinkStubs.cpp and WidgetHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28080
+
+        * platform/haiku/TemporaryLinkStubs.cpp: Added.
+        (loadResourceIntoArray):
+        (WebCore::historyContains):
+        (WebCore::supportedKeySizes):
+        (WebCore::signedPublicKeyAndChallengeString):
+        (WebCore::userIdleTime):
+        (WebCore::callOnMainThread):
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+        (WebCore::KURL::fileSystemPath):
+        (WebCore::getSupportedKeySizes):
+        * platform/haiku/WidgetHaiku.cpp: Added.
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::~Widget):
+        (WebCore::Widget::frameRect):
+        (WebCore::Widget::setFrameRect):
+        (WebCore::Widget::setFocus):
+        (WebCore::Widget::setCursor):
+        (WebCore::Widget::show):
+        (WebCore::Widget::hide):
+        (WebCore::Widget::paint):
+        (WebCore::Widget::setIsSelected):
+
+2009-08-07  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix the problem that isAttribute is set to false for onerror and
+        onmessage in worker custom code.
+        https://bugs.webkit.org/show_bug.cgi?id=28083
+
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_SETTER):
+
+2009-08-07  Vitaly Repeshko  <vitalyr@quad.spb.corp.google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        V8 bindings: speed up lookupDOMWrapper by using new V8 API function.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28071
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::lookupDOMWrapper):
+
+2009-08-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        selectionHasStyle doesn't handle text-specific properties properly
+        https://bugs.webkit.org/show_bug.cgi?id=27858
+
+        This patch modifies selectionHasStyle so that it returns TrueTriState when text styles
+        (text-decoration, font-style, font-weight, & color) are present in all text nodes,
+        regardless of whether the style is also present in their ancestor nodes or not.
+        e.g. New behavior concludes that <b><i>hello</i><i>world</i></b> has italic style.
+
+        WebKit now applies the text styles (bold, italic, etc) if the specified style was not present on
+        at least one text node, rather than at the beginning of selection except on Mac.
+        On Mac, WebKit applies the text style if the style was not present at the beginning of style.
+
+        Test: editing/execCommand/toggle-compound-styles.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::getPropertiesNotInComputedStyle): bug fix, must use copy instead of makeMutable for a mutable style.
+        * editing/Editor.cpp:
+        (WebCore::):
+        (WebCore::triStateOfStyleInComputedStyle): Added a boolean type to ignore text-specific styles
+        (WebCore::Editor::selectionHasStyle): Ignores text-specific styles for all but text nodes
+        * editing/EditorCommand.cpp:
+        (WebCore::executeToggleStyle): Uses selectionHasStyle instead of selectionStartHasStyle
+
+2009-08-07  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Do not register V8 error message listener in WorkerContextExecutionProxy.
+        https://bugs.webkit.org/show_bug.cgi?id=28082
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initV8IfNeeded):
+
+2009-08-07  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        Cairo-based Windows port does not handle cookies properly
+        https://bugs.webkit.org/show_bug.cgi?id=27414
+
+        curl handles cookies by itself, so using WinINet functions
+        to get and set cookies is wrong.
+
+        Replace CookieJarWin.cpp with CookieJarCurl.cpp so that
+        cookies can be implemented later once curl provides an API to
+        get and set cookies.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-08-07  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28074
+
+        V8 bindings for the window.applicationCache attribute.
+
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp: Added.
+
+2009-08-07  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Right click on timeline of media controls panel cause seek
+        https://bugs.webkit.org/show_bug.cgi?id=27920
+
+        Add a test simulate the behavior of seeking by right clicking
+        on the time bar of media controls while playing.
+
+        * media/controls-right-click-on-timebar-expected.txt: Added.
+        * media/controls-right-click-on-timebar.html: Added.
+
+2009-08-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        deprecatedCopyInheritableProperties must be replaced by two different functions
+        https://bugs.webkit.org/show_bug.cgi?id=28057
+
+        This patch deletes deprecatedInheritableProperties and modifies call callees to call either editingStyleAtPosition
+        or prepareEditingStyleToApplyAt. The concept of editing style is introduced in this patch,
+        which consists of all CSS properties need to be preserved under editing operations.
+
+        No test is added since this patch does not change any behavior.
+
+        * css/CSSComputedStyleDeclaration.cpp: Removed deprecatedCopyInheritableProperties
+        * css/CSSComputedStyleDeclaration.h: Removed deprecatedCopyInheritableProperties
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::):
+        (WebCore::editingStyleAtPosition): Obtains the editing-specific computed style at the position
+        (WebCore::prepareEditingStyleToApplyAt): Removes redundant editing styles at the specified position
+        (WebCore::removeStylesAddedByNode): Removes the style derived from the specified node
+        * editing/ApplyStyleCommand.h:
+        (WebCore::):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::moveParagraphs): Uses editingStyleAtPosition
+        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem): Uses editingStyleAtPosition
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::removeEnclosingAnchorStyle): Uses removeStyleOfNode
+        (WebCore::DeleteSelectionCommand::saveTypingStyleState): Uses editingStyleAtPosition
+        (WebCore::DeleteSelectionCommand::calculateTypingStyleAfterDelete): Uses prepareEditingStyleToApplyAt
+        * editing/EditCommand.cpp:
+        * editing/EditCommand.h:
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::calculateStyleBeforeInsertion): Uses editingStyleAtPosition
+        (WebCore::InsertParagraphSeparatorCommand::applyStyleAfterInsertion): Uses prepareEditingStyleToApplyAt
+        * editing/RemoveFormatCommand.cpp:
+        (WebCore::RemoveFormatCommand::doApply): Uses editingStyleAtPosition
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::handleStyleSpansBeforeInsertion): Uses editingStyleAtPosition
+        (WebCore::ReplaceSelectionCommand::handleStyleSpans): Uses editingStyleAtPosition and prepareEditingStyleToApplyAt
+        (WebCore::ReplaceSelectionCommand::doApply): Uses prepareEditingStyleToApplyAt
+        * editing/markup.cpp:
+        (WebCore::removeEnclosingMailBlockquoteStyle): Uses removeStyleOfNode
+        (WebCore::removeDefaultStyles): Uses prepareEditingStyleToApplyAt
+        (WebCore::createMarkup): Uses editingStyleAtPosition
+
+2009-08-07  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27250: Geolocation callback function IDL files are superfluous
+        https://bugs.webkit.org/show_bug.cgi?id=27250
+
+        The objects for the Geolocation success and error callbacks are created 'manually' in
+        WebCore/bindings/js/JSGeolocationCustom.cpp. Furthermore, the callback interfaces are 
+        marked 'NoInterfaceObject' in the W3C spec, so the prototype should not
+        appear on the window object. Hence IDL files for these callbacks are not required.
+
+        See http://www.w3.org/TR/geolocation-API/#geolocation_interface and
+        http://www.w3.org/TR/WebIDL/#NoInterfaceObject.
+
+        No new tests required.
+
+        * DerivedSources.make: Modified. Removed reference to IDL files.
+        * WebCore.gypi: Modified. Removed reference to IDL files.
+        * WebCore.xcodeproj/project.pbxproj: Modified. Removed reference to IDL files.
+        * page/PositionCallback.idl: Removed.
+        * page/PositionErrorCallback.idl: Removed.
+
+2009-08-07  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by David Levin.
+
+        Build fix for Qt when ENABLE_VIDEO = 0.  This was necessitated by r46890 which
+        put the idl files back into play regardless of compile time defines.
+
+        * html/TimeRanges.idl:
+
+2009-08-07  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Coding style patches for RenderThemeQt.cpp based on results from cpp_style.py.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28050
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::baselinePosition):
+        (WebCore::inflateButtonRect):
+        (WebCore::RenderThemeQt::supportsFocus):
+        (WebCore::RenderThemeQt::applyTheme):
+
+2009-08-07  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Prevent RenderThemeQt AdjustStyle based calls for TextField, MenuList and MenuListButton
+        from discarding style colour.
+
+        Add tests and remove tests from platform/qt/Skipped that now pass.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28050
+
+        Tests: fast/forms/menulist-style-color.html
+               fast/forms/text-style-color.html
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::adjustTextFieldStyle):
+        (WebCore::RenderThemeQt::adjustMenuListStyle):
+        (WebCore::RenderThemeQt::adjustMenuListButtonStyle):
+
+2009-08-07  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22495
+        [V8] Re-land http://trac.webkit.org/changeset/46821, now that
+        http://trac.webkit.org/changeset/46874 re-landed
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-08-07  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Darin Adler and George Staikos.
+
+        Add rectToRect convenience function which returns the TransformationMatrix
+        which maps the 'from' rectangle to the 'to' rectangle.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28067
+
+        No tests as this would require binding the method to js and since it is static
+        that doesn't seem possible.  Please check the math.
+
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::TransformationMatrix::rectToRect):
+        * platform/graphics/transforms/TransformationMatrix.h:
+
+2009-08-07  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Implement the HTML5 hashchange event.
+        https://bugs.webkit.org/show_bug.cgi?id=21605
+
+        Test: fast/loader/hashchange-event.html
+
+        * dom/EventNames.h: Add "hashchange"
+        * html/HTMLAttributeNames.in: Add "onhashchange"
+
+        * loader/FrameLoader.cpp:
+        (WebCore::HashChangeEventTask::create):
+        (WebCore::HashChangeEventTask::performTask):
+        (WebCore::HashChangeEventTask::HashChangeEventTask):
+        (WebCore::FrameLoader::scrollToAnchor): When an anchor navigation is completed and the
+          new fragment identifier is different from the old one, queue a hash change event
+          on the Document.
+
+        Add a window event listener for the hashchange event if onhashchange is encountered:
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute): 
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+
+        Add a new string utility method that gives "null and empty are equivalent" behavior:
+        * platform/text/PlatformString.h:
+        (WebCore::equalIgnoringNullity):
+        * platform/text/StringImpl.cpp:
+        (WebCore::equalIgnoringNullity):
+        * platform/text/StringImpl.h:
+
+2009-08-07  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Add the initial implementation of the ability to resize the columns in
+        a DataGrid in the Web Inspector. Enables that functionality in both the
+        Profile View and in the Local Storage View.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26182
+        
+        In this version, resizing a column can change the width of at most two
+        columns (the columns to the left and right of the resizer being dragged).
+        
+        Possible changes in future patches:
+        
+        1) Be able to specify the minimum size of a column and the maximum size
+           of a column. If the minimum size is equal to the maximum size, the
+           column can't be resized.
+        2) Make the behavior more in line with the following description:
+        
+        Everything before the column that is resized stays fixed size. The
+        resized column changes sizes. The other columns except the last stay
+        the same size. And the last column adjusts to fit with a minimum size.
+        If the last column is already the minimum, the next to last column
+        shrinks, etc.
+        
+        3) Make it possible to scale the column sizes appropriately when the
+           Web Inspector window gets resized.
+        
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        Once the DataGrid is added to the DOM, update the widths of the
+        DataGrid in order to put the resizers in place.
+        (WebInspector.DOMStorageItemsView.prototype.resize):
+        Update the widths of the DataGrid in order to correctly adjust the
+        positions of the resizers.
+        
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid):
+        Store column groups whose widths can later be changed when the columns
+        are resized by the user.
+        Also, keep track of whether the widths of the columns have been
+        initialized.
+        (WebInspector.DataGrid.prototype.updateWidths):
+        Create the resizers for the columns.
+        (WebInspector.DataGrid.prototype._clickInDataTable):
+        Didn't actually change anything in this method, just added a comma to
+        the end of the function.
+        (WebInspector.DataGrid.prototype._startResizerDragging):
+        Store the resizer that is currently dragging.
+        (WebInspector.DataGrid.prototype._resizerDragging):
+        Constrain the area that the resizer can be dragged to the column to
+        it's left and right, with some padding added to make sure that the
+        neighboring columns don't disappear.
+        (WebInspector.DataGrid.prototype._endResizerDragging):
+        
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.resize):
+        Resize the view.
+        (WebInspector.DatabasesPanel.prototype._updateSidebarWidth):
+        ditto.
+        
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView.prototype.show):
+        Now that the DataGrid is actually attached to the DOM, update the
+        widths of the DataGrid in order to put the resizers in place.
+        (WebInspector.ProfileView.prototype.resize):
+        Update the widths of the DataGrid in order to correctly adjust the
+        positions of the resizers.
+        
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.resize):
+        Resize the view.
+        (WebInspector.ProfilesPanel.prototype._updateSidebarWidth):
+        ditto.
+        
+        * inspector/front-end/inspector.css:
+        Add in a style rule for a resizer in the Data Grid.
+
+2009-08-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Back out r46847 and fix the Qt build system to always generate
+        all the JS binding files from IDL files. The generated files
+        have #if feature guards, so the #ifs are not needed in the
+        files using them.
+
+        * WebCore.pro:
+        * bindings/js/JSEventTarget.cpp:
+        * bindings/js/JSWorkerContextBase.cpp:
+        * bindings/js/WorkerScriptController.cpp:
+
+2009-08-07  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Adele Peterson.
+
+        Cannot scroll for box-reflect:right
+        https://bugs.webkit.org/show_bug.cgi?id=27979
+
+        Update m_overflowLeft an m_overflowWidth for reflection just like
+        m_overflowTop and m_overflowHeight.
+
+        Test: fast/reflections/reflection-overflow-scroll.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+
+2009-08-06  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        box-shadow's spread is ignored with <table>
+        https://bugs.webkit.org/show_bug.cgi?id=28017
+
+        Use RenderStyle::getBoxShadowExtent just like RenderBlock.
+
+        Test: fast/box-shadow/box-shadow-overflow-scroll.html
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+
+2009-08-06  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: NodeLists Don't Display Well in the Console
+        https://bugs.webkit.org/show_bug.cgi?id=28061
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._format): Specific check if the object is a NodeList, display as an "array"
+
+2009-08-06  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by David Levin.
+
+        Chromium Linux: add support for @font-face
+        https://bugs.webkit.org/show_bug.cgi?id=28015
+        
+        * loader/CachedFont.cpp:
+        (WebCore::CachedFont::~CachedFont):
+        (WebCore::CachedFont::ensureCustomFontData):
+        (WebCore::CachedFont::platformDataFromCustomData):
+        (WebCore::CachedFont::allClientsRemoved):
+
+        Modified #ifdefs so that chromium linux can load remote fonts.
+        
+        * platform/graphics/chromium/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        (WebCore::createFontCustomPlatformData):
+
+        Create SkTypeface for a web font by calling SkTypeface::CreateFromStream function.
+        
+        (WebCore::RemoteFontStream::RemoteFontStream):
+        (WebCore::RemoteFontStream::~RemoteFontStream):
+        (WebCore::RemoteFontStream::rewind):
+        (WebCore::RemoteFontStream::read):
+
+        New class that implements SkStream interface and wraps wtf's SharedBuffer.
+        
+        * platform/graphics/chromium/FontCustomPlatformData.h:
+        (WebCore::FontCustomPlatformData::FontCustomPlatformData):
+
+        Added member variables for Linux.
+        
+2009-08-06  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix JPEGImageDecoder.cpp compile error on WinCE
+        https://bugs.webkit.org/show_bug.cgi?id=28051
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+
+2009-08-06  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Eric Seidel.
+
+        Adding WebCore support for the waf build system for wx.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27619
+
+        * wscript: Added.
+
+2009-08-06  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed revert.
+
+        http://bugs.webkit.org/show_bug.cgi?id=27879
+
+        Revert 46877 because it broke GTK.
+
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+
+2009-08-06  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 27956 - AX: roleValue should be cached for performance
+        https://bugs.webkit.org/show_bug.cgi?id=27956
+
+        Caches the role value of an accessibility object instead of calculating it everytime.
+        The changes gained a 5% speedup using VoiceOver to navigate a webpage.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::handleAriaRoleChanged):
+
+        Use generic role setter instead of specific ARIA role setter.
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::AccessibilityObject):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::headingLevel):
+
+        Make headingLevel into instance method so that it can *safely* be called in the constructor.
+
+        (WebCore::AccessibilityObject::setRoleValue):
+        (WebCore::AccessibilityObject::roleValue):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::AccessibilityRenderObject):
+        (WebCore::AccessibilityRenderObject::headingLevel):
+        (WebCore::AccessibilityRenderObject::intValue):
+        (WebCore::AccessibilityRenderObject::updateAccessibilityRole):
+        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (AXAttributeStringSetHeadingLevel):
+
+2009-08-06  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Adam Barth.
+
+        Change Noncopyable inheriting to public
+        http://bugs.webkit.org/show_bug.cgi?id=27879
+
+        Since Noncopyable is inherited from FastAllocBase, Noncopyable's
+        inheriting has been changed to public.
+
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+
+2009-08-06  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Add explicit dependencies for our build verification scripts to ensure that they always run after linking has completed.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-08-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Implement the matchMedium method on the Media interface described in the CSSOM View Module.
+        https://bugs.webkit.org/show_bug.cgi?id=22495
+        
+        Add a new Media interface, obtainable via the AbstractView, that can
+        evaluate queries via its matchesMedium() method.
+
+        Test: fast/media/matchmedium-query-api.html
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        Add Media.* files to the build.
+
+        * css/Media.cpp: Added.
+        (WebCore::Media::Media):
+        (WebCore::Media::type):
+        (WebCore::Media::matchMedium):
+        * css/Media.h: Added.
+        (WebCore::Media::create):
+        (WebCore::Media::document):
+        * css/Media.idl: Added.
+        Media::matchMedium() uses a MediaQueryEvaluator() to test the query.
+
+        * page/AbstractView.idl:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::media):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        Add a readonly attribute for Media.
+
+2009-08-06  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27455
+        Support for a custom validation message in ValidityState and related
+        form controls.
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#dom-cva-setcustomvalidity
+
+        Tests: fast/forms/ValidityState-customError-001.html
+               fast/forms/ValidityState-customError-002.html
+               fast/forms/ValidityState-customError-003.html
+               fast/forms/ValidityState-customError-004.html
+
+        * html/HTMLButtonElement.idl: setCustomValidity DOM method
+        * html/HTMLFieldSetElement.idl: ditto
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::setCustomValidity): ditto
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::valueMissing): moved down
+        * html/HTMLInputElement.idl: ditto
+        * html/HTMLSelectElement.idl: ditto
+        * html/HTMLTextAreaElement.idl:
+        * html/ValidityState.h:
+        (WebCore::ValidityState::setCustomErrorMessage): method to set custom
+        validation message
+        (WebCore::ValidityState::customError): validation flag
+
+2009-08-06  Mark Rowe  <mrowe@apple.com>
+
+        Bring a little order to our otherwise out of control lives.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-08-06  Mark Rowe  <mrowe@apple.com>
+
+        Stop copying .idl files in to the framework resources directory.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-08-06  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build some more.
+
+        Add JSWebSocket.cpp and JSWebSocket.h to the Xcode project, and move the WebSocket-related
+        files and groups in to the appropriate locations.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-08-06  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add WebSocket.idl
+        https://bugs.webkit.org/show_bug.cgi?id=27209
+
+        Add WebSocket.idl in WebCore/websockets/.
+        Add build systems only for GNUmakefile.am and WebCore.xcodeproj now.
+        Other build systems will be updated once the code is functional.
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSWebSocketConstructor.cpp: Added.
+        * bindings/js/JSWebSocketConstructor.h: Added.
+        * bindings/js/JSWebSocketCustom.cpp: Added.
+        * websockets/WebSocket.cpp: Added.
+        * websockets/WebSocket.h: Added.
+        * websockets/WebSocket.idl: Added.
+
+2009-08-06  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Style cleaning for WorkerContextExecutionProxy.
+        https://bugs.webkit.org/show_bug.cgi?id=27997
+
+        Cleanup WorkerContextExecutioonProxy related files to follow
+        WebKit coding styles after all V8 binding codes are upstreamed.
+        1) Lower-case the first letter of remaining functins in class
+           WorkerContextExecutionProxy. Update the V8 code generator
+           and all other references accordingly.
+        2) Integrate getConstructor from WorkerContextExecutionProxy
+           to V8DOMWrapper.
+        3) Other misc changes, like removing trailing whitespaces and
+           sorting the include files.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getConstructorForContext):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::~V8WorkerContextEventListener):
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+        (WebCore::V8WorkerContextEventListener::reportError):
+        (WebCore::V8WorkerContextEventListener::getReceiverObject):
+        * bindings/v8/V8WorkerContextObjectEventListener.cpp:
+        (WebCore::weakObjectEventListenerCallback):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::handleConsoleMessage):
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
+        (WebCore::WorkerContextExecutionProxy::convertEventToV8Object):
+        (WebCore::WorkerContextExecutionProxy::convertEventTargetToV8Object):
+        (WebCore::WorkerContextExecutionProxy::convertWorkerContextToV8Object):
+        (WebCore::WorkerContextExecutionProxy::toV8):
+        (WebCore::WorkerContextExecutionProxy::forgetV8EventObject):
+        (WebCore::WorkerContextExecutionProxy::removeEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        (WebCore::WorkerContextExecutionProxy::context):
+        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-08-06  Darin Adler  <darin@apple.com>
+
+        Fix Mac Leopard debug build.
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::equalIgnoringCase): Removed meaningless assertion; an unsigned
+        is always >= 0 and checking causes a warning in the newer versions of gcc.
+
+2009-08-06  Adam Barth  <abarth@webkit.org>
+
+        Unreview rollout.
+
+        Revert 46840 because it broke the reliability tests.
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScheduledAction.h:
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+
+2009-08-06  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed rollout.
+
+        Revert 46840 in preparation to revert 46838, which broke the reliability tests.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::updateDocumentWrapperCache):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        (WebCore::V8Proxy::mainWorldContext):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::context):
+
+2009-08-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: move style-related utilities into InjectedScript.
+
+        http://bugs.webkit.org/show_bug.cgi?id=27939
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.CSSStyleDeclaration):
+        (WebInspector.CSSStyleDeclaration.prototype.isPropertyImplicit):
+        (WebInspector.CSSStyleDeclaration.prototype.styleTextWithShorthands):
+        (WebInspector.CSSStyleDeclaration.prototype.getLonghandProperties):
+        (WebInspector.CSSStyleDeclaration.prototype.getShorthandPriority):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.applyStyleText):
+        (InjectedScript.toggleStyleEnabled):
+        (InjectedScript._serializeStyle):
+        (InjectedScript._getUniqueStyleProperties):
+        (InjectedScript._getLonghandProperties):
+        (InjectedScript._getShorthandPriority):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._update):
+        (WebInspector.StylePropertiesSection.prototype.isPropertyOverloaded):
+        (WebInspector.StylePropertiesSection.prototype.onpopulate):
+        (WebInspector.StylePropertyTreeElement.prototype.get priority):
+        (WebInspector.StylePropertyTreeElement.prototype.get value):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/utilities.js:
+
+2009-08-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed build fix, add #ifdef guards around
+        inclusions of shared worker specific files.
+
+        * bindings/js/JSEventTarget.cpp:
+        * bindings/js/JSWorkerContextBase.cpp:
+        * bindings/js/WorkerScriptController.cpp:
+
+2009-08-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        cssgrammar.cpp fails to compile with RVCT compiler
+        https://bugs.webkit.org/show_bug.cgi?id=27952
+
+        * css/CSSGrammar.y: Do not convert to String to get rid of the stray
+        memory allocation 
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::equalIgnoringCase):
+        * platform/text/StringImpl.h: 
+        (WebCore::equalIgnoringCase): Add charactersEqualIgnoringCase
+          function that works with a character pointer and length
+
+2009-08-06  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Created first working implementation of SharedWorkers (execution only, no sharing).
+        https://bugs.webkit.org/show_bug.cgi?id=27927
+
+        Added initial implementations of SharedWorkerThread and SharedWorkerContext.
+        No v8 bindings yet.
+
+        * DerivedSources.cpp:
+        Added shared worker files.
+        * DerivedSources.make:
+        Added shared worker files.
+        * GNUmakefile.am:
+        Added shared worker files.
+        * WebCore.gypi:
+        Added shared worker files.
+        * WebCore.pro:
+        Added shared worker files.
+        * WebCore.vcproj/WebCore.vcproj:
+        Added shared worker files.
+        * WebCore.xcodeproj/project.pbxproj:
+        Added shared worker files.
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        Added code to convert from EventTarget to correct JS class.
+        (WebCore::toEventTarget):
+        Added code to cast from JS object to appropriate EventTarget impl class.
+        * bindings/js/JSSharedWorkerConstructor.cpp:
+        (WebCore::JSSharedWorkerConstructor::JSSharedWorkerConstructor):
+        (WebCore::constructSharedWorker):
+        Tweaked the constructor code to pass in the lexical global object like normal workers.
+        * bindings/js/JSSharedWorkerContextCustom.cpp: Added.
+        (WebCore::JSSharedWorkerContext::mark):
+        Custom marking of the onconnect handler.
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::toJSSharedWorkerContext):
+        (WebCore::toJSWorkerContext):
+        Added proper conversion to the correct WorkerContext derived class.
+        * bindings/js/JSWorkerContextBase.h:
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::initScript):
+        Updated WorkerScriptController to create the correct type of binding object (JSSharedWorkerContext vs JSDedicatedWorkerContext)
+        * bindings/scripts/CodeGeneratorV8.pm:
+        Added support for SharedWorkerContext.
+        * bindings/v8/DOMObjectsInclude.h:
+        Added shared worker bindings files.
+        * dom/EventNames.h:
+        Added connect event.
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toSharedWorkerContext):
+        Added API for casting to new derived class (SharedWorkerContext).
+        * dom/EventTarget.h:
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::resolveURL):
+        Moved code that resolves/validates URLs to base class so it can be shared between dedicated/shared workers.
+        * workers/AbstractWorker.h:
+        * workers/DedicatedWorkerContext.cpp:
+        (WebCore::DedicatedWorkerContext::logException):
+        Refactored exception handling code - moved onerror handling to base class.
+        * workers/DedicatedWorkerContext.h:
+        (WebCore::DedicatedWorkerContext::isDedicatedWorkerContext):
+        * workers/SharedWorker.cpp:
+        (WebCore::SharedWorker::SharedWorker):
+        Changed constructor to fire up worker thread.
+        * workers/SharedWorker.h:
+        * workers/SharedWorkerContext.cpp: Added.
+        (WebCore::SharedWorkerContext::SharedWorkerContext):
+        (WebCore::SharedWorkerContext::~SharedWorkerContext):
+        (WebCore::SharedWorkerContext::logException):
+        (WebCore::SharedWorkerContext::addMessage):
+        Placeholder methods until we add support for sending exceptions/messages to console.
+        (WebCore::SharedWorkerContext::dispatchConnect):
+        (WebCore::SharedWorkerContext::thread):
+        * workers/SharedWorkerContext.h: Added.
+        (WebCore::SharedWorkerContext::create):
+        (WebCore::SharedWorkerContext::isSharedWorkerContext):
+        (WebCore::SharedWorkerContext::toSharedWorkerContext):
+        (WebCore::SharedWorkerContext::setOnconnect):
+        (WebCore::SharedWorkerContext::onconnect):
+        (WebCore::SharedWorkerContext::name):
+        * workers/SharedWorkerContext.idl: Added.
+        * workers/SharedWorkerRepository.h: Added.
+        (WebCore::SharedWorkerRepository::~SharedWorkerRepository):
+        * workers/DefaultSharedWorkerRepository.cpp: Added.
+        Implementation of core singleton class that will be used to implement sharing.
+        (WebCore::SharedWorkerProxy::setThread):
+        Proxy object used to handle resource loading for a given shared worker.
+        (WebCore::SharedWorkerProxy::postTaskToLoader):
+        (WebCore::SharedWorkerProxy::postTaskForModeToWorkerContext):
+        Placeholder routines until we implement loading.
+        (WebCore::SharedWorkerConnectTask::create):
+        Creates a task to fire off a connect event on the worker thread.
+        (WebCore::SharedWorkerConnectTask::SharedWorkerConnectTask):
+        (WebCore::SharedWorkerConnectTask::performTask):
+        (WebCore::SharedWorkerLoader::SharedWorkerLoader):
+        Added helper object to load the initial script for the worker.
+        (WebCore::SharedWorkerLoader::load):
+        (WebCore::SharedWorkerLoader::notifyFinished):
+        (WebCore::SharedWorkerRepository::instance):
+        (WebCore::DefaultSharedWorkerRepository::instance):
+        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
+        Fires off the worker thread once the script is loaded.
+        (WebCore::SharedWorkerRepository::connect):
+        (WebCore::DefaultSharedWorkerRepository::DefaultSharedWorkerRepository):
+        (WebCore::DefaultSharedWorkerRepository::~DefaultSharedWorkerRepository):
+        * workers/DefaultSharedWorkerRepository.h: Added.
+        * workers/SharedWorkerThread.cpp: Added.
+        (WebCore::SharedWorkerThread::create):
+        (WebCore::SharedWorkerThread::SharedWorkerThread):
+        (WebCore::SharedWorkerThread::~SharedWorkerThread):
+        (WebCore::SharedWorkerThread::createWorkerContext):
+        * workers/SharedWorkerThread.h: Added.
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::reportException):
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::isSharedWorkerContext):
+        (WebCore::WorkerContext::isDedicatedWorkerContext):
+        Added APIs to determine the type of a given context.
+
+2009-08-06  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Added ENABLE_3D_CANVAS flag to build, default to off
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-08-06  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] windowsKeyCodeForKeyEvent fix
+
+        Fix windowsKeyCodeForKeyEvent to determine wheter the event comes from the keypad.
+
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+
+2009-08-06  George Staikos  <george.staikos@torchmobile.com>
+
+        Rubber-stamped by Ariya Hidayat.
+
+        Remove the dead wince/ directory that should never have gone in.
+
+        * svg/graphics/wince: Removed.
+        * svg/graphics/wince/SVGResourceFilterWince.cpp: Removed.
+
+2009-08-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Extract style editing into a separate file that is
+        going to be loaded in page context.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27939
+
+        * inspector/front-end/InjectedScript.js: Added.
+        (InjectedScript.applyStyleText):
+        (InjectedScript.setStyleText):
+        (InjectedScript.toggleStyleEnabled):
+        (InjectedScript.setStyleRule):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted.callback):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.StylePropertyTreeElement.prototype.):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2009-08-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        [V8] Remove bug-bait V8Proxy::context()
+        https://bugs.webkit.org/show_bug.cgi?id=27826
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::updateDocumentWrapperCache):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        (WebCore::V8Proxy::mainWorldContext):
+        * bindings/v8/V8Proxy.h:
+
+2009-08-06  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed attempt to fix the Chromium Linux build.  This function is
+        not used.
+
+        * bindings/v8/OwnHandle.h:
+
+2009-08-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Teach ScheduledAction::execute about isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=27703
+
+        We now save a weak handle to the original context.  We use that handle
+        to call the timeout in the right context / world.
+
+        Tests: http/tests/security/isolatedWorld/window-setTimeout-function.html
+               http/tests/security/isolatedWorld/window-setTimeout-string.html
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScheduledAction.h:
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+
+2009-08-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [V8] Revert http://trac.webkit.org/changeset/46821, which was
+        landed to supplement http://trac.webkit.org/changeset/46816, but
+        now that the latter is reverted, the former needs the same.
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-08-05  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Color is only reported in rgb() format; should toggle between rgb() and hex
+        https://bugs.webkit.org/show_bug.cgi?id=13516
+
+          New Class to Parse and Change Between Color Representations:
+
+        * inspector/front-end/Color.js: Added.
+        (WebInspector.Color):
+
+          Representations of Colors in Raw Form. (May be Lazy Loaded):
+
+        (WebInspector.Color.prototype.get shorthex):
+        (WebInspector.Color.prototype.get hex):
+        (WebInspector.Color.prototype.set hex):
+        (WebInspector.Color.prototype.get rgb):
+        (WebInspector.Color.prototype.set rgb):
+        (WebInspector.Color.prototype.get hsl):
+        (WebInspector.Color.prototype.set hsl):
+        (WebInspector.Color.prototype.get nickname):
+        (WebInspector.Color.prototype.set nickname):
+        (WebInspector.Color.prototype.get rgba):
+        (WebInspector.Color.prototype.set rgba):
+        (WebInspector.Color.prototype.get hsla):
+        (WebInspector.Color.prototype.set hsla):
+
+          Helpers and Standard String Representations:
+
+        (WebInspector.Color.prototype.hasShortHex):
+        (WebInspector.Color.prototype.toRgb):
+        (WebInspector.Color.prototype.toHsl):
+        (WebInspector.Color.prototype.toShortHex):
+        (WebInspector.Color.prototype.toHex):
+        (WebInspector.Color.prototype.toRgba):
+        (WebInspector.Color.prototype.toHsla):
+        (WebInspector.Color.prototype.toNickname):
+
+          Conversion Functions to Determine Other Representations:
+          My Sources for all algorithms and sample data:
+          Wikipedia: http://en.wikipedia.org/wiki/HSV_color_space
+          CSS Specification: http://www.w3.org/TR/css3-color/#hsla-color
+
+        (WebInspector.Color.prototype.rgbToHex):
+        (WebInspector.Color.prototype.hexToRgb):
+        (WebInspector.Color.prototype.rgbToHsl):
+        (WebInspector.Color.prototype.hslToRgb.hueToRgb):
+        (WebInspector.Color.prototype.hslToRgb):
+        (WebInspector.Color.prototype.rgbaToHsla):
+        (WebInspector.Color.prototype.hslaToRgba):
+
+          Called from the constructor, attempts to parse and will throw an error
+          if it cannot parse.  If simple then the "hex" value is guarenteed.
+          If advanced then both the "rgba" and "hsla" are guarenteed.  If it is
+          a nickname in any way (e.g. "transparent", "black") then this is
+          guarenteed to be set as well.
+
+        (WebInspector.Color.prototype.parse):
+
+          Clicking on the swatch will rotate through Color Representations.
+            Simple:   rgb -> hsl -> nickname? -> shorthex? -> hex -> (loop around)
+            Advanced: rgba -> hsla -> nickname? -> (loop around)
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.value.):
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle):
+
+          Load Color.js:
+
+        * inspector/front-end/inspector.html:
+
+2009-08-05  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Support setting event listeners for message ports in the worker process.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28004
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::retrieve):
+        (WebCore::WorkerContextExecutionProxy::EventTargetToV8Object):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-08-05  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        http://bugs.webkit.org/show_bug.cgi?id=28022
+
+        Minor fix for media code on chromium/skia.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintMediaSliderTrack):
+
+2009-08-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Client side image maps did not handle zoom correctly.
+        Client side image maps did not handle border and padding correctly.
+
+        Test: fast/images/image-map-zoom.html
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::nodeAtPoint): Compute the values to pass in to the map
+        element using the content box and the effective zoom.
+
+2009-08-05  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28027
+        <rdar://7064428> Files with accents in names are submitted incorrectly due to use of
+        precomposed Unicode
+
+        * platform/network/mac/FormDataStreamMac.mm: (WebCore::setHTTPBody): Use getFileSize() from
+        FileSystem.h instead of custom code for getting file size. This adds path normalization
+        necessary with some file systems on Mac. This also loses a S_IFMT check, which didn't seem
+        important anyway.
+
+2009-08-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [V8] Include Media into V8 bindings.
+
+        * bindings/v8/DOMObjectsInclude.h: Added Media include.
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Added V8Media include.
+        * bindings/v8/V8Index.cpp: Added decl for V8Media.
+        * bindings/v8/V8Index.h: Added V8Media include.
+
+2009-08-04  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Fix Windows layout test crashes.
+
+        PluginView::removeFromUnstartedListIfNecessary() would try to remove
+        any unstarted PluginView from the Page's set of unstarted plug-ins,
+        regardless of why the PluginView wasn't started. If we tried to start a
+        plug-in, but it failed to start, we would hit an assertion in
+        Page::removeUnstartedPlugin() that asserts that we would only modify the
+        unstarted plug-ins set if we were not currently starting plug-ins.
+
+        Fix this by having PluginView track whether it's waiting to be started,
+        and to check this before trying to remove itself from the Page's
+        unstarted plug-ins set.
+
+        Reviewed by Darin Adler.
+
+        * page/Page.cpp:
+        (WebCore::Page::removeUnstartedPlugin):
+        Assert that the passed PluginView is in the unstarted set.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+        Set that we are not waiting to be started.
+        (WebCore::PluginView::startOrAddtoUnstartedList):
+        Set that we are waiting to be started.
+        (WebCore::PluginView::removeFromUnstartedListIfNecessary):
+        Check not whether we are started, but whether we are waiting to be
+        started.
+        (WebCore::PluginView::PluginView):
+
+        * plugins/PluginView.h:
+
+2009-08-05  Jeremy Orlow  <jorlow@chromium.org>
+
+       Fix DOM Storage memory leak
+       https://bugs.webkit.org/show_bug.cgi?id=28029
+
+       Forgot to use adoptRef in one place.  This caused the = operator to
+       increment the ref count when it shouldn't have, so StorageAreaImpl's were
+       never freed.
+
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::storageArea):
+
+2009-08-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Let CodeGeneratorV8.pm know that Media is ref-counted.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added Media check to IsRefPtrType.
+
+2009-08-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Levin.
+
+        Use checked casts for render tree
+        https://bugs.webkit.org/show_bug.cgi?id=23522
+
+        Last patch. Makes all the casts of RenderObject use checked
+        casts instead of using static_cast directly.
+
+        * accessibility/AccessibilityListBox.cpp:
+        (WebCore::AccessibilityListBox::visibleChildren):
+        (WebCore::AccessibilityListBox::doAccessibilityHitTest):
+        * accessibility/AccessibilityListBoxOption.cpp:
+        (WebCore::AccessibilityListBoxOption::elementRect):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::textUnderElement):
+        (WebCore::AccessibilityRenderObject::stringValue):
+        (WebCore::AccessibilityRenderObject::titleUIElement):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySliderThumb::elementRect):
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::updatePlaceholderVisibility):
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::scrollToSelection):
+        (WebCore::SelectElement::recalcStyle):
+        (WebCore::SelectElement::setRecalcListItems):
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply):
+        * html/HTMLAppletElement.cpp:
+        (WebCore::HTMLAppletElement::renderWidgetForJSBindings):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::reset):
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::updateWidget):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::attach):
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::defaultEventHandler):
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::attach):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        (WebCore::HTMLInputElement::addSearchResult):
+        (WebCore::HTMLInputElement::onSearch):
+        * html/HTMLLIElement.cpp:
+        (WebCore::HTMLLIElement::parseMappedAttribute):
+        (WebCore::HTMLLIElement::attach):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setReadyState):
+        (WebCore::HTMLMediaElement::mediaPlayerDurationChanged):
+        (WebCore::HTMLMediaElement::mediaPlayerSizeChanged):
+        (WebCore::HTMLMediaElement::mediaPlayerRenderingCanBeAccelerated):
+        (WebCore::HTMLMediaElement::mediaPlayerGraphicsLayer):
+        (WebCore::HTMLMediaElement::defaultEventHandler):
+        (WebCore::HTMLMediaElement::finishParsingChildren):
+        * html/HTMLOListElement.cpp:
+        (WebCore::HTMLOListElement::parseMappedAttribute):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::updateWidget):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::defaultEventHandler):
+        * page/DragController.cpp:
+        (WebCore::DragController::concludeEditDrag):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::selectCursor):
+        (WebCore::EventHandler::capsLockStateMayHaveChanged):
+        * page/Frame.cpp:
+        (WebCore::Frame::ownerRenderer):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::detachCustomScrollbars):
+        * page/wince/FrameWince.cpp:
+        (WebCore::computePageRectsForFrame):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlTimelineElement::defaultEventHandler):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak):
+        * rendering/RenderCounter.cpp:
+        (WebCore::planCounter):
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::computeEdgeInfo):
+        (WebCore::RenderFrameSet::setIsResizing):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::contentsBox):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateBacking):
+        (WebCore::RenderLayerCompositor::requiresCompositingForVideo):
+        * rendering/RenderListItem.cpp:
+        (WebCore::previousListItem):
+        (WebCore::RenderListItem::explicitValueChanged):
+        * rendering/RenderObject.cpp:
+        (WebCore::updateListMarkerNumbers):
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::updateListMarkerNumbers):
+        (WebCore::invalidateCountersInContainer):
+        * rendering/RenderScrollbarTheme.cpp:
+        (WebCore::RenderScrollbarTheme::minimumThumbLength):
+        (WebCore::RenderScrollbarTheme::backButtonRect):
+        (WebCore::RenderScrollbarTheme::forwardButtonRect):
+        (WebCore::RenderScrollbarTheme::trackRect):
+        (WebCore::RenderScrollbarTheme::constrainTrackRectToTrackPieces):
+        (WebCore::RenderScrollbarTheme::paintScrollbarBackground):
+        (WebCore::RenderScrollbarTheme::paintTrackBackground):
+        (WebCore::RenderScrollbarTheme::paintTrackPiece):
+        (WebCore::RenderScrollbarTheme::paintButton):
+        (WebCore::RenderScrollbarTheme::paintThumb):
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderThumbElement::defaultEventHandler):
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::paintSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::determineSliderThumbState):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintSliderThumb):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::paintSliderThumb):
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::determineSliderThumbState):
+        * rendering/SVGCharacterLayoutInfo.cpp:
+        (WebCore::SVGCharacterLayoutInfo::addLayoutInformation):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::findSVGRootObject):
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::RenderTextControlInnerBlock::nodeAtPoint):
+        (WebCore::SearchFieldResultsButtonElement::defaultEventHandler):
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::attach):
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::canvasResource):
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::rootInlineBoxForTextContentElement):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+        Use checked casts.
+
+        * rendering/RenderApplet.h:
+        * rendering/RenderCounter.h:
+        * rendering/RenderFieldset.h:
+        * rendering/RenderFileUploadControl.h:
+        * rendering/RenderFrame.h:
+        * rendering/RenderFrameSet.h:
+        * rendering/RenderHTMLCanvas.h:
+        * rendering/RenderListBox.h:
+        * rendering/RenderListItem.h:
+        * rendering/RenderListMarker.h:
+        * rendering/RenderMedia.h:
+        * rendering/RenderMenuList.h:
+        * rendering/RenderPart.h:
+        * rendering/RenderPartObject.h:
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGTextPath.h:
+        * rendering/RenderSVGViewportContainer.h:
+        * rendering/RenderScrollbar.h:
+        * rendering/RenderSlider.h:
+        * rendering/RenderTextControlMultiLine.h:
+        * rendering/RenderTextControlSingleLine.h:
+        * rendering/RenderVideo.h:
+        Added a checked cast. Also made most members protected or private.
+
+        * rendering/RenderBlock.h:
+        * rendering/RenderInline.h:
+        * rendering/RenderReplaced.h:
+        * rendering/RenderSVGBlock.h:
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGInlineText.h:
+        * rendering/RenderSVGText.h:
+        * rendering/RenderTextControl.h:
+        Made most members protected or private.
+
+        * rendering/RenderInline.cpp:
+        * rendering/RenderSVGContainer.cpp:
+        * rendering/RenderSVGHiddenContainer.cpp:
+        * rendering/RenderSVGImage.cpp:
+        * rendering/RenderSVGRoot.cpp:
+        Removed unneeded destructor.
+
+        * rendering/RenderSVGHiddenContainer.h:
+        Removed unneeded virtual function overrides that did the same as
+        the default and base class.
+
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::paint): Updated to use m_viewport
+        directly instead of using a function call.
+        (WebCore::RenderSVGViewportContainer::applyViewportClip): Ditto.
+        (WebCore::RenderSVGViewportContainer::viewportTransform): Ditto.
+        (WebCore::RenderSVGViewportContainer::localToParentTransform): Ditto.
+        (WebCore::RenderSVGViewportContainer::pointIsInsideViewportClip): Ditto.
+
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::pseudoForScrollbarPart): Changed switch statement to use cases for
+        all values instead of using a default case.
+
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<): Removed dependency on casting to types that don't
+        have any public members we need to get at. Instead, use function names to
+        identify the type rather than doing so much overloading. Changed to use
+        checked casts.
+        (WebCore::write): Ditto.
+
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::renderSubtreeToImage): Changed to use a checked cast and also
+        added a comment about the fact that the code does not do sufficient type
+        checking before doing the cast.
+
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::writeRenderSVGTextBox): Renamed this from operator<<.
+        (WebCore::writeSVGInlineTextBoxes): Renamed this from writeSVGInlineText.
+        (WebCore::writeSVGText): Renamed this from write.
+        (WebCore::writeSVGInlineText): Ditto.
+        (WebCore::writeSVGImage): Ditto.
+        * rendering/SVGRenderTreeAsText.h: Updated for name changes. Removed
+        unneeded default arguments.
+
+2009-08-05  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27851
+        Fix a pair of compiler warnings on the GTK Linux buildbot.
+
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
+        (WebCore::BMPImageDecoder::processFileHeader): Don't use multi-character constants, they're not portable.
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::setSize): Simpler code that also doesn't compare signed with unsigned.
+
+2009-08-05  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26460
+        Return multiple icon entries from the ICO decoder as separate frames,
+        sorted by decreasing quality (much like the CG ICO decoder does).
+
+        As a result of this change, we can eliminate the Skia-specific setData()
+        hack that the Chromium port used to select the desired icon size -- now
+        callers can just enumerate the frames and ask for the data from the one
+        they like.
+        
+        Under the hood, the ICO decoder now keeps vectors for a number of things
+        (including directory entries and image decoders) where it used to have
+        single members.  However, callers (that I have seen) will only request
+        one frame from the icon, so practically there aren't going to be lots of
+        instantiated image decoders.
+
+        * platform/graphics/ImageSource.h: Move |m_decoder| back to private now that Skia no longer needs to access it.
+        * platform/graphics/cairo/ImageSourceCairo.cpp:
+        (WebCore::createDecoder): Remove size argument from ICO decoder instantiation.
+        * platform/graphics/skia/ImageSourceSkia.cpp:
+        (WebCore::createDecoder): Remove size argument from ICO decoder instantiation.
+        (WebCore::ImageSource::setData): Remove function to ask for a particular icon size.
+        * platform/graphics/skia/ImageSourceSkia.h: Removed.
+        * platform/graphics/wx/ImageSourceWx.cpp:
+        (WebCore::createDecoder): Remove size argument from ICO decoder instantiation.
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::ICOImageDecoder):
+        (WebCore::ICOImageDecoder::~ICOImageDecoder): Delete all instantiated per-frame decoders.
+        (WebCore::ICOImageDecoder::setData): Send data to all instantiated per-frame decoders.
+        (WebCore::ICOImageDecoder::isSizeAvailable): Use size from icon directory instead of PNG decoder (if applicable) so we can report it without decoding the PNG frames.
+        (WebCore::ICOImageDecoder::size): Report frame-specific size if BMP decoder is calling.  Otherwise, use size from icon directory instead of PNG decoder (if applicable).
+        (WebCore::ICOImageDecoder::frameSizeAtIndex): Implement.
+        (WebCore::ICOImageDecoder::setSize): Sanity check value if BMP decoder is calling.
+        (WebCore::ICOImageDecoder::frameCount): Implement.
+        (WebCore::ICOImageDecoder::frameBufferAtIndex): Sanity check size for PNG frames.
+        (WebCore::ICOImageDecoder::compareEntries): Add utility function for sorting entries.
+        (WebCore::ICOImageDecoder::setDataForPNGDecoderAtIndex): Factor out utility function for passing correct data blob to a PNG decoder.
+        (WebCore::ICOImageDecoder::decodeWithCheckForDataEnded): Split decode() into two pieces.
+        (WebCore::ICOImageDecoder::decodeDirectory): The first part of the old decode().
+        (WebCore::ICOImageDecoder::decodeAtIndex): The second part of the old decode(), split off so we avoid decoding an entry until it's requested.
+        (WebCore::ICOImageDecoder::processDirectory): Add resizing of internal data structures based on directory contents.
+        (WebCore::ICOImageDecoder::processDirectoryEntries): Sort entries by quality.
+        (WebCore::ICOImageDecoder::imageTypeAtIndex): Return type to caller instead of setting a member.
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+
+2009-08-05  Szabo Carol  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27942
+
+        Test: fast/forms/select-reset-multiple-selections-4-single-selection.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::reset):
+           Added HTML 4.01 compliant handling of broken webpages that
+           specify more than one selected option for single selection SELECT
+           element, in a manner that emulates Firefox and is similar to IE 7
+
+
+2009-08-05  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        WebCore.pro bugfix
+
+        Fix the gperf lines to properly include the string.h header at compilation with gperf version 3.0.3 and newer.
+
+        * WebCore.pro:
+
+2009-08-05  Chris Fleizach  <cfleizach@apple.com>
+
+        Fix Tiger build breakage.
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+
+2009-08-04  Simon Hausmann  <hausmann@webkit.org>
+
+        Prospective build fix for Qt build bot: Fix dependency of HTMLNames.cpp
+        to both source files, HTMLTagNames.in and HTMLAttributeNames.in
+
+        * WebCore.pro:
+
+2009-08-04  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Keypress should exit from pan scrolling mode.
+        https://bugs.webkit.org/show_bug.cgi?id=28005
+
+        Change the logic from only exiting pan scrolling on escape to exiting on any key press,
+        making it easier for users to back out of an accidental pan scroll.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::keyEvent):
+        
+2009-08-04  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        REGRESSION (r45064): Drop caret remains in text control after the mouse exits
+        https://bugs.webkit.org/show_bug.cgi?id=26787
+
+        Add back missing dragController()->clear() call.
+
+        * manual-tests/drag-caret.html: Added.
+        * page/DragController.cpp:
+        (WebCore::DragController::tryDocumentDrag):
+
+2009-08-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Bug 27994 - WAI-ARIA: aria-valuetext needs to be implemented
+        https://bugs.webkit.org/show_bug.cgi?id=27994
+
+        Forgot to commit attribute names.
+
+        * html/HTMLAttributeNames.in:
+
+2009-08-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27994 - WAI-ARIA: aria-valuetext needs to be implemented
+        https://bugs.webkit.org/show_bug.cgi?id=27994
+
+        Test: platform/mac/accessibility/aria-valuetext.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::valueDescription):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::valueDescription):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        * html/HTMLAttributeNames.in:
+
+2009-08-04  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27821
+
+        No new features, no new tests. Existing layout tests pass.
+
+        * WebCore.base.exp:
+
+        Export AppliationCacheGroup::storeCopyOfCache
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+        Restore DOMApplicationCache.h and ApplicationCacheHost.h to 'project' headers
+        instead of 'private' headers since they're no longer in the DocumentLoader.h
+        include graph.
+
+        * html/HTMLHtmlElement.cpp:
+        (WebCore::HTMLHtmlElement::insertedIntoDocument):
+
+        Reinstate the test for manifest.isNull instead of .isEmtpty().
+        Added a FIXME to revisit once the spec gets clarified.
+        
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::DocumentLoader):
+        (WebCore::DocumentLoader::mainReceivedError):
+        (WebCore::DocumentLoader::detachFromFrame):
+        * loader/DocumentLoader.h:
+        (WebCore::DocumentLoader::applicationCacheHost):
+
+        ApplicationCacheHost is held in an OwnPtr<> by DocumentLoader. This was done
+        for compile time friendliness, it results in a smaller include graph for files
+        dependent on DocumentLoader.h.
+
+        * loader/FrameLoader.cpp:
+        * loader/MainResourceLoader.cpp:
+        * loader/ResourceLoader.cpp:
+
+        Cleanup ussage of ENABLE(xxx) around includes, generally remove those guards.
+        This was done for readability at the include site. The included files contain appropriate guards,
+        so they're not needed at the include site.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::selectCache):
+        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource):
+        (WebCore::ApplicationCacheGroup::failedLoadingMainResource):
+        (WebCore::ApplicationCacheGroup::update):
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
+        (WebCore::ApplicationCacheGroup::manifestNotFound):
+        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete):
+        (WebCore::ApplicationCacheGroup::startLoadingEntry):
+        (WebCore::CallCacheListenerTask::create):
+        (WebCore::CallCacheListenerTask::performTask):
+        (WebCore::CallCacheListenerTask::CallCacheListenerTask):
+        (WebCore::ApplicationCacheGroup::postListenerTask):
+        * loader/appcache/ApplicationCacheGroup.h:
+
+        Use ApplicationCachHost defined constants, no longer depends on DOMApplicationCache.
+
+        * loader/appcache/ApplicationCacheHost.cpp:
+        (WebCore::ApplicationCacheHost::ApplicationCacheHost):
+        (WebCore::ApplicationCacheHost::setDOMApplicationCache):
+        (WebCore::ApplicationCacheHost::notifyEventListener):
+        (WebCore::ApplicationCacheHost::status):
+        * loader/appcache/ApplicationCacheHost.h:
+        (WebCore::ApplicationCacheHost::):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::storeCopyOfCache):
+        * loader/appcache/ApplicationCacheStorage.h:
+
+        Merge recently added transferApplicationCache and pre-existing storeCopyOfCache methods.
+
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::status):
+        (WebCore::DOMApplicationCache::addEventListener):
+        (WebCore::DOMApplicationCache::removeEventListener):
+        (WebCore::DOMApplicationCache::callListener):
+        (WebCore::DOMApplicationCache::toEventType):
+        (WebCore::DOMApplicationCache::toEventID):
+        * loader/appcache/DOMApplicationCache.h:
+        (WebCore::DOMApplicationCache::setAttributeEventListener):
+        (WebCore::DOMApplicationCache::getAttributeEventListener):
+        (WebCore::DOMApplicationCache::clearAttributeEventListener):
+        (WebCore::DOMApplicationCache::callEventListener):
+        (WebCore::DOMApplicationCache::setOnchecking):
+        (WebCore::DOMApplicationCache::onchecking):
+        (WebCore::DOMApplicationCache::setOnerror):
+        (WebCore::DOMApplicationCache::onerror):
+        (WebCore::DOMApplicationCache::setOnnoupdate):
+        (WebCore::DOMApplicationCache::onnoupdate):
+        (WebCore::DOMApplicationCache::setOndownloading):
+        (WebCore::DOMApplicationCache::ondownloading):
+        (WebCore::DOMApplicationCache::setOnprogress):
+        (WebCore::DOMApplicationCache::onprogress):
+        (WebCore::DOMApplicationCache::setOnupdateready):
+        (WebCore::DOMApplicationCache::onupdateready):
+        (WebCore::DOMApplicationCache::setOncached):
+        (WebCore::DOMApplicationCache::oncached):
+        (WebCore::DOMApplicationCache::setOnobsolete):
+        (WebCore::DOMApplicationCache::onobsolete):
+
+        Use ApplicationCachHost defined constants for Status and EventIDs.
+
+2009-08-04  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Revert r46421 and r46769, which appear to have totally hosed the v8 bindings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27719
+
+        * bindings/v8/V8AbstractEventListener.cpp: Revert r46421.
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp: Revert r46769.
+        (WebCore::ACCESSOR_GETTER):
+
+2009-08-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27993 - AXSliders are missing required attributes and actions
+        https://bugs.webkit.org/show_bug.cgi?id=27993
+
+        Expose appropriate actions and attributes for sliders.
+
+        Test: platform/mac/accessibility/slider-supports-actions.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::orientation):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySlider::orientation):
+        * accessibility/AccessibilitySlider.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityActionNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+
+2009-08-04  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Fix an assert in WebCoreStringResource that causes worker script
+        evaluation failed.
+        https://bugs.webkit.org/show_bug.cgi?id=27996
+
+        The fix is to check for the same thread, instead of the main thread.
+        This is because Chromium's workers use v8 in a single thread that is
+        not the main thread.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::WebCoreStringResource::WebCoreStringResource):
+        (WebCore::WebCoreStringResource::~WebCoreStringResource):
+        (WebCore::WebCoreStringResource::atomicString):
+
+2009-08-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Add support for transitions/animations of text-indent.
+
+        Test: transitions/text-indent-transition.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::ensurePropertyMap):
+
+2009-08-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Add support for transitions of min- and max-width, and min- and max-height.
+        https://bugs.webkit.org/show_bug.cgi?id=27990
+
+        Test: transitions/min-max-width-height-transitions.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::ensurePropertyMap):
+
+2009-08-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27964 - WAI-ARIA: radio button does not determine its label from text content
+        https://bugs.webkit.org/show_bug.cgi?id=27964
+
+        ARIA radio buttons also need to use the text inside of them, like buttons and other roles.
+        Also fixed an issue where an extra space was being appended to some ARIA labels.
+
+        Test: platform/mac/accessibility/aria-radiobutton-text.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::ariaAccessibilityName):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::ariaAccessibilityName):
+        (WebCore::AccessibilityRenderObject::ariaLabeledByAttribute):
+        (WebCore::AccessibilityRenderObject::title):
+        (WebCore::AccessibilityRenderObject::ariaDescribedByAttribute):
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-08-04  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Missed a place that expects window.event to be hidden when it shouldn't be.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27719
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER): window.event is no longer hidden.
+
+2009-08-03  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Bug 27958 - WAI-ARIA: Implement 'aria-required' attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=27958
+
+        Test: platform/mac/accessibility/aria-required.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isRequired):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isRequired):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        * html/HTMLAttributeNames.in:
+
+2009-08-04  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add QWebPluginDatabase API to the Qt API.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        * WebCore.pro:
+
+2009-08-04  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Adam Treat.
+
+        [Qt] PlusDarker is not supported. Fall back to CompositionMode_Darken
+        (as it is the closest match) instead of CompositionMode_SourceOver.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::toQtCompositionMode):
+
+2009-08-04  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [v8] Fix crash when converting empty v8 string to atomic webkit string.
+        https://bugs.webkit.org/show_bug.cgi?id=27975
+
+        collection-null-like-arguments.html tests for this.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8StringToAtomicWebCoreString):
+
+2009-08-04  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        selectionHasStyle needs clean up to fix Bug 27858
+        https://bugs.webkit.org/show_bug.cgi?id=27865
+
+        This patch cleans up selectionStartHasStyle and selectionHasStyle.
+        No test is added because the patch does not change any behavior.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::getPropertiesNotInComputedStyle): Used in triStateOfStyleInComputedStyle but will be used here as well
+        * editing/ApplyStyleCommand.h: Added the prototype of getPropertiesNotInComputedStyle
+        * editing/Editor.cpp:
+        (WebCore::triStateOfStyleInComputedStyle): Determines if the specified style is present in the specified computed style.
+        (WebCore::Editor::selectionStartHasStyle): Uses triStateOfStyleInComputedStyle
+        (WebCore::Editor::selectionHasStyle): Uses triStateOfStyleInComputedStyle instead of updateState
+
+2009-08-03  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix MessagePort construction in worker process.  Also make the other object constructions match this.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27906
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setDOMException):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::ToV8Object):
+
+2009-08-03  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by David Levin.
+
+        [V8] Cache atomic strings in externalized v8 strings
+        https://bugs.webkit.org/show_bug.cgi?id=27762
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::WebCoreStringResource::WebCoreStringResource):
+        (WebCore::WebCoreStringResource::~WebCoreStringResource):
+        (WebCore::WebCoreStringResource::data):
+        (WebCore::WebCoreStringResource::length):
+        (WebCore::WebCoreStringResource::webcoreString):
+        (WebCore::WebCoreStringResource::atomicString):
+        (WebCore::WebCoreStringResource::toStringResource):
+        (WebCore::v8StringToWebCoreString):
+        (WebCore::v8StringToAtomicWebCoreString):
+        (WebCore::v8ValueToWebCoreString):
+        (WebCore::v8ValueToAtomicWebCoreString):
+        * bindings/v8/V8Binding.h:
+        (WebCore::):
+        * dom/Document.idl:
+
+2009-08-03  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: DOM Storage Live Updating Should Not Affect Tabbing
+        https://bugs.webkit.org/show_bug.cgi?id=27957
+
+        * inspector/front-end/DOMStorageDataGrid.js:
+        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode): disable storage event listener
+        (WebInspector.DOMStorageDataGrid.prototype._startEditing): disable storage event listener
+        (WebInspector.DOMStorageDataGrid.prototype._editingCancelled): enable storage event listener
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype._unregisterStorageEventListener): quick return if no listener
+
+2009-08-03  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Consolidate common gcc flags to WebKit.pri
+        https://bugs.webkit.org/show_bug.cgi?id=27934
+
+        * WebCore.pro:
+
+2009-08-03  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium code sometimes isn't sandboxed and needs to access the FS.
+        https://bugs.webkit.org/show_bug.cgi?id=27954
+
+        These changes are the WebKit side of http://codereview.chromium.org/159778 which
+        aims to make LocalStorage persistent.
+
+        This change runs all FileSystem routines through the ChromiumBridge so that
+        WebKitClients can handle them if they choose to.  For now, the only such client
+        will be the one running in the browser process.
+
+        It also adds a method called sandboxEnabled to the Chromium bridge so that the
+        SQLite file system code can shift its behavior depending on whether we're
+        inside a sandbox or not.
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/FileSystemChromium.cpp:
+        (WebCore::deleteFile):
+        (WebCore::deleteEmptyDirectory):
+        (WebCore::getFileModificationTime):
+        (WebCore::directoryName):
+        (WebCore::pathByAppendingComponent):
+        (WebCore::makeAllDirectories):
+        (WebCore::fileExists):
+        * platform/sql/chromium/SQLiteFileSystemChromium.cpp:
+        (WebCore::SQLiteFileSystem::openDatabase):
+        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:
+        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
+
+2009-08-03  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] Implement media slider for chromium
+        https://bugs.webkit.org/show_bug.cgi?id=27859
+
+        Implemented the media slider for chromium port. The implementation
+        is using Skia for drawing the thumb and buffered region instead of
+        using any native system controls so different platforms would have
+        the same look and feel.
+
+        No new tests because this is covered by existing tests.
+
+        * css/mediaControlsChromium.css:
+        * rendering/RenderThemeChromiumSkia.cpp:
+        * rendering/RenderThemeChromiumSkia.h:
+        * rendering/RenderThemeChromiumWin.cpp:
+
+2009-07-27  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26460
+        Plumbing and cleanup in advance of returning multiple frames from the
+        ICOImageDecoder:
+        * Make ImageDecoder::frameCount() return a size_t like
+          ImageSource::frameCount() and BitmapImage::frameCount() already do.
+        * Add ImageDecoder::frameSizeAtIndex() alongside size(), to report the
+          size of a particular frame.  Hook all the
+          ImageSource::frameSizeAtIndex() implementations to this.  No
+          ImageDecoder implements this yet; that will come in my next change.
+
+        * platform/graphics/cairo/ImageSourceCairo.cpp:
+        (WebCore::ImageSource::frameSizeAtIndex): Hook to ImageDecoder function.
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::frameCount): returns size_t.
+        * platform/graphics/qt/ImageDecoderQt.h: frameCount() returns size_t.
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        (WebCore::ImageSource::frameSizeAtIndex): Hook to ImageDecoder function.
+        * platform/graphics/skia/ImageSourceSkia.cpp:
+        (WebCore::ImageSource::frameSizeAtIndex): Hook to ImageDecoder function.
+        * platform/graphics/win/ImageCGWin.cpp:
+        (WebCore::BitmapImage::drawFrameMatchingSourceSize): frameCount() returns size_t.
+        * platform/graphics/win/ImageCairoWin.cpp:
+        (WebCore::BitmapImage::drawFrameMatchingSourceSize): frameCount() returns size_t.
+        * platform/graphics/wx/ImageSourceWx.cpp:
+        (WebCore::ImageSource::frameSizeAtIndex): Hook to ImageDecoder function.
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::size): Clarify comment.
+        (WebCore::ImageDecoder::frameSizeAtIndex): Add.
+        (WebCore::ImageDecoder::frameCount): returns size_t.
+        (WebCore::ImageDecoder::frameBufferAtIndex): Remove unneeded param name.
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::frameCount): returns size_t.
+        (WebCore::GIFImageDecoder::frameBufferAtIndex): frameCount() returns size_t.
+        * platform/image-decoders/gif/GIFImageDecoder.h: frameCount() returns size_t.
+
+2009-08-03  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix a bug that could cause an ASSERT to fail incorrectly, leading
+        to a renderer crash in Chromium.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27947
+
+        All tests in storage/ pass.
+
+        * platform/sql/SQLiteTransaction.cpp:
+        (WebCore::SQLiteTransaction::~SQLiteTransaction):
+        (WebCore::SQLiteTransaction::begin):
+
+2009-08-03  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Based on work by Yael Aharon.
+
+        Implement keyboard event forwarding for windowless plugins
+        for the Qt port.
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::setSharedXEventFields):
+        (WebCore::setXKeyEventSpecificFields):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+
+2009-08-03  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Make Bottom "Drawer" More Extensible To Support Other Views
+        https://bugs.webkit.org/show_bug.cgi?id=27928
+
+        * English.lproj/localizedStrings.js:
+
+          "Show changes view", "Hide changes view", "Clear changes log", "%d style change", "%d style changes"
+
+        * inspector/front-end/ChangesView.js: Added.
+        (WebInspector.ChangesView):
+        (WebInspector.ChangesView.prototype._clearButtonClicked):
+        (WebInspector.ChangesView.prototype._toggleChangesButtonClicked):
+        (WebInspector.ChangesView.prototype.attach):
+        (WebInspector.ChangesView.prototype.show):
+        (WebInspector.ChangesView.prototype.hide):
+
+          To be a new view to show Changes made via the inspector.  DOM, CSS, or otherwise.
+
+        * inspector/front-end/Console.js: Removed.
+
+          Sliding View aspect moved to Drawer.js.  The "console" itself has moved to ConsoleView.js
+
+        * inspector/front-end/ConsoleView.js: Added.
+
+          Little has changed from its move from Console.js other then support for working with the Drawer.
+
+        * inspector/front-end/Drawer.js: Added.
+        (WebInspector.Drawer):
+        (WebInspector.Drawer.prototype.get visibleView):
+        (WebInspector.Drawer.prototype.set visibleView):
+        (WebInspector.Drawer.prototype.show.animationFinished):
+        (WebInspector.Drawer.prototype.show):
+        (WebInspector.Drawer.prototype.hide.animationFinished):
+        (WebInspector.Drawer.prototype.hide):
+        (WebInspector.Drawer.prototype._safelyRemoveChildren):
+        (WebInspector.Drawer.prototype._startStatusBarDragging):
+        (WebInspector.Drawer.prototype._statusBarDragging):
+        (WebInspector.Drawer.prototype._endStatusBarDragging):
+
+          Allow for multiple views inside the Sliding Drawer.
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype.renameSelector):
+        (WebInspector.ElementsPanel.prototype.addStyleChange):
+        (WebInspector.ElementsPanel.prototype.removeStyleChange):
+        (WebInspector.ElementsPanel.prototype.generateStylesheet):
+
+          Starting work on the "Changes" Panel. The ability to generate a Stylesheet from Styles added via the Inspector.
+
+        * inspector/front-end/Images/styleIcon.png: Added.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.prototype.isInspectorStylesheet):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.BlankStylePropertiesSection.prototype.makeNormal):
+        (WebInspector.StylePropertyTreeElement.prototype):
+
+          Interface with ElementsPanel for generating a Stylesheet of Changes.
+
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css: Refactored to allow for multiple views in the drawer.
+        * inspector/front-end/inspector.html: Refactored to allow for multiple views in the drawer.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.get styleChanges):
+        (WebInspector.set styleChanges):
+        (WebInspector._updateChangesCount):
+        (WebInspector.loaded):
+        (WebInspector.documentKeyDown):
+        (WebInspector.showConsole):
+        (WebInspector.showChanges):
+
+          Support for the drawer and "styles changed icon" similar to the "errors and warnings" icons.
+
+2009-08-03  Dean McNamee  <deanm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Correct an assert on a PassRefPtr in the v8 svg bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=27951
+
+        * bindings/v8/V8SVGPODTypeWrapper.h:
+        (WebCore::V8SVGDynamicPODTypeWrapper::V8SVGDynamicPODTypeWrapper):
+
+2009-08-03  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27748
+        crash w/ stack overflow when same CSS file loaded repeatedly
+
+        Fix crash caused by a stack overflow when repeatedly loading very large
+        CSS files. CSSRuleData in CSSStyleSelector.h destroyed itself 
+        recursively rather than iteratively.
+
+        Test: fast/css/large-list-of-rules-crash.html
+
+        * css/CSSStyleSelector.h:
+        (WebCore::CSSRuleData::~CSSRuleData):
+        (WebCore::CSSRuleDataList::~CSSRuleDataList):
+
+2009-08-03  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Make the DRT APIs to pause transitions and animations work for accelerated animations
+        <https://bugs.webkit.org/show_bug.cgi?id=27627>
+        <rdar://problem/6442932>
+
+        Fix the 'pauseAnimationAtTimeOnElementWithId' and 'pauseTransitionAtTimeOnElementWithId' APIs
+        available to LayoutTests to work with accelerated animations and transitions. Done by sending
+        the pause time down to the GraphicsLayer, and using it to stop time on the layer.
+        
+        I also added an assertion to check that the animation has actually started when we
+        try to pause it, to check that the pause time we compute is valid. This revealed a number
+        of tests that tried to pause before animations started, required some amount of test fixing.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::freezeAtTime):
+        * page/animation/AnimationBase.h:
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::pauseAnimationAtTime):
+        (WebCore::CompositeAnimation::pauseTransitionAtTime):
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::suspendAnimations):
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::suspendAnimations):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::suspendAnimations):
+        * rendering/RenderLayerBacking.h:
+
+2009-08-03  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix Chromium build by removing PluginView.h from Page.cpp.
+        Chromium doesn't use PluginView and the pointer is never
+        dereferenced so the header doesn't need to be included.
+        https://bugs.webkit.org/show_bug.cgi?id=27946
+
+        No new tests because this is a build fix.
+
+        * page/Page.cpp:
+
+2009-08-03  Eric Carlson  <eric.carlson@apple.com>
+
+        One more build fix after https://bugs.webkit.org/show_bug.cgi?id=46720.
+
+        Unreviewed.
+
+        * WebCoreSources.bkl:
+
+2009-08-03  Eric Carlson  <eric.carlson@apple.com>
+
+        Build fix after https://bugs.webkit.org/show_bug.cgi?id=46720.
+
+        Unreviewed.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-08-03  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27943: Need to implement ARIA role="radiogroup"
+        https://bugs.webkit.org/show_bug.cgi?id=27943
+
+        Test: platform/mac/accessibility/aria-radiogroup.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isRadioGroup):
+        (WebCore::AccessibilityObject::selectedRadioButton):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::selectedRadioButton):
+        (WebCore::RoleEntry::):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper roleDescription]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+
+2009-08-03  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        HTMLInputElement is not controllable by assistive technologies
+        https://bugs.webkit.org/show_bug.cgi?id=27941
+
+        Test: accessibility/input-slider.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+            Add AccessibilitySlider.cpp/.h
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+            Create AccessibilitySlider and AccessibilitySliderThumb.
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::increment):
+        (WebCore::AccessibilityObject::decrement):
+            Add default, do nothing, base class methods.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+            Correct typo.
+
+        * accessibility/AccessibilitySlider.cpp: Added.
+        (WebCore::AccessibilitySlider::AccessibilitySlider):
+        (WebCore::AccessibilitySlider::create):
+        (WebCore::AccessibilitySlider::children):
+        (WebCore::AccessibilitySlider::addChildren):
+        (WebCore::AccessibilitySlider::getAttribute):
+        (WebCore::AccessibilitySlider::valueForRange):
+        (WebCore::AccessibilitySlider::maxValueForRange):
+        (WebCore::AccessibilitySlider::minValueForRange):
+        (WebCore::AccessibilitySlider::changeValue):
+        (WebCore::AccessibilitySlider::setValue):
+        (WebCore::AccessibilitySlider::increment):
+        (WebCore::AccessibilitySlider::decrement):
+        (WebCore::AccessibilitySlider::element):
+        (WebCore::AccessibilitySliderThumb::AccessibilitySliderThumb):
+        (WebCore::AccessibilitySliderThumb::create):
+        (WebCore::AccessibilitySliderThumb::elementRect):
+        (WebCore::AccessibilitySliderThumb::size):
+        * accessibility/AccessibilitySlider.h: Added.
+        (WebCore::AccessibilitySlider::~AccessibilitySlider):
+        (WebCore::AccessibilitySlider::roleValue):
+        (WebCore::AccessibilitySlider::accessibilityIsIgnored):
+        (WebCore::AccessibilitySlider::isSlider):
+        (WebCore::AccessibilitySlider::canSetValueAttribute):
+        (WebCore::AccessibilitySliderThumb::~AccessibilitySliderThumb):
+        (WebCore::AccessibilitySliderThumb::roleValue):
+        (WebCore::AccessibilitySliderThumb::accessibilityIsIgnored):
+        (WebCore::AccessibilitySliderThumb::setParentObject):
+        (WebCore::AccessibilitySliderThumb::parentObject):
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (RoleEntry::):
+            SliderThumbRole -> NSAccessibilityValueIndicatorRole
+        (-[AccessibilityObjectWrapper roleDescription]):
+            Return role description for NSAccessibilitySliderRole and NSAccessibilityValueIndicatorRole.
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+            Minor coding style correction.
+        (-[AccessibilityObjectWrapper accessibilityPerformPressAction]):
+            If attachement view handles press action, don't also call object wrapper.
+        (-[AccessibilityObjectWrapper accessibilityPerformIncrementAction]):
+            New, call object's increment() method.
+        (-[AccessibilityObjectWrapper accessibilityPerformDecrementAction]):
+            New, call object's decrement() method.
+        (-[AccessibilityObjectWrapper accessibilityPerformAction:]):
+            Respond to NSAccessibilityIncrementAction and NSAccessibilityDecrementAction.
+
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::thumbRect):
+            Factor logic out of layout so AccessibilitySliderThumb can get thumb location/size.
+        (WebCore::RenderSlider::layout):
+            Move code to thumbRect().
+        * rendering/RenderSlider.h:
+
+2009-08-03  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Build fix if Netscape plugin support is turned off
+        https://bugs.webkit.org/show_bug.cgi?id=27940
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::stop): Do not call NPN_MemFree if NPAPI is
+        disabled
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::platformStart): Empty stub.
+
+2009-07-31  Joe Mason  <joe.mason@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE port: LOAD_WITH_ALTERED_SEARCH_PATH param of LoadLibraryEx not supported on WINCE
+        https://bugs.webkit.org/show_bug.cgi?id=27917
+
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::load): use LoadLibrary instead of LoadLibraryEx
+
+2009-08-02  Adam Barth  <abarth@webkit.org>
+        Reviewed by Darin Adler.
+
+        SVGElementInstance::scriptExecutionContext should call document() instead of scriptExecutionContext()
+
+        https://bugs.webkit.org/show_bug.cgi?id=27932
+
+        There's no reason to pay for a virtual function call in this case.  We
+        can just call document() directly because we know that element is a
+        Node*.
+
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::scriptExecutionContext):
+
+2009-08-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        JSNodeCustom should call document() instead of scriptExecutionContext()
+        https://bugs.webkit.org/show_bug.cgi?id=27931
+
+        We want to call document() because it's in inline function, instead of
+        scriptExecutionContext() because it's a virtual function.  If we have a
+        Node*, then we know that the virtual function will always return the
+        document anyway.
+
+        There are more instance of this bug, but I'd like to start with a small
+        patch and work up.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::toJSDOMGlobalObject):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+
+2009-08-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Anders Carlsson.
+
+        Share implementation of PluginView::userAgent() and userAgentStatic()
+
+        https://bugs.webkit.org/show_bug.cgi?id=27706
+
+        Differences to the original implementation are as follows:
+        
+            - The Win port used to return 0 for userAgentStatic, but now
+              returns the quirk mode MozillaUserAgent as the other ports.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::userAgent):
+        (WebCore::PluginView::userAgentStatic):
+        * plugins/PluginViewNone.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/mac/PluginViewMac.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        * plugins/win/PluginViewWin.cpp:
+
+2009-07-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Anders Carlsson.
+
+        Unregister plugin from PluginMainThreadScheduler if NPP_New fails
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27706
+        
+        Since the plugin has not been started yet (m_isStarted is not set),
+        calling stop() will not have any affect, so we manually unregister
+        in start() before returning.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+
+2009-07-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Anders Carlsson.
+
+        Join the various versions of PluginView::stop() into one shared implementation
+
+        https://bugs.webkit.org/show_bug.cgi?id=27706
+
+        The platform-dependent bits are now ifdef'ed in the shared implementation,
+        using the XP_ defines (XP_WIN, XP_MACOSX, XP_UNIX) from npapi.h
+        
+        Differences to the original implementation are as follows:
+
+            - The Qt port unregistered the plugin before calling NP_SetWindow
+              with a 0 window handle. Now it's done after (similar to Win)
+
+            - The GTK and Qt ports unregistered the plugin before clearing
+              the m_npWindow.ws_info struct. Now it's done after.
+              
+            - The Win port constructed the DropAllLocks after unsubclassing
+              the window. Now it's done before.
+              
+            - The Mac, Qt, and GTK ports did not pass a NPSavedData struct
+              to NP_Destroy (like the Win port). Now all ports do.
+
+            - The Win port did not call PluginView::setCurrentPluginView()
+              before calling to NP-functions. Now it does.     
+
+        * plugins/PluginView.cpp:
+        * plugins/PluginViewNone.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/mac/PluginViewMac.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        * plugins/win/PluginViewWin.cpp:
+
+2009-07-30  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: let me *edit* css styles in the web inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=27124
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel): added property stylesheet pointing to 1 stylesheet added to the page if needed
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update): handle blank sections
+        (WebInspector.StylesSidebarPane.prototype.addBlankSection): blank section in the correct position
+        (WebInspector.StylesSidebarPane.prototype.appropriateSelectorForNode): helper to get a nice selector for the selectd node
+        (WebInspector.StylePropertiesSection):
+        (WebInspector.StylePropertiesSection.prototype.expand):
+        (WebInspector.StylePropertiesSection.prototype.isPropertyInherited):
+        (WebInspector.StylePropertiesSection.prototype.isPropertyOverloaded):
+        (WebInspector.StylePropertiesSection.prototype.addNewBlankProperty):
+        (WebInspector.StylePropertiesSection.prototype._dblclickEmptySpace): easily create new properties
+        (WebInspector.StylePropertiesSection.prototype._dblclickSelector):
+        (WebInspector.StylePropertiesSection.prototype.startEditingSelector): allow for editing selectors
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCancelled):
+        (WebInspector.StylePropertiesSection.prototype._doesSelectorAffectSelectedNode): helper to check if a selector applies to the selected node
+        (WebInspector.BlankStylePropertiesSection.prototype._dblclick):
+        (WebInspector.BlankStylePropertiesSection.prototype.startEditing):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingCancelled):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted):
+        (WebInspector.BlankStylePropertiesSection.prototype.makeNormal): morph into a StylePropertiesSection
+        (WebInspector.StylePropertyTreeElement.prototype):
+        (WebInspector.StylePropertyTreeElement.prototype.):
+        * inspector/front-end/inspector.css:
+
+2009-07-31  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [v8] check if proxy is present before invoking a handler
+        https://bugs.webkit.org/show_bug.cgi?id=27883 
+
+        Do not invoke handler function if proxy is null pointer (that would lead to access violation
+        anyway)
+
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::callListenerFunction):
+
+2009-08-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Reimplement Elements Panel so that its
+        interaction with DOM is serialized.
+
+        This is a first cut wuth read support for DOM elements
+        tree as well as some limited editing. No properties, no
+        styles, no search capabilities are implemented yet.
+        Set Preferences.useDOMAgent to true in order to try it
+        out, otherwise disabled by default.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27771
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getChildNodes):
+        (WebCore::InspectorBackend::setAttribute):
+        (WebCore::InspectorBackend::removeAttribute):
+        (WebCore::InspectorBackend::setTextNodeValue):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::domAgent):
+        * inspector/InspectorDOMAgent.cpp: Added.
+        * inspector/InspectorDOMAgent.h: Added.
+        * inspector/InspectorFrontend.cpp:
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/Callback.js: Added.
+        * inspector/front-end/DOMAgent.js: Added.
+        * inspector/front-end/ElementsPanel.js:
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+
+2009-08-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        isContentEditable function in htmlediting.* must be removed
+        https://bugs.webkit.org/show_bug.cgi?id=27870
+
+        This patch removes isContentEditable function in htmlediting.cpp and
+        replaces all usage by calling Node::isContentEditable or its derivatives.
+
+        * editing/AppendNodeCommand.cpp: ditto
+        (WebCore::AppendNodeCommand::AppendNodeCommand): ditto
+        * editing/IndentOutdentCommand.cpp: ditto
+        (WebCore::IndentOutdentCommand::outdentParagraph): ditto
+        * editing/InsertNodeBeforeCommand.cpp: ditto
+        (WebCore::InsertNodeBeforeCommand::InsertNodeBeforeCommand): ditto
+        * editing/htmlediting.cpp: ditto
+        (WebCore::enclosingNodeWithTag): ditto
+        (WebCore::enclosingNodeOfType): ditto
+        (WebCore::canMergeLists): ditto
+        * editing/htmlediting.h: Updated prototype
+
+2009-08-01  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix a message port handle always getting marked as reachable once it gets entangled.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27824
+
+        No tests since this only arises with the Chromium multi-process message port implementation
+        which isn't in this repostiory.
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GCEpilogueVisitor::visitDOMWrapper):
+
+2009-07-31  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Barth.
+
+        Fix Geolocation permission problem
+        https://bugs.webkit.org/show_bug.cgi?id=26993
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::requestPermission):
+
+2009-07-31  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Added project properties as needed by symbian platform
+
+        * WebCore.pro:
+
+2009-07-31  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        Fix compiler warning.
+
+        Initialize member variables in the correct order.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+
+2009-07-31  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Windows build fix!
+
+        Unreviewed.
+
+        * page/win/PageWin.cpp:
+
+2009-07-31  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Mac build fix.
+
+        Unreviewed.
+
+        * page/Page.cpp:
+        Move setCanStartPlugins() from here...
+        * page/win/PageWin.cpp:
+        (WebCore::Page::setCanStartPlugins):
+        ... to here.
+
+2009-07-29  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://problem/5698113> Safari shouldn't auto-activate plug-ins in
+        background tabs (make Win consistent with Mac)
+
+        https://bugs.webkit.org/show_bug.cgi?id=27855
+
+        Reviewed by Anders Carlsson.
+
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::dispatchDidFailToStartPlugin):
+        Declare a new function to dispatch failures to start plug-ins.
+
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        Initialize new member variable.
+        (WebCore::Page::addUnstartedPlugin):
+        Add the PluginView to the set of unstarted plug-ins.
+        (WebCore::Page::removeUnstartedPlugin):
+        Remove the PluginView from the set of unstarted plug-ins.
+        (WebCore::Page::setCanStartPlugins):
+        If we can now start plug-ins, iterate the set of unstarted plug-ins,
+        starting them. If a plug-in fails to start, dispatch a failed-to-start-
+        plug-in error. Clear the list of unstarted plug-ins.
+
+        * page/Page.h:
+        Added m_canStartPlugins to track whether we can currently start
+        plug-ins. Added m_unstartedPlugins to keep track of plug-ins in the
+        page that are waiting to be started.
+        (WebCore::Page::canStartPlugins):
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+        m_mimeType is now a WebCore::String, so we call .utf8(). If NPP_New()
+        fails, set m_status to reflect this; this used to be set by init(), but
+        start() will not be called by init() if we are delaying start().
+        If NPP_New() succeeds, set m_status to reflect this, and call
+        platformStart().
+        (WebCore::PluginView::startOrAddToUnstartedList):
+        If we cannot start plug-ins, add this view to the Page's list of
+        unstarted plug-ins and return true. Otherwise, call start() and return
+        the result.
+        (WebCore::PluginView::removeFromUnstartedListIfNecessary):
+        If we've been started or we don't have a Page, return early. Remove
+        ourselves from the Page's list of unstarted plug-ins.
+        (WebCore::PluginView::bindingInstance):
+        If we haven't been started yet, return 0. This matches the Mac
+        behavior.
+        (WebCore::PluginView::setParameters):
+        If we find the "plug-ins page" parameter, record it; it may be used if
+        we fail to start the plug-in.
+        (WebCore::PluginView::PluginView):
+        Initialize new members m_haveUpdatedPluginWidget. Initialize m_mimeType
+        with mimeType directly; m_mimeType is now a WebCore::String.
+
+        * plugins/PluginView.h:
+        Made start() public, so Page can call it when we start unstarted
+        plug-ins. Changed m_mimeType from CString to String and added
+        m_pluginsPage; these are needed by dispatchDidFailToStartPlugin().
+        (WebCore::PluginView::pluginsPage):
+        Added for dispatchDidFailToStartPlugin().
+        (WebCore::PluginView::mimeType):
+        Ditto.
+        (WebCore::PluginView::url):
+        Ditto.
+
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::platformStart):
+        Stubbed.
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+        Stubbed.
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::platformStart):
+        Stubbed.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        Use m_haveUpdatedPluginWidget to ensure that we will call MoveWindow()
+        and SetWindowRgn() to position the plug-in and set its clip rect if an
+        earlier call to updatePluginWidget() was made before
+        setPlatformPluginWidget() was called to set the plug-in's HWND.
+        (WebCore::PluginView::~PluginView):
+        Call removeFromUnstartedListIfNecessary() to remove the plug-in from
+        the unstarted list if the plug-in is destroyed before it is started.
+        (WebCore::PluginView::init):
+        Call startOrAddtoUnstartedList to start the plug-in or, if plug-ins
+        cannot be started, to add it to the list of plug-ins waiting to be
+        started. Set m_status to indicate success; this is also set by start(),
+        but that may be delayed, and we don't want the loader to dispatch a
+        failed-to-start-plug-in error when we return from init().
+        (WebCore::PluginView::platformStart):
+        Added; code moved from init(). This is now called by start() to perform
+        any platform-specific tasks that need to take place after the plug-in
+        has started. Added a call to updatePluginWidget() to ensure we position
+        the plug-in and set its clip rect after the plug-in has started.
+        Removed the setting of m_status; start() does this before calling this
+        function (and we assert this at the head of the function).
+
+2009-07-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Levin.
+
+        Use checked casts for render tree
+        https://bugs.webkit.org/show_bug.cgi?id=23522
+
+        Next step: Add casts for all the RenderTable classes and use them everywhere.
+
+        Also added a few uses in places that were still using static_cast.
+        Also made some virtual member functions private.
+        Also changed RenderTable::m_tableLayout to use OwnPtr.
+
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::isTableExposableThroughAccessibility):
+        (WebCore::AccessibilityTable::addChildren):
+        (WebCore::AccessibilityTable::cellForColumnAndRow):
+        * accessibility/AccessibilityTableCell.cpp:
+        (WebCore::AccessibilityTableCell::parentTable):
+        (WebCore::AccessibilityTableCell::rowIndexRange):
+        (WebCore::AccessibilityTableCell::columnIndexRange):
+        (WebCore::AccessibilityTableCell::titleUIElement):
+        * accessibility/AccessibilityTableColumn.cpp:
+        (WebCore::AccessibilityTableColumn::headerObject):
+        * accessibility/AccessibilityTableRow.cpp:
+        (WebCore::AccessibilityTableRow::parentTable):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::removeNode):
+        * editing/TextIterator.cpp:
+        (WebCore::shouldEmitTabBeforeNode):
+        (WebCore::shouldEmitNewlinesBeforeAndAfterNode):
+        * html/HTMLTableCellElement.cpp:
+        (WebCore::HTMLTableCellElement::parseMappedAttribute):
+        * html/HTMLTableColElement.cpp:
+        (WebCore::HTMLTableColElement::parseMappedAttribute):
+        * page/Frame.cpp:
+        (WebCore::Frame::searchForLabelsAboveCell):
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::searchForNSLabelsAboveCell):
+        * rendering/AutoTableLayout.cpp:
+        (WebCore::AutoTableLayout::recalcColumn):
+        (WebCore::AutoTableLayout::fullRecalc):
+        (WebCore::shouldScaleColumns):
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcWidthArray):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::calcPrefWidths):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcPercentageHeight):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::addChild):
+        (WebCore::RenderObject::containingBlock):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::collapsedBottomBorder):
+        * rendering/RenderTableCol.cpp:
+        (WebCore::RenderTableCol::table):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::addChild):
+        (WebCore::RenderTableRow::layout):
+        (WebCore::RenderTableRow::paint):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::addChild):
+        (WebCore::RenderTableSection::layoutRows):
+        (WebCore::RenderTableSection::lowestPosition):
+        (WebCore::RenderTableSection::rightmostPosition):
+        (WebCore::RenderTableSection::leftmostPosition):
+        (WebCore::RenderTableSection::paintObject):
+        (WebCore::RenderTableSection::recalcCells):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        (WebCore::writeTextRun):
+        Use checked casts.
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::styleDidChange): Updated to use OwnPtr.
+        (WebCore::RenderTable::addChild): Use checked cast.
+        (WebCore::RenderTable::layout): Ditto.
+        (WebCore::RenderTable::setCellWidths): Ditto.
+        (WebCore::RenderTable::paintObject): Ditto.
+        (WebCore::RenderTable::splitColumn): Ditto.
+        (WebCore::RenderTable::appendColumn): Ditto.
+        (WebCore::RenderTable::colElement): Ditto.
+        (WebCore::RenderTable::recalcSections): Ditto.
+        (WebCore::RenderTable::outerBorderBottom): Ditto.
+        (WebCore::RenderTable::outerBorderLeft): Ditto.
+        (WebCore::RenderTable::outerBorderRight): Ditto.
+        (WebCore::RenderTable::sectionAbove): Ditto.
+        (WebCore::RenderTable::sectionBelow): Ditto.
+
+        * rendering/RenderTable.h: Added checked cast. Made virtual
+        functions private. Changed m_tableLayout to be a OwnPtr.
+
+        * rendering/RenderTableCell.h: Added checked cast.
+        * rendering/RenderTableCol.h: Ditto. Made virtual functions private.
+        * rendering/RenderTableRow.h: Ditto.
+        * rendering/RenderTableSection.h: Ditto.
+
+2009-07-31  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by John Sullivan.
+
+        <rdar://problem/6973106> and https://bugs.webkit.org/show_bug.cgi?id=27896
+        Favicons are still loaded when automatic image loading is disabled.
+
+        People who want to avoid loading images generally want to avoid loading all images.
+
+        Test: http/tests/misc/favicon-loads-with-images-disabled.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::startIconLoader): After committing the URL mapping, don't actually 
+          perform the load if images shouldn't be loading.
+
+2009-07-31  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Anders Carlsson.
+        
+        Accelerated animations stutter on pages with lots of animations and 3d transforms
+        https://bugs.webkit.org/show_bug.cgi?id=27884
+        
+        This patch changes the strategy for synchronizing painting view the view,
+        and compositing layer updates. Previously the strategy was to disable screen
+        updates between the time we updated the layer tree, and painted the view. That
+        left screen updates disabled for too long (hundreds of milliseconds) in some
+        cases, causing animation stutter.
+        
+        The new strategy is to batch up changes to the CA layer tree, and commit them
+        all at once just before painting happens (referred to as a "sync" in the code).
+        GraphicsLayerCA now keeps a bitmask of changed properties, and then migrates
+        the values stored in GraphicsLayer into the CA layer tree at commit time.
+        
+        Compositing layers are then synced in FrameView::paintContents(). However, not
+        all style/layout changes will result in painting; to deal with style changes that
+        touch only compositing properties, we set up a runloop observer that takes care
+        of comitting layer changes when no painting happens.
+
+        * WebCore.base.exp: Export FrameView::syncCompositingStateRecursive()
+
+        * loader/EmptyClients.h: scheduleViewUpdate() renamed to syncCompositingStateRecursive()
+        * page/ChromeClient.h: scheduleViewUpdate() renamed to syncCompositingStateRecursive()
+
+        * page/FrameView.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::syncCompositingStateRecursive): syncCompositingState() on the
+        view and all subviews. Like layoutIfNeededRecursive(). If layout is pending, does not
+        sync and returns false, since we only want to sync when layout is done.
+        
+        (WebCore::FrameView::paintContents): syncCompositingState() before painting.
+
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::endAnimation):
+        Call animationPaused() to notify the graphics layers about animation pausing.
+        
+        * platform/graphics/FloatPoint3D.h:
+        (WebCore::operator==):
+        (WebCore::operator!=): 
+        Add missing comparison operators.
+        
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::setOpacity):
+        (WebCore::GraphicsLayer::setBackgroundColor): Simple setters no longer care about animation info.
+        
+        (WebCore::GraphicsLayer::paintGraphicsLayerContents): Null-check client.
+        
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::AnimationValue:):
+        (WebCore::TransformAnimationValue:):
+        (WebCore::KeyframeValueList:):
+        (WebCore::KeyframeValueList::insert):
+        Cleaned up versions of FloatValue and TransformValue, used to store information
+        about keyframes values.
+
+        (WebCore::GraphicsLayer::contentsRect):
+        (WebCore::GraphicsLayer::setContentsRect):
+        ContentsRect is now a simple setter.
+        
+        (WebCore::GraphicsLayer::addAnimation):
+        (WebCore::GraphicsLayer::removeAnimationsForProperty):
+        (WebCore::GraphicsLayer::removeAnimationsForKeyframes):
+        (WebCore::GraphicsLayer::pauseAnimation):
+        Simplified animation api.
+        
+        (WebCore::GraphicsLayer::setGeometryOrientation):
+        (WebCore::GraphicsLayer::geometryOrientation):
+        setGeometryOrientation is now just a normal member variable.
+        
+        (WebCore::GraphicsLayer::contentsOrientation): add a getter.
+        (WebCore::GraphicsLayer::syncCompositingState): Entry into the layer sync code.
+        
+        * platform/graphics/GraphicsLayerClient.h: scheduleViewUpdate() renamed to syncCompositingStateRecursive)
+
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        Lots of cleanup and refactoring. Main points:
+        - Layer changes are all batched, and only committed to the CA layer on syncCompositingState().
+        - Bitmask is used to store which properties have changed. More efficient than before.
+        - Simpler animation interface; simple setters are no longer confounded with animations.
+        - Refactored code that creates CA animations, and stores which animations are running.
+
+        * platform/graphics/transforms/TransformOperations.h:
+        (WebCore::TransformOperations::size):
+        (WebCore::TransformOperations::at): Useful accessors for size and indexed access.
+        
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderLayerBacking.cpp:
+        Renamed 'contentsLayer' to 'foregroundLayer' to avoid confusion with GraphicsLayer's
+        contentsLayer.
+        Adapt to GraphicsLayer's simpler animation API.
+        Pass animation pausing through to the graphics layers.
+        contentsBox() is no longer a callback via GraphicsLayerClient.
+        
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::setCompositingLayersNeedRebuild):
+        (WebCore::RenderLayerCompositor::scheduleSync):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        scheduleViewUpdate() is no longer required. Instead, we plumb through "compositingLayerSync"
+        notifications, which travel up to WebKit and set up a runloop observer.
+        
+2009-07-30  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by David Levin.
+
+        Guard needs //'s between #endif and ENABLE(DATAGRID)
+        https://bugs.webkit.org/show_bug.cgi?id=27862
+
+        Compiling this file causes a build break without this change.
+
+        * bindings/v8/custom/V8DataGridColumnListCustom.cpp:
+
+2009-07-31  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Geolocation clean up when no longer updating
+        https://bugs.webkit.org/show_bug.cgi?id=27888
+
+        When Geolocation::disconnectFrame() is called, need to call 
+        Document::setUsingGeolocation(false) to mirror the true call 
+        when it is set up.
+
+        When handling an error, and there are no more listeners, call
+        GeolocationService::stopUpdating().
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::disconnectFrame):
+        (WebCore::Geolocation::handleError):
+
+2009-07-31  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by George Staikos.
+
+        Consolidate GeoLocation code to send positions and errors
+        https://bugs.webkit.org/show_bug.cgi?id=27863
+        
+        Create helper methods that will send positions and errors to either
+        one shots or watchers.
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::sendError):
+        (WebCore::Geolocation::sendErrorToOneShots):
+        (WebCore::Geolocation::sendErrorToWatchers):
+        (WebCore::Geolocation::sendPosition):
+        (WebCore::Geolocation::sendPositionToOneShots):
+        (WebCore::Geolocation::sendPositionToWatchers):
+        * page/Geolocation.h:
+
+2009-07-31  Xan Lopez  <xlopez@igalia.com>
+
+        Roll out previous change as it might be causing some weirdness in
+        the bots.
+
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
+        (WebCore::BMPImageDecoder::processFileHeader):
+
+2009-07-31  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Mark Rowe.
+
+        Fix compiler warning.
+        https://bugs.webkit.org/show_bug.cgi?id=27851
+
+        GCC does not like multi-character character constants, so use the
+        explicit numerical value of 'BM' in the enum.
+
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
+        (WebCore::BMPImageDecoder::processFileHeader):
+
+2009-07-30  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Mark Rowe, but Dan Bernstein also reviewed and asked thoughtful questions.
+
+        <rdar://problem/7106968> and https://bugs.webkit.org/show_bug.cgi?id=27868
+        http://www.ruthhuntcandy.com/ goes into infinite refresh in WebKit, works in others.
+        
+        Test: http/tests/misc/meta-refresh-stray-single-quote.html
+
+        * platform/network/HTTPParsers.cpp:
+        (WebCore::parseHTTPRefresh): Allow for a stray quote character at the start of the URL string.
+
+2009-07-30  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Adele Peterson and Jon Honeycutt.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=27828> for Mac.
+        Bug 27828: Title attribute is not respected on option elements
+
+        No tests added as it is not clear how to test a tool tip from DumpRenderTree.
+
+        * platform/PopupMenuClient.h: Add a method for retrieving the tool tip of an item.
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenu::populate): Set the tool tip of the menu item to that of the represented item.
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::itemToolTip): Expose the title attribute of the element as the tool tip.
+        * rendering/RenderMenuList.h:
+        * rendering/RenderTextControlSingleLine.h:
+        (WebCore::RenderTextControlSingleLine::itemToolTip): Return an empty string, indicating no tool tip, for
+        the popup menu in RenderTextControlSingleLine.
+
+2009-07-30  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Remove ChromeClientChromium::setToolTip().
+        https://bugs.webkit.org/show_bug.cgi?id=27861
+
+        This patch is just to remove a temporarily introduced overloaded empty
+        virtual function. No test is needed.
+
+        * page/chromium/ChromeClientChromium.h:
+
+2009-07-30  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27821
+
+        ApplicationCacheHost refactoring.
+        
+        1) Better encapsulate the interfaces between webcore common code
+        and the appcache system within a new class ApplicationCacheHost.
+
+        2) Use that interface throughout the loader system, replacing inline appcache logic.
+
+        3) Implement the interface in terms of webcore's appcache system.
+
+        4) Add the new files to various makefiles.
+
+        5) Implement protocolHostAndPortAreEqual() in KURLGoogle.cpp
+
+        No new features, no new tests. The existing layout tests all pass.
+
+        * GNUmakefile.am:
+        * WebCore.base.exp:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/HTMLHtmlElement.cpp:
+        (WebCore::HTMLHtmlElement::insertedIntoDocument):
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::DocumentLoader):
+        (WebCore::DocumentLoader::~DocumentLoader):
+        (WebCore::DocumentLoader::mainReceivedError):
+        (WebCore::DocumentLoader::detachFromFrame):
+        (WebCore::DocumentLoader::setPrimaryLoadComplete):
+        * loader/DocumentLoader.h:
+        (WebCore::DocumentLoader::applicationCacheHost):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        (WebCore::FrameLoader::loadResourceSynchronously):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didReceiveResponse):
+        (WebCore::MainResourceLoader::didReceiveData):
+        (WebCore::MainResourceLoader::didFinishLoading):
+        (WebCore::MainResourceLoader::didFail):
+        (WebCore::MainResourceLoader::load):
+        * loader/MainResourceLoader.h:
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::load):
+        (WebCore::ResourceLoader::willSendRequest):
+        (WebCore::ResourceLoader::didReceiveResponse):
+        (WebCore::ResourceLoader::didFail):
+        * loader/ResourceLoader.h:
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::selectCache):
+        (WebCore::ApplicationCacheGroup::selectCacheWithoutManifestURL):
+        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource):
+        (WebCore::ApplicationCacheGroup::failedLoadingMainResource):
+        (WebCore::ApplicationCacheGroup::disassociateDocumentLoader):
+        (WebCore::ApplicationCacheGroup::update):
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
+        (WebCore::ApplicationCacheGroup::manifestNotFound):
+        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete):
+        (WebCore::ApplicationCacheGroup::startLoadingEntry):
+        (WebCore::ApplicationCacheGroup::associateDocumentLoaderWithCache):
+        (WebCore::CallCacheListenerTask::create):
+        (WebCore::CallCacheListenerTask::performTask):
+        (WebCore::CallCacheListenerTask::CallCacheListenerTask):
+        (WebCore::ApplicationCacheGroup::postListenerTask):
+        * loader/appcache/ApplicationCacheGroup.h:
+        * loader/appcache/ApplicationCacheHost.cpp: Added.
+        * loader/appcache/ApplicationCacheHost.h: Added.
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::transferApplicationCache):
+        * loader/appcache/ApplicationCacheStorage.h:
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::DOMApplicationCache):
+        (WebCore::DOMApplicationCache::disconnectFrame):
+        (WebCore::DOMApplicationCache::applicationCacheHost):
+        (WebCore::DOMApplicationCache::status):
+        (WebCore::DOMApplicationCache::update):
+        (WebCore::DOMApplicationCache::swapCache):
+        (WebCore::DOMApplicationCache::addEventListener):
+        (WebCore::DOMApplicationCache::removeEventListener):
+        (WebCore::DOMApplicationCache::dispatchEvent):
+        (WebCore::DOMApplicationCache::callListener):
+        (WebCore::DOMApplicationCache::toEventName):
+        (WebCore::DOMApplicationCache::toEventType):
+        * loader/appcache/DOMApplicationCache.h:
+        (WebCore::DOMApplicationCache::):
+        (WebCore::DOMApplicationCache::setAttributeEventListener):
+        (WebCore::DOMApplicationCache::getAttributeEventListener):
+        (WebCore::DOMApplicationCache::clearAttributeEventListener):
+        (WebCore::DOMApplicationCache::callEventListener):
+        (WebCore::DOMApplicationCache::setOnchecking):
+        (WebCore::DOMApplicationCache::onchecking):
+        (WebCore::DOMApplicationCache::setOnerror):
+        (WebCore::DOMApplicationCache::onerror):
+        (WebCore::DOMApplicationCache::setOnnoupdate):
+        (WebCore::DOMApplicationCache::onnoupdate):
+        (WebCore::DOMApplicationCache::setOndownloading):
+        (WebCore::DOMApplicationCache::ondownloading):
+        (WebCore::DOMApplicationCache::setOnprogress):
+        (WebCore::DOMApplicationCache::onprogress):
+        (WebCore::DOMApplicationCache::setOnupdateready):
+        (WebCore::DOMApplicationCache::onupdateready):
+        (WebCore::DOMApplicationCache::setOncached):
+        (WebCore::DOMApplicationCache::oncached):
+        (WebCore::DOMApplicationCache::setOnobsolete):
+        (WebCore::DOMApplicationCache::onobsolete):
+        (WebCore::DOMApplicationCache::~DOMApplicationCache):
+        * platform/KURLGoogle.cpp:
+        (WebCore::protocolHostAndPortAreEqual):
+
+2009-07-30  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27854 - crash at WebCore::AXObjectCache::notificationPostTimerFired
+        https://bugs.webkit.org/show_bug.cgi?id=27854
+
+        AccessibilityObjects need to be retained while waiting to fire their notifications, otherwise
+        they can disappear and then lead to crashes.
+       
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::notificationPostTimerFired):
+        (WebCore::AXObjectCache::postNotification):
+        * accessibility/AXObjectCache.h:
+
+2009-07-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Minor change to earlier commit suggested by Darin Adler.
+        Use the variable rather than dereferencing 'it' again.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::keyframeStylesForAnimation):
+
+2009-07-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Animation with a timing function property in a keyframe eats CPU
+        https://bugs.webkit.org/show_bug.cgi?id=27856
+        <rdar://problem/7104476> Animation demo uses lots of CPU
+        
+        Don't include animation-timing-function in the list of properties to
+        animate in a keyframe animation, because this property is not animated;
+        instead, it describes the timing function to apply to this keyframe.
+        
+        This prevents the animation code from thinking that there's a property
+        that it has to software-animate, and thus firing the animation timer frequently.
+        
+        Not testable because there is no visible impact.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::keyframeStylesForAnimation): Don't add
+        CSSPropertyWebkitAnimationTimingFunction to the list of properties to animate.
+
+        * page/animation/KeyframeAnimation.cpp
+        (WebCore::KeyframeAnimation::getKeyframeAnimationInterval): Add a comment
+
+2009-07-30  Mike Fenton  <mike.fenton@torchmobile.com>
+
+         Reviewed by Adam Treat.
+
+         Apply colour style to buttons that use Theme settings in Qt.
+
+         https://bugs.webkit.org/show_bug.cgi?id=27814
+
+         * platform/qt/RenderThemeQt.cpp:
+         (WebCore::RenderThemeQt::adjustButtonStyle):
+
+=== End merge of nitro-extreme branch 2009-07-30 ===
+
+2009-05-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Make WebCore compile with the new JS number representation.
+
+        * ForwardingHeaders/runtime/JSAPIValueWrapper.h: Added.
+        * ForwardingHeaders/runtime/JSNumberCell.h: Removed.
+        * bindings/js/ScriptEventListener.cpp:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/c/c_instance.cpp:
+
+=== Start merge of nitro-extreme branch 2009-07-30 ===
+
+2009-07-30  Dean McNamee  <deanm@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Don't try to hash member function pointers, instead use a precomputed value based on the field.
+        https://bugs.webkit.org/show_bug.cgi?id=27843
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8SVGPODTypeWrapper.h:
+        (WebCore::PODTypeWrapperCacheInfo::PODTypeWrapperCacheInfo):
+        (WebCore::PODTypeWrapperCacheInfo::operator==):
+        (WebCore::PODTypeWrapperCacheInfoHash::hash):
+        (WebCore::V8SVGDynamicPODTypeWrapperCache::lookupOrCreateWrapper):
+
+2009-07-30  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix compiler warning.
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+
+2009-07-29  Matt Perry  <mpcomplete@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add a way to register V8 extensions for Isolated Worlds only.
+        https://bugs.webkit.org/show_bug.cgi?id=27785
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInNewWorld):
+        (WebCore::ScriptController::evaluateInNewContext):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::evaluate):
+        * bindings/v8/V8IsolatedWorld.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInNewWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::createNewContext):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        (WebCore::V8Proxy::registerExtensionWithV8):
+        (WebCore::V8Proxy::registerExtension):
+        * bindings/v8/V8Proxy.h:
+
+2009-07-30  Mike Fenton  <mike.fenton@torchmobile.com>
+
+         Reviewed by Adam Treat.
+
+         Add previously defined out support to PopupMenuQt for marking entries as
+         disabled and for selecting the desired item.
+
+         https://bugs.webkit.org/show_bug.cgi?id=27772
+
+         * platform/qt/PopupMenuQt.cpp:
+         (WebCore::PopupMenu::populate):
+
+2009-07-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Levin.
+
+        Use checked casts for render tree
+        https://bugs.webkit.org/show_bug.cgi?id=23522
+
+        Next step: Add new toRenderWidget cast and use it everywhere.
+
+        Use checked casts in all the places that were using static_cast
+        but there is a checked cast available.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::stringValue):
+        (WebCore::AccessibilityRenderObject::widget):
+        (WebCore::AccessibilityRenderObject::widgetForAttachmentView):
+        (WebCore::AccessibilityRenderObject::visiblePositionForPoint):
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getPangoLayoutForAtk):
+        * dom/Document.cpp:
+        (WebCore::widgetForNode):
+        (WebCore::Document::setFocusedNode):
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::findWidgetRenderer):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::defaultEventHandler):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::renderWidgetForJSBindings):
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::defaultEventHandler):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadSubframe):
+        * loader/PluginDocument.cpp:
+        (WebCore::PluginTokenizer::writeRawData):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        (WebCore::subframeForTargetNode):
+        (WebCore::EventHandler::handleWheelEvent):
+        * page/Frame.cpp:
+        (WebCore::isFrameElement):
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::computePageRects):
+        * page/android/EventHandlerAndroid.cpp:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        * page/chromium/EventHandlerChromium.cpp:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        * page/chromium/FrameChromium.cpp:
+        (WebCore::computePageRectsForFrame):
+        * page/gtk/EventHandlerGtk.cpp:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        * page/haiku/EventHandlerHaiku.cpp:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+        * page/win/FrameWin.cpp:
+        (WebCore::computePageRectsForFrame):
+        * page/wx/EventHandlerWx.cpp:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::getCachedImage):
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writeImage):
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writeImage):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeImage):
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::getCachedImage):
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::writeImage):
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::getCachedImage):
+        * platform/win/PasteboardWin.cpp:
+        (WebCore::Pasteboard::writeImage):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::boxModelObject):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::splitInlines):
+        (WebCore::RenderInline::addChildToContinuation):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateImageContents):
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::RenderTextControlInnerBlock::positionForPoint):
+        Use checked cast instead of static_cast.
+        
+        * rendering/RenderWidget.h: Added toRenderWidget.
+
+2009-07-30  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: some files modified to build for WINCE
+        https://bugs.webkit.org/show_bug.cgi?id=27816
+
+        * accessibility/AccessibilityObject.h:
+        * page/win/EventHandlerWin.cpp:
+        (WebCore::EventHandler::createDraggingClipboard):
+        * platform/win/PlatformMouseEventWin.cpp:
+        (WebCore::messageToEventType):
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/win/PlatformScreenWin.cpp:
+        (WebCore::deviceInfoForWidget):
+        (WebCore::screenIsMonochrome):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::paint):
+        (WebCore::registerPopup):
+        (WebCore::PopupWndProc):
+
+2009-07-30  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: modified graphics files
+        https://bugs.webkit.org/show_bug.cgi?id=27779
+
+        * platform/graphics/BitmapImage.h:
+        (WebCore::BitmapImage::mayFillWithSolidColor):
+        * platform/graphics/Gradient.h:
+        * platform/graphics/GraphicsContext.cpp:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/ImageSource.h:
+        * platform/graphics/MediaPlayer.cpp:
+        * platform/graphics/Path.h:
+        * platform/graphics/Pattern.h:
+        * platform/graphics/transforms/Matrix3DTransformOperation.cpp:
+        (WebCore::Matrix3DTransformOperation::blend):
+        * platform/graphics/transforms/MatrixTransformOperation.cpp:
+        (WebCore::MatrixTransformOperation::blend):
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (WebCore::TransformationMatrix::operator*):
+        * platform/graphics/win/IconWin.cpp:
+        (WebCore::Icon::createIconForFile):
+        (WebCore::Icon::createIconForFiles):
+        (WebCore::Icon::paint):
+
+2009-07-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Improve efficiency by rewriting code doing three hash table
+        lookups, which can be replaced by just one as pointed out
+        by Darin Adler.
+
+        Though being slightly less clear, this should be considerable
+        faster.
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::remove):
+
+2009-07-30  Antonio Gomes   <antonio.gomes@openbossa.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] Code cleanup in MediaPlayerPrivateGStreamer.cpp|h and VideoSinkGStreamer.cpp|h (Part 2)
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        Removed unneeded includes (gdk.h and gtk.h) and added glib.h and cairo.h instead.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-07-30  Antonio Gomes   <antonio.gomes@openbossa.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] Code cleanup in MediaPlayerPrivateGStreamer.cpp|h and VideoSinkGStreamer.cpp|h (Part 1)
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        Fixed many code style issues pointed by WebKitTools/Scripts/modules/cpplint.py
+        No functionality change at all.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        * platform/graphics/gtk/VideoSinkGStreamer.h:
+
+2009-07-30  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Allow to explicitly choose a preferred plugin for a mimetype.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        When the preferred plugin is set for a specific MIME type, it will be
+        always picked up, regardless of its version, quirks etc.
+
+        Client applications may want to use that API to resolve mimetype
+        ambiguity in a custom way, rather than in the default way that is
+        currently used in WebKit.
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::pluginForMIMEType):
+        (WebCore::PluginDatabase::MIMETypeForExtension):
+        (WebCore::PluginDatabase::setPreferredPluginForMIMEType): Added.
+        (WebCore::PluginDatabase::remove):
+        (WebCore::PluginDatabase::clear):
+        * plugins/PluginDatabase.h:
+
+2009-07-30  Jakub Wieczorek  <faw217@gmail.com>
+
+        [Qt] Fix build with Qt 4.4 after r46535.
+
+        * platform/network/qt/ResourceHandleQt.cpp:
+
+2009-07-30  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Video elements fires another "load" event when attached to DOM
+        https://bugs.webkit.org/show_bug.cgi?id=27623
+
+        Test: media/media-load-event.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::insertedIntoDocument):
+            Only schedule load when element's network state is NETWORK_EMPTY.
+
+2009-07-30  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by David Levin.
+
+        Cache v8 strings when converting from WebCore::String to v8 string.
+        https://bugs.webkit.org/show_bug.cgi?id=27655
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8String): now just immediately calls v8ExternalString
+        (WebCore::enableStringImplCache): enables caching of conversions from WebCore::StringImpl to
+        v8::String
+        (WebCore::makeExternalString): utilty function to create external v8::String out of
+        WebCore::String
+        (WebCore::getStringCache): static function to access string cache
+        (WebCore::cachedStringCallback): callback for weak handles of v8::Strings stored in the
+        cache
+        (WebCore::v8ExternalString): if caching enabled, checks if there is already v8::String for
+        the given WebCore::StringImpl.  If present, returns it, otherwise creates a new v8 external
+        string.
+        * bindings/v8/V8Binding.h:
+
+2009-07-30  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25535
+        [GTK] object:state-changed:checked events missing for radio buttons and checkboxes
+
+        Implement state-changed:checked for radio buttons and checkboxes.
+
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setChecked):
+
+2009-07-30  Xan Lopez  <xlopez@igalia.com>
+
+        Forgot the 'break'.
+
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+
+2009-07-30  Xan Lopez  <xlopez@igalia.com>
+
+        Try to fix Mac build.
+
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+
+2009-07-29  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Adam Barth.
+
+        Add missing enumeration value to switch.
+
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+
+2009-07-29  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Workers need to throw an exception when presented with invalid URLs.
+        https://bugs.webkit.org/show_bug.cgi?id=27770
+
+        Tests covered by worker-constructor.html and worker-redirect.html.
+
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::constructWorker):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
+        * workers/Worker.h:
+        (WebCore::Worker::create):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::importScripts):
+        * workers/WorkerScriptLoader.cpp:
+        (WebCore::WorkerScriptLoader::loadSynchronously):
+        (WebCore::WorkerScriptLoader::loadAsynchronously):
+        (WebCore::WorkerScriptLoader::createResourceRequest):
+        * workers/WorkerScriptLoader.h:
+
+2009-07-29  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        (REGRESSION: r46039) Should restore previous connections-per-host limit for non-http(s) hosts
+        https://bugs.webkit.org/show_bug.cgi?id=27822 and <rdar://problem/7091659>
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::servePendingRequests): For non-http(s) hosts, restore the previous behavior of 
+          only limiting connections while parsing and still trying to figure out stylesheet urls.
+
+2009-07-29  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: Add WebCore/page/wince/FrameWince.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27729
+
+        * page/wince/FrameWince.cpp: Added.
+
+2009-07-29  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        REGRESSION(r46370-46426): /editing/style/remove-underline-from-stylesheet.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=27809
+
+        The patch primarily rebaselines the tests but also fixes the bug in currentlyHasStyle.
+        To determine that a particular text decoration is present, currentlyHasStyle should refer to
+        -webkit-text-decorations-in-effect to take care of styles set by u, s, strike tags and ancestors' CSS.
+        We also need to update layout to accommodate the changes made within ApplyStyleCommand.
+
+        * editing/ApplyStyleCommand.cpp: ditto
+        (WebCore::StyleChange::currentlyHasStyle): ditto
+
+2009-07-29  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: changes to platform/text files
+        https://bugs.webkit.org/show_bug.cgi?id=27715
+
+        * platform/text/String.cpp:
+        (WebCore::String::format):
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::encode):
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::buildBaseTextCodecMaps):
+        (WebCore::extendTextCodecMaps):
+
+2009-07-29  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Roben.
+
+        FIX: HDC leaks in PopupMenuWin.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27817
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::~PopupMenu):
+        (WebCore::PopupMenu::paint):
+
+2009-07-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Illegal values for <ol start> cause list numbering start at 0 (should start at 1)
+        https://bugs.webkit.org/show_bug.cgi?id=27810
+
+        Test: fast/lists/ol-start-parsing.html
+
+        * html/HTMLOListElement.cpp:
+        (WebCore::HTMLOListElement::parseMappedAttribute): Check the result of toInt
+        and use the value 1 if it failed to parse. Before we were getting toInt's default
+        behavior, which is to return 0.
+
+2009-07-29  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Added foundation work to allow a testing infrastructure for the Web
+        Inspector.
+
+        * inspector/InspectorClient.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::scriptObjectReady): Tell the testing
+        harness that the window object is ready.
+        * loader/EmptyClients.h: Empty class support for SVG.
+        (WebCore::EmptyInspectorClient::inspectorWindowObjectCleared):
+
+2009-07-29  Chris Fleizach  <cfleizach@apple.com>
+
+        Build fix for windows after landing
+        Bug 27807 - AX: move re-usable code into more common areas for other platforms
+   
+        Apparently bzero doesn't exist on windows.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::textMarkerDataForVisiblePosition):
+
+2009-07-29  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Justin Garcia.
+
+        Bug 27807 - AX: move re-usable code into more common areas for other platforms
+        https://bugs.webkit.org/show_bug.cgi?id=27807
+
+        Moves some accessibility code that was in the Mac file to a more common place so 
+        it can be used by other platforms. 
+        This includes:
+           Making TextMarkerData from a VisiblePosition.
+           Making a VisiblePosition from TextMarkerData.
+           Finding the anchor accessibility object for an arbitrary Node.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::visiblePositionForTextMarkerData):
+        (WebCore::AXObjectCache::textMarkerDataForVisiblePosition):
+        * accessibility/AXObjectCache.h:
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::anchorElementForNode):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::visiblePositionForIndex):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (textMarkerForVisiblePosition):
+        (visiblePositionForTextMarker):
+        (AXAttributedStringAppendText):
+
+2009-07-29  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Inset box shadows are incorrectly accounted for in visual overflow
+        computations
+        https://bugs.webkit.org/show_bug.cgi?id=27811
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesHorizontally): Use
+            getBoxShadowHorizontalExtent().
+        (WebCore::InlineFlowBox::placeBoxesVertically): Use
+            getBoxShadowVerticalExtent(). Removed duplicate code to get the
+            text-shadow overflow.
+        (WebCore::InlineFlowBox::paint): Use getBoxShadowHorizontalExtent().
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::overflowHeight): Use
+            getBoxShadowVerticalExtent().
+        (WebCore::RenderBlock::overflowWidth): Use
+            getBoxShadowHorizontalExtent().
+        (WebCore::RenderBlock::overflowLeft): Ditto.
+        (WebCore::RenderBlock::overflowTop): Use getBoxShadowVerticalExtent().
+        (WebCore::RenderBlock::overflowRect): Use getBoxShadowExtent().
+        (WebCore::RenderBlock::layoutBlock): Ditto.
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock): Ditto.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::calculateRects): Exclude inset shadows.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded): Use
+            getBoxShadowHorizontalExtent() and getBoxShadowVerticalExtent().
+        (WebCore::RenderObject::adjustRectForOutlineAndShadow): Exclude inset
+            shadows.
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::adjustOverflowForBoxShadowAndReflect): Ditto.
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::setTextShadow): Also assert that text-shadows are
+            not inset.
+        (WebCore::RenderStyle::getBoxShadowExtent): Added. Excludes inset
+            shadows.
+        (WebCore::RenderStyle::getBoxShadowHorizontalExtent): Ditto.
+        (WebCore::RenderStyle::getBoxShadowVerticalExtent): Ditto.
+        * rendering/style/RenderStyle.h:
+
+2009-07-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix crash when an element with display: table-row is composited (e.g. via a 3d-transform)
+        https://bugs.webkit.org/show_bug.cgi?id=27796
+        
+        Avoid repainting when a layer becomes composited if the renderer is not parented
+        yet, because it makes no sense to do so.
+        
+        If the table row is a repaint container, default to the RenderBox implementation
+        of clippedOverflowRectForRepaint(), because we cannot hand off the repaint rect
+        computation to something that is above the repaint container.
+
+        Test: fast/table/table-row-compositing-repaint-crash.html
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::repaintOnCompositingChange):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::clippedOverflowRectForRepaint):
+
+2009-07-29  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27791
+        307 redirects of POSTs should use POST, not GET
+
+        Test: http/tests/loading/redirect-methods.html
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]):
+
+2009-07-29  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Adding -webkit-animation-play-state back in
+        https://bugs.webkit.org/show_bug.cgi?id=26867
+
+        We've decided to keep -webkit-animation-play-state. So this
+        just adds back in the code from https://bugs.webkit.org/show_bug.cgi?id=22907.
+
+        Test: animations/play-state.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseAnimationPlayState):
+        (WebCore::CSSParser::parseAnimationProperty):
+        * css/CSSParser.h:
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        (WebCore::CSSStyleSelector::mapAnimationPlayState):
+        * css/CSSStyleSelector.h:
+        * platform/animation/Animation.h:
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-07-29  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Expose the default plugin directories and the current directory set of
+        the plugin database as public API.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        * plugins/PluginDatabase.h:
+        (WebCore::PluginDatabase::pluginDirectories):
+
+2009-07-29  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] Font size for current time display in media controls panel
+        is affected by body font size.
+        https://bugs.webkit.org/show_bug.cgi?id=27799
+
+        Fixing the problem of rendering by explicitly setting the font size
+        for the time displays.
+
+        No new tests since this is covered by existing media tests.
+
+        * css/mediaControlsChromium.css:
+
+2009-07-29  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by David Levin.
+
+        Update WebCore/page/ContextMenuController.cpp to conform to WebKit
+        Style Guidelines as identified by cpp_style.py.
+        https://bugs.webkit.org/show_bug.cgi?id=27613
+
+        * page/ContextMenuController.cpp:
+        (WebCore::openNewWindow):
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+
+2009-07-29  Dean McNamee  <deanm@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Removed unused wrapCPointer/extractCPointer from the v8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=27805
+
+        * bindings/v8/V8DOMWrapper.h:
+
+2009-07-29  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Expose the PluginDatabase::pluginForMIMEType() function as public API.
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        It can be used to determine the appropriate plugin for a mime type,
+        without guessing the mimetype from the extension.
+
+        * plugins/PluginDatabase.h:
+
+2009-07-29  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Adam Treat.
+
+        Allow to enable/disable particular plugin packages.
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        Disabled plugins will not be picked up when looking for a plugin
+        supporting the requested mimetypes.
+
+        Client applications may want to use that API to disable specific
+        plugins.
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::pluginForMIMEType):
+        (WebCore::PluginDatabase::MIMETypeForExtension):
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::PluginPackage):
+        (WebCore::PluginPackage::setEnabled):
+        * plugins/PluginPackage.h:
+        (WebCore::PluginPackage::isEnabled):
+
+2009-07-29  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        [WML] Running WML tests in random order multiple times exposes subtle bugs
+        https://bugs.webkit.org/show_bug.cgi?id=27801
+
+        Remove superflous assertions regarding the parent node. Under certain circumstances
+        these can even fire (related to garbage collection while destructing). Fixes random order
+        WML tests (run-webkit-tests fast/wml wml http/tests/wml fast/wml ... --random)
+
+        The wml/enter-first-card-with-events.html test relied on a bug in our implementation of
+        WMLPageState::reset() - the history stack should still contain the current card afterwards.
+        Fix that bug by preserving the first item in BackForwardList::clearWMLPageHistory().
+
+        * history/BackForwardList.cpp: Preserve first item in history stack, as demanded by the spec.
+        (WebCore::BackForwardList::clearWMLPageHistory):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::insertedIntoDocument):
+        (WebCore::WMLDoElement::removedFromDocument):
+        * wml/WMLNoopElement.cpp:
+        (WebCore::WMLNoopElement::insertedIntoDocument):
+        * wml/WMLOnEventElement.cpp:
+        (WebCore::eventHandlingParent):
+        * wml/WMLPostfieldElement.cpp:
+        (WebCore::WMLPostfieldElement::insertedIntoDocument):
+        (WebCore::WMLPostfieldElement::removedFromDocument):
+        * wml/WMLSetvarElement.cpp:
+        (WebCore::WMLSetvarElement::insertedIntoDocument):
+        (WebCore::WMLSetvarElement::removedFromDocument):
+        * wml/WMLTaskElement.cpp:
+        (WebCore::WMLTaskElement::insertedIntoDocument):
+        (WebCore::WMLTaskElement::removedFromDocument):
+        * wml/WMLTimerElement.cpp:
+        (WebCore::WMLTimerElement::insertedIntoDocument):
+        (WebCore::WMLTimerElement::removedFromDocument):
+
+2009-07-29  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26848
+        [Qt] ResourceHandle::willLoadFromCache needs to be implemented QtWebKit.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadItem):
+        * platform/network/ResourceHandle.h:
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::willLoadFromCache):
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::ResourceHandle::willLoadFromCache):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::willLoadFromCache):
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::willLoadFromCache):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
+
+2009-07-29  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        Media control panel for <video> in MediaDocument is mis-placed
+        https://bugs.webkit.org/show_bug.cgi?id=27798
+
+        Fixing a rendering problem: When <video> is displayed in MediaDocument,
+        the media control panel overlaps with the video by 16 pixels.
+
+        No new tests as this is covered by existing media tests.
+
+        * css/mediaControlsChromium.css:
+
+2009-07-29  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed build fix for Chromium.  Those last two patches weren't
+        independent despite the clean merge.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+
+2009-07-29  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        ImageSourceCG makes bad data refs (race condition causes blank images)
+        https://bugs.webkit.org/show_bug.cgi?id=27777
+
+        Make ImageSourceCG guarantee that the lifetime of the SharedBuffer that
+        backs the CFDataRef will be long enough.
+
+        No new tests, as this fixes a bug with a race condition that is
+        difficult to trigger.
+
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::setData):
+
+2009-07-29  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Console should show completions for the command line APIs
+        https://bugs.webkit.org/show_bug.cgi?id=27696
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype._reportCompletions): Adds properties from _inspectorCommandLineAPI to 
+        completions when available.
+        * inspector/front-end/utilities.js:
+        (Object.properties): Added.
+        (Object.sortedProperties):
+
+2009-07-29  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Refactor the first step of layout in RenderFlexibleBox.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27704
+
+        No new tests as this change is just a refactoring.
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::gatherFlexChildrenInfo):
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+
+2009-07-29  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Fix a bug that HTMLOptionElement::value() returns an incorrect
+        value in a case that the element has a label attribute and no
+        value attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=27760
+
+        Test: fast/forms/option-value-and-label.html
+
+        * dom/OptionElement.cpp:
+        (WebCore::OptionElement::collectOptionLabelOrText):
+        (WebCore::OptionElement::collectOptionInnerText):
+        (WebCore::OptionElement::normalizeText):
+        (WebCore::OptionElement::collectOptionTextRespectingGroupLabel):
+        (WebCore::OptionElement::collectOptionValue):
+        * dom/OptionElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::text):
+        * wml/WMLOptionElement.cpp:
+        (WebCore::WMLOptionElement::text):
+
+2009-07-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix isolated world wrappers for event handlers
+        https://bugs.webkit.org/show_bug.cgi?id=27533
+
+        Instead of getting the context from the frame, we cache the context
+        when the listener is created so that we get the context for the right
+        world.
+
+        Test: http/tests/security/isolatedWorld/click-event.html
+
+        * WebCore.gypi:
+        * bindings/v8/OwnHandle.h: Added.
+        (WebCore::OwnHandle::OwnHandle):
+        (WebCore::OwnHandle::~OwnHandle):
+        (WebCore::OwnHandle::get):
+        (WebCore::OwnHandle::set):
+        (WebCore::OwnHandle::release):
+        (WebCore::OwnHandle::adopt):
+        (WebCore::OwnHandle::swap):
+        (WebCore::OwnHandle::clear):
+        (WebCore::OwnHandle::makeWeak):
+        (WebCore::OwnHandle::weakCallback):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8DOMWrapper.h:
+
+2009-07-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Teach V8Proxy::context about isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=27701
+
+        Change V8Proxy::context(Frame*) to understand isolated worlds.  Audit
+        all callers of this method to make sure they want isolated worlds.  In
+        cases where we really want the main world, I've changed the call to
+        V8Proxy::mainWorldContext(Frame*).
+        
+        The main visible change is to the document.open method when called with
+        more than two arguments.  This design seems more likely to lead to
+        future correct code.
+
+        Test: http/tests/security/isolatedWorld/document-open.html
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        (WebCore::ScriptController::evaluate):
+        (WebCore::ScriptController::bindToWindowObject):
+        (WebCore::ScriptController::collectGarbage):
+        (WebCore::createScriptObject):
+        (WebCore::ScriptController::createScriptObjectForPluginElement):
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::handleEvent):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getConstructor):
+        (WebCore::V8DOMWrapper::setHiddenWindowReference):
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):
+        (WebCore::V8DOMWrapper::convertWindowToV8Object):
+        * bindings/v8/V8Helpers.cpp:
+        (WebCore::toV8Context):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::context):
+        (WebCore::V8Proxy::mainWorldContext):
+        (WebCore::V8Proxy::bindJsObjectToWindow):
+        * bindings/v8/V8Proxy.h:
+
+2009-07-29  Balazs Kelemen  <kelemen.balazs.3@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        Fix the Qt build, add missing file.
+
+        * WebCore.pro:
+
+2009-07-28  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Speculative fix for <rdar://problem/7005077> WER: Crash in
+        WebCore::PluginStream::destroyStream+279 (1310510882)
+
+        Reviewed by Oliver Hunt.
+
+        * plugins/PluginStream.cpp:
+        (WebCore::PluginStream::destroyStream):
+        Move the "protector" RefPtr out of the block that dispatches
+        notifications and into the function level; if NPN_DestroyStream were
+        called from NPP_NewStream as the comment warns, we would be deleted at
+        the end of the block.
+
+2009-07-28  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Inspector: Tab Through the DOM Storage DataGrid when Editing
+
+        https://bugs.webkit.org/show_bug.cgi?id=27746
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/DOMStorageDataGrid.js:
+        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode): refactored to directly edit and select a column
+        (WebInspector.DOMStorageDataGrid.prototype._startEditing):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted.moveToNextIfNeeded): handles moveDirection on a commit
+        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted): uses moveToNext to traverse appropriately
+
+2009-07-28  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Inspector: Create New DOM Storage Items via DataGrid
+
+        https://bugs.webkit.org/show_bug.cgi?id=27322
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/DOMStorageDataGrid.js:
+        (WebInspector.DOMStorageDataGrid.prototype._startEditing): click anyway means creationNode
+        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted): fix unintended globals
+        (WebInspector.DOMStorageDataGrid.prototype.deleteSelectedRow): creationNode is special case
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid.prototype.addCreationNode): maintain a quick ref to the single creationNode
+        (WebInspector.CreationDataGridNode): new type of node
+        (WebInspector.CreationDataGridNode.prototype.makeNormal): convert to a normal node
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.dataGridForDOMStorage): add a creationNode to the GridData
+
+2009-07-28  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Inspector: Automatically Refresh DOM Storage Grids on "storage" event
+
+        https://bugs.webkit.org/show_bug.cgi?id=27400
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.show): trigger adding the listener
+        (WebInspector.DatabasesPanel.prototype.reset): trigger removing the listener
+        (WebInspector.DatabasesPanel.prototype._registerStorageEventListener): register the listener on the inspected window
+        (WebInspector.DatabasesPanel.prototype._unregisterStorageEventListener): unregister the listener on the inspected window
+        (WebInspector.DatabasesPanel.prototype._storageEvent): handle the storage event
+
+2009-07-28  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Inspector should support inspect() in the command line.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19874
+        rdar://problem/6070225
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled.inspectObject):
+        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled):
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.revealAndSelectDomStorage): Added.
+        (WebInspector.DatabasesPanel.prototype.revealAndSelectDatabase): Added.
+        (WebInspector.DatabasesPanel.prototype.showDatabase): 
+
+2009-07-28  Keishi Hattori  <casey.hattori@gmail.com>
+
+        The rest of: Web Inspector: Add inspected node using public console API.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27758
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled): Removed _inspectorCommandLineAPI._addInspectedNode.
+        (WebInspector.Console.prototype.addInspectedNode): Added.
+
+2009-07-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Accept autocomplete on 'End' key pressed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27447.
+
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype.handleKeyEvent):
+
+2009-07-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by David Levin.
+
+        [Qt] Build fix after r46502
+        https://bugs.webkit.org/show_bug.cgi?id=27789
+
+        * WebCore.pro: Remove StorageArea.cpp
+
+2009-07-28  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Follow-on fix to r35582.  Replace main thread assertions with WebCoreObjCScheduleDeallocateOnMainThread
+        in -dealloc overrides in DOMObject subclasses.
+
+        * bindings/scripts/CodeGeneratorObjC.pm:
+
+2009-07-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        [WML] WML*Element classes mostly implement insertedIntoDocument(), not removedFromDocument()
+        https://bugs.webkit.org/show_bug.cgi?id=27786
+
+        WML*Element classes mostly implement insertedIntoDocument(), not removedFromDocument().
+        The only case where this is relevant in WML is error handling. The parsed WML
+        tree fragment is inserted in an XHTML compound error document. This requires
+        removedFromDocument() to be correctly implemented otherwhise we run into
+        trouble (visible when using run-webkit-tests fast/wml --random).
+
+        * wml/WMLAnchorElement.cpp:
+        (WebCore::WMLAnchorElement::registerTask):
+        (WebCore::WMLAnchorElement::deregisterTask):
+        * wml/WMLAnchorElement.h:
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::removedFromDocument):
+        (WebCore::WMLDoElement::registerTask):
+        (WebCore::WMLDoElement::deregisterTask):
+        * wml/WMLDoElement.h:
+        * wml/WMLEventHandlingElement.cpp:
+        (WebCore::WMLEventHandlingElement::registerDoElement):
+        (WebCore::WMLEventHandlingElement::deregisterDoElement):
+        * wml/WMLEventHandlingElement.h:
+        * wml/WMLFieldSetElement.cpp:
+        (WebCore::WMLFieldSetElement::removedFromDocument):
+        * wml/WMLGoElement.cpp:
+        (WebCore::WMLGoElement::registerPostfieldElement):
+        (WebCore::WMLGoElement::deregisterPostfieldElement):
+        * wml/WMLGoElement.h:
+        * wml/WMLIntrinsicEventHandler.cpp:
+        (WebCore::WMLIntrinsicEventHandler::deregisterIntrinsicEvent):
+        * wml/WMLIntrinsicEventHandler.h:
+        * wml/WMLOnEventElement.cpp:
+        (WebCore::eventHandlingParent):
+        (WebCore::WMLOnEventElement::registerTask):
+        (WebCore::WMLOnEventElement::deregisterTask):
+        * wml/WMLOnEventElement.h:
+        * wml/WMLPostfieldElement.cpp:
+        (WebCore::WMLPostfieldElement::removedFromDocument):
+        * wml/WMLPostfieldElement.h:
+        * wml/WMLSetvarElement.cpp:
+        (WebCore::WMLSetvarElement::removedFromDocument):
+        * wml/WMLSetvarElement.h:
+        * wml/WMLTaskElement.cpp:
+        (WebCore::WMLTaskElement::removedFromDocument):
+        (WebCore::WMLTaskElement::registerVariableSetter):
+        (WebCore::WMLTaskElement::deregisterVariableSetter):
+        (WebCore::WMLTaskElement::storeVariableState):
+        * wml/WMLTaskElement.h:
+        * wml/WMLTimerElement.cpp:
+        (WebCore::WMLTimerElement::removedFromDocument):
+        * wml/WMLTimerElement.h:
+
+2009-07-28  David Levin  <levin@chromium.org>
+
+        Suggested by Drew Wilson.
+
+        Speculative gtk build fix, follow up to:
+        https://bugs.webkit.org/show_bug.cgi?id=27697
+
+        * GNUmakefile.am:
+
+2009-07-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        [CSS3 Backgrounds and Borders] Drop the prefix from the border-radius
+        properties
+        https://bugs.webkit.org/show_bug.cgi?id=27578
+
+        [CSS3 Backgrounds and Borders] Handle the / and 4 values in
+        border-radius
+        https://bugs.webkit.org/show_bug.cgi?id=27584
+
+        Test: fast/borders/border-radius-parsing.html
+
+        Dropped the -webkit- prefix from the individual corner border-radius
+        properties. Added border-radius with the / and 4-value syntax, and
+        maintained -webkit-border-radius with legacy 2-value syntax.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (computedProperties): Removed Webkit prefix.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Ditto.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Removed Webkit prefix from the
+            single-corner properties. Call out to parseBorderRadius() to parse
+            border-radius and -webkit-border-radius. 
+        (WebCore::completeBorderRadii): Added this helper function that
+            completes the values for all four corners when fewer than four are
+            specified.
+        (WebCore::CSSParser::parseBorderRadius): Added.
+        (WebCore::cssPropertyID): Map -webkit-border-*-*-radius to the
+            unprefixed property.
+        * css/CSSParser.h:
+        * css/CSSPropertyLonghand.cpp:
+        (WebCore::initShorthandMap): Removed the Webkit prefix. Added an entry
+            for border-radius. Kept the entry for -webkit-border-radius.
+        * css/CSSPropertyNames.in: Removed the -webkit- prefix from the
+            single-corenr properties. Added border-radius. Kept
+            -webkit-border-radius because of its conflicting syntax.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Removed the Webkit prefix.
+        * page/animation/AnimationBase.cpp:
+        (WebCore::ensurePropertyMap): Ditto.
+
+2009-07-28  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Refactored dedicated-worker-specific code from WorkerThread into DedicatedWorkerThread class.
+
+        WorkerThread needs to be refactored to separate out dedicated-worker functionality.
+        https://bugs.webkit.org/show_bug.cgi?id=27697
+
+        This is just a refactoring, so existing tests suffice.
+
+        * GNUmakefile.am:
+        Added DedicatedWorkerThread.h/.cpp
+        * WebCore.gypi:
+        Added DedicatedWorkerThread.h/.cpp
+        * WebCore.pro:
+        Added DedicatedWorkerThread.h/.cpp
+        * WebCore.vcproj/WebCore.vcproj:
+        Added DedicatedWorkerThread.h/.cpp
+        * WebCore.xcodeproj/project.pbxproj:
+        Added DedicatedWorkerThread.h/.cpp
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        Removed code to track pending activity - this is handled by DedicatedWorkerContext::importScripts() now.
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        Removed code to track pending activity - this is handled by DedicatedWorkerContext::importScripts() now.
+        * workers/DedicatedWorkerContext.cpp:
+        (WebCore::DedicatedWorkerContext::DedicatedWorkerContext):
+        (WebCore::DedicatedWorkerContext::addMessage):
+        Forwards console messages to parent document.
+        (WebCore::DedicatedWorkerContext::importScripts):
+        Now sends the updated pending activity status after importing scripts.
+        (WebCore::DedicatedWorkerContext::thread):
+        Helper routine that casts WorkerThread to DedicatedWorkerThread.
+        * workers/DedicatedWorkerContext.h:
+        (WebCore::DedicatedWorkerContext::create):
+        * workers/DedicatedWorkerThread.cpp: Added.
+        (WebCore::DedicatedWorkerThread::create):
+        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
+        (WebCore::DedicatedWorkerThread::~DedicatedWorkerThread):
+        (WebCore::DedicatedWorkerThread::createWorkerContext):
+        Implementation of the base class factory method to create the appropriate worker context.
+        (WebCore::DedicatedWorkerThread::runEventLoop):
+        Reports pending activity before running the event loop.
+        * workers/DedicatedWorkerThread.h: Added.
+        (WebCore::DedicatedWorkerThread::workerObjectProxy):
+        Moved from base class.
+        * workers/WorkerContext.cpp:
+        * workers/WorkerContext.h:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerMessagingProxy::startWorkerContext):
+        Now creates DedicatedWorkerThread.
+        (WebCore::WorkerMessagingProxy::workerThreadCreated):
+        Now is passed a DedicatedWorkerThread.
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::WorkerThread):
+        Moved workerObjectProxy param into derived class constructor.
+        (WebCore::WorkerThread::workerThread):
+        (WebCore::WorkerThread::runEventLoop):
+        Moved the event loop execution into a virtual function so DedicatedWorkerThread could report pending activity first.
+        * workers/WorkerThread.h:
+        (WebCore::WorkerThread::workerContext):
+
+2009-07-28  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix V8NPUtils' handling of UTF8 identifiers.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27782
+
+        * bindings/v8/V8NPUtils.cpp:
+        (getStringIdentifier): Treat the input string as UTF8 instead of ASCII,
+            since NPN_GetStringIdentifier() is expecting UTF8.
+
+2009-07-28  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Misc cleanup in DOM Storage.
+        https://bugs.webkit.org/show_bug.cgi?id=27517
+
+        The StorageAreaImpl changes are all for Chromium.  Because the DOM Storage implementation
+        runs in a different process from where the Frame object lives, Chromium passes in NULL
+        for the sourceFrame.  This affects events and handling privateBrowsing.  Chromium's
+        incognito mode does not use the private browsing setting, so that's not a concern.  As for
+        events, I've decided to simply disable them for now.
+
+        The StorageNamespaceImpl changes get rid of a stale comment (path is .copy'ed for thread-
+        safety) and to add an assert that .copy is only ever called on a SessionStorage namespace.
+
+        Also cleaned up tailing whitespace in several parts of StorageAreaImpl.cpp
+
+        * storage/StorageArea.cpp: Removed.  (It was empty anyway.)
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::privateBrowsingEnabled): Factored out the check.
+        (WebCore::StorageAreaImpl::setItem): Make frame optional.
+        (WebCore::StorageAreaImpl::removeItem): ditto
+        (WebCore::StorageAreaImpl::clear): ditto
+        (WebCore::StorageAreaImpl::dispatchStorageEvent): Disable in Chromium for now.
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl): Remove stale comment.
+        (WebCore::StorageNamespaceImpl::copy): Add assert that it's SessionStorage.
+
+2009-07-28  Alpha Lam  <hclam@google.com>
+
+        Reviewed by David Levin.
+
+        [chromium] Default UI controls for <video> has rendering problems
+        https://bugs.webkit.org/show_bug.cgi?id=27669
+
+        Fixes the bug that <video> in MediaDocument is 1 pixel tall if
+        it is playing an audio file by changing the style to be 32px
+        tall.
+
+        Also fixes a problem of default styled audio tag that hides the
+        all the time digits by expanding the width to 300px.
+
+        Changed the size and position of the current time and remaining
+        display to give enough space for the hour digit to be shown.
+
+        There are no new tests provided because this is already covered
+        by existing tests.
+
+        * css/mediaControlsChromium.css:
+
+2009-07-28  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix style in PluginPackage and PluginDatabase.
+        Part of https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::refresh):
+        (WebCore::PluginDatabase::findPlugin):
+        * plugins/PluginDatabase.h:
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::~PluginPackage):
+        (WebCore::PluginPackage::freeLibrarySoon):
+        (WebCore::PluginPackage::freeLibraryTimerFired):
+        (WebCore::PluginPackage::unloadWithoutShutdown):
+        (WebCore::PluginPackage::initializeBrowserFuncs):
+        * plugins/PluginPackage.h:
+
+2009-07-28  Anantanarayanan Iyengar  <ananta@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27769
+        The V8 bindings function V8Proxy::createNewContext can be 
+        called during frame shutdown where the activeDocumentLoader
+        function in FrameLoader can return NULL. Added a check for the
+        same.
+
+        No new tests added as this is an edge case where the V8 
+        bindings code is reentered via NPAPI during shutdown. It is 
+        difficult to write a consistently reproducible test for this.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::createNewContext):
+
+2009-07-28  Ivan Posva  <iposva@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Associate the CanvasPixelData backing store with the
+        indexed properties of the wrapper object.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27773
+
+        No new tests: Relying on existing Canvas tests.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+
+2009-07-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Nuke all references to JSWorkerContextBase.lut.h, it was removed
+        back in April.
+
+        * GNUmakefile.am:
+
+2009-07-28  Robert Agoston  <Agoston.Robert@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        Fixed references to script generate-webkitversion.pl, and
+        removed duplicated generate-webkitversion.pl
+
+        https://bugs.webkit.org/show_bug.cgi?id=27158
+
+        * WebCore.pro:
+        * platform/generate-webkitversion.pl: Removed.
+
+2009-07-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Dmitry Glazkov.
+
+        Web Inspector: encapsulate ScriptState into the ScriptObject, get rid of
+        InspectorJSONObject.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27766
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/ScriptArray.cpp:
+        (WebCore::ScriptArray::ScriptArray):
+        (WebCore::ScriptArray::set):
+        (WebCore::ScriptArray::length):
+        (WebCore::ScriptArray::createNew):
+        * bindings/js/ScriptArray.h:
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::construct):
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptObject::ScriptObject):
+        (WebCore::ScriptObject::set):
+        (WebCore::ScriptObject::createNew):
+        (WebCore::ScriptGlobalObject::get):
+        * bindings/js/ScriptObject.h:
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/ScriptArray.cpp:
+        (WebCore::ScriptArray::ScriptArray):
+        (WebCore::ScriptArray::set):
+        (WebCore::ScriptArray::length):
+        (WebCore::ScriptArray::createNew):
+        * bindings/v8/ScriptArray.h:
+        * bindings/v8/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::construct):
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptObject::ScriptObject):
+        (WebCore::ScriptObject::set):
+        (WebCore::ScriptObject::createNew):
+        (WebCore::ScriptGlobalObject::get):
+        * bindings/v8/ScriptObject.h:
+        (WebCore::ScriptObject::ScriptObject):
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToConsole):
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::bind):
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::bind):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::newScriptArray):
+        (WebCore::InspectorFrontend::newScriptObject):
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        (WebCore::InspectorFrontend::addResource):
+        (WebCore::InspectorFrontend::updateResource):
+        (WebCore::InspectorFrontend::addDatabase):
+        (WebCore::InspectorFrontend::addDOMStorage):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorJSONObject.cpp: Removed.
+        * inspector/InspectorJSONObject.h: Removed.
+        * inspector/InspectorResource.cpp:
+        (WebCore::populateHeadersObject):
+        (WebCore::InspectorResource::createScriptObject):
+        (WebCore::InspectorResource::updateScriptObject):
+
+2009-07-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] Variable substitution recursion seems to have bugs
+        https://bugs.webkit.org/show_bug.cgi?id=27726
+
+        Allow <setvar> elements to depend on the value specified by preceeding <setvar> elements.
+        Required by the specification - assure it only works in linear order. A setvar element may
+        not depend on the variable state of a following setvar element, only the previous ones.
+
+        Extend wml/variable-reference-valid.html layout test to cover these cases.
+
+        * wml/WMLTaskElement.cpp:
+        (WebCore::WMLTaskElement::storeVariableState):
+
+2009-07-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] Page title doesn't update after variable substitution, if it contained variables
+        https://bugs.webkit.org/show_bug.cgi?id=27725
+
+        Fix bug in containsVariableReference() function, we we're decreasing the nameEndPosition
+        too much, leading to a bug with 1-char variable names, which were not detected properly.
+
+        Extend wml/variable-reference-valid.html layout test to cover 1-char variable names.
+        Also fixes manual-tests/wml/task-refresh-in-anchor.wml, which happened to use 1-char variable names.
+
+        * wml/WMLVariables.cpp:
+        (WebCore::containsVariableReference):
+
+2009-07-28  Robert Hogan  <robert@roberthogan.net>
+
+        Reviewed by Simon Hausmann.
+
+        Add WebKit version API to Qt.
+
+        Get the current version of WebKit from WebKit/mac/Configurations/Version.xcconfig
+        at compile time and make it available to webkit ports through WebKitVersion.h.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27158
+
+        * WebCore.pro: Call generate-webkitversion.pl
+
+2009-07-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed make dist build fix.
+
+        * GNUmakefile.am:
+
+2009-07-28  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Replace hardcoded separator text with proper separator.
+        Also adjusts include order as per style guidelines.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27763
+
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::populate):
+
 2009-07-28  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
         Reviewed by Steve Falkenburg.
@@ -18675,6 +40548,15 @@
         * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
         (webkit_accessible_class_init):
 
+2009-08-07  Luke Kenneth Casson Leighton  <lkcl@lkcl.net>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27424
+
+        * WebKit/gtk/gdom/ConvertToGCharPrivate.h: Added.
+        (copyAsGChar): added to help GObject bindings convert various types to glib's gchar* 
+
 2009-06-16  Xan Lopez  <xlopez@igalia.com>
 
         Reviewed by Gustavo Noronha.
diff --git a/src/3rdparty/webkit/WebCore/DerivedSources.cpp b/src/3rdparty/webkit/WebCore/DerivedSources.cpp
index 1455060..408daba 100644
--- a/src/3rdparty/webkit/WebCore/DerivedSources.cpp
+++ b/src/3rdparty/webkit/WebCore/DerivedSources.cpp
@@ -30,7 +30,11 @@
 #include "JSBarInfo.cpp"
 #include "JSCanvasGradient.cpp"
 #include "JSCanvasPattern.cpp"
+#include "JSCanvasRenderingContext.cpp"
 #include "JSCanvasRenderingContext2D.cpp"
+#if ENABLE(3D_CANVAS)    
+#include "JSCanvasRenderingContext3D.cpp"
+#endif
 #include "JSCDATASection.cpp"
 #include "JSCharacterData.cpp"
 #include "JSClientRect.cpp"
@@ -73,6 +77,7 @@
 #include "JSErrorEvent.cpp"
 #include "JSEvent.cpp"
 #include "JSEventException.cpp"
+#include "JSEventSource.cpp"
 #include "JSFile.cpp"
 #include "JSFileList.cpp"
 #include "JSHistory.cpp"
@@ -92,6 +97,7 @@
 #include "JSHTMLDataGridCellElement.cpp"
 #include "JSHTMLDataGridColElement.cpp"
 #include "JSHTMLDataGridRowElement.cpp"
+#include "JSHTMLDataListElement.cpp"
 #include "JSHTMLDirectoryElement.cpp"
 #include "JSHTMLDivElement.cpp"
 #include "JSHTMLDListElement.cpp"
@@ -149,6 +155,7 @@
 #include "JSJavaScriptCallFrame.cpp"
 #include "JSKeyboardEvent.cpp"
 #include "JSLocation.cpp"
+#include "JSMedia.cpp"
 #include "JSMediaError.cpp"
 #include "JSMediaList.cpp"
 #include "JSMessageChannel.cpp"
@@ -165,7 +172,10 @@
 #include "JSNodeIterator.cpp"
 #include "JSNodeList.cpp"
 #include "JSNotation.cpp"
+#include "JSNotificationCenter.cpp"
+#include "JSNotification.cpp"
 #include "JSOverflowEvent.cpp"
+#include "JSPageTransitionEvent.cpp"
 #include "JSPlugin.cpp"
 #include "JSPluginArray.cpp"
 #include "JSProcessingInstruction.cpp"
@@ -176,6 +186,7 @@
 #include "JSRGBColor.cpp"
 #include "JSScreen.cpp"
 #include "JSSharedWorker.cpp"
+#include "JSSharedWorkerContext.cpp"
 #include "JSSQLError.cpp"
 #include "JSSQLResultSet.cpp"
 #include "JSSQLResultSetRowList.cpp"
@@ -208,7 +219,6 @@
 #include "JSSVGColor.cpp"
 #include "JSSVGComponentTransferFunctionElement.cpp"
 #include "JSSVGCursorElement.cpp"
-#include "JSSVGDefinitionSrcElement.cpp"
 #include "JSSVGDefsElement.cpp"
 #include "JSSVGDescElement.cpp"
 #include "JSSVGDocument.cpp"
@@ -331,6 +341,7 @@
 #include "JSWebKitCSSMatrix.cpp"
 #include "JSWebKitPoint.cpp"
 #include "JSWebKitTransitionEvent.cpp"
+#include "JSWebSocket.cpp"
 #include "JSWheelEvent.cpp"
 #include "JSWorker.cpp"
 #include "JSWorkerContext.cpp"
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/parser/Parser.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/parser/Parser.h
deleted file mode 100644
index 863df59..0000000
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/parser/Parser.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Parser_h
-#define WebCore_FWD_Parser_h
-#include <JavaScriptCore/Parser.h>
-#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/CollectorHeapIterator.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/CollectorHeapIterator.h
deleted file mode 100644
index fcfe26d..0000000
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/CollectorHeapIterator.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_CollectorHeapIterator_h
-#define WebCore_FWD_CollectorHeapIterator_h
-#include <JavaScriptCore/CollectorHeapIterator.h>
-#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSAPIValueWrapper.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSAPIValueWrapper.h
new file mode 100644
index 0000000..955a610
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSAPIValueWrapper.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_JSAPIValueWrapper_h
+#define WebCore_FWD_JSAPIValueWrapper_h
+#include <JavaScriptCore/JSAPIValueWrapper.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PossiblyNull.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PossiblyNull.h
new file mode 100644
index 0000000..d52a4a0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PossiblyNull.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_PossiblyNull_h
+#define WebCore_FWD_PossiblyNull_h
+#include <JavaScriptCore/PossiblyNull.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/WebCore.gypi b/src/3rdparty/webkit/WebCore/WebCore.gypi
index d6f2487..3a5c73c 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.gypi
+++ b/src/3rdparty/webkit/WebCore/WebCore.gypi
@@ -20,6 +20,7 @@
             'css/CSSVariablesDeclaration.idl',
             'css/CSSVariablesRule.idl',
             'css/Counter.idl',
+            'css/Media.idl',
             'css/MediaList.idl',
             'css/RGBColor.idl',
             'css/Rect.idl',
@@ -63,6 +64,7 @@
             'dom/NodeList.idl',
             'dom/Notation.idl',
             'dom/OverflowEvent.idl',
+            'dom/PageTransitionEvent.idl',
             'dom/ProcessingInstruction.idl',
             'dom/ProgressEvent.idl',
             'dom/Range.idl',
@@ -74,10 +76,11 @@
             'dom/WebKitAnimationEvent.idl',
             'dom/WebKitTransitionEvent.idl',
             'dom/WheelEvent.idl',
-            'html/CanvasGradient.idl',
-            'html/CanvasPattern.idl',
-            'html/CanvasPixelArray.idl',
-            'html/CanvasRenderingContext2D.idl',
+            'html/canvas/CanvasGradient.idl',
+            'html/canvas/CanvasPattern.idl',
+            'html/canvas/CanvasPixelArray.idl',
+            'html/canvas/CanvasRenderingContext.idl',
+            'html/canvas/CanvasRenderingContext2D.idl',
             'html/DataGridColumn.idl',
             'html/DataGridColumnList.idl',
             'html/File.idl',
@@ -99,6 +102,7 @@
             'html/HTMLDataGridColElement.idl',
             'html/HTMLDataGridElement.idl',
             'html/HTMLDataGridRowElement.idl',
+            'html/HTMLDataListElement.idl',
             'html/HTMLDirectoryElement.idl',
             'html/HTMLDivElement.idl',
             'html/HTMLDocument.idl',
@@ -159,6 +163,8 @@
             'inspector/InspectorBackend.idl',
             'inspector/JavaScriptCallFrame.idl',
             'loader/appcache/DOMApplicationCache.idl',
+            'notifications/Notification.idl',
+            'notifications/NotificationCenter.idl',
             'page/AbstractView.idl',
             'page/BarInfo.idl',
             'page/Console.idl',
@@ -169,9 +175,7 @@
             'page/History.idl',
             'page/Location.idl',
             'page/Navigator.idl',
-            'page/PositionCallback.idl',
             'page/PositionError.idl',
-            'page/PositionErrorCallback.idl',
             'page/Screen.idl',
             'page/WebKitPoint.idl',
             'page/WorkerNavigator.idl',
@@ -213,7 +217,6 @@
             'svg/SVGColor.idl',
             'svg/SVGComponentTransferFunctionElement.idl',
             'svg/SVGCursorElement.idl',
-            'svg/SVGDefinitionSrcElement.idl',
             'svg/SVGDefsElement.idl',
             'svg/SVGDescElement.idl',
             'svg/SVGDocument.idl',
@@ -336,6 +339,7 @@
             'workers/AbstractWorker.idl',
             'workers/DedicatedWorkerContext.idl',
             'workers/SharedWorker.idl',
+            'workers/SharedWorkerContext.idl',
             'workers/Worker.idl',
             'workers/WorkerContext.idl',
             'workers/WorkerLocation.idl',
@@ -369,10 +373,14 @@
             'accessibility/AccessibilityListBox.h',
             'accessibility/AccessibilityListBoxOption.cpp',
             'accessibility/AccessibilityListBoxOption.h',
+            'accessibility/AccessibilityMediaControls.cpp',
+            'accessibility/AccessibilityMediaControls.h',
             'accessibility/AccessibilityObject.cpp',
             'accessibility/AccessibilityObject.h',
             'accessibility/AccessibilityRenderObject.cpp',
             'accessibility/AccessibilityRenderObject.h',
+            'accessibility/AccessibilitySlider.cpp',
+            'accessibility/AccessibilitySlider.h',
             'accessibility/AccessibilityTable.cpp',
             'accessibility/AccessibilityTable.h',
             'accessibility/AccessibilityTableCell.cpp',
@@ -406,12 +414,14 @@
             'bindings/js/JSAttrCustom.cpp',
             'bindings/js/JSAudioConstructor.cpp',
             'bindings/js/JSAudioConstructor.h',
+            'bindings/js/JSCanvasRenderingContextCustom.cpp',
             'bindings/js/JSCanvasRenderingContext2DCustom.cpp',
             'bindings/js/JSCDATASectionCustom.cpp',
             'bindings/js/JSClipboardCustom.cpp',
             'bindings/js/JSConsoleCustom.cpp',
             'bindings/js/JSCoordinatesCustom.cpp',
             'bindings/js/JSCSSRuleCustom.cpp',
+            'bindings/js/JSCSSRuleListCustom.cpp',
             'bindings/js/JSCSSStyleDeclarationCustom.cpp',
             'bindings/js/JSCSSStyleDeclarationCustom.h',
             'bindings/js/JSCSSValueCustom.cpp',
@@ -462,6 +472,7 @@
             'bindings/js/JSHTMLAllCollection.h',
             'bindings/js/JSHTMLAppletElementCustom.cpp',
             'bindings/js/JSHTMLAppletElementCustom.h',
+            'bindings/js/JSHTMLCanvasElementCustom.cpp',
             'bindings/js/JSHTMLCollectionCustom.cpp',
             'bindings/js/JSHTMLDataGridElementCustom.cpp',
             'bindings/js/JSHTMLDocumentCustom.cpp',
@@ -495,7 +506,9 @@
             'bindings/js/JSMessageChannelConstructor.cpp',
             'bindings/js/JSMessageChannelConstructor.h',
             'bindings/js/JSMessageChannelCustom.cpp',
+            'bindings/js/JSMessageEventCustom.cpp',
             'bindings/js/JSMessagePortCustom.cpp',
+            'bindings/js/JSMessagePortCustom.h',
             'bindings/js/JSMimeTypeArrayCustom.cpp',
             'bindings/js/JSNamedNodeMapCustom.cpp',
             'bindings/js/JSNamedNodesCollection.cpp',
@@ -517,6 +530,10 @@
             'bindings/js/JSQuarantinedObjectWrapper.h',
             'bindings/js/JSRGBColor.cpp',
             'bindings/js/JSRGBColor.h',
+            'bindings/js/JSSharedWorkerConstructor.cpp',
+            'bindings/js/JSSharedWorkerConstructor.h',
+            'bindings/js/JSSharedWorkerContextCustom.cpp',
+            'bindings/js/JSSharedWorkerCustom.cpp',
             'bindings/js/JSSQLResultSetRowListCustom.cpp',
             'bindings/js/JSSQLTransactionCustom.cpp',
             'bindings/js/JSStorageCustom.cpp',
@@ -615,11 +632,13 @@
             'bindings/v8/custom/V8DataGridColumnListCustom.cpp',
             'bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp',
             'bindings/v8/custom/V8DocumentLocationCustom.cpp',
+            'bindings/v8/custom/V8DOMApplicationCacheCustom.cpp',
             'bindings/v8/custom/V8DOMParserConstructor.cpp',
             'bindings/v8/custom/V8DOMWindowCustom.cpp',
             'bindings/v8/custom/V8DocumentCustom.cpp',
             'bindings/v8/custom/V8ElementCustom.cpp',
             'bindings/v8/custom/V8EventCustom.cpp',
+            'bindings/v8/custom/V8FileListCustom.cpp',
             'bindings/v8/custom/V8HTMLAudioElementConstructor.cpp',
             'bindings/v8/custom/V8HTMLCanvasElementCustom.cpp',
             'bindings/v8/custom/V8HTMLCollectionCustom.cpp',
@@ -640,7 +659,9 @@
             'bindings/v8/custom/V8InspectorBackendCustom.cpp',
             'bindings/v8/custom/V8LocationCustom.cpp',
             'bindings/v8/custom/V8MessageChannelConstructor.cpp',
+            'bindings/v8/custom/V8MessageEventCustom.cpp',
             'bindings/v8/custom/V8MessagePortCustom.cpp',
+            'bindings/v8/custom/V8MessagePortCustom.h',
             'bindings/v8/custom/V8NamedNodeMapCustom.cpp',
             'bindings/v8/custom/V8NamedNodesCollection.cpp',
             'bindings/v8/custom/V8NamedNodesCollection.h',
@@ -649,6 +670,7 @@
             'bindings/v8/custom/V8NodeFilterCustom.cpp',
             'bindings/v8/custom/V8NodeIteratorCustom.cpp',
             'bindings/v8/custom/V8NodeListCustom.cpp',
+            'bindings/v8/custom/V8NotificationCenterCustom.cpp',
             'bindings/v8/custom/V8StorageCustom.cpp',
             'bindings/v8/custom/V8SQLResultSetRowListCustom.cpp',
             'bindings/v8/custom/V8SQLTransactionCustom.cpp',
@@ -677,6 +699,7 @@
             'bindings/v8/MainThreadDOMData.h',
             'bindings/v8/NPV8Object.cpp',
             'bindings/v8/NPV8Object.h',
+            'bindings/v8/OwnHandle.h',
             'bindings/v8/ScheduledAction.cpp',
             'bindings/v8/ScheduledAction.h',
             'bindings/v8/ScopedDOMDataStore.cpp',
@@ -861,6 +884,8 @@
             'css/FontValue.h',
             'css/MediaFeatureNames.cpp',
             'css/MediaFeatureNames.h',
+            'css/Media.cpp',
+            'css/Media.h',
             'css/MediaList.cpp',
             'css/MediaList.h',
             'css/MediaQuery.cpp',
@@ -937,7 +962,6 @@
             'dom/DOMCoreException.h',
             'dom/DOMImplementation.cpp',
             'dom/DOMImplementation.h',
-            'dom/DocPtr.h',
             'dom/Document.cpp',
             'dom/Document.h',
             'dom/DocumentFragment.cpp',
@@ -1018,6 +1042,8 @@
             'dom/OptionGroupElement.h',
             'dom/OverflowEvent.cpp',
             'dom/OverflowEvent.h',
+            'dom/PageTransitionEvent.cpp',
+            'dom/PageTransitionEvent.h',
             'dom/Position.cpp',
             'dom/Position.h',
             'dom/PositionIterator.cpp',
@@ -1194,16 +1220,18 @@
             'history/HistoryItem.h',
             'history/PageCache.cpp',
             'history/PageCache.h',
-            'html/CanvasGradient.cpp',
-            'html/CanvasGradient.h',
-            'html/CanvasPattern.cpp',
-            'html/CanvasPattern.h',
-            'html/CanvasPixelArray.cpp',
-            'html/CanvasPixelArray.h',
-            'html/CanvasRenderingContext2D.cpp',
-            'html/CanvasRenderingContext2D.h',
-            'html/CanvasStyle.cpp',
-            'html/CanvasStyle.h',
+            'html/canvas/CanvasGradient.cpp',
+            'html/canvas/CanvasGradient.h',
+            'html/canvas/CanvasPattern.cpp',
+            'html/canvas/CanvasPattern.h',
+            'html/canvas/CanvasPixelArray.cpp',
+            'html/canvas/CanvasPixelArray.h',
+            'html/canvas/CanvasRenderingContext.cpp',
+            'html/canvas/CanvasRenderingContext.h',
+            'html/canvas/CanvasRenderingContext2D.cpp',
+            'html/canvas/CanvasRenderingContext2D.h',
+            'html/canvas/CanvasStyle.cpp',
+            'html/canvas/CanvasStyle.h',
             'html/CollectionCache.cpp',
             'html/CollectionCache.h',
             'html/CollectionType.h',
@@ -1253,6 +1281,8 @@
             'html/HTMLDataGridElement.h',
             'html/HTMLDataGridRowElement.cpp',
             'html/HTMLDataGridRowElement.h',
+            'html/HTMLDataListElement.cpp',
+            'html/HTMLDataListElement.h',
             'html/HTMLDirectoryElement.cpp',
             'html/HTMLDirectoryElement.h',
             'html/HTMLDivElement.cpp',
@@ -1399,20 +1429,24 @@
             'inspector/InspectorClient.h',
             'inspector/ConsoleMessage.cpp',
             'inspector/ConsoleMessage.h',
+            'inspector/DOMDispatchTimelineItem.cpp',
+            'inspector/DOMDispatchTimelineItem.h',
             'inspector/InspectorBackend.cpp',
             'inspector/InspectorBackend.h',
             'inspector/InspectorController.cpp',
             'inspector/InspectorController.h',
             'inspector/InspectorDatabaseResource.cpp',
             'inspector/InspectorDatabaseResource.h',
+            'inspector/InspectorDOMAgent.cpp',
+            'inspector/InspectorDOMAgent.h',
             'inspector/InspectorDOMStorageResource.cpp',
             'inspector/InspectorDOMStorageResource.h',
             'inspector/InspectorFrontend.cpp',
             'inspector/InspectorFrontend.h',
-            'inspector/InspectorJSONObject.cpp',
-            'inspector/InspectorJSONObject.h',
             'inspector/InspectorResource.cpp',
             'inspector/InspectorResource.h',
+            'inspector/InspectorTimelineAgent.cpp',
+            'inspector/InspectorTimelineAgent.h',
             'inspector/JavaScriptCallFrame.cpp',
             'inspector/JavaScriptCallFrame.h',
             'inspector/JavaScriptDebugListener.h',
@@ -1422,10 +1456,14 @@
             'inspector/JavaScriptProfile.h',
             'inspector/JavaScriptProfileNode.cpp',
             'inspector/JavaScriptProfileNode.h',
+            'inspector/TimelineItem.cpp',
+            'inspector/TimelineItem.h',
             'loader/appcache/ApplicationCache.cpp',
             'loader/appcache/ApplicationCache.h',
             'loader/appcache/ApplicationCacheGroup.cpp',
             'loader/appcache/ApplicationCacheGroup.h',
+            'loader/appcache/ApplicationCacheHost.cpp',
+            'loader/appcache/ApplicationCacheHost.h',
             'loader/appcache/ApplicationCacheResource.cpp',
             'loader/appcache/ApplicationCacheResource.h',
             'loader/appcache/ApplicationCacheStorage.cpp',
@@ -1540,12 +1578,16 @@
             'loader/ThreadableLoader.h',
             'loader/ThreadableLoaderClient.h',
             'loader/ThreadableLoaderClientWrapper.h',
-            'loader/UserStyleSheetLoader.cpp',
-            'loader/UserStyleSheetLoader.h',
             'loader/WorkerThreadableLoader.cpp',
             'loader/WorkerThreadableLoader.h',
             'loader/loader.cpp',
             'loader/loader.h',
+            'notifications/Notification.cpp',
+            'notifications/Notification.h',
+            'notifications/NotificationCenter.cpp',
+            'notifications/NotificationCenter.h',
+            'notifications/NotificationPresenter.h',
+            'notifications/NotificationContents.h',
             'page/animation/AnimationBase.cpp',
             'page/animation/AnimationBase.h',
             'page/animation/AnimationController.cpp',
@@ -1598,7 +1640,6 @@
             'page/ContextMenuClient.h',
             'page/ContextMenuController.cpp',
             'page/ContextMenuController.h',
-            'page/Coordinates.cpp',
             'page/DOMSelection.cpp',
             'page/DOMSelection.h',
             'page/DOMTimer.cpp',
@@ -1624,7 +1665,6 @@
             'page/FrameView.h',
             'page/Geolocation.cpp',
             'page/Geolocation.h',
-            'page/Geoposition.cpp',
             'page/Geoposition.h',
             'page/History.cpp',
             'page/History.h',
@@ -1636,6 +1676,8 @@
             'page/Navigator.h',
             'page/NavigatorBase.cpp',
             'page/NavigatorBase.h',
+            'page/OriginAccessEntry.cpp',
+            'page/OriginAccessEntry.h',
             'page/Page.cpp',
             'page/Page.h',
             'page/PageGroup.cpp',
@@ -1655,6 +1697,10 @@
             'page/SecurityOriginHash.h',
             'page/Settings.cpp',
             'page/Settings.h',
+            'page/UserScript.h',
+            'page/UserScriptTypes.h',
+            'page/UserStyleSheet.h',
+            'page/UserStyleSheetTypes.h',
             'page/WebKitPoint.h',
             'page/WindowFeatures.cpp',
             'page/WindowFeatures.h',
@@ -1736,7 +1782,6 @@
             'platform/graphics/cairo/ImageBufferCairo.cpp',
             'platform/graphics/cairo/ImageBufferData.h',
             'platform/graphics/cairo/ImageCairo.cpp',
-            'platform/graphics/cairo/ImageSourceCairo.cpp',
             'platform/graphics/cairo/PathCairo.cpp',
             'platform/graphics/cairo/PatternCairo.cpp',
             'platform/graphics/cairo/TransformationMatrixCairo.cpp',
@@ -1900,8 +1945,6 @@
             'platform/graphics/skia/GraphicsContextSkia.cpp',
             'platform/graphics/skia/ImageBufferSkia.cpp',
             'platform/graphics/skia/ImageSkia.cpp',
-            'platform/graphics/skia/ImageSourceSkia.cpp',
-            'platform/graphics/skia/ImageSourceSkia.h',
             'platform/graphics/skia/IntPointSkia.cpp',
             'platform/graphics/skia/IntRectSkia.cpp',
             'platform/graphics/skia/NativeImageSkia.cpp',
@@ -1984,7 +2027,6 @@
             'platform/graphics/wx/GraphicsContextWx.cpp',
             'platform/graphics/wx/ImageBufferData.h',
             'platform/graphics/wx/ImageBufferWx.cpp',
-            'platform/graphics/wx/ImageSourceWx.cpp',
             'platform/graphics/wx/ImageWx.cpp',
             'platform/graphics/wx/IntPointWx.cpp',
             'platform/graphics/wx/IntRectWx.cpp',
@@ -2044,9 +2086,11 @@
             'platform/graphics/Icon.h',
             'platform/graphics/Image.cpp',
             'platform/graphics/Image.h',
+            'platform/graphics/ImageBuffer.cpp',
             'platform/graphics/ImageBuffer.h',
             'platform/graphics/ImageObserver.h',
             'platform/graphics/ImageSource.h',
+            'platform/graphics/ImageSource.cpp',
             'platform/graphics/IntPoint.h',
             'platform/graphics/IntRect.cpp',
             'platform/graphics/IntRect.h',
@@ -2116,20 +2160,25 @@
             'platform/gtk/gtkdrawing.h',
             'platform/gtk/guriescape.h',
             'platform/image-decoders/ImageDecoder.h',
+            'platform/image-decoders/ImageDecoder.cpp',
             'platform/image-decoders/bmp/BMPImageDecoder.cpp',
             'platform/image-decoders/bmp/BMPImageDecoder.h',
             'platform/image-decoders/bmp/BMPImageReader.cpp',
             'platform/image-decoders/bmp/BMPImageReader.h',
+            'platform/image-decoders/cairo/ImageDecoderCairo.cpp',
             'platform/image-decoders/gif/GIFImageDecoder.cpp',
             'platform/image-decoders/gif/GIFImageDecoder.h',
             'platform/image-decoders/gif/GIFImageReader.cpp',
             'platform/image-decoders/gif/GIFImageReader.h',
+            'platform/image-decoders/haiku/ImageDecoderHaiku.cpp',
             'platform/image-decoders/ico/ICOImageDecoder.cpp',
             'platform/image-decoders/ico/ICOImageDecoder.h',
             'platform/image-decoders/jpeg/JPEGImageDecoder.cpp',
             'platform/image-decoders/jpeg/JPEGImageDecoder.h',
             'platform/image-decoders/png/PNGImageDecoder.cpp',
             'platform/image-decoders/png/PNGImageDecoder.h',
+            'platform/image-decoders/skia/ImageDecoderSkia.cpp',
+            'platform/image-decoders/wx/ImageDecoderWx.cpp',
             'platform/image-decoders/xbm/XBMImageDecoder.cpp',
             'platform/image-decoders/xbm/XBMImageDecoder.h',
             'platform/image-decoders/zlib/crc32.h',
@@ -2143,7 +2192,6 @@
             'platform/image-decoders/zlib/zconf.h',
             'platform/image-decoders/zlib/zlib.h',
             'platform/image-decoders/zlib/zutil.h',
-            'platform/image-decoders/skia/ImageDecoderSkia.cpp',
             'platform/image-encoders/skia/PNGImageEncoder.cpp',
             'platform/image-encoders/skia/PNGImageEncoder.h',
             'platform/mac/AutodrainedPool.mm',
@@ -2354,8 +2402,7 @@
             'platform/sql/SQLiteTransaction.cpp',
             'platform/sql/SQLiteTransaction.h',
             'platform/sql/chromium/SQLiteFileSystemChromium.cpp',
-            'platform/sql/chromium/SQLiteFileSystemChromiumLinux.cpp',
-            'platform/sql/chromium/SQLiteFileSystemChromiumMac.cpp',
+            'platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp',
             'platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp',
             'platform/symbian/FloatPointSymbian.cpp',
             'platform/symbian/FloatRectSymbian.cpp',
@@ -2528,6 +2575,7 @@
             'platform/ContextMenu.cpp',
             'platform/ContextMenu.h',
             'platform/ContextMenuItem.h',
+            'platform/Cookie.h',
             'platform/CookieJar.h',
             'platform/CrossThreadCopier.h',
             'platform/CrossThreadCopier.cpp',
@@ -2565,6 +2613,8 @@
             'platform/Logging.h',
             'platform/MIMETypeRegistry.cpp',
             'platform/MIMETypeRegistry.h',
+            'platform/mock/GeolocationServiceMock.cpp',
+            'platform/mock/GeolocationServiceMock.h',
             'platform/NotImplemented.h',
             'platform/Pasteboard.h',
             'platform/PlatformKeyboardEvent.h',
@@ -2950,6 +3000,10 @@
             'storage/SQLTransaction.cpp',
             'storage/SQLTransaction.h',
             'storage/SQLTransactionCallback.h',
+            'storage/SQLTransactionClient.h',
+            'storage/SQLTransactionClient.cpp',
+            'storage/SQLTransactionCoordinator.h',
+            'storage/SQLTransactionCoordinator.cpp',
             'storage/SQLTransactionErrorCallback.h',
             'storage/Storage.cpp',
             'storage/Storage.h',
@@ -3076,8 +3130,6 @@
             'svg/SVGComponentTransferFunctionElement.h',
             'svg/SVGCursorElement.cpp',
             'svg/SVGCursorElement.h',
-            'svg/SVGDefinitionSrcElement.cpp',
-            'svg/SVGDefinitionSrcElement.h',
             'svg/SVGDefsElement.cpp',
             'svg/SVGDefsElement.h',
             'svg/SVGDescElement.cpp',
@@ -3317,9 +3369,18 @@
             'workers/AbstractWorker.h',
             'workers/DedicatedWorkerContext.cpp',
             'workers/DedicatedWorkerContext.h',
+            'workers/DedicatedWorkerThread.cpp',
+            'workers/DedicatedWorkerThread.h',
+            'workers/DefaultSharedWorkerRepository.cpp',
+            'workers/DefaultSharedWorkerRepository.h',
             'workers/GenericWorkerTask.h',
             'workers/SharedWorker.cpp',
             'workers/SharedWorker.h',
+            'workers/SharedWorkerContext.cpp',
+            'workers/SharedWorkerContext.h',
+            'workers/SharedWorkerRepository.h',
+            'workers/SharedWorkerThread.cpp',
+            'workers/SharedWorkerThread.h',
             'workers/Worker.cpp',
             'workers/Worker.h',
             'workers/WorkerContext.cpp',
@@ -3331,6 +3392,7 @@
             'workers/WorkerMessagingProxy.cpp',
             'workers/WorkerMessagingProxy.h',
             'workers/WorkerObjectProxy.h',
+            'workers/WorkerReportingProxy.h',
             'workers/WorkerRunLoop.cpp',
             'workers/WorkerRunLoop.h',
             'workers/WorkerScriptLoader.cpp',
@@ -3392,5 +3454,195 @@
             'xml/XSLTUnicodeSort.cpp',
             'xml/XSLTUnicodeSort.h',
         ],
+        'webinspector_files': [
+
+            'inspector/front-end/inspector.html',
+            'inspector/front-end/BottomUpProfileDataGridTree.js',
+            'inspector/front-end/Breakpoint.js',
+            'inspector/front-end/BreakpointsSidebarPane.js',
+            'inspector/front-end/Callback.js',
+            'inspector/front-end/CallStackSidebarPane.js',
+            'inspector/front-end/ChangesView.js',
+            'inspector/front-end/Color.js',
+            'inspector/front-end/ConsoleView.js',
+            'inspector/front-end/CookieItemsView.js',
+            'inspector/front-end/Database.js',
+            'inspector/front-end/DatabaseQueryView.js',
+            'inspector/front-end/DatabaseTableView.js',
+            'inspector/front-end/DataGrid.js',
+            'inspector/front-end/DOMAgent.js',
+            'inspector/front-end/DOMStorage.js',
+            'inspector/front-end/DOMStorageDataGrid.js',
+            'inspector/front-end/DOMStorageItemsView.js',
+            'inspector/front-end/Drawer.js',
+            'inspector/front-end/ElementsPanel.js',
+            'inspector/front-end/ElementsTreeOutline.js',
+            'inspector/front-end/FontView.js',
+            'inspector/front-end/ImageView.js',
+            'inspector/front-end/InjectedScript.js',
+            'inspector/front-end/InjectedScriptAccess.js',
+            'inspector/front-end/inspector.js',
+            'inspector/front-end/KeyboardShortcut.js',
+            'inspector/front-end/MetricsSidebarPane.js',
+            'inspector/front-end/Object.js',
+            'inspector/front-end/ObjectProxy.js',
+            'inspector/front-end/ObjectPropertiesSection.js',
+            'inspector/front-end/Panel.js',
+            'inspector/front-end/PanelEnablerView.js',
+            'inspector/front-end/Placard.js',
+            'inspector/front-end/Popup.js',
+            'inspector/front-end/ProfileDataGridTree.js',
+            'inspector/front-end/ProfilesPanel.js',
+            'inspector/front-end/ProfileView.js',
+            'inspector/front-end/PropertiesSection.js',
+            'inspector/front-end/PropertiesSidebarPane.js',
+            'inspector/front-end/Resource.js',
+            'inspector/front-end/ResourceCategory.js',
+            'inspector/front-end/ResourcesPanel.js',
+            'inspector/front-end/ResourceView.js',
+            'inspector/front-end/ScopeChainSidebarPane.js',
+            'inspector/front-end/Script.js',
+            'inspector/front-end/ScriptsPanel.js',
+            'inspector/front-end/ScriptView.js',
+            'inspector/front-end/SidebarPane.js',
+            'inspector/front-end/SidebarTreeElement.js',
+            'inspector/front-end/SourceFrame.js',
+            'inspector/front-end/SourceView.js',
+            'inspector/front-end/StatusBarButton.js',
+            'inspector/front-end/StoragePanel.js',
+            'inspector/front-end/StylesSidebarPane.js',
+            'inspector/front-end/SummaryBar.js',
+            'inspector/front-end/TextPrompt.js',
+            'inspector/front-end/TimelineAgent.js',
+            'inspector/front-end/TopDownProfileDataGridTree.js',
+            'inspector/front-end/treeoutline.js',
+            'inspector/front-end/utilities.js',
+            'inspector/front-end/View.js',
+            'inspector/front-end/WatchExpressionsSidebarPane.js',
+            'inspector/front-end/inspector.css',
+        ],
+        'webinspector_image_files': [
+
+            'inspector/front-end/Images/back.png',
+            'inspector/front-end/Images/checker.png',
+            'inspector/front-end/Images/clearConsoleButtonGlyph.png',
+            'inspector/front-end/Images/closeButtons.png',
+            'inspector/front-end/Images/consoleButtonGlyph.png',
+            'inspector/front-end/Images/cookie.png',
+            'inspector/front-end/Images/database.png',
+            'inspector/front-end/Images/databaseTable.png',
+            'inspector/front-end/Images/debuggerContinue.png',
+            'inspector/front-end/Images/debuggerPause.png',
+            'inspector/front-end/Images/debuggerStepInto.png',
+            'inspector/front-end/Images/debuggerStepOut.png',
+            'inspector/front-end/Images/debuggerStepOver.png',
+            'inspector/front-end/Images/disclosureTriangleSmallDown.png',
+            'inspector/front-end/Images/disclosureTriangleSmallDownBlack.png',
+            'inspector/front-end/Images/disclosureTriangleSmallDownWhite.png',
+            'inspector/front-end/Images/disclosureTriangleSmallRight.png',
+            'inspector/front-end/Images/disclosureTriangleSmallRightBlack.png',
+            'inspector/front-end/Images/disclosureTriangleSmallRightDown.png',
+            'inspector/front-end/Images/disclosureTriangleSmallRightDownBlack.png',
+            'inspector/front-end/Images/disclosureTriangleSmallRightDownWhite.png',
+            'inspector/front-end/Images/disclosureTriangleSmallRightWhite.png',
+            'inspector/front-end/Images/dockButtonGlyph.png',
+            'inspector/front-end/Images/elementsIcon.png',
+            'inspector/front-end/Images/enableOutlineButtonGlyph.png',
+            'inspector/front-end/Images/enableSolidButtonGlyph.png',
+            'inspector/front-end/Images/errorIcon.png',
+            'inspector/front-end/Images/errorMediumIcon.png',
+            'inspector/front-end/Images/excludeButtonGlyph.png',
+            'inspector/front-end/Images/focusButtonGlyph.png',
+            'inspector/front-end/Images/forward.png',
+            'inspector/front-end/Images/glossyHeader.png',
+            'inspector/front-end/Images/glossyHeaderPressed.png',
+            'inspector/front-end/Images/glossyHeaderSelected.png',
+            'inspector/front-end/Images/glossyHeaderSelectedPressed.png',
+            'inspector/front-end/Images/goArrow.png',
+            'inspector/front-end/Images/graphLabelCalloutLeft.png',
+            'inspector/front-end/Images/graphLabelCalloutRight.png',
+            'inspector/front-end/Images/largerResourcesButtonGlyph.png',
+            'inspector/front-end/Images/localStorage.png',
+            'inspector/front-end/Images/nodeSearchButtonGlyph.png',
+            'inspector/front-end/Images/paneBottomGrow.png',
+            'inspector/front-end/Images/paneBottomGrowActive.png',
+            'inspector/front-end/Images/paneGrowHandleLine.png',
+            'inspector/front-end/Images/pauseOnExceptionButtonGlyph.png',
+            'inspector/front-end/Images/percentButtonGlyph.png',
+            'inspector/front-end/Images/profileGroupIcon.png',
+            'inspector/front-end/Images/profileIcon.png',
+            'inspector/front-end/Images/profilesIcon.png',
+            'inspector/front-end/Images/profileSmallIcon.png',
+            'inspector/front-end/Images/profilesSilhouette.png',
+            'inspector/front-end/Images/radioDot.png',
+            'inspector/front-end/Images/recordButtonGlyph.png',
+            'inspector/front-end/Images/recordToggledButtonGlyph.png',
+            'inspector/front-end/Images/reloadButtonGlyph.png',
+            'inspector/front-end/Images/resourceCSSIcon.png',
+            'inspector/front-end/Images/resourceDocumentIcon.png',
+            'inspector/front-end/Images/resourceDocumentIconSmall.png',
+            'inspector/front-end/Images/resourceJSIcon.png',
+            'inspector/front-end/Images/resourcePlainIcon.png',
+            'inspector/front-end/Images/resourcePlainIconSmall.png',
+            'inspector/front-end/Images/resourcesIcon.png',
+            'inspector/front-end/Images/resourcesSilhouette.png',
+            'inspector/front-end/Images/resourcesSizeGraphIcon.png',
+            'inspector/front-end/Images/resourcesTimeGraphIcon.png',
+            'inspector/front-end/Images/scriptsIcon.png',
+            'inspector/front-end/Images/scriptsSilhouette.png',
+            'inspector/front-end/Images/searchSmallBlue.png',
+            'inspector/front-end/Images/searchSmallBrightBlue.png',
+            'inspector/front-end/Images/searchSmallGray.png',
+            'inspector/front-end/Images/searchSmallWhite.png',
+            'inspector/front-end/Images/segment.png',
+            'inspector/front-end/Images/segmentEnd.png',
+            'inspector/front-end/Images/segmentHover.png',
+            'inspector/front-end/Images/segmentHoverEnd.png',
+            'inspector/front-end/Images/segmentSelected.png',
+            'inspector/front-end/Images/segmentSelectedEnd.png',
+            'inspector/front-end/Images/sessionStorage.png',
+            'inspector/front-end/Images/splitviewDimple.png',
+            'inspector/front-end/Images/splitviewDividerBackground.png',
+            'inspector/front-end/Images/statusbarBackground.png',
+            'inspector/front-end/Images/statusbarBottomBackground.png',
+            'inspector/front-end/Images/statusbarButtons.png',
+            'inspector/front-end/Images/statusbarMenuButton.png',
+            'inspector/front-end/Images/statusbarMenuButtonSelected.png',
+            'inspector/front-end/Images/statusbarResizerHorizontal.png',
+            'inspector/front-end/Images/statusbarResizerVertical.png',
+            'inspector/front-end/Images/storageIcon.png',
+            'inspector/front-end/Images/timelineHollowPillBlue.png',
+            'inspector/front-end/Images/timelineHollowPillGray.png',
+            'inspector/front-end/Images/timelineHollowPillGreen.png',
+            'inspector/front-end/Images/timelineHollowPillOrange.png',
+            'inspector/front-end/Images/timelineHollowPillPurple.png',
+            'inspector/front-end/Images/timelineHollowPillRed.png',
+            'inspector/front-end/Images/timelineHollowPillYellow.png',
+            'inspector/front-end/Images/timelinePillBlue.png',
+            'inspector/front-end/Images/timelinePillGray.png',
+            'inspector/front-end/Images/timelinePillGreen.png',
+            'inspector/front-end/Images/timelinePillOrange.png',
+            'inspector/front-end/Images/timelinePillPurple.png',
+            'inspector/front-end/Images/timelinePillRed.png',
+            'inspector/front-end/Images/timelinePillYellow.png',
+            'inspector/front-end/Images/tipBalloon.png',
+            'inspector/front-end/Images/tipBalloonBottom.png',
+            'inspector/front-end/Images/tipIcon.png',
+            'inspector/front-end/Images/tipIconPressed.png',
+            'inspector/front-end/Images/toolbarItemSelected.png',
+            'inspector/front-end/Images/treeDownTriangleBlack.png',
+            'inspector/front-end/Images/treeDownTriangleWhite.png',
+            'inspector/front-end/Images/treeRightTriangleBlack.png',
+            'inspector/front-end/Images/treeRightTriangleWhite.png',
+            'inspector/front-end/Images/treeUpTriangleBlack.png',
+            'inspector/front-end/Images/treeUpTriangleWhite.png',
+            'inspector/front-end/Images/undockButtonGlyph.png',
+            'inspector/front-end/Images/userInputIcon.png',
+            'inspector/front-end/Images/userInputPreviousIcon.png',
+            'inspector/front-end/Images/userInputResultIcon.png',
+            'inspector/front-end/Images/warningIcon.png',
+            'inspector/front-end/Images/warningMediumIcon.png',
+            'inspector/front-end/Images/warningsErrors.png',
+        ],
     }
 }
diff --git a/src/3rdparty/webkit/WebCore/WebCore.order b/src/3rdparty/webkit/WebCore/WebCore.order
index 31b178c..ff42e26 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.order
+++ b/src/3rdparty/webkit/WebCore/WebCore.order
@@ -334,8 +334,6 @@ __ZN7WebCore9FrameView29setShouldUpdateWhileOffscreenEb
 __ZNK7WebCore9FrameTree12traverseNextEPKNS_5FrameE
 __ZN7WebCore6Widget21releasePlatformWidgetEv
 __ZN7WebCore6Widget20retainPlatformWidgetEv
-__ZN7WebCore9FrameView14initScrollbarsEv
-__ZN7WebCore9FrameView27updateDefaultScrollbarStateEv
 __ZNK7WebCore10ScrollView14scrollbarModesERNS_13ScrollbarModeES2_
 __ZNK7WebCore10ScrollView22platformScrollbarModesERNS_13ScrollbarModeES2_
 __ZN7WebCore10ScrollView17setScrollbarModesENS_13ScrollbarModeES1_
@@ -1267,7 +1265,7 @@ __ZNK7WebCore4KURL11createCFURLEv
 __ZNK7WebCore4KURL12copyToBufferERN3WTF6VectorIcLm512EEE
 __ZNK7WebCore19ResourceRequestBase11cachePolicyEv
 __ZNK7WebCore19ResourceRequestBase15timeoutIntervalEv
-__ZNK7WebCore19ResourceRequestBase16allowHTTPCookiesEv
+__ZNK7WebCore19ResourceRequestBase16allowCookiesEv
 __ZNK7WebCore19ResourceRequestBase16httpHeaderFieldsEv
 __ZNK7WebCore19ResourceRequestBase8httpBodyEv
 __ZN7WebCore21findEventWithKeyStateEPNS_5EventE
@@ -2290,7 +2288,6 @@ __ZN3JSC8Bindings10RootObject9gcProtectEPNS_8JSObjectE
 __ZNK3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTra
 __ZN3WTF7HashMapIPN3JSC8JSObjectEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3addERKS3_RKj
 __ZN3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTrai
-__ZN7WebCore19InspectorController34inspectedWindowScriptObjectClearedEPNS_5FrameE
 __ZN7WebCore6StringC1ERKN3JSC7UStringE
 __ZN7WebCore6StringC2ERKN3JSC7UStringE
 __ZNK7WebCore20StringSourceProvider4dataEv
@@ -5760,7 +5757,6 @@ __ZN3WTF9HashTableIPN7WebCore6WidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashI
 __ZN3WTF9HashTableIPN7WebCore6WidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTableEi
 __ZN7WebCore10ScrollView16platformAddChildEPNS_6WidgetE
 __ZN7WebCore16RenderPartObject11viewClearedEv
-__ZN7WebCore9FrameView20setCanHaveScrollbarsEb
 __ZN7WebCore10ScrollView20setCanHaveScrollbarsEb
 __ZNK7WebCore14SecurityOrigin9canAccessEPKS0_
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm10EE6shrinkEm
@@ -20833,7 +20829,7 @@ __ZN7WebCore13WorkerRunLoop9runInModeEPNS_13WorkerContextERKNS_6StringE
 __ZN7WebCore22WorkerThreadableLoader16MainThreadBridge22mainThreadCreateLoaderEPNS_22ScriptExecutionContextEPS1_St8auto_ptrINS_
 __ZN7WebCore19ResourceRequestBase5adoptESt8auto_ptrINS_30CrossThreadResourceRequestDataEE
 __ZN7WebCore13HTTPHeaderMap5adoptESt8auto_ptrIN3WTF6VectorISt4pairINS_6StringES5_ELm0EEEE
-__ZN7WebCore19ResourceRequestBase19setAllowHTTPCookiesEb
+__ZN7WebCore19ResourceRequestBase19setAllowCookiesEb
 __ZN7WebCore18GenericWorkerTask5IPNS_22WorkerThreadableLoader16MainThreadBridgeES3_St8auto_ptrINS_30CrossThreadResourceRequestD
 __ZN7WebCore22WorkerThreadableLoader16MainThreadBridge18didReceiveResponseERKNS_16ResourceResponseE
 __ZN7WebCore18createCallbackTaskIN3WTF6RefPtrINS1_16ThreadSafeSharedINS_29ThreadableLoaderClientWrapperEEEEENS2_IS4_EENS_16Reso
diff --git a/src/3rdparty/webkit/WebCore/WebCore.pro b/src/3rdparty/webkit/WebCore/WebCore.pro
index 2fb5c32..e614ffb 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.pro
+++ b/src/3rdparty/webkit/WebCore/WebCore.pro
@@ -1,6 +1,19 @@
 # WebCore - qmake build info
 CONFIG += building-libs
 CONFIG += depend_includepath
+
+symbian: {
+    TARGET.EPOCALLOWDLLDATA=1
+    TARGET.EPOCHEAPSIZE = 0x20000 0x2000000 // Min 128kB, Max 32MB
+    TARGET.CAPABILITY = All -Tcb
+
+    webkitlibs.sources = QtWebKit.dll
+    webkitlibs.path = /sys/bin
+    DEPLOYMENT += webkitlibs
+
+    TARGET.UID3 = 0x200267C2
+}
+
 include($$PWD/../WebKit.pri)
 
 TEMPLATE = lib
@@ -34,14 +47,9 @@ unix {
     lessThan(QT_MINOR_VERSION, 4): QMAKE_PKGCONFIG_REQUIRES += QtXml
 }
 
-CONFIG -= warn_on
-*-g++*:QMAKE_CXXFLAGS += -Wreturn-type -fno-strict-aliasing
-
 unix:!mac:*-g++*:QMAKE_CXXFLAGS += -ffunction-sections -fdata-sections 
 unix:!mac:*-g++*:QMAKE_LFLAGS += -Wl,--gc-sections
 
-#QMAKE_CXXFLAGS += -Wall -Wno-undef -Wno-unused-parameter
-
 CONFIG(release):!CONFIG(QTDIR_build) {
     contains(QT_CONFIG, reduce_exports):CONFIG += hide_symbols
     unix:contains(QT_CONFIG, reduce_relocations):CONFIG += bsymbolic_functions
@@ -92,7 +100,7 @@ CONFIG(QTDIR_build) {
 # Optional components (look for defs in config.h and included files!)
 
 contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
-    DEFINES+=ENABLE_DATABASE=0 ENABLE_DOM_STORAGE=0 ENABLE_ICONDATABASE=0 ENABLE_WORKERS=0
+    DEFINES+=ENABLE_DATABASE=0 ENABLE_DOM_STORAGE=0 ENABLE_ICONDATABASE=0 ENABLE_WORKERS=0 ENABLE_SHARED_WORKERS=0
 }
 
 # turn off SQLITE support if we do not have sqlite3 available
@@ -100,6 +108,7 @@ contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
 
 !contains(DEFINES, ENABLE_JAVASCRIPT_DEBUGGER=.): DEFINES += ENABLE_JAVASCRIPT_DEBUGGER=1
 !contains(DEFINES, ENABLE_DATABASE=.): DEFINES += ENABLE_DATABASE=1
+!contains(DEFINES, ENABLE_EVENTSOURCE=.): DEFINES += ENABLE_EVENTSOURCE=1
 !contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=.): DEFINES += ENABLE_OFFLINE_WEB_APPLICATIONS=1
 !contains(DEFINES, ENABLE_DOM_STORAGE=.): DEFINES += ENABLE_DOM_STORAGE=1
 !contains(DEFINES, ENABLE_ICONDATABASE=.): DEFINES += ENABLE_ICONDATABASE=1
@@ -119,8 +128,9 @@ contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
 !contains(DEFINES, ENABLE_XPATH=.): DEFINES += ENABLE_XPATH=1
 !contains(DEFINES, ENABLE_XSLT=.): DEFINES += ENABLE_XSLT=0
 #!contains(DEFINES, ENABLE_XBL=.): DEFINES += ENABLE_XBL=1
+!contains(DEFINES, ENABLE_WCSS=.): DEFINES += ENABLE_WCSS=0
 !contains(DEFINES, ENABLE_WML=.): DEFINES += ENABLE_WML=0
-!contains(DEFINES, ENABLE_SHARED_WORKERS=.): DEFINES += ENABLE_SHARED_WORKERS=0
+!contains(DEFINES, ENABLE_SHARED_WORKERS=.): DEFINES += ENABLE_SHARED_WORKERS=1
 !contains(DEFINES, ENABLE_WORKERS=.): DEFINES += ENABLE_WORKERS=1
 !contains(DEFINES, ENABLE_XHTMLMP=.): DEFINES += ENABLE_XHTMLMP=0
 !contains(DEFINES, ENABLE_DATAGRID=.): DEFINES += ENABLE_DATAGRID=1
@@ -146,6 +156,9 @@ contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
     else:DEFINES += ENABLE_VIDEO=0
 }
 
+# HTML5 datalist support
+!contains(DEFINES, ENABLE_DATALIST=.): DEFINES += ENABLE_DATALIST=1
+
 # Nescape plugins support (NPAPI)
 !contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=.) {
     unix|win32-*:!embedded:!wince*:!symbian {
@@ -155,6 +168,10 @@ contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
     }
 }
 
+# Web Socket support.
+# FIXME: Enable once platform code is landed.
+# !contains(DEFINES, ENABLE_WEB_SOCKETS=.): DEFINES += ENABLE_WEB_SOCKETS=1
+
 DEFINES += WTF_USE_JAVASCRIPTCORE_BINDINGS=1 WTF_CHANGES=1
 
 # Used to compute defaults for the build-webkit script
@@ -164,9 +181,12 @@ CONFIG(compute_defaults) {
 }
 
 RESOURCES += \
-    $$PWD/../WebCore/inspector/front-end/WebKit.qrc \
     $$PWD/../WebCore/WebCore.qrc
 
+!symbian {
+    RESOURCES += $$PWD/../WebCore/inspector/front-end/WebKit.qrc
+}
+
 include($$PWD/../JavaScriptCore/JavaScriptCore.pri)
 
 INCLUDEPATH = \
@@ -181,11 +201,13 @@ INCLUDEPATH = \
     $$PWD/editing \
     $$PWD/history \
     $$PWD/html \
+    $$PWD/html/canvas \
     $$PWD/inspector \
     $$PWD/loader \
     $$PWD/loader/appcache \
     $$PWD/loader/archive \
     $$PWD/loader/icon \
+    $$PWD/notifications \
     $$PWD/page \
     $$PWD/page/animation \
     $$PWD/platform \
@@ -194,6 +216,7 @@ INCLUDEPATH = \
     $$PWD/platform/graphics/filters \
     $$PWD/platform/graphics/transforms \
     $$PWD/platform/image-decoders \
+    $$PWD/platform/mock \
     $$PWD/platform/network \
     $$PWD/platform/sql \
     $$PWD/platform/text \
@@ -205,6 +228,7 @@ INCLUDEPATH = \
     $$PWD/svg/animation \
     $$PWD/svg/graphics \
     $$PWD/svg/graphics/filters \
+    $$PWD/websockets \
     $$PWD/wml \
     $$PWD/workers \
     $$PWD/xml \
@@ -247,9 +271,16 @@ WALDOCSSVALUES = $$PWD/css/CSSValueKeywords.in
 
 DASHBOARDSUPPORTCSSPROPERTIES = $$PWD/css/DashboardSupportCSSPropertyNames.in
 
-SVGCSSPROPERTIES = $$PWD/css/SVGCSSPropertyNames.in
 
-SVGCSSVALUES = $$PWD/css/SVGCSSValueKeywords.in
+contains(DEFINES, ENABLE_SVG=1) {
+    EXTRACSSPROPERTIES += $$PWD/css/SVGCSSPropertyNames.in
+    EXTRACSSVALUES += $$PWD/css/SVGCSSValueKeywords.in
+}
+
+contains(DEFINES, ENABLE_WCSS=1) {
+    EXTRACSSPROPERTIES += $$PWD/css/WCSSPropertyNames.in
+    EXTRACSSVALUES += $$PWD/css/WCSSValueKeywords.in
+}
 
 STYLESHEETS_EMBED = \
     $$PWD/css/html.css \
@@ -280,6 +311,7 @@ IDL_BINDINGS += \
     css/CSSValueList.idl \
     css/CSSVariablesDeclaration.idl \
     css/CSSVariablesRule.idl \
+    css/Media.idl \
     css/MediaList.idl \
     css/RGBColor.idl \
     css/Rect.idl \
@@ -322,6 +354,7 @@ IDL_BINDINGS += \
     dom/NodeList.idl \
     dom/Notation.idl \
     dom/OverflowEvent.idl \
+    dom/PageTransitionEvent.idl \
     dom/ProcessingInstruction.idl \
     dom/ProgressEvent.idl \
     dom/RangeException.idl \
@@ -333,9 +366,20 @@ IDL_BINDINGS += \
     dom/WebKitAnimationEvent.idl \
     dom/WebKitTransitionEvent.idl \
     dom/WheelEvent.idl \
-    html/CanvasGradient.idl \
-    html/CanvasPattern.idl \
-    html/CanvasRenderingContext2D.idl \
+    html/canvas/CanvasArray.idl \
+    html/canvas/CanvasArrayBuffer.idl \
+    html/canvas/CanvasByteArray.idl \
+    html/canvas/CanvasFloatArray.idl \
+    html/canvas/CanvasGradient.idl \
+    html/canvas/CanvasIntArray.idl \
+    html/canvas/CanvasPattern.idl \
+    html/canvas/CanvasRenderingContext.idl \
+    html/canvas/CanvasRenderingContext2D.idl \
+    html/canvas/CanvasRenderingContext3D.idl \
+    html/canvas/CanvasShortArray.idl \
+    html/canvas/CanvasUnsignedByteArray.idl \
+    html/canvas/CanvasUnsignedIntArray.idl \
+    html/canvas/CanvasUnsignedShortArray.idl \
     html/DataGridColumn.idl \
     html/DataGridColumnList.idl \
     html/File.idl \
@@ -356,6 +400,7 @@ IDL_BINDINGS += \
     html/HTMLDataGridCellElement.idl \
     html/HTMLDataGridColElement.idl \
     html/HTMLDataGridRowElement.idl \
+    html/HTMLDataListElement.idl \
     html/HTMLDirectoryElement.idl \
     html/HTMLDivElement.idl \
     html/HTMLDListElement.idl \
@@ -411,14 +456,18 @@ IDL_BINDINGS += \
     html/ImageData.idl \
     html/MediaError.idl \
     html/TextMetrics.idl \
+    html/TimeRanges.idl \
     html/ValidityState.idl \
     html/VoidCallback.idl \
     inspector/InspectorBackend.idl \
+    inspector/JavaScriptCallFrame.idl \
+    loader/appcache/DOMApplicationCache.idl \
     page/BarInfo.idl \
     page/Console.idl \
     page/Coordinates.idl \
     page/DOMSelection.idl \
     page/DOMWindow.idl \
+    page/EventSource.idl \
     page/Geolocation.idl \
     page/Geoposition.idl \
     page/History.idl \
@@ -427,25 +476,181 @@ IDL_BINDINGS += \
     page/PositionError.idl \
     page/Screen.idl \
     page/WebKitPoint.idl \
+    page/WorkerNavigator.idl \
     plugins/Plugin.idl \
     plugins/MimeType.idl \
     plugins/PluginArray.idl \
     plugins/MimeTypeArray.idl \
+    storage/Database.idl \
+    storage/Storage.idl \
+    storage/StorageEvent.idl \
+    storage/SQLError.idl \
+    storage/SQLResultSet.idl \
+    storage/SQLResultSetRowList.idl \
+    storage/SQLTransaction.idl \
+    svg/SVGZoomEvent.idl \
+    svg/SVGAElement.idl \
+    svg/SVGAltGlyphElement.idl \
+    svg/SVGAngle.idl \
+    svg/SVGAnimateColorElement.idl \
+    svg/SVGAnimatedAngle.idl \
+    svg/SVGAnimatedBoolean.idl \
+    svg/SVGAnimatedEnumeration.idl \
+    svg/SVGAnimatedInteger.idl \
+    svg/SVGAnimatedLength.idl \
+    svg/SVGAnimatedLengthList.idl \
+    svg/SVGAnimatedNumber.idl \
+    svg/SVGAnimatedNumberList.idl \
+    svg/SVGAnimatedPreserveAspectRatio.idl \
+    svg/SVGAnimatedRect.idl \
+    svg/SVGAnimatedString.idl \
+    svg/SVGAnimatedTransformList.idl \
+    svg/SVGAnimateElement.idl \
+    svg/SVGAnimateTransformElement.idl \
+    svg/SVGAnimationElement.idl \
+    svg/SVGCircleElement.idl \
+    svg/SVGClipPathElement.idl \
+    svg/SVGColor.idl \
+    svg/SVGComponentTransferFunctionElement.idl \
+    svg/SVGCursorElement.idl \
+    svg/SVGDefsElement.idl \
+    svg/SVGDescElement.idl \
+    svg/SVGDocument.idl \
+    svg/SVGElement.idl \
+    svg/SVGElementInstance.idl \
+    svg/SVGElementInstanceList.idl \
+    svg/SVGEllipseElement.idl \
+    svg/SVGException.idl \
+    svg/SVGFEBlendElement.idl \
+    svg/SVGFEColorMatrixElement.idl \
+    svg/SVGFEComponentTransferElement.idl \
+    svg/SVGFECompositeElement.idl \
+    svg/SVGFEDiffuseLightingElement.idl \
+    svg/SVGFEDisplacementMapElement.idl \
+    svg/SVGFEDistantLightElement.idl \
+    svg/SVGFEFloodElement.idl \
+    svg/SVGFEFuncAElement.idl \
+    svg/SVGFEFuncBElement.idl \
+    svg/SVGFEFuncGElement.idl \
+    svg/SVGFEFuncRElement.idl \
+    svg/SVGFEGaussianBlurElement.idl \
+    svg/SVGFEImageElement.idl \
+    svg/SVGFEMergeElement.idl \
+    svg/SVGFEMergeNodeElement.idl \
+    svg/SVGFEOffsetElement.idl \
+    svg/SVGFEPointLightElement.idl \
+    svg/SVGFESpecularLightingElement.idl \
+    svg/SVGFESpotLightElement.idl \
+    svg/SVGFETileElement.idl \
+    svg/SVGFETurbulenceElement.idl \
+    svg/SVGFilterElement.idl \
+    svg/SVGFontElement.idl \
+    svg/SVGFontFaceElement.idl \
+    svg/SVGFontFaceFormatElement.idl \
+    svg/SVGFontFaceNameElement.idl \
+    svg/SVGFontFaceSrcElement.idl \
+    svg/SVGFontFaceUriElement.idl \
+    svg/SVGForeignObjectElement.idl \
+    svg/SVGGElement.idl \
+    svg/SVGGlyphElement.idl \
+    svg/SVGGradientElement.idl \
+    svg/SVGHKernElement.idl \
+    svg/SVGImageElement.idl \
+    svg/SVGLength.idl \
+    svg/SVGLengthList.idl \
+    svg/SVGLinearGradientElement.idl \
+    svg/SVGLineElement.idl \
+    svg/SVGMarkerElement.idl \
+    svg/SVGMaskElement.idl \
+    svg/SVGMatrix.idl \
+    svg/SVGMetadataElement.idl \
+    svg/SVGMissingGlyphElement.idl \
+    svg/SVGNumber.idl \
+    svg/SVGNumberList.idl \
+    svg/SVGPaint.idl \
+    svg/SVGPathElement.idl \
+    svg/SVGPathSegArcAbs.idl \
+    svg/SVGPathSegArcRel.idl \
+    svg/SVGPathSegClosePath.idl \
+    svg/SVGPathSegCurvetoCubicAbs.idl \
+    svg/SVGPathSegCurvetoCubicRel.idl \
+    svg/SVGPathSegCurvetoCubicSmoothAbs.idl \
+    svg/SVGPathSegCurvetoCubicSmoothRel.idl \
+    svg/SVGPathSegCurvetoQuadraticAbs.idl \
+    svg/SVGPathSegCurvetoQuadraticRel.idl \
+    svg/SVGPathSegCurvetoQuadraticSmoothAbs.idl \
+    svg/SVGPathSegCurvetoQuadraticSmoothRel.idl \
+    svg/SVGPathSeg.idl \
+    svg/SVGPathSegLinetoAbs.idl \
+    svg/SVGPathSegLinetoHorizontalAbs.idl \
+    svg/SVGPathSegLinetoHorizontalRel.idl \
+    svg/SVGPathSegLinetoRel.idl \
+    svg/SVGPathSegLinetoVerticalAbs.idl \
+    svg/SVGPathSegLinetoVerticalRel.idl \
+    svg/SVGPathSegList.idl \
+    svg/SVGPathSegMovetoAbs.idl \
+    svg/SVGPathSegMovetoRel.idl \
+    svg/SVGPatternElement.idl \
+    svg/SVGPoint.idl \
+    svg/SVGPointList.idl \
+    svg/SVGPolygonElement.idl \
+    svg/SVGPolylineElement.idl \
+    svg/SVGPreserveAspectRatio.idl \
+    svg/SVGRadialGradientElement.idl \
+    svg/SVGRectElement.idl \
+    svg/SVGRect.idl \
+    svg/SVGRenderingIntent.idl \
+    svg/SVGScriptElement.idl \
+    svg/SVGSetElement.idl \
+    svg/SVGStopElement.idl \
+    svg/SVGStringList.idl \
+    svg/SVGStyleElement.idl \
+    svg/SVGSVGElement.idl \
+    svg/SVGSwitchElement.idl \
+    svg/SVGSymbolElement.idl \
+    svg/SVGTextContentElement.idl \
+    svg/SVGTextElement.idl \
+    svg/SVGTextPathElement.idl \
+    svg/SVGTextPositioningElement.idl \
+    svg/SVGTitleElement.idl \
+    svg/SVGTransform.idl \
+    svg/SVGTransformList.idl \
+    svg/SVGTRefElement.idl \
+    svg/SVGTSpanElement.idl \
+    svg/SVGUnitTypes.idl \
+    svg/SVGUseElement.idl \
+    svg/SVGViewElement.idl \
+    websockets/WebSocket.idl \
+    workers/AbstractWorker.idl \
+    workers/DedicatedWorkerContext.idl \
+    workers/SharedWorker.idl \
+    workers/SharedWorkerContext.idl \
+    workers/Worker.idl \
+    workers/WorkerContext.idl \
+    workers/WorkerLocation.idl \
     xml/DOMParser.idl \
     xml/XMLHttpRequest.idl \
     xml/XMLHttpRequestException.idl \
     xml/XMLHttpRequestProgressEvent.idl \
     xml/XMLHttpRequestUpload.idl \
-    xml/XMLSerializer.idl
+    xml/XMLSerializer.idl \
+    xml/XPathNSResolver.idl \
+    xml/XPathException.idl \
+    xml/XPathExpression.idl \
+    xml/XPathResult.idl \
+    xml/XPathEvaluator.idl \
+    xml/XSLTProcessor.idl
 
 
 SOURCES += \
     accessibility/AccessibilityImageMapLink.cpp \
+    accessibility/AccessibilityMediaControls.cpp \    
     accessibility/AccessibilityObject.cpp \    
     accessibility/AccessibilityList.cpp \    
     accessibility/AccessibilityListBox.cpp \    
     accessibility/AccessibilityListBoxOption.cpp \    
     accessibility/AccessibilityRenderObject.cpp \    
+    accessibility/AccessibilitySlider.cpp \    
     accessibility/AccessibilityARIAGrid.cpp \    
     accessibility/AccessibilityARIAGridCell.cpp \    
     accessibility/AccessibilityARIAGridRow.cpp \    
@@ -458,10 +663,12 @@ SOURCES += \
     bindings/js/GCController.cpp \
     bindings/js/JSAttrCustom.cpp \
     bindings/js/JSCDATASectionCustom.cpp \
+    bindings/js/JSCanvasRenderingContextCustom.cpp \
     bindings/js/JSCanvasRenderingContext2DCustom.cpp \
     bindings/js/JSClipboardCustom.cpp \
     bindings/js/JSConsoleCustom.cpp \
     bindings/js/JSCSSRuleCustom.cpp \
+    bindings/js/JSCSSRuleListCustom.cpp \
     bindings/js/JSCSSStyleDeclarationCustom.cpp \
     bindings/js/JSCSSValueCustom.cpp \
     bindings/js/JSCoordinatesCustom.cpp \
@@ -479,11 +686,14 @@ SOURCES += \
     bindings/js/JSDOMWindowShell.cpp \
     bindings/js/JSElementCustom.cpp \
     bindings/js/JSEventCustom.cpp \
+    bindings/js/JSEventSourceConstructor.cpp \
+    bindings/js/JSEventSourceCustom.cpp \
     bindings/js/JSEventTarget.cpp \
     bindings/js/JSGeolocationCustom.cpp \
     bindings/js/JSHTMLAllCollection.cpp \
     bindings/js/JSHistoryCustom.cpp \
     bindings/js/JSHTMLAppletElementCustom.cpp \
+    bindings/js/JSHTMLCanvasElementCustom.cpp \
     bindings/js/JSHTMLCollectionCustom.cpp \
     bindings/js/JSHTMLDataGridElementCustom.cpp \
     bindings/js/JSHTMLDocumentCustom.cpp \
@@ -526,7 +736,9 @@ SOURCES += \
     bindings/js/JSPluginArrayCustom.cpp \
     bindings/js/JSMessageChannelConstructor.cpp \
     bindings/js/JSMessageChannelCustom.cpp \
+    bindings/js/JSMessageEventCustom.cpp \
     bindings/js/JSMessagePortCustom.cpp \
+    bindings/js/JSMessagePortCustom.h \
     bindings/js/JSMimeTypeArrayCustom.cpp \
     bindings/js/JSDOMBinding.cpp \
     bindings/js/JSEventListener.cpp \
@@ -601,6 +813,7 @@ SOURCES += \
     css/FontFamilyValue.cpp \
     css/FontValue.cpp \
     css/MediaFeatureNames.cpp \
+    css/Media.cpp \
     css/MediaList.cpp \
     css/MediaQuery.cpp \
     css/MediaQueryEvaluator.cpp \
@@ -669,6 +882,7 @@ SOURCES += \
     dom/OptionGroupElement.cpp \
     dom/OptionElement.cpp \
     dom/OverflowEvent.cpp \
+    dom/PageTransitionEvent.cpp \
     dom/Position.cpp \
     dom/PositionIterator.cpp \
     dom/ProcessingInstruction.cpp \
@@ -750,11 +964,12 @@ SOURCES += \
     history/HistoryItem.cpp \
     history/qt/HistoryItemQt.cpp \
     history/PageCache.cpp \
-    html/CanvasGradient.cpp \
-    html/CanvasPattern.cpp \
-    html/CanvasPixelArray.cpp \
-    html/CanvasRenderingContext2D.cpp \
-    html/CanvasStyle.cpp \
+    html/canvas/CanvasGradient.cpp \
+    html/canvas/CanvasPattern.cpp \
+    html/canvas/CanvasPixelArray.cpp \
+    html/canvas/CanvasRenderingContext.cpp \
+    html/canvas/CanvasRenderingContext2D.cpp \
+    html/canvas/CanvasStyle.cpp \
     html/CollectionCache.cpp \
     html/DataGridColumn.cpp \
     html/DataGridColumnList.cpp \
@@ -777,6 +992,7 @@ SOURCES += \
     html/HTMLDataGridCellElement.cpp \
     html/HTMLDataGridColElement.cpp \
     html/HTMLDataGridRowElement.cpp \
+    html/HTMLDataListElement.cpp \
     html/HTMLDirectoryElement.cpp \
     html/HTMLDivElement.cpp \
     html/HTMLDListElement.cpp \
@@ -846,17 +1062,19 @@ SOURCES += \
     html/PreloadScanner.cpp \
     html/ValidityState.cpp \
     inspector/ConsoleMessage.cpp \
+    inspector/DOMDispatchTimelineItem.cpp \
     inspector/InspectorBackend.cpp \
+    inspector/InspectorController.cpp \
     inspector/InspectorDatabaseResource.cpp \
+    inspector/InspectorDOMAgent.cpp \
     inspector/InspectorDOMStorageResource.cpp \
-    inspector/InspectorController.cpp \
     inspector/InspectorFrontend.cpp \
     inspector/InspectorResource.cpp \
-    inspector/InspectorJSONObject.cpp \
+    inspector/InspectorTimelineAgent.cpp \
+    inspector/TimelineItem.cpp \
     loader/archive/ArchiveFactory.cpp \
     loader/archive/ArchiveResource.cpp \
     loader/archive/ArchiveResourceCollection.cpp \
-    loader/UserStyleSheetLoader.cpp \
     loader/Cache.cpp \
     loader/CachedCSSStyleSheet.cpp \
     loader/CachedFont.cpp \
@@ -901,7 +1119,6 @@ SOURCES += \
     page/Chrome.cpp \
     page/Console.cpp \
     page/ContextMenuController.cpp \
-    page/Coordinates.cpp \
     page/DOMSelection.cpp \
     page/DOMTimer.cpp \
     page/DOMWindow.cpp \
@@ -909,15 +1126,16 @@ SOURCES += \
     page/NavigatorBase.cpp \
     page/DragController.cpp \
     page/EventHandler.cpp \
+    page/EventSource.cpp \
     page/FocusController.cpp \
     page/Frame.cpp \
     page/FrameTree.cpp \
     page/FrameView.cpp \
     page/Geolocation.cpp \
-    page/Geoposition.cpp \
     page/History.cpp \
     page/Location.cpp \
     page/MouseEventWithHitTestResults.cpp \
+    page/OriginAccessEntry.cpp \
     page/Page.cpp \
     page/PageGroup.cpp \
     page/PageGroupLoadDeferrer.cpp \
@@ -964,6 +1182,8 @@ SOURCES += \
     platform/graphics/GraphicsContext.cpp \
     platform/graphics/GraphicsTypes.cpp \
     platform/graphics/Image.cpp \
+    platform/graphics/ImageBuffer.cpp \
+    platform/graphics/ImageSource.cpp \
     platform/graphics/IntRect.cpp \
     platform/graphics/Path.cpp \
     platform/graphics/PathTraversalState.cpp \
@@ -985,6 +1205,7 @@ SOURCES += \
     platform/LinkHash.cpp \
     platform/Logging.cpp \
     platform/MIMETypeRegistry.cpp \
+    platform/mock/GeolocationServiceMock.cpp \
     platform/network/AuthenticationChallengeBase.cpp \
     platform/network/Credential.cpp \
     platform/network/FormData.cpp \
@@ -1125,8 +1346,10 @@ HEADERS += \
     accessibility/AccessibilityListBox.h \
     accessibility/AccessibilityListBoxOption.h \
     accessibility/AccessibilityList.h \
+    accessibility/AccessibilityMediaControls.h \
     accessibility/AccessibilityObject.h \
     accessibility/AccessibilityRenderObject.h \
+    accessibility/AccessibilitySlider.h \
     accessibility/AccessibilityTableCell.h \
     accessibility/AccessibilityTableColumn.h \
     accessibility/AccessibilityTable.h \
@@ -1154,6 +1377,7 @@ HEADERS += \
     bindings/js/JSDOMWindowCustom.h \
     bindings/js/JSDOMWindowShell.h \
     bindings/js/JSEventListener.h \
+    bindings/js/JSEventSourceConstructor.h \
     bindings/js/JSEventTarget.h \
     bindings/js/JSHistoryCustom.h \
     bindings/js/JSHTMLAllCollection.h \
@@ -1258,6 +1482,7 @@ HEADERS += \
     css/FontFamilyValue.h \
     css/FontValue.h \
     css/MediaFeatureNames.h \
+    css/Media.h \
     css/MediaList.h \
     css/MediaQueryEvaluator.h \
     css/MediaQueryExp.h \
@@ -1326,6 +1551,7 @@ HEADERS += \
     dom/OptionElement.h \
     dom/OptionGroupElement.h \
     dom/OverflowEvent.h \
+    dom/PageTransitionEvent.h \
     dom/Position.h \
     dom/PositionIterator.h \
     dom/ProcessingInstruction.h \
@@ -1402,11 +1628,12 @@ HEADERS += \
     history/CachedPage.h \
     history/HistoryItem.h \
     history/PageCache.h \
-    html/CanvasGradient.h \
-    html/CanvasPattern.h \
-    html/CanvasPixelArray.h \
-    html/CanvasRenderingContext2D.h \
-    html/CanvasStyle.h \
+    html/canvas/CanvasGradient.h \
+    html/canvas/CanvasPattern.h \
+    html/canvas/CanvasPixelArray.h \
+    html/canvas/CanvasRenderingContext.h \
+    html/canvas/CanvasRenderingContext2D.h \
+    html/canvas/CanvasStyle.h \
     html/CollectionCache.h \
     html/DataGridColumn.h \
     html/DataGridColumnList.h \
@@ -1503,18 +1730,21 @@ HEADERS += \
     html/TimeRanges.h \
     html/ValidityState.h \
     inspector/ConsoleMessage.h \
+    inspector/DOMDispatchTimelineItem.h \
     inspector/InspectorBackend.h \
     inspector/InspectorController.h \
     inspector/InspectorDatabaseResource.h \
     inspector/InspectorDOMStorageResource.h \
     inspector/InspectorFrontend.h \
-    inspector/InspectorJSONObject.h \
     inspector/InspectorResource.h \
+    inspector/InspectorTimelineAgent.h \
     inspector/JavaScriptCallFrame.h \
     inspector/JavaScriptDebugServer.h \
     inspector/JavaScriptProfile.h \
     inspector/JavaScriptProfileNode.h \
+    inspector/TimelineItem.h \
     loader/appcache/ApplicationCacheGroup.h \
+    loader/appcache/ApplicationCacheHost.h \
     loader/appcache/ApplicationCache.h \
     loader/appcache/ApplicationCacheResource.h \
     loader/appcache/ApplicationCacheStorage.h \
@@ -1561,7 +1791,6 @@ HEADERS += \
     loader/TextDocument.h \
     loader/TextResourceDecoder.h \
     loader/ThreadableLoader.h \
-    loader/UserStyleSheetLoader.h \
     loader/WorkerThreadableLoader.h \
     page/animation/AnimationBase.h \
     page/animation/AnimationController.h \
@@ -1578,6 +1807,7 @@ HEADERS += \
     page/DOMWindow.h \
     page/DragController.h \
     page/EventHandler.h \
+    page/EventSource.h \
     page/FocusController.h \
     page/Frame.h \
     page/FrameTree.h \
@@ -1610,6 +1840,7 @@ HEADERS += \
     platform/DragImage.h \
     platform/FileChooser.h \
     platform/GeolocationService.h \
+    platform/mock/GeolocationServiceMock.h \
     platform/graphics/BitmapImage.h \
     platform/graphics/Color.h \
     platform/graphics/filters/FEBlend.h \
@@ -1633,6 +1864,7 @@ HEADERS += \
     platform/graphics/GraphicsContext.h \
     platform/graphics/GraphicsTypes.h \
     platform/graphics/Image.h \
+    platform/graphics/ImageSource.h \
     platform/graphics/IntRect.h \
     platform/graphics/MediaPlayer.h \
     platform/graphics/Path.h \
@@ -1880,7 +2112,6 @@ HEADERS += \
     svg/SVGColor.h \
     svg/SVGComponentTransferFunctionElement.h \
     svg/SVGCursorElement.h \
-    svg/SVGDefinitionSrcElement.h \
     svg/SVGDefsElement.h \
     svg/SVGDescElement.h \
     svg/SVGDocumentExtensions.h \
@@ -2031,6 +2262,8 @@ HEADERS += \
     wml/WMLTimerElement.h \
     wml/WMLVariables.h \
     workers/AbstractWorker.h \
+    workers/DedicatedWorkerContext.h \
+    workers/DedicatedWorkerThread.h \
     workers/SharedWorker.h \
     workers/WorkerContext.h \
     workers/Worker.h \
@@ -2065,6 +2298,7 @@ HEADERS += \
     xml/XSLTProcessor.h \
     xml/XSLTUnicodeSort.h \
     $$PWD/../WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h \
+    $$PWD/platform/network/qt/DnsPrefetchHelper.h
 
 SOURCES += \
     accessibility/qt/AccessibilityObjectQt.cpp \
@@ -2097,6 +2331,7 @@ SOURCES += \
     platform/graphics/qt/StillImageQt.cpp \
     platform/network/qt/ResourceHandleQt.cpp \
     platform/network/qt/ResourceRequestQt.cpp \
+    platform/network/qt/DnsPrefetchHelper.cpp \
     platform/network/qt/QNetworkReplyHandler.cpp \
     editing/qt/EditorQt.cpp \
     platform/qt/ClipboardQt.cpp \
@@ -2148,15 +2383,19 @@ SOURCES += \
     ../WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp \
     ../WebKit/qt/WebCoreSupport/InspectorClientQt.cpp \
     ../WebKit/qt/Api/qwebframe.cpp \
+    ../WebKit/qt/Api/qwebgraphicsitem.cpp \
     ../WebKit/qt/Api/qwebpage.cpp \
     ../WebKit/qt/Api/qwebview.cpp \
     ../WebKit/qt/Api/qwebelement.cpp \
     ../WebKit/qt/Api/qwebhistory.cpp \
     ../WebKit/qt/Api/qwebsettings.cpp \
     ../WebKit/qt/Api/qwebhistoryinterface.cpp \
+    ../WebKit/qt/Api/qwebplugindatabase.cpp \
     ../WebKit/qt/Api/qwebpluginfactory.cpp \
     ../WebKit/qt/Api/qwebsecurityorigin.cpp \
-    ../WebKit/qt/Api/qwebdatabase.cpp
+    ../WebKit/qt/Api/qwebdatabase.cpp \
+    ../WebKit/qt/Api/qwebinspector.cpp \
+    ../WebKit/qt/Api/qwebkitversion.cpp
 
 
     win32-*|wince*: SOURCES += platform/win/SystemTimeWin.cpp
@@ -2253,6 +2492,10 @@ contains(DEFINES, ENABLE_DATAGRID=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_DATAGRID=1
 }
 
+contains(DEFINES, ENABLE_EVENTSOURCE=1) {
+    FEATURE_DEFINES_JAVASCRIPT += ENABLE_EVENTSOURCE=1
+}
+
 contains(DEFINES, ENABLE_SQLITE=1) {
     !system-sqlite:exists( $${SQLITE3SRCDIR}/sqlite3.c ) {
             # Build sqlite3 into WebCore from source
@@ -2269,8 +2512,7 @@ contains(DEFINES, ENABLE_SQLITE=1) {
             LIBS *= $$QT_LFLAGS_SQLITE
         } else {
             INCLUDEPATH += $${SQLITE3SRCDIR}
-            symbian: LIBS += -lsqlite3.lib
-            else: LIBS += -lsqlite3
+            LIBS += -lsqlite3
         }
     }
 
@@ -2300,6 +2542,8 @@ contains(DEFINES, ENABLE_DATABASE=1) {
         storage/SQLResultSetRowList.cpp \
         storage/SQLStatement.cpp \
         storage/SQLTransaction.cpp \
+        storage/SQLTransactionClient.cpp \
+        storage/SQLTransactionCoordinator.cpp \
         bindings/js/JSCustomSQLStatementCallback.cpp \
         bindings/js/JSCustomSQLStatementErrorCallback.cpp \
         bindings/js/JSCustomSQLTransactionCallback.cpp \
@@ -2307,13 +2551,6 @@ contains(DEFINES, ENABLE_DATABASE=1) {
         bindings/js/JSDatabaseCustom.cpp \
         bindings/js/JSSQLResultSetRowListCustom.cpp \
         bindings/js/JSSQLTransactionCustom.cpp
-
-    IDL_BINDINGS += \
-        storage/Database.idl \
-        storage/SQLError.idl \
-        storage/SQLResultSet.idl \
-        storage/SQLResultSetRowList.idl \
-        storage/SQLTransaction.idl
 }
 
 contains(DEFINES, ENABLE_DOM_STORAGE=1) {
@@ -2334,6 +2571,8 @@ contains(DEFINES, ENABLE_DOM_STORAGE=1) {
         storage/SQLResultSetRowList.h \
         storage/SQLStatement.h \
         storage/SQLTransaction.h \
+        storage/SQLTransactionClient.h \
+        storage/SQLTransactionCoordinator.h \
         storage/StorageArea.h \
         storage/StorageAreaImpl.h \
         storage/StorageAreaSync.h \
@@ -2349,7 +2588,6 @@ contains(DEFINES, ENABLE_DOM_STORAGE=1) {
         storage/LocalStorageTask.cpp \
         storage/LocalStorageThread.cpp \
         storage/Storage.cpp \
-        storage/StorageArea.cpp \
         storage/StorageAreaImpl.cpp \
         storage/StorageAreaSync.cpp \
         storage/StorageEvent.cpp \
@@ -2357,10 +2595,6 @@ contains(DEFINES, ENABLE_DOM_STORAGE=1) {
         storage/StorageNamespace.cpp \
         storage/StorageNamespaceImpl.cpp \
         storage/StorageSyncManager.cpp
-
-    IDL_BINDINGS += \
-        storage/Storage.idl \
-        storage/StorageEvent.idl
 }
 
 contains(DEFINES, ENABLE_ICONDATABASE=1) {
@@ -2376,14 +2610,6 @@ contains(DEFINES, ENABLE_ICONDATABASE=1) {
 contains(DEFINES, ENABLE_WORKERS=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_WORKERS=1
 
-    IDL_BINDINGS += \
-        page/WorkerNavigator.idl \
-        workers/AbstractWorker.idl \
-        workers/DedicatedWorkerContext.idl \
-        workers/Worker.idl \
-        workers/WorkerContext.idl \
-        workers/WorkerLocation.idl
-
     SOURCES += \
         bindings/js/JSAbstractWorkerCustom.cpp \
         bindings/js/JSDedicatedWorkerContextCustom.cpp \
@@ -2396,6 +2622,7 @@ contains(DEFINES, ENABLE_WORKERS=1) {
         page/WorkerNavigator.cpp \
         workers/AbstractWorker.cpp \
         workers/DedicatedWorkerContext.cpp \
+        workers/DedicatedWorkerThread.cpp \
         workers/Worker.cpp \
         workers/WorkerContext.cpp \
         workers/WorkerLocation.cpp \
@@ -2405,24 +2632,22 @@ contains(DEFINES, ENABLE_WORKERS=1) {
         workers/WorkerScriptLoader.cpp
 }
 
-contains(DEFINES, SHARED_WORKERS=1) {
+contains(DEFINES, ENABLE_SHARED_WORKERS=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_SHARED_WORKERS=1
 
-    IDL_BINDINGS += \
-        workers/SharedWorker.idl
-
     SOURCES += \
         bindings/js/JSSharedWorkerConstructor.cpp \
+        bindings/js/JSSharedWorkerContextCustom.cpp \
         bindings/js/JSSharedWorkerCustom.cpp \
-        workers/SharedWorker.cpp
+        workers/DefaultSharedWorkerRepository.cpp \
+        workers/SharedWorker.cpp \
+        workers/SharedWorkerContext.cpp \
+        workers/SharedWorkerThread.cpp
 }
 
 contains(DEFINES, ENABLE_VIDEO=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_VIDEO=1
 
-    IDL_BINDINGS += \
-        html/TimeRanges.idl
-
     SOURCES += \
         html/HTMLAudioElement.cpp \
         html/HTMLMediaElement.cpp \
@@ -2459,13 +2684,6 @@ contains(DEFINES, ENABLE_XPATH=1) {
 
     XPATHBISON = $$PWD/xml/XPathGrammar.y
 
-    IDL_BINDINGS += \
-        xml/XPathNSResolver.idl \
-        xml/XPathException.idl \
-        xml/XPathExpression.idl \
-        xml/XPathResult.idl \
-        xml/XPathEvaluator.idl
-
     SOURCES += \
         xml/NativeXPathNSResolver.cpp \
         xml/XPathEvaluator.cpp \
@@ -2500,9 +2718,6 @@ contains(DEFINES, ENABLE_XSLT=1) {
         LIBS += -llibxml2 -llibxslt
     }
 
-    IDL_BINDINGS += \
-        xml/XSLTProcessor.idl
-
     SOURCES += \
         bindings/js/JSXSLTProcessorConstructor.cpp \
         bindings/js/JSXSLTProcessorCustom.cpp \
@@ -2530,6 +2745,14 @@ contains(DEFINES, ENABLE_FILTERS=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_FILTERS=1
 }
 
+contains(DEFINES, ENABLE_WCSS=1) {
+    FEATURE_DEFINES_JAVASCRIPT += ENABLE_WCSS=1
+    contains(DEFINES, ENABLE_XHTMLMP=0) {
+        DEFINES -= ENABLE_XHTMLMP=0
+        DEFINES += ENABLE_XHTMLMP=1
+    }
+}
+
 contains(DEFINES, ENABLE_WML=1) {
     SOURCES += \
         wml/WMLAElement.cpp \
@@ -2600,141 +2823,6 @@ contains(DEFINES, ENABLE_SVG=1) {
 
     XLINK_NAMES = $$PWD/svg/xlinkattrs.in
 
-    IDL_BINDINGS += \
-        svg/SVGZoomEvent.idl \
-        svg/SVGAElement.idl \
-        svg/SVGAltGlyphElement.idl \
-        svg/SVGAngle.idl \
-        svg/SVGAnimateColorElement.idl \
-        svg/SVGAnimatedAngle.idl \
-        svg/SVGAnimatedBoolean.idl \
-        svg/SVGAnimatedEnumeration.idl \
-        svg/SVGAnimatedInteger.idl \
-        svg/SVGAnimatedLength.idl \
-        svg/SVGAnimatedLengthList.idl \
-        svg/SVGAnimatedNumber.idl \
-        svg/SVGAnimatedNumberList.idl \
-        svg/SVGAnimatedPreserveAspectRatio.idl \
-        svg/SVGAnimatedRect.idl \
-        svg/SVGAnimatedString.idl \
-        svg/SVGAnimatedTransformList.idl \
-        svg/SVGAnimateElement.idl \
-        svg/SVGAnimateTransformElement.idl \
-        svg/SVGAnimationElement.idl \
-        svg/SVGCircleElement.idl \
-        svg/SVGClipPathElement.idl \
-        svg/SVGColor.idl \
-        svg/SVGComponentTransferFunctionElement.idl \
-        svg/SVGCursorElement.idl \
-        svg/SVGDefinitionSrcElement.idl \
-        svg/SVGDefsElement.idl \
-        svg/SVGDescElement.idl \
-        svg/SVGDocument.idl \
-        svg/SVGElement.idl \
-        svg/SVGElementInstance.idl \
-        svg/SVGElementInstanceList.idl \
-        svg/SVGEllipseElement.idl \
-        svg/SVGException.idl \
-        svg/SVGFEBlendElement.idl \
-        svg/SVGFEColorMatrixElement.idl \
-        svg/SVGFEComponentTransferElement.idl \
-        svg/SVGFECompositeElement.idl \
-        svg/SVGFEDiffuseLightingElement.idl \
-        svg/SVGFEDisplacementMapElement.idl \
-        svg/SVGFEDistantLightElement.idl \
-        svg/SVGFEFloodElement.idl \
-        svg/SVGFEFuncAElement.idl \
-        svg/SVGFEFuncBElement.idl \
-        svg/SVGFEFuncGElement.idl \
-        svg/SVGFEFuncRElement.idl \
-        svg/SVGFEGaussianBlurElement.idl \
-        svg/SVGFEImageElement.idl \
-        svg/SVGFEMergeElement.idl \
-        svg/SVGFEMergeNodeElement.idl \
-        svg/SVGFEOffsetElement.idl \
-        svg/SVGFEPointLightElement.idl \
-        svg/SVGFESpecularLightingElement.idl \
-        svg/SVGFESpotLightElement.idl \
-        svg/SVGFETileElement.idl \
-        svg/SVGFETurbulenceElement.idl \
-        svg/SVGFilterElement.idl \
-        svg/SVGFontElement.idl \
-        svg/SVGFontFaceElement.idl \
-        svg/SVGFontFaceFormatElement.idl \
-        svg/SVGFontFaceNameElement.idl \
-        svg/SVGFontFaceSrcElement.idl \
-        svg/SVGFontFaceUriElement.idl \
-        svg/SVGForeignObjectElement.idl \
-        svg/SVGGElement.idl \
-        svg/SVGGlyphElement.idl \
-        svg/SVGGradientElement.idl \
-        svg/SVGHKernElement.idl \
-        svg/SVGImageElement.idl \
-        svg/SVGLength.idl \
-        svg/SVGLengthList.idl \
-        svg/SVGLinearGradientElement.idl \
-        svg/SVGLineElement.idl \
-        svg/SVGMarkerElement.idl \
-        svg/SVGMaskElement.idl \
-        svg/SVGMatrix.idl \
-        svg/SVGMetadataElement.idl \
-        svg/SVGMissingGlyphElement.idl \
-        svg/SVGNumber.idl \
-        svg/SVGNumberList.idl \
-        svg/SVGPaint.idl \
-        svg/SVGPathElement.idl \
-        svg/SVGPathSegArcAbs.idl \
-        svg/SVGPathSegArcRel.idl \
-        svg/SVGPathSegClosePath.idl \
-        svg/SVGPathSegCurvetoCubicAbs.idl \
-        svg/SVGPathSegCurvetoCubicRel.idl \
-        svg/SVGPathSegCurvetoCubicSmoothAbs.idl \
-        svg/SVGPathSegCurvetoCubicSmoothRel.idl \
-        svg/SVGPathSegCurvetoQuadraticAbs.idl \
-        svg/SVGPathSegCurvetoQuadraticRel.idl \
-        svg/SVGPathSegCurvetoQuadraticSmoothAbs.idl \
-        svg/SVGPathSegCurvetoQuadraticSmoothRel.idl \
-        svg/SVGPathSeg.idl \
-        svg/SVGPathSegLinetoAbs.idl \
-        svg/SVGPathSegLinetoHorizontalAbs.idl \
-        svg/SVGPathSegLinetoHorizontalRel.idl \
-        svg/SVGPathSegLinetoRel.idl \
-        svg/SVGPathSegLinetoVerticalAbs.idl \
-        svg/SVGPathSegLinetoVerticalRel.idl \
-        svg/SVGPathSegList.idl \
-        svg/SVGPathSegMovetoAbs.idl \
-        svg/SVGPathSegMovetoRel.idl \
-        svg/SVGPatternElement.idl \
-        svg/SVGPoint.idl \
-        svg/SVGPointList.idl \
-        svg/SVGPolygonElement.idl \
-        svg/SVGPolylineElement.idl \
-        svg/SVGPreserveAspectRatio.idl \
-        svg/SVGRadialGradientElement.idl \
-        svg/SVGRectElement.idl \
-        svg/SVGRect.idl \
-        svg/SVGRenderingIntent.idl \
-        svg/SVGScriptElement.idl \
-        svg/SVGSetElement.idl \
-        svg/SVGStopElement.idl \
-        svg/SVGStringList.idl \
-        svg/SVGStyleElement.idl \
-        svg/SVGSVGElement.idl \
-        svg/SVGSwitchElement.idl \
-        svg/SVGSymbolElement.idl \
-        svg/SVGTextContentElement.idl \
-        svg/SVGTextElement.idl \
-        svg/SVGTextPathElement.idl \
-        svg/SVGTextPositioningElement.idl \
-        svg/SVGTitleElement.idl \
-        svg/SVGTransform.idl \
-        svg/SVGTransformList.idl \
-        svg/SVGTRefElement.idl \
-        svg/SVGTSpanElement.idl \
-        svg/SVGUnitTypes.idl \
-        svg/SVGUseElement.idl \
-        svg/SVGViewElement.idl 
-
     SOURCES += \
 # TODO: this-one-is-not-auto-added! FIXME! tmp/SVGElementFactory.cpp \
         bindings/js/JSSVGElementInstanceCustom.cpp \
@@ -2769,7 +2857,6 @@ contains(DEFINES, ENABLE_SVG=1) {
         svg/SVGColor.cpp \
         svg/SVGComponentTransferFunctionElement.cpp \
         svg/SVGCursorElement.cpp \
-        svg/SVGDefinitionSrcElement.cpp \
         svg/SVGDefsElement.cpp \
         svg/SVGDescElement.cpp \
         svg/SVGDocument.cpp \
@@ -2973,49 +3060,29 @@ contains(DEFINES, ENABLE_SVG=1) {
         xlinknames.variable_out = GENERATED_SOURCES
         addExtraCompilerWithHeader(xlinknames)
 
-    # GENERATOR 6-A:
-    cssprops.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
-    cssprops.input = WALDOCSSPROPS
-    cssprops.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$DASHBOARDSUPPORTCSSPROPERTIES $$SVGCSSPROPERTIES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makeprop.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
-    cssprops.CONFIG = target_predeps no_link
-    cssprops.variable_out =
-    cssprops.depend = ${QMAKE_FILE_NAME} DASHBOARDSUPPORTCSSPROPERTIES SVGCSSPROPERTIES
-    addExtraCompilerWithHeader(cssprops)
-
-    # GENERATOR 6-B:
-    cssvalues.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.c
-    cssvalues.input = WALDOCSSVALUES
-    cssvalues.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$SVGCSSVALUES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makevalues.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.gperf
-    cssvalues.CONFIG = target_predeps no_link
-    cssvalues.variable_out =
-    cssvalues.depend = ${QMAKE_FILE_NAME} SVGCSSVALUES
-    addExtraCompilerWithHeader(cssvalues)
-} else {
-    # GENERATOR 6-A:
-    cssprops.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
-    cssprops.input = WALDOCSSPROPS
-    cssprops.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$DASHBOARDSUPPORTCSSPROPERTIES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makeprop.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
-    cssprops.CONFIG = target_predeps no_link
-    cssprops.variable_out =
-    cssprops.depend = ${QMAKE_FILE_NAME} DASHBOARDSUPPORTCSSPROPERTIES
-    addExtraCompilerWithHeader(cssprops)
-
-    # GENERATOR 6-B:
-    cssvalues.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.c
-    cssvalues.input = WALDOCSSVALUES
-    cssvalues.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makevalues.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.gperf
-    cssvalues.CONFIG = target_predeps no_link
-    cssvalues.variable_out =
-    cssvalues.clean = ${QMAKE_FILE_OUT} ${QMAKE_VAR_GENERATED_SOURCES_DIR_SLASH}${QMAKE_FILE_BASE}.h
-    addExtraCompiler(cssvalues)
-}
+} 
+# GENERATOR 6-A:
+cssprops.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
+cssprops.input = WALDOCSSPROPS
+cssprops.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$DASHBOARDSUPPORTCSSPROPERTIES $$EXTRACSSPROPERTIES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makeprop.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
+cssprops.CONFIG = target_predeps no_link
+cssprops.variable_out =
+cssprops.depend = ${QMAKE_FILE_NAME} DASHBOARDSUPPORTCSSPROPERTIES EXTRACSSPROPERTIES
+addExtraCompilerWithHeader(cssprops)
+
+# GENERATOR 6-B:
+cssvalues.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.c
+cssvalues.input = WALDOCSSVALUES
+cssvalues.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$EXTRACSSVALUES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makevalues.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.gperf
+cssvalues.CONFIG = target_predeps no_link
+cssvalues.variable_out =
+cssvalues.depend = ${QMAKE_FILE_NAME} EXTRACSSVALUES
+cssvalues.clean = ${QMAKE_FILE_OUT} ${QMAKE_VAR_GENERATED_SOURCES_DIR_SLASH}${QMAKE_FILE_BASE}.h
+addExtraCompiler(cssvalues)
 
 contains(DEFINES, ENABLE_JAVASCRIPT_DEBUGGER=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_JAVASCRIPT_DEBUGGER=1
 
-    IDL_BINDINGS += \
-        inspector/JavaScriptCallFrame.idl
-
     SOURCES += \
         bindings/js/JSJavaScriptCallFrameCustom.cpp \
         inspector/JavaScriptCallFrame.cpp \
@@ -3027,12 +3094,10 @@ contains(DEFINES, ENABLE_JAVASCRIPT_DEBUGGER=1) {
 contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_OFFLINE_WEB_APPLICATIONS=1
 
-IDL_BINDINGS += \
-    loader/appcache/DOMApplicationCache.idl
-
 SOURCES += \
     loader/appcache/ApplicationCache.cpp \
     loader/appcache/ApplicationCacheGroup.cpp \
+    loader/appcache/ApplicationCacheHost.cpp \
     loader/appcache/ApplicationCacheStorage.cpp \
     loader/appcache/ApplicationCacheResource.cpp \
     loader/appcache/DOMApplicationCache.cpp \
@@ -3045,6 +3110,12 @@ idl.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}JS${QMAKE_FILE_BASE}.cpp
 idl.variable_out = GENERATED_SOURCES
 idl.input = IDL_BINDINGS
 idl.commands = perl -I$$PWD/bindings/scripts $$PWD/bindings/scripts/generate-bindings.pl --defines \"$${FEATURE_DEFINES_JAVASCRIPT}\" --generator JS --include $$PWD/dom --include $$PWD/html --include $$PWD/xml --include $$PWD/svg --outputDir $$GENERATED_SOURCES_DIR --preprocessor \"$${QMAKE_MOC} -E\" ${QMAKE_FILE_NAME}
+idl.depends = $$PWD/bindings/scripts/generate-bindings.pl \
+              $$PWD/bindings/scripts/CodeGenerator.pm \
+              $$PWD/bindings/scripts/CodeGeneratorJS.pm \
+              $$PWD/bindings/scripts/IDLParser.pm \
+              $$PWD/bindings/scripts/IDLStructure.pm \
+              $$PWD/bindings/scripts/InFilesParser.pm
 idl.CONFIG += target_predeps
 addExtraCompilerWithHeader(idl)
 
@@ -3082,6 +3153,7 @@ htmlnames.input = HTML_NAMES
 htmlnames.dependency_type = TYPE_C
 htmlnames.CONFIG = target_predeps
 htmlnames.variable_out = GENERATED_SOURCES
+htmlnames.depends = $$PWD/html/HTMLAttributeNames.in
 addExtraCompilerWithHeader(htmlnames)
 
 htmlelementfactory.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLElementFactory.cpp
@@ -3113,7 +3185,7 @@ addExtraCompilerWithHeader(xmlnames)
 
 # GENERATOR 8-A:
 entities.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLEntityNames.c
-entities.commands = gperf -a -L ANSI-C -C -G -c -o -t --key-positions="*" -N findEntity -D -s 2 < $$PWD/html/HTMLEntityNames.gperf > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLEntityNames.c
+entities.commands = gperf -a -L ANSI-C -C -G -c -o -t --includes --key-positions="*" -N findEntity -D -s 2 < $$PWD/html/HTMLEntityNames.gperf > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLEntityNames.c
 entities.input = ENTITIES_GPERF
 entities.dependency_type = TYPE_C
 entities.CONFIG = target_predeps no_link
@@ -3124,7 +3196,7 @@ addExtraCompiler(entities)
 # GENERATOR 8-B:
 doctypestrings.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
 doctypestrings.input = DOCTYPESTRINGS
-doctypestrings.commands = perl -e \"print \'$${LITERAL_HASH}include <string.h>\';\" > ${QMAKE_FILE_OUT} && echo // bogus >> ${QMAKE_FILE_OUT} && gperf -CEot -L ANSI-C --key-positions="*" -N findDoctypeEntry -F ,PubIDInfo::eAlmostStandards,PubIDInfo::eAlmostStandards < ${QMAKE_FILE_NAME} >> ${QMAKE_FILE_OUT}
+doctypestrings.commands = gperf -CEot -L ANSI-C --includes --key-positions="*" -N findDoctypeEntry -F ,PubIDInfo::eAlmostStandards,PubIDInfo::eAlmostStandards < ${QMAKE_FILE_NAME} >> ${QMAKE_FILE_OUT}
 doctypestrings.dependency_type = TYPE_C
 doctypestrings.CONFIG += target_predeps no_link
 doctypestrings.variable_out =
@@ -3133,7 +3205,7 @@ addExtraCompiler(doctypestrings)
 
 # GENERATOR 8-C:
 colordata.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}ColorData.c
-colordata.commands = perl -e \"print \'$${LITERAL_HASH}include <string.h>\';\" > ${QMAKE_FILE_OUT} && echo // bogus >> ${QMAKE_FILE_OUT} && gperf -CDEot -L ANSI-C --key-positions="*" -N findColor -D -s 2 < ${QMAKE_FILE_NAME} >> ${QMAKE_FILE_OUT}
+colordata.commands = gperf -CDEot -L ANSI-C --includes --key-positions="*" -N findColor -D -s 2 < ${QMAKE_FILE_NAME} >> ${QMAKE_FILE_OUT}
 colordata.input = COLORDAT_GPERF
 colordata.CONFIG = target_predeps no_link
 colordata.variable_out =
@@ -3160,7 +3232,20 @@ xpathbison.dependency_type = TYPE_C
 xpathbison.variable_out = GENERATED_SOURCES
 addExtraCompilerWithHeader(xpathbison)
 
-include($$PWD/../WebKit/qt/Api/headers.pri, "", true)
+# GENERATOR 11: WebKit Version
+# The appropriate Apple-maintained Version.xcconfig file for WebKit version information is in WebKit/mac/Configurations/.
+webkitversion.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}WebKitVersion.h
+webkitversion.commands = perl $$PWD/../WebKit/scripts/generate-webkitversion.pl --config $$PWD/../WebKit/mac/Configurations/Version.xcconfig --outputDir $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}
+WEBKITVERSION_SCRIPT = $$PWD/../WebKit/scripts/generate-webkitversion.pl
+webkitversion.input = WEBKITVERSION_SCRIPT
+webkitversion.CONFIG = target_predeps
+webkitversion.depend = $$PWD/../WebKit/scripts/generate-webkitversion.pl
+webkitversion.variable_out = GENERATED_SOURCES
+webkitversion.clean = ${QMAKE_VAR_GENERATED_SOURCES_DIR_SLASH}WebKitVersion.h
+addExtraCompiler(webkitversion)
+
+
+include($$PWD/../WebKit/qt/Api/headers.pri)
 HEADERS += $$WEBKIT_API_HEADERS
 !CONFIG(QTDIR_build) {
     target.path = $$[QT_INSTALL_LIBS]
@@ -3195,10 +3280,10 @@ HEADERS += $$WEBKIT_API_HEADERS
             !build_pass {
                 message("Building QtWebKit as a framework, as that's how Qt was built. You can")
                 message("override this by passing CONFIG+=webkit_no_framework to build-webkit.")
+
+                CONFIG += build_all
             } else {
-                debug_and_release:CONFIG(debug, debug|release) {
-                    TARGET = $$qtLibraryTarget($$TARGET)
-                }
+                debug_and_release:TARGET = $$qtLibraryTarget($$TARGET)
             }
 
             CONFIG += lib_bundle qt_no_framework_direct_includes qt_framework
@@ -3209,6 +3294,7 @@ HEADERS += $$WEBKIT_API_HEADERS
         }
 
         QMAKE_LFLAGS_SONAME = "$${QMAKE_LFLAGS_SONAME}$${DESTDIR}$${QMAKE_DIR_SEP}"
+        LIBS += -framework Carbon -framework AppKit
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/WebCorePrefix.h b/src/3rdparty/webkit/WebCore/WebCorePrefix.h
index c0d1e70..6c8e200 100644
--- a/src/3rdparty/webkit/WebCore/WebCorePrefix.h
+++ b/src/3rdparty/webkit/WebCore/WebCorePrefix.h
@@ -113,6 +113,13 @@
 #include <stdio.h>
 #else
 #include <CoreServices/CoreServices.h>
+
+#if defined(WIN32) || defined(_WIN32)
+/* Including CoreServices.h on Windows doesn't include CFNetwork.h, so we do
+   it explicitly here to make Windows more consistent with Mac. */
+#include <CFNetwork/CFNetwork.h>
+#endif
+
 #endif
 #endif
 
@@ -125,8 +132,11 @@
 #define delete ("if you use new/delete make sure to include config.h at the top of the file"()) 
 #endif
 
-/* Work around a bug with C++ library that screws up Objective-C++ when exception support is disabled. */
-#if defined(__APPLE__)
+/* When C++ exceptions are disabled, the C++ library defines |try| and |catch|
+ * to allow C++ code that expects exceptions to build. These definitions
+ * interfere with Objective-C++ uses of Objective-C exception handlers, which
+ * use |@try| and |@catch|. As a workaround, undefine these macros. */
+#ifdef __OBJC__
 #undef try
 #undef catch
 #endif
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.cpp b/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.cpp
index ec250ed..55199a3 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -36,13 +36,22 @@
 #include "AccessibilityListBox.h"
 #include "AccessibilityListBoxOption.h"
 #include "AccessibilityImageMapLink.h"
+#include "AccessibilityMediaControls.h"
 #include "AccessibilityRenderObject.h"
+#include "AccessibilitySlider.h"
 #include "AccessibilityTable.h"
 #include "AccessibilityTableCell.h"
 #include "AccessibilityTableColumn.h"
 #include "AccessibilityTableHeaderContainer.h"
 #include "AccessibilityTableRow.h"
+#include "FocusController.h"
+#include "Frame.h"
 #include "HTMLNames.h"
+#if ENABLE(VIDEO)
+#include "MediaControlElements.h"
+#endif
+#include "InputElement.h"
+#include "Page.h"
 #include "RenderObject.h"
 #include "RenderView.h"
 
@@ -71,6 +80,32 @@ AXObjectCache::~AXObjectCache()
     }
 }
 
+AccessibilityObject* AXObjectCache::focusedUIElementForPage(const Page* page)
+{
+    // get the focused node in the page
+    Document* focusedDocument = page->focusController()->focusedOrMainFrame()->document();
+    Node* focusedNode = focusedDocument->focusedNode();
+    if (!focusedNode)
+        focusedNode = focusedDocument;
+
+    RenderObject* focusedNodeRenderer = focusedNode->renderer();
+    if (!focusedNodeRenderer)
+        return 0;
+
+    AccessibilityObject* obj = focusedNodeRenderer->document()->axObjectCache()->getOrCreate(focusedNodeRenderer);
+
+    if (obj->shouldFocusActiveDescendant()) {
+        if (AccessibilityObject* descendant = obj->activeDescendant())
+            obj = descendant;
+    }
+
+    // the HTML element, for example, is focusable but has an AX object that is ignored
+    if (obj->accessibilityIsIgnored())
+        obj = obj->parentObjectUnignored();
+
+    return obj;
+}
+
 AccessibilityObject* AXObjectCache::get(RenderObject* renderer)
 {
     if (!renderer)
@@ -106,7 +141,7 @@ AccessibilityObject* AXObjectCache::getOrCreate(RenderObject* renderer)
         RefPtr<AccessibilityObject> newObj = 0;
         if (renderer->isListBox())
             newObj = AccessibilityListBox::create(renderer);
-        else if (node && (node->hasTagName(ulTag) || node->hasTagName(olTag) || node->hasTagName(dlTag)))
+        else if (node && (nodeIsAriaType(node, "list") || node->hasTagName(ulTag) || node->hasTagName(olTag) || node->hasTagName(dlTag)))
             newObj = AccessibilityList::create(renderer);
         
         // aria tables
@@ -125,6 +160,16 @@ AccessibilityObject* AXObjectCache::getOrCreate(RenderObject* renderer)
         else if (renderer->isTableCell())
             newObj = AccessibilityTableCell::create(renderer);
 
+#if ENABLE(VIDEO)
+        // media controls
+        else if (renderer->node() && renderer->node()->isMediaControlElement())
+            newObj = AccessibilityMediaControl::create(renderer);
+#endif
+
+        // input type=range
+        else if (renderer->isSlider())
+            newObj = AccessibilitySlider::create(renderer);
+
         else
             newObj = AccessibilityRenderObject::create(renderer);
         
@@ -157,7 +202,10 @@ AccessibilityObject* AXObjectCache::getOrCreate(AccessibilityRole role)
             break;            
         case TableHeaderContainerRole:
             obj = AccessibilityTableHeaderContainer::create();
-            break;            
+            break;   
+        case SliderThumbRole:
+            obj = AccessibilitySliderThumb::create();
+            break;
         default:
             obj = 0;
     }
@@ -204,6 +252,23 @@ void AXObjectCache::remove(RenderObject* renderer)
     m_renderObjectMapping.remove(renderer);
 }
 
+#if !PLATFORM(WIN)
+AXID AXObjectCache::platformGenerateAXID() const
+{
+    static AXID lastUsedID = 0;
+
+    // Generate a new ID.
+    AXID objID = lastUsedID;
+    do {
+        ++objID;
+    } while (objID == 0 || HashTraits<AXID>::isDeletedValue(objID) || m_idsInUse.contains(objID));
+
+    lastUsedID = objID;
+
+    return objID;
+}
+#endif
+
 AXID AXObjectCache::getAXID(AccessibilityObject* obj)
 {
     // check for already-assigned ID
@@ -212,15 +277,10 @@ AXID AXObjectCache::getAXID(AccessibilityObject* obj)
         ASSERT(m_idsInUse.contains(objID));
         return objID;
     }
-    
-    // generate a new ID
-    static AXID lastUsedID = 0;
-    objID = lastUsedID;
-    do
-        ++objID;
-    while (objID == 0 || HashTraits<AXID>::isDeletedValue(objID) || m_idsInUse.contains(objID));
+
+    objID = platformGenerateAXID();
+
     m_idsInUse.add(objID);
-    lastUsedID = objID;
     obj->setAXObjectID(objID);
     
     return objID;
@@ -260,7 +320,7 @@ void AXObjectCache::notificationPostTimerFired(Timer<AXObjectCache>*)
 
     unsigned i = 0, count = m_notificationsToPost.size();
     for (i = 0; i < count; ++i) {
-        AccessibilityObject* obj = m_notificationsToPost[i].first;
+        AccessibilityObject* obj = m_notificationsToPost[i].first.get();
 #ifndef NDEBUG
         // Make sure none of the render views are in the process of being layed out.
         // Notifications should only be sent after the renderer has finished
@@ -279,7 +339,7 @@ void AXObjectCache::notificationPostTimerFired(Timer<AXObjectCache>*)
 }
     
 #if HAVE(ACCESSIBILITY)
-void AXObjectCache::postNotification(RenderObject* renderer, const String& message, bool postToElement)
+void AXObjectCache::postNotification(RenderObject* renderer, AXNotification notification, bool postToElement)
 {
     // Notifications for text input objects are sent to that object.
     // All others are sent to the top WebArea.
@@ -307,14 +367,14 @@ void AXObjectCache::postNotification(RenderObject* renderer, const String& messa
     if (!obj)
         return;
 
-    m_notificationsToPost.append(make_pair(obj.get(), message));
+    m_notificationsToPost.append(make_pair(obj, notification));
     if (!m_notificationPostTimer.isActive())
         m_notificationPostTimer.startOneShot(0);
 }
 
 void AXObjectCache::selectedChildrenChanged(RenderObject* renderer)
 {
-    postNotification(renderer, "AXSelectedChildrenChanged", true);
+    postNotification(renderer, AXSelectedChildrenChanged, true);
 }
 #endif
 
@@ -334,8 +394,64 @@ void AXObjectCache::handleAriaRoleChanged(RenderObject* renderer)
         return;
     AccessibilityObject* obj = getOrCreate(renderer);
     if (obj && obj->isAccessibilityRenderObject())
-        static_cast<AccessibilityRenderObject*>(obj)->setAriaRole();
+        static_cast<AccessibilityRenderObject*>(obj)->updateAccessibilityRole();
 }
 #endif
+    
+VisiblePosition AXObjectCache::visiblePositionForTextMarkerData(TextMarkerData& textMarkerData)
+{
+    VisiblePosition visiblePos = VisiblePosition(textMarkerData.node, textMarkerData.offset, textMarkerData.affinity);
+    Position deepPos = visiblePos.deepEquivalent();
+    if (deepPos.isNull())
+        return VisiblePosition();
+    
+    RenderObject* renderer = deepPos.node()->renderer();
+    if (!renderer)
+        return VisiblePosition();
+    
+    AXObjectCache* cache = renderer->document()->axObjectCache();
+    if (!cache->isIDinUse(textMarkerData.axID))
+        return VisiblePosition();
+    
+    if (deepPos.node() != textMarkerData.node || deepPos.deprecatedEditingOffset() != textMarkerData.offset)
+        return VisiblePosition();
+    
+    return visiblePos;
+}
 
+void AXObjectCache::textMarkerDataForVisiblePosition(TextMarkerData& textMarkerData, const VisiblePosition& visiblePos)
+{
+    // This memory must be bzero'd so instances of TextMarkerData can be tested for byte-equivalence.
+    // This also allows callers to check for failure by looking at textMarkerData upon return.
+    memset(&textMarkerData, 0, sizeof(TextMarkerData));
+    
+    if (visiblePos.isNull())
+        return;
+    
+    Position deepPos = visiblePos.deepEquivalent();
+    Node* domNode = deepPos.node();
+    ASSERT(domNode);
+    if (!domNode)
+        return;
+    
+    if (domNode->isHTMLElement()) {
+        InputElement* inputElement = toInputElement(static_cast<Element*>(domNode));
+        if (inputElement && inputElement->isPasswordField())
+            return;
+    }
+    
+    // locate the renderer, which must exist for a visible dom node
+    RenderObject* renderer = domNode->renderer();
+    ASSERT(renderer);
+    
+    // find or create an accessibility object for this renderer
+    AXObjectCache* cache = renderer->document()->axObjectCache();
+    RefPtr<AccessibilityObject> obj = cache->getOrCreate(renderer);
+    
+    textMarkerData.axID = obj.get()->axObjectID();
+    textMarkerData.node = domNode;
+    textMarkerData.offset = deepPos.deprecatedEditingOffset();
+    textMarkerData.affinity = visiblePos.affinity();    
+}
+    
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.h b/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.h
index 904283c..5a75f84 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -42,13 +42,11 @@ class WebCoreTextMarker;
 
 namespace WebCore {
 
+    class Node;
+    class Page;
     class RenderObject;
     class String;
     class VisiblePosition;
-    class AccessibilityObject;
-    class Node;
-    
-    typedef unsigned AXID;
 
     struct TextMarkerData  {
         AXID axID;
@@ -61,7 +59,9 @@ namespace WebCore {
     public:
         AXObjectCache();
         ~AXObjectCache();
-        
+
+        static AccessibilityObject* focusedUIElementForPage(const Page*);
+
         // to be used with render objects
         AccessibilityObject* getOrCreate(RenderObject*);
         
@@ -76,16 +76,13 @@ namespace WebCore {
 
         void detachWrapper(AccessibilityObject*);
         void attachWrapper(AccessibilityObject*);
-        void postNotification(RenderObject*, const String&, bool postToElement);
-        void postPlatformNotification(AccessibilityObject*, const String&);
         void childrenChanged(RenderObject*);
         void selectedChildrenChanged(RenderObject*);
         void handleActiveDescendantChanged(RenderObject*);
         void handleAriaRoleChanged(RenderObject*);
-        void handleFocusedUIElementChanged();
-#if PLATFORM(GTK)
-        void handleFocusedUIElementChangedWithRenderers(RenderObject*, RenderObject*);
-#endif
+        void handleFocusedUIElementChanged(RenderObject* oldFocusedRenderer, RenderObject* newFocusedRenderer);
+        void handleScrolledToAnchor(const Node* anchorNode);
+
         static void enableAccessibility() { gAccessibilityEnabled = true; }
         static void enableEnhancedUserInterfaceAccessibility() { gAccessibilityEnhancedUserInterfaceEnabled = true; }
         
@@ -94,6 +91,28 @@ namespace WebCore {
 
         void removeAXID(AccessibilityObject*);
         bool isIDinUse(AXID id) const { return m_idsInUse.contains(id); }
+        AXID platformGenerateAXID() const;
+        AccessibilityObject* objectFromAXID(AXID id) const { return m_objects.get(id).get(); }
+
+        // Text marker utilities.
+        static void textMarkerDataForVisiblePosition(TextMarkerData&, const VisiblePosition&);
+        static VisiblePosition visiblePositionForTextMarkerData(TextMarkerData&);
+
+        enum AXNotification {
+            AXCheckedStateChanged,
+            AXFocusedUIElementChanged,
+            AXLayoutComplete,
+            AXLoadComplete,
+            AXSelectedChildrenChanged,
+            AXSelectedTextChanged,
+            AXValueChanged,
+            AXScrolledToAnchor,
+        };
+        
+        void postNotification(RenderObject*, AXNotification, bool postToElement);
+
+    protected:
+        void postPlatformNotification(AccessibilityObject*, AXNotification);
 
     private:
         HashMap<AXID, RefPtr<AccessibilityObject> > m_objects;
@@ -104,7 +123,7 @@ namespace WebCore {
         HashSet<AXID> m_idsInUse;
         
         Timer<AXObjectCache> m_notificationPostTimer;
-        Vector<pair<AccessibilityObject*, const String> > m_notificationsToPost;
+        Vector<pair<RefPtr<AccessibilityObject>, AXNotification> > m_notificationsToPost;
         void notificationPostTimerFired(Timer<AXObjectCache>*);
         
         AXID getAXID(AccessibilityObject*);
@@ -114,15 +133,13 @@ namespace WebCore {
 #if !HAVE(ACCESSIBILITY)
     inline void AXObjectCache::handleActiveDescendantChanged(RenderObject*) { }
     inline void AXObjectCache::handleAriaRoleChanged(RenderObject*) { }
-    inline void AXObjectCache::handleFocusedUIElementChanged() { }
     inline void AXObjectCache::detachWrapper(AccessibilityObject*) { }
     inline void AXObjectCache::attachWrapper(AccessibilityObject*) { }
     inline void AXObjectCache::selectedChildrenChanged(RenderObject*) { }
-    inline void AXObjectCache::postNotification(RenderObject*, const String&, bool postToElement) { }
-    inline void AXObjectCache::postPlatformNotification(AccessibilityObject*, const String&) { }
-#if PLATFORM(GTK)
-    inline void AXObjectCache::handleFocusedUIElementChangedWithRenderers(RenderObject*, RenderObject*) { }
-#endif
+    inline void AXObjectCache::postNotification(RenderObject*, AXNotification, bool postToElement) { }
+    inline void AXObjectCache::postPlatformNotification(AccessibilityObject*, AXNotification) { }
+    inline void AXObjectCache::handleFocusedUIElementChanged(RenderObject*, RenderObject*) { }
+    inline void AXObjectCache::handleScrolledToAnchor(const Node*) { }
 #endif
 
 }
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.cpp
index 3b7c7a4..95239b0 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.cpp
@@ -69,6 +69,13 @@ bool AccessibilityList::isUnorderedList() const
         return false;
     
     Node* node = m_renderer->node();
+
+    // The ARIA spec says the "list" role is supposed to mimic a UL or OL tag.
+    // Since it can't be both, it's probably OK to say that it's an un-ordered list.
+    // On the Mac, there's no distinction to the client.
+    if (ariaRoleAttribute() == ListRole)
+        return true;
+    
     return node && node->hasTagName(ulTag);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.cpp
index e38aff5..1f37481 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.cpp
@@ -135,7 +135,7 @@ void AccessibilityListBox::visibleChildren(AccessibilityChildrenVector& result)
     
     unsigned length = m_children.size();
     for (unsigned i = 0; i < length; i++) {
-        if (static_cast<RenderListBox*>(m_renderer)->listIndexIsVisible(i))
+        if (toRenderListBox(m_renderer)->listIndexIsVisible(i))
             result.append(m_children[i]);
     }
 }
@@ -168,7 +168,7 @@ AccessibilityObject* AccessibilityListBox::doAccessibilityHitTest(const IntPoint
     const Vector<Element*>& listItems = static_cast<HTMLSelectElement*>(node)->listItems();
     unsigned length = listItems.size();
     for (unsigned i = 0; i < length; i++) {
-        IntRect rect = static_cast<RenderListBox*>(m_renderer)->itemBoundingBoxRect(parentRect.x(), parentRect.y(), i);
+        IntRect rect = toRenderListBox(m_renderer)->itemBoundingBoxRect(parentRect.x(), parentRect.y(), i);
         // The cast to HTMLElement below is safe because the only other possible listItem type
         // would be a WMLElement, but WML builds don't use accessbility features at all.
         if (rect.contains(point))
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.cpp
index a5cd5da..6e3bf98 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.cpp
@@ -100,7 +100,7 @@ IntRect AccessibilityListBoxOption::elementRect() const
     IntRect parentRect = listBoxRenderer->document()->axObjectCache()->getOrCreate(listBoxRenderer)->boundingBoxRect();
     int index = listBoxOptionIndex();
     if (index != -1)
-        rect = static_cast<RenderListBox*>(listBoxRenderer)->itemBoundingBoxRect(parentRect.x(), parentRect.y(), index);
+        rect = toRenderListBox(listBoxRenderer)->itemBoundingBoxRect(parentRect.x(), parentRect.y(), index);
     
     return rect;
 }
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.cpp
new file mode 100644
index 0000000..a807ab9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.cpp
@@ -0,0 +1,320 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#include "config.h"
+
+#if ENABLE(VIDEO)
+
+#include "AccessibilityMediaControls.h"
+
+#include "AXObjectCache.h"
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
+#include "LocalizedStrings.h"
+#include "MediaControlElements.h"
+#include "RenderObject.h"
+#include "RenderSlider.h"
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+
+AccessibilityMediaControl::AccessibilityMediaControl(RenderObject* renderer)
+    : AccessibilityRenderObject(renderer)
+{
+}
+
+PassRefPtr<AccessibilityObject> AccessibilityMediaControl::create(RenderObject* renderer)
+{
+    ASSERT(renderer->node() && renderer->node()->isMediaControlElement());
+
+    Node* node = renderer->node();
+    MediaControlElementType controlType;
+
+    if (node->hasTagName(inputTag))
+        controlType = static_cast<MediaControlInputElement*>(node)->displayType();
+    else
+        controlType = static_cast<MediaControlElement*>(node)->displayType();
+
+    PassRefPtr<AccessibilityObject> obj;
+    switch (controlType) {
+    case MediaSlider:
+        obj = AccessibilityMediaTimeline::create(renderer);
+        break;
+
+    case MediaCurrentTimeDisplay:
+    case MediaTimeRemainingDisplay:
+        obj = AccessibilityMediaTimeDisplay::create(renderer);
+        break;
+
+    case MediaControlsPanel:
+        obj = AccessibilityMediaControlsContainer::create(renderer);
+        break;
+
+    default:
+        obj = adoptRef(new AccessibilityMediaControl(renderer));
+        break;
+    }
+
+    return obj;
+}
+
+MediaControlElementType AccessibilityMediaControl::controlType() const
+{
+    if (!renderer() || !renderer()->node())
+        return MediaTimelineContainer;  // Timeline container is not accessible.
+
+    Node* node = renderer()->node();
+
+    if (node->hasTagName(inputTag))
+        return static_cast<MediaControlInputElement*>(node)->displayType();
+
+    return static_cast<MediaControlElement*>(node)->displayType();
+}
+
+String AccessibilityMediaControl::controlTypeName() const
+{
+    DEFINE_STATIC_LOCAL(const String, mediaMuteButtonName, ("MuteButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaPlayButtonName, ("PlayButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaSeekBackButtonName, ("SeekBackButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaSeekForwardButtonName, ("SeekForwardButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaRewindButtonName, ("RewindButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaReturnToRealtimeButtonName, ("ReturnToRealtimeButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaUnMuteButtonName, ("UnMuteButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaPauseButtonName, ("PauseButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaStatusDisplayName, ("StatusDisplay"));
+    DEFINE_STATIC_LOCAL(const String, mediaCurrentTimeDisplay, ("CurrentTimeDisplay"));
+    DEFINE_STATIC_LOCAL(const String, mediaTimeRemainingDisplay, ("TimeRemainingDisplay"));
+
+    switch (controlType()) {
+    case MediaMuteButton:
+        return mediaMuteButtonName;
+    case MediaPlayButton:
+        return mediaPlayButtonName;
+    case MediaSeekBackButton:
+        return mediaSeekBackButtonName;
+    case MediaSeekForwardButton:
+        return mediaSeekForwardButtonName;
+    case MediaRewindButton:
+        return mediaRewindButtonName;
+    case MediaReturnToRealtimeButton:
+        return mediaReturnToRealtimeButtonName;
+    case MediaUnMuteButton:
+        return mediaUnMuteButtonName;
+    case MediaPauseButton:
+        return mediaPauseButtonName;
+    case MediaStatusDisplay:
+        return mediaStatusDisplayName;
+    case MediaCurrentTimeDisplay:
+        return mediaCurrentTimeDisplay;
+    case MediaTimeRemainingDisplay:
+        return mediaTimeRemainingDisplay;
+
+    default:
+        break;
+    }
+
+    return String();
+}
+
+String AccessibilityMediaControl::title() const
+{
+    DEFINE_STATIC_LOCAL(const String, controlsPanel, ("ControlsPanel"));
+
+    if (controlType() == MediaControlsPanel)
+        return localizedMediaControlElementString(controlsPanel);
+
+    return AccessibilityRenderObject::title();
+}
+
+String AccessibilityMediaControl::accessibilityDescription() const
+{
+    return localizedMediaControlElementString(controlTypeName());
+}
+
+String AccessibilityMediaControl::helpText() const
+{
+    return localizedMediaControlElementHelpText(controlTypeName());
+}
+
+bool AccessibilityMediaControl::accessibilityIsIgnored() const
+{
+    if (!m_renderer || !m_renderer->style() || m_renderer->style()->visibility() != VISIBLE || controlType() == MediaTimelineContainer)
+        return true;
+
+    return false;
+}
+
+AccessibilityRole AccessibilityMediaControl::roleValue() const
+{
+    switch (controlType()) {
+    case MediaFullscreenButton:
+    case MediaMuteButton:
+    case MediaPlayButton:
+    case MediaSeekBackButton:
+    case MediaSeekForwardButton:
+    case MediaRewindButton:
+    case MediaReturnToRealtimeButton:
+    case MediaUnMuteButton:
+    case MediaPauseButton:
+        return ButtonRole;
+
+    case MediaStatusDisplay:
+        return StaticTextRole;
+
+    case MediaTimelineContainer:
+        return GroupRole;
+
+    default:
+        break;
+    }
+
+    return UnknownRole;
+}
+
+
+
+//
+// AccessibilityMediaControlsContainer
+
+AccessibilityMediaControlsContainer::AccessibilityMediaControlsContainer(RenderObject* renderer)
+    : AccessibilityMediaControl(renderer)
+{
+}
+
+PassRefPtr<AccessibilityObject> AccessibilityMediaControlsContainer::create(RenderObject* renderer)
+{
+    return adoptRef(new AccessibilityMediaControlsContainer(renderer));
+}
+
+String AccessibilityMediaControlsContainer::accessibilityDescription() const
+{
+    return localizedMediaControlElementString(elementTypeName());
+}
+
+String AccessibilityMediaControlsContainer::helpText() const
+{
+    return localizedMediaControlElementHelpText(elementTypeName());
+}
+
+bool AccessibilityMediaControlsContainer::controllingVideoElement() const
+{
+    if (!m_renderer->node())
+        return true;
+
+    MediaControlTimeDisplayElement* element = static_cast<MediaControlTimeDisplayElement*>(m_renderer->node());
+
+    return element->mediaElement()->isVideo();
+}
+
+const String AccessibilityMediaControlsContainer::elementTypeName() const
+{
+    DEFINE_STATIC_LOCAL(const String, videoElement, ("VideoElement"));
+    DEFINE_STATIC_LOCAL(const String, audioElement, ("AudioElement"));
+
+    if (controllingVideoElement())
+        return videoElement;
+    return audioElement;
+}
+
+
+//
+// AccessibilityMediaTimeline
+
+AccessibilityMediaTimeline::AccessibilityMediaTimeline(RenderObject* renderer)
+    : AccessibilitySlider(renderer)
+{
+}
+
+PassRefPtr<AccessibilityObject> AccessibilityMediaTimeline::create(RenderObject* renderer)
+{
+    return adoptRef(new AccessibilityMediaTimeline(renderer));
+}
+
+String AccessibilityMediaTimeline::valueDescription() const
+{
+    ASSERT(m_renderer->node()->hasTagName(inputTag));
+
+    float time = static_cast<HTMLInputElement*>(m_renderer->node())->value().toFloat();
+    return localizedMediaTimeDescription(time);
+}
+
+String AccessibilityMediaTimeline::helpText() const
+{
+    DEFINE_STATIC_LOCAL(const String, slider, ("Slider"));
+    return localizedMediaControlElementHelpText(slider);
+}
+
+
+//
+// AccessibilityMediaTimeDisplay
+
+AccessibilityMediaTimeDisplay::AccessibilityMediaTimeDisplay(RenderObject* renderer)
+    : AccessibilityMediaControl(renderer)
+{
+}
+
+PassRefPtr<AccessibilityObject> AccessibilityMediaTimeDisplay::create(RenderObject* renderer)
+{
+    return adoptRef(new AccessibilityMediaTimeDisplay(renderer));
+}
+
+bool AccessibilityMediaTimeDisplay::accessibilityIsIgnored() const
+{
+    if (!m_renderer || !m_renderer->style() || m_renderer->style()->visibility() != VISIBLE)
+        return true;
+
+    return !m_renderer->style()->width().value();
+}
+
+String AccessibilityMediaTimeDisplay::accessibilityDescription() const
+{
+    DEFINE_STATIC_LOCAL(const String, currentTimeDisplay, ("CurrentTimeDisplay"));
+    DEFINE_STATIC_LOCAL(const String, timeRemainingDisplay, ("TimeRemainingDisplay"));
+
+    if (controlType() == MediaCurrentTimeDisplay)
+        return localizedMediaControlElementString(currentTimeDisplay);
+
+    return localizedMediaControlElementString(timeRemainingDisplay);
+}
+
+String AccessibilityMediaTimeDisplay::stringValue() const
+{
+    if (!m_renderer || !m_renderer->node())
+        return String();
+
+    MediaControlTimeDisplayElement* element = static_cast<MediaControlTimeDisplayElement*>(m_renderer->node());
+    float time = element->currentValue();
+    return localizedMediaTimeDescription(fabsf(time));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(VIDEO)
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.h
new file mode 100644
index 0000000..9b306fd
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.h
@@ -0,0 +1,117 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#ifndef AccessibilityMediaControls_h
+#define AccessibilityMediaControls_h
+
+#if ENABLE(VIDEO)
+
+#include "AccessibilitySlider.h"
+#include "MediaControlElements.h"
+
+namespace WebCore {
+
+    class AccessibilityMediaControl : public AccessibilityRenderObject {
+
+    public:
+        static PassRefPtr<AccessibilityObject> create(RenderObject*);
+        virtual ~AccessibilityMediaControl() { }
+
+        virtual AccessibilityRole roleValue() const;
+        virtual bool accessibilityIsIgnored() const;
+
+        virtual String title() const;
+        virtual String accessibilityDescription() const;
+        virtual String helpText() const;
+
+    protected:
+        AccessibilityMediaControl(RenderObject*);
+        MediaControlElementType controlType() const;
+        String controlTypeName() const;
+    };
+
+
+    class AccessibilityMediaTimeline : public AccessibilitySlider {
+
+    public:
+        static PassRefPtr<AccessibilityObject> create(RenderObject*);
+        virtual ~AccessibilityMediaTimeline() { }
+
+        virtual bool isMediaTimeline() const { return true; }
+
+        virtual String helpText() const;
+        virtual String valueDescription() const;
+        const AtomicString& getAttribute(const QualifiedName& attribute) const;
+
+    private:
+        AccessibilityMediaTimeline(RenderObject*);
+    };
+
+
+    class AccessibilityMediaControlsContainer : public AccessibilityMediaControl {
+
+    public:
+        static PassRefPtr<AccessibilityObject> create(RenderObject*);
+        virtual ~AccessibilityMediaControlsContainer() { }
+
+        virtual AccessibilityRole roleValue() const { return ToolbarRole; }
+        virtual bool accessibilityIsIgnored() const { return false; }
+
+        virtual String helpText() const;
+        virtual String accessibilityDescription() const;
+
+    private:
+        AccessibilityMediaControlsContainer(RenderObject*);
+        bool controllingVideoElement() const;
+        const String elementTypeName() const;
+    };
+
+
+    class AccessibilityMediaTimeDisplay : public AccessibilityMediaControl {
+
+    public:
+        static PassRefPtr<AccessibilityObject> create(RenderObject*);
+        virtual ~AccessibilityMediaTimeDisplay() { }
+
+        virtual AccessibilityRole roleValue() const { return StaticTextRole; }
+        virtual bool accessibilityIsIgnored() const;
+
+        virtual String stringValue() const;
+        virtual String accessibilityDescription() const;
+
+    private:
+        AccessibilityMediaTimeDisplay(RenderObject*);
+    };
+
+
+} // namespace WebCore
+
+#endif // ENABLE(VIDEO)
+
+#endif // AccessibilityMediaControls_h
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.cpp
index f1d829c..d7093e4 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -41,6 +41,7 @@
 #include "NotImplemented.h"
 #include "Page.h"
 #include "RenderImage.h"
+#include "RenderListItem.h"
 #include "RenderListMarker.h"
 #include "RenderMenuList.h"
 #include "RenderTextControl.h"
@@ -62,6 +63,7 @@ using namespace HTMLNames;
 AccessibilityObject::AccessibilityObject()
     : m_id(0)
     , m_haveChildren(false)
+    , m_role(UnknownRole)
 #if PLATFORM(GTK)
     , m_wrapper(0)
 #endif
@@ -88,6 +90,35 @@ AccessibilityObject* AccessibilityObject::parentObjectUnignored() const
     return parent;
 }
 
+AccessibilityObject* AccessibilityObject::firstAccessibleObjectFromNode(const Node* node)
+{
+    ASSERT(AXObjectCache::accessibilityEnabled());
+
+    if (!node)
+        return 0;
+
+    Document* document = node->document();
+    if (!document)
+        return 0;
+
+    AXObjectCache* cache = document->axObjectCache();
+
+    AccessibilityObject* accessibleObject = cache->getOrCreate(node->renderer());
+    while (accessibleObject && accessibleObject->accessibilityIsIgnored()) {
+        node = node->traverseNextNode();
+
+        while (node && !node->renderer())
+            node = node->traverseNextSibling();
+
+        if (!node)
+            return 0;
+
+        accessibleObject = cache->getOrCreate(node->renderer());
+    }
+
+    return accessibleObject;
+}
+
 bool AccessibilityObject::isARIAInput(AccessibilityRole ariaRole)
 {
     return ariaRole == RadioButtonRole || ariaRole == CheckBoxRole || ariaRole == TextFieldRole;
@@ -362,6 +393,49 @@ static bool replacedNodeNeedsCharacter(Node* replacedNode)
     return true;
 }
 
+// Finds a RenderListItem parent give a node.
+RenderListItem* AccessibilityObject::renderListItemContainerForNode(Node* node) const
+{
+    for (Node* stringNode = node; stringNode; stringNode = stringNode->parent()) {
+        RenderObject* renderObject = stringNode->renderer();
+        if (!renderObject || !renderObject->isListItem())
+            continue;
+        
+        return toRenderListItem(renderObject);
+    }
+    
+    return 0;
+}
+    
+// Returns the text associated with a list marker if this node is contained within a list item.
+String AccessibilityObject::listMarkerTextForNodeAndPosition(Node* node, const VisiblePosition& visiblePositionStart) const
+{
+    // If the range does not contain the start of the line, the list marker text should not be included.
+    if (!isStartOfLine(visiblePositionStart))
+        return String();
+
+    RenderListItem* listItem = renderListItemContainerForNode(node);
+    if (!listItem)
+        return String();
+        
+    // If this is in a list item, we need to manually add the text for the list marker 
+    // because a RenderListMarker does not have a Node equivalent and thus does not appear
+    // when iterating text.
+    const String& markerText = listItem->markerText();
+    if (markerText.isEmpty())
+        return String();
+                
+    // Append text, plus the period that follows the text.
+    // FIXME: Not all list marker styles are followed by a period, but this
+    // sounds much better when there is a synthesized pause because of a period.
+    Vector<UChar> resultVector;
+    resultVector.append(markerText.characters(), markerText.length());
+    resultVector.append('.');
+    resultVector.append(' ');
+    
+    return String::adopt(resultVector);
+}
+    
 String AccessibilityObject::stringForVisiblePositionRange(const VisiblePositionRange& visiblePositionRange) const
 {
     if (visiblePositionRange.isNull())
@@ -372,6 +446,11 @@ String AccessibilityObject::stringForVisiblePositionRange(const VisiblePositionR
     for (TextIterator it(range.get()); !it.atEnd(); it.advance()) {
         // non-zero length means textual node, zero length means replaced node (AKA "attachments" in AX)
         if (it.length() != 0) {
+            // Add a textual representation for list marker text
+            String listMarkerText = listMarkerTextForNodeAndPosition(it.node(), visiblePositionRange.start);
+            if (!listMarkerText.isEmpty())
+                resultVector.append(listMarkerText.characters(), listMarkerText.length());
+                
             resultVector.append(it.characters(), it.length());
         } else {
             // locate the node and starting offset for this replaced range
@@ -657,6 +736,24 @@ void AccessibilityObject::clearChildren()
     m_children.clear();
 }
 
+AccessibilityObject* AccessibilityObject::anchorElementForNode(Node* node)
+{
+    RenderObject* obj = node->renderer();
+    if (!obj)
+        return 0;
+    
+    RefPtr<AccessibilityObject> axObj = obj->document()->axObjectCache()->getOrCreate(obj);
+    Element* anchor = axObj->anchorElement();
+    if (!anchor)
+        return 0;
+    
+    RenderObject* anchorRenderer = anchor->renderer();
+    if (!anchorRenderer)
+        return 0;
+    
+    return anchorRenderer->document()->axObjectCache()->getOrCreate(anchorRenderer);
+}
+    
 const String& AccessibilityObject::actionVerb() const
 {
     // FIXME: Need to add verbs for select elements.
@@ -685,5 +782,18 @@ const String& AccessibilityObject::actionVerb() const
             return noAction;
     }
 }
+ 
+// Lacking concrete evidence of orientation, horizontal means width > height. vertical is height > width;
+AccessibilityOrientation AccessibilityObject::orientation() const
+{
+    IntRect bounds = elementRect();
+    if (bounds.size().width() > bounds.size().height())
+        return AccessibilityOrientationHorizontal;
+    if (bounds.size().height() > bounds.size().width())
+        return AccessibilityOrientationVertical;
+
+    // A tie goes to horizontal.
+    return AccessibilityOrientationHorizontal;
+}
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h
index 319ace9..8762fd8 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nuanti Ltd.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -40,7 +40,7 @@
 
 #if PLATFORM(MAC)
 #include <wtf/RetainPtr.h>
-#elif PLATFORM(WIN)
+#elif PLATFORM(WIN) && !PLATFORM(WINCE)
 #include "AccessibilityObjectWrapperWin.h"
 #include "COMPtr.h"
 #elif PLATFORM(CHROMIUM)
@@ -86,10 +86,13 @@ class IntPoint;
 class IntSize;
 class Node;
 class RenderObject;
+class RenderListItem;
 class VisibleSelection;
 class String;
 class Widget;
 
+typedef unsigned AXID;
+
 enum AccessibilityRole {
     UnknownRole = 1,
     ButtonRole,
@@ -155,9 +158,36 @@ enum AccessibilityRole {
     TableHeaderContainerRole,
     DefinitionListTermRole,
     DefinitionListDefinitionRole,
-    AnnotationRole
+    AnnotationRole,
+    SliderThumbRole,
+    
+    // ARIA Grouping roles
+    LandmarkApplicationRole,
+    LandmarkBannerRole,
+    LandmarkComplementaryRole,
+    LandmarkContentInfoRole,
+    LandmarkMainRole,
+    LandmarkNavigationRole,
+    LandmarkSearchRole,
+    
+    ApplicationLogRole,
+    ApplicationMarqueeRole,
+    ApplicationStatusRole,
+    ApplicationTimerRole,
+    
+    DocumentRole,
+    DocumentArticleRole,
+    DocumentNoteRole,
+    DocumentRegionRole,
+    
+    UserInterfaceTooltipRole
 };
 
+enum AccessibilityOrientation {
+    AccessibilityOrientationVertical,
+    AccessibilityOrientationHorizontal,
+};
+    
 struct VisiblePositionRange {
 
     VisiblePosition start;
@@ -214,6 +244,7 @@ public:
     virtual bool isWebArea() const { return false; };
     virtual bool isCheckboxOrRadio() const { return false; };
     virtual bool isListBox() const { return roleValue() == ListBoxRole; };
+    virtual bool isMediaTimeline() const { return false; }
     virtual bool isMenuRelated() const { return false; }
     virtual bool isMenu() const { return false; }
     virtual bool isMenuBar() const { return false; }
@@ -231,6 +262,7 @@ public:
     virtual bool isTableCell() const { return false; };
     virtual bool isFieldset() const { return false; };
     virtual bool isGroup() const { return false; };
+    bool isRadioGroup() const { return roleValue() == RadioGroupRole; }
     
     virtual bool isChecked() const { return false; };
     virtual bool isEnabled() const { return false; };
@@ -244,6 +276,7 @@ public:
     virtual bool isPressed() const { return false; };
     virtual bool isReadOnly() const { return false; };
     virtual bool isVisited() const { return false; };
+    virtual bool isRequired() const { return false; };
 
     virtual bool canSetFocusAttribute() const { return false; };
     virtual bool canSetTextRangeAttributes() const { return false; };
@@ -256,10 +289,13 @@ public:
     bool accessibilityShouldUseUniqueId() const { return true; };
     virtual bool accessibilityIsIgnored() const  { return true; };
 
+    virtual int headingLevel() const { return 0; }
     virtual int intValue() const { return 0; }
+    virtual String valueDescription() const { return String(); }
     virtual float valueForRange() const { return 0.0f; }
     virtual float maxValueForRange() const { return 0.0f; }
     virtual float minValueForRange() const { return 0.0f; }
+    virtual AccessibilityObject* selectedRadioButton() { return 0; }
     virtual int layoutCount() const { return 0; }
     static bool isARIAControl(AccessibilityRole);
     static bool isARIAInput(AccessibilityRole);
@@ -274,6 +310,7 @@ public:
     virtual AccessibilityObject* parentObject() const = 0;
     virtual AccessibilityObject* parentObjectUnignored() const;
     virtual AccessibilityObject* parentObjectIfExists() const { return 0; }
+    static AccessibilityObject* firstAccessibleObjectFromNode(const Node*);
 
     virtual AccessibilityObject* observableObject() const { return 0; }
     virtual void linkedUIElements(AccessibilityChildrenVector&) const { }
@@ -283,17 +320,20 @@ public:
     virtual AccessibilityRole ariaRoleAttribute() const { return UnknownRole; }
     virtual bool isPresentationalChildOfAriaRole() const { return false; }
     virtual bool ariaRoleHasPresentationalChildren() const { return false; }
-    virtual AccessibilityRole roleValue() const { return UnknownRole; }
-    virtual String ariaAccessiblityName(const String&) const { return String(); }
+
+    void setRoleValue(AccessibilityRole role) { m_role = role; }
+    virtual AccessibilityRole roleValue() const { return m_role; }
+    virtual String ariaAccessibilityName(const String&) const { return String(); }
     virtual String ariaLabeledByAttribute() const { return String(); }
     virtual String ariaDescribedByAttribute() const { return String(); }
     virtual String accessibilityDescription() const { return String(); }
     virtual PassRefPtr<Range> ariaSelectedTextDOMRange() const { return 0; }
 
     virtual AXObjectCache* axObjectCache() const { return 0; }
-    unsigned axObjectID() const { return m_id; }
-    void setAXObjectID(unsigned axObjectID) { m_id = axObjectID; }
+    AXID axObjectID() const { return m_id; }
+    void setAXObjectID(AXID axObjectID) { m_id = axObjectID; }
     
+    static AccessibilityObject* anchorElementForNode(Node*);
     virtual Element* anchorElement() const { return 0; }
     virtual Element* actionElement() const { return 0; }
     virtual IntRect boundingBoxRect() const { return IntRect(); }
@@ -332,7 +372,11 @@ public:
     virtual void makeRangeVisible(const PlainTextRange&) { }
     virtual bool press() const;
     bool performDefaultAction() const { return press(); }
-    
+
+    virtual AccessibilityOrientation orientation() const;
+    virtual void increment() { };
+    virtual void decrement() { };
+
     virtual void childrenChanged() { }
     virtual const AccessibilityChildrenVector& children() { return m_children; }
     virtual void addChildren() { }
@@ -373,8 +417,7 @@ public:
     VisiblePosition previousSentenceStartPosition(const VisiblePosition&) const;
     VisiblePosition nextParagraphEndPosition(const VisiblePosition&) const;
     VisiblePosition previousParagraphStartPosition(const VisiblePosition&) const;
-    virtual VisiblePosition visiblePositionForIndex(unsigned, bool /*
-lastIndexOK */) const { return VisiblePosition(); }
+    virtual VisiblePosition visiblePositionForIndex(unsigned, bool /*lastIndexOK */) const { return VisiblePosition(); }
     
     virtual VisiblePosition visiblePositionForIndex(int) const { return VisiblePosition(); }
     virtual int indexForVisiblePosition(const VisiblePosition&) const { return 0; }
@@ -391,6 +434,7 @@ lastIndexOK */) const { return VisiblePosition(); }
 
     virtual String doAXStringForRange(const PlainTextRange&) const { return String(); }
     virtual IntRect doAXBoundsForRange(const PlainTextRange&) const { return IntRect(); }
+    String listMarkerTextForNodeAndPosition(Node*, const VisiblePosition&) const;
 
     unsigned doAXLineForIndex(unsigned);
 
@@ -419,16 +463,18 @@ lastIndexOK */) const { return VisiblePosition(); }
     virtual void updateBackingStore() { }
     
 protected:
-    unsigned m_id;
+    AXID m_id;
     AccessibilityChildrenVector m_children;
     mutable bool m_haveChildren;
+    AccessibilityRole m_role;
     
     virtual void clearChildren();
     virtual bool isDetached() const { return true; }
-
+    RenderListItem* renderListItemContainerForNode(Node* node) const;
+    
 #if PLATFORM(MAC)
     RetainPtr<AccessibilityObjectWrapper> m_wrapper;
-#elif PLATFORM(WIN)
+#elif PLATFORM(WIN) && !PLATFORM(WINCE)
     COMPtr<AccessibilityObjectWrapper> m_wrapper;
 #elif PLATFORM(GTK)
     AtkObject* m_wrapper;
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
index 65a1a7d..b7dd601 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -35,7 +35,6 @@
 #include "CharacterNames.h"
 #include "EventNames.h"
 #include "FloatRect.h"
-#include "FocusController.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "HTMLAreaElement.h"
@@ -54,7 +53,6 @@
 #include "HitTestResult.h"
 #include "LocalizedStrings.h"
 #include "NodeList.h"
-#include "Page.h"
 #include "RenderButton.h"
 #include "RenderFieldset.h"
 #include "RenderFileUploadControl.h"
@@ -83,10 +81,11 @@ namespace WebCore {
 using namespace HTMLNames;
 
 AccessibilityRenderObject::AccessibilityRenderObject(RenderObject* renderer)
-    : m_renderer(renderer)
+    : AccessibilityObject()
+    , m_renderer(renderer)
     , m_ariaRole(UnknownRole)
 {
-    setAriaRole();
+    updateAccessibilityRole();
 #ifndef NDEBUG
     m_renderer->setHasAXObject(true);
 #endif
@@ -293,7 +292,7 @@ bool AccessibilityRenderObject::isSlider() const
 {
     return roleValue() == SliderRole;
 }
-    
+
 bool AccessibilityRenderObject::isMenuRelated() const
 {
     AccessibilityRole role = roleValue();
@@ -403,6 +402,11 @@ bool AccessibilityRenderObject::isReadOnly() const
         return !frame->isContentEditable();
     }
 
+    if (m_renderer->isTextField())
+        return static_cast<HTMLInputElement*>(m_renderer->node())->readOnly();
+    if (m_renderer->isTextArea())
+        return static_cast<HTMLTextAreaElement*>(m_renderer->node())->readOnly();
+    
     return !m_renderer->node() || !m_renderer->node()->isContentEditable();
 }
 
@@ -416,23 +420,23 @@ bool AccessibilityRenderObject::isOffScreen() const
     return viewRect.isEmpty();
 }
 
-int AccessibilityRenderObject::headingLevel(Node* node)
+int AccessibilityRenderObject::headingLevel() const
 {
     // headings can be in block flow and non-block flow
+    if (!m_renderer)
+        return 0;
+    
+    Node* node = m_renderer->node();
     if (!node)
         return 0;
 
-    if (RenderObject* renderer = node->renderer()) {
-        AccessibilityObject* axObjectForNode = node->document()->axObjectCache()->getOrCreate(renderer);
-        if (axObjectForNode->ariaRoleAttribute() == HeadingRole) {
-            if (!node->isElementNode())
-                return 0;
-            Element* element = static_cast<Element*>(node);
-            return element->getAttribute(aria_levelAttr).toInt();
-        }
+    if (ariaRoleAttribute() == HeadingRole)  {
+        if (!node->isElementNode())
+            return 0;
+        Element* element = static_cast<Element*>(node);
+        return element->getAttribute(aria_levelAttr).toInt();
     }
-            
-    
+
     if (node->hasTagName(h1Tag))
         return 1;
     
@@ -487,6 +491,21 @@ bool AccessibilityRenderObject::isGroup() const
     return roleValue() == GroupRole;
 }
     
+AccessibilityObject* AccessibilityRenderObject::selectedRadioButton()
+{
+    if (!isRadioGroup())
+        return 0;
+    
+    // Find the child radio button that is selected (ie. the intValue == 1).
+    int count = m_children.size();
+    for (int i = 0; i < count; ++i) {
+        AccessibilityObject* object = m_children[i].get();
+        if (object->roleValue() == RadioButtonRole && object->intValue() == 1)
+            return object;
+    }
+    return 0;
+}
+    
 const AtomicString& AccessibilityRenderObject::getAttribute(const QualifiedName& attribute) const
 {
     Node* node = m_renderer->node();
@@ -587,6 +606,22 @@ Element* AccessibilityRenderObject::mouseButtonListener() const
     return 0;
 }
 
+void AccessibilityRenderObject::increment()
+{
+    if (roleValue() != SliderRole)
+        return;
+    
+    changeValueByPercent(5);
+}
+
+void AccessibilityRenderObject::decrement()
+{
+    if (roleValue() != SliderRole)
+        return;
+    
+    changeValueByPercent(-5);
+}
+
 static Element* siblingWithAriaRole(String role, Node* node)
 {
     Node* sibling = node->parent()->firstChild();
@@ -682,10 +717,8 @@ String AccessibilityRenderObject::textUnderElement() const
     if (!m_renderer)
         return String();
     
-    if (isFileUploadButton()) {
-        RenderFileUploadControl* uploadControl = static_cast<RenderFileUploadControl*>(m_renderer);
-        return uploadControl->buttonValue();
-    }
+    if (isFileUploadButton())
+        return toRenderFileUploadControl(m_renderer)->buttonValue();
     
     Node* node = m_renderer->node();
     if (node) {
@@ -719,7 +752,7 @@ int AccessibilityRenderObject::intValue() const
         return 0;
     
     if (isHeading())
-        return headingLevel(m_renderer->node());
+        return headingLevel();
     
     Node* node = m_renderer->node();
     if (!node || !isCheckboxOrRadio())
@@ -736,6 +769,15 @@ int AccessibilityRenderObject::intValue() const
     return static_cast<HTMLInputElement*>(node)->checked();
 }
 
+String AccessibilityRenderObject::valueDescription() const
+{
+    // Only sliders and progress bars support value descriptions currently.
+    if (!isProgressIndicator() && !isSlider())
+        return String();
+    
+    return getAttribute(aria_valuetextAttr).string();
+}
+    
 float AccessibilityRenderObject::valueForRange() const
 {
     if (!isProgressIndicator() && !isSlider())
@@ -769,13 +811,13 @@ String AccessibilityRenderObject::stringValue() const
         return textUnderElement();
     
     if (m_renderer->isMenuList())
-        return static_cast<RenderMenuList*>(m_renderer)->text();
+        return toRenderMenuList(m_renderer)->text();
     
     if (m_renderer->isListMarker())
-        return static_cast<RenderListMarker*>(m_renderer)->text();
+        return toRenderListMarker(m_renderer)->text();
     
     if (m_renderer->isRenderButton())
-        return static_cast<RenderButton*>(m_renderer)->text();
+        return toRenderButton(m_renderer)->text();
 
     if (isWebArea()) {
         if (m_renderer->document()->frame())
@@ -793,10 +835,8 @@ String AccessibilityRenderObject::stringValue() const
     if (isTextControl())
         return text();
     
-    if (isFileUploadButton()) {
-        RenderFileUploadControl* uploadControl = static_cast<RenderFileUploadControl*>(m_renderer);
-        return uploadControl->fileTextValue();
-    }
+    if (isFileUploadButton())
+        return toRenderFileUploadControl(m_renderer)->fileTextValue();
     
     // FIXME: We might need to implement a value here for more types
     // FIXME: It would be better not to advertise a value at all for the types for which we don't implement one;
@@ -824,7 +864,7 @@ static String accessibleNameForNode(Node* node)
     return String();
 }
 
-String AccessibilityRenderObject::ariaAccessiblityName(const String& s) const
+String AccessibilityRenderObject::ariaAccessibilityName(const String& s) const
 {
     Document* document = m_renderer->document();
     if (!document)
@@ -847,7 +887,9 @@ String AccessibilityRenderObject::ariaAccessiblityName(const String& s) const
                 nameFragment = accessibleNameForNode(n);
                 ariaLabel.append(nameFragment.characters(), nameFragment.length());
             }
-            ariaLabel.append(' ');
+            
+            if (i != size - 1)
+                ariaLabel.append(' ');
         }
     }
     return String::adopt(ariaLabel);
@@ -871,7 +913,7 @@ String AccessibilityRenderObject::ariaLabeledByAttribute() const
             return String();
     }
 
-    return ariaAccessiblityName(idList);
+    return ariaAccessibilityName(idList);
 }
 
 static HTMLLabelElement* labelForElement(Element* element)
@@ -947,6 +989,7 @@ String AccessibilityRenderObject::title() const
         || ariaRole == ListBoxOptionRole
         || ariaRole == MenuItemRole
         || ariaRole == MenuButtonRole
+        || ariaRole == RadioButtonRole
         || isHeading())
         return textUnderElement();
     
@@ -962,7 +1005,7 @@ String AccessibilityRenderObject::ariaDescribedByAttribute() const
     if (idList.isEmpty())
         return String();
     
-    return ariaAccessiblityName(idList);
+    return ariaAccessibilityName(idList);
 }
 
 String AccessibilityRenderObject::accessibilityDescription() const
@@ -996,7 +1039,7 @@ String AccessibilityRenderObject::accessibilityDescription() const
                 const AtomicString& title = static_cast<HTMLFrameElementBase*>(owner)->getAttribute(titleAttr);
                 if (!title.isEmpty())
                     return title;
-                return static_cast<HTMLFrameElementBase*>(owner)->name();
+                return static_cast<HTMLFrameElementBase*>(owner)->getAttribute(nameAttr);
             }
             if (owner->isHTMLElement())
                 return static_cast<HTMLElement*>(owner)->getAttribute(nameAttr);
@@ -1098,35 +1141,23 @@ AccessibilityObject* AccessibilityRenderObject::internalLinkElement() const
     HTMLAnchorElement* anchor = static_cast<HTMLAnchorElement*>(element);
     
     KURL linkURL = anchor->href();
-    String ref = linkURL.ref();
-    if (ref.isEmpty())
+    String fragmentIdentifier = linkURL.fragmentIdentifier();
+    if (fragmentIdentifier.isEmpty())
         return 0;
     
     // check if URL is the same as current URL
-    linkURL.removeRef();
+    linkURL.removeFragmentIdentifier();
     if (m_renderer->document()->url() != linkURL)
         return 0;
     
-    Node* linkedNode = m_renderer->document()->findAnchor(ref);
+    Node* linkedNode = m_renderer->document()->findAnchor(fragmentIdentifier);
     if (!linkedNode)
         return 0;
     
-    // the element we find may not be accessible, keep searching until we find a good one
-    AccessibilityObject* linkedAXElement = m_renderer->document()->axObjectCache()->getOrCreate(linkedNode->renderer());
-    while (linkedAXElement && linkedAXElement->accessibilityIsIgnored()) {
-        linkedNode = linkedNode->traverseNextNode();
-        
-        while (linkedNode && !linkedNode->renderer())
-            linkedNode = linkedNode->traverseNextSibling();
-        
-        if (!linkedNode)
-            return 0;
-        linkedAXElement = m_renderer->document()->axObjectCache()->getOrCreate(linkedNode->renderer());
-    }
-    
-    return linkedAXElement;
+    // The element we find may not be accessible, so find the first accessible object.
+    return firstAccessibleObjectFromNode(linkedNode);
 }
-    
+
 void AccessibilityRenderObject::addRadioButtonGroupMembers(AccessibilityChildrenVector& linkedUIElements) const
 {
     if (!m_renderer || roleValue() != RadioButtonRole)
@@ -1196,7 +1227,7 @@ AccessibilityObject* AccessibilityRenderObject::titleUIElement() const
     
     // if isFieldset is true, the renderer is guaranteed to be a RenderFieldset
     if (isFieldset())
-        return axObjectCache()->getOrCreate(static_cast<RenderFieldset*>(m_renderer)->findLegend());
+        return axObjectCache()->getOrCreate(toRenderFieldset(m_renderer)->findLegend());
     
     if (!exposesTitleUIElement())
         return 0;
@@ -1307,7 +1338,7 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
         }
         
         if (node && node->hasTagName(canvasTag)) {
-            RenderHTMLCanvas* canvas = static_cast<RenderHTMLCanvas*>(m_renderer);
+            RenderHTMLCanvas* canvas = toRenderHTMLCanvas(m_renderer);
             if (canvas->height() <= 1 || canvas->width() <= 1)
                 return true;
             return false;
@@ -1508,6 +1539,14 @@ bool AccessibilityRenderObject::isVisited() const
 {
     return m_renderer->style()->pseudoState() == PseudoVisited;
 }
+    
+bool AccessibilityRenderObject::isRequired() const
+{
+    if (equalIgnoringCase(getAttribute(aria_requiredAttr).string(), "true"))
+        return true;
+    
+    return false;
+}
 
 bool AccessibilityRenderObject::isSelected() const
 {
@@ -1558,8 +1597,22 @@ void AccessibilityRenderObject::setFocused(bool on)
     }
 }
 
+void AccessibilityRenderObject::changeValueByPercent(float percentChange)
+{
+    float range = maxValueForRange() - minValueForRange();
+    float value = valueForRange();
+    
+    value += range * (percentChange / 100);
+    setValue(String::number(value));
+    
+    axObjectCache()->postNotification(m_renderer, AXObjectCache::AXValueChanged, true);
+}
+    
 void AccessibilityRenderObject::setValue(const String& string)
 {
+    if (!m_renderer)
+        return;
+    
     // FIXME: Do we want to do anything here for ARIA textboxes?
     if (m_renderer->isTextField()) {
         HTMLInputElement* input = static_cast<HTMLInputElement*>(m_renderer->node());
@@ -1567,6 +1620,10 @@ void AccessibilityRenderObject::setValue(const String& string)
     } else if (m_renderer->isTextArea()) {
         HTMLTextAreaElement* textArea = static_cast<HTMLTextAreaElement*>(m_renderer->node());
         textArea->setValue(string);
+    } else if (roleValue() == SliderRole) {
+        Node* element = m_renderer->node();
+        if (element && element->isElementNode())
+            static_cast<Element*>(element)->setAttribute(aria_valuenowAttr, string);
     }
 }
 
@@ -1603,8 +1660,7 @@ Widget* AccessibilityRenderObject::widget() const
 {
     if (!m_renderer->isWidget())
         return 0;
-    
-    return static_cast<RenderWidget*>(m_renderer)->widget();
+    return toRenderWidget(m_renderer)->widget();
 }
 
 AXObjectCache* AccessibilityRenderObject::axObjectCache() const
@@ -1627,7 +1683,7 @@ AccessibilityObject* AccessibilityRenderObject::accessibilityParentForImageMap(H
         
         // The HTMLImageElement's useMap() value includes the '#' symbol at the beginning,
         // which has to be stripped off
-        String useMapName = static_cast<HTMLImageElement*>(curr)->useMap().substring(1).lower();
+        String useMapName = static_cast<HTMLImageElement*>(curr)->getAttribute(usemapAttr).string().substring(1).lower();
         if (useMapName == mapName)
             return axObjectCache()->getOrCreate(obj);
     }
@@ -1675,7 +1731,7 @@ Widget* AccessibilityRenderObject::widgetForAttachmentView() const
 {
     if (!isAttachment())
         return 0;
-    return static_cast<RenderWidget*>(m_renderer)->widget();
+    return toRenderWidget(m_renderer)->widget();
 }
 
 FrameView* AccessibilityRenderObject::frameViewIfRenderView() const
@@ -1880,7 +1936,7 @@ VisiblePosition AccessibilityRenderObject::visiblePositionForPoint(const IntPoin
             break;
         
         // descend into widget (FRAME, IFRAME, OBJECT...)
-        Widget* widget = static_cast<RenderWidget*>(renderer)->widget();
+        Widget* widget = toRenderWidget(renderer)->widget();
         if (!widget || !widget->isFrameView())
             break;
         Frame* frame = static_cast<FrameView*>(widget)->frame();
@@ -2071,32 +2127,11 @@ AccessibilityObject* AccessibilityRenderObject::doAccessibilityHitTest(const Int
 
 AccessibilityObject* AccessibilityRenderObject::focusedUIElement() const
 {
-    // get the focused node in the page
     Page* page = m_renderer->document()->page();
     if (!page)
         return 0;
-    
-    Document* focusedDocument = page->focusController()->focusedOrMainFrame()->document();
-    Node* focusedNode = focusedDocument->focusedNode();
-    if (!focusedNode)
-        focusedNode = focusedDocument;
-    
-    RenderObject* focusedNodeRenderer = focusedNode->renderer();
-    if (!focusedNodeRenderer)
-        return 0;
-    
-    AccessibilityObject* obj = focusedNodeRenderer->document()->axObjectCache()->getOrCreate(focusedNodeRenderer);
-    
-    if (obj->shouldFocusActiveDescendant()) {
-        if (AccessibilityObject* descendant = obj->activeDescendant())
-            obj = descendant;
-    }
-    
-    // the HTML element, for example, is focusable but has an AX object that is ignored
-    if (obj->accessibilityIsIgnored())
-        obj = obj->parentObjectUnignored();
-    
-    return obj;
+
+    return AXObjectCache::focusedUIElementForPage(page);
 }
 
 bool AccessibilityRenderObject::shouldFocusActiveDescendant() const
@@ -2143,7 +2178,7 @@ AccessibilityObject* AccessibilityRenderObject::activeDescendant() const
         return 0;
     
     AccessibilityObject* obj = renderer()->document()->axObjectCache()->getOrCreate(target->renderer());
-    if (obj->isAccessibilityRenderObject())
+    if (obj && obj->isAccessibilityRenderObject())
     // an activedescendant is only useful if it has a renderer, because that's what's needed to post the notification
         return obj;
     return 0;
@@ -2161,7 +2196,7 @@ void AccessibilityRenderObject::handleActiveDescendantChanged()
     AccessibilityRenderObject* activedescendant = static_cast<AccessibilityRenderObject*>(activeDescendant());
     
     if (activedescendant && shouldFocusActiveDescendant())
-        doc->axObjectCache()->postNotification(activedescendant->renderer(), "AXFocusedUIElementChanged", true);
+        doc->axObjectCache()->postNotification(activedescendant->renderer(), AXObjectCache::AXFocusedUIElementChanged, true);
 }
 
 
@@ -2185,31 +2220,52 @@ static const ARIARoleMap& createARIARoleMap()
     };
 
     const RoleEntry roles[] = {
+        { "application", LandmarkApplicationRole },
+        { "article", DocumentArticleRole },
+        { "banner", LandmarkBannerRole },
         { "button", ButtonRole },
         { "checkbox", CheckBoxRole },
+        { "complementary", LandmarkComplementaryRole },
+        { "contentinfo", LandmarkContentInfoRole },
         { "grid", TableRole },
         { "gridcell", CellRole },
         { "columnheader", ColumnHeaderRole },
+        { "definition", DefinitionListDefinitionRole },
+        { "document", DocumentRole },
         { "rowheader", RowHeaderRole },
         { "group", GroupRole },
         { "heading", HeadingRole },
         { "img", ImageRole },
         { "link", WebCoreLinkRole },
+        { "list", ListRole },        
+        { "listitem", GroupRole },        
         { "listbox", ListBoxRole },
+        { "log", ApplicationLogRole },
         // "option" isn't here because it may map to different roles depending on the parent element's role
+        { "main", LandmarkMainRole },
+        { "marquee", ApplicationMarqueeRole },
         { "menu", MenuRole },
         { "menubar", GroupRole },
         // "menuitem" isn't here because it may map to different roles depending on the parent element's role
         { "menuitemcheckbox", MenuItemRole },
         { "menuitemradio", MenuItemRole },
+        { "note", DocumentNoteRole },
+        { "navigation", LandmarkNavigationRole },
         { "progressbar", ProgressIndicatorRole },
         { "radio", RadioButtonRole },
+        { "radiogroup", RadioGroupRole },
+        { "region", DocumentRegionRole },
         { "row", RowRole },
         { "range", SliderRole },
+        { "search", LandmarkSearchRole },
+        { "separator", SplitterRole },
         { "slider", SliderRole },
         { "spinbutton", ProgressIndicatorRole },
+        { "status", ApplicationStatusRole },
         { "textbox", TextAreaRole },
-        { "toolbar", ToolbarRole }
+        { "timer", ApplicationTimerRole },
+        { "toolbar", ToolbarRole },
+        { "tooltip", UserInterfaceTooltipRole }
     };
     ARIARoleMap& roleMap = *new ARIARoleMap;
         
@@ -2253,20 +2309,22 @@ AccessibilityRole AccessibilityRenderObject::determineAriaRoleAttribute() const
     return UnknownRole;
 }
 
-void AccessibilityRenderObject::setAriaRole()
-{
-    m_ariaRole = determineAriaRoleAttribute();
-}
-
 AccessibilityRole AccessibilityRenderObject::ariaRoleAttribute() const
 {
     return m_ariaRole;
 }
-
-AccessibilityRole AccessibilityRenderObject::roleValue() const
+    
+void AccessibilityRenderObject::updateAccessibilityRole()
+{
+    m_role = determineAccessibilityRole();
+}
+    
+AccessibilityRole AccessibilityRenderObject::determineAccessibilityRole()
 {
     if (!m_renderer)
         return UnknownRole;
+
+    m_ariaRole = determineAriaRoleAttribute();
     
     Node* node = m_renderer->node();
     AccessibilityRole ariaRole = ariaRoleAttribute();
@@ -2320,7 +2378,7 @@ AccessibilityRole AccessibilityRenderObject::roleValue() const
     if (m_renderer->isMenuList())
         return PopUpButtonRole;
     
-    if (headingLevel(m_renderer->node()) != 0)
+    if (headingLevel() != 0)
         return HeadingRole;
     
     if (node && node->hasTagName(ddTag))
@@ -2367,7 +2425,7 @@ bool AccessibilityRenderObject::canSetFocusAttribute() const
     Node* node = m_renderer->node();
 
     // NOTE: It would be more accurate to ask the document whether setFocusedNode() would
-    // do anything.  For example, it setFocusedNode() will do nothing if the current focused
+    // do anything.  For example, setFocusedNode() will do nothing if the current focused
     // node will not relinquish the focus.
     if (!node || !node->isElementNode())
         return false;
@@ -2384,6 +2442,7 @@ bool AccessibilityRenderObject::canSetFocusAttribute() const
         case PopUpButtonRole:
         case CheckBoxRole:
         case RadioButtonRole:
+        case SliderRole:
             return true;
         default:
             return false;
@@ -2395,10 +2454,10 @@ bool AccessibilityRenderObject::canSetValueAttribute() const
     if (equalIgnoringCase(getAttribute(aria_readonlyAttr).string(), "true"))
         return false;
 
-    if (isWebArea()) 
+    if (isWebArea() || isTextControl()) 
         return !isReadOnly();
 
-    return isTextControl() || isProgressIndicator() || isSlider();
+    return isProgressIndicator() || isSlider();
 }
 
 bool AccessibilityRenderObject::canSetTextRangeAttributes() const
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
index 4f8e247..e600b61 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
@@ -101,6 +101,7 @@ public:
     virtual bool isPressed() const;
     virtual bool isReadOnly() const;
     virtual bool isVisited() const;        
+    virtual bool isRequired() const;
 
     const AtomicString& getAttribute(const QualifiedName&) const;
     virtual bool canSetFocusAttribute() const;
@@ -111,11 +112,13 @@ public:
     
     virtual bool accessibilityIsIgnored() const;
     
-    static int headingLevel(Node*);
+    virtual int headingLevel() const;
     virtual int intValue() const;
+    virtual String valueDescription() const;
     virtual float valueForRange() const;
     virtual float maxValueForRange() const;
     virtual float minValueForRange() const;
+    virtual AccessibilityObject* selectedRadioButton();
     virtual int layoutCount() const;
     
     virtual AccessibilityObject* doAccessibilityHitTest(const IntPoint&) const;
@@ -133,8 +136,8 @@ public:
     virtual AccessibilityRole ariaRoleAttribute() const;
     virtual bool isPresentationalChildOfAriaRole() const;
     virtual bool ariaRoleHasPresentationalChildren() const;
-    void setAriaRole();
-    virtual AccessibilityRole roleValue() const;
+    void updateAccessibilityRole();
+    
     virtual AXObjectCache* axObjectCache() const;
     
     virtual Element* actionElement() const;
@@ -161,7 +164,7 @@ public:
     virtual PlainTextRange selectedTextRange() const;
     virtual VisibleSelection selection() const;
     virtual String stringValue() const;
-    virtual String ariaAccessiblityName(const String&) const;
+    virtual String ariaAccessibilityName(const String&) const;
     virtual String ariaLabeledByAttribute() const;
     virtual String title() const;
     virtual String ariaDescribedByAttribute() const;
@@ -185,6 +188,9 @@ public:
     virtual void setFocused(bool);
     virtual void setSelectedTextRange(const PlainTextRange&);
     virtual void setValue(const String&);
+    virtual void changeValueByPercent(float percentChange);
+    virtual void increment();
+    virtual void decrement();
     
     virtual void detach();
     virtual void childrenChanged();
@@ -231,7 +237,8 @@ private:
     bool ariaIsHidden() const;
 
     Element* menuElementForMenuButton() const;
-    Element* menuItemElementForMenu() const; 
+    Element* menuItemElementForMenu() const;
+    AccessibilityRole determineAccessibilityRole();
     AccessibilityRole determineAriaRoleAttribute() const;
 
     IntRect checkboxOrRadioRect() const;
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.cpp
new file mode 100644
index 0000000..5aca672
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.cpp
@@ -0,0 +1,162 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "AccessibilitySlider.h"
+
+#include "AXObjectCache.h"
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
+#include "RenderObject.h"
+#include "RenderSlider.h"
+
+namespace WebCore {
+    
+using namespace HTMLNames;
+
+AccessibilitySlider::AccessibilitySlider(RenderObject* renderer)
+    : AccessibilityRenderObject(renderer)
+{
+}
+
+PassRefPtr<AccessibilitySlider> AccessibilitySlider::create(RenderObject* renderer)
+{
+    return adoptRef(new AccessibilitySlider(renderer));
+}
+
+const AccessibilityObject::AccessibilityChildrenVector& AccessibilitySlider::children()
+{
+    if (!m_haveChildren)
+        addChildren();
+    return m_children;
+}
+
+AccessibilityOrientation AccessibilitySlider::orientation() const
+{
+    // Default to horizontal in the unknown case.
+    if (!m_renderer)
+        return AccessibilityOrientationHorizontal;
+    
+    RenderStyle* style = m_renderer->style();
+    if (!style)
+        return AccessibilityOrientationHorizontal;
+    
+    ControlPart styleAppearance = style->appearance();
+    switch (styleAppearance) {
+        case SliderThumbHorizontalPart:
+        case SliderHorizontalPart:
+        case MediaSliderPart:
+            return AccessibilityOrientationHorizontal;
+        
+        case SliderThumbVerticalPart: 
+        case SliderVerticalPart:
+        case MediaVolumeSliderPart:
+            return AccessibilityOrientationVertical;
+            
+        default:
+            return AccessibilityOrientationHorizontal;
+    }
+}
+    
+void AccessibilitySlider::addChildren()
+{
+    ASSERT(!m_haveChildren); 
+    
+    m_haveChildren = true;
+
+    AccessibilitySliderThumb* thumb = static_cast<AccessibilitySliderThumb*>(m_renderer->document()->axObjectCache()->getOrCreate(SliderThumbRole));
+    thumb->setParentObject(this);
+    m_children.append(thumb);
+}
+
+const AtomicString& AccessibilitySlider::getAttribute(const QualifiedName& attribute) const
+{
+    return element()->getAttribute(attribute);
+}
+
+float AccessibilitySlider::valueForRange() const
+{
+    return element()->value().toFloat();
+}
+
+float AccessibilitySlider::maxValueForRange() const
+{
+    return getAttribute(maxAttr).toFloat();
+}
+
+float AccessibilitySlider::minValueForRange() const
+{
+    return getAttribute(minAttr).toFloat();
+}
+
+void AccessibilitySlider::setValue(const String& value)
+{
+    HTMLInputElement* input = element();
+    
+    if (input->value() == value)
+        return;
+
+    input->setValue(value);
+
+    // Fire change event manually, as RenderSlider::setValueForPosition does.
+    input->dispatchFormControlChangeEvent();
+}
+
+HTMLInputElement* AccessibilitySlider::element() const
+{
+    return static_cast<HTMLInputElement*>(m_renderer->node());
+}
+
+
+AccessibilitySliderThumb::AccessibilitySliderThumb()
+    : m_parentSlider(0)
+{
+}
+
+PassRefPtr<AccessibilitySliderThumb> AccessibilitySliderThumb::create()
+{
+    return adoptRef(new AccessibilitySliderThumb());
+}
+    
+IntRect AccessibilitySliderThumb::elementRect() const
+{
+    if (!m_parentSlider->renderer())
+        return IntRect();
+
+    IntRect intRect = toRenderSlider(m_parentSlider->renderer())->thumbRect();
+    FloatQuad floatQuad = m_parentSlider->renderer()->localToAbsoluteQuad(FloatRect(intRect));
+
+    return floatQuad.enclosingBoundingBox();
+}
+
+IntSize AccessibilitySliderThumb::size() const
+{
+    return elementRect().size();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.h
new file mode 100644
index 0000000..254ebdd
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.h
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef AccessibilitySlider_h
+#define AccessibilitySlider_h
+
+#include "AccessibilityRenderObject.h"
+
+namespace WebCore {
+
+    class HTMLInputElement;
+
+    class AccessibilitySlider : public AccessibilityRenderObject {
+        
+    public:
+        static PassRefPtr<AccessibilitySlider> create(RenderObject*);
+        virtual ~AccessibilitySlider() { }
+
+        virtual AccessibilityRole roleValue() const { return SliderRole; }
+        virtual bool accessibilityIsIgnored() const { return false; }
+
+        virtual bool isSlider() const { return true; }
+
+        virtual const AccessibilityChildrenVector& children();
+        virtual void addChildren();
+
+        virtual bool canSetValueAttribute() const { return true; };
+        const AtomicString& getAttribute(const QualifiedName& attribute) const;
+
+        virtual void setValue(const String&);
+        virtual float valueForRange() const;
+        virtual float maxValueForRange() const;
+        virtual float minValueForRange() const;
+        virtual AccessibilityOrientation orientation() const;
+
+    protected:
+        AccessibilitySlider(RenderObject*);
+
+    private:
+        HTMLInputElement* element() const;
+    };
+
+    class AccessibilitySliderThumb : public AccessibilityObject {
+        
+    public:
+        static PassRefPtr<AccessibilitySliderThumb> create();
+        virtual ~AccessibilitySliderThumb() { }
+
+        virtual AccessibilityRole roleValue() const { return SliderThumbRole; }
+        virtual bool accessibilityIsIgnored() const { return false; }
+
+        void setParentObject(AccessibilitySlider* slider) { m_parentSlider = slider; }
+        virtual AccessibilityObject* parentObject() const { return m_parentSlider; }
+
+        virtual IntSize size() const;
+        virtual IntRect elementRect() const;
+
+    private:
+        AccessibilitySliderThumb();
+
+        AccessibilitySlider* m_parentSlider;
+    };
+
+
+} // namespace WebCore
+
+#endif // AccessibilitySlider_h
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.cpp
index 6d7dbe2..928ef2c 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.cpp
@@ -84,7 +84,7 @@ bool AccessibilityTable::isTableExposableThroughAccessibility()
     if (ariaRole != UnknownRole)
         return false;
     
-    RenderTable* table = static_cast<RenderTable*>(m_renderer);
+    RenderTable* table = toRenderTable(m_renderer);
     
     // this employs a heuristic to determine if this table should appear. 
     // Only "data" tables should be exposed as tables. 
@@ -212,7 +212,7 @@ void AccessibilityTable::addChildren()
     if (!m_renderer || !m_renderer->isTable())
         return;
     
-    RenderTable* table = static_cast<RenderTable*>(m_renderer);
+    RenderTable* table = toRenderTable(m_renderer);
     AXObjectCache* axCache = m_renderer->document()->axObjectCache();
 
     // go through all the available sections to pull out the rows
@@ -374,7 +374,7 @@ AccessibilityTableCell* AccessibilityTable::cellForColumnAndRow(unsigned column,
     if (!hasChildren())
         addChildren();
     
-    RenderTable* table = static_cast<RenderTable*>(m_renderer);
+    RenderTable* table = toRenderTable(m_renderer);
     RenderTableSection* tableSection = table->header();
     if (!tableSection)
         tableSection = table->firstBody();
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableCell.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableCell.cpp
index 7ac3937..7674cb8 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableCell.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableCell.cpp
@@ -67,7 +67,7 @@ AccessibilityObject* AccessibilityTableCell::parentTable() const
     if (!m_renderer || !m_renderer->isTableCell())
         return false;
     
-    return axObjectCache()->getOrCreate(static_cast<RenderTableCell*>(m_renderer)->table());
+    return axObjectCache()->getOrCreate(toRenderTableCell(m_renderer)->table());
 }
     
 bool AccessibilityTableCell::isTableCell() const
@@ -92,7 +92,7 @@ void AccessibilityTableCell::rowIndexRange(pair<int, int>& rowRange)
     if (!m_renderer || !m_renderer->isTableCell())
         return;
     
-    RenderTableCell* renderCell = static_cast<RenderTableCell*>(m_renderer);
+    RenderTableCell* renderCell = toRenderTableCell(m_renderer);
     rowRange.first = renderCell->row();
     rowRange.second = renderCell->rowSpan();
     
@@ -122,7 +122,7 @@ void AccessibilityTableCell::columnIndexRange(pair<int, int>& columnRange)
     if (!m_renderer || !m_renderer->isTableCell())
         return;
     
-    RenderTableCell* renderCell = static_cast<RenderTableCell*>(m_renderer);
+    RenderTableCell* renderCell = toRenderTableCell(m_renderer);
     columnRange.first = renderCell->col();
     columnRange.second = renderCell->colSpan();    
 }
@@ -141,7 +141,7 @@ AccessibilityObject* AccessibilityTableCell::titleUIElement() const
     if (node && node->hasTagName(thTag))
         return 0;
     
-    RenderTableCell* renderCell = static_cast<RenderTableCell*>(m_renderer);
+    RenderTableCell* renderCell = toRenderTableCell(m_renderer);
 
     // If this cell is in the first column, there is no need to continue.
     int col = renderCell->col();
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.cpp
index ee79444..e09d65e 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.cpp
@@ -105,7 +105,7 @@ AccessibilityObject* AccessibilityTableColumn::headerObject()
     if (!renderer->isTable())
         return 0;
     
-    RenderTable* table = static_cast<RenderTable*>(renderer);
+    RenderTable* table = toRenderTable(renderer);
     
     AccessibilityObject* headerObject = 0;
     
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableRow.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableRow.cpp
index 9f5f972..53b479e 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableRow.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableRow.cpp
@@ -87,7 +87,7 @@ AccessibilityObject* AccessibilityTableRow::parentTable() const
     if (!m_renderer || !m_renderer->isTableRow())
         return 0;
     
-    return axObjectCache()->getOrCreate(static_cast<RenderTableRow*>(m_renderer)->table());
+    return axObjectCache()->getOrCreate(toRenderTableRow(m_renderer)->table());
 }
     
 AccessibilityObject* AccessibilityTableRow::headerObject()
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
index 3146413..475b374 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009 Apple, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -43,18 +44,18 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSAbstractWorker::mark()
+void JSAbstractWorker::markChildren(MarkStack& markStack)
 {
-    Base::mark();
+    Base::markChildren(markStack);
 
-    markIfNotNull(m_impl->onerror());
+    markIfNotNull(markStack, m_impl->onerror());
 
     typedef AbstractWorker::EventListenersMap EventListenersMap;
     typedef AbstractWorker::ListenerVector ListenerVector;
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
         for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction();
+            (*vecIter)->markJSFunction(markStack);
     }
 }
 
@@ -63,10 +64,12 @@ JSValue JSAbstractWorker::addEventListener(ExecState* exec, const ArgList& args)
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -75,10 +78,12 @@ JSValue JSAbstractWorker::removeEventListener(ExecState* exec, const ArgList& ar
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
index abd5ad5..e217023 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
@@ -48,7 +48,8 @@ void JSAttr::setValue(ExecState* exec, JSValue value)
     Element* ownerElement = imp->ownerElement();
     if (ownerElement && (ownerElement->hasTagName(iframeTag) || ownerElement->hasTagName(frameTag))) {
         if (equalIgnoringCase(imp->name(), "src") && protocolIsJavaScript(deprecatedParseURL(attrValue))) {
-            if (!checkNodeSecurity(exec, static_cast<HTMLFrameElementBase*>(ownerElement)->contentDocument()))
+            Document* contentDocument = static_cast<HTMLFrameElementBase*>(ownerElement)->contentDocument();
+            if (contentDocument && !checkNodeSecurity(exec, contentDocument))
                 return;
         }
     }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp
index 87a3880..174cc11 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp
@@ -34,6 +34,7 @@
 #include "JSHTMLAudioElement.h"
 #include "ScriptExecutionContext.h"
 #include "Text.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleListCustom.cpp
new file mode 100644
index 0000000..be3a9a2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleListCustom.cpp
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All right reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSCSSRuleList.h"
+
+#include "CSSRuleList.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCSSRuleList::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    CSSRuleList* list = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    unsigned length = list->length();
+    for (unsigned i = 0; i < length; ++i)
+        markDOMObjectWrapper(markStack, globalData, list->item(i));
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
index 280ec93..4a137d3 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,8 +27,8 @@
 #include "JSCSSStyleDeclarationCustom.h"
 
 #include "AtomicString.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSPrimitiveValue.h"
-#include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
 #include "PlatformString.h"
 #include <runtime/StringObjectThatMasqueradesAsUndefined.h>
@@ -40,6 +40,21 @@ using namespace WTF;
 
 namespace WebCore {
 
+void JSCSSStyleDeclaration::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    CSSStyleDeclaration* declaration = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    if (declaration->isMutableStyleDeclaration()) {
+        CSSMutableStyleDeclaration* mutableDeclaration = static_cast<CSSMutableStyleDeclaration*>(declaration);
+        CSSMutableStyleDeclaration::const_iterator end = mutableDeclaration->end();
+        for (CSSMutableStyleDeclaration::const_iterator it = mutableDeclaration->begin(); it != end; ++it)
+            markDOMObjectWrapper(markStack, globalData, it->value());
+    }
+}
+
 // Check for a CSS prefix.
 // Passed prefix is all lowercase.
 // First character of the prefix within the property name may be upper or lowercase.
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.cpp
new file mode 100644
index 0000000..93d53ca
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.cpp
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasArrayBufferConstructor.h"
+
+#include "Document.h"
+#include "CanvasArrayBuffer.h"
+#include "JSCanvasArrayBuffer.h"
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasArrayBufferConstructor::s_info = { "CanvasArrayBufferConstructor", 0, 0, 0 };
+
+JSCanvasArrayBufferConstructor::JSCanvasArrayBufferConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasArrayBufferConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasArrayBufferPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasArrayBuffer(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasArrayBufferConstructor* jsConstructor = static_cast<JSCanvasArrayBufferConstructor*>(constructor);
+
+    unsigned int size = 0;
+    if (args.size() == 1) {
+        size = (unsigned int)args.at(0).toInt32(exec);
+        if (isnan(size))
+            size = 0;
+    }
+    return asObject(toJS(exec, jsConstructor->globalObject(), CanvasArrayBuffer::create(size)));
+}
+
+JSC::ConstructType JSCanvasArrayBufferConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasArrayBuffer;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h
new file mode 100644
index 0000000..44c9000
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasArrayBufferConstructor_h
+#define JSCanvasArrayBufferConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+#include "JSCanvasArrayBuffer.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+    class CanvasArray;
+
+    // Template function used by CanvasXXXArrayConstructors
+    template<class C, typename T>
+    PassRefPtr<CanvasArray> construct(JSC::ExecState* exec, const JSC::ArgList& args)
+    {
+        // There are 3 constructors:
+        //
+        //  1) (in int size)
+        //  2) (in CanvasArrayBuffer buffer, [Optional] in int offset, [Optional] in unsigned int length)
+        //  3) (in sequence<T>) - This ends up being a JS "array-like" object
+        //
+        RefPtr<C> arrayObject;
+        
+        if (args.size() < 1)
+            return 0;
+        
+        if (args.at(0).isObject()) {
+            RefPtr<CanvasArrayBuffer> buffer = toCanvasArrayBuffer(args.at(0));
+            if (buffer) {
+                int offset = (args.size() > 1) ? args.at(1).toInt32(exec) : 0;
+                unsigned int length = (args.size() > 2) ? static_cast<unsigned int>(args.at(2).toInt32(exec)) : 0;
+                return C::create(buffer, offset, length);
+            }
+            
+            JSC::JSObject* array = asObject(args.at(0));
+            int length = array->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
+            void* tempValues;
+            if (!tryFastMalloc(length * sizeof(T)).getValue(tempValues)) {
+                throwError(exec, JSC::GeneralError);
+                return 0;
+            }
+            
+            OwnFastMallocPtr<T> values(static_cast<T*>(tempValues));
+            for (int i = 0; i < length; ++i) {
+                JSC::JSValue v = array->get(exec, i);
+                if (exec->hadException())
+                    return 0;
+                values.get()[i] = static_cast<T>(v.toNumber(exec));
+            }
+            
+            return C::create(values.get(), length);
+        }
+        
+        unsigned size = static_cast<unsigned>(args.at(0).toInt32(exec));
+        return C::create(size);
+    }
+
+    class JSCanvasArrayBufferConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasArrayBufferConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasArrayBufferConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayCustom.cpp
new file mode 100644
index 0000000..4aa1547
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayCustom.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "config.h"
+#include "JSCanvasArray.h"
+
+#include "CanvasArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasArray* object)
+{
+    if (!object)
+        return jsUndefined();
+        
+    
+
+#if ENABLE(3D_CANVAS)
+    if (object->is3d())
+        return getDOMObjectWrapper<JSCanvasRenderingContext3D>(exec, globalObject, static_cast<CanvasRenderingContext3D*>(object));
+#endif
+    ASSERT(object->is2d());
+    return getDOMObjectWrapper<JSCanvasRenderingContext2D>(exec, globalObject, static_cast<CanvasRenderingContext2D*>(object));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.cpp
new file mode 100644
index 0000000..ec1d66d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasByteArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasByteArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasByteArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasByteArrayConstructor::s_info = { "CanvasByteArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasByteArrayConstructor::JSCanvasByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasByteArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasByteArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasByteArrayConstructor* jsConstructor = static_cast<JSCanvasByteArrayConstructor*>(constructor);
+    RefPtr<CanvasByteArray> array = static_cast<CanvasByteArray*>(construct<CanvasByteArray, signed char>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasByteArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.h
new file mode 100644
index 0000000..4d5dc11
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasByteArrayConstructor_h
+#define JSCanvasByteArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasByteArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasByteArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayCustom.cpp
new file mode 100644
index 0000000..04697ce
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasByteArray.h"
+
+#include "CanvasByteArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<signed char>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasByteArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasByteArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.cpp
new file mode 100644
index 0000000..15e39c2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasFloatArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasFloatArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasFloatArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasFloatArrayConstructor::s_info = { "CanvasFloatArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasFloatArrayConstructor::JSCanvasFloatArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasFloatArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasFloatArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasFloatArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasFloatArrayConstructor* jsConstructor = static_cast<JSCanvasFloatArrayConstructor*>(constructor);
+    RefPtr<CanvasFloatArray> array = static_cast<CanvasFloatArray*>(construct<CanvasFloatArray, float>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasFloatArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasFloatArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.h
new file mode 100644
index 0000000..efea250
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasFloatArrayConstructor_h
+#define JSCanvasFloatArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasFloatArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasFloatArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasFloatArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayCustom.cpp
new file mode 100644
index 0000000..20cd805c0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasFloatArray.h"
+
+#include "CanvasFloatArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasFloatArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<float>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasFloatArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasFloatArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.cpp
new file mode 100644
index 0000000..6d57912
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasIntArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasIntArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasIntArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasIntArrayConstructor::s_info = { "CanvasIntArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasIntArrayConstructor::JSCanvasIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasIntArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasIntArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasIntArrayConstructor* jsConstructor = static_cast<JSCanvasIntArrayConstructor*>(constructor);
+    RefPtr<CanvasIntArray> array = static_cast<CanvasIntArray*>(construct<CanvasIntArray, int>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasIntArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.h
new file mode 100644
index 0000000..5e19652
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasIntArrayConstructor_h
+#define JSCanvasIntArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasIntArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasIntArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayCustom.cpp
new file mode 100644
index 0000000..8442b87
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasIntArray.h"
+
+#include "CanvasIntArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<signed int>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasIntArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasIntArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasNumberArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasNumberArrayCustom.cpp
new file mode 100644
index 0000000..be10ac0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasNumberArrayCustom.cpp
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasNumberArray.h"
+
+#include "CanvasNumberArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSCanvasNumberArray::getByIndex(JSC::ExecState* exec, unsigned int index)
+{
+    JSC::JSValue result = jsNumber(exec, impl()->item(index));
+    return result;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
index 398a679..bb3500b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
@@ -67,27 +67,31 @@ static PassRefPtr<CanvasStyle> toHTMLCanvasStyle(ExecState*, JSValue value)
 
 JSValue JSCanvasRenderingContext2D::strokeStyle(ExecState* exec) const
 {
-    return toJS(exec, impl()->strokeStyle());        
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
+    return toJS(exec, context->strokeStyle());        
 }
 
 void JSCanvasRenderingContext2D::setStrokeStyle(ExecState* exec, JSValue value)
 {
-    impl()->setStrokeStyle(toHTMLCanvasStyle(exec, value));
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
+    context->setStrokeStyle(toHTMLCanvasStyle(exec, value));
 }
 
 JSValue JSCanvasRenderingContext2D::fillStyle(ExecState* exec) const
 {
-    return toJS(exec, impl()->fillStyle());
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
+    return toJS(exec, context->fillStyle());
 }
 
 void JSCanvasRenderingContext2D::setFillStyle(ExecState* exec, JSValue value)
 {
-    impl()->setFillStyle(toHTMLCanvasStyle(exec, value));
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
+    context->setFillStyle(toHTMLCanvasStyle(exec, value));
 }
 
 JSValue JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgList& args)
 {
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     // string arg = named color
     // number arg = gray color
@@ -124,7 +128,7 @@ JSValue JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgList&
 
 JSValue JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     // string arg = named color
     // number arg = gray color
@@ -162,7 +166,7 @@ JSValue JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const ArgLis
 
 JSValue JSCanvasRenderingContext2D::strokeRect(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
     
     if (args.size() <= 4)
         context->strokeRect(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
@@ -176,7 +180,7 @@ JSValue JSCanvasRenderingContext2D::strokeRect(ExecState* exec, const ArgList& a
 
 JSValue JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     // DrawImage has three variants:
     //     drawImage(img, dx, dy)
@@ -264,7 +268,7 @@ JSValue JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList& ar
 
 JSValue JSCanvasRenderingContext2D::drawImageFromRect(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
     
     JSValue value = args.at(0);
     if (!value.isObject())
@@ -284,7 +288,7 @@ JSValue JSCanvasRenderingContext2D::drawImageFromRect(ExecState* exec, const Arg
 
 JSValue JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     switch (args.size()) {
         case 3:
@@ -330,7 +334,7 @@ JSValue JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList& ar
 
 JSValue JSCanvasRenderingContext2D::createPattern(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     JSValue value = args.at(0);
     if (!value.isObject())
@@ -362,7 +366,7 @@ JSValue JSCanvasRenderingContext2D::putImageData(ExecState* exec, const ArgList&
     // putImageData has two variants
     // putImageData(ImageData, x, y)
     // putImageData(ImageData, x, y, dirtyX, dirtyY, dirtyWidth, dirtyHeight)
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     ExceptionCode ec = 0;
     if (args.size() >= 7)
@@ -377,7 +381,7 @@ JSValue JSCanvasRenderingContext2D::putImageData(ExecState* exec, const ArgList&
 
 JSValue JSCanvasRenderingContext2D::fillText(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     // string arg = text to draw
     // number arg = x
@@ -395,7 +399,7 @@ JSValue JSCanvasRenderingContext2D::fillText(ExecState* exec, const ArgList& arg
 
 JSValue JSCanvasRenderingContext2D::strokeText(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     // string arg = text to draw
     // number arg = x
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp
new file mode 100644
index 0000000..3938ba1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp
@@ -0,0 +1,443 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasRenderingContext3D.h"
+
+#include "CanvasRenderingContext3D.h"
+#include "ExceptionCode.h"
+#include "HTMLCanvasElement.h"
+#include "HTMLImageElement.h"
+#include "JSCanvasFloatArray.h"
+#include "JSCanvasIntArray.h"
+#include "JSHTMLCanvasElement.h"
+#include "JSHTMLImageElement.h"
+#include "JSWebKitCSSMatrix.h"
+#include <runtime/Error.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/OwnFastMallocPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSCanvasRenderingContext3D::bufferData(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned usage = args.at(2).toInt32(exec);
+
+    // If argument 1 is a number, we are initializing this buffer to that size
+    if (!args.at(1).isObject()) {
+        unsigned int count = args.at(1).toInt32(exec);
+        static_cast<CanvasRenderingContext3D*>(impl())->bufferData(target, count, usage);
+        return jsUndefined();
+    }
+
+    CanvasArray* array = toCanvasArray(args.at(1));
+    
+    static_cast<CanvasRenderingContext3D*>(impl())->bufferData(target, array, usage);
+    return jsUndefined();
+}
+
+JSValue JSCanvasRenderingContext3D::bufferSubData(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned offset = args.at(1).toInt32(exec);
+    
+    CanvasArray* array = toCanvasArray(args.at(2));
+    
+    static_cast<CanvasRenderingContext3D*>(impl())->bufferSubData(target, offset, array);
+    return jsUndefined();
+}
+
+// void texImage2DHTML(in unsigned long target, in unsigned long level, in HTMLImageElement image);
+JSValue JSCanvasRenderingContext3D::texImage2D(ExecState* exec, const ArgList& args)
+{ 
+    if (args.size() < 3)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    CanvasRenderingContext3D* context = static_cast<CanvasRenderingContext3D*>(impl());    
+    unsigned target = args.at(0).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    unsigned level = args.at(1).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+    
+    if (args.size() > 5) {
+        // This must be the bare array case.
+        if (args.size() != 9)
+            return throwError(exec, SyntaxError);
+            
+        unsigned internalformat = args.at(2).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned width = args.at(3).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned height = args.at(4).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned border = args.at(5).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned format = args.at(6).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned type = args.at(7).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        CanvasArray* array = toCanvasArray(args.at(8));
+        if (exec->hadException())    
+            return jsUndefined();
+            
+        if (!array)
+            return throwError(exec, TypeError);
+        
+        // FIXME: Need to check to make sure CanvasArray is a CanvasByteArray or CanvasShortArray,
+        // depending on the passed type parameter.
+        
+        context->texImage2D(target, level, internalformat, width, height, border, format, type, array, ec);
+        return jsUndefined();
+    }
+    
+    // The image parameter can be a <img> or <canvas> element.
+    JSValue value = args.at(2);
+    if (!value.isObject())
+        return throwError(exec, TypeError);
+    JSObject* o = asObject(value);
+    
+    bool flipY = (args.size() > 3) ? args.at(3).toBoolean(exec) : false;
+    bool premultiplyAlpha = (args.size() > 4) ? args.at(3).toBoolean(exec) : false;
+    
+    if (o->inherits(&JSHTMLImageElement::s_info)) {
+        HTMLImageElement* imgElt = static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        context->texImage2D(target, level, imgElt, flipY, premultiplyAlpha, ec);
+    } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
+        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        context->texImage2D(target, level, canvas, flipY, premultiplyAlpha, ec);
+    } else {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+    }
+    
+    return jsUndefined();    
+}
+
+// void texSubImage2DHTML(in unsigned long target, in unsigned long level, in unsigned long xoff, in unsigned long yoff, in unsigned long width, in unsigned long height, in HTMLImageElement image);
+JSValue JSCanvasRenderingContext3D::texSubImage2D(ExecState* exec, const ArgList& args)
+{ 
+    if (args.size() < 7 || args.size() > 9)
+        return throwError(exec, SyntaxError);
+
+    CanvasRenderingContext3D* context = static_cast<CanvasRenderingContext3D*>(impl());    
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned level = args.at(1).toInt32(exec);
+    unsigned xoff = args.at(2).toInt32(exec);
+    unsigned yoff = args.at(3).toInt32(exec);
+    unsigned width = args.at(4).toInt32(exec);
+    unsigned height = args.at(5).toInt32(exec);
+    
+    // The image parameter can be a <img> or <canvas> element.
+    JSValue value = args.at(6);
+    if (!value.isObject())
+        return throwError(exec, TypeError);
+    JSObject* o = asObject(value);
+    
+    bool flipY = (args.size() > 3) ? args.at(3).toBoolean(exec) : false;
+    bool premultiplyAlpha = (args.size() > 4) ? args.at(3).toBoolean(exec) : false;
+    
+    ExceptionCode ec = 0;
+    if (o->inherits(&JSHTMLImageElement::s_info)) {
+        HTMLImageElement* imgElt = static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        context->texSubImage2D(target, level, xoff, yoff, width, height, imgElt, flipY, premultiplyAlpha, ec);
+    } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
+        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        context->texSubImage2D(target, level, xoff, yoff, width, height, canvas, flipY, premultiplyAlpha, ec);
+    } else {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+    }
+    
+    return jsUndefined();    
+}
+
+template<typename T>
+void toArray(JSC::ExecState* exec, JSC::JSValue value, T*& array, int& size)
+{
+    array = 0;
+    
+    if (!value.isObject())
+        return;
+        
+    JSC::JSObject* object = asObject(value);
+    int length = object->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
+    void* tempValues;
+    if (!tryFastMalloc(length * sizeof(T)).getValue(tempValues))
+        return;
+    
+    T* values = static_cast<T*>(tempValues);
+    for (int i = 0; i < length; ++i) {
+        JSC::JSValue v = object->get(exec, i);
+        if (exec->hadException())
+            return;
+        values[i] = static_cast<T>(v.toNumber(exec));
+    }
+
+    array = values;
+    size = length;
+}
+
+enum DataFunctionToCall {
+    f_uniform1v, f_uniform2v, f_uniform3v, f_uniform4v,
+    f_vertexAttrib1v, f_vertexAttrib2v, f_vertexAttrib3v, f_vertexAttrib4v
+};
+
+enum DataFunctionMatrixToCall {
+    f_uniformMatrix2fv, f_uniformMatrix3fv, f_uniformMatrix4fv
+};
+
+static JSC::JSValue dataFunctionf(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    long location = args.at(0).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    RefPtr<CanvasFloatArray> canvasArray = toCanvasFloatArray(args.at(1));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    if (canvasArray) {
+        switch(f) {
+            case f_uniform1v: context->uniform1fv(location, canvasArray.get()); break;
+            case f_uniform2v: context->uniform2fv(location, canvasArray.get()); break;
+            case f_uniform3v: context->uniform3fv(location, canvasArray.get()); break;
+            case f_uniform4v: context->uniform4fv(location, canvasArray.get()); break;
+            case f_vertexAttrib1v: context->vertexAttrib1fv(location, canvasArray.get()); break;
+            case f_vertexAttrib2v: context->vertexAttrib2fv(location, canvasArray.get()); break;
+            case f_vertexAttrib3v: context->vertexAttrib3fv(location, canvasArray.get()); break;
+            case f_vertexAttrib4v: context->vertexAttrib4fv(location, canvasArray.get()); break;
+        }
+        return jsUndefined();
+    }
+    
+    float* array;
+    int size;
+    toArray<float>(exec, args.at(1), array, size);
+    
+    if (!array)
+        return throwError(exec, TypeError);
+
+    switch(f) {
+        case f_uniform1v: context->uniform1fv(location, array, size); break;
+        case f_uniform2v: context->uniform2fv(location, array, size); break;
+        case f_uniform3v: context->uniform3fv(location, array, size); break;
+        case f_uniform4v: context->uniform4fv(location, array, size); break;
+        case f_vertexAttrib1v: context->vertexAttrib1fv(location, array, size); break;
+        case f_vertexAttrib2v: context->vertexAttrib2fv(location, array, size); break;
+        case f_vertexAttrib3v: context->vertexAttrib3fv(location, array, size); break;
+        case f_vertexAttrib4v: context->vertexAttrib4fv(location, array, size); break;
+    }
+    return jsUndefined();
+}
+
+static JSC::JSValue dataFunctioni(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    long location = args.at(0).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    RefPtr<CanvasIntArray> canvasArray = toCanvasIntArray(args.at(1));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    if (canvasArray) {
+        switch(f) {
+            case f_uniform1v: context->uniform1iv(location, canvasArray.get()); break;
+            case f_uniform2v: context->uniform2iv(location, canvasArray.get()); break;
+            case f_uniform3v: context->uniform3iv(location, canvasArray.get()); break;
+            case f_uniform4v: context->uniform4iv(location, canvasArray.get()); break;
+            default: break;
+        }
+        return jsUndefined();
+    }
+    
+    int* array;
+    int size;
+    toArray<int>(exec, args.at(1), array, size);
+    
+    if (!array)
+        return throwError(exec, TypeError);
+
+    switch(f) {
+        case f_uniform1v: context->uniform1iv(location, array, size); break;
+        case f_uniform2v: context->uniform2iv(location, array, size); break;
+        case f_uniform3v: context->uniform3iv(location, array, size); break;
+        case f_uniform4v: context->uniform4iv(location, array, size); break;
+        default: break;
+    }
+    return jsUndefined();
+}
+
+static JSC::JSValue dataFunctionMatrix(DataFunctionMatrixToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    long location = args.at(0).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    bool transpose = args.at(1).toBoolean(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    RefPtr<CanvasFloatArray> canvasArray = toCanvasFloatArray(args.at(2));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    if (canvasArray) {
+        switch(f) {
+            case f_uniformMatrix2fv: context->uniformMatrix2fv(location, transpose, canvasArray.get()); break;
+            case f_uniformMatrix3fv: context->uniformMatrix3fv(location, transpose, canvasArray.get()); break;
+            case f_uniformMatrix4fv: context->uniformMatrix4fv(location, transpose, canvasArray.get()); break;
+        }
+        return jsUndefined();
+    }
+    
+    float* array;
+    int size;
+    toArray<float>(exec, args.at(2), array, size);
+    
+    if (!array)
+        return throwError(exec, TypeError);
+
+    switch(f) {
+        case f_uniformMatrix2fv: context->uniformMatrix2fv(location, transpose, array, size); break;
+        case f_uniformMatrix3fv: context->uniformMatrix3fv(location, transpose, array, size); break;
+        case f_uniformMatrix4fv: context->uniformMatrix4fv(location, transpose, array, size); break;
+    }
+    return jsUndefined();
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform1fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform1iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform2iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform3iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform4iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix2fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix3fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix4fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib1fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
new file mode 100644
index 0000000..0cd2aa3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSCanvasRenderingContext.h"
+
+#include "CanvasRenderingContext2D.h"
+#include "JSCanvasRenderingContext2D.h"
+#if ENABLE(3D_CANVAS)
+#include "CanvasRenderingContext3D.h"
+#include "JSCanvasRenderingContext3D.h"
+#endif
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasRenderingContext* object)
+{
+    if (!object)
+        return jsUndefined();
+
+#if ENABLE(3D_CANVAS)
+    if (object->is3d())
+        return getDOMObjectWrapper<JSCanvasRenderingContext3D>(exec, globalObject, static_cast<CanvasRenderingContext3D*>(object));
+#endif
+    ASSERT(object->is2d());
+    return getDOMObjectWrapper<JSCanvasRenderingContext2D>(exec, globalObject, static_cast<CanvasRenderingContext2D*>(object));
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayConstructor.cpp
new file mode 100644
index 0000000..a885b7b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayConstructor.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasShortArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasShortArray.h"
+#include "JSCanvasArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasShortArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasShortArrayConstructor::s_info = { "CanvasShortArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasShortArrayConstructor::JSCanvasShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasShortArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasShortArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasShortArrayConstructor* jsConstructor = static_cast<JSCanvasShortArrayConstructor*>(constructor);
+    RefPtr<CanvasShortArray> array = static_cast<CanvasShortArray*>(construct<CanvasShortArray, short>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasShortArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayConstructor.h
new file mode 100644
index 0000000..df21825
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasShortArrayConstructor_h
+#define JSCanvasShortArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasShortArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasShortArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayCustom.cpp
new file mode 100644
index 0000000..21af0a6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasShortArray.h"
+
+#include "CanvasShortArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<signed short>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasShortArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasShortArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp
new file mode 100644
index 0000000..5d0800e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedByteArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasUnsignedByteArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasUnsignedByteArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasUnsignedByteArrayConstructor::s_info = { "CanvasUnsignedByteArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasUnsignedByteArrayConstructor::JSCanvasUnsignedByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasUnsignedByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedByteArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasUnsignedByteArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasUnsignedByteArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedByteArrayConstructor*>(constructor);
+    RefPtr<CanvasUnsignedByteArray> array = static_cast<CanvasUnsignedByteArray*>(construct<CanvasUnsignedByteArray, unsigned char>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasUnsignedByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasUnsignedByteArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.h
new file mode 100644
index 0000000..9cfb721
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasUnsignedByteArrayConstructor_h
+#define JSCanvasUnsignedByteArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasUnsignedByteArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasUnsignedByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasUnsignedByteArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayCustom.cpp
new file mode 100644
index 0000000..f2b0c74
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedByteArray.h"
+
+#include "CanvasUnsignedByteArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasUnsignedByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<unsigned char>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedByteArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasUnsignedByteArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp
new file mode 100644
index 0000000..5f145a7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedIntArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasUnsignedIntArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasUnsignedIntArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasUnsignedIntArrayConstructor::s_info = { "CanvasUnsignedIntArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasUnsignedIntArrayConstructor::JSCanvasUnsignedIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasUnsignedIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedIntArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasUnsignedIntArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasUnsignedIntArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedIntArrayConstructor*>(constructor);
+    RefPtr<CanvasUnsignedIntArray> array = static_cast<CanvasUnsignedIntArray*>(construct<CanvasUnsignedIntArray, unsigned int>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasUnsignedIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasUnsignedIntArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.h
new file mode 100644
index 0000000..6016159
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasUnsignedIntArrayConstructor_h
+#define JSCanvasUnsignedIntArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasUnsignedIntArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasUnsignedIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasUnsignedIntArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayCustom.cpp
new file mode 100644
index 0000000..95a80a7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedIntArray.h"
+
+#include "CanvasUnsignedIntArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasUnsignedIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<unsigned int>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedIntArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasUnsignedIntArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp
new file mode 100644
index 0000000..9735693
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedShortArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasUnsignedShortArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasUnsignedShortArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasUnsignedShortArrayConstructor::s_info = { "CanvasUnsignedShortArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasUnsignedShortArrayConstructor::JSCanvasUnsignedShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasUnsignedShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedShortArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasUnsignedShortArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasUnsignedShortArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedShortArrayConstructor*>(constructor);
+    RefPtr<CanvasUnsignedShortArray> array = static_cast<CanvasUnsignedShortArray*>(construct<CanvasUnsignedShortArray, unsigned short>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasUnsignedShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasUnsignedShortArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h
new file mode 100644
index 0000000..23c197f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasUnsignedShortArrayConstructor_h
+#define JSCanvasUnsignedShortArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasUnsignedShortArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasUnsignedShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasUnsignedShortArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayCustom.cpp
new file mode 100644
index 0000000..290cd4b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedShortArray.h"
+
+#include "CanvasUnsignedShortArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasUnsignedShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<unsigned short>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedShortArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasUnsignedShortArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSClipboardCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSClipboardCustom.cpp
index 73946c8..78dca49 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSClipboardCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSClipboardCustom.cpp
@@ -59,7 +59,7 @@ JSValue JSClipboard::types(ExecState* exec) const
     MarkedArgumentBuffer list;
     HashSet<String>::const_iterator end = types.end();
     for (HashSet<String>::const_iterator it = types.begin(); it != end; ++it)
-        list.append(jsString(exec, it->operator UString()));
+        list.append(jsString(exec, UString(*it)));
     return constructArray(exec, list);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
index e28fd8f..7074423 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
@@ -35,23 +35,18 @@ namespace WebCore {
 
 using namespace JSC;
 
-JSCustomPositionCallback::JSCustomPositionCallback(JSObject* callback, Frame* frame)
+JSCustomPositionCallback::JSCustomPositionCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
     : m_callback(callback)
-    , m_frame(frame)
+    , m_globalObject(globalObject)
 {
 }
 
-void JSCustomPositionCallback::handleEvent(Geoposition* geoposition, bool& raisedException)
+void JSCustomPositionCallback::handleEvent(Geoposition* geoposition)
 {
     ASSERT(m_callback);
-    ASSERT(m_frame);
-    
-    if (!m_frame->script()->isEnabled())
-        return;
+    ASSERT(m_globalObject);
 
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
+    ExecState* exec = m_globalObject->globalExec();
     
     JSC::JSLock lock(SilenceAssertionsOnly);
     
@@ -72,14 +67,12 @@ void JSCustomPositionCallback::handleEvent(Geoposition* geoposition, bool& raise
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), geoposition));
 
-    globalObject->globalData()->timeoutChecker->start();
+    m_globalObject->globalData()->timeoutChecker.start();
     call(exec, function, callType, callData, m_callback, args);
-    globalObject->globalData()->timeoutChecker->stop();
-    
-    if (exec->hadException()) {
+    m_globalObject->globalData()->timeoutChecker.stop();
+
+    if (exec->hadException())
         reportCurrentException(exec);
-        raisedException = true;
-    }
     
     Document::updateStyleForAllDocuments();
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.h
index 6c0d306..15a166a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.h
@@ -27,30 +27,28 @@
 #define JSCustomPositionCallback_h
 
 #include "PositionCallback.h"
-#include <runtime/JSObject.h>
+#include "JSDOMGlobalObject.h"
 #include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
-namespace JSC {
-    class JSObject;
-}
-
 namespace WebCore {
 
-class Frame;
 class Geoposition;
 
 class JSCustomPositionCallback : public PositionCallback {
 public:
-    static PassRefPtr<JSCustomPositionCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomPositionCallback(callback, frame)); }
+    static PassRefPtr<JSCustomPositionCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomPositionCallback(callback, globalObject));
+    }
     
-    virtual void handleEvent(Geoposition*, bool& raisedException);
-
 private:
-    JSCustomPositionCallback(JSC::JSObject* callback, Frame*);
+    JSCustomPositionCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
+
+    virtual void handleEvent(Geoposition*);
 
     JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    RefPtr<Frame> m_frame;
+    JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
 };
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
index dbe46e2..9109cd1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
@@ -35,23 +35,18 @@ namespace WebCore {
     
 using namespace JSC;
 
-JSCustomPositionErrorCallback::JSCustomPositionErrorCallback(JSObject* callback, Frame* frame)
+JSCustomPositionErrorCallback::JSCustomPositionErrorCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
     : m_callback(callback)
-    , m_frame(frame)
+    , m_globalObject(globalObject)
 {
 }
 
 void JSCustomPositionErrorCallback::handleEvent(PositionError* positionError)
 {
     ASSERT(m_callback);
-    ASSERT(m_frame);
-    
-    if (!m_frame->script()->isEnabled())
-        return;
+    ASSERT(m_globalObject);
 
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
+    ExecState* exec = m_globalObject->globalExec();
     
     JSC::JSLock lock(SilenceAssertionsOnly);
     
@@ -72,13 +67,13 @@ void JSCustomPositionErrorCallback::handleEvent(PositionError* positionError)
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), positionError));
     
-    globalObject->globalData()->timeoutChecker->start();
+    m_globalObject->globalData()->timeoutChecker.start();
     call(exec, function, callType, callData, m_callback, args);
-    globalObject->globalData()->timeoutChecker->stop();
+    m_globalObject->globalData()->timeoutChecker.stop();
     
     if (exec->hadException())
         reportCurrentException(exec);
-    
+
     Document::updateStyleForAllDocuments();
 }
     
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.h
index 9f143a2..d97e967 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.h
@@ -27,30 +27,27 @@
 #define JSCustomPositionErrorCallback_h
 
 #include "PositionErrorCallback.h"
-#include <runtime/JSObject.h>
+#include "JSDOMGlobalObject.h"
 #include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
-namespace JSC {
-    class JSObject;
-}
-
 namespace WebCore {
     
-class Frame;
 class PositionError;
 
 class JSCustomPositionErrorCallback : public PositionErrorCallback {
 public:
-    static PassRefPtr<JSCustomPositionErrorCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomPositionErrorCallback(callback, frame)); }
+    static PassRefPtr<JSCustomPositionErrorCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomPositionErrorCallback(callback, globalObject));
+    }
     
-    virtual void handleEvent(PositionError*);
-
 private:
-    JSCustomPositionErrorCallback(JSC::JSObject* callback, Frame*);
+    JSCustomPositionErrorCallback(JSC::JSObject* callback, JSDOMGlobalObject* globalObject);
+    virtual void handleEvent(PositionError*);
 
     JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    RefPtr<Frame> m_frame;
+    JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
 };
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
index a2b5c83..cdeda8f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
@@ -28,6 +28,7 @@
 
 #include "config.h"
 #include "JSCustomSQLStatementCallback.h"
+
 #if ENABLE(DATABASE)
 
 #include "Frame.h"
@@ -40,23 +41,18 @@ namespace WebCore {
     
 using namespace JSC;
     
-JSCustomSQLStatementCallback::JSCustomSQLStatementCallback(JSObject* callback, Frame* frame)
+JSCustomSQLStatementCallback::JSCustomSQLStatementCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
     : m_callback(callback)
-    , m_frame(frame)
+    , m_globalObject(globalObject)
 {
 }
     
 void JSCustomSQLStatementCallback::handleEvent(SQLTransaction* transaction, SQLResultSet* resultSet, bool& raisedException)
 {
     ASSERT(m_callback);
-    ASSERT(m_frame);
+    ASSERT(m_globalObject);
         
-    if (!m_frame->script()->isEnabled())
-        return;
-
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
+    ExecState* exec = m_globalObject->globalExec();
         
     JSC::JSLock lock(SilenceAssertionsOnly);
 
@@ -78,9 +74,9 @@ void JSCustomSQLStatementCallback::handleEvent(SQLTransaction* transaction, SQLR
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), transaction));
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), resultSet));
         
-    globalObject->globalData()->timeoutChecker->start();
+    m_globalObject->globalData()->timeoutChecker.start();
     call(exec, function, callType, callData, m_callback, args);
-    globalObject->globalData()->timeoutChecker->stop();
+    m_globalObject->globalData()->timeoutChecker.stop();
 
     if (exec->hadException()) {
         reportCurrentException(exec);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.h
index c380670..e6600c5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.h
@@ -31,32 +31,29 @@
 
 #if ENABLE(DATABASE)
 
+#include "JSDOMGlobalObject.h"
 #include "SQLStatementCallback.h"
-
-#include <runtime/JSObject.h>
 #include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
-namespace JSC {
-    class JSObject;
-}
-
 namespace WebCore {
 
-class Frame;
 class SQLResultSet;
 
 class JSCustomSQLStatementCallback : public SQLStatementCallback {
 public:
-    static PassRefPtr<JSCustomSQLStatementCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomSQLStatementCallback(callback, frame)); }
+    static PassRefPtr<JSCustomSQLStatementCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomSQLStatementCallback(callback, globalObject));
+    }
 
     virtual void handleEvent(SQLTransaction*, SQLResultSet*, bool& raisedException);
 
 private:
-    JSCustomSQLStatementCallback(JSC::JSObject* callback, Frame*);
+    JSCustomSQLStatementCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
     JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    RefPtr<Frame> m_frame;
+    JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
index c7c467f..ea47c64 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
@@ -41,23 +41,18 @@ namespace WebCore {
     
 using namespace JSC;
     
-JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback(JSObject* callback, Frame* frame)
+JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
     : m_callback(callback)
-    , m_frame(frame)
+    , m_globalObject(globalObject)
 {
 }
     
 bool JSCustomSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction, SQLError* error)
 {
     ASSERT(m_callback);
-    ASSERT(m_frame);
+    ASSERT(m_globalObject);
         
-    if (!m_frame->script()->isEnabled())
-        return true;
-
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
+    ExecState* exec = m_globalObject->globalExec();
         
     JSC::JSLock lock(SilenceAssertionsOnly);
         
@@ -82,13 +77,13 @@ bool JSCustomSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction,
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), error));
         
     JSValue result;
-    globalObject->globalData()->timeoutChecker->start();
+    m_globalObject->globalData()->timeoutChecker.start();
     if (handleEventCallType != CallTypeNone)
         result = call(exec, handleEventFunction, handleEventCallType, handleEventCallData, m_callback, args);
     else
         result = call(exec, m_callback, callbackCallType, callbackCallData, m_callback, args);
-    globalObject->globalData()->timeoutChecker->stop();
-        
+    m_globalObject->globalData()->timeoutChecker.stop();
+
     if (exec->hadException()) {
         reportCurrentException(exec);
             
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
index e563393..e03ac35 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
@@ -31,32 +31,29 @@
 
 #if ENABLE(DATABASE)
 
+#include "JSDOMGlobalObject.h"
 #include "SQLStatementErrorCallback.h"
-
-#include <runtime/JSObject.h>
 #include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
-namespace JSC {
-    class JSObject;
-}
-
 namespace WebCore {
     
-class Frame;
 class SQLError;
     
 class JSCustomSQLStatementErrorCallback : public SQLStatementErrorCallback {
 public:
-    static PassRefPtr<JSCustomSQLStatementErrorCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomSQLStatementErrorCallback(callback, frame)); }
+    static PassRefPtr<JSCustomSQLStatementErrorCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomSQLStatementErrorCallback(callback, globalObject));
+    }
         
     virtual bool handleEvent(SQLTransaction*, SQLError*);
 
 private:
-    JSCustomSQLStatementErrorCallback(JSC::JSObject* callback, Frame*);
+    JSCustomSQLStatementErrorCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
     JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    RefPtr<Frame> m_frame;
+    JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
 };
     
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
index ca7f069..1886345 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
@@ -32,9 +32,10 @@
 #if ENABLE(DATABASE)
 
 #include "Frame.h"
-#include "ScriptController.h"
+#include "JSDOMGlobalObject.h"
 #include "JSSQLTransaction.h"
 #include "Page.h"
+#include "ScriptController.h"
 #include <runtime/JSLock.h>
 #include <wtf/MainThread.h>
 #include <wtf/RefCountedLeakCounter.h>
@@ -47,25 +48,28 @@ using namespace JSC;
 static WTF::RefCountedLeakCounter counter("JSCustomSQLTransactionCallback");
 #endif
 
-// We have to clean up the data on the main thread for two reasons:
-//
-//     1) Can't deref a Frame on a non-main thread.
-//     2) Unprotecting the JSObject on a non-main thread would register that thread
-//        for JavaScript garbage collection, which could unnecessarily slow things down.
+// We have to clean up the data on the main thread because unprotecting the 
+// JSObject on a non-main thread would register that thread for JavaScript
+// garbage collection, which could unnecessarily slow things down.
 
 class JSCustomSQLTransactionCallback::Data {
 public:
-    Data(JSObject* callback, Frame* frame) : m_callback(callback), m_frame(frame) { }
+    Data(JSObject* callback, JSDOMGlobalObject* globalObject)
+        : m_callback(callback)
+        , m_globalObject(globalObject)
+    {
+    }
+
     JSObject* callback() { return m_callback; }
-    Frame* frame() { return m_frame.get(); }
+    JSDOMGlobalObject* globalObject() { return m_globalObject.get(); }
 
 private:
     ProtectedPtr<JSObject> m_callback;
-    RefPtr<Frame> m_frame;
+    ProtectedPtr<JSDOMGlobalObject> m_globalObject;
 };
 
-JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback(JSObject* callback, Frame* frame)
-    : m_data(new Data(callback, frame))
+JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
+    : m_data(new Data(callback, globalObject))
 {
 #ifndef NDEBUG
     counter.increment();
@@ -90,13 +94,9 @@ void JSCustomSQLTransactionCallback::handleEvent(SQLTransaction* transaction, bo
 {
     ASSERT(m_data);
     ASSERT(m_data->callback());
-    ASSERT(m_data->frame());
-
-    if (!m_data->frame()->script()->isEnabled())
-        return;
+    ASSERT(m_data->globalObject());
 
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_data->frame()->script()->globalObject();
+    JSDOMGlobalObject* globalObject = m_data->globalObject();
     ExecState* exec = globalObject->globalExec();
         
     JSC::JSLock lock(SilenceAssertionsOnly);
@@ -120,12 +120,12 @@ void JSCustomSQLTransactionCallback::handleEvent(SQLTransaction* transaction, bo
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), transaction));
 
-    globalObject->globalData()->timeoutChecker->start();
+    globalObject->globalData()->timeoutChecker.start();
     if (handleEventCallType != CallTypeNone)
         call(exec, handleEventFunction, handleEventCallType, handleEventCallData, m_data->callback(), args);
     else
         call(exec, m_data->callback(), callbackCallType, callbackCallData, m_data->callback(), args);
-    globalObject->globalData()->timeoutChecker->stop();
+    globalObject->globalData()->timeoutChecker.stop();
         
     if (exec->hadException()) {
         reportCurrentException(exec);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
index 22c367c..f7f78f2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
@@ -32,7 +32,6 @@
 #if ENABLE(DATABASE)
 
 #include "SQLTransactionCallback.h"
-
 #include <wtf/PassRefPtr.h>
 
 namespace JSC {
@@ -42,17 +41,21 @@ namespace JSC {
 namespace WebCore {
 
 class Frame;
+class JSDOMGlobalObject;
 
 class JSCustomSQLTransactionCallback : public SQLTransactionCallback {
 public:
-    static PassRefPtr<JSCustomSQLTransactionCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomSQLTransactionCallback(callback, frame)); }
+    static PassRefPtr<JSCustomSQLTransactionCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomSQLTransactionCallback(callback, globalObject));
+    }
 
     virtual ~JSCustomSQLTransactionCallback();
     
     virtual void handleEvent(SQLTransaction*, bool& raisedException);
 
 private:
-    JSCustomSQLTransactionCallback(JSC::JSObject* callback, Frame*);
+    JSCustomSQLTransactionCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
     static void deleteData(void*);
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
index 1c6de7f..b2f8280 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
@@ -40,23 +40,18 @@ namespace WebCore {
     
 using namespace JSC;
     
-JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback(JSObject* callback, Frame* frame)
+JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
     : m_callback(callback)
-    , m_frame(frame)
+    , m_globalObject(globalObject)
 {
 }
     
 void JSCustomSQLTransactionErrorCallback::handleEvent(SQLError* error)
 {
     ASSERT(m_callback);
-    ASSERT(m_frame);
+    ASSERT(m_globalObject);
 
-    if (!m_frame->script()->isEnabled())
-        return;
-
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
+    ExecState* exec = m_globalObject->globalExec();
 
     JSC::JSLock lock(SilenceAssertionsOnly);
 
@@ -77,9 +72,9 @@ void JSCustomSQLTransactionErrorCallback::handleEvent(SQLError* error)
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), error));
 
-    globalObject->globalData()->timeoutChecker->start();
+    m_globalObject->globalData()->timeoutChecker.start();
     call(exec, function, callType, callData, m_callback, args);
-    globalObject->globalData()->timeoutChecker->stop();
+    m_globalObject->globalData()->timeoutChecker.stop();
 
     if (exec->hadException())
         reportCurrentException(exec);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
index be3df29..42fcbce 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
@@ -32,31 +32,28 @@
 #if ENABLE(DATABASE)
 
 #include "SQLTransactionErrorCallback.h"
-
-#include <runtime/JSObject.h>
+#include "JSDOMGlobalObject.h"
 #include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
-namespace JSC {
-    class JSObject;
-}
-
 namespace WebCore {
 
-class Frame;
 class SQLError;
 
 class JSCustomSQLTransactionErrorCallback : public SQLTransactionErrorCallback {
 public:
-    static PassRefPtr<JSCustomSQLTransactionErrorCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomSQLTransactionErrorCallback(callback, frame)); }
+    static PassRefPtr<JSCustomSQLTransactionErrorCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomSQLTransactionErrorCallback(callback, globalObject));
+    }
     
     virtual void handleEvent(SQLError*);
 
 private:
-    JSCustomSQLTransactionErrorCallback(JSC::JSObject* callback, Frame*);
+    JSCustomSQLTransactionErrorCallback(JSC::JSObject* callback, JSDOMGlobalObject* globalObject);
 
     JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    RefPtr<Frame> m_frame;
+    JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.cpp
index 2273ff0..5300c42 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.cpp
@@ -38,22 +38,18 @@ namespace WebCore {
     
 using namespace JSC;
     
-JSCustomVoidCallback::JSCustomVoidCallback(JSObject* callback, Frame* frame)
+JSCustomVoidCallback::JSCustomVoidCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
     : m_callback(callback)
-    , m_frame(frame)
+    , m_globalObject(globalObject)
 {
 }
     
 void JSCustomVoidCallback::handleEvent()
 {
     ASSERT(m_callback);
-    ASSERT(m_frame);
-       
-    if (!m_frame->script()->isEnabled())
-        return;
-        
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
+    ASSERT(m_globalObject);
+
+    ExecState* exec = m_globalObject->globalExec();
         
     JSC::JSLock lock(SilenceAssertionsOnly);
         
@@ -73,27 +69,14 @@ void JSCustomVoidCallback::handleEvent()
         
     MarkedArgumentBuffer args;
     
-    globalObject->globalData()->timeoutChecker->start();
+    m_globalObject->globalData()->timeoutChecker.start();
     call(exec, function, callType, callData, m_callback, args);
-    globalObject->globalData()->timeoutChecker->stop();
-        
+    m_globalObject->globalData()->timeoutChecker.stop();
+
     if (exec->hadException())
         reportCurrentException(exec);
         
     Document::updateStyleForAllDocuments();
 }
- 
-PassRefPtr<VoidCallback> toVoidCallback(ExecState* exec, JSValue value)
-{
-    JSObject* object = value.getObject();
-    if (!object)
-        return 0;
-    
-    Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!frame)
-        return 0;
-    
-    return JSCustomVoidCallback::create(object, frame);
-}
 
-}
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.h
index 9cd7c34..f3db49f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.h
@@ -29,33 +29,28 @@
 #ifndef JSCustomVoidCallback_h
 #define JSCustomVoidCallback_h
 
+#include "JSDOMGlobalObject.h"
 #include "VoidCallback.h"
-
-#include <runtime/JSObject.h>
 #include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
 namespace WebCore {
+
+class JSCustomVoidCallback : public VoidCallback {
+public: 
+    static PassRefPtr<JSCustomVoidCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomVoidCallback(callback, globalObject));
+    }
     
-    class Frame;
+    virtual void handleEvent();
     
-    class JSCustomVoidCallback : public VoidCallback {
-    public: 
-        static PassRefPtr<JSCustomVoidCallback> create(JSC::JSObject* callback, Frame* frame)
-        {
-            return adoptRef(new JSCustomVoidCallback(callback, frame));
-        }
-        
-        virtual void handleEvent();
-        
-    private:
-        JSCustomVoidCallback(JSC::JSObject* callback, Frame*);
-
-        JSC::ProtectedPtr<JSC::JSObject> m_callback;
-        RefPtr<Frame> m_frame;
-    };
+private:
+    JSCustomVoidCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
-    PassRefPtr<VoidCallback> toVoidCallback(JSC::ExecState*, JSC::JSValue);
+    JSC::ProtectedPtr<JSC::JSObject> m_callback;
+    JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
+};
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
index 55e6481..4476be5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
@@ -95,9 +95,9 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
     MarkedArgumentBuffer args;
     args.append(jsString(exec, prefix));
 
-    globalObject->globalData()->timeoutChecker->start();
+    globalObject->globalData()->timeoutChecker.start();
     JSValue retval = call(exec, function, callType, callData, m_customResolver, args);
-    globalObject->globalData()->timeoutChecker->stop();
+    globalObject->globalData()->timeoutChecker.stop();
 
     String result;
     if (exec->hadException())
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
index a7fae78..b833e71 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
@@ -42,25 +42,25 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSDOMApplicationCache::mark()
+void JSDOMApplicationCache::markChildren(MarkStack& markStack)
 {
-    Base::mark();
+    Base::markChildren(markStack);
 
-    markIfNotNull(m_impl->onchecking());
-    markIfNotNull(m_impl->onerror());
-    markIfNotNull(m_impl->onnoupdate());
-    markIfNotNull(m_impl->ondownloading());
-    markIfNotNull(m_impl->onprogress());
-    markIfNotNull(m_impl->onupdateready());
-    markIfNotNull(m_impl->oncached());
-    markIfNotNull(m_impl->onobsolete());
+    markIfNotNull(markStack, m_impl->onchecking());
+    markIfNotNull(markStack, m_impl->onerror());
+    markIfNotNull(markStack, m_impl->onnoupdate());
+    markIfNotNull(markStack, m_impl->ondownloading());
+    markIfNotNull(markStack, m_impl->onprogress());
+    markIfNotNull(markStack, m_impl->onupdateready());
+    markIfNotNull(markStack, m_impl->oncached());
+    markIfNotNull(markStack, m_impl->onobsolete());
 
     typedef DOMApplicationCache::EventListenersMap EventListenersMap;
     typedef DOMApplicationCache::ListenerVector ListenerVector;
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
         for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction();
+            (*vecIter)->markJSFunction(markStack);
     }
 }
 
@@ -112,10 +112,12 @@ JSValue JSDOMApplicationCache::addEventListener(ExecState* exec, const ArgList&
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -124,10 +126,12 @@ JSValue JSDOMApplicationCache::removeEventListener(ExecState* exec, const ArgLis
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
index 910da12..df384ea 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
@@ -18,11 +18,6 @@
  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
-// gcc 3.x can't handle including the HashMap pointer specialization in this file
-#if defined __GNUC__ && !defined __GLIBCXX__ // less than gcc 3.4
-#define HASH_MAP_PTR_SPEC_WORKAROUND 1
-#endif
-
 #include "config.h"
 #include "JSDOMBinding.h"
 
@@ -33,6 +28,7 @@
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "HTMLAudioElement.h"
+#include "HTMLCanvasElement.h"
 #include "HTMLImageElement.h"
 #include "HTMLScriptElement.h"
 #include "HTMLNames.h"
@@ -47,6 +43,8 @@
 #include "RangeException.h"
 #include "ScriptController.h"
 #include "XMLHttpRequestException.h"
+#include <runtime/Error.h>
+#include <runtime/JSFunction.h>
 #include <runtime/PrototypeFunction.h>
 #include <wtf/StdLibExtras.h>
 
@@ -269,18 +267,48 @@ static inline bool isObservableThroughDOM(JSNode* jsNode)
     Node* node = jsNode->impl();
 
     if (node->inDocument()) {
-        // 1. If a node is in the document, and its wrapper has custom properties,
+        // If a node is in the document, and its wrapper has custom properties,
         // the wrapper is observable because future access to the node through the
         // DOM must reflect those properties.
         if (jsNode->hasCustomProperties())
             return true;
 
-        // 2. If a node is in the document, and has event listeners, its wrapper is
+        // If a node is in the document, and has event listeners, its wrapper is
         // observable because its wrapper is responsible for marking those event listeners.
         if (node->eventListeners().size())
             return true; // Technically, we may overzealously mark a wrapper for a node that has only non-JS event listeners. Oh well.
+
+        // If a node owns another object with a wrapper with custom properties,
+        // the wrapper must be treated as observable, because future access to
+        // those objects through the DOM must reflect those properties.
+        // FIXME: It would be better if this logic could be in the node next to
+        // the custom markChildren functions rather than here.
+        if (node->isElementNode()) {
+            if (NamedNodeMap* attributes = static_cast<Element*>(node)->attributeMap()) {
+                if (DOMObject* wrapper = getCachedDOMObjectWrapper(*jsNode->globalObject()->globalData(), attributes)) {
+                    if (wrapper->hasCustomProperties())
+                        return true;
+                }
+            }
+            if (node->isStyledElement()) {
+                if (CSSMutableStyleDeclaration* style = static_cast<StyledElement*>(node)->inlineStyleDecl()) {
+                    if (DOMObject* wrapper = getCachedDOMObjectWrapper(*jsNode->globalObject()->globalData(), style)) {
+                        if (wrapper->hasCustomProperties())
+                            return true;
+                    }
+                }
+            }
+            if (static_cast<Element*>(node)->hasTagName(canvasTag)) {
+                if (CanvasRenderingContext* context = static_cast<HTMLCanvasElement*>(node)->renderingContext()) {
+                    if (DOMObject* wrapper = getCachedDOMObjectWrapper(*jsNode->globalObject()->globalData(), context)) {
+                        if (wrapper->hasCustomProperties())
+                            return true;
+                    }
+                }
+            }
+        }
     } else {
-        // 3. If a wrapper is the last reference to an image or script element
+        // If a wrapper is the last reference to an image or script element
         // that is loading but not in the document, the wrapper is observable
         // because it is the only thing keeping the image element alive, and if
         // the image element is destroyed, its load event will not fire.
@@ -298,18 +326,18 @@ static inline bool isObservableThroughDOM(JSNode* jsNode)
     return false;
 }
 
-void markDOMNodesForDocument(Document* doc)
+void markDOMNodesForDocument(MarkStack& markStack, Document* doc)
 {
     JSWrapperCache& nodeDict = doc->wrapperCache();
     JSWrapperCache::iterator nodeEnd = nodeDict.end();
     for (JSWrapperCache::iterator nodeIt = nodeDict.begin(); nodeIt != nodeEnd; ++nodeIt) {
         JSNode* jsNode = nodeIt->second;
-        if (!jsNode->marked() && isObservableThroughDOM(jsNode))
-            jsNode->mark();
+        if (isObservableThroughDOM(jsNode))
+            markStack.append(jsNode);
     }
 }
 
-void markActiveObjectsForContext(JSGlobalData& globalData, ScriptExecutionContext* scriptExecutionContext)
+void markActiveObjectsForContext(MarkStack& markStack, JSGlobalData& globalData, ScriptExecutionContext* scriptExecutionContext)
 {
     // If an element has pending activity that may result in event listeners being called
     // (e.g. an XMLHttpRequest), we need to keep JS wrappers alive.
@@ -322,8 +350,8 @@ void markActiveObjectsForContext(JSGlobalData& globalData, ScriptExecutionContex
             // Generally, an active object with pending activity must have a wrapper to mark its listeners.
             // However, some ActiveDOMObjects don't have JS wrappers (timers created by setTimeout is one example).
             // FIXME: perhaps need to make sure even timers have a markable 'wrapper'.
-            if (wrapper && !wrapper->marked())
-                wrapper->mark();
+            if (wrapper)
+                markStack.append(wrapper);
         }
     }
 
@@ -333,8 +361,8 @@ void markActiveObjectsForContext(JSGlobalData& globalData, ScriptExecutionContex
         // If the message port is remotely entangled, then always mark it as in-use because we can't determine reachability across threads.
         if (!(*iter)->locallyEntangledPort() || (*iter)->hasPendingActivity()) {
             DOMObject* wrapper = getCachedDOMObjectWrapper(globalData, *iter);
-            if (wrapper && !wrapper->marked())
-                wrapper->mark();
+            if (wrapper)
+                markStack.append(wrapper);
         }
     }
 }
@@ -351,14 +379,17 @@ void updateDOMNodeDocument(Node* node, Document* oldDocument, Document* newDocum
     addWrapper(wrapper);
 }
 
-void markDOMObjectWrapper(JSGlobalData& globalData, void* object)
+void markDOMObjectWrapper(MarkStack& markStack, JSGlobalData& globalData, void* object)
 {
+    // FIXME: This could be changed to only mark wrappers that are "observable"
+    // as markDOMNodesForDocument does, allowing us to collect more wrappers,
+    // but doing this correctly would be challenging.
     if (!object)
         return;
     DOMObject* wrapper = getCachedDOMObjectWrapper(globalData, object);
-    if (!wrapper || wrapper->marked())
+    if (!wrapper)
         return;
-    wrapper->mark();
+    markStack.append(wrapper);
 }
 
 JSValue jsStringOrNull(ExecState* exec, const String& s)
@@ -594,4 +625,27 @@ void cacheDOMConstructor(ExecState* exec, const ClassInfo* classInfo, JSObject*
     constructors.set(classInfo, constructor);
 }
 
+JSC::JSObject* toJSSequence(ExecState* exec, JSValue value, unsigned& length)
+{
+    JSObject* object = value.getObject();
+    if (!object) {
+        throwError(exec, TypeError);
+        return 0;
+    }
+    JSValue lengthValue = object->get(exec, exec->propertyNames().length);
+    if (exec->hadException())
+        return 0;
+
+    if (lengthValue.isUndefinedOrNull()) {
+        throwError(exec, TypeError);
+        return 0;
+    }
+
+    length = lengthValue.toUInt32(exec);
+    if (exec->hadException())
+        return 0;
+
+    return object;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
index 3975940..c3ab266 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
  *  Copyright (C) 2009 Google, Inc. All rights reserved.
  *
@@ -26,7 +26,6 @@
 #include "Document.h" // For DOMConstructorWithDocument
 #include <runtime/Completion.h>
 #include <runtime/Lookup.h>
-#include <runtime/JSFunction.h>
 #include <wtf/Noncopyable.h>
 
 namespace JSC {
@@ -61,7 +60,7 @@ namespace WebCore {
 #endif
     };
 
-    // FIXME: This class should colapse into DOMObject once all DOMObjects are
+    // FIXME: This class should collapse into DOMObject once all DOMObjects are
     // updated to store a globalObject pointer.
     class DOMObjectWithGlobalPointer : public DOMObject {
     public:
@@ -73,6 +72,11 @@ namespace WebCore {
             return m_globalObject->scriptExecutionContext();
         }
 
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+        {
+            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasStandardGetOwnPropertySlot));
+        }
+
     protected:
         DOMObjectWithGlobalPointer(PassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
             : DOMObject(structure)
@@ -83,13 +87,12 @@ namespace WebCore {
             // needing to reach through the frame to get to the Document*.  See bug 27640.
             // ASSERT(globalObject->scriptExecutionContext());
         }
-        virtual ~DOMObjectWithGlobalPointer() {}
+        virtual ~DOMObjectWithGlobalPointer() { }
 
-        void mark()
+        void markChildren(JSC::MarkStack& markStack)
         {
-            DOMObject::mark();
-            if (!m_globalObject->marked())
-                m_globalObject->mark();
+            DOMObject::markChildren(markStack);
+            markStack.append(m_globalObject);
         }
 
     private:
@@ -137,9 +140,9 @@ namespace WebCore {
     void forgetDOMNode(Document*, Node*);
     void forgetAllDOMNodesForDocument(Document*);
     void updateDOMNodeDocument(Node*, Document* oldDocument, Document* newDocument);
-    void markDOMNodesForDocument(Document*);
-    void markActiveObjectsForContext(JSC::JSGlobalData&, ScriptExecutionContext*);
-    void markDOMObjectWrapper(JSC::JSGlobalData& globalData, void* object);
+    void markDOMNodesForDocument(JSC::MarkStack&, Document*);
+    void markActiveObjectsForContext(JSC::MarkStack&, JSC::JSGlobalData&, ScriptExecutionContext*);
+    void markDOMObjectWrapper(JSC::MarkStack&, JSC::JSGlobalData& globalData, void* object);
 
     JSC::Structure* getCachedDOMStructure(JSDOMGlobalObject*, const JSC::ClassInfo*);
     JSC::Structure* cacheDOMStructure(JSDOMGlobalObject*, PassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
@@ -278,6 +281,9 @@ namespace WebCore {
         return toJS(exec, globalObject, ptr.get());
     }
 
+    // Validates that the passed object is a sequence type per section 4.1.13 of the WebIDL spec.
+    JSC::JSObject* toJSSequence(JSC::ExecState*, JSC::JSValue, unsigned&);
+
     bool checkNodeSecurity(JSC::ExecState*, Node*);
 
     // Helpers for Window, History, and Location classes to implement cross-domain policy.
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
index a7f7b21..240a56c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -50,47 +50,17 @@ JSDOMGlobalObject::JSDOMGlobalObject(PassRefPtr<Structure> structure, JSDOMGloba
 {
 }
 
-JSDOMGlobalObject::~JSDOMGlobalObject()
+void JSDOMGlobalObject::markChildren(MarkStack& markStack)
 {
-    JSListenersMap::iterator it = d()->jsEventListeners.begin();
-    JSListenersMap::iterator end = d()->jsEventListeners.end();
-    for (; it != end; ++it)
-        it->second->clearGlobalObject();
-}
-
-void JSDOMGlobalObject::mark()
-{
-    Base::mark();
+    Base::markChildren(markStack);
 
     JSDOMStructureMap::iterator end = structures().end();
     for (JSDOMStructureMap::iterator it = structures().begin(); it != end; ++it)
-        it->second->mark();
+        it->second->markAggregate(markStack);
 
     JSDOMConstructorMap::iterator end2 = constructors().end();
-    for (JSDOMConstructorMap::iterator it2 = constructors().begin(); it2 != end2; ++it2) {
-        if (!it2->second->marked())
-            it2->second->mark();
-    }
-}
-
-JSEventListener* JSDOMGlobalObject::findJSEventListener(JSValue val)
-{
-    if (!val.isObject())
-        return 0;
-
-    return d()->jsEventListeners.get(asObject(val));
-}
-
-PassRefPtr<JSEventListener> JSDOMGlobalObject::findOrCreateJSEventListener(JSValue val)
-{
-    if (JSEventListener* listener = findJSEventListener(val))
-        return listener;
-
-    if (!val.isObject())
-        return 0;
-
-    // The JSEventListener constructor adds it to our jsEventListeners map.
-    return JSEventListener::create(asObject(val), this, false).get();
+    for (JSDOMConstructorMap::iterator it2 = constructors().begin(); it2 != end2; ++it2)
+        markStack.append(it2->second);
 }
 
 PassRefPtr<JSEventListener> JSDOMGlobalObject::createJSAttributeEventListener(JSValue val)
@@ -101,11 +71,6 @@ PassRefPtr<JSEventListener> JSDOMGlobalObject::createJSAttributeEventListener(JS
     return JSEventListener::create(asObject(val), this, true).get();
 }
 
-JSDOMGlobalObject::JSListenersMap& JSDOMGlobalObject::jsEventListeners()
-{
-    return d()->jsEventListeners;
-}
-
 void JSDOMGlobalObject::setCurrentEvent(Event* evt)
 {
     d()->evt = evt;
@@ -116,10 +81,15 @@ Event* JSDOMGlobalObject::currentEvent() const
     return d()->evt;
 }
 
+JSDOMGlobalObject* toJSDOMGlobalObject(Document* document)
+{
+    return toJSDOMWindow(document->frame());
+}
+
 JSDOMGlobalObject* toJSDOMGlobalObject(ScriptExecutionContext* scriptExecutionContext)
 {
     if (scriptExecutionContext->isDocument())
-        return toJSDOMWindow(static_cast<Document*>(scriptExecutionContext)->frame());
+        return toJSDOMGlobalObject(static_cast<Document*>(scriptExecutionContext));
 
 #if ENABLE(WORKERS)
     if (scriptExecutionContext->isWorkerContext())
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
index bc6c1f2..996e155 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
@@ -31,6 +31,7 @@
 
 namespace WebCore {
 
+    class Document;
     class Event;
     class JSLazyEventListener;
     class JSEventListener;
@@ -45,7 +46,6 @@ namespace WebCore {
         struct JSDOMGlobalObjectData;
 
         JSDOMGlobalObject(PassRefPtr<JSC::Structure>, JSDOMGlobalObjectData*, JSC::JSObject* thisValue);
-        virtual ~JSDOMGlobalObject();
 
     public:
         JSDOMStructureMap& structures() { return d()->structures; }
@@ -53,27 +53,17 @@ namespace WebCore {
 
         virtual ScriptExecutionContext* scriptExecutionContext() const = 0;
 
-        // Finds a wrapper of a GC-unprotected JS EventListener, returns 0 if no existing one.
-        JSEventListener* findJSEventListener(JSC::JSValue);
-
-        // Finds or creates a wrapper of a JS EventListener. JS EventListener object is *NOT* GC-protected.
-        PassRefPtr<JSEventListener> findOrCreateJSEventListener(JSC::JSValue);
-
-        // Creates a GC-protected JS EventListener for an "onXXX" event attribute.
-        // These listeners cannot be removed through the removeEventListener API.
+        // Creates a JS EventListener for an "onXXX" event attribute. These
+        // listeners cannot be removed through the removeEventListener API.
         PassRefPtr<JSEventListener> createJSAttributeEventListener(JSC::JSValue);
 
-        typedef HashMap<JSC::JSObject*, JSEventListener*> JSListenersMap;
-
-        JSListenersMap& jsEventListeners();
-
         // Make binding code generation easier.
         JSDOMGlobalObject* globalObject() { return this; }
 
         void setCurrentEvent(Event*);
         Event* currentEvent() const;
 
-        virtual void mark();
+        virtual void markChildren(JSC::MarkStack&);
 
     protected:
         struct JSDOMGlobalObjectData : public JSC::JSGlobalObject::JSGlobalObjectData {
@@ -82,8 +72,6 @@ namespace WebCore {
             JSDOMStructureMap structures;
             JSDOMConstructorMap constructors;
 
-            JSDOMGlobalObject::JSListenersMap jsEventListeners;
-
             Event* evt;
         };
 
@@ -102,6 +90,7 @@ namespace WebCore {
         return constructor;
     }
 
+    JSDOMGlobalObject* toJSDOMGlobalObject(Document*);
     JSDOMGlobalObject* toJSDOMGlobalObject(ScriptExecutionContext*);
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
index cf81f54..6eca3e7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -113,7 +113,7 @@ ExecState* JSDOMWindowBase::globalExec()
 
 bool JSDOMWindowBase::supportsProfiling() const
 {
-#if !ENABLE(JAVASCRIPT_DEBUGGER)
+#if !ENABLE(JAVASCRIPT_DEBUGGER) || !ENABLE(INSPECTOR)
     return false;
 #else
     Frame* frame = impl()->frame();
@@ -166,7 +166,10 @@ JSGlobalData* JSDOMWindowBase::commonJSGlobalData()
     static JSGlobalData* globalData;
     if (!globalData) {
         globalData = JSGlobalData::createLeaked().releaseRef();
-        globalData->timeoutChecker->setTimeoutInterval(10000); // 10 seconds
+        globalData->timeoutChecker.setTimeoutInterval(10000); // 10 seconds
+#ifndef NDEBUG
+        globalData->mainThreadOnly = true;
+#endif
     }
 
     return globalData;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
index 93eae74..27e95fe 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -38,22 +38,42 @@
 #include "JSDOMWindowShell.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
+#include "JSEventSourceConstructor.h"
 #include "JSHTMLCollection.h"
 #include "JSHistory.h"
 #include "JSImageConstructor.h"
 #include "JSLocation.h"
 #include "JSMessageChannelConstructor.h"
 #include "JSMessagePort.h"
+#include "JSMessagePortCustom.h"
 #include "JSOptionConstructor.h"
+
+#if ENABLE(SHARED_WORKERS)
 #include "JSSharedWorkerConstructor.h"
+#endif
+
+#if ENABLE(3D_CANVAS)
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasByteArrayConstructor.h"
+#include "JSCanvasUnsignedByteArrayConstructor.h"
+#include "JSCanvasIntArrayConstructor.h"
+#include "JSCanvasUnsignedIntArrayConstructor.h"
+#include "JSCanvasShortArrayConstructor.h"
+#include "JSCanvasUnsignedShortArrayConstructor.h"
+#include "JSCanvasFloatArrayConstructor.h"
+#endif
 #include "JSWebKitCSSMatrixConstructor.h"
 #include "JSWebKitPointConstructor.h"
+#if ENABLE(WEB_SOCKETS)
+#include "JSWebSocketConstructor.h"
+#endif
 #include "JSWorkerConstructor.h"
 #include "JSXMLHttpRequestConstructor.h"
 #include "JSXSLTProcessorConstructor.h"
 #include "Location.h"
 #include "MediaPlayer.h"
 #include "MessagePort.h"
+#include "NotificationCenter.h"
 #include "Page.h"
 #include "PlatformScreen.h"
 #include "RegisteredEventListener.h"
@@ -61,6 +81,8 @@
 #include "ScriptController.h"
 #include "Settings.h"
 #include "WindowFeatures.h"
+#include <runtime/Error.h>
+#include <runtime/JSFunction.h>
 #include <runtime/JSObject.h>
 #include <runtime/PrototypeFunction.h>
 
@@ -68,32 +90,32 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSDOMWindow::mark()
+void JSDOMWindow::markChildren(MarkStack& markStack)
 {
-    Base::mark();
+    Base::markChildren(markStack);
 
-    markEventListeners(impl()->eventListeners());
+    markEventListeners(markStack, impl()->eventListeners());
 
     JSGlobalData& globalData = *Heap::heap(this)->globalData();
 
-    markDOMObjectWrapper(globalData, impl()->optionalConsole());
-    markDOMObjectWrapper(globalData, impl()->optionalHistory());
-    markDOMObjectWrapper(globalData, impl()->optionalLocationbar());
-    markDOMObjectWrapper(globalData, impl()->optionalMenubar());
-    markDOMObjectWrapper(globalData, impl()->optionalNavigator());
-    markDOMObjectWrapper(globalData, impl()->optionalPersonalbar());
-    markDOMObjectWrapper(globalData, impl()->optionalScreen());
-    markDOMObjectWrapper(globalData, impl()->optionalScrollbars());
-    markDOMObjectWrapper(globalData, impl()->optionalSelection());
-    markDOMObjectWrapper(globalData, impl()->optionalStatusbar());
-    markDOMObjectWrapper(globalData, impl()->optionalToolbar());
-    markDOMObjectWrapper(globalData, impl()->optionalLocation());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalConsole());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalHistory());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalLocationbar());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalMenubar());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalNavigator());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalPersonalbar());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalScreen());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalScrollbars());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalSelection());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalStatusbar());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalToolbar());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalLocation());
 #if ENABLE(DOM_STORAGE)
-    markDOMObjectWrapper(globalData, impl()->optionalSessionStorage());
-    markDOMObjectWrapper(globalData, impl()->optionalLocalStorage());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalSessionStorage());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalLocalStorage());
 #endif
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    markDOMObjectWrapper(globalData, impl()->optionalApplicationCache());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalApplicationCache());
 #endif
 }
 
@@ -271,6 +293,150 @@ bool JSDOMWindow::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return Base::getOwnPropertySlot(exec, propertyName, slot);
 }
 
+bool JSDOMWindow::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    // When accessing a Window cross-domain, functions are always the native built-in ones, and they
+    // are not affected by properties changed on the Window or anything in its prototype chain.
+    // This is consistent with the behavior of Firefox.
+    
+    const HashEntry* entry;
+    
+    // We don't want any properties other than "close" and "closed" on a closed window.
+    if (!impl()->frame()) {
+        // The following code is safe for cross-domain and same domain use.
+        // It ignores any custom properties that might be set on the DOMWindow (including a custom prototype).
+        entry = s_info.propHashTable(exec)->entry(exec, propertyName);
+        if (entry && !(entry->attributes() & Function) && entry->propertyGetter() == jsDOMWindowClosed) {
+            descriptor.setDescriptor(jsBoolean(true), ReadOnly | DontDelete | DontEnum);
+            return true;
+        }
+        entry = JSDOMWindowPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
+        if (entry && (entry->attributes() & Function) && entry->function() == jsDOMWindowPrototypeFunctionClose) {
+            PropertySlot slot;
+            slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionClose, 0>);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+            return true;
+        }
+        descriptor.setUndefined();
+        return true;
+    }
+
+    String errorMessage;
+    bool allowsAccess = allowsAccessFrom(exec, errorMessage);
+    if (allowsAccess && JSGlobalObject::getOwnPropertyDescriptor(exec, propertyName, descriptor))
+        return true;
+
+    // We need this code here because otherwise JSDOMWindowBase will stop the search before we even get to the
+    // prototype due to the blanket same origin (allowsAccessFrom) check at the end of getOwnPropertySlot.
+    // Also, it's important to get the implementation straight out of the DOMWindow prototype regardless of
+    // what prototype is actually set on this object.
+    entry = JSDOMWindowPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
+    if (entry) {
+        if (entry->attributes() & Function) {
+            if (entry->function() == jsDOMWindowPrototypeFunctionBlur) {
+                if (!allowsAccess) {
+                    PropertySlot slot;
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionBlur, 0>);
+                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionClose) {
+                if (!allowsAccess) {
+                    PropertySlot slot;
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionClose, 0>);
+                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionFocus) {
+                if (!allowsAccess) {
+                    PropertySlot slot;
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionFocus, 0>);
+                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionPostMessage) {
+                if (!allowsAccess) {
+                    PropertySlot slot;
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionPostMessage, 2>);
+                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionShowModalDialog) {
+                if (!DOMWindow::canShowModalDialog(impl()->frame())) {
+                    descriptor.setUndefined();
+                    return true;
+                }
+            }
+        }
+    } else {
+        // Allow access to toString() cross-domain, but always Object.prototype.toString.
+        if (propertyName == exec->propertyNames().toString) {
+            if (!allowsAccess) {
+                PropertySlot slot;
+                slot.setCustom(this, objectToStringFunctionGetter);
+                descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+                return true;
+            }
+        }
+    }
+    
+    entry = JSDOMWindow::s_info.propHashTable(exec)->entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        slot.setCustom(this, entry->propertyGetter());
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+    
+    // Check for child frames by name before built-in properties to
+    // match Mozilla. This does not match IE, but some sites end up
+    // naming frames things that conflict with window properties that
+    // are in Moz but not IE. Since we have some of these, we have to do
+    // it the Moz way.
+    if (impl()->frame()->tree()->child(propertyName)) {
+        PropertySlot slot;
+        slot.setCustom(this, childFrameGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    
+    // Do prototype lookup early so that functions and attributes in the prototype can have
+    // precedence over the index and name getters.  
+    JSValue proto = prototype();
+    if (proto.isObject()) {
+        if (asObject(proto)->getPropertyDescriptor(exec, propertyName, descriptor)) {
+            if (!allowsAccess) {
+                printErrorMessage(errorMessage);
+                descriptor.setUndefined();
+            }
+            return true;
+        }
+    }
+
+    bool ok;
+    unsigned i = propertyName.toArrayIndex(&ok);
+    if (ok && i < impl()->frame()->tree()->childCount()) {
+        PropertySlot slot;
+        slot.setCustomIndex(this, i, indexGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+
+    // Allow shortcuts like 'Image1' instead of document.images.Image1
+    Document* document = impl()->frame()->document();
+    if (document->isHTMLDocument()) {
+        AtomicStringImpl* atomicPropertyName = AtomicString::find(propertyName);
+        if (atomicPropertyName && (static_cast<HTMLDocument*>(document)->hasNamedItem(atomicPropertyName) || document->hasElementWithId(atomicPropertyName))) {
+            PropertySlot slot;
+            slot.setCustom(this, namedItemGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+            return true;
+        }
+    }
+    
+    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
 void JSDOMWindow::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (!impl()->frame())
@@ -290,20 +456,28 @@ void JSDOMWindow::put(ExecState* exec, const Identifier& propertyName, JSValue v
         Base::put(exec, propertyName, value, slot);
 }
 
-bool JSDOMWindow::deleteProperty(ExecState* exec, const Identifier& propertyName, bool checkDontDelete)
+bool JSDOMWindow::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
     // Only allow deleting properties by frames in the same origin.
     if (!allowsAccessFrom(exec))
         return false;
-    return Base::deleteProperty(exec, propertyName, checkDontDelete);
+    return Base::deleteProperty(exec, propertyName);
 }
 
-void JSDOMWindow::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSDOMWindow::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     // Only allow the window to enumerated by frames in the same origin.
     if (!allowsAccessFrom(exec))
         return;
-    Base::getPropertyNames(exec, propertyNames, listedAttributes);
+    Base::getPropertyNames(exec, propertyNames);
+}
+
+void JSDOMWindow::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    // Only allow the window to enumerated by frames in the same origin.
+    if (!allowsAccessFrom(exec))
+        return;
+    Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 bool JSDOMWindow::getPropertyAttributes(ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
@@ -424,6 +598,13 @@ JSValue JSDOMWindow::event(ExecState* exec) const
     return toJS(exec, event);
 }
 
+#if ENABLE(EVENTSOURCE)
+JSValue JSDOMWindow::eventSource(ExecState* exec) const
+{
+    return getDOMConstructor<JSEventSourceConstructor>(exec, this);
+}
+#endif
+
 JSValue JSDOMWindow::image(ExecState* exec) const
 {
     return getDOMConstructor<JSImageConstructor>(exec, this);
@@ -453,6 +634,48 @@ JSValue JSDOMWindow::webKitCSSMatrix(ExecState* exec) const
     return getDOMConstructor<JSWebKitCSSMatrixConstructor>(exec, this);
 }
  
+#if ENABLE(3D_CANVAS)
+JSValue JSDOMWindow::canvasArrayBuffer(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasArrayBufferConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasByteArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasByteArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasUnsignedByteArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasUnsignedByteArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasIntArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasIntArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasUnsignedIntArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasUnsignedIntArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasShortArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasShortArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasUnsignedShortArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasUnsignedShortArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasFloatArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasFloatArrayConstructor>(exec, this);
+}
+#endif
+ 
 JSValue JSDOMWindow::xmlHttpRequest(ExecState* exec) const
 {
     return getDOMConstructor<JSXMLHttpRequestConstructor>(exec, this);
@@ -486,6 +709,13 @@ JSValue JSDOMWindow::sharedWorker(ExecState* exec) const
 }
 #endif
 
+#if ENABLE(WEB_SOCKETS)
+JSValue JSDOMWindow::webSocket(ExecState* exec) const
+{
+    return getDOMConstructor<JSWebSocketConstructor>(exec, this);
+}
+#endif
+
 // Custom functions
 
 // Helper for window.open() and window.showModalDialog()
@@ -529,7 +759,7 @@ static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicF
         newWindow->putDirect(Identifier(exec, "dialogArguments"), dialogArgs);
 
     if (!protocolIsJavaScript(url) || newWindow->allowsAccessFrom(exec)) {
-        KURL completedURL = url.isEmpty() ? KURL("") : completeURL(exec, url);
+        KURL completedURL = url.isEmpty() ? KURL(ParsedURLString, "") : completeURL(exec, url);
         bool userGesture = processingUserGesture(exec);
 
         if (created)
@@ -700,14 +930,18 @@ JSValue JSDOMWindow::postMessage(ExecState* exec, const ArgList& args)
     if (exec->hadException())
         return jsUndefined();
 
-    MessagePort* messagePort = (args.size() == 2) ? 0 : toMessagePort(args.at(1));
+    MessagePortArray messagePorts;
+    if (args.size() > 2)
+        fillMessagePortArray(exec, args.at(1), messagePorts);
+    if (exec->hadException())
+        return jsUndefined();
 
     String targetOrigin = valueToStringWithUndefinedOrNullCheck(exec, args.at((args.size() == 2) ? 1 : 2));
     if (exec->hadException())
         return jsUndefined();
 
     ExceptionCode ec = 0;
-    window->postMessage(message, messagePort, targetOrigin, source, ec);
+    window->postMessage(message, &messagePorts, targetOrigin, source, ec);
     setDOMException(exec, ec);
 
     return jsUndefined();
@@ -788,9 +1022,11 @@ JSValue JSDOMWindow::addEventListener(ExecState* exec, const ArgList& args)
     if (!frame)
         return jsUndefined();
 
-    if (RefPtr<JSEventListener> listener = findOrCreateJSEventListener(args.at(1)))
-        impl()->addEventListener(AtomicString(args.at(0).toString(exec)), listener.release(), args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -800,9 +1036,11 @@ JSValue JSDOMWindow::removeEventListener(ExecState* exec, const ArgList& args)
     if (!frame)
         return jsUndefined();
 
-    if (JSEventListener* listener = findJSEventListener(args.at(1)))
-        impl()->removeEventListener(AtomicString(args.at(0).toString(exec)), listener, args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
index ec31721..f969dc1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -71,11 +71,11 @@ void JSDOMWindowShell::setWindow(PassRefPtr<DOMWindow> domWindow)
 // JSObject methods
 // ----
 
-void JSDOMWindowShell::mark()
+void JSDOMWindowShell::markChildren(MarkStack& markStack)
 {
-    Base::mark();
-    if (m_window && !m_window->marked())
-        m_window->mark();
+    Base::markChildren(markStack);
+    if (m_window)
+        markStack.append(m_window);
 }
 
 UString JSDOMWindowShell::className() const
@@ -88,6 +88,11 @@ bool JSDOMWindowShell::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return m_window->getOwnPropertySlot(exec, propertyName, slot);
 }
 
+bool JSDOMWindowShell::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return m_window->getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
 void JSDOMWindowShell::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     m_window->put(exec, propertyName, value, slot);
@@ -98,14 +103,19 @@ void JSDOMWindowShell::putWithAttributes(ExecState* exec, const Identifier& prop
     m_window->putWithAttributes(exec, propertyName, value, attributes);
 }
 
-bool JSDOMWindowShell::deleteProperty(ExecState* exec, const Identifier& propertyName, bool checkDontDelete)
+bool JSDOMWindowShell::deleteProperty(ExecState* exec, const Identifier& propertyName)
+{
+    return m_window->deleteProperty(exec, propertyName);
+}
+
+void JSDOMWindowShell::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
-    return m_window->deleteProperty(exec, propertyName, checkDontDelete);
+    m_window->getPropertyNames(exec, propertyNames);
 }
 
-void JSDOMWindowShell::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSDOMWindowShell::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
-    m_window->getPropertyNames(exec, propertyNames, listedAttributes);
+    m_window->getOwnPropertyNames(exec, propertyNames);
 }
 
 bool JSDOMWindowShell::getPropertyAttributes(JSC::ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
index 87b63fc..a7c2c56 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
@@ -64,13 +64,15 @@ namespace WebCore {
         }
 
     private:
-        virtual void mark();
+        virtual void markChildren(JSC::MarkStack&);
         virtual JSC::UString className() const;
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
         virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
         virtual void putWithAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, unsigned attributes);
-        virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier& propertyName, bool checkDontDelete = true);
-        virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype);
+        virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier& propertyName);
+        virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+        virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
         virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, unsigned& attributes) const;
         virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);
         virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCustom.cpp
index af3b066..0932cca 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCustom.cpp
@@ -52,17 +52,13 @@ JSValue JSDatabase::changeVersion(ExecState* exec, const ArgList& args)
     String oldVersion = args.at(0).toString(exec);
     String newVersion = args.at(1).toString(exec);
 
-    Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!frame)
-        return jsUndefined();
-    
     JSObject* object;
     if (!(object = args.at(2).getObject())) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
     }
     
-    RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, frame));
+    RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject())));
     
     RefPtr<SQLTransactionErrorCallback> errorCallback;
     if (!args.at(3).isNull()) {
@@ -71,24 +67,25 @@ JSValue JSDatabase::changeVersion(ExecState* exec, const ArgList& args)
             return jsUndefined();
         }
         
-        errorCallback = JSCustomSQLTransactionErrorCallback::create(object, frame);
+        errorCallback = JSCustomSQLTransactionErrorCallback::create(object, static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()));
     }
     
     RefPtr<VoidCallback> successCallback;
     if (!args.at(4).isNull()) {
-        successCallback = toVoidCallback(exec, args.at(4));
-        if (!successCallback) {
+        if (!(object = args.at(4).getObject())) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
         }
+
+        successCallback = JSCustomVoidCallback::create(object, static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()));
     }
-    
+
     m_impl->changeVersion(oldVersion, newVersion, callback.release(), errorCallback.release(), successCallback.release());
     
     return jsUndefined();
 }
 
-JSValue JSDatabase::transaction(ExecState* exec, const ArgList& args)
+static JSValue createTransaction(ExecState* exec, const ArgList& args, Database* database, JSDOMGlobalObject* globalObject, bool readOnly)
 {
     JSObject* object;
     
@@ -96,12 +93,8 @@ JSValue JSDatabase::transaction(ExecState* exec, const ArgList& args)
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
     }        
- 
-    Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!frame)
-        return jsUndefined();
-    
-    RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, frame));
+     
+    RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, globalObject));
     RefPtr<SQLTransactionErrorCallback> errorCallback;
     
     if (args.size() > 1 && !args.at(1).isNull()) {
@@ -110,22 +103,33 @@ JSValue JSDatabase::transaction(ExecState* exec, const ArgList& args)
             return jsUndefined();
         }
 
-        errorCallback = JSCustomSQLTransactionErrorCallback::create(object, frame);
+        errorCallback = JSCustomSQLTransactionErrorCallback::create(object, globalObject);
     }
 
     RefPtr<VoidCallback> successCallback;
     if (args.size() > 2 && !args.at(2).isNull()) {
-        successCallback = toVoidCallback(exec, args.at(2));
-        if (!successCallback) {
+        if (!(object = args.at(2).getObject())) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
         }
+
+        successCallback = JSCustomVoidCallback::create(object, globalObject);
     }
     
-    m_impl->transaction(callback.release(), errorCallback.release(), successCallback.release());
-
+    database->transaction(callback.release(), errorCallback.release(), successCallback.release(), readOnly);
     return jsUndefined();
 }
+
+JSValue JSDatabase::transaction(ExecState* exec, const ArgList& args)
+{
+    return createTransaction(exec, args, m_impl.get(), static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()), false);
+}
     
+JSValue JSDatabase::readTransaction(ExecState* exec, const ArgList& args)
+{
+    return createTransaction(exec, args, m_impl.get(), static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()), true);
+}
+
 }
+
 #endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDedicatedWorkerContextCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDedicatedWorkerContextCustom.cpp
index c45a6a3..a633a42 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDedicatedWorkerContextCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDedicatedWorkerContextCustom.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009 Apple, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -34,15 +35,23 @@
 
 #include "JSDedicatedWorkerContext.h"
 
+#include "JSDOMBinding.h"
+#include "JSMessagePortCustom.h"
+
 using namespace JSC;
 
 namespace WebCore {
 
-void JSDedicatedWorkerContext::mark()
+void JSDedicatedWorkerContext::markChildren(MarkStack& markStack)
 {
-    Base::mark();
+    Base::markChildren(markStack);
+
+    markIfNotNull(markStack, impl()->onmessage());
+}
 
-    markIfNotNull(impl()->onmessage());
+JSC::JSValue JSDedicatedWorkerContext::postMessage(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return handlePostMessage(exec, args, impl());
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp
new file mode 100644
index 0000000..493d7bd
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(NOTIFICATIONS)
+
+#include "Document.h"
+#include "JSCustomVoidCallback.h"
+#include "JSEventListener.h"
+#include "JSNotification.h"
+#include "JSNotificationCenter.h"
+#include "Notification.h"
+#include "NotificationCenter.h"
+#include <runtime/Error.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSNotificationCenter::requestPermission(ExecState* exec, const ArgList& args)
+{
+    // Permission request is only valid from page context.
+    ScriptExecutionContext* context = impl()->context();
+    if (context->isWorkerContext())
+        return throwError(exec, SyntaxError);
+
+    if (!args.at(0).isObject())
+        return throwError(exec, TypeError);
+
+    PassRefPtr<JSCustomVoidCallback> callback = JSCustomVoidCallback::create(args.at(0).getObject(), static_cast<Document*>(context)->frame());
+
+    impl()->requestPermission(callback);
+    return jsUndefined();
+}
+
+JSValue JSNotification::addEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener)), globalObject, false), args.at(2).toBoolean(exec));
+    return jsUndefined();
+}
+
+JSValue JSNotification::removeEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false).get(), args.at(2).toBoolean(exec));
+    return jsUndefined();
+}
+
+
+} // namespace
+
+#endif // ENABLE(NOTIFICATIONS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
index 493aaea..e48b593 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,6 +24,10 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "HTMLDocument.h"
+#include "JSCanvasRenderingContext2D.h"
+#if ENABLE(3D_CANVAS)
+#include "JSCanvasRenderingContext3D.h"
+#endif
 #include "JSDOMWindowCustom.h"
 #include "JSHTMLDocument.h"
 #include "JSLocation.h"
@@ -35,15 +39,23 @@
 #include "SVGDocument.h"
 #endif
 
+#include <wtf/GetPtr.h>
+
 using namespace JSC;
 
 namespace WebCore {
 
-void JSDocument::mark()
+void JSDocument::markChildren(MarkStack& markStack)
 {
-    JSNode::mark();
-    markDOMNodesForDocument(impl());
-    markActiveObjectsForContext(*Heap::heap(this)->globalData(), impl());
+    JSNode::markChildren(markStack);
+
+    Document* document = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    markDOMNodesForDocument(markStack, document);
+    markActiveObjectsForContext(markStack, globalData, document);
+    markDOMObjectWrapper(markStack, globalData, document->implementation());
+    markDOMObjectWrapper(markStack, globalData, document->styleSheets());
 }
 
 JSValue JSDocument::location(ExecState* exec) const
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp
index 47793d0..fb64ff2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -51,15 +51,27 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+void JSElement::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    Element* element = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    markDOMObjectWrapper(markStack, globalData, element->attributeMap());
+    if (element->isStyledElement())
+        markDOMObjectWrapper(markStack, globalData, static_cast<StyledElement*>(element)->inlineStyleDecl());
+}
+
 static inline bool allowSettingSrcToJavascriptURL(ExecState* exec, Element* element, const String& name, const String& value)
 {
     if ((element->hasTagName(iframeTag) || element->hasTagName(frameTag)) && equalIgnoringCase(name, "src") && protocolIsJavaScript(deprecatedParseURL(value))) {
-        HTMLFrameElementBase* frame = static_cast<HTMLFrameElementBase*>(element);
-        if (!checkNodeSecurity(exec, frame->contentDocument()))
+        Document* contentDocument = static_cast<HTMLFrameElementBase*>(element)->contentDocument();
+        if (contentDocument && !checkNodeSecurity(exec, contentDocument))
             return false;
     }
     return true;
-} 
+}
 
 JSValue JSElement::setAttribute(ExecState* exec, const ArgList& args)
 {
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
index 257c259..162543d 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
@@ -38,6 +38,7 @@
 #include "JSMouseEvent.h"
 #include "JSMutationEvent.h"
 #include "JSOverflowEvent.h"
+#include "JSPageTransitionEvent.h"
 #include "JSProgressEvent.h"
 #include "JSTextEvent.h"
 #include "JSUIEvent.h"
@@ -51,6 +52,7 @@
 #include "MouseEvent.h"
 #include "MutationEvent.h"
 #include "OverflowEvent.h"
+#include "PageTransitionEvent.h"
 #include "ProgressEvent.h"
 #include "TextEvent.h"
 #include "UIEvent.h"
@@ -111,6 +113,8 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Event* event)
         wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, OverflowEvent, event);
     else if (event->isMessageEvent())
         wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, MessageEvent, event);
+    else if (event->isPageTransitionEvent())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, PageTransitionEvent, event);
     else if (event->isProgressEvent()) {
         if (event->isXMLHttpRequestProgressEvent())
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, XMLHttpRequestProgressEvent, event);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
index c7797be..d391073 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
@@ -32,18 +32,16 @@ using namespace JSC;
 namespace WebCore {
 
 JSEventListener::JSEventListener(JSObject* function, JSDOMGlobalObject* globalObject, bool isAttribute)
-    : m_jsFunction(function)
+    : EventListener(JSEventListenerType)
+    , m_jsFunction(function)
     , m_globalObject(globalObject)
     , m_isAttribute(isAttribute)
 {
-    if (!m_isAttribute && m_jsFunction)
-        globalObject->jsEventListeners().set(m_jsFunction, this);
+    ASSERT(m_globalObject);
 }
 
 JSEventListener::~JSEventListener()
 {
-    if (!m_isAttribute && m_jsFunction && m_globalObject)
-        m_globalObject->jsEventListeners().remove(m_jsFunction);
 }
 
 JSObject* JSEventListener::jsFunction() const
@@ -51,12 +49,11 @@ JSObject* JSEventListener::jsFunction() const
     return m_jsFunction;
 }
 
-void JSEventListener::markJSFunction()
+void JSEventListener::markJSFunction(MarkStack& markStack)
 {
-    if (m_jsFunction && !m_jsFunction->marked())
-        m_jsFunction->mark();
-    if (m_globalObject && !m_globalObject->marked())
-        m_globalObject->mark();
+    if (m_jsFunction)
+        markStack.append(m_jsFunction);
+    markStack.append(m_globalObject);
 }
 
 void JSEventListener::handleEvent(Event* event, bool isWindowEvent)
@@ -68,13 +65,6 @@ void JSEventListener::handleEvent(Event* event, bool isWindowEvent)
         return;
 
     JSDOMGlobalObject* globalObject = m_globalObject;
-    // Null check as clearGlobalObject() can clear this and we still get called back by
-    // xmlhttprequest objects. See http://bugs.webkit.org/show_bug.cgi?id=13275
-    // FIXME: Is this check still necessary? Requests are supposed to be stopped before clearGlobalObject() is called.
-    ASSERT(globalObject);
-    if (!globalObject)
-        return;
-
     ScriptExecutionContext* scriptExecutionContext = globalObject->scriptExecutionContext();
     if (!scriptExecutionContext)
         return;
@@ -113,15 +103,12 @@ void JSEventListener::handleEvent(Event* event, bool isWindowEvent)
         Event* savedEvent = globalObject->currentEvent();
         globalObject->setCurrentEvent(event);
 
-        // If this event handler is the first JavaScript to execute, then the
-        // dynamic global object should be set to the global object of the
-        // window in which the event occurred.
         JSGlobalData* globalData = globalObject->globalData();
         DynamicGlobalObjectScope globalObjectScope(exec, globalData->dynamicGlobalObject ? globalData->dynamicGlobalObject : globalObject);
 
         JSValue retval;
         if (handleEventFunction) {
-            globalObject->globalData()->timeoutChecker->start();
+            globalData->timeoutChecker.start();
             retval = call(exec, handleEventFunction, callType, callData, jsFunction, args);
         } else {
             JSValue thisValue;
@@ -129,10 +116,10 @@ void JSEventListener::handleEvent(Event* event, bool isWindowEvent)
                 thisValue = globalObject->toThisObject(exec);
             else
                 thisValue = toJS(exec, globalObject, event->currentTarget());
-            globalObject->globalData()->timeoutChecker->start();
+            globalData->timeoutChecker.start();
             retval = call(exec, jsFunction, callType, callData, thisValue, args);
         }
-        globalObject->globalData()->timeoutChecker->stop();
+        globalData->timeoutChecker.stop();
 
         globalObject->setCurrentEvent(savedEvent);
 
@@ -163,9 +150,6 @@ bool JSEventListener::reportError(const String& message, const String& url, int
         return false;
 
     JSDOMGlobalObject* globalObject = m_globalObject;
-    if (!globalObject)
-        return false;
-
     ExecState* exec = globalObject->globalExec();
 
     CallData callData;
@@ -179,17 +163,14 @@ bool JSEventListener::reportError(const String& message, const String& url, int
     args.append(jsString(exec, url));
     args.append(jsNumber(exec, lineNumber));
 
-    // If this event handler is the first JavaScript to execute, then the
-    // dynamic global object should be set to the global object of the
-    // window in which the event occurred.
     JSGlobalData* globalData = globalObject->globalData();
     DynamicGlobalObjectScope globalObjectScope(exec, globalData->dynamicGlobalObject ? globalData->dynamicGlobalObject : globalObject);    
 
     JSValue thisValue = globalObject->toThisObject(exec);
 
-    globalObject->globalData()->timeoutChecker->start();
+    globalData->timeoutChecker.start();
     JSValue returnValue = call(exec, jsFunction, callType, callData, thisValue, args);
-    globalObject->globalData()->timeoutChecker->stop();
+    globalData->timeoutChecker.stop();
 
     // If an error occurs while handling the script error, it should be bubbled up.
     if (exec->hadException()) {
@@ -206,4 +187,11 @@ bool JSEventListener::virtualisAttribute() const
     return m_isAttribute;
 }
 
+bool JSEventListener::operator==(const EventListener& listener)
+{
+    if (const JSEventListener* jsEventListener = JSEventListener::cast(&listener))
+        return m_jsFunction == jsEventListener->m_jsFunction && m_isAttribute == jsEventListener->m_isAttribute;
+    return false;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
index 2497750..92f0c41 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
@@ -34,8 +34,17 @@ namespace WebCore {
         {
             return adoptRef(new JSEventListener(listener, globalObject, isAttribute));
         }
+
+        static const JSEventListener* cast(const EventListener* listener)
+        {
+            return listener->type() == JSEventListenerType
+                ? static_cast<const JSEventListener*>(listener)
+                : 0;
+        }
+
         virtual ~JSEventListener();
-        void clearGlobalObject() { m_globalObject = 0; }
+
+        virtual bool operator==(const EventListener& other);
 
         // Returns true if this event listener was created for an event handler attribute, like "onload" or "onclick".
         bool isAttribute() const { return m_isAttribute; }
@@ -43,7 +52,7 @@ namespace WebCore {
         virtual JSC::JSObject* jsFunction() const;
 
     private:
-        virtual void markJSFunction();
+        virtual void markJSFunction(JSC::MarkStack&);
         virtual void handleEvent(Event*, bool isWindowEvent);
         virtual bool reportError(const String& message, const String& url, int lineNumber);
         virtual bool virtualisAttribute() const;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceConstructor.cpp
new file mode 100644
index 0000000..c6e4825
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceConstructor.cpp
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2009 Ericsson AB
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Ericsson nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(EVENTSOURCE)
+
+#include "JSEventSourceConstructor.h"
+
+#include "EventSource.h"
+#include "ExceptionCode.h"
+#include "JSEventSource.h"
+#include "ScriptExecutionContext.h"
+#include <runtime/Error.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSEventSourceConstructor);
+
+const ClassInfo JSEventSourceConstructor::s_info = { "EventSourceContructor", 0, 0, 0 };
+
+JSEventSourceConstructor::JSEventSourceConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSEventSourceConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSEventSourcePrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructEventSource(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    if (args.size() < 1)
+        return throwError(exec, SyntaxError, "Not enough arguments");
+
+    UString url = args.at(0).toString(exec);
+    if (exec->hadException())
+        return 0;
+
+    JSEventSourceConstructor* jsConstructor =  static_cast<JSEventSourceConstructor*>(constructor);
+    ScriptExecutionContext* context = jsConstructor->scriptExecutionContext();
+    if (!context)
+        return throwError(exec, ReferenceError, "EventSource constructor associated document is unavailable");
+
+    ExceptionCode ec = 0;
+    RefPtr<EventSource> eventSource = EventSource::create(url, context, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return 0;
+    }
+
+    return asObject(toJS(exec, jsConstructor->globalObject(), eventSource.release()));
+}
+
+ConstructType JSEventSourceConstructor::getConstructData(ConstructData& constructData)
+{
+    constructData.native.function = constructEventSource;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(EVENTSOURCE)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceConstructor.h
new file mode 100644
index 0000000..b2f3cb5
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceConstructor.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2009 Ericsson AB
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Ericsson nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSEventSourceConstructor_h
+#define JSEventSourceConstructor_h
+
+#if ENABLE(EVENTSOURCE)
+
+#include "JSDOMBinding.h"
+
+namespace WebCore {
+
+    class JSEventSourceConstructor : public DOMConstructorObject {
+    public:
+        JSEventSourceConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(EVENTSOURCE)
+
+#endif // JSEventSourceConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp
new file mode 100644
index 0000000..deebcb9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2009 Ericsson AB
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Ericsson nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(EVENTSOURCE)
+
+#include "JSEventSource.h"
+
+#include "EventSource.h"
+#include "JSDOMGlobalObject.h"
+#include "JSEventListener.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSEventSource::markChildren(MarkStack& markStack)
+{
+    DOMObject::markChildren(markStack);
+
+    markIfNotNull(markStack, m_impl->onopen());
+    markIfNotNull(markStack, m_impl->onmessage());
+    markIfNotNull(markStack, m_impl->onerror());
+
+    typedef EventSource::EventListenersMap EventListenersMap;
+    typedef EventSource::ListenerVector ListenerVector;
+    EventListenersMap& eventListeners = m_impl->eventListeners();
+    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
+        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
+            (*vecIter)->markJSFunction(markStack);
+    }
+}
+
+JSValue JSEventSource::addEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false).get(), args.at(2).toBoolean(exec));
+    return jsUndefined();
+}
+
+JSValue JSEventSource::removeEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false).get(), args.at(2).toBoolean(exec));
+    return jsUndefined();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(EVENTSOURCE)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.cpp
index b75cccf..0421d10 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.cpp
@@ -33,12 +33,29 @@
 #include "JSEventListener.h"
 #include "JSMessagePort.h"
 #include "JSNode.h"
+#if ENABLE(SHARED_WORKERS)
+
+#include "JSSharedWorker.h"
+#include "JSSharedWorkerContext.h"
+#endif
+
 #include "JSXMLHttpRequest.h"
 #include "JSXMLHttpRequestUpload.h"
 #include "MessagePort.h"
+
+#if ENABLE(SHARED_WORKERS)
+#include "SharedWorker.h"
+#include "SharedWorkerContext.h"
+#endif
+
 #include "XMLHttpRequest.h"
 #include "XMLHttpRequestUpload.h"
 
+#if ENABLE(EVENTSOURCE)
+#include "EventSource.h"
+#include "JSEventSource.h"
+#endif
+
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
 #include "DOMApplicationCache.h"
 #include "JSDOMApplicationCache.h"
@@ -56,9 +73,14 @@
 #include "Worker.h"
 #endif
 
-#if ENABLE(SHARED_WORKERS)
-#include "JSSharedWorker.h"
-#include "SharedWorker.h"
+#if ENABLE(NOTIFICATIONS)
+#include "JSNotification.h"
+#include "Notification.h"
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+#include "JSWebSocket.h"
+#include "WebSocket.h"
 #endif
 
 using namespace JSC;
@@ -70,6 +92,11 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, EventTarget* targ
     if (!target)
         return jsNull();
     
+#if ENABLE(EVENTSOURCE)
+    if (EventSource* eventSource = target->toEventSource())
+        return toJS(exec, globalObject, eventSource);
+#endif
+
 #if ENABLE(SVG)
     // SVGElementInstance supports both toSVGElementInstance and toNode since so much mouse handling code depends on toNode returning a valid node.
     if (SVGElementInstance* instance = target->toSVGElementInstance())
@@ -107,6 +134,19 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, EventTarget* targ
 #if ENABLE(SHARED_WORKERS)
     if (SharedWorker* sharedWorker = target->toSharedWorker())
         return toJS(exec, globalObject, sharedWorker);
+
+    if (SharedWorkerContext* workerContext = target->toSharedWorkerContext())
+        return toJSDOMGlobalObject(workerContext);
+#endif
+
+#if ENABLE(NOTIFICATIONS)
+    if (Notification* notification = target->toNotification())
+        return toJS(exec, notification);
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+    if (WebSocket* webSocket = target->toWebSocket())
+        return toJS(exec, webSocket);
 #endif
 
     ASSERT_NOT_REACHED();
@@ -116,7 +156,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, EventTarget* targ
 EventTarget* toEventTarget(JSC::JSValue value)
 {
     #define CONVERT_TO_EVENT_TARGET(type) \
-        if (value.isObject(&JS##type::s_info)) \
+        if (value.inherits(&JS##type::s_info)) \
             return static_cast<JS##type*>(asObject(value))->impl();
 
     CONVERT_TO_EVENT_TARGET(Node)
@@ -124,9 +164,13 @@ EventTarget* toEventTarget(JSC::JSValue value)
     CONVERT_TO_EVENT_TARGET(XMLHttpRequestUpload)
     CONVERT_TO_EVENT_TARGET(MessagePort)
 
-    if (value.isObject(&JSDOMWindowShell::s_info))
+    if (value.inherits(&JSDOMWindowShell::s_info))
         return static_cast<JSDOMWindowShell*>(asObject(value))->impl();
 
+#if ENABLE(EVENTSOURCE)
+    CONVERT_TO_EVENT_TARGET(EventSource)
+#endif
+
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     CONVERT_TO_EVENT_TARGET(DOMApplicationCache)
 #endif
@@ -142,6 +186,15 @@ EventTarget* toEventTarget(JSC::JSValue value)
 
 #if ENABLE(SHARED_WORKERS)
     CONVERT_TO_EVENT_TARGET(SharedWorker)
+    CONVERT_TO_EVENT_TARGET(SharedWorkerContext)
+#endif
+
+#if ENABLE(NOTIFICATIONS)
+    CONVERT_TO_EVENT_TARGET(Notification)
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+    CONVERT_TO_EVENT_TARGET(WebSocket)
 #endif
 
     return 0;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp
index 493166c..10f8bd5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -34,114 +34,130 @@
 #include "JSCustomPositionErrorCallback.h"
 #include "JSDOMWindow.h"
 #include "PositionOptions.h"
+#include <runtime/InternalFunction.h>
 
 using namespace JSC;
+using namespace std;
 
 namespace WebCore {
 
-static PassRefPtr<PositionOptions> createPositionOptions(ExecState* exec, JSValue value)
+static PassRefPtr<PositionCallback> createPositionCallback(ExecState* exec, JSDOMGlobalObject* globalObject, JSValue value)
 {
-    if (!value.isObject())
+    // The spec specifies 'FunctionOnly' for this object.
+    if (!value.inherits(&InternalFunction::info)) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
         return 0;
+    }
 
     JSObject* object = asObject(value);
+    return JSCustomPositionCallback::create(object, globalObject);
+}
 
-    JSValue enableHighAccuracyValue = object->get(exec, Identifier(exec, "enableHighAccuracy"));
-    if (exec->hadException())
+static PassRefPtr<PositionErrorCallback> createPositionErrorCallback(ExecState* exec, JSDOMGlobalObject* globalObject, JSValue value)
+{
+    // Argument is optional (hence undefined is allowed), and null is allowed.
+    if (value.isUndefinedOrNull())
         return 0;
-    bool enableHighAccuracy = enableHighAccuracyValue.toBoolean(exec);
-    if (exec->hadException())
+
+    // The spec specifies 'FunctionOnly' for this object.
+    if (!value.inherits(&InternalFunction::info)) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
         return 0;
+    }
 
-    JSValue timeoutValue = object->get(exec, Identifier(exec, "timeout"));
+    JSObject* object = asObject(value);
+    return JSCustomPositionErrorCallback::create(object, globalObject);
+}
+
+static PassRefPtr<PositionOptions> createPositionOptions(ExecState* exec, JSValue value)
+{
+    // Create default options.
+    RefPtr<PositionOptions> options = PositionOptions::create();
+
+    // Argument is optional (hence undefined is allowed), and null is allowed.
+    if (value.isUndefinedOrNull()) {
+        // Use default options.
+        return options.release();
+    }
+
+    // Given the above test, this will always yield an object.
+    JSObject* object = value.toObject(exec);
+
+    // For all three properties, we apply the following ...
+    // - If the getter or the property's valueOf method throws an exception, we
+    //   quit so as not to risk overwriting the exception.
+    // - If the value is absent or undefined, we don't override the default.
+    JSValue enableHighAccuracyValue = object->get(exec, Identifier(exec, "enableHighAccuracy"));
     if (exec->hadException())
         return 0;
-    unsigned timeout = timeoutValue.toUInt32(exec);
+    if (!enableHighAccuracyValue.isUndefined()) {
+        options->setEnableHighAccuracy(enableHighAccuracyValue.toBoolean(exec));
+        if (exec->hadException())
+            return 0;
+    }
+
+    JSValue timeoutValue = object->get(exec, Identifier(exec, "timeout"));
     if (exec->hadException())
         return 0;
+    if (!timeoutValue.isUndefined()) {
+        // Wrap to int32 and force non-negative to match behavior of window.setTimeout.
+        options->setTimeout(max(0, timeoutValue.toInt32(exec)));
+        if (exec->hadException())
+            return 0;
+    }
 
     JSValue maximumAgeValue = object->get(exec, Identifier(exec, "maximumAge"));
     if (exec->hadException())
         return 0;
-    unsigned maximumAge = maximumAgeValue.toUInt32(exec);
-    if (exec->hadException())
-        return 0;
+    if (!maximumAgeValue.isUndefined()) {
+        // Wrap to int32 and force non-negative to match behavior of window.setTimeout.
+        options->setMaximumAge(max(0, maximumAgeValue.toInt32(exec)));
+        if (exec->hadException())
+            return 0;
+    }
 
-    return PositionOptions::create(enableHighAccuracy, timeout, maximumAge);
+    return options.release();
 }
 
 JSValue JSGeolocation::getCurrentPosition(ExecState* exec, const ArgList& args)
 {
     // Arguments: PositionCallback, (optional)PositionErrorCallback, (optional)PositionOptions
-    RefPtr<PositionCallback> positionCallback;
-    JSObject* object = args.at(0).getObject();
+
+    RefPtr<PositionCallback> positionCallback = createPositionCallback(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), args.at(0));
     if (exec->hadException())
         return jsUndefined();
-    if (!object) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
+    ASSERT(positionCallback);
+
+    RefPtr<PositionErrorCallback> positionErrorCallback = createPositionErrorCallback(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), args.at(1));
+    if (exec->hadException())
         return jsUndefined();
-    }
 
-    if (Frame* frame = toJSDOMWindow(exec->lexicalGlobalObject())->impl()->frame())
-        positionCallback = JSCustomPositionCallback::create(object, frame);
-    
-    RefPtr<PositionErrorCallback> positionErrorCallback;
-    if (!args.at(1).isUndefinedOrNull()) {
-        JSObject* object = args.at(1).getObject();
-        if (!object) {
-            setDOMException(exec, TYPE_MISMATCH_ERR);
-            return jsUndefined();
-        }
-
-        if (Frame* frame = toJSDOMWindow(exec->lexicalGlobalObject())->impl()->frame())
-            positionErrorCallback = JSCustomPositionErrorCallback::create(object, frame);
-    }
-    
-    RefPtr<PositionOptions> positionOptions;
-    if (!args.at(2).isUndefinedOrNull()) {
-        positionOptions = createPositionOptions(exec, args.at(2));
-        if (exec->hadException())
-            return jsUndefined();
-    }
+    RefPtr<PositionOptions> positionOptions = createPositionOptions(exec, args.at(2));
+    if (exec->hadException())
+        return jsUndefined();
+    ASSERT(positionOptions);
 
     m_impl->getCurrentPosition(positionCallback.release(), positionErrorCallback.release(), positionOptions.release());
-    
     return jsUndefined();
 }
 
 JSValue JSGeolocation::watchPosition(ExecState* exec, const ArgList& args)
 {
     // Arguments: PositionCallback, (optional)PositionErrorCallback, (optional)PositionOptions
-    RefPtr<PositionCallback> positionCallback;
-    JSObject* object = args.at(0).getObject();
+
+    RefPtr<PositionCallback> positionCallback = createPositionCallback(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), args.at(0));
     if (exec->hadException())
         return jsUndefined();
-    if (!object) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
+    ASSERT(positionCallback);
+
+    RefPtr<PositionErrorCallback> positionErrorCallback = createPositionErrorCallback(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), args.at(1));
+    if (exec->hadException())
         return jsUndefined();
-    }
-    
-    if (Frame* frame = toJSDOMWindow(exec->lexicalGlobalObject())->impl()->frame())
-        positionCallback = JSCustomPositionCallback::create(object, frame);
-    
-    RefPtr<PositionErrorCallback> positionErrorCallback;
-    if (!args.at(1).isUndefinedOrNull()) {
-        JSObject* object = args.at(1).getObject();
-        if (!object) {
-            setDOMException(exec, TYPE_MISMATCH_ERR);
-            return jsUndefined();
-        }
-        
-        if (Frame* frame = toJSDOMWindow(exec->lexicalGlobalObject())->impl()->frame())
-            positionErrorCallback = JSCustomPositionErrorCallback::create(object, frame);
-    }
-    
-    RefPtr<PositionOptions> positionOptions;
-    if (!args.at(2).isUndefinedOrNull()) {
-        positionOptions = createPositionOptions(exec, args.at(2));
-        if (exec->hadException())
-            return jsUndefined();
-    }
+
+    RefPtr<PositionOptions> positionOptions = createPositionOptions(exec, args.at(2));
+    if (exec->hadException())
+        return jsUndefined();
+    ASSERT(positionOptions);
 
     int watchID = m_impl->watchPosition(positionCallback.release(), positionErrorCallback.release(), positionOptions.release());
     return jsNumber(exec, watchID);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
index 37561af..30892e0 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
@@ -38,6 +38,11 @@ bool JSHTMLAppletElement::getOwnPropertySlotDelegate(ExecState* exec, const Iden
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
+bool JSHTMLAppletElement::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return runtimeObjectCustomGetOwnPropertyDescriptor(exec, propertyName, descriptor, this);
+}
+
 bool JSHTMLAppletElement::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
new file mode 100644
index 0000000..8ecd287
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSHTMLCanvasElement.h"
+
+#include "HTMLCanvasElement.h"
+#include "JSCanvasRenderingContext2D.h"
+#if ENABLE(3D_CANVAS)
+#include "JSCanvasRenderingContext3D.h"
+#endif
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSHTMLCanvasElement::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(impl());
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    markDOMObjectWrapper(markStack, globalData, canvas->renderingContext());
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
index 2570bc6..bce3ffb 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
@@ -38,6 +38,11 @@ bool JSHTMLEmbedElement::getOwnPropertySlotDelegate(ExecState* exec, const Ident
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
+bool JSHTMLEmbedElement::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return runtimeObjectCustomGetOwnPropertyDescriptor(exec, propertyName, descriptor, this);
+}
+
 bool JSHTMLEmbedElement::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
index c8aea9f..6e01513 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
@@ -32,16 +32,20 @@
 #include "CSSHelper.h"
 #include "Document.h"
 #include "HTMLFrameElement.h"
+#include "HTMLNames.h"
 #include "JSDOMBinding.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
 static inline bool allowSettingJavascriptURL(ExecState* exec, HTMLFrameElement* imp, const String& value)
 {
     if (protocolIsJavaScript(deprecatedParseURL(value))) {
-        if (!checkNodeSecurity(exec, imp->contentDocument()))
+        Document* contentDocument = imp->contentDocument();
+        if (contentDocument && !checkNodeSecurity(exec, contentDocument))
             return false;
     }
     return true;
@@ -55,8 +59,7 @@ void JSHTMLFrameElement::setSrc(ExecState* exec, JSValue value)
     if (!allowSettingJavascriptURL(exec, imp, srcValue))
         return;
 
-    imp->setSrc(srcValue);
-    return;
+    imp->setAttribute(srcAttr, srcValue);
 }
 
 void JSHTMLFrameElement::setLocation(ExecState* exec, JSValue value)
@@ -68,7 +71,6 @@ void JSHTMLFrameElement::setLocation(ExecState* exec, JSValue value)
         return;
 
     imp->setLocation(locationValue);
-    return;
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
index 8e32381..60ea45e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
@@ -32,12 +32,15 @@
 #include "CSSHelper.h"
 #include "Document.h"
 #include "HTMLIFrameElement.h"
+#include "HTMLNames.h"
 #include "JSDOMBinding.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
 void JSHTMLIFrameElement::setSrc(ExecState* exec, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(impl());
@@ -45,11 +48,12 @@ void JSHTMLIFrameElement::setSrc(ExecState* exec, JSValue value)
     String srcValue = valueToStringWithNullCheck(exec, value);
 
     if (protocolIsJavaScript(deprecatedParseURL(srcValue))) {
-        if (!checkNodeSecurity(exec, imp->contentDocument()))
+        Document* contentDocument = imp->contentDocument();
+        if (contentDocument && !checkNodeSecurity(exec, contentDocument))
             return;
     }
 
-    imp->setSrc(srcValue);
+    imp->setAttribute(srcAttr, srcValue);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLInputElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
index 6b47622..e5166ee 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
@@ -29,6 +29,7 @@
 #include "Document.h"
 #include "HTMLInputElement.h"
 #include "Settings.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
index a99e46c..1bfb51f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
@@ -38,6 +38,11 @@ bool JSHTMLObjectElement::getOwnPropertySlotDelegate(ExecState* exec, const Iden
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
+bool JSHTMLObjectElement::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return runtimeObjectCustomGetOwnPropertyDescriptor(exec, propertyName, descriptor, this);
+}
+
 bool JSHTMLObjectElement::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp
index 86b7df7..b24b1ff 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp
@@ -31,6 +31,7 @@
 
 #include "Frame.h"
 #include "History.h"
+#include <runtime/JSFunction.h>
 #include <runtime/PrototypeFunction.h>
 
 using namespace JSC;
@@ -92,6 +93,52 @@ bool JSHistory::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& pr
     return true;
 }
 
+bool JSHistory::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    // When accessing History cross-domain, functions are always the native built-in ones.
+    // See JSDOMWindow::getOwnPropertySlotDelegate for additional details.
+    
+    // Our custom code is only needed to implement the Window cross-domain scheme, so if access is
+    // allowed, return false so the normal lookup will take place.
+    String message;
+    if (allowsAccessFromFrame(exec, impl()->frame(), message))
+        return false;
+    
+    // Check for the few functions that we allow, even when called cross-domain.
+    const HashEntry* entry = JSHistoryPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        // Allow access to back(), forward() and go() from any frame.
+        if (entry->attributes() & Function) {
+            if (entry->function() == jsHistoryPrototypeFunctionBack) {
+                slot.setCustom(this, nonCachingStaticBackFunctionGetter);
+                descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+                return true;
+            } else if (entry->function() == jsHistoryPrototypeFunctionForward) {
+                slot.setCustom(this, nonCachingStaticForwardFunctionGetter);
+                descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+                return true;
+            } else if (entry->function() == jsHistoryPrototypeFunctionGo) {
+                slot.setCustom(this, nonCachingStaticGoFunctionGetter);
+                descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+                return true;
+            }
+        }
+    } else {
+        // Allow access to toString() cross-domain, but always Object.toString.
+        if (propertyName == exec->propertyNames().toString) {
+            PropertySlot slot;
+            slot.setCustom(this, objectToStringFunctionGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+            return true;
+        }
+    }
+    
+    printErrorMessageForFrame(impl()->frame(), message);
+    descriptor.setUndefined();
+    return true;
+}
+
 bool JSHistory::putDelegate(ExecState* exec, const Identifier&, JSValue, PutPropertySlot&)
 {
     // Only allow putting by frames in the same origin.
@@ -100,20 +147,20 @@ bool JSHistory::putDelegate(ExecState* exec, const Identifier&, JSValue, PutProp
     return false;
 }
 
-bool JSHistory::deleteProperty(ExecState* exec, const Identifier& propertyName, bool checkDontDelete)
+bool JSHistory::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
     // Only allow deleting by frames in the same origin.
     if (!allowsAccessFromFrame(exec, impl()->frame()))
         return false;
-    return Base::deleteProperty(exec, propertyName, checkDontDelete);
+    return Base::deleteProperty(exec, propertyName);
 }
 
-void JSHistory::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSHistory::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     // Only allow the history object to enumerated by frames in the same origin.
     if (!allowsAccessFromFrame(exec, impl()->frame()))
         return;
-    Base::getPropertyNames(exec, propertyNames, listedAttributes);
+    Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp
index faaaf41..0f4a991 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp
@@ -25,6 +25,7 @@
 #include "JSHTMLImageElement.h"
 #include "JSNode.h"
 #include "ScriptExecutionContext.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
index fff7aee..7daeec7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JSInspectedObjectWrapper.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "JSInspectorCallbackWrapper.h"
 #include <runtime/JSGlobalObject.h>
 #include <wtf/StdLibExtras.h>
@@ -125,3 +127,5 @@ JSValue JSInspectedObjectWrapper::prepareIncomingValue(ExecState*, JSValue value
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp
index b2eb2d1..c80441d 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp
@@ -33,6 +33,8 @@
 #include "config.h"
 #include "JSInspectorBackend.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "Console.h"
 #if ENABLE(DATABASE)
 #include "Database.h"
@@ -51,6 +53,10 @@
 #include "JSRange.h"
 #include "Node.h"
 #include "Page.h"
+#if ENABLE(DOM_STORAGE)
+#include "Storage.h"
+#include "JSStorage.h"
+#endif
 #include "TextIterator.h"
 #include "VisiblePosition.h"
 #include <runtime/JSArray.h>
@@ -70,21 +76,12 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValue JSInspectorBackend::highlightDOMNode(JSC::ExecState*, const JSC::ArgList& args)
+JSValue JSInspectorBackend::highlightDOMNode(JSC::ExecState* exec, const JSC::ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
 
-    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
-    if (!wrapper)
-        return jsUndefined();
-
-    Node* node = toNode(wrapper->unwrappedObject());
-    if (!node)
-        return jsUndefined();
-
-    impl()->highlight(node);
-
+    impl()->highlight(args.at(0).toInt32(exec));
     return jsUndefined();
 }
 
@@ -280,4 +277,94 @@ JSValue JSInspectorBackend::profiles(JSC::ExecState* exec, const JSC::ArgList&)
 
 #endif
 
+JSValue JSInspectorBackend::nodeForId(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    Node* node = impl()->nodeForId(args.at(0).toInt32(exec));
+    if (!node)
+        return jsUndefined();
+
+    InspectorController* ic = impl()->inspectorController();
+    if (!ic)
+        return jsUndefined();
+
+    JSLock lock(SilenceAssertionsOnly);
+    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame());
+    return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), toJS(exec, deprecatedGlobalObjectForPrototype(inspectedWindow->globalExec()), node));
+}
+
+JSValue JSInspectorBackend::wrapObject(ExecState*, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    return impl()->wrapObject(ScriptValue(args.at(0))).jsValue();
+}
+
+JSValue JSInspectorBackend::unwrapObject(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    return impl()->unwrapObject(args.at(0).toString(exec)).jsValue();
+}
+
+JSValue JSInspectorBackend::pushNodePathToFrontend(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 2)
+        return jsUndefined();
+
+    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
+    if (!wrapper)
+        return jsUndefined();
+
+    Node* node = toNode(wrapper->unwrappedObject());
+    if (!node)
+        return jsUndefined();
+
+    bool selectInUI = args.at(1).toBoolean(exec);
+    return jsNumber(exec, impl()->pushNodePathToFrontend(node, selectInUI));
+}
+
+#if ENABLE(DATABASE)
+JSValue JSInspectorBackend::selectDatabase(ExecState*, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
+    if (!wrapper)
+        return jsUndefined();
+
+    Database* database = toDatabase(wrapper->unwrappedObject());
+    if (database)
+        impl()->selectDatabase(database);
+    return jsUndefined();
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+JSValue JSInspectorBackend::selectDOMStorage(ExecState*, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+    InspectorController* ic = impl()->inspectorController();
+    if (!ic)
+        return jsUndefined();
+
+    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
+    if (!wrapper)
+        return jsUndefined();
+
+    Storage* storage = toStorage(wrapper->unwrappedObject());
+    if (storage)
+        impl()->selectDOMStorage(storage);
+    return jsUndefined();
+}
+#endif
+
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
index 0e14109..e7d3f51 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JSInspectorCallbackWrapper.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "JSInspectedObjectWrapper.h"
 #include <wtf/StdLibExtras.h>
 
@@ -73,7 +75,7 @@ JSValue JSInspectorCallbackWrapper::wrap(ExecState* unwrappedExec, JSValue unwra
         static Structure* structure = leakInspectorCallbackWrapperStructure();
         return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, structure);
     }
-    return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, asObject(wrap(unwrappedExec, prototype))->inheritorID());
+    return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, createStructure(wrap(unwrappedExec, prototype)));
 }
 
 JSInspectorCallbackWrapper::JSInspectorCallbackWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, PassRefPtr<Structure> structure)
@@ -105,3 +107,5 @@ JSValue JSInspectorCallbackWrapper::prepareIncomingValue(ExecState* unwrappedExe
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp
index f4758e4..cf0ed44 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp
@@ -23,6 +23,7 @@
 #include "Frame.h"
 #include "JSNode.h"
 #include <runtime/FunctionConstructor.h>
+#include <runtime/JSFunction.h>
 #include <runtime/JSLock.h>
 #include <wtf/RefCountedLeakCounter.h>
 
@@ -97,7 +98,7 @@ void JSLazyEventListener::parseCode() const
     ExecState* exec = m_globalObject->globalExec();
 
     MarkedArgumentBuffer args;
-    UString sourceURL(executionContext->url().string().operator UString());
+    UString sourceURL(executionContext->url().string());
     args.append(jsNontrivialString(exec, m_eventParameterName));
     args.append(jsString(exec, m_code));
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
index 4fcf548..ef58349 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
@@ -31,6 +31,7 @@
 #include "KURL.h"
 #include "Location.h"
 #include "ScriptController.h"
+#include <runtime/JSFunction.h>
 #include <runtime/PrototypeFunction.h>
 
 using namespace JSC;
@@ -93,6 +94,51 @@ bool JSLocation::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& p
     return true;
 }
 
+bool JSLocation::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    Frame* frame = impl()->frame();
+    if (!frame) {
+        descriptor.setUndefined();
+        return true;
+    }
+    
+    // When accessing Location cross-domain, functions are always the native built-in ones.
+    // See JSDOMWindow::getOwnPropertySlotDelegate for additional details.
+    
+    // Our custom code is only needed to implement the Window cross-domain scheme, so if access is
+    // allowed, return false so the normal lookup will take place.
+    String message;
+    if (allowsAccessFromFrame(exec, frame, message))
+        return false;
+    
+    // Check for the few functions that we allow, even when called cross-domain.
+    const HashEntry* entry = JSLocationPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
+    PropertySlot slot;
+    if (entry && (entry->attributes() & Function)) {
+        if (entry->function() == jsLocationPrototypeFunctionReplace) {
+            slot.setCustom(this, nonCachingStaticReplaceFunctionGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+            return true;
+        } else if (entry->function() == jsLocationPrototypeFunctionReload) {
+            slot.setCustom(this, nonCachingStaticReloadFunctionGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+            return true;
+        } else if (entry->function() == jsLocationPrototypeFunctionAssign) {
+            slot.setCustom(this, nonCachingStaticAssignFunctionGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+            return true;
+        }
+    }
+    
+    // FIXME: Other implementers of the Window cross-domain scheme (Window, History) allow toString,
+    // but for now we have decided not to, partly because it seems silly to return "[Object Location]" in
+    // such cases when normally the string form of Location would be the URL.
+    
+    printErrorMessageForFrame(frame, message);
+    descriptor.setUndefined();
+    return true;
+}
+
 bool JSLocation::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     Frame* frame = impl()->frame();
@@ -120,20 +166,20 @@ bool JSLocation::putDelegate(ExecState* exec, const Identifier& propertyName, JS
     return false;
 }
 
-bool JSLocation::deleteProperty(ExecState* exec, const Identifier& propertyName, bool checkDontDelete)
+bool JSLocation::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
     // Only allow deleting by frames in the same origin.
     if (!allowsAccessFromFrame(exec, impl()->frame()))
         return false;
-    return Base::deleteProperty(exec, propertyName, checkDontDelete);
+    return Base::deleteProperty(exec, propertyName);
 }
 
-void JSLocation::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSLocation::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     // Only allow the location object to enumerated by frames in the same origin.
     if (!allowsAccessFromFrame(exec, impl()->frame()))
         return;
-    Base::getPropertyNames(exec, propertyNames, listedAttributes);
+    Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 void JSLocation::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
@@ -245,13 +291,13 @@ void JSLocation::setHash(ExecState* exec, JSValue value)
     ASSERT(frame);
 
     KURL url = frame->loader()->url();
-    String oldRef = url.ref();
+    String oldFragmentIdentifier = url.fragmentIdentifier();
     String str = value.toString(exec);
     if (str.startsWith("#"))
         str = str.substring(1);
-    if (oldRef == str || (oldRef.isNull() && str.isEmpty()))
+    if (equalIgnoringNullity(oldFragmentIdentifier, str))
         return;
-    url.setRef(str);
+    url.setFragmentIdentifier(str);
 
     navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.cpp
index 25a5cb2..9721ba3 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.cpp
@@ -30,6 +30,7 @@
 #include "JSDocument.h"
 #include "JSMessageChannel.h"
 #include "MessageChannel.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelCustom.cpp
index d3b5878..574e28a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,20 +32,20 @@ using namespace JSC;
 
 namespace WebCore {
     
-void JSMessageChannel::mark()
+void JSMessageChannel::markChildren(MarkStack& markStack)
 {
-    Base::mark();
+    Base::markChildren(markStack);
 
     if (MessagePort* port = m_impl->port1()) {
         DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), port);
-        if (wrapper && !wrapper->marked())
-            wrapper->mark();
+        if (wrapper)
+            markStack.append(wrapper);
     }
 
     if (MessagePort* port = m_impl->port2()) {
         DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), port);
-        if (wrapper && !wrapper->marked())
-            wrapper->mark();
+        if (wrapper)
+            markStack.append(wrapper);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageEventCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageEventCustom.cpp
new file mode 100644
index 0000000..4c61c04
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageEventCustom.cpp
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSMessageEvent.h"
+
+#include "JSDOMBinding.h"
+#include "JSDOMWindow.h"
+#include "JSEventTarget.h"
+#include "JSMessagePortCustom.h"
+#include "MessageEvent.h"
+#include <runtime/JSArray.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSMessageEvent::ports(ExecState* exec) const
+{
+    MessagePortArray* ports = static_cast<MessageEvent*>(impl())->ports();
+    if (!ports || ports->isEmpty())
+        return jsNull();
+
+    MarkedArgumentBuffer list;
+    for (size_t i = 0; i < ports->size(); i++)
+        list.append(toJS(exec, globalObject(), (*ports)[i].get()));
+    return constructArray(exec, list);
+}
+
+JSC::JSValue JSMessageEvent::initMessageEvent(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    const UString& typeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
+    const UString& dataArg = args.at(3).toString(exec);
+    const UString& originArg = args.at(4).toString(exec);
+    const UString& lastEventIdArg = args.at(5).toString(exec);
+    DOMWindow* sourceArg = toDOMWindow(args.at(6));
+    OwnPtr<MessagePortArray> messagePorts;
+    if (!args.at(7).isUndefinedOrNull()) {
+        messagePorts = new MessagePortArray();
+        fillMessagePortArray(exec, args.at(7), *messagePorts);
+        if (exec->hadException())
+            return jsUndefined();
+    }
+
+    MessageEvent* event = static_cast<MessageEvent*>(this->impl());
+    event->initMessageEvent(typeArg, canBubbleArg, cancelableArg, dataArg, originArg, lastEventIdArg, sourceArg, messagePorts.release());
+    return jsUndefined();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
index 71472d5..8202d1a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
@@ -28,27 +28,30 @@
 
 #include "AtomicString.h"
 #include "Event.h"
+#include "ExceptionCode.h"
 #include "Frame.h"
 #include "JSDOMGlobalObject.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
+#include "JSMessagePortCustom.h"
 #include "MessagePort.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-void JSMessagePort::mark()
+void JSMessagePort::markChildren(MarkStack& markStack)
 {
-    Base::mark();
+    Base::markChildren(markStack);
 
-    markIfNotNull(m_impl->onmessage());
+    markIfNotNull(markStack, m_impl->onmessage());
 
     // If we have a locally entangled port, we can directly mark it as reachable. Ports that are remotely entangled are marked in-use by markActiveObjectsForContext().
     if (MessagePort* entangledPort = m_impl->locallyEntangledPort()) {
         DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), entangledPort);
-        if (wrapper && !wrapper->marked())
-            wrapper->mark();
+        if (wrapper)
+            markStack.append(wrapper);
     }
 
     typedef MessagePort::EventListenersMap EventListenersMap;
@@ -56,7 +59,7 @@ void JSMessagePort::mark()
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
         for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) 
-            (*vecIter)->markJSFunction();
+            (*vecIter)->markJSFunction(markStack);
     }
 }
 
@@ -65,10 +68,12 @@ JSValue JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -77,11 +82,54 @@ JSValue JSMessagePort::removeEventListener(ExecState* exec, const ArgList& args)
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
+JSC::JSValue JSMessagePort::postMessage(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return handlePostMessage(exec, args, impl());
+}
+
+void fillMessagePortArray(JSC::ExecState* exec, JSC::JSValue value, MessagePortArray& portArray)
+{
+    // Convert from the passed-in JS array-like object to a MessagePortArray.
+    // Also validates the elements per sections 4.1.13 and 4.1.15 of the WebIDL spec and section 8.3.3 of the HTML5 spec.
+    if (value.isUndefinedOrNull()) {
+        portArray.resize(0);
+        return;
+    }
+
+    // Validation of sequence types, per WebIDL spec 4.1.13.
+    unsigned length;
+    JSObject* object = toJSSequence(exec, value, length);
+    if (exec->hadException())
+        return;
+
+    portArray.resize(length);
+    for (unsigned i = 0 ; i < length; ++i) {
+        JSValue value = object->get(exec, i);
+        if (exec->hadException())
+            return;
+        // Validation of non-null objects, per HTML5 spec 8.3.3.
+        if (value.isUndefinedOrNull()) {
+            setDOMException(exec, INVALID_STATE_ERR);
+            return;
+        }
+
+        // Validation of Objects implementing an interface, per WebIDL spec 4.1.15.
+        RefPtr<MessagePort> port = toMessagePort(value);
+        if (!port) {
+            throwError(exec, TypeError);
+            return;
+        }
+        portArray[i] = port.release();
+    }
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.h b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.h
new file mode 100644
index 0000000..7e90943
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSMessagePortCustom_h
+#define JSMessagePortCustom_h
+
+#include "MessagePort.h"
+#include <runtime/JSValue.h>
+
+namespace WebCore {
+
+    typedef int ExceptionCode;
+
+    class String;
+
+    // Helper function which pulls the values out of a JS sequence and into a MessagePortArray.
+    // Also validates the elements per sections 4.1.13 and 4.1.15 of the WebIDL spec and section 8.3.3 of the HTML5 spec.
+    // May generate an exception via the passed ExecState.
+    void fillMessagePortArray(JSC::ExecState*, JSC::JSValue, MessagePortArray&);
+
+    // Helper function to convert from JS postMessage arguments to WebCore postMessage arguments.
+    template <typename T>
+    inline JSC::JSValue handlePostMessage(JSC::ExecState* exec, const JSC::ArgList& args, T* impl)
+    {
+        String message = args.at(0).toString(exec);
+        MessagePortArray portArray;
+        fillMessagePortArray(exec, args.at(1), portArray);
+        if (exec->hadException())
+            return JSC::jsUndefined();
+
+        ExceptionCode ec = 0;
+        impl->postMessage(message, &portArray, ec);
+        setDOMException(exec, ec);
+        return JSC::jsUndefined();
+    }
+
+}
+#endif // JSMessagePortCustom_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.cpp
index f36a7d6..a1cb202 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.cpp
@@ -89,4 +89,37 @@ bool JSNamedNodesCollection::getOwnPropertySlot(ExecState* exec, const Identifie
     return DOMObjectWithGlobalPointer::getOwnPropertySlot(exec, propertyName, slot);
 }
 
+bool JSNamedNodesCollection::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    if (propertyName == exec->propertyNames().length) {
+        descriptor.setDescriptor(jsNumber(exec, m_nodes->size()), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok);
+    if (ok && index < m_nodes->size()) {
+        PropertySlot slot;
+        slot.setCustomIndex(this, index, indexGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete);
+        return true;
+    }
+    
+    // For IE compatibility, we need to be able to look up elements in a
+    // document.formName.name result by id as well as be index.
+    
+    AtomicString atomicPropertyName = propertyName;
+    for (unsigned i = 0; i < m_nodes->size(); i++) {
+        Node* node = (*m_nodes)[i].get();
+        if (node->hasAttributes() && node->attributes()->id() == atomicPropertyName) {
+            PropertySlot slot;
+            slot.setCustomIndex(this, i, indexGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete);
+            return true;
+        }
+    }
+    
+    return DOMObjectWithGlobalPointer::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.h b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.h
index cd6c2cb..fc629d8 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.h
@@ -40,6 +40,7 @@ namespace WebCore {
         JSNamedNodesCollection(JSC::ExecState*, JSDOMGlobalObject*, const Vector<RefPtr<Node> >&);
 
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
 
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
         static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNavigatorCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNavigatorCustom.cpp
index ea6cceb..c023931 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNavigatorCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNavigatorCustom.cpp
@@ -29,13 +29,13 @@ namespace WebCore {
 
 using namespace JSC;
 
-void JSNavigator::mark()
+void JSNavigator::markChildren(MarkStack& markStack)
 {
-    Base::mark();
+    Base::markChildren(markStack);
 
     JSGlobalData& globalData = *Heap::heap(this)->globalData();
 
-    markDOMObjectWrapper(globalData, impl()->optionalGeolocation());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalGeolocation());
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
index 2f080b8..e88a9ec 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -110,25 +110,37 @@ JSValue JSNode::appendChild(ExecState* exec, const ArgList& args)
 
 JSValue JSNode::addEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    Document* document = impl()->document();
+    if (!document)
+        return jsUndefined();
+        
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(document);
     if (!globalObject)
         return jsUndefined();
 
-    if (RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1)))
-        impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
 JSValue JSNode::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    Document* document = impl()->document();
+    if (!document)
+        return jsUndefined();
+
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(document);
     if (!globalObject)
         return jsUndefined();
 
-    if (JSEventListener* listener = globalObject->findJSEventListener(args.at(1)))
-        impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -136,22 +148,21 @@ void JSNode::pushEventHandlerScope(ExecState*, ScopeChain&) const
 {
 }
 
-void JSNode::mark()
+void JSNode::markChildren(MarkStack& markStack)
 {
-    ASSERT(!marked());
-
     Node* node = m_impl.get();
 
+    Base::markChildren(markStack);
+    markEventListeners(markStack, node->eventListeners());
+
     // Nodes in the document are kept alive by JSDocument::mark, so, if we're in
     // the document, we need to mark the document, but we don't need to explicitly
     // mark any other nodes.
     if (node->inDocument()) {
-        Base::mark();
-        markEventListeners(node->eventListeners());
-        if (Document* doc = node->ownerDocument())
+        if (Document* doc = node->ownerDocument()) {
             if (DOMObject* docWrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), doc))
-                if (!docWrapper->marked())
-                    docWrapper->mark();
+                markStack.append(docWrapper);
+        }
         return;
     }
 
@@ -163,33 +174,17 @@ void JSNode::mark()
 
     // Nodes in a subtree are marked by the tree's root, so, if the root is already
     // marking the tree, we don't need to explicitly mark any other nodes.
-    if (root->inSubtreeMark()) {
-        Base::mark();
-        markEventListeners(node->eventListeners());
+    if (root->inSubtreeMark())
         return;
-    }
 
     // Mark the whole tree subtree.
     root->setInSubtreeMark(true);
     for (Node* nodeToMark = root; nodeToMark; nodeToMark = nodeToMark->traverseNextNode()) {
         JSNode* wrapper = getCachedDOMNodeWrapper(m_impl->document(), nodeToMark);
-        if (wrapper) {
-            if (!wrapper->marked())
-                wrapper->mark();
-        } else if (nodeToMark == node) {
-            // This is the case where the map from the document to wrappers has
-            // been cleared out, but a wrapper is being marked. For now, we'll
-            // let the rest of the tree of wrappers get collected, because we have
-            // no good way of finding them. Later we should test behavior of other
-            // browsers and see if we need to preserve other wrappers in this case.
-            if (!marked())
-                mark();
-        }
+        if (wrapper)
+            markStack.append(wrapper);
     }
     root->setInSubtreeMark(false);
-
-    // Double check that we actually ended up marked. This assert caught problems in the past.
-    ASSERT(marked());
 }
 
 static ALWAYS_INLINE JSValue createWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, Node* node)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp
index 2595af5..a199417 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -36,10 +36,9 @@ JSNodeFilterCondition::JSNodeFilterCondition(JSValue filter)
 {
 }
 
-void JSNodeFilterCondition::mark()
+void JSNodeFilterCondition::markAggregate(MarkStack& markStack)
 {
-    if (!m_filter.marked())
-        m_filter.mark();
+    markStack.append(m_filter);
 }
 
 short JSNodeFilterCondition::acceptNode(JSC::ExecState* exec, Node* filterNode) const
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.h b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.h
index 3d591c6..b96534a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.h
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -39,7 +39,7 @@ namespace WebCore {
         JSNodeFilterCondition(JSC::JSValue filter);
 
         virtual short acceptNode(ScriptState*, Node*) const;
-        virtual void mark();
+        virtual void markAggregate(JSC::MarkStack&);
 
         mutable JSC::JSValue m_filter;
     };
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCustom.cpp
index a48a59d..2a99a93 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,10 +35,10 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSNodeFilter::mark()
+void JSNodeFilter::markChildren(MarkStack& markStack)
 {
-    impl()->mark();
-    Base::mark();
+    Base::markChildren(markStack);
+    impl()->markAggregate(markStack);
 }
 
 JSValue JSNodeFilter::acceptNode(ExecState* exec, const ArgList& args)
@@ -48,7 +48,7 @@ JSValue JSNodeFilter::acceptNode(ExecState* exec, const ArgList& args)
 
 PassRefPtr<NodeFilter> toNodeFilter(JSValue value)
 {
-    if (value.isObject(&JSNodeFilter::s_info))
+    if (value.inherits(&JSNodeFilter::s_info))
         return static_cast<JSNodeFilter*>(asObject(value))->impl();
 
     return NodeFilter::create(JSNodeFilterCondition::create(value));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeIteratorCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeIteratorCustom.cpp
index a2b9658..6a09abf 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeIteratorCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeIteratorCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -29,12 +29,12 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSNodeIterator::mark()
+void JSNodeIterator::markChildren(MarkStack& markStack)
 {
+    Base::markChildren(markStack);
+
     if (NodeFilter* filter = m_impl->filter())
-        filter->mark();
-    
-    Base::mark();
+        filter->markAggregate(markStack);
 }
 
 JSValue JSNodeIterator::nextNode(ExecState* exec, const ArgList&)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp
index 2b8bd5d..7da0666 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp
@@ -25,6 +25,7 @@
 #include "JSHTMLOptionElement.h"
 #include "ScriptExecutionContext.h"
 #include "Text.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp
index 56b0eca..ada2a77 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp
@@ -86,6 +86,22 @@ bool runtimeObjectCustomGetOwnPropertySlot(ExecState* exec, const Identifier& pr
     return true;
 }
 
+bool runtimeObjectCustomGetOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor, JSHTMLElement* element)
+{
+    RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element->impl());
+    if (!runtimeObject)
+        return false;
+    if (!runtimeObject->hasProperty(exec, propertyName))
+        return false;
+    PropertySlot slot;
+    slot.setCustom(element, runtimeObjectPropertyGetter);
+    // While we don't know what the plugin allows, we do know that we prevent
+    // enumeration or deletion of properties, so we mark plugin properties
+    // as DontEnum | DontDelete
+    descriptor.setDescriptor(slot.getValue(exec, propertyName), DontEnum | DontDelete);
+    return true;
+}
+
 bool runtimeObjectCustomPut(ExecState* exec, const Identifier& propertyName, JSValue value, HTMLElement* element, PutPropertySlot& slot)
 {
     RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h
index 8c9dfa7..a5a323a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h
@@ -33,6 +33,7 @@ namespace WebCore {
     JSC::JSValue runtimeObjectGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
     JSC::JSValue runtimeObjectPropertyGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
     bool runtimeObjectCustomGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&, JSHTMLElement*);
+    bool runtimeObjectCustomGetOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&, JSHTMLElement*);
     bool runtimeObjectCustomPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, HTMLElement*, JSC::PutPropertySlot&);
     JSC::CallType runtimeObjectGetCallData(HTMLElement*, JSC::CallData&);
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
index 3ca0dd4..a071a4e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -92,14 +92,12 @@ void JSQuarantinedObjectWrapper::transferExceptionToExecState(ExecState* exec) c
     exec->setException(wrapOutgoingValue(unwrappedExecState(), exception));
 }
 
-void JSQuarantinedObjectWrapper::mark()
+void JSQuarantinedObjectWrapper::markChildren(MarkStack& markStack)
 {
-    JSObject::mark();
+    JSObject::markChildren(markStack);
 
-    if (!m_unwrappedObject->marked())
-        m_unwrappedObject->mark();
-    if (!m_unwrappedGlobalObject->marked())
-        m_unwrappedGlobalObject->mark();
+    markStack.append(m_unwrappedObject);
+    markStack.append(m_unwrappedGlobalObject);
 }
 
 bool JSQuarantinedObjectWrapper::getOwnPropertySlot(ExecState* exec, const Identifier& identifier, PropertySlot& slot)
@@ -140,6 +138,26 @@ bool JSQuarantinedObjectWrapper::getOwnPropertySlot(ExecState* exec, unsigned id
     return result;
 }
 
+bool JSQuarantinedObjectWrapper::getOwnPropertyDescriptor(ExecState* exec, const Identifier& identifier, PropertyDescriptor& descriptor)
+{
+    if (!allowsGetProperty()) {
+        descriptor.setUndefined();
+        return true;
+    }
+
+    PropertyDescriptor unwrappedDescriptor;
+    bool result = m_unwrappedObject->getOwnPropertyDescriptor(unwrappedExecState(), identifier, unwrappedDescriptor);
+
+    if (unwrappedDescriptor.hasAccessors()) {
+        descriptor.setAccessorDescriptor(wrapOutgoingValue(unwrappedExecState(), unwrappedDescriptor.getter()),
+                                         wrapOutgoingValue(unwrappedExecState(), unwrappedDescriptor.setter()),
+                                         unwrappedDescriptor.attributes());
+    } else
+        descriptor.setDescriptor(wrapOutgoingValue(unwrappedExecState(), unwrappedDescriptor.value()), unwrappedDescriptor.attributes());
+    transferExceptionToExecState(exec);
+    return result;
+}
+
 void JSQuarantinedObjectWrapper::put(ExecState* exec, const Identifier& identifier, JSValue value, PutPropertySlot& slot)
 {
     if (!allowsSetProperty())
@@ -160,12 +178,12 @@ void JSQuarantinedObjectWrapper::put(ExecState* exec, unsigned identifier, JSVal
     transferExceptionToExecState(exec);
 }
 
-bool JSQuarantinedObjectWrapper::deleteProperty(ExecState* exec, const Identifier& identifier, bool checkDontDelete)
+bool JSQuarantinedObjectWrapper::deleteProperty(ExecState* exec, const Identifier& identifier)
 {
     if (!allowsDeleteProperty())
         return false;
 
-    bool result = m_unwrappedObject->deleteProperty(unwrappedExecState(), identifier, checkDontDelete);
+    bool result = m_unwrappedObject->deleteProperty(unwrappedExecState(), identifier);
 
     transferExceptionToExecState(exec);
 
@@ -268,12 +286,20 @@ CallType JSQuarantinedObjectWrapper::getCallData(CallData& callData)
     return CallTypeHost;
 }
 
-void JSQuarantinedObjectWrapper::getPropertyNames(ExecState*, PropertyNameArray& array, unsigned listedAttributes)
+void JSQuarantinedObjectWrapper::getPropertyNames(ExecState*, PropertyNameArray& array)
+{
+    if (!allowsGetPropertyNames())
+        return;
+    
+    m_unwrappedObject->getPropertyNames(unwrappedExecState(), array);
+}
+
+void JSQuarantinedObjectWrapper::getOwnPropertyNames(ExecState*, PropertyNameArray& array)
 {
     if (!allowsGetPropertyNames())
         return;
 
-    m_unwrappedObject->getPropertyNames(unwrappedExecState(), array, listedAttributes);
+    m_unwrappedObject->getOwnPropertyNames(unwrappedExecState(), array);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
index 95e42f6..37f2518 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -53,24 +53,26 @@ namespace WebCore {
     protected:
         JSQuarantinedObjectWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, PassRefPtr<JSC::Structure>);
 
-        virtual void mark();
+        virtual void markChildren(JSC::MarkStack&);
 
     private:
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
         virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned, JSC::PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
 
         virtual void put(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
         virtual void put(JSC::ExecState*, unsigned, JSC::JSValue);
 
-        virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&, bool checkDontDelete = true);
+        virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
         virtual bool deleteProperty(JSC::ExecState*, unsigned);
 
         virtual JSC::CallType getCallData(JSC::CallData&);
         virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
 
         virtual bool hasInstance(JSC::ExecState*, JSC::JSValue, JSC::JSValue proto);
-
-        virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype);
+        
+        virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+        virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
 
         virtual JSC::UString className() const { return m_unwrappedObject->className(); }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSQLTransactionCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSQLTransactionCustom.cpp
index 30d59aa..e022401 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSQLTransactionCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSQLTransactionCustom.cpp
@@ -44,6 +44,11 @@ namespace WebCore {
     
 JSValue JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
 {
+    if (args.isEmpty()) {
+        setDOMException(exec, SYNTAX_ERR);
+        return jsUndefined();
+    }
+
     String sqlStatement = args.at(0).toString(exec);
     if (exec->hadException())
         return jsUndefined();
@@ -90,8 +95,7 @@ JSValue JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
             return jsUndefined();
         }
         
-        if (Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame())
-            callback = JSCustomSQLStatementCallback::create(object, frame);
+        callback = JSCustomSQLStatementCallback::create(object, static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()));
     }
     
     RefPtr<SQLStatementErrorCallback> errorCallback;
@@ -102,8 +106,7 @@ JSValue JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
             return jsUndefined();
         }
         
-        if (Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame())
-            errorCallback = JSCustomSQLStatementErrorCallback::create(object, frame);
+        errorCallback = JSCustomSQLStatementErrorCallback::create(object, static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()));
     }
     
     ExceptionCode ec = 0;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
index 055368e..e8001de 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2009 Apple, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -37,14 +38,14 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSSVGElementInstance::mark()
+void JSSVGElementInstance::markChildren(MarkStack& markStack)
 {
-    Base::mark();
+    Base::markChildren(markStack);
 
     // Mark the wrapper for our corresponding element, so it can mark its event handlers.
     JSNode* correspondingWrapper = getCachedDOMNodeWrapper(impl()->correspondingElement()->document(), impl()->correspondingElement());
-    if (correspondingWrapper && !correspondingWrapper->marked())
-        correspondingWrapper->mark();
+    if (correspondingWrapper)
+        markStack.append(correspondingWrapper);
 }
 
 JSValue JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& args)
@@ -53,9 +54,11 @@ JSValue JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& a
     if (!globalObject)
         return jsUndefined();
 
-    if (RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1)))
-        impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -65,9 +68,11 @@ JSValue JSSVGElementInstance::removeEventListener(ExecState* exec, const ArgList
     if (!globalObject)
         return jsUndefined();
 
-    if (JSEventListener* listener = globalObject->findJSEventListener(args.at(1)))
-        impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerConstructor.cpp
index a312225..651805c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerConstructor.cpp
@@ -37,6 +37,7 @@
 #include "JSDOMWindowCustom.h"
 #include "JSSharedWorker.h"
 #include "SharedWorker.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
@@ -45,15 +46,17 @@ namespace WebCore {
 const ClassInfo JSSharedWorkerConstructor::s_info = { "SharedWorkerConstructor", 0, 0, 0 };
 
 JSSharedWorkerConstructor::JSSharedWorkerConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSSharedWorkerConstructor::createStructure(globalObject->objectPrototype()))
+    : DOMConstructorObject(JSSharedWorkerConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
     putDirect(exec->propertyNames().prototype, JSSharedWorkerPrototype::self(exec, globalObject), None);
     // Host functions have a length property describing the number of expected arguments.
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
-static JSObject* constructSharedWorker(ExecState* exec, JSObject*, const ArgList& args)
+static JSObject* constructSharedWorker(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
+    JSSharedWorkerConstructor* jsConstructor = static_cast<JSSharedWorkerConstructor*>(constructor);
+
     if (args.size() < 2)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
@@ -62,13 +65,13 @@ static JSObject* constructSharedWorker(ExecState* exec, JSObject*, const ArgList
     if (exec->hadException())
         return 0;
 
-    ScriptExecutionContext* context = static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject())->scriptExecutionContext();
+    // FIXME: We need to use both the dynamic scope and the lexical scope (dynamic scope for resolving the worker URL)
+    DOMWindow* window = asJSDOMWindow(exec->lexicalGlobalObject())->impl();
     ExceptionCode ec = 0;
-    RefPtr<SharedWorker> worker = SharedWorker::create(scriptURL, name, context, ec);
+    RefPtr<SharedWorker> worker = SharedWorker::create(scriptURL, name, window->document(), ec);
     setDOMException(exec, ec);
 
-    // FIXME: toJS() creates an object whose prototype is derived from lexicalGlobalScope, which is incorrect (Bug 27088)
-    return asObject(toJS(exec, worker.release()));
+    return asObject(toJS(exec, jsConstructor->globalObject(), worker.release()));
 }
 
 ConstructType JSSharedWorkerConstructor::getConstructData(ConstructData& constructData)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerContextCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerContextCustom.cpp
new file mode 100644
index 0000000..dca3536
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerContextCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(SHARED_WORKERS)
+
+#include "JSSharedWorkerContext.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSSharedWorkerContext::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    markIfNotNull(markStack, impl()->onconnect());
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SHARED_WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerCustom.cpp
index 8553298..f21f50c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSharedWorkerCustom.cpp
@@ -41,14 +41,14 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSSharedWorker::mark()
+void JSSharedWorker::markChildren(MarkStack& markStack)
 {
-    Base::mark();
+    Base::markChildren(markStack);
 
     if (MessagePort* port = impl()->port()) {
         DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), port);
-        if (wrapper && !wrapper->marked())
-            wrapper->mark();
+        if (wrapper)
+            markStack.append(wrapper);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp
index 4af5ddd..e416d35 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp
@@ -47,7 +47,7 @@ JSValue JSStorage::nameGetter(ExecState* exec, const Identifier& propertyName, c
     return jsStringOrNull(exec, thisObj->impl()->getItem(propertyName));
 }
 
-bool JSStorage::deleteProperty(ExecState* exec, const Identifier& propertyName, bool /*checkDontDelete*/)
+bool JSStorage::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
     // Only perform the custom delete if the object doesn't have a native property by this name.
     // Since hasProperty() would end up calling canGetItemsForName() and be fooled, we need to check
@@ -64,14 +64,13 @@ bool JSStorage::deleteProperty(ExecState* exec, const Identifier& propertyName,
     return true;
 }
 
-void JSStorage::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSStorage::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
-    ExceptionCode ec;
     unsigned length = m_impl->length();
     for (unsigned i = 0; i < length; ++i)
-        propertyNames.add(Identifier(exec, m_impl->key(i, ec)));
+        propertyNames.add(Identifier(exec, m_impl->key(i)));
         
-    Base::getPropertyNames(exec, propertyNames, listedAttributes);
+    Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 bool JSStorage::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp
index 00dacee..d711b6f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -52,20 +52,25 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, StyleSheet* style
     return wrapper;
 }
 
-void JSStyleSheet::mark()
+void JSStyleSheet::markChildren(MarkStack& markStack)
 {
-    Base::mark();
+    Base::markChildren(markStack);
+
+    StyleSheet* sheet = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    unsigned length = sheet->length();
+    for (unsigned i = 0; i < length; ++i)
+        markDOMObjectWrapper(markStack, globalData, sheet->item(i));
 
     // This prevents us from having a style sheet with a dangling ownerNode pointer.
     // A better solution would be to handle this on the DOM side -- if the style sheet
     // is kept around, then we want the node to stay around too. One possibility would
     // be to make ref/deref on the style sheet ref/deref the node instead, but there's
     // a lot of disentangling of the CSS DOM objects that would need to happen first.
-    if (Node* ownerNode = impl()->ownerNode()) {
-        if (JSNode* ownerNodeWrapper = getCachedDOMNodeWrapper(ownerNode->document(), ownerNode)) {
-            if (!ownerNodeWrapper->marked())
-                ownerNodeWrapper->mark();
-        }
+    if (Node* ownerNode = sheet->ownerNode()) {
+        if (JSNode* ownerNodeWrapper = getCachedDOMNodeWrapper(ownerNode->document(), ownerNode))
+            markStack.append(ownerNodeWrapper);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp
index 1da6418..7bf9389 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,6 +35,18 @@ using namespace JSC;
 
 namespace WebCore {
 
+void JSStyleSheetList::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    StyleSheetList* list = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    unsigned length = list->length();
+    for (unsigned i = 0; i < length; ++i)
+        markDOMObjectWrapper(markStack, globalData, list->item(i));
+}
+
 bool JSStyleSheetList::canGetItemsForName(ExecState*, StyleSheetList* styleSheetList, const Identifier& propertyName)
 {
     return styleSheetList->getNamedItem(propertyName);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSTreeWalkerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSTreeWalkerCustom.cpp
index 58eea72..f879cf4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSTreeWalkerCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSTreeWalkerCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -29,12 +29,12 @@ using namespace JSC;
 
 namespace WebCore {
     
-void JSTreeWalker::mark()
+void JSTreeWalker::markChildren(MarkStack& markStack)
 {
+    Base::markChildren(markStack);
+
     if (NodeFilter* filter = m_impl->filter())
-        filter->mark();
-    
-    Base::mark();
+        filter->markAggregate(markStack);
 }
     
 JSValue JSTreeWalker::parentNode(ExecState* exec, const ArgList&)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketConstructor.cpp
new file mode 100644
index 0000000..5b34765
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketConstructor.cpp
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "JSWebSocketConstructor.h"
+
+#include "JSWebSocket.h"
+#include "ScriptExecutionContext.h"
+#include "WebSocket.h"
+#include <runtime/Error.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSWebSocketConstructor);
+
+const ClassInfo JSWebSocketConstructor::s_info = { "WebSocketConstructor", 0, 0, 0 };
+
+JSWebSocketConstructor::JSWebSocketConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebSocketConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSWebSocketPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly | DontDelete | DontEnum);
+}
+
+static JSObject* constructWebSocket(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSWebSocketConstructor* jsConstructor = static_cast<JSWebSocketConstructor*>(constructor);
+    ScriptExecutionContext* context = jsConstructor->scriptExecutionContext();
+    if (!context)
+        return throwError(exec, ReferenceError, "WebSocket constructor associated document is unavailable");
+
+    if (args.size() == 0)
+        return throwError(exec, SyntaxError, "Not enough arguments");
+
+    const String& urlString = args.at(0).toString(exec);
+    if (exec->hadException())
+        return throwError(exec, SyntaxError, "wrong URL");
+    const KURL& url = context->completeURL(urlString);
+    RefPtr<WebSocket> webSocket = WebSocket::create(context);
+    ExceptionCode ec = 0;
+    if (args.size() < 2)
+        webSocket->connect(url, ec);
+    else {
+        const String& protocol = args.at(1).toString(exec);
+        if (exec->hadException())
+            return 0;
+        webSocket->connect(url, protocol, ec);
+    }
+    setDOMException(exec, ec);
+    return CREATE_DOM_OBJECT_WRAPPER(exec, jsConstructor->globalObject(), WebSocket, webSocket.get());
+}
+
+ConstructType JSWebSocketConstructor::getConstructData(ConstructData& constructData)
+{
+    constructData.native.function = constructWebSocket;
+    return ConstructTypeHost;
+}
+
+}  // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketConstructor.h
new file mode 100644
index 0000000..069647a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketConstructor.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSWebSocketConstructor_h
+#define JSWebSocketConstructor_h
+
+#include "JSDOMBinding.h"
+
+namespace WebCore {
+
+class JSWebSocketConstructor : public DOMConstructorObject {
+  public:
+    JSWebSocketConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+    static const JSC::ClassInfo s_info;
+
+  private:
+    virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+};
+
+}  // namespace WebCore
+
+#endif  // JSWebSocketConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp
new file mode 100644
index 0000000..401b33d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ * Copyright (C) 2009 Apple, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "JSWebSocket.h"
+
+#include "KURL.h"
+#include "WebSocket.h"
+#include "NotImplemented.h"
+#include <runtime/Error.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSWebSocket::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+    if (m_impl->readyState() != WebSocket::CLOSED)
+        markIfNotNull(markStack, m_impl->onmessage());
+    // FIXME: mark if EventListeners is registered.
+}
+
+// Custom functions
+JSValue JSWebSocket::send(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return throwError(exec, SyntaxError, "Not enough arguments");
+
+    const String& msg = args.at(0).toString(exec);
+    if (exec->hadException())
+        return throwError(exec, SyntaxError, "bad message data.");
+    ExceptionCode ec = 0;
+    JSValue ret = jsBoolean(impl()->send(msg, ec));
+    setDOMException(exec, ec);
+    return ret;
+}
+
+// FIXME: implement addEventListener/removeEventListener.
+
+}  // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerConstructor.cpp
index e1686f7..69c05e7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerConstructor.cpp
@@ -34,6 +34,7 @@
 #include "JSDOMWindowCustom.h"
 #include "JSWorker.h"
 #include "Worker.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
@@ -62,7 +63,12 @@ static JSObject* constructWorker(ExecState* exec, JSObject* constructor, const A
     // See section 4.8.2 step 14 of WebWorkers for why this is the lexicalGlobalObject. 
     DOMWindow* window = asJSDOMWindow(exec->lexicalGlobalObject())->impl();
 
-    RefPtr<Worker> worker = Worker::create(scriptURL, window->document());
+    ExceptionCode ec = 0;
+    RefPtr<Worker> worker = Worker::create(scriptURL, window->document(), ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return 0;
+    }
 
     return asObject(toJS(exec, jsConstructor->globalObject(), worker.release()));
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp
index 622da70..1e4df42 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp
@@ -32,6 +32,7 @@
 #include "JSWorkerContextBase.h"
 
 #include "JSDedicatedWorkerContext.h"
+#include "JSSharedWorkerContext.h"
 #include "JSWorkerContext.h"
 #include "WorkerContext.h"
 
@@ -83,10 +84,26 @@ JSDedicatedWorkerContext* toJSDedicatedWorkerContext(JSValue value)
     return 0;
 }
 
+#if ENABLE(SHARED_WORKERS)
+JSSharedWorkerContext* toJSSharedWorkerContext(JSValue value)
+{
+    if (!value.isObject())
+        return 0;
+    const ClassInfo* classInfo = asObject(value)->classInfo();
+    if (classInfo == &JSSharedWorkerContext::s_info)
+        return static_cast<JSSharedWorkerContext*>(asObject(value));
+    return 0;
+}
+#endif
+
 JSWorkerContext* toJSWorkerContext(JSValue value)
 {
-    // When we support shared workers, we'll add code to test for SharedWorkerContext too.
-    return toJSDedicatedWorkerContext(value);
+    JSWorkerContext* context = toJSDedicatedWorkerContext(value);
+#if ENABLE(SHARED_WORKERS)
+    if (!context)
+        context = toJSSharedWorkerContext(value);
+#endif
+    return context;
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.h
index f7ad17f..a9a6e63 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.h
@@ -34,6 +34,7 @@
 namespace WebCore {
 
     class JSDedicatedWorkerContext;
+    class JSSharedWorkerContext;
     class JSWorkerContext;
     class WorkerContext;
 
@@ -61,6 +62,10 @@ namespace WebCore {
     JSDedicatedWorkerContext* toJSDedicatedWorkerContext(JSC::JSValue);
     JSWorkerContext* toJSWorkerContext(JSC::JSValue);
 
+#if ENABLE(SHARED_WORKERS)
+    JSSharedWorkerContext* toJSSharedWorkerContext(JSC::JSValue);
+#endif
+
 } // namespace WebCore
 
 #endif // ENABLE(WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
index 6a7602d..9e54fa0 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
@@ -43,29 +43,33 @@
 #include "WorkerNavigator.h"
 #include <interpreter/Interpreter.h>
 
+#if ENABLE(EVENTSOURCE)
+#include "JSEventSourceConstructor.h"
+#endif
+
 using namespace JSC;
 
 namespace WebCore {
 
-void JSWorkerContext::mark()
+void JSWorkerContext::markChildren(MarkStack& markStack)
 {
-    Base::mark();
+    Base::markChildren(markStack);
 
     JSGlobalData& globalData = *this->globalData();
 
-    markActiveObjectsForContext(globalData, scriptExecutionContext());
+    markActiveObjectsForContext(markStack, globalData, scriptExecutionContext());
 
-    markDOMObjectWrapper(globalData, impl()->optionalLocation());
-    markDOMObjectWrapper(globalData, impl()->optionalNavigator());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalLocation());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalNavigator());
 
-    markIfNotNull(impl()->onerror());
+    markIfNotNull(markStack, impl()->onerror());
 
     typedef WorkerContext::EventListenersMap EventListenersMap;
     typedef WorkerContext::ListenerVector ListenerVector;
     EventListenersMap& eventListeners = impl()->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
         for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction();
+            (*vecIter)->markJSFunction(markStack);
     }
 }
 
@@ -77,6 +81,21 @@ bool JSWorkerContext::getOwnPropertySlotDelegate(ExecState* exec, const Identifi
     return false;
 }
 
+bool JSWorkerContext::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    // Look for overrides before looking at any of our own properties.
+    if (JSGlobalObject::getOwnPropertyDescriptor(exec, propertyName, descriptor))
+        return true;
+    return false;
+}
+
+#if ENABLE(EVENTSOURCE)
+JSValue JSWorkerContext::eventSource(ExecState* exec) const
+{
+    return getDOMConstructor<JSEventSourceConstructor>(exec, this);
+}
+#endif
+
 JSValue JSWorkerContext::xmlHttpRequest(ExecState* exec) const
 {
     return getDOMConstructor<JSXMLHttpRequestConstructor>(exec, this);
@@ -107,19 +126,21 @@ JSValue JSWorkerContext::importScripts(ExecState* exec, const ArgList& args)
 
 JSValue JSWorkerContext::addEventListener(ExecState* exec, const ArgList& args)
 {
-    RefPtr<JSEventListener> listener = findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
 JSValue JSWorkerContext::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSEventListener* listener = findJSEventListener(args.at(1));
-    if (!listener)
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerCustom.cpp
index 6010f83..a42a043 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerCustom.cpp
@@ -30,17 +30,23 @@
 #include "JSWorker.h"
 
 #include "JSDOMGlobalObject.h"
+#include "JSMessagePortCustom.h"
 #include "Worker.h"
 
 using namespace JSC;
 
 namespace WebCore {
-    
-void JSWorker::mark()
+
+void JSWorker::markChildren(MarkStack& markStack)
 {
-    Base::mark();
+    Base::markChildren(markStack);
+
+    markIfNotNull(markStack, static_cast<Worker*>(impl())->onmessage());
+}
 
-    markIfNotNull(static_cast<Worker*>(impl())->onmessage());
+JSC::JSValue JSWorker::postMessage(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return handlePostMessage(exec, args, impl());
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
index a644c9e..91fff9a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
@@ -23,6 +23,7 @@
 #include "JSXMLHttpRequest.h"
 #include "ScriptExecutionContext.h"
 #include "XMLHttpRequest.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
index 06a5817..c69f727 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
@@ -49,29 +49,29 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSXMLHttpRequest::mark()
+void JSXMLHttpRequest::markChildren(MarkStack& markStack)
 {
-    Base::mark();
+    Base::markChildren(markStack);
 
     if (XMLHttpRequestUpload* upload = m_impl->optionalUpload()) {
         DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), upload);
-        if (wrapper && !wrapper->marked())
-            wrapper->mark();
+        if (wrapper)
+            markStack.append(wrapper);
     }
 
-    markIfNotNull(m_impl->onreadystatechange());
-    markIfNotNull(m_impl->onabort());
-    markIfNotNull(m_impl->onerror());
-    markIfNotNull(m_impl->onload());
-    markIfNotNull(m_impl->onloadstart());
-    markIfNotNull(m_impl->onprogress());
+    markIfNotNull(markStack, m_impl->onreadystatechange());
+    markIfNotNull(markStack, m_impl->onabort());
+    markIfNotNull(markStack, m_impl->onerror());
+    markIfNotNull(markStack, m_impl->onload());
+    markIfNotNull(markStack, m_impl->onloadstart());
+    markIfNotNull(markStack, m_impl->onprogress());
     
     typedef XMLHttpRequest::EventListenersMap EventListenersMap;
     typedef XMLHttpRequest::ListenerVector ListenerVector;
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
         for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction();
+            (*vecIter)->markJSFunction(markStack);
     }
 }
 
@@ -123,9 +123,9 @@ JSValue JSXMLHttpRequest::send(ExecState* exec, const ArgList& args)
         JSValue val = args.at(0);
         if (val.isUndefinedOrNull())
             impl()->send(ec);
-        else if (val.isObject(&JSDocument::s_info))
+        else if (val.inherits(&JSDocument::s_info))
             impl()->send(toDocument(val), ec);
-        else if (val.isObject(&JSFile::s_info))
+        else if (val.inherits(&JSFile::s_info))
             impl()->send(toFile(val), ec);
         else
             impl()->send(val.toString(exec), ec);
@@ -168,10 +168,12 @@ JSValue JSXMLHttpRequest::addEventListener(ExecState* exec, const ArgList& args)
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -180,10 +182,12 @@ JSValue JSXMLHttpRequest::removeEventListener(ExecState* exec, const ArgList& ar
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
index 597010c..2f17542 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
@@ -41,28 +41,28 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSXMLHttpRequestUpload::mark()
+void JSXMLHttpRequestUpload::markChildren(MarkStack& markStack)
 {
-    Base::mark();
+    Base::markChildren(markStack);
 
     if (XMLHttpRequest* xmlHttpRequest = m_impl->associatedXMLHttpRequest()) {
         DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), xmlHttpRequest);
-        if (wrapper && !wrapper->marked())
-            wrapper->mark();
+        if (wrapper)
+            markStack.append(wrapper);
     }
 
-    markIfNotNull(m_impl->onabort());
-    markIfNotNull(m_impl->onerror());
-    markIfNotNull(m_impl->onload());
-    markIfNotNull(m_impl->onloadstart());
-    markIfNotNull(m_impl->onprogress());
+    markIfNotNull(markStack, m_impl->onabort());
+    markIfNotNull(markStack, m_impl->onerror());
+    markIfNotNull(markStack, m_impl->onload());
+    markIfNotNull(markStack, m_impl->onloadstart());
+    markIfNotNull(markStack, m_impl->onprogress());
     
     typedef XMLHttpRequestUpload::EventListenersMap EventListenersMap;
     typedef XMLHttpRequestUpload::ListenerVector ListenerVector;
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
         for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction();
+            (*vecIter)->markJSFunction(markStack);
     }
 }
 
@@ -71,10 +71,12 @@ JSValue JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList&
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -83,10 +85,12 @@ JSValue JSXMLHttpRequestUpload::removeEventListener(ExecState* exec, const ArgLi
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorCustom.cpp
index 01e53a6..441bbc9 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorCustom.cpp
@@ -49,7 +49,7 @@ namespace WebCore {
 JSValue JSXSLTProcessor::importStylesheet(ExecState*, const ArgList& args)
 {
     JSValue nodeVal = args.at(0);
-    if (nodeVal.isObject(&JSNode::s_info)) {
+    if (nodeVal.inherits(&JSNode::s_info)) {
         JSNode* node = static_cast<JSNode*>(asObject(nodeVal));
         impl()->importStylesheet(node->impl());
         return jsUndefined();
@@ -62,7 +62,7 @@ JSValue JSXSLTProcessor::transformToFragment(ExecState* exec, const ArgList& arg
 {
     JSValue nodeVal = args.at(0);
     JSValue docVal = args.at(1);
-    if (nodeVal.isObject(&JSNode::s_info) && docVal.isObject(&JSDocument::s_info)) {
+    if (nodeVal.inherits(&JSNode::s_info) && docVal.inherits(&JSDocument::s_info)) {
         WebCore::Node* node = static_cast<JSNode*>(asObject(nodeVal))->impl();
         Document* doc = static_cast<Document*>(static_cast<JSDocument*>(asObject(docVal))->impl());
         return toJS(exec, impl()->transformToFragment(node, doc).get());
@@ -74,7 +74,7 @@ JSValue JSXSLTProcessor::transformToFragment(ExecState* exec, const ArgList& arg
 JSValue JSXSLTProcessor::transformToDocument(ExecState* exec, const ArgList& args)
 {
     JSValue nodeVal = args.at(0);
-    if (nodeVal.isObject(&JSNode::s_info)) {
+    if (nodeVal.inherits(&JSNode::s_info)) {
         JSNode* node = static_cast<JSNode*>(asObject(nodeVal));
         RefPtr<Document> resultDocument = impl()->transformToDocument(node->impl());
         if (resultDocument)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
index 28cbe60..9e64bce 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
@@ -101,9 +101,9 @@ void ScheduledAction::executeFunctionInContext(JSGlobalObject* globalObject, JSV
     for (size_t i = 0; i < size; ++i)
         args.append(m_args[i]);
 
-    globalObject->globalData()->timeoutChecker->start();
+    globalObject->globalData()->timeoutChecker.start();
     call(exec, m_function, callType, callData, thisValue, args);
-    globalObject->globalData()->timeoutChecker->stop();
+    globalObject->globalData()->timeoutChecker.stop();
 
     if (exec->hadException())
         reportCurrentException(exec);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptArray.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptArray.cpp
index 016c7a7..2c4075a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptArray.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptArray.cpp
@@ -37,8 +37,8 @@ using namespace JSC;
 
 namespace WebCore {
 
-ScriptArray::ScriptArray(JSArray* object)
-    : ScriptObject(object)
+ScriptArray::ScriptArray(ScriptState* scriptState, JSArray* object)
+    : ScriptObject(scriptState, object)
 {
 }
 
@@ -51,57 +51,58 @@ static bool handleException(ScriptState* scriptState)
     return false;
 }
 
-bool ScriptArray::set(ScriptState* scriptState, unsigned index, const ScriptObject& value)
+bool ScriptArray::set(unsigned index, const ScriptObject& value)
 {
     JSLock lock(SilenceAssertionsOnly);
-    jsArray()->put(scriptState, index, value.jsObject());
-    return handleException(scriptState);
+    jsArray()->put(m_scriptState, index, value.jsObject());
+    return handleException(m_scriptState);
 }
 
-bool ScriptArray::set(ScriptState* scriptState, unsigned index, const String& value)
+bool ScriptArray::set(unsigned index, const String& value)
 {
     JSLock lock(SilenceAssertionsOnly);
-    jsArray()->put(scriptState, index, jsString(scriptState, value));
-    return handleException(scriptState);
+    jsArray()->put(m_scriptState, index, jsString(m_scriptState, value));
+    return handleException(m_scriptState);
 }
 
-bool ScriptArray::set(ScriptState* scriptState, unsigned index, double value)
+bool ScriptArray::set(unsigned index, double value)
 {
     JSLock lock(SilenceAssertionsOnly);
-    jsArray()->put(scriptState, index, jsNumber(scriptState, value));
-    return handleException(scriptState);
+    jsArray()->put(m_scriptState, index, jsNumber(m_scriptState, value));
+    return handleException(m_scriptState);
 }
 
-bool ScriptArray::set(ScriptState* scriptState, unsigned index, long long value)
+bool ScriptArray::set(unsigned index, long long value)
 {
     JSLock lock(SilenceAssertionsOnly);
-    jsArray()->put(scriptState, index, jsNumber(scriptState, value));
-    return handleException(scriptState);
+    jsArray()->put(m_scriptState, index, jsNumber(m_scriptState, value));
+    return handleException(m_scriptState);
 }
 
-bool ScriptArray::set(ScriptState* scriptState, unsigned index, int value)
+bool ScriptArray::set(unsigned index, int value)
 {
     JSLock lock(SilenceAssertionsOnly);
-    jsArray()->put(scriptState, index, jsNumber(scriptState, value));
-    return handleException(scriptState);
+    jsArray()->put(m_scriptState, index, jsNumber(m_scriptState, value));
+    return handleException(m_scriptState);
 }
 
-bool ScriptArray::set(ScriptState* scriptState, unsigned index, bool value)
+bool ScriptArray::set(unsigned index, bool value)
 {
     JSLock lock(SilenceAssertionsOnly);
-    jsArray()->put(scriptState, index, jsBoolean(value));
-    return handleException(scriptState);
+    jsArray()->put(m_scriptState, index, jsBoolean(value));
+    return handleException(m_scriptState);
 }
 
-unsigned ScriptArray::length(ScriptState*)
+unsigned ScriptArray::length()
 {
+    JSLock lock(SilenceAssertionsOnly);
     return jsArray()->length();
 }
 
 ScriptArray ScriptArray::createNew(ScriptState* scriptState)
 {
     JSLock lock(SilenceAssertionsOnly);
-    return ScriptArray(constructEmptyArray(scriptState));
+    return ScriptArray(scriptState, constructEmptyArray(scriptState));
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptArray.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptArray.h
index 2ba307f..9240368 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptArray.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptArray.h
@@ -40,17 +40,17 @@ namespace WebCore {
 
     class ScriptArray : public ScriptObject {
     public:
-        ScriptArray(JSC::JSArray*);
+        ScriptArray(ScriptState*, JSC::JSArray*);
         ScriptArray() {}
         JSC::JSArray* jsArray() const { return asArray(jsValue()); }
 
-        bool set(ScriptState*, unsigned index, const ScriptObject&);
-        bool set(ScriptState*, unsigned index, const String&);
-        bool set(ScriptState*, unsigned index, double);
-        bool set(ScriptState*, unsigned index, long long);
-        bool set(ScriptState*, unsigned index, int);
-        bool set(ScriptState*, unsigned index, bool);
-        unsigned length(ScriptState*);
+        bool set(unsigned index, const ScriptObject&);
+        bool set(unsigned index, const String&);
+        bool set(unsigned index, double);
+        bool set(unsigned index, long long);
+        bool set(unsigned index, int);
+        bool set(unsigned index, bool);
+        unsigned length();
 
         static ScriptArray createNew(ScriptState*);
     };
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.cpp
index 58168d0..09752d1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.cpp
@@ -40,7 +40,7 @@ namespace WebCore {
 
 ScriptCallFrame::ScriptCallFrame(const UString& functionName, const UString& urlString, int lineNumber, const ArgList& args, unsigned skipArgumentCount)
     : m_functionName(functionName)
-    , m_sourceURL(urlString)
+    , m_sourceURL(ParsedURLString, urlString)
     , m_lineNumber(lineNumber)
 {
     size_t argumentCount = args.size();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
index 2abe5b0..4b33069 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
@@ -33,6 +33,7 @@
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "Settings.h"
+#include "StorageNamespace.h"
 #include "XSSAuditor.h"
 #include "npruntime_impl.h"
 #include "runtime_root.h"
@@ -110,9 +111,9 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
 
     RefPtr<Frame> protect = m_frame;
 
-    m_windowShell->window()->globalData()->timeoutChecker->start();
+    m_windowShell->window()->globalData()->timeoutChecker.start();
     Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), jsSourceCode, m_windowShell);
-    m_windowShell->window()->globalData()->timeoutChecker->stop();
+    m_windowShell->window()->globalData()->timeoutChecker.stop();
 
     // Evaluating the JavaScript could cause the frame to be deallocated
     // so we start the keep alive timer here.
@@ -130,6 +131,14 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
     return JSValue();
 }
 
+void ScriptController::evaluateInIsolatedWorld(unsigned /* worldID */, const Vector<ScriptSourceCode>& sourceCode) 
+{
+    // FIXME: Actually support isolated worlds!
+    unsigned size = sourceCode.size();
+    for (unsigned i = 0; i < size; ++i)
+        evaluate(sourceCode[i]);
+}
+
 void ScriptController::clearWindowShell()
 {
     if (!m_windowShell)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
index 4528495..56e8f0c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
@@ -81,6 +81,7 @@ public:
     }
 
     ScriptValue evaluate(const ScriptSourceCode&);
+    void evaluateInIsolatedWorld(unsigned worldID, const Vector<ScriptSourceCode>&);
 
     void setEventHandlerLineNumber(int lineno) { m_handlerLineNumber = lineno; }
     int eventHandlerLineNumber() { return m_handlerLineNumber; }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerHaiku.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerHaiku.cpp
index b573b97..3fe471d 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerHaiku.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerHaiku.cpp
@@ -28,8 +28,8 @@
 #include "ScriptController.h"
 
 #include "PluginView.h"
-#include "runtime_root.h"
 #include "runtime.h"
+#include "runtime_root.h"
 
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp
index ca6b03a..46e80ac 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp
@@ -170,7 +170,7 @@ ScriptObject ScriptFunctionCall::construct(bool& hadException, bool reportExcept
         return ScriptObject();
     }
 
-    return ScriptObject(asObject(result));
+    return ScriptObject(m_exec, asObject(result));
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp
index e664645..b527a96 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp
@@ -40,8 +40,9 @@ using namespace JSC;
 
 namespace WebCore {
 
-ScriptObject::ScriptObject(JSObject* object)
+ScriptObject::ScriptObject(ScriptState* scriptState, JSObject* object)
     : ScriptValue(object)
+    , m_scriptState(scriptState)
 {
 }
 
@@ -54,66 +55,66 @@ static bool handleException(ScriptState* scriptState)
     return false;
 }
 
-bool ScriptObject::set(ScriptState* scriptState, const String& name, const String& value)
+bool ScriptObject::set(const String& name, const String& value)
 {
     JSLock lock(SilenceAssertionsOnly);
     PutPropertySlot slot;
-    jsObject()->put(scriptState, Identifier(scriptState, name), jsString(scriptState, value), slot);
-    return handleException(scriptState);
+    jsObject()->put(m_scriptState, Identifier(m_scriptState, name), jsString(m_scriptState, value), slot);
+    return handleException(m_scriptState);
 }
 
-bool ScriptObject::set(ScriptState* scriptState, const char* name, const ScriptObject& value)
+bool ScriptObject::set(const char* name, const ScriptObject& value)
 {
     JSLock lock(SilenceAssertionsOnly);
     PutPropertySlot slot;
-    jsObject()->put(scriptState, Identifier(scriptState, name), value.jsObject(), slot);
-    return handleException(scriptState);
+    jsObject()->put(m_scriptState, Identifier(m_scriptState, name), value.jsObject(), slot);
+    return handleException(m_scriptState);
 }
 
-bool ScriptObject::set(ScriptState* scriptState, const char* name, const String& value)
+bool ScriptObject::set(const char* name, const String& value)
 {
     JSLock lock(SilenceAssertionsOnly);
     PutPropertySlot slot;
-    jsObject()->put(scriptState, Identifier(scriptState, name), jsString(scriptState, value), slot);
-    return handleException(scriptState);
+    jsObject()->put(m_scriptState, Identifier(m_scriptState, name), jsString(m_scriptState, value), slot);
+    return handleException(m_scriptState);
 }
 
-bool ScriptObject::set(ScriptState* scriptState, const char* name, double value)
+bool ScriptObject::set(const char* name, double value)
 {
     JSLock lock(SilenceAssertionsOnly);
     PutPropertySlot slot;
-    jsObject()->put(scriptState, Identifier(scriptState, name), jsNumber(scriptState, value), slot);
-    return handleException(scriptState);
+    jsObject()->put(m_scriptState, Identifier(m_scriptState, name), jsNumber(m_scriptState, value), slot);
+    return handleException(m_scriptState);
 }
 
-bool ScriptObject::set(ScriptState* scriptState, const char* name, long long value)
+bool ScriptObject::set(const char* name, long long value)
 {
     JSLock lock(SilenceAssertionsOnly);
     PutPropertySlot slot;
-    jsObject()->put(scriptState, Identifier(scriptState, name), jsNumber(scriptState, value), slot);
-    return handleException(scriptState);
+    jsObject()->put(m_scriptState, Identifier(m_scriptState, name), jsNumber(m_scriptState, value), slot);
+    return handleException(m_scriptState);
 }
 
-bool ScriptObject::set(ScriptState* scriptState, const char* name, int value)
+bool ScriptObject::set(const char* name, int value)
 {
     JSLock lock(SilenceAssertionsOnly);
     PutPropertySlot slot;
-    jsObject()->put(scriptState, Identifier(scriptState, name), jsNumber(scriptState, value), slot);
-    return handleException(scriptState);
+    jsObject()->put(m_scriptState, Identifier(m_scriptState, name), jsNumber(m_scriptState, value), slot);
+    return handleException(m_scriptState);
 }
 
-bool ScriptObject::set(ScriptState* scriptState, const char* name, bool value)
+bool ScriptObject::set(const char* name, bool value)
 {
     JSLock lock(SilenceAssertionsOnly);
     PutPropertySlot slot;
-    jsObject()->put(scriptState, Identifier(scriptState, name), jsBoolean(value), slot);
-    return handleException(scriptState);
+    jsObject()->put(m_scriptState, Identifier(m_scriptState, name), jsBoolean(value), slot);
+    return handleException(m_scriptState);
 }
 
 ScriptObject ScriptObject::createNew(ScriptState* scriptState)
 {
     JSLock lock(SilenceAssertionsOnly);
-    return ScriptObject(constructEmptyObject(scriptState));
+    return ScriptObject(scriptState, constructEmptyObject(scriptState));
 }
 
 bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, const ScriptObject& value)
@@ -123,6 +124,7 @@ bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, const S
     return handleException(scriptState);
 }
 
+#if ENABLE(INSPECTOR)
 bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InspectorBackend* value)
 {
     JSLock lock(SilenceAssertionsOnly);
@@ -130,6 +132,7 @@ bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, Inspect
     globalObject->putDirect(Identifier(scriptState, name), toJS(scriptState, globalObject, value));
     return handleException(scriptState);
 }
+#endif // ENABLE(INSPECTOR)
 
 bool ScriptGlobalObject::get(ScriptState* scriptState, const char* name, ScriptObject& value)
 {
@@ -141,7 +144,7 @@ bool ScriptGlobalObject::get(ScriptState* scriptState, const char* name, ScriptO
     if (!jsValue.isObject())
         return false;
 
-    value = ScriptObject(asObject(jsValue));
+    value = ScriptObject(scriptState, asObject(jsValue));
     return true;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h
index 97022da..a8b11e0 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h
@@ -42,25 +42,30 @@ namespace WebCore {
 
     class ScriptObject : public ScriptValue {
     public:
-        ScriptObject(JSC::JSObject*);
+        ScriptObject(ScriptState*, JSC::JSObject*);
         ScriptObject() {}
         JSC::JSObject* jsObject() const { return asObject(jsValue()); }
 
-        bool set(ScriptState*, const String& name, const String&);
-        bool set(ScriptState*, const char* name, const ScriptObject&);
-        bool set(ScriptState*, const char* name, const String&);
-        bool set(ScriptState*, const char* name, double);
-        bool set(ScriptState*, const char* name, long long);
-        bool set(ScriptState*, const char* name, int);
-        bool set(ScriptState*, const char* name, bool);
+        bool set(const String& name, const String&);
+        bool set(const char* name, const ScriptObject&);
+        bool set(const char* name, const String&);
+        bool set(const char* name, double);
+        bool set(const char* name, long long);
+        bool set(const char* name, int);
+        bool set(const char* name, bool);
 
         static ScriptObject createNew(ScriptState*);
+    
+    protected:
+        ScriptState* m_scriptState;
     };
 
     class ScriptGlobalObject {
     public:
         static bool set(ScriptState*, const char* name, const ScriptObject&);
+#if ENABLE(INSPECTOR)
         static bool set(ScriptState*, const char* name, InspectorBackend*);
+#endif
         static bool get(ScriptState*, const char* name, ScriptObject&);
         static bool remove(ScriptState*, const char* name);
     private:
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp
index 171883a..b48556e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp
@@ -31,6 +31,8 @@
 #include "config.h"
 #include "ScriptObjectQuarantine.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "Document.h"
 #include "Frame.h"
 #include "JSDOMBinding.h"
@@ -38,6 +40,7 @@
 #include "JSNode.h"
 #include "ScriptObject.h"
 #include "ScriptValue.h"
+#include "Storage.h"
 
 #include <runtime/JSLock.h>
 
@@ -73,23 +76,24 @@ bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObj
     ExecState* exec = globalObject->globalExec();
 
     JSLock lock(SilenceAssertionsOnly);
-    quarantinedObject = ScriptObject(asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, globalObject, database))));
+    quarantinedObject = ScriptObject(exec, asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, globalObject, database))));
 
     return true;
 }
 #endif
 
 #if ENABLE(DOM_STORAGE)
-bool getQuarantinedScriptObject(Frame* frame, Storage* storage, ScriptObject& quarantinedObject)
+bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObject)
 {
-    ASSERT(frame);
     ASSERT(storage);
+    Frame* frame = storage->frame();
+    ASSERT(frame);
 
     JSDOMGlobalObject* globalObject = toJSDOMWindow(frame);
     ExecState* exec = globalObject->globalExec();
 
     JSLock lock(SilenceAssertionsOnly);
-    quarantinedObject = ScriptObject(asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, globalObject, storage))));
+    quarantinedObject = ScriptObject(exec, asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, globalObject, storage))));
 
     return true;
 }
@@ -103,7 +107,7 @@ bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject)
 
     JSLock lock(SilenceAssertionsOnly);
     // FIXME: Should use some sort of globalObjectFromNode()
-    quarantinedObject = ScriptObject(asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, deprecatedGlobalObjectForPrototype(exec), node))));
+    quarantinedObject = ScriptObject(exec, asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, deprecatedGlobalObjectForPrototype(exec), node))));
 
     return true;
 }
@@ -116,10 +120,12 @@ bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedO
     ExecState* exec = window->globalExec();
 
     JSLock lock(SilenceAssertionsOnly);
-    quarantinedObject = ScriptObject(asObject(JSInspectedObjectWrapper::wrap(exec, window)));
+    quarantinedObject = ScriptObject(exec, asObject(JSInspectedObjectWrapper::wrap(exec, window)));
 
     return true;
 }
 
 
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.h
index d70acd7..df52379 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.h
@@ -37,7 +37,6 @@ namespace WebCore {
 
     class Database;
     class DOMWindow;
-    class Frame;
     class Node;
     class ScriptObject;
     class ScriptValue;
@@ -49,7 +48,7 @@ namespace WebCore {
     bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject);
 #endif
 #if ENABLE(DOM_STORAGE)
-    bool getQuarantinedScriptObject(Frame* frame, Storage* storage, ScriptObject& quarantinedObject);
+    bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObject);
 #endif
     bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject);
     bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp
index d427cee..6eac102 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp
@@ -74,4 +74,11 @@ bool ScriptValue::isUndefined() const
     return m_value.get().isUndefined();
 }
 
+bool ScriptValue::isObject() const
+{
+    if (!m_value)
+        return false;
+    return m_value.get().isObject();
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h
index 209ce06..19bb693 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h
@@ -50,6 +50,7 @@ public:
     bool isEqual(ScriptState*, const ScriptValue&) const;
     bool isNull() const;
     bool isUndefined() const;
+    bool isObject() const;
     bool hasNoValue() const { return m_value == JSC::JSValue(); }
 
 private:
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
index 1b8eed6..3590dad 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
@@ -32,8 +32,10 @@
 
 #include "JSDOMBinding.h"
 #include "JSDedicatedWorkerContext.h"
+#include "JSSharedWorkerContext.h"
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
+#include "WorkerContext.h"
 #include "WorkerObjectProxy.h"
 #include "WorkerThread.h"
 #include <interpreter/Interpreter.h>
@@ -73,12 +75,22 @@ void WorkerScriptController::initScript()
     RefPtr<Structure> workerContextPrototypeStructure = JSWorkerContextPrototype::createStructure(jsNull());
     ProtectedPtr<JSWorkerContextPrototype> workerContextPrototype = new (m_globalData.get()) JSWorkerContextPrototype(workerContextPrototypeStructure.release());
 
-    // FIXME: When we add SharedWorkerContext, generate the correct wrapper here.
-    RefPtr<Structure> dedicatedContextPrototypeStructure = JSDedicatedWorkerContextPrototype::createStructure(workerContextPrototype);
-    ProtectedPtr<JSDedicatedWorkerContextPrototype> dedicatedContextPrototype = new (m_globalData.get()) JSDedicatedWorkerContextPrototype(dedicatedContextPrototypeStructure.release());
-    RefPtr<Structure> structure = JSDedicatedWorkerContext::createStructure(dedicatedContextPrototype);
-
-    m_workerContextWrapper = new (m_globalData.get()) JSDedicatedWorkerContext(structure.release(), static_cast<DedicatedWorkerContext*>(m_workerContext));
+    if (m_workerContext->isDedicatedWorkerContext()) {
+        RefPtr<Structure> dedicatedContextPrototypeStructure = JSDedicatedWorkerContextPrototype::createStructure(workerContextPrototype);
+        ProtectedPtr<JSDedicatedWorkerContextPrototype> dedicatedContextPrototype = new (m_globalData.get()) JSDedicatedWorkerContextPrototype(dedicatedContextPrototypeStructure.release());
+        RefPtr<Structure> structure = JSDedicatedWorkerContext::createStructure(dedicatedContextPrototype);
+
+        m_workerContextWrapper = new (m_globalData.get()) JSDedicatedWorkerContext(structure.release(), m_workerContext->toDedicatedWorkerContext());
+#if ENABLE(SHARED_WORKERS)
+    } else {
+        ASSERT(m_workerContext->isSharedWorkerContext());
+        RefPtr<Structure> sharedContextPrototypeStructure = JSSharedWorkerContextPrototype::createStructure(workerContextPrototype);
+        ProtectedPtr<JSSharedWorkerContextPrototype> sharedContextPrototype = new (m_globalData.get()) JSSharedWorkerContextPrototype(sharedContextPrototypeStructure.release());
+        RefPtr<Structure> structure = JSSharedWorkerContext::createStructure(sharedContextPrototype);
+
+        m_workerContextWrapper = new (m_globalData.get()) JSSharedWorkerContext(structure.release(), m_workerContext->toSharedWorkerContext());
+#endif
+    }
 }
 
 ScriptValue WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode)
@@ -109,11 +121,9 @@ ScriptValue WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode,
     JSLock lock(SilenceAssertionsOnly);
 
     ExecState* exec = m_workerContextWrapper->globalExec();
-    m_workerContextWrapper->globalData()->timeoutChecker->start();
+    m_workerContextWrapper->globalData()->timeoutChecker.start();
     Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), sourceCode.jsSourceCode(), m_workerContextWrapper);
-    m_workerContextWrapper->globalData()->timeoutChecker->stop();
-
-    m_workerContext->thread()->workerObjectProxy().reportPendingActivity(m_workerContext->hasPendingActivity());
+    m_workerContextWrapper->globalData()->timeoutChecker.stop();
 
     if (comp.complType() == Normal || comp.complType() == ReturnValue)
         return comp.value();
@@ -136,7 +146,7 @@ void WorkerScriptController::forbidExecution()
     // It is not critical for Interpreter::m_timeoutTime to be synchronized, we just rely on it reaching the worker thread's processor sooner or later.
     MutexLocker lock(m_sharedDataMutex);
     m_executionForbidden = true;
-    m_globalData->timeoutChecker->setTimeoutInterval(1); // 1ms is the smallest timeout that can be set.
+    m_globalData->timeoutChecker.setTimeoutInterval(1); // 1ms is the smallest timeout that can be set.
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGenerator.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGenerator.pm
index 341c607..92bd390 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGenerator.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGenerator.pm
@@ -4,6 +4,7 @@
 # Copyright (C) 2005 Nikolas Zimmermann <wildfox@kde.org>
 # Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
 # Copyright (C) 2007 Apple Inc. All rights reserved.
+# Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 # 
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Library General Public
@@ -23,12 +24,16 @@
 
 package CodeGenerator;
 
+use File::Find;
+
 my $useDocument = "";
 my $useGenerator = "";
 my $useOutputDir = "";
 my $useDirectories = "";
 my $useLayerOnTop = 0;
 my $preprocessor;
+my $writeDependencies = 0;
+my $defines = "";
 
 my $codeGenerator = 0;
 
@@ -54,12 +59,8 @@ my %svgAnimatedTypeHash = ("SVGAnimatedAngle" => 1, "SVGAnimatedBoolean" => 1,
                            "SVGAnimatedRect" => 1, "SVGAnimatedString" => 1,
                            "SVGAnimatedTransformList" => 1);
 
-# Helpers for 'ScanDirectory'
-my $endCondition = 0;
-my $foundFilename = "";
-my @foundFilenames = ();
-my $ignoreParent = 1;
-my $defines = "";
+# Cache of IDL file pathnames.
+my $idlFiles;
 
 # Default constructor
 sub new
@@ -72,6 +73,7 @@ sub new
     $useOutputDir = shift;
     $useLayerOnTop = shift;
     $preprocessor = shift;
+    $writeDependencies = shift;
 
     bless($reference, $object);
     return $reference;
@@ -95,7 +97,7 @@ sub ProcessDocument
 
     # Dynamically load external code generation perl module
     require $ifaceName . ".pm";
-    $codeGenerator = $ifaceName->new($object, $useOutputDir, $useLayerOnTop, $preprocessor);
+    $codeGenerator = $ifaceName->new($object, $useOutputDir, $useLayerOnTop, $preprocessor, $writeDependencies);
     unless (defined($codeGenerator)) {
         my $classes = $useDocument->classes;
         foreach my $class (@$classes) {
@@ -116,100 +118,83 @@ sub ProcessDocument
     $codeGenerator->finish();
 }
 
-# Necessary for V8 bindings to determine whether an interface is descendant from Node.
-# Node descendants are treated differently by DOMMap and this allows inferring the
-# type statically. See more at the original change: http://codereview.chromium.org/3195.
-# FIXME: Figure out a way to eliminate this JS bindings dichotomy.
-sub FindParentsRecursively
+sub ForAllParents
 {
     my $object = shift;
     my $dataNode = shift;
-    my @parents = ($dataNode->name);
-    foreach (@{$dataNode->parents}) {
-        my $interface = $object->StripModule($_);
-
-        $endCondition = 0;
-        $foundFilename = "";
-        foreach (@{$useDirectories}) {
-            $object->ScanDirectory("$interface.idl", $_, $_, 0) if ($foundFilename eq "");
-        }
+    my $beforeRecursion = shift;
+    my $afterRecursion = shift;
+    my $parentsOnly = shift;
 
-        if ($foundFilename ne "") {
-            print "  |  |>  Parsing parent IDL \"$foundFilename\" for interface \"$interface\"\n" if $verbose;
+    my $recurse;
+    $recurse = sub {
+        my $interface = shift;
 
-           # Step #2: Parse the found IDL file (in quiet mode).
-            my $parser = IDLParser->new(1);
-            my $document = $parser->Parse($foundFilename, $defines, $preprocessor, 1);
+        for (@{$interface->parents}) {
+            my $interfaceName = $object->StripModule($_);
+            my $parentInterface = $object->ParseInterface($interfaceName, $parentsOnly);
 
-            foreach my $class (@{$document->classes}) {
-                @parents = (@parents, FindParentsRecursively($object, $class));
+            if ($beforeRecursion) {
+                &$beforeRecursion($parentInterface) eq 'prune' and next;
             }
-        } else {
-            die("Could NOT find specified parent interface \"$interface\"!\n")
+            &$recurse($parentInterface);
+            &$afterRecursion($parentInterface) if $afterRecursion;
         }
-    }
-    return @parents;
+    };
+
+    &$recurse($dataNode);
 }
 
 sub AddMethodsConstantsAndAttributesFromParentClasses
 {
-    # For the passed interface, recursively parse all parent
-    # IDLs in order to find out all inherited properties/methods.
+    # Add to $dataNode all of its inherited interface members, except for those
+    # inherited through $dataNode's first listed parent.  If an array reference
+    # is passed in as $parents, the names of all ancestor interfaces visited
+    # will be appended to the array.  If $collectDirectParents is true, then
+    # even the names of $dataNode's first listed parent and its ancestors will
+    # be appended to $parents.
 
     my $object = shift;
     my $dataNode = shift;
+    my $parents = shift;
+    my $collectDirectParents = shift;
 
-    my @parents = @{$dataNode->parents};
-    my $parentsMax = @{$dataNode->parents};
+    my $first = 1;
 
-    my $constantsRef = $dataNode->constants;
-    my $functionsRef = $dataNode->functions;
-    my $attributesRef = $dataNode->attributes;
+    $object->ForAllParents($dataNode, sub {
+        my $interface = shift;
 
-    foreach (@{$dataNode->parents}) {
-        if ($ignoreParent) {
+        if ($first) {
             # Ignore first parent class, already handled by the generation itself.
-            $ignoreParent = 0;
-            next;
-        }
-
-        my $interface = $object->StripModule($_);
-
-        # Step #1: Find the IDL file associated with 'interface'
-        $endCondition = 0;
-        $foundFilename = "";
+            $first = 0;
+
+            if ($collectDirectParents) {
+                # Just collect the names of the direct ancestor interfaces,
+                # if necessary.
+                push(@$parents, $interface->name);
+                $object->ForAllParents($interface, sub {
+                    my $interface = shift;
+                    push(@$parents, $interface->name);
+                }, undef, 1);
+            }
 
-        foreach (@{$useDirectories}) {
-            $object->ScanDirectory("$interface.idl", $_, $_, 0) if ($foundFilename eq "");
+            # Prune the recursion here.
+            return 'prune';
         }
 
-        if ($foundFilename ne "") {
-            print "  |  |>  Parsing parent IDL \"$foundFilename\" for interface \"$interface\"\n" if $verbose;
-
-            # Step #2: Parse the found IDL file (in quiet mode).
-            my $parser = IDLParser->new(1);
-            my $document = $parser->Parse($foundFilename, $defines, $preprocessor);
+        # Collect the name of this additional parent.
+        push(@$parents, $interface->name) if $parents;
 
-            foreach my $class (@{$document->classes}) {
-                # Step #3: Enter recursive parent search
-                AddMethodsConstantsAndAttributesFromParentClasses($object, $class);
+        print "  |  |>  -> Inheriting "
+            . @{$interface->constants} . " constants, "
+            . @{$interface->functions} . " functions, "
+            . @{$interface->attributes} . " attributes...\n  |  |>\n" if $verbose;
 
-                # Step #4: Collect constants & functions & attributes of this parent-class
-                my $constantsMax = @{$class->constants};
-                my $functionsMax = @{$class->functions};
-                my $attributesMax = @{$class->attributes};
-
-                print "  |  |>  -> Inheriting $constantsMax constants, $functionsMax functions, $attributesMax attributes...\n  |  |>\n" if $verbose;
-
-                # Step #5: Concatenate data
-                push(@$constantsRef, $_) foreach (@{$class->constants});
-                push(@$functionsRef, $_) foreach (@{$class->functions});
-                push(@$attributesRef, $_) foreach (@{$class->attributes});
-            }
-        } else {
-            die("Could NOT find specified parent interface \"$interface\"!\n");
-        }
-    }
+        # Add this parent's members to $dataNode.
+        push(@{$dataNode->constants}, @{$interface->constants});
+        push(@{$dataNode->functions}, @{$interface->functions});
+        push(@{$dataNode->attributes}, @{$interface->attributes});
+    });
 }
 
 sub GetMethodsAndAttributesFromParentClasses
@@ -220,76 +205,67 @@ sub GetMethodsAndAttributesFromParentClasses
     my $object = shift;
     my $dataNode = shift;
 
-    my @parents = @{$dataNode->parents};
-
-    return if @{$dataNode->parents} == 0;
-
     my @parentList = ();
 
-    foreach (@{$dataNode->parents}) {
-        my $interface = $object->StripModule($_);
+    $object->ForAllParents($dataNode, undef, sub {
+        my $interface = shift;
 
-        # Step #1: Find the IDL file associated with 'interface'
-        $endCondition = 0;
-        $foundFilename = "";
+        my $hash = {
+            "name" => $interface->name,
+            "functions" => $interface->functions,
+            "attributes" => $interface->attributes
+        };
 
-        foreach (@{$useDirectories}) {
-            $object->ScanDirectory("${interface}.idl", $_, $_, 0) if $foundFilename eq "";
-        }
-
-        die("Could NOT find specified parent interface \"$interface\"!\n") if $foundFilename eq "";
-
-        print "  |  |>  Parsing parent IDL \"$foundFilename\" for interface \"$interface\"\n" if $verbose;
+        unshift(@parentList, $hash);
+    });
 
-        # Step #2: Parse the found IDL file (in quiet mode).
-        my $parser = IDLParser->new(1);
-        my $document = $parser->Parse($foundFilename, $defines);
+    return @parentList;
+}
 
-        foreach my $class (@{$document->classes}) {
-            # Step #3: Enter recursive parent search
-            push(@parentList, GetMethodsAndAttributesFromParentClasses($object, $class));
+sub IDLFileForInterface
+{
+    my $object = shift;
+    my $interfaceName = shift;
 
-            # Step #4: Collect constants & functions & attributes of this parent-class
+    unless ($idlFiles) {
+        my $sourceRoot = $ENV{SOURCE_ROOT};
+        my @directories = map { $_ = "$sourceRoot/$_" if $sourceRoot && -d "$sourceRoot/$_"; $_ } @$useDirectories;
 
-            # print "  |  |>  -> Inheriting $functionsMax functions amd $attributesMax attributes...\n  |  |>\n" if $verbose;
-            my $hash = {
-                "name" => $class->name,
-                "functions" => $class->functions,
-                "attributes" => $class->attributes
-            };
+        $idlFiles = { };
 
-            # Step #5: Concatenate data
-            unshift(@parentList, $hash);
-        }
+        my $wanted = sub {
+            $idlFiles->{$1} = $File::Find::name if /^([A-Z].*)\.idl$/;
+            $File::Find::prune = 1 if /^\../;
+        };
+        find($wanted, @directories);
     }
 
-    return @parentList;
+    return $idlFiles->{$interfaceName};
 }
 
 sub ParseInterface
 {
-    my ($object, $interfaceName) = @_;
+    my $object = shift;
+    my $interfaceName = shift;
+    my $parentsOnly = shift;
 
-    # Step #1: Find the IDL file associated with 'interface'
-    $endCondition = 0;
-    $foundFilename = "";
+    return undef if $interfaceName eq 'Object';
 
-    foreach (@{$useDirectories}) {
-        $object->ScanDirectory("${interfaceName}.idl", $_, $_, 0) if $foundFilename eq "";
-    }
-    die "Could NOT find specified parent interface \"$interfaceName\"!\n" if $foundFilename eq "";
+    # Step #1: Find the IDL file associated with 'interface'
+    my $filename = $object->IDLFileForInterface($interfaceName)
+        or die("Could NOT find IDL file for interface \"$interfaceName\"!\n");
 
-    print "  |  |>  Parsing parent IDL \"$foundFilename\" for interface \"$interfaceName\"\n" if $verbose;
+    print "  |  |>  Parsing parent IDL \"$filename\" for interface \"$interfaceName\"\n" if $verbose;
 
     # Step #2: Parse the found IDL file (in quiet mode).
     my $parser = IDLParser->new(1);
-    my $document = $parser->Parse($foundFilename, $defines);
+    my $document = $parser->Parse($filename, $defines, $preprocessor, $parentsOnly);
 
     foreach my $interface (@{$document->classes}) {
         return $interface if $interface->name eq $interfaceName;
     }
 
-    die "Interface definition not found";
+    die("Could NOT find interface definition for $interface in $filename");
 }
 
 # Helpers for all CodeGenerator***.pm modules
@@ -348,56 +324,6 @@ sub IsSVGAnimatedType
     return 0; 
 }
 
-# Internal Helper
-sub ScanDirectory
-{
-    my $object = shift;
-
-    my $interface = shift;
-    my $directory = shift;
-    my $useDirectory = shift;
-    my $reportAllFiles = shift;
-
-    return if ($endCondition eq 1) and ($reportAllFiles eq 0);
-
-    my $sourceRoot = $ENV{SOURCE_ROOT};
-    my $thisDir = $sourceRoot ? "$sourceRoot/$directory" : $directory;
-
-    if (!opendir(DIR, $thisDir)) {
-        opendir(DIR, $directory) or die "[ERROR] Can't open directory $thisDir or $directory: \"$!\"\n";
-        $thisDir = $directory;
-    }
-
-    my @names = readdir(DIR) or die "[ERROR] Cant't read directory $thisDir \"$!\"\n";
-    closedir(DIR);
-
-    foreach my $name (@names) {
-        # Skip if we already found the right file or
-        # if we encounter 'exotic' stuff (ie. '.', '..', '.svn')
-        next if ($endCondition eq 1) or ($name =~ /^\./);
-
-        # Recurisvely enter directory
-        if (-d "$thisDir/$name") {
-            $object->ScanDirectory($interface, "$directory/$name", $useDirectory, $reportAllFiles);
-            next;
-        }
-
-        # Check wheter we found the desired file
-        my $condition = ($name eq $interface);
-        $condition = 1 if ($interface eq "allidls") and ($name =~ /\.idl$/);
-
-        if ($condition) {
-            $foundFilename = "$thisDir/$name";
-
-            if ($reportAllFiles eq 0) {
-                $endCondition = 1;
-            } else {
-                push(@foundFilenames, $foundFilename);
-            }
-        }
-    }
-}
-
 # Uppercase the first letter while respecting WebKit style guidelines. 
 # E.g., xmlEncoding becomes XMLEncoding, but xmlllang becomes Xmllang.
 sub WK_ucfirst
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
index 5885543..88f67f0 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -4,6 +4,7 @@
 # Copyright (C) 2006, 2007 Samuel Weinig <sam@webkit.org>
 # Copyright (C) 2006 Alexey Proskuryakov <ap@webkit.org>
 # Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+# Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 # 
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Library General Public
@@ -26,6 +27,7 @@ use File::stat;
 
 my $module = "";
 my $outputDir = "";
+my $writeDependencies = 0;
 
 my @headerContentHeader = ();
 my @headerContent = ();
@@ -34,6 +36,7 @@ my %headerIncludes = ();
 my @implContentHeader = ();
 my @implContent = ();
 my %implIncludes = ();
+my @depsContent = ();
 
 # Default .h template
 my $headerTemplate = << "EOF";
@@ -66,6 +69,9 @@ sub new
 
     $codeGenerator = shift;
     $outputDir = shift;
+    shift; # $useLayerOnTop
+    shift; # $preprocessor
+    $writeDependencies = shift;
 
     bless($reference, $object);
     return $reference;
@@ -100,9 +106,16 @@ sub GenerateInterface
     # Open files for writing
     my $headerFileName = "$outputDir/JS$name.h";
     my $implFileName = "$outputDir/JS$name.cpp";
+    my $depsFileName = "$outputDir/JS$name.dep";
+
+    # Remove old dependency file.
+    unlink($depsFileName);
 
     open($IMPL, ">$implFileName") || die "Couldn't open file $implFileName";
     open($HEADER, ">$headerFileName") || die "Couldn't open file $headerFileName";
+    if (@depsContent) {
+        open($DEPS, ">$depsFileName") || die "Couldn't open file $depsFileName";
+    }
 }
 
 # Params: 'idlDocument' struct
@@ -300,11 +313,11 @@ sub GenerateGetOwnPropertySlotBody
         &$manualLookupGetterGeneration();
     }
 
-    if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}) {
+    if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
         push(@getOwnPropertySlotImpl, "    bool ok;\n");
         push(@getOwnPropertySlotImpl, "    unsigned index = propertyName.toUInt32(&ok, false);\n");
         push(@getOwnPropertySlotImpl, "    if (ok && index < static_cast<$implClassName*>(impl())->length()) {\n");
-        if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"}) {
+        if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
             push(@getOwnPropertySlotImpl, "        slot.setValue(getByIndex(exec, index));\n");
         } else {
             push(@getOwnPropertySlotImpl, "        slot.setCustomIndex(this, index, indexGetter);\n");
@@ -348,6 +361,99 @@ sub GenerateGetOwnPropertySlotBody
     return @getOwnPropertySlotImpl;
 }
 
+sub GenerateGetOwnPropertyDescriptorBody
+{
+    my ($dataNode, $interfaceName, $className, $implClassName, $hasAttributes, $inlined) = @_;
+    
+    my $namespaceMaybe = ($inlined ? "JSC::" : "");
+    
+    my @getOwnPropertyDescriptorImpl = ();
+    
+    if ($interfaceName eq "NamedNodeMap" or $interfaceName eq "HTMLCollection") {
+        push(@getOwnPropertyDescriptorImpl, "    ${namespaceMaybe}JSValue proto = prototype();\n");
+        push(@getOwnPropertyDescriptorImpl, "    if (proto.isObject() && static_cast<${namespaceMaybe}JSObject*>(asObject(proto))->hasProperty(exec, propertyName))\n");
+        push(@getOwnPropertyDescriptorImpl, "        return false;\n\n");
+    }
+    
+    my $manualLookupGetterGeneration = sub {
+        my $requiresManualLookup = $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasNameGetter"};
+        if ($requiresManualLookup) {
+            push(@getOwnPropertyDescriptorImpl, "    const ${namespaceMaybe}HashEntry* entry = ${className}Table.entry(exec, propertyName);\n");
+            push(@getOwnPropertyDescriptorImpl, "    if (entry) {\n");
+            push(@getOwnPropertyDescriptorImpl, "        PropertySlot slot;\n");
+            push(@getOwnPropertyDescriptorImpl, "        slot.setCustom(this, entry->propertyGetter());\n");
+            push(@getOwnPropertyDescriptorImpl, "        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());\n");
+            push(@getOwnPropertyDescriptorImpl, "        return true;\n");
+            push(@getOwnPropertyDescriptorImpl, "    }\n");
+        }
+    };
+    
+    if (!$dataNode->extendedAttributes->{"HasOverridingNameGetter"}) {
+        &$manualLookupGetterGeneration();
+    }
+    
+    if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
+        push(@getOwnPropertyDescriptorImpl, "    bool ok;\n");
+        push(@getOwnPropertyDescriptorImpl, "    unsigned index = propertyName.toUInt32(&ok, false);\n");
+        push(@getOwnPropertyDescriptorImpl, "    if (ok && index < static_cast<$implClassName*>(impl())->length()) {\n");
+        if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
+            # Assume that if there's a setter, the index will be writable
+            if ($dataNode->extendedAttributes->{"HasIndexSetter"} || $dataNode->extendedAttributes->{"HasCustomIndexSetter"}) {
+                push(@getOwnPropertyDescriptorImpl, "        descriptor.setDescriptor(getByIndex(exec, index), ${namespaceMaybe}DontDelete);\n");
+            } else {
+                push(@getOwnPropertyDescriptorImpl, "        descriptor.setDescriptor(getByIndex(exec, index), ${namespaceMaybe}DontDelete | ${namespaceMaybe}ReadOnly);\n");
+            }
+        } else {
+            push(@getOwnPropertyDescriptorImpl, "        ${namespaceMaybe}PropertySlot slot;\n");
+            push(@getOwnPropertyDescriptorImpl, "        slot.setCustomIndex(this, index, indexGetter);\n");
+            # Assume that if there's a setter, the index will be writable
+            if ($dataNode->extendedAttributes->{"HasIndexSetter"} || $dataNode->extendedAttributes->{"HasCustomIndexSetter"}) {
+                push(@getOwnPropertyDescriptorImpl, "        descriptor.setDescriptor(slot.getValue(exec, propertyName), ${namespaceMaybe}DontDelete);\n");
+            } else {
+                push(@getOwnPropertyDescriptorImpl, "        descriptor.setDescriptor(slot.getValue(exec, propertyName), ${namespaceMaybe}DontDelete | ${namespaceMaybe}ReadOnly);\n");
+            }
+        }
+        push(@getOwnPropertyDescriptorImpl, "        return true;\n");
+        push(@getOwnPropertyDescriptorImpl, "    }\n");
+    }
+    
+    if ($dataNode->extendedAttributes->{"HasNameGetter"} || $dataNode->extendedAttributes->{"HasOverridingNameGetter"}) {
+        push(@getOwnPropertyDescriptorImpl, "    if (canGetItemsForName(exec, static_cast<$implClassName*>(impl()), propertyName)) {\n");
+        push(@getOwnPropertyDescriptorImpl, "        ${namespaceMaybe}PropertySlot slot;\n");
+        push(@getOwnPropertyDescriptorImpl, "        slot.setCustom(this, nameGetter);\n");
+        push(@getOwnPropertyDescriptorImpl, "        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);\n");
+        push(@getOwnPropertyDescriptorImpl, "        return true;\n");
+        push(@getOwnPropertyDescriptorImpl, "    }\n");
+        if ($inlined) {
+            $headerIncludes{"AtomicString.h"} = 1;
+        } else {
+            $implIncludes{"AtomicString.h"} = 1;
+        }
+    }
+    
+    if ($dataNode->extendedAttributes->{"HasOverridingNameGetter"}) {
+        &$manualLookupGetterGeneration();
+    }
+    
+    if ($dataNode->extendedAttributes->{"DelegatingGetOwnPropertySlot"}) {
+        push(@getOwnPropertyDescriptorImpl, "    if (getOwnPropertyDescriptorDelegate(exec, propertyName, descriptor))\n");
+        push(@getOwnPropertyDescriptorImpl, "        return true;\n");
+    }
+    
+    if ($hasAttributes) {
+        if ($inlined) {
+            die "Cannot inline if NoStaticTables is set." if ($dataNode->extendedAttributes->{"NoStaticTables"});
+            push(@getOwnPropertyDescriptorImpl, "    return ${namespaceMaybe}getStaticValueDescriptor<$className, Base>(exec, s_info.staticPropHashTable, this, propertyName, descriptor);\n");
+        } else {
+            push(@getOwnPropertyDescriptorImpl, "    return ${namespaceMaybe}getStaticValueDescriptor<$className, Base>(exec, " . hashTableAccessor($dataNode->extendedAttributes->{"NoStaticTables"}, $className) . ", this, propertyName, descriptor);\n");
+        }
+    } else {
+        push(@getOwnPropertyDescriptorImpl, "    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);\n");
+    }
+    
+    return @getOwnPropertyDescriptorImpl;
+}
+
 sub GenerateHeader
 {
     my $object = shift;
@@ -356,11 +462,12 @@ sub GenerateHeader
     my $interfaceName = $dataNode->name;
     my $className = "JS$interfaceName";
     my $implClassName = $interfaceName;
+    my @ancestorInterfaceNames = ();
 
     # We only support multiple parents with SVG (for now).
     if (@{$dataNode->parents} > 1) {
         die "A class can't have more than one parent" unless $interfaceName =~ /SVG/;
-        $codeGenerator->AddMethodsConstantsAndAttributesFromParentClasses($dataNode);
+        $codeGenerator->AddMethodsConstantsAndAttributesFromParentClasses($dataNode, \@ancestorInterfaceNames);
     }
 
     my $hasLegacyParent = $dataNode->extendedAttributes->{"LegacyParent"};
@@ -452,6 +559,7 @@ sub GenerateHeader
                  || $dataNode->extendedAttributes->{"GenerateConstructor"} 
                  || $dataNode->extendedAttributes->{"HasIndexGetter"}
                  || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}
+                 || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}
                  || $dataNode->extendedAttributes->{"CustomGetOwnPropertySlot"}
                  || $dataNode->extendedAttributes->{"DelegatingGetOwnPropertySlot"}
                  || $dataNode->extendedAttributes->{"HasNameGetter"}
@@ -460,8 +568,10 @@ sub GenerateHeader
     # Getters
     if ($hasGetter) {
         push(@headerContent, "    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);\n");
-        push(@headerContent, "    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);\n") if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}) && !$dataNode->extendedAttributes->{"HasOverridingNameGetter"};
+        push(@headerContent, "    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);\n");
+        push(@headerContent, "    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);\n") if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) && !$dataNode->extendedAttributes->{"HasOverridingNameGetter"};
         push(@headerContent, "    bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n") if $dataNode->extendedAttributes->{"DelegatingGetOwnPropertySlot"};
+        push(@headerContent, "    bool getOwnPropertyDescriptorDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);\n") if $dataNode->extendedAttributes->{"DelegatingGetOwnPropertySlot"};
     }
 
     # Check if we have any writable properties
@@ -504,7 +614,7 @@ sub GenerateHeader
     }
 
     # Custom mark function
-    push(@headerContent, "    virtual void mark();\n\n") if $dataNode->extendedAttributes->{"CustomMarkFunction"};
+    push(@headerContent, "    virtual void markChildren(JSC::MarkStack&);\n\n") if $dataNode->extendedAttributes->{"CustomMarkFunction"};
 
     # Custom pushEventHandlerScope function
     push(@headerContent, "    virtual void pushEventHandlerScope(JSC::ExecState*, JSC::ScopeChain&) const;\n\n") if $dataNode->extendedAttributes->{"CustomPushEventHandlerScope"};
@@ -513,10 +623,12 @@ sub GenerateHeader
     push(@headerContent, "    virtual JSC::CallType getCallData(JSC::CallData&);\n\n") if $dataNode->extendedAttributes->{"CustomCall"};
 
     # Custom deleteProperty function
-    push(@headerContent, "    virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&, bool checkDontDelete = true);\n") if $dataNode->extendedAttributes->{"CustomDeleteProperty"};
+    push(@headerContent, "    virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);\n") if $dataNode->extendedAttributes->{"CustomDeleteProperty"};
 
-    # Custom getPropertyNames function
-    push(@headerContent, "    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, unsigned listedAttributes = Structure::Prototype);\n") if ($dataNode->extendedAttributes->{"CustomGetPropertyNames"} || $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"});
+    # Custom getPropertyNames function exists on DOMWindow
+    push(@headerContent, "    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);\n") if $interfaceName eq "DOMWindow";
+    # Custom getOwnPropertyNames function
+    push(@headerContent, "    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);\n") if ($dataNode->extendedAttributes->{"CustomGetPropertyNames"} || $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"});    
 
     # Custom getPropertyAttributes function
     push(@headerContent, "    virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier&, unsigned& attributes) const;\n") if $dataNode->extendedAttributes->{"CustomGetPropertyAttributes"};
@@ -599,7 +711,7 @@ sub GenerateHeader
     if ($dataNode->extendedAttributes->{"HasIndexGetter"}) {
         push(@headerContent, "    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
     }
-    if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"}) {
+    if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
         push(@headerContent, "    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);\n");
     }
     
@@ -621,6 +733,10 @@ sub GenerateHeader
         push(@headerContent, "{\n");
         push(@headerContent, GenerateGetOwnPropertySlotBody($dataNode, $interfaceName, $className, $implClassName, $numAttributes > 0, 1));
         push(@headerContent, "}\n\n");
+        push(@headerContent, "ALWAYS_INLINE bool ${className}::getOwnPropertyDescriptor(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertyDescriptor& descriptor)\n");
+        push(@headerContent, "{\n");
+        push(@headerContent, GenerateGetOwnPropertyDescriptorBody($dataNode, $interfaceName, $className, $implClassName, $numAttributes > 0, 1));
+        push(@headerContent, "}\n\n");
     }
 
     if (!$hasParent || $dataNode->extendedAttributes->{"GenerateToJS"} || $dataNode->extendedAttributes->{"CustomToJS"}) {
@@ -662,11 +778,19 @@ sub GenerateHeader
     push(@headerContent, "    static const JSC::ClassInfo s_info;\n");
     if ($numFunctions > 0 || $numConstants > 0 || $dataNode->extendedAttributes->{"DelegatingPrototypeGetOwnPropertySlot"}) {
         push(@headerContent, "    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n");
+        push(@headerContent, "    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);\n");
         push(@headerContent, "    bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n") if $dataNode->extendedAttributes->{"DelegatingPrototypeGetOwnPropertySlot"};
+        push(@headerContent, "    bool getOwnPropertyDescriptorDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);\n") if $dataNode->extendedAttributes->{"DelegatingPrototypeGetOwnPropertySlot"};
 
         push(@headerContent,
             "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
             "    {\n" .
+            "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType" . ($dataNode->extendedAttributes->{"CustomMarkFunction"} ? "" : ", JSC::HasDefaultMark") . "));\n" .
+            "    }\n");
+    } elsif ($dataNode->extendedAttributes->{"CustomMarkFunction"}) {
+        push(@headerContent,
+            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
+            "    {\n" .
             "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));\n" .
             "    }\n");
     }
@@ -718,6 +842,12 @@ sub GenerateHeader
     push(@headerContent, "\n} // namespace WebCore\n\n");
     push(@headerContent, "#endif // ${conditionalString}\n\n") if $conditional;
     push(@headerContent, "#endif\n");
+
+    # - Generate dependencies.
+    if ($writeDependencies && @ancestorInterfaceNames) {
+        push(@depsContent, "$className.h : ", join(" ", map { "$_.idl" } @ancestorInterfaceNames), "\n");
+        push(@depsContent, map { "$_.idl :\n" } @ancestorInterfaceNames); 
+    }
 }
 
 sub GenerateImplementation
@@ -749,7 +879,7 @@ sub GenerateImplementation
     AddIncludesForSVGAnimatedType($interfaceName) if $className =~ /^JSSVGAnimated/;
 
     $implIncludes{"<wtf/GetPtr.h>"} = 1;
-    $implIncludes{"<runtime/PropertyNameArray.h>"} = 1 if $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"};
+    $implIncludes{"<runtime/PropertyNameArray.h>"} = 1 if $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"};
 
     AddIncludesForType($interfaceName);
 
@@ -933,6 +1063,25 @@ sub GenerateImplementation
             push(@implContent, "    return getStaticPropertySlot<${className}Prototype, JSObject>(exec, " . prototypeHashTableAccessor($dataNode->extendedAttributes->{"NoStaticTables"}, $className) . ", this, propertyName, slot);\n");
         }
         push(@implContent, "}\n\n");
+
+        push(@implContent, "bool ${className}Prototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)\n");
+        push(@implContent, "{\n");
+        
+        if ($dataNode->extendedAttributes->{"DelegatingPrototypeGetOwnPropertySlot"}) {
+            push(@implContent, "    if (getOwnPropertyDescriptorDelegate(exec, propertyName, descriptor))\n");
+            push(@implContent, "        return true;\n");
+        }
+        
+        if ($numConstants eq 0 && $numFunctions eq 0) {
+            push(@implContent, "    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);\n");        
+        } elsif ($numConstants eq 0) {
+            push(@implContent, "    return getStaticFunctionDescriptor<JSObject>(exec, " . prototypeHashTableAccessor($dataNode->extendedAttributes->{"NoStaticTables"}, $className) . ", this, propertyName, descriptor);\n");
+        } elsif ($numFunctions eq 0) {
+            push(@implContent, "    return getStaticValueDescriptor<${className}Prototype, JSObject>(exec, " . prototypeHashTableAccessor($dataNode->extendedAttributes->{"NoStaticTables"}, $className) . ", this, propertyName, descriptor);\n");
+        } else {
+            push(@implContent, "    return getStaticPropertyDescriptor<${className}Prototype, JSObject>(exec, " . prototypeHashTableAccessor($dataNode->extendedAttributes->{"NoStaticTables"}, $className) . ", this, propertyName, descriptor);\n");
+        }
+        push(@implContent, "}\n\n");
     }
 
     if ($dataNode->extendedAttributes->{"DelegatingPrototypePutFunction"}) {
@@ -1049,6 +1198,7 @@ sub GenerateImplementation
                  || $dataNode->extendedAttributes->{"GenerateConstructor"} 
                  || $dataNode->extendedAttributes->{"HasIndexGetter"}
                  || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}
+                 || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}
                  || $dataNode->extendedAttributes->{"DelegatingGetOwnPropertySlot"}
                  || $dataNode->extendedAttributes->{"CustomGetOwnPropertySlot"}
                  || $dataNode->extendedAttributes->{"HasNameGetter"}
@@ -1061,14 +1211,18 @@ sub GenerateImplementation
             push(@implContent, "{\n");
             push(@implContent, GenerateGetOwnPropertySlotBody($dataNode, $interfaceName, $className, $implClassName, $numAttributes > 0, 0));
             push(@implContent, "}\n\n");
+            push(@implContent, "bool ${className}::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)\n");
+            push(@implContent, "{\n");
+            push(@implContent, GenerateGetOwnPropertyDescriptorBody($dataNode, $interfaceName, $className, $implClassName, $numAttributes > 0, 0));
+            push(@implContent, "}\n\n");
         }
 
-        if (($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}) 
+        if (($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) 
                 && !$dataNode->extendedAttributes->{"HasOverridingNameGetter"}) {
             push(@implContent, "bool ${className}::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)\n");
             push(@implContent, "{\n");
             push(@implContent, "    if (propertyName < static_cast<$implClassName*>(impl())->length()) {\n");
-            if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"}) {
+            if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
                 push(@implContent, "        slot.setValue(getByIndex(exec, propertyName));\n");
             } else {
                 push(@implContent, "        slot.setCustomIndex(this, propertyName, indexGetter);\n");
@@ -1333,14 +1487,14 @@ sub GenerateImplementation
         }
     }
 
-    if (($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}) && !$dataNode->extendedAttributes->{"CustomGetPropertyNames"}) {
-        push(@implContent, "void ${className}::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)\n");
+    if (($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) && !$dataNode->extendedAttributes->{"CustomGetPropertyNames"}) {
+        push(@implContent, "void ${className}::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)\n");
         push(@implContent, "{\n");
-        if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}) {
+        if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
             push(@implContent, "    for (unsigned i = 0; i < static_cast<${implClassName}*>(impl())->length(); ++i)\n");
             push(@implContent, "        propertyNames.add(Identifier::from(exec, i));\n");
         }
-        push(@implContent, "     Base::getPropertyNames(exec, propertyNames, listedAttributes);\n");
+        push(@implContent, "     Base::getOwnPropertyNames(exec, propertyNames);\n");
         push(@implContent, "}\n\n");
     }
 
@@ -1373,7 +1527,7 @@ sub GenerateImplementation
                 push(@implContent, "    if (!castedThisObj)\n");
                 push(@implContent, "        return throwError(exec, TypeError);\n");
             } else {
-                push(@implContent, "    if (!thisValue.isObject(&${className}::s_info))\n");
+                push(@implContent, "    if (!thisValue.inherits(&${className}::s_info))\n");
                 push(@implContent, "        return throwError(exec, TypeError);\n");
                 push(@implContent, "    $className* castedThisObj = static_cast<$className*>(asObject(thisValue));\n");
             }
@@ -1507,6 +1661,17 @@ sub GenerateImplementation
             $implIncludes{"Node.h"} = 1;
         }
     }
+    
+    if ($dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
+        push(@implContent, "\nJSValue ${className}::getByIndex(ExecState* exec, unsigned index)\n");
+        push(@implContent, "{\n");
+        push(@implContent, "    return jsNumber(exec, static_cast<$implClassName*>(impl())->item(index));\n");
+        push(@implContent, "}\n");
+        if ($interfaceName eq "HTMLCollection") {
+            $implIncludes{"JSNode.h"} = 1;
+            $implIncludes{"Node.h"} = 1;
+        }
+    }
 
     if ((!$hasParent or $dataNode->extendedAttributes->{"GenerateToJS"}) and !$dataNode->extendedAttributes->{"CustomToJS"}) {
         if ($podType) {
@@ -1537,7 +1702,7 @@ sub GenerateImplementation
 
         push(@implContent, "{\n");
 
-        push(@implContent, "    return value.isObject(&${className}::s_info) ? " . ($podType ? "($podType) *" : "") . "static_cast<$className*>(asObject(value))->impl() : ");
+        push(@implContent, "    return value.inherits(&${className}::s_info) ? " . ($podType ? "($podType) *" : "") . "static_cast<$className*>(asObject(value))->impl() : ");
         if ($podType and $podType ne "float") {
             push(@implContent, "$podType();\n}\n");
         } else {
@@ -2021,6 +2186,15 @@ sub WriteData
         @headerContent = ();
         %headerIncludes = ();
     }
+
+    if (defined($DEPS)) {
+        # Write dependency file.
+        print $DEPS @depsContent;
+        close($DEPS);
+        undef($DEPS);
+
+        @depsContent = ();
+    }
 }
 
 sub constructorFor
@@ -2041,6 +2215,7 @@ public:
         putDirect(exec->propertyNames().prototype, ${protoClassName}::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -2074,6 +2249,11 @@ bool ${constructorClassName}::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<${constructorClassName}, DOMObject>(exec, &${constructorClassName}Table, this, propertyName, slot);
 }
 
+bool ${constructorClassName}::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<${constructorClassName}, DOMObject>(exec, &${constructorClassName}Table, this, propertyName, descriptor);
+}
+
 EOF
 
     $implJSCInclude{"JSNumberCell.h"} = 1; # FIXME: What is this for?
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorObjC.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorObjC.pm
index d46d88a..0026ba1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorObjC.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorObjC.pm
@@ -4,6 +4,7 @@
 # Copyright (C) 2006, 2007 Samuel Weinig <sam@webkit.org>
 # Copyright (C) 2006 Alexey Proskuryakov <ap@webkit.org>
 # Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+# Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Library General Public
@@ -28,6 +29,7 @@ use File::stat;
 # Global Variables
 my $module = "";
 my $outputDir = "";
+my $writeDependencies = 0;
 my %publicInterfaces = ();
 my $newPublicClass = 0;
 my $interfaceAvailabilityVersion = "";
@@ -49,6 +51,7 @@ my @internalHeaderContent = ();
 my @implContentHeader = ();
 my @implContent = ();
 my %implIncludes = ();
+my @depsContent = ();
 
 # Hashes
 my %protocolTypeHash = ("XPathNSResolver" => 1, "EventListener" => 1, "EventTarget" => 1, "NodeFilter" => 1,
@@ -194,6 +197,9 @@ sub new
 
     $codeGenerator = shift;
     $outputDir = shift;
+    shift; # $useLayerOnTop
+    shift; # $preprocessor
+    $writeDependencies = shift;
 
     bless($reference, $object);
     return $reference;
@@ -976,8 +982,10 @@ sub GenerateImplementation
     my $object = shift;
     my $dataNode = shift;
 
+    my @ancestorInterfaceNames = ();
+
     if (@{$dataNode->parents} > 1) {
-        $codeGenerator->AddMethodsConstantsAndAttributesFromParentClasses($dataNode);
+        $codeGenerator->AddMethodsConstantsAndAttributesFromParentClasses($dataNode, \@ancestorInterfaceNames);
     }
 
     my $interfaceName = $dataNode->name;
@@ -1059,9 +1067,12 @@ sub GenerateImplementation
 
     # Only generate 'dealloc' and 'finalize' methods for direct subclasses of DOMObject.
     if ($parentImplClassName eq "Object") {
+        $implIncludes{"WebCoreObjCExtras.h"} = 1;
         push(@implContent, "- (void)dealloc\n");
         push(@implContent, "{\n");
-        push(@implContent, "    $assertMainThread\n");
+        push(@implContent, "    if (WebCoreObjCScheduleDeallocateOnMainThread([$className class], self))\n");
+        push(@implContent, "        return;\n");
+        push(@implContent, "\n");
         if ($interfaceName eq "NodeIterator") {
             push(@implContent, "    if (_internal) {\n");
             push(@implContent, "        [self detach];\n");
@@ -1540,6 +1551,12 @@ sub GenerateImplementation
 
     # - End the ifdef conditional if necessary
     push(@implContent, "\n#endif // ${conditionalString}\n") if $conditional;
+
+    # - Generate dependencies.
+    if ($writeDependencies && @ancestorInterfaceNames) {
+        push(@depsContent, "$className.h : ", join(" ", map { "$_.idl" } @ancestorInterfaceNames), "\n");
+        push(@depsContent, map { "$_.idl :\n" } @ancestorInterfaceNames); 
+    }
 }
 
 # Internal helper
@@ -1553,12 +1570,14 @@ sub WriteData
     my $privateHeaderFileName = "$outputDir/" . $name . "Private.h";
     my $implFileName = "$outputDir/" . $name . ".mm";
     my $internalHeaderFileName = "$outputDir/" . $name . "Internal.h";
+    my $depsFileName = "$outputDir/" . $name . ".dep";
 
     # Remove old files.
     unlink($headerFileName);
     unlink($privateHeaderFileName);
     unlink($implFileName);
     unlink($internalHeaderFileName);
+    unlink($depsFileName);
 
     # Write public header.
     open(HEADER, ">$headerFileName") or die "Couldn't open file $headerFileName";
@@ -1621,6 +1640,14 @@ sub WriteData
 
        @internalHeaderContent = ();
     }
+
+    # Write dependency file.
+    if (@depsContent) {
+        open(DEPS, ">$depsFileName") or die "Couldn't open file $depsFileName";
+        print DEPS @depsContent;
+        close(DEPS);
+        @depsContent = ();
+    }
 }
 
 1;
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
index 862649f..b3307cd 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -5,6 +5,7 @@
 # Copyright (C) 2006 Alexey Proskuryakov <ap@webkit.org>
 # Copyright (C) 2006 Apple Computer, Inc.
 # Copyright (C) 2007, 2008, 2009 Google Inc.
+# Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 #
 # This file is part of the KDE project
 #
@@ -27,6 +28,7 @@
 package CodeGeneratorV8;
 
 use File::stat;
+use Digest::MD5;
 
 my $module = "";
 my $outputDir = "";
@@ -89,26 +91,6 @@ sub leftShift($$) {
     return (($value << $distance) & 0xFFFFFFFF);
 }
 
-# Uppercase the first letter, while respecting WebKit style guidelines.
-# E.g., xmlEncoding becomes XMLEncoding, but xmlllang becomes Xmllang.
-sub WK_ucfirst
-{
-    my $param = shift;
-    my $ret = ucfirst($param);
-    $ret =~ s/Xml/XML/ if $ret =~ /^Xml[^a-z]/;
-    return $ret;
-}
-
-# Lowercase the first letter while respecting WebKit style guidelines.
-# URL becomes url, but SetURL becomes setURL.
-sub WK_lcfirst
-{
-    my $param = shift;
-    my $ret = lcfirst($param);
-    $ret =~ s/uRL/url/;
-    return $ret;
-}
-
 # Workaround for V8 bindings difference where RGBColor is not a POD type.
 sub IsPodType
 {
@@ -265,7 +247,7 @@ sub GenerateHeader
 
     # Copy contents of parent classes except the first parent or if it is
     # EventTarget.
-    $codeGenerator->AddMethodsConstantsAndAttributesFromParentClasses($dataNode);
+    $codeGenerator->AddMethodsConstantsAndAttributesFromParentClasses($dataNode, \@allParents, 1);
 
     my $hasLegacyParent = $dataNode->extendedAttributes->{"LegacyParent"};
     my $conditionalString = GenerateConditionalString($dataNode);
@@ -344,6 +326,12 @@ sub IsNodeSubType
     return 0;
 }
 
+sub RequiresCustomEventListenerAccessors
+{
+    my $dataNode = shift;
+    return !IsNodeSubType($dataNode) && $dataNode->name ne "SVGElementInstance";
+}
+
 sub HolderToNative
 {
     my $dataNode = shift;
@@ -433,10 +421,11 @@ END
     // context of the DOMWindow and not in the context of the caller.
     return V8DOMWrapper::getConstructor(type, window);
 END
-    } elsif ($classIndex eq "DEDICATEDWORKERCONTEXT" or $classIndex eq "WORKERCONTEXT") {
+    } elsif ($classIndex eq "DEDICATEDWORKERCONTEXT" or $classIndex eq "WORKERCONTEXT" or $classIndex eq "SHAREDWORKERCONTEXT") {
         $implIncludes{"WorkerContextExecutionProxy.h"} = 1;
         push(@implContentDecls, <<END);
-    return WorkerContextExecutionProxy::retrieve()->GetConstructor(type);
+    WorkerContext* workerContext = V8DOMWrapper::convertToNativeObject<WorkerContext>(V8ClassIndex::WORKERCONTEXT, info.Holder());
+    return V8DOMWrapper::getConstructor(type, workerContext);
 END
     } else {
         push(@implContentDecls, "    return v8::Undefined();");
@@ -461,7 +450,7 @@ sub GenerateNormalAttrGetter
     my $attrName = $attribute->signature->name;
     $implIncludes{"V8Proxy.h"} = 1;
 
-    my $attrType = $codeGenerator->StripModule($attribute->signature->type);
+    my $attrType = GetTypeFromSignature($attribute->signature);
     my $attrIsPodType = IsPodType($attrType);
 
     my $nativeType = GetNativeTypeFromSignature($attribute->signature, 0);
@@ -541,10 +530,10 @@ END
         $attrName = $attribute->signature->extendedAttributes->{"v8referenceattr"};
     }
 
-    my $getterFunc = WK_lcfirst($attrName);
+    my $getterFunc = $codeGenerator->WK_lcfirst($attrName);
     $getterFunc .= "Animated" if $codeGenerator->IsSVGAnimatedType($attribute->signature->type);
 
-    my $returnType = $codeGenerator->StripModule($attribute->signature->type);
+    my $returnType = GetTypeFromSignature($attribute->signature);
 
     my $getterString;
     if ($getterStringUsesImp) {
@@ -580,7 +569,7 @@ END
         my $getter = $getterString;
         $getter =~ s/imp->//;
         $getter =~ s/\(\)//;
-        my $setter = "set" . WK_ucfirst($getter);
+        my $setter = "set" . $codeGenerator->WK_ucfirst($getter);
 
         my $implClassIsAnimatedType = $codeGenerator->IsSVGAnimatedType($implClassName);
         if (not $implClassIsAnimatedType and $codeGenerator->IsPodTypeWithWriteableProperties($attrType) and not defined $attribute->signature->extendedAttributes->{"Immutable"}) {
@@ -593,7 +582,10 @@ END
             }
         } else {
             if ($implClassIsAnimatedType) {
-                my $wrapper = "V8SVGDynamicPODTypeWrapperCache<$nativeType, $implClassName>::lookupOrCreateWrapper(imp, &${implClassName}::$getter, &${implClassName}::$setter)";
+                # We can't hash member function pointers, so instead generate
+                # some hashing material based on the names of the methods.
+                my $hashhex = substr(Digest::MD5::md5_hex("${implClassName}::$getter ${implClassName}::$setter)"), 0, 8);
+                my $wrapper = "V8SVGDynamicPODTypeWrapperCache<$nativeType, $implClassName>::lookupOrCreateWrapper(imp, &${implClassName}::$getter, &${implClassName}::$setter, 0x$hashhex)";
                 push(@implContentDecls, "    RefPtr<V8SVGPODTypeWrapper<" . $nativeType . "> > wrapper = $wrapper;\n");
             } else {
                 my $wrapper = GenerateSVGStaticPodTypeWrapper($returnType, $getterString);
@@ -694,7 +686,11 @@ END
     }
 
     my $nativeType = GetNativeTypeFromSignature($attribute->signature, 0);
-    push(@implContentDecls, "    $nativeType v = " . JSValueToNative($attribute->signature, "value") . ";\n");
+    if ($attribute->signature->type eq "EventListener") {
+        push(@implContentDecls, "    $nativeType v = V8DOMWrapper::getEventListener(imp, value, true, false);\n");
+    } else {
+        push(@implContentDecls, "    $nativeType v = " . JSValueToNative($attribute->signature, "value") . ";\n");
+    }
 
     my $result = "";
     if ($nativeType eq "int" and $attribute->signature->extendedAttributes->{"ConvertFromString"}) {
@@ -704,7 +700,7 @@ END
     if ($nativeType eq "int" and $attribute->signature->extendedAttributes->{"ConvertFromString"}) {
         $result .= ")";
     }
-    my $returnType = $codeGenerator->StripModule($attribute->signature->type);
+    my $returnType = GetTypeFromSignature($attribute->signature);
     if (IsRefPtrType($returnType)) {
         $result = "WTF::getPtr(" . $result . ")";
     }
@@ -719,13 +715,24 @@ END
     if ($implClassName eq "double") {
         push(@implContentDecls, "    *imp = $result;\n");
     } else {
-        my $implSetterFunctionName = WK_ucfirst($attrName);
+        my $implSetterFunctionName = $codeGenerator->WK_ucfirst($attrName);
         my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
         my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
         if ($reflect || $reflectURL) {
             $implIncludes{"HTMLNames.h"} = 1;
             my $contentAttributeName = ($reflect || $reflectURL) eq "1" ? $attrName : ($reflect || $reflectURL);
             push(@implContentDecls, "    imp->setAttribute(HTMLNames::${contentAttributeName}Attr, $result");
+        } elsif ($attribute->signature->type eq "EventListener") {
+            $implIncludes{"V8AbstractEventListener.h"} = 1;
+            $implIncludes{"V8CustomBinding.h"} = 1;
+            push(@implContentDecls, "    $nativeType old = imp->$attrName();\n");
+            push(@implContentDecls, "    if (old && static_cast<V8AbstractEventListener*>(old.get())->isObjectListener()) {\n");
+            push(@implContentDecls, "      v8::Local<v8::Object> oldListener = static_cast<V8AbstractEventListener*>(old.get())->getListenerObject();\n");
+            push(@implContentDecls, "      removeHiddenDependency(holder, oldListener, V8Custom::kNodeEventListenerCacheIndex);\n");
+            push(@implContentDecls, "    }\n");
+            push(@implContentDecls, "    imp->set$implSetterFunctionName($result);\n");
+            push(@implContentDecls, "    if ($result)\n");
+            push(@implContentDecls, "      createHiddenDependency(holder, value, V8Custom::kNodeEventListenerCacheIndex");
         } else {
             push(@implContentDecls, "    imp->set$implSetterFunctionName(" . $result);
         }
@@ -774,7 +781,7 @@ sub GenerateNewFunctionTemplate
         my $customFunc = $function->signature->extendedAttributes->{"Custom"} ||
                          $function->signature->extendedAttributes->{"V8Custom"};
         if ($customFunc eq 1) {
-            $customFunc = $interfaceName . WK_ucfirst($name);
+            $customFunc = $interfaceName . $codeGenerator->WK_ucfirst($name);
         }
         return "v8::FunctionTemplate::New(V8Custom::v8${customFunc}Callback, v8::Handle<v8::Value>(), $signature)";
     } else {
@@ -836,6 +843,11 @@ END
         push(@implContentDecls, "    ScriptCallStack callStack(args, $numParameters);\n");
         $implIncludes{"ScriptCallStack.h"} = 1;
     }
+    if ($function->signature->extendedAttributes->{"SVGCheckSecurityDocument"}) {
+        push(@implContentDecls,
+"    if (!V8Proxy::checkNodeSecurity(imp->getSVGDocument(ec)))\n" .
+"      return v8::Undefined();\n");
+    }
 
     my $paramIndex = 0;
     foreach my $parameter (@{$function->parameters}) {
@@ -888,7 +900,8 @@ END
 
 sub GenerateBatchedAttributeData
 {
-    my $interfaceName = shift;
+    my $dataNode = shift;
+    my $interfaceName = $dataNode->name;
     my $attributes = shift;
 
     foreach my $attribute (@$attributes) {
@@ -921,7 +934,7 @@ sub GenerateBatchedAttributeData
             "";
         if ($customAccessor eq 1) {
             # use the naming convension, interface + (capitalize) attr name
-            $customAccessor = $interfaceName . WK_ucfirst($attrName);
+            $customAccessor = $interfaceName . $codeGenerator->WK_ucfirst($attrName);
         }
 
         my $getter;
@@ -951,13 +964,16 @@ sub GenerateBatchedAttributeData
             $propAttr = "v8::ReadOnly";
 
         # EventListeners
-        } elsif ($attribute->signature->type eq "EventListener") {
+        } elsif ($attribute->signature->type eq "EventListener" && RequiresCustomEventListenerAccessors($dataNode)) {
             if ($interfaceName eq "DOMWindow") {
                 $getter = "V8Custom::v8DOMWindowEventHandlerAccessorGetter";
                 $setter = "V8Custom::v8DOMWindowEventHandlerAccessorSetter";
-            } elsif ($interfaceName eq "Element" || $interfaceName eq "Document" || $interfaceName eq "HTMLBodyElement" || $interfaceName eq "SVGElementInstance" || $interfaceName eq "HTMLFrameSetElement") {
-                $getter = "V8Custom::v8ElementEventHandlerAccessorGetter";
-                $setter = "V8Custom::v8ElementEventHandlerAccessorSetter";
+            } elsif ($interfaceName eq "DOMApplicationCache") {
+                $getter = "V8Custom::v8DOMApplicationCacheEventHandlerAccessorGetter";
+                $setter = "V8Custom::v8DOMApplicationCacheEventHandlerAccessorSetter";
+            } elsif ($interfaceName eq "Notification") {
+                $getter = "V8Custom::v8NotificationEventHandlerAccessorGetter";
+                $setter = "V8Custom::v8NotificationEventHandlerAccessorSetter";
             } else {
                 $getter = "V8Custom::v8${customAccessor}AccessorGetter";
                 if ($interfaceName eq "WorkerContext" and $attrName eq "self") {
@@ -967,51 +983,24 @@ sub GenerateBatchedAttributeData
                     $setter = "V8Custom::v8${customAccessor}AccessorSetter";
                 }
             }
+        } else {
+            # Default Getter and Setter
+            $getter = "${interfaceName}Internal::${attrName}AttrGetter";
+            $setter = "${interfaceName}Internal::${attrName}AttrSetter";
 
-        # Custom Getter and Setter
-        } elsif ($attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
-            $getter = "V8Custom::v8${customAccessor}AccessorGetter";
-            if ($interfaceName eq "WorkerContext" and $attrName eq "self") {
-                $setter = "0";
-                $propAttr = "v8::ReadOnly";
-            } else {
+            # Custom Setter
+            if ($attrExt->{"CustomSetter"} || $attrExt->{"V8CustomSetter"} || $attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
                 $hasCustomSetter = 1;
                 $setter = "V8Custom::v8${customAccessor}AccessorSetter";
             }
 
-        # Custom Setter
-        } elsif ($attrExt->{"CustomSetter"} || $attrExt->{"V8CustomSetter"}) {
-            $hasCustomSetter = 1;
-            $getter = "${interfaceName}Internal::${attrName}AttrGetter";
-            $setter = "V8Custom::v8${customAccessor}AccessorSetter";
-
-        # Custom Getter
-        } elsif ($attrExt->{"CustomGetter"}) {
-            $getter = "V8Custom::v8${customAccessor}AccessorGetter";
-            $setter = "${interfaceName}Internal::${attrName}AttrSetter";
-
-        # Replaceable
-        } elsif ($attrExt->{"Replaceable"}) {
-            # Replaceable accessor is put on instance template with ReadOnly attribute.
-            $getter = "${interfaceName}Internal::${attrName}AttrGetter";
-            $setter = "0";
-
-            # Mark to avoid duplicate v8::ReadOnly flags in output.
-            $hasCustomSetter = 1;
-
-            # Handle the special case of window.top being marked upstream as Replaceable.
-            # FIXME: Investigate why [Replaceable] is not marked as ReadOnly
-            # upstream and reach parity.
-            if (!($interfaceName eq "DOMWindow" and $attrName eq "top")) {
-                $propAttr .= "|v8::ReadOnly";
+            # Custom Getter
+            if ($attrExt->{"CustomGetter"} || $attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
+                $getter = "V8Custom::v8${customAccessor}AccessorGetter";
             }
-
-        # Normal
-        } else {
-            $getter = "${interfaceName}Internal::${attrName}AttrGetter";
-            $setter = "${interfaceName}Internal::${attrName}AttrSetter";
         }
 
+        # Replaceable
         if ($attrExt->{"Replaceable"} && !$hasCustomSetter) {
             $setter = "0";
             $propAttr .= "|v8::ReadOnly";
@@ -1060,8 +1049,6 @@ sub GenerateImplementation
     my $hasLegacyParent = $dataNode->extendedAttributes->{"LegacyParent"};
     my $conditionalString = GenerateConditionalString($dataNode);
 
-    @allParents = $codeGenerator->FindParentsRecursively($dataNode);
-
     # - Add default header template
     @implContentHeader = split("\r", $headerTemplate);
 
@@ -1100,13 +1087,13 @@ sub GenerateImplementation
             next;
         }
 
-        # Make EventListeners always custom.
+        # Make EventListeners custom for some types.
         # FIXME: make the perl code capable of generating the
         #   event setters/getters.  For now, WebKit has started removing the
         #   [Custom] attribute, so just automatically insert it to avoid forking
         #   other files.  This should be okay because we can't generate stubs
         #   for any event getter/setters anyway.
-        if ($attrType eq "EventListener") {
+        if ($attrType eq "EventListener" && RequiresCustomEventListenerAccessors($dataNode)) {
             $attribute->signature->extendedAttributes->{"Custom"} = 1;
             $implIncludes{"V8CustomBinding.h"} = 1;
             next;
@@ -1178,7 +1165,7 @@ sub GenerateImplementation
         # Put the attributes that disallow shadowing on the shadow object.
         $attributes = \@normal;
         push(@implContent, "static const BatchedAttribute shadow_attrs[] = {\n");
-        GenerateBatchedAttributeData($interfaceName, \@disallows_shadowing);
+        GenerateBatchedAttributeData($dataNode, \@disallows_shadowing);
         push(@implContent, "};\n");
     }
 
@@ -1186,7 +1173,7 @@ sub GenerateImplementation
     if (@$attributes) {
         $has_attributes = 1;
         push(@implContent, "static const BatchedAttribute ${interfaceName}_attrs[] = {\n");
-        GenerateBatchedAttributeData($interfaceName, $attributes);
+        GenerateBatchedAttributeData($dataNode, $attributes);
         push(@implContent, "};\n");
     }
 
@@ -1235,7 +1222,18 @@ END
     push(@implContent,  <<END);
 static v8::Persistent<v8::FunctionTemplate> Configure${className}Template(v8::Persistent<v8::FunctionTemplate> desc) {
   v8::Local<v8::ObjectTemplate> instance = desc->InstanceTemplate();
-  instance->SetInternalFieldCount(2);
+END
+    if (IsNodeSubType($dataNode)) {
+        push(@implContent, <<END);
+  instance->SetInternalFieldCount(V8Custom::kNodeMinimumInternalFieldCount);
+END
+    } else {
+        push(@implContent, <<END);
+  instance->SetInternalFieldCount(V8Custom::kDefaultWrapperInternalFieldCount);
+END
+    }
+
+    push(@implContent,  <<END);
   v8::Local<v8::Signature> default_signature = v8::Signature::New(desc);
   v8::Local<v8::ObjectTemplate> proto = desc->PrototypeTemplate();
   $access_check
@@ -1400,7 +1398,7 @@ sub GenerateFunctionCallString()
 
     my $name = $function->signature->name;
     my $isPodType = IsPodType($implClassName);
-    my $returnType = $codeGenerator->StripModule($function->signature->type);
+    my $returnType = GetTypeFromSignature($function->signature);
     my $returnsPodType = IsPodType($returnType);
     my $nativeReturnType = GetNativeType($returnType, 0);
     my $result = "";
@@ -1566,12 +1564,25 @@ sub GetClassName
 }
 
 
+sub GetTypeFromSignature
+{
+    my $signature = shift;
+
+    my $type = $codeGenerator->StripModule($signature->type);
+    if (($type eq "DOMString") && $signature->extendedAttributes->{"HintAtomic"}) {
+        $type = "AtomicString";
+    }
+
+    return $type;
+}
+
+
 sub GetNativeTypeFromSignature
 {
     my $signature = shift;
     my $isParameter = shift;
 
-    my $type = $codeGenerator->StripModule($signature->type);
+    my $type = GetTypeFromSignature($signature);
 
     return GetNativeType($type, $isParameter);
 }
@@ -1604,12 +1615,14 @@ sub IsRefPtrType
     return 1 if $type eq "Element";
     return 1 if $type eq "EntityReference";
     return 1 if $type eq "Event";
+    return 1 if $type eq "EventListener";
     return 1 if $type eq "FileList";
     return 1 if $type eq "HTMLCollection";
     return 1 if $type eq "HTMLDocument";
     return 1 if $type eq "HTMLElement";
     return 1 if $type eq "HTMLOptionsCollection";
     return 1 if $type eq "ImageData";
+    return 1 if $type eq "Media";
     return 1 if $type eq "MediaError";
     return 1 if $type eq "MimeType";
     return 1 if $type eq "Node";
@@ -1620,6 +1633,7 @@ sub IsRefPtrType
     return 1 if $type eq "Plugin";
     return 1 if $type eq "ProcessingInstruction";
     return 1 if $type eq "Range";
+    return 1 if $type eq "RGBColor";
     return 1 if $type eq "Text";
     return 1 if $type eq "TextMetrics";
     return 1 if $type eq "TimeRanges";
@@ -1762,7 +1776,7 @@ sub TranslateParameter
 sub BasicTypeCanFailConversion
 {
     my $signature = shift;
-    my $type = $codeGenerator->StripModule($signature->type);
+    my $type = GetTypeFromSignature($signature);
 
     return 1 if $type eq "SVGLength";
     return 1 if $type eq "SVGMatrix";
@@ -1776,7 +1790,7 @@ sub TypeCanFailConversion
 {
     my $signature = shift;
 
-    my $type = $codeGenerator->StripModule($signature->type);
+    my $type = GetTypeFromSignature($signature);
 
     $implIncludes{"ExceptionCode.h"} = 1 if $type eq "Attr";
 
@@ -1792,7 +1806,7 @@ sub JSValueToNative
     my $okParam = shift;
     my $maybeOkParam = $okParam ? ", ${okParam}" : "";
 
-    my $type = $codeGenerator->StripModule($signature->type);
+    my $type = GetTypeFromSignature($signature);
 
     return "$value" if $type eq "JSObject";
     return "$value->BooleanValue()" if $type eq "boolean";
@@ -1803,7 +1817,12 @@ sub JSValueToNative
     return "static_cast<Range::CompareHow>($value->Int32Value())" if $type eq "CompareHow";
     return "static_cast<SVGPaint::SVGPaintType>($value->ToInt32()->Int32Value())" if $type eq "SVGPaintType";
 
-    return "toWebCoreString($value)" if $type eq "AtomicString" or $type eq "DOMUserData";
+    if ($type eq "AtomicString") {
+        return "v8ValueToAtomicWebCoreStringWithNullCheck($value)" if $signature->extendedAttributes->{"ConvertNullToNullString"};
+        return "v8ValueToAtomicWebCoreString($value)";
+    }
+
+    return "toWebCoreString($value)" if $type eq "DOMUserData";
     if ($type eq "DOMString") {
         return "toWebCoreStringWithNullCheck($value)" if $signature->extendedAttributes->{"ConvertNullToNullString"};
         return "toWebCoreStringWithNullOrUndefinedCheck($value)" if $signature->extendedAttributes->{"ConvertUndefinedOrNullToNullString"};
@@ -1981,7 +2000,7 @@ sub ReturnNativeToJSValue
     my $signature = shift;
     my $value = shift;
     my $indent = shift;
-    my $type = $codeGenerator->StripModule($signature->type);
+    my $type = GetTypeFromSignature($signature);
     my $className= "V8$type";
 
     return "return v8::Date::New(static_cast<double>($value))" if $type eq "DOMTimeStamp";
@@ -2028,16 +2047,16 @@ sub ReturnNativeToJSValue
         return "return V8DOMWrapper::convertEventListenerToV8Object($value)";
     }
 
-    if ($type eq "DedicatedWorkerContext" or $type eq "WorkerContext") {
+    if ($type eq "DedicatedWorkerContext" or $type eq "WorkerContext" or $type eq "SharedWorkerContext") {
         $implIncludes{"WorkerContextExecutionProxy.h"} = 1;
-        return "return WorkerContextExecutionProxy::WorkerContextToV8Object($value)";
+        return "return WorkerContextExecutionProxy::convertWorkerContextToV8Object($value)";
     }
 
-    if ($type eq "WorkerLocation" or $type eq "WorkerNavigator") {
+    if ($type eq "WorkerLocation" or $type eq "WorkerNavigator" or $type eq "NotificationCenter") {
         $implIncludes{"WorkerContextExecutionProxy.h"} = 1;
         my $classIndex = uc($type);
 
-        return "return WorkerContextExecutionProxy::ToV8Object(V8ClassIndex::$classIndex, $value)";
+        return "return WorkerContextExecutionProxy::convertToV8Object(V8ClassIndex::$classIndex, $value)";
     }
 
     else {
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/IDLParser.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/IDLParser.pm
index c4cb041..4abdb45 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/IDLParser.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/IDLParser.pm
@@ -309,7 +309,11 @@ sub ParseInterface
                 $methodException =~ s/\s+//g;
                 @{$newDataNode->raisesExceptions} = split(/,/, $methodException);
 
-                my @params = split(/,/, $methodSignature);
+                # Split arguments at commas but only if the comma
+                # is not within attribute brackets, expressed here
+                # as being followed by a ']' without a preceding '['.
+                # Note that this assumes that attributes don't nest.
+                my @params = split(/,(?![^[]*\])/, $methodSignature);
                 foreach(@params) {
                     my $line = $_;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/generate-bindings.pl b/src/3rdparty/webkit/WebCore/bindings/scripts/generate-bindings.pl
index 9c374bf..c7adeb3 100755
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/generate-bindings.pl
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/generate-bindings.pl
@@ -42,12 +42,14 @@ my $outputDirectory;
 my $generator;
 my $defines;
 my $preprocessor;
+my $writeDependencies;
 
 GetOptions('include=s@' => \@idlDirectories,
            'outputDir=s' => \$outputDirectory,
            'generator=s' => \$generator,
            'defines=s' => \$defines,
-           'preprocessor=s' => \$preprocessor);
+           'preprocessor=s' => \$preprocessor,
+           'write-dependencies' => \$writeDependencies);
 
 my $idlFile = $ARGV[0];
 
@@ -65,5 +67,5 @@ my $parser = IDLParser->new(1);
 my $document = $parser->Parse($idlFile, $defines, $preprocessor);
 
 # Generate desired output for given IDL file.
-my $codeGen = CodeGenerator->new(\@idlDirectories, $generator, $outputDirectory, 0, $preprocessor);
+my $codeGen = CodeGenerator->new(\@idlDirectories, $generator, $outputDirectory, 0, $preprocessor, $writeDependencies);
 $codeGen->ProcessDocument($document, $defines);
diff --git a/src/3rdparty/webkit/WebCore/bridge/NP_jsobject.cpp b/src/3rdparty/webkit/WebCore/bridge/NP_jsobject.cpp
index 0a51f45..006f17f 100644
--- a/src/3rdparty/webkit/WebCore/bridge/NP_jsobject.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/NP_jsobject.cpp
@@ -122,9 +122,9 @@ bool _NPN_InvokeDefault(NPP, NPObject* o, const NPVariant* args, uint32_t argCou
         MarkedArgumentBuffer argList;
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
-        globalObject->globalData()->timeoutChecker->start();
+        globalObject->globalData()->timeoutChecker.start();
         JSValue resultV = call(exec, function, callType, callData, function, argList);
-        globalObject->globalData()->timeoutChecker->stop();
+        globalObject->globalData()->timeoutChecker.stop();
 
         // Convert and return the result of the function call.
         convertValueToNPVariant(exec, resultV, result);
@@ -172,9 +172,9 @@ bool _NPN_Invoke(NPP npp, NPObject* o, NPIdentifier methodName, const NPVariant*
         MarkedArgumentBuffer argList;
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
-        globalObject->globalData()->timeoutChecker->start();
+        globalObject->globalData()->timeoutChecker.start();
         JSValue resultV = call(exec, function, callType, callData, obj->imp, argList);
-        globalObject->globalData()->timeoutChecker->stop();
+        globalObject->globalData()->timeoutChecker.stop();
 
         // Convert and return the result of the function call.
         convertValueToNPVariant(exec, resultV, result);
@@ -202,9 +202,9 @@ bool _NPN_Evaluate(NPP, NPObject* o, NPString* s, NPVariant* variant)
         JSLock lock(SilenceAssertionsOnly);
         String scriptString = convertNPStringToUTF16(s);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
-        globalObject->globalData()->timeoutChecker->start();
+        globalObject->globalData()->timeoutChecker.start();
         Completion completion = JSC::evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(scriptString));
-        globalObject->globalData()->timeoutChecker->stop();
+        globalObject->globalData()->timeoutChecker.stop();
         ComplType type = completion.complType();
         
         JSValue result;
@@ -442,9 +442,9 @@ bool _NPN_Construct(NPP, NPObject* o, const NPVariant* args, uint32_t argCount,
         MarkedArgumentBuffer argList;
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
-        globalObject->globalData()->timeoutChecker->start();
+        globalObject->globalData()->timeoutChecker.start();
         JSValue resultV = construct(exec, constructor, constructType, constructData, argList);
-        globalObject->globalData()->timeoutChecker->stop();
+        globalObject->globalData()->timeoutChecker.stop();
         
         // Convert and return the result.
         convertValueToNPVariant(exec, resultV, result);
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_instance.cpp b/src/3rdparty/webkit/WebCore/bridge/c/c_instance.cpp
index d5c1a8b..fcdd166 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_instance.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_instance.cpp
@@ -238,7 +238,7 @@ JSValue CInstance::valueOf(ExecState* exec) const
     return stringValue(exec);
 }
 
-void CInstance::getPropertyNames(ExecState* exec, PropertyNameArray& nameArray, unsigned listedAttributes)
+void CInstance::getPropertyNames(ExecState* exec, PropertyNameArray& nameArray)
 {
     if (!NP_CLASS_STRUCT_VERSION_HAS_ENUM(_object->_class) || !_object->_class->enumerate)
         return;
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_instance.h b/src/3rdparty/webkit/WebCore/bridge/c/c_instance.h
index e7fd4bb..f9e9de3 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_instance.h
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_instance.h
@@ -65,7 +65,7 @@ public:
     virtual bool supportsConstruct() const;
     virtual JSValue invokeConstruct(ExecState*, const ArgList&);
 
-    virtual void getPropertyNames(ExecState*, PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype);
+    virtual void getPropertyNames(ExecState*, PropertyNameArray&);
 
     JSValue stringValue(ExecState*) const;
     JSValue numberValue(ExecState*) const;
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.mm b/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.mm
index 8bb8b78..eb4a6bd 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.mm
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.mm
@@ -29,19 +29,18 @@
 #if ENABLE(MAC_JAVA_BRIDGE)
 
 #include "Frame.h"
+#include "ScriptController.h"
+#include "StringSourceProvider.h"
 #include "WebCoreFrameView.h"
 #include "jni_runtime.h"
 #include "jni_utility.h"
-#include "ScriptController.h"
 #include "runtime_object.h"
 #include "runtime_root.h"
 #include <interpreter/CallFrame.h>
+#include <runtime/Completion.h>
 #include <runtime/JSGlobalObject.h>
 #include <runtime/JSLock.h>
-#include <runtime/Completion.h>
-#include <runtime/Completion.h>
 #include <wtf/Assertions.h>
-#include <parser/SourceProvider.h>
 
 using WebCore::Frame;
 
@@ -302,9 +301,9 @@ jobject JavaJSObject::call(jstring methodName, jobjectArray args) const
     // Call the function object.
     MarkedArgumentBuffer argList;
     getListFromJArray(exec, args, argList);
-    rootObject->globalObject()->globalData()->timeoutChecker->start();
+    rootObject->globalObject()->globalData()->timeoutChecker.start();
     JSValue result = JSC::call(exec, function, callType, callData, _imp, argList);
-    rootObject->globalObject()->globalData()->timeoutChecker->stop();
+    rootObject->globalObject()->globalData()->timeoutChecker.stop();
 
     return convertValueToJObject(result);
 }
@@ -321,9 +320,9 @@ jobject JavaJSObject::eval(jstring script) const
     if (!rootObject)
         return 0;
 
-    rootObject->globalObject()->globalData()->timeoutChecker->start();
+    rootObject->globalObject()->globalData()->timeoutChecker.start();
     Completion completion = JSC::evaluate(rootObject->globalObject()->globalExec(), rootObject->globalObject()->globalScopeChain(), makeSource(JavaString(script)));
-    rootObject->globalObject()->globalData()->timeoutChecker->stop();
+    rootObject->globalObject()->globalData()->timeoutChecker.stop();
     ComplType type = completion.complType();
     
     if (type == Normal) {
diff --git a/src/3rdparty/webkit/WebCore/bridge/npapi.h b/src/3rdparty/webkit/WebCore/bridge/npapi.h
index 2ff657e..07121b0 100644
--- a/src/3rdparty/webkit/WebCore/bridge/npapi.h
+++ b/src/3rdparty/webkit/WebCore/bridge/npapi.h
@@ -71,6 +71,13 @@
 #    endif /* XP_PC */
 #endif /* __MWERKS__ */
 
+#ifdef __SYMBIAN32__
+#   ifndef XP_SYMBIAN
+#       define XP_SYMBIAN 1
+#       undef XP_WIN
+#   endif
+#endif  /* __SYMBIAN32__ */
+
 #if defined(__APPLE_CC__) && !defined(__MACOS_CLASSIC__) && !defined(XP_UNIX)
 #   define XP_MACOSX
 #endif
@@ -350,10 +357,9 @@ typedef enum {
     NPPVpluginWantsAllNetworkStreams = 18,
 
     /* Checks to see if the plug-in would like the browser to load the "src" attribute. */
-    NPPVpluginCancelSrcStream = 20
+    NPPVpluginCancelSrcStream = 20,
 
 #ifdef XP_MACOSX
-    ,
     /* Used for negotiating drawing models */
     NPPVpluginDrawingModel = 1000,
     /* Used for negotiating event models */
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.cpp b/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.cpp
index 020b1c7..58280e3 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.cpp
@@ -56,12 +56,12 @@ public:
 
     static const ClassInfo s_info;
 
-    virtual void mark()
+    virtual void markChildren(MarkStack& markStack)
     {
+        RuntimeObjectImp::markChildren(markStack);
         QtInstance* instance = static_cast<QtInstance*>(getInternalInstance());
         if (instance)
-            instance->mark();
-        RuntimeObjectImp::mark();
+            instance->markAggregate(markStack);
     }
 
 protected:
@@ -202,13 +202,13 @@ RuntimeObjectImp* QtInstance::createRuntimeObject(ExecState* exec)
     return ret;
 }
 
-void QtInstance::mark()
+void QtInstance::markAggregate(MarkStack& markStack)
 {
-    if (m_defaultMethod && !m_defaultMethod->marked())
-        m_defaultMethod->mark();
+    if (m_defaultMethod)
+        markStack.append(m_defaultMethod);
     foreach(JSObject* val, m_methods.values()) {
-        if (val && !val->marked())
-            val->mark();
+        if (val)
+            markStack.append(val);
     }
 }
 
@@ -222,7 +222,7 @@ void QtInstance::end()
     // Do nothing.
 }
 
-void QtInstance::getPropertyNames(ExecState* exec, PropertyNameArray& array, unsigned listedAttributes)
+void QtInstance::getPropertyNames(ExecState* exec, PropertyNameArray& array)
 {
     // This is the enumerable properties, so put:
     // properties
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.h b/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.h
index 069c04f..c276b29 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.h
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.h
@@ -48,11 +48,11 @@ public:
     virtual JSValue valueOf(ExecState*) const;
     virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
 
-    virtual void mark(); // This isn't inherited
+    void markAggregate(MarkStack&);
 
     virtual JSValue invokeMethod(ExecState*, const MethodList&, const ArgList&);
 
-    virtual void getPropertyNames(ExecState*, PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype);
+    virtual void getPropertyNames(ExecState*, PropertyNameArray&);
 
     JSValue stringValue(ExecState* exec) const;
     JSValue numberValue(ExecState* exec) const;
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.cpp b/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.cpp
index 6be119c..23eef11 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.cpp
@@ -20,6 +20,7 @@
 #include "config.h"
 #include "qt_runtime.h"
 
+#include "BooleanObject.h"
 #include "DateInstance.h"
 #include "DateMath.h"
 #include "DatePrototype.h"
@@ -46,9 +47,9 @@
 #include <JSFunction.h>
 #include <limits.h>
 #include <runtime.h>
+#include <runtime/Error.h>
 #include <runtime_array.h>
 #include <runtime_object.h>
-#include "BooleanObject.h"
 
 // QtScript has these
 Q_DECLARE_METATYPE(QObjectList);
@@ -1162,7 +1163,7 @@ static int findMethodIndex(ExecState* exec,
         }
 
         // If the native method requires more arguments than what was passed from JavaScript
-        if (jsArgs.size() < (types.count() - 1)) {
+        if (jsArgs.size() + 1 < static_cast<unsigned>(types.count())) {
             qMatchDebug() << "Match:too few args for" << method.signature();
             tooFewArgs.append(index);
             continue;
@@ -1185,7 +1186,7 @@ static int findMethodIndex(ExecState* exec,
 
         bool converted = true;
         int matchDistance = 0;
-        for (int i = 0; converted && i < types.count() - 1; ++i) {
+        for (unsigned i = 0; converted && i + 1 < static_cast<unsigned>(types.count()); ++i) {
             JSValue arg = i < jsArgs.size() ? jsArgs.at(i) : jsUndefined();
 
             int argdistance = -1;
@@ -1202,7 +1203,7 @@ static int findMethodIndex(ExecState* exec,
         qMatchDebug() << "Match: " << method.signature() << (converted ? "converted":"failed to convert") << "distance " << matchDistance;
 
         if (converted) {
-            if ((jsArgs.size() == types.count() - 1)
+            if ((jsArgs.size() + 1 == static_cast<unsigned>(types.count()))
                 && (matchDistance == 0)) {
                 // perfect match, use this one
                 chosenIndex = index;
@@ -1328,14 +1329,14 @@ QtRuntimeMetaMethod::QtRuntimeMetaMethod(ExecState* exec, const Identifier& iden
     d->m_allowPrivate = allowPrivate;
 }
 
-void QtRuntimeMetaMethod::mark()
+void QtRuntimeMetaMethod::markChildren(MarkStack& markStack)
 {
-    QtRuntimeMethod::mark();
+    QtRuntimeMethod::markChildren(markStack);
     QW_D(QtRuntimeMetaMethod);
     if (d->m_connect)
-        d->m_connect->mark();
+        markStack.append(d->m_connect);
     if (d->m_disconnect)
-        d->m_disconnect->mark();
+        markStack.append(d->m_disconnect);
 }
 
 JSValue QtRuntimeMetaMethod::call(ExecState* exec, JSObject* functionObject, JSValue thisValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h b/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h
index 72d93eb..edb577c 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h
@@ -167,7 +167,7 @@ public:
 
     virtual bool getOwnPropertySlot(ExecState *, const Identifier&, PropertySlot&);
 
-    virtual void mark();
+    virtual void markChildren(MarkStack& markStack);
 
 protected:
     QtRuntimeMetaMethodData* d_func() const {return reinterpret_cast<QtRuntimeMetaMethodData*>(d_ptr);}
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime.h b/src/3rdparty/webkit/WebCore/bridge/runtime.h
index a67b148..e028020 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime.h
@@ -100,7 +100,7 @@ public:
     virtual bool supportsConstruct() const { return false; }
     virtual JSValue invokeConstruct(ExecState*, const ArgList&) { return JSValue(); }
     
-    virtual void getPropertyNames(ExecState*, PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype) { }
+    virtual void getPropertyNames(ExecState*, PropertyNameArray&) { }
 
     virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const = 0;
     
@@ -111,6 +111,7 @@ public:
     virtual ~Instance();
 
     virtual bool getOwnPropertySlot(JSObject*, ExecState*, const Identifier&, PropertySlot&) { return false; }
+    virtual bool getOwnPropertyDescriptor(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&) { return false; }
     virtual void put(JSObject*, ExecState*, const Identifier&, JSValue, PutPropertySlot&) { }
 
 protected:
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_array.cpp b/src/3rdparty/webkit/WebCore/bridge/runtime_array.cpp
index 84520d2..feadb07 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_array.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_array.cpp
@@ -75,6 +75,29 @@ bool RuntimeArray::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return JSObject::getOwnPropertySlot(exec, propertyName, slot);
 }
 
+bool RuntimeArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    if (propertyName == exec->propertyNames().length) {
+        PropertySlot slot;
+        slot.setCustom(this, lengthGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    
+    bool ok;
+    unsigned index = propertyName.toArrayIndex(&ok);
+    if (ok) {
+        if (index < getLength()) {
+            PropertySlot slot;
+            slot.setCustomIndex(this, index, indexGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | DontEnum);
+            return true;
+        }
+    }
+    
+    return JSObject::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
 bool RuntimeArray::getOwnPropertySlot(ExecState *exec, unsigned index, PropertySlot& slot)
 {
     if (index < getLength()) {
@@ -112,12 +135,12 @@ void RuntimeArray::put(ExecState* exec, unsigned index, JSValue value)
     getConcreteArray()->setValueAt(exec, index, value);
 }
 
-bool RuntimeArray::deleteProperty(ExecState*, const Identifier&, bool)
+bool RuntimeArray::deleteProperty(ExecState*, const Identifier&)
 {
     return false;
 }
 
-bool RuntimeArray::deleteProperty(ExecState*, unsigned, bool)
+bool RuntimeArray::deleteProperty(ExecState*, unsigned)
 {
     return false;
 }
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_array.h b/src/3rdparty/webkit/WebCore/bridge/runtime_array.h
index dbb1559..f614f7f 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_array.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_array.h
@@ -37,11 +37,12 @@ public:
     
     virtual bool getOwnPropertySlot(ExecState *, const Identifier&, PropertySlot&);
     virtual bool getOwnPropertySlot(ExecState *, unsigned, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState *, const Identifier&, PropertyDescriptor&);
     virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
     virtual void put(ExecState*, unsigned propertyName, JSValue);
     
-    virtual bool deleteProperty(ExecState *exec, const Identifier &propertyName, bool checkDontDelete = true);
-    virtual bool deleteProperty(ExecState *exec, unsigned propertyName, bool checkDontDelete = true);
+    virtual bool deleteProperty(ExecState *exec, const Identifier &propertyName);
+    virtual bool deleteProperty(ExecState *exec, unsigned propertyName);
     
     virtual const ClassInfo *classInfo() const { return &s_info; }
     
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_method.cpp b/src/3rdparty/webkit/WebCore/bridge/runtime_method.cpp
index 0af0af5..ffe4c0a 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_method.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_method.cpp
@@ -73,6 +73,18 @@ bool RuntimeMethod::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return InternalFunction::getOwnPropertySlot(exec, propertyName, slot);
 }
 
+bool RuntimeMethod::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor &descriptor)
+{
+    if (propertyName == exec->propertyNames().length) {
+        PropertySlot slot;
+        slot.setCustom(this, lengthGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    
+    return InternalFunction::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
 static JSValue JSC_HOST_CALL callRuntimeMethod(ExecState* exec, JSObject* function, JSValue thisValue, const ArgList& args)
 {
     RuntimeMethod* method = static_cast<RuntimeMethod*>(function);
@@ -82,13 +94,13 @@ static JSValue JSC_HOST_CALL callRuntimeMethod(ExecState* exec, JSObject* functi
     
     RuntimeObjectImp* imp;
 
-    if (thisValue.isObject(&RuntimeObjectImp::s_info)) {
+    if (thisValue.inherits(&RuntimeObjectImp::s_info)) {
         imp = static_cast<RuntimeObjectImp*>(asObject(thisValue));
     } else {
         // If thisObj is the DOM object for a plugin, get the corresponding
         // runtime object from the DOM object.
         JSValue value = thisValue.get(exec, Identifier(exec, "__apple_runtime_object"));
-        if (value.isObject(&RuntimeObjectImp::s_info))    
+        if (value.inherits(&RuntimeObjectImp::s_info))    
             imp = static_cast<RuntimeObjectImp*>(asObject(value));
         else
             return throwError(exec, TypeError);
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_method.h b/src/3rdparty/webkit/WebCore/bridge/runtime_method.h
index 5333c14..3233ffa 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_method.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_method.h
@@ -53,6 +53,7 @@ public:
 private:
     static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual CallType getCallData(CallData&);
 
     OwnPtr<Bindings::MethodList> _methodList;
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_object.cpp b/src/3rdparty/webkit/WebCore/bridge/runtime_object.cpp
index 90129fa..0282411 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_object.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_object.cpp
@@ -167,6 +167,54 @@ bool RuntimeObjectImp::getOwnPropertySlot(ExecState *exec, const Identifier& pro
     return instance->getOwnPropertySlot(this, exec, propertyName, slot);
 }
 
+bool RuntimeObjectImp::getOwnPropertyDescriptor(ExecState *exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    if (!instance) {
+        throwInvalidAccessError(exec);
+        return false;
+    }
+    
+    instance->begin();
+    
+    Class *aClass = instance->getClass();
+    
+    if (aClass) {
+        // See if the instance has a field with the specified name.
+        Field *aField = aClass->fieldNamed(propertyName, instance.get());
+        if (aField) {
+            PropertySlot slot;
+            slot.setCustom(this, fieldGetter);
+            instance->end();
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete);
+            return true;
+        } else {
+            // Now check if a method with specified name exists, if so return a function object for
+            // that method.
+            MethodList methodList = aClass->methodsNamed(propertyName, instance.get());
+            if (methodList.size() > 0) {
+                PropertySlot slot;
+                slot.setCustom(this, methodGetter);
+                instance->end();
+                descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly);
+                return true;
+            }
+        }
+        
+        // Try a fallback object.
+        if (!aClass->fallbackObject(exec, instance.get(), propertyName).isUndefined()) {
+            PropertySlot slot;
+            slot.setCustom(this, fallbackObjectGetter);
+            instance->end();
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly | DontEnum);
+            return true;
+        }
+    }
+    
+    instance->end();
+    
+    return instance->getOwnPropertyDescriptor(this, exec, propertyName, descriptor);
+}
+
 void RuntimeObjectImp::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (!instance) {
@@ -187,7 +235,7 @@ void RuntimeObjectImp::put(ExecState* exec, const Identifier& propertyName, JSVa
     instance->end();
 }
 
-bool RuntimeObjectImp::deleteProperty(ExecState*, const Identifier&, bool)
+bool RuntimeObjectImp::deleteProperty(ExecState*, const Identifier&)
 {
     // Can never remove a property of a RuntimeObject.
     return false;
@@ -241,18 +289,23 @@ ConstructType RuntimeObjectImp::getConstructData(ConstructData& constructData)
     return ConstructTypeHost;
 }
 
-void RuntimeObjectImp::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void RuntimeObjectImp::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     if (!instance) {
         throwInvalidAccessError(exec);
         return;
     }
-    
+
     instance->begin();
-    instance->getPropertyNames(exec, propertyNames, listedAttributes);
+    instance->getPropertyNames(exec, propertyNames);
     instance->end();
 }
 
+void RuntimeObjectImp::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    getOwnPropertyNames(exec, propertyNames);
+}
+
 JSObject* RuntimeObjectImp::throwInvalidAccessError(ExecState* exec)
 {
     return throwError(exec, ReferenceError, "Trying to access object from destroyed plug-in.");
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_object.h b/src/3rdparty/webkit/WebCore/bridge/runtime_object.h
index 1d5aa09..5e8f57e 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_object.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_object.h
@@ -38,13 +38,15 @@ public:
     virtual ~RuntimeObjectImp();
 
     virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier& propertyName, PropertyDescriptor&);
     virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
-    virtual bool deleteProperty(ExecState* , const Identifier& propertyName, bool checkDontDelete = true);
+    virtual bool deleteProperty(ExecState* , const Identifier& propertyName);
     virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
     virtual CallType getCallData(CallData&);
     virtual ConstructType getConstructData(ConstructData&);
-    
-    virtual void getPropertyNames(ExecState*, PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype);
+
+    virtual void getPropertyNames(ExecState*, PropertyNameArray&);
+    virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
 
     virtual void invalidate();
     Bindings::Instance* getInternalInstance() const { return instance.get(); }
diff --git a/src/3rdparty/webkit/WebCore/config.h b/src/3rdparty/webkit/WebCore/config.h
index 411ddb1..62a7f60a 100644
--- a/src/3rdparty/webkit/WebCore/config.h
+++ b/src/3rdparty/webkit/WebCore/config.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2004, 2005, 2006 Apple Inc.
- * 
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ -74,15 +75,6 @@
 
 #endif /* PLATFORM(WIN_OS) */
 
-// On MSW, wx headers need to be included before windows.h is.
-// The only way we can always ensure this is if we include wx here.
-#if PLATFORM(WX)
-// The defines in KeyboardCodes.h conflict with Windows as well, and the only way I've found
-// to address the problem is include KeyboarddCodes.h before windows.h, so do it here.
-#include "KeyboardCodes.h"
-#include <wx/defs.h>
-#endif
-
 #ifdef __cplusplus
 
 // These undefs match up with defines in WebCorePrefix.h for Mac OS X.
@@ -93,10 +85,19 @@
 
 #endif
 
+// On MSW, wx headers need to be included before windows.h is.
+// The only way we can always ensure this is if we include wx here.
+#if PLATFORM(WX)
+// The defines in KeyboardCodes.h conflict with Windows as well, and the only way I've found
+// to address the problem is include KeyboarddCodes.h before windows.h, so do it here.
+#include "KeyboardCodes.h"
+#include <wx/defs.h>
+#endif
+
 // this breaks compilation of <QFontDatabase>, at least, so turn it off for now
 // Also generates errors on wx on Windows, presumably because these functions
 // are used from wx headers.
-#if !PLATFORM(QT) && !PLATFORM(WX)
+#if !PLATFORM(QT) && !PLATFORM(WX) && !PLATFORM(CHROMIUM)
 #include <wtf/DisallowCType.h>
 #endif
 
@@ -156,13 +157,30 @@
 #include <wtf/MathExtras.h>
 #endif
 
-#if !defined(WTF_USE_V8)
-/* Currently Chromium is the only platform which uses V8 by default */
 #if PLATFORM(CHROMIUM)
+
+#if !PLATFORM(DARWIN)
+// Define SKIA on non-Mac.
+#define WTF_PLATFORM_SKIA 1
+#endif /* !PLATFORM(DARWIN) */
+
+// Chromium uses this file instead of JavaScriptCore/config.h to compile
+// JavaScriptCore/wtf (chromium doesn't compile the rest of JSC). Therefore,
+// this define is required.
+#define WTF_CHANGES 1
+
+#define WTF_USE_GOOGLEURL 1
+
+#if !defined(WTF_USE_V8)
 #define WTF_USE_V8 1
-#else
-#define WTF_USE_V8 0
+#endif
+
+#undef WTF_USE_CFNETWORK
+
 #endif /* PLATFORM(CHROMIUM) */
+
+#if !defined(WTF_USE_V8)
+#define WTF_USE_V8 0
 #endif /* !defined(WTF_USE_V8) */
 
 /* Using V8 implies not using JSC and vice versa */
diff --git a/src/3rdparty/webkit/WebCore/css/CSSCanvasValue.cpp b/src/3rdparty/webkit/WebCore/css/CSSCanvasValue.cpp
index cf8cb42..0c1c3f9 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSCanvasValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSCanvasValue.cpp
@@ -47,15 +47,15 @@ String CSSCanvasValue::cssText() const
 void CSSCanvasValue::canvasChanged(HTMLCanvasElement*, const FloatRect& changedRect)
 {
     IntRect imageChangeRect = enclosingIntRect(changedRect);
-    HashMap<RenderObject*, IntSize>::const_iterator end = m_clients.end();
-    for (HashMap<RenderObject*, IntSize>::const_iterator curr = m_clients.begin(); curr != end; ++curr)
+    RenderObjectSizeCountMap::const_iterator end = m_clients.end();
+    for (RenderObjectSizeCountMap::const_iterator curr = m_clients.begin(); curr != end; ++curr)
         curr->first->imageChanged(static_cast<WrappedImagePtr>(this), &imageChangeRect);
 }
 
 void CSSCanvasValue::canvasResized(HTMLCanvasElement*)
 {
-    HashMap<RenderObject*, IntSize>::const_iterator end = m_clients.end();
-    for (HashMap<RenderObject*, IntSize>::const_iterator curr = m_clients.begin(); curr != end; ++curr)
+    RenderObjectSizeCountMap::const_iterator end = m_clients.end();
+    for (RenderObjectSizeCountMap::const_iterator curr = m_clients.begin(); curr != end; ++curr)
         curr->first->imageChanged(static_cast<WrappedImagePtr>(this));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp
index 476ed1e..debd396 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -58,7 +58,10 @@ static const int computedProperties[] = {
     CSSPropertyBackgroundOrigin,
     CSSPropertyBackgroundPosition, // more-specific background-position-x/y are non-standard
     CSSPropertyBackgroundRepeat,
+    CSSPropertyBackgroundSize,
     CSSPropertyBorderBottomColor,
+    CSSPropertyBorderBottomLeftRadius,
+    CSSPropertyBorderBottomRightRadius,
     CSSPropertyBorderBottomStyle,
     CSSPropertyBorderBottomWidth,
     CSSPropertyBorderCollapse,
@@ -69,6 +72,8 @@ static const int computedProperties[] = {
     CSSPropertyBorderRightStyle,
     CSSPropertyBorderRightWidth,
     CSSPropertyBorderTopColor,
+    CSSPropertyBorderTopLeftRadius,
+    CSSPropertyBorderTopRightRadius,
     CSSPropertyBorderTopStyle,
     CSSPropertyBorderTopWidth,
     CSSPropertyBottom,
@@ -145,20 +150,16 @@ static const int computedProperties[] = {
     CSSPropertyWebkitAnimationDuration,
     CSSPropertyWebkitAnimationIterationCount,
     CSSPropertyWebkitAnimationName,
+    CSSPropertyWebkitAnimationPlayState,
     CSSPropertyWebkitAnimationTimingFunction,
     CSSPropertyWebkitAppearance,
     CSSPropertyWebkitBackfaceVisibility,
     CSSPropertyWebkitBackgroundClip,
     CSSPropertyWebkitBackgroundComposite,
     CSSPropertyWebkitBackgroundOrigin,
-    CSSPropertyWebkitBackgroundSize,
-    CSSPropertyWebkitBorderBottomLeftRadius,
-    CSSPropertyWebkitBorderBottomRightRadius,
     CSSPropertyWebkitBorderFit,
     CSSPropertyWebkitBorderHorizontalSpacing,
     CSSPropertyWebkitBorderImage,
-    CSSPropertyWebkitBorderTopLeftRadius,
-    CSSPropertyWebkitBorderTopRightRadius,
     CSSPropertyWebkitBorderVerticalSpacing,
     CSSPropertyWebkitBoxAlign,
     CSSPropertyWebkitBoxDirection,
@@ -182,6 +183,7 @@ static const int computedProperties[] = {
 #if ENABLE(DASHBOARD_SUPPORT)
     CSSPropertyWebkitDashboardRegion,
 #endif
+    CSSPropertyWebkitFontSmoothing,
     CSSPropertyWebkitHighlight,
     CSSPropertyWebkitLineBreak,
     CSSPropertyWebkitLineClamp,
@@ -618,6 +620,23 @@ static PassRefPtr<CSSValue> renderTextDecorationFlagsToCSSValue(int textDecorati
     return list;
 }
 
+static PassRefPtr<CSSValue> fillRepeatToCSSValue(EFillRepeat xRepeat, EFillRepeat yRepeat)
+{
+    // For backwards compatibility, if both values are equal, just return one of them. And
+    // if the two values are equivalent to repeat-x or repeat-y, just return the shorthand.
+    if (xRepeat == yRepeat)
+        return CSSPrimitiveValue::create(xRepeat);
+    if (xRepeat == CSSValueRepeat && yRepeat == CSSValueNoRepeat)
+        return CSSPrimitiveValue::createIdentifier(CSSValueRepeatX);
+    if (xRepeat == CSSValueNoRepeat && yRepeat == CSSValueRepeat)
+        return CSSPrimitiveValue::createIdentifier(CSSValueRepeatY);
+
+    RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
+    list->append(CSSPrimitiveValue::create(xRepeat));
+    list->append(CSSPrimitiveValue::create(yRepeat));
+    return list.release();
+}
+
 PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int propertyID, EUpdateLayout updateLayout) const
 {
     Node* node = m_node.get();
@@ -648,14 +667,19 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             if (style->backgroundImage())
                 return style->backgroundImage()->cssValue();
             return CSSPrimitiveValue::createIdentifier(CSSValueNone);
-        case CSSPropertyWebkitBackgroundSize: {
+        case CSSPropertyBackgroundSize: {
+            EFillSizeType size = style->backgroundSizeType();
+            if (size == Contain)
+                return CSSPrimitiveValue::createIdentifier(CSSValueContain);
+            if (size == Cover)
+                return CSSPrimitiveValue::createIdentifier(CSSValueCover);
             RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
-            list->append(CSSPrimitiveValue::create(style->backgroundSize().width()));
-            list->append(CSSPrimitiveValue::create(style->backgroundSize().height()));
+            list->append(CSSPrimitiveValue::create(style->backgroundSizeLength().width()));
+            list->append(CSSPrimitiveValue::create(style->backgroundSizeLength().height()));
             return list.release();
         }  
         case CSSPropertyBackgroundRepeat:
-            return CSSPrimitiveValue::create(style->backgroundRepeat());
+            return fillRepeatToCSSValue(style->backgroundRepeatX(), style->backgroundRepeatY());
         case CSSPropertyWebkitBackgroundComposite:
             return CSSPrimitiveValue::create(style->backgroundComposite());
         case CSSPropertyBackgroundAttachment:
@@ -925,7 +949,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return list.release();
         }  
         case CSSPropertyWebkitMaskRepeat:
-            return CSSPrimitiveValue::create(style->maskRepeat());
+            return fillRepeatToCSSValue(style->maskRepeatX(), style->maskRepeatY());
         case CSSPropertyWebkitMaskAttachment:
             return CSSPrimitiveValue::create(style->maskAttachment());
         case CSSPropertyWebkitMaskComposite:
@@ -1097,6 +1121,8 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return CSSPrimitiveValue::create(style->matchNearestMailBlockquoteColor());
         case CSSPropertyResize:
             return CSSPrimitiveValue::create(style->resize());
+        case CSSPropertyWebkitFontSmoothing:
+            return CSSPrimitiveValue::create(style->fontSmoothing());
         case CSSPropertyZIndex:
             if (style->hasAutoZIndex())
                 return CSSPrimitiveValue::createIdentifier(CSSValueAuto);
@@ -1183,6 +1209,21 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
                 list->append(CSSPrimitiveValue::createIdentifier(CSSValueNone));
             return list.release();
         }
+        case CSSPropertyWebkitAnimationPlayState: {
+            RefPtr<CSSValueList> list = CSSValueList::createCommaSeparated();
+            const AnimationList* t = style->animations();
+            if (t) {
+                for (size_t i = 0; i < t->size(); ++i) {
+                    int prop = t->animation(i)->playState();
+                    if (prop == AnimPlayStatePlaying)
+                        list->append(CSSPrimitiveValue::createIdentifier(CSSValueRunning));
+                    else
+                        list->append(CSSPrimitiveValue::createIdentifier(CSSValuePaused));
+                }
+            } else
+                list->append(CSSPrimitiveValue::createIdentifier(CSSValueRunning));
+            return list.release();
+        }
         case CSSPropertyWebkitAnimationTimingFunction:
             return getTimingFunctionValue(style->animations());
         case CSSPropertyWebkitAppearance:
@@ -1225,13 +1266,13 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return CSSPrimitiveValue::create(style->userDrag());
         case CSSPropertyWebkitUserSelect:
             return CSSPrimitiveValue::create(style->userSelect());
-        case CSSPropertyWebkitBorderBottomLeftRadius:
+        case CSSPropertyBorderBottomLeftRadius:
             return getBorderRadiusCornerValue(style->borderBottomLeftRadius());
-        case CSSPropertyWebkitBorderBottomRightRadius:
+        case CSSPropertyBorderBottomRightRadius:
             return getBorderRadiusCornerValue(style->borderBottomRightRadius());
-        case CSSPropertyWebkitBorderTopLeftRadius:
+        case CSSPropertyBorderTopLeftRadius:
             return getBorderRadiusCornerValue(style->borderTopLeftRadius());
-        case CSSPropertyWebkitBorderTopRightRadius:
+        case CSSPropertyBorderTopRightRadius:
             return getBorderRadiusCornerValue(style->borderTopRightRadius());
         case CSSPropertyClip: {
             if (!style->hasClip())
@@ -1297,6 +1338,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyBorderBottom:
         case CSSPropertyBorderColor:
         case CSSPropertyBorderLeft:
+        case CSSPropertyBorderRadius:
         case CSSPropertyBorderRight:
         case CSSPropertyBorderStyle:
         case CSSPropertyBorderTop:
@@ -1421,37 +1463,6 @@ String CSSComputedStyleDeclaration::item(unsigned i) const
     return getPropertyName(static_cast<CSSPropertyID>(computedProperties[i]));
 }
 
-// This is the list of properties we want to copy in the copyInheritableProperties() function.
-// It is the intersection of the list of inherited CSS properties and the
-// properties for which we have a computed implementation in this file.
-static const int inheritableProperties[] = {
-    CSSPropertyBorderCollapse,
-    CSSPropertyColor,
-    CSSPropertyFontFamily,
-    CSSPropertyFontSize,
-    CSSPropertyFontStyle,
-    CSSPropertyFontVariant,
-    CSSPropertyFontWeight,
-    CSSPropertyLetterSpacing,
-    CSSPropertyLineHeight,
-    CSSPropertyOrphans,
-    CSSPropertyTextAlign,
-    CSSPropertyTextIndent,
-    CSSPropertyTextTransform,
-    CSSPropertyWhiteSpace,
-    CSSPropertyWidows,
-    CSSPropertyWordSpacing,
-    CSSPropertyWebkitBorderHorizontalSpacing,
-    CSSPropertyWebkitBorderVerticalSpacing,
-    CSSPropertyWebkitTextDecorationsInEffect,
-    CSSPropertyWebkitTextFillColor,
-    CSSPropertyWebkitTextSizeAdjust,
-    CSSPropertyWebkitTextStrokeColor,
-    CSSPropertyWebkitTextStrokeWidth,
-};
-
-static const unsigned numInheritableProperties = sizeof(inheritableProperties) / sizeof(inheritableProperties[0]);
-
 bool CSSComputedStyleDeclaration::cssPropertyMatches(const CSSProperty* property) const
 {
     if (property->id() == CSSPropertyFontSize && property->value()->isPrimitiveValue() && m_node) {
@@ -1468,29 +1479,6 @@ bool CSSComputedStyleDeclaration::cssPropertyMatches(const CSSProperty* property
     return CSSStyleDeclaration::cssPropertyMatches(property);
 }
 
-// FIXME: deprecatedCopyInheritableProperties is used for two purposes:
-// 1.  Calculating the typing style.
-// 2.  Moving HTML subtrees and seeking to remove redundant styles.
-// These tasks should be broken out into two separate functions.  New code should not use this function.
-PassRefPtr<CSSMutableStyleDeclaration> CSSComputedStyleDeclaration::deprecatedCopyInheritableProperties() const
-{
-    RefPtr<CSSMutableStyleDeclaration> style = copyPropertiesInSet(inheritableProperties, numInheritableProperties);
-    if (style && m_node && m_node->computedStyle()) {
-        // If a node's text fill color is invalid, then its children use 
-        // their font-color as their text fill color (they don't
-        // inherit it).  Likewise for stroke color.
-        ExceptionCode ec = 0;
-        if (!m_node->computedStyle()->textFillColor().isValid())
-            style->removeProperty(CSSPropertyWebkitTextFillColor, ec);
-        if (!m_node->computedStyle()->textStrokeColor().isValid())
-            style->removeProperty(CSSPropertyWebkitTextStrokeColor, ec);
-        ASSERT(ec == 0);
-        if (int keywordSize = m_node->computedStyle()->fontDescription().keywordSize())
-            style->setProperty(CSSPropertyFontSize, cssIdentifierForFontSizeKeyword(keywordSize));
-    }
-    return style.release();
-}
-
 PassRefPtr<CSSMutableStyleDeclaration> CSSComputedStyleDeclaration::copy() const
 {
     return copyPropertiesInSet(computedProperties, numComputedProperties);
diff --git a/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.h b/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.h
index 5d3ccc1..c1f34c3 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.h
@@ -55,7 +55,6 @@ public:
     PassRefPtr<CSSValue> getSVGPropertyCSSValue(int propertyID, EUpdateLayout) const;
 #endif
 
-    PassRefPtr<CSSMutableStyleDeclaration> deprecatedCopyInheritableProperties() const;
 protected:
     virtual bool cssPropertyMatches(const CSSProperty*) const;
 
diff --git a/src/3rdparty/webkit/WebCore/css/CSSCursorImageValue.cpp b/src/3rdparty/webkit/WebCore/css/CSSCursorImageValue.cpp
index 84ac565..c1a517c 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSCursorImageValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSCursorImageValue.cpp
@@ -39,8 +39,8 @@ namespace WebCore {
 #if ENABLE(SVG)
 static inline bool isSVGCursorIdentifier(const String& url)
 {
-    KURL kurl(url);
-    return kurl.hasRef();
+    KURL kurl(ParsedURLString, url);
+    return kurl.hasFragmentIdentifier();
 }
 
 static inline SVGCursorElement* resourceReferencedByCursorElement(const String& fragmentId, Document* document)
diff --git a/src/3rdparty/webkit/WebCore/css/CSSGrammar.y b/src/3rdparty/webkit/WebCore/css/CSSGrammar.y
index 22c7014..1c1f7b4 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSGrammar.y
+++ b/src/3rdparty/webkit/WebCore/css/CSSGrammar.y
@@ -740,9 +740,9 @@ key:
     | IDENT {
         $$.id = 0; $$.isInt = false; $$.unit = CSSPrimitiveValue::CSS_NUMBER;
         CSSParserString& str = $1;
-        if (equalIgnoringCase(static_cast<const String&>(str), "from"))
+        if (equalIgnoringCase("from", str.characters, str.length))
             $$.fValue = 0;
-        else if (equalIgnoringCase(static_cast<const String&>(str), "to"))
+        else if (equalIgnoringCase("to", str.characters, str.length))
             $$.fValue = 100;
         else
             YYERROR;
diff --git a/src/3rdparty/webkit/WebCore/css/CSSImageGeneratorValue.cpp b/src/3rdparty/webkit/WebCore/css/CSSImageGeneratorValue.cpp
index 6e23d95..4cf0873 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSImageGeneratorValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSImageGeneratorValue.cpp
@@ -49,24 +49,42 @@ void CSSImageGeneratorValue::addClient(RenderObject* renderer, const IntSize& si
     ref();
     if (!size.isEmpty())
         m_sizes.add(size);
-    m_clients.add(renderer, size);
+    
+    RenderObjectSizeCountMap::iterator it = m_clients.find(renderer);
+    if (it == m_clients.end())
+        m_clients.add(renderer, SizeCountPair(size, 1));
+    else {
+        SizeCountPair& sizeCount = it->second;
+        ++sizeCount.second;
+    }
 }
 
 void CSSImageGeneratorValue::removeClient(RenderObject* renderer)
 {
-    IntSize size = m_clients.get(renderer);
+    RenderObjectSizeCountMap::iterator it = m_clients.find(renderer);
+    ASSERT(it != m_clients.end());
+
+    SizeCountPair& sizeCount = it->second;
+    IntSize size = sizeCount.first;
     if (!size.isEmpty()) {
         m_sizes.remove(size);
         if (!m_sizes.contains(size))
             m_images.remove(size);
     }
-    m_clients.remove(renderer);
+    
+    if (!--sizeCount.second)
+        m_clients.remove(renderer);
+
     deref();
 }
 
 Image* CSSImageGeneratorValue::getImage(RenderObject* renderer, const IntSize& size)
 {
-    IntSize oldSize = m_clients.get(renderer);
+    RenderObjectSizeCountMap::iterator it = m_clients.find(renderer);
+    ASSERT(it != m_clients.end());
+
+    SizeCountPair& sizeCount = it->second;
+    IntSize oldSize = sizeCount.first;
     if (oldSize != size) {
         removeClient(renderer);
         addClient(renderer, size);
diff --git a/src/3rdparty/webkit/WebCore/css/CSSImageGeneratorValue.h b/src/3rdparty/webkit/WebCore/css/CSSImageGeneratorValue.h
index 661fd37..c053bfe 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSImageGeneratorValue.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSImageGeneratorValue.h
@@ -57,8 +57,11 @@ protected:
     Image* getImage(RenderObject*, const IntSize&);
     void putImage(const IntSize&, PassRefPtr<Image>);
 
+    typedef pair<IntSize, int> SizeCountPair;
+    typedef HashMap<RenderObject*, SizeCountPair> RenderObjectSizeCountMap;
+
     HashCountedSet<IntSize> m_sizes; // A count of how many times a given image size is in use.
-    HashMap<RenderObject*, IntSize> m_clients; // A map from RenderObjects to image sizes.
+    RenderObjectSizeCountMap m_clients; // A map from RenderObjects (with entry count) to image sizes.
     HashMap<IntSize, RefPtr<Image> > m_images; // A cache of Image objects by image size.
     
     RefPtr<StyleGeneratedImage> m_image;
diff --git a/src/3rdparty/webkit/WebCore/css/CSSImageValue.cpp b/src/3rdparty/webkit/WebCore/css/CSSImageValue.cpp
index 7fc99bb..3432a4e 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSImageValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSImageValue.cpp
@@ -63,7 +63,7 @@ StyleCachedImage* CSSImageValue::cachedImage(DocLoader* loader, const String& ur
             cachedImage = loader->requestImage(url);
         else {
             // FIXME: Should find a way to make these images sit in their own memory partition, since they are user agent images.
-            cachedImage = static_cast<CachedImage*>(cache()->requestResource(0, CachedResource::ImageResource, KURL(url), String()));
+            cachedImage = static_cast<CachedImage*>(cache()->requestResource(0, CachedResource::ImageResource, KURL(ParsedURLString, url), String()));
         }
 
         if (cachedImage) {
diff --git a/src/3rdparty/webkit/WebCore/css/CSSImportRule.cpp b/src/3rdparty/webkit/WebCore/css/CSSImportRule.cpp
index 50e60f4..9dafba9 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSImportRule.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSImportRule.cpp
@@ -1,7 +1,7 @@
 /*
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * (C) 2002-2003 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2002, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2002, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -26,6 +26,8 @@
 #include "DocLoader.h"
 #include "Document.h"
 #include "MediaList.h"
+#include "Settings.h"
+#include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
@@ -60,7 +62,20 @@ void CSSImportRule::setCSSStyleSheet(const String& url, const String& charset, c
 
     CSSStyleSheet* parent = parentStyleSheet();
     bool strict = !parent || parent->useStrictParsing();
-    m_styleSheet->parseString(sheet->sheetText(strict), strict);
+    String sheetText = sheet->sheetText(strict);
+    m_styleSheet->parseString(sheetText, strict);
+
+    if (strict && parent && parent->doc() && parent->doc()->settings() && parent->doc()->settings()->needsSiteSpecificQuirks()) {
+        // Work around <https://bugs.webkit.org/show_bug.cgi?id=28350>.
+        DEFINE_STATIC_LOCAL(const String, slashKHTMLFixesDotCss, ("/KHTMLFixes.css"));
+        DEFINE_STATIC_LOCAL(const String, mediaWikiKHTMLFixesStyleSheet, ("/* KHTML fix stylesheet */\n/* work around the horizontal scrollbars */\n#column-content { margin-left: 0; }\n\n"));
+        if (url.endsWith(slashKHTMLFixesDotCss) && sheetText == mediaWikiKHTMLFixesStyleSheet) {
+            ASSERT(m_styleSheet->length() == 1);
+            ExceptionCode ec;
+            m_styleSheet->deleteRule(0, ec);
+        }
+    }
+
     m_loading = false;
 
     if (parent)
@@ -85,7 +100,7 @@ void CSSImportRule::insertedIntoParent()
     String absHref = m_strHref;
     if (!parentSheet->href().isNull())
         // use parent styleheet's URL as the base URL
-        absHref = KURL(KURL(parentSheet->href()), m_strHref).string();
+        absHref = KURL(KURL(ParsedURLString, parentSheet->href()), m_strHref).string();
 
     // Check for a cycle in our import chain.  If we encounter a stylesheet
     // in our parent chain with the same URL, then just bail.
diff --git a/src/3rdparty/webkit/WebCore/css/CSSMutableStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/css/CSSMutableStyleDeclaration.cpp
index 8ff5300..2dd2f5d 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSMutableStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSMutableStyleDeclaration.cpp
@@ -28,6 +28,7 @@
 #include "CSSPropertyNames.h"
 #include "CSSRule.h"
 #include "CSSStyleSheet.h"
+#include "CSSValueKeywords.h"
 #include "CSSValueList.h"
 #include "Document.h"
 #include "ExceptionCode.h"
@@ -110,15 +111,24 @@ String CSSMutableStyleDeclaration::getPropertyValue(int propertyID) const
     switch (propertyID) {
         case CSSPropertyBackgroundPosition: {
             // FIXME: Is this correct? The code in cssparser.cpp is confusing
-            const int properties[2] = { CSSPropertyBackgroundPositionX,
-                                        CSSPropertyBackgroundPositionY };
+            const int properties[2] = { CSSPropertyBackgroundPositionX, CSSPropertyBackgroundPositionY };
+            return getLayeredShorthandValue(properties, 2);
+        }
+        case CSSPropertyBackgroundRepeat: {
+            const int properties[2] = { CSSPropertyBackgroundRepeatX, CSSPropertyBackgroundRepeatY };
             return getLayeredShorthandValue(properties, 2);
         }
         case CSSPropertyBackground: {
-            const int properties[7] = { CSSPropertyBackgroundImage, CSSPropertyBackgroundRepeat, 
-                                        CSSPropertyBackgroundAttachment, CSSPropertyBackgroundPosition, CSSPropertyBackgroundClip,
-                                        CSSPropertyBackgroundOrigin, CSSPropertyBackgroundColor };
-            return getLayeredShorthandValue(properties, 7);
+            const int properties[9] = { CSSPropertyBackgroundColor,
+                                        CSSPropertyBackgroundImage, 
+                                        CSSPropertyBackgroundRepeatX, 
+                                        CSSPropertyBackgroundRepeatY, 
+                                        CSSPropertyBackgroundAttachment, 
+                                        CSSPropertyBackgroundPositionX, 
+                                        CSSPropertyBackgroundPositionY, 
+                                        CSSPropertyBackgroundClip,
+                                        CSSPropertyBackgroundOrigin }; 
+            return getLayeredShorthandValue(properties, 9);
         }
         case CSSPropertyBorder: {
             const int properties[3][4] = {{ CSSPropertyBorderTopWidth,
@@ -206,8 +216,11 @@ String CSSMutableStyleDeclaration::getPropertyValue(int propertyID) const
         }
         case CSSPropertyWebkitMaskPosition: {
             // FIXME: Is this correct? The code in cssparser.cpp is confusing
-            const int properties[2] = { CSSPropertyWebkitMaskPositionX,
-                                        CSSPropertyWebkitMaskPositionY };
+            const int properties[2] = { CSSPropertyWebkitMaskPositionX, CSSPropertyWebkitMaskPositionY };
+            return getLayeredShorthandValue(properties, 2);
+        }
+        case CSSPropertyWebkitMaskRepeat: {
+            const int properties[2] = { CSSPropertyWebkitMaskRepeatX, CSSPropertyWebkitMaskRepeatY };
             return getLayeredShorthandValue(properties, 2);
         }
         case CSSPropertyWebkitMask: {
@@ -286,6 +299,9 @@ String CSSMutableStyleDeclaration::getLayeredShorthandValue(const int* propertie
     // can safely be omitted.
     for (size_t i = 0; i < numLayers; i++) {
         String layerRes;
+        bool useRepeatXShorthand = false;
+        bool useRepeatYShorthand = false;
+        bool useSingleWordShorthand = false;
         for (size_t j = 0; j < number; j++) {
             RefPtr<CSSValue> value;
             if (values[j]) {
@@ -302,11 +318,50 @@ String CSSMutableStyleDeclaration::getLayeredShorthandValue(const int* propertie
                         value = 0;
                 }
             }
+
+            // We need to report background-repeat as it was written in the CSS. If the property is implicit,
+            // then it was written with only one value. Here we figure out which value that was so we can
+            // report back correctly. 
+            if (properties[j] == CSSPropertyBackgroundRepeatX && isPropertyImplicit(properties[j])) {
+                if (j < number - 1 && properties[j + 1] == CSSPropertyBackgroundRepeatY) {
+                    RefPtr<CSSValue> yValue;
+                    RefPtr<CSSValue> nextValue = values[j + 1];
+                    if (nextValue->isValueList())
+                        yValue = static_cast<CSSValueList*>(nextValue.get())->itemWithoutBoundsCheck(i);
+                    else
+                        yValue = nextValue;
+                        
+                    int xId = static_cast<CSSPrimitiveValue*>(value.get())->getIdent();
+                    int yId = static_cast<CSSPrimitiveValue*>(yValue.get())->getIdent();
+                    if (xId != yId) {
+                        if (xId == CSSValueRepeat && yId == CSSValueNoRepeat) {
+                            useRepeatXShorthand = true;
+                            ++j;
+                        } else if (xId == CSSValueNoRepeat && yId == CSSValueRepeat) {
+                            useRepeatYShorthand = true;
+                            continue;
+                        }
+                    } else {
+                        useSingleWordShorthand = true;
+                        ++j;
+                    }
+                }
+            }
             
             if (value && !value->isImplicitInitialValue()) {
                 if (!layerRes.isNull())
                     layerRes += " ";
-                layerRes += value->cssText();
+                if (useRepeatXShorthand) {
+                    useRepeatXShorthand = false;
+                    layerRes += getValueName(CSSValueRepeatX);
+                } else if (useRepeatYShorthand) {
+                    useRepeatYShorthand = false;
+                    layerRes += getValueName(CSSValueRepeatY);
+                } else if (useSingleWordShorthand) {
+                    useSingleWordShorthand = false;
+                    layerRes += value->cssText();
+                } else
+                    layerRes += value->cssText();
             }
         }
         
@@ -583,6 +638,8 @@ String CSSMutableStyleDeclaration::cssText() const
     
     const CSSProperty* positionXProp = 0;
     const CSSProperty* positionYProp = 0;
+    const CSSProperty* repeatXProp = 0;
+    const CSSProperty* repeatYProp = 0;
     
     unsigned size = m_properties.size();
     for (unsigned n = 0; n < size; ++n) {
@@ -591,6 +648,10 @@ String CSSMutableStyleDeclaration::cssText() const
             positionXProp = &prop;
         else if (prop.id() == CSSPropertyBackgroundPositionY)
             positionYProp = &prop;
+        else if (prop.id() == CSSPropertyBackgroundRepeatX)
+            repeatXProp = &prop;
+        else if (prop.id() == CSSPropertyBackgroundRepeatY)
+            repeatYProp = &prop;
         else
             result += prop.cssText();
     }
@@ -614,6 +675,22 @@ String CSSMutableStyleDeclaration::cssText() const
             result += positionYProp->cssText();
     }
 
+    // FIXME: We need to do the same for background-repeat.
+    if (repeatXProp && repeatYProp && repeatXProp->isImportant() == repeatYProp->isImportant()) {
+        String repeatValue;
+        const int repeatProperties[2] = { CSSPropertyBackgroundRepeatX, CSSPropertyBackgroundRepeatY };
+        if (repeatXProp->value()->isValueList() || repeatYProp->value()->isValueList()) 
+            repeatValue = getLayeredShorthandValue(repeatProperties, 2);
+        else
+            repeatValue = repeatXProp->value()->cssText() + " " + repeatYProp->value()->cssText();
+        result += "background-repeat: " + repeatValue + (repeatXProp->isImportant() ? " !important" : "") + "; ";
+    } else {
+        if (repeatXProp) 
+            result += repeatXProp->cssText();
+        if (repeatYProp)
+            result += repeatYProp->cssText();
+    }
+
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/css/CSSParser.cpp b/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
index 411379e..aa2be59 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
@@ -4,6 +4,7 @@
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Nicholas Shanks <webkit@nickshanks.com>
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -167,7 +168,7 @@ CSSParser::~CSSParser()
     }
     delete m_floatingMediaQueryExp;
     delete m_floatingMediaQuery;
-    deleteAllValues(m_floatingSelectors);
+    fastDeleteAllValues(m_floatingSelectors);
     deleteAllValues(m_floatingValueLists);
     deleteAllValues(m_floatingFunctions);
     deleteAllValues(m_reusableSelectorVector);
@@ -695,7 +696,11 @@ bool CSSParser::parseValue(int propId, bool important)
         // inline | block | list-item | run-in | inline-block | table |
         // inline-table | table-row-group | table-header-group | table-footer-group | table-row |
         // table-column-group | table-column | table-cell | table-caption | box | inline-box | none | inherit
+#if ENABLE(WCSS)
+        if ((id >= CSSValueInline && id <= CSSValueWapMarquee) || id == CSSValueNone)
+#else
         if ((id >= CSSValueInline && id <= CSSValueWebkitInlineBox) || id == CSSValueNone)
+#endif
             valid_primitive = true;
         break;
 
@@ -868,8 +873,10 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyBackgroundPosition:
     case CSSPropertyBackgroundPositionX:
     case CSSPropertyBackgroundPositionY:
-    case CSSPropertyWebkitBackgroundSize:
+    case CSSPropertyBackgroundSize:
     case CSSPropertyBackgroundRepeat:
+    case CSSPropertyBackgroundRepeatX:
+    case CSSPropertyBackgroundRepeatY:
     case CSSPropertyWebkitMaskAttachment:
     case CSSPropertyWebkitMaskClip:
     case CSSPropertyWebkitMaskComposite:
@@ -879,17 +886,21 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyWebkitMaskPositionX:
     case CSSPropertyWebkitMaskPositionY:
     case CSSPropertyWebkitMaskSize:
-    case CSSPropertyWebkitMaskRepeat: {
+    case CSSPropertyWebkitMaskRepeat:
+    case CSSPropertyWebkitMaskRepeatX:
+    case CSSPropertyWebkitMaskRepeatY: {
         RefPtr<CSSValue> val1;
         RefPtr<CSSValue> val2;
         int propId1, propId2;
+        bool result = false;
         if (parseFillProperty(propId, propId1, propId2, val1, val2)) {
             addProperty(propId1, val1.release(), important);
             if (val2)
                 addProperty(propId2, val2.release(), important);
-            return true;
+            result = true;
         }
-        return false;
+        m_implicitShorthand = false;
+        return result;
     }
     case CSSPropertyListStyleImage:     // <uri> | none | inherit
         if (id == CSSValueNone) {
@@ -1147,11 +1158,10 @@ bool CSSParser::parseValue(int propId, bool important)
             }
         }
         break;
-    case CSSPropertyWebkitBorderTopRightRadius:
-    case CSSPropertyWebkitBorderTopLeftRadius:
-    case CSSPropertyWebkitBorderBottomLeftRadius:
-    case CSSPropertyWebkitBorderBottomRightRadius:
-    case CSSPropertyWebkitBorderRadius: {
+    case CSSPropertyBorderTopRightRadius:
+    case CSSPropertyBorderTopLeftRadius:
+    case CSSPropertyBorderBottomLeftRadius:
+    case CSSPropertyBorderBottomRightRadius: {
         if (num != 1 && num != 2)
             return false;
         valid_primitive = validUnit(value, FLength, m_strict);
@@ -1167,20 +1177,15 @@ bool CSSParser::parseValue(int propId, bool important)
             parsedValue2 = CSSPrimitiveValue::create(value->fValue, (CSSPrimitiveValue::UnitTypes)value->unit);
         } else
             parsedValue2 = parsedValue1;
-        
+
         RefPtr<Pair> pair = Pair::create(parsedValue1.release(), parsedValue2.release());
         RefPtr<CSSPrimitiveValue> val = CSSPrimitiveValue::create(pair.release());
-        if (propId == CSSPropertyWebkitBorderRadius) {
-            const int properties[4] = { CSSPropertyWebkitBorderTopRightRadius,
-                                        CSSPropertyWebkitBorderTopLeftRadius,
-                                        CSSPropertyWebkitBorderBottomLeftRadius,
-                                        CSSPropertyWebkitBorderBottomRightRadius };
-            for (int i = 0; i < 4; i++)
-                addProperty(properties[i], val.get(), important);
-        } else
-            addProperty(propId, val.release(), important);
+        addProperty(propId, val.release(), important);
         return true;
     }
+    case CSSPropertyBorderRadius:
+    case CSSPropertyWebkitBorderRadius:
+        return parseBorderRadius(propId, important);
     case CSSPropertyOutlineOffset:
         valid_primitive = validUnit(value, FLength, m_strict);
         break;
@@ -1267,6 +1272,28 @@ bool CSSParser::parseValue(int propId, bool important)
         else
             valid_primitive = validUnit(value, FTime|FInteger|FNonNeg, m_strict);
         break;
+#if ENABLE(WCSS)
+    case CSSPropertyWapMarqueeDir:
+        if (id == CSSValueLtr || id == CSSValueRtl)
+            valid_primitive = true;
+        break;
+    case CSSPropertyWapMarqueeStyle:
+        if (id == CSSValueNone || id == CSSValueSlide || id == CSSValueScroll || id == CSSValueAlternate)
+            valid_primitive = true;
+        break;
+    case CSSPropertyWapMarqueeLoop:
+        if (id == CSSValueInfinite)
+            valid_primitive = true;
+        else
+            valid_primitive = validUnit(value, FInteger | FNonNeg, m_strict);
+        break;
+    case CSSPropertyWapMarqueeSpeed:
+        if (id == CSSValueNormal || id == CSSValueSlow || id == CSSValueFast)
+            valid_primitive = true;
+        else
+            valid_primitive = validUnit(value, FTime | FInteger | FNonNeg, m_strict);
+        break;
+#endif
     case CSSPropertyWebkitUserDrag: // auto | none | element
         if (id == CSSValueAuto || id == CSSValueNone || id == CSSValueElement)
             valid_primitive = true;
@@ -1354,6 +1381,7 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyWebkitAnimationDirection:
     case CSSPropertyWebkitAnimationDuration:
     case CSSPropertyWebkitAnimationName:
+    case CSSPropertyWebkitAnimationPlayState:
     case CSSPropertyWebkitAnimationIterationCount:
     case CSSPropertyWebkitAnimationTimingFunction:
     case CSSPropertyWebkitTransitionDelay:
@@ -1495,6 +1523,12 @@ bool CSSParser::parseValue(int propId, bool important)
             valid_primitive = true;
         break;
 
+    case CSSPropertyWebkitFontSmoothing:
+        if (id == CSSValueAuto || id == CSSValueNone 
+            || id == CSSValueAntialiased || id == CSSValueSubpixelAntialiased)
+            valid_primitive = true;
+        break;
+
 #if ENABLE(DASHBOARD_SUPPORT)
     case CSSPropertyWebkitDashboardRegion:                 // <dashboard-region> | <dashboard-region> 
         if (value->unit == CSSParserValue::Function || id == CSSValueNone)
@@ -1507,7 +1541,7 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyBackground: {
         // Position must come before color in this array because a plain old "0" is a legal color
         // in quirks mode but it's usually the X coordinate of a position.
-        // FIXME: Add CSSPropertyWebkitBackgroundSize to the shorthand.
+        // FIXME: Add CSSPropertyBackgroundSize to the shorthand.
         const int properties[] = { CSSPropertyBackgroundImage, CSSPropertyBackgroundRepeat, 
                                    CSSPropertyBackgroundAttachment, CSSPropertyBackgroundPosition, CSSPropertyBackgroundOrigin, 
                                    CSSPropertyBackgroundColor };
@@ -1681,7 +1715,7 @@ void CSSParser::addFillValue(RefPtr<CSSValue>& lval, PassRefPtr<CSSValue> rval)
         lval = rval;
 }
 
-const int cMaxFillProperties = 7;
+const int cMaxFillProperties = 9;
 
 bool CSSParser::parseFillShorthand(int propId, const int* properties, int numProperties, bool important)
 {
@@ -1695,6 +1729,7 @@ bool CSSParser::parseFillShorthand(int propId, const int* properties, int numPro
     RefPtr<CSSValue> values[cMaxFillProperties];
     RefPtr<CSSValue> clipValue;
     RefPtr<CSSValue> positionYValue;
+    RefPtr<CSSValue> repeatYValue;
     int i;
 
     while (m_valueList->current()) {
@@ -1712,6 +1747,8 @@ bool CSSParser::parseFillShorthand(int propId, const int* properties, int numPro
                     addFillValue(values[i], CSSInitialValue::createImplicit());
                     if (properties[i] == CSSPropertyBackgroundPosition || properties[i] == CSSPropertyWebkitMaskPosition)
                         addFillValue(positionYValue, CSSInitialValue::createImplicit());
+                    if (properties[i] == CSSPropertyBackgroundRepeat || properties[i] == CSSPropertyWebkitMaskRepeat)
+                        addFillValue(repeatYValue, CSSInitialValue::createImplicit());
                     if ((properties[i] == CSSPropertyBackgroundOrigin || properties[i] == CSSPropertyWebkitMaskOrigin) && !parsedProperty[i]) {
                         // If background-origin wasn't present, then reset background-clip also.
                         addFillValue(clipValue, CSSInitialValue::createImplicit());
@@ -1734,6 +1771,8 @@ bool CSSParser::parseFillShorthand(int propId, const int* properties, int numPro
                     addFillValue(values[i], val1.release());
                     if (properties[i] == CSSPropertyBackgroundPosition || properties[i] == CSSPropertyWebkitMaskPosition)
                         addFillValue(positionYValue, val2.release());
+                    if (properties[i] == CSSPropertyBackgroundRepeat || properties[i] == CSSPropertyWebkitMaskRepeat)
+                        addFillValue(repeatYValue, val2.release());
                     if (properties[i] == CSSPropertyBackgroundOrigin || properties[i] == CSSPropertyWebkitMaskOrigin) {
                         // Reparse the value as a clip, and see if we succeed.
                         if (parseFillProperty(CSSPropertyBackgroundClip, propId1, propId2, val1, val2))
@@ -1757,6 +1796,8 @@ bool CSSParser::parseFillShorthand(int propId, const int* properties, int numPro
             addFillValue(values[i], CSSInitialValue::createImplicit());
             if (properties[i] == CSSPropertyBackgroundPosition || properties[i] == CSSPropertyWebkitMaskPosition)
                 addFillValue(positionYValue, CSSInitialValue::createImplicit());
+            if (properties[i] == CSSPropertyBackgroundRepeat || properties[i] == CSSPropertyWebkitMaskRepeat)
+                addFillValue(repeatYValue, CSSInitialValue::createImplicit());
             if ((properties[i] == CSSPropertyBackgroundOrigin || properties[i] == CSSPropertyWebkitMaskOrigin) && !parsedProperty[i]) {
                 // If background-origin wasn't present, then reset background-clip also.
                 addFillValue(clipValue, CSSInitialValue::createImplicit());
@@ -1774,6 +1815,14 @@ bool CSSParser::parseFillShorthand(int propId, const int* properties, int numPro
             addProperty(CSSPropertyWebkitMaskPositionX, values[i].release(), important);
             // it's OK to call positionYValue.release() since we only see CSSPropertyWebkitMaskPosition once
             addProperty(CSSPropertyWebkitMaskPositionY, positionYValue.release(), important);
+        } else if (properties[i] == CSSPropertyBackgroundRepeat) {
+            addProperty(CSSPropertyBackgroundRepeatX, values[i].release(), important);
+            // it's OK to call repeatYValue.release() since we only see CSSPropertyBackgroundPosition once
+            addProperty(CSSPropertyBackgroundRepeatY, repeatYValue.release(), important);
+        } else if (properties[i] == CSSPropertyWebkitMaskRepeat) {
+            addProperty(CSSPropertyWebkitMaskRepeatX, values[i].release(), important);
+            // it's OK to call repeatYValue.release() since we only see CSSPropertyBackgroundPosition once
+            addProperty(CSSPropertyWebkitMaskRepeatY, repeatYValue.release(), important);
         } else
             addProperty(properties[i], values[i].release(), important);
             
@@ -2214,9 +2263,59 @@ void CSSParser::parseFillPosition(RefPtr<CSSValue>& value1, RefPtr<CSSValue>& va
         value1.swap(value2);
 }
 
-PassRefPtr<CSSValue> CSSParser::parseFillSize()
+void CSSParser::parseFillRepeat(RefPtr<CSSValue>& value1, RefPtr<CSSValue>& value2)
 {
     CSSParserValue* value = m_valueList->current();
+
+    int id = m_valueList->current()->id;
+    if (id == CSSValueRepeatX) {
+        m_implicitShorthand = true;
+        value1 = CSSPrimitiveValue::createIdentifier(CSSValueRepeat);
+        value2 = CSSPrimitiveValue::createIdentifier(CSSValueNoRepeat);
+        m_valueList->next();
+        return;
+    } 
+    if (id == CSSValueRepeatY) {
+        m_implicitShorthand = true;
+        value1 = CSSPrimitiveValue::createIdentifier(CSSValueNoRepeat);
+        value2 = CSSPrimitiveValue::createIdentifier(CSSValueRepeat);
+        m_valueList->next();
+        return;    
+    }
+    if (id == CSSValueRepeat || id == CSSValueNoRepeat || id == CSSValueRound || id == CSSValueSpace)
+        value1 = CSSPrimitiveValue::createIdentifier(id);
+    else {
+        value1 = 0;
+        return;
+    }
+
+    value = m_valueList->next();
+
+    // First check for the comma.  If so, we are finished parsing this value or value pair.
+    if (value && value->unit == CSSParserValue::Operator && value->iValue == ',')
+        value = 0;
+
+    if (value)
+        id = m_valueList->current()->id;
+    
+    if (value && (id == CSSValueRepeat || id == CSSValueNoRepeat || id == CSSValueRound || id == CSSValueSpace)) {
+        value2 = CSSPrimitiveValue::createIdentifier(id);
+        m_valueList->next();
+    } else { 
+        // If only one value was specified, value2 is the same as value1.
+        m_implicitShorthand = true;
+        value2 = CSSPrimitiveValue::createIdentifier(static_cast<CSSPrimitiveValue*>(value1.get())->getIdent());
+    }
+}
+
+PassRefPtr<CSSValue> CSSParser::parseFillSize(bool& allowComma)
+{
+    allowComma = true;
+    CSSParserValue* value = m_valueList->current();
+
+    if (value->id == CSSValueContain || value->id == CSSValueCover)
+        return CSSPrimitiveValue::createIdentifier(value->id);
+
     RefPtr<CSSPrimitiveValue> parsedValue1;
     
     if (value->id == CSSValueAuto)
@@ -2231,6 +2330,8 @@ PassRefPtr<CSSValue> CSSParser::parseFillSize()
     if ((value = m_valueList->next())) {
         if (value->id == CSSValueAuto)
             parsedValue2 = CSSPrimitiveValue::create(0, CSSPrimitiveValue::CSS_UNKNOWN);
+        else if (value->unit == CSSParserValue::Operator && value->iValue == ',')
+            allowComma = false;
         else {
             if (!validUnit(value, FLength|FPercent, m_strict))
                 return 0;
@@ -2261,6 +2362,12 @@ bool CSSParser::parseFillProperty(int propId, int& propId1, int& propId2,
     } else if (propId == CSSPropertyWebkitMaskPosition) {
         propId1 = CSSPropertyWebkitMaskPositionX;
         propId2 = CSSPropertyWebkitMaskPositionY;
+    } else if (propId == CSSPropertyBackgroundRepeat) {
+        propId1 = CSSPropertyBackgroundRepeatX;
+        propId2 = CSSPropertyBackgroundRepeatY;
+    } else if (propId == CSSPropertyWebkitMaskRepeat) {
+        propId1 = CSSPropertyWebkitMaskRepeatX;
+        propId2 = CSSPropertyWebkitMaskRepeatY;
     }
 
     while ((val = m_valueList->current())) {
@@ -2273,6 +2380,7 @@ bool CSSParser::parseFillProperty(int propId, int& propId1, int& propId2,
             m_valueList->next();
             allowComma = false;
         } else {
+            allowComma = true;
             switch (propId) {
                 case CSSPropertyBackgroundColor:
                     currValue = parseBackgroundColor();
@@ -2347,17 +2455,16 @@ bool CSSParser::parseFillProperty(int propId, int& propId1, int& propId2,
                     break;
                 case CSSPropertyBackgroundRepeat:
                 case CSSPropertyWebkitMaskRepeat:
-                    if (val->id >= CSSValueRepeat && val->id <= CSSValueNoRepeat) {
-                        currValue = CSSPrimitiveValue::createIdentifier(val->id);
-                        m_valueList->next();
-                    }
+                    parseFillRepeat(currValue, currValue2);
+                    // parseFillRepeat advances the m_valueList pointer
                     break;
-                case CSSPropertyWebkitBackgroundSize:
-                case CSSPropertyWebkitMaskSize:
-                    currValue = parseFillSize();
+                case CSSPropertyBackgroundSize:
+                case CSSPropertyWebkitMaskSize: {
+                    currValue = parseFillSize(allowComma);
                     if (currValue)
                         m_valueList->next();
                     break;
+                }
             }
             if (!currValue)
                 return false;
@@ -2382,7 +2489,6 @@ bool CSSParser::parseFillProperty(int propId, int& propId1, int& propId2,
                 else
                     value2 = currValue2.release();
             }
-            allowComma = true;
         }
         
         // When parsing any fill shorthand property, we let it handle building up the lists for all
@@ -2452,6 +2558,14 @@ PassRefPtr<CSSValue> CSSParser::parseAnimationName()
     return 0;
 }
 
+PassRefPtr<CSSValue> CSSParser::parseAnimationPlayState()
+{
+    CSSParserValue* value = m_valueList->current();
+    if (value->id == CSSValueRunning || value->id == CSSValuePaused)
+        return CSSPrimitiveValue::createIdentifier(value->id);
+    return 0;
+}
+
 PassRefPtr<CSSValue> CSSParser::parseAnimationProperty()
 {
     CSSParserValue* value = m_valueList->current();
@@ -2573,6 +2687,11 @@ bool CSSParser::parseAnimationProperty(int propId, RefPtr<CSSValue>& result)
                     if (currValue)
                         m_valueList->next();
                     break;
+                case CSSPropertyWebkitAnimationPlayState:
+                    currValue = parseAnimationPlayState();
+                    if (currValue)
+                        m_valueList->next();
+                    break;
                 case CSSPropertyWebkitTransitionProperty:
                     currValue = parseAnimationProperty();
                     if (currValue)
@@ -3895,6 +4014,75 @@ bool CSSParser::parseBorderImage(int propId, bool important, RefPtr<CSSValue>& r
     return false;
 }
 
+static void completeBorderRadii(RefPtr<CSSPrimitiveValue> radii[4])
+{
+    if (radii[3])
+        return;
+    if (!radii[2]) {
+        if (!radii[1])
+            radii[1] = radii[0];
+        radii[2] = radii[0];
+    }
+    radii[3] = radii[1];
+}
+
+bool CSSParser::parseBorderRadius(int propId, bool important)
+{
+    unsigned num = m_valueList->size();
+    if (num > 9)
+        return false;
+
+    RefPtr<CSSPrimitiveValue> radii[2][4];
+
+    unsigned indexAfterSlash = 0;
+    for (unsigned i = 0; i < num; ++i) {
+        CSSParserValue* value = m_valueList->valueAt(i);
+        if (value->unit == CSSParserValue::Operator) {
+            if (value->iValue != '/')
+                return false;
+
+            if (!i || indexAfterSlash || i + 1 == num || num > i + 5)
+                return false;
+
+            indexAfterSlash = i + 1;
+            completeBorderRadii(radii[0]);
+            continue;
+        }
+
+        if (i - indexAfterSlash >= 4)
+            return false;
+
+        if (!validUnit(value, FLength, m_strict))
+            return false;
+
+        RefPtr<CSSPrimitiveValue> radius = CSSPrimitiveValue::create(value->fValue, static_cast<CSSPrimitiveValue::UnitTypes>(value->unit));
+
+        if (!indexAfterSlash) {
+            radii[0][i] = radius;
+
+            // Legacy syntax: -webkit-border-radius: l1 l2; is equivalent to border-radius: l1 / l2;
+            if (num == 2 && propId == CSSPropertyWebkitBorderRadius) {
+                indexAfterSlash = 1;
+                completeBorderRadii(radii[0]);
+            }
+        } else
+            radii[1][i - indexAfterSlash] = radius.release();
+    }
+
+    if (!indexAfterSlash) {
+        completeBorderRadii(radii[0]);
+        for (unsigned i = 0; i < 4; ++i)
+            radii[1][i] = radii[0][i];
+    } else
+        completeBorderRadii(radii[1]);
+
+    addProperty(CSSPropertyBorderTopLeftRadius, CSSPrimitiveValue::create(Pair::create(radii[0][0].release(), radii[1][0].release())), important);
+    addProperty(CSSPropertyBorderTopRightRadius, CSSPrimitiveValue::create(Pair::create(radii[0][1].release(), radii[1][1].release())), important);
+    addProperty(CSSPropertyBorderBottomRightRadius, CSSPrimitiveValue::create(Pair::create(radii[0][2].release(), radii[1][2].release())), important);
+    addProperty(CSSPropertyBorderBottomLeftRadius, CSSPrimitiveValue::create(Pair::create(radii[0][3].release(), radii[1][3].release())), important);
+    return true;
+}
+
 bool CSSParser::parseCounter(int propId, int defaultValue, bool important)
 {
     enum { ID, VAL } state = ID;
@@ -4593,7 +4781,7 @@ UChar* CSSParser::text(int *length)
 
 CSSSelector* CSSParser::createFloatingSelector()
 {
-    CSSSelector* selector = new CSSSelector;
+    CSSSelector* selector = fastNew<CSSSelector>();
     m_floatingSelectors.add(selector);
     return selector;
 }
@@ -4988,6 +5176,21 @@ static int cssPropertyID(const UChar* propertyName, unsigned length)
                 const char* const boxShadow = "box-shadow";
                 name = boxShadow;
                 length = strlen(boxShadow);
+            } else if (strcmp(buffer, "-webkit-background-size") == 0) {
+                // CSS Backgrounds/Borders.  -webkit-background-size worked in Safari 4 and earlier.
+                const char* const backgroundSize = "background-size";
+                name = backgroundSize;
+                length = strlen(backgroundSize);
+            } else if (hasPrefix(buffer + 7, length - 7, "-border-")) {
+                // -webkit-border-*-*-radius worked in Safari 4 and earlier. -webkit-border-radius syntax
+                // differs from border-radius, so it is remains as a distinct property.
+                if (!strcmp(buffer + 15, "top-left-radius")
+                        || !strcmp(buffer + 15, "top-right-radius")
+                        || !strcmp(buffer + 15, "bottom-right-radius")
+                        || !strcmp(buffer + 15, "bottom-left-radius")) {
+                    name = buffer + 8;
+                    length -= 8;
+                }
             }
         }
     }
diff --git a/src/3rdparty/webkit/WebCore/css/CSSParser.h b/src/3rdparty/webkit/WebCore/css/CSSParser.h
index d4b92f5..1a156da 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSParser.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSParser.h
@@ -82,7 +82,8 @@ namespace WebCore {
         bool parseFillImage(RefPtr<CSSValue>&);
         PassRefPtr<CSSValue> parseFillPositionXY(bool& xFound, bool& yFound);
         void parseFillPosition(RefPtr<CSSValue>&, RefPtr<CSSValue>&);
-        PassRefPtr<CSSValue> parseFillSize();
+        void parseFillRepeat(RefPtr<CSSValue>&, RefPtr<CSSValue>&);
+        PassRefPtr<CSSValue> parseFillSize(bool &allowComma);
         
         bool parseFillProperty(int propId, int& propId1, int& propId2, RefPtr<CSSValue>&, RefPtr<CSSValue>&);
         bool parseFillShorthand(int propId, const int* properties, int numProperties, bool important);
@@ -96,6 +97,7 @@ namespace WebCore {
         PassRefPtr<CSSValue> parseAnimationDuration();
         PassRefPtr<CSSValue> parseAnimationIterationCount();
         PassRefPtr<CSSValue> parseAnimationName();
+        PassRefPtr<CSSValue> parseAnimationPlayState();
         PassRefPtr<CSSValue> parseAnimationProperty();
         PassRefPtr<CSSValue> parseAnimationTimingFunction();
 
@@ -139,6 +141,7 @@ namespace WebCore {
         // CSS3 Parsing Routines (for properties specific to CSS3)
         bool parseShadow(int propId, bool important);
         bool parseBorderImage(int propId, bool important, RefPtr<CSSValue>&);
+        bool parseBorderRadius(int propId, bool important);
         
         bool parseReflect(int propId, bool important);
 
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp
index 6343dac..1f2c9ca 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp
@@ -643,7 +643,7 @@ Rect* CSSPrimitiveValue::getRectValue(ExceptionCode& ec) const
     return m_value.rect;
 }
 
-RGBColor* CSSPrimitiveValue::getRGBColorValue(ExceptionCode& ec) const
+PassRefPtr<RGBColor> CSSPrimitiveValue::getRGBColorValue(ExceptionCode& ec) const
 {
     ec = 0;
     if (m_type != CSS_RGBCOLOR) {
@@ -652,7 +652,7 @@ RGBColor* CSSPrimitiveValue::getRGBColorValue(ExceptionCode& ec) const
     }
 
     // FIMXE: This should not return a new object for each invocation.
-    return RGBColor::create(m_value.rgbcolor).releaseRef();
+    return RGBColor::create(m_value.rgbcolor);
 }
 
 Pair* CSSPrimitiveValue::getPairValue(ExceptionCode& ec) const
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.h b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.h
index 85a0ba3..d417619 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.h
@@ -152,7 +152,7 @@ public:
     Rect* getRectValue(ExceptionCode&) const;
     Rect* getRectValue() const { return m_type != CSS_RECT ? 0 : m_value.rect; }
 
-    RGBColor* getRGBColorValue(ExceptionCode&) const;
+    PassRefPtr<RGBColor> getRGBColorValue(ExceptionCode&) const;
     RGBA32 getRGBA32Value() const { return m_type != CSS_RGBCOLOR ? 0 : m_value.rgbcolor; }
 
     Pair* getPairValue(ExceptionCode&) const;
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h
index 69cfbb1..70b21c4 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2007 Alexey Proskuryakov <ap@nypop.com>.
  * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -227,6 +228,15 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ControlPart e)
         case MediaSliderThumbPart:
             m_value.ident = CSSValueMediaSliderthumb;
             break;
+        case MediaVolumeSliderContainerPart:
+            m_value.ident = CSSValueMediaVolumeSliderContainer;
+            break;
+        case MediaVolumeSliderPart:
+            m_value.ident = CSSValueMediaVolumeSlider;
+            break;
+        case MediaVolumeSliderThumbPart:
+            m_value.ident = CSSValueMediaVolumeSliderthumb;
+            break;
         case MediaControlsBackgroundPart:
             m_value.ident = CSSValueMediaControlsBackground;
             break;
@@ -375,15 +385,15 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EFillRepeat e)
         case RepeatFill:
             m_value.ident = CSSValueRepeat;
             break;
-        case RepeatXFill:
-            m_value.ident = CSSValueRepeatX;
-            break;
-        case RepeatYFill:
-            m_value.ident = CSSValueRepeatY;
-            break;
         case NoRepeatFill:
             m_value.ident = CSSValueNoRepeat;
             break;
+        case RoundFill:
+            m_value.ident = CSSValueRound;
+            break;
+        case SpaceFill:
+            m_value.ident = CSSValueSpace;
+            break;
     }
 }
 
@@ -392,12 +402,12 @@ template<> inline CSSPrimitiveValue::operator EFillRepeat() const
     switch (m_value.ident) {
         case CSSValueRepeat:
             return RepeatFill;
-        case CSSValueRepeatX:
-            return RepeatXFill;
-        case CSSValueRepeatY:
-            return RepeatYFill;
         case CSSValueNoRepeat:
             return NoRepeatFill;
+        case CSSValueRound:
+            return RoundFill;
+        case CSSValueSpace:
+            return SpaceFill;
         default:
             ASSERT_NOT_REACHED();
             return RepeatFill;
@@ -522,6 +532,7 @@ template<> inline CSSPrimitiveValue::operator EBoxOrient() const
         case CSSValueInlineAxis:
             return HORIZONTAL;
         case CSSValueVertical:
+        case CSSValueBlockAxis:
             return VERTICAL;
         default:
             ASSERT_NOT_REACHED();
@@ -777,6 +788,11 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EDisplay e)
         case TABLE_CAPTION:
             m_value.ident = CSSValueTableCaption;
             break;
+#if ENABLE(WCSS)
+        case WAP_MARQUEE:
+            m_value.ident = CSSValueWapMarquee;
+            break;
+#endif
         case BOX:
             m_value.ident = CSSValueWebkitBox;
             break;
@@ -1782,6 +1798,45 @@ template<> inline CSSPrimitiveValue::operator EPointerEvents() const
     }
 }
 
+template<> inline CSSPrimitiveValue::CSSPrimitiveValue(FontSmoothing smoothing)
+    : m_type(CSS_IDENT)
+{
+    switch (smoothing) {
+    case AutoSmoothing:
+        m_value.ident = CSSValueAuto;
+        return;
+    case NoSmoothing:
+        m_value.ident = CSSValueNone;
+        return;
+    case Antialiased:
+        m_value.ident = CSSValueAntialiased;
+        return;
+    case SubpixelAntialiased:
+        m_value.ident = CSSValueSubpixelAntialiased;
+        return;
+    }
+    
+    ASSERT_NOT_REACHED();
+    m_value.ident = CSSValueAuto;
+}
+
+template<> inline CSSPrimitiveValue::operator FontSmoothing() const
+{
+    switch (m_value.ident) {
+    case CSSValueAuto:
+        return AutoSmoothing;
+    case CSSValueNone:
+        return NoSmoothing;
+    case CSSValueAntialiased:
+        return Antialiased;
+    case CSSValueSubpixelAntialiased:
+        return SubpixelAntialiased;
+    }
+    
+    ASSERT_NOT_REACHED();
+    return AutoSmoothing;
+}
+
 #if ENABLE(SVG)
 
 template<> inline CSSPrimitiveValue::CSSPrimitiveValue(LineCap e)
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPropertyLonghand.cpp b/src/3rdparty/webkit/WebCore/css/CSSPropertyLonghand.cpp
index a907235..b45fa0d 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPropertyLonghand.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSPropertyLonghand.cpp
@@ -77,6 +77,9 @@ static void initShorthandMap(ShorthandMap& shorthandMap)
     static const int backgroundPositionProperties[] = { CSSPropertyBackgroundPositionX, CSSPropertyBackgroundPositionY };
     SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBackgroundPosition, backgroundPositionProperties);
 
+    static const int backgroundRepeatProperties[] = { CSSPropertyBackgroundRepeatX, CSSPropertyBackgroundRepeatY };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBackgroundRepeat, backgroundRepeatProperties);
+
     static const int borderSpacingProperties[] = { CSSPropertyWebkitBorderHorizontalSpacing, CSSPropertyWebkitBorderVerticalSpacing };
     SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderSpacing, borderSpacingProperties);
 
@@ -134,7 +137,8 @@ static void initShorthandMap(ShorthandMap& shorthandMap)
         CSSPropertyBackgroundOrigin,
         CSSPropertyBackgroundPositionX,
         CSSPropertyBackgroundPositionY,
-        CSSPropertyBackgroundRepeat,
+        CSSPropertyBackgroundRepeatX,
+        CSSPropertyBackgroundRepeatY
     };
     SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBackground, backgroundProperties);
 
@@ -152,16 +156,20 @@ static void initShorthandMap(ShorthandMap& shorthandMap)
     SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyOverflow, overflowProperties);
 
     static const int borderRadiusProperties[] = {
-        CSSPropertyWebkitBorderTopRightRadius,
-        CSSPropertyWebkitBorderTopLeftRadius,
-        CSSPropertyWebkitBorderBottomLeftRadius,
-        CSSPropertyWebkitBorderBottomRightRadius
+        CSSPropertyBorderTopRightRadius,
+        CSSPropertyBorderTopLeftRadius,
+        CSSPropertyBorderBottomLeftRadius,
+        CSSPropertyBorderBottomRightRadius
     };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderRadius, borderRadiusProperties);
     SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitBorderRadius, borderRadiusProperties);
 
     static const int maskPositionProperties[] = { CSSPropertyWebkitMaskPositionX, CSSPropertyWebkitMaskPositionY };
     SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitMaskPosition, maskPositionProperties);
 
+    static const int maskRepeatProperties[] = { CSSPropertyWebkitMaskRepeatX, CSSPropertyWebkitMaskRepeatY };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitMaskRepeat, maskRepeatProperties);
+
     static const int maskProperties[] = {
         CSSPropertyWebkitMaskAttachment,
         CSSPropertyWebkitMaskClip,
@@ -169,7 +177,8 @@ static void initShorthandMap(ShorthandMap& shorthandMap)
         CSSPropertyWebkitMaskOrigin,
         CSSPropertyWebkitMaskPositionX,
         CSSPropertyWebkitMaskPositionY,
-        CSSPropertyWebkitMaskRepeat,
+        CSSPropertyWebkitMaskRepeatX,
+        CSSPropertyWebkitMaskRepeatY
     };
     SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitMask, maskProperties);
 
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in b/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in
index 49b2c3c..1bf526b 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in
+++ b/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in
@@ -18,9 +18,14 @@ background-position
 background-position-x
 background-position-y
 background-repeat
+background-repeat-x
+background-repeat-y
+background-size
 border
 border-bottom
 border-bottom-color
+border-bottom-left-radius
+border-bottom-right-radius
 border-bottom-style
 border-bottom-width
 border-collapse
@@ -29,6 +34,7 @@ border-left
 border-left-color
 border-left-style
 border-left-width
+border-radius
 border-right
 border-right-color
 border-right-style
@@ -37,6 +43,8 @@ border-spacing
 border-style
 border-top
 border-top-color
+border-top-left-radius
+border-top-right-radius
 border-top-style
 border-top-width
 border-width
@@ -145,22 +153,22 @@ zoom
 -webkit-animation-duration
 -webkit-animation-iteration-count
 -webkit-animation-name
+-webkit-animation-play-state
 -webkit-animation-timing-function
 -webkit-appearance
 -webkit-backface-visibility
 -webkit-background-clip
 -webkit-background-composite
 -webkit-background-origin
--webkit-background-size
 -webkit-binding
--webkit-border-bottom-left-radius
--webkit-border-bottom-right-radius
 -webkit-border-fit
 -webkit-border-horizontal-spacing
 -webkit-border-image
+
+# -webkit-border-radius differs from border-radius only in the interpretation of
+# a value consisting of two lengths: "-webkit-border-radius: l1 l2;" is equivalent
+# to "border-radius: l1 / l2;"
 -webkit-border-radius
--webkit-border-top-left-radius
--webkit-border-top-right-radius
 -webkit-border-vertical-spacing
 -webkit-box-align
 -webkit-box-direction
@@ -184,6 +192,7 @@ zoom
 -webkit-column-width
 -webkit-columns
 -webkit-font-size-delta
+-webkit-font-smoothing
 -webkit-highlight
 -webkit-line-break
 -webkit-line-clamp
@@ -208,6 +217,8 @@ zoom
 -webkit-mask-position-x
 -webkit-mask-position-y
 -webkit-mask-repeat
+-webkit-mask-repeat-x
+-webkit-mask-repeat-y
 -webkit-mask-size
 -webkit-match-nearest-mail-blockquote-color
 -webkit-nbsp-mode
diff --git a/src/3rdparty/webkit/WebCore/css/CSSRuleList.idl b/src/3rdparty/webkit/WebCore/css/CSSRuleList.idl
index 224d6a1..9add078 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSRuleList.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSRuleList.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,6 +27,7 @@ module css {
 
     // Introduced in DOM Level 2:
     interface [
+        CustomMarkFunction,
         GenerateConstructor,
         HasIndexGetter,
         InterfaceUUID=64c346a0-1e34-49d3-9472-57ec8e0fdccb,
diff --git a/src/3rdparty/webkit/WebCore/css/CSSSelector.cpp b/src/3rdparty/webkit/WebCore/css/CSSSelector.cpp
index 80910a7..9d9dd1b 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSSelector.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSSelector.cpp
@@ -77,9 +77,12 @@ void CSSSelector::extractPseudoType() const
     DEFINE_STATIC_LOCAL(AtomicString, before, ("before"));
     DEFINE_STATIC_LOCAL(AtomicString, checked, ("checked"));
     DEFINE_STATIC_LOCAL(AtomicString, fileUploadButton, ("-webkit-file-upload-button"));
+    DEFINE_STATIC_LOCAL(AtomicString, defaultString, ("default"));
     DEFINE_STATIC_LOCAL(AtomicString, disabled, ("disabled"));
     DEFINE_STATIC_LOCAL(AtomicString, readOnly, ("read-only"));
     DEFINE_STATIC_LOCAL(AtomicString, readWrite, ("read-write"));
+    DEFINE_STATIC_LOCAL(AtomicString, valid, ("valid"));
+    DEFINE_STATIC_LOCAL(AtomicString, invalid, ("invalid"));
     DEFINE_STATIC_LOCAL(AtomicString, drag, ("-webkit-drag"));
     DEFINE_STATIC_LOCAL(AtomicString, dragAlias, ("-khtml-drag")); // was documented with this name in Apple documentation, so keep an alia
     DEFINE_STATIC_LOCAL(AtomicString, empty, ("empty"));
@@ -105,6 +108,7 @@ void CSSSelector::extractPseudoType() const
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsMuteButton, ("-webkit-media-controls-mute-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsPlayButton, ("-webkit-media-controls-play-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsTimeline, ("-webkit-media-controls-timeline"));
+    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsVolumeSlider, ("-webkit-media-controls-volume-slider"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsSeekBackButton, ("-webkit-media-controls-seek-back-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsSeekForwardButton, ("-webkit-media-controls-seek-forward-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsRewindButton, ("-webkit-media-controls-rewind-button"));
@@ -112,6 +116,7 @@ void CSSSelector::extractPseudoType() const
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsStatusDisplay, ("-webkit-media-controls-status-display"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsFullscreenButton, ("-webkit-media-controls-fullscreen-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsTimelineContainer, ("-webkit-media-controls-timeline-container"));
+    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsVolumeSliderContainer, ("-webkit-media-controls-volume-slider-container"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsCurrentTimeDisplay, ("-webkit-media-controls-current-time-display"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsTimeRemainingDisplay, ("-webkit-media-controls-time-remaining-display"));
     DEFINE_STATIC_LOCAL(AtomicString, notStr, ("not("));
@@ -170,12 +175,18 @@ void CSSSelector::extractPseudoType() const
     else if (m_value == fileUploadButton) {
         m_pseudoType = PseudoFileUploadButton;
         element = true;
-    } else if (m_value == disabled)
+    } else if (m_value == defaultString)
+        m_pseudoType = PseudoDefault;
+    else if (m_value == disabled)
         m_pseudoType = PseudoDisabled;
     else if (m_value == readOnly)
         m_pseudoType = PseudoReadOnly;
     else if (m_value == readWrite)
         m_pseudoType = PseudoReadWrite;
+    else if (m_value == valid)
+        m_pseudoType = PseudoValid;
+    else if (m_value == invalid)
+        m_pseudoType = PseudoInvalid;
     else if (m_value == drag || m_value == dragAlias)
         m_pseudoType = PseudoDrag;
     else if (m_value == enabled)
@@ -235,6 +246,9 @@ void CSSSelector::extractPseudoType() const
     } else if (m_value == mediaControlsTimeline) {
         m_pseudoType = PseudoMediaControlsTimeline;
         element = true;
+    } else if (m_value == mediaControlsVolumeSlider) {
+        m_pseudoType = PseudoMediaControlsVolumeSlider;
+        element = true;
     } else if (m_value == mediaControlsSeekBackButton) {
         m_pseudoType = PseudoMediaControlsSeekBackButton;
         element = true;
@@ -256,6 +270,9 @@ void CSSSelector::extractPseudoType() const
     } else if (m_value == mediaControlsTimelineContainer) {
         m_pseudoType = PseudoMediaControlsTimelineContainer;
         element = true;
+    } else if (m_value == mediaControlsVolumeSliderContainer) {
+        m_pseudoType = PseudoMediaControlsVolumeSliderContainer;
+        element = true;
     } else if (m_value == notStr)
         m_pseudoType = PseudoNot;
     else if (m_value == nthChild)
diff --git a/src/3rdparty/webkit/WebCore/css/CSSSelector.h b/src/3rdparty/webkit/WebCore/css/CSSSelector.h
index 18251fd..7836136 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSSelector.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSSelector.h
@@ -126,12 +126,15 @@ namespace WebCore {
             PseudoChecked,
             PseudoEnabled,
             PseudoFullPageMedia,
+            PseudoDefault,
             PseudoDisabled,
             PseudoInputPlaceholder,
             PseudoOptional,
             PseudoRequired,
             PseudoReadOnly,
             PseudoReadWrite,
+            PseudoValid,
+            PseudoInvalid,
             PseudoIndeterminate,
             PseudoTarget,
             PseudoBefore,
@@ -170,9 +173,11 @@ namespace WebCore {
             PseudoMediaControlsMuteButton,
             PseudoMediaControlsPlayButton,
             PseudoMediaControlsTimelineContainer,
+            PseudoMediaControlsVolumeSliderContainer,
             PseudoMediaControlsCurrentTimeDisplay,
             PseudoMediaControlsTimeRemainingDisplay,
             PseudoMediaControlsTimeline,
+            PseudoMediaControlsVolumeSlider,
             PseudoMediaControlsSeekBackButton,
             PseudoMediaControlsSeekForwardButton,
             PseudoMediaControlsRewindButton,
diff --git a/src/3rdparty/webkit/WebCore/css/CSSSelectorList.cpp b/src/3rdparty/webkit/WebCore/css/CSSSelectorList.cpp
index 5ad3809..f12d64f 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSSelectorList.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSSelectorList.cpp
@@ -55,11 +55,9 @@ void CSSSelectorList::adoptSelectorVector(Vector<CSSSelector*>& selectorVector)
     m_selectorArray = reinterpret_cast<CSSSelector*>(fastMalloc(sizeof(CSSSelector) * selectorVector.size()));
     for (size_t i = 0; i < size; ++i) {
         memcpy(&m_selectorArray[i], selectorVector[i], sizeof(CSSSelector));
-        // We want to free the memory (which was allocated with new), but we
-        // don't want the destructor to run since it will affect the copy
-        // we've just made. In theory this is undefined, but operator delete
-        // is only defined taking a void*, so in practice it should be ok.
-        delete reinterpret_cast<char*>(selectorVector[i]);
+        // We want to free the memory (which was allocated with fastNew), but we
+        // don't want the destructor to run since it will affect the copy we've just made.
+        fastDeleteSkippingDestructor(selectorVector[i]);
         ASSERT(!m_selectorArray[i].isLastInSelectorList());
     }
     m_selectorArray[size - 1].setLastInSelectorList();
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.idl b/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.idl
index f7ce37f..3e37418 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -22,6 +22,7 @@ module css {
 
     // Introduced in DOM Level 2:
     interface [
+        CustomMarkFunction,
         GenerateConstructor,
         DelegatingPutFunction,
         HasNameGetter,
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
index 49e2c36..d6bcd39 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
@@ -408,7 +408,9 @@ static const MediaQueryEvaluator& printEval()
     return staticPrintEval;
 }
 
-CSSStyleSelector::CSSStyleSelector(Document* doc, const String& userStyleSheet, StyleSheetList* styleSheets, CSSStyleSheet* mappedElementSheet, bool strictParsing, bool matchAuthorAndUserStyles)
+CSSStyleSelector::CSSStyleSelector(Document* doc, StyleSheetList* styleSheets, CSSStyleSheet* mappedElementSheet,
+                                   CSSStyleSheet* pageUserSheet, const Vector<RefPtr<CSSStyleSheet> >* pageGroupUserSheets,
+                                   bool strictParsing, bool matchAuthorAndUserStyles)
     : m_backgroundData(BackgroundFillLayer)
     , m_checker(doc, strictParsing)
     , m_fontSelector(CSSFontSelector::create(doc))
@@ -449,12 +451,15 @@ CSSStyleSelector::CSSStyleSelector(Document* doc, const String& userStyleSheet,
     }
 
     // FIXME: This sucks! The user sheet is reparsed every time!
-    if (!userStyleSheet.isEmpty()) {
-        m_userSheet = CSSStyleSheet::create(doc);
-        m_userSheet->parseString(userStyleSheet, strictParsing);
-
+    if (pageUserSheet || pageGroupUserSheets) {
         m_userStyle = new CSSRuleSet();
-        m_userStyle->addRulesFromSheet(m_userSheet.get(), *m_medium, this);
+        if (pageUserSheet)
+            m_userStyle->addRulesFromSheet(pageUserSheet, *m_medium, this);
+        if (pageGroupUserSheets) {
+            unsigned length = pageGroupUserSheets->size();
+            for (unsigned i = 0; i < length; i++)
+                m_userStyle->addRulesFromSheet(pageGroupUserSheets->at(i).get(), *m_medium, this);
+        }
     }
 
     // add stylesheets from document
@@ -995,6 +1000,13 @@ bool CSSStyleSelector::canShareStyleWithElement(Node* n)
 
                 if (s->isEnabledFormControl() != m_element->isEnabledFormControl())
                     return false;
+
+                if (s->isDefaultButtonForForm() != m_element->isDefaultButtonForForm())
+                    return false;
+
+                if ((s->willValidate() && s->isValidFormControlElement()) !=
+                    (m_element->willValidate() && m_element->isValidFormControlElement()))
+                    return false;
             }
 
             if (style->transitions() || style->animations())
@@ -1318,8 +1330,13 @@ void CSSStyleSelector::keyframeStylesForAnimation(Element* e, const RenderStyle*
 
         // Add all the animating properties to the list
         CSSMutableStyleDeclaration::const_iterator end = kf->style()->end();
-        for (CSSMutableStyleDeclaration::const_iterator it = kf->style()->begin(); it != end; ++it)
-            list.addProperty((*it).id());
+        for (CSSMutableStyleDeclaration::const_iterator it = kf->style()->begin(); it != end; ++it) {
+            int property = (*it).id();
+            // Timing-function within keyframes is special, because it is not animated; it just
+            // describes the timing function between this keyframe and the next.
+            if (property != CSSPropertyWebkitAnimationTimingFunction)
+                list.addProperty(property);
+        }
         
         // Add this keyframe style to all the indicated key times
         Vector<float> keys;
@@ -2353,6 +2370,8 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
             case CSSSelector::PseudoFullPageMedia:
                 return e && e->document() && e->document()->isMediaDocument();
                 break;
+            case CSSSelector::PseudoDefault:
+                return e && e->isDefaultButtonForForm();
             case CSSSelector::PseudoDisabled:
                 if (e && e->isFormControlElement()) {
                     InputElement* inputElement = toInputElement(e);
@@ -2379,6 +2398,10 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
                 return e && e->isOptionalFormControl();
             case CSSSelector::PseudoRequired:
                 return e && e->isRequiredFormControl();
+            case CSSSelector::PseudoValid:
+                return e && e->willValidate() && e->isValidFormControlElement();
+            case CSSSelector::PseudoInvalid:
+                return e && e->willValidate() && !e->isValidFormControlElement();
             case CSSSelector::PseudoChecked: {
                 if (!e || !e->isFormControlElement())
                     break;
@@ -2489,7 +2512,10 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
                 return true;
             case CSSSelector::PseudoMediaControlsTimelineContainer:
                 dynamicPseudo = MEDIA_CONTROLS_TIMELINE_CONTAINER;
-                 return true;
+                return true;
+            case CSSSelector::PseudoMediaControlsVolumeSliderContainer:
+                dynamicPseudo = MEDIA_CONTROLS_VOLUME_SLIDER_CONTAINER;
+                return true;
             case CSSSelector::PseudoMediaControlsCurrentTimeDisplay:
                 dynamicPseudo = MEDIA_CONTROLS_CURRENT_TIME_DISPLAY;
                 return true;
@@ -2499,6 +2525,9 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
             case CSSSelector::PseudoMediaControlsTimeline:
                 dynamicPseudo = MEDIA_CONTROLS_TIMELINE;
                 return true;
+            case CSSSelector::PseudoMediaControlsVolumeSlider:
+                dynamicPseudo = MEDIA_CONTROLS_VOLUME_SLIDER;
+                return true;
             case CSSSelector::PseudoMediaControlsSeekBackButton:
                 dynamicPseudo = MEDIA_CONTROLS_SEEK_BACK_BUTTON;
                 return true;
@@ -2915,10 +2944,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitBackgroundOrigin:
         HANDLE_BACKGROUND_VALUE(origin, Origin, value)
         return;
-    case CSSPropertyBackgroundRepeat:
-        HANDLE_BACKGROUND_VALUE(repeat, Repeat, value)
-        return;
-    case CSSPropertyWebkitBackgroundSize:
+    case CSSPropertyBackgroundSize:
         HANDLE_BACKGROUND_VALUE(size, Size, value)
         return;
     case CSSPropertyWebkitMaskAttachment:
@@ -2933,9 +2959,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitMaskOrigin:
         HANDLE_MASK_VALUE(origin, Origin, value)
         return;
-    case CSSPropertyWebkitMaskRepeat:
-        HANDLE_MASK_VALUE(repeat, Repeat, value)
-        return;
     case CSSPropertyWebkitMaskSize:
         HANDLE_MASK_VALUE(size, Size, value)
         return;
@@ -2986,6 +3009,26 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     case CSSPropertyDisplay:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(display, Display)
+#if ENABLE(WCSS)
+        if (primitiveValue) {
+            if (primitiveValue->getIdent() == CSSValueWapMarquee) {
+                // Initialize Wap Marquee style
+                m_style->setOverflowX(OMARQUEE);
+                m_style->setOverflowY(OMARQUEE);
+                m_style->setWhiteSpace(NOWRAP);
+                m_style->setMarqueeDirection(MLEFT);
+                m_style->setMarqueeSpeed(85); // Normal speed
+                m_style->setMarqueeLoopCount(1);
+                m_style->setMarqueeBehavior(MSCROLL);
+
+                if (m_parentStyle)
+                    m_style->setDisplay(m_parentStyle->display());
+                else
+                    m_style->setDisplay(*primitiveValue);
+            } else
+                m_style->setDisplay(*primitiveValue);
+        }
+#endif
         return;
     case CSSPropertyEmptyCells:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(emptyCells, EmptyCells)
@@ -3202,6 +3245,26 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         HANDLE_MASK_VALUE(yPosition, YPosition, value)
         return;
     }
+    case CSSPropertyBackgroundRepeat:
+        HANDLE_BACKGROUND_INHERIT_AND_INITIAL(repeatX, RepeatX);
+        HANDLE_BACKGROUND_INHERIT_AND_INITIAL(repeatY, RepeatY);
+        return;
+    case CSSPropertyBackgroundRepeatX:
+        HANDLE_BACKGROUND_VALUE(repeatX, RepeatX, value)
+        return;
+    case CSSPropertyBackgroundRepeatY:
+        HANDLE_BACKGROUND_VALUE(repeatY, RepeatY, value)
+        return;
+    case CSSPropertyWebkitMaskRepeat:
+        HANDLE_MASK_INHERIT_AND_INITIAL(repeatX, RepeatX);
+        HANDLE_MASK_INHERIT_AND_INITIAL(repeatY, RepeatY);
+        return;
+    case CSSPropertyWebkitMaskRepeatX:
+        HANDLE_MASK_VALUE(repeatX, RepeatX, value)
+        return;
+    case CSSPropertyWebkitMaskRepeatY:
+        HANDLE_MASK_VALUE(repeatY, RepeatY, value)
+        return;
     case CSSPropertyBorderSpacing: {
         if (isInherit) {
             m_style->setHorizontalBorderSpacing(m_parentStyle->horizontalBorderSpacing());
@@ -3432,6 +3495,41 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     }
 
+    case CSSPropertyWebkitFontSmoothing: {
+        FontDescription fontDescription = m_style->fontDescription();
+        if (isInherit) 
+            fontDescription.setFontSmoothing(m_parentStyle->fontSmoothing());
+        else if (isInitial)
+            fontDescription.setFontSmoothing(AutoSmoothing);
+        else {
+            if (!primitiveValue)
+                return;
+            int id = primitiveValue->getIdent();
+            FontSmoothing smoothing;
+            switch (id) {
+                case CSSValueAuto:
+                    smoothing = AutoSmoothing;
+                    break;
+                case CSSValueNone:
+                    smoothing = NoSmoothing;
+                    break;
+                case CSSValueAntialiased:
+                    smoothing = Antialiased;
+                    break;
+                case CSSValueSubpixelAntialiased:
+                    smoothing = SubpixelAntialiased;
+                    break;
+                default:
+                    ASSERT_NOT_REACHED();
+                    smoothing = AutoSmoothing;
+            }
+            fontDescription.setFontSmoothing(smoothing);
+        }
+        if (m_style->setFontDescription(fontDescription))
+            m_fontDirty = true;
+        return;
+    }
+
     case CSSPropertyLetterSpacing:
     case CSSPropertyWordSpacing:
     {
@@ -3749,7 +3847,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     {
         FontDescription fontDescription = m_style->fontDescription();
         fontDescription.setKeywordSize(0);
-        bool familyIsFixed = fontDescription.genericFamily() == FontDescription::MonospaceFamily;
         float oldSize = 0;
         float size = 0;
         
@@ -3764,7 +3861,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             if (m_parentNode)
                 fontDescription.setKeywordSize(m_parentStyle->fontDescription().keywordSize());
         } else if (isInitial) {
-            size = fontSizeForKeyword(CSSValueMedium, m_style->htmlHacks(), familyIsFixed);
+            size = fontSizeForKeyword(CSSValueMedium, m_style->htmlHacks(), fontDescription.useFixedDefaultSize());
             fontDescription.setKeywordSize(CSSValueMedium - CSSValueXxSmall + 1);
         } else if (primitiveValue->getIdent()) {
             // Keywords are being used.
@@ -3777,7 +3874,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                 case CSSValueXLarge:
                 case CSSValueXxLarge:
                 case CSSValueWebkitXxxLarge:
-                    size = fontSizeForKeyword(primitiveValue->getIdent(), m_style->htmlHacks(), familyIsFixed);
+                    size = fontSizeForKeyword(primitiveValue->getIdent(), m_style->htmlHacks(), fontDescription.useFixedDefaultSize());
                     fontDescription.setKeywordSize(primitiveValue->getIdent() - CSSValueXxSmall + 1);
                     break;
                 case CSSValueLarger:
@@ -4020,13 +4117,12 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             if (m_style->setFontDescription(fontDescription))
                 m_fontDirty = true;
             return;
-        }
-        else if (isInitial) {
+        } else if (isInitial) {
             FontDescription initialDesc = FontDescription();
             FontDescription fontDescription = m_style->fontDescription();
             // We need to adjust the size to account for the generic family change from monospace
             // to non-monospace.
-            if (fontDescription.keywordSize() && fontDescription.genericFamily() == FontDescription::MonospaceFamily)
+            if (fontDescription.keywordSize() && fontDescription.useFixedDefaultSize())
                 setFontSize(fontDescription, fontSizeForKeyword(CSSValueXxSmall + fontDescription.keywordSize() - 1, m_style->htmlHacks(), false));
             fontDescription.setGenericFamily(initialDesc.genericFamily());
             if (!initialDesc.firstFamily().familyIsEmpty())
@@ -4036,21 +4132,23 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             return;
         }
         
-        if (!value->isValueList()) return;
+        if (!value->isValueList())
+            return;
         FontDescription fontDescription = m_style->fontDescription();
-        CSSValueList *list = static_cast<CSSValueList*>(value);
+        CSSValueList* list = static_cast<CSSValueList*>(value);
         int len = list->length();
         FontFamily& firstFamily = fontDescription.firstFamily();
-        FontFamily *currFamily = 0;
+        FontFamily* currFamily = 0;
         
         // Before mapping in a new font-family property, we should reset the generic family.
-        bool oldFamilyIsMonospace = fontDescription.genericFamily() == FontDescription::MonospaceFamily;
+        bool oldFamilyUsedFixedDefaultSize = fontDescription.useFixedDefaultSize();
         fontDescription.setGenericFamily(FontDescription::NoFamily);
 
         for (int i = 0; i < len; i++) {
-            CSSValue *item = list->itemWithoutBoundsCheck(i);
-            if (!item->isPrimitiveValue()) continue;
-            CSSPrimitiveValue *val = static_cast<CSSPrimitiveValue*>(item);
+            CSSValue* item = list->itemWithoutBoundsCheck(i);
+            if (!item->isPrimitiveValue())
+                continue;
+            CSSPrimitiveValue* val = static_cast<CSSPrimitiveValue*>(item);
             AtomicString face;
             Settings* settings = m_checker.m_document->settings();
             if (val->primitiveType() == CSSPrimitiveValue::CSS_STRING)
@@ -4082,28 +4180,32 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                         break;
                 }
             }
-    
+
             if (!face.isEmpty()) {
                 if (!currFamily) {
                     // Filling in the first family.
                     firstFamily.setFamily(face);
+                    firstFamily.appendFamily(0); // Remove any inherited family-fallback list.
                     currFamily = &firstFamily;
-                }
-                else {
+                } else {
                     RefPtr<SharedFontFamily> newFamily = SharedFontFamily::create();
                     newFamily->setFamily(face);
                     currFamily->appendFamily(newFamily);
                     currFamily = newFamily.get();
                 }
-    
-                if (fontDescription.keywordSize() && (fontDescription.genericFamily() == FontDescription::MonospaceFamily) != oldFamilyIsMonospace)
-                    setFontSize(fontDescription, fontSizeForKeyword(CSSValueXxSmall + fontDescription.keywordSize() - 1, m_style->htmlHacks(), !oldFamilyIsMonospace));
-            
-                if (m_style->setFontDescription(fontDescription))
-                    m_fontDirty = true;
             }
         }
-      return;
+
+        // We can't call useFixedDefaultSize() until all new font families have been added
+        // If currFamily is non-zero then we set at least one family on this description.
+        if (currFamily) {
+            if (fontDescription.keywordSize() && fontDescription.useFixedDefaultSize() != oldFamilyUsedFixedDefaultSize)
+                setFontSize(fontDescription, fontSizeForKeyword(CSSValueXxSmall + fontDescription.keywordSize() - 1, m_style->htmlHacks(), !oldFamilyUsedFixedDefaultSize));
+
+            if (m_style->setFontDescription(fontDescription))
+                m_fontDirty = true;
+        }
+        return;
     }
     case CSSPropertyTextDecoration: {
         // list of ident
@@ -4445,6 +4547,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     }
 
+    case CSSPropertyBorderRadius:
     case CSSPropertyWebkitBorderRadius:
         if (isInherit) {
             m_style->setBorderTopLeftRadius(m_parentStyle->borderTopLeftRadius());
@@ -4458,23 +4561,23 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             return;
         }
         // Fall through
-    case CSSPropertyWebkitBorderTopLeftRadius:
-    case CSSPropertyWebkitBorderTopRightRadius:
-    case CSSPropertyWebkitBorderBottomLeftRadius:
-    case CSSPropertyWebkitBorderBottomRightRadius: {
+    case CSSPropertyBorderTopLeftRadius:
+    case CSSPropertyBorderTopRightRadius:
+    case CSSPropertyBorderBottomLeftRadius:
+    case CSSPropertyBorderBottomRightRadius: {
         if (isInherit) {
-            HANDLE_INHERIT_COND(CSSPropertyWebkitBorderTopLeftRadius, borderTopLeftRadius, BorderTopLeftRadius)
-            HANDLE_INHERIT_COND(CSSPropertyWebkitBorderTopRightRadius, borderTopRightRadius, BorderTopRightRadius)
-            HANDLE_INHERIT_COND(CSSPropertyWebkitBorderBottomLeftRadius, borderBottomLeftRadius, BorderBottomLeftRadius)
-            HANDLE_INHERIT_COND(CSSPropertyWebkitBorderBottomRightRadius, borderBottomRightRadius, BorderBottomRightRadius)
+            HANDLE_INHERIT_COND(CSSPropertyBorderTopLeftRadius, borderTopLeftRadius, BorderTopLeftRadius)
+            HANDLE_INHERIT_COND(CSSPropertyBorderTopRightRadius, borderTopRightRadius, BorderTopRightRadius)
+            HANDLE_INHERIT_COND(CSSPropertyBorderBottomLeftRadius, borderBottomLeftRadius, BorderBottomLeftRadius)
+            HANDLE_INHERIT_COND(CSSPropertyBorderBottomRightRadius, borderBottomRightRadius, BorderBottomRightRadius)
             return;
         }
         
         if (isInitial) {
-            HANDLE_INITIAL_COND_WITH_VALUE(CSSPropertyWebkitBorderTopLeftRadius, BorderTopLeftRadius, BorderRadius)
-            HANDLE_INITIAL_COND_WITH_VALUE(CSSPropertyWebkitBorderTopRightRadius, BorderTopRightRadius, BorderRadius)
-            HANDLE_INITIAL_COND_WITH_VALUE(CSSPropertyWebkitBorderBottomLeftRadius, BorderBottomLeftRadius, BorderRadius)
-            HANDLE_INITIAL_COND_WITH_VALUE(CSSPropertyWebkitBorderBottomRightRadius, BorderBottomRightRadius, BorderRadius)
+            HANDLE_INITIAL_COND_WITH_VALUE(CSSPropertyBorderTopLeftRadius, BorderTopLeftRadius, BorderRadius)
+            HANDLE_INITIAL_COND_WITH_VALUE(CSSPropertyBorderTopRightRadius, BorderTopRightRadius, BorderRadius)
+            HANDLE_INITIAL_COND_WITH_VALUE(CSSPropertyBorderBottomLeftRadius, BorderBottomLeftRadius, BorderRadius)
+            HANDLE_INITIAL_COND_WITH_VALUE(CSSPropertyBorderBottomRightRadius, BorderBottomRightRadius, BorderRadius)
             return;
         }
 
@@ -4497,16 +4600,16 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
 
         IntSize size(width, height);
         switch (id) {
-            case CSSPropertyWebkitBorderTopLeftRadius:
+            case CSSPropertyBorderTopLeftRadius:
                 m_style->setBorderTopLeftRadius(size);
                 break;
-            case CSSPropertyWebkitBorderTopRightRadius:
+            case CSSPropertyBorderTopRightRadius:
                 m_style->setBorderTopRightRadius(size);
                 break;
-            case CSSPropertyWebkitBorderBottomLeftRadius:
+            case CSSPropertyBorderBottomLeftRadius:
                 m_style->setBorderBottomLeftRadius(size);
                 break;
-            case CSSPropertyWebkitBorderBottomRightRadius:
+            case CSSPropertyBorderBottomRightRadius:
                 m_style->setBorderBottomRightRadius(size);
                 break;
             default:
@@ -4736,6 +4839,9 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         m_style->setMarqueeLoopCount(m_parentStyle->marqueeLoopCount());
         m_style->setMarqueeBehavior(m_parentStyle->marqueeBehavior());
         return;
+#if ENABLE(WCSS)
+    case CSSPropertyWapMarqueeLoop:
+#endif
     case CSSPropertyWebkitMarqueeRepetition: {
         HANDLE_INHERIT_AND_INITIAL(marqueeLoopCount, MarqueeLoopCount)
         if (!primitiveValue)
@@ -4746,6 +4852,9 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             m_style->setMarqueeLoopCount(primitiveValue->getIntValue());
         return;
     }
+#if ENABLE(WCSS)
+    case CSSPropertyWapMarqueeSpeed:
+#endif
     case CSSPropertyWebkitMarqueeSpeed: {
         HANDLE_INHERIT_AND_INITIAL(marqueeSpeed, MarqueeSpeed)      
         if (!primitiveValue)
@@ -4796,9 +4905,30 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         }
         return;
     }
+#if ENABLE(WCSS)
+    case CSSPropertyWapMarqueeStyle:
+#endif
     case CSSPropertyWebkitMarqueeStyle:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(marqueeBehavior, MarqueeBehavior)      
         return;
+#if ENABLE(WCSS)
+    case CSSPropertyWapMarqueeDir:
+        HANDLE_INHERIT_AND_INITIAL(marqueeDirection, MarqueeDirection)
+        if (primitiveValue && primitiveValue->getIdent()) {
+            switch (primitiveValue->getIdent()) {
+            case CSSValueLtr:
+                m_style->setMarqueeDirection(MRIGHT);
+                break;
+            case CSSValueRtl:
+                m_style->setMarqueeDirection(MLEFT);
+                break;
+            default:
+                m_style->setMarqueeDirection(*primitiveValue);
+                break;
+            }
+        }
+        return;
+#endif
     case CSSPropertyWebkitMarqueeDirection:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(marqueeDirection, MarqueeDirection)
         return;
@@ -5067,6 +5197,9 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitAnimationName:
         HANDLE_ANIMATION_VALUE(name, Name, value)
         return;
+    case CSSPropertyWebkitAnimationPlayState:
+        HANDLE_ANIMATION_VALUE(playState, PlayState, value)
+        return;
     case CSSPropertyWebkitAnimationTimingFunction:
         HANDLE_ANIMATION_VALUE(timingFunction, TimingFunction, value)
         return;
@@ -5226,10 +5359,10 @@ void CSSStyleSelector::mapFillImage(FillLayer* layer, CSSValue* value)
     layer->setImage(styleImage(value));
 }
 
-void CSSStyleSelector::mapFillRepeat(FillLayer* layer, CSSValue* value)
+void CSSStyleSelector::mapFillRepeatX(FillLayer* layer, CSSValue* value)
 {
     if (value->cssValueType() == CSSValue::CSS_INITIAL) {
-        layer->setRepeat(FillLayer::initialFillRepeat(layer->type()));
+        layer->setRepeatX(FillLayer::initialFillRepeatX(layer->type()));
         return;
     }
     
@@ -5237,22 +5370,46 @@ void CSSStyleSelector::mapFillRepeat(FillLayer* layer, CSSValue* value)
         return;
 
     CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
-    layer->setRepeat(*primitiveValue);
+    layer->setRepeatX(*primitiveValue);
 }
 
-void CSSStyleSelector::mapFillSize(FillLayer* layer, CSSValue* value)
+void CSSStyleSelector::mapFillRepeatY(FillLayer* layer, CSSValue* value)
 {
-    LengthSize b = FillLayer::initialFillSize(layer->type());
-    
     if (value->cssValueType() == CSSValue::CSS_INITIAL) {
-        layer->setSize(b);
+        layer->setRepeatY(FillLayer::initialFillRepeatY(layer->type()));
         return;
     }
     
     if (!value->isPrimitiveValue())
         return;
-        
+
     CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
+    layer->setRepeatY(*primitiveValue);
+}
+
+void CSSStyleSelector::mapFillSize(FillLayer* layer, CSSValue* value)
+{
+    if (!value->isPrimitiveValue()) {
+        layer->setSizeType(SizeNone);
+        return;
+    }
+
+    CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
+    if (primitiveValue->getIdent() == CSSValueContain)
+        layer->setSizeType(Contain);
+    else if (primitiveValue->getIdent() == CSSValueCover)
+        layer->setSizeType(Cover);
+    else
+        layer->setSizeType(SizeLength);
+    
+    LengthSize b = FillLayer::initialFillSizeLength(layer->type());
+    
+    if (value->cssValueType() == CSSValue::CSS_INITIAL || primitiveValue->getIdent() == CSSValueContain
+        || primitiveValue->getIdent() == CSSValueCover) {
+        layer->setSizeLength(b);
+        return;
+    }
+
     Pair* pair = primitiveValue->getPairValue();
     if (!pair)
         return;
@@ -5289,7 +5446,7 @@ void CSSStyleSelector::mapFillSize(FillLayer* layer, CSSValue* value)
     
     b.setWidth(firstLength);
     b.setHeight(secondLength);
-    layer->setSize(b);
+    layer->setSizeLength(b);
 }
 
 void CSSStyleSelector::mapFillXPosition(FillLayer* layer, CSSValue* value)
@@ -5414,6 +5571,18 @@ void CSSStyleSelector::mapAnimationName(Animation* layer, CSSValue* value)
         layer->setName(primitiveValue->getStringValue());
 }
 
+void CSSStyleSelector::mapAnimationPlayState(Animation* layer, CSSValue* value)
+{
+    if (value->cssValueType() == CSSValue::CSS_INITIAL) {
+        layer->setPlayState(Animation::initialAnimationPlayState());
+        return;
+    }
+
+    CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
+    EAnimPlayState playState = (primitiveValue->getIdent() == CSSValuePaused) ? AnimPlayStatePaused : AnimPlayStatePlaying;
+    layer->setPlayState(playState);
+}
+
 void CSSStyleSelector::mapAnimationProperty(Animation* animation, CSSValue* value)
 {
     if (value->cssValueType() == CSSValue::CSS_INITIAL) {
@@ -5555,8 +5724,7 @@ void CSSStyleSelector::checkForGenericFamilyChange(RenderStyle* style, RenderSty
         return;
 
     const FontDescription& parentFont = parentStyle->fontDescription();
-
-    if (childFont.genericFamily() == parentFont.genericFamily())
+    if (childFont.useFixedDefaultSize() == parentFont.useFixedDefaultSize())
         return;
 
     // For now, lump all families but monospace together.
@@ -5569,17 +5737,16 @@ void CSSStyleSelector::checkForGenericFamilyChange(RenderStyle* style, RenderSty
     // If the font uses a keyword size, then we refetch from the table rather than
     // multiplying by our scale factor.
     float size;
-    if (childFont.keywordSize()) {
-        size = fontSizeForKeyword(CSSValueXxSmall + childFont.keywordSize() - 1, style->htmlHacks(),
-                                  childFont.genericFamily() == FontDescription::MonospaceFamily);
-    } else {
+    if (childFont.keywordSize())
+        size = fontSizeForKeyword(CSSValueXxSmall + childFont.keywordSize() - 1, style->htmlHacks(), childFont.useFixedDefaultSize());
+    else {
         Settings* settings = m_checker.m_document->settings();
         float fixedScaleFactor = settings
             ? static_cast<float>(settings->defaultFixedFontSize()) / settings->defaultFontSize()
             : 1;
-        size = (parentFont.genericFamily() == FontDescription::MonospaceFamily) ? 
-                childFont.specifiedSize()/fixedScaleFactor :
-                childFont.specifiedSize()*fixedScaleFactor;
+        size = parentFont.useFixedDefaultSize() ?
+                childFont.specifiedSize() / fixedScaleFactor :
+                childFont.specifiedSize() * fixedScaleFactor;
     }
 
     FontDescription newFontDescription(childFont);
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.h b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.h
index d86dd8c..6e0663f 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.h
@@ -80,7 +80,9 @@ public:
     // This class selects a RenderStyle for a given element based on a collection of stylesheets.
     class CSSStyleSelector : public Noncopyable {
     public:
-        CSSStyleSelector(Document*, const String& userStyleSheet, StyleSheetList*, CSSStyleSheet*, bool strictParsing, bool matchAuthorAndUserStyles);
+        CSSStyleSelector(Document*, StyleSheetList* authorSheets, CSSStyleSheet* mappedElementSheet,
+                         CSSStyleSheet* pageUserSheet, const Vector<RefPtr<CSSStyleSheet> >* pageGroupUserSheets,
+                         bool strictParsing, bool matchAuthorAndUserStyles);
         ~CSSStyleSelector();
 
         void initElementAndPseudoState(Element*);
@@ -175,7 +177,6 @@ public:
         
         CSSRuleSet* m_authorStyle;
         CSSRuleSet* m_userStyle;
-        RefPtr<CSSStyleSheet> m_userSheet;
 
         bool m_hasUAAppearance;
         BorderData m_borderData;
@@ -223,7 +224,8 @@ public:
         void mapFillComposite(FillLayer*, CSSValue*);
         void mapFillOrigin(FillLayer*, CSSValue*);
         void mapFillImage(FillLayer*, CSSValue*);
-        void mapFillRepeat(FillLayer*, CSSValue*);
+        void mapFillRepeatX(FillLayer*, CSSValue*);
+        void mapFillRepeatY(FillLayer*, CSSValue*);
         void mapFillSize(FillLayer*, CSSValue*);
         void mapFillXPosition(FillLayer*, CSSValue*);
         void mapFillYPosition(FillLayer*, CSSValue*);
@@ -233,6 +235,7 @@ public:
         void mapAnimationDuration(Animation*, CSSValue*);
         void mapAnimationIterationCount(Animation*, CSSValue*);
         void mapAnimationName(Animation*, CSSValue*);
+        void mapAnimationPlayState(Animation*, CSSValue*);
         void mapAnimationProperty(Animation*, CSSValue*);
         void mapAnimationTimingFunction(Animation*, CSSValue*);
 
@@ -295,7 +298,9 @@ public:
                 prev->m_next = this;
         }
 
-        ~CSSRuleData() { delete m_next; }
+        ~CSSRuleData() 
+        { 
+        }
 
         unsigned position() { return m_position; }
         CSSStyleRule* rule() { return m_rule; }
@@ -317,7 +322,17 @@ public:
         {
         }
 
-        ~CSSRuleDataList() { delete m_first; }
+        ~CSSRuleDataList() 
+        { 
+            CSSRuleData* ptr;
+            CSSRuleData* next;
+            ptr = m_first;
+            while (ptr) {
+                next = ptr->next();
+                delete ptr;
+                ptr = next;
+            }
+        }
 
         CSSRuleData* first() { return m_first; }
         CSSRuleData* last() { return m_last; }
diff --git a/src/3rdparty/webkit/WebCore/css/CSSValueKeywords.in b/src/3rdparty/webkit/WebCore/css/CSSValueKeywords.in
index c0b52f2..791f425 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSValueKeywords.in
+++ b/src/3rdparty/webkit/WebCore/css/CSSValueKeywords.in
@@ -169,6 +169,8 @@ repeat
 repeat-x
 repeat-y
 no-repeat
+# round
+# space
 #
 # CSS_PROP__WEBKIT_BACKGROUND_COMPOSITE:
 #
@@ -260,6 +262,7 @@ table-cell
 table-caption
 -webkit-box
 -webkit-inline-box
+-wap-marquee
 #none
 #
 # CSS_PROP_CURSOR:
@@ -509,6 +512,9 @@ media-rewind-button
 media-return-to-realtime-button
 media-slider
 media-sliderthumb
+media-volume-slider-container
+media-volume-slider
+media-volume-sliderthumb
 media-controls-background
 media-current-time-display
 media-time-remaining-display
@@ -551,6 +557,12 @@ padding
 padding-box
 
 #
+# background-size
+#
+contain
+cover
+
+#
 # CSS_PROP__KHTML_RTL_ORDERING
 #
 logical
@@ -611,3 +623,11 @@ fill
 stroke
 #all
 #none
+
+#
+# -webkit-font-smoothing
+#
+# auto
+# none
+antialiased
+subpixel-antialiased
diff --git a/src/3rdparty/webkit/WebCore/css/CSSValueList.cpp b/src/3rdparty/webkit/WebCore/css/CSSValueList.cpp
index 4928026..9633f7c 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSValueList.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSValueList.cpp
@@ -96,6 +96,14 @@ bool CSSValueList::hasValue(CSSValue* val)
     return false;
 }
 
+PassRefPtr<CSSValueList> CSSValueList::copy()
+{
+    PassRefPtr<CSSValueList> newList = m_isSpaceSeparated ? createSpaceSeparated() : createCommaSeparated();
+    for (size_t index = 0; index < m_values.size(); index++)
+        newList->append(item(index));
+    return newList;
+}
+
 String CSSValueList::cssText() const
 {
     String result = "";
diff --git a/src/3rdparty/webkit/WebCore/css/CSSValueList.h b/src/3rdparty/webkit/WebCore/css/CSSValueList.h
index 0d531de..b835345 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSValueList.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSValueList.h
@@ -54,6 +54,7 @@ public:
     void prepend(PassRefPtr<CSSValue>);
     bool removeAll(CSSValue*);
     bool hasValue(CSSValue*);
+    PassRefPtr<CSSValueList> copy();
 
     virtual String cssText() const;
 
diff --git a/src/3rdparty/webkit/WebCore/css/Media.cpp b/src/3rdparty/webkit/WebCore/css/Media.cpp
new file mode 100644
index 0000000..57c4aac
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/css/Media.cpp
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#include "Media.h"
+#include "CSSStyleSelector.h"
+#include "Frame.h"
+#include "FrameView.h"
+#include "MediaList.h"
+#include "MediaQueryEvaluator.h"
+
+namespace WebCore {
+
+Media::Media(DOMWindow* window)
+    : m_window(window)
+{
+}
+
+String Media::type() const
+{
+    Frame* frame = m_window->frame();
+    FrameView* view = frame ? frame->view() : 0;
+    if (view)
+        return view->mediaType();
+
+    return String();
+}
+
+bool Media::matchMedium(const String& query) const
+{
+    Document* document = m_window->document();
+    Frame* frame = m_window->frame();
+
+    CSSStyleSelector* styleSelector = document->styleSelector();
+    Element* docElement = document->documentElement();
+    if (!styleSelector || !docElement || !frame)
+        return false;
+
+    RefPtr<RenderStyle> rootStyle = styleSelector->styleForElement(docElement, 0 /*defaultParent*/, false /*allowSharing*/, true /*resolveForRootDefault*/);
+    RefPtr<MediaList> media = MediaList::create();
+
+    ExceptionCode ec = 0;
+    media->setMediaText(query, ec);
+    if (ec)
+        return false;
+
+    MediaQueryEvaluator screenEval(type(), frame, rootStyle.get());
+    return screenEval.eval(media.get());
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/css/Media.h b/src/3rdparty/webkit/WebCore/css/Media.h
new file mode 100644
index 0000000..0d7b504
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/css/Media.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef Media_h
+#define Media_h
+
+#include "DOMWindow.h"
+
+namespace WebCore {
+
+class Media : public RefCounted<Media> {
+public:
+    static PassRefPtr<Media> create(DOMWindow* window)
+    {
+        return adoptRef(new Media(window));
+    }
+    
+    Document* document() const { return m_window->document(); }
+
+    String type() const;
+
+    bool matchMedium(const String&) const;
+    
+private:
+    Media(DOMWindow*);
+
+    RefPtr<DOMWindow> m_window;
+};
+
+} // namespace
+
+#endif // Media_h
diff --git a/src/3rdparty/webkit/WebCore/css/Media.idl b/src/3rdparty/webkit/WebCore/css/Media.idl
new file mode 100644
index 0000000..b01d712
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/css/Media.idl
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module view {
+    interface [
+        GenerateConstructor,
+    ] Media {
+        readonly attribute DOMString type;
+        boolean matchMedium(in DOMString mediaquery);
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/css/StyleBase.cpp b/src/3rdparty/webkit/WebCore/css/StyleBase.cpp
index 17b51bb..8bfec5e 100644
--- a/src/3rdparty/webkit/WebCore/css/StyleBase.cpp
+++ b/src/3rdparty/webkit/WebCore/css/StyleBase.cpp
@@ -57,7 +57,7 @@ KURL StyleBase::baseURL() const
     if (!sheet)
         return KURL();
     if (!sheet->href().isNull())
-        return KURL(sheet->href());
+        return KURL(ParsedURLString, sheet->href());
     if (sheet->parent()) 
         return sheet->parent()->baseURL();
     if (!sheet->ownerNode()) 
diff --git a/src/3rdparty/webkit/WebCore/css/StyleSheetList.idl b/src/3rdparty/webkit/WebCore/css/StyleSheetList.idl
index 2abd22f..574d749 100644
--- a/src/3rdparty/webkit/WebCore/css/StyleSheetList.idl
+++ b/src/3rdparty/webkit/WebCore/css/StyleSheetList.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -22,6 +22,7 @@ module stylesheets {
 
     // Introduced in DOM Level 2:
     interface [
+        CustomMarkFunction,
         GenerateConstructor,
         HasIndexGetter,
         HasNameGetter,
diff --git a/src/3rdparty/webkit/WebCore/css/WCSSPropertyNames.in b/src/3rdparty/webkit/WebCore/css/WCSSPropertyNames.in
new file mode 100644
index 0000000..704209f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/css/WCSSPropertyNames.in
@@ -0,0 +1,4 @@
+-wap-marquee-dir
+-wap-marquee-loop
+-wap-marquee-speed
+-wap-marquee-style
diff --git a/src/3rdparty/webkit/WebCore/css/WCSSValueKeywords.in b/src/3rdparty/webkit/WebCore/css/WCSSValueKeywords.in
new file mode 100644
index 0000000..00657ba
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/css/WCSSValueKeywords.in
@@ -0,0 +1 @@
+# place holder for all WCSS specific CSS value keywords
diff --git a/src/3rdparty/webkit/WebCore/css/html.css b/src/3rdparty/webkit/WebCore/css/html.css
index 6b03390..30d5661 100644
--- a/src/3rdparty/webkit/WebCore/css/html.css
+++ b/src/3rdparty/webkit/WebCore/css/html.css
@@ -72,6 +72,10 @@ layer {
     display: block
 }
 
+nav {
+    display: block
+}
+
 marquee {
     display: inline-block;
     overflow: -webkit-marquee
@@ -364,7 +368,7 @@ textarea {
     word-wrap: break-word;
 }
 
-input::-webkit-input-placeholder, isindex::-webkit-input-placeholder {
+input::-webkit-input-placeholder, isindex::-webkit-input-placeholder, textarea::-webkit-input-placeholder {
     color: darkGray;
 }
 
@@ -483,6 +487,10 @@ select[size="1"] {
     white-space: pre;
 }
 
+datalist {
+    display: none;
+}
+
 optgroup {
     font-weight: bolder;
 }
diff --git a/src/3rdparty/webkit/WebCore/css/mediaControls.css b/src/3rdparty/webkit/WebCore/css/mediaControls.css
index f9694f8..d0ec90d 100644
--- a/src/3rdparty/webkit/WebCore/css/mediaControls.css
+++ b/src/3rdparty/webkit/WebCore/css/mediaControls.css
@@ -88,6 +88,14 @@ audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
     padding: 0px 2px;
 }
 
+audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container {
+    display: none;
+}
+
+audio::-webkit-media-controls-volume-slider, video::-webkit-media-controls-volume-slider {
+    display: none;
+}
+
 audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button {
     -webkit-appearance: media-seek-back-button;
     display: -webkit-box;
diff --git a/src/3rdparty/webkit/WebCore/css/mediaControlsChromium.css b/src/3rdparty/webkit/WebCore/css/mediaControlsChromium.css
index 63eca4b..0c01da2 100644
--- a/src/3rdparty/webkit/WebCore/css/mediaControlsChromium.css
+++ b/src/3rdparty/webkit/WebCore/css/mediaControlsChromium.css
@@ -26,26 +26,27 @@
 /* Chromium default media controls */
 
 audio {
-    width: 200px;
+    width: 300px;
     height: 32px;
 }
 
 audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
     -webkit-user-select: none;
     position: absolute;
+    overflow: visible;
     bottom: 0;
     width: 100%;
-    height: 100%;
+    height: 32px;
     z-index: 0;
+    background-color: rgba(0, 0, 0, 0.6);
 }
 
 video:-webkit-full-page-media::-webkit-media-controls-panel {
-    bottom: -16px;
+    bottom: -32px;
 }
 
 audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button {
     -webkit-appearance: media-mute-button;
-
     position: absolute;
     top: auto;
     bottom: 0;
@@ -54,8 +55,6 @@ audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-bu
 
     width: 34px;
     height: 32px;
-
-    background: rgba(123, 0, 0, 0.6);
 }
 
 audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button {
@@ -63,14 +62,12 @@ audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-bu
 
     position: absolute;
     top: auto;
-    bottom: 0;
-    left: 0px;
-    right: auto;
+    bottom: 7px;
+    left: 7px;
+    right: 6px;
 
-    width: 30px;
-    height: 32px;
-
-    background: rgba(0, 221, 0, 0.6);
+    width: 18px;
+    height: 19px;
 }
 
 audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-timeline-container {
@@ -86,7 +83,8 @@ audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-
     width: auto;
     height: 32px;
 
-    background: rgba(0, 0, 0, 0.6);
+    border-left-color: rgba(255, 255, 255, 0.2);
+    border-right-color: rgba(255, 255, 255, 0.2);
 }
 
 audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display {
@@ -105,10 +103,11 @@ audio::-webkit-media-controls-current-time-display, video::-webkit-media-control
     right: 0px;
 
     height: 20px;
-    width: 48px;
+    width: 58px;
 
     text-align: center;
     font-family: Arial;
+    font-size: 16px;
     font-weight: bold;
     color: white;
 }
@@ -129,24 +128,29 @@ audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-contr
     right: 0px;
 
     height: 20px;
-    width: 48px;
+    width: 58px;
 
     text-align: center;
     font-family: Arial;
+    font-size: 16px;
     font-weight: bold;
     color: white;
 }
 
 audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
-    -webkit-appearance: slider-horizontal;
+    -webkit-appearance: media-slider;
     position: absolute;
     top: auto;
-    bottom: 9px;
-    left: 0px;
-    right: 50px;
-    height: 13px;
-
-    background: rgba(0, 0, 0, 0.6);
+    bottom: 8px;
+    left: 6px;
+    right: 65px;
+    height: 16px;
+
+    border-color: rgba(255, 255, 255, 0.2);
+    border-width: 1px;
+    border-radius: 2px;
+    background-color: rgba(255, 255, 255, 0.08);
+    color: rgb(50, 140, 223);
 }
 
 audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button {
@@ -163,3 +167,25 @@ audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-f
     -webkit-appearance: media-fullscreen-button;
     display: none;
 }
+
+audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container {
+    -webkit-appearance: media-volume-slider-container;
+    position: absolute;
+
+    width: 34px;
+    height: 100px;
+
+    background-color: rgba(0, 0, 0, 0.6);
+}
+
+audio::-webkit-media-controls-volume-slider, video::-webkit-media-controls-volume-slider {
+    -webkit-appearance: media-volume-slider;
+    display: inline;
+    position: absolute;
+
+    top: 10px;
+    left: 12px;
+
+    width: 10px;
+    height: 80px;
+}
diff --git a/src/3rdparty/webkit/WebCore/css/wml.css b/src/3rdparty/webkit/WebCore/css/wml.css
index 9c938dd..54e5a97 100644
--- a/src/3rdparty/webkit/WebCore/css/wml.css
+++ b/src/3rdparty/webkit/WebCore/css/wml.css
@@ -223,6 +223,13 @@ small {
     font-size: smaller
 }
 
+pre {
+    display: block;
+    font-family: monospace;
+    white-space: pre;
+    margin: 1__qem 0
+}
+
 /* states */
 
 :focus { 
diff --git a/src/3rdparty/webkit/WebCore/dom/Attr.cpp b/src/3rdparty/webkit/WebCore/dom/Attr.cpp
index 435c1af..aa5916b 100644
--- a/src/3rdparty/webkit/WebCore/dom/Attr.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Attr.cpp
@@ -3,7 +3,7 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -30,10 +30,10 @@
 
 namespace WebCore {
 
-Attr::Attr(Element* element, Document* docPtr, PassRefPtr<Attribute> a)
-    : ContainerNode(docPtr)
+inline Attr::Attr(Element* element, Document* document, PassRefPtr<Attribute> attribute)
+    : ContainerNode(document)
     , m_element(element)
-    , m_attribute(a)
+    , m_attribute(attribute)
     , m_ignoreChildrenChanged(0)
     , m_specified(true)  
 {
@@ -41,6 +41,13 @@ Attr::Attr(Element* element, Document* docPtr, PassRefPtr<Attribute> a)
     m_attribute->m_impl = this;
 }
 
+PassRefPtr<Attr> Attr::create(Element* element, Document* document, PassRefPtr<Attribute> attribute)
+{
+    RefPtr<Attr> attr = adoptRef(new Attr(element, document, attribute));
+    attr->createTextChild();
+    return attr.release();
+}
+
 Attr::~Attr()
 {
     ASSERT(m_attribute->attr() == this);
@@ -86,14 +93,14 @@ const AtomicString& Attr::prefix() const
     return m_attribute->prefix();
 }
 
-void Attr::setPrefix(const AtomicString &_prefix, ExceptionCode& ec)
+void Attr::setPrefix(const AtomicString& prefix, ExceptionCode& ec)
 {
     ec = 0;
-    checkSetPrefix(_prefix, ec);
+    checkSetPrefix(prefix, ec);
     if (ec)
         return;
 
-    m_attribute->setPrefix(_prefix);
+    m_attribute->setPrefix(prefix);
 }
 
 String Attr::nodeValue() const
@@ -101,11 +108,11 @@ String Attr::nodeValue() const
     return value();
 }
 
-void Attr::setValue(const String& v, ExceptionCode&)
+void Attr::setValue(const AtomicString& value, ExceptionCode&)
 {
     m_ignoreChildrenChanged++;
     removeChildren();
-    m_attribute->setValue(v.impl());
+    m_attribute->setValue(value);
     createTextChild();
     m_ignoreChildrenChanged--;
 
@@ -120,7 +127,7 @@ void Attr::setNodeValue(const String& v, ExceptionCode& ec)
 
 PassRefPtr<Node> Attr::cloneNode(bool /*deep*/)
 {
-    RefPtr<Attr> clone = new Attr(0, document(), m_attribute->clone());
+    RefPtr<Attr> clone = adoptRef(new Attr(0, document(), m_attribute->clone()));
     cloneChildNodes(clone.get());
     return clone.release();
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/Attr.h b/src/3rdparty/webkit/WebCore/dom/Attr.h
index ed4dc07..e927a6e 100644
--- a/src/3rdparty/webkit/WebCore/dom/Attr.h
+++ b/src/3rdparty/webkit/WebCore/dom/Attr.h
@@ -3,7 +3,7 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -39,48 +39,47 @@ namespace WebCore {
 class Attr : public ContainerNode {
     friend class NamedNodeMap;
 public:
-    Attr(Element*, Document*, PassRefPtr<Attribute>);
-    ~Attr();
+    static PassRefPtr<Attr> create(Element*, Document*, PassRefPtr<Attribute>);
+    virtual ~Attr();
 
-    // Call this after calling the constructor so the
-    // Attr node isn't floating when we append the text node.
-    void createTextChild();
-    
-    // DOM methods & attributes for Attr
     String name() const { return qualifiedName().toString(); }
     bool specified() const { return m_specified; }
     Element* ownerElement() const { return m_element; }
 
-    String value() const { return m_attribute->value(); }
-    void setValue(const String&, ExceptionCode&);
+    const AtomicString& value() const { return m_attribute->value(); }
+    void setValue(const AtomicString&, ExceptionCode&);
+
+    Attribute* attr() const { return m_attribute.get(); }
+    const QualifiedName& qualifiedName() const { return m_attribute->name(); }
+
+    // An extension to get presentational information for attributes.
+    CSSStyleDeclaration* style() { return m_attribute->style(); }
+
+    void setSpecified(bool specified) { m_specified = specified; }
+
+private:
+    Attr(Element*, Document*, PassRefPtr<Attribute>);
+
+    void createTextChild();
 
-    // DOM methods overridden from parent classes
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
+
     const AtomicString& localName() const;
     const AtomicString& namespaceURI() const;
     const AtomicString& prefix() const;
+
     virtual void setPrefix(const AtomicString&, ExceptionCode&);
 
     virtual String nodeValue() const;
     virtual void setNodeValue(const String&, ExceptionCode&);
     virtual PassRefPtr<Node> cloneNode(bool deep);
 
-    // Other methods (not part of DOM)
     virtual bool isAttributeNode() const { return true; }
     virtual bool childTypeAllowed(NodeType);
 
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
-    Attribute* attr() const { return m_attribute.get(); }
-    const QualifiedName& qualifiedName() const { return m_attribute->name(); }
-
-    // An extension to get presentational information for attributes.
-    CSSStyleDeclaration* style() { return m_attribute->style(); }
-
-    void setSpecified(bool specified) { m_specified = specified; }
-
-private:
     virtual const AtomicString& virtualPrefix() const { return prefix(); }
     virtual const AtomicString& virtualLocalName() const { return localName(); }
     virtual const AtomicString& virtualNamespaceURI() const { return namespaceURI(); }
diff --git a/src/3rdparty/webkit/WebCore/dom/Attribute.cpp b/src/3rdparty/webkit/WebCore/dom/Attribute.cpp
index 048ac6a..0ab0bb6 100644
--- a/src/3rdparty/webkit/WebCore/dom/Attribute.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Attribute.cpp
@@ -37,10 +37,8 @@ PassRefPtr<Attribute> Attribute::clone() const
 PassRefPtr<Attr> Attribute::createAttrIfNeeded(Element* e)
 {
     RefPtr<Attr> r = m_impl;
-    if (!r) {
-        r = new Attr(e, e->document(), this);
-        r->createTextChild();
-    }
+    if (!r)
+        r = Attr::create(e, e->document(), this);
     return r.release();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/dom/CDATASection.cpp b/src/3rdparty/webkit/WebCore/dom/CDATASection.cpp
index 72faa70..d73054e 100644
--- a/src/3rdparty/webkit/WebCore/dom/CDATASection.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/CDATASection.cpp
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -26,13 +26,14 @@
 
 namespace WebCore {
 
-CDATASection::CDATASection(Document* document, const String& text)
-    : Text(document, text)
+inline CDATASection::CDATASection(Document* document, const String& data)
+    : Text(document, data)
 {
 }
 
-CDATASection::~CDATASection()
+PassRefPtr<CDATASection> CDATASection::create(Document* document, const String& data)
 {
+    return adoptRef(new CDATASection(document, data));
 }
 
 String CDATASection::nodeName() const
@@ -47,19 +48,17 @@ Node::NodeType CDATASection::nodeType() const
 
 PassRefPtr<Node> CDATASection::cloneNode(bool /*deep*/)
 {
-    return new CDATASection(document(), m_data);
+    return create(document(), data());
 }
 
-// DOM Section 1.1.1
 bool CDATASection::childTypeAllowed(NodeType)
 {
     return false;
 }
 
-PassRefPtr<Text> CDATASection::createNew(PassRefPtr<StringImpl> string)
+PassRefPtr<Text> CDATASection::virtualCreate(const String& data)
 {
-    return new CDATASection(document(), string);
+    return create(document(), data);
 }
 
-
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/CDATASection.h b/src/3rdparty/webkit/WebCore/dom/CDATASection.h
index 8b7df9d..5cf07e1 100644
--- a/src/3rdparty/webkit/WebCore/dom/CDATASection.h
+++ b/src/3rdparty/webkit/WebCore/dom/CDATASection.h
@@ -1,9 +1,7 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003 Apple Computer, Inc.
+ * Copyright (C) 2003, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -31,16 +29,16 @@ namespace WebCore {
 
 class CDATASection : public Text {
 public:
+    static PassRefPtr<CDATASection> create(Document*, const String&);
+
+private:
     CDATASection(Document*, const String&);
-    virtual ~CDATASection();
 
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
     virtual PassRefPtr<Node> cloneNode(bool deep);
     virtual bool childTypeAllowed(NodeType);
-
-protected:
-    virtual PassRefPtr<Text> createNew(PassRefPtr<StringImpl>);
+    virtual PassRefPtr<Text> virtualCreate(const String&);
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/CharacterData.cpp b/src/3rdparty/webkit/WebCore/dom/CharacterData.cpp
index 9a72de9..902b7ff 100644
--- a/src/3rdparty/webkit/WebCore/dom/CharacterData.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/CharacterData.cpp
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -30,20 +30,11 @@
 
 namespace WebCore {
 
-CharacterData::CharacterData(Document *doc, bool isText)
-    : Node(doc, false, false, isText)
-    , m_data(StringImpl::empty())
-{
-}
-
-CharacterData::CharacterData(Document* document, const String& text, bool isText)
-    : Node(document, false, false, isText)
-{
-    m_data = text.impl() ? text.impl() : StringImpl::empty();
-}
-
-CharacterData::~CharacterData()
+CharacterData::CharacterData(Document* document, const String& text, ConstructionType type)
+    : Node(document, type)
+    , m_data(text.impl() ? text.impl() : StringImpl::empty())
 {
+    ASSERT(type == CreateOther || type == CreateText);
 }
 
 void CharacterData::setData(const String& data, ExceptionCode&)
diff --git a/src/3rdparty/webkit/WebCore/dom/CharacterData.h b/src/3rdparty/webkit/WebCore/dom/CharacterData.h
index d9e55c0..6c31933 100644
--- a/src/3rdparty/webkit/WebCore/dom/CharacterData.h
+++ b/src/3rdparty/webkit/WebCore/dom/CharacterData.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -29,12 +29,6 @@ namespace WebCore {
 
 class CharacterData : public Node {
 public:
-    CharacterData(Document*, const String& text, bool isText = false);
-    CharacterData(Document*, bool isText = false);
-    virtual ~CharacterData();
-
-    // DOM methods & attributes for CharacterData
-
     String data() const { return m_data; }
     void setData(const String&, ExceptionCode&);
     unsigned length() const { return m_data->length(); }
@@ -42,31 +36,30 @@ public:
     void appendData(const String&, ExceptionCode&);
     void insertData(unsigned offset, const String&, ExceptionCode&);
     void deleteData(unsigned offset, unsigned count, ExceptionCode&);
-    void replaceData(unsigned offset, unsigned count, const String &arg, ExceptionCode&);
+    void replaceData(unsigned offset, unsigned count, const String&, ExceptionCode&);
 
     bool containsOnlyWhitespace() const;
 
-    // DOM methods overridden from parent classes
-
-    virtual String nodeValue() const;
-    virtual void setNodeValue(const String&, ExceptionCode&);
-    
-    // Other methods (not part of DOM)
+    StringImpl* dataImpl() { return m_data.get(); }
 
-    virtual bool isCharacterDataNode() const { return true; }
-    virtual int maxCharacterOffset() const;
-    StringImpl* string() { return m_data.get(); }
+protected:
+    CharacterData(Document*, const String&, ConstructionType);
 
-    virtual bool offsetInCharacters() const;
     virtual bool rendererIsNeeded(RenderStyle*);
 
-protected:
-    RefPtr<StringImpl> m_data;
-
+    void setDataImpl(PassRefPtr<StringImpl> impl) { m_data = impl; }
     void dispatchModifiedEvent(StringImpl* oldValue);
 
 private:
+    virtual String nodeValue() const;
+    virtual void setNodeValue(const String&, ExceptionCode&);
+    virtual bool isCharacterDataNode() const { return true; }
+    virtual int maxCharacterOffset() const;
+    virtual bool offsetInCharacters() const;
+
     void checkCharDataOperation(unsigned offset, ExceptionCode&);
+
+    RefPtr<StringImpl> m_data;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/Clipboard.h b/src/3rdparty/webkit/WebCore/dom/Clipboard.h
index 0fea604..f6c09b2 100644
--- a/src/3rdparty/webkit/WebCore/dom/Clipboard.h
+++ b/src/3rdparty/webkit/WebCore/dom/Clipboard.h
@@ -64,7 +64,9 @@ namespace WebCore {
         virtual void setDragImageElement(Node*, const IntPoint&) = 0;
         
         virtual DragImageRef createDragImage(IntPoint& dragLocation) const = 0;
+#if ENABLE(DRAG_SUPPORT)
         virtual void declareAndWriteDragImage(Element*, const KURL&, const String& title, Frame*) = 0;
+#endif
         virtual void writeURL(const KURL&, const String&, Frame*) = 0;
         virtual void writeRange(Range*, Frame*) = 0;
 
diff --git a/src/3rdparty/webkit/WebCore/dom/Comment.cpp b/src/3rdparty/webkit/WebCore/dom/Comment.cpp
index a36a491..3dcde38 100644
--- a/src/3rdparty/webkit/WebCore/dom/Comment.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Comment.cpp
@@ -1,9 +1,7 @@
-/**
- * This file is part of the DOM implementation for KDE.
- *
+/*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003 Apple Computer, Inc.
+ * Copyright (C) 2003, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,22 +22,16 @@
 #include "config.h"
 #include "Comment.h"
 
-#include "Document.h"
-
 namespace WebCore {
 
-Comment::Comment(Document* doc, const String& text)
-    : CharacterData(doc, text)
-{
-}
-
-Comment::Comment(Document* doc)
-    : CharacterData(doc)
+inline Comment::Comment(Document* document, const String& text)
+    : CharacterData(document, text, CreateOther)
 {
 }
 
-Comment::~Comment()
+PassRefPtr<Comment> Comment::create(Document* document, const String& text)
 {
+    return adoptRef(new Comment(document, text));
 }
 
 String Comment::nodeName() const
@@ -54,10 +46,9 @@ Node::NodeType Comment::nodeType() const
 
 PassRefPtr<Node> Comment::cloneNode(bool /*deep*/)
 {
-    return document()->createComment(m_data);
+    return create(document(), data());
 }
 
-// DOM Section 1.1.1
 bool Comment::childTypeAllowed(NodeType)
 {
     return false;
diff --git a/src/3rdparty/webkit/WebCore/dom/Comment.h b/src/3rdparty/webkit/WebCore/dom/Comment.h
index d00ba62..680ffae 100644
--- a/src/3rdparty/webkit/WebCore/dom/Comment.h
+++ b/src/3rdparty/webkit/WebCore/dom/Comment.h
@@ -1,9 +1,7 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003 Apple Computer, Inc.
+ * Copyright (C) 2003, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -31,16 +29,14 @@ namespace WebCore {
 
 class Comment : public CharacterData {
 public:
-    Comment(Document*, const String &_text);
-    Comment(Document*);
-    virtual ~Comment();
+    static PassRefPtr<Comment> create(Document*, const String&);
+
+private:
+    Comment(Document*, const String&);
 
-    // DOM methods overridden from  parent classes
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
     virtual PassRefPtr<Node> cloneNode(bool deep);
-
-    // Other methods (not part of DOM)
     virtual bool isCommentNode() const { return true; }
     virtual bool childTypeAllowed(NodeType);
 };
diff --git a/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp b/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp
index 2d79156..1ec4eb3 100644
--- a/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp
@@ -690,7 +690,7 @@ bool ContainerNode::getUpperLeftCorner(FloatPoint& point) const
             point = o->container()->localToAbsolute();
             if (o->isText() && toRenderText(o)->firstTextBox()) {
                 point.move(toRenderText(o)->linesBoundingBox().x(),
-                           toRenderText(o)->firstTextBox()->root()->topOverflow());
+                           toRenderText(o)->firstTextBox()->root()->lineTop());
             } else if (o->isBox()) {
                 RenderBox* box = toRenderBox(o);
                 point.move(box->x(), box->y());
@@ -869,16 +869,16 @@ static void dispatchChildInsertionEvents(Node* child, ExceptionCode& ec)
     ASSERT(!eventDispatchForbidden());
 
     RefPtr<Node> c = child;
-    DocPtr<Document> doc = child->document();
+    RefPtr<Document> document = child->document();
 
     if (c->parentNode() && c->parentNode()->inDocument())
         c->insertedIntoDocument();
     else
         c->insertedIntoTree(true);
 
-    doc->incDOMTreeVersion();
+    document->incDOMTreeVersion();
 
-    if (c->parentNode() && doc->hasListenerType(Document::DOMNODEINSERTED_LISTENER)) {
+    if (c->parentNode() && document->hasListenerType(Document::DOMNODEINSERTED_LISTENER)) {
         ec = 0;
         c->dispatchMutationEvent(eventNames().DOMNodeInsertedEvent, true, c->parentNode(), String(), String(), ec); 
         if (ec)
@@ -886,27 +886,28 @@ static void dispatchChildInsertionEvents(Node* child, ExceptionCode& ec)
     }
 
     // dispatch the DOMNodeInsertedIntoDocument event to all descendants
-    if (c->inDocument() && doc->hasListenerType(Document::DOMNODEINSERTEDINTODOCUMENT_LISTENER))
+    if (c->inDocument() && document->hasListenerType(Document::DOMNODEINSERTEDINTODOCUMENT_LISTENER)) {
         for (; c; c = c->traverseNextNode(child)) {
             ec = 0;
             c->dispatchMutationEvent(eventNames().DOMNodeInsertedIntoDocumentEvent, false, 0, String(), String(), ec); 
             if (ec)
                 return;
         }
+    }
 }
 
 static void dispatchChildRemovalEvents(Node* child, ExceptionCode& ec)
 {
     RefPtr<Node> c = child;
-    DocPtr<Document> doc = child->document();
+    RefPtr<Document> document = child->document();
 
     // update auxiliary doc info (e.g. iterators) to note that node is being removed
-    doc->nodeWillBeRemoved(child);
+    document->nodeWillBeRemoved(child);
 
-    doc->incDOMTreeVersion();
+    document->incDOMTreeVersion();
 
     // dispatch pre-removal mutation events
-    if (c->parentNode() && doc->hasListenerType(Document::DOMNODEREMOVED_LISTENER)) {
+    if (c->parentNode() && document->hasListenerType(Document::DOMNODEREMOVED_LISTENER)) {
         ec = 0;
         c->dispatchMutationEvent(eventNames().DOMNodeRemovedEvent, true, c->parentNode(), String(), String(), ec); 
         if (ec)
@@ -914,7 +915,7 @@ static void dispatchChildRemovalEvents(Node* child, ExceptionCode& ec)
     }
 
     // dispatch the DOMNodeRemovedFromDocument event to all descendants
-    if (c->inDocument() && doc->hasListenerType(Document::DOMNODEREMOVEDFROMDOCUMENT_LISTENER))
+    if (c->inDocument() && document->hasListenerType(Document::DOMNODEREMOVEDFROMDOCUMENT_LISTENER))
         for (; c; c = c->traverseNextNode(child)) {
             ec = 0;
             c->dispatchMutationEvent(eventNames().DOMNodeRemovedFromDocumentEvent, false, 0, String(), String(), ec); 
diff --git a/src/3rdparty/webkit/WebCore/dom/ContainerNode.h b/src/3rdparty/webkit/WebCore/dom/ContainerNode.h
index 3ad932c..aa480a7 100644
--- a/src/3rdparty/webkit/WebCore/dom/ContainerNode.h
+++ b/src/3rdparty/webkit/WebCore/dom/ContainerNode.h
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -38,7 +38,6 @@ namespace Private {
 
 class ContainerNode : public Node {
 public:
-    ContainerNode(Document*, bool isElement = false);
     virtual ~ContainerNode();
 
     Node* firstChild() const { return m_firstChild; }
@@ -74,6 +73,8 @@ public:
     void cloneChildNodes(ContainerNode* clone);
 
 protected:
+    ContainerNode(Document*, ConstructionType = CreateContainer);
+
     static void queuePostAttachCallback(NodeCallback, Node*);
     void suspendPostAttachCallbacks();
     void resumePostAttachCallbacks();
@@ -97,8 +98,8 @@ private:
     Node* m_lastChild;
 };
 
-inline ContainerNode::ContainerNode(Document* document, bool isElement)
-    : Node(document, isElement, true)
+inline ContainerNode::ContainerNode(Document* document, ConstructionType type)
+    : Node(document, type)
     , m_firstChild(0)
     , m_lastChild(0)
 {
diff --git a/src/3rdparty/webkit/WebCore/dom/DOMImplementation.cpp b/src/3rdparty/webkit/WebCore/dom/DOMImplementation.cpp
index 065f708..59b9703 100644
--- a/src/3rdparty/webkit/WebCore/dom/DOMImplementation.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/DOMImplementation.cpp
@@ -223,12 +223,6 @@ DOMImplementation* DOMImplementation::getInterface(const String& /*feature*/)
 PassRefPtr<Document> DOMImplementation::createDocument(const String& namespaceURI,
     const String& qualifiedName, DocumentType* doctype, ExceptionCode& ec)
 {
-    // WRONG_DOCUMENT_ERR: Raised if doctype has already been used with a different document or was
-    // created from a different implementation.
-    bool shouldThrowWrongDocErr = false;
-    if (doctype && doctype->document())
-        shouldThrowWrongDocErr = true;
-
     RefPtr<Document> doc;
 #if ENABLE(SVG)
     if (namespaceURI == SVGNames::svgNamespaceURI)
@@ -245,24 +239,27 @@ PassRefPtr<Document> DOMImplementation::createDocument(const String& namespaceUR
     else
         doc = Document::create(0);
 
-    // now get the interesting parts of the doctype
-    if (doctype)
-        doc->addChild(doctype);
-
+    RefPtr<Node> documentElement;
     if (!qualifiedName.isEmpty()) {
-        RefPtr<Node> documentElement = doc->createElementNS(namespaceURI, qualifiedName, ec);
+        documentElement = doc->createElementNS(namespaceURI, qualifiedName, ec);
         if (ec)
             return 0;
-        doc->addChild(documentElement.release());
     }
 
+    // WRONG_DOCUMENT_ERR: Raised if doctype has already been used with a different document or was
+    // created from a different implementation.
     // Hixie's interpretation of the DOM Core spec suggests we should prefer
-    // other exceptions to WRONG_DOCUMENT_ERR (based on order mentioned in spec)
-    if (shouldThrowWrongDocErr) {
+    // other exceptions to WRONG_DOCUMENT_ERR (based on order mentioned in spec).
+    if (doctype && doctype->document()) {
         ec = WRONG_DOCUMENT_ERR;
         return 0;
     }
 
+    if (doctype)
+        doc->addChild(doctype);
+    if (documentElement)
+        doc->addChild(documentElement.release());
+
     return doc.release();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/dom/DocPtr.h b/src/3rdparty/webkit/WebCore/dom/DocPtr.h
deleted file mode 100644
index 8b50e8d..0000000
--- a/src/3rdparty/webkit/WebCore/dom/DocPtr.h
+++ /dev/null
@@ -1,114 +0,0 @@
-/*
- * This file is part of the DOM implementation for KDE.
- * Copyright (C) 2005, 2006 Apple Computer, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef DocPtr_h
-#define DocPtr_h
-
-namespace WebCore {
-
-template <class T> class DocPtr {
-public:
-    DocPtr() : m_ptr(0) {}
-    DocPtr(T *ptr) : m_ptr(ptr) { if (ptr) ptr->selfOnlyRef(); }
-    DocPtr(const DocPtr &o) : m_ptr(o.m_ptr) { if (T *ptr = m_ptr) ptr->selfOnlyRef(); }
-    ~DocPtr() { if (T *ptr = m_ptr) ptr->selfOnlyDeref(); }
-    
-    template <class U> DocPtr(const DocPtr<U> &o) : m_ptr(o.get()) { if (T *ptr = m_ptr) ptr->selfOnlyRef(); }
-    
-    void resetSkippingRef(T *o) { m_ptr = o; }
-    
-    T *get() const { return m_ptr; }
-    
-    T &operator*() const { return *m_ptr; }
-    T *operator->() const { return m_ptr; }
-    
-    bool operator!() const { return !m_ptr; }
-
-    // this type conversion operator allows implicit conversion to
-    // bool but not to other integer types
-    
-    typedef T * (DocPtr::*UnspecifiedBoolType)() const;
-    operator UnspecifiedBoolType() const
-    {
-        return m_ptr ? &DocPtr::get : 0;
-    }
-    
-    DocPtr &operator=(const DocPtr &);
-    DocPtr &operator=(T *);
-    
- private:
-    T *m_ptr;
-};
-
-template <class T> DocPtr<T> &DocPtr<T>::operator=(const DocPtr<T> &o) 
-{
-    T *optr = o.m_ptr;
-    if (optr)
-        optr->selfOnlyRef();
-    if (T *ptr = m_ptr)
-        ptr->selfOnlyDeref();
-    m_ptr = optr;
-        return *this;
-}
-
-template <class T> inline DocPtr<T> &DocPtr<T>::operator=(T *optr)
-{
-    if (optr)
-        optr->selfOnlyRef();
-    if (T *ptr = m_ptr)
-        ptr->selfOnlyDeref();
-    m_ptr = optr;
-    return *this;
-}
-
-template <class T> inline bool operator==(const DocPtr<T> &a, const DocPtr<T> &b) 
-{ 
-    return a.get() == b.get(); 
-}
-
-template <class T> inline bool operator==(const DocPtr<T> &a, const T *b) 
-{ 
-    return a.get() == b; 
-}
-
-template <class T> inline bool operator==(const T *a, const DocPtr<T> &b) 
-{
-    return a == b.get(); 
-}
-
-template <class T> inline bool operator!=(const DocPtr<T> &a, const DocPtr<T> &b) 
-{ 
-    return a.get() != b.get(); 
-}
-
-template <class T> inline bool operator!=(const DocPtr<T> &a, const T *b)
-{
-    return a.get() != b; 
-}
-
-template <class T> inline bool operator!=(const T *a, const DocPtr<T> &b) 
-{ 
-    return a != b.get(); 
-}
-
-} // namespace WebCore
-
-#endif // DocPtr_h
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.cpp b/src/3rdparty/webkit/WebCore/dom/Document.cpp
index 228cfde..1b8afe7 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Document.cpp
@@ -80,7 +80,7 @@
 #include "HitTestResult.h"
 #include "ImageLoader.h"
 #include "InspectorController.h"
-#include "ScriptEventListener.h"
+#include "InspectorTimelineAgent.h"
 #include "KeyboardEvent.h"
 #include "Logging.h"
 #include "MappedAttribute.h"
@@ -94,6 +94,8 @@
 #include "NodeWithIndex.h"
 #include "OverflowEvent.h"
 #include "Page.h"
+#include "PageGroup.h"
+#include "PageTransitionEvent.h"
 #include "PlatformKeyboardEvent.h"
 #include "ProcessingInstruction.h"
 #include "ProgressEvent.h"
@@ -104,6 +106,7 @@
 #include "RenderWidget.h"
 #include "ScriptController.h"
 #include "ScriptElement.h"
+#include "ScriptEventListener.h"
 #include "SecurityOrigin.h"
 #include "SegmentedString.h"
 #include "SelectionController.h"
@@ -121,6 +124,7 @@
 #include "XMLHttpRequest.h"
 #include "XMLNames.h"
 #include "XMLTokenizer.h"
+#include "htmlediting.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/HashFunctions.h>
 #include <wtf/MainThread.h>
@@ -132,6 +136,10 @@
 #include "DatabaseThread.h"
 #endif
 
+#if ENABLE(SHARED_WORKERS)
+#include "SharedWorkerRepository.h"
+#endif
+
 #if ENABLE(DOM_STORAGE)
 #include "StorageEvent.h"
 #endif
@@ -154,6 +162,7 @@
 #if ENABLE(SVG)
 #include "SVGDocumentExtensions.h"
 #include "SVGElementFactory.h"
+#include "SVGNames.h"
 #include "SVGZoomEvent.h"
 #include "SVGStyleElement.h"
 #endif
@@ -267,7 +276,7 @@ static Widget* widgetForNode(Node* focusedNode)
     RenderObject* renderer = focusedNode->renderer();
     if (!renderer || !renderer->isWidget())
         return 0;
-    return static_cast<RenderWidget*>(renderer)->widget();
+    return toRenderWidget(renderer)->widget();
 }
 
 static bool acceptsEditingFocus(Node *node)
@@ -339,7 +348,9 @@ Document::Document(Frame* frame, bool isXHTML)
     , m_containsWMLContent(false)
 #endif
 {
-    m_document.resetSkippingRef(this);
+    m_document = this;
+
+    m_pageGroupUserSheetCacheValid = false;
 
     m_printing = false;
     
@@ -409,8 +420,7 @@ void Document::removedLastRef()
         // want the document to be destructed until after
         // removeAllChildren returns, so we guard ourselves with an
         // extra self-only ref.
-
-        DocPtr<Document> guard(this);
+        selfOnlyRef();
 
         // We must make sure not to be retaining any of our children through
         // these extra pointers or we will create a reference cycle.
@@ -434,6 +444,8 @@ void Document::removedLastRef()
 #ifndef NDEBUG
         m_inRemovedLastRefFunction = false;
 #endif
+
+        selfOnlyDeref();
     } else {
 #ifndef NDEBUG
         m_deletionHasBegun = true;
@@ -460,7 +472,7 @@ Document::~Document()
 #endif
 
     delete m_tokenizer;
-    m_document.resetSkippingRef(0);
+    m_document = 0;
     delete m_styleSelector;
     delete m_docLoader;
     
@@ -496,8 +508,6 @@ Document::~Document()
 
     if (m_styleSheets)
         m_styleSheets->documentDestroyed();
-
-    m_document = 0;
 }
 
 void Document::resetLinkColor()
@@ -567,17 +577,17 @@ PassRefPtr<Element> Document::createElement(const AtomicString& name, ExceptionC
 
 PassRefPtr<DocumentFragment> Document::createDocumentFragment()
 {
-    return new DocumentFragment(document());
+    return DocumentFragment::create(document());
 }
 
 PassRefPtr<Text> Document::createTextNode(const String& data)
 {
-    return new Text(this, data);
+    return Text::create(this, data);
 }
 
 PassRefPtr<Comment> Document::createComment(const String& data)
 {
-    return new Comment(this, data);
+    return Comment::create(this, data);
 }
 
 PassRefPtr<CDATASection> Document::createCDATASection(const String& data, ExceptionCode& ec)
@@ -586,7 +596,7 @@ PassRefPtr<CDATASection> Document::createCDATASection(const String& data, Except
         ec = NOT_SUPPORTED_ERR;
         return 0;
     }
-    return new CDATASection(this, data);
+    return CDATASection::create(this, data);
 }
 
 PassRefPtr<ProcessingInstruction> Document::createProcessingInstruction(const String& target, const String& data, ExceptionCode& ec)
@@ -599,7 +609,7 @@ PassRefPtr<ProcessingInstruction> Document::createProcessingInstruction(const St
         ec = NOT_SUPPORTED_ERR;
         return 0;
     }
-    return new ProcessingInstruction(this, target, data);
+    return ProcessingInstruction::create(this, target, data);
 }
 
 PassRefPtr<EntityReference> Document::createEntityReference(const String& name, ExceptionCode& ec)
@@ -612,12 +622,12 @@ PassRefPtr<EntityReference> Document::createEntityReference(const String& name,
         ec = NOT_SUPPORTED_ERR;
         return 0;
     }
-    return new EntityReference(this, name);
+    return EntityReference::create(this, name);
 }
 
 PassRefPtr<EditingText> Document::createEditingTextNode(const String& text)
 {
-    return new EditingText(this, text);
+    return EditingText::create(this, text);
 }
 
 PassRefPtr<CSSStyleDeclaration> Document::createCSSStyleDeclaration()
@@ -682,11 +692,8 @@ PassRefPtr<Node> Document::importNode(Node* importedNode, bool deep, ExceptionCo
 
             return newElement.release();
         }
-        case ATTRIBUTE_NODE: {
-            RefPtr<Attr> newAttr = new Attr(0, this, static_cast<Attr*>(importedNode)->attr()->clone());
-            newAttr->createTextChild();
-            return newAttr.release();
-        }
+        case ATTRIBUTE_NODE:
+            return Attr::create(0, this, static_cast<Attr*>(importedNode)->attr()->clone());
         case DOCUMENT_FRAGMENT_NODE: {
             DocumentFragment* oldFragment = static_cast<DocumentFragment*>(importedNode);
             RefPtr<DocumentFragment> newFragment = createDocumentFragment();
@@ -798,7 +805,7 @@ PassRefPtr<Element> Document::createElement(const QualifiedName& qName, bool cre
 #endif
     
     if (!e)
-        e = new Element(qName, document());
+        e = Element::create(qName, document());
 
     // <image> uses imgTag so we need a special rule.
 #if ENABLE(WML)
@@ -920,16 +927,25 @@ KURL Document::baseURI() const
 
 Element* Document::elementFromPoint(int x, int y) const
 {
+    // FIXME: Share code between this and caretRangeFromPoint.
     if (!renderer())
         return 0;
+    Frame* frame = this->frame();
+    if (!frame)
+        return 0;
+    FrameView* frameView = frame->view();
+    if (!frameView)
+        return 0;
 
-    HitTestRequest request(HitTestRequest::ReadOnly |
-                           HitTestRequest::Active);
+    float zoomFactor = frame->pageZoomFactor();
+    IntPoint point = roundedIntPoint(FloatPoint(x * zoomFactor, y * zoomFactor)) + view()->scrollOffset();
 
-    float zoomFactor = frame() ? frame()->pageZoomFactor() : 1.0f;
+    if (!frameView->visibleContentRect().contains(point))
+        return 0;
 
-    HitTestResult result(roundedIntPoint(FloatPoint(x * zoomFactor, y * zoomFactor)));
-    renderView()->layer()->hitTest(request, result); 
+    HitTestRequest request(HitTestRequest::ReadOnly | HitTestRequest::Active);
+    HitTestResult result(point);
+    renderView()->layer()->hitTest(request, result);
 
     Node* n = result.innerNode();
     while (n && !n->isElementNode())
@@ -939,6 +955,50 @@ Element* Document::elementFromPoint(int x, int y) const
     return static_cast<Element*>(n);
 }
 
+PassRefPtr<Range> Document::caretRangeFromPoint(int x, int y)
+{
+    // FIXME: Share code between this and elementFromPoint.
+    if (!renderer())
+        return 0;
+    Frame* frame = this->frame();
+    if (!frame)
+        return 0;
+    FrameView* frameView = frame->view();
+    if (!frameView)
+        return 0;
+
+    float zoomFactor = frame->pageZoomFactor();
+    IntPoint point = roundedIntPoint(FloatPoint(x * zoomFactor, y * zoomFactor)) + view()->scrollOffset();
+
+    if (!frameView->visibleContentRect().contains(point))
+        return 0;
+
+    HitTestRequest request(HitTestRequest::ReadOnly | HitTestRequest::Active);
+    HitTestResult result(point);
+    renderView()->layer()->hitTest(request, result);
+
+    Node* node = result.innerNode();
+    if (!node)
+        return 0;
+
+    Node* shadowAncestorNode = node->shadowAncestorNode();
+    if (shadowAncestorNode != node) {
+        unsigned offset = shadowAncestorNode->nodeIndex();
+        Node* container = shadowAncestorNode->parentNode();
+        return Range::create(this, container, offset, container, offset);
+    }
+
+    RenderObject* renderer = node->renderer();
+    if (!renderer)
+        return 0;
+    VisiblePosition visiblePosition = renderer->positionForPoint(result.localPoint());
+    if (visiblePosition.isNull())
+        return 0;
+
+    Position rangeCompliantPosition = rangeCompliantEquivalent(visiblePosition);
+    return Range::create(this, rangeCompliantPosition, rangeCompliantPosition);
+}
+
 void Document::addElementById(const AtomicString& elementId, Element* element)
 {
     typedef HashMap<AtomicStringImpl*, Element*>::iterator iterator;
@@ -1154,6 +1214,12 @@ void Document::recalcStyle(StyleChange change)
     if (m_inStyleRecalc)
         return; // Guard against re-entrancy. -dwh
 
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent();
+    if (timelineAgent)
+        timelineAgent->willRecalculateStyle();
+#endif
+
     m_inStyleRecalc = true;
     suspendPostAttachCallbacks();
     if (view())
@@ -1226,6 +1292,11 @@ bail_out:
         m_closeAfterStyleRecalc = false;
         implicitClose();
     }
+
+#if ENABLE(INSPECTOR)
+    if (timelineAgent)
+        timelineAgent->didRecalculateStyle();
+#endif
 }
 
 void Document::updateStyleIfNeeded()
@@ -1322,7 +1393,8 @@ void Document::attach()
         bool matchAuthorAndUserStyles = true;
         if (Settings* docSettings = settings())
             matchAuthorAndUserStyles = docSettings->authorAndUserStylesEnabled();
-        m_styleSelector = new CSSStyleSelector(this, userStyleSheet(), m_styleSheets.get(), m_mappedElementSheet.get(), !inCompatMode(), matchAuthorAndUserStyles);
+        m_styleSelector = new CSSStyleSelector(this, m_styleSheets.get(), m_mappedElementSheet.get(), pageUserSheet(), pageGroupUserSheets(), 
+                                               !inCompatMode(), matchAuthorAndUserStyles);
     }
 
     recalcStyle(Force);
@@ -1348,7 +1420,11 @@ void Document::detach()
     // Send out documentWillBecomeInactive() notifications to registered elements,
     // in order to stop media elements
     documentWillBecomeInactive();
-    
+
+#if ENABLE(SHARED_WORKERS)
+    SharedWorkerRepository::documentDetached(this);
+#endif
+
     if (m_frame) {
         FrameView* view = m_frame->view();
         if (view)
@@ -1386,29 +1462,10 @@ void Document::removeAllEventListeners()
 {
     if (DOMWindow* domWindow = this->domWindow())
         domWindow->removeAllEventListeners();
-    removeAllDisconnectedNodeEventListeners();
     for (Node* node = this; node; node = node->traverseNextNode())
         node->removeAllEventListeners();
 }
 
-void Document::registerDisconnectedNodeWithEventListeners(Node* node)
-{
-    m_disconnectedNodesWithEventListeners.add(node);
-}
-
-void Document::unregisterDisconnectedNodeWithEventListeners(Node* node)
-{
-    m_disconnectedNodesWithEventListeners.remove(node);
-}
-
-void Document::removeAllDisconnectedNodeEventListeners()
-{
-    HashSet<Node*>::iterator end = m_disconnectedNodesWithEventListeners.end();
-    for (HashSet<Node*>::iterator i = m_disconnectedNodesWithEventListeners.begin(); i != end; ++i)
-        (*i)->removeAllEventListeners();
-    m_disconnectedNodesWithEventListeners.clear();
-}
-
 RenderView* Document::renderView() const
 {
     return toRenderView(renderer());
@@ -1649,6 +1706,7 @@ void Document::implicitClose()
 
     ImageLoader::dispatchPendingLoadEvents();
     dispatchLoadEvent();
+    dispatchPageTransitionEvent(EventNames().pageshowEvent, false);
     if (f)
         f->loader()->handledOnloadEvents();
 #ifdef INSTRUMENT_LAYOUT_SCHEDULING
@@ -1695,7 +1753,7 @@ void Document::implicitClose()
         // exists in the cache (we ignore the return value because we don't need it here). This is 
         // only safe to call when a layout is not in progress, so it can not be used in postNotification.    
         axObjectCache()->getOrCreate(renderObject);
-        axObjectCache()->postNotification(renderObject, "AXLoadComplete", true);
+        axObjectCache()->postNotification(renderObject, AXObjectCache::AXLoadComplete, true);
     }
 #endif
 
@@ -1857,34 +1915,68 @@ String Document::userAgent(const KURL& url) const
     return frame() ? frame()->loader()->userAgent(url) : String();
 }
 
-void Document::setCSSStyleSheet(const String& url, const String& charset, const CachedCSSStyleSheet* sheet)
+CSSStyleSheet* Document::pageUserSheet()
 {
-    m_sheet = CSSStyleSheet::create(this, url, charset);
-    m_sheet->parseString(sheet->sheetText());
+    if (m_pageUserSheet)
+        return m_pageUserSheet.get();
+    
+    Page* owningPage = page();
+    if (!owningPage)
+        return 0;
+    
+    String userSheetText = owningPage->userStyleSheet();
+    if (userSheetText.isEmpty())
+        return 0;
+    
+    // Parse the sheet and cache it.
+    m_pageUserSheet = CSSStyleSheet::create(this);
+    m_pageUserSheet->parseString(userSheetText, !inCompatMode());
+    return m_pageUserSheet.get();
+}
 
+void Document::clearPageUserSheet()
+{
+    m_pageUserSheet = 0;
     updateStyleSelector();
 }
 
-#if FRAME_LOADS_USER_STYLESHEET
-void Document::setUserStyleSheet(const String& sheet)
+const Vector<RefPtr<CSSStyleSheet> >* Document::pageGroupUserSheets() const
 {
-    if (m_usersheet != sheet) {
-        m_usersheet = sheet;
-        updateStyleSelector();
+    if (m_pageGroupUserSheetCacheValid)
+        return m_pageGroupUserSheets.get();
+    
+    m_pageGroupUserSheetCacheValid = true;
+    
+    Page* owningPage = page();
+    if (!owningPage)
+        return 0;
+        
+    const PageGroup& pageGroup = owningPage->group();
+    const UserStyleSheetMap* sheetsMap = pageGroup.userStyleSheets();
+    if (!sheetsMap)
+        return 0;
+
+    UserStyleSheetMap::const_iterator end = sheetsMap->end();
+    for (UserStyleSheetMap::const_iterator it = sheetsMap->begin(); it != end; ++it) {
+        const UserStyleSheetVector* sheets = it->second;
+        for (unsigned i = 0; i < sheets->size(); ++i) {
+            const UserStyleSheet* sheet = sheets->at(i).get();
+            RefPtr<CSSStyleSheet> parsedSheet = CSSStyleSheet::create(const_cast<Document*>(this));
+            parsedSheet->parseString(sheet->source(), !inCompatMode());
+            if (!m_pageGroupUserSheets)
+                m_pageGroupUserSheets.set(new Vector<RefPtr<CSSStyleSheet> >);
+            m_pageGroupUserSheets->append(parsedSheet.release());
+        }
     }
+
+    return m_pageGroupUserSheets.get();
 }
-#endif
 
-String Document::userStyleSheet() const
+void Document::clearPageGroupUserSheets()
 {
-#if FRAME_LOADS_USER_STYLESHEET
-    return m_usersheet;
-#else
-    Page* page = this->page();
-    if (!page)
-        return String();
-    return page->userStyleSheet();
-#endif
+    m_pageGroupUserSheets.clear();
+    m_pageGroupUserSheetCacheValid = false;
+    updateStyleSelector();
 }
 
 CSSStyleSheet* Document::elementSheet()
@@ -2448,7 +2540,8 @@ void Document::recalcStyleSelector()
 
     // Create a new style selector
     delete m_styleSelector;
-    m_styleSelector = new CSSStyleSelector(this, userStyleSheet(), m_styleSheets.get(), m_mappedElementSheet.get(), !inCompatMode(), matchAuthorAndUserStyles);
+    m_styleSelector = new CSSStyleSelector(this, m_styleSheets.get(), m_mappedElementSheet.get(), 
+                                           pageUserSheet(), pageGroupUserSheets(), !inCompatMode(), matchAuthorAndUserStyles);
     m_didCalculateStyleSelector = true;
 }
 
@@ -2541,13 +2634,12 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
         oldFocusedNode->setFocus(false);
                 
         // Dispatch a change event for text fields or textareas that have been edited
-        RenderObject* r = static_cast<RenderObject*>(oldFocusedNode.get()->renderer());
+        RenderObject* r = oldFocusedNode->renderer();
         if (r && r->isTextControl() && toRenderTextControl(r)->isEdited()) {
             oldFocusedNode->dispatchEvent(eventNames().changeEvent, true, false);
-            if ((r = static_cast<RenderObject*>(oldFocusedNode.get()->renderer()))) {
-                if (r->isTextControl())
-                    toRenderTextControl(r)->setEdited(false);
-            }
+            r = oldFocusedNode->renderer();
+            if (r && r->isTextControl())
+                toRenderTextControl(r)->setEdited(false);
         }
 
         // Dispatch the blur event and let the node do any other blur related activities (important for text fields)
@@ -2564,10 +2656,10 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
             focusChangeBlocked = true;
             newFocusedNode = 0;
         }
-        if ((oldFocusedNode.get() == this) && oldFocusedNode->hasOneRef())
+        if (oldFocusedNode == this && oldFocusedNode->hasOneRef())
             return true;
             
-        if (oldFocusedNode.get() == oldFocusedNode->rootEditableElement())
+        if (oldFocusedNode == oldFocusedNode->rootEditableElement())
             frame()->editor()->didEndEditing();
     }
 
@@ -2596,7 +2688,7 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
         }
         m_focusedNode->setFocus();
 
-        if (m_focusedNode.get() == m_focusedNode->rootEditableElement())
+        if (m_focusedNode == m_focusedNode->rootEditableElement())
             frame()->editor()->didBeginEditing();
 
         // eww, I suck. set the qt focus correctly
@@ -2618,20 +2710,17 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
         }
     }
 
-#if PLATFORM(MAC) && !PLATFORM(CHROMIUM)
-    if (!focusChangeBlocked && m_focusedNode && AXObjectCache::accessibilityEnabled())
-        axObjectCache()->handleFocusedUIElementChanged();
-#elif PLATFORM(GTK)
+#if ((PLATFORM(MAC) || PLATFORM(WIN)) && !PLATFORM(CHROMIUM)) || PLATFORM(GTK)
     if (!focusChangeBlocked && m_focusedNode && AXObjectCache::accessibilityEnabled()) {
         RenderObject* oldFocusedRenderer = 0;
         RenderObject* newFocusedRenderer = 0;
 
         if (oldFocusedNode)
-            oldFocusedRenderer = oldFocusedNode.get()->renderer();
+            oldFocusedRenderer = oldFocusedNode->renderer();
         if (newFocusedNode)
-            newFocusedRenderer = newFocusedNode.get()->renderer();
+            newFocusedRenderer = newFocusedNode->renderer();
 
-        axObjectCache()->handleFocusedUIElementChangedWithRenderers(oldFocusedRenderer, newFocusedRenderer);
+        axObjectCache()->handleFocusedUIElementChanged(oldFocusedRenderer, newFocusedRenderer);
     }
 #endif
 
@@ -2802,6 +2891,15 @@ void Document::dispatchLoadEvent()
     domWindow->dispatchLoadEvent();
 }
 
+void Document::dispatchPageTransitionEvent(const AtomicString& eventType, bool persisted)
+{
+    ASSERT(!eventDispatchForbidden());
+    DOMWindow* domWindow = this->domWindow();
+    if (!domWindow)
+        return;
+    domWindow->dispatchPageTransitionEvent(eventType, persisted);
+}
+
 PassRefPtr<Event> Document::createEvent(const String& eventType, ExceptionCode& ec)
 {
     if (eventType == "Event" || eventType == "Events" || eventType == "HTMLEvents")
@@ -2816,6 +2914,8 @@ PassRefPtr<Event> Document::createEvent(const String& eventType, ExceptionCode&
         return MutationEvent::create();
     if (eventType == "OverflowEvent")
         return OverflowEvent::create();
+    if (eventType == "PageTransitionEvent")
+        return PageTransitionEvent::create();
     if (eventType == "ProgressEvent")
         return ProgressEvent::create();
 #if ENABLE(DOM_STORAGE)
@@ -3825,7 +3925,7 @@ PassRefPtr<Attr> Document::createAttributeNS(const String& namespaceURI, const S
 
     // FIXME: Assume this is a mapped attribute, since createAttribute isn't namespace-aware.  There's no harm to XML
     // documents if we're wrong.
-    return new Attr(0, this, MappedAttribute::create(qName, StringImpl::empty()));
+    return Attr::create(0, this, MappedAttribute::create(qName, StringImpl::empty()));
 }
 
 #if ENABLE(SVG)
@@ -4126,7 +4226,7 @@ void Document::initSecurityContext()
     if (!m_frame) {
         // No source for a security context.
         // This can occur via document.implementation.createDocument().
-        m_cookieURL = KURL("");
+        m_cookieURL = KURL(ParsedURLString, "");
         ScriptExecutionContext::setSecurityOrigin(SecurityOrigin::createEmpty());
         return;
     }
@@ -4327,7 +4427,7 @@ void Document::detachRange(Range* range)
     m_ranges.remove(range);
 }
 
-CanvasRenderingContext2D* Document::getCSSCanvasContext(const String& type, const String& name, int width, int height)
+CanvasRenderingContext* Document::getCSSCanvasContext(const String& type, const String& name, int width, int height)
 {
     HTMLCanvasElement* result = getCSSCanvasElement(name);
     if (!result)
@@ -4378,10 +4478,12 @@ void Document::reportException(const String& errorMessage, int lineNumber, const
 void Document::addMessage(MessageDestination destination, MessageSource source, MessageType type, MessageLevel level, const String& message, unsigned lineNumber, const String& sourceURL)
 {
     switch (destination) {
+#if ENABLE(INSPECTOR)
     case InspectorControllerDestination:
         if (page())
             page()->inspectorController()->addMessageToConsole(source, type, level, message, lineNumber, sourceURL);
         return;
+#endif
     case ConsoleDestination:
         if (DOMWindow* window = domWindow())
             window->console()->addMessage(source, type, level, message, lineNumber, sourceURL);
@@ -4392,8 +4494,10 @@ void Document::addMessage(MessageDestination destination, MessageSource source,
 
 void Document::resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString)
 {
+#if ENABLE(INSPECTOR)
     if (page())
         page()->inspectorController()->resourceRetrievedByXMLHttpRequest(identifier, sourceString);
+#endif
     Frame* frame = this->frame();
     if (frame) {
         FrameLoader* frameLoader = frame->loader();
@@ -4403,8 +4507,13 @@ void Document::resourceRetrievedByXMLHttpRequest(unsigned long identifier, const
 
 void Document::scriptImported(unsigned long identifier, const String& sourceString)
 {
+#if ENABLE(INSPECTOR)
     if (page())
         page()->inspectorController()->scriptImported(identifier, sourceString);
+#else
+    UNUSED_PARAM(identifier);
+    UNUSED_PARAM(sourceString);
+#endif
 }
 
 class ScriptExecutionContextTaskTimer : public TimerBase {
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.h b/src/3rdparty/webkit/WebCore/dom/Document.h
index 6655d9b..bb247f3 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.h
+++ b/src/3rdparty/webkit/WebCore/dom/Document.h
@@ -33,19 +33,11 @@
 #include "CollectionType.h"
 #include "Color.h"
 #include "DocumentMarker.h"
+#include "Page.h"
 #include "ScriptExecutionContext.h"
 #include "Timer.h"
 #include <wtf/HashCountedSet.h>
 
-// FIXME: We should move Mac off of the old Frame-based user stylesheet loading
-// code and onto the new code in Page. We can't do that until the code in Page
-// supports non-file: URLs, however.
-#if PLATFORM(MAC) || PLATFORM(QT)
-#define FRAME_LOADS_USER_STYLESHEET 1
-#else
-#define FRAME_LOADS_USER_STYLESHEET 0
-#endif
-
 namespace WebCore {
 
     class Attr;
@@ -53,7 +45,7 @@ namespace WebCore {
     class CDATASection;
     class CachedCSSStyleSheet;
     class CachedScript;
-    class CanvasRenderingContext2D;
+    class CanvasRenderingContext;
     class CharacterData;
     class CSSStyleDeclaration;
     class CSSStyleSelector;
@@ -83,12 +75,12 @@ namespace WebCore {
     class HTMLHeadElement;
     class HTMLInputElement;
     class HTMLMapElement;
+    class InspectorTimelineAgent;
     class IntPoint;
     class JSNode;
     class MouseEventWithHitTestResults;
     class NodeFilter;
     class NodeIterator;
-    class Page;
     class PlatformMouseEvent;
     class ProcessingInstruction;
     class Range;
@@ -172,19 +164,16 @@ class Document : public ContainerNode, public ScriptExecutionContext {
 public:
     static PassRefPtr<Document> create(Frame* frame)
     {
-        return new Document(frame, false);
+        return adoptRef(new Document(frame, false));
     }
     static PassRefPtr<Document> createXHTML(Frame* frame)
     {
-        return new Document(frame, true);
+        return adoptRef(new Document(frame, true));
     }
     virtual ~Document();
 
-    virtual bool isDocument() const { return true; }
-
     using ContainerNode::ref;
     using ContainerNode::deref;
-    virtual void removedLastRef();
 
     // Nodes belonging to this document hold "self-only" references -
     // these are enough to keep the document from being destroyed, but
@@ -214,7 +203,6 @@ public:
     DocumentType* doctype() const { return m_docType.get(); }
 
     DOMImplementation* implementation() const;
-    virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
     
     Element* documentElement() const
     {
@@ -240,6 +228,8 @@ public:
     bool containsMultipleElementsWithId(const AtomicString& elementId) { return m_duplicateIds.contains(elementId.impl()); }
 
     Element* elementFromPoint(int x, int y) const;
+    PassRefPtr<Range> caretRangeFromPoint(int x, int y);
+
     String readyState() const;
 
     String defaultCharset() const;
@@ -299,11 +289,6 @@ public:
 
     CollectionCache* nameCollectionInfo(CollectionType, const AtomicString& name);
 
-    // DOM methods overridden from  parent classes
-
-    virtual String nodeName() const;
-    virtual NodeType nodeType() const;
-
     // Other methods (not part of DOM)
     virtual bool isHTMLDocument() const { return false; }
     virtual bool isImageDocument() const { return false; }
@@ -392,6 +377,9 @@ public:
     Frame* frame() const { return m_frame; } // can be NULL
     Page* page() const; // can be NULL
     Settings* settings() const; // can be NULL
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* inspectorTimelineAgent() const; // can be NULL
+#endif
 
     PassRefPtr<Range> createRange();
 
@@ -455,17 +443,15 @@ public:
 
     virtual String userAgent(const KURL&) const;
 
-    // from cachedObjectClient
-    virtual void setCSSStyleSheet(const String& url, const String& charset, const CachedCSSStyleSheet*);
-
-#if FRAME_LOADS_USER_STYLESHEET
-    void setUserStyleSheet(const String& sheet);
-#endif
+    CSSStyleSheet* pageUserSheet();
+    void clearPageUserSheet();
 
-    String userStyleSheet() const;
+    const Vector<RefPtr<CSSStyleSheet> >* pageGroupUserSheets() const;
+    void clearPageGroupUserSheets();
 
     CSSStyleSheet* elementSheet();
     CSSStyleSheet* mappedElementSheet();
+    
     virtual Tokenizer* createTokenizer();
     Tokenizer* tokenizer() { return m_tokenizer; }
     
@@ -474,10 +460,6 @@ public:
 
     enum ParseMode { Compat, AlmostStrict, Strict };
 
-private:
-    virtual void determineParseMode() {}
-    
-public:
     void setParseMode(ParseMode m) { m_parseMode = m; }
     ParseMode parseMode() const { return m_parseMode; }
 
@@ -506,11 +488,6 @@ public:
     
     MouseEventWithHitTestResults prepareMouseEvent(const HitTestRequest&, const IntPoint&, const PlatformMouseEvent&);
 
-    virtual bool childTypeAllowed(NodeType);
-    virtual PassRefPtr<Node> cloneNode(bool deep);
-
-    virtual bool canReplaceChild(Node* newChild, Node* oldChild);
-    
     StyleSheetList* styleSheets();
 
     /* Newly proposed CSS3 mechanism for selecting alternate
@@ -573,6 +550,7 @@ public:
     void dispatchWindowEvent(PassRefPtr<Event>);
     void dispatchWindowEvent(const AtomicString& eventType, bool canBubbleArg, bool cancelableArg);
     void dispatchLoadEvent();
+    void dispatchPageTransitionEvent(const AtomicString& eventType, bool persisted);
 
     PassRefPtr<Event> createEvent(const String& eventType, ExceptionCode&);
 
@@ -743,8 +721,6 @@ public:
 
     void setDocType(PassRefPtr<DocumentType>);
 
-    virtual void finishedParsing();
-
 #if ENABLE(XPATH)
     // XPathEvaluator methods
     PassRefPtr<XPathExpression> createExpression(const String& expression,
@@ -782,11 +758,10 @@ public:
     DOMSelection* getSelection() const;
     
     // Extension for manipulating canvas drawing contexts for use in CSS
-    CanvasRenderingContext2D* getCSSCanvasContext(const String& type, const String& name, int width, int height);
+    CanvasRenderingContext* getCSSCanvasContext(const String& type, const String& name, int width, int height);
     HTMLCanvasElement* getCSSCanvasElement(const String& name);
 
     bool isDNSPrefetchEnabled() const { return m_isDNSPrefetchEnabled; }
-    void initDNSPrefetch();
     void parseDNSPrefetchControlHeader(const String&);
 
     virtual void reportException(const String& errorMessage, int lineNumber, const String& sourceURL);
@@ -795,22 +770,124 @@ public:
     virtual void scriptImported(unsigned long, const String&);
     virtual void postTask(PassRefPtr<Task>); // Executes the task on context's thread asynchronously.
 
+    typedef HashMap<WebCore::Node*, JSNode*> JSWrapperCache;
+    JSWrapperCache& wrapperCache() { return m_wrapperCache; }
+
+    virtual void finishedParsing();
+
+    bool inPageCache() const { return m_inPageCache; }
+    void setInPageCache(bool flag);
+    
+    // Elements can register themselves for the "documentWillBecomeInactive()" and  
+    // "documentDidBecomeActive()" callbacks
+    void registerForDocumentActivationCallbacks(Element*);
+    void unregisterForDocumentActivationCallbacks(Element*);
+    void documentWillBecomeInactive();
+    void documentDidBecomeActive();
+
+    void registerForMediaVolumeCallbacks(Element*);
+    void unregisterForMediaVolumeCallbacks(Element*);
+    void mediaVolumeDidChange();
+
+    void setShouldCreateRenderers(bool);
+    bool shouldCreateRenderers();
+
+    void setDecoder(PassRefPtr<TextResourceDecoder>);
+    TextResourceDecoder* decoder() const { return m_decoder.get(); }
+
+    String displayStringModifiedByEncoding(const String&) const;
+    PassRefPtr<StringImpl> displayStringModifiedByEncoding(PassRefPtr<StringImpl>) const;
+    void displayBufferModifiedByEncoding(UChar* buffer, unsigned len) const;
+
+    // Quirk for the benefit of Apple's Dictionary application.
+    void setFrameElementsShouldIgnoreScrolling(bool ignore) { m_frameElementsShouldIgnoreScrolling = ignore; }
+    bool frameElementsShouldIgnoreScrolling() const { return m_frameElementsShouldIgnoreScrolling; }
+
+#if ENABLE(DASHBOARD_SUPPORT)
+    void setDashboardRegionsDirty(bool f) { m_dashboardRegionsDirty = f; }
+    bool dashboardRegionsDirty() const { return m_dashboardRegionsDirty; }
+    bool hasDashboardRegions () const { return m_hasDashboardRegions; }
+    void setHasDashboardRegions(bool f) { m_hasDashboardRegions = f; }
+    const Vector<DashboardRegionValue>& dashboardRegions() const;
+    void setDashboardRegions(const Vector<DashboardRegionValue>&);
+#endif
+
+    void removeAllEventListeners();
+
+    CheckedRadioButtons& checkedRadioButtons() { return m_checkedRadioButtons; }
+    
+#if ENABLE(SVG)
+    const SVGDocumentExtensions* svgExtensions();
+    SVGDocumentExtensions* accessSVGExtensions();
+#endif
+
+    void initSecurityContext();
+
+    // Explicitly override the security origin for this document.
+    // Note: It is dangerous to change the security origin of a document
+    //       that already contains content.
+    void setSecurityOrigin(SecurityOrigin*);
+
+    bool processingLoadEvent() const { return m_processingLoadEvent; }
+
+#if ENABLE(DATABASE)
+    void addOpenDatabase(Database*);
+    void removeOpenDatabase(Database*);
+    DatabaseThread* databaseThread();   // Creates the thread as needed, but not if it has been already terminated.
+    void setHasOpenDatabases() { m_hasOpenDatabases = true; }
+    bool hasOpenDatabases() { return m_hasOpenDatabases; }
+    void stopDatabases();
+#endif
+
+    void setUsingGeolocation(bool f) { m_usingGeolocation = f; }
+    bool usingGeolocation() const { return m_usingGeolocation; };
+
+#if ENABLE(WML)
+    void setContainsWMLContent(bool value) { m_containsWMLContent = value; }
+    bool containsWMLContent() const { return m_containsWMLContent; }
+
+    void resetWMLPageState();
+    void initializeWMLPageState();
+#endif
+
 protected:
     Document(Frame*, bool isXHTML);
 
-    void setStyleSelector(CSSStyleSelector* styleSelector) {  m_styleSelector = styleSelector; }
+    void setStyleSelector(CSSStyleSelector* styleSelector) { m_styleSelector = styleSelector; }
+
+    void clearXMLVersion() { m_xmlVersion = String(); }
 
 private:
+    virtual bool isDocument() const { return true; }
+    virtual void removedLastRef();
+    virtual void determineParseMode() { }
+
+    virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
+
+    virtual String nodeName() const;
+    virtual NodeType nodeType() const;
+    virtual bool childTypeAllowed(NodeType);
+    virtual PassRefPtr<Node> cloneNode(bool deep);
+    virtual bool canReplaceChild(Node* newChild, Node* oldChild);
+
     virtual void refScriptExecutionContext() { ref(); }
     virtual void derefScriptExecutionContext() { deref(); }
 
     virtual const KURL& virtualURL() const; // Same as url(), but needed for ScriptExecutionContext to implement it without a performance loss for direct calls.
     virtual KURL virtualCompleteURL(const String&) const; // Same as completeURL() for the same reason as above.
 
+    void initDNSPrefetch();
+
     String encoding() const;
 
     void executeScriptSoonTimerFired(Timer<Document>*);
 
+    void updateTitle();
+    void updateFocusAppearanceTimerFired(Timer<Document>*);
+    void updateBaseURL();
+
+    void cacheDocumentElement() const;
+
     CSSStyleSelector* m_styleSelector;
     bool m_didCalculateStyleSelector;
 
@@ -838,11 +915,6 @@ private:
     RefPtr<DocumentType> m_docType;
     mutable RefPtr<DOMImplementation> m_implementation;
 
-    RefPtr<StyleSheet> m_sheet;
-#if FRAME_LOADS_USER_STYLESHEET
-    String m_usersheet;
-#endif
-
     // Track the number of currently loading top-level stylesheets.  Sheets
     // loaded using the @import directive are not included in this count.
     // We use this count of pending sheets to detect when we can begin attaching
@@ -862,6 +934,9 @@ private:
 
     RefPtr<CSSStyleSheet> m_elemSheet;
     RefPtr<CSSStyleSheet> m_mappedElementSheet;
+    RefPtr<CSSStyleSheet> m_pageUserSheet;
+    mutable OwnPtr<Vector<RefPtr<CSSStyleSheet> > > m_pageGroupUserSheets;
+    mutable bool m_pageGroupUserSheetCacheValid;
 
     bool m_printing;
     
@@ -949,8 +1024,6 @@ private:
     typedef HashMap<AtomicStringImpl*, HTMLMapElement*> ImageMapsByName;
     ImageMapsByName m_imageMapsByName;
 
-    HashSet<Node*> m_disconnectedNodesWithEventListeners;
-
     int m_docID; // A unique document identifier used for things like document-specific mapped attributes.
 
     String m_xmlEncoding;
@@ -963,96 +1036,6 @@ private:
     bool m_shouldProcessNoScriptElement;
 #endif
 
-public:
-    bool inPageCache() const { return m_inPageCache; }
-    void setInPageCache(bool flag);
-    
-    // Elements can register themselves for the "documentWillBecomeInactive()" and  
-    // "documentDidBecomeActive()" callbacks
-    void registerForDocumentActivationCallbacks(Element*);
-    void unregisterForDocumentActivationCallbacks(Element*);
-    void documentWillBecomeInactive();
-    void documentDidBecomeActive();
-
-    void registerForMediaVolumeCallbacks(Element*);
-    void unregisterForMediaVolumeCallbacks(Element*);
-    void mediaVolumeDidChange();
-
-    void setShouldCreateRenderers(bool);
-    bool shouldCreateRenderers();
-    
-    void setDecoder(PassRefPtr<TextResourceDecoder>);
-    TextResourceDecoder* decoder() const { return m_decoder.get(); }
-
-    String displayStringModifiedByEncoding(const String&) const;
-    PassRefPtr<StringImpl> displayStringModifiedByEncoding(PassRefPtr<StringImpl>) const;
-    void displayBufferModifiedByEncoding(UChar* buffer, unsigned len) const;
-
-    // Quirk for the benefit of Apple's Dictionary application.
-    void setFrameElementsShouldIgnoreScrolling(bool ignore) { m_frameElementsShouldIgnoreScrolling = ignore; }
-    bool frameElementsShouldIgnoreScrolling() const { return m_frameElementsShouldIgnoreScrolling; }
-
-#if ENABLE(DASHBOARD_SUPPORT)
-    void setDashboardRegionsDirty(bool f) { m_dashboardRegionsDirty = f; }
-    bool dashboardRegionsDirty() const { return m_dashboardRegionsDirty; }
-    bool hasDashboardRegions () const { return m_hasDashboardRegions; }
-    void setHasDashboardRegions(bool f) { m_hasDashboardRegions = f; }
-    const Vector<DashboardRegionValue>& dashboardRegions() const;
-    void setDashboardRegions(const Vector<DashboardRegionValue>&);
-#endif
-
-    void removeAllEventListeners();
-
-    void registerDisconnectedNodeWithEventListeners(Node*);
-    void unregisterDisconnectedNodeWithEventListeners(Node*);
-    
-    CheckedRadioButtons& checkedRadioButtons() { return m_checkedRadioButtons; }
-    
-#if ENABLE(SVG)
-    const SVGDocumentExtensions* svgExtensions();
-    SVGDocumentExtensions* accessSVGExtensions();
-#endif
-
-    void initSecurityContext();
-
-    // Explicitly override the security origin for this document.
-    // Note: It is dangerous to change the security origin of a document
-    //       that already contains content.
-    void setSecurityOrigin(SecurityOrigin*);
-
-    bool processingLoadEvent() const { return m_processingLoadEvent; }
-
-#if ENABLE(DATABASE)
-    void addOpenDatabase(Database*);
-    void removeOpenDatabase(Database*);
-    DatabaseThread* databaseThread();   // Creates the thread as needed, but not if it has been already terminated.
-    void setHasOpenDatabases() { m_hasOpenDatabases = true; }
-    bool hasOpenDatabases() { return m_hasOpenDatabases; }
-    void stopDatabases();
-#endif
-    
-    void setUsingGeolocation(bool f) { m_usingGeolocation = f; }
-    bool usingGeolocation() const { return m_usingGeolocation; };
-
-#if ENABLE(WML)
-    void setContainsWMLContent(bool value) { m_containsWMLContent = value; }
-    bool containsWMLContent() const { return m_containsWMLContent; }
-
-    void resetWMLPageState();
-    void initializeWMLPageState();
-#endif
-
-protected:
-    void clearXMLVersion() { m_xmlVersion = String(); }
-
-private:
-    void updateTitle();
-    void removeAllDisconnectedNodeEventListeners();
-    void updateFocusAppearanceTimerFired(Timer<Document>*);
-    void updateBaseURL();
-
-    void cacheDocumentElement() const;
-
     RenderObject* m_savedRenderer;
     int m_secureForms;
     
@@ -1106,10 +1089,6 @@ private:
 
     unsigned m_numNodeListCaches;
 
-public:
-    typedef HashMap<WebCore::Node*, JSNode*> JSWrapperCache;
-    JSWrapperCache& wrapperCache() { return m_wrapperCache; }
-private:
     JSWrapperCache m_wrapperCache;
 
 #if ENABLE(DATABASE)
@@ -1134,9 +1113,15 @@ inline bool Document::hasElementWithId(AtomicStringImpl* id) const
     
 inline bool Node::isDocumentNode() const
 {
-    return this == m_document.get();
+    return this == m_document;
 }
 
+#if ENABLE(INSPECTOR)
+inline InspectorTimelineAgent* Document::inspectorTimelineAgent() const {
+    return page() ? page()->inspectorTimelineAgent() : 0;
+}
+#endif
+
 } // namespace WebCore
 
 #endif // Document_h
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.idl b/src/3rdparty/webkit/WebCore/dom/Document.idl
index ad41057..34a9771 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Document.idl
@@ -35,7 +35,7 @@ module core {
         readonly attribute [V8Custom] DOMImplementation implementation;
         readonly attribute Element documentElement;
 
-        [ReturnsNew] Element createElement(in [ConvertNullToNullString] DOMString tagName)
+        [ReturnsNew] Element createElement(in [ConvertNullToNullString, HintAtomic] DOMString tagName)
             raises (DOMException);
         DocumentFragment   createDocumentFragment();
         [ReturnsNew] Text createTextNode(in DOMString data);
@@ -64,7 +64,7 @@ module core {
             raises (DOMException);
         [OldStyleObjC] NodeList getElementsByTagNameNS(in [ConvertNullToNullString] DOMString namespaceURI,
                                                        in DOMString localName);
-        Element            getElementById(in DOMString elementId);
+        Element            getElementById(in [HintAtomic] DOMString elementId);
 
         // DOM Level 3 Core
 
@@ -191,6 +191,9 @@ module core {
         readonly attribute [ConvertNullStringTo=Undefined] DOMString readyState;
 
         Element            elementFromPoint(in long x, in long y);
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+        Range              caretRangeFromPoint(in long x, in long y);
+#endif
 
         // Mozilla extensions
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
@@ -241,8 +244,8 @@ module core {
 
 #if defined(ENABLE_WML) && ENABLE_WML
         // Only used from within WML layout tests, WML doesn't have JS support at all.
-        void resetWMLPageState();
-        void initializeWMLPageState();
+        [DontEnum] void resetWMLPageState();
+        [DontEnum] void initializeWMLPageState();
 #endif
 
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
@@ -264,6 +267,7 @@ module core {
         attribute [DontEnum] EventListener onerror;
         attribute [DontEnum] EventListener onfocus;
         attribute [DontEnum] EventListener oninput;
+        attribute [DontEnum] EventListener oninvalid;
         attribute [DontEnum] EventListener onkeydown;
         attribute [DontEnum] EventListener onkeypress;
         attribute [DontEnum] EventListener onkeyup;
@@ -285,7 +289,6 @@ module core {
         // attribute [DontEnum] EventListener onended;
         // attribute [DontEnum] EventListener onformchange;
         // attribute [DontEnum] EventListener onforminput;
-        // attribute [DontEnum] EventListener oninvalid;
         // attribute [DontEnum] EventListener onloadeddata;
         // attribute [DontEnum] EventListener onloadedmetadata;
         // attribute [DontEnum] EventListener onloadstart;
diff --git a/src/3rdparty/webkit/WebCore/dom/DocumentFragment.cpp b/src/3rdparty/webkit/WebCore/dom/DocumentFragment.cpp
index 7a6174f..3663e99 100644
--- a/src/3rdparty/webkit/WebCore/dom/DocumentFragment.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/DocumentFragment.cpp
@@ -1,10 +1,8 @@
-/**
- * This file is part of the DOM implementation for KDE.
- *
+/*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -23,13 +21,18 @@
  */
 
 #include "config.h"
-
 #include "DocumentFragment.h"
 
 namespace WebCore {
 
-DocumentFragment::DocumentFragment(Document *doc) : ContainerNode(doc)
+inline DocumentFragment::DocumentFragment(Document* document)
+    : ContainerNode(document)
+{
+}
+
+PassRefPtr<DocumentFragment> DocumentFragment::create(Document* document)
 {
+    return adoptRef(new DocumentFragment(document));
 }
 
 String DocumentFragment::nodeName() const
@@ -42,7 +45,6 @@ Node::NodeType DocumentFragment::nodeType() const
     return DOCUMENT_FRAGMENT_NODE;
 }
 
-// DOM Section 1.1.1
 bool DocumentFragment::childTypeAllowed(NodeType type)
 {
     switch (type) {
@@ -60,7 +62,7 @@ bool DocumentFragment::childTypeAllowed(NodeType type)
 
 PassRefPtr<Node> DocumentFragment::cloneNode(bool deep)
 {
-    RefPtr<DocumentFragment> clone = new DocumentFragment(document());
+    RefPtr<DocumentFragment> clone = create(document());
     if (deep)
         cloneChildNodes(clone.get());
     return clone.release();
diff --git a/src/3rdparty/webkit/WebCore/dom/DocumentFragment.h b/src/3rdparty/webkit/WebCore/dom/DocumentFragment.h
index 46d8ecd..e624ee4 100644
--- a/src/3rdparty/webkit/WebCore/dom/DocumentFragment.h
+++ b/src/3rdparty/webkit/WebCore/dom/DocumentFragment.h
@@ -1,10 +1,8 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -32,6 +30,9 @@ namespace WebCore {
 
 class DocumentFragment : public ContainerNode {
 public:
+    static PassRefPtr<DocumentFragment> create(Document*);
+
+private:
     DocumentFragment(Document*);
 
     virtual String nodeName() const;
diff --git a/src/3rdparty/webkit/WebCore/dom/DocumentType.cpp b/src/3rdparty/webkit/WebCore/dom/DocumentType.cpp
index 885a65b..b8185e7 100644
--- a/src/3rdparty/webkit/WebCore/dom/DocumentType.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/DocumentType.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -29,11 +29,11 @@
 
 namespace WebCore {
 
-DocumentType::DocumentType(Document* document, const String& n, const String& p, const String& s)
-    : Node(document)
-    , m_name(n)
-    , m_publicId(p)
-    , m_systemId(s)
+DocumentType::DocumentType(Document* document, const String& name, const String& publicId, const String& systemId)
+    : Node(document, CreateOther)
+    , m_name(name)
+    , m_publicId(publicId)
+    , m_systemId(systemId)
 {
 }
 
@@ -54,7 +54,7 @@ Node::NodeType DocumentType::nodeType() const
 
 PassRefPtr<Node> DocumentType::cloneNode(bool /*deep*/)
 {
-    return new DocumentType(document(), m_name, m_publicId, m_systemId);
+    return create(document(), m_name, m_publicId, m_systemId);
 }
 
 void DocumentType::insertedIntoDocument()
diff --git a/src/3rdparty/webkit/WebCore/dom/DocumentType.h b/src/3rdparty/webkit/WebCore/dom/DocumentType.h
index 9fd3c6e..4f89d01 100644
--- a/src/3rdparty/webkit/WebCore/dom/DocumentType.h
+++ b/src/3rdparty/webkit/WebCore/dom/DocumentType.h
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -34,7 +34,7 @@ class DocumentType : public Node {
 public:
     static PassRefPtr<DocumentType> create(Document* document, const String& name, const String& publicId, const String& systemId)
     {
-        return new DocumentType(document, name, publicId, systemId);
+        return adoptRef(new DocumentType(document, name, publicId, systemId));
     }
 
     NamedNodeMap* entities() const { return m_entities.get(); }
diff --git a/src/3rdparty/webkit/WebCore/dom/EditingText.cpp b/src/3rdparty/webkit/WebCore/dom/EditingText.cpp
index 40cf97d..b36931a 100644
--- a/src/3rdparty/webkit/WebCore/dom/EditingText.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/EditingText.cpp
@@ -1,9 +1,5 @@
-/**
- * This file is part of the DOM implementation for KDE.
- *
- * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003 Apple Computer, Inc.
+/*
+ * Copyright (C) 2003, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,24 +20,19 @@
 #include "config.h"
 #include "EditingText.h"
 
-// FIXME: does this really require a class? Perhaps any Text node
-// inside an editable element should have the "always create a renderer"
-// behavior.
+// FIXME: Does this really require a class? Perhaps instead any text node
+// inside an editable element could have the "always create a renderer" behavior.
 
 namespace WebCore {
 
-EditingText::EditingText(Document *impl, const String &text)
-    : Text(impl, text)
-{
-}
-
-EditingText::EditingText(Document *impl)
-    : Text(impl)
+inline EditingText::EditingText(Document* document, const String& data)
+    : Text(document, data)
 {
 }
 
-EditingText::~EditingText()
+PassRefPtr<EditingText> EditingText::create(Document* document, const String& data)
 {
+    return adoptRef(new EditingText(document, data));
 }
 
 bool EditingText::rendererIsNeeded(RenderStyle*)
diff --git a/src/3rdparty/webkit/WebCore/dom/EditingText.h b/src/3rdparty/webkit/WebCore/dom/EditingText.h
index e114786..08223c2 100644
--- a/src/3rdparty/webkit/WebCore/dom/EditingText.h
+++ b/src/3rdparty/webkit/WebCore/dom/EditingText.h
@@ -1,9 +1,5 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
- * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003 Apple Computer, Inc.
+ * Copyright (C) 2003, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -31,11 +27,12 @@ namespace WebCore {
 
 class EditingText : public Text {
 public:
-    EditingText(Document *impl, const String &text);
-    EditingText(Document *impl);
-    virtual ~EditingText();
+    static PassRefPtr<EditingText> create(Document*, const String&);
 
+private:
     virtual bool rendererIsNeeded(RenderStyle *);
+
+    EditingText(Document*, const String&);
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/Element.cpp b/src/3rdparty/webkit/WebCore/dom/Element.cpp
index 1956be4..f04723f 100644
--- a/src/3rdparty/webkit/WebCore/dom/Element.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Element.cpp
@@ -57,12 +57,17 @@ namespace WebCore {
 using namespace HTMLNames;
 using namespace XMLNames;
     
-Element::Element(const QualifiedName& tagName, Document* doc)
-    : ContainerNode(doc, true)
+Element::Element(const QualifiedName& tagName, Document* document, ConstructionType type)
+    : ContainerNode(document, type)
     , m_tagName(tagName)
 {
 }
 
+PassRefPtr<Element> Element::create(const QualifiedName& tagName, Document* document)
+{
+    return adoptRef(new Element(tagName, document, CreateElement));
+}
+
 Element::~Element()
 {
     if (namedAttrMap)
@@ -597,16 +602,20 @@ void Element::attributeChanged(Attribute* attr, bool)
 
 void Element::updateAfterAttributeChanged(Attribute* attr)
 {
-    if (!document()->axObjectCache()->accessibilityEnabled())
+    AXObjectCache* axObjectCache = document()->axObjectCache();
+    if (!axObjectCache->accessibilityEnabled())
         return;
 
     const QualifiedName& attrName = attr->name();
     if (attrName == aria_activedescendantAttr) {
         // any change to aria-activedescendant attribute triggers accessibility focus change, but document focus remains intact
-        document()->axObjectCache()->handleActiveDescendantChanged(renderer());
+        axObjectCache->handleActiveDescendantChanged(renderer());
     } else if (attrName == roleAttr) {
         // the role attribute can change at any time, and the AccessibilityObject must pick up these changes
-        document()->axObjectCache()->handleAriaRoleChanged(renderer());
+        axObjectCache->handleAriaRoleChanged(renderer());
+    } else if (attrName == aria_valuenowAttr) {
+        // If the valuenow attribute changes, AX clients need to be notified.
+        axObjectCache->postNotification(renderer(), AXObjectCache::AXValueChanged, true);
     }
 }
     
@@ -677,7 +686,7 @@ void Element::setPrefix(const AtomicString &_prefix, ExceptionCode& ec)
 
 KURL Element::baseURI() const
 {
-    KURL base(getAttribute(baseAttr));
+    KURL base(KURL(), getAttribute(baseAttr));
     if (!base.protocol().isEmpty())
         return base;
 
@@ -804,7 +813,8 @@ bool Element::pseudoStyleCacheIsInvalid(const RenderStyle* currentStyle, RenderS
 
 void Element::recalcStyle(StyleChange change)
 {
-    RenderStyle* currentStyle = renderStyle();
+    // Ref currentStyle in case it would otherwise be deleted when setRenderStyle() is called.
+    RefPtr<RenderStyle> currentStyle(renderStyle());
     bool hasParentStyle = parentNode() ? parentNode()->renderStyle() : false;
     bool hasPositionalRules = needsStyleRecalc() && currentStyle && currentStyle->childrenAffectedByPositionalRules();
     bool hasDirectAdjacentRules = currentStyle && currentStyle->childrenAffectedByDirectAdjacentRules();
@@ -820,7 +830,7 @@ void Element::recalcStyle(StyleChange change)
     }
     if (hasParentStyle && (change >= Inherit || needsStyleRecalc())) {
         RefPtr<RenderStyle> newStyle = document()->styleSelector()->styleForElement(this);
-        StyleChange ch = diff(currentStyle, newStyle.get());
+        StyleChange ch = diff(currentStyle.get(), newStyle.get());
         if (ch == Detach || !currentStyle) {
             if (attached())
                 detach();
@@ -852,9 +862,9 @@ void Element::recalcStyle(StyleChange change)
                 newStyle->setChildrenAffectedByDirectAdjacentRules();
         }
 
-        if (ch != NoChange || pseudoStyleCacheIsInvalid(currentStyle, newStyle.get())) {
+        if (ch != NoChange || pseudoStyleCacheIsInvalid(currentStyle.get(), newStyle.get())) {
             setRenderStyle(newStyle);
-        } else if (needsStyleRecalc() && (styleChangeType() != AnimationStyleChange) && (document()->usesSiblingRules() || document()->usesDescendantRules())) {
+        } else if (needsStyleRecalc() && (styleChangeType() != SyntheticStyleChange) && (document()->usesSiblingRules() || document()->usesDescendantRules())) {
             // Although no change occurred, we use the new style so that the cousin style sharing code won't get
             // fooled into believing this style is the same.  This is only necessary if the document actually uses
             // sibling/descendant rules, since otherwise it isn't possible for ancestor styles to affect sharing of
@@ -863,7 +873,7 @@ void Element::recalcStyle(StyleChange change)
                 renderer()->setStyleInternal(newStyle.get());
             else
                 setRenderStyle(newStyle);
-        } else if (styleChangeType() == AnimationStyleChange)
+        } else if (styleChangeType() == SyntheticStyleChange)
              setRenderStyle(newStyle);
 
         if (change != Force) {
@@ -1215,14 +1225,24 @@ void Element::focus(bool restorePreviousSelection)
     if (doc->focusedNode() == this)
         return;
 
-    doc->updateLayoutIgnorePendingStylesheets();
-    
     if (!supportsFocus())
         return;
-    
+
+    // If the stylesheets have already been loaded we can reliably check isFocusable.
+    // If not, we continue and set the focused node on the focus controller below so
+    // that it can be updated soon after attach. 
+    if (doc->haveStylesheetsLoaded()) {
+        doc->updateLayoutIgnorePendingStylesheets();
+        if (!isFocusable())
+            return;
+    }
+
     if (Page* page = doc->page())
         page->focusController()->setFocusedNode(this, doc->frame());
 
+    // Setting the focused node above might have invalidated the layout due to scripts.
+    doc->updateLayoutIgnorePendingStylesheets();
+
     if (!isFocusable()) {
         ensureRareData()->setNeedsFocusAppearanceUpdateSoonAfterAttach(true);
         return;
diff --git a/src/3rdparty/webkit/WebCore/dom/Element.h b/src/3rdparty/webkit/WebCore/dom/Element.h
index 0ff2ed1..e7a910c 100644
--- a/src/3rdparty/webkit/WebCore/dom/Element.h
+++ b/src/3rdparty/webkit/WebCore/dom/Element.h
@@ -3,7 +3,7 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -41,8 +41,8 @@ class IntSize;
 
 class Element : public ContainerNode {
 public:
-    Element(const QualifiedName&, Document*);
-    ~Element();
+    static PassRefPtr<Element> create(const QualifiedName&, Document*);
+    virtual ~Element();
 
     const AtomicString& getIDAttribute() const;
     bool hasAttribute(const QualifiedName&) const;
@@ -64,7 +64,6 @@ public:
     void scrollIntoView(bool alignToTop = true);
     void scrollIntoViewIfNeeded(bool centerIfNeeded = true);
 
-    void scrollByUnits(int units, ScrollGranularity);
     void scrollByLines(int lines);
     void scrollByPages(int pages);
 
@@ -108,17 +107,11 @@ public:
 
     const AtomicString& localName() const { return m_tagName.localName(); }
     const AtomicString& prefix() const { return m_tagName.prefix(); }
-    virtual void setPrefix(const AtomicString&, ExceptionCode&);
     const AtomicString& namespaceURI() const { return m_tagName.namespaceURI(); }
 
     virtual KURL baseURI() const;
 
-    // DOM methods overridden from parent classes
-    virtual NodeType nodeType() const;
     virtual String nodeName() const;
-    virtual void insertedIntoDocument();
-    virtual void removedFromDocument();
-    virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
     PassRefPtr<Element> cloneElementWithChildren();
     PassRefPtr<Element> cloneElementWithoutChildren();
@@ -136,13 +129,9 @@ public:
     // This method is called whenever an attribute is added, changed or removed.
     virtual void attributeChanged(Attribute*, bool preserveDecls = false);
 
-    // The implementation of Element::attributeChanged() calls the following two functions.
-    // They are separated to allow a different flow of control in StyledElement::attributeChanged().
-    void recalcStyleIfNeededAfterAttributeChanged(Attribute*);
-    void updateAfterAttributeChanged(Attribute*);
-
     // not part of the DOM
     void setAttributeMap(PassRefPtr<NamedNodeMap>);
+    NamedNodeMap* attributeMap() const { return namedAttrMap.get(); }
 
     virtual void copyNonAttributeProperties(const Element* /*source*/) { }
 
@@ -153,10 +142,6 @@ public:
 
     virtual RenderStyle* computedStyle();
 
-    virtual bool childTypeAllowed(NodeType);
-
-    virtual PassRefPtr<Attribute> createAttribute(const QualifiedName&, const AtomicString& value);
-    
     void dispatchAttrRemovalEvent(Attribute*);
     void dispatchAttrAdditionEvent(Attribute*);
 
@@ -171,12 +156,6 @@ public:
     virtual void updateFocusAppearance(bool restorePreviousSelection);
     void blur();
 
-#ifndef NDEBUG
-    virtual void formatForDebugger(char* buffer, unsigned length) const;
-#endif
-
-    bool pseudoStyleCacheIsInvalid(const RenderStyle* currentStyle, RenderStyle* newStyle);
-
     String innerText() const;
     String outerText() const;
  
@@ -207,13 +186,15 @@ public:
     Element* nextElementSibling() const;
     unsigned childElementCount() const;
 
-    // FormControlElement API
     virtual bool isFormControlElement() const { return false; }
     virtual bool isEnabledFormControl() const { return true; }
     virtual bool isReadOnlyFormControl() const { return false; }
     virtual bool isTextFormControl() const { return false; }
     virtual bool isOptionalFormControl() const { return false; }
     virtual bool isRequiredFormControl() const { return false; }
+    virtual bool isDefaultButtonForForm() const { return false; }
+    virtual bool willValidate() const { return false; }
+    virtual bool isValidFormControlElement() { return false; }
 
     virtual bool formControlValueMatchesRenderer() const { return false; }
     virtual void setFormControlValueMatchesRenderer(bool) { }
@@ -226,13 +207,39 @@ public:
 
     virtual void dispatchFormControlChangeEvent() { }
 
+protected:
+    Element(const QualifiedName&, Document*, ConstructionType);
+
+    virtual void insertedIntoDocument();
+    virtual void removedFromDocument();
+    virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
+
+    // The implementation of Element::attributeChanged() calls the following two functions.
+    // They are separated to allow a different flow of control in StyledElement::attributeChanged().
+    void recalcStyleIfNeededAfterAttributeChanged(Attribute*);
+    void updateAfterAttributeChanged(Attribute*);
+
 private:
+    void scrollByUnits(int units, ScrollGranularity);
+
+    virtual void setPrefix(const AtomicString&, ExceptionCode&);
+    virtual NodeType nodeType() const;
+    virtual bool childTypeAllowed(NodeType);
+
+    virtual PassRefPtr<Attribute> createAttribute(const QualifiedName&, const AtomicString& value);
+    
+#ifndef NDEBUG
+    virtual void formatForDebugger(char* buffer, unsigned length) const;
+#endif
+
+    bool pseudoStyleCacheIsInvalid(const RenderStyle* currentStyle, RenderStyle* newStyle);
+
     virtual void createAttributeMap() const;
 
-    virtual void updateStyleAttribute() const {}
+    virtual void updateStyleAttribute() const { }
 
 #if ENABLE(SVG)
-    virtual void updateAnimatedSVGAttribute(const String&) const {}
+    virtual void updateAnimatedSVGAttribute(const String&) const { }
 #endif
 
     void updateFocusAppearanceSoonAfterAttach();
@@ -249,10 +256,10 @@ private:
     QualifiedName m_tagName;
     virtual NodeRareData* createRareData();
 
-protected:
     ElementRareData* rareData() const;
     ElementRareData* ensureRareData();
     
+protected:
     mutable RefPtr<NamedNodeMap> namedAttrMap;
 };
     
diff --git a/src/3rdparty/webkit/WebCore/dom/Element.idl b/src/3rdparty/webkit/WebCore/dom/Element.idl
index 53711e9..cbb36d9 100644
--- a/src/3rdparty/webkit/WebCore/dom/Element.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Element.idl
@@ -21,6 +21,7 @@
 module core {
 
     interface [
+        CustomMarkFunction,
         GenerateConstructor,
         GenerateNativeConverter,
         InlineGetOwnPropertySlot,
@@ -148,6 +149,7 @@ module core {
         attribute [DontEnum] EventListener onerror;
         attribute [DontEnum] EventListener onfocus;
         attribute [DontEnum] EventListener oninput;
+        attribute [DontEnum] EventListener oninvalid;
         attribute [DontEnum] EventListener onkeydown;
         attribute [DontEnum] EventListener onkeypress;
         attribute [DontEnum] EventListener onkeyup;
@@ -169,7 +171,6 @@ module core {
         // attribute [DontEnum] EventListener onended;
         // attribute [DontEnum] EventListener onformchange;
         // attribute [DontEnum] EventListener onforminput;
-        // attribute [DontEnum] EventListener oninvalid;
         // attribute [DontEnum] EventListener onloadeddata;
         // attribute [DontEnum] EventListener onloadedmetadata;
         // attribute [DontEnum] EventListener onloadstart;
diff --git a/src/3rdparty/webkit/WebCore/dom/EntityReference.cpp b/src/3rdparty/webkit/WebCore/dom/EntityReference.cpp
index 012605c..c4c292a 100644
--- a/src/3rdparty/webkit/WebCore/dom/EntityReference.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/EntityReference.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2000 Peter Kelly (pmk@post.com)
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -23,12 +23,17 @@
 
 namespace WebCore {
 
-EntityReference::EntityReference(Document* document, const String& entityName)
+inline EntityReference::EntityReference(Document* document, const String& entityName)
     : ContainerNode(document)
     , m_entityName(entityName)
 {
 }
 
+PassRefPtr<EntityReference> EntityReference::create(Document* document, const String& entityName)
+{
+    return adoptRef(new EntityReference(document, entityName));
+}
+
 String EntityReference::nodeName() const
 {
     return m_entityName;
@@ -41,7 +46,7 @@ Node::NodeType EntityReference::nodeType() const
 
 PassRefPtr<Node> EntityReference::cloneNode(bool)
 {
-    return new EntityReference(document(), m_entityName);
+    return create(document(), m_entityName);
 }
 
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/dom/EntityReference.h b/src/3rdparty/webkit/WebCore/dom/EntityReference.h
index 4767a5e..7a6f6c3 100644
--- a/src/3rdparty/webkit/WebCore/dom/EntityReference.h
+++ b/src/3rdparty/webkit/WebCore/dom/EntityReference.h
@@ -28,13 +28,15 @@ namespace WebCore {
 
 class EntityReference : public ContainerNode {
 public:
+    static PassRefPtr<EntityReference> create(Document*, const String& entityName);
+
+private:
     EntityReference(Document*, const String& entityName);
 
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
     virtual PassRefPtr<Node> cloneNode(bool deep);
 
-private:
     String m_entityName;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/dom/Event.cpp b/src/3rdparty/webkit/WebCore/dom/Event.cpp
index 9d1d079..4088e2c 100644
--- a/src/3rdparty/webkit/WebCore/dom/Event.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Event.cpp
@@ -124,6 +124,11 @@ bool Event::isOverflowEvent() const
     return false;
 }
 
+bool Event::isPageTransitionEvent() const
+{
+    return false;
+}
+
 bool Event::isProgressEvent() const
 {
     return false;
diff --git a/src/3rdparty/webkit/WebCore/dom/Event.h b/src/3rdparty/webkit/WebCore/dom/Event.h
index 823ff20..7d06378 100644
--- a/src/3rdparty/webkit/WebCore/dom/Event.h
+++ b/src/3rdparty/webkit/WebCore/dom/Event.h
@@ -109,6 +109,7 @@ namespace WebCore {
         virtual bool isWheelEvent() const;
         virtual bool isBeforeTextInsertedEvent() const;
         virtual bool isOverflowEvent() const;
+        virtual bool isPageTransitionEvent() const;
         virtual bool isProgressEvent() const;
         virtual bool isXMLHttpRequestProgressEvent() const;
         virtual bool isWebKitAnimationEvent() const;
diff --git a/src/3rdparty/webkit/WebCore/dom/EventListener.h b/src/3rdparty/webkit/WebCore/dom/EventListener.h
index d288c8d..501c61d 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventListener.h
+++ b/src/3rdparty/webkit/WebCore/dom/EventListener.h
@@ -26,6 +26,7 @@
 
 namespace JSC {
     class JSObject;
+    class MarkStack;
 }
 
 namespace WebCore {
@@ -34,7 +35,14 @@ namespace WebCore {
 
     class EventListener : public RefCounted<EventListener> {
     public:
+        enum Type { JSEventListenerType, 
+                    ImageEventListenerType, 
+                    InspectorDOMAgentType, 
+                    ObjCEventListenerType, 
+                    ConditionEventListenerType };
+                    
         virtual ~EventListener() { }
+        virtual bool operator==(const EventListener&) = 0;
         virtual void handleEvent(Event*, bool isWindowEvent = false) = 0;
         // Return true to indicate that the error is handled.
         virtual bool reportError(const String& /*message*/, const String& /*url*/, int /*lineNumber*/) { return false; }
@@ -42,17 +50,26 @@ namespace WebCore {
 
 #if USE(JSC)
         virtual JSC::JSObject* jsFunction() const { return 0; }
-        virtual void markJSFunction() { }
+        virtual void markJSFunction(JSC::MarkStack&) { }
 #endif
 
         bool isAttribute() const { return virtualisAttribute(); }
+        Type type() const { return m_type; }
+
+    protected:
+        EventListener(Type type)
+            : m_type(type)
+        {
+        }
 
     private:
         virtual bool virtualisAttribute() const { return false; }
+        
+        Type m_type;
     };
 
 #if USE(JSC)
-    inline void markIfNotNull(EventListener* listener) { if (listener) listener->markJSFunction(); }
+    inline void markIfNotNull(JSC::MarkStack& markStack, EventListener* listener) { if (listener) listener->markJSFunction(markStack); }
 #endif
 
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/EventNames.h b/src/3rdparty/webkit/WebCore/dom/EventNames.h
index 9272ba4..382bbf7 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventNames.h
+++ b/src/3rdparty/webkit/WebCore/dom/EventNames.h
@@ -40,6 +40,7 @@ namespace WebCore {
     macro(checking) \
     macro(click) \
     macro(close) \
+    macro(connect) \
     macro(contextmenu) \
     macro(copy) \
     macro(cut) \
@@ -54,11 +55,14 @@ namespace WebCore {
     macro(drop) \
     macro(error) \
     macro(focus) \
+    macro(hashchange) \
     macro(input) \
+    macro(invalid) \
     macro(keydown) \
     macro(keypress) \
     macro(keyup) \
     macro(load) \
+    macro(loadend) \
     macro(loadstart) \
     macro(message) \
     macro(mousedown) \
@@ -71,7 +75,10 @@ namespace WebCore {
     macro(obsolete) \
     macro(offline) \
     macro(online) \
+    macro(open) \
     macro(overflowchanged) \
+    macro(pagehide) \
+    macro(pageshow) \
     macro(paste) \
     macro(readystatechange) \
     macro(reset) \
diff --git a/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp b/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp
index 42668e3..652644f 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp
@@ -44,6 +44,11 @@ EventTarget::~EventTarget()
 {
 }
 
+EventSource* EventTarget::toEventSource()
+{
+    return 0;
+}
+
 Node* EventTarget::toNode()
 {
     return 0;
@@ -78,6 +83,13 @@ SVGElementInstance* EventTarget::toSVGElementInstance()
 }
 #endif
 
+#if ENABLE(WEB_SOCKETS)
+WebSocket* EventTarget::toWebSocket()
+{
+    return 0;
+}
+#endif
+
 MessagePort* EventTarget::toMessagePort()
 {
     return 0;
@@ -100,6 +112,17 @@ SharedWorker* EventTarget::toSharedWorker()
 {
     return 0;
 }
+SharedWorkerContext* EventTarget::toSharedWorkerContext()
+{
+    return 0;
+}
+#endif
+
+#if ENABLE(NOTIFICATIONS)
+Notification* EventTarget::toNotification()
+{
+    return 0;
+}
 #endif
 
 #ifndef NDEBUG
diff --git a/src/3rdparty/webkit/WebCore/dom/EventTarget.h b/src/3rdparty/webkit/WebCore/dom/EventTarget.h
index f0c794f..6bcc3fb 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventTarget.h
+++ b/src/3rdparty/webkit/WebCore/dom/EventTarget.h
@@ -43,11 +43,15 @@ namespace WebCore {
     class DOMWindow;
     class Event;
     class EventListener;
+    class EventSource;
     class MessagePort;
     class Node;
+    class Notification;
     class SVGElementInstance;
     class ScriptExecutionContext;
     class SharedWorker;
+    class SharedWorkerContext;
+    class WebSocket;
     class Worker;
     class XMLHttpRequest;
     class XMLHttpRequestUpload;
@@ -56,6 +60,7 @@ namespace WebCore {
 
     class EventTarget {
     public:
+        virtual EventSource* toEventSource();
         virtual MessagePort* toMessagePort();
         virtual Node* toNode();
         virtual DOMWindow* toDOMWindow();
@@ -71,9 +76,16 @@ namespace WebCore {
         virtual Worker* toWorker();
         virtual DedicatedWorkerContext* toDedicatedWorkerContext();
 #endif
-
 #if ENABLE(SHARED_WORKERS)
         virtual SharedWorker* toSharedWorker();
+        virtual SharedWorkerContext* toSharedWorkerContext();
+#endif
+#if ENABLE(WEB_SOCKETS)
+        virtual WebSocket* toWebSocket();
+#endif
+
+#if ENABLE(NOTIFICATIONS)
+        virtual Notification* toNotification();
 #endif
 
         virtual ScriptExecutionContext* scriptExecutionContext() const = 0;
diff --git a/src/3rdparty/webkit/WebCore/dom/ExceptionCode.h b/src/3rdparty/webkit/WebCore/dom/ExceptionCode.h
index 08bffa6..58b18e2 100644
--- a/src/3rdparty/webkit/WebCore/dom/ExceptionCode.h
+++ b/src/3rdparty/webkit/WebCore/dom/ExceptionCode.h
@@ -57,7 +57,7 @@ namespace WebCore {
         NETWORK_ERR = 19,
         ABORT_ERR = 20,
         URL_MISMATCH_ERR = 21,
-        QUOTA_EXCEEDED_ERR = 22
+        QUOTA_EXCEEDED_ERR = 22,
     };
 
     enum ExceptionType {
diff --git a/src/3rdparty/webkit/WebCore/dom/InputElement.cpp b/src/3rdparty/webkit/WebCore/dom/InputElement.cpp
index b25cd5c..97793e2 100644
--- a/src/3rdparty/webkit/WebCore/dom/InputElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/InputElement.cpp
@@ -46,25 +46,25 @@ namespace WebCore {
 using namespace HTMLNames;
 
 // FIXME: According to HTML4, the length attribute's value can be arbitrarily
-// large. However, due to http://bugs.webkit.org/show_bugs.cgi?id=14536 things
+// large. However, due to https://bugs.webkit.org/show_bug.cgi?id=14536 things
 // get rather sluggish when a text field has a larger number of characters than
 // this, even when just clicking in the text field.
 const int InputElement::s_maximumLength = 524288;
 const int InputElement::s_defaultSize = 20;
 
-void InputElement::dispatchFocusEvent(InputElementData& data, InputElement* inputElement, Element* element)
+void InputElement::dispatchFocusEvent(InputElement* inputElement, Element* element)
 {
     if (!inputElement->isTextField())
         return;
 
-    updatePlaceholderVisibility(data, inputElement, element);
+    updatePlaceholderVisibility(inputElement, element);
 
     Document* document = element->document();
     if (inputElement->isPasswordField() && document->frame())
         document->setUseSecureKeyboardEntryWhenActive(true);
 }
 
-void InputElement::dispatchBlurEvent(InputElementData& data, InputElement* inputElement, Element* element)
+void InputElement::dispatchBlurEvent(InputElement* inputElement, Element* element)
 {
     if (!inputElement->isTextField())
         return;
@@ -74,7 +74,7 @@ void InputElement::dispatchBlurEvent(InputElementData& data, InputElement* input
     if (!frame)
         return;
 
-    updatePlaceholderVisibility(data, inputElement, element);
+    updatePlaceholderVisibility(inputElement, element);
 
     if (inputElement->isPasswordField())
         document->setUseSecureKeyboardEntryWhenActive(false);
@@ -82,18 +82,19 @@ void InputElement::dispatchBlurEvent(InputElementData& data, InputElement* input
     frame->textFieldDidEndEditing(element);
 }
 
-void InputElement::updatePlaceholderVisibility(InputElementData& data, InputElement* inputElement, Element* element, bool placeholderValueChanged)
+bool InputElement::placeholderShouldBeVisible(const InputElement* inputElement, const Element* element)
 {
-    ASSERT(inputElement->isTextField());
-    Document* document = element->document();
-
-    bool oldPlaceholderShouldBeVisible = data.placeholderShouldBeVisible();
-    data.setPlaceholderShouldBeVisible(inputElement->value().isEmpty() 
-                                       && document->focusedNode() != element
-                                       && !inputElement->placeholder().isEmpty());
+    return inputElement->value().isEmpty()
+        && element->document()->focusedNode() != element
+        && !inputElement->placeholder().isEmpty();
+}
 
-    if ((oldPlaceholderShouldBeVisible != data.placeholderShouldBeVisible() || placeholderValueChanged) && element->renderer())
-        static_cast<RenderTextControlSingleLine*>(element->renderer())->updatePlaceholderVisibility();
+void InputElement::updatePlaceholderVisibility(InputElement* inputElement, Element* element, bool placeholderValueChanged)
+{
+    ASSERT(inputElement->isTextField());
+    bool placeholderVisible = inputElement->placeholderShouldBeVisible();
+    if (element->renderer())
+        toRenderTextControlSingleLine(element->renderer())->updatePlaceholderVisibility(placeholderVisible, placeholderValueChanged);
 }
 
 void InputElement::updateFocusAppearance(InputElementData& data, InputElement* inputElement, Element* element, bool restorePreviousSelection)
@@ -137,11 +138,11 @@ void InputElement::aboutToUnload(InputElement* inputElement, Element* element)
 
 void InputElement::setValueFromRenderer(InputElementData& data, InputElement* inputElement, Element* element, const String& value)
 {
-    // Renderer and our event handler are responsible for constraining values.
-    ASSERT(value == inputElement->constrainValue(value) || inputElement->constrainValue(value).isEmpty());
+    // Renderer and our event handler are responsible for sanitizing values.
+    ASSERT(value == inputElement->sanitizeValue(value) || inputElement->sanitizeValue(value).isEmpty());
 
     if (inputElement->isTextField())
-        updatePlaceholderVisibility(data, inputElement, element);
+        updatePlaceholderVisibility(inputElement, element);
 
     // Workaround for bug where trailing \n is included in the result of textContent.
     // The assert macro above may also be simplified to:  value == constrainValue(value)
@@ -175,16 +176,21 @@ static int numCharactersInGraphemeClusters(StringImpl* s, int numGraphemeCluster
     return textBreakCurrent(it);
 }
 
-String InputElement::constrainValue(const InputElement* inputElement, const String& proposedValue, int maxLength)
+String InputElement::sanitizeValue(const InputElement* inputElement, const String& proposedValue)
+{
+    return InputElement::sanitizeUserInputValue(inputElement, proposedValue, s_maximumLength);
+}
+
+String InputElement::sanitizeUserInputValue(const InputElement* inputElement, const String& proposedValue, int maxLength)
 {
-    String string = proposedValue;
     if (!inputElement->isTextField())
-        return string;
+        return proposedValue;
 
+    String string = proposedValue;
     string.replace("\r\n", " ");
     string.replace('\r', ' ');
     string.replace('\n', ' ');
-    
+
     StringImpl* s = string.impl();
     int newLength = numCharactersInGraphemeClusters(s, maxLength);
     for (int i = 0; i < newLength; ++i) {
@@ -217,20 +223,27 @@ static int numGraphemeClusters(StringImpl* s)
     return num;
 }
 
-void InputElement::handleBeforeTextInsertedEvent(InputElementData& data, InputElement* inputElement, Document* document, Event* event)
+void InputElement::handleBeforeTextInsertedEvent(InputElementData& data, InputElement* inputElement, Element* element, Event* event)
 {
     ASSERT(event->isBeforeTextInsertedEvent());
-
     // Make sure that the text to be inserted will not violate the maxLength.
-    int oldLength = numGraphemeClusters(inputElement->value().impl());
-    ASSERT(oldLength <= data.maxLength());
-    int selectionLength = numGraphemeClusters(plainText(document->frame()->selection()->selection().toNormalizedRange().get()).impl());
+
+    // We use RenderTextControlSingleLine::text() instead of InputElement::value()
+    // because they can be mismatched by sanitizeValue() in
+    // RenderTextControlSingleLine::subtreeHasChanged() in some cases.
+    int oldLength = numGraphemeClusters(toRenderTextControlSingleLine(element->renderer())->text().impl());
+
+    // selection() may be a pre-edit text.
+    int selectionLength = numGraphemeClusters(plainText(element->document()->frame()->selection()->selection().toNormalizedRange().get()).impl());
     ASSERT(oldLength >= selectionLength);
-    int maxNewLength = data.maxLength() - (oldLength - selectionLength);
+
+    // Selected characters will be removed by the next text event.
+    int baseLength = oldLength - selectionLength;
+    int appendableLength = data.maxLength() - baseLength;
 
     // Truncate the inserted text to avoid violating the maxLength and other constraints.
     BeforeTextInsertedEvent* textEvent = static_cast<BeforeTextInsertedEvent*>(event);
-    textEvent->setText(constrainValue(inputElement, textEvent->text(), maxNewLength));
+    textEvent->setText(sanitizeUserInputValue(inputElement, textEvent->text(), appendableLength));
 }
 
 void InputElement::parseSizeAttribute(InputElementData& data, Element* element, MappedAttribute* attribute)
@@ -259,7 +272,7 @@ void InputElement::parseMaxLengthAttribute(InputElementData& data, InputElement*
 void InputElement::updateValueIfNeeded(InputElementData& data, InputElement* inputElement)
 {
     String oldValue = data.value();
-    String newValue = inputElement->constrainValue(oldValue);
+    String newValue = sanitizeValue(inputElement, oldValue);
     if (newValue != oldValue)
         inputElement->setValue(newValue);
 }
@@ -277,8 +290,7 @@ void InputElement::notifyFormStateChanged(Element* element)
 
 // InputElementData
 InputElementData::InputElementData()
-    : m_placeholderShouldBeVisible(false)
-    , m_size(InputElement::s_defaultSize)
+    : m_size(InputElement::s_defaultSize)
     , m_maxLength(InputElement::s_maximumLength)
     , m_cachedSelectionStart(-1)
     , m_cachedSelectionEnd(-1)
diff --git a/src/3rdparty/webkit/WebCore/dom/InputElement.h b/src/3rdparty/webkit/WebCore/dom/InputElement.h
index 7ad3cbd..746e4f2 100644
--- a/src/3rdparty/webkit/WebCore/dom/InputElement.h
+++ b/src/3rdparty/webkit/WebCore/dom/InputElement.h
@@ -54,7 +54,7 @@ public:
     virtual String placeholder() const = 0;
     virtual void setPlaceholder(const String&) = 0;
 
-    virtual String constrainValue(const String&) const = 0;
+    virtual String sanitizeValue(const String&) const = 0;
     virtual void setValueFromRenderer(const String&) = 0;
 
     virtual void cacheSelection(int start, int end) = 0;
@@ -64,15 +64,21 @@ public:
     static const int s_defaultSize;
 
 protected:
-    static void dispatchFocusEvent(InputElementData&, InputElement*, Element*);
-    static void dispatchBlurEvent(InputElementData&, InputElement*, Element*);
-    static void updatePlaceholderVisibility(InputElementData&, InputElement*, Element*, bool placeholderValueChanged = false);
+    static void dispatchFocusEvent(InputElement*, Element*);
+    static void dispatchBlurEvent(InputElement*, Element*);
+    static bool placeholderShouldBeVisible(const InputElement*, const Element*);
+    static void updatePlaceholderVisibility(InputElement*, Element*, bool placeholderValueChanged = false);
     static void updateFocusAppearance(InputElementData&, InputElement*, Element*, bool restorePreviousSelection);
     static void updateSelectionRange(InputElement*, Element*, int start, int end);
     static void aboutToUnload(InputElement*, Element*);
     static void setValueFromRenderer(InputElementData&, InputElement*, Element*, const String&);
-    static String constrainValue(const InputElement*, const String& proposedValue, int maxLength);
-    static void handleBeforeTextInsertedEvent(InputElementData&, InputElement*, Document*, Event*);
+    // Replaces CRs and LFs, shrinks the value for s_maximumLength.
+    // This should be applied to values from the HTML value attribute and the DOM value property.
+    static String sanitizeValue(const InputElement*, const String&);
+    // Replaces CRs and LFs, shrinks the value for the specified maximum length.
+    // This should be applied to values specified by users.
+    static String sanitizeUserInputValue(const InputElement*, const String&, int);
+    static void handleBeforeTextInsertedEvent(InputElementData&, InputElement*, Element*, Event*);
     static void parseSizeAttribute(InputElementData&, Element*, MappedAttribute*);
     static void parseMaxLengthAttribute(InputElementData&, InputElement*, Element*, MappedAttribute*);
     static void updateValueIfNeeded(InputElementData&, InputElement*);
@@ -85,9 +91,6 @@ class InputElementData {
 public:
     InputElementData();
 
-    bool placeholderShouldBeVisible() const { return m_placeholderShouldBeVisible; }
-    void setPlaceholderShouldBeVisible(bool visible) { m_placeholderShouldBeVisible = visible; }
-
     const AtomicString& name() const;
     void setName(const AtomicString& value) { m_name = value; }
 
@@ -107,7 +110,6 @@ public:
     void setCachedSelectionEnd(int value) { m_cachedSelectionEnd = value; }
 
 private:
-    bool m_placeholderShouldBeVisible;
     AtomicString m_name;
     String m_value;
     int m_size;
diff --git a/src/3rdparty/webkit/WebCore/dom/MessageEvent.cpp b/src/3rdparty/webkit/WebCore/dom/MessageEvent.cpp
index a0af32d..2ef8bc2 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessageEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/MessageEvent.cpp
@@ -37,13 +37,13 @@ MessageEvent::MessageEvent()
 {
 }
 
-MessageEvent::MessageEvent(const String& data, const String& origin, const String& lastEventId, PassRefPtr<DOMWindow> source, PassRefPtr<MessagePort> messagePort)
-    : Event(eventNames().messageEvent, false, true)
+MessageEvent::MessageEvent(const String& data, const String& origin, const String& lastEventId, PassRefPtr<DOMWindow> source, PassOwnPtr<MessagePortArray> ports)
+    : Event(eventNames().messageEvent, false, false)
     , m_data(data)
     , m_origin(origin)
     , m_lastEventId(lastEventId)
     , m_source(source)
-    , m_messagePort(messagePort)
+    , m_ports(ports)
 {
 }
 
@@ -51,7 +51,7 @@ MessageEvent::~MessageEvent()
 {
 }
 
-void MessageEvent::initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& data, const String& origin, const String& lastEventId, DOMWindow* source, MessagePort* messagePort)
+void MessageEvent::initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& data, const String& origin, const String& lastEventId, DOMWindow* source, PassOwnPtr<MessagePortArray> ports)
 {
     if (dispatched())
         return;
@@ -62,7 +62,26 @@ void MessageEvent::initMessageEvent(const AtomicString& type, bool canBubble, bo
     m_origin = origin;
     m_lastEventId = lastEventId;
     m_source = source;
-    m_messagePort = messagePort;
+    m_ports = ports;
+}
+
+// FIXME: remove this when we update the ObjC bindings (bug #28774).
+MessagePort* MessageEvent::messagePort()
+{
+    if (!m_ports)
+        return 0;
+    ASSERT(m_ports->size() == 1);
+    return (*m_ports)[0].get();
+}
+
+void MessageEvent::initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& data, const String& origin, const String& lastEventId, DOMWindow* source, MessagePort* port)
+{
+    MessagePortArray* ports = 0;
+    if (port) {
+        ports = new MessagePortArray();
+        ports->append(port);
+    }
+    initMessageEvent(type, canBubble, cancelable, data, origin, lastEventId, source, ports);
 }
 
 bool MessageEvent::isMessageEvent() const 
diff --git a/src/3rdparty/webkit/WebCore/dom/MessageEvent.h b/src/3rdparty/webkit/WebCore/dom/MessageEvent.h
index 87a6745..7d94689 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessageEvent.h
+++ b/src/3rdparty/webkit/WebCore/dom/MessageEvent.h
@@ -28,6 +28,7 @@
 #ifndef MessageEvent_h
 #define MessageEvent_h
 
+#include "DOMWindow.h"
 #include "Event.h"
 #include "MessagePort.h"
 
@@ -41,31 +42,36 @@ namespace WebCore {
         {
             return adoptRef(new MessageEvent);
         }
-        static PassRefPtr<MessageEvent> create(const String& data, const String& origin, const String& lastEventId, PassRefPtr<DOMWindow> source, PassRefPtr<MessagePort> messagePort)
+        static PassRefPtr<MessageEvent> create(const String& data, const String& origin, const String& lastEventId, PassRefPtr<DOMWindow> source, PassOwnPtr<MessagePortArray> ports)
         {
-            return adoptRef(new MessageEvent(data, origin, lastEventId, source, messagePort));
+            return adoptRef(new MessageEvent(data, origin, lastEventId, source, ports));
         }
         virtual ~MessageEvent();
 
-        void initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& data, const String& origin, const String& lastEventId, DOMWindow* source, MessagePort*);
-        
+        void initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& data, const String& origin, const String& lastEventId, DOMWindow* source, PassOwnPtr<MessagePortArray>);
+
         const String& data() const { return m_data; }
         const String& origin() const { return m_origin; }
         const String& lastEventId() const { return m_lastEventId; }
         DOMWindow* source() const { return m_source.get(); }
-        MessagePort* messagePort() const { return m_messagePort.get(); }
-        
+        MessagePortArray* ports() const { return m_ports.get(); }
+
+        // FIXME: remove this when we update the ObjC bindings (bug #28774).
+        MessagePort* messagePort();
+        // FIXME: remove this when we update the ObjC bindings (bug #28774).
+        void initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& data, const String& origin, const String& lastEventId, DOMWindow* source, MessagePort*);
+
         virtual bool isMessageEvent() const;
 
-    private:    
+    private:
         MessageEvent();
-        MessageEvent(const String& data, const String& origin, const String& lastEventId, PassRefPtr<DOMWindow> source, PassRefPtr<MessagePort> messagePort);
+        MessageEvent(const String& data, const String& origin, const String& lastEventId, PassRefPtr<DOMWindow> source, PassOwnPtr<MessagePortArray>);
 
         String m_data;
         String m_origin;
         String m_lastEventId;
         RefPtr<DOMWindow> m_source;
-        RefPtr<MessagePort> m_messagePort;
+        OwnPtr<MessagePortArray> m_ports;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/MessageEvent.idl b/src/3rdparty/webkit/WebCore/dom/MessageEvent.idl
index 8e8f271..a32cc93 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessageEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/MessageEvent.idl
@@ -35,9 +35,16 @@ module events {
         readonly attribute DOMString origin;
         readonly attribute DOMString lastEventId;
         readonly attribute DOMWindow source;
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
+        readonly attribute [CustomGetter] Array ports;
+
+        [Custom] void initMessageEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString dataArg, in DOMString originArg, in DOMString lastEventIdArg, in DOMWindow sourceArg, in Array messagePorts);
+#else
+        // There's no good way to expose an array via the ObjC bindings, so for now just expose a single port.
         readonly attribute MessagePort messagePort;
-        
+
         void initMessageEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString dataArg, in DOMString originArg, in DOMString lastEventIdArg, in DOMWindow sourceArg, in MessagePort messagePort);
+#endif
 
     };
 
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp b/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp
index 9f3e4d2..bfd7932 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp
@@ -55,28 +55,41 @@ MessagePort::~MessagePort()
         m_scriptExecutionContext->destroyedMessagePort(this);
 }
 
+// FIXME: remove this when we update the ObjC bindings (bug #28774).
+void MessagePort::postMessage(const String& message, MessagePort* port, ExceptionCode& ec)
+{
+    MessagePortArray ports;
+    if (port)
+        ports.append(port);
+    postMessage(message, &ports, ec);
+}
+
 void MessagePort::postMessage(const String& message, ExceptionCode& ec)
 {
-    postMessage(message, 0, ec);
+    postMessage(message, static_cast<MessagePortArray*>(0), ec);
 }
 
-void MessagePort::postMessage(const String& message, MessagePort* dataPort, ExceptionCode& ec)
+void MessagePort::postMessage(const String& message, const MessagePortArray* ports, ExceptionCode& ec)
 {
     if (!m_entangledChannel)
         return;
     ASSERT(m_scriptExecutionContext);
 
-    OwnPtr<MessagePortChannel> channel;
-    if (dataPort) {
-        if (dataPort == this || m_entangledChannel->isConnectedTo(dataPort)) {
-            ec = INVALID_STATE_ERR;
-            return;
+    OwnPtr<MessagePortChannelArray> channels;
+    // Make sure we aren't connected to any of the passed-in ports.
+    if (ports) {
+        for (unsigned int i = 0; i < ports->size(); ++i) {
+            MessagePort* dataPort = (*ports)[i].get();
+            if (dataPort == this || m_entangledChannel->isConnectedTo(dataPort)) {
+                ec = INVALID_STATE_ERR;
+                return;
+            }
         }
-        channel = dataPort->disentangle(ec);
+        channels = MessagePort::disentanglePorts(ports, ec);
         if (ec)
             return;
     }
-    m_entangledChannel->postMessageToRemote(MessagePortChannel::EventData::create(message, channel.release()));
+    m_entangledChannel->postMessageToRemote(MessagePortChannel::EventData::create(message, channels.release()));
 }
 
 PassOwnPtr<MessagePortChannel> MessagePort::disentangle(ExceptionCode& ec)
@@ -155,14 +168,8 @@ void MessagePort::dispatchMessages()
 
     OwnPtr<MessagePortChannel::EventData> eventData;
     while (m_entangledChannel && m_entangledChannel->tryGetMessageFromRemote(eventData)) {
-        RefPtr<MessagePort> port;
-        OwnPtr<MessagePortChannel> channel = eventData->channel();
-        if (channel) {
-            // The remote side sent over a MessagePortChannel, so create a MessagePort to wrap it.
-            port = MessagePort::create(*m_scriptExecutionContext);
-            port->entangle(channel.release());
-        }
-        RefPtr<Event> evt = MessageEvent::create(eventData->message(), "", "", 0, port.release());
+        OwnPtr<MessagePortArray> ports = MessagePort::entanglePorts(*m_scriptExecutionContext, eventData->channels());
+        RefPtr<Event> evt = MessageEvent::create(eventData->message(), "", "", 0, ports.release());
 
         if (m_onMessageListener) {
             evt->setTarget(this);
@@ -186,7 +193,7 @@ void MessagePort::addEventListener(const AtomicString& eventType, PassRefPtr<Eve
     } else {
         ListenerVector& listeners = iter->second;
         for (ListenerVector::iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-            if (*listenerIter == eventListener)
+            if (**listenerIter == *eventListener)
                 return;
         }
         
@@ -203,7 +210,7 @@ void MessagePort::removeEventListener(const AtomicString& eventType, EventListen
     
     ListenerVector& listeners = iter->second;
     for (ListenerVector::const_iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-        if (*listenerIter == eventListener) {
+        if (**listenerIter == *eventListener) {
             listeners.remove(listenerIter - listeners.begin());
             return;
         }
@@ -245,4 +252,46 @@ MessagePort* MessagePort::locallyEntangledPort()
     return m_entangledChannel ? m_entangledChannel->locallyEntangledPort(m_scriptExecutionContext) : 0;
 }
 
+PassOwnPtr<MessagePortChannelArray> MessagePort::disentanglePorts(const MessagePortArray* ports, ExceptionCode& ec)
+{
+    if (!ports || !ports->size())
+        return 0;
+
+    // HashSet used to efficiently check for duplicates in the passed-in array.
+    HashSet<MessagePort*> portSet;
+
+    // Walk the incoming array - if there are any duplicate ports, or null ports or cloned ports, throw an error (per section 8.3.3 of the HTML5 spec).
+    for (unsigned int i = 0; i < ports->size(); ++i) {
+        MessagePort* port = (*ports)[i].get();
+        if (!port || !port->isEntangled() || portSet.contains(port)) {
+            ec = INVALID_STATE_ERR;
+            return 0;
+        }
+        portSet.add(port);
+    }
+
+    // Passed-in ports passed validity checks, so we can disentangle them.
+    MessagePortChannelArray* portArray = new MessagePortChannelArray(ports->size());
+    for (unsigned int i = 0 ; i < ports->size() ; ++i) {
+        OwnPtr<MessagePortChannel> channel = (*ports)[i]->disentangle(ec);
+        ASSERT(!ec); // Can't generate exception here if passed above checks.
+        (*portArray)[i] = channel.release();
+    }
+    return portArray;
+}
+
+PassOwnPtr<MessagePortArray> MessagePort::entanglePorts(ScriptExecutionContext& context, PassOwnPtr<MessagePortChannelArray> channels)
+{
+    if (!channels || !channels->size())
+        return 0;
+
+    MessagePortArray* portArray = new MessagePortArray(channels->size());
+    for (unsigned int i = 0; i < channels->size(); ++i) {
+        RefPtr<MessagePort> port = MessagePort::create(context);
+        port->entangle((*channels)[i].release());
+        (*portArray)[i] = port.release();
+    }
+    return portArray;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePort.h b/src/3rdparty/webkit/WebCore/dom/MessagePort.h
index f416b9b..d042bc1 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePort.h
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePort.h
@@ -44,22 +44,38 @@ namespace WebCore {
     class AtomicStringImpl;
     class Event;
     class Frame;
+    class MessagePort;
     class ScriptExecutionContext;
     class String;
 
+    // The overwhelmingly common case is sending a single port, so handle that efficiently with an inline buffer of size 1.
+    typedef Vector<RefPtr<MessagePort>, 1> MessagePortArray;
+
     class MessagePort : public RefCounted<MessagePort>, public EventTarget {
     public:
         static PassRefPtr<MessagePort> create(ScriptExecutionContext& scriptExecutionContext) { return adoptRef(new MessagePort(scriptExecutionContext)); }
         ~MessagePort();
 
         void postMessage(const String& message, ExceptionCode&);
+        void postMessage(const String& message, const MessagePortArray*, ExceptionCode&);
+        // FIXME: remove this when we update the ObjC bindings (bug #28774).
         void postMessage(const String& message, MessagePort*, ExceptionCode&);
+
         void start();
         void close();
 
         void entangle(PassOwnPtr<MessagePortChannel>);
         PassOwnPtr<MessagePortChannel> disentangle(ExceptionCode&);
 
+        // Disentangle an array of ports, returning the entangled channels.
+        // Per section 8.3.3 of the HTML5 spec, generates an INVALID_STATE_ERR exception if any of the passed ports are null or not entangled.
+        // Returns 0 if there is an exception, or if the passed-in array is 0/empty.
+        static PassOwnPtr<MessagePortChannelArray> disentanglePorts(const MessagePortArray*, ExceptionCode&);
+
+        // Entangles an array of channels, returning an array of MessagePorts in matching order.
+        // Returns 0 if the passed array is 0/empty.
+        static PassOwnPtr<MessagePortArray> entanglePorts(ScriptExecutionContext&, PassOwnPtr<MessagePortChannelArray>);
+
         void messageAvailable();
         bool started() const { return m_started; }
 
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePort.idl b/src/3rdparty/webkit/WebCore/dom/MessagePort.idl
index e5f9ad1..11ab757 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePort.idl
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePort.idl
@@ -34,7 +34,7 @@ module events {
 // We need to have something as an ObjC binding, because MessagePort is used in MessageEvent, which already has one,
 // but we don't want to actually expose the API while it is in flux.
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-        void postMessage(in DOMString message, in [Optional] MessagePort messagePort)
+        [Custom] void postMessage(in DOMString message, in [Optional] Array messagePorts)
             raises(DOMException);
         void start();
         void close();
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.cpp b/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.cpp
index 05134c0..34b2ce7 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.cpp
@@ -33,14 +33,14 @@
 namespace WebCore {
 
 
-PassOwnPtr<MessagePortChannel::EventData> MessagePortChannel::EventData::create(const String& message, PassOwnPtr<MessagePortChannel> channel)
+PassOwnPtr<MessagePortChannel::EventData> MessagePortChannel::EventData::create(const String& message, PassOwnPtr<MessagePortChannelArray> channels)
 {
-    return new EventData(message, channel);
+    return new EventData(message, channels);
 }
 
-MessagePortChannel::EventData::EventData(const String& message, PassOwnPtr<MessagePortChannel> channel)
+MessagePortChannel::EventData::EventData(const String& message, PassOwnPtr<MessagePortChannelArray> channels)
     : m_message(message.copy())
-    , m_channel(channel)
+    , m_channels(channels)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.h b/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.h
index 93b224b..4acfe7f 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.h
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.h
@@ -42,10 +42,14 @@
 namespace WebCore {
 
     class MessagePort;
+    class MessagePortChannel;
     class PlatformMessagePortChannel;
     class ScriptExecutionContext;
     class String;
 
+    // The overwhelmingly common case is sending a single port, so handle that efficiently with an inline buffer of size 1.
+    typedef Vector<OwnPtr<MessagePortChannel>, 1> MessagePortChannelArray;
+
     // MessagePortChannel is a platform-independent interface to the remote side of a message channel.
     // It acts as a wrapper around the platform-dependent PlatformMessagePortChannel implementation which ensures that the platform-dependent close() method is invoked before destruction.
     class MessagePortChannel : public Noncopyable {
@@ -73,15 +77,15 @@ namespace WebCore {
 
         class EventData {
         public:
-            static PassOwnPtr<EventData> create(const String&, PassOwnPtr<MessagePortChannel>);
+            static PassOwnPtr<EventData> create(const String&, PassOwnPtr<MessagePortChannelArray>);
 
             const String& message() { return m_message; }
-            PassOwnPtr<MessagePortChannel> channel() { return m_channel.release(); }
+            PassOwnPtr<MessagePortChannelArray> channels() { return m_channels.release(); }
 
         private:
-            EventData(const String& message, PassOwnPtr<MessagePortChannel>);
+            EventData(const String& message, PassOwnPtr<MessagePortChannelArray>);
             String m_message;
-            OwnPtr<MessagePortChannel> m_channel;
+            OwnPtr<MessagePortChannelArray> m_channels;
         };
 
         // Sends a message and optional cloned port to the remote port.
diff --git a/src/3rdparty/webkit/WebCore/dom/Node.cpp b/src/3rdparty/webkit/WebCore/dom/Node.cpp
index 192462d..a26dd04 100644
--- a/src/3rdparty/webkit/WebCore/dom/Node.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Node.cpp
@@ -50,6 +50,7 @@
 #include "Frame.h"
 #include "FrameView.h"
 #include "HTMLNames.h"
+#include "InspectorTimelineAgent.h"
 #include "KeyboardEvent.h"
 #include "Logging.h"
 #include "MouseEvent.h"
@@ -332,8 +333,69 @@ Node::StyleChange Node::diff(const RenderStyle* s1, const RenderStyle* s2)
     return ch;
 }
 
-Node::Node(Document* doc, bool isElement, bool isContainer, bool isText)
-    : m_document(doc)
+inline bool Node::initialRefCount(ConstructionType type)
+{
+    switch (type) {
+        case CreateContainer:
+        case CreateElement:
+        case CreateOther:
+        case CreateText:
+            return 1;
+        case CreateElementZeroRefCount:
+            return 0;
+    }
+    ASSERT_NOT_REACHED();
+    return 1;
+}
+
+inline bool Node::isContainer(ConstructionType type)
+{
+    switch (type) {
+        case CreateContainer:
+        case CreateElement:
+        case CreateElementZeroRefCount:
+            return true;
+        case CreateOther:
+        case CreateText:
+            return false;
+    }
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+inline bool Node::isElement(ConstructionType type)
+{
+    switch (type) {
+        case CreateContainer:
+        case CreateOther:
+        case CreateText:
+            return false;
+        case CreateElement:
+        case CreateElementZeroRefCount:
+            return true;
+    }
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+inline bool Node::isText(ConstructionType type)
+{
+    switch (type) {
+        case CreateContainer:
+        case CreateElement:
+        case CreateElementZeroRefCount:
+        case CreateOther:
+            return false;
+        case CreateText:
+            return true;
+    }
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+Node::Node(Document* document, ConstructionType type)
+    : TreeShared<Node>(initialRefCount(type))
+    , m_document(document)
     , m_previous(0)
     , m_next(0)
     , m_renderer(0)
@@ -350,25 +412,27 @@ Node::Node(Document* doc, bool isElement, bool isContainer, bool isText)
     , m_inDetach(false)
     , m_inSubtreeMark(false)
     , m_hasRareData(false)
-    , m_isElement(isElement)
-    , m_isContainer(isContainer)
-    , m_isText(isText)
+    , m_isElement(isElement(type))
+    , m_isContainer(isContainer(type))
+    , m_isText(isText(type))
     , m_parsingChildrenFinished(true)
-#if ENABLE(SVG)
-    , m_areSVGAttributesValid(true)
-#endif
     , m_isStyleAttributeValid(true)
     , m_synchronizingStyleAttribute(false)
 #if ENABLE(SVG)
+    , m_areSVGAttributesValid(true)
     , m_synchronizingSVGAttributes(false)
 #endif
 {
+    if (m_document)
+        m_document->selfOnlyRef();
+
 #ifndef NDEBUG
     if (shouldIgnoreLeaks)
         ignoreSet.add(this);
     else
         nodeCounter.increment();
 #endif
+
 #if DUMP_NODE_STATISTICS
     liveNodeSet.add(this);
 #endif
@@ -388,9 +452,6 @@ Node::~Node()
     liveNodeSet.remove(this);
 #endif
 
-    if (!eventListeners().isEmpty() && !inDocument())
-        document()->unregisterDisconnectedNodeWithEventListeners(this);
-
     if (!hasRareData())
         ASSERT(!NodeRareData::rareDataMap().contains(this));
     else {
@@ -411,6 +472,9 @@ Node::~Node()
         m_previous->setNextSibling(0);
     if (m_next)
         m_next->setPreviousSibling(0);
+
+    if (m_document)
+        m_document->selfOnlyDeref();
 }
 
 #ifdef NDEBUG
@@ -445,14 +509,19 @@ void Node::setDocument(Document* document)
     if (inDocument() || m_document == document)
         return;
 
+    document->selfOnlyRef();
+
     setWillMoveToNewOwnerDocumentWasCalled(false);
     willMoveToNewOwnerDocument();
     ASSERT(willMoveToNewOwnerDocumentWasCalled);
 
 #if USE(JSC)
-    updateDOMNodeDocument(this, m_document.get(), document);
+    updateDOMNodeDocument(this, m_document, document);
 #endif
 
+    if (m_document)
+        m_document->selfOnlyDeref();
+
     m_document = document;
 
     setDidMoveToNewOwnerDocumentWasCalled(false);
@@ -514,7 +583,8 @@ PassRefPtr<NodeList> Node::childNodes()
     NodeRareData* data = ensureRareData();
     if (!data->nodeLists()) {
         data->setNodeLists(NodeListsNodeData::create());
-        document()->addNodeListCache();
+        if (document())
+            document()->addNodeListCache();
     }
 
     return ChildNodeList::create(this, data->nodeLists()->m_childNodeListCaches.get());
@@ -694,7 +764,7 @@ void Node::setNeedsStyleRecalc(StyleChangeType changeType)
     if ((changeType != NoStyleChange) && !attached()) // changed compared to what?
         return;
 
-    if (!(changeType == InlineStyleChange && (m_styleChange == FullStyleChange || m_styleChange == AnimationStyleChange)))
+    if (!(changeType == InlineStyleChange && (m_styleChange == FullStyleChange || m_styleChange == SyntheticStyleChange)))
         m_styleChange = changeType;
 
     if (m_styleChange != NoStyleChange) {
@@ -757,10 +827,30 @@ bool Node::rareDataFocused() const
     ASSERT(hasRareData());
     return rareData()->isFocused();
 }
+
+bool Node::supportsFocus() const
+{
+    return hasRareData() && rareData()->tabIndexSetExplicitly();
+}
     
 bool Node::isFocusable() const
 {
-    return hasRareData() && rareData()->tabIndexSetExplicitly();
+    if (!inDocument() || !supportsFocus())
+        return false;
+    
+    if (renderer())
+        ASSERT(!renderer()->needsLayout());
+    else
+        // If the node is in a display:none tree it might say it needs style recalc but
+        // the whole document is atually up to date.
+        ASSERT(!document()->childNeedsStyleRecalc());
+    
+    // FIXME: Even if we are not visible, we might have a child that is visible.
+    // Hyatt wants to fix that some day with a "has visible content" flag or the like.
+    if (!renderer() || renderer()->style()->visibility() != VISIBLE)
+        return false;
+
+    return true;
 }
 
 bool Node::isKeyboardFocusable(KeyboardEvent*) const
@@ -788,7 +878,7 @@ void Node::registerDynamicNodeList(DynamicNodeList* list)
     if (!data->nodeLists()) {
         data->setNodeLists(NodeListsNodeData::create());
         document()->addNodeListCache();
-    } else if (!m_document->hasNodeListCaches()) {
+    } else if (!m_document || !m_document->hasNodeListCaches()) {
         // We haven't been receiving notifications while there were no registered lists, so the cache is invalid now.
         data->nodeLists()->invalidateCaches();
     }
@@ -806,7 +896,8 @@ void Node::unregisterDynamicNodeList(DynamicNodeList* list)
         data->nodeLists()->m_listsWithCaches.remove(list);
         if (data->nodeLists()->isEmpty()) {
             data->clearNodeLists();
-            document()->removeNodeListCache();
+            if (document())
+                document()->removeNodeListCache();
         }
     }
 }
@@ -1895,11 +1986,11 @@ void Node::appendTextContent(bool convertBRsToNewlines, StringBuilder& content)
         case TEXT_NODE:
         case CDATA_SECTION_NODE:
         case COMMENT_NODE:
-            content.append(static_cast<const CharacterData*>(this)->CharacterData::nodeValue());
+            content.append(static_cast<const CharacterData*>(this)->data());
             break;
 
         case PROCESSING_INSTRUCTION_NODE:
-            content.append(static_cast<const ProcessingInstruction*>(this)->ProcessingInstruction::nodeValue());
+            content.append(static_cast<const ProcessingInstruction*>(this)->data());
             break;
         
         case ELEMENT_NODE:
@@ -2263,34 +2354,22 @@ const RegisteredEventListenerVector& Node::eventListeners() const
 
 void Node::insertedIntoDocument()
 {
-    if (!eventListeners().isEmpty())
-        document()->unregisterDisconnectedNodeWithEventListeners(this);
-
     setInDocument(true);
 }
 
 void Node::removedFromDocument()
 {
-    if (!eventListeners().isEmpty())
-        document()->registerDisconnectedNodeWithEventListeners(this);
-
     setInDocument(false);
 }
 
 void Node::willMoveToNewOwnerDocument()
 {
-    if (!eventListeners().isEmpty())
-        document()->unregisterDisconnectedNodeWithEventListeners(this);
-
     ASSERT(!willMoveToNewOwnerDocumentWasCalled);
     setWillMoveToNewOwnerDocumentWasCalled(true);
 }
 
 void Node::didMoveToNewOwnerDocument()
 {
-    if (!eventListeners().isEmpty())
-        document()->registerDisconnectedNodeWithEventListeners(this);
-
     ASSERT(!didMoveToNewOwnerDocumentWasCalled);
     setDidMoveToNewOwnerDocumentWasCalled(true);
 }
@@ -2322,11 +2401,8 @@ static inline void updateSVGElementInstancesAfterEventListenerChange(Node* refer
 
 void Node::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
 {
-    Document* document = this->document();
-    if (!document->attached())
-        return;
-
-    document->addListenerTypeIfNeeded(eventType);
+    if (Document* document = this->document())
+        document->addListenerTypeIfNeeded(eventType);
 
     RegisteredEventListenerVector& listeners = ensureRareData()->ensureListeners();
 
@@ -2334,10 +2410,6 @@ void Node::addEventListener(const AtomicString& eventType, PassRefPtr<EventListe
     // The DOM2 spec says that "duplicate instances are discarded" in this case.
     removeEventListener(eventType, listener.get(), useCapture);
 
-    // adding the first one
-    if (listeners.isEmpty() && !inDocument())
-        document->registerDisconnectedNodeWithEventListeners(this);
-
     listeners.append(RegisteredEventListener::create(eventType, listener, useCapture));
     updateSVGElementInstancesAfterEventListenerChange(this);
 }
@@ -2354,14 +2426,10 @@ void Node::removeEventListener(const AtomicString& eventType, EventListener* lis
     size_t size = listeners->size();
     for (size_t i = 0; i < size; ++i) {
         RegisteredEventListener& r = *listeners->at(i);
-        if (r.eventType() == eventType && r.listener() == listener && r.useCapture() == useCapture) {
+        if (r.eventType() == eventType && r.useCapture() == useCapture && *r.listener() == *listener) {
             r.setRemoved(true);
             listeners->remove(i);
 
-            // removed last
-            if (listeners->isEmpty() && !inDocument())
-                document()->unregisterDisconnectedNodeWithEventListeners(this);
-
             updateSVGElementInstancesAfterEventListenerChange(this);
             return;
         }
@@ -2457,6 +2525,12 @@ bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
     ASSERT(event->target());
     ASSERT(!event->type().isNull()); // JavaScript code can create an event with an empty name, but not null.
 
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* timelineAgent = document()->inspectorTimelineAgent();
+    if (timelineAgent)
+        timelineAgent->willDispatchDOMEvent(*event);
+#endif
+
     // Make a vector of ancestors to send the event to.
     // If the node is not in a document just send the event to it.
     // Be sure to ref all of nodes since event handlers could result in the last reference going away.
@@ -2568,6 +2642,11 @@ doneDispatching:
     }
 
 doneWithDefault:
+#if ENABLE(INSPECTOR)
+    if (timelineAgent)
+        timelineAgent->didDispatchDOMEvent();
+#endif
+
     Document::updateStyleForAllDocuments();
 
     return !event->defaultPrevented();
@@ -2851,10 +2930,6 @@ void Node::clearAttributeEventListener(const AtomicString& eventType)
         r.setRemoved(true);
         listeners->remove(i);
 
-        // removed last
-        if (listeners->isEmpty() && !inDocument())
-            document()->unregisterDisconnectedNodeWithEventListeners(this);
-
         updateSVGElementInstancesAfterEventListenerChange(this);
         return;
     }
@@ -2896,10 +2971,12 @@ void Node::defaultEventHandler(Event* event)
     } else if (eventType == eventNames().clickEvent) {
         int detail = event->isUIEvent() ? static_cast<UIEvent*>(event)->detail() : 0;
         dispatchUIEvent(eventNames().DOMActivateEvent, detail, event);
+#if ENABLE(CONTEXT_MENUS)
     } else if (eventType == eventNames().contextmenuEvent) {
         if (Frame* frame = document()->frame())
             if (Page* page = frame->page())
                 page->contextMenuController()->handleContextMenuEvent(event);
+#endif
     } else if (eventType == eventNames().textInputEvent) {
         if (event->isTextEvent())
             if (Frame* frame = document()->frame())
@@ -2997,6 +3074,16 @@ void Node::setOninput(PassRefPtr<EventListener> eventListener)
     setAttributeEventListener(eventNames().inputEvent, eventListener);
 }
 
+EventListener* Node::oninvalid() const
+{
+    return getAttributeEventListener(eventNames().invalidEvent);
+}
+
+void Node::setOninvalid(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().invalidEvent, eventListener);
+}
+
 EventListener* Node::onkeydown() const
 {
     return getAttributeEventListener(eventNames().keydownEvent);
diff --git a/src/3rdparty/webkit/WebCore/dom/Node.h b/src/3rdparty/webkit/WebCore/dom/Node.h
index ab743f4..af1e73b 100644
--- a/src/3rdparty/webkit/WebCore/dom/Node.h
+++ b/src/3rdparty/webkit/WebCore/dom/Node.h
@@ -25,7 +25,6 @@
 #ifndef Node_h
 #define Node_h
 
-#include "DocPtr.h"
 #include "EventTarget.h"
 #include "KURLHash.h"
 #include "PlatformString.h"
@@ -68,7 +67,10 @@ class StringBuilder;
 
 typedef int ExceptionCode;
 
-enum StyleChangeType { NoStyleChange, InlineStyleChange, FullStyleChange, AnimationStyleChange };
+// SyntheticStyleChange means that we need to go through the entire style change logic even though
+// no style property has actually changed. It is used to restructure the tree when, for instance,
+// RenderLayers are created or destroyed due to animation changes.
+enum StyleChangeType { NoStyleChange, InlineStyleChange, FullStyleChange, SyntheticStyleChange };
 
 const unsigned short DOCUMENT_POSITION_EQUIVALENT = 0x00;
 const unsigned short DOCUMENT_POSITION_DISCONNECTED = 0x01;
@@ -108,7 +110,6 @@ public:
     enum StyleChange { NoChange, NoInherit, Inherit, Detach, Force };    
     static StyleChange diff(const RenderStyle*, const RenderStyle*);
 
-    Node(Document*, bool isElement = false, bool isContainer = false, bool isText = false);
     virtual ~Node();
 
     // DOM methods & attributes for Node
@@ -182,6 +183,7 @@ public:
     static bool isWMLElement() { return false; }
 #endif
 
+    virtual bool isMediaControlElement() const { return false; }
     virtual bool isStyledElement() const { return false; }
     virtual bool isFrameOwnerElement() const { return false; }
     virtual bool isAttributeNode() const { return false; }
@@ -289,10 +291,10 @@ public:
 
     virtual short tabIndex() const;
 
-    /**
-     * Whether this node can receive the keyboard focus.
-     */
-    virtual bool supportsFocus() const { return isFocusable(); }
+    // Whether this kind of node can receive focus by default. Most nodes are
+    // not focusable but some elements, such as form controls and links are.
+    virtual bool supportsFocus() const;
+    // Whether the node can actually be focused.
     virtual bool isFocusable() const;
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
     virtual bool isMouseFocusable() const;
@@ -316,7 +318,7 @@ public:
     {
         ASSERT(this);
         ASSERT(m_document || (nodeType() == DOCUMENT_TYPE_NODE && !inDocument()));
-        return m_document.get();
+        return m_document;
     }
     void setDocument(Document*);
 
@@ -499,19 +501,6 @@ public:
 
     unsigned short compareDocumentPosition(Node*);
 
-protected:
-    virtual void willMoveToNewOwnerDocument();
-    virtual void didMoveToNewOwnerDocument();
-    
-    virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const { }
-    void setTabIndexExplicitly(short);
-    
-    bool hasRareData() const { return m_hasRareData; }
-    
-    NodeRareData* rareData() const;
-    NodeRareData* ensureRareData();
-
-public:
     virtual Node* toNode() { return this; }
 
     virtual ScriptExecutionContext* scriptExecutionContext() const;
@@ -588,8 +577,24 @@ public:
     void setOncontextmenu(PassRefPtr<EventListener>);
     EventListener* ondblclick() const;
     void setOndblclick(PassRefPtr<EventListener>);
+    EventListener* ondragenter() const;
+    void setOndragenter(PassRefPtr<EventListener>);
+    EventListener* ondragover() const;
+    void setOndragover(PassRefPtr<EventListener>);
+    EventListener* ondragleave() const;
+    void setOndragleave(PassRefPtr<EventListener>);
+    EventListener* ondrop() const;
+    void setOndrop(PassRefPtr<EventListener>);
+    EventListener* ondragstart() const;
+    void setOndragstart(PassRefPtr<EventListener>);
+    EventListener* ondrag() const;
+    void setOndrag(PassRefPtr<EventListener>);
+    EventListener* ondragend() const;
+    void setOndragend(PassRefPtr<EventListener>);
     EventListener* oninput() const;
     void setOninput(PassRefPtr<EventListener>);
+    EventListener* oninvalid() const;
+    void setOninvalid(PassRefPtr<EventListener>);
     EventListener* onkeydown() const;
     void setOnkeydown(PassRefPtr<EventListener>);
     EventListener* onkeypress() const;
@@ -608,20 +613,6 @@ public:
     void setOnmouseup(PassRefPtr<EventListener>);
     EventListener* onmousewheel() const;
     void setOnmousewheel(PassRefPtr<EventListener>);
-    EventListener* ondragenter() const;
-    void setOndragenter(PassRefPtr<EventListener>);
-    EventListener* ondragover() const;
-    void setOndragover(PassRefPtr<EventListener>);
-    EventListener* ondragleave() const;
-    void setOndragleave(PassRefPtr<EventListener>);
-    EventListener* ondrop() const;
-    void setOndrop(PassRefPtr<EventListener>);
-    EventListener* ondragstart() const;
-    void setOndragstart(PassRefPtr<EventListener>);
-    EventListener* ondrag() const;
-    void setOndrag(PassRefPtr<EventListener>);
-    EventListener* ondragend() const;
-    void setOndragend(PassRefPtr<EventListener>);
     EventListener* onscroll() const;
     void setOnscroll(PassRefPtr<EventListener>);
     EventListener* onselect() const;
@@ -651,14 +642,35 @@ public:
 
     using TreeShared<Node>::ref;
     using TreeShared<Node>::deref;
- 
+
+protected:
+    // CreateElementZeroRefCount is deprecated and can be removed once we convert all element
+    // classes to start with a reference count of 1.
+    enum ConstructionType { CreateContainer, CreateElement, CreateOther, CreateText, CreateElementZeroRefCount };
+    Node(Document*, ConstructionType);
+
+    virtual void willMoveToNewOwnerDocument();
+    virtual void didMoveToNewOwnerDocument();
+    
+    virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const { }
+    void setTabIndexExplicitly(short);
+    
+    bool hasRareData() const { return m_hasRareData; }
+    
+    NodeRareData* rareData() const;
+    NodeRareData* ensureRareData();
+
 private:
+    static bool initialRefCount(ConstructionType);
+    static bool isContainer(ConstructionType);
+    static bool isElement(ConstructionType);
+    static bool isText(ConstructionType);
+
     virtual void refEventTarget() { ref(); }
     virtual void derefEventTarget() { deref(); }
 
     void removeAllEventListenersSlowCase();
 
-private:
     virtual NodeRareData* createRareData();
     Node* containerChildNode(unsigned index) const;
     unsigned containerChildNodeCount() const;
@@ -676,7 +688,7 @@ private:
 
     void appendTextContent(bool convertBRsToNewlines, StringBuilder&) const;
 
-    DocPtr<Document> m_document;
+    Document* m_document;
     Node* m_previous;
     Node* m_next;
     RenderObject* m_renderer;
@@ -699,22 +711,16 @@ private:
     const bool m_isText : 1;
 
 protected:
-    // These bits are used by the Element derived class, pulled up here so they can
+    // These bits are used by derived classes, pulled up here so they can
     // be stored in the same memory word as the Node bits above.
-    bool m_parsingChildrenFinished : 1;
-#if ENABLE(SVG)
-    mutable bool m_areSVGAttributesValid : 1;
-#endif
 
-    // These bits are used by the StyledElement derived class, and live here for the
-    // same reason as above.
-    mutable bool m_isStyleAttributeValid : 1;
-    mutable bool m_synchronizingStyleAttribute : 1;
+    bool m_parsingChildrenFinished : 1; // Element
+    mutable bool m_isStyleAttributeValid : 1; // StyledElement
+    mutable bool m_synchronizingStyleAttribute : 1; // StyledElement
 
 #if ENABLE(SVG)
-    // This bit is used by the SVGElement derived class, and lives here for the same
-    // reason as above.
-    mutable bool m_synchronizingSVGAttributes : 1;
+    mutable bool m_areSVGAttributesValid : 1; // Element
+    mutable bool m_synchronizingSVGAttributes : 1; // SVGElement
 #endif
 
     // 11 bits remaining
diff --git a/src/3rdparty/webkit/WebCore/dom/NodeFilter.h b/src/3rdparty/webkit/WebCore/dom/NodeFilter.h
index 94c87e3..5a542ad 100644
--- a/src/3rdparty/webkit/WebCore/dom/NodeFilter.h
+++ b/src/3rdparty/webkit/WebCore/dom/NodeFilter.h
@@ -3,7 +3,7 @@
  * Copyright (C) 2000 Frederik Holljen (frederik.holljen@hig.no)
  * Copyright (C) 2001 Peter Kelly (pmk@post.com)
  * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
- * Copyright (C) 2004, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -71,7 +71,7 @@ namespace WebCore {
         }
 
         short acceptNode(ScriptState*, Node*) const;
-        void mark() { m_condition->mark(); };
+        void markAggregate(JSC::MarkStack& markStack) { m_condition->markAggregate(markStack); };
 
         // For non-JS bindings. Silently ignores the JavaScript exception if any.
         short acceptNode(Node* node) const { return acceptNode(scriptStateFromNode(node), node); }
diff --git a/src/3rdparty/webkit/WebCore/dom/NodeFilterCondition.h b/src/3rdparty/webkit/WebCore/dom/NodeFilterCondition.h
index c94cc9a..0d6313f 100644
--- a/src/3rdparty/webkit/WebCore/dom/NodeFilterCondition.h
+++ b/src/3rdparty/webkit/WebCore/dom/NodeFilterCondition.h
@@ -3,7 +3,7 @@
  * Copyright (C) 2000 Frederik Holljen (frederik.holljen@hig.no)
  * Copyright (C) 2001 Peter Kelly (pmk@post.com)
  * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
- * Copyright (C) 2004, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -28,6 +28,10 @@
 #include "ScriptState.h"
 #include <wtf/RefCounted.h>
 
+namespace JSC {
+    class MarkStack;
+}
+
 namespace WebCore {
 
     class Node;
@@ -36,7 +40,7 @@ namespace WebCore {
     public:
         virtual ~NodeFilterCondition() { }
         virtual short acceptNode(ScriptState*, Node*) const = 0;
-        virtual void mark() { }
+        virtual void markAggregate(JSC::MarkStack&) { }
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/Notation.cpp b/src/3rdparty/webkit/WebCore/dom/Notation.cpp
index 7081d98..cade384 100644
--- a/src/3rdparty/webkit/WebCore/dom/Notation.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Notation.cpp
@@ -1,8 +1,6 @@
-/**
- * This file is part of the DOM implementation for KDE.
- *
+/*
  * Copyright (C) 2000 Peter Kelly (pmk@post.com)
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -19,17 +17,14 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "Notation.h"
 
 namespace WebCore {
 
-Notation::Notation(Document* doc) : ContainerNode(doc)
-{
-}
-
-Notation::Notation(Document* doc, const String& name, const String& publicId, const String& systemId)
-    : ContainerNode(doc)
+Notation::Notation(Document* document, const String& name, const String& publicId, const String& systemId)
+    : ContainerNode(document)
     , m_name(name)
     , m_publicId(publicId)
     , m_systemId(systemId)
@@ -52,7 +47,6 @@ PassRefPtr<Node> Notation::cloneNode(bool /*deep*/)
     return 0;
 }
 
-// DOM Section 1.1.1
 bool Notation::childTypeAllowed(NodeType)
 {
     return false;
diff --git a/src/3rdparty/webkit/WebCore/dom/Notation.h b/src/3rdparty/webkit/WebCore/dom/Notation.h
index 2bd5363..547c9e7 100644
--- a/src/3rdparty/webkit/WebCore/dom/Notation.h
+++ b/src/3rdparty/webkit/WebCore/dom/Notation.h
@@ -1,8 +1,6 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2000 Peter Kelly (pmk@post.com)
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,26 +22,25 @@
 #ifndef Notation_h
 #define Notation_h
 
-#include "CachedResourceClient.h"
 #include "ContainerNode.h"
 
 namespace WebCore {
 
+// FIXME: This class is never instantiated. Maybe it should be removed.
+
 class Notation : public ContainerNode {
 public:
-    Notation(Document*);
-    Notation(Document*, const String& name, const String& publicId, const String& systemId);
+    const String& publicId() const { return m_publicId; }
+    const String& systemId() const { return m_systemId; }
 
-    // DOM methods & attributes for Notation
-    String publicId() const { return m_publicId; }
-    String systemId() const { return m_systemId; }
+private:
+    Notation(Document*, const String& name, const String& publicId, const String& systemId);
 
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
     virtual PassRefPtr<Node> cloneNode(bool deep);
     virtual bool childTypeAllowed(NodeType);
 
-private:
     String m_name;
     String m_publicId;
     String m_systemId;
diff --git a/src/3rdparty/webkit/WebCore/dom/OptionElement.cpp b/src/3rdparty/webkit/WebCore/dom/OptionElement.cpp
index 581c070..1de5fa4 100644
--- a/src/3rdparty/webkit/WebCore/dom/OptionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/OptionElement.cpp
@@ -67,7 +67,7 @@ int OptionElement::optionIndex(SelectElement* selectElement, const Element* elem
     return 0;
 }
 
-String OptionElement::collectOptionText(const OptionElementData& data, const Element* element)
+String OptionElement::collectOptionLabelOrText(const OptionElementData& data, const Element* element)
 {
     Document* document = element->document();
     String text;
@@ -75,22 +75,31 @@ String OptionElement::collectOptionText(const OptionElementData& data, const Ele
     // WinIE does not use the label attribute, so as a quirk, we ignore it.
     if (!document->inCompatMode())
         text = data.label();
+    if (text.isEmpty())
+        text = collectOptionInnerText(element);
+    return normalizeText(document, text);
+}
 
-    if (text.isEmpty()) {
-        Node* n = element->firstChild();
-        while (n) {
-            if (n->nodeType() == Node::TEXT_NODE || n->nodeType() == Node::CDATA_SECTION_NODE)
-                text += n->nodeValue();
-
-            // skip script content
-            if (n->isElementNode() && toScriptElement(static_cast<Element*>(n)))
-                n = n->traverseNextSibling(element);
-            else
-                n = n->traverseNextNode(element);
-        }
+String OptionElement::collectOptionInnerText(const Element* element)
+{
+    String text;
+    Node* n = element->firstChild();
+    while (n) {
+        if (n->nodeType() == Node::TEXT_NODE || n->nodeType() == Node::CDATA_SECTION_NODE)
+            text += n->nodeValue();
+
+        // skip script content
+        if (n->isElementNode() && toScriptElement(static_cast<Element*>(n)))
+            n = n->traverseNextSibling(element);
+        else
+            n = n->traverseNextNode(element);
     }
+    return text;
+}
 
-    text = document->displayStringModifiedByEncoding(text);
+String OptionElement::normalizeText(const Document* document, const String& src)
+{
+    String text = document->displayStringModifiedByEncoding(src);
 
     // In WinIE, leading and trailing whitespace is ignored in options and optgroups. We match this behavior.
     text = text.stripWhiteSpace();
@@ -104,9 +113,9 @@ String OptionElement::collectOptionTextRespectingGroupLabel(const OptionElementD
 {
     Element* parentElement = static_cast<Element*>(element->parentNode());
     if (parentElement && toOptionGroupElement(parentElement))
-        return "    " + collectOptionText(data, element);
+        return "    " + collectOptionLabelOrText(data, element);
 
-    return collectOptionText(data, element);
+    return collectOptionLabelOrText(data, element);
 }
 
 String OptionElement::collectOptionValue(const OptionElementData& data, const Element* element)
@@ -116,7 +125,7 @@ String OptionElement::collectOptionValue(const OptionElementData& data, const El
         return value;
 
     // Use the text if the value wasn't set.
-    return collectOptionText(data, element).stripWhiteSpace();
+    return collectOptionInnerText(element).stripWhiteSpace();
 }
 
 // OptionElementData
diff --git a/src/3rdparty/webkit/WebCore/dom/OptionElement.h b/src/3rdparty/webkit/WebCore/dom/OptionElement.h
index c6b9778..a765d53 100644
--- a/src/3rdparty/webkit/WebCore/dom/OptionElement.h
+++ b/src/3rdparty/webkit/WebCore/dom/OptionElement.h
@@ -44,9 +44,12 @@ public:
 protected:
     static void setSelectedState(OptionElementData&, Element*, bool selected);
     static int optionIndex(SelectElement*, const Element*);
-    static String collectOptionText(const OptionElementData&, const Element*);
+    static String collectOptionLabelOrText(const OptionElementData&, const Element*);
     static String collectOptionTextRespectingGroupLabel(const OptionElementData&, const Element*);
     static String collectOptionValue(const OptionElementData&, const Element*);
+private:
+    static String collectOptionInnerText(const Element*);
+    static String normalizeText(const Document*, const String&);
 };
 
 // HTML/WMLOptionElement hold this struct as member variable
diff --git a/src/3rdparty/webkit/WebCore/dom/PageTransitionEvent.cpp b/src/3rdparty/webkit/WebCore/dom/PageTransitionEvent.cpp
new file mode 100644
index 0000000..f9c487d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/PageTransitionEvent.cpp
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "PageTransitionEvent.h"
+
+#include "EventNames.h"
+
+namespace WebCore {
+        
+PageTransitionEvent::PageTransitionEvent()
+    : m_persisted(false)
+{
+}
+
+PageTransitionEvent::PageTransitionEvent(const AtomicString& type, bool persisted)
+    : Event(type, true, true)
+    , m_persisted(persisted)
+{
+}
+
+PageTransitionEvent::~PageTransitionEvent()
+{
+}
+
+void PageTransitionEvent::initPageTransitionEvent(const AtomicString& type, 
+                                            bool canBubbleArg,
+                                            bool cancelableArg,
+                                            bool persisted)
+{
+    if (dispatched())
+        return;
+    
+    initEvent(type, canBubbleArg, cancelableArg);
+    
+    m_persisted = persisted;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/PageTransitionEvent.h b/src/3rdparty/webkit/WebCore/dom/PageTransitionEvent.h
new file mode 100644
index 0000000..33c5a0c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/PageTransitionEvent.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef PageTransitionEvent_h
+#define PageTransitionEvent_h
+
+#include "Event.h"
+
+namespace WebCore {
+
+    class PageTransitionEvent : public Event {
+    public:
+        static PassRefPtr<PageTransitionEvent> create()
+        {
+            return adoptRef(new PageTransitionEvent);
+        }
+        static PassRefPtr<PageTransitionEvent> create(const AtomicString& type, bool persisted)
+        {
+            return adoptRef(new PageTransitionEvent(type, persisted));
+        }
+
+        virtual ~PageTransitionEvent();
+
+        void initPageTransitionEvent(const AtomicString& type, 
+                                bool canBubbleArg,
+                                bool cancelableArg,
+                                bool persisted);
+
+        virtual bool isPageTransitionEvent() const { return true; }
+
+        bool persisted() const { return m_persisted; }
+
+    private:
+        PageTransitionEvent();
+        PageTransitionEvent(const AtomicString& type, bool persisted);
+
+        bool m_persisted;
+    };
+
+} // namespace WebCore
+
+#endif // PageTransitionEvent_h
diff --git a/src/3rdparty/webkit/WebCore/page/PositionErrorCallback.idl b/src/3rdparty/webkit/WebCore/dom/PageTransitionEvent.idl
index 07edfa6..a09f94b 100644
--- a/src/3rdparty/webkit/WebCore/page/PositionErrorCallback.idl
+++ b/src/3rdparty/webkit/WebCore/dom/PageTransitionEvent.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,12 +23,15 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-module core {
+module events {
 
     interface [
         GenerateConstructor
-    ] PositionErrorCallback {
-        void handleEvent(in PositionError error);
+    ] PageTransitionEvent : Event {
+
+        readonly attribute boolean persisted;
+
+        void initPageTransitionEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in boolean persisted);
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/Position.cpp b/src/3rdparty/webkit/WebCore/dom/Position.cpp
index 3b4c3e8..060b28c 100644
--- a/src/3rdparty/webkit/WebCore/dom/Position.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Position.cpp
@@ -138,10 +138,7 @@ int Position::computeOffsetInContainerNode() const
 
     switch (anchorType()) {
     case PositionIsOffsetInAnchor:
-    {
-        int maximumValidOffset = m_anchorNode->offsetInCharacters() ? m_anchorNode->maxCharacterOffset() : m_anchorNode->childNodeCount();
-        return std::min(maximumValidOffset, m_offset);
-    }
+        return std::min(lastOffsetInNode(m_anchorNode.get()), m_offset);
     case PositionIsBeforeAnchor:
         return m_anchorNode->nodeIndex();
     case PositionIsAfterAnchor:
@@ -1115,28 +1112,7 @@ void Position::showTreeForThis() const
 
 #endif
 
-Position startPosition(const Range* r)
-{
-    return r ? r->startPosition() : Position();
-}
-
-Position endPosition(const Range* r)
-{
-    return r ? r->endPosition() : Position();
-}
 
-// NOTE: first/lastDeepEditingPositionForNode can return "editing positions" (like [img, 0])
-// for elements which editing "ignores".  the rest of the editing code will treat [img, 0]
-// as "the last position before the img"
-Position firstDeepEditingPositionForNode(Node* node)
-{
-    return Position(node, 0);
-}
-
-Position lastDeepEditingPositionForNode(Node* node)
-{
-    return Position(node, lastOffsetForEditing(node));
-}
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/dom/Position.h b/src/3rdparty/webkit/WebCore/dom/Position.h
index b434ec9..c08872d 100644
--- a/src/3rdparty/webkit/WebCore/dom/Position.h
+++ b/src/3rdparty/webkit/WebCore/dom/Position.h
@@ -28,6 +28,7 @@
 
 #include "TextAffinity.h"
 #include "TextDirection.h"
+#include "Node.h" // for position creation functions
 #include <wtf/Assertions.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
@@ -188,14 +189,53 @@ inline bool operator!=(const Position& a, const Position& b)
     return !(a == b);
 }
 
-Position startPosition(const Range*);
-Position endPosition(const Range*);
+// We define position creation functions to make callsites more readable.
+// These are inline to prevent ref-churn when returning a Position object.
+// If we ever add a PassPosition we can make these non-inline.
 
-// NOTE: first/lastDeepEditingPositionForNode can return "editing positions" (like [img, 0])
-// for elements which editing "ignores".  the rest of the editing code will treat [img, 0]
-// as "the last position before the img"
-Position firstDeepEditingPositionForNode(Node*);
-Position lastDeepEditingPositionForNode(Node*);
+inline Position positionInParentBeforeNode(const Node* node)
+{
+    // FIXME: This should ASSERT(node->parentNode())
+    // At least one caller currently hits this ASSERT though, which indicates
+    // that the caller is trying to make a position relative to a disconnected node (which is likely an error)
+    // Specifically, editing/deleting/delete-ligature-001.html crashes with ASSERT(node->parentNode())
+    return Position(node->parentNode(), node->nodeIndex(), Position::PositionIsOffsetInAnchor);
+}
+
+inline Position positionInParentAfterNode(const Node* node)
+{
+    ASSERT(node->parentNode());
+    return Position(node->parentNode(), node->nodeIndex() + 1, Position::PositionIsOffsetInAnchor);
+}
+
+// positionBeforeNode and positionAfterNode return neighbor-anchored positions, construction is O(1)
+inline Position positionBeforeNode(Node* anchorNode)
+{
+    ASSERT(anchorNode);
+    return Position(anchorNode, Position::PositionIsBeforeAnchor);
+}
+
+inline Position positionAfterNode(Node* anchorNode)
+{
+    ASSERT(anchorNode);
+    return Position(anchorNode, Position::PositionIsAfterAnchor);
+}
+
+inline int lastOffsetInNode(Node* node)
+{
+    return node->offsetInCharacters() ? node->maxCharacterOffset() : node->childNodeCount();
+}
+
+// firstPositionInNode and lastPositionInNode return parent-anchored positions, lastPositionInNode construction is O(n) due to childNodeCount()
+inline Position firstPositionInNode(Node* anchorNode)
+{
+    return Position(anchorNode, 0, Position::PositionIsOffsetInAnchor);
+}
+
+inline Position lastPositionInNode(Node* anchorNode)
+{
+    return Position(anchorNode, lastOffsetInNode(anchorNode), Position::PositionIsOffsetInAnchor);
+}
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageArea.cpp b/src/3rdparty/webkit/WebCore/dom/PositionCreationFunctions.h
index e69de29..e69de29 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageArea.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/PositionCreationFunctions.h
diff --git a/src/3rdparty/webkit/WebCore/dom/PositionIterator.cpp b/src/3rdparty/webkit/WebCore/dom/PositionIterator.cpp
index a029b5e..8d881ba 100644
--- a/src/3rdparty/webkit/WebCore/dom/PositionIterator.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/PositionIterator.cpp
@@ -38,7 +38,7 @@ PositionIterator::operator Position() const
 {
     if (m_nodeAfterPositionInAnchor) {
         ASSERT(m_nodeAfterPositionInAnchor->parentNode() == m_anchorNode);
-        return positionBeforeNode(m_nodeAfterPositionInAnchor);
+        return positionInParentBeforeNode(m_nodeAfterPositionInAnchor);
     }
     if (m_anchorNode->hasChildNodes())
         return lastDeepEditingPositionForNode(m_anchorNode);
diff --git a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp
index 806bf92..8404481 100644
--- a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2000 Peter Kelly (pmk@post.com)
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -35,8 +35,10 @@
 
 namespace WebCore {
 
-ProcessingInstruction::ProcessingInstruction(Document* doc)
-    : ContainerNode(doc)
+inline ProcessingInstruction::ProcessingInstruction(Document* document, const String& target, const String& data)
+    : ContainerNode(document)
+    , m_target(target)
+    , m_data(data)
     , m_cachedSheet(0)
     , m_loading(false)
     , m_alternate(false)
@@ -46,17 +48,9 @@ ProcessingInstruction::ProcessingInstruction(Document* doc)
 {
 }
 
-ProcessingInstruction::ProcessingInstruction(Document* doc, const String& target, const String& data)
-    : ContainerNode(doc)
-    , m_target(target)
-    , m_data(data)
-    , m_cachedSheet(0)
-    , m_loading(false)
-    , m_alternate(false)
-#if ENABLE(XSLT)
-    , m_isXSL(false)
-#endif
+PassRefPtr<ProcessingInstruction> ProcessingInstruction::create(Document* document, const String& target, const String& data)
 {
+    return adoptRef(new ProcessingInstruction(document, target, data));
 }
 
 ProcessingInstruction::~ProcessingInstruction()
@@ -95,8 +89,9 @@ void ProcessingInstruction::setNodeValue(const String& nodeValue, ExceptionCode&
 
 PassRefPtr<Node> ProcessingInstruction::cloneNode(bool /*deep*/)
 {
-    // ### copy m_localHref
-    return new ProcessingInstruction(document(), m_target, m_data);
+    // FIXME: Is it a problem that this does not copy m_localHref?
+    // What about other data members?
+    return create(document(), m_target, m_data);
 }
 
 // DOM Section 1.1.1
diff --git a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.h b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.h
index d133019..4b7dc86 100644
--- a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.h
+++ b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.h
@@ -1,8 +1,6 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2000 Peter Kelly (pmk@post.com)
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2006 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -35,15 +33,28 @@ class CSSStyleSheet;
 
 class ProcessingInstruction : public ContainerNode, private CachedResourceClient {
 public:
-    ProcessingInstruction(Document*);
-    ProcessingInstruction(Document*, const String& target, const String& data);
+    static PassRefPtr<ProcessingInstruction> create(Document*, const String& target, const String& data);
     virtual ~ProcessingInstruction();
 
-    // DOM methods & attributes for Notation
-    String target() const { return m_target; }
-    String data() const { return m_data; }
+    const String& target() const { return m_target; }
+    const String& data() const { return m_data; }
     void setData(const String&, ExceptionCode&);
 
+    void setCreatedByParser(bool createdByParser) { m_createdByParser = createdByParser; }
+
+    virtual void finishParsingChildren();
+
+    const String& localHref() const { return m_localHref; }
+    StyleSheet* sheet() const { return m_sheet.get(); }
+    void setCSSStyleSheet(PassRefPtr<CSSStyleSheet>);
+
+#if ENABLE(XSLT)
+    bool isXSL() const { return m_isXSL; }
+#endif
+
+private:
+    ProcessingInstruction(Document*, const String& target, const String& data);
+
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
     virtual String nodeValue() const;
@@ -55,28 +66,18 @@ public:
 
     virtual void insertedIntoDocument();
     virtual void removedFromDocument();
-    void setCreatedByParser(bool createdByParser) { m_createdByParser = createdByParser; }
-    virtual void finishParsingChildren();
 
-    // Other methods (not part of DOM)
-    String localHref() const { return m_localHref; }
-    StyleSheet* sheet() const { return m_sheet.get(); }
     void checkStyleSheet();
     virtual void setCSSStyleSheet(const String& url, const String& charset, const CachedCSSStyleSheet*);
 #if ENABLE(XSLT)
     virtual void setXSLStyleSheet(const String& url, const String& sheet);
 #endif
-    void setCSSStyleSheet(PassRefPtr<CSSStyleSheet>);
+
     bool isLoading() const;
     virtual bool sheetLoaded();
 
-#if ENABLE(XSLT)
-    bool isXSL() const { return m_isXSL; }
-#endif
-
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
-private:
     void parseStyleSheet(const String& sheet);
 
     String m_target;
diff --git a/src/3rdparty/webkit/WebCore/dom/Range.cpp b/src/3rdparty/webkit/WebCore/dom/Range.cpp
index edee305..0503597 100644
--- a/src/3rdparty/webkit/WebCore/dom/Range.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Range.cpp
@@ -33,6 +33,7 @@
 #include "Text.h"
 #include "TextIterator.h"
 #include "VisiblePosition.h"
+#include "htmlediting.h"
 #include "markup.h"
 #include "visible_units.h"
 #include <stdio.h>
@@ -586,7 +587,7 @@ PassRefPtr<DocumentFragment> Range::processContents(ActionType action, Exception
 
     RefPtr<DocumentFragment> fragment;
     if (action == EXTRACT_CONTENTS || action == CLONE_CONTENTS)
-        fragment = new DocumentFragment(m_ownerDocument.get());
+        fragment = DocumentFragment::create(m_ownerDocument.get());
     
     ec = 0;
     if (collapsed(ec))
@@ -1798,4 +1799,26 @@ void Range::textNodeSplit(Text* oldNode)
     boundaryTextNodesSplit(m_end, oldNode);
 }
 
+void Range::expand(const String& unit, ExceptionCode& ec)
+{
+    VisiblePosition start(startPosition());
+    VisiblePosition end(endPosition());
+    if (unit == "word") {
+        start = startOfWord(start);
+        end = endOfWord(end);
+    } else if (unit == "sentence") {
+        start = startOfSentence(start);
+        end = endOfSentence(end);
+    } else if (unit == "block") {
+        start = startOfParagraph(start);
+        end = endOfParagraph(end);
+    } else if (unit == "document") {
+        start = startOfDocument(start);
+        end = endOfDocument(end);
+    } else
+        return;
+    setStart(start.deepEquivalent().containerNode(), start.deepEquivalent().computeOffsetInContainerNode(), ec);
+    setEnd(end.deepEquivalent().containerNode(), end.deepEquivalent().computeOffsetInContainerNode(), ec);
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/Range.h b/src/3rdparty/webkit/WebCore/dom/Range.h
index 1487a7c..3382c84 100644
--- a/src/3rdparty/webkit/WebCore/dom/Range.h
+++ b/src/3rdparty/webkit/WebCore/dom/Range.h
@@ -112,6 +112,11 @@ public:
     void textNodesMerged(NodeWithIndex& oldNode, unsigned offset);
     void textNodeSplit(Text* oldNode);
 
+    // Expand range to a unit (word or sentence or block or document) boundary.
+    // Please refer to https://bugs.webkit.org/show_bug.cgi?id=27632 comment #5 
+    // for details.
+    void expand(const String&, ExceptionCode&);
+
 #ifndef NDEBUG
     void formatForDebugger(char* buffer, unsigned length) const;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/Range.idl b/src/3rdparty/webkit/WebCore/dom/Range.idl
index 0750c32..633bd90 100644
--- a/src/3rdparty/webkit/WebCore/dom/Range.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Range.idl
@@ -112,6 +112,9 @@ module ranges {
                                in long offset)
             raises(RangeException, DOMException);
 
+        void expand(in DOMString unit)
+            raises(RangeException, DOMException);
+
 #if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         readonly attribute DOMString text;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/RegisteredEventListener.h b/src/3rdparty/webkit/WebCore/dom/RegisteredEventListener.h
index 479c2ff..034f6c3 100644
--- a/src/3rdparty/webkit/WebCore/dom/RegisteredEventListener.h
+++ b/src/3rdparty/webkit/WebCore/dom/RegisteredEventListener.h
@@ -2,7 +2,7 @@
  * Copyright (C) 2001 Peter Kelly (pmk@post.com)
  * Copyright (C) 2001 Tobias Anton (anton@stud.fbi.fh-darmstadt.de)
  * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
- * Copyright (C) 2003, 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -55,10 +55,10 @@ namespace WebCore {
     typedef Vector<RefPtr<RegisteredEventListener> > RegisteredEventListenerVector;
 
 #if USE(JSC)
-    inline void markEventListeners(const RegisteredEventListenerVector& listeners)
+    inline void markEventListeners(JSC::MarkStack& markStack, const RegisteredEventListenerVector& listeners)
     {
         for (size_t i = 0; i < listeners.size(); ++i)
-            listeners[i]->listener()->markJSFunction();
+            listeners[i]->listener()->markJSFunction(markStack);
     }
 
     inline void invalidateEventListeners(const RegisteredEventListenerVector& listeners)
diff --git a/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.h b/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.h
index f95f0045..bb78b6f 100644
--- a/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.h
+++ b/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.h
@@ -44,8 +44,10 @@ namespace WebCore {
     class String;
 
     enum MessageDestination {
+#if ENABLE(INSPECTOR)
         InspectorControllerDestination,
-        ConsoleDestination
+#endif
+        ConsoleDestination,
     };
 
     class ScriptExecutionContext {
diff --git a/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp b/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp
index 45f3bd8..49713ba 100644
--- a/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp
@@ -48,11 +48,11 @@
 #endif
 
 // Configure platform-specific behavior when focused pop-up receives arrow/space/return keystroke.
-// (PLATFORM(MAC) is always false in Chromium, hence the extra test.)
+// (PLATFORM(MAC) and PLATFORM(GTK) are always false in Chromium, hence the extra tests.)
 #if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
 #define ARROW_KEYS_POP_MENU 1
 #define SPACE_OR_RETURN_POP_MENU 0
-#elif PLATFORM(GTK)
+#elif PLATFORM(GTK) || (PLATFORM(CHROMIUM) && PLATFORM(LINUX))
 #define ARROW_KEYS_POP_MENU 0
 #define SPACE_OR_RETURN_POP_MENU 1
 #else
@@ -218,7 +218,7 @@ void SelectElement::scrollToSelection(SelectElementData& data, Element* element)
         return;
 
     if (RenderObject* renderer = element->renderer())
-        static_cast<RenderListBox*>(renderer)->selectionChanged();
+        toRenderListBox(renderer)->selectionChanged();
 }
 
 void SelectElement::recalcStyle(SelectElementData& data, Element* element)
@@ -226,9 +226,9 @@ void SelectElement::recalcStyle(SelectElementData& data, Element* element)
     RenderObject* renderer = element->renderer();
     if (element->childNeedsStyleRecalc() && renderer) {
         if (data.usesMenuList())
-            static_cast<RenderMenuList*>(renderer)->setOptionsChanged(true);
+            toRenderMenuList(renderer)->setOptionsChanged(true);
         else
-            static_cast<RenderListBox*>(renderer)->setOptionsChanged(true);
+            toRenderListBox(renderer)->setOptionsChanged(true);
     } else if (data.shouldRecalcListItems())
         recalcListItems(data, element);
 }
@@ -239,9 +239,9 @@ void SelectElement::setRecalcListItems(SelectElementData& data, Element* element
     data.setActiveSelectionAnchorIndex(-1); // Manual selection anchor is reset when manipulating the select programmatically.
     if (RenderObject* renderer = element->renderer()) {
         if (data.usesMenuList())
-            static_cast<RenderMenuList*>(renderer)->setOptionsChanged(true);
+            toRenderMenuList(renderer)->setOptionsChanged(true);
         else
-            static_cast<RenderListBox*>(renderer)->setOptionsChanged(true);
+            toRenderListBox(renderer)->setOptionsChanged(true);
     }
     element->setNeedsStyleRecalc();
 }
@@ -492,8 +492,8 @@ bool SelectElement::appendFormData(SelectElementData& data, Element* element, Fo
 
 void SelectElement::reset(SelectElementData& data, Element* element)
 {
-    bool optionSelected = false;
     OptionElement* firstOption = 0;
+    OptionElement* selectedOption = 0;
 
     const Vector<Element*>& items = data.listItems(element);
     for (unsigned i = 0; i < items.size(); ++i) {
@@ -502,8 +502,10 @@ void SelectElement::reset(SelectElementData& data, Element* element)
             continue;
 
         if (!items[i]->getAttribute(HTMLNames::selectedAttr).isNull()) {
+            if (selectedOption && !data.multiple())
+                selectedOption->setSelectedState(false);
             optionElement->setSelectedState(true);
-            optionSelected = true;
+            selectedOption = optionElement;
         } else
             optionElement->setSelectedState(false);
 
@@ -511,7 +513,7 @@ void SelectElement::reset(SelectElementData& data, Element* element)
             firstOption = optionElement;
     }
 
-    if (!optionSelected && firstOption && data.usesMenuList())
+    if (!selectedOption && firstOption && data.usesMenuList())
         firstOption->setSelectedState(true);
 
     element->setNeedsStyleRecalc();
@@ -559,7 +561,7 @@ void SelectElement::menuListDefaultEventHandler(SelectElementData& data, Element
             // Save the selection so it can be compared to the new selection when dispatching change events during setSelectedIndex,
             // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
             saveLastSelection(data, element);
-            if (RenderMenuList* menuList = static_cast<RenderMenuList*>(element->renderer()))
+            if (RenderMenuList* menuList = toRenderMenuList(element->renderer()))
                 menuList->showPopup();
             handled = true;
         }
@@ -587,7 +589,7 @@ void SelectElement::menuListDefaultEventHandler(SelectElementData& data, Element
             handled = true;
         }
         
-        if (handled && listIndex >= 0 && listIndex < listItems.size())
+        if (handled && listIndex >= 0 && (unsigned)listIndex < listItems.size())
             setSelectedIndex(data, element, listToOptionIndex(data, element, listIndex));
 #endif
         if (handled)
@@ -609,7 +611,7 @@ void SelectElement::menuListDefaultEventHandler(SelectElementData& data, Element
             // Save the selection so it can be compared to the new selection when dispatching change events during setSelectedIndex,
             // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
             saveLastSelection(data, element);
-            if (RenderMenuList* menuList = static_cast<RenderMenuList*>(element->renderer()))
+            if (RenderMenuList* menuList = toRenderMenuList(element->renderer()))
                 menuList->showPopup();
             handled = true;
         }
@@ -619,7 +621,7 @@ void SelectElement::menuListDefaultEventHandler(SelectElementData& data, Element
             // Save the selection so it can be compared to the new selection when dispatching change events during setSelectedIndex,
             // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
             saveLastSelection(data, element);
-            if (RenderMenuList* menuList = static_cast<RenderMenuList*>(element->renderer()))
+            if (RenderMenuList* menuList = toRenderMenuList(element->renderer()))
                 menuList->showPopup();
             handled = true;
         } else if (keyCode == '\r') {
@@ -642,14 +644,16 @@ void SelectElement::menuListDefaultEventHandler(SelectElementData& data, Element
 
     if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton) {
         element->focus();
-        if (RenderMenuList* menuList = static_cast<RenderMenuList*>(element->renderer())) {
-            if (menuList->popupIsVisible())
-                menuList->hidePopup();
-            else {
-                // Save the selection so it can be compared to the new selection when we call onChange during setSelectedIndex,
-                // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
-                saveLastSelection(data, element);
-                menuList->showPopup();
+        if (element->renderer() && element->renderer()->isMenuList()) {
+            if (RenderMenuList* menuList = toRenderMenuList(element->renderer())) {
+                if (menuList->popupIsVisible())
+                    menuList->hidePopup();
+                else {
+                    // Save the selection so it can be compared to the new selection when we call onChange during setSelectedIndex,
+                    // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
+                    saveLastSelection(data, element);
+                    menuList->showPopup();
+                }
             }
         }
         event->setDefaultHandled();
@@ -666,7 +670,7 @@ void SelectElement::listBoxDefaultEventHandler(SelectElementData& data, Element*
         // Convert to coords relative to the list box if needed.
         MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
         IntPoint localOffset = roundedIntPoint(element->renderer()->absoluteToLocal(mouseEvent->absoluteLocation(), false, true));
-        int listIndex = static_cast<RenderListBox*>(element->renderer())->listIndexAtOffset(localOffset.x(), localOffset.y());
+        int listIndex = toRenderListBox(element->renderer())->listIndexAtOffset(localOffset.x(), localOffset.y());
         if (listIndex >= 0) {
             // Save the selection so it can be compared to the new selection when dispatching change events during mouseup, or after autoscroll finishes.
             saveLastSelection(data, element);
@@ -674,7 +678,7 @@ void SelectElement::listBoxDefaultEventHandler(SelectElementData& data, Element*
             data.setActiveSelectionState(true);
             
             bool multiSelectKeyPressed = false;
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
             multiSelectKeyPressed = mouseEvent->metaKey();
 #else
             multiSelectKeyPressed = mouseEvent->ctrlKey();
@@ -759,7 +763,7 @@ void SelectElement::listBoxDefaultEventHandler(SelectElementData& data, Element*
                 setActiveSelectionAnchorIndex(data, element, data.activeSelectionEndIndex());
             }
 
-            static_cast<RenderListBox*>(element->renderer())->scrollToRevealElementAtListIndex(endIndex);
+            toRenderListBox(element->renderer())->scrollToRevealElementAtListIndex(endIndex);
             updateListBoxSelection(data, element, deselectOthers);
             listBoxOnChange(data, element);
             event->setDefaultHandled();
diff --git a/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp b/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp
index 456cc52..5212380 100644
--- a/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp
@@ -101,11 +101,6 @@ void StyledElement::removeMappedAttributeDecl(MappedAttributeEntry entryType, co
     mappedAttributeDecls->remove(MappedAttributeKey(entryType, attrName.localName().impl(), attrValue.impl()));
 }
 
-void StyledElement::invalidateStyleAttribute()
-{
-    m_isStyleAttributeValid = false;
-}
-
 void StyledElement::updateStyleAttribute() const
 {
     ASSERT(!m_isStyleAttributeValid);
@@ -116,8 +111,8 @@ void StyledElement::updateStyleAttribute() const
     m_synchronizingStyleAttribute = false;
 }
 
-StyledElement::StyledElement(const QualifiedName& name, Document *doc)
-    : Element(name, doc)
+StyledElement::StyledElement(const QualifiedName& name, Document* document, ConstructionType type)
+    : Element(name, document, type)
 {
 }
 
@@ -280,14 +275,6 @@ CSSStyleDeclaration* StyledElement::style()
     return getInlineStyleDecl();
 }
 
-static inline int toHex(UChar c)
-{
-    return ((c >= '0' && c <= '9') ? (c - '0')
-        : ((c >= 'a' && c <= 'f') ? (c - 'a' + 10)
-        : ((c >= 'A' && c <= 'F') ? (c - 'A' + 10)
-        : -1)));
-}
-
 void StyledElement::addCSSProperty(MappedAttribute* attr, int id, const String &value)
 {
     if (!attr->decl()) createMappedDecl(attr);
@@ -300,12 +287,6 @@ void StyledElement::addCSSProperty(MappedAttribute* attr, int id, int value)
     attr->decl()->setProperty(id, value, false);
 }
 
-void StyledElement::addCSSStringProperty(MappedAttribute* attr, int id, const String &value, CSSPrimitiveValue::UnitTypes type)
-{
-    if (!attr->decl()) createMappedDecl(attr);
-    attr->decl()->setStringProperty(id, value, type, false);
-}
-
 void StyledElement::addCSSImageProperty(MappedAttribute* attr, int id, const String& url)
 {
     if (!attr->decl()) createMappedDecl(attr);
@@ -393,10 +374,9 @@ void StyledElement::addCSSColor(MappedAttribute* attr, int id, const String& c)
                 // search forward for digits in the string
                 int numDigits = 0;
                 while (pos < (int)color.length() && numDigits < basicLength) {
-                    int hex = toHex(color[pos]);
-                    colors[component] = (colors[component] << 4);
-                    if (hex > 0) {
-                        colors[component] += hex;
+                    colors[component] <<= 4;
+                    if (isASCIIHexDigit(color[pos])) {
+                        colors[component] += toASCIIHexValue(color[pos]);
                         maxDigit = min(maxDigit, numDigits);
                     }
                     numDigits++;
@@ -410,10 +390,9 @@ void StyledElement::addCSSColor(MappedAttribute* attr, int id, const String& c)
             
             // normalize to 00-ff. The highest filled digit counts, minimum is 2 digits
             maxDigit -= 2;
-            colors[0] >>= 4*maxDigit;
-            colors[1] >>= 4*maxDigit;
-            colors[2] >>= 4*maxDigit;
-            // ASSERT(colors[0] < 0x100 && colors[1] < 0x100 && colors[2] < 0x100);
+            colors[0] >>= 4 * maxDigit;
+            colors[1] >>= 4 * maxDigit;
+            colors[2] >>= 4 * maxDigit;
             
             color = String::format("#%02x%02x%02x", colors[0], colors[1], colors[2]);
             if (attr->decl()->setProperty(id, color, false))
diff --git a/src/3rdparty/webkit/WebCore/dom/StyledElement.h b/src/3rdparty/webkit/WebCore/dom/StyledElement.h
index 158992e..85fa7a7 100644
--- a/src/3rdparty/webkit/WebCore/dom/StyledElement.h
+++ b/src/3rdparty/webkit/WebCore/dom/StyledElement.h
@@ -3,7 +3,7 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -38,54 +38,49 @@ class MappedAttribute;
 
 class StyledElement : public Element {
 public:
-    StyledElement(const QualifiedName&, Document*);
     virtual ~StyledElement();
 
-    virtual bool isStyledElement() const { return true; }
-
     NamedMappedAttrMap* mappedAttributes() { return static_cast<NamedMappedAttrMap*>(namedAttrMap.get()); }
     const NamedMappedAttrMap* mappedAttributes() const { return static_cast<NamedMappedAttrMap*>(namedAttrMap.get()); }
+
     bool hasMappedAttributes() const { return namedAttrMap && mappedAttributes()->hasMappedAttributes(); }
     bool isMappedAttribute(const QualifiedName& name) const { MappedAttributeEntry res = eNone; mapToEntry(name, res); return res != eNone; }
 
-    void addCSSLength(MappedAttribute* attr, int id, const String &value);
-    void addCSSProperty(MappedAttribute* attr, int id, const String &value);
-    void addCSSProperty(MappedAttribute* attr, int id, int value);
-    void addCSSStringProperty(MappedAttribute* attr, int id, const String &value, CSSPrimitiveValue::UnitTypes = CSSPrimitiveValue::CSS_STRING);
+    void addCSSLength(MappedAttribute*, int id, const String& value);
+    void addCSSProperty(MappedAttribute*, int id, const String& value);
+    void addCSSProperty(MappedAttribute*, int id, int value);
     void addCSSImageProperty(MappedAttribute*, int propertyID, const String& url);
-    void addCSSColor(MappedAttribute* attr, int id, const String &c);
-    void createMappedDecl(MappedAttribute* attr);
-    
-    static CSSMappedAttributeDeclaration* getMappedAttributeDecl(MappedAttributeEntry type, const QualifiedName& name, const AtomicString& value);
+    void addCSSColor(MappedAttribute*, int id, const String& color);
+
+    static CSSMappedAttributeDeclaration* getMappedAttributeDecl(MappedAttributeEntry, const QualifiedName& name, const AtomicString& value);
     static void setMappedAttributeDecl(MappedAttributeEntry, const QualifiedName& name, const AtomicString& value, CSSMappedAttributeDeclaration*);
-    static void removeMappedAttributeDecl(MappedAttributeEntry type, const QualifiedName& name, const AtomicString& value);
+    static void removeMappedAttributeDecl(MappedAttributeEntry, const QualifiedName& name, const AtomicString& value);
 
     static CSSMappedAttributeDeclaration* getMappedAttributeDecl(MappedAttributeEntry, Attribute*);
     static void setMappedAttributeDecl(MappedAttributeEntry, Attribute*, CSSMappedAttributeDeclaration*);
-    
+
     CSSMutableStyleDeclaration* inlineStyleDecl() const { return m_inlineStyleDecl.get(); }
     virtual bool canHaveAdditionalAttributeStyleDecls() const { return false; }
     virtual void additionalAttributeStyleDecls(Vector<CSSMutableStyleDeclaration*>&) {};
     CSSMutableStyleDeclaration* getInlineStyleDecl();
     CSSStyleDeclaration* style();
-    void createInlineStyleDecl();
-    void destroyInlineStyleDecl();
     void invalidateStyleAttribute();
-    virtual void updateStyleAttribute() const;
-    
+
     const ClassNames& classNames() const { ASSERT(hasClass()); ASSERT(mappedAttributes()); return mappedAttributes()->classNames(); }
 
-    virtual void attributeChanged(Attribute*, bool preserveDecls = false);
-    virtual void parseMappedAttribute(MappedAttribute*);
     virtual bool mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const;
-    virtual void createAttributeMap() const;
+
     virtual PassRefPtr<Attribute> createAttribute(const QualifiedName&, const AtomicString& value);
 
+protected:
+    StyledElement(const QualifiedName&, Document*, ConstructionType);
+
+    virtual void attributeChanged(Attribute*, bool preserveDecls = false);
+    virtual void parseMappedAttribute(MappedAttribute*);
     virtual void copyNonAttributeProperties(const Element*);
 
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
-protected:
     // classAttributeChanged() exists to share code between
     // parseMappedAttribute (called via setAttribute()) and
     // svgAttributeChanged (called when element.className.baseValue is set)
@@ -93,9 +88,25 @@ protected:
     
     virtual void didMoveToNewOwnerDocument();
 
+private:
+    virtual bool isStyledElement() const { return true; }
+
+    void createMappedDecl(MappedAttribute*);
+
+    void createInlineStyleDecl();
+    void destroyInlineStyleDecl();
+    virtual void updateStyleAttribute() const;
+
+    virtual void createAttributeMap() const;
+
     RefPtr<CSSMutableStyleDeclaration> m_inlineStyleDecl;
 };
 
+inline void StyledElement::invalidateStyleAttribute()
+{
+    m_isStyleAttributeValid = false;
+}
+
 } //namespace
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/Text.cpp b/src/3rdparty/webkit/WebCore/dom/Text.cpp
index bbd926b..00db1c1 100644
--- a/src/3rdparty/webkit/WebCore/dom/Text.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Text.cpp
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -37,22 +37,18 @@
 #include "WMLVariables.h"
 #endif
 
-namespace WebCore {
-
-// DOM Section 1.1.1
+using namespace std;
 
-Text::Text(Document* document, const String& text)
-    : CharacterData(document, text, true)
-{
-}
+namespace WebCore {
 
-Text::Text(Document* document)
-    : CharacterData(document, true)
+Text::Text(Document* document, const String& data)
+    : CharacterData(document, data, CreateText)
 {
 }
 
-Text::~Text()
+PassRefPtr<Text> Text::create(Document* document, const String& data)
 {
+    return adoptRef(new Text(document, data));
 }
 
 PassRefPtr<Text> Text::splitText(unsigned offset, ExceptionCode& ec)
@@ -61,14 +57,14 @@ PassRefPtr<Text> Text::splitText(unsigned offset, ExceptionCode& ec)
 
     // INDEX_SIZE_ERR: Raised if the specified offset is negative or greater than
     // the number of 16-bit units in data.
-    if (offset > m_data->length()) {
+    if (offset > length()) {
         ec = INDEX_SIZE_ERR;
         return 0;
     }
 
-    RefPtr<StringImpl> oldStr = m_data;
-    RefPtr<Text> newText = createNew(oldStr->substring(offset));
-    m_data = oldStr->substring(0, offset);
+    RefPtr<StringImpl> oldStr = dataImpl();
+    RefPtr<Text> newText = virtualCreate(oldStr->substring(offset));
+    setDataImpl(oldStr->substring(0, offset));
 
     dispatchModifiedEvent(oldStr.get());
 
@@ -81,7 +77,7 @@ PassRefPtr<Text> Text::splitText(unsigned offset, ExceptionCode& ec)
         document()->textNodeSplit(this);
 
     if (renderer())
-        toRenderText(renderer())->setText(m_data);
+        toRenderText(renderer())->setText(dataImpl());
 
     return newText.release();
 }
@@ -199,7 +195,7 @@ Node::NodeType Text::nodeType() const
 
 PassRefPtr<Node> Text::cloneNode(bool /*deep*/)
 {
-    return document()->createTextNode(m_data);
+    return create(document(), data());
 }
 
 bool Text::rendererIsNeeded(RenderStyle *style)
@@ -244,7 +240,7 @@ bool Text::rendererIsNeeded(RenderStyle *style)
     return true;
 }
 
-RenderObject *Text::createRenderer(RenderArena* arena, RenderStyle*)
+RenderObject* Text::createRenderer(RenderArena* arena, RenderStyle*)
 {
 #if ENABLE(SVG)
     if (parentNode()->isSVGElement()
@@ -252,17 +248,17 @@ RenderObject *Text::createRenderer(RenderArena* arena, RenderStyle*)
         && !parentNode()->hasTagName(SVGNames::foreignObjectTag)
 #endif
     )
-        return new (arena) RenderSVGInlineText(this, m_data);
+        return new (arena) RenderSVGInlineText(this, dataImpl());
 #endif
     
-    return new (arena) RenderText(this, m_data);
+    return new (arena) RenderText(this, dataImpl());
 }
 
 void Text::attach()
 {
 #if ENABLE(WML)
     if (document()->isWMLDocument() && !containsOnlyWhitespace()) {
-        String text = m_data;
+        String text = data();
         ASSERT(!text.isEmpty());
 
         text = substituteVariableReferences(text, document());
@@ -286,7 +282,7 @@ void Text::recalcStyle(StyleChange change)
     if (needsStyleRecalc()) {
         if (renderer()) {
             if (renderer()->isText())
-                toRenderText(renderer())->setText(m_data);
+                toRenderText(renderer())->setText(dataImpl());
         } else {
             if (attached())
                 detach();
@@ -296,40 +292,42 @@ void Text::recalcStyle(StyleChange change)
     setNeedsStyleRecalc(NoStyleChange);
 }
 
-// DOM Section 1.1.1
 bool Text::childTypeAllowed(NodeType)
 {
     return false;
 }
 
-PassRefPtr<Text> Text::createNew(PassRefPtr<StringImpl> string)
+PassRefPtr<Text> Text::virtualCreate(const String& data)
 {
-    return new Text(document(), string);
+    return create(document(), data);
 }
 
-PassRefPtr<Text> Text::createWithLengthLimit(Document* doc, const String& text, unsigned& charsLeft, unsigned maxChars)
+PassRefPtr<Text> Text::createWithLengthLimit(Document* document, const String& data, unsigned& charsLeft, unsigned maxChars)
 {
-    if (charsLeft == text.length() && charsLeft <= maxChars) {
+    unsigned dataLength = data.length();
+
+    if (charsLeft == dataLength && charsLeft <= maxChars) {
         charsLeft = 0;
-        return new Text(doc, text);
+        return create(document, data);
     }
+
+    unsigned start = dataLength - charsLeft;
+    unsigned end = start + min(charsLeft, maxChars);
     
-    unsigned start = text.length() - charsLeft;
-    unsigned end = start + std::min(charsLeft, maxChars);
-    
-    // check we are not on an unbreakable boundary
-    TextBreakIterator* it = characterBreakIterator(text.characters(), text.length());
-    if (end < text.length() && !isTextBreak(it, end))
+    // Check we are not on an unbreakable boundary.
+    TextBreakIterator* it = characterBreakIterator(data.characters(), dataLength);
+    if (end < dataLength && !isTextBreak(it, end))
         end = textBreakPreceding(it, end);
         
-    // maxChars of unbreakable characters could lead to infinite loop
+    // If we have maxChars of unbreakable characters the above could lead to
+    // an infinite loop.
+    // FIXME: It would be better to just have the old value of end before calling
+    // textBreakPreceding rather than this, because this exceeds the length limit.
     if (end <= start)
-        end = text.length();
+        end = dataLength;
     
-    String nodeText = text.substring(start, end - start);
-    charsLeft = text.length() - end;
-        
-    return new Text(doc, nodeText);
+    charsLeft = dataLength - end;
+    return create(document, data.substring(start, end - start));
 }
 
 #ifndef NDEBUG
@@ -343,7 +341,7 @@ void Text::formatForDebugger(char *buffer, unsigned length) const
         result += s;
     }
           
-    s = nodeValue();
+    s = data();
     if (s.length() > 0) {
         if (result.length() > 0)
             result += "; ";
diff --git a/src/3rdparty/webkit/WebCore/dom/Text.h b/src/3rdparty/webkit/WebCore/dom/Text.h
index e5a6e69..4722736 100644
--- a/src/3rdparty/webkit/WebCore/dom/Text.h
+++ b/src/3rdparty/webkit/WebCore/dom/Text.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -27,44 +27,39 @@
 
 namespace WebCore {
     
-const unsigned cTextNodeLengthLimit = 1 << 16;
-
 class Text : public CharacterData {
 public:
-    Text(Document *impl, const String &_text);
-    Text(Document *impl);
-    virtual ~Text();
+    static const unsigned defaultLengthLimit = 1 << 16;
 
-    // DOM methods & attributes for CharacterData
+    static PassRefPtr<Text> create(Document*, const String&);
+    static PassRefPtr<Text> createWithLengthLimit(Document*, const String&, unsigned& charsLeft, unsigned lengthLimit = defaultLengthLimit);
 
     PassRefPtr<Text> splitText(unsigned offset, ExceptionCode&);
 
     // DOM Level 3: http://www.w3.org/TR/DOM-Level-3-Core/core.html#ID-1312295772
+
     String wholeText() const;
     PassRefPtr<Text> replaceWholeText(const String&, ExceptionCode&);
 
-    // DOM methods overridden from parent classes
+    virtual void attach();
+
+protected:
+    Text(Document*, const String&);
 
+private:
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
     virtual PassRefPtr<Node> cloneNode(bool deep);
-
-    // Other methods (not part of DOM)
-
-    virtual void attach();
     virtual bool rendererIsNeeded(RenderStyle*);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual void recalcStyle(StyleChange = NoChange);
     virtual bool childTypeAllowed(NodeType);
 
-    static PassRefPtr<Text> createWithLengthLimit(Document*, const String&, unsigned& charsLeft, unsigned maxChars = cTextNodeLengthLimit);
+    virtual PassRefPtr<Text> virtualCreate(const String&);
 
 #ifndef NDEBUG
     virtual void formatForDebugger(char* buffer, unsigned length) const;
 #endif
-
-protected:
-    virtual PassRefPtr<Text> createNew(PassRefPtr<StringImpl>);
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
index 1747c3c..4d06343 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
@@ -136,7 +136,7 @@ bool XMLTokenizer::enterText()
 #if !USE(QXMLSTREAM)
     ASSERT(m_bufferedText.size() == 0);
 #endif
-    RefPtr<Node> newNode = new Text(m_doc, "");
+    RefPtr<Node> newNode = Text::create(m_doc, "");
     if (!m_currentNode->addChild(newNode.get()))
         return false;
     setCurrentNode(newNode.get());
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
index 4387a66..da2f9b6 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
@@ -951,7 +951,7 @@ void XMLTokenizer::cdataBlock(const xmlChar* s, int len)
     
     exitText();
 
-    RefPtr<Node> newNode = new CDATASection(m_doc, toString(s, len));
+    RefPtr<Node> newNode = CDATASection::create(m_doc, toString(s, len));
     if (!m_currentNode->addChild(newNode.get()))
         return;
     if (m_view && !newNode->attached())
@@ -970,7 +970,7 @@ void XMLTokenizer::comment(const xmlChar* s)
     
     exitText();
 
-    RefPtr<Node> newNode = new Comment(m_doc, toString(s));
+    RefPtr<Node> newNode = Comment::create(m_doc, toString(s));
     m_currentNode->addChild(newNode.get());
     if (m_view && !newNode->attached())
         newNode->attach();
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp
index 16c637f..799eef3 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp
@@ -692,7 +692,7 @@ void XMLTokenizer::parseCdata()
 {
     exitText();
 
-    RefPtr<Node> newNode = new CDATASection(m_doc, m_stream.text());
+    RefPtr<Node> newNode = CDATASection::create(m_doc, m_stream.text());
     if (!m_currentNode->addChild(newNode.get()))
         return;
     if (m_view && !newNode->attached())
@@ -703,7 +703,7 @@ void XMLTokenizer::parseComment()
 {
     exitText();
 
-    RefPtr<Node> newNode = new Comment(m_doc, m_stream.text());
+    RefPtr<Node> newNode = Comment::create(m_doc, m_stream.text());
     m_currentNode->addChild(newNode.get());
     if (m_view && !newNode->attached())
         newNode->attach();
diff --git a/src/3rdparty/webkit/WebCore/dom/make_names.pl b/src/3rdparty/webkit/WebCore/dom/make_names.pl
index e6d59a0..6b5ddb4 100755
--- a/src/3rdparty/webkit/WebCore/dom/make_names.pl
+++ b/src/3rdparty/webkit/WebCore/dom/make_names.pl
@@ -48,28 +48,30 @@ my %parameters = ();
 my $extraDefines = 0;
 my $preprocessor = "/usr/bin/gcc -E -P -x c++";
 
-GetOptions('tags=s' => \$tagsFile, 
+GetOptions(
+    'tags=s' => \$tagsFile, 
     'attrs=s' => \$attrsFile,
     'factory' => \$printFactory,
     'outputDir=s' => \$outputDir,
     'extraDefines=s' => \$extraDefines,
     'preprocessor=s' => \$preprocessor,
-    'wrapperFactory' => \$printWrapperFactory);
+    'wrapperFactory' => \$printWrapperFactory
+);
 
 die "You must specify at least one of --tags <file> or --attrs <file>" unless (length($tagsFile) || length($attrsFile));
 
 readNames($tagsFile, "tags") if length($tagsFile);
 readNames($attrsFile, "attrs") if length($attrsFile);
 
-die "You must specify a namespace (e.g. SVG) for <namespace>Names.h" unless $parameters{'namespace'};
-die "You must specify a namespaceURI (e.g. http://www.w3.org/2000/svg)" unless $parameters{'namespaceURI'};
+die "You must specify a namespace (e.g. SVG) for <namespace>Names.h" unless $parameters{namespace};
+die "You must specify a namespaceURI (e.g. http://www.w3.org/2000/svg)" unless $parameters{namespaceURI};
 
-$parameters{'namespacePrefix'} = $parameters{'namespace'} unless $parameters{'namespacePrefix'};
+$parameters{namespacePrefix} = $parameters{namespace} unless $parameters{namespacePrefix};
 
 mkpath($outputDir);
-my $namesBasePath = "$outputDir/$parameters{'namespace'}Names";
-my $factoryBasePath = "$outputDir/$parameters{'namespace'}ElementFactory";
-my $wrapperFactoryBasePath = "$outputDir/JS$parameters{'namespace'}ElementWrapperFactory";
+my $namesBasePath = "$outputDir/$parameters{namespace}Names";
+my $factoryBasePath = "$outputDir/$parameters{namespace}ElementFactory";
+my $wrapperFactoryBasePath = "$outputDir/JS$parameters{namespace}ElementWrapperFactory";
 
 printNamesHeaderFile("$namesBasePath.h");
 printNamesCppFile("$namesBasePath.cpp");
@@ -86,39 +88,44 @@ if ($printWrapperFactory) {
 
 ### Hash initialization
 
-sub initializeTagPropertyHash
+sub defaultTagPropertyHash
 {
-    return ('constructorNeedsCreatedByParser' => 0,
-            'constructorNeedsFormElement' => 0,
-            'exportString' => 0,
-            'interfaceName' => defaultInterfaceName($_[0]),
-            # By default, the JSInterfaceName is the same as the interfaceName.
-            'JSInterfaceName' => defaultInterfaceName($_[0]),
-            'mapToTagName' => '',
-            'wrapperOnlyIfMediaIsAvailable' => 0,
-            'conditional' => 0);
+    return (
+        'constructorNeedsCreatedByParser' => 0,
+        'constructorNeedsFormElement' => 0,
+        'createWithNew' => 0,
+        'exportString' => 0,
+        'interfaceName' => defaultInterfaceName($_[0]),
+        # By default, the JSInterfaceName is the same as the interfaceName.
+        'JSInterfaceName' => defaultInterfaceName($_[0]),
+        'mapToTagName' => '',
+        'wrapperOnlyIfMediaIsAvailable' => 0,
+        'conditional' => 0
+    );
 }
 
-sub initializeAttrPropertyHash
+sub defaultAttrPropertyHash
 {
     return ('exportString' => 0);
 }
 
-sub initializeParametersHash
+sub defaultParametersHash
 {
-    return ('namespace' => '',
-            'namespacePrefix' => '',
-            'namespaceURI' => '',
-            'guardFactoryWith' => '',
-            'tagsNullNamespace' => 0,
-            'attrsNullNamespace' => 0,
-            'exportStrings' => 0);
+    return (
+        'namespace' => '',
+        'namespacePrefix' => '',
+        'namespaceURI' => '',
+        'guardFactoryWith' => '',
+        'tagsNullNamespace' => 0,
+        'attrsNullNamespace' => 0,
+        'exportStrings' => 0
+    );
 }
 
 sub defaultInterfaceName
 {
-    die "No namespace found" if !$parameters{'namespace'};
-    return $parameters{'namespace'} . upperCaseName($_[0]) . "Element"
+    die "No namespace found" if !$parameters{namespace};
+    return $parameters{namespace} . upperCaseName($_[0]) . "Element"
 }
 
 ### Parsing handlers
@@ -129,16 +136,16 @@ sub tagsHandler
 
     $tag =~ s/-/_/g;
 
-    # Initialize default properties' values.
-    $tags{$tag} = { initializeTagPropertyHash($tag) } if !defined($tags{$tag});
+    # Initialize default property values.
+    $tags{$tag} = { defaultTagPropertyHash($tag) } if !defined($tags{$tag});
 
     if ($property) {
         die "Unknown property $property for tag $tag\n" if !defined($tags{$tag}{$property});
-        # The code rely on JSInterfaceName deriving from interfaceName to check for custom JSInterfaceName.
-        # So just override JSInterfaceName if it was not already set.
-        if ($property eq "interfaceName" && $tags{$tag}{'JSInterfaceName'} eq $tags{$tag}{'interfaceName'}) {
-                $tags{$tag}{'JSInterfaceName'} = $value;
-        }
+
+        # The code relies on JSInterfaceName deriving from interfaceName to check for custom JSInterfaceName.
+        # So override JSInterfaceName if it was not already set.
+        $tags{$tag}{JSInterfaceName} = $value if $property eq "interfaceName" && $tags{$tag}{JSInterfaceName} eq $tags{$tag}{interfaceName};
+
         $tags{$tag}{$property} = $value;
     }
 }
@@ -150,7 +157,7 @@ sub attrsHandler
     $attr =~ s/-/_/g;
 
     # Initialize default properties' values.
-    $attrs{$attr} = { initializeAttrPropertyHash($attr) } if !defined($attrs{$attr});
+    $attrs{$attr} = { defaultAttrPropertyHash($attr) } if !defined($attrs{$attr});
 
     if ($property) {
         die "Unknown property $property for attribute $attr\n" if !defined($attrs{$attr}{$property});
@@ -163,7 +170,7 @@ sub parametersHandler
     my ($parameter, $value) = @_;
 
     # Initialize default properties' values.
-    %parameters = initializeParametersHash() if !(keys %parameters);
+    %parameters = defaultParametersHash() if !(keys %parameters);
 
     die "Unknown parameter $parameter for tags/attrs\n" if !defined($parameters{$parameter});
     $parameters{$parameter} = $value;
@@ -214,7 +221,7 @@ sub printMacros
     for my $name (sort keys %$namesRef) {
         print F "$macro $name","$suffix;\n";
 
-        if ($parameters{'exportStrings'} or $names{$name}{"exportString"}) { 
+        if ($parameters{exportStrings} or $names{$name}{exportString}) { 
             print F "extern char $name", "${suffix}String[];\n";
         }
     }
@@ -223,7 +230,7 @@ sub printMacros
 sub usesDefaultWrapper
 {
     my $tagName = shift;
-    return $tagName eq $parameters{'namespace'} . "Element";
+    return $tagName eq $parameters{namespace} . "Element";
 }
 
 # Build a direct mapping from the tags to the Element to create, excluding
@@ -232,16 +239,16 @@ sub buildConstructorMap
 {
     my %tagConstructorMap = ();
     for my $tagName (keys %tags) {
-        my $interfaceName = $tags{$tagName}{'interfaceName'};
+        my $interfaceName = $tags{$tagName}{interfaceName};
         next if (usesDefaultWrapper($interfaceName));
 
-        if ($tags{$tagName}{'mapToTagName'}) {
-            die "Cannot handle multiple mapToTagName for $tagName\n" if $tags{$tags{$tagName}{'mapToTagName'}}{'mapToTagName'};
-            $interfaceName = $tags{ $tags{$tagName}{'mapToTagName'} }{'interfaceName'};
+        if ($tags{$tagName}{mapToTagName}) {
+            die "Cannot handle multiple mapToTagName for $tagName\n" if $tags{$tags{$tagName}{mapToTagName}}{mapToTagName};
+            $interfaceName = $tags{ $tags{$tagName}{mapToTagName} }{interfaceName};
         }
 
         # Chop the string to keep the interesting part.
-        $interfaceName =~ s/$parameters{'namespace'}(.*)Element/$1/;
+        $interfaceName =~ s/$parameters{namespace}(.*)Element/$1/;
         $tagConstructorMap{$tagName} = lc($interfaceName);
     }
 
@@ -254,17 +261,13 @@ sub printConstructorSignature
 {
     my ($F, $tagName, $constructorName, $constructorTagName) = @_;
 
-    print F "static PassRefPtr<$parameters{'namespace'}Element> ${constructorName}Constructor(const QualifiedName& $constructorTagName, Document* doc";
-    if ($parameters{'namespace'} eq "HTML") {
+    print F "static PassRefPtr<$parameters{namespace}Element> ${constructorName}Constructor(const QualifiedName& $constructorTagName, Document* document";
+    if ($parameters{namespace} eq "HTML") {
         print F ", HTMLFormElement*";
-        if ($tags{$tagName}{'constructorNeedsFormElement'}) {
-            print F " formElement";
-        }
+        print F " formElement" if $tags{$tagName}{constructorNeedsFormElement};
     }
     print F ", bool";
-    if ($tags{$tagName}{'constructorNeedsCreatedByParser'}) {
-        print F " createdByParser"; 
-    }
+    print F " createdByParser" if $tags{$tagName}{constructorNeedsCreatedByParser};
     print F ")\n{\n";
 }
 
@@ -276,22 +279,26 @@ sub printConstructorInterior
     my ($F, $tagName, $interfaceName, $constructorTagName) = @_;
 
     # Handle media elements.
-    if ($tags{$tagName}{'wrapperOnlyIfMediaIsAvailable'}) {
+    if ($tags{$tagName}{wrapperOnlyIfMediaIsAvailable}) {
         print F <<END
     if (!MediaPlayer::isAvailable())
-        return new HTMLElement($constructorTagName, doc);
+        return HTMLElement::create($constructorTagName, document);
 END
 ;
     }
 
-    # Now call the constructor with the right parameters.
-    print F "    return new ${interfaceName}($constructorTagName, doc";
-    if ($tags{$tagName}{'constructorNeedsFormElement'}) {
-        print F ", formElement";
-    }
-    if ($tags{$tagName}{'constructorNeedsCreatedByParser'}) {
-        print F ", createdByParser";
+    my $newPrefix = "";
+    my $createSuffix = "::create";
+
+    if ($tags{$tagName}{createWithNew}) {
+        $newPrefix = "new ";
+        $createSuffix = "";
     }
+
+    # Call the constructor with the right parameters.
+    print F "    return $newPrefix$interfaceName${createSuffix}($constructorTagName, document";
+    print F ", formElement" if $tags{$tagName}{constructorNeedsFormElement};
+    print F ", createdByParser" if $tags{$tagName}{constructorNeedsCreatedByParser};
     print F ");\n}\n\n";
 }
 
@@ -300,20 +307,20 @@ sub printConstructors
     my ($F, $tagConstructorMapRef) = @_;
     my %tagConstructorMap = %$tagConstructorMapRef;
 
-    print F "#if $parameters{'guardFactoryWith'}\n" if $parameters{'guardFactoryWith'};
+    print F "#if $parameters{guardFactoryWith}\n" if $parameters{guardFactoryWith};
 
     # This is to avoid generating the same constructor several times.
     my %uniqueTags = ();
     for my $tagName (sort keys %tagConstructorMap) {
-        my $interfaceName = $tags{$tagName}{'interfaceName'};
+        my $interfaceName = $tags{$tagName}{interfaceName};
 
         # Ignore the mapped tag
         # FIXME: It could be moved inside this loop but was split for readibility.
-        next if (defined($uniqueTags{$interfaceName}) || $tags{$tagName}{'mapToTagName'});
+        next if (defined($uniqueTags{$interfaceName}) || $tags{$tagName}{mapToTagName});
 
         $uniqueTags{$interfaceName} = '1';
 
-        my $conditional = $tags{$tagName}{"conditional"};
+        my $conditional = $tags{$tagName}{conditional};
         if ($conditional) {
             my $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
             print F "#if ${conditionalString}\n\n";
@@ -323,20 +330,20 @@ sub printConstructors
         printConstructorInterior($F, $tagName, $interfaceName, "tagName");
 
         if ($conditional) {
-            print F "#endif\n\n";
+            print F "#endif\n";
         }
     }
 
     # Mapped tag name uses a special wrapper to keep their prefix and namespaceURI while using the mapped localname.
     for my $tagName (sort keys %tagConstructorMap) {
-        if ($tags{$tagName}{'mapToTagName'}) {
-            my $mappedName = $tags{$tagName}{'mapToTagName'};
+        if ($tags{$tagName}{mapToTagName}) {
+            my $mappedName = $tags{$tagName}{mapToTagName};
             printConstructorSignature($F, $mappedName, $mappedName . "To" . $tagName, "tagName");
-            printConstructorInterior($F, $mappedName, $tags{$mappedName}{'interfaceName'}, "QualifiedName(tagName.prefix(), ${mappedName}Tag.localName(), tagName.namespaceURI())");
+            printConstructorInterior($F, $mappedName, $tags{$mappedName}{interfaceName}, "QualifiedName(tagName.prefix(), ${mappedName}Tag.localName(), tagName.namespaceURI())");
         }
     }
 
-    print F "#endif\n" if $parameters{'guardFactoryWith'};
+    print F "#endif\n" if $parameters{guardFactoryWith};
 }
 
 sub printFunctionInits
@@ -346,14 +353,14 @@ sub printFunctionInits
 
     for my $tagName (sort keys %tagConstructorMap) {
 
-        my $conditional = $tags{$tagName}{"conditional"};
+        my $conditional = $tags{$tagName}{conditional};
         if ($conditional) {
             my $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
             print F "#if ${conditionalString}\n";
         }
 
-        if ($tags{$tagName}{'mapToTagName'}) {
-            print F "    addTag(${tagName}Tag, $tags{$tagName}{'mapToTagName'}To${tagName}Constructor);\n";
+        if ($tags{$tagName}{mapToTagName}) {
+            print F "    addTag(${tagName}Tag, $tags{$tagName}{mapToTagName}To${tagName}Constructor);\n";
         } else {
             print F "    addTag(${tagName}Tag, $tagConstructorMap{$tagName}Constructor);\n";
         }
@@ -368,9 +375,7 @@ sub svgCapitalizationHacks
 {
     my $name = shift;
 
-    if ($name =~ /^fe(.+)$/) {
-        $name = "FE" . ucfirst $1;
-    }
+    $name = "FE" . ucfirst $1 if $name =~ /^fe(.+)$/;
 
     return $name;
 }
@@ -379,7 +384,7 @@ sub upperCaseName
 {
     my $name = shift;
     
-    $name = svgCapitalizationHacks($name) if ($parameters{'namespace'} eq "SVG");
+    $name = svgCapitalizationHacks($name) if ($parameters{namespace} eq "SVG");
 
     while ($name =~ /^(.*?)_(.*)/) {
         $name = $1 . ucfirst $2;
@@ -392,10 +397,11 @@ sub printLicenseHeader
 {
     my $F = shift;
     print F "/*
- * THIS FILE IS AUTOMATICALLY GENERATED, DO NOT EDIT.
+ * THIS FILE WAS AUTOMATICALLY GENERATED, DO NOT EDIT.
  *
+ * This file was generated by the dom/make_names.pl script.
  *
- * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -416,10 +422,9 @@ sub printLicenseHeader
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-
 ";
 }
 
@@ -428,16 +433,16 @@ sub printNamesHeaderFile
     my ($headerPath) = shift;
     my $F;
     open F, ">$headerPath";
-    
+
     printLicenseHeader($F);
-    print F "#ifndef DOM_$parameters{'namespace'}NAMES_H\n";
-    print F "#define DOM_$parameters{'namespace'}NAMES_H\n\n";
+    print F "#ifndef DOM_$parameters{namespace}NAMES_H\n";
+    print F "#define DOM_$parameters{namespace}NAMES_H\n\n";
     print F "#include \"QualifiedName.h\"\n\n";
-    
-    print F "namespace WebCore {\n\n namespace $parameters{'namespace'}Names {\n\n";
-    
-    my $lowerNamespace = lc($parameters{'namespacePrefix'});
-    print F "#ifndef DOM_$parameters{'namespace'}NAMES_HIDE_GLOBALS\n";
+
+    print F "namespace WebCore {\n\n namespace $parameters{namespace}Names {\n\n";
+
+    my $lowerNamespace = lc($parameters{namespacePrefix});
+    print F "#ifndef DOM_$parameters{namespace}NAMES_HIDE_GLOBALS\n";
     print F "// Namespace\n";
     print F "extern const WebCore::AtomicString ${lowerNamespace}NamespaceURI;\n\n";
 
@@ -451,19 +456,19 @@ sub printNamesHeaderFile
         printMacros($F, "extern const WebCore::QualifiedName", "Attr", \%attrs);
     }
     print F "#endif\n\n";
-    
+
     if (keys %tags) {
-        print F "WebCore::QualifiedName** get$parameters{'namespace'}Tags(size_t* size);\n";
+        print F "WebCore::QualifiedName** get$parameters{namespace}Tags(size_t* size);\n";
     }
 
     if (keys %attrs) {
-        print F "WebCore::QualifiedName** get$parameters{'namespace'}Attrs(size_t* size);\n";
+        print F "WebCore::QualifiedName** get$parameters{namespace}Attrs(size_t* size);\n";
     }
-    
+
     print F "\nvoid init();\n\n";
     print F "} }\n\n";
     print F "#endif\n\n";
-    
+
     close F;
 }
 
@@ -475,25 +480,25 @@ sub printNamesCppFile
     
     printLicenseHeader($F);
     
-    my $lowerNamespace = lc($parameters{'namespacePrefix'});
+    my $lowerNamespace = lc($parameters{namespacePrefix});
 
 print F "#include \"config.h\"\n";
 
 print F "#ifdef SKIP_STATIC_CONSTRUCTORS_ON_GCC\n";
-print F "#define DOM_$parameters{'namespace'}NAMES_HIDE_GLOBALS 1\n";
+print F "#define DOM_$parameters{namespace}NAMES_HIDE_GLOBALS 1\n";
 print F "#else\n";
 print F "#define QNAME_DEFAULT_CONSTRUCTOR 1\n";
 print F "#endif\n\n";
 
 
-print F "#include \"$parameters{'namespace'}Names.h\"\n\n";
+print F "#include \"$parameters{namespace}Names.h\"\n\n";
 print F "#include \"StaticConstructors.h\"\n";
 
-print F "namespace WebCore {\n\n namespace $parameters{'namespace'}Names {
+print F "namespace WebCore {\n\n namespace $parameters{namespace}Names {
 
 using namespace WebCore;
 
-DEFINE_GLOBAL(AtomicString, ${lowerNamespace}NamespaceURI, \"$parameters{'namespaceURI'}\")
+DEFINE_GLOBAL(AtomicString, ${lowerNamespace}NamespaceURI, \"$parameters{namespaceURI}\")
 ";
 
     if (keys %tags) {
@@ -502,14 +507,14 @@ DEFINE_GLOBAL(AtomicString, ${lowerNamespace}NamespaceURI, \"$parameters{'namesp
             print F "DEFINE_GLOBAL(QualifiedName, ", $name, "Tag, nullAtom, \"$name\", ${lowerNamespace}NamespaceURI);\n";
         }
         
-        print F "\n\nWebCore::QualifiedName** get$parameters{'namespace'}Tags(size_t* size)\n";
-        print F "{\n    static WebCore::QualifiedName* $parameters{'namespace'}Tags[] = {\n";
+        print F "\n\nWebCore::QualifiedName** get$parameters{namespace}Tags(size_t* size)\n";
+        print F "{\n    static WebCore::QualifiedName* $parameters{namespace}Tags[] = {\n";
         for my $name (sort keys %tags) {
             print F "        (WebCore::QualifiedName*)&${name}Tag,\n";
         }
         print F "    };\n";
         print F "    *size = ", scalar(keys %tags), ";\n";
-        print F "    return $parameters{'namespace'}Tags;\n";
+        print F "    return $parameters{namespace}Tags;\n";
         print F "}\n";
     }
 
@@ -518,14 +523,14 @@ DEFINE_GLOBAL(AtomicString, ${lowerNamespace}NamespaceURI, \"$parameters{'namesp
         for my $name (sort keys %attrs) {
             print F "DEFINE_GLOBAL(QualifiedName, ", $name, "Attr, nullAtom, \"$name\", ${lowerNamespace}NamespaceURI);\n";
         }
-        print F "\n\nWebCore::QualifiedName** get$parameters{'namespace'}Attrs(size_t* size)\n";
-        print F "{\n    static WebCore::QualifiedName* $parameters{'namespace'}Attr[] = {\n";
+        print F "\n\nWebCore::QualifiedName** get$parameters{namespace}Attrs(size_t* size)\n";
+        print F "{\n    static WebCore::QualifiedName* $parameters{namespace}Attr[] = {\n";
         for my $name (sort keys %attrs) {
             print F "        (WebCore::QualifiedName*)&${name}Attr,\n";
         }
         print F "    };\n";
         print F "    *size = ", scalar(keys %attrs), ";\n";
-        print F "    return $parameters{'namespace'}Attr;\n";
+        print F "    return $parameters{namespace}Attr;\n";
         print F "}\n";
     }
 
@@ -549,16 +554,16 @@ print F "\nvoid init()
     AtomicString::init();
 ";
     
-    print(F "    AtomicString ${lowerNamespace}NS(\"$parameters{'namespaceURI'}\");\n\n");
+    print(F "    AtomicString ${lowerNamespace}NS(\"$parameters{namespaceURI}\");\n\n");
 
     print(F "    // Namespace\n");
     print(F "    new ((void*)&${lowerNamespace}NamespaceURI) AtomicString(${lowerNamespace}NS);\n\n");
     if (keys %tags) {
-        my $tagsNamespace = $parameters{'tagsNullNamespace'} ? "nullAtom" : "${lowerNamespace}NS";
+        my $tagsNamespace = $parameters{tagsNullNamespace} ? "nullAtom" : "${lowerNamespace}NS";
         printDefinitions($F, \%tags, "tags", $tagsNamespace);
     }
     if (keys %attrs) {
-        my $attrsNamespace = $parameters{'attrsNullNamespace'} ? "nullAtom" : "${lowerNamespace}NS";
+        my $attrsNamespace = $parameters{attrsNullNamespace} ? "nullAtom" : "${lowerNamespace}NS";
         printDefinitions($F, \%attrs, "attributes", $attrsNamespace);
     }
 
@@ -572,7 +577,7 @@ sub printJSElementIncludes
 
     my %tagsSeen;
     for my $tagName (sort keys %tags) {
-        my $JSInterfaceName = $tags{$tagName}{"JSInterfaceName"};
+        my $JSInterfaceName = $tags{$tagName}{JSInterfaceName};
         next if defined($tagsSeen{$JSInterfaceName}) || usesDefaultJSWrapper($tagName);
         $tagsSeen{$JSInterfaceName} = 1;
 
@@ -586,7 +591,7 @@ sub printElementIncludes
 
     my %tagsSeen;
     for my $tagName (sort keys %tags) {
-        my $interfaceName = $tags{$tagName}{"interfaceName"};
+        my $interfaceName = $tags{$tagName}{interfaceName};
         next if defined($tagsSeen{$interfaceName});
         $tagsSeen{$interfaceName} = 1;
 
@@ -604,7 +609,7 @@ sub printDefinitionStrings
 
     my %names = %$namesRef;
     for my $name (sort keys %$namesRef) {
-        next if (!$parameters{'exportStrings'} and !$names{$name}{"exportString"});
+        next if (!$parameters{exportStrings} and !$names{$name}{exportString});
 
         my $realName = $name;
         $realName =~ s/_/-/g;
@@ -625,7 +630,7 @@ sub printDefinitions
 
     my %names = %$namesRef;
     for my $name (sort keys %$namesRef) {
-        next if ($parameters{'exportStrings'} or $names{$name}{"exportString"});
+        next if ($parameters{exportStrings} or $names{$name}{exportString});
 
         my $realName = $name;
         $realName =~ s/_/-/g;
@@ -651,39 +656,31 @@ printLicenseHeader($F);
 
 print F <<END
 #include "config.h"
-#include "$parameters{'namespace'}ElementFactory.h"
-
-#include "$parameters{'namespace'}Names.h"
-#if ENABLE(DASHBOARD_SUPPORT)
-#include "Document.h"
-#include "Settings.h"
-#endif
+#include "$parameters{namespace}ElementFactory.h"
 
+#include "$parameters{namespace}Names.h"
 END
 ;
 
-if ($parameters{'namespace'} eq "HTML") {
-    print F "#include \"HTMLFormElement.h\"\n";
-}
-
 printElementIncludes($F);
 
 print F <<END
 #include <wtf/HashMap.h>
 
+#if ENABLE(DASHBOARD_SUPPORT)
+#include "Document.h"
+#include "Settings.h"
+#endif
+
 namespace WebCore {
 
-using namespace $parameters{'namespace'}Names;
+using namespace $parameters{namespace}Names;
 
 END
 ;
 
-print F "typedef PassRefPtr<$parameters{'namespace'}Element> (*ConstructorFunction)(const QualifiedName&, Document*";
-
-if ($parameters{'namespace'} eq "HTML") {
-    print F ", HTMLFormElement*";
-}
-
+print F "typedef PassRefPtr<$parameters{namespace}Element> (*ConstructorFunction)(const QualifiedName&, Document*";
+print F ", HTMLFormElement*" if $parameters{namespace} eq "HTML";
 print F ", bool createdByParser);\n";
 print F <<END
 typedef HashMap<AtomicStringImpl*, ConstructorFunction> FunctionMap;
@@ -697,7 +694,7 @@ my %tagConstructorMap = buildConstructorMap();
 
 printConstructors($F, \%tagConstructorMap);
 
-print F "#if $parameters{'guardFactoryWith'}\n" if $parameters{'guardFactoryWith'};
+print F "#if $parameters{guardFactoryWith}\n" if $parameters{guardFactoryWith};
 
 print F <<END
 static void addTag(const QualifiedName& tag, ConstructorFunction func)
@@ -705,10 +702,10 @@ static void addTag(const QualifiedName& tag, ConstructorFunction func)
     gFunctionMap->set(tag.localName().impl(), func);
 }
 
-static inline void createFunctionMapIfNecessary()
+static void createFunctionMap()
 {
-    if (gFunctionMap)
-        return;
+    ASSERT(!gFunctionMap);
+
     // Create the table.
     gFunctionMap = new FunctionMap;
     
@@ -719,30 +716,25 @@ END
 printFunctionInits($F, \%tagConstructorMap);
 
 print F "}\n";
-print F "#endif\n" if $parameters{'guardFactoryWith'};
-
-print F "\nPassRefPtr<$parameters{'namespace'}Element> $parameters{'namespace'}ElementFactory::create$parameters{'namespace'}Element(const QualifiedName& qName, Document* doc";
-
-if ($parameters{"namespace"} eq "HTML") {
-    print F ", HTMLFormElement* formElement";
-}
+print F "#endif\n" if $parameters{guardFactoryWith};
 
+print F "\nPassRefPtr<$parameters{namespace}Element> $parameters{namespace}ElementFactory::create$parameters{namespace}Element(const QualifiedName& qName, Document* document";
+print F ", HTMLFormElement* formElement" if $parameters{namespace} eq "HTML";
 print F ", bool createdByParser)\n{\n";
 
-print F "#if $parameters{'guardFactoryWith'}\n" if $parameters{'guardFactoryWith'};
+print F "#if $parameters{guardFactoryWith}\n" if $parameters{guardFactoryWith};
 
 print F <<END
-    // Don't make elements without a document
-    if (!doc)
+    if (!document)
         return 0;
 
 END
 ;
 
-if ($parameters{'namespace'} ne "HTML") {
+if ($parameters{namespace} ne "HTML") {
 print F <<END
 #if ENABLE(DASHBOARD_SUPPORT)
-    Settings* settings = doc->settings();
+    Settings* settings = document->settings();
     if (settings && settings->usesDashboardBackwardCompatibilityMode())
         return 0;
 #endif
@@ -752,21 +744,21 @@ END
 }
 
 print F <<END
-    createFunctionMapIfNecessary();
-    ConstructorFunction func = gFunctionMap->get(qName.localName().impl());
-    if (func)
+    if (!gFunctionMap)
+        createFunctionMap();
+    if (ConstructorFunction function = gFunctionMap->get(qName.localName().impl()))
 END
 ;
 
-if ($parameters{"namespace"} eq "HTML") {
-    print F "        return func(qName, doc, formElement, createdByParser);\n";
+if ($parameters{namespace} eq "HTML") {
+    print F "        return function(qName, document, formElement, createdByParser);\n";
 } else {
-    print F "        return func(qName, doc, createdByParser);\n";
+    print F "        return function(qName, document, createdByParser);\n";
 }
 
-print F "    return new $parameters{'namespace'}Element(qName, doc);\n";
+print F "    return $parameters{namespace}Element::create(qName, document);\n";
 
-if ($parameters{'guardFactoryWith'}) {
+if ($parameters{guardFactoryWith}) {
 
 print F <<END
 #else
@@ -797,8 +789,8 @@ sub printFactoryHeaderFile
     printLicenseHeader($F);
 
     print F<<END
-#ifndef $parameters{'namespace'}ElementFactory_h
-#define $parameters{'namespace'}ElementFactory_h
+#ifndef $parameters{namespace}ElementFactory_h
+#define $parameters{namespace}ElementFactory_h
 
 #include <wtf/PassRefPtr.h>
 
@@ -811,35 +803,29 @@ namespace WebCore {
 
 namespace WebCore {
 
-    class $parameters{'namespace'}Element;
+    class $parameters{namespace}Element;
 END
 ;
 
-if ($parameters{'namespace'} eq "HTML") {
-    print F "     class HTMLFormElement;\n";
-}
+print F "     class HTMLFormElement;\n" if $parameters{namespace} eq "HTML";
 
 print F<<END
     // The idea behind this class is that there will eventually be a mapping from namespace URIs to ElementFactories that can dispense
     // elements. In a compound document world, the generic createElement function (will end up being virtual) will be called.
-    class $parameters{'namespace'}ElementFactory {
+    class $parameters{namespace}ElementFactory {
     public:
         PassRefPtr<Element> createElement(const WebCore::QualifiedName&, WebCore::Document*, bool createdByParser = true);
 END
 ;
-print F "        static PassRefPtr<$parameters{'namespace'}Element> create$parameters{'namespace'}Element(const WebCore::QualifiedName&, WebCore::Document*";
-
-if ($parameters{'namespace'} eq "HTML") {
-    print F ", HTMLFormElement* = 0";
-}
-
+print F "        static PassRefPtr<$parameters{namespace}Element> create$parameters{namespace}Element(const WebCore::QualifiedName&, WebCore::Document*";
+print F ", HTMLFormElement* = 0" if $parameters{namespace} eq "HTML";
 print F ", bool /*createdByParser*/ = true);\n";
 
 printf F<<END
     };
 }
 
-#endif // $parameters{'namespace'}ElementFactory_h
+#endif // $parameters{namespace}ElementFactory_h
 
 END
 ;
@@ -854,7 +840,7 @@ sub usesDefaultJSWrapper
     my $name = shift;
 
     # A tag reuses the default wrapper if its JSInterfaceName matches the default namespace Element.
-    return $tags{$name}{'JSInterfaceName'} eq $parameters{"namespace"} . "Element" || $tags{$name}{'JSInterfaceName'} eq "HTMLNoScriptElement";
+    return $tags{$name}{JSInterfaceName} eq $parameters{namespace} . "Element" || $tags{$name}{JSInterfaceName} eq "HTMLNoScriptElement";
 }
 
 sub printWrapperFunctions
@@ -864,11 +850,11 @@ sub printWrapperFunctions
     my %tagsSeen;
     for my $tagName (sort keys %tags) {
         # Avoid defining the same wrapper method twice.
-        my $JSInterfaceName = $tags{$tagName}{"JSInterfaceName"};
+        my $JSInterfaceName = $tags{$tagName}{JSInterfaceName};
         next if defined($tagsSeen{$JSInterfaceName}) || usesDefaultJSWrapper($tagName);
         $tagsSeen{$JSInterfaceName} = 1;
 
-        my $conditional = $tags{$tagName}{"conditional"};
+        my $conditional = $tags{$tagName}{conditional};
         if ($conditional) {
             my $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
             print F "#if ${conditionalString}\n\n";
@@ -876,12 +862,12 @@ sub printWrapperFunctions
 
         # Hack for the media tags
         # FIXME: This should have been done via a CustomWrapper attribute and a separate *Custom file.
-        if ($tags{$tagName}{"wrapperOnlyIfMediaIsAvailable"}) {
+        if ($tags{$tagName}{wrapperOnlyIfMediaIsAvailable}) {
             print F <<END
-static JSNode* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{'namespace'}Element> element)
+static JSNode* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{namespace}Element> element)
 {
     if (!MediaPlayer::isAvailable())
-        return CREATE_DOM_NODE_WRAPPER(exec, globalObject, $parameters{'namespace'}Element, element.get());
+        return CREATE_DOM_NODE_WRAPPER(exec, globalObject, $parameters{namespace}Element, element.get());
     return CREATE_DOM_NODE_WRAPPER(exec, globalObject, ${JSInterfaceName}, element.get());
 }
 
@@ -889,7 +875,7 @@ END
 ;
         } else {
             print F <<END
-static JSNode* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{'namespace'}Element> element)
+static JSNode* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{namespace}Element> element)
 {
     return CREATE_DOM_NODE_WRAPPER(exec, globalObject, ${JSInterfaceName}, element.get());
 }
@@ -897,6 +883,7 @@ static JSNode* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObjec
 END
 ;
         }
+
         if ($conditional) {
             print F "#endif\n\n";
         }
@@ -913,13 +900,13 @@ sub printWrapperFactoryCppFile
 
     print F "#include \"config.h\"\n\n";
 
-    print F "#if $parameters{'guardFactoryWith'}\n\n" if $parameters{'guardFactoryWith'};
+    print F "#if $parameters{guardFactoryWith}\n\n" if $parameters{guardFactoryWith};
 
-    print F "#include \"JS$parameters{'namespace'}ElementWrapperFactory.h\"\n";
+    print F "#include \"JS$parameters{namespace}ElementWrapperFactory.h\"\n";
 
     printJSElementIncludes($F);
 
-    print F "\n#include \"$parameters{'namespace'}Names.h\"\n\n";
+    print F "\n#include \"$parameters{namespace}Names.h\"\n\n";
 
     printElementIncludes($F);
 
@@ -930,9 +917,9 @@ using namespace JSC;
 
 namespace WebCore {
 
-using namespace $parameters{'namespace'}Names;
+using namespace $parameters{namespace}Names;
 
-typedef JSNode* (*Create$parameters{'namespace'}ElementWrapperFunction)(ExecState*, JSDOMGlobalObject*, PassRefPtr<$parameters{'namespace'}Element>);
+typedef JSNode* (*Create$parameters{namespace}ElementWrapperFunction)(ExecState*, JSDOMGlobalObject*, PassRefPtr<$parameters{namespace}Element>);
 
 END
 ;
@@ -940,9 +927,9 @@ END
     printWrapperFunctions($F);
 
     print F <<END
-JSNode* createJS$parameters{'namespace'}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{'namespace'}Element> element)
+JSNode* createJS$parameters{namespace}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{namespace}Element> element)
 {   
-    typedef HashMap<WebCore::AtomicStringImpl*, Create$parameters{'namespace'}ElementWrapperFunction> FunctionMap;
+    typedef HashMap<WebCore::AtomicStringImpl*, Create$parameters{namespace}ElementWrapperFunction> FunctionMap;
     DEFINE_STATIC_LOCAL(FunctionMap, map, ());
     if (map.isEmpty()) {
 END
@@ -952,13 +939,13 @@ END
         # Do not add the name to the map if it does not have a JS wrapper constructor or uses the default wrapper.
         next if usesDefaultJSWrapper($tag, \%tags);
 
-        my $conditional = $tags{$tag}{"conditional"};
+        my $conditional = $tags{$tag}{conditional};
         if ($conditional) {
             my $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
             print F "#if ${conditionalString}\n";
         }
 
-        my $ucTag = $tags{$tag}{"JSInterfaceName"};
+        my $ucTag = $tags{$tag}{JSInterfaceName};
         print F "       map.set(${tag}Tag.localName().impl(), create${ucTag}Wrapper);\n";
 
         if ($conditional) {
@@ -968,10 +955,10 @@ END
 
     print F <<END
     }
-    Create$parameters{'namespace'}ElementWrapperFunction createWrapperFunction = map.get(element->localName().impl());
+    Create$parameters{namespace}ElementWrapperFunction createWrapperFunction = map.get(element->localName().impl());
     if (createWrapperFunction)
         return createWrapperFunction(exec, globalObject, element);
-    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, $parameters{'namespace'}Element, element.get());
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, $parameters{namespace}Element, element.get());
 }
 
 }
@@ -979,7 +966,7 @@ END
 END
 ;
 
-    print F "#endif\n" if $parameters{'guardFactoryWith'};
+    print F "#endif\n" if $parameters{guardFactoryWith};
 
     close F;
 }
@@ -992,10 +979,10 @@ sub printWrapperFactoryHeaderFile
 
     printLicenseHeader($F);
 
-    print F "#ifndef JS$parameters{'namespace'}ElementWrapperFactory_h\n";
-    print F "#define JS$parameters{'namespace'}ElementWrapperFactory_h\n\n";
+    print F "#ifndef JS$parameters{namespace}ElementWrapperFactory_h\n";
+    print F "#define JS$parameters{namespace}ElementWrapperFactory_h\n\n";
 
-    print F "#if $parameters{'guardFactoryWith'}\n" if $parameters{'guardFactoryWith'};
+    print F "#if $parameters{guardFactoryWith}\n" if $parameters{guardFactoryWith};
 
     print F <<END
 #include <wtf/Forward.h>
@@ -1008,18 +995,18 @@ namespace WebCore {
 
     class JSNode;
     class JSDOMGlobalObject;
-    class $parameters{'namespace'}Element;
+    class $parameters{namespace}Element;
 
-    JSNode* createJS$parameters{'namespace'}Wrapper(JSC::ExecState*, JSDOMGlobalObject*, PassRefPtr<$parameters{'namespace'}Element>);
+    JSNode* createJS$parameters{namespace}Wrapper(JSC::ExecState*, JSDOMGlobalObject*, PassRefPtr<$parameters{namespace}Element>);
 
 }
  
 END
 ;
 
-    print F "#endif // $parameters{'guardFactoryWith'}\n\n" if $parameters{'guardFactoryWith'};
+    print F "#endif // $parameters{guardFactoryWith}\n\n" if $parameters{guardFactoryWith};
 
-    print F "#endif // JS$parameters{'namespace'}ElementWrapperFactory_h\n";
+    print F "#endif // JS$parameters{namespace}ElementWrapperFactory_h\n";
 
     close F;
 }
diff --git a/src/3rdparty/webkit/WebCore/editing/AppendNodeCommand.cpp b/src/3rdparty/webkit/WebCore/editing/AppendNodeCommand.cpp
index 06d0158..ef79e9c 100644
--- a/src/3rdparty/webkit/WebCore/editing/AppendNodeCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/AppendNodeCommand.cpp
@@ -39,7 +39,7 @@ AppendNodeCommand::AppendNodeCommand(PassRefPtr<Element> parent, PassRefPtr<Node
     ASSERT(m_node);
     ASSERT(!m_node->parent());
 
-    ASSERT(enclosingNodeOfType(Position(m_parent.get(), 0), isContentEditable) || !m_parent->attached());
+    ASSERT(m_parent->isContentEditable() || !m_parent->attached());
 }
 
 void AppendNodeCommand::doApply()
diff --git a/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp b/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp
index 36cd823..0c3aa42 100644
--- a/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp
@@ -58,6 +58,8 @@ public:
     String cssStyle() const { return m_cssStyle; }
     bool applyBold() const { return m_applyBold; }
     bool applyItalic() const { return m_applyItalic; }
+    bool applyUnderline() const { return m_applyUnderline; }
+    bool applyLineThrough() const { return m_applyLineThrough; }
     bool applySubscript() const { return m_applySubscript; }
     bool applySuperscript() const { return m_applySuperscript; }
     bool applyFontColor() const { return m_applyFontColor.length() > 0; }
@@ -70,12 +72,14 @@ public:
 
 private:
     void init(PassRefPtr<CSSStyleDeclaration>, const Position&);
-    bool checkForLegacyHTMLStyleChange(const CSSProperty*);
-    static bool currentlyHasStyle(const Position&, const CSSProperty*);
-    
+    void reconcileTextDecorationProperties(CSSMutableStyleDeclaration*);
+    void extractTextStyles(CSSMutableStyleDeclaration*);
+
     String m_cssStyle;
     bool m_applyBold;
     bool m_applyItalic;
+    bool m_applyUnderline;
+    bool m_applyLineThrough;
     bool m_applySubscript;
     bool m_applySuperscript;
     String m_applyFontColor;
@@ -87,6 +91,8 @@ private:
 StyleChange::StyleChange(CSSStyleDeclaration* style, const Position& position)
     : m_applyBold(false)
     , m_applyItalic(false)
+    , m_applyUnderline(false)
+    , m_applyLineThrough(false)
     , m_applySubscript(false)
     , m_applySuperscript(false)
 {
@@ -99,103 +105,135 @@ void StyleChange::init(PassRefPtr<CSSStyleDeclaration> style, const Position& po
     if (!document || !document->frame())
         return;
 
-    bool useHTMLFormattingTags = !document->frame()->editor()->shouldStyleWithCSS();
-    RefPtr<CSSMutableStyleDeclaration> mutableStyle = style->makeMutable();
-    // We shouldn't have both text-decoration and -webkit-text-decorations-in-effect because that wouldn't make sense.
-    ASSERT(!mutableStyle->getPropertyCSSValue(CSSPropertyTextDecoration) || !mutableStyle->getPropertyCSSValue(CSSPropertyWebkitTextDecorationsInEffect));
-    String styleText("");
-    bool addedDirection = false;
-    CSSMutableStyleDeclaration::const_iterator end = mutableStyle->end();
-    for (CSSMutableStyleDeclaration::const_iterator it = mutableStyle->begin(); it != end; ++it) {
-        const CSSProperty *property = &*it;
-
-        // If position is empty or the position passed in already has the 
-        // style, just move on.
-        if (position.isNotNull() && currentlyHasStyle(position, property))
-            continue;
-        
-        // Changing the whitespace style in a tab span would collapse the tab into a space.
-        if (property->id() == CSSPropertyWhiteSpace && (isTabSpanTextNode(position.node()) || isTabSpanNode((position.node()))))
-            continue;
-        
-        // If needed, figure out if this change is a legacy HTML style change.
-        if (useHTMLFormattingTags && checkForLegacyHTMLStyleChange(property))
-            continue;
+    RefPtr<CSSComputedStyleDeclaration> computedStyle = position.computedStyle();
+    RefPtr<CSSMutableStyleDeclaration> mutableStyle = getPropertiesNotInComputedStyle(style.get(), computedStyle.get());
 
-        if (property->id() == CSSPropertyDirection) {
-            if (addedDirection)
-                continue;
-            addedDirection = true;
-        }
+    reconcileTextDecorationProperties(mutableStyle.get());
+    if (!document->frame()->editor()->shouldStyleWithCSS())
+        extractTextStyles(mutableStyle.get());
 
-        // Add this property
-        if (property->id() == CSSPropertyTextDecoration || property->id() == CSSPropertyWebkitTextDecorationsInEffect) {
-            // Always use text-decoration because -webkit-text-decoration-in-effect is internal.
-            CSSProperty alteredProperty(CSSPropertyTextDecoration, property->value(), property->isImportant());
-            // We don't add "text-decoration: none" because it doesn't override the existing text decorations; i.e. redundant
-            if (!equalIgnoringCase(alteredProperty.value()->cssText(), "none"))
-                styleText += alteredProperty.cssText();
-        } else
-            styleText += property->cssText();
+    // Changing the whitespace style in a tab span would collapse the tab into a space.
+    if (isTabSpanTextNode(position.node()) || isTabSpanNode((position.node())))
+        mutableStyle->removeProperty(CSSPropertyWhiteSpace);
 
-        if (!addedDirection && property->id() == CSSPropertyUnicodeBidi) {
-            styleText += "direction: " + style->getPropertyValue(CSSPropertyDirection) + "; ";
-            addedDirection = true;
-        }
-    }
+    // If unicode-bidi is present in mutableStyle and direction is not, then add direction to mutableStyle.
+    // FIXME: Shouldn't this be done in getPropertiesNotInComputedStyle?
+    if (mutableStyle->getPropertyCSSValue(CSSPropertyUnicodeBidi) && !style->getPropertyCSSValue(CSSPropertyDirection))
+        mutableStyle->setProperty(CSSPropertyDirection, style->getPropertyValue(CSSPropertyDirection));
 
     // Save the result for later
-    m_cssStyle = styleText.stripWhiteSpace();
+    m_cssStyle = mutableStyle->cssText().stripWhiteSpace();
+}
+
+void StyleChange::reconcileTextDecorationProperties(CSSMutableStyleDeclaration* style)
+{    
+    RefPtr<CSSValue> textDecorationsInEffect = style->getPropertyCSSValue(CSSPropertyWebkitTextDecorationsInEffect);
+    RefPtr<CSSValue> textDecoration = style->getPropertyCSSValue(CSSPropertyTextDecoration);
+    // We shouldn't have both text-decoration and -webkit-text-decorations-in-effect because that wouldn't make sense.
+    ASSERT(!textDecorationsInEffect || !textDecoration);
+    if (textDecorationsInEffect) {
+        style->setProperty(CSSPropertyTextDecoration, textDecorationsInEffect->cssText());
+        style->removeProperty(CSSPropertyWebkitTextDecorationsInEffect);
+        textDecoration = textDecorationsInEffect;
+    }
+
+    // If text-decration is set to "none", remove the property because we don't want to add redundant "text-decoration: none".
+    if (textDecoration && !textDecoration->isValueList())
+        style->removeProperty(CSSPropertyTextDecoration);
 }
 
-// This function is the mapping from CSS styles to styling tags (like font-weight: bold to <b>)
-bool StyleChange::checkForLegacyHTMLStyleChange(const CSSProperty* property)
+static int getIdentifierValue(CSSMutableStyleDeclaration* style, int propertyID)
 {
-    if (!property || !property->value())
-        return false;
-    
-    String valueText(property->value()->cssText());
-    switch (property->id()) {
-        case CSSPropertyFontWeight:
-            if (equalIgnoringCase(valueText, "bold")) {
-                m_applyBold = true;
-                return true;
-            }
-            break;
-        case CSSPropertyVerticalAlign:
-            if (equalIgnoringCase(valueText, "sub")) {
-                m_applySubscript = true;
-                return true;
-            }
-            if (equalIgnoringCase(valueText, "super")) {
-                m_applySuperscript = true;
-                return true;
-            }
-            break;
-        case CSSPropertyFontStyle:
-            if (equalIgnoringCase(valueText, "italic") || equalIgnoringCase(valueText, "oblique")) {
-                m_applyItalic = true;
-                return true;
-            }
-            break;
-        case CSSPropertyColor: {
-            RGBA32 rgba = 0;
-            CSSParser::parseColor(rgba, valueText);
-            Color color(rgba);
-            m_applyFontColor = color.name();
-            return true;
-        }
-        case CSSPropertyFontFamily:
-            m_applyFontFace = valueText;
-            return true;
-        case CSSPropertyFontSize:
-            if (property->value()->cssValueType() == CSSValue::CSS_PRIMITIVE_VALUE) {
-                CSSPrimitiveValue *value = static_cast<CSSPrimitiveValue *>(property->value());
+    if (!style)
+        return 0;
+
+    RefPtr<CSSValue> value = style->getPropertyCSSValue(propertyID);
+    if (!value || !value->isPrimitiveValue())
+        return 0;
+
+    return static_cast<CSSPrimitiveValue*>(value.get())->getIdent();
+}
+
+static void setTextDecorationProperty(CSSMutableStyleDeclaration* style, const CSSValueList* newTextDecoration, int propertyID)
+{
+    if (newTextDecoration->length())
+        style->setProperty(propertyID, newTextDecoration->cssText(), style->getPropertyPriority(propertyID));
+    else {
+        // text-decoration: none is redundant since it does not remove any text decorations.
+        ASSERT(!style->getPropertyPriority(propertyID));
+        style->removeProperty(propertyID);
+    }
+}
+
+void StyleChange::extractTextStyles(CSSMutableStyleDeclaration* style)
+{
+    ASSERT(style);
+
+    if (getIdentifierValue(style, CSSPropertyFontWeight) == CSSValueBold) {
+        style->removeProperty(CSSPropertyFontWeight);
+        m_applyBold = true;
+    }
 
-                if (value->primitiveType() < CSSPrimitiveValue::CSS_PX || value->primitiveType() > CSSPrimitiveValue::CSS_PC)
-                    // Size keyword or relative unit.
-                    return false;
+    int fontStyle = getIdentifierValue(style, CSSPropertyFontStyle);
+    if (fontStyle == CSSValueItalic || fontStyle == CSSValueOblique) {
+        style->removeProperty(CSSPropertyFontStyle);
+        m_applyItalic = true;
+    }
+
+    // Assuming reconcileTextDecorationProperties has been called, there should not be -webkit-text-decorations-in-effect
+    // Furthermore, text-decoration: none has been trimmed so that text-decoration property is always a CSSValueList.
+    if (RefPtr<CSSValue> textDecoration = style->getPropertyCSSValue(CSSPropertyTextDecoration)) {
+        ASSERT(textDecoration->isValueList());
+        DEFINE_STATIC_LOCAL(RefPtr<CSSPrimitiveValue>, underline, (CSSPrimitiveValue::createIdentifier(CSSValueUnderline)));
+        DEFINE_STATIC_LOCAL(RefPtr<CSSPrimitiveValue>, lineThrough, (CSSPrimitiveValue::createIdentifier(CSSValueLineThrough)));
+
+        RefPtr<CSSValueList> newTextDecoration = static_cast<CSSValueList*>(textDecoration.get())->copy();
+        if (newTextDecoration->removeAll(underline.get()))
+            m_applyUnderline = true;
+        if (newTextDecoration->removeAll(lineThrough.get()))
+            m_applyLineThrough = true;
+
+        // If trimTextDecorations, delete underline and line-through
+        setTextDecorationProperty(style, newTextDecoration.get(), CSSPropertyTextDecoration);
+    }
 
+    int verticalAlign = getIdentifierValue(style, CSSPropertyVerticalAlign);
+    switch (verticalAlign) {
+    case CSSValueSub:
+        style->removeProperty(CSSPropertyVerticalAlign);
+        m_applySubscript = true;
+        break;
+    case CSSValueSuper:
+        style->removeProperty(CSSPropertyVerticalAlign);
+        m_applySuperscript = true;
+        break;
+    }
+
+    if (RefPtr<CSSValue> colorValue = style->getPropertyCSSValue(CSSPropertyColor)) {
+        ASSERT(colorValue->isPrimitiveValue());
+        CSSPrimitiveValue* primitiveColor = static_cast<CSSPrimitiveValue*>(colorValue.get());
+        RGBA32 rgba;
+        if (primitiveColor->primitiveType() != CSSPrimitiveValue::CSS_RGBCOLOR) {
+            CSSParser::parseColor(rgba, colorValue->cssText());
+            // Need to take care of named color such as green and black
+            // This code should be removed after https://bugs.webkit.org/show_bug.cgi?id=28282 is fixed.
+        } else
+            rgba = primitiveColor->getRGBA32Value();
+        m_applyFontColor = Color(rgba).name();
+        style->removeProperty(CSSPropertyColor);
+    }
+
+    m_applyFontFace = style->getPropertyValue(CSSPropertyFontFamily);
+    style->removeProperty(CSSPropertyFontFamily);
+
+    if (RefPtr<CSSValue> fontSize = style->getPropertyCSSValue(CSSPropertyFontSize)) {
+        if (!fontSize->isPrimitiveValue())
+            style->removeProperty(CSSPropertyFontSize); // Can't make sense of the number. Put no font size.
+        else {
+            CSSPrimitiveValue* value = static_cast<CSSPrimitiveValue*>(fontSize.get());
+
+            // Only accept absolute scale
+            if (value->primitiveType() >= CSSPrimitiveValue::CSS_PX && value->primitiveType() <= CSSPrimitiveValue::CSS_PC) {
                 float number = value->getFloatValue(CSSPrimitiveValue::CSS_PX);
                 if (number <= 9)
                     m_applyFontSize = "1";
@@ -211,31 +249,12 @@ bool StyleChange::checkForLegacyHTMLStyleChange(const CSSProperty* property)
                     m_applyFontSize = "6";
                 else
                     m_applyFontSize = "7";
-                // Huge quirk in Microsft Entourage is that they understand CSS font-size, but also write 
-                // out legacy 1-7 values in font tags (I guess for mailers that are not CSS-savvy at all, 
-                // like Eudora). Yes, they write out *both*. We need to write out both as well. Return false.
-                return false; 
-            }
-            else {
-                // Can't make sense of the number. Put no font size.
-                return true;
             }
+            // Huge quirk in Microsft Entourage is that they understand CSS font-size, but also write 
+            // out legacy 1-7 values in font tags (I guess for mailers that are not CSS-savvy at all, 
+            // like Eudora). Yes, they write out *both*. We need to write out both as well.
+        }
     }
-    return false;
-}
-
-bool StyleChange::currentlyHasStyle(const Position &pos, const CSSProperty *property)
-{
-    ASSERT(pos.isNotNull());
-    RefPtr<CSSComputedStyleDeclaration> style = pos.computedStyle();
-    RefPtr<CSSValue> value;
-    if (property->id() == CSSPropertyFontSize)
-        value = style->getFontSizeCSSValuePreferringKeyword();
-    else
-        value = style->getPropertyCSSValue(property->id(), DoNotUpdateLayout);
-    if (!value)
-        return false;
-    return equalIgnoringCase(value->cssText(), property->value()->cssText());
 }
 
 static String& styleSpanClassString()
@@ -300,6 +319,125 @@ PassRefPtr<HTMLElement> createStyleSpanElement(Document* document)
     return styleElement.release();
 }
 
+static void diffTextDecorations(CSSMutableStyleDeclaration* style, int propertID, CSSValue* refTextDecoration)
+{
+    RefPtr<CSSValue> textDecoration = style->getPropertyCSSValue(propertID);
+    if (!textDecoration || !textDecoration->isValueList() || !refTextDecoration || !refTextDecoration->isValueList())
+        return;
+
+    RefPtr<CSSValueList> newTextDecoration = static_cast<CSSValueList*>(textDecoration.get())->copy();
+    CSSValueList* valuesInRefTextDecoration = static_cast<CSSValueList*>(refTextDecoration);
+
+    for (size_t i = 0; i < valuesInRefTextDecoration->length(); i++)
+        newTextDecoration->removeAll(valuesInRefTextDecoration->item(i));
+
+    setTextDecorationProperty(style, newTextDecoration.get(), propertID);
+}
+
+RefPtr<CSSMutableStyleDeclaration> getPropertiesNotInComputedStyle(CSSStyleDeclaration* style, CSSComputedStyleDeclaration* computedStyle)
+{
+    ASSERT(style);
+    ASSERT(computedStyle);
+    RefPtr<CSSMutableStyleDeclaration> result = style->copy();
+    computedStyle->diff(result.get());
+
+    RefPtr<CSSValue> computedTextDecorationsInEffect = computedStyle->getPropertyCSSValue(CSSPropertyWebkitTextDecorationsInEffect);
+    diffTextDecorations(result.get(), CSSPropertyTextDecoration, computedTextDecorationsInEffect.get());
+    diffTextDecorations(result.get(), CSSPropertyWebkitTextDecorationsInEffect, computedTextDecorationsInEffect.get());
+
+    return result;
+}
+
+// Editing style properties must be preserved during editing operation.
+// e.g. when a user inserts a new paragraph, all properties listed here must be copied to the new paragraph.
+// FIXME: The current editingStyleProperties contains all inheritableProperties but we may not need to preserve all inheritable properties
+static const int editingStyleProperties[] = {
+    CSSPropertyBackgroundColor,
+    // CSS inheritable properties
+    CSSPropertyBorderCollapse,
+    CSSPropertyColor,
+    CSSPropertyFontFamily,
+    CSSPropertyFontSize,
+    CSSPropertyFontStyle,
+    CSSPropertyFontVariant,
+    CSSPropertyFontWeight,
+    CSSPropertyLetterSpacing,
+    CSSPropertyLineHeight,
+    CSSPropertyOrphans,
+    CSSPropertyTextAlign,
+    CSSPropertyTextIndent,
+    CSSPropertyTextTransform,
+    CSSPropertyWhiteSpace,
+    CSSPropertyWidows,
+    CSSPropertyWordSpacing,
+    CSSPropertyWebkitBorderHorizontalSpacing,
+    CSSPropertyWebkitBorderVerticalSpacing,
+    CSSPropertyWebkitTextDecorationsInEffect,
+    CSSPropertyWebkitTextFillColor,
+    CSSPropertyWebkitTextSizeAdjust,
+    CSSPropertyWebkitTextStrokeColor,
+    CSSPropertyWebkitTextStrokeWidth,
+};
+size_t numEditingStyleProperties = sizeof(editingStyleProperties)/sizeof(editingStyleProperties[0]);
+
+PassRefPtr<CSSMutableStyleDeclaration> editingStyleAtPosition(Position pos, ShouldIncludeTypingStyle shouldIncludeTypingStyle)
+{
+    RefPtr<CSSComputedStyleDeclaration> computedStyleAtPosition = pos.computedStyle();
+    RefPtr<CSSMutableStyleDeclaration> style = computedStyleAtPosition->copyPropertiesInSet(editingStyleProperties, numEditingStyleProperties);
+
+    if (style && pos.node() && pos.node()->computedStyle()) {
+        RenderStyle* renderStyle = pos.node()->computedStyle();
+        // If a node's text fill color is invalid, then its children use 
+        // their font-color as their text fill color (they don't
+        // inherit it).  Likewise for stroke color.
+        ExceptionCode ec = 0;
+        if (!renderStyle->textFillColor().isValid())
+            style->removeProperty(CSSPropertyWebkitTextFillColor, ec);
+        if (!renderStyle->textStrokeColor().isValid())
+            style->removeProperty(CSSPropertyWebkitTextStrokeColor, ec);
+        ASSERT(ec == 0);
+        if (renderStyle->fontDescription().keywordSize())
+            style->setProperty(CSSPropertyFontSize, computedStyleAtPosition->getFontSizeCSSValuePreferringKeyword()->cssText());
+    }
+
+    if (shouldIncludeTypingStyle == IncludeTypingStyle) {
+        CSSMutableStyleDeclaration* typingStyle = pos.node()->document()->frame()->typingStyle();
+        if (typingStyle)
+            style->merge(typingStyle);
+    }
+
+    return style.release();
+}
+
+void prepareEditingStyleToApplyAt(CSSMutableStyleDeclaration* editingStyle, Position pos)
+{
+    // ReplaceSelectionCommand::handleStyleSpans() requiers that this function only removes the editing style.
+    // If this function was modified in the futureto delete all redundant properties, then add a boolean value to indicate
+    // which one of editingStyleAtPosition or computedStyle is called.
+    RefPtr<CSSMutableStyleDeclaration> style = editingStyleAtPosition(pos);
+    style->diff(editingStyle);
+
+    // if alpha value is zero, we don't add the background color.
+    RefPtr<CSSValue> backgroundColor = editingStyle->getPropertyCSSValue(CSSPropertyBackgroundColor);
+    if (backgroundColor && backgroundColor->isPrimitiveValue()) {
+        CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(backgroundColor.get());
+        Color color = Color(primitiveValue->getRGBA32Value());
+        ExceptionCode ec;
+        if (color.alpha() == 0)
+            editingStyle->removeProperty(CSSPropertyBackgroundColor, ec);
+    }
+}
+
+void removeStylesAddedByNode(CSSMutableStyleDeclaration* editingStyle, Node* node)
+{
+    ASSERT(node);
+    ASSERT(node->parentNode());
+    RefPtr<CSSMutableStyleDeclaration> parentStyle = editingStyleAtPosition(Position(node->parentNode(), 0));
+    RefPtr<CSSMutableStyleDeclaration> style = editingStyleAtPosition(Position(node, 0));
+    parentStyle->diff(style.get());
+    style->diff(editingStyle);
+}
+    
 ApplyStyleCommand::ApplyStyleCommand(Document* document, CSSStyleDeclaration* style, EditAction editingAction, EPropertyLevel propertyLevel)
     : CompositeEditCommand(document)
     , m_style(style->makeMutable())
@@ -770,9 +908,9 @@ void ApplyStyleCommand::applyInlineStyle(CSSMutableStyleDeclaration *style)
     if (unicodeBidi) {
         // Avoid removing the dir attribute and the unicode-bidi and direction properties from the unsplit ancestors.
         if (startUnsplitAncestor && nodeFullySelected(startUnsplitAncestor, removeStart, end))
-            embeddingRemoveStart = positionAfterNode(startUnsplitAncestor);
+            embeddingRemoveStart = positionInParentAfterNode(startUnsplitAncestor);
         if (endUnsplitAncestor && nodeFullySelected(endUnsplitAncestor, removeStart, end))
-            embeddingRemoveEnd = positionBeforeNode(endUnsplitAncestor).downstream();
+            embeddingRemoveEnd = positionInParentBeforeNode(endUnsplitAncestor).downstream();
     }
 
     if (embeddingRemoveStart != removeStart || embeddingRemoveEnd != end) {
@@ -822,7 +960,7 @@ void ApplyStyleCommand::applyInlineStyle(CSSMutableStyleDeclaration *style)
                 if (ancestorUnicodeBidi) {
                     ASSERT(ancestorUnicodeBidi->isPrimitiveValue());
                     if (static_cast<CSSPrimitiveValue*>(ancestorUnicodeBidi.get())->getIdent() == CSSValueEmbed) {
-                        embeddingApplyStart = positionAfterNode(n);
+                        embeddingApplyStart = positionInParentAfterNode(n);
                         break;
                     }
                 }
@@ -836,7 +974,7 @@ void ApplyStyleCommand::applyInlineStyle(CSSMutableStyleDeclaration *style)
                 if (ancestorUnicodeBidi) {
                     ASSERT(ancestorUnicodeBidi->isPrimitiveValue());
                     if (static_cast<CSSPrimitiveValue*>(ancestorUnicodeBidi.get())->getIdent() == CSSValueEmbed) {
-                        embeddingApplyEnd = positionBeforeNode(n);
+                        embeddingApplyEnd = positionInParentBeforeNode(n);
                         break;
                     }
                 }
@@ -1175,7 +1313,7 @@ void ApplyStyleCommand::applyTextDecorationStyle(Node *node, CSSMutableStyleDecl
         return;
 
     HTMLElement *element = static_cast<HTMLElement *>(node);
-        
+
     StyleChange styleChange(style, Position(element, 0));
     if (styleChange.cssStyle().length()) {
         String cssText = styleChange.cssStyle();
@@ -1184,6 +1322,12 @@ void ApplyStyleCommand::applyTextDecorationStyle(Node *node, CSSMutableStyleDecl
             cssText += decl->cssText();
         setNodeAttribute(element, styleAttr, cssText);
     }
+
+    if (styleChange.applyUnderline())
+        surroundNodeRangeWithElement(node, node, createHTMLElement(document(), uTag));
+
+    if (styleChange.applyLineThrough())
+        surroundNodeRangeWithElement(node, node, createHTMLElement(document(), sTag));    
 }
 
 void ApplyStyleCommand::pushDownTextDecorationStyleAroundNode(Node* targetNode, bool forceNegate)
@@ -1235,6 +1379,7 @@ void ApplyStyleCommand::pushDownTextDecorationStyleAtBoundaries(const Position &
     pushDownTextDecorationStyleAroundNode(end.node(), true);
 }
 
+// FIXME: Why does this exist?  Callers should either use lastOffsetForEditing or lastOffsetInNode
 static int maxRangeOffset(Node *n)
 {
     if (n->offsetInCharacters())
@@ -1618,6 +1763,12 @@ void ApplyStyleCommand::addInlineStyleIfNeeded(CSSMutableStyleDeclaration *style
     if (styleChange.applyItalic())
         surroundNodeRangeWithElement(startNode, endNode, createHTMLElement(document(), iTag));
 
+    if (styleChange.applyUnderline())
+        surroundNodeRangeWithElement(startNode, endNode, createHTMLElement(document(), uTag));
+
+    if (styleChange.applyLineThrough())
+        surroundNodeRangeWithElement(startNode, endNode, createHTMLElement(document(), sTag));
+
     if (styleChange.applySubscript())
         surroundNodeRangeWithElement(startNode, endNode, createHTMLElement(document(), subTag));
     else if (styleChange.applySuperscript())
diff --git a/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.h b/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.h
index 61213d8..29aa483 100644
--- a/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.h
@@ -114,6 +114,16 @@ private:
 
 bool isStyleSpan(const Node*);
 PassRefPtr<HTMLElement> createStyleSpanElement(Document*);
+RefPtr<CSSMutableStyleDeclaration> getPropertiesNotInComputedStyle(CSSStyleDeclaration* style, CSSComputedStyleDeclaration* computedStyle);
+
+enum ShouldIncludeTypingStyle {
+    IncludeTypingStyle,
+    IgnoreTypingStyle
+};
+
+PassRefPtr<CSSMutableStyleDeclaration> editingStyleAtPosition(Position, ShouldIncludeTypingStyle = IgnoreTypingStyle);
+void prepareEditingStyleToApplyAt(CSSMutableStyleDeclaration*, Position);
+void removeStylesAddedByNode(CSSMutableStyleDeclaration*, Node*);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/editing/BreakBlockquoteCommand.cpp b/src/3rdparty/webkit/WebCore/editing/BreakBlockquoteCommand.cpp
index 4f3949d..1ca2d87 100644
--- a/src/3rdparty/webkit/WebCore/editing/BreakBlockquoteCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/BreakBlockquoteCommand.cpp
@@ -144,7 +144,7 @@ void BreakBlockquoteCommand::doApply()
             while (listChildNode && !listChildNode->hasTagName(liTag))
                 listChildNode = listChildNode->nextSibling();
             if (listChildNode && listChildNode->renderer())
-                setNodeAttribute(static_cast<Element*>(clonedChild.get()), startAttr, String::number(static_cast<RenderListItem*>(listChildNode->renderer())->value()));
+                setNodeAttribute(static_cast<Element*>(clonedChild.get()), startAttr, String::number(toRenderListItem(listChildNode->renderer())->value()));
         }
             
         appendNode(clonedChild.get(), clonedAncestor.get());
diff --git a/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.cpp b/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.cpp
index dcb3326..0496a8f 100644
--- a/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.cpp
@@ -343,13 +343,13 @@ Position CompositeEditCommand::positionOutsideTabSpan(const Position& pos)
     Node* tabSpan = tabSpanNode(pos.node());
     
     if (pos.deprecatedEditingOffset() <= caretMinOffset(pos.node()))
-        return positionBeforeNode(tabSpan);
+        return positionInParentBeforeNode(tabSpan);
         
     if (pos.deprecatedEditingOffset() >= caretMaxOffset(pos.node()))
-        return positionAfterNode(tabSpan);
+        return positionInParentAfterNode(tabSpan);
 
     splitTextNodeContainingElement(static_cast<Text *>(pos.node()), pos.deprecatedEditingOffset());
-    return positionBeforeNode(tabSpan);
+    return positionInParentBeforeNode(tabSpan);
 }
 
 void CompositeEditCommand::insertNodeAtTabSpanPosition(PassRefPtr<Node> node, const Position& pos)
@@ -519,7 +519,7 @@ void CompositeEditCommand::deleteInsignificantText(PassRefPtr<Text> textNode, un
             gapStart = max(gapStart, start);
             gapEnd = min(gapEnd, end);
             if (str.isNull())
-                str = textNode->string()->substring(start, end - start);
+                str = textNode->data().substring(start, end - start);
             // remove text in the gap
             str.remove(gapStart - start - removed, gapLen);
             removed += gapLen;
@@ -795,14 +795,14 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
 
     // FIXME: This is an inefficient way to preserve style on nodes in the paragraph to move.  It 
     // shouldn't matter though, since moved paragraphs will usually be quite small.
-    RefPtr<DocumentFragment> fragment = startOfParagraphToMove != endOfParagraphToMove ? createFragmentFromMarkup(document(), createMarkup(range.get(), 0, DoNotAnnotateForInterchange, true), "") : PassRefPtr<DocumentFragment>(0);
+    RefPtr<DocumentFragment> fragment = startOfParagraphToMove != endOfParagraphToMove ? createFragmentFromMarkup(document(), createMarkup(range.get(), 0, DoNotAnnotateForInterchange, true), "") : 0;
     
     // A non-empty paragraph's style is moved when we copy and move it.  We don't move 
     // anything if we're given an empty paragraph, but an empty paragraph can have style
     // too, <div><b><br></b></div> for example.  Save it so that we can preserve it later.
     RefPtr<CSSMutableStyleDeclaration> styleInEmptyParagraph;
     if (startOfParagraphToMove == endOfParagraphToMove && preserveStyle) {
-        styleInEmptyParagraph = styleAtPosition(startOfParagraphToMove.deepEquivalent());
+        styleInEmptyParagraph = editingStyleAtPosition(startOfParagraphToMove.deepEquivalent(), IncludeTypingStyle);
         // The moved paragraph should assume the block style of the destination.
         styleInEmptyParagraph->removeBlockProperties();
     }
@@ -890,31 +890,57 @@ bool CompositeEditCommand::breakOutOfEmptyListItem()
     Node* emptyListItem = enclosingEmptyListItem(endingSelection().visibleStart());
     if (!emptyListItem)
         return false;
-        
-    RefPtr<CSSMutableStyleDeclaration> style = styleAtPosition(endingSelection().start());
+
+    RefPtr<CSSMutableStyleDeclaration> style = editingStyleAtPosition(endingSelection().start(), IncludeTypingStyle);
 
     Node* listNode = emptyListItem->parentNode();
-    
-    if (!listNode->isContentEditable())
+    // FIXME: Can't we do something better when the immediate parent wasn't a list node?
+    if (!listNode
+        || (!listNode->hasTagName(ulTag) && !listNode->hasTagName(olTag))
+        || !listNode->isContentEditable())
         return false;
-    
-    RefPtr<Element> newBlock = isListElement(listNode->parentNode()) ? createListItemElement(document()) : createDefaultParagraphElement(document());
-    
+
+    RefPtr<Element> newBlock = 0;
+    if (Node* blockEnclosingList = listNode->parentNode()) {
+        if (blockEnclosingList->hasTagName(liTag)) { // listNode is inside another list item
+            if (visiblePositionAfterNode(blockEnclosingList) == visiblePositionAfterNode(listNode)) {
+                // If listNode appears at the end of the outer list item, then move listNode outside of this list item
+                // e.g. <ul><li>hello <ul><li><br></li></ul> </li></ul> should become <ul><li>hello</li> <ul><li><br></li></ul> </ul> after this section
+                // If listNode does NOT appear at the end, then we should consider it as a regular paragraph.
+                // e.g. <ul><li> <ul><li><br></li></ul> hello</li></ul> should become <ul><li> <div><br></div> hello</li></ul> at the end
+                splitElement(static_cast<Element*>(blockEnclosingList), listNode);
+                removeNodePreservingChildren(listNode->parentNode());
+                newBlock = createListItemElement(document());
+            }
+            // If listNode does NOT appear at the end of the outer list item, then behave as if in a regular paragraph. 
+        } else if (blockEnclosingList->hasTagName(olTag) || blockEnclosingList->hasTagName(ulTag))
+            newBlock = createListItemElement(document());
+    }
+    if (!newBlock)
+        newBlock = createDefaultParagraphElement(document());
+
     if (emptyListItem->renderer()->nextSibling()) {
+        // If emptyListItem follows another list item, split the list node.
         if (emptyListItem->renderer()->previousSibling())
             splitElement(static_cast<Element*>(listNode), emptyListItem);
+
+        // If emptyListItem is followed by other list item, then insert newBlock before the list node.
+        // Because we have splitted the element, emptyListItem is the first element in the list node.
+        // i.e. insert newBlock before ul or ol whose first element is emptyListItem
         insertNodeBefore(newBlock, listNode);
         removeNode(emptyListItem);
     } else {
+        // When emptyListItem does not follow any list item, insert newBlock after the enclosing list node.
+        // Remove the enclosing node if emptyListItem is the only child; otherwise just remove emptyListItem.
         insertNodeAfter(newBlock, listNode);
         removeNode(emptyListItem->renderer()->previousSibling() ? emptyListItem : listNode);
     }
-    
+
     appendBlockPlaceholder(newBlock);
     setEndingSelection(VisibleSelection(Position(newBlock.get(), 0), DOWNSTREAM));
-    
-    computedStyle(endingSelection().start().node())->diff(style.get());
-    if (style->length() > 0)
+
+    prepareEditingStyleToApplyAt(style.get(), endingSelection().start());
+    if (style->length())
         applyStyle(style.get());
     
     return true;
@@ -960,7 +986,7 @@ bool CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph()
     ASSERT(caretPos.node()->hasTagName(brTag) || caretPos.node()->isTextNode() && caretPos.node()->renderer()->style()->preserveNewline());
     
     if (caretPos.node()->hasTagName(brTag)) {
-        Position beforeBR(positionBeforeNode(caretPos.node()));
+        Position beforeBR(positionInParentBeforeNode(caretPos.node()));
         removeNode(caretPos.node());
         prune(beforeBR.node());
     } else {
@@ -1013,7 +1039,7 @@ Position CompositeEditCommand::positionAvoidingSpecialElementBoundary(const Posi
             if (lineBreakExistsAtVisiblePosition(visiblePos) && downstream.node()->isDescendantOf(enclosingAnchor))
                 return original;
             
-            result = positionAfterNode(enclosingAnchor);
+            result = positionInParentAfterNode(enclosingAnchor);
         }
         // If visually just before an anchor, insert *outside* the anchor unless it's the first
         // VisiblePosition in a paragraph, to match NSTextView.
@@ -1027,7 +1053,7 @@ Position CompositeEditCommand::positionAvoidingSpecialElementBoundary(const Posi
             if (!enclosingAnchor)
                 return original;
 
-            result = positionBeforeNode(enclosingAnchor);
+            result = positionInParentBeforeNode(enclosingAnchor);
         }
     }
         
diff --git a/src/3rdparty/webkit/WebCore/editing/CreateLinkCommand.cpp b/src/3rdparty/webkit/WebCore/editing/CreateLinkCommand.cpp
index 263feab..d7048fe 100644
--- a/src/3rdparty/webkit/WebCore/editing/CreateLinkCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/CreateLinkCommand.cpp
@@ -43,7 +43,7 @@ void CreateLinkCommand::doApply()
     if (endingSelection().isNone())
         return;
         
-    RefPtr<HTMLAnchorElement> anchorElement = new HTMLAnchorElement(document());
+    RefPtr<HTMLAnchorElement> anchorElement = HTMLAnchorElement::create(document());
     anchorElement->setHref(m_url);
     
     if (endingSelection().isRange()) {
@@ -51,9 +51,9 @@ void CreateLinkCommand::doApply()
         applyStyledElement(anchorElement.get());
     } else {
         insertNodeAt(anchorElement.get(), endingSelection().start());
-        RefPtr<Text> textNode = new Text(document(), m_url);
+        RefPtr<Text> textNode = Text::create(document(), m_url);
         appendNode(textNode.get(), anchorElement.get());
-        setEndingSelection(VisibleSelection(positionBeforeNode(anchorElement.get()), positionAfterNode(anchorElement.get()), DOWNSTREAM));
+        setEndingSelection(VisibleSelection(positionInParentBeforeNode(anchorElement.get()), positionInParentAfterNode(anchorElement.get()), DOWNSTREAM));
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.cpp b/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.cpp
index 725c01d..c154426 100644
--- a/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.cpp
@@ -187,7 +187,7 @@ void DeleteButtonController::respondToChangedSelection(const VisibleSelection& o
 void DeleteButtonController::createDeletionUI()
 {
     RefPtr<HTMLDivElement> container = new HTMLDivElement(divTag, m_target->document());
-    container->setId(containerElementIdentifier);
+    container->setAttribute(idAttr, containerElementIdentifier);
 
     CSSMutableStyleDeclaration* style = container->getInlineStyleDecl();
     style->setProperty(CSSPropertyWebkitUserDrag, CSSValueNone);
@@ -202,7 +202,7 @@ void DeleteButtonController::createDeletionUI()
     style->setProperty(CSSPropertyLeft, "0");
 
     RefPtr<HTMLDivElement> outline = new HTMLDivElement(divTag, m_target->document());
-    outline->setId(outlineElementIdentifier);
+    outline->setAttribute(idAttr, outlineElementIdentifier);
 
     const int borderWidth = 4;
     const int borderRadius = 6;
@@ -225,7 +225,7 @@ void DeleteButtonController::createDeletionUI()
         return;
 
     RefPtr<DeleteButton> button = new DeleteButton(m_target->document());
-    button->setId(buttonElementIdentifier);
+    button->setAttribute(idAttr, buttonElementIdentifier);
 
     const int buttonWidth = 30;
     const int buttonHeight = 30;
@@ -350,7 +350,7 @@ void DeleteButtonController::deleteTarget()
     // Because the deletion UI only appears when the selection is entirely
     // within the target, we unconditionally update the selection to be
     // a caret where the target had been.
-    Position pos = positionBeforeNode(element.get());
+    Position pos = positionInParentBeforeNode(element.get());
     applyCommand(RemoveNodeCommand::create(element.release()));
     m_frame->selection()->setSelection(VisiblePosition(pos));
 }
diff --git a/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.cpp b/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.cpp
index d3ac341..d94dcd2 100644
--- a/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.cpp
@@ -44,6 +44,7 @@
 #include "Text.h"
 #include "TextIterator.h"
 #include "visible_units.h"
+#include "ApplyStyleCommand.h"
 
 namespace WebCore {
 
@@ -136,16 +137,15 @@ void DeleteSelectionCommand::initializeStartEnd(Position& start, Position& end)
             
         if (VisiblePosition(start) != m_selectionToDelete.visibleStart() || VisiblePosition(end) != m_selectionToDelete.visibleEnd())
             break;
-        
-        // If we're going to expand to include the startSpecialContainer, it must be fully selected.
 
-        if (startSpecialContainer && !endSpecialContainer && comparePositions(positionAfterNode(startSpecialContainer), end) > -1)
+        // If we're going to expand to include the startSpecialContainer, it must be fully selected.
+        if (startSpecialContainer && !endSpecialContainer && comparePositions(positionInParentAfterNode(startSpecialContainer), end) > -1)
             break;
 
         // If we're going to expand to include the endSpecialContainer, it must be fully selected.
-        if (endSpecialContainer && !startSpecialContainer && comparePositions(start, positionBeforeNode(endSpecialContainer)) > -1)
+        if (endSpecialContainer && !startSpecialContainer && comparePositions(start, positionInParentBeforeNode(endSpecialContainer)) > -1)
             break;
-        
+
         if (startSpecialContainer && startSpecialContainer->isDescendantOf(endSpecialContainer))
             // Don't adjust the end yet, it is the end of a special element that contains the start
             // special element (which may or may not be fully selected).
@@ -259,11 +259,8 @@ static void removeEnclosingAnchorStyle(CSSMutableStyleDeclaration* style, const
     Node* enclosingAnchor = enclosingAnchorElement(position);
     if (!enclosingAnchor || !enclosingAnchor->parentNode())
         return;
-            
-    RefPtr<CSSMutableStyleDeclaration> parentStyle = Position(enclosingAnchor->parentNode(), 0).computedStyle()->deprecatedCopyInheritableProperties();
-    RefPtr<CSSMutableStyleDeclaration> anchorStyle = Position(enclosingAnchor, 0).computedStyle()->deprecatedCopyInheritableProperties();
-    parentStyle->diff(anchorStyle.get());
-    anchorStyle->diff(style);
+    
+    removeStylesAddedByNode(style, enclosingAnchor);
 }
 
 void DeleteSelectionCommand::saveTypingStyleState()
@@ -277,19 +274,17 @@ void DeleteSelectionCommand::saveTypingStyleState()
     // early return in calculateTypingStyleAfterDelete).
     if (m_upstreamStart.node() == m_downstreamEnd.node() && m_upstreamStart.node()->isTextNode())
         return;
-        
+
     // Figure out the typing style in effect before the delete is done.
-    RefPtr<CSSComputedStyleDeclaration> computedStyle = positionBeforeTabSpan(m_selectionToDelete.start()).computedStyle();
-    m_typingStyle = computedStyle->deprecatedCopyInheritableProperties();
-    
+    m_typingStyle = editingStyleAtPosition(positionBeforeTabSpan(m_selectionToDelete.start()));
+
     removeEnclosingAnchorStyle(m_typingStyle.get(), m_selectionToDelete.start());
-    
+
     // If we're deleting into a Mail blockquote, save the style at end() instead of start()
     // We'll use this later in computeTypingStyleAfterDelete if we end up outside of a Mail blockquote
-    if (nearestMailBlockquote(m_selectionToDelete.start().node())) {
-        computedStyle = m_selectionToDelete.end().computedStyle();
-        m_deleteIntoBlockquoteStyle = computedStyle->deprecatedCopyInheritableProperties();
-    } else
+    if (nearestMailBlockquote(m_selectionToDelete.start().node()))
+        m_deleteIntoBlockquoteStyle = editingStyleAtPosition(m_selectionToDelete.end());
+    else
         m_deleteIntoBlockquoteStyle = 0;
 }
 
@@ -321,7 +316,7 @@ static void updatePositionForNodeRemoval(Node* node, Position& position)
     if (node->parent() == position.node() && node->nodeIndex() < (unsigned)position.deprecatedEditingOffset())
         position = Position(position.node(), position.deprecatedEditingOffset() - 1);
     if (position.node() == node || position.node()->isDescendantOf(node))
-        position = positionBeforeNode(node);
+        position = positionInParentBeforeNode(node);
 }
 
 void DeleteSelectionCommand::removeNode(PassRefPtr<Node> node)
@@ -364,7 +359,7 @@ void DeleteSelectionCommand::removeNode(PassRefPtr<Node> node)
         // make sure empty cell has some height
         updateLayout();
         RenderObject *r = node->renderer();
-        if (r && r->isTableCell() && static_cast<RenderTableCell*>(r)->contentHeight() <= 0)
+        if (r && r->isTableCell() && toRenderTableCell(r)->contentHeight() <= 0)
             insertBlockPlaceholder(Position(node, 0));
         return;
     }
@@ -668,9 +663,8 @@ void DeleteSelectionCommand::calculateTypingStyleAfterDelete()
     if (m_deleteIntoBlockquoteStyle && !nearestMailBlockquote(m_endingPosition.node()))
         m_typingStyle = m_deleteIntoBlockquoteStyle;
     m_deleteIntoBlockquoteStyle = 0;
-    
-    RefPtr<CSSComputedStyleDeclaration> endingStyle = computedStyle(m_endingPosition.node());
-    endingStyle->diff(m_typingStyle.get());
+
+    prepareEditingStyleToApplyAt(m_typingStyle.get(), m_endingPosition);
     if (!m_typingStyle->length())
         m_typingStyle = 0;
     VisiblePosition visibleEnd(m_endingPosition);
diff --git a/src/3rdparty/webkit/WebCore/editing/EditCommand.cpp b/src/3rdparty/webkit/WebCore/editing/EditCommand.cpp
index d826231..2301c54 100644
--- a/src/3rdparty/webkit/WebCore/editing/EditCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/EditCommand.cpp
@@ -195,18 +195,6 @@ bool EditCommand::isTypingCommand() const
     return false;
 }
 
-PassRefPtr<CSSMutableStyleDeclaration> EditCommand::styleAtPosition(const Position &pos)
-{
-    RefPtr<CSSMutableStyleDeclaration> style = positionBeforeTabSpan(pos).computedStyle()->deprecatedCopyInheritableProperties();
- 
-    // FIXME: It seems misleading to also include the typing style when returning the style at some arbitrary
-    // position in the document.
-    CSSMutableStyleDeclaration* typingStyle = document()->frame()->typingStyle();
-    if (typingStyle)
-        style->merge(typingStyle);
-
-    return style.release();
-}
 
 void EditCommand::updateLayout() const
 {
diff --git a/src/3rdparty/webkit/WebCore/editing/EditCommand.h b/src/3rdparty/webkit/WebCore/editing/EditCommand.h
index c4969f6..7dc4d92 100644
--- a/src/3rdparty/webkit/WebCore/editing/EditCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/EditCommand.h
@@ -66,7 +66,6 @@ protected:
     void setStartingSelection(const VisibleSelection&);
     void setEndingSelection(const VisibleSelection&);
 
-    PassRefPtr<CSSMutableStyleDeclaration> styleAtPosition(const Position&);
     void updateLayout() const;
 
 private:
diff --git a/src/3rdparty/webkit/WebCore/editing/Editor.cpp b/src/3rdparty/webkit/WebCore/editing/Editor.cpp
index 0b150d3..3f3f736 100644
--- a/src/3rdparty/webkit/WebCore/editing/Editor.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/Editor.cpp
@@ -393,7 +393,7 @@ void Editor::respondToChangedContents(const VisibleSelection& endingSelection)
     if (AXObjectCache::accessibilityEnabled()) {
         Node* node = endingSelection.start().node();
         if (node)
-            m_frame->document()->axObjectCache()->postNotification(node->renderer(), "AXValueChanged", false);
+            m_frame->document()->axObjectCache()->postNotification(node->renderer(), AXObjectCache::AXValueChanged, false);
     }
     
     if (client())
@@ -771,66 +771,54 @@ bool Editor::clientIsEditable() const
     return client() && client()->isEditable();
 }
 
+// CSS properties that only has a visual difference when applied to text.
+static const int textOnlyProperties[] = {
+    CSSPropertyTextDecoration,
+    CSSPropertyWebkitTextDecorationsInEffect,
+    CSSPropertyFontStyle,
+    CSSPropertyFontWeight,
+    CSSPropertyColor,
+};
+
+static TriState triStateOfStyleInComputedStyle(CSSStyleDeclaration* desiredStyle, CSSComputedStyleDeclaration* computedStyle, bool ignoreTextOnlyProperties = false)
+{
+    RefPtr<CSSMutableStyleDeclaration> diff = getPropertiesNotInComputedStyle(desiredStyle, computedStyle);
+
+    if (ignoreTextOnlyProperties)
+        diff->removePropertiesInSet(textOnlyProperties, sizeof(textOnlyProperties)/sizeof(textOnlyProperties[0]));
+
+    if (!diff->length())
+        return TrueTriState;
+    else if (diff->length() == desiredStyle->length())
+        return FalseTriState;
+    return MixedTriState;
+}
+
 bool Editor::selectionStartHasStyle(CSSStyleDeclaration* style) const
 {
     Node* nodeToRemove;
     RefPtr<CSSComputedStyleDeclaration> selectionStyle = m_frame->selectionComputedStyle(nodeToRemove);
     if (!selectionStyle)
         return false;
-    
-    RefPtr<CSSMutableStyleDeclaration> mutableStyle = style->makeMutable();
-    
-    bool match = true;
-    CSSMutableStyleDeclaration::const_iterator end = mutableStyle->end();
-    for (CSSMutableStyleDeclaration::const_iterator it = mutableStyle->begin(); it != end; ++it) {
-        int propertyID = (*it).id();
-        if (!equalIgnoringCase(mutableStyle->getPropertyValue(propertyID), selectionStyle->getPropertyValue(propertyID))) {
-            match = false;
-            break;
-        }
-    }
-    
+    TriState state = triStateOfStyleInComputedStyle(style, selectionStyle.get());
     if (nodeToRemove) {
         ExceptionCode ec = 0;
         nodeToRemove->remove(ec);
         ASSERT(ec == 0);
     }
-    
-    return match;
-}
-
-static void updateState(CSSMutableStyleDeclaration* desiredStyle, CSSComputedStyleDeclaration* computedStyle, bool& atStart, TriState& state)
-{
-    CSSMutableStyleDeclaration::const_iterator end = desiredStyle->end();
-    for (CSSMutableStyleDeclaration::const_iterator it = desiredStyle->begin(); it != end; ++it) {
-        int propertyID = (*it).id();
-        String desiredProperty = desiredStyle->getPropertyValue(propertyID);
-        String computedProperty = computedStyle->getPropertyValue(propertyID);
-        TriState propertyState = equalIgnoringCase(desiredProperty, computedProperty)
-            ? TrueTriState : FalseTriState;
-        if (atStart) {
-            state = propertyState;
-            atStart = false;
-        } else if (state != propertyState) {
-            state = MixedTriState;
-            break;
-        }
-    }
+    return state == TrueTriState;
 }
 
 TriState Editor::selectionHasStyle(CSSStyleDeclaration* style) const
 {
-    bool atStart = true;
     TriState state = FalseTriState;
 
-    RefPtr<CSSMutableStyleDeclaration> mutableStyle = style->makeMutable();
-
     if (!m_frame->selection()->isRange()) {
         Node* nodeToRemove;
         RefPtr<CSSComputedStyleDeclaration> selectionStyle = m_frame->selectionComputedStyle(nodeToRemove);
         if (!selectionStyle)
             return FalseTriState;
-        updateState(mutableStyle.get(), selectionStyle.get(), atStart, state);
+        state = triStateOfStyleInComputedStyle(style, selectionStyle.get());
         if (nodeToRemove) {
             ExceptionCode ec = 0;
             nodeToRemove->remove(ec);
@@ -839,10 +827,15 @@ TriState Editor::selectionHasStyle(CSSStyleDeclaration* style) const
     } else {
         for (Node* node = m_frame->selection()->start().node(); node; node = node->traverseNextNode()) {
             RefPtr<CSSComputedStyleDeclaration> nodeStyle = computedStyle(node);
-            if (nodeStyle)
-                updateState(mutableStyle.get(), nodeStyle.get(), atStart, state);
-            if (state == MixedTriState)
-                break;
+            if (nodeStyle) {
+                TriState nodeState = triStateOfStyleInComputedStyle(style, nodeStyle.get(), !node->isTextNode());
+                if (node == m_frame->selection()->start().node())
+                    state = nodeState;
+                else if (state != nodeState) {
+                    state = MixedTriState;
+                    break;
+                }
+            }
             if (node == m_frame->selection()->end().node())
                 break;
         }
diff --git a/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp b/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
index e4d94c2..196a4da 100644
--- a/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
@@ -40,6 +40,7 @@
 #include "FormatBlockCommand.h"
 #include "Frame.h"
 #include "HTMLFontElement.h"
+#include "HTMLHRElement.h"
 #include "HTMLImageElement.h"
 #include "IndentOutdentCommand.h"
 #include "InsertListCommand.h"
@@ -120,6 +121,9 @@ static bool executeApplyStyle(Frame* frame, EditorCommandSource source, EditActi
     return applyCommandToFrame(frame, source, action, style.get());
 }
 
+// FIXME: executeToggleStyleInList does not handle complicated cases such as <b><u>hello</u>world</b> properly.
+//        This function must use Editor::selectionHasStyle to determine the current style but we cannot fix this
+//        until https://bugs.webkit.org/show_bug.cgi?id=27818 is resolved.
 static bool executeToggleStyleInList(Frame* frame, EditorCommandSource source, EditAction action, int propertyID, CSSValue* value)
 {
     ExceptionCode ec = 0;
@@ -148,12 +152,23 @@ static bool executeToggleStyleInList(Frame* frame, EditorCommandSource source, E
     newMutableStyle->setProperty(propertyID, newStyle,ec);
     return applyCommandToFrame(frame, source, action, newMutableStyle.get());
 }
-    
+
 static bool executeToggleStyle(Frame* frame, EditorCommandSource source, EditAction action, int propertyID, const char* offValue, const char* onValue)
 {
     RefPtr<CSSMutableStyleDeclaration> style = CSSMutableStyleDeclaration::create();
-    style->setProperty(propertyID, onValue);
-    style->setProperty(propertyID, frame->editor()->selectionStartHasStyle(style.get()) ? offValue : onValue);
+    style->setProperty(propertyID, onValue); // We need to add this style to pass it to selectionStartHasStyle / selectionHasStyle
+
+    // Style is considered present when
+    // mac: present at the beginning of selection
+    // other: present throughout the selection
+    Settings* settings = frame->document()->settings();
+    bool styleIsPresent;
+    if (settings && settings->editingBehavior() == EditingMacBehavior)
+        styleIsPresent = frame->editor()->selectionStartHasStyle(style.get());
+    else
+        styleIsPresent = frame->editor()->selectionHasStyle(style.get()) == TrueTriState;
+
+    style->setProperty(propertyID, styleIsPresent ? offValue : onValue);
     return applyCommandToFrame(frame, source, action, style.get());
 }
 
@@ -184,7 +199,7 @@ static bool executeInsertFragment(Frame* frame, PassRefPtr<DocumentFragment> fra
 
 static bool executeInsertNode(Frame* frame, PassRefPtr<Node> content)
 {
-    RefPtr<DocumentFragment> fragment = new DocumentFragment(frame->document());
+    RefPtr<DocumentFragment> fragment = DocumentFragment::create(frame->document());
     ExceptionCode ec = 0;
     fragment->appendChild(content, ec);
     if (ec)
@@ -453,9 +468,9 @@ static bool executeInsertBacktab(Frame* frame, Event* event, EditorCommandSource
 
 static bool executeInsertHorizontalRule(Frame* frame, Event*, EditorCommandSource, const String& value)
 {
-    RefPtr<HTMLElement> hr = new HTMLElement(hrTag, frame->document());
+    RefPtr<HTMLHRElement> hr = new HTMLHRElement(hrTag, frame->document());
     if (!value.isEmpty())
-        hr->setId(value);
+        hr->setAttribute(idAttr, value);
     return executeInsertNode(frame, hr.release());
 }
 
@@ -1179,7 +1194,7 @@ static TriState stateOrderedList(Frame* frame, Event*)
 
 static TriState stateStrikethrough(Frame* frame, Event*)
 {
-    return stateStyle(frame, CSSPropertyTextDecoration, "line-through");
+    return stateStyle(frame, CSSPropertyWebkitTextDecorationsInEffect, "line-through");
 }
 
 static TriState stateStyleWithCSS(Frame* frame, Event*)
@@ -1214,7 +1229,7 @@ static TriState stateTextWritingDirectionRightToLeft(Frame* frame, Event*)
 
 static TriState stateUnderline(Frame* frame, Event*)
 {
-    return stateStyle(frame, CSSPropertyTextDecoration, "underline");
+    return stateStyle(frame, CSSPropertyWebkitTextDecorationsInEffect, "underline");
 }
 
 static TriState stateUnorderedList(Frame* frame, Event*)
diff --git a/src/3rdparty/webkit/WebCore/editing/EditorInsertAction.h b/src/3rdparty/webkit/WebCore/editing/EditorInsertAction.h
index b8b137d..5b732dc 100644
--- a/src/3rdparty/webkit/WebCore/editing/EditorInsertAction.h
+++ b/src/3rdparty/webkit/WebCore/editing/EditorInsertAction.h
@@ -32,7 +32,7 @@ namespace WebCore {
 enum EditorInsertAction {
     EditorInsertActionTyped,
     EditorInsertActionPasted,
-    EditorInsertActionDropped
+    EditorInsertActionDropped,
 };
 
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
index 42dd515..308ba74 100644
--- a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
@@ -121,12 +121,6 @@ void IndentOutdentCommand::indentIntoBlockquote(const VisiblePosition& startOfCu
         targetBlockquote = 0;
 }
 
-bool IndentOutdentCommand::isAtUnsplittableElement(const Position& pos) const
-{
-    Node* node = pos.node();
-    return node == editableRootForPosition(pos) || node == enclosingNodeOfType(pos, &isTableCell);
-}
-
 // Enclose all nodes between start and end by newParent, which is a sibling node of nodes between start and end
 // FIXME: moveParagraph is overly complicated.  We need to clean up moveParagraph so that it uses appendParagraphIntoNode
 // or prepare more specialized functions and delete moveParagraph
@@ -173,7 +167,7 @@ void IndentOutdentCommand::removeUnnecessaryLineBreakAt(const Position& endOfPar
     Node* parentNode = br->parentNode();
 
     // If the node isn't br or the parent node is empty, then don't remove.
-    if (!br->hasTagName(brTag) || isVisiblyAdjacent(positionBeforeNode(parentNode), positionAfterNode(parentNode)))
+    if (!br->hasTagName(brTag) || isVisiblyAdjacent(positionInParentBeforeNode(parentNode), positionInParentAfterNode(parentNode)))
         return;
 
     removeNodeAndPruneAncestors(br);
@@ -211,7 +205,7 @@ void IndentOutdentCommand::indentRegion()
             blockquoteForNextIndent = 0;
         else {
             VisiblePosition startOfCurrentParagraph = startOfParagraph(endOfCurrentParagraph);
-            Node* blockNode = enclosingBlock(endOfCurrentParagraph.deepEquivalent().node());
+            Node* blockNode = enclosingBlock(endOfCurrentParagraph.deepEquivalent().node()->parentNode());
             // extend the region so that it contains all the ancestor blocks within the selection
             ExceptionCode ec;
             Element* unsplittableNode = unsplittableElementForPosition(endOfCurrentParagraph.deepEquivalent());
@@ -244,7 +238,7 @@ void IndentOutdentCommand::outdentParagraph()
     VisiblePosition visibleEndOfParagraph = endOfParagraph(visibleStartOfParagraph);
 
     Node* enclosingNode = enclosingNodeOfType(visibleStartOfParagraph.deepEquivalent(), &isListOrIndentBlockquote);
-    if (!enclosingNode || !isContentEditable(enclosingNode->parentNode()))  // We can't outdent if there is no place to go!
+    if (!enclosingNode || !enclosingNode->parentNode()->isContentEditable())  // We can't outdent if there is no place to go!
         return;
 
     // Use InsertListCommand to remove the selection from the list
@@ -273,7 +267,7 @@ void IndentOutdentCommand::outdentParagraph()
             if (Node* splitPointParent = splitPoint->parentNode()) {
                 if (splitPointParent->hasTagName(blockquoteTag)
                     && !splitPoint->hasTagName(blockquoteTag)
-                    && isContentEditable(splitPointParent->parentNode())) // We can't outdent if there is no place to go!
+                    && splitPointParent->parentNode()->isContentEditable()) // We can't outdent if there is no place to go!
                     splitElement(static_cast<Element*>(splitPointParent), splitPoint);
             }
         }
diff --git a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
index 104a0e7..d83128e 100644
--- a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
@@ -46,8 +46,6 @@ private:
     virtual void doApply();
     virtual EditAction editingAction() const { return m_typeOfAction == Indent ? EditActionIndent : EditActionOutdent; }
 
-    // FIXME: Does this belong in htmlediting.cpp?
-    bool isAtUnsplittableElement(const Position&) const;
     void appendParagraphIntoNode(const VisiblePosition& start, const VisiblePosition& end, Node* newParent);
     void removeUnnecessaryLineBreakAt(const Position& endOfParagraph);
 
diff --git a/src/3rdparty/webkit/WebCore/editing/InsertLineBreakCommand.cpp b/src/3rdparty/webkit/WebCore/editing/InsertLineBreakCommand.cpp
index f020459..caaae0a 100644
--- a/src/3rdparty/webkit/WebCore/editing/InsertLineBreakCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/InsertLineBreakCommand.cpp
@@ -125,12 +125,12 @@ void InsertLineBreakCommand::doApply()
         if (!isStartOfParagraph(VisiblePosition(Position(nodeToInsert.get(), 0))))
             insertNodeBefore(nodeToInsert->cloneNode(false).get(), nodeToInsert.get());
         
-        setEndingSelection(VisibleSelection(positionAfterNode(nodeToInsert.get()), DOWNSTREAM));
+        setEndingSelection(VisibleSelection(positionInParentAfterNode(nodeToInsert.get()), DOWNSTREAM));
     // If we're inserting after all of the rendered text in a text node, or into a non-text node,
     // a simple insertion is sufficient.
     } else if (pos.deprecatedEditingOffset() >= caretMaxOffset(pos.node()) || !pos.node()->isTextNode()) {
         insertNodeAt(nodeToInsert.get(), pos);
-        setEndingSelection(VisibleSelection(positionAfterNode(nodeToInsert.get()), DOWNSTREAM));
+        setEndingSelection(VisibleSelection(positionInParentAfterNode(nodeToInsert.get()), DOWNSTREAM));
     } else {
         // Split a text node
         ASSERT(pos.node()->isTextNode());
@@ -144,7 +144,7 @@ void InsertLineBreakCommand::doApply()
         // Handle whitespace that occurs after the split
         updateLayout();
         if (!endingPosition.isRenderedCharacter()) {
-            Position positionBeforeTextNode(positionBeforeNode(textNode));
+            Position positionBeforeTextNode(positionInParentBeforeNode(textNode));
             // Clear out all whitespace and insert one non-breaking space
             deleteInsignificantTextDownstream(endingPosition);
             ASSERT(!textNode->renderer() || textNode->renderer()->style()->collapseWhiteSpace());
diff --git a/src/3rdparty/webkit/WebCore/editing/InsertListCommand.cpp b/src/3rdparty/webkit/WebCore/editing/InsertListCommand.cpp
index ec707d2..beb5d08 100644
--- a/src/3rdparty/webkit/WebCore/editing/InsertListCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/InsertListCommand.cpp
@@ -251,7 +251,7 @@ void InsertListCommand::doApply()
             // Also avoid the containing list item.
             Node* listChild = enclosingListChild(insertionPos.node());
             if (listChild && listChild->hasTagName(liTag))
-                insertionPos = positionBeforeNode(listChild);
+                insertionPos = positionInParentBeforeNode(listChild);
 
             insertNodeAt(listElement, insertionPos);
 
diff --git a/src/3rdparty/webkit/WebCore/editing/InsertNodeBeforeCommand.cpp b/src/3rdparty/webkit/WebCore/editing/InsertNodeBeforeCommand.cpp
index c3acd9d..4f60963 100644
--- a/src/3rdparty/webkit/WebCore/editing/InsertNodeBeforeCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/InsertNodeBeforeCommand.cpp
@@ -40,7 +40,7 @@ InsertNodeBeforeCommand::InsertNodeBeforeCommand(PassRefPtr<Node> insertChild, P
     ASSERT(m_refChild);
     ASSERT(m_refChild->parentNode());
 
-    ASSERT(enclosingNodeOfType(Position(m_refChild->parentNode(), 0), isContentEditable) || !m_refChild->parentNode()->attached());
+    ASSERT(m_refChild->parentNode()->isContentEditable() || !m_refChild->parentNode()->attached());
 }
 
 void InsertNodeBeforeCommand::doApply()
diff --git a/src/3rdparty/webkit/WebCore/editing/InsertParagraphSeparatorCommand.cpp b/src/3rdparty/webkit/WebCore/editing/InsertParagraphSeparatorCommand.cpp
index 7d6e5c4..9823aba 100644
--- a/src/3rdparty/webkit/WebCore/editing/InsertParagraphSeparatorCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/InsertParagraphSeparatorCommand.cpp
@@ -38,6 +38,7 @@
 #include "Text.h"
 #include "htmlediting.h"
 #include "visible_units.h"
+#include "ApplyStyleCommand.h"
 
 namespace WebCore {
 
@@ -63,7 +64,7 @@ void InsertParagraphSeparatorCommand::calculateStyleBeforeInsertion(const Positi
     if (!isStartOfParagraph(visiblePos) && !isEndOfParagraph(visiblePos))
         return;
     
-    m_style = styleAtPosition(pos);
+    m_style = editingStyleAtPosition(pos, IncludeTypingStyle);
 }
 
 void InsertParagraphSeparatorCommand::applyStyleAfterInsertion(Node* originalEnclosingBlock)
@@ -79,8 +80,9 @@ void InsertParagraphSeparatorCommand::applyStyleAfterInsertion(Node* originalEnc
         
     if (!m_style)
         return;
+    
+    prepareEditingStyleToApplyAt(m_style.get(), endingSelection().start());
 
-    computedStyle(endingSelection().start().node())->diff(m_style.get());
     if (m_style->length() > 0)
         applyStyle(m_style.get());
 }
@@ -232,7 +234,7 @@ void InsertParagraphSeparatorCommand::doApply()
     if (isStartOfParagraph(visiblePos)) {
         RefPtr<Element> br = createBreakElement(document());
         insertNodeAt(br.get(), insertionPosition);
-        insertionPosition = positionAfterNode(br.get());
+        insertionPosition = positionInParentAfterNode(br.get());
     }
     
     // Move downstream. Typing style code will take care of carrying along the 
diff --git a/src/3rdparty/webkit/WebCore/editing/InsertTextCommand.cpp b/src/3rdparty/webkit/WebCore/editing/InsertTextCommand.cpp
index 6b0af9b..f10d71b 100644
--- a/src/3rdparty/webkit/WebCore/editing/InsertTextCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/InsertTextCommand.cpp
@@ -145,7 +145,7 @@ void InsertTextCommand::input(const String& text, bool selectInsertedText)
     
     // It is possible for the node that contains startPosition to contain only unrendered whitespace,
     // and so deleteInsignificantText could remove it.  Save the position before the node in case that happens.
-    Position positionBeforeStartNode(positionBeforeNode(startPosition.node()));
+    Position positionBeforeStartNode(positionInParentBeforeNode(startPosition.node()));
     deleteInsignificantText(startPosition.upstream(), startPosition.downstream());
     if (!startPosition.node()->inDocument())
         startPosition = positionBeforeStartNode;
diff --git a/src/3rdparty/webkit/WebCore/editing/RemoveFormatCommand.cpp b/src/3rdparty/webkit/WebCore/editing/RemoveFormatCommand.cpp
index 1cf9aa2..9243adc 100644
--- a/src/3rdparty/webkit/WebCore/editing/RemoveFormatCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/RemoveFormatCommand.cpp
@@ -35,6 +35,7 @@
 #include "SelectionController.h"
 #include "TextIterator.h"
 #include "TypingCommand.h"
+#include "ApplyStyleCommand.h"
 
 namespace WebCore {
 
@@ -55,8 +56,8 @@ void RemoveFormatCommand::doApply()
     // Get the default style for this editable root, it's the style that we'll give the
     // content that we're operating on.
     Node* root = frame->selection()->rootEditableElement();
-    RefPtr<CSSMutableStyleDeclaration> defaultStyle = computedStyle(root)->deprecatedCopyInheritableProperties();
-    
+    RefPtr<CSSMutableStyleDeclaration> defaultStyle = editingStyleAtPosition(Position(root, 0));
+
     // Delete the selected content.
     // FIXME: We should be able to leave this to insertText, but its delete operation
     // doesn't preserve the style we're about to set.
diff --git a/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.cpp b/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.cpp
index e0f62cf..a3a43b3 100644
--- a/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.cpp
@@ -528,7 +528,7 @@ VisiblePosition ReplaceSelectionCommand::positionAtEndOfInsertedContent()
 VisiblePosition ReplaceSelectionCommand::positionAtStartOfInsertedContent()
 {
     // Return the inserted content's first VisiblePosition.
-    return VisiblePosition(nextCandidate(positionBeforeNode(m_firstNodeInserted.get())));
+    return VisiblePosition(nextCandidate(positionInParentBeforeNode(m_firstNodeInserted.get())));
 }
 
 // Remove style spans before insertion if they are unnecessary.  It's faster because we'll 
@@ -549,8 +549,9 @@ static bool handleStyleSpansBeforeInsertion(ReplacementFragment& fragment, const
     
     Node* sourceDocumentStyleSpan = topNode;
     RefPtr<Node> copiedRangeStyleSpan = sourceDocumentStyleSpan->firstChild();
-    
-    RefPtr<CSSMutableStyleDeclaration> styleAtInsertionPos = rangeCompliantEquivalent(insertionPos).computedStyle()->deprecatedCopyInheritableProperties();
+
+    RefPtr<CSSMutableStyleDeclaration> styleAtInsertionPos = editingStyleAtPosition(rangeCompliantEquivalent(insertionPos));
+
     String styleText = styleAtInsertionPos->cssText();
     
     if (styleText == static_cast<Element*>(sourceDocumentStyleSpan)->getAttribute(styleAttr)) {
@@ -606,8 +607,8 @@ void ReplaceSelectionCommand::handleStyleSpans()
     // styles from blockquoteNode are allowed to override those from the source document, see <rdar://problem/4930986> and <rdar://problem/5089327>.
     Node* blockquoteNode = isMailPasteAsQuotationNode(context) ? context : nearestMailBlockquote(context);
     if (blockquoteNode) {
-        RefPtr<CSSMutableStyleDeclaration> blockquoteStyle = computedStyle(blockquoteNode)->deprecatedCopyInheritableProperties();
-        RefPtr<CSSMutableStyleDeclaration> parentStyle = computedStyle(blockquoteNode->parentNode())->deprecatedCopyInheritableProperties();
+        RefPtr<CSSMutableStyleDeclaration> blockquoteStyle = editingStyleAtPosition(Position(blockquoteNode, 0));
+        RefPtr<CSSMutableStyleDeclaration> parentStyle = editingStyleAtPosition(Position(blockquoteNode->parentNode(), 0));
         parentStyle->diff(blockquoteStyle.get());
 
         CSSMutableStyleDeclaration::const_iterator end = blockquoteStyle->end();
@@ -618,10 +619,10 @@ void ReplaceSelectionCommand::handleStyleSpans()
 
         context = blockquoteNode->parentNode();
     }
-    
-    RefPtr<CSSMutableStyleDeclaration> contextStyle = computedStyle(context)->deprecatedCopyInheritableProperties();
-    contextStyle->diff(sourceDocumentStyle.get());
-    
+
+    // This operation requires that only editing styles to be removed from sourceDocumentStyle.
+    prepareEditingStyleToApplyAt(sourceDocumentStyle.get(), Position(context, 0));
+
     // Remove block properties in the span's style. This prevents properties that probably have no effect 
     // currently from affecting blocks later if the style is cloned for a new block element during a future 
     // editing operation.
@@ -655,9 +656,8 @@ void ReplaceSelectionCommand::handleStyleSpans()
     
     // Remove redundant styles.
     context = copiedRangeStyleSpan->parentNode();
-    contextStyle = computedStyle(context)->deprecatedCopyInheritableProperties();
-    contextStyle->diff(copiedRangeStyle.get());
-    
+    prepareEditingStyleToApplyAt(copiedRangeStyle.get(), Position(context, 0));
+
     // See the comments above about removing block properties.
     copiedRangeStyle->removeBlockProperties();
 
@@ -725,7 +725,7 @@ void ReplaceSelectionCommand::doApply()
         return;
     
     if (m_matchStyle)
-        m_insertionStyle = styleAtPosition(selection.start());
+        m_insertionStyle = editingStyleAtPosition(selection.start(), IncludeTypingStyle);
     
     VisiblePosition visibleStart = selection.visibleStart();
     VisiblePosition visibleEnd = selection.visibleEnd();
@@ -794,7 +794,7 @@ void ReplaceSelectionCommand::doApply()
         Node* br = endingSelection().start().node(); 
         ASSERT(br->hasTagName(brTag)); 
         // Insert content between the two blockquotes, but remove the br (since it was just a placeholder). 
-        insertionPos = positionBeforeNode(br); 
+        insertionPos = positionInParentBeforeNode(br);
         removeNode(br);
     }
     
@@ -817,9 +817,9 @@ void ReplaceSelectionCommand::doApply()
         ASSERT(startBlock != currentRoot);
         VisiblePosition visibleInsertionPos(insertionPos);
         if (isEndOfBlock(visibleInsertionPos) && !(isStartOfBlock(visibleInsertionPos) && fragment.hasInterchangeNewlineAtEnd()))
-            insertionPos = positionAfterNode(startBlock);
+            insertionPos = positionInParentAfterNode(startBlock);
         else if (isStartOfBlock(visibleInsertionPos))
-            insertionPos = positionBeforeNode(startBlock);
+            insertionPos = positionInParentBeforeNode(startBlock);
     }
 
     // Paste into run of tabs splits the tab span.
diff --git a/src/3rdparty/webkit/WebCore/editing/SelectionController.cpp b/src/3rdparty/webkit/WebCore/editing/SelectionController.cpp
index b6874d6..7d99916 100644
--- a/src/3rdparty/webkit/WebCore/editing/SelectionController.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/SelectionController.cpp
@@ -90,7 +90,8 @@ void SelectionController::moveTo(const Position &pos, EAffinity affinity, bool u
 
 void SelectionController::moveTo(const Range *r, EAffinity affinity, bool userTriggered)
 {
-    setSelection(VisibleSelection(startPosition(r), endPosition(r), affinity), true, true, userTriggered);
+    VisibleSelection selection = r ? VisibleSelection(r->startPosition(), r->endPosition(), affinity) : VisibleSelection(Position(), Position(), affinity);
+    setSelection(selection, true, true, userTriggered);
 }
 
 void SelectionController::moveTo(const Position &base, const Position &extent, EAffinity affinity, bool userTriggered)
diff --git a/src/3rdparty/webkit/WebCore/editing/SplitTextNodeCommand.cpp b/src/3rdparty/webkit/WebCore/editing/SplitTextNodeCommand.cpp
index 07a54e3..3b04e01 100644
--- a/src/3rdparty/webkit/WebCore/editing/SplitTextNodeCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/SplitTextNodeCommand.cpp
@@ -55,7 +55,7 @@ void SplitTextNodeCommand::doApply()
     if (prefixText.isEmpty())
         return;
 
-    RefPtr<Text> prefixTextNode = new Text(document(), prefixText);
+    RefPtr<Text> prefixTextNode = Text::create(document(), prefixText);
     ASSERT(prefixTextNode);
     document()->copyMarkers(m_text2.get(), 0, m_offset, prefixTextNode.get(), 0);
 
diff --git a/src/3rdparty/webkit/WebCore/editing/TextIterator.cpp b/src/3rdparty/webkit/WebCore/editing/TextIterator.cpp
index f82a972..d36849c 100644
--- a/src/3rdparty/webkit/WebCore/editing/TextIterator.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/TextIterator.cpp
@@ -33,7 +33,6 @@
 #include "HTMLNames.h"
 #include "htmlediting.h"
 #include "InlineTextBox.h"
-#include "Position.h"
 #include "Range.h"
 #include "RenderTableCell.h"
 #include "RenderTableRow.h"
@@ -599,7 +598,7 @@ static bool shouldEmitTabBeforeNode(Node* node)
         return false;
     
     // Want a tab before every cell other than the first one
-    RenderTableCell* rc = static_cast<RenderTableCell*>(r);
+    RenderTableCell* rc = toRenderTableCell(r);
     RenderTable* t = rc->table();
     return t && (t->cellBefore(rc) || t->cellAbove(rc));
 }
@@ -649,7 +648,7 @@ static bool shouldEmitNewlinesBeforeAndAfterNode(Node* node)
     // Need to make an exception for table row elements, because they are neither
     // "inline" or "RenderBlock", but we want newlines for them.
     if (r->isTableRow()) {
-        RenderTable* t = static_cast<RenderTableRow*>(r)->table();
+        RenderTable* t = toRenderTableRow(r)->table();
         if (t && !t->isInline())
             return true;
     }
@@ -941,7 +940,7 @@ SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator(const Range* r)
     if (!endNode->offsetInCharacters()) {
         if (endOffset > 0 && endOffset <= static_cast<int>(endNode->childNodeCount())) {
             endNode = endNode->childNode(endOffset - 1);
-            endOffset = endNode->offsetInCharacters() ? endNode->maxCharacterOffset() : endNode->childNodeCount();
+            endOffset = lastOffsetInNode(endNode);
         }
     }
 
diff --git a/src/3rdparty/webkit/WebCore/editing/UnlinkCommand.cpp b/src/3rdparty/webkit/WebCore/editing/UnlinkCommand.cpp
index 0ba9a06..7234a3b 100644
--- a/src/3rdparty/webkit/WebCore/editing/UnlinkCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/UnlinkCommand.cpp
@@ -37,14 +37,13 @@ UnlinkCommand::UnlinkCommand(Document* document)
 
 void UnlinkCommand::doApply()
 {
-    // FIXME: If a caret is inside a link, remove it.
+    // FIXME: If a caret is inside a link, we should remove it, but currently we don't.
     if (!endingSelection().isRange())
         return;
         
     pushPartiallySelectedAnchorElementsDown();
 
-    HTMLAnchorElement* anchorElement = new HTMLAnchorElement(document());
-    removeStyledElement(anchorElement);
+    removeStyledElement(HTMLAnchorElement::create(document()));
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/editing/VisibleSelection.cpp b/src/3rdparty/webkit/WebCore/editing/VisibleSelection.cpp
index 56ad6b3..8adfd71 100644
--- a/src/3rdparty/webkit/WebCore/editing/VisibleSelection.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/VisibleSelection.cpp
@@ -511,7 +511,7 @@ void VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries()
             while (p.isNotNull() && !(lowestEditableAncestor(p.node()) == baseEditableAncestor && !isEditablePosition(p))) {
                 Node* root = editableRootForPosition(p);
                 shadowAncestor = root ? root->shadowAncestorNode() : 0;
-                p = isAtomicNode(p.node()) ? positionBeforeNode(p.node()) : previousVisuallyDistinctCandidate(p);
+                p = isAtomicNode(p.node()) ? positionInParentBeforeNode(p.node()) : previousVisuallyDistinctCandidate(p);
                 if (p.isNull() && (shadowAncestor != root))
                     p = lastDeepEditingPositionForNode(shadowAncestor);
             }
@@ -540,7 +540,7 @@ void VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries()
             while (p.isNotNull() && !(lowestEditableAncestor(p.node()) == baseEditableAncestor && !isEditablePosition(p))) {
                 Node* root = editableRootForPosition(p);
                 shadowAncestor = root ? root->shadowAncestorNode() : 0;
-                p = isAtomicNode(p.node()) ? positionAfterNode(p.node()) : nextVisuallyDistinctCandidate(p);
+                p = isAtomicNode(p.node()) ? positionInParentAfterNode(p.node()) : nextVisuallyDistinctCandidate(p);
                 if (p.isNull() && (shadowAncestor != root))
                     p = Position(shadowAncestor, 0);
             }
diff --git a/src/3rdparty/webkit/WebCore/editing/htmlediting.cpp b/src/3rdparty/webkit/WebCore/editing/htmlediting.cpp
index a04d2b7..d19ef6b 100644
--- a/src/3rdparty/webkit/WebCore/editing/htmlediting.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/htmlediting.cpp
@@ -183,6 +183,13 @@ bool isEditablePosition(const Position& p)
     return node->isContentEditable();
 }
 
+bool isAtUnsplittableElement(const Position& pos)
+{
+    Node* node = pos.node();
+    return (node == editableRootForPosition(pos) || node == enclosingNodeOfType(pos, &isTableCell));
+}
+    
+    
 bool isRichlyEditablePosition(const Position& p)
 {
     Node* node = p.node();
@@ -221,11 +228,6 @@ Element* unsplittableElementForPosition(const Position& p)
     return editableRootForPosition(p);
 }
 
-bool isContentEditable(const Node* node)
-{
-    return node->isContentEditable();
-}
-
 Position nextCandidate(const Position& position)
 {
     PositionIterator p = position;
@@ -285,7 +287,7 @@ VisiblePosition firstEditablePositionAfterPositionInRoot(const Position& positio
             p = lastDeepEditingPositionForNode(shadowAncestor);
     
     while (p.node() && !isEditablePosition(p) && p.node()->isDescendantOf(highestRoot))
-        p = isAtomicNode(p.node()) ? positionAfterNode(p.node()) : nextVisuallyDistinctCandidate(p);
+        p = isAtomicNode(p.node()) ? positionInParentAfterNode(p.node()) : nextVisuallyDistinctCandidate(p);
     
     if (p.node() && !p.node()->isDescendantOf(highestRoot))
         return VisiblePosition();
@@ -306,7 +308,7 @@ VisiblePosition lastEditablePositionBeforePositionInRoot(const Position& positio
             p = firstDeepEditingPositionForNode(shadowAncestor);
     
     while (p.node() && !isEditablePosition(p) && p.node()->isDescendantOf(highestRoot))
-        p = isAtomicNode(p.node()) ? positionBeforeNode(p.node()) : previousVisuallyDistinctCandidate(p);
+        p = isAtomicNode(p.node()) ? positionInParentBeforeNode(p.node()) : previousVisuallyDistinctCandidate(p);
     
     if (p.node() && !p.node()->isDescendantOf(highestRoot))
         return VisiblePosition();
@@ -344,7 +346,7 @@ Position rangeCompliantEquivalent(const Position& pos)
 
     if (pos.deprecatedEditingOffset() <= 0) {
         if (node->parentNode() && (editingIgnoresContent(node) || isTableElement(node)))
-            return positionBeforeNode(node);
+            return positionInParentBeforeNode(node);
         return Position(node, 0);
     }
 
@@ -354,7 +356,7 @@ Position rangeCompliantEquivalent(const Position& pos)
     int maxCompliantOffset = node->childNodeCount();
     if (pos.deprecatedEditingOffset() > maxCompliantOffset) {
         if (node->parentNode())
-            return positionAfterNode(node);
+            return positionInParentAfterNode(node);
 
         // there is no other option at this point than to
         // use the highest allowed position in the node
@@ -364,11 +366,11 @@ Position rangeCompliantEquivalent(const Position& pos)
     // Editing should never generate positions like this.
     if ((pos.deprecatedEditingOffset() < maxCompliantOffset) && editingIgnoresContent(node)) {
         ASSERT_NOT_REACHED();
-        return node->parentNode() ? positionBeforeNode(node) : Position(node, 0);
+        return node->parentNode() ? positionInParentBeforeNode(node) : Position(node, 0);
     }
     
     if (pos.deprecatedEditingOffset() == maxCompliantOffset && (editingIgnoresContent(node) || isTableElement(node)))
-        return positionAfterNode(node);
+        return positionInParentAfterNode(node);
     
     return Position(pos);
 }
@@ -389,10 +391,10 @@ int lastOffsetForEditing(const Node* node)
         return 0;
     if (node->offsetInCharacters())
         return node->maxCharacterOffset();
-        
+
     if (node->hasChildNodes())
         return node->childNodeCount();
-    
+
     // NOTE: This should preempt the childNodeCount for, e.g., select nodes
     if (editingIgnoresContent(node))
         return 1;
@@ -464,24 +466,30 @@ bool isSpecialElement(const Node *n)
 }
 
 // Checks if a string is a valid tag for the FormatBlockCommand function of execCommand. Expects lower case strings.
-bool validBlockTag(const String& blockTag)
-{
-    if (blockTag == "address" ||
-        blockTag == "blockquote" ||
-        blockTag == "dd" ||
-        blockTag == "div" ||
-        blockTag == "dl" ||
-        blockTag == "dt" ||
-        blockTag == "h1" ||
-        blockTag == "h2" ||
-        blockTag == "h3" ||
-        blockTag == "h4" ||
-        blockTag == "h5" ||
-        blockTag == "h6" ||
-        blockTag == "p" ||
-        blockTag == "pre")
-        return true;
-    return false;
+bool validBlockTag(const AtomicString& blockTag)
+{
+    if (blockTag.isEmpty())
+        return false;
+
+    DEFINE_STATIC_LOCAL(HashSet<AtomicString>, blockTags, ());
+    if (blockTags.isEmpty()) {
+        blockTags.add(addressTag.localName());
+        blockTags.add(blockquoteTag.localName());
+        blockTags.add(ddTag.localName());
+        blockTags.add(divTag.localName());
+        blockTags.add(dlTag.localName());
+        blockTags.add(dtTag.localName());
+        blockTags.add(h1Tag.localName());
+        blockTags.add(h2Tag.localName());
+        blockTags.add(h3Tag.localName());
+        blockTags.add(h4Tag.localName());
+        blockTags.add(h5Tag.localName());
+        blockTags.add(h6Tag.localName());
+        blockTags.add(navTag.localName());
+        blockTags.add(pTag.localName());
+        blockTags.add(preTag.localName());
+    }
+    return blockTags.contains(blockTag);
 }
 
 static Node* firstInSpecialElement(const Position& pos)
@@ -524,7 +532,7 @@ Position positionBeforeContainingSpecialElement(const Position& pos, Node** cont
     Node* n = firstInSpecialElement(pos);
     if (!n)
         return pos;
-    Position result = positionBeforeNode(n);
+    Position result = positionInParentBeforeNode(n);
     if (result.isNull() || result.node()->rootEditableElement() != pos.node()->rootEditableElement())
         return pos;
     if (containingSpecialElement)
@@ -542,7 +550,7 @@ Position positionAfterContainingSpecialElement(const Position& pos, Node **conta
     Node* n = lastInSpecialElement(pos);
     if (!n)
         return pos;
-    Position result = positionAfterNode(n);
+    Position result = positionInParentAfterNode(n);
     if (result.isNull() || result.node()->rootEditableElement() != pos.node()->rootEditableElement())
         return pos;
     if (containingSpecialElement)
@@ -577,20 +585,6 @@ Node* isLastPositionBeforeTable(const VisiblePosition& visiblePosition)
     return 0;
 }
 
-Position positionBeforeNode(const Node* node)
-{
-    ASSERT(node);
-    // FIXME: Should ASSERT(node->parentNode()) but doing so results in editing/deleting/delete-ligature-001.html crashing
-    return Position(node->parentNode(), node->nodeIndex());
-}
-
-Position positionAfterNode(const Node* node)
-{
-    ASSERT(node);
-    // FIXME: Should ASSERT(node->parentNode()) but doing so results in editing/deleting/delete-ligature-001.html crashing
-    return Position(node->parentNode(), node->nodeIndex() + 1);
-}
-
 // Returns the visible position at the beginning of a node
 VisiblePosition visiblePositionBeforeNode(Node* node)
 {
@@ -598,7 +592,7 @@ VisiblePosition visiblePositionBeforeNode(Node* node)
     if (node->childNodeCount())
         return VisiblePosition(node, 0, DOWNSTREAM);
     ASSERT(node->parentNode());
-    return positionBeforeNode(node);
+    return positionInParentBeforeNode(node);
 }
 
 // Returns the visible position at the ending of a node
@@ -608,7 +602,7 @@ VisiblePosition visiblePositionAfterNode(Node* node)
     if (node->childNodeCount())
         return VisiblePosition(node, node->childNodeCount(), DOWNSTREAM);
     ASSERT(node->parentNode());
-    return positionAfterNode(node);
+    return positionInParentAfterNode(node);
 }
 
 // Create a range object with two visible positions, start and end.
@@ -664,7 +658,7 @@ Node* enclosingNodeWithTag(const Position& p, const QualifiedName& tagName)
         
     Node* root = highestEditableRoot(p);
     for (Node* n = p.node(); n; n = n->parentNode()) {
-        if (root && !isContentEditable(n))
+        if (root && !n->isContentEditable())
             continue;
         if (n->hasTagName(tagName))
             return n;
@@ -684,7 +678,7 @@ Node* enclosingNodeOfType(const Position& p, bool (*nodeIsOfType)(const Node*),
     for (Node* n = p.node(); n; n = n->parentNode()) {
         // Don't return a non-editable node if the input position was editable, since
         // the callers from editing will no doubt want to perform editing inside the returned node.
-        if (root && !isContentEditable(n) && onlyReturnEditableNodes)
+        if (root && !n->isContentEditable() && onlyReturnEditableNodes)
             continue;
         if ((*nodeIsOfType)(n))
             return n;
@@ -821,9 +815,9 @@ bool canMergeLists(Element* firstList, Element* secondList)
         return false;
 
     return firstList->hasTagName(secondList->tagQName())// make sure the list types match (ol vs. ul)
-    && isContentEditable(firstList) && isContentEditable(secondList)// both lists are editable
+    && firstList->isContentEditable() && secondList->isContentEditable()// both lists are editable
     && firstList->rootEditableElement() == secondList->rootEditableElement()// don't cross editing boundaries
-    && isVisiblyAdjacent(positionAfterNode(firstList), positionBeforeNode(secondList));
+    && isVisiblyAdjacent(positionInParentAfterNode(firstList), positionInParentBeforeNode(secondList));
     // Make sure there is no visible content between this li and the previous list
 }
 
@@ -913,7 +907,7 @@ Position positionBeforeTabSpan(const Position& pos)
     else if (!isTabSpanNode(node))
         return pos;
     
-    return positionBeforeNode(node);
+    return positionInParentBeforeNode(node);
 }
 
 PassRefPtr<Element> createTabSpanElement(Document* document, PassRefPtr<Node> tabTextNode)
diff --git a/src/3rdparty/webkit/WebCore/editing/htmlediting.h b/src/3rdparty/webkit/WebCore/editing/htmlediting.h
index 8f5d5ff..f44181c 100644
--- a/src/3rdparty/webkit/WebCore/editing/htmlediting.h
+++ b/src/3rdparty/webkit/WebCore/editing/htmlediting.h
@@ -29,6 +29,7 @@
 #include <wtf/Forward.h>
 #include "HTMLNames.h"
 #include "ExceptionCode.h"
+#include "Position.h"
 
 namespace WebCore {
 
@@ -42,48 +43,146 @@ class String;
 class VisiblePosition;
 class VisibleSelection;
 
-Position rangeCompliantEquivalent(const Position&);
-Position rangeCompliantEquivalent(const VisiblePosition&);
+
+// This file contains a set of helper functions used by the editing commands
+
+// -------------------------------------------------------------------------
+// Node
+// -------------------------------------------------------------------------
+
+// Functions returning Node
+
+Node* highestAncestor(Node*);
+Node* highestEditableRoot(const Position&);
+Node* highestEnclosingNodeOfType(const Position&, bool (*nodeIsOfType)(const Node*));
+Node* lowestEditableAncestor(Node*);   
+
+Node* enclosingBlock(Node*);
+Node* enclosingTableCell(const Position&);
+Node* enclosingEmptyListItem(const VisiblePosition&);
+Node* enclosingAnchorElement(const Position&);
+Node* enclosingNodeWithTag(const Position&, const QualifiedName&);
+Node* enclosingNodeOfType(const Position&, bool (*nodeIsOfType)(const Node*), bool onlyReturnEditableNodes = true);
+
+Node* tabSpanNode(const Node*);
+Node* nearestMailBlockquote(const Node*);
+Node* isLastPositionBeforeTable(const VisiblePosition&);
+Node* isFirstPositionAfterTable(const VisiblePosition&);
+
+// offset functions on Node
+
 int lastOffsetForEditing(const Node*);
-bool isAtomicNode(const Node*);
+int caretMinOffset(const Node*);
+int caretMaxOffset(const Node*);
+
+// boolean functions on Node
+
 bool editingIgnoresContent(const Node*);
 bool canHaveChildrenForEditing(const Node*);
-Node* highestEditableRoot(const Position&);
-VisiblePosition firstEditablePositionAfterPositionInRoot(const Position&, Node*);
-VisiblePosition lastEditablePositionBeforePositionInRoot(const Position&, Node*);
-int comparePositions(const Position&, const Position&);
-int comparePositions(const VisiblePosition&, const VisiblePosition&);
-Node* lowestEditableAncestor(Node*);
-bool isContentEditable(const Node*);
+bool isAtomicNode(const Node*);
+bool isBlock(const Node*);
+bool isSpecialElement(const Node*);
+bool isTabSpanNode(const Node*);
+bool isTabSpanTextNode(const Node*);
+bool isMailBlockquote(const Node*);
+bool isTableElement(Node*);
+bool isTableCell(const Node*);
+bool isTableStructureNode(const Node*);
+bool isListElement(Node*);
+bool isNodeRendered(const Node*);
+bool isNodeVisiblyContainedWithin(Node*, const Range*);
+    
+    
+// -------------------------------------------------------------------------
+// Position
+// -------------------------------------------------------------------------
+    
+// Functions returning Position
+    
+Position rangeCompliantEquivalent(const Position&);
+Position rangeCompliantEquivalent(const VisiblePosition&);
+    
 Position nextCandidate(const Position&);
-Position nextVisuallyDistinctCandidate(const Position&);
 Position previousCandidate(const Position&);
+    
+Position nextVisuallyDistinctCandidate(const Position&);
 Position previousVisuallyDistinctCandidate(const Position&);
+
+Position positionBeforeTabSpan(const Position&);
+Position positionBeforeContainingSpecialElement(const Position&, Node** containingSpecialElement=0);
+Position positionAfterContainingSpecialElement(const Position&, Node** containingSpecialElement=0);
+Position positionOutsideContainingSpecialElement(const Position&, Node** containingSpecialElement=0);
+    
+// Position creation functions are inline to prevent ref-churn.
+// Other Position creation functions are in Position.h
+// but these depend on lastOffsetForEditing which is defined in htmlediting.h.
+
+// NOTE: first/lastDeepEditingPositionForNode return legacy editing positions (like [img, 0])
+// for elements which editing ignores.  The rest of the editing code will treat [img, 0]
+// as "the last position before the img".
+// New code should use the creation functions in Position.h instead.
+inline Position firstDeepEditingPositionForNode(Node* anchorNode)
+{
+    ASSERT(anchorNode);
+    return Position(anchorNode, 0);
+}
+
+inline Position lastDeepEditingPositionForNode(Node* anchorNode)
+{
+    ASSERT(anchorNode);
+    return Position(anchorNode, lastOffsetForEditing(anchorNode));
+}
+       
+// comparision functions on Position
+    
+int comparePositions(const Position&, const Position&);
+
+// boolean functions on Position
+    
 bool isEditablePosition(const Position&);
 bool isRichlyEditablePosition(const Position&);
-Element* editableRootForPosition(const Position&);
-Element* unsplittableElementForPosition(const Position&);
-bool isBlock(const Node*);
-Node* enclosingBlock(Node*);
+bool isFirstVisiblePositionInSpecialElement(const Position&);
+bool isLastVisiblePositionInSpecialElement(const Position&);
+bool lineBreakExistsAtPosition(const Position&);
+bool isVisiblyAdjacent(const Position& first, const Position& second);
+bool isAtUnsplittableElement(const Position&);
 
-String stringWithRebalancedWhitespace(const String&, bool, bool);
-const String& nonBreakingSpaceString();
+// miscellaneous functions on Position
 
-//------------------------------------------------------------------------------------------
+unsigned numEnclosingMailBlockquotes(const Position&);
 
-Position positionBeforeNode(const Node*);
-Position positionAfterNode(const Node*);
+// -------------------------------------------------------------------------
+// VisiblePosition
+// -------------------------------------------------------------------------
+    
+// Functions returning VisiblePosition
+    
+VisiblePosition firstEditablePositionAfterPositionInRoot(const Position&, Node*);
+VisiblePosition lastEditablePositionBeforePositionInRoot(const Position&, Node*);
 VisiblePosition visiblePositionBeforeNode(Node*);
 VisiblePosition visiblePositionAfterNode(Node*);
+
+bool lineBreakExistsAtVisiblePosition(const VisiblePosition&);
+    
+int comparePositions(const VisiblePosition&, const VisiblePosition&);
+int indexForVisiblePosition(const VisiblePosition&);
+
+// -------------------------------------------------------------------------
+// Range
+// -------------------------------------------------------------------------
+
+// Functions returning Range
+
 PassRefPtr<Range> createRange(PassRefPtr<Document>, const VisiblePosition& start, const VisiblePosition& end, ExceptionCode&);
 PassRefPtr<Range> extendRangeToWrappingNodes(PassRefPtr<Range> rangeToExtend, const Range* maximumRange, const Node* rootNode);
-
 PassRefPtr<Range> avoidIntersectionWithNode(const Range*, Node*);
-VisibleSelection avoidIntersectionWithNode(const VisibleSelection&, Node*);
-
-bool isSpecialElement(const Node*);
-bool validBlockTag(const String&);
 
+// -------------------------------------------------------------------------
+// HTMLElement
+// -------------------------------------------------------------------------
+    
+// Functions returning HTMLElement
+    
 PassRefPtr<HTMLElement> createDefaultParagraphElement(Document*);
 PassRefPtr<HTMLElement> createBreakElement(Document*);
 PassRefPtr<HTMLElement> createOrderedListElement(Document*);
@@ -92,57 +191,45 @@ PassRefPtr<HTMLElement> createListItemElement(Document*);
 PassRefPtr<HTMLElement> createHTMLElement(Document*, const QualifiedName&);
 PassRefPtr<HTMLElement> createHTMLElement(Document*, const AtomicString&);
 
-bool isTabSpanNode(const Node*);
-bool isTabSpanTextNode(const Node*);
-Node* tabSpanNode(const Node*);
-Position positionBeforeTabSpan(const Position&);
+HTMLElement* enclosingList(Node*);
+HTMLElement* outermostEnclosingList(Node*);
+HTMLElement* enclosingListChild(Node*);
+
+// -------------------------------------------------------------------------
+// Element
+// -------------------------------------------------------------------------
+    
+// Functions returning Element
+    
 PassRefPtr<Element> createTabSpanElement(Document*);
 PassRefPtr<Element> createTabSpanElement(Document*, PassRefPtr<Node> tabTextNode);
 PassRefPtr<Element> createTabSpanElement(Document*, const String& tabText);
-
-bool isNodeRendered(const Node*);
-bool isMailBlockquote(const Node*);
-Node* nearestMailBlockquote(const Node*);
-unsigned numEnclosingMailBlockquotes(const Position&);
-int caretMinOffset(const Node*);
-int caretMaxOffset(const Node*);
-
-//------------------------------------------------------------------------------------------
-
-bool isTableStructureNode(const Node*);
 PassRefPtr<Element> createBlockPlaceholderElement(Document*);
 
-bool isFirstVisiblePositionInSpecialElement(const Position&);
-Position positionBeforeContainingSpecialElement(const Position&, Node** containingSpecialElement=0);
-bool isLastVisiblePositionInSpecialElement(const Position&);
-Position positionAfterContainingSpecialElement(const Position&, Node** containingSpecialElement=0);
-Position positionOutsideContainingSpecialElement(const Position&, Node** containingSpecialElement=0);
-Node* isLastPositionBeforeTable(const VisiblePosition&);
-Node* isFirstPositionAfterTable(const VisiblePosition&);
+Element* editableRootForPosition(const Position&);
+Element* unsplittableElementForPosition(const Position&);
 
-Node* enclosingNodeWithTag(const Position&, const QualifiedName&);
-Node* enclosingNodeOfType(const Position&, bool (*nodeIsOfType)(const Node*), bool onlyReturnEditableNodes = true);
-Node* highestEnclosingNodeOfType(const Position&, bool (*nodeIsOfType)(const Node*));
-Node* enclosingTableCell(const Position&);
-Node* enclosingEmptyListItem(const VisiblePosition&);
-Node* enclosingAnchorElement(const Position&);
-bool isListElement(Node*);
-HTMLElement* enclosingList(Node*);
-HTMLElement* outermostEnclosingList(Node*);
-HTMLElement* enclosingListChild(Node*);
+// Boolean functions on Element
+    
 bool canMergeLists(Element* firstList, Element* secondList);
-Node* highestAncestor(Node*);
-bool isTableElement(Node*);
-bool isTableCell(const Node*);
-
-bool lineBreakExistsAtPosition(const Position&);
-bool lineBreakExistsAtVisiblePosition(const VisiblePosition&);
+    
+// -------------------------------------------------------------------------
+// VisibleSelection
+// -------------------------------------------------------------------------
+    
+// Functions returning VisibleSelection
 
+VisibleSelection avoidIntersectionWithNode(const VisibleSelection&, Node*);
 VisibleSelection selectionForParagraphIteration(const VisibleSelection&);
+    
+
+// Miscellaneous functions on String
+    
+String stringWithRebalancedWhitespace(const String&, bool, bool);
+const String& nonBreakingSpaceString();
+bool validBlockTag(const AtomicString&);
+    
 
-int indexForVisiblePosition(const VisiblePosition&);
-bool isVisiblyAdjacent(const Position& first, const Position& second);
-bool isNodeVisiblyContainedWithin(Node*, const Range*);
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/editing/markup.cpp b/src/3rdparty/webkit/WebCore/editing/markup.cpp
index 1c737a0..43e7c92 100644
--- a/src/3rdparty/webkit/WebCore/editing/markup.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/markup.cpp
@@ -58,6 +58,7 @@
 #include "htmlediting.h"
 #include "visible_units.h"
 #include <wtf/StdLibExtras.h>
+#include "ApplyStyleCommand.h"
 
 using namespace std;
 
@@ -291,20 +292,16 @@ static void removeEnclosingMailBlockquoteStyle(CSSMutableStyleDeclaration* style
     Node* blockquote = nearestMailBlockquote(node);
     if (!blockquote || !blockquote->parentNode())
         return;
-            
-    RefPtr<CSSMutableStyleDeclaration> parentStyle = Position(blockquote->parentNode(), 0).computedStyle()->deprecatedCopyInheritableProperties();
-    RefPtr<CSSMutableStyleDeclaration> blockquoteStyle = Position(blockquote, 0).computedStyle()->deprecatedCopyInheritableProperties();
-    parentStyle->diff(blockquoteStyle.get());
-    blockquoteStyle->diff(style);
+
+    removeStylesAddedByNode(style, blockquote);
 }
 
 static void removeDefaultStyles(CSSMutableStyleDeclaration* style, Document* document)
 {
     if (!document || !document->documentElement())
         return;
-            
-    RefPtr<CSSMutableStyleDeclaration> documentStyle = computedStyle(document->documentElement())->deprecatedCopyInheritableProperties();
-    documentStyle->diff(style);
+
+    prepareEditingStyleToApplyAt(style, Position(document->documentElement(), 0));
 }
 
 static bool shouldAddNamespaceElem(const Element* elem)
@@ -423,7 +420,7 @@ static void appendStartMarkup(Vector<UChar>& result, const Node* node, const Ran
         case Node::COMMENT_NODE:
             // FIXME: Comment content is not escaped, but XMLSerializer (and possibly other callers) should raise an exception if it includes "-->".
             append(result, "<!--");
-            append(result, static_cast<const Comment*>(node)->nodeValue());
+            append(result, static_cast<const Comment*>(node)->data());
             append(result, "-->");
             break;
         case Node::DOCUMENT_NODE:
@@ -648,7 +645,7 @@ static void completeURLs(Node* node, const String& baseURL)
 {
     Vector<AttributeChange> changes;
 
-    KURL parsedBaseURL(baseURL);
+    KURL parsedBaseURL(ParsedURLString, baseURL);
 
     Node* end = node->traverseNextSibling();
     for (Node* n = node; n != end; n = n->traverseNextNode()) {
@@ -970,7 +967,7 @@ String createMarkup(const Range* range, Vector<Node*>* nodes, EAnnotateForInterc
     Node* body = enclosingNodeWithTag(Position(commonAncestor, 0), bodyTag);
     // FIXME: Do this for all fully selected blocks, not just the body.
     Node* fullySelectedRoot = body && *VisibleSelection::selectionFromContentsOfNode(body).toNormalizedRange() == *updatedRange ? body : 0;
-    RefPtr<CSSMutableStyleDeclaration> fullySelectedRootStyle = fullySelectedRoot ? styleFromMatchedRulesAndInlineDecl(fullySelectedRoot) : PassRefPtr<CSSMutableStyleDeclaration>(0);
+    RefPtr<CSSMutableStyleDeclaration> fullySelectedRootStyle = fullySelectedRoot ? styleFromMatchedRulesAndInlineDecl(fullySelectedRoot) : 0;
     if (annotate && fullySelectedRoot) {
         if (shouldIncludeWrapperForFullySelectedRoot(fullySelectedRoot, fullySelectedRootStyle.get()))
             specialCommonAncestor = fullySelectedRoot;
@@ -1007,7 +1004,7 @@ String createMarkup(const Range* range, Vector<Node*>* nodes, EAnnotateForInterc
     // Add a wrapper span with the styles that all of the nodes in the markup inherit.
     Node* parentOfLastClosed = lastClosed ? lastClosed->parentNode() : 0;
     if (parentOfLastClosed && parentOfLastClosed->renderer()) {
-        RefPtr<CSSMutableStyleDeclaration> style = computedStyle(parentOfLastClosed)->deprecatedCopyInheritableProperties();
+        RefPtr<CSSMutableStyleDeclaration> style = editingStyleAtPosition(Position(parentOfLastClosed, 0));
 
         // Styles that Mail blockquotes contribute should only be placed on the Mail blockquote, to help
         // us differentiate those styles from ones that the user has applied.  This helps us
@@ -1031,8 +1028,8 @@ String createMarkup(const Range* range, Vector<Node*>* nodes, EAnnotateForInterc
         // Add a style span with the document's default styles.  We add these in a separate
         // span so that at paste time we can differentiate between document defaults and user
         // applied styles.
-        RefPtr<CSSMutableStyleDeclaration> defaultStyle = computedStyle(document->documentElement())->deprecatedCopyInheritableProperties();
-        
+        RefPtr<CSSMutableStyleDeclaration> defaultStyle = editingStyleAtPosition(Position(document->documentElement(), 0));
+
         if (defaultStyle->length() > 0)
             addStyleMarkup(preMarkups, markups, defaultStyle.get(), document);
     }
diff --git a/src/3rdparty/webkit/WebCore/editing/visible_units.cpp b/src/3rdparty/webkit/WebCore/editing/visible_units.cpp
index 869c893..c96fdfd 100644
--- a/src/3rdparty/webkit/WebCore/editing/visible_units.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/visible_units.cpp
@@ -611,7 +611,7 @@ VisiblePosition previousLinePosition(const VisiblePosition &visiblePosition, int
         Node* node = renderer->node();
         if (node && editingIgnoresContent(node))
             return Position(node->parent(), node->nodeIndex());
-        return renderer->positionForPoint(IntPoint(x - absPos.x(), root->topOverflow()));
+        return renderer->positionForPoint(IntPoint(x - absPos.x(), root->lineTop()));
     }
     
     // Could not find a previous line. This means we must already be on the first line.
@@ -712,7 +712,7 @@ VisiblePosition nextLinePosition(const VisiblePosition &visiblePosition, int x)
         Node* node = renderer->node();
         if (node && editingIgnoresContent(node))
             return Position(node->parent(), node->nodeIndex());
-        return renderer->positionForPoint(IntPoint(x - absPos.x(), root->topOverflow()));
+        return renderer->positionForPoint(IntPoint(x - absPos.x(), root->lineTop()));
     }    
 
     // Could not find a next line. This means we must already be on the last line.
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSGrammar.cpp b/src/3rdparty/webkit/WebCore/generated/CSSGrammar.cpp
index bdd4346..6428e64 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSGrammar.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/CSSGrammar.cpp
@@ -1,23 +1,24 @@
-
-/* A Bison parser, made by GNU Bison 2.4.1.  */
+/* A Bison parser, made by GNU Bison 2.3.  */
 
 /* Skeleton implementation for Bison's Yacc-like parsers in C
-   
-      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
+
+   Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
    Free Software Foundation, Inc.
-   
-   This program is free software: you can redistribute it and/or modify
+
+   This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation, either version 3 of the License, or
-   (at your option) any later version.
-   
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
-   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin Street, Fifth Floor,
+   Boston, MA 02110-1301, USA.  */
 
 /* As a special exception, you may create a larger work that contains
    part or all of the Bison parser skeleton and distribute that work
@@ -28,7 +29,7 @@
    special exception, which will cause the skeleton and the resulting
    Bison output files to be licensed under the GNU General Public
    License without this special exception.
-   
+
    This special exception was added by the Free Software Foundation in
    version 2.2 of Bison.  */
 
@@ -46,7 +47,7 @@
 #define YYBISON 1
 
 /* Bison version.  */
-#define YYBISON_VERSION "2.4.1"
+#define YYBISON_VERSION "2.3"
 
 /* Skeleton name.  */
 #define YYSKELETON_NAME "yacc.c"
@@ -54,28 +55,161 @@
 /* Pure parsers.  */
 #define YYPURE 1
 
-/* Push parsers.  */
-#define YYPUSH 0
-
-/* Pull parsers.  */
-#define YYPULL 1
-
 /* Using locations.  */
 #define YYLSP_NEEDED 0
 
 /* Substitute the variable and function names.  */
-#define yyparse         cssyyparse
-#define yylex           cssyylex
-#define yyerror         cssyyerror
-#define yylval          cssyylval
-#define yychar          cssyychar
-#define yydebug         cssyydebug
-#define yynerrs         cssyynerrs
+#define yyparse cssyyparse
+#define yylex   cssyylex
+#define yyerror cssyyerror
+#define yylval  cssyylval
+#define yychar  cssyychar
+#define yydebug cssyydebug
+#define yynerrs cssyynerrs
+
+
+/* Tokens.  */
+#ifndef YYTOKENTYPE
+# define YYTOKENTYPE
+   /* Put the tokens into the symbol table, so that GDB and other debuggers
+      know about them.  */
+   enum yytokentype {
+     TOKEN_EOF = 0,
+     LOWEST_PREC = 258,
+     UNIMPORTANT_TOK = 259,
+     WHITESPACE = 260,
+     SGML_CD = 261,
+     INCLUDES = 262,
+     DASHMATCH = 263,
+     BEGINSWITH = 264,
+     ENDSWITH = 265,
+     CONTAINS = 266,
+     STRING = 267,
+     IDENT = 268,
+     NTH = 269,
+     HEX = 270,
+     IDSEL = 271,
+     IMPORT_SYM = 272,
+     PAGE_SYM = 273,
+     MEDIA_SYM = 274,
+     FONT_FACE_SYM = 275,
+     CHARSET_SYM = 276,
+     NAMESPACE_SYM = 277,
+     WEBKIT_RULE_SYM = 278,
+     WEBKIT_DECLS_SYM = 279,
+     WEBKIT_KEYFRAME_RULE_SYM = 280,
+     WEBKIT_KEYFRAMES_SYM = 281,
+     WEBKIT_VALUE_SYM = 282,
+     WEBKIT_MEDIAQUERY_SYM = 283,
+     WEBKIT_SELECTOR_SYM = 284,
+     WEBKIT_VARIABLES_SYM = 285,
+     WEBKIT_DEFINE_SYM = 286,
+     VARIABLES_FOR = 287,
+     WEBKIT_VARIABLES_DECLS_SYM = 288,
+     ATKEYWORD = 289,
+     IMPORTANT_SYM = 290,
+     MEDIA_ONLY = 291,
+     MEDIA_NOT = 292,
+     MEDIA_AND = 293,
+     REMS = 294,
+     QEMS = 295,
+     EMS = 296,
+     EXS = 297,
+     PXS = 298,
+     CMS = 299,
+     MMS = 300,
+     INS = 301,
+     PTS = 302,
+     PCS = 303,
+     DEGS = 304,
+     RADS = 305,
+     GRADS = 306,
+     TURNS = 307,
+     MSECS = 308,
+     SECS = 309,
+     HERZ = 310,
+     KHERZ = 311,
+     DIMEN = 312,
+     PERCENTAGE = 313,
+     FLOATTOKEN = 314,
+     INTEGER = 315,
+     URI = 316,
+     FUNCTION = 317,
+     NOTFUNCTION = 318,
+     UNICODERANGE = 319,
+     VARCALL = 320
+   };
+#endif
+/* Tokens.  */
+#define TOKEN_EOF 0
+#define LOWEST_PREC 258
+#define UNIMPORTANT_TOK 259
+#define WHITESPACE 260
+#define SGML_CD 261
+#define INCLUDES 262
+#define DASHMATCH 263
+#define BEGINSWITH 264
+#define ENDSWITH 265
+#define CONTAINS 266
+#define STRING 267
+#define IDENT 268
+#define NTH 269
+#define HEX 270
+#define IDSEL 271
+#define IMPORT_SYM 272
+#define PAGE_SYM 273
+#define MEDIA_SYM 274
+#define FONT_FACE_SYM 275
+#define CHARSET_SYM 276
+#define NAMESPACE_SYM 277
+#define WEBKIT_RULE_SYM 278
+#define WEBKIT_DECLS_SYM 279
+#define WEBKIT_KEYFRAME_RULE_SYM 280
+#define WEBKIT_KEYFRAMES_SYM 281
+#define WEBKIT_VALUE_SYM 282
+#define WEBKIT_MEDIAQUERY_SYM 283
+#define WEBKIT_SELECTOR_SYM 284
+#define WEBKIT_VARIABLES_SYM 285
+#define WEBKIT_DEFINE_SYM 286
+#define VARIABLES_FOR 287
+#define WEBKIT_VARIABLES_DECLS_SYM 288
+#define ATKEYWORD 289
+#define IMPORTANT_SYM 290
+#define MEDIA_ONLY 291
+#define MEDIA_NOT 292
+#define MEDIA_AND 293
+#define REMS 294
+#define QEMS 295
+#define EMS 296
+#define EXS 297
+#define PXS 298
+#define CMS 299
+#define MMS 300
+#define INS 301
+#define PTS 302
+#define PCS 303
+#define DEGS 304
+#define RADS 305
+#define GRADS 306
+#define TURNS 307
+#define MSECS 308
+#define SECS 309
+#define HERZ 310
+#define KHERZ 311
+#define DIMEN 312
+#define PERCENTAGE 313
+#define FLOATTOKEN 314
+#define INTEGER 315
+#define URI 316
+#define FUNCTION 317
+#define NOTFUNCTION 318
+#define UNICODERANGE 319
+#define VARCALL 320
+
 
 
-/* Copy the first part of user declarations.  */
 
-/* Line 189 of yacc.c  */
+/* Copy the first part of user declarations.  */
 #line 1 "../css/CSSGrammar.y"
 
 
@@ -136,9 +270,6 @@ using namespace HTMLNames;
 
 
 
-/* Line 189 of yacc.c  */
-#line 141 "WebCore/tmp/../generated/CSSGrammar.tab.c"
-
 /* Enabling traces.  */
 #ifndef YYDEBUG
 # define YYDEBUG 0
@@ -157,89 +288,10 @@ using namespace HTMLNames;
 # define YYTOKEN_TABLE 0
 #endif
 
-
-/* Tokens.  */
-#ifndef YYTOKENTYPE
-# define YYTOKENTYPE
-   /* Put the tokens into the symbol table, so that GDB and other debuggers
-      know about them.  */
-   enum yytokentype {
-     TOKEN_EOF = 0,
-     LOWEST_PREC = 258,
-     UNIMPORTANT_TOK = 259,
-     WHITESPACE = 260,
-     SGML_CD = 261,
-     INCLUDES = 262,
-     DASHMATCH = 263,
-     BEGINSWITH = 264,
-     ENDSWITH = 265,
-     CONTAINS = 266,
-     STRING = 267,
-     IDENT = 268,
-     NTH = 269,
-     HEX = 270,
-     IDSEL = 271,
-     IMPORT_SYM = 272,
-     PAGE_SYM = 273,
-     MEDIA_SYM = 274,
-     FONT_FACE_SYM = 275,
-     CHARSET_SYM = 276,
-     NAMESPACE_SYM = 277,
-     WEBKIT_RULE_SYM = 278,
-     WEBKIT_DECLS_SYM = 279,
-     WEBKIT_KEYFRAME_RULE_SYM = 280,
-     WEBKIT_KEYFRAMES_SYM = 281,
-     WEBKIT_VALUE_SYM = 282,
-     WEBKIT_MEDIAQUERY_SYM = 283,
-     WEBKIT_SELECTOR_SYM = 284,
-     WEBKIT_VARIABLES_SYM = 285,
-     WEBKIT_DEFINE_SYM = 286,
-     VARIABLES_FOR = 287,
-     WEBKIT_VARIABLES_DECLS_SYM = 288,
-     ATKEYWORD = 289,
-     IMPORTANT_SYM = 290,
-     MEDIA_ONLY = 291,
-     MEDIA_NOT = 292,
-     MEDIA_AND = 293,
-     REMS = 294,
-     QEMS = 295,
-     EMS = 296,
-     EXS = 297,
-     PXS = 298,
-     CMS = 299,
-     MMS = 300,
-     INS = 301,
-     PTS = 302,
-     PCS = 303,
-     DEGS = 304,
-     RADS = 305,
-     GRADS = 306,
-     TURNS = 307,
-     MSECS = 308,
-     SECS = 309,
-     HERZ = 310,
-     KHERZ = 311,
-     DIMEN = 312,
-     PERCENTAGE = 313,
-     FLOATTOKEN = 314,
-     INTEGER = 315,
-     URI = 316,
-     FUNCTION = 317,
-     NOTFUNCTION = 318,
-     UNICODERANGE = 319,
-     VARCALL = 320
-   };
-#endif
-
-
-
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
-{
-
-/* Line 214 of yacc.c  */
 #line 62 "../css/CSSGrammar.y"
-
+{
     bool boolean;
     char character;
     int integer;
@@ -261,21 +313,18 @@ typedef union YYSTYPE
     WebKitCSSKeyframeRule* keyframeRule;
     WebKitCSSKeyframesRule* keyframesRule;
     float val;
-
-
-
-/* Line 214 of yacc.c  */
-#line 269 "WebCore/tmp/../generated/CSSGrammar.tab.c"
-} YYSTYPE;
-# define YYSTYPE_IS_TRIVIAL 1
+}
+/* Line 187 of yacc.c.  */
+#line 319 "WebCore/tmp/../generated/CSSGrammar.tab.c"
+	YYSTYPE;
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
+# define YYSTYPE_IS_TRIVIAL 1
 #endif
 
 
-/* Copy the second part of user declarations.  */
 
-/* Line 264 of yacc.c  */
+/* Copy the second part of user declarations.  */
 #line 86 "../css/CSSGrammar.y"
 
 
@@ -291,8 +340,8 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 
 
 
-/* Line 264 of yacc.c  */
-#line 296 "WebCore/tmp/../generated/CSSGrammar.tab.c"
+/* Line 216 of yacc.c.  */
+#line 345 "WebCore/tmp/../generated/CSSGrammar.tab.c"
 
 #ifdef short
 # undef short
@@ -367,14 +416,14 @@ typedef short int yytype_int16;
 #if (defined __STDC__ || defined __C99__FUNC__ \
      || defined __cplusplus || defined _MSC_VER)
 static int
-YYID (int yyi)
+YYID (int i)
 #else
 static int
-YYID (yyi)
-    int yyi;
+YYID (i)
+    int i;
 #endif
 {
-  return yyi;
+  return i;
 }
 #endif
 
@@ -455,9 +504,9 @@ void free (void *); /* INFRINGES ON USER NAME SPACE */
 /* A type that is properly aligned for any stack member.  */
 union yyalloc
 {
-  yytype_int16 yyss_alloc;
-  YYSTYPE yyvs_alloc;
-};
+  yytype_int16 yyss;
+  YYSTYPE yyvs;
+  };
 
 /* The size of the maximum gap between one aligned stack and the next.  */
 # define YYSTACK_GAP_MAXIMUM (sizeof (union yyalloc) - 1)
@@ -491,12 +540,12 @@ union yyalloc
    elements in the stack, and YYPTR gives the new location of the
    stack.  Advance YYPTR to a properly aligned location for the next
    stack.  */
-# define YYSTACK_RELOCATE(Stack_alloc, Stack)				\
+# define YYSTACK_RELOCATE(Stack)					\
     do									\
       {									\
 	YYSIZE_T yynewbytes;						\
-	YYCOPY (&yyptr->Stack_alloc, Stack, yysize);			\
-	Stack = &yyptr->Stack_alloc;					\
+	YYCOPY (&yyptr->Stack, Stack, yysize);				\
+	Stack = &yyptr->Stack;						\
 	yynewbytes = yystacksize * sizeof (*Stack) + YYSTACK_GAP_MAXIMUM; \
 	yyptr += yynewbytes / sizeof (*yyptr);				\
       }									\
@@ -1518,20 +1567,17 @@ yy_symbol_print (yyoutput, yytype, yyvaluep)
 #if (defined __STDC__ || defined __C99__FUNC__ \
      || defined __cplusplus || defined _MSC_VER)
 static void
-yy_stack_print (yytype_int16 *yybottom, yytype_int16 *yytop)
+yy_stack_print (yytype_int16 *bottom, yytype_int16 *top)
 #else
 static void
-yy_stack_print (yybottom, yytop)
-    yytype_int16 *yybottom;
-    yytype_int16 *yytop;
+yy_stack_print (bottom, top)
+    yytype_int16 *bottom;
+    yytype_int16 *top;
 #endif
 {
   YYFPRINTF (stderr, "Stack now");
-  for (; yybottom <= yytop; yybottom++)
-    {
-      int yybot = *yybottom;
-      YYFPRINTF (stderr, " %d", yybot);
-    }
+  for (; bottom <= top; ++bottom)
+    YYFPRINTF (stderr, " %d", *bottom);
   YYFPRINTF (stderr, "\n");
 }
 
@@ -1565,11 +1611,11 @@ yy_reduce_print (yyvsp, yyrule)
   /* The symbols being reduced.  */
   for (yyi = 0; yyi < yynrhs; yyi++)
     {
-      YYFPRINTF (stderr, "   $%d = ", yyi + 1);
+      fprintf (stderr, "   $%d = ", yyi + 1);
       yy_symbol_print (stderr, yyrhs[yyprhs[yyrule] + yyi],
 		       &(yyvsp[(yyi + 1) - (yynrhs)])
 		       		       );
-      YYFPRINTF (stderr, "\n");
+      fprintf (stderr, "\n");
     }
 }
 
@@ -1849,8 +1895,10 @@ yydestruct (yymsg, yytype, yyvaluep)
 	break;
     }
 }
+
 
 /* Prevent warnings from -Wmissing-prototypes.  */
+
 #ifdef YYPARSE_PARAM
 #if defined __STDC__ || defined __cplusplus
 int yyparse (void *YYPARSE_PARAM);
@@ -1869,9 +1917,10 @@ int yyparse ();
 
 
 
-/*-------------------------.
-| yyparse or yypush_parse.  |
-`-------------------------*/
+
+/*----------.
+| yyparse.  |
+`----------*/
 
 #ifdef YYPARSE_PARAM
 #if (defined __STDC__ || defined __C99__FUNC__ \
@@ -1895,46 +1944,22 @@ yyparse ()
 #endif
 #endif
 {
-/* The lookahead symbol.  */
+  /* The look-ahead symbol.  */
 int yychar;
 
-/* The semantic value of the lookahead symbol.  */
+/* The semantic value of the look-ahead symbol.  */
 YYSTYPE yylval;
 
-    /* Number of syntax errors so far.  */
-    int yynerrs;
-
-    int yystate;
-    /* Number of tokens to shift before error messages enabled.  */
-    int yyerrstatus;
-
-    /* The stacks and their tools:
-       `yyss': related to states.
-       `yyvs': related to semantic values.
-
-       Refer to the stacks thru separate pointers, to allow yyoverflow
-       to reallocate them elsewhere.  */
-
-    /* The state stack.  */
-    yytype_int16 yyssa[YYINITDEPTH];
-    yytype_int16 *yyss;
-    yytype_int16 *yyssp;
-
-    /* The semantic value stack.  */
-    YYSTYPE yyvsa[YYINITDEPTH];
-    YYSTYPE *yyvs;
-    YYSTYPE *yyvsp;
-
-    YYSIZE_T yystacksize;
+/* Number of syntax errors so far.  */
+int yynerrs;
 
+  int yystate;
   int yyn;
   int yyresult;
-  /* Lookahead token as an internal (translated) token number.  */
-  int yytoken;
-  /* The variables used to return semantic value and location from the
-     action routines.  */
-  YYSTYPE yyval;
-
+  /* Number of tokens to shift before error messages enabled.  */
+  int yyerrstatus;
+  /* Look-ahead token as an internal (translated) token number.  */
+  int yytoken = 0;
 #if YYERROR_VERBOSE
   /* Buffer for error messages, and its allocated size.  */
   char yymsgbuf[128];
@@ -1942,28 +1967,51 @@ YYSTYPE yylval;
   YYSIZE_T yymsg_alloc = sizeof yymsgbuf;
 #endif
 
+  /* Three stacks and their tools:
+     `yyss': related to states,
+     `yyvs': related to semantic values,
+     `yyls': related to locations.
+
+     Refer to the stacks thru separate pointers, to allow yyoverflow
+     to reallocate them elsewhere.  */
+
+  /* The state stack.  */
+  yytype_int16 yyssa[YYINITDEPTH];
+  yytype_int16 *yyss = yyssa;
+  yytype_int16 *yyssp;
+
+  /* The semantic value stack.  */
+  YYSTYPE yyvsa[YYINITDEPTH];
+  YYSTYPE *yyvs = yyvsa;
+  YYSTYPE *yyvsp;
+
+
+
 #define YYPOPSTACK(N)   (yyvsp -= (N), yyssp -= (N))
 
+  YYSIZE_T yystacksize = YYINITDEPTH;
+
+  /* The variables used to return semantic value and location from the
+     action routines.  */
+  YYSTYPE yyval;
+
+
   /* The number of symbols on the RHS of the reduced rule.
      Keep to zero when no symbol should be popped.  */
   int yylen = 0;
 
-  yytoken = 0;
-  yyss = yyssa;
-  yyvs = yyvsa;
-  yystacksize = YYINITDEPTH;
-
   YYDPRINTF ((stderr, "Starting parse\n"));
 
   yystate = 0;
   yyerrstatus = 0;
   yynerrs = 0;
-  yychar = YYEMPTY; /* Cause a token to be read.  */
+  yychar = YYEMPTY;		/* Cause a token to be read.  */
 
   /* Initialize stack pointers.
      Waste one element of value and location stack
      so that they stay on the same level as the state stack.
      The wasted elements are never initialized.  */
+
   yyssp = yyss;
   yyvsp = yyvs;
 
@@ -1993,6 +2041,7 @@ YYSTYPE yylval;
 	YYSTYPE *yyvs1 = yyvs;
 	yytype_int16 *yyss1 = yyss;
 
+
 	/* Each stack pointer address is followed by the size of the
 	   data in use in that stack, in bytes.  This used to be a
 	   conditional around just the two extra args, but that might
@@ -2000,6 +2049,7 @@ YYSTYPE yylval;
 	yyoverflow (YY_("memory exhausted"),
 		    &yyss1, yysize * sizeof (*yyssp),
 		    &yyvs1, yysize * sizeof (*yyvsp),
+
 		    &yystacksize);
 
 	yyss = yyss1;
@@ -2022,8 +2072,9 @@ YYSTYPE yylval;
 	  (union yyalloc *) YYSTACK_ALLOC (YYSTACK_BYTES (yystacksize));
 	if (! yyptr)
 	  goto yyexhaustedlab;
-	YYSTACK_RELOCATE (yyss_alloc, yyss);
-	YYSTACK_RELOCATE (yyvs_alloc, yyvs);
+	YYSTACK_RELOCATE (yyss);
+	YYSTACK_RELOCATE (yyvs);
+
 #  undef YYSTACK_RELOCATE
 	if (yyss1 != yyssa)
 	  YYSTACK_FREE (yyss1);
@@ -2034,6 +2085,7 @@ YYSTYPE yylval;
       yyssp = yyss + yysize - 1;
       yyvsp = yyvs + yysize - 1;
 
+
       YYDPRINTF ((stderr, "Stack size increased to %lu\n",
 		  (unsigned long int) yystacksize));
 
@@ -2043,9 +2095,6 @@ YYSTYPE yylval;
 
   YYDPRINTF ((stderr, "Entering state %d\n", yystate));
 
-  if (yystate == YYFINAL)
-    YYACCEPT;
-
   goto yybackup;
 
 /*-----------.
@@ -2054,16 +2103,16 @@ YYSTYPE yylval;
 yybackup:
 
   /* Do appropriate processing given the current state.  Read a
-     lookahead token if we need one and don't already have one.  */
+     look-ahead token if we need one and don't already have one.  */
 
-  /* First try to decide what to do without reference to lookahead token.  */
+  /* First try to decide what to do without reference to look-ahead token.  */
   yyn = yypact[yystate];
   if (yyn == YYPACT_NINF)
     goto yydefault;
 
-  /* Not known => get a lookahead token if don't already have one.  */
+  /* Not known => get a look-ahead token if don't already have one.  */
 
-  /* YYCHAR is either YYEMPTY or YYEOF or a valid lookahead symbol.  */
+  /* YYCHAR is either YYEMPTY or YYEOF or a valid look-ahead symbol.  */
   if (yychar == YYEMPTY)
     {
       YYDPRINTF ((stderr, "Reading a token: "));
@@ -2095,16 +2144,20 @@ yybackup:
       goto yyreduce;
     }
 
+  if (yyn == YYFINAL)
+    YYACCEPT;
+
   /* Count tokens shifted since error; after three, turn off error
      status.  */
   if (yyerrstatus)
     yyerrstatus--;
 
-  /* Shift the lookahead token.  */
+  /* Shift the look-ahead token.  */
   YY_SYMBOL_PRINT ("Shifting", yytoken, &yylval, &yylloc);
 
-  /* Discard the shifted token.  */
-  yychar = YYEMPTY;
+  /* Discard the shifted token unless it is eof.  */
+  if (yychar != YYEOF)
+    yychar = YYEMPTY;
 
   yystate = yyn;
   *++yyvsp = yylval;
@@ -2144,8 +2197,6 @@ yyreduce:
   switch (yyn)
     {
         case 12:
-
-/* Line 1455 of yacc.c  */
 #line 287 "../css/CSSGrammar.y"
     {
         static_cast<CSSParser*>(parser)->m_rule = (yyvsp[(4) - (6)].rule);
@@ -2153,8 +2204,6 @@ yyreduce:
     break;
 
   case 13:
-
-/* Line 1455 of yacc.c  */
 #line 293 "../css/CSSGrammar.y"
     {
         static_cast<CSSParser*>(parser)->m_keyframe = (yyvsp[(4) - (6)].keyframeRule);
@@ -2162,8 +2211,6 @@ yyreduce:
     break;
 
   case 14:
-
-/* Line 1455 of yacc.c  */
 #line 299 "../css/CSSGrammar.y"
     {
         /* can be empty */
@@ -2171,8 +2218,6 @@ yyreduce:
     break;
 
   case 15:
-
-/* Line 1455 of yacc.c  */
 #line 305 "../css/CSSGrammar.y"
     {
         /* can be empty */
@@ -2180,8 +2225,6 @@ yyreduce:
     break;
 
   case 16:
-
-/* Line 1455 of yacc.c  */
 #line 311 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -2197,8 +2240,6 @@ yyreduce:
     break;
 
   case 17:
-
-/* Line 1455 of yacc.c  */
 #line 325 "../css/CSSGrammar.y"
     {
          CSSParser* p = static_cast<CSSParser*>(parser);
@@ -2207,8 +2248,6 @@ yyreduce:
     break;
 
   case 18:
-
-/* Line 1455 of yacc.c  */
 #line 332 "../css/CSSGrammar.y"
     {
         if ((yyvsp[(4) - (5)].selectorList)) {
@@ -2220,16 +2259,12 @@ yyreduce:
     break;
 
   case 25:
-
-/* Line 1455 of yacc.c  */
 #line 354 "../css/CSSGrammar.y"
     {
   ;}
     break;
 
   case 28:
-
-/* Line 1455 of yacc.c  */
 #line 364 "../css/CSSGrammar.y"
     {
      CSSParser* p = static_cast<CSSParser*>(parser);
@@ -2240,24 +2275,18 @@ yyreduce:
     break;
 
   case 29:
-
-/* Line 1455 of yacc.c  */
 #line 370 "../css/CSSGrammar.y"
     {
   ;}
     break;
 
   case 30:
-
-/* Line 1455 of yacc.c  */
 #line 372 "../css/CSSGrammar.y"
     {
   ;}
     break;
 
   case 32:
-
-/* Line 1455 of yacc.c  */
 #line 378 "../css/CSSGrammar.y"
     {
      CSSParser* p = static_cast<CSSParser*>(parser);
@@ -2267,16 +2296,12 @@ yyreduce:
     break;
 
   case 33:
-
-/* Line 1455 of yacc.c  */
 #line 383 "../css/CSSGrammar.y"
     {
  ;}
     break;
 
   case 35:
-
-/* Line 1455 of yacc.c  */
 #line 389 "../css/CSSGrammar.y"
     {
     CSSParser* p = static_cast<CSSParser*>(parser);
@@ -2286,8 +2311,6 @@ yyreduce:
     break;
 
   case 39:
-
-/* Line 1455 of yacc.c  */
 #line 403 "../css/CSSGrammar.y"
     {
      CSSParser* p = static_cast<CSSParser*>(parser);
@@ -2297,15 +2320,11 @@ yyreduce:
     break;
 
   case 49:
-
-/* Line 1455 of yacc.c  */
 #line 426 "../css/CSSGrammar.y"
     { (yyval.ruleList) = 0; ;}
     break;
 
   case 50:
-
-/* Line 1455 of yacc.c  */
 #line 427 "../css/CSSGrammar.y"
     {
       (yyval.ruleList) = (yyvsp[(1) - (3)].ruleList);
@@ -2318,8 +2337,6 @@ yyreduce:
     break;
 
   case 60:
-
-/* Line 1455 of yacc.c  */
 #line 454 "../css/CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createImportRule((yyvsp[(3) - (6)].string), (yyvsp[(5) - (6)].mediaList));
@@ -2327,8 +2344,6 @@ yyreduce:
     break;
 
   case 61:
-
-/* Line 1455 of yacc.c  */
 #line 457 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
@@ -2336,8 +2351,6 @@ yyreduce:
     break;
 
   case 62:
-
-/* Line 1455 of yacc.c  */
 #line 460 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
@@ -2345,8 +2358,6 @@ yyreduce:
     break;
 
   case 63:
-
-/* Line 1455 of yacc.c  */
 #line 463 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
@@ -2354,8 +2365,6 @@ yyreduce:
     break;
 
   case 64:
-
-/* Line 1455 of yacc.c  */
 #line 469 "../css/CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createVariablesRule((yyvsp[(3) - (7)].mediaList), true);
@@ -2363,8 +2372,6 @@ yyreduce:
     break;
 
   case 65:
-
-/* Line 1455 of yacc.c  */
 #line 473 "../css/CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createVariablesRule((yyvsp[(3) - (7)].mediaList), false);
@@ -2372,8 +2379,6 @@ yyreduce:
     break;
 
   case 66:
-
-/* Line 1455 of yacc.c  */
 #line 479 "../css/CSSGrammar.y"
     {
         (yyval.mediaList) = static_cast<CSSParser*>(parser)->createMediaList();
@@ -2381,8 +2386,6 @@ yyreduce:
     break;
 
   case 67:
-
-/* Line 1455 of yacc.c  */
 #line 483 "../css/CSSGrammar.y"
     {
         (yyval.mediaList) = (yyvsp[(3) - (3)].mediaList);
@@ -2390,8 +2393,6 @@ yyreduce:
     break;
 
   case 68:
-
-/* Line 1455 of yacc.c  */
 #line 489 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (1)].boolean);
@@ -2399,8 +2400,6 @@ yyreduce:
     break;
 
   case 69:
-
-/* Line 1455 of yacc.c  */
 #line 492 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (2)].boolean);
@@ -2410,8 +2409,6 @@ yyreduce:
     break;
 
   case 70:
-
-/* Line 1455 of yacc.c  */
 #line 497 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (1)].boolean);
@@ -2419,8 +2416,6 @@ yyreduce:
     break;
 
   case 71:
-
-/* Line 1455 of yacc.c  */
 #line 500 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
@@ -2428,8 +2423,6 @@ yyreduce:
     break;
 
   case 72:
-
-/* Line 1455 of yacc.c  */
 #line 503 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
@@ -2437,8 +2430,6 @@ yyreduce:
     break;
 
   case 73:
-
-/* Line 1455 of yacc.c  */
 #line 506 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (2)].boolean);
@@ -2446,8 +2437,6 @@ yyreduce:
     break;
 
   case 74:
-
-/* Line 1455 of yacc.c  */
 #line 512 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (3)].boolean);
@@ -2455,8 +2444,6 @@ yyreduce:
     break;
 
   case 75:
-
-/* Line 1455 of yacc.c  */
 #line 515 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
@@ -2464,8 +2451,6 @@ yyreduce:
     break;
 
   case 76:
-
-/* Line 1455 of yacc.c  */
 #line 518 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
@@ -2473,8 +2458,6 @@ yyreduce:
     break;
 
   case 77:
-
-/* Line 1455 of yacc.c  */
 #line 521 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
@@ -2482,8 +2465,6 @@ yyreduce:
     break;
 
   case 78:
-
-/* Line 1455 of yacc.c  */
 #line 524 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (4)].boolean);
@@ -2493,8 +2474,6 @@ yyreduce:
     break;
 
   case 79:
-
-/* Line 1455 of yacc.c  */
 #line 529 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (4)].boolean);
@@ -2502,8 +2481,6 @@ yyreduce:
     break;
 
   case 80:
-
-/* Line 1455 of yacc.c  */
 #line 532 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (6)].boolean);
@@ -2511,8 +2488,6 @@ yyreduce:
     break;
 
   case 81:
-
-/* Line 1455 of yacc.c  */
 #line 538 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = static_cast<CSSParser*>(parser)->addVariable((yyvsp[(1) - (4)].string), (yyvsp[(4) - (4)].valueList));
@@ -2520,8 +2495,6 @@ yyreduce:
     break;
 
   case 82:
-
-/* Line 1455 of yacc.c  */
 #line 542 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = static_cast<CSSParser*>(parser)->addVariableDeclarationBlock((yyvsp[(1) - (7)].string));
@@ -2529,8 +2502,6 @@ yyreduce:
     break;
 
   case 83:
-
-/* Line 1455 of yacc.c  */
 #line 546 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
@@ -2538,8 +2509,6 @@ yyreduce:
     break;
 
   case 84:
-
-/* Line 1455 of yacc.c  */
 #line 550 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
@@ -2547,8 +2516,6 @@ yyreduce:
     break;
 
   case 85:
-
-/* Line 1455 of yacc.c  */
 #line 554 "../css/CSSGrammar.y"
     {
         /* @variables { varname: } Just reduce away this variable with no value. */
@@ -2557,8 +2524,6 @@ yyreduce:
     break;
 
   case 86:
-
-/* Line 1455 of yacc.c  */
 #line 559 "../css/CSSGrammar.y"
     {
         /* if we come across rules with invalid values like this case: @variables { varname: *; }, just discard the property/value pair */
@@ -2567,8 +2532,6 @@ yyreduce:
     break;
 
   case 87:
-
-/* Line 1455 of yacc.c  */
 #line 566 "../css/CSSGrammar.y"
     {
         (yyval.string) = (yyvsp[(1) - (2)].string);
@@ -2576,8 +2539,6 @@ yyreduce:
     break;
 
   case 88:
-
-/* Line 1455 of yacc.c  */
 #line 572 "../css/CSSGrammar.y"
     {
     CSSParser* p = static_cast<CSSParser*>(parser);
@@ -2587,22 +2548,16 @@ yyreduce:
     break;
 
   case 91:
-
-/* Line 1455 of yacc.c  */
 #line 582 "../css/CSSGrammar.y"
     { (yyval.string).characters = 0; ;}
     break;
 
   case 92:
-
-/* Line 1455 of yacc.c  */
 #line 583 "../css/CSSGrammar.y"
     { (yyval.string) = (yyvsp[(1) - (2)].string); ;}
     break;
 
   case 95:
-
-/* Line 1455 of yacc.c  */
 #line 592 "../css/CSSGrammar.y"
     {
         (yyval.string) = (yyvsp[(1) - (2)].string);
@@ -2610,8 +2565,6 @@ yyreduce:
     break;
 
   case 96:
-
-/* Line 1455 of yacc.c  */
 #line 598 "../css/CSSGrammar.y"
     {
         (yyval.valueList) = 0;
@@ -2619,8 +2572,6 @@ yyreduce:
     break;
 
   case 97:
-
-/* Line 1455 of yacc.c  */
 #line 601 "../css/CSSGrammar.y"
     {
         (yyval.valueList) = (yyvsp[(3) - (4)].valueList);
@@ -2628,8 +2579,6 @@ yyreduce:
     break;
 
   case 98:
-
-/* Line 1455 of yacc.c  */
 #line 607 "../css/CSSGrammar.y"
     {
         (yyvsp[(3) - (7)].string).lower();
@@ -2638,8 +2587,6 @@ yyreduce:
     break;
 
   case 99:
-
-/* Line 1455 of yacc.c  */
 #line 614 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -2649,8 +2596,6 @@ yyreduce:
     break;
 
   case 100:
-
-/* Line 1455 of yacc.c  */
 #line 619 "../css/CSSGrammar.y"
     {
         (yyval.mediaQueryExpList) = (yyvsp[(1) - (5)].mediaQueryExpList);
@@ -2659,8 +2604,6 @@ yyreduce:
     break;
 
   case 101:
-
-/* Line 1455 of yacc.c  */
 #line 626 "../css/CSSGrammar.y"
     {
         (yyval.mediaQueryExpList) = static_cast<CSSParser*>(parser)->createFloatingMediaQueryExpList();
@@ -2668,8 +2611,6 @@ yyreduce:
     break;
 
   case 102:
-
-/* Line 1455 of yacc.c  */
 #line 629 "../css/CSSGrammar.y"
     {
         (yyval.mediaQueryExpList) = (yyvsp[(3) - (3)].mediaQueryExpList);
@@ -2677,8 +2618,6 @@ yyreduce:
     break;
 
   case 103:
-
-/* Line 1455 of yacc.c  */
 #line 635 "../css/CSSGrammar.y"
     {
         (yyval.mediaQueryRestrictor) = MediaQuery::None;
@@ -2686,8 +2625,6 @@ yyreduce:
     break;
 
   case 104:
-
-/* Line 1455 of yacc.c  */
 #line 638 "../css/CSSGrammar.y"
     {
         (yyval.mediaQueryRestrictor) = MediaQuery::Only;
@@ -2695,8 +2632,6 @@ yyreduce:
     break;
 
   case 105:
-
-/* Line 1455 of yacc.c  */
 #line 641 "../css/CSSGrammar.y"
     {
         (yyval.mediaQueryRestrictor) = MediaQuery::Not;
@@ -2704,8 +2639,6 @@ yyreduce:
     break;
 
   case 106:
-
-/* Line 1455 of yacc.c  */
 #line 647 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -2714,8 +2647,6 @@ yyreduce:
     break;
 
   case 107:
-
-/* Line 1455 of yacc.c  */
 #line 652 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -2725,8 +2656,6 @@ yyreduce:
     break;
 
   case 108:
-
-/* Line 1455 of yacc.c  */
 #line 660 "../css/CSSGrammar.y"
     {
         (yyval.mediaList) = static_cast<CSSParser*>(parser)->createMediaList();
@@ -2734,8 +2663,6 @@ yyreduce:
     break;
 
   case 110:
-
-/* Line 1455 of yacc.c  */
 #line 667 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -2745,8 +2672,6 @@ yyreduce:
     break;
 
   case 111:
-
-/* Line 1455 of yacc.c  */
 #line 672 "../css/CSSGrammar.y"
     {
         (yyval.mediaList) = (yyvsp[(1) - (4)].mediaList);
@@ -2756,8 +2681,6 @@ yyreduce:
     break;
 
   case 112:
-
-/* Line 1455 of yacc.c  */
 #line 677 "../css/CSSGrammar.y"
     {
         (yyval.mediaList) = 0;
@@ -2765,8 +2688,6 @@ yyreduce:
     break;
 
   case 113:
-
-/* Line 1455 of yacc.c  */
 #line 683 "../css/CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createMediaRule((yyvsp[(3) - (7)].mediaList), (yyvsp[(6) - (7)].ruleList));
@@ -2774,8 +2695,6 @@ yyreduce:
     break;
 
   case 114:
-
-/* Line 1455 of yacc.c  */
 #line 686 "../css/CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createMediaRule(0, (yyvsp[(5) - (6)].ruleList));
@@ -2783,8 +2702,6 @@ yyreduce:
     break;
 
   case 115:
-
-/* Line 1455 of yacc.c  */
 #line 692 "../css/CSSGrammar.y"
     {
       (yyval.string) = (yyvsp[(1) - (2)].string);
@@ -2792,8 +2709,6 @@ yyreduce:
     break;
 
   case 116:
-
-/* Line 1455 of yacc.c  */
 #line 698 "../css/CSSGrammar.y"
     {
         (yyval.rule) = (yyvsp[(7) - (8)].keyframesRule);
@@ -2802,15 +2717,11 @@ yyreduce:
     break;
 
   case 119:
-
-/* Line 1455 of yacc.c  */
 #line 710 "../css/CSSGrammar.y"
     { (yyval.keyframesRule) = static_cast<CSSParser*>(parser)->createKeyframesRule(); ;}
     break;
 
   case 120:
-
-/* Line 1455 of yacc.c  */
 #line 711 "../css/CSSGrammar.y"
     {
         (yyval.keyframesRule) = (yyvsp[(1) - (3)].keyframesRule);
@@ -2820,8 +2731,6 @@ yyreduce:
     break;
 
   case 121:
-
-/* Line 1455 of yacc.c  */
 #line 719 "../css/CSSGrammar.y"
     {
         (yyval.keyframeRule) = static_cast<CSSParser*>(parser)->createKeyframeRule((yyvsp[(1) - (6)].valueList));
@@ -2829,8 +2738,6 @@ yyreduce:
     break;
 
   case 122:
-
-/* Line 1455 of yacc.c  */
 #line 725 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -2840,8 +2747,6 @@ yyreduce:
     break;
 
   case 123:
-
-/* Line 1455 of yacc.c  */
 #line 730 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -2852,22 +2757,18 @@ yyreduce:
     break;
 
   case 124:
-
-/* Line 1455 of yacc.c  */
 #line 739 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).isInt = false; (yyval.value).fValue = (yyvsp[(1) - (1)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_NUMBER; ;}
     break;
 
   case 125:
-
-/* Line 1455 of yacc.c  */
 #line 740 "../css/CSSGrammar.y"
     {
         (yyval.value).id = 0; (yyval.value).isInt = false; (yyval.value).unit = CSSPrimitiveValue::CSS_NUMBER;
         CSSParserString& str = (yyvsp[(1) - (1)].string);
-        if (equalIgnoringCase(static_cast<const String&>(str), "from"))
+        if (equalIgnoringCase("from", str.characters, str.length))
             (yyval.value).fValue = 0;
-        else if (equalIgnoringCase(static_cast<const String&>(str), "to"))
+        else if (equalIgnoringCase("to", str.characters, str.length))
             (yyval.value).fValue = 100;
         else
             YYERROR;
@@ -2875,8 +2776,6 @@ yyreduce:
     break;
 
   case 126:
-
-/* Line 1455 of yacc.c  */
 #line 764 "../css/CSSGrammar.y"
     {
       (yyval.rule) = 0;
@@ -2884,8 +2783,6 @@ yyreduce:
     break;
 
   case 127:
-
-/* Line 1455 of yacc.c  */
 #line 767 "../css/CSSGrammar.y"
     {
       (yyval.rule) = 0;
@@ -2893,8 +2790,6 @@ yyreduce:
     break;
 
   case 128:
-
-/* Line 1455 of yacc.c  */
 #line 774 "../css/CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createFontFaceRule();
@@ -2902,8 +2797,6 @@ yyreduce:
     break;
 
   case 129:
-
-/* Line 1455 of yacc.c  */
 #line 777 "../css/CSSGrammar.y"
     {
       (yyval.rule) = 0;
@@ -2911,8 +2804,6 @@ yyreduce:
     break;
 
   case 130:
-
-/* Line 1455 of yacc.c  */
 #line 780 "../css/CSSGrammar.y"
     {
       (yyval.rule) = 0;
@@ -2920,43 +2811,31 @@ yyreduce:
     break;
 
   case 131:
-
-/* Line 1455 of yacc.c  */
 #line 786 "../css/CSSGrammar.y"
     { (yyval.relation) = CSSSelector::DirectAdjacent; ;}
     break;
 
   case 132:
-
-/* Line 1455 of yacc.c  */
 #line 787 "../css/CSSGrammar.y"
     { (yyval.relation) = CSSSelector::IndirectAdjacent; ;}
     break;
 
   case 133:
-
-/* Line 1455 of yacc.c  */
 #line 788 "../css/CSSGrammar.y"
     { (yyval.relation) = CSSSelector::Child; ;}
     break;
 
   case 134:
-
-/* Line 1455 of yacc.c  */
 #line 792 "../css/CSSGrammar.y"
     { (yyval.integer) = -1; ;}
     break;
 
   case 135:
-
-/* Line 1455 of yacc.c  */
 #line 793 "../css/CSSGrammar.y"
     { (yyval.integer) = 1; ;}
     break;
 
   case 136:
-
-/* Line 1455 of yacc.c  */
 #line 797 "../css/CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createStyleRule((yyvsp[(1) - (5)].selectorList));
@@ -2964,8 +2843,6 @@ yyreduce:
     break;
 
   case 137:
-
-/* Line 1455 of yacc.c  */
 #line 803 "../css/CSSGrammar.y"
     {
         if ((yyvsp[(1) - (1)].selector)) {
@@ -2979,8 +2856,6 @@ yyreduce:
     break;
 
   case 138:
-
-/* Line 1455 of yacc.c  */
 #line 812 "../css/CSSGrammar.y"
     {
         if ((yyvsp[(1) - (4)].selectorList) && (yyvsp[(4) - (4)].selector)) {
@@ -2993,8 +2868,6 @@ yyreduce:
     break;
 
   case 139:
-
-/* Line 1455 of yacc.c  */
 #line 820 "../css/CSSGrammar.y"
     {
         (yyval.selectorList) = 0;
@@ -3002,8 +2875,6 @@ yyreduce:
     break;
 
   case 140:
-
-/* Line 1455 of yacc.c  */
 #line 826 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(1) - (2)].selector);
@@ -3011,8 +2882,6 @@ yyreduce:
     break;
 
   case 141:
-
-/* Line 1455 of yacc.c  */
 #line 832 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(1) - (1)].selector);
@@ -3020,8 +2889,6 @@ yyreduce:
     break;
 
   case 142:
-
-/* Line 1455 of yacc.c  */
 #line 836 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(1) - (1)].selector);
@@ -3029,8 +2896,6 @@ yyreduce:
     break;
 
   case 143:
-
-/* Line 1455 of yacc.c  */
 #line 840 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(2) - (2)].selector);
@@ -3050,8 +2915,6 @@ yyreduce:
     break;
 
   case 144:
-
-/* Line 1455 of yacc.c  */
 #line 855 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(3) - (3)].selector);
@@ -3076,8 +2939,6 @@ yyreduce:
     break;
 
   case 145:
-
-/* Line 1455 of yacc.c  */
 #line 875 "../css/CSSGrammar.y"
     {
         (yyval.selector) = 0;
@@ -3085,29 +2946,21 @@ yyreduce:
     break;
 
   case 146:
-
-/* Line 1455 of yacc.c  */
 #line 881 "../css/CSSGrammar.y"
     { (yyval.string).characters = 0; (yyval.string).length = 0; ;}
     break;
 
   case 147:
-
-/* Line 1455 of yacc.c  */
 #line 882 "../css/CSSGrammar.y"
     { static UChar star = '*'; (yyval.string).characters = &star; (yyval.string).length = 1; ;}
     break;
 
   case 148:
-
-/* Line 1455 of yacc.c  */
 #line 883 "../css/CSSGrammar.y"
     { (yyval.string) = (yyvsp[(1) - (2)].string); ;}
     break;
 
   case 149:
-
-/* Line 1455 of yacc.c  */
 #line 887 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3117,8 +2970,6 @@ yyreduce:
     break;
 
   case 150:
-
-/* Line 1455 of yacc.c  */
 #line 892 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(2) - (2)].selector);
@@ -3130,8 +2981,6 @@ yyreduce:
     break;
 
   case 151:
-
-/* Line 1455 of yacc.c  */
 #line 899 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(1) - (1)].selector);
@@ -3142,8 +2991,6 @@ yyreduce:
     break;
 
   case 152:
-
-/* Line 1455 of yacc.c  */
 #line 905 "../css/CSSGrammar.y"
     {
         AtomicString namespacePrefix = (yyvsp[(1) - (2)].string);
@@ -3158,8 +3005,6 @@ yyreduce:
     break;
 
   case 153:
-
-/* Line 1455 of yacc.c  */
 #line 915 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(3) - (3)].selector);
@@ -3176,8 +3021,6 @@ yyreduce:
     break;
 
   case 154:
-
-/* Line 1455 of yacc.c  */
 #line 927 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(2) - (2)].selector);
@@ -3192,8 +3035,6 @@ yyreduce:
     break;
 
   case 155:
-
-/* Line 1455 of yacc.c  */
 #line 940 "../css/CSSGrammar.y"
     {
         CSSParserString& str = (yyvsp[(1) - (1)].string);
@@ -3206,8 +3047,6 @@ yyreduce:
     break;
 
   case 156:
-
-/* Line 1455 of yacc.c  */
 #line 948 "../css/CSSGrammar.y"
     {
         static UChar star = '*';
@@ -3217,8 +3056,6 @@ yyreduce:
     break;
 
   case 157:
-
-/* Line 1455 of yacc.c  */
 #line 956 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(1) - (1)].selector);
@@ -3226,8 +3063,6 @@ yyreduce:
     break;
 
   case 158:
-
-/* Line 1455 of yacc.c  */
 #line 959 "../css/CSSGrammar.y"
     {
         if (!(yyvsp[(2) - (2)].selector))
@@ -3245,8 +3080,6 @@ yyreduce:
     break;
 
   case 159:
-
-/* Line 1455 of yacc.c  */
 #line 972 "../css/CSSGrammar.y"
     {
         (yyval.selector) = 0;
@@ -3254,8 +3087,6 @@ yyreduce:
     break;
 
   case 160:
-
-/* Line 1455 of yacc.c  */
 #line 978 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3268,8 +3099,6 @@ yyreduce:
     break;
 
   case 161:
-
-/* Line 1455 of yacc.c  */
 #line 986 "../css/CSSGrammar.y"
     {
         if ((yyvsp[(1) - (1)].string).characters[0] >= '0' && (yyvsp[(1) - (1)].string).characters[0] <= '9') {
@@ -3286,8 +3115,6 @@ yyreduce:
     break;
 
   case 165:
-
-/* Line 1455 of yacc.c  */
 #line 1004 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3300,8 +3127,6 @@ yyreduce:
     break;
 
   case 166:
-
-/* Line 1455 of yacc.c  */
 #line 1015 "../css/CSSGrammar.y"
     {
         CSSParserString& str = (yyvsp[(1) - (2)].string);
@@ -3314,8 +3139,6 @@ yyreduce:
     break;
 
   case 167:
-
-/* Line 1455 of yacc.c  */
 #line 1026 "../css/CSSGrammar.y"
     {
         (yyval.selector) = static_cast<CSSParser*>(parser)->createFloatingSelector();
@@ -3325,8 +3148,6 @@ yyreduce:
     break;
 
   case 168:
-
-/* Line 1455 of yacc.c  */
 #line 1031 "../css/CSSGrammar.y"
     {
         (yyval.selector) = static_cast<CSSParser*>(parser)->createFloatingSelector();
@@ -3337,8 +3158,6 @@ yyreduce:
     break;
 
   case 169:
-
-/* Line 1455 of yacc.c  */
 #line 1037 "../css/CSSGrammar.y"
     {
         AtomicString namespacePrefix = (yyvsp[(3) - (5)].string);
@@ -3351,8 +3170,6 @@ yyreduce:
     break;
 
   case 170:
-
-/* Line 1455 of yacc.c  */
 #line 1045 "../css/CSSGrammar.y"
     {
         AtomicString namespacePrefix = (yyvsp[(3) - (9)].string);
@@ -3366,8 +3183,6 @@ yyreduce:
     break;
 
   case 171:
-
-/* Line 1455 of yacc.c  */
 #line 1057 "../css/CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::Exact;
@@ -3375,8 +3190,6 @@ yyreduce:
     break;
 
   case 172:
-
-/* Line 1455 of yacc.c  */
 #line 1060 "../css/CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::List;
@@ -3384,8 +3197,6 @@ yyreduce:
     break;
 
   case 173:
-
-/* Line 1455 of yacc.c  */
 #line 1063 "../css/CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::Hyphen;
@@ -3393,8 +3204,6 @@ yyreduce:
     break;
 
   case 174:
-
-/* Line 1455 of yacc.c  */
 #line 1066 "../css/CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::Begin;
@@ -3402,8 +3211,6 @@ yyreduce:
     break;
 
   case 175:
-
-/* Line 1455 of yacc.c  */
 #line 1069 "../css/CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::End;
@@ -3411,8 +3218,6 @@ yyreduce:
     break;
 
   case 176:
-
-/* Line 1455 of yacc.c  */
 #line 1072 "../css/CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::Contain;
@@ -3420,8 +3225,6 @@ yyreduce:
     break;
 
   case 179:
-
-/* Line 1455 of yacc.c  */
 #line 1083 "../css/CSSGrammar.y"
     {
         (yyval.selector) = static_cast<CSSParser*>(parser)->createFloatingSelector();
@@ -3456,8 +3259,6 @@ yyreduce:
     break;
 
   case 180:
-
-/* Line 1455 of yacc.c  */
 #line 1113 "../css/CSSGrammar.y"
     {
         (yyval.selector) = static_cast<CSSParser*>(parser)->createFloatingSelector();
@@ -3481,8 +3282,6 @@ yyreduce:
     break;
 
   case 181:
-
-/* Line 1455 of yacc.c  */
 #line 1133 "../css/CSSGrammar.y"
     {
         CSSParser *p = static_cast<CSSParser*>(parser);
@@ -3504,8 +3303,6 @@ yyreduce:
     break;
 
   case 182:
-
-/* Line 1455 of yacc.c  */
 #line 1151 "../css/CSSGrammar.y"
     {
         CSSParser *p = static_cast<CSSParser*>(parser);
@@ -3527,8 +3324,6 @@ yyreduce:
     break;
 
   case 183:
-
-/* Line 1455 of yacc.c  */
 #line 1169 "../css/CSSGrammar.y"
     {
         CSSParser *p = static_cast<CSSParser*>(parser);
@@ -3551,8 +3346,6 @@ yyreduce:
     break;
 
   case 184:
-
-/* Line 1455 of yacc.c  */
 #line 1188 "../css/CSSGrammar.y"
     {
         if (!(yyvsp[(4) - (6)].selector) || (yyvsp[(4) - (6)].selector)->simpleSelector() || (yyvsp[(4) - (6)].selector)->tagHistory())
@@ -3569,8 +3362,6 @@ yyreduce:
     break;
 
   case 185:
-
-/* Line 1455 of yacc.c  */
 #line 1203 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (1)].boolean);
@@ -3578,8 +3369,6 @@ yyreduce:
     break;
 
   case 186:
-
-/* Line 1455 of yacc.c  */
 #line 1206 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (2)].boolean);
@@ -3589,8 +3378,6 @@ yyreduce:
     break;
 
   case 187:
-
-/* Line 1455 of yacc.c  */
 #line 1211 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (1)].boolean);
@@ -3598,8 +3385,6 @@ yyreduce:
     break;
 
   case 188:
-
-/* Line 1455 of yacc.c  */
 #line 1214 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
@@ -3607,8 +3392,6 @@ yyreduce:
     break;
 
   case 189:
-
-/* Line 1455 of yacc.c  */
 #line 1217 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
@@ -3616,8 +3399,6 @@ yyreduce:
     break;
 
   case 190:
-
-/* Line 1455 of yacc.c  */
 #line 1220 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (2)].boolean);
@@ -3625,8 +3406,6 @@ yyreduce:
     break;
 
   case 191:
-
-/* Line 1455 of yacc.c  */
 #line 1223 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (2)].boolean);
@@ -3634,8 +3413,6 @@ yyreduce:
     break;
 
   case 192:
-
-/* Line 1455 of yacc.c  */
 #line 1229 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (3)].boolean);
@@ -3643,8 +3420,6 @@ yyreduce:
     break;
 
   case 193:
-
-/* Line 1455 of yacc.c  */
 #line 1232 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
@@ -3652,8 +3427,6 @@ yyreduce:
     break;
 
   case 194:
-
-/* Line 1455 of yacc.c  */
 #line 1235 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
@@ -3661,8 +3434,6 @@ yyreduce:
     break;
 
   case 195:
-
-/* Line 1455 of yacc.c  */
 #line 1238 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
@@ -3670,8 +3441,6 @@ yyreduce:
     break;
 
   case 196:
-
-/* Line 1455 of yacc.c  */
 #line 1241 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (4)].boolean);
@@ -3681,8 +3450,6 @@ yyreduce:
     break;
 
   case 197:
-
-/* Line 1455 of yacc.c  */
 #line 1246 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (4)].boolean);
@@ -3690,8 +3457,6 @@ yyreduce:
     break;
 
   case 198:
-
-/* Line 1455 of yacc.c  */
 #line 1249 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (6)].boolean);
@@ -3699,8 +3464,6 @@ yyreduce:
     break;
 
   case 199:
-
-/* Line 1455 of yacc.c  */
 #line 1255 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
@@ -3718,8 +3481,6 @@ yyreduce:
     break;
 
   case 200:
-
-/* Line 1455 of yacc.c  */
 #line 1269 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3735,8 +3496,6 @@ yyreduce:
     break;
 
   case 201:
-
-/* Line 1455 of yacc.c  */
 #line 1281 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
@@ -3744,8 +3503,6 @@ yyreduce:
     break;
 
   case 202:
-
-/* Line 1455 of yacc.c  */
 #line 1285 "../css/CSSGrammar.y"
     {
         /* The default movable type template has letter-spacing: .none;  Handle this by looking for
@@ -3756,8 +3513,6 @@ yyreduce:
     break;
 
   case 203:
-
-/* Line 1455 of yacc.c  */
 #line 1292 "../css/CSSGrammar.y"
     {
         /* When we encounter something like p {color: red !important fail;} we should drop the declaration */
@@ -3766,8 +3521,6 @@ yyreduce:
     break;
 
   case 204:
-
-/* Line 1455 of yacc.c  */
 #line 1297 "../css/CSSGrammar.y"
     {
         /* Handle this case: div { text-align: center; !important } Just reduce away the stray !important. */
@@ -3776,8 +3529,6 @@ yyreduce:
     break;
 
   case 205:
-
-/* Line 1455 of yacc.c  */
 #line 1302 "../css/CSSGrammar.y"
     {
         /* div { font-family: } Just reduce away this property with no value. */
@@ -3786,8 +3537,6 @@ yyreduce:
     break;
 
   case 206:
-
-/* Line 1455 of yacc.c  */
 #line 1307 "../css/CSSGrammar.y"
     {
         /* if we come across rules with invalid values like this case: p { weight: *; }, just discard the rule */
@@ -3796,8 +3545,6 @@ yyreduce:
     break;
 
   case 207:
-
-/* Line 1455 of yacc.c  */
 #line 1312 "../css/CSSGrammar.y"
     {
         /* if we come across: div { color{;color:maroon} }, ignore everything within curly brackets */
@@ -3806,8 +3553,6 @@ yyreduce:
     break;
 
   case 208:
-
-/* Line 1455 of yacc.c  */
 #line 1319 "../css/CSSGrammar.y"
     {
         (yyval.integer) = cssPropertyID((yyvsp[(1) - (2)].string));
@@ -3815,22 +3560,16 @@ yyreduce:
     break;
 
   case 209:
-
-/* Line 1455 of yacc.c  */
 #line 1325 "../css/CSSGrammar.y"
     { (yyval.boolean) = true; ;}
     break;
 
   case 210:
-
-/* Line 1455 of yacc.c  */
 #line 1326 "../css/CSSGrammar.y"
     { (yyval.boolean) = false; ;}
     break;
 
   case 211:
-
-/* Line 1455 of yacc.c  */
 #line 1330 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3840,8 +3579,6 @@ yyreduce:
     break;
 
   case 212:
-
-/* Line 1455 of yacc.c  */
 #line 1335 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3860,8 +3597,6 @@ yyreduce:
     break;
 
   case 213:
-
-/* Line 1455 of yacc.c  */
 #line 1349 "../css/CSSGrammar.y"
     {
         (yyval.valueList) = 0;
@@ -3869,8 +3604,6 @@ yyreduce:
     break;
 
   case 214:
-
-/* Line 1455 of yacc.c  */
 #line 1355 "../css/CSSGrammar.y"
     {
         (yyval.character) = '/';
@@ -3878,8 +3611,6 @@ yyreduce:
     break;
 
   case 215:
-
-/* Line 1455 of yacc.c  */
 #line 1358 "../css/CSSGrammar.y"
     {
         (yyval.character) = ',';
@@ -3887,8 +3618,6 @@ yyreduce:
     break;
 
   case 216:
-
-/* Line 1455 of yacc.c  */
 #line 1361 "../css/CSSGrammar.y"
     {
         (yyval.character) = 0;
@@ -3896,29 +3625,21 @@ yyreduce:
     break;
 
   case 217:
-
-/* Line 1455 of yacc.c  */
 #line 1367 "../css/CSSGrammar.y"
     { (yyval.value) = (yyvsp[(1) - (1)].value); ;}
     break;
 
   case 218:
-
-/* Line 1455 of yacc.c  */
 #line 1368 "../css/CSSGrammar.y"
     { (yyval.value) = (yyvsp[(2) - (2)].value); (yyval.value).fValue *= (yyvsp[(1) - (2)].integer); ;}
     break;
 
   case 219:
-
-/* Line 1455 of yacc.c  */
 #line 1369 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(1) - (2)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_STRING; ;}
     break;
 
   case 220:
-
-/* Line 1455 of yacc.c  */
 #line 1370 "../css/CSSGrammar.y"
     {
       (yyval.value).id = cssValueKeywordID((yyvsp[(1) - (2)].string));
@@ -3928,50 +3649,36 @@ yyreduce:
     break;
 
   case 221:
-
-/* Line 1455 of yacc.c  */
 #line 1376 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(1) - (2)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_DIMENSION; ;}
     break;
 
   case 222:
-
-/* Line 1455 of yacc.c  */
 #line 1377 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(2) - (3)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_DIMENSION; ;}
     break;
 
   case 223:
-
-/* Line 1455 of yacc.c  */
 #line 1378 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(1) - (2)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_URI; ;}
     break;
 
   case 224:
-
-/* Line 1455 of yacc.c  */
 #line 1379 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(1) - (2)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_UNICODE_RANGE; ;}
     break;
 
   case 225:
-
-/* Line 1455 of yacc.c  */
 #line 1380 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(1) - (1)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_PARSER_HEXCOLOR; ;}
     break;
 
   case 226:
-
-/* Line 1455 of yacc.c  */
 #line 1381 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).string = CSSParserString(); (yyval.value).unit = CSSPrimitiveValue::CSS_PARSER_HEXCOLOR; ;}
     break;
 
   case 227:
-
-/* Line 1455 of yacc.c  */
 #line 1383 "../css/CSSGrammar.y"
     {
       (yyval.value) = (yyvsp[(1) - (1)].value);
@@ -3979,8 +3686,6 @@ yyreduce:
     break;
 
   case 228:
-
-/* Line 1455 of yacc.c  */
 #line 1386 "../css/CSSGrammar.y"
     {
       (yyval.value) = (yyvsp[(1) - (2)].value);
@@ -3988,8 +3693,6 @@ yyreduce:
     break;
 
   case 229:
-
-/* Line 1455 of yacc.c  */
 #line 1389 "../css/CSSGrammar.y"
     { /* Handle width: %; */
       (yyval.value).id = 0; (yyval.value).unit = 0;
@@ -3997,148 +3700,106 @@ yyreduce:
     break;
 
   case 230:
-
-/* Line 1455 of yacc.c  */
 #line 1395 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).isInt = true; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_NUMBER; ;}
     break;
 
   case 231:
-
-/* Line 1455 of yacc.c  */
 #line 1396 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).isInt = false; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_NUMBER; ;}
     break;
 
   case 232:
-
-/* Line 1455 of yacc.c  */
 #line 1397 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_PERCENTAGE; ;}
     break;
 
   case 233:
-
-/* Line 1455 of yacc.c  */
 #line 1398 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_PX; ;}
     break;
 
   case 234:
-
-/* Line 1455 of yacc.c  */
 #line 1399 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_CM; ;}
     break;
 
   case 235:
-
-/* Line 1455 of yacc.c  */
 #line 1400 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_MM; ;}
     break;
 
   case 236:
-
-/* Line 1455 of yacc.c  */
 #line 1401 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_IN; ;}
     break;
 
   case 237:
-
-/* Line 1455 of yacc.c  */
 #line 1402 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_PT; ;}
     break;
 
   case 238:
-
-/* Line 1455 of yacc.c  */
 #line 1403 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_PC; ;}
     break;
 
   case 239:
-
-/* Line 1455 of yacc.c  */
 #line 1404 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_DEG; ;}
     break;
 
   case 240:
-
-/* Line 1455 of yacc.c  */
 #line 1405 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_RAD; ;}
     break;
 
   case 241:
-
-/* Line 1455 of yacc.c  */
 #line 1406 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_GRAD; ;}
     break;
 
   case 242:
-
-/* Line 1455 of yacc.c  */
 #line 1407 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_TURN; ;}
     break;
 
   case 243:
-
-/* Line 1455 of yacc.c  */
 #line 1408 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_MS; ;}
     break;
 
   case 244:
-
-/* Line 1455 of yacc.c  */
 #line 1409 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_S; ;}
     break;
 
   case 245:
-
-/* Line 1455 of yacc.c  */
 #line 1410 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_HZ; ;}
     break;
 
   case 246:
-
-/* Line 1455 of yacc.c  */
 #line 1411 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_KHZ; ;}
     break;
 
   case 247:
-
-/* Line 1455 of yacc.c  */
 #line 1412 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_EMS; ;}
     break;
 
   case 248:
-
-/* Line 1455 of yacc.c  */
 #line 1413 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSParserValue::Q_EMS; ;}
     break;
 
   case 249:
-
-/* Line 1455 of yacc.c  */
 #line 1414 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_EXS; ;}
     break;
 
   case 250:
-
-/* Line 1455 of yacc.c  */
 #line 1415 "../css/CSSGrammar.y"
     {
       (yyval.value).id = 0;
@@ -4151,8 +3812,6 @@ yyreduce:
     break;
 
   case 251:
-
-/* Line 1455 of yacc.c  */
 #line 1426 "../css/CSSGrammar.y"
     {
       (yyval.value).id = 0;
@@ -4162,8 +3821,6 @@ yyreduce:
     break;
 
   case 252:
-
-/* Line 1455 of yacc.c  */
 #line 1434 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -4177,8 +3834,6 @@ yyreduce:
     break;
 
   case 253:
-
-/* Line 1455 of yacc.c  */
 #line 1443 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -4192,22 +3847,16 @@ yyreduce:
     break;
 
   case 254:
-
-/* Line 1455 of yacc.c  */
 #line 1459 "../css/CSSGrammar.y"
     { (yyval.string) = (yyvsp[(1) - (2)].string); ;}
     break;
 
   case 255:
-
-/* Line 1455 of yacc.c  */
 #line 1460 "../css/CSSGrammar.y"
     { (yyval.string) = (yyvsp[(1) - (2)].string); ;}
     break;
 
   case 256:
-
-/* Line 1455 of yacc.c  */
 #line 1467 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
@@ -4215,8 +3864,6 @@ yyreduce:
     break;
 
   case 257:
-
-/* Line 1455 of yacc.c  */
 #line 1470 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
@@ -4224,8 +3871,6 @@ yyreduce:
     break;
 
   case 258:
-
-/* Line 1455 of yacc.c  */
 #line 1476 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
@@ -4233,8 +3878,6 @@ yyreduce:
     break;
 
   case 259:
-
-/* Line 1455 of yacc.c  */
 #line 1479 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
@@ -4242,8 +3885,6 @@ yyreduce:
     break;
 
   case 262:
-
-/* Line 1455 of yacc.c  */
 #line 1490 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
@@ -4251,8 +3892,6 @@ yyreduce:
     break;
 
   case 263:
-
-/* Line 1455 of yacc.c  */
 #line 1496 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
@@ -4260,8 +3899,6 @@ yyreduce:
     break;
 
   case 264:
-
-/* Line 1455 of yacc.c  */
 #line 1502 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
@@ -4269,9 +3906,8 @@ yyreduce:
     break;
 
 
-
-/* Line 1455 of yacc.c  */
-#line 4275 "WebCore/tmp/../generated/CSSGrammar.tab.c"
+/* Line 1267 of yacc.c.  */
+#line 3911 "WebCore/tmp/../generated/CSSGrammar.tab.c"
       default: break;
     }
   YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
@@ -4282,6 +3918,7 @@ yyreduce:
 
   *++yyvsp = yyval;
 
+
   /* Now `shift' the result of the reduction.  Determine what state
      that goes to, based on the state we popped back to and the rule
      number reduced by.  */
@@ -4346,7 +3983,7 @@ yyerrlab:
 
   if (yyerrstatus == 3)
     {
-      /* If just tried and failed to reuse lookahead token after an
+      /* If just tried and failed to reuse look-ahead token after an
 	 error, discard it.  */
 
       if (yychar <= YYEOF)
@@ -4363,7 +4000,7 @@ yyerrlab:
 	}
     }
 
-  /* Else will try to reuse lookahead token after shifting the error
+  /* Else will try to reuse look-ahead token after shifting the error
      token.  */
   goto yyerrlab1;
 
@@ -4420,6 +4057,9 @@ yyerrlab1:
       YY_STACK_PRINT (yyss, yyssp);
     }
 
+  if (yyn == YYFINAL)
+    YYACCEPT;
+
   *++yyvsp = yylval;
 
 
@@ -4444,7 +4084,7 @@ yyabortlab:
   yyresult = 1;
   goto yyreturn;
 
-#if !defined(yyoverflow) || YYERROR_VERBOSE
+#ifndef yyoverflow
 /*-------------------------------------------------.
 | yyexhaustedlab -- memory exhaustion comes here.  |
 `-------------------------------------------------*/
@@ -4455,7 +4095,7 @@ yyexhaustedlab:
 #endif
 
 yyreturn:
-  if (yychar != YYEMPTY)
+  if (yychar != YYEOF && yychar != YYEMPTY)
      yydestruct ("Cleanup: discarding lookahead",
 		 yytoken, &yylval);
   /* Do not reclaim the symbols of the rule which action triggered
@@ -4481,8 +4121,6 @@ yyreturn:
 }
 
 
-
-/* Line 1675 of yacc.c  */
 #line 1529 "../css/CSSGrammar.y"
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSGrammar.h b/src/3rdparty/webkit/WebCore/generated/CSSGrammar.h
index ad6b20a..e718f52 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSGrammar.h
+++ b/src/3rdparty/webkit/WebCore/generated/CSSGrammar.h
@@ -1,25 +1,26 @@
 #ifndef CSSGRAMMAR_H
 #define CSSGRAMMAR_H
-
-/* A Bison parser, made by GNU Bison 2.4.1.  */
+/* A Bison parser, made by GNU Bison 2.3.  */
 
 /* Skeleton interface for Bison's Yacc-like parsers in C
-   
-      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
+
+   Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
    Free Software Foundation, Inc.
-   
-   This program is free software: you can redistribute it and/or modify
+
+   This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation, either version 3 of the License, or
-   (at your option) any later version.
-   
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
-   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin Street, Fifth Floor,
+   Boston, MA 02110-1301, USA.  */
 
 /* As a special exception, you may create a larger work that contains
    part or all of the Bison parser skeleton and distribute that work
@@ -30,11 +31,10 @@
    special exception, which will cause the skeleton and the resulting
    Bison output files to be licensed under the GNU General Public
    License without this special exception.
-   
+
    This special exception was added by the Free Software Foundation in
    version 2.2 of Bison.  */
 
-
 /* Tokens.  */
 #ifndef YYTOKENTYPE
 # define YYTOKENTYPE
@@ -107,16 +107,79 @@
      VARCALL = 320
    };
 #endif
+/* Tokens.  */
+#define TOKEN_EOF 0
+#define LOWEST_PREC 258
+#define UNIMPORTANT_TOK 259
+#define WHITESPACE 260
+#define SGML_CD 261
+#define INCLUDES 262
+#define DASHMATCH 263
+#define BEGINSWITH 264
+#define ENDSWITH 265
+#define CONTAINS 266
+#define STRING 267
+#define IDENT 268
+#define NTH 269
+#define HEX 270
+#define IDSEL 271
+#define IMPORT_SYM 272
+#define PAGE_SYM 273
+#define MEDIA_SYM 274
+#define FONT_FACE_SYM 275
+#define CHARSET_SYM 276
+#define NAMESPACE_SYM 277
+#define WEBKIT_RULE_SYM 278
+#define WEBKIT_DECLS_SYM 279
+#define WEBKIT_KEYFRAME_RULE_SYM 280
+#define WEBKIT_KEYFRAMES_SYM 281
+#define WEBKIT_VALUE_SYM 282
+#define WEBKIT_MEDIAQUERY_SYM 283
+#define WEBKIT_SELECTOR_SYM 284
+#define WEBKIT_VARIABLES_SYM 285
+#define WEBKIT_DEFINE_SYM 286
+#define VARIABLES_FOR 287
+#define WEBKIT_VARIABLES_DECLS_SYM 288
+#define ATKEYWORD 289
+#define IMPORTANT_SYM 290
+#define MEDIA_ONLY 291
+#define MEDIA_NOT 292
+#define MEDIA_AND 293
+#define REMS 294
+#define QEMS 295
+#define EMS 296
+#define EXS 297
+#define PXS 298
+#define CMS 299
+#define MMS 300
+#define INS 301
+#define PTS 302
+#define PCS 303
+#define DEGS 304
+#define RADS 305
+#define GRADS 306
+#define TURNS 307
+#define MSECS 308
+#define SECS 309
+#define HERZ 310
+#define KHERZ 311
+#define DIMEN 312
+#define PERCENTAGE 313
+#define FLOATTOKEN 314
+#define INTEGER 315
+#define URI 316
+#define FUNCTION 317
+#define NOTFUNCTION 318
+#define UNICODERANGE 319
+#define VARCALL 320
+
 
 
 
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
-{
-
-/* Line 1676 of yacc.c  */
 #line 62 "../css/CSSGrammar.y"
-
+{
     bool boolean;
     char character;
     int integer;
@@ -138,18 +201,15 @@ typedef union YYSTYPE
     WebKitCSSKeyframeRule* keyframeRule;
     WebKitCSSKeyframesRule* keyframesRule;
     float val;
-
-
-
-/* Line 1676 of yacc.c  */
-#line 144 "WebCore/tmp/../generated/CSSGrammar.tab.h"
-} YYSTYPE;
-# define YYSTYPE_IS_TRIVIAL 1
+}
+/* Line 1489 of yacc.c.  */
+#line 205 "WebCore/tmp/../generated/CSSGrammar.tab.h"
+	YYSTYPE;
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
+# define YYSTYPE_IS_TRIVIAL 1
 #endif
 
 
 
-
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp
index 65b49d6..d4e26cc 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp
@@ -37,7 +37,7 @@ struct props {
     const char* name;
     int id;
 };
-/* maximum key range = 1853, duplicates = 0 */
+/* maximum key range = 1808, duplicates = 0 */
 
 #ifdef __GNUC__
 __inline
@@ -51,32 +51,32 @@ hash_prop (register const char *str, register unsigned int len)
 {
   static const unsigned short asso_values[] =
     {
-      1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859,
-      1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859,
-      1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859,
-      1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859,
-      1859, 1859, 1859, 1859, 1859,    0, 1859, 1859, 1859, 1859,
-      1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859,
-      1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859,
-      1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859,
-      1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859,
-      1859, 1859, 1859, 1859, 1859, 1859, 1859,    5,    0,   75,
-         0,    0,  355,    5,  315,    0,    0,    0,  105,    0,
-         5,    0,   55,   20,    5,   25,    0,  140,   30,   15,
-       420,  395,   10, 1859, 1859, 1859, 1859, 1859, 1859, 1859,
-      1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859,
-      1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859,
-      1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859,
-      1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859,
-      1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859,
-      1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859,
-      1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859,
-      1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859,
-      1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859,
-      1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859,
-      1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859,
-      1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859, 1859,
-      1859, 1859, 1859, 1859, 1859, 1859
+      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
+      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
+      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
+      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
+      1814, 1814, 1814, 1814, 1814,    0, 1814, 1814, 1814, 1814,
+      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
+      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
+      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
+      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
+      1814, 1814, 1814, 1814, 1814, 1814, 1814,    5,    0,   75,
+         0,    0,  345,    5,  315,    0,   10,    0,  105,    0,
+         5,    0,   55,   30,    5,   25,    0,  140,   75,   15,
+       375,  395,   10, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
+      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
+      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
+      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
+      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
+      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
+      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
+      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
+      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
+      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
+      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
+      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
+      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
+      1814, 1814, 1814, 1814, 1814, 1814
     };
   register int hval = len;
 
@@ -226,556 +226,570 @@ findProp (register const char *str, register unsigned int len)
 {
   enum
     {
-      TOTAL_KEYWORDS = 271,
+      TOTAL_KEYWORDS = 278,
       MIN_WORD_LENGTH = 3,
       MAX_WORD_LENGTH = 43,
       MIN_HASH_VALUE = 6,
-      MAX_HASH_VALUE = 1858
+      MAX_HASH_VALUE = 1813
     };
 
   static const struct props wordlist_prop[] =
     {
-#line 42 "CSSPropertyNames.gperf"
+#line 50 "CSSPropertyNames.gperf"
       {"bottom", CSSPropertyBottom},
-#line 140 "CSSPropertyNames.gperf"
+#line 148 "CSSPropertyNames.gperf"
       {"zoom", CSSPropertyZoom},
-#line 20 "CSSPropertyNames.gperf"
+#line 23 "CSSPropertyNames.gperf"
       {"border", CSSPropertyBorder},
-#line 259 "CSSPropertyNames.gperf"
+#line 266 "CSSPropertyNames.gperf"
       {"marker", CSSPropertyMarker},
-#line 21 "CSSPropertyNames.gperf"
+#line 24 "CSSPropertyNames.gperf"
       {"border-bottom", CSSPropertyBorderBottom},
-#line 261 "CSSPropertyNames.gperf"
+#line 268 "CSSPropertyNames.gperf"
       {"marker-mid", CSSPropertyMarkerMid},
-#line 71 "CSSPropertyNames.gperf"
+#line 79 "CSSPropertyNames.gperf"
       {"margin", CSSPropertyMargin},
-#line 278 "CSSPropertyNames.gperf"
+#line 285 "CSSPropertyNames.gperf"
       {"kerning", CSSPropertyKerning},
-#line 260 "CSSPropertyNames.gperf"
+#line 267 "CSSPropertyNames.gperf"
       {"marker-end", CSSPropertyMarkerEnd},
-#line 72 "CSSPropertyNames.gperf"
+#line 80 "CSSPropertyNames.gperf"
       {"margin-bottom", CSSPropertyMarginBottom},
-#line 243 "CSSPropertyNames.gperf"
+#line 250 "CSSPropertyNames.gperf"
       {"mask", CSSPropertyMask},
-#line 264 "CSSPropertyNames.gperf"
+#line 271 "CSSPropertyNames.gperf"
       {"stroke", CSSPropertyStroke},
-#line 104 "CSSPropertyNames.gperf"
+#line 112 "CSSPropertyNames.gperf"
       {"size", CSSPropertySize},
-#line 136 "CSSPropertyNames.gperf"
+#line 144 "CSSPropertyNames.gperf"
       {"word-break", CSSPropertyWordBreak},
-#line 280 "CSSPropertyNames.gperf"
+#line 287 "CSSPropertyNames.gperf"
       {"writing-mode", CSSPropertyWritingMode},
-#line 154 "CSSPropertyNames.gperf"
+#line 162 "CSSPropertyNames.gperf"
       {"-webkit-binding", CSSPropertyWebkitBinding},
-#line 102 "CSSPropertyNames.gperf"
+#line 110 "CSSPropertyNames.gperf"
       {"resize", CSSPropertyResize},
-#line 258 "CSSPropertyNames.gperf"
+#line 265 "CSSPropertyNames.gperf"
       {"image-rendering", CSSPropertyImageRendering},
-#line 141 "CSSPropertyNames.gperf"
+#line 149 "CSSPropertyNames.gperf"
       {"-webkit-animation", CSSPropertyWebkitAnimation},
-#line 159 "CSSPropertyNames.gperf"
+#line 165 "CSSPropertyNames.gperf"
       {"-webkit-border-image", CSSPropertyWebkitBorderImage},
-#line 199 "CSSPropertyNames.gperf"
+#line 204 "CSSPropertyNames.gperf"
       {"-webkit-mask", CSSPropertyWebkitMask},
-#line 128 "CSSPropertyNames.gperf"
+#line 136 "CSSPropertyNames.gperf"
       {"top", CSSPropertyTop},
-#line 134 "CSSPropertyNames.gperf"
+#line 142 "CSSPropertyNames.gperf"
       {"widows", CSSPropertyWidows},
-#line 262 "CSSPropertyNames.gperf"
+#line 269 "CSSPropertyNames.gperf"
       {"marker-start", CSSPropertyMarkerStart},
-#line 146 "CSSPropertyNames.gperf"
+#line 154 "CSSPropertyNames.gperf"
       {"-webkit-animation-name", CSSPropertyWebkitAnimationName},
-#line 95 "CSSPropertyNames.gperf"
+#line 103 "CSSPropertyNames.gperf"
       {"page", CSSPropertyPage},
-#line 204 "CSSPropertyNames.gperf"
+#line 209 "CSSPropertyNames.gperf"
       {"-webkit-mask-image", CSSPropertyWebkitMaskImage},
-#line 37 "CSSPropertyNames.gperf"
+#line 43 "CSSPropertyNames.gperf"
       {"border-top", CSSPropertyBorderTop},
-#line 90 "CSSPropertyNames.gperf"
+#line 98 "CSSPropertyNames.gperf"
       {"padding", CSSPropertyPadding},
-#line 232 "CSSPropertyNames.gperf"
+#line 239 "CSSPropertyNames.gperf"
       {"-webkit-transition", CSSPropertyWebkitTransition},
-#line 205 "CSSPropertyNames.gperf"
+#line 210 "CSSPropertyNames.gperf"
       {"-webkit-mask-origin", CSSPropertyWebkitMaskOrigin},
-#line 91 "CSSPropertyNames.gperf"
+#line 99 "CSSPropertyNames.gperf"
       {"padding-bottom", CSSPropertyPaddingBottom},
-#line 75 "CSSPropertyNames.gperf"
+#line 83 "CSSPropertyNames.gperf"
       {"margin-top", CSSPropertyMarginTop},
-#line 191 "CSSPropertyNames.gperf"
+#line 196 "CSSPropertyNames.gperf"
       {"-webkit-margin-start", CSSPropertyWebkitMarginStart},
-#line 48 "CSSPropertyNames.gperf"
+#line 56 "CSSPropertyNames.gperf"
       {"content", CSSPropertyContent},
-#line 100 "CSSPropertyNames.gperf"
+#line 108 "CSSPropertyNames.gperf"
       {"position", CSSPropertyPosition},
-#line 52 "CSSPropertyNames.gperf"
+#line 60 "CSSPropertyNames.gperf"
       {"direction", CSSPropertyDirection},
-#line 210 "CSSPropertyNames.gperf"
+#line 217 "CSSPropertyNames.gperf"
       {"-webkit-mask-size", CSSPropertyWebkitMaskSize},
-#line 105 "CSSPropertyNames.gperf"
+#line 113 "CSSPropertyNames.gperf"
       {"src", CSSPropertySrc},
-#line 138 "CSSPropertyNames.gperf"
+#line 146 "CSSPropertyNames.gperf"
       {"word-wrap", CSSPropertyWordWrap},
-#line 212 "CSSPropertyNames.gperf"
+#line 219 "CSSPropertyNames.gperf"
       {"-webkit-nbsp-mode", CSSPropertyWebkitNbspMode},
-#line 98 "CSSPropertyNames.gperf"
+#line 106 "CSSPropertyNames.gperf"
       {"page-break-inside", CSSPropertyPageBreakInside},
-#line 209 "CSSPropertyNames.gperf"
+#line 214 "CSSPropertyNames.gperf"
       {"-webkit-mask-repeat", CSSPropertyWebkitMaskRepeat},
-#line 94 "CSSPropertyNames.gperf"
+#line 102 "CSSPropertyNames.gperf"
       {"padding-top", CSSPropertyPaddingTop},
-#line 99 "CSSPropertyNames.gperf"
-      {"pointer-events", CSSPropertyPointerEvents},
-#line 213 "CSSPropertyNames.gperf"
+#line 220 "CSSPropertyNames.gperf"
       {"-webkit-padding-start", CSSPropertyWebkitPaddingStart},
-#line 143 "CSSPropertyNames.gperf"
+#line 151 "CSSPropertyNames.gperf"
       {"-webkit-animation-direction", CSSPropertyWebkitAnimationDirection},
-#line 206 "CSSPropertyNames.gperf"
+#line 211 "CSSPropertyNames.gperf"
       {"-webkit-mask-position", CSSPropertyWebkitMaskPosition},
-#line 187 "CSSPropertyNames.gperf"
+#line 192 "CSSPropertyNames.gperf"
       {"-webkit-line-break", CSSPropertyWebkitLineBreak},
-#line 269 "CSSPropertyNames.gperf"
+#line 276 "CSSPropertyNames.gperf"
       {"stroke-miterlimit", CSSPropertyStrokeMiterlimit},
-#line 268 "CSSPropertyNames.gperf"
-      {"stroke-linejoin", CSSPropertyStrokeLinejoin},
-#line 218 "CSSPropertyNames.gperf"
+#line 225 "CSSPropertyNames.gperf"
       {"-webkit-rtl-ordering", CSSPropertyWebkitRtlOrdering},
 #line 275 "CSSPropertyNames.gperf"
+      {"stroke-linejoin", CSSPropertyStrokeLinejoin},
+#line 282 "CSSPropertyNames.gperf"
       {"dominant-baseline", CSSPropertyDominantBaseline},
-#line 44 "CSSPropertyNames.gperf"
+#line 52 "CSSPropertyNames.gperf"
       {"caption-side", CSSPropertyCaptionSide},
-#line 47 "CSSPropertyNames.gperf"
+#line 107 "CSSPropertyNames.gperf"
+      {"pointer-events", CSSPropertyPointerEvents},
+#line 55 "CSSPropertyNames.gperf"
       {"color", CSSPropertyColor},
-#line 101 "CSSPropertyNames.gperf"
-      {"quotes", CSSPropertyQuotes},
-#line 35 "CSSPropertyNames.gperf"
+#line 41 "CSSPropertyNames.gperf"
       {"border-spacing", CSSPropertyBorderSpacing},
-#line 45 "CSSPropertyNames.gperf"
+#line 53 "CSSPropertyNames.gperf"
       {"clear", CSSPropertyClear},
-#line 193 "CSSPropertyNames.gperf"
-      {"-webkit-marquee", CSSPropertyWebkitMarquee},
-#line 137 "CSSPropertyNames.gperf"
+#line 36 "CSSPropertyNames.gperf"
+      {"border-radius", CSSPropertyBorderRadius},
+#line 109 "CSSPropertyNames.gperf"
+      {"quotes", CSSPropertyQuotes},
+#line 145 "CSSPropertyNames.gperf"
       {"word-spacing", CSSPropertyWordSpacing},
-#line 26 "CSSPropertyNames.gperf"
+#line 31 "CSSPropertyNames.gperf"
       {"border-color", CSSPropertyBorderColor},
-#line 22 "CSSPropertyNames.gperf"
+#line 198 "CSSPropertyNames.gperf"
+      {"-webkit-marquee", CSSPropertyWebkitMarquee},
+#line 25 "CSSPropertyNames.gperf"
       {"border-bottom-color", CSSPropertyBorderBottomColor},
-#line 144 "CSSPropertyNames.gperf"
+#line 152 "CSSPropertyNames.gperf"
       {"-webkit-animation-duration", CSSPropertyWebkitAnimationDuration},
-#line 237 "CSSPropertyNames.gperf"
+#line 244 "CSSPropertyNames.gperf"
       {"-webkit-user-drag", CSSPropertyWebkitUserDrag},
-#line 160 "CSSPropertyNames.gperf"
+#line 166 "CSSPropertyNames.gperf"
       {"-webkit-border-radius", CSSPropertyWebkitBorderRadius},
-#line 203 "CSSPropertyNames.gperf"
+#line 208 "CSSPropertyNames.gperf"
       {"-webkit-mask-composite", CSSPropertyWebkitMaskComposite},
-#line 254 "CSSPropertyNames.gperf"
+#line 261 "CSSPropertyNames.gperf"
       {"color-rendering", CSSPropertyColorRendering},
-#line 129 "CSSPropertyNames.gperf"
+#line 137 "CSSPropertyNames.gperf"
       {"unicode-bidi", CSSPropertyUnicodeBidi},
-#line 46 "CSSPropertyNames.gperf"
+#line 54 "CSSPropertyNames.gperf"
       {"clip", CSSPropertyClip},
-#line 234 "CSSPropertyNames.gperf"
+#line 241 "CSSPropertyNames.gperf"
       {"-webkit-transition-duration", CSSPropertyWebkitTransitionDuration},
-#line 148 "CSSPropertyNames.gperf"
+#line 157 "CSSPropertyNames.gperf"
       {"-webkit-appearance", CSSPropertyWebkitAppearance},
 #line 10 "CSSPropertyNames.gperf"
       {"background", CSSPropertyBackground},
-#line 130 "CSSPropertyNames.gperf"
+#line 138 "CSSPropertyNames.gperf"
       {"unicode-range", CSSPropertyUnicodeRange},
-#line 51 "CSSPropertyNames.gperf"
+#line 59 "CSSPropertyNames.gperf"
       {"cursor", CSSPropertyCursor},
-#line 82 "CSSPropertyNames.gperf"
+#line 90 "CSSPropertyNames.gperf"
       {"outline", CSSPropertyOutline},
 #line 14 "CSSPropertyNames.gperf"
       {"background-image", CSSPropertyBackgroundImage},
-#line 38 "CSSPropertyNames.gperf"
+#line 44 "CSSPropertyNames.gperf"
       {"border-top-color", CSSPropertyBorderTopColor},
 #line 15 "CSSPropertyNames.gperf"
       {"background-origin", CSSPropertyBackgroundOrigin},
-#line 50 "CSSPropertyNames.gperf"
+#line 58 "CSSPropertyNames.gperf"
       {"counter-reset", CSSPropertyCounterReset},
-#line 249 "CSSPropertyNames.gperf"
+#line 256 "CSSPropertyNames.gperf"
       {"stop-color", CSSPropertyStopColor},
-#line 196 "CSSPropertyNames.gperf"
-      {"-webkit-marquee-repetition", CSSPropertyWebkitMarqueeRepetition},
-#line 214 "CSSPropertyNames.gperf"
-      {"-webkit-perspective", CSSPropertyWebkitPerspective},
-#line 273 "CSSPropertyNames.gperf"
+#line 280 "CSSPropertyNames.gperf"
       {"alignment-baseline", CSSPropertyAlignmentBaseline},
-#line 197 "CSSPropertyNames.gperf"
-      {"-webkit-marquee-speed", CSSPropertyWebkitMarqueeSpeed},
-#line 267 "CSSPropertyNames.gperf"
+#line 22 "CSSPropertyNames.gperf"
+      {"background-size", CSSPropertyBackgroundSize},
+#line 201 "CSSPropertyNames.gperf"
+      {"-webkit-marquee-repetition", CSSPropertyWebkitMarqueeRepetition},
+#line 274 "CSSPropertyNames.gperf"
       {"stroke-linecap", CSSPropertyStrokeLinecap},
-#line 152 "CSSPropertyNames.gperf"
+#line 161 "CSSPropertyNames.gperf"
       {"-webkit-background-origin", CSSPropertyWebkitBackgroundOrigin},
-#line 65 "CSSPropertyNames.gperf"
+#line 73 "CSSPropertyNames.gperf"
       {"letter-spacing", CSSPropertyLetterSpacing},
-#line 194 "CSSPropertyNames.gperf"
-      {"-webkit-marquee-direction", CSSPropertyWebkitMarqueeDirection},
 #line 202 "CSSPropertyNames.gperf"
+      {"-webkit-marquee-speed", CSSPropertyWebkitMarqueeSpeed},
+#line 207 "CSSPropertyNames.gperf"
       {"-webkit-mask-clip", CSSPropertyWebkitMaskClip},
-#line 195 "CSSPropertyNames.gperf"
-      {"-webkit-marquee-increment", CSSPropertyWebkitMarqueeIncrement},
-#line 215 "CSSPropertyNames.gperf"
-      {"-webkit-perspective-origin", CSSPropertyWebkitPerspectiveOrigin},
-#line 145 "CSSPropertyNames.gperf"
-      {"-webkit-animation-iteration-count", CSSPropertyWebkitAnimationIterationCount},
 #line 153 "CSSPropertyNames.gperf"
-      {"-webkit-background-size", CSSPropertyWebkitBackgroundSize},
+      {"-webkit-animation-iteration-count", CSSPropertyWebkitAnimationIterationCount},
+#line 199 "CSSPropertyNames.gperf"
+      {"-webkit-marquee-direction", CSSPropertyWebkitMarqueeDirection},
+#line 200 "CSSPropertyNames.gperf"
+      {"-webkit-marquee-increment", CSSPropertyWebkitMarqueeIncrement},
 #line 19 "CSSPropertyNames.gperf"
       {"background-repeat", CSSPropertyBackgroundRepeat},
-#line 103 "CSSPropertyNames.gperf"
+#line 221 "CSSPropertyNames.gperf"
+      {"-webkit-perspective", CSSPropertyWebkitPerspective},
+#line 111 "CSSPropertyNames.gperf"
       {"right", CSSPropertyRight},
-#line 49 "CSSPropertyNames.gperf"
+#line 57 "CSSPropertyNames.gperf"
       {"counter-increment", CSSPropertyCounterIncrement},
-#line 135 "CSSPropertyNames.gperf"
+#line 143 "CSSPropertyNames.gperf"
       {"width", CSSPropertyWidth},
 #line 16 "CSSPropertyNames.gperf"
       {"background-position", CSSPropertyBackgroundPosition},
-#line 79 "CSSPropertyNames.gperf"
+#line 87 "CSSPropertyNames.gperf"
       {"min-width", CSSPropertyMinWidth},
-#line 31 "CSSPropertyNames.gperf"
+#line 222 "CSSPropertyNames.gperf"
+      {"-webkit-perspective-origin", CSSPropertyWebkitPerspectiveOrigin},
+#line 37 "CSSPropertyNames.gperf"
       {"border-right", CSSPropertyBorderRight},
-#line 41 "CSSPropertyNames.gperf"
+#line 49 "CSSPropertyNames.gperf"
       {"border-width", CSSPropertyBorderWidth},
-#line 131 "CSSPropertyNames.gperf"
-      {"vertical-align", CSSPropertyVerticalAlign},
-#line 74 "CSSPropertyNames.gperf"
+#line 64 "CSSPropertyNames.gperf"
+      {"font", CSSPropertyFont},
+#line 82 "CSSPropertyNames.gperf"
       {"margin-right", CSSPropertyMarginRight},
-#line 24 "CSSPropertyNames.gperf"
+#line 29 "CSSPropertyNames.gperf"
       {"border-bottom-width", CSSPropertyBorderBottomWidth},
-#line 56 "CSSPropertyNames.gperf"
-      {"font", CSSPropertyFont},
-#line 244 "CSSPropertyNames.gperf"
+#line 251 "CSSPropertyNames.gperf"
       {"enable-background", CSSPropertyEnableBackground},
-#line 271 "CSSPropertyNames.gperf"
+#line 278 "CSSPropertyNames.gperf"
       {"stroke-width", CSSPropertyStrokeWidth},
-#line 184 "CSSPropertyNames.gperf"
-      {"-webkit-columns", CSSPropertyWebkitColumns},
 #line 188 "CSSPropertyNames.gperf"
+      {"-webkit-columns", CSSPropertyWebkitColumns},
+#line 193 "CSSPropertyNames.gperf"
       {"-webkit-line-clamp", CSSPropertyWebkitLineClamp},
-#line 251 "CSSPropertyNames.gperf"
+#line 258 "CSSPropertyNames.gperf"
       {"color-interpolation", CSSPropertyColorInterpolation},
-#line 25 "CSSPropertyNames.gperf"
-      {"border-collapse", CSSPropertyBorderCollapse},
-#line 157 "CSSPropertyNames.gperf"
+#line 163 "CSSPropertyNames.gperf"
       {"-webkit-border-fit", CSSPropertyWebkitBorderFit},
-#line 58 "CSSPropertyNames.gperf"
+#line 66 "CSSPropertyNames.gperf"
       {"font-size", CSSPropertyFontSize},
-#line 176 "CSSPropertyNames.gperf"
+#line 30 "CSSPropertyNames.gperf"
+      {"border-collapse", CSSPropertyBorderCollapse},
+#line 117 "CSSPropertyNames.gperf"
+      {"text-indent", CSSPropertyTextIndent},
+#line 147 "CSSPropertyNames.gperf"
+      {"z-index", CSSPropertyZIndex},
+#line 139 "CSSPropertyNames.gperf"
+      {"vertical-align", CSSPropertyVerticalAlign},
+#line 180 "CSSPropertyNames.gperf"
       {"-webkit-column-break-inside", CSSPropertyWebkitColumnBreakInside},
-#line 93 "CSSPropertyNames.gperf"
+#line 101 "CSSPropertyNames.gperf"
       {"padding-right", CSSPropertyPaddingRight},
-#line 239 "CSSPropertyNames.gperf"
+#line 246 "CSSPropertyNames.gperf"
       {"-webkit-user-select", CSSPropertyWebkitUserSelect},
-#line 40 "CSSPropertyNames.gperf"
+#line 48 "CSSPropertyNames.gperf"
       {"border-top-width", CSSPropertyBorderTopWidth},
-#line 81 "CSSPropertyNames.gperf"
+#line 279 "CSSPropertyNames.gperf"
+      {"text-rendering", CSSPropertyTextRendering},
+#line 89 "CSSPropertyNames.gperf"
       {"orphans", CSSPropertyOrphans},
-#line 61 "CSSPropertyNames.gperf"
-      {"font-variant", CSSPropertyFontVariant},
-#line 178 "CSSPropertyNames.gperf"
+#line 174 "CSSPropertyNames.gperf"
+      {"-webkit-box-orient", CSSPropertyWebkitBoxOrient},
+#line 233 "CSSPropertyNames.gperf"
+      {"-webkit-transform", CSSPropertyWebkitTransform},
+#line 182 "CSSPropertyNames.gperf"
       {"-webkit-column-gap", CSSPropertyWebkitColumnGap},
-#line 190 "CSSPropertyNames.gperf"
+#line 195 "CSSPropertyNames.gperf"
       {"-webkit-margin-collapse", CSSPropertyWebkitMarginCollapse},
-#line 226 "CSSPropertyNames.gperf"
-      {"-webkit-transform", CSSPropertyWebkitTransform},
-#line 151 "CSSPropertyNames.gperf"
+#line 160 "CSSPropertyNames.gperf"
       {"-webkit-background-composite", CSSPropertyWebkitBackgroundComposite},
-#line 189 "CSSPropertyNames.gperf"
+#line 194 "CSSPropertyNames.gperf"
       {"-webkit-margin-bottom-collapse", CSSPropertyWebkitMarginBottomCollapse},
 #line 13 "CSSPropertyNames.gperf"
       {"background-color", CSSPropertyBackgroundColor},
-#line 263 "CSSPropertyNames.gperf"
+#line 230 "CSSPropertyNames.gperf"
+      {"-webkit-text-stroke", CSSPropertyWebkitTextStroke},
+#line 270 "CSSPropertyNames.gperf"
       {"shape-rendering", CSSPropertyShapeRendering},
-#line 109 "CSSPropertyNames.gperf"
-      {"text-indent", CSSPropertyTextIndent},
-#line 139 "CSSPropertyNames.gperf"
-      {"z-index", CSSPropertyZIndex},
-#line 163 "CSSPropertyNames.gperf"
-      {"-webkit-border-vertical-spacing", CSSPropertyWebkitBorderVerticalSpacing},
-#line 83 "CSSPropertyNames.gperf"
-      {"outline-color", CSSPropertyOutlineColor},
-#line 97 "CSSPropertyNames.gperf"
+#line 105 "CSSPropertyNames.gperf"
       {"page-break-before", CSSPropertyPageBreakBefore},
-#line 227 "CSSPropertyNames.gperf"
+#line 234 "CSSPropertyNames.gperf"
       {"-webkit-transform-origin", CSSPropertyWebkitTransformOrigin},
-#line 96 "CSSPropertyNames.gperf"
+#line 104 "CSSPropertyNames.gperf"
       {"page-break-after", CSSPropertyPageBreakAfter},
-#line 272 "CSSPropertyNames.gperf"
-      {"text-rendering", CSSPropertyTextRendering},
-#line 170 "CSSPropertyNames.gperf"
-      {"-webkit-box-orient", CSSPropertyWebkitBoxOrient},
-#line 64 "CSSPropertyNames.gperf"
+#line 91 "CSSPropertyNames.gperf"
+      {"outline-color", CSSPropertyOutlineColor},
+#line 206 "CSSPropertyNames.gperf"
+      {"-webkit-mask-box-image", CSSPropertyWebkitMaskBoxImage},
+#line 177 "CSSPropertyNames.gperf"
+      {"-webkit-box-sizing", CSSPropertyWebkitBoxSizing},
+#line 72 "CSSPropertyNames.gperf"
       {"left", CSSPropertyLeft},
-#line 230 "CSSPropertyNames.gperf"
+#line 237 "CSSPropertyNames.gperf"
       {"-webkit-transform-origin-z", CSSPropertyWebkitTransformOriginZ},
-#line 55 "CSSPropertyNames.gperf"
+#line 69 "CSSPropertyNames.gperf"
+      {"font-variant", CSSPropertyFontVariant},
+#line 63 "CSSPropertyNames.gperf"
       {"float", CSSPropertyFloat},
-#line 245 "CSSPropertyNames.gperf"
+#line 252 "CSSPropertyNames.gperf"
       {"filter", CSSPropertyFilter},
-#line 200 "CSSPropertyNames.gperf"
-      {"-webkit-mask-attachment", CSSPropertyWebkitMaskAttachment},
-#line 27 "CSSPropertyNames.gperf"
+#line 32 "CSSPropertyNames.gperf"
       {"border-left", CSSPropertyBorderLeft},
-#line 223 "CSSPropertyNames.gperf"
-      {"-webkit-text-stroke", CSSPropertyWebkitTextStroke},
+#line 205 "CSSPropertyNames.gperf"
+      {"-webkit-mask-attachment", CSSPropertyWebkitMaskAttachment},
+#line 116 "CSSPropertyNames.gperf"
+      {"text-decoration", CSSPropertyTextDecoration},
+#line 81 "CSSPropertyNames.gperf"
+      {"margin-left", CSSPropertyMarginLeft},
 #line 12 "CSSPropertyNames.gperf"
       {"background-clip", CSSPropertyBackgroundClip},
-#line 192 "CSSPropertyNames.gperf"
+#line 197 "CSSPropertyNames.gperf"
       {"-webkit-margin-top-collapse", CSSPropertyWebkitMarginTopCollapse},
-#line 73 "CSSPropertyNames.gperf"
-      {"margin-left", CSSPropertyMarginLeft},
-#line 242 "CSSPropertyNames.gperf"
+#line 167 "CSSPropertyNames.gperf"
+      {"-webkit-border-vertical-spacing", CSSPropertyWebkitBorderVerticalSpacing},
+#line 249 "CSSPropertyNames.gperf"
       {"clip-rule", CSSPropertyClipRule},
-#line 201 "CSSPropertyNames.gperf"
-      {"-webkit-mask-box-image", CSSPropertyWebkitMaskBoxImage},
-#line 173 "CSSPropertyNames.gperf"
-      {"-webkit-box-sizing", CSSPropertyWebkitBoxSizing},
-#line 133 "CSSPropertyNames.gperf"
+#line 169 "CSSPropertyNames.gperf"
+      {"-webkit-box-direction", CSSPropertyWebkitBoxDirection},
+#line 141 "CSSPropertyNames.gperf"
       {"white-space", CSSPropertyWhiteSpace},
-#line 150 "CSSPropertyNames.gperf"
+#line 115 "CSSPropertyNames.gperf"
+      {"text-align", CSSPropertyTextAlign},
+#line 215 "CSSPropertyNames.gperf"
+      {"-webkit-mask-repeat-x", CSSPropertyWebkitMaskRepeatX},
+#line 159 "CSSPropertyNames.gperf"
       {"-webkit-background-clip", CSSPropertyWebkitBackgroundClip},
-#line 87 "CSSPropertyNames.gperf"
-      {"overflow", CSSPropertyOverflow},
-#line 108 "CSSPropertyNames.gperf"
-      {"text-decoration", CSSPropertyTextDecoration},
-#line 80 "CSSPropertyNames.gperf"
-      {"opacity", CSSPropertyOpacity},
-#line 32 "CSSPropertyNames.gperf"
-      {"border-right-color", CSSPropertyBorderRightColor},
-#line 165 "CSSPropertyNames.gperf"
-      {"-webkit-box-direction", CSSPropertyWebkitBoxDirection},
-#line 92 "CSSPropertyNames.gperf"
+#line 216 "CSSPropertyNames.gperf"
+      {"-webkit-mask-repeat-y", CSSPropertyWebkitMaskRepeatY},
+#line 168 "CSSPropertyNames.gperf"
+      {"-webkit-box-align", CSSPropertyWebkitBoxAlign},
+#line 212 "CSSPropertyNames.gperf"
+      {"-webkit-mask-position-x", CSSPropertyWebkitMaskPositionX},
+#line 100 "CSSPropertyNames.gperf"
       {"padding-left", CSSPropertyPaddingLeft},
-#line 185 "CSSPropertyNames.gperf"
+#line 189 "CSSPropertyNames.gperf"
       {"-webkit-font-size-delta", CSSPropertyWebkitFontSizeDelta},
-#line 36 "CSSPropertyNames.gperf"
+#line 27 "CSSPropertyNames.gperf"
+      {"border-bottom-right-radius", CSSPropertyBorderBottomRightRadius},
+#line 88 "CSSPropertyNames.gperf"
+      {"opacity", CSSPropertyOpacity},
+#line 38 "CSSPropertyNames.gperf"
+      {"border-right-color", CSSPropertyBorderRightColor},
+#line 175 "CSSPropertyNames.gperf"
+      {"-webkit-box-pack", CSSPropertyWebkitBoxPack},
+#line 172 "CSSPropertyNames.gperf"
+      {"-webkit-box-lines", CSSPropertyWebkitBoxLines},
+#line 42 "CSSPropertyNames.gperf"
       {"border-style", CSSPropertyBorderStyle},
-#line 208 "CSSPropertyNames.gperf"
+#line 213 "CSSPropertyNames.gperf"
       {"-webkit-mask-position-y", CSSPropertyWebkitMaskPositionY},
-#line 107 "CSSPropertyNames.gperf"
-      {"text-align", CSSPropertyTextAlign},
-#line 23 "CSSPropertyNames.gperf"
+#line 95 "CSSPropertyNames.gperf"
+      {"overflow", CSSPropertyOverflow},
+#line 28 "CSSPropertyNames.gperf"
       {"border-bottom-style", CSSPropertyBorderBottomStyle},
-#line 156 "CSSPropertyNames.gperf"
-      {"-webkit-border-bottom-right-radius", CSSPropertyWebkitBorderBottomRightRadius},
-#line 142 "CSSPropertyNames.gperf"
-      {"-webkit-animation-delay", CSSPropertyWebkitAnimationDelay},
-#line 132 "CSSPropertyNames.gperf"
-      {"visibility", CSSPropertyVisibility},
-#line 255 "CSSPropertyNames.gperf"
+#line 262 "CSSPropertyNames.gperf"
       {"fill", CSSPropertyFill},
-#line 164 "CSSPropertyNames.gperf"
-      {"-webkit-box-align", CSSPropertyWebkitBoxAlign},
-#line 207 "CSSPropertyNames.gperf"
-      {"-webkit-mask-position-x", CSSPropertyWebkitMaskPositionX},
-#line 270 "CSSPropertyNames.gperf"
+#line 150 "CSSPropertyNames.gperf"
+      {"-webkit-animation-delay", CSSPropertyWebkitAnimationDelay},
+#line 277 "CSSPropertyNames.gperf"
       {"stroke-opacity", CSSPropertyStrokeOpacity},
-#line 116 "CSSPropertyNames.gperf"
+#line 124 "CSSPropertyNames.gperf"
       {"text-overline", CSSPropertyTextOverline},
-#line 240 "CSSPropertyNames.gperf"
-      {"-webkit-variable-declaration-block", CSSPropertyWebkitVariableDeclarationBlock},
-#line 177 "CSSPropertyNames.gperf"
+#line 181 "CSSPropertyNames.gperf"
       {"-webkit-column-count", CSSPropertyWebkitColumnCount},
-#line 118 "CSSPropertyNames.gperf"
+#line 126 "CSSPropertyNames.gperf"
       {"text-overline-mode", CSSPropertyTextOverlineMode},
-#line 171 "CSSPropertyNames.gperf"
-      {"-webkit-box-pack", CSSPropertyWebkitBoxPack},
-#line 168 "CSSPropertyNames.gperf"
-      {"-webkit-box-lines", CSSPropertyWebkitBoxLines},
-#line 233 "CSSPropertyNames.gperf"
+#line 46 "CSSPropertyNames.gperf"
+      {"border-top-right-radius", CSSPropertyBorderTopRightRadius},
+#line 240 "CSSPropertyNames.gperf"
       {"-webkit-transition-delay", CSSPropertyWebkitTransitionDelay},
-#line 53 "CSSPropertyNames.gperf"
+#line 61 "CSSPropertyNames.gperf"
       {"display", CSSPropertyDisplay},
-#line 86 "CSSPropertyNames.gperf"
+#line 94 "CSSPropertyNames.gperf"
       {"outline-width", CSSPropertyOutlineWidth},
-#line 235 "CSSPropertyNames.gperf"
+#line 242 "CSSPropertyNames.gperf"
       {"-webkit-transition-property", CSSPropertyWebkitTransitionProperty},
-#line 39 "CSSPropertyNames.gperf"
+#line 47 "CSSPropertyNames.gperf"
       {"border-top-style", CSSPropertyBorderTopStyle},
-#line 179 "CSSPropertyNames.gperf"
+#line 183 "CSSPropertyNames.gperf"
       {"-webkit-column-rule", CSSPropertyWebkitColumnRule},
-#line 162 "CSSPropertyNames.gperf"
-      {"-webkit-border-top-right-radius", CSSPropertyWebkitBorderTopRightRadius},
-#line 241 "CSSPropertyNames.gperf"
+#line 140 "CSSPropertyNames.gperf"
+      {"visibility", CSSPropertyVisibility},
+#line 248 "CSSPropertyNames.gperf"
       {"clip-path", CSSPropertyClipPath},
-#line 250 "CSSPropertyNames.gperf"
+#line 257 "CSSPropertyNames.gperf"
       {"stop-opacity", CSSPropertyStopOpacity},
-#line 248 "CSSPropertyNames.gperf"
+#line 247 "CSSPropertyNames.gperf"
+      {"-webkit-variable-declaration-block", CSSPropertyWebkitVariableDeclarationBlock},
+#line 229 "CSSPropertyNames.gperf"
+      {"-webkit-text-size-adjust", CSSPropertyWebkitTextSizeAdjust},
+#line 231 "CSSPropertyNames.gperf"
+      {"-webkit-text-stroke-color", CSSPropertyWebkitTextStrokeColor},
+#line 255 "CSSPropertyNames.gperf"
       {"lighting-color", CSSPropertyLightingColor},
-#line 63 "CSSPropertyNames.gperf"
+#line 71 "CSSPropertyNames.gperf"
       {"height", CSSPropertyHeight},
-#line 78 "CSSPropertyNames.gperf"
-      {"min-height", CSSPropertyMinHeight},
-#line 246 "CSSPropertyNames.gperf"
+#line 253 "CSSPropertyNames.gperf"
       {"flood-color", CSSPropertyFloodColor},
-#line 147 "CSSPropertyNames.gperf"
+#line 156 "CSSPropertyNames.gperf"
       {"-webkit-animation-timing-function", CSSPropertyWebkitAnimationTimingFunction},
+#line 131 "CSSPropertyNames.gperf"
+      {"text-underline", CSSPropertyTextUnderline},
+#line 86 "CSSPropertyNames.gperf"
+      {"min-height", CSSPropertyMinHeight},
+#line 155 "CSSPropertyNames.gperf"
+      {"-webkit-animation-play-state", CSSPropertyWebkitAnimationPlayState},
+#line 133 "CSSPropertyNames.gperf"
+      {"text-underline-mode", CSSPropertyTextUnderlineMode},
+#line 26 "CSSPropertyNames.gperf"
+      {"border-bottom-left-radius", CSSPropertyBorderBottomLeftRadius},
 #line 11 "CSSPropertyNames.gperf"
       {"background-attachment", CSSPropertyBackgroundAttachment},
-#line 222 "CSSPropertyNames.gperf"
-      {"-webkit-text-size-adjust", CSSPropertyWebkitTextSizeAdjust},
-#line 67 "CSSPropertyNames.gperf"
-      {"list-style", CSSPropertyListStyle},
-#line 28 "CSSPropertyNames.gperf"
+#line 33 "CSSPropertyNames.gperf"
       {"border-left-color", CSSPropertyBorderLeftColor},
-#line 158 "CSSPropertyNames.gperf"
+#line 75 "CSSPropertyNames.gperf"
+      {"list-style", CSSPropertyListStyle},
+#line 164 "CSSPropertyNames.gperf"
       {"-webkit-border-horizontal-spacing", CSSPropertyWebkitBorderHorizontalSpacing},
-#line 224 "CSSPropertyNames.gperf"
-      {"-webkit-text-stroke-color", CSSPropertyWebkitTextStrokeColor},
-#line 68 "CSSPropertyNames.gperf"
+#line 243 "CSSPropertyNames.gperf"
+      {"-webkit-transition-timing-function", CSSPropertyWebkitTransitionTimingFunction},
+#line 76 "CSSPropertyNames.gperf"
       {"list-style-image", CSSPropertyListStyleImage},
-#line 34 "CSSPropertyNames.gperf"
+#line 40 "CSSPropertyNames.gperf"
       {"border-right-width", CSSPropertyBorderRightWidth},
-#line 236 "CSSPropertyNames.gperf"
-      {"-webkit-transition-timing-function", CSSPropertyWebkitTransitionTimingFunction},
-#line 183 "CSSPropertyNames.gperf"
+#line 187 "CSSPropertyNames.gperf"
       {"-webkit-column-width", CSSPropertyWebkitColumnWidth},
-#line 155 "CSSPropertyNames.gperf"
-      {"-webkit-border-bottom-left-radius", CSSPropertyWebkitBorderBottomLeftRadius},
-#line 123 "CSSPropertyNames.gperf"
-      {"text-underline", CSSPropertyTextUnderline},
-#line 217 "CSSPropertyNames.gperf"
-      {"-webkit-perspective-origin-y", CSSPropertyWebkitPerspectiveOriginY},
-#line 125 "CSSPropertyNames.gperf"
-      {"text-underline-mode", CSSPropertyTextUnderlineMode},
-#line 62 "CSSPropertyNames.gperf"
+#line 20 "CSSPropertyNames.gperf"
+      {"background-repeat-x", CSSPropertyBackgroundRepeatX},
+#line 70 "CSSPropertyNames.gperf"
       {"font-weight", CSSPropertyFontWeight},
-#line 253 "CSSPropertyNames.gperf"
+#line 260 "CSSPropertyNames.gperf"
       {"color-profile", CSSPropertyColorProfile},
-#line 216 "CSSPropertyNames.gperf"
+#line 45 "CSSPropertyNames.gperf"
+      {"border-top-left-radius", CSSPropertyBorderTopLeftRadius},
+#line 21 "CSSPropertyNames.gperf"
+      {"background-repeat-y", CSSPropertyBackgroundRepeatY},
+#line 17 "CSSPropertyNames.gperf"
+      {"background-position-x", CSSPropertyBackgroundPositionX},
+#line 85 "CSSPropertyNames.gperf"
+      {"max-width", CSSPropertyMaxWidth},
+#line 223 "CSSPropertyNames.gperf"
       {"-webkit-perspective-origin-x", CSSPropertyWebkitPerspectiveOriginX},
-#line 198 "CSSPropertyNames.gperf"
-      {"-webkit-marquee-style", CSSPropertyWebkitMarqueeStyle},
-#line 18 "CSSPropertyNames.gperf"
-      {"background-position-y", CSSPropertyBackgroundPositionY},
-#line 175 "CSSPropertyNames.gperf"
+#line 179 "CSSPropertyNames.gperf"
       {"-webkit-column-break-before", CSSPropertyWebkitColumnBreakBefore},
-#line 174 "CSSPropertyNames.gperf"
+#line 178 "CSSPropertyNames.gperf"
       {"-webkit-column-break-after", CSSPropertyWebkitColumnBreakAfter},
-#line 161 "CSSPropertyNames.gperf"
-      {"-webkit-border-top-left-radius", CSSPropertyWebkitBorderTopLeftRadius},
-#line 66 "CSSPropertyNames.gperf"
+#line 18 "CSSPropertyNames.gperf"
+      {"background-position-y", CSSPropertyBackgroundPositionY},
+#line 190 "CSSPropertyNames.gperf"
+      {"-webkit-font-smoothing", CSSPropertyWebkitFontSmoothing},
+#line 173 "CSSPropertyNames.gperf"
+      {"-webkit-box-ordinal-group", CSSPropertyWebkitBoxOrdinalGroup},
+#line 203 "CSSPropertyNames.gperf"
+      {"-webkit-marquee-style", CSSPropertyWebkitMarqueeStyle},
+#line 224 "CSSPropertyNames.gperf"
+      {"-webkit-perspective-origin-y", CSSPropertyWebkitPerspectiveOriginY},
+#line 51 "CSSPropertyNames.gperf"
+      {"box-shadow", CSSPropertyBoxShadow},
+#line 129 "CSSPropertyNames.gperf"
+      {"text-shadow", CSSPropertyTextShadow},
+#line 74 "CSSPropertyNames.gperf"
       {"line-height", CSSPropertyLineHeight},
-#line 69 "CSSPropertyNames.gperf"
-      {"list-style-position", CSSPropertyListStylePosition},
-#line 17 "CSSPropertyNames.gperf"
-      {"background-position-x", CSSPropertyBackgroundPositionX},
 #line 77 "CSSPropertyNames.gperf"
-      {"max-width", CSSPropertyMaxWidth},
-#line 106 "CSSPropertyNames.gperf"
+      {"list-style-position", CSSPropertyListStylePosition},
+#line 114 "CSSPropertyNames.gperf"
       {"table-layout", CSSPropertyTableLayout},
-#line 117 "CSSPropertyNames.gperf"
+#line 125 "CSSPropertyNames.gperf"
       {"text-overline-color", CSSPropertyTextOverlineColor},
-#line 54 "CSSPropertyNames.gperf"
+#line 62 "CSSPropertyNames.gperf"
       {"empty-cells", CSSPropertyEmptyCells},
-#line 169 "CSSPropertyNames.gperf"
-      {"-webkit-box-ordinal-group", CSSPropertyWebkitBoxOrdinalGroup},
-#line 85 "CSSPropertyNames.gperf"
-      {"outline-style", CSSPropertyOutlineStyle},
-#line 43 "CSSPropertyNames.gperf"
-      {"box-shadow", CSSPropertyBoxShadow},
-#line 121 "CSSPropertyNames.gperf"
-      {"text-shadow", CSSPropertyTextShadow},
-#line 59 "CSSPropertyNames.gperf"
+#line 232 "CSSPropertyNames.gperf"
+      {"-webkit-text-stroke-width", CSSPropertyWebkitTextStrokeWidth},
+#line 130 "CSSPropertyNames.gperf"
+      {"text-transform", CSSPropertyTextTransform},
+#line 67 "CSSPropertyNames.gperf"
       {"font-stretch", CSSPropertyFontStretch},
-#line 180 "CSSPropertyNames.gperf"
+#line 93 "CSSPropertyNames.gperf"
+      {"outline-style", CSSPropertyOutlineStyle},
+#line 286 "CSSPropertyNames.gperf"
+      {"text-anchor", CSSPropertyTextAnchor},
+#line 184 "CSSPropertyNames.gperf"
       {"-webkit-column-rule-color", CSSPropertyWebkitColumnRuleColor},
-#line 265 "CSSPropertyNames.gperf"
+#line 272 "CSSPropertyNames.gperf"
       {"stroke-dasharray", CSSPropertyStrokeDasharray},
-#line 30 "CSSPropertyNames.gperf"
+#line 35 "CSSPropertyNames.gperf"
       {"border-left-width", CSSPropertyBorderLeftWidth},
-#line 225 "CSSPropertyNames.gperf"
-      {"-webkit-text-stroke-width", CSSPropertyWebkitTextStrokeWidth},
-#line 257 "CSSPropertyNames.gperf"
+#line 264 "CSSPropertyNames.gperf"
       {"fill-rule", CSSPropertyFillRule},
-#line 122 "CSSPropertyNames.gperf"
-      {"text-transform", CSSPropertyTextTransform},
-#line 279 "CSSPropertyNames.gperf"
-      {"text-anchor", CSSPropertyTextAnchor},
-#line 274 "CSSPropertyNames.gperf"
+#line 235 "CSSPropertyNames.gperf"
+      {"-webkit-transform-origin-x", CSSPropertyWebkitTransformOriginX},
+#line 281 "CSSPropertyNames.gperf"
       {"baseline-shift", CSSPropertyBaselineShift},
-#line 229 "CSSPropertyNames.gperf"
+#line 132 "CSSPropertyNames.gperf"
+      {"text-underline-color", CSSPropertyTextUnderlineColor},
+#line 236 "CSSPropertyNames.gperf"
       {"-webkit-transform-origin-y", CSSPropertyWebkitTransformOriginY},
-#line 228 "CSSPropertyNames.gperf"
-      {"-webkit-transform-origin-x", CSSPropertyWebkitTransformOriginX},
-#line 33 "CSSPropertyNames.gperf"
-      {"border-right-style", CSSPropertyBorderRightStyle},
-#line 252 "CSSPropertyNames.gperf"
+#line 259 "CSSPropertyNames.gperf"
       {"color-interpolation-filters", CSSPropertyColorInterpolationFilters},
-#line 124 "CSSPropertyNames.gperf"
-      {"text-underline-color", CSSPropertyTextUnderlineColor},
-#line 60 "CSSPropertyNames.gperf"
+#line 39 "CSSPropertyNames.gperf"
+      {"border-right-style", CSSPropertyBorderRightStyle},
+#line 68 "CSSPropertyNames.gperf"
       {"font-style", CSSPropertyFontStyle},
-#line 120 "CSSPropertyNames.gperf"
+#line 128 "CSSPropertyNames.gperf"
       {"text-overline-width", CSSPropertyTextOverlineWidth},
-#line 89 "CSSPropertyNames.gperf"
-      {"overflow-y", CSSPropertyOverflowY},
-#line 88 "CSSPropertyNames.gperf"
+#line 96 "CSSPropertyNames.gperf"
       {"overflow-x", CSSPropertyOverflowX},
-#line 115 "CSSPropertyNames.gperf"
+#line 123 "CSSPropertyNames.gperf"
       {"text-overflow", CSSPropertyTextOverflow},
-#line 182 "CSSPropertyNames.gperf"
+#line 176 "CSSPropertyNames.gperf"
+      {"-webkit-box-reflect", CSSPropertyWebkitBoxReflect},
+#line 245 "CSSPropertyNames.gperf"
+      {"-webkit-user-modify", CSSPropertyWebkitUserModify},
+#line 186 "CSSPropertyNames.gperf"
       {"-webkit-column-rule-width", CSSPropertyWebkitColumnRuleWidth},
+#line 97 "CSSPropertyNames.gperf"
+      {"overflow-y", CSSPropertyOverflowY},
 #line 238 "CSSPropertyNames.gperf"
-      {"-webkit-user-modify", CSSPropertyWebkitUserModify},
-#line 231 "CSSPropertyNames.gperf"
       {"-webkit-transform-style", CSSPropertyWebkitTransformStyle},
-#line 172 "CSSPropertyNames.gperf"
-      {"-webkit-box-reflect", CSSPropertyWebkitBoxReflect},
-#line 84 "CSSPropertyNames.gperf"
+#line 92 "CSSPropertyNames.gperf"
       {"outline-offset", CSSPropertyOutlineOffset},
-#line 247 "CSSPropertyNames.gperf"
+#line 135 "CSSPropertyNames.gperf"
+      {"text-underline-width", CSSPropertyTextUnderlineWidth},
+#line 254 "CSSPropertyNames.gperf"
       {"flood-opacity", CSSPropertyFloodOpacity},
-#line 29 "CSSPropertyNames.gperf"
+#line 34 "CSSPropertyNames.gperf"
       {"border-left-style", CSSPropertyBorderLeftStyle},
-#line 127 "CSSPropertyNames.gperf"
-      {"text-underline-width", CSSPropertyTextUnderlineWidth},
-#line 76 "CSSPropertyNames.gperf"
+#line 84 "CSSPropertyNames.gperf"
       {"max-height", CSSPropertyMaxHeight},
-#line 186 "CSSPropertyNames.gperf"
-      {"-webkit-highlight", CSSPropertyWebkitHighlight},
-#line 221 "CSSPropertyNames.gperf"
+#line 228 "CSSPropertyNames.gperf"
       {"-webkit-text-security", CSSPropertyWebkitTextSecurity},
-#line 256 "CSSPropertyNames.gperf"
+#line 191 "CSSPropertyNames.gperf"
+      {"-webkit-highlight", CSSPropertyWebkitHighlight},
+#line 263 "CSSPropertyNames.gperf"
       {"fill-opacity", CSSPropertyFillOpacity},
-#line 119 "CSSPropertyNames.gperf"
+#line 273 "CSSPropertyNames.gperf"
+      {"stroke-dashoffset", CSSPropertyStrokeDashoffset},
+#line 127 "CSSPropertyNames.gperf"
       {"text-overline-style", CSSPropertyTextOverlineStyle},
-#line 149 "CSSPropertyNames.gperf"
-      {"-webkit-backface-visibility", CSSPropertyWebkitBackfaceVisibility},
-#line 70 "CSSPropertyNames.gperf"
+#line 78 "CSSPropertyNames.gperf"
       {"list-style-type", CSSPropertyListStyleType},
-#line 266 "CSSPropertyNames.gperf"
-      {"stroke-dashoffset", CSSPropertyStrokeDashoffset},
-#line 211 "CSSPropertyNames.gperf"
+#line 218 "CSSPropertyNames.gperf"
       {"-webkit-match-nearest-mail-blockquote-color", CSSPropertyWebkitMatchNearestMailBlockquoteColor},
-#line 181 "CSSPropertyNames.gperf"
+#line 185 "CSSPropertyNames.gperf"
       {"-webkit-column-rule-style", CSSPropertyWebkitColumnRuleStyle},
-#line 277 "CSSPropertyNames.gperf"
-      {"glyph-orientation-vertical", CSSPropertyGlyphOrientationVertical},
-#line 220 "CSSPropertyNames.gperf"
+#line 158 "CSSPropertyNames.gperf"
+      {"-webkit-backface-visibility", CSSPropertyWebkitBackfaceVisibility},
+#line 227 "CSSPropertyNames.gperf"
       {"-webkit-text-fill-color", CSSPropertyWebkitTextFillColor},
-#line 126 "CSSPropertyNames.gperf"
+#line 134 "CSSPropertyNames.gperf"
       {"text-underline-style", CSSPropertyTextUnderlineStyle},
-#line 57 "CSSPropertyNames.gperf"
+#line 284 "CSSPropertyNames.gperf"
+      {"glyph-orientation-vertical", CSSPropertyGlyphOrientationVertical},
+#line 65 "CSSPropertyNames.gperf"
       {"font-family", CSSPropertyFontFamily},
-#line 110 "CSSPropertyNames.gperf"
-      {"text-line-through", CSSPropertyTextLineThrough},
-#line 166 "CSSPropertyNames.gperf"
+#line 170 "CSSPropertyNames.gperf"
       {"-webkit-box-flex", CSSPropertyWebkitBoxFlex},
-#line 112 "CSSPropertyNames.gperf"
+#line 118 "CSSPropertyNames.gperf"
+      {"text-line-through", CSSPropertyTextLineThrough},
+#line 120 "CSSPropertyNames.gperf"
       {"text-line-through-mode", CSSPropertyTextLineThroughMode},
-#line 276 "CSSPropertyNames.gperf"
-      {"glyph-orientation-horizontal", CSSPropertyGlyphOrientationHorizontal},
-#line 219 "CSSPropertyNames.gperf"
+#line 226 "CSSPropertyNames.gperf"
       {"-webkit-text-decorations-in-effect", CSSPropertyWebkitTextDecorationsInEffect},
-#line 111 "CSSPropertyNames.gperf"
-      {"text-line-through-color", CSSPropertyTextLineThroughColor},
-#line 167 "CSSPropertyNames.gperf"
+#line 283 "CSSPropertyNames.gperf"
+      {"glyph-orientation-horizontal", CSSPropertyGlyphOrientationHorizontal},
+#line 171 "CSSPropertyNames.gperf"
       {"-webkit-box-flex-group", CSSPropertyWebkitBoxFlexGroup},
-#line 114 "CSSPropertyNames.gperf"
+#line 119 "CSSPropertyNames.gperf"
+      {"text-line-through-color", CSSPropertyTextLineThroughColor},
+#line 122 "CSSPropertyNames.gperf"
       {"text-line-through-width", CSSPropertyTextLineThroughWidth},
-#line 113 "CSSPropertyNames.gperf"
+#line 121 "CSSPropertyNames.gperf"
       {"text-line-through-style", CSSPropertyTextLineThroughStyle}
     };
 
@@ -794,133 +808,130 @@ findProp (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  38,  39,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  40,  -1,  -1,
        -1,  -1,  41,  -1,  -1,  -1,  -1,  -1,  -1,  42,
-       -1,  -1,  -1,  -1,  -1,  -1,  43,  -1,  -1,  44,
-       -1,  45,  -1,  -1,  -1,  -1,  -1,  46,  -1,  -1,
-       -1,  47,  -1,  48,  -1,  -1,  -1,  49,  -1,  -1,
-       50,  -1,  -1,  -1,  -1,  51,  -1,  -1,  -1,  -1,
-       -1,  -1,  52,  -1,  -1,  -1,  -1,  53,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       54,  55,  -1,  -1,  56,  57,  -1,  -1,  -1,  -1,
-       58,  -1,  59,  -1,  -1,  -1,  -1,  60,  -1,  -1,
-       -1,  -1,  -1,  -1,  61,  -1,  62,  63,  -1,  -1,
-       -1,  64,  65,  -1,  -1,  66,  -1,  -1,  -1,  -1,
-       -1,  -1,  67,  -1,  -1,  -1,  -1,  -1,  -1,  68,
-       -1,  -1,  69,  70,  -1,  71,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  72,  -1,  -1,  73,  74,  -1,  -1,
-       -1,  75,  -1,  -1,  -1,  -1,  76,  77,  78,  -1,
-       -1,  -1,  -1,  -1,  -1,  79,  80,  -1,  -1,  81,
-       -1,  -1,  -1,  82,  -1,  -1,  83,  -1,  -1,  84,
-       85,  -1,  -1,  -1,  86,  87,  -1,  88,  -1,  -1,
-       89,  90,  -1,  91,  -1,  -1,  -1,  -1,  92,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  93,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  43,  -1,  -1,  -1,
+       -1,  44,  -1,  -1,  -1,  -1,  -1,  45,  -1,  -1,
+       -1,  46,  -1,  47,  -1,  -1,  -1,  48,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  49,  -1,  -1,  -1,  -1,
+       50,  -1,  51,  -1,  -1,  -1,  -1,  52,  -1,  -1,
+       -1,  -1,  -1,  -1,  53,  -1,  -1,  -1,  -1,  -1,
+       54,  -1,  -1,  -1,  55,  56,  -1,  -1,  57,  -1,
+       -1,  58,  59,  -1,  -1,  -1,  -1,  60,  -1,  -1,
+       61,  -1,  -1,  -1,  62,  -1,  63,  64,  -1,  -1,
+       -1,  65,  66,  -1,  -1,  67,  -1,  -1,  -1,  -1,
+       -1,  -1,  68,  -1,  -1,  -1,  -1,  -1,  -1,  69,
+       -1,  -1,  70,  71,  -1,  72,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  73,  -1,  -1,  74,  75,  -1,  -1,
+       -1,  76,  -1,  -1,  -1,  -1,  77,  78,  79,  -1,
+       -1,  -1,  -1,  -1,  -1,  80,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  81,  -1,  82,  83,  -1,  -1,  84,
+       85,  -1,  -1,  -1,  86,  -1,  87,  88,  -1,  -1,
+       -1,  -1,  -1,  89,  -1,  90,  -1,  -1,  -1,  -1,
+       91,  -1,  -1,  -1,  -1,  -1,  -1,  92,  -1,  -1,
+       -1,  -1,  -1,  -1,  93,  -1,  -1,  -1,  -1,  -1,
        94,  -1,  95,  -1,  -1,  96,  -1,  -1,  -1,  97,
-       -1,  -1,  -1,  -1,  98,  -1,  -1,  99,  -1,  -1,
-       -1,  -1, 100,  -1, 101,  -1,  -1, 102,  -1, 103,
-       -1,  -1,  -1,  -1, 104,  -1,  -1, 105,  -1,  -1,
+       -1,  -1,  -1,  -1,  98,  -1,  99, 100,  -1,  -1,
+       -1,  -1, 101,  -1, 102,  -1,  -1, 103,  -1, 104,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 105,  -1,  -1,
        -1,  -1, 106,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      107,  -1,  -1, 108, 109,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 110,  -1,  -1, 111,  -1,
-       -1,  -1,  -1,  -1, 112,  -1,  -1, 113, 114, 115,
-       -1, 116,  -1,  -1,  -1,  -1,  -1, 117,  -1,  -1,
-       -1,  -1, 118, 119,  -1,  -1,  -1,  -1, 120,  -1,
-       -1,  -1, 121, 122,  -1, 123, 124,  -1,  -1,  -1,
-      125, 126, 127,  -1,  -1,  -1, 128,  -1, 129,  -1,
-       -1,  -1, 130,  -1, 131,  -1, 132,  -1,  -1, 133,
-       -1,  -1,  -1, 134, 135,  -1, 136,  -1,  -1,  -1,
-      137, 138,  -1, 139,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 140,  -1,  -1, 141, 142,  -1, 143,  -1,  -1,
-       -1, 144,  -1,  -1, 145,  -1,  -1, 146, 147,  -1,
-       -1, 148,  -1,  -1,  -1,  -1,  -1,  -1, 149,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 150,  -1,
-       -1,  -1,  -1,  -1,  -1, 151,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 152, 153,  -1,
-       -1, 154, 155, 156,  -1,  -1,  -1, 157, 158,  -1,
-      159,  -1,  -1,  -1, 160,  -1,  -1,  -1,  -1, 161,
-       -1,  -1,  -1, 162,  -1, 163,  -1,  -1,  -1, 164,
-       -1,  -1, 165, 166, 167,  -1,  -1,  -1, 168, 169,
-      170,  -1,  -1, 171,  -1,  -1, 172, 173,  -1, 174,
-       -1,  -1, 175, 176,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 177,  -1,  -1,  -1, 178,  -1,  -1, 179,
-       -1, 180,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 181,
-       -1,  -1, 182,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 183,  -1,  -1,  -1,  -1,  -1,
-       -1, 184,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      185,  -1,  -1,  -1,  -1,  -1, 186,  -1, 187,  -1,
-       -1, 188,  -1,  -1, 189, 190,  -1,  -1,  -1,  -1,
-       -1,  -1, 191, 192,  -1, 193,  -1,  -1,  -1,  -1,
-       -1, 194,  -1, 195, 196,  -1,  -1,  -1,  -1,  -1,
-      197,  -1,  -1, 198, 199,  -1,  -1,  -1, 200, 201,
-       -1,  -1,  -1,  -1,  -1,  -1, 202,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 203,  -1,
-       -1,  -1,  -1, 204,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 205,  -1,  -1,  -1,  -1, 206, 207,  -1,  -1,
-       -1, 208,  -1,  -1,  -1, 209,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 210,  -1,  -1, 211,
-       -1, 212,  -1,  -1, 213,  -1,  -1, 214,  -1, 215,
-       -1, 216,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 217,  -1,  -1, 218,  -1,
-      219, 220, 221,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      222,  -1,  -1,  -1,  -1,  -1, 223,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 224,  -1,  -1,
-      225,  -1,  -1,  -1, 226,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 227,  -1, 228,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 229,
-       -1, 230,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 231,  -1, 232,  -1,
-       -1,  -1, 233,  -1,  -1, 234,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 235,  -1,  -1,  -1,  -1,
+      107,  -1,  -1, 108, 109,  -1,  -1,  -1, 110,  -1,
+       -1,  -1,  -1,  -1, 111, 112, 113, 114,  -1, 115,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 116, 117, 118,
+       -1, 119,  -1,  -1, 120,  -1,  -1, 121, 122,  -1,
+       -1,  -1, 123, 124,  -1,  -1,  -1,  -1, 125,  -1,
+       -1,  -1,  -1, 126,  -1, 127, 128,  -1,  -1, 129,
+      130,  -1, 131,  -1, 132,  -1, 133,  -1, 134,  -1,
+       -1,  -1, 135, 136, 137,  -1, 138, 139,  -1,  -1,
+      140, 141,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 142,  -1, 143,  -1,  -1,  -1,  -1,  -1,  -1,
+      144, 145,  -1,  -1,  -1, 146,  -1, 147,  -1,  -1,
+       -1, 148,  -1,  -1, 149,  -1, 150,  -1,  -1,  -1,
+       -1, 151,  -1,  -1,  -1, 152, 153,  -1, 154,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 236, 237,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 155, 156, 157,  -1,
+       -1,  -1, 158, 159,  -1,  -1, 160, 161, 162,  -1,
+       -1, 163, 164,  -1,  -1,  -1,  -1, 165, 166,  -1,
+       -1,  -1,  -1, 167, 168,  -1,  -1,  -1,  -1, 169,
+       -1,  -1,  -1, 170,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 171,  -1,  -1,  -1, 172,  -1,
+      173,  -1,  -1, 174,  -1,  -1,  -1,  -1, 175, 176,
+       -1,  -1, 177, 178,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 179,  -1,  -1,  -1, 180,  -1,  -1, 181,
+      182,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 183,
+       -1,  -1, 184,  -1, 185,  -1,  -1,  -1,  -1, 186,
+      187,  -1,  -1,  -1, 188,  -1,  -1,  -1,  -1,  -1,
+       -1, 189,  -1,  -1,  -1,  -1, 190,  -1, 191, 192,
+      193,  -1,  -1, 194, 195,  -1,  -1,  -1,  -1,  -1,
+      196, 197, 198,  -1,  -1, 199,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 200, 201,  -1,  -1,  -1,  -1,  -1,
+       -1, 202,  -1, 203,  -1,  -1,  -1,  -1,  -1,  -1,
+      204,  -1,  -1,  -1, 205,  -1, 206,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 207,  -1,
+       -1,  -1, 208,  -1, 209,  -1, 210,  -1,  -1, 211,
+       -1,  -1,  -1, 212,  -1,  -1,  -1, 213,  -1,  -1,
+       -1, 214,  -1,  -1,  -1,  -1, 215, 216,  -1,  -1,
+      217, 218,  -1, 219,  -1, 220, 221,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 222,  -1,  -1, 223,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 224,  -1, 225,
+       -1, 226,  -1,  -1,  -1, 227,  -1,  -1,  -1, 228,
+       -1,  -1, 229,  -1,  -1,  -1,  -1,  -1, 230,  -1,
+       -1, 231,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      232,  -1,  -1,  -1,  -1,  -1, 233, 234,  -1,  -1,
+       -1,  -1,  -1,  -1, 235,  -1,  -1,  -1,  -1,  -1,
+       -1, 236,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 237,
+      238, 239,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      238,  -1,  -1, 239,  -1, 240,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 241,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 242,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 240,  -1,  -1,  -1,  -1,  -1, 241,  -1,
+       -1,  -1,  -1,  -1,  -1, 242,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 243,  -1,  -1,  -1,  -1, 244,
-       -1,  -1,  -1, 245,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 246,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 243,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      247,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      244,  -1,  -1, 245,  -1,  -1,  -1,  -1,  -1, 246,
+       -1,  -1,  -1,  -1, 247, 248,  -1,  -1,  -1,  -1,
+      249,  -1,  -1, 250,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 251,
+       -1,  -1,  -1,  -1,  -1, 252,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 253,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 254,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 255,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      248,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 249,  -1,  -1,  -1, 250,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 251,  -1, 252,
-       -1,  -1, 253,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      254,  -1,  -1,  -1,  -1,  -1,  -1, 255, 256,  -1,
+       -1, 256,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      257, 258,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 257,  -1,  -1,  -1,  -1, 258,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 259,  -1, 260,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      261,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 262,  -1,
+      263,  -1,  -1,  -1,  -1,  -1,  -1, 264,  -1,  -1,
+       -1,  -1,  -1, 265,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 259,  -1,
+      266,  -1,  -1,  -1,  -1,  -1, 267,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 260,  -1,  -1,  -1,  -1,
-       -1, 261,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 268,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 269,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 270,  -1,  -1,  -1,  -1, 271,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 272,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 262,  -1,  -1,
-       -1, 263, 264,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 265,  -1,
-       -1,  -1,  -1,  -1, 266,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 273,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -928,14 +939,14 @@ findProp (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 274,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 275,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 267,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 268,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -945,9 +956,9 @@ findProp (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 276,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 269,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -965,8 +976,7 @@ findProp (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 270
+       -1,  -1,  -1, 277
     };
 
   if (len <= MAX_WORD_LENGTH && len >= MIN_WORD_LENGTH)
@@ -988,9 +998,9 @@ findProp (register const char *str, register unsigned int len)
     }
   return 0;
 }
-#line 281 "CSSPropertyNames.gperf"
+#line 288 "CSSPropertyNames.gperf"
 
-static const char * const propertyNameStrings[271] = {
+static const char * const propertyNameStrings[278] = {
 "background",
 "background-attachment",
 "background-clip",
@@ -1001,9 +1011,14 @@ static const char * const propertyNameStrings[271] = {
 "background-position-x",
 "background-position-y",
 "background-repeat",
+"background-repeat-x",
+"background-repeat-y",
+"background-size",
 "border",
 "border-bottom",
 "border-bottom-color",
+"border-bottom-left-radius",
+"border-bottom-right-radius",
 "border-bottom-style",
 "border-bottom-width",
 "border-collapse",
@@ -1012,6 +1027,7 @@ static const char * const propertyNameStrings[271] = {
 "border-left-color",
 "border-left-style",
 "border-left-width",
+"border-radius",
 "border-right",
 "border-right-color",
 "border-right-style",
@@ -1020,6 +1036,8 @@ static const char * const propertyNameStrings[271] = {
 "border-style",
 "border-top",
 "border-top-color",
+"border-top-left-radius",
+"border-top-right-radius",
 "border-top-style",
 "border-top-width",
 "border-width",
@@ -1128,22 +1146,18 @@ static const char * const propertyNameStrings[271] = {
 "-webkit-animation-duration",
 "-webkit-animation-iteration-count",
 "-webkit-animation-name",
+"-webkit-animation-play-state",
 "-webkit-animation-timing-function",
 "-webkit-appearance",
 "-webkit-backface-visibility",
 "-webkit-background-clip",
 "-webkit-background-composite",
 "-webkit-background-origin",
-"-webkit-background-size",
 "-webkit-binding",
-"-webkit-border-bottom-left-radius",
-"-webkit-border-bottom-right-radius",
 "-webkit-border-fit",
 "-webkit-border-horizontal-spacing",
 "-webkit-border-image",
 "-webkit-border-radius",
-"-webkit-border-top-left-radius",
-"-webkit-border-top-right-radius",
 "-webkit-border-vertical-spacing",
 "-webkit-box-align",
 "-webkit-box-direction",
@@ -1167,6 +1181,7 @@ static const char * const propertyNameStrings[271] = {
 "-webkit-column-width",
 "-webkit-columns",
 "-webkit-font-size-delta",
+"-webkit-font-smoothing",
 "-webkit-highlight",
 "-webkit-line-break",
 "-webkit-line-clamp",
@@ -1191,6 +1206,8 @@ static const char * const propertyNameStrings[271] = {
 "-webkit-mask-position-x",
 "-webkit-mask-position-y",
 "-webkit-mask-repeat",
+"-webkit-mask-repeat-x",
+"-webkit-mask-repeat-y",
 "-webkit-mask-size",
 "-webkit-match-nearest-mail-blockquote-color",
 "-webkit-nbsp-mode",
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h
index fdd854c..9af7f73 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h
+++ b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h
@@ -15,271 +15,278 @@ enum CSSPropertyID {
     CSSPropertyBackgroundPositionX = 1008,
     CSSPropertyBackgroundPositionY = 1009,
     CSSPropertyBackgroundRepeat = 1010,
-    CSSPropertyBorder = 1011,
-    CSSPropertyBorderBottom = 1012,
-    CSSPropertyBorderBottomColor = 1013,
-    CSSPropertyBorderBottomStyle = 1014,
-    CSSPropertyBorderBottomWidth = 1015,
-    CSSPropertyBorderCollapse = 1016,
-    CSSPropertyBorderColor = 1017,
-    CSSPropertyBorderLeft = 1018,
-    CSSPropertyBorderLeftColor = 1019,
-    CSSPropertyBorderLeftStyle = 1020,
-    CSSPropertyBorderLeftWidth = 1021,
-    CSSPropertyBorderRight = 1022,
-    CSSPropertyBorderRightColor = 1023,
-    CSSPropertyBorderRightStyle = 1024,
-    CSSPropertyBorderRightWidth = 1025,
-    CSSPropertyBorderSpacing = 1026,
-    CSSPropertyBorderStyle = 1027,
-    CSSPropertyBorderTop = 1028,
-    CSSPropertyBorderTopColor = 1029,
-    CSSPropertyBorderTopStyle = 1030,
-    CSSPropertyBorderTopWidth = 1031,
-    CSSPropertyBorderWidth = 1032,
-    CSSPropertyBottom = 1033,
-    CSSPropertyBoxShadow = 1034,
-    CSSPropertyCaptionSide = 1035,
-    CSSPropertyClear = 1036,
-    CSSPropertyClip = 1037,
-    CSSPropertyColor = 1038,
-    CSSPropertyContent = 1039,
-    CSSPropertyCounterIncrement = 1040,
-    CSSPropertyCounterReset = 1041,
-    CSSPropertyCursor = 1042,
-    CSSPropertyDirection = 1043,
-    CSSPropertyDisplay = 1044,
-    CSSPropertyEmptyCells = 1045,
-    CSSPropertyFloat = 1046,
-    CSSPropertyFont = 1047,
-    CSSPropertyFontFamily = 1048,
-    CSSPropertyFontSize = 1049,
-    CSSPropertyFontStretch = 1050,
-    CSSPropertyFontStyle = 1051,
-    CSSPropertyFontVariant = 1052,
-    CSSPropertyFontWeight = 1053,
-    CSSPropertyHeight = 1054,
-    CSSPropertyLeft = 1055,
-    CSSPropertyLetterSpacing = 1056,
-    CSSPropertyLineHeight = 1057,
-    CSSPropertyListStyle = 1058,
-    CSSPropertyListStyleImage = 1059,
-    CSSPropertyListStylePosition = 1060,
-    CSSPropertyListStyleType = 1061,
-    CSSPropertyMargin = 1062,
-    CSSPropertyMarginBottom = 1063,
-    CSSPropertyMarginLeft = 1064,
-    CSSPropertyMarginRight = 1065,
-    CSSPropertyMarginTop = 1066,
-    CSSPropertyMaxHeight = 1067,
-    CSSPropertyMaxWidth = 1068,
-    CSSPropertyMinHeight = 1069,
-    CSSPropertyMinWidth = 1070,
-    CSSPropertyOpacity = 1071,
-    CSSPropertyOrphans = 1072,
-    CSSPropertyOutline = 1073,
-    CSSPropertyOutlineColor = 1074,
-    CSSPropertyOutlineOffset = 1075,
-    CSSPropertyOutlineStyle = 1076,
-    CSSPropertyOutlineWidth = 1077,
-    CSSPropertyOverflow = 1078,
-    CSSPropertyOverflowX = 1079,
-    CSSPropertyOverflowY = 1080,
-    CSSPropertyPadding = 1081,
-    CSSPropertyPaddingBottom = 1082,
-    CSSPropertyPaddingLeft = 1083,
-    CSSPropertyPaddingRight = 1084,
-    CSSPropertyPaddingTop = 1085,
-    CSSPropertyPage = 1086,
-    CSSPropertyPageBreakAfter = 1087,
-    CSSPropertyPageBreakBefore = 1088,
-    CSSPropertyPageBreakInside = 1089,
-    CSSPropertyPointerEvents = 1090,
-    CSSPropertyPosition = 1091,
-    CSSPropertyQuotes = 1092,
-    CSSPropertyResize = 1093,
-    CSSPropertyRight = 1094,
-    CSSPropertySize = 1095,
-    CSSPropertySrc = 1096,
-    CSSPropertyTableLayout = 1097,
-    CSSPropertyTextAlign = 1098,
-    CSSPropertyTextDecoration = 1099,
-    CSSPropertyTextIndent = 1100,
-    CSSPropertyTextLineThrough = 1101,
-    CSSPropertyTextLineThroughColor = 1102,
-    CSSPropertyTextLineThroughMode = 1103,
-    CSSPropertyTextLineThroughStyle = 1104,
-    CSSPropertyTextLineThroughWidth = 1105,
-    CSSPropertyTextOverflow = 1106,
-    CSSPropertyTextOverline = 1107,
-    CSSPropertyTextOverlineColor = 1108,
-    CSSPropertyTextOverlineMode = 1109,
-    CSSPropertyTextOverlineStyle = 1110,
-    CSSPropertyTextOverlineWidth = 1111,
-    CSSPropertyTextShadow = 1112,
-    CSSPropertyTextTransform = 1113,
-    CSSPropertyTextUnderline = 1114,
-    CSSPropertyTextUnderlineColor = 1115,
-    CSSPropertyTextUnderlineMode = 1116,
-    CSSPropertyTextUnderlineStyle = 1117,
-    CSSPropertyTextUnderlineWidth = 1118,
-    CSSPropertyTop = 1119,
-    CSSPropertyUnicodeBidi = 1120,
-    CSSPropertyUnicodeRange = 1121,
-    CSSPropertyVerticalAlign = 1122,
-    CSSPropertyVisibility = 1123,
-    CSSPropertyWhiteSpace = 1124,
-    CSSPropertyWidows = 1125,
-    CSSPropertyWidth = 1126,
-    CSSPropertyWordBreak = 1127,
-    CSSPropertyWordSpacing = 1128,
-    CSSPropertyWordWrap = 1129,
-    CSSPropertyZIndex = 1130,
-    CSSPropertyZoom = 1131,
-    CSSPropertyWebkitAnimation = 1132,
-    CSSPropertyWebkitAnimationDelay = 1133,
-    CSSPropertyWebkitAnimationDirection = 1134,
-    CSSPropertyWebkitAnimationDuration = 1135,
-    CSSPropertyWebkitAnimationIterationCount = 1136,
-    CSSPropertyWebkitAnimationName = 1137,
-    CSSPropertyWebkitAnimationTimingFunction = 1138,
-    CSSPropertyWebkitAppearance = 1139,
-    CSSPropertyWebkitBackfaceVisibility = 1140,
-    CSSPropertyWebkitBackgroundClip = 1141,
-    CSSPropertyWebkitBackgroundComposite = 1142,
-    CSSPropertyWebkitBackgroundOrigin = 1143,
-    CSSPropertyWebkitBackgroundSize = 1144,
-    CSSPropertyWebkitBinding = 1145,
-    CSSPropertyWebkitBorderBottomLeftRadius = 1146,
-    CSSPropertyWebkitBorderBottomRightRadius = 1147,
-    CSSPropertyWebkitBorderFit = 1148,
-    CSSPropertyWebkitBorderHorizontalSpacing = 1149,
-    CSSPropertyWebkitBorderImage = 1150,
-    CSSPropertyWebkitBorderRadius = 1151,
-    CSSPropertyWebkitBorderTopLeftRadius = 1152,
-    CSSPropertyWebkitBorderTopRightRadius = 1153,
-    CSSPropertyWebkitBorderVerticalSpacing = 1154,
-    CSSPropertyWebkitBoxAlign = 1155,
-    CSSPropertyWebkitBoxDirection = 1156,
-    CSSPropertyWebkitBoxFlex = 1157,
-    CSSPropertyWebkitBoxFlexGroup = 1158,
-    CSSPropertyWebkitBoxLines = 1159,
-    CSSPropertyWebkitBoxOrdinalGroup = 1160,
-    CSSPropertyWebkitBoxOrient = 1161,
-    CSSPropertyWebkitBoxPack = 1162,
-    CSSPropertyWebkitBoxReflect = 1163,
-    CSSPropertyWebkitBoxSizing = 1164,
-    CSSPropertyWebkitColumnBreakAfter = 1165,
-    CSSPropertyWebkitColumnBreakBefore = 1166,
-    CSSPropertyWebkitColumnBreakInside = 1167,
-    CSSPropertyWebkitColumnCount = 1168,
-    CSSPropertyWebkitColumnGap = 1169,
-    CSSPropertyWebkitColumnRule = 1170,
-    CSSPropertyWebkitColumnRuleColor = 1171,
-    CSSPropertyWebkitColumnRuleStyle = 1172,
-    CSSPropertyWebkitColumnRuleWidth = 1173,
-    CSSPropertyWebkitColumnWidth = 1174,
-    CSSPropertyWebkitColumns = 1175,
-    CSSPropertyWebkitFontSizeDelta = 1176,
-    CSSPropertyWebkitHighlight = 1177,
-    CSSPropertyWebkitLineBreak = 1178,
-    CSSPropertyWebkitLineClamp = 1179,
-    CSSPropertyWebkitMarginBottomCollapse = 1180,
-    CSSPropertyWebkitMarginCollapse = 1181,
-    CSSPropertyWebkitMarginStart = 1182,
-    CSSPropertyWebkitMarginTopCollapse = 1183,
-    CSSPropertyWebkitMarquee = 1184,
-    CSSPropertyWebkitMarqueeDirection = 1185,
-    CSSPropertyWebkitMarqueeIncrement = 1186,
-    CSSPropertyWebkitMarqueeRepetition = 1187,
-    CSSPropertyWebkitMarqueeSpeed = 1188,
-    CSSPropertyWebkitMarqueeStyle = 1189,
-    CSSPropertyWebkitMask = 1190,
-    CSSPropertyWebkitMaskAttachment = 1191,
-    CSSPropertyWebkitMaskBoxImage = 1192,
-    CSSPropertyWebkitMaskClip = 1193,
-    CSSPropertyWebkitMaskComposite = 1194,
-    CSSPropertyWebkitMaskImage = 1195,
-    CSSPropertyWebkitMaskOrigin = 1196,
-    CSSPropertyWebkitMaskPosition = 1197,
-    CSSPropertyWebkitMaskPositionX = 1198,
-    CSSPropertyWebkitMaskPositionY = 1199,
-    CSSPropertyWebkitMaskRepeat = 1200,
-    CSSPropertyWebkitMaskSize = 1201,
-    CSSPropertyWebkitMatchNearestMailBlockquoteColor = 1202,
-    CSSPropertyWebkitNbspMode = 1203,
-    CSSPropertyWebkitPaddingStart = 1204,
-    CSSPropertyWebkitPerspective = 1205,
-    CSSPropertyWebkitPerspectiveOrigin = 1206,
-    CSSPropertyWebkitPerspectiveOriginX = 1207,
-    CSSPropertyWebkitPerspectiveOriginY = 1208,
-    CSSPropertyWebkitRtlOrdering = 1209,
-    CSSPropertyWebkitTextDecorationsInEffect = 1210,
-    CSSPropertyWebkitTextFillColor = 1211,
-    CSSPropertyWebkitTextSecurity = 1212,
-    CSSPropertyWebkitTextSizeAdjust = 1213,
-    CSSPropertyWebkitTextStroke = 1214,
-    CSSPropertyWebkitTextStrokeColor = 1215,
-    CSSPropertyWebkitTextStrokeWidth = 1216,
-    CSSPropertyWebkitTransform = 1217,
-    CSSPropertyWebkitTransformOrigin = 1218,
-    CSSPropertyWebkitTransformOriginX = 1219,
-    CSSPropertyWebkitTransformOriginY = 1220,
-    CSSPropertyWebkitTransformOriginZ = 1221,
-    CSSPropertyWebkitTransformStyle = 1222,
-    CSSPropertyWebkitTransition = 1223,
-    CSSPropertyWebkitTransitionDelay = 1224,
-    CSSPropertyWebkitTransitionDuration = 1225,
-    CSSPropertyWebkitTransitionProperty = 1226,
-    CSSPropertyWebkitTransitionTimingFunction = 1227,
-    CSSPropertyWebkitUserDrag = 1228,
-    CSSPropertyWebkitUserModify = 1229,
-    CSSPropertyWebkitUserSelect = 1230,
-    CSSPropertyWebkitVariableDeclarationBlock = 1231,
-    CSSPropertyClipPath = 1232,
-    CSSPropertyClipRule = 1233,
-    CSSPropertyMask = 1234,
-    CSSPropertyEnableBackground = 1235,
-    CSSPropertyFilter = 1236,
-    CSSPropertyFloodColor = 1237,
-    CSSPropertyFloodOpacity = 1238,
-    CSSPropertyLightingColor = 1239,
-    CSSPropertyStopColor = 1240,
-    CSSPropertyStopOpacity = 1241,
-    CSSPropertyColorInterpolation = 1242,
-    CSSPropertyColorInterpolationFilters = 1243,
-    CSSPropertyColorProfile = 1244,
-    CSSPropertyColorRendering = 1245,
-    CSSPropertyFill = 1246,
-    CSSPropertyFillOpacity = 1247,
-    CSSPropertyFillRule = 1248,
-    CSSPropertyImageRendering = 1249,
-    CSSPropertyMarker = 1250,
-    CSSPropertyMarkerEnd = 1251,
-    CSSPropertyMarkerMid = 1252,
-    CSSPropertyMarkerStart = 1253,
-    CSSPropertyShapeRendering = 1254,
-    CSSPropertyStroke = 1255,
-    CSSPropertyStrokeDasharray = 1256,
-    CSSPropertyStrokeDashoffset = 1257,
-    CSSPropertyStrokeLinecap = 1258,
-    CSSPropertyStrokeLinejoin = 1259,
-    CSSPropertyStrokeMiterlimit = 1260,
-    CSSPropertyStrokeOpacity = 1261,
-    CSSPropertyStrokeWidth = 1262,
-    CSSPropertyTextRendering = 1263,
-    CSSPropertyAlignmentBaseline = 1264,
-    CSSPropertyBaselineShift = 1265,
-    CSSPropertyDominantBaseline = 1266,
-    CSSPropertyGlyphOrientationHorizontal = 1267,
-    CSSPropertyGlyphOrientationVertical = 1268,
-    CSSPropertyKerning = 1269,
-    CSSPropertyTextAnchor = 1270,
-    CSSPropertyWritingMode = 1271
+    CSSPropertyBackgroundRepeatX = 1011,
+    CSSPropertyBackgroundRepeatY = 1012,
+    CSSPropertyBackgroundSize = 1013,
+    CSSPropertyBorder = 1014,
+    CSSPropertyBorderBottom = 1015,
+    CSSPropertyBorderBottomColor = 1016,
+    CSSPropertyBorderBottomLeftRadius = 1017,
+    CSSPropertyBorderBottomRightRadius = 1018,
+    CSSPropertyBorderBottomStyle = 1019,
+    CSSPropertyBorderBottomWidth = 1020,
+    CSSPropertyBorderCollapse = 1021,
+    CSSPropertyBorderColor = 1022,
+    CSSPropertyBorderLeft = 1023,
+    CSSPropertyBorderLeftColor = 1024,
+    CSSPropertyBorderLeftStyle = 1025,
+    CSSPropertyBorderLeftWidth = 1026,
+    CSSPropertyBorderRadius = 1027,
+    CSSPropertyBorderRight = 1028,
+    CSSPropertyBorderRightColor = 1029,
+    CSSPropertyBorderRightStyle = 1030,
+    CSSPropertyBorderRightWidth = 1031,
+    CSSPropertyBorderSpacing = 1032,
+    CSSPropertyBorderStyle = 1033,
+    CSSPropertyBorderTop = 1034,
+    CSSPropertyBorderTopColor = 1035,
+    CSSPropertyBorderTopLeftRadius = 1036,
+    CSSPropertyBorderTopRightRadius = 1037,
+    CSSPropertyBorderTopStyle = 1038,
+    CSSPropertyBorderTopWidth = 1039,
+    CSSPropertyBorderWidth = 1040,
+    CSSPropertyBottom = 1041,
+    CSSPropertyBoxShadow = 1042,
+    CSSPropertyCaptionSide = 1043,
+    CSSPropertyClear = 1044,
+    CSSPropertyClip = 1045,
+    CSSPropertyColor = 1046,
+    CSSPropertyContent = 1047,
+    CSSPropertyCounterIncrement = 1048,
+    CSSPropertyCounterReset = 1049,
+    CSSPropertyCursor = 1050,
+    CSSPropertyDirection = 1051,
+    CSSPropertyDisplay = 1052,
+    CSSPropertyEmptyCells = 1053,
+    CSSPropertyFloat = 1054,
+    CSSPropertyFont = 1055,
+    CSSPropertyFontFamily = 1056,
+    CSSPropertyFontSize = 1057,
+    CSSPropertyFontStretch = 1058,
+    CSSPropertyFontStyle = 1059,
+    CSSPropertyFontVariant = 1060,
+    CSSPropertyFontWeight = 1061,
+    CSSPropertyHeight = 1062,
+    CSSPropertyLeft = 1063,
+    CSSPropertyLetterSpacing = 1064,
+    CSSPropertyLineHeight = 1065,
+    CSSPropertyListStyle = 1066,
+    CSSPropertyListStyleImage = 1067,
+    CSSPropertyListStylePosition = 1068,
+    CSSPropertyListStyleType = 1069,
+    CSSPropertyMargin = 1070,
+    CSSPropertyMarginBottom = 1071,
+    CSSPropertyMarginLeft = 1072,
+    CSSPropertyMarginRight = 1073,
+    CSSPropertyMarginTop = 1074,
+    CSSPropertyMaxHeight = 1075,
+    CSSPropertyMaxWidth = 1076,
+    CSSPropertyMinHeight = 1077,
+    CSSPropertyMinWidth = 1078,
+    CSSPropertyOpacity = 1079,
+    CSSPropertyOrphans = 1080,
+    CSSPropertyOutline = 1081,
+    CSSPropertyOutlineColor = 1082,
+    CSSPropertyOutlineOffset = 1083,
+    CSSPropertyOutlineStyle = 1084,
+    CSSPropertyOutlineWidth = 1085,
+    CSSPropertyOverflow = 1086,
+    CSSPropertyOverflowX = 1087,
+    CSSPropertyOverflowY = 1088,
+    CSSPropertyPadding = 1089,
+    CSSPropertyPaddingBottom = 1090,
+    CSSPropertyPaddingLeft = 1091,
+    CSSPropertyPaddingRight = 1092,
+    CSSPropertyPaddingTop = 1093,
+    CSSPropertyPage = 1094,
+    CSSPropertyPageBreakAfter = 1095,
+    CSSPropertyPageBreakBefore = 1096,
+    CSSPropertyPageBreakInside = 1097,
+    CSSPropertyPointerEvents = 1098,
+    CSSPropertyPosition = 1099,
+    CSSPropertyQuotes = 1100,
+    CSSPropertyResize = 1101,
+    CSSPropertyRight = 1102,
+    CSSPropertySize = 1103,
+    CSSPropertySrc = 1104,
+    CSSPropertyTableLayout = 1105,
+    CSSPropertyTextAlign = 1106,
+    CSSPropertyTextDecoration = 1107,
+    CSSPropertyTextIndent = 1108,
+    CSSPropertyTextLineThrough = 1109,
+    CSSPropertyTextLineThroughColor = 1110,
+    CSSPropertyTextLineThroughMode = 1111,
+    CSSPropertyTextLineThroughStyle = 1112,
+    CSSPropertyTextLineThroughWidth = 1113,
+    CSSPropertyTextOverflow = 1114,
+    CSSPropertyTextOverline = 1115,
+    CSSPropertyTextOverlineColor = 1116,
+    CSSPropertyTextOverlineMode = 1117,
+    CSSPropertyTextOverlineStyle = 1118,
+    CSSPropertyTextOverlineWidth = 1119,
+    CSSPropertyTextShadow = 1120,
+    CSSPropertyTextTransform = 1121,
+    CSSPropertyTextUnderline = 1122,
+    CSSPropertyTextUnderlineColor = 1123,
+    CSSPropertyTextUnderlineMode = 1124,
+    CSSPropertyTextUnderlineStyle = 1125,
+    CSSPropertyTextUnderlineWidth = 1126,
+    CSSPropertyTop = 1127,
+    CSSPropertyUnicodeBidi = 1128,
+    CSSPropertyUnicodeRange = 1129,
+    CSSPropertyVerticalAlign = 1130,
+    CSSPropertyVisibility = 1131,
+    CSSPropertyWhiteSpace = 1132,
+    CSSPropertyWidows = 1133,
+    CSSPropertyWidth = 1134,
+    CSSPropertyWordBreak = 1135,
+    CSSPropertyWordSpacing = 1136,
+    CSSPropertyWordWrap = 1137,
+    CSSPropertyZIndex = 1138,
+    CSSPropertyZoom = 1139,
+    CSSPropertyWebkitAnimation = 1140,
+    CSSPropertyWebkitAnimationDelay = 1141,
+    CSSPropertyWebkitAnimationDirection = 1142,
+    CSSPropertyWebkitAnimationDuration = 1143,
+    CSSPropertyWebkitAnimationIterationCount = 1144,
+    CSSPropertyWebkitAnimationName = 1145,
+    CSSPropertyWebkitAnimationPlayState = 1146,
+    CSSPropertyWebkitAnimationTimingFunction = 1147,
+    CSSPropertyWebkitAppearance = 1148,
+    CSSPropertyWebkitBackfaceVisibility = 1149,
+    CSSPropertyWebkitBackgroundClip = 1150,
+    CSSPropertyWebkitBackgroundComposite = 1151,
+    CSSPropertyWebkitBackgroundOrigin = 1152,
+    CSSPropertyWebkitBinding = 1153,
+    CSSPropertyWebkitBorderFit = 1154,
+    CSSPropertyWebkitBorderHorizontalSpacing = 1155,
+    CSSPropertyWebkitBorderImage = 1156,
+    CSSPropertyWebkitBorderRadius = 1157,
+    CSSPropertyWebkitBorderVerticalSpacing = 1158,
+    CSSPropertyWebkitBoxAlign = 1159,
+    CSSPropertyWebkitBoxDirection = 1160,
+    CSSPropertyWebkitBoxFlex = 1161,
+    CSSPropertyWebkitBoxFlexGroup = 1162,
+    CSSPropertyWebkitBoxLines = 1163,
+    CSSPropertyWebkitBoxOrdinalGroup = 1164,
+    CSSPropertyWebkitBoxOrient = 1165,
+    CSSPropertyWebkitBoxPack = 1166,
+    CSSPropertyWebkitBoxReflect = 1167,
+    CSSPropertyWebkitBoxSizing = 1168,
+    CSSPropertyWebkitColumnBreakAfter = 1169,
+    CSSPropertyWebkitColumnBreakBefore = 1170,
+    CSSPropertyWebkitColumnBreakInside = 1171,
+    CSSPropertyWebkitColumnCount = 1172,
+    CSSPropertyWebkitColumnGap = 1173,
+    CSSPropertyWebkitColumnRule = 1174,
+    CSSPropertyWebkitColumnRuleColor = 1175,
+    CSSPropertyWebkitColumnRuleStyle = 1176,
+    CSSPropertyWebkitColumnRuleWidth = 1177,
+    CSSPropertyWebkitColumnWidth = 1178,
+    CSSPropertyWebkitColumns = 1179,
+    CSSPropertyWebkitFontSizeDelta = 1180,
+    CSSPropertyWebkitFontSmoothing = 1181,
+    CSSPropertyWebkitHighlight = 1182,
+    CSSPropertyWebkitLineBreak = 1183,
+    CSSPropertyWebkitLineClamp = 1184,
+    CSSPropertyWebkitMarginBottomCollapse = 1185,
+    CSSPropertyWebkitMarginCollapse = 1186,
+    CSSPropertyWebkitMarginStart = 1187,
+    CSSPropertyWebkitMarginTopCollapse = 1188,
+    CSSPropertyWebkitMarquee = 1189,
+    CSSPropertyWebkitMarqueeDirection = 1190,
+    CSSPropertyWebkitMarqueeIncrement = 1191,
+    CSSPropertyWebkitMarqueeRepetition = 1192,
+    CSSPropertyWebkitMarqueeSpeed = 1193,
+    CSSPropertyWebkitMarqueeStyle = 1194,
+    CSSPropertyWebkitMask = 1195,
+    CSSPropertyWebkitMaskAttachment = 1196,
+    CSSPropertyWebkitMaskBoxImage = 1197,
+    CSSPropertyWebkitMaskClip = 1198,
+    CSSPropertyWebkitMaskComposite = 1199,
+    CSSPropertyWebkitMaskImage = 1200,
+    CSSPropertyWebkitMaskOrigin = 1201,
+    CSSPropertyWebkitMaskPosition = 1202,
+    CSSPropertyWebkitMaskPositionX = 1203,
+    CSSPropertyWebkitMaskPositionY = 1204,
+    CSSPropertyWebkitMaskRepeat = 1205,
+    CSSPropertyWebkitMaskRepeatX = 1206,
+    CSSPropertyWebkitMaskRepeatY = 1207,
+    CSSPropertyWebkitMaskSize = 1208,
+    CSSPropertyWebkitMatchNearestMailBlockquoteColor = 1209,
+    CSSPropertyWebkitNbspMode = 1210,
+    CSSPropertyWebkitPaddingStart = 1211,
+    CSSPropertyWebkitPerspective = 1212,
+    CSSPropertyWebkitPerspectiveOrigin = 1213,
+    CSSPropertyWebkitPerspectiveOriginX = 1214,
+    CSSPropertyWebkitPerspectiveOriginY = 1215,
+    CSSPropertyWebkitRtlOrdering = 1216,
+    CSSPropertyWebkitTextDecorationsInEffect = 1217,
+    CSSPropertyWebkitTextFillColor = 1218,
+    CSSPropertyWebkitTextSecurity = 1219,
+    CSSPropertyWebkitTextSizeAdjust = 1220,
+    CSSPropertyWebkitTextStroke = 1221,
+    CSSPropertyWebkitTextStrokeColor = 1222,
+    CSSPropertyWebkitTextStrokeWidth = 1223,
+    CSSPropertyWebkitTransform = 1224,
+    CSSPropertyWebkitTransformOrigin = 1225,
+    CSSPropertyWebkitTransformOriginX = 1226,
+    CSSPropertyWebkitTransformOriginY = 1227,
+    CSSPropertyWebkitTransformOriginZ = 1228,
+    CSSPropertyWebkitTransformStyle = 1229,
+    CSSPropertyWebkitTransition = 1230,
+    CSSPropertyWebkitTransitionDelay = 1231,
+    CSSPropertyWebkitTransitionDuration = 1232,
+    CSSPropertyWebkitTransitionProperty = 1233,
+    CSSPropertyWebkitTransitionTimingFunction = 1234,
+    CSSPropertyWebkitUserDrag = 1235,
+    CSSPropertyWebkitUserModify = 1236,
+    CSSPropertyWebkitUserSelect = 1237,
+    CSSPropertyWebkitVariableDeclarationBlock = 1238,
+    CSSPropertyClipPath = 1239,
+    CSSPropertyClipRule = 1240,
+    CSSPropertyMask = 1241,
+    CSSPropertyEnableBackground = 1242,
+    CSSPropertyFilter = 1243,
+    CSSPropertyFloodColor = 1244,
+    CSSPropertyFloodOpacity = 1245,
+    CSSPropertyLightingColor = 1246,
+    CSSPropertyStopColor = 1247,
+    CSSPropertyStopOpacity = 1248,
+    CSSPropertyColorInterpolation = 1249,
+    CSSPropertyColorInterpolationFilters = 1250,
+    CSSPropertyColorProfile = 1251,
+    CSSPropertyColorRendering = 1252,
+    CSSPropertyFill = 1253,
+    CSSPropertyFillOpacity = 1254,
+    CSSPropertyFillRule = 1255,
+    CSSPropertyImageRendering = 1256,
+    CSSPropertyMarker = 1257,
+    CSSPropertyMarkerEnd = 1258,
+    CSSPropertyMarkerMid = 1259,
+    CSSPropertyMarkerStart = 1260,
+    CSSPropertyShapeRendering = 1261,
+    CSSPropertyStroke = 1262,
+    CSSPropertyStrokeDasharray = 1263,
+    CSSPropertyStrokeDashoffset = 1264,
+    CSSPropertyStrokeLinecap = 1265,
+    CSSPropertyStrokeLinejoin = 1266,
+    CSSPropertyStrokeMiterlimit = 1267,
+    CSSPropertyStrokeOpacity = 1268,
+    CSSPropertyStrokeWidth = 1269,
+    CSSPropertyTextRendering = 1270,
+    CSSPropertyAlignmentBaseline = 1271,
+    CSSPropertyBaselineShift = 1272,
+    CSSPropertyDominantBaseline = 1273,
+    CSSPropertyGlyphOrientationHorizontal = 1274,
+    CSSPropertyGlyphOrientationVertical = 1275,
+    CSSPropertyKerning = 1276,
+    CSSPropertyTextAnchor = 1277,
+    CSSPropertyWritingMode = 1278,
 };
 
 const int firstCSSProperty = 1001;
-const int numCSSProperties = 271;
+const int numCSSProperties = 278;
 const size_t maxCSSPropertyNameLength = 43;
 
 const char* getPropertyName(CSSPropertyID);
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.c b/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.c
index 44df1ce..1975392 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.c
+++ b/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.c
@@ -191,7 +191,7 @@ findValue (register const char *str, register unsigned int len)
 {
   enum
     {
-      TOTAL_KEYWORDS = 540,
+      TOTAL_KEYWORDS = 548,
       MIN_WORD_LENGTH = 2,
       MAX_WORD_LENGTH = 31,
       MIN_HASH_VALUE = 0,
@@ -204,9 +204,9 @@ findValue (register const char *str, register unsigned int len)
       {"100", CSSValue100},
 #line 42 "CSSValueKeywords.gperf"
       {"300", CSSValue300},
-#line 288 "CSSValueKeywords.gperf"
+#line 289 "CSSValueKeywords.gperf"
       {"end", CSSValueEnd},
-#line 548 "CSSValueKeywords.gperf"
+#line 556 "CSSValueKeywords.gperf"
       {"lr", CSSValueLr},
 #line 48 "CSSValueKeywords.gperf"
       {"900", CSSValue900},
@@ -226,25 +226,25 @@ findValue (register const char *str, register unsigned int len)
       {"400", CSSValue400},
 #line 41 "CSSValueKeywords.gperf"
       {"200", CSSValue200},
-#line 482 "CSSValueKeywords.gperf"
+#line 490 "CSSValueKeywords.gperf"
       {"oldlace", CSSValueOldlace},
 #line 71 "CSSValueKeywords.gperf"
       {"cursive", CSSValueCursive},
-#line 242 "CSSValueKeywords.gperf"
+#line 243 "CSSValueKeywords.gperf"
       {"above", CSSValueAbove},
-#line 252 "CSSValueKeywords.gperf"
+#line 253 "CSSValueKeywords.gperf"
       {"cross", CSSValueCross},
-#line 403 "CSSValueKeywords.gperf"
+#line 411 "CSSValueKeywords.gperf"
       {"coral", CSSValueCoral},
 #line 13 "CSSValueKeywords.gperf"
       {"none", CSSValueNone},
-#line 494 "CSSValueKeywords.gperf"
+#line 502 "CSSValueKeywords.gperf"
       {"plum", CSSValuePlum},
-#line 550 "CSSValueKeywords.gperf"
+#line 558 "CSSValueKeywords.gperf"
       {"tb", CSSValueTb},
 #line 86 "CSSValueKeywords.gperf"
       {"purple", CSSValuePurple},
-#line 251 "CSSValueKeywords.gperf"
+#line 252 "CSSValueKeywords.gperf"
       {"crop", CSSValueCrop},
 #line 36 "CSSValueKeywords.gperf"
       {"normal", CSSValueNormal},
@@ -252,65 +252,67 @@ findValue (register const char *str, register unsigned int len)
       {"inline", CSSValueInline},
 #line 176 "CSSValueKeywords.gperf"
       {"armenian", CSSValueArmenian},
-#line 241 "CSSValueKeywords.gperf"
+#line 242 "CSSValueKeywords.gperf"
       {"collapse", CSSValueCollapse},
 #line 73 "CSSValueKeywords.gperf"
       {"monospace", CSSValueMonospace},
-#line 215 "CSSValueKeywords.gperf"
+#line 216 "CSSValueKeywords.gperf"
       {"e-resize", CSSValueEResize},
-#line 372 "CSSValueKeywords.gperf"
+#line 378 "CSSValueKeywords.gperf"
       {"lines", CSSValueLines},
-#line 221 "CSSValueKeywords.gperf"
+#line 222 "CSSValueKeywords.gperf"
       {"s-resize", CSSValueSResize},
-#line 314 "CSSValueKeywords.gperf"
+#line 315 "CSSValueKeywords.gperf"
       {"ellipsis", CSSValueEllipsis},
 #line 84 "CSSValueKeywords.gperf"
       {"olive", CSSValueOlive},
-#line 209 "CSSValueKeywords.gperf"
+#line 210 "CSSValueKeywords.gperf"
       {"alias", CSSValueAlias},
 #line 81 "CSSValueKeywords.gperf"
       {"lime", CSSValueLime},
 #line 164 "CSSValueKeywords.gperf"
       {"circle", CSSValueCircle},
-#line 466 "CSSValueKeywords.gperf"
+#line 474 "CSSValueKeywords.gperf"
       {"linen", CSSValueLinen},
-#line 218 "CSSValueKeywords.gperf"
+#line 219 "CSSValueKeywords.gperf"
       {"n-resize", CSSValueNResize},
 #line 15 "CSSValueKeywords.gperf"
       {"inset", CSSValueInset},
-#line 295 "CSSValueKeywords.gperf"
+#line 296 "CSSValueKeywords.gperf"
       {"multiple", CSSValueMultiple},
-#line 402 "CSSValueKeywords.gperf"
+#line 410 "CSSValueKeywords.gperf"
       {"chocolate", CSSValueChocolate},
-#line 313 "CSSValueKeywords.gperf"
+#line 314 "CSSValueKeywords.gperf"
       {"clip", CSSValueClip},
-#line 406 "CSSValueKeywords.gperf"
+#line 374 "CSSValueKeywords.gperf"
+      {"contain", CSSValueContain},
+#line 414 "CSSValueKeywords.gperf"
       {"crimson", CSSValueCrimson},
-#line 405 "CSSValueKeywords.gperf"
+#line 413 "CSSValueKeywords.gperf"
       {"cornsilk", CSSValueCornsilk},
 #line 187 "CSSValueKeywords.gperf"
       {"compact", CSSValueCompact},
-#line 278 "CSSValueKeywords.gperf"
+#line 279 "CSSValueKeywords.gperf"
       {"scroll", CSSValueScroll},
-#line 253 "CSSValueKeywords.gperf"
+#line 254 "CSSValueKeywords.gperf"
       {"embed", CSSValueEmbed},
-#line 513 "CSSValueKeywords.gperf"
+#line 521 "CSSValueKeywords.gperf"
       {"tomato", CSSValueTomato},
 #line 150 "CSSValueKeywords.gperf"
       {"top", CSSValueTop},
-#line 263 "CSSValueKeywords.gperf"
+#line 264 "CSSValueKeywords.gperf"
       {"loud", CSSValueLoud},
-#line 366 "CSSValueKeywords.gperf"
+#line 370 "CSSValueKeywords.gperf"
       {"content", CSSValueContent},
 #line 77 "CSSValueKeywords.gperf"
       {"blue", CSSValueBlue},
-#line 262 "CSSValueKeywords.gperf"
+#line 263 "CSSValueKeywords.gperf"
       {"local", CSSValueLocal},
-#line 515 "CSSValueKeywords.gperf"
+#line 523 "CSSValueKeywords.gperf"
       {"violet", CSSValueViolet},
-#line 493 "CSSValueKeywords.gperf"
+#line 501 "CSSValueKeywords.gperf"
       {"pink", CSSValuePink},
-#line 283 "CSSValueKeywords.gperf"
+#line 284 "CSSValueKeywords.gperf"
       {"thin", CSSValueThin},
 #line 51 "CSSValueKeywords.gperf"
       {"small", CSSValueSmall},
@@ -322,61 +324,61 @@ findValue (register const char *str, register unsigned int len)
       {"initial", CSSValueInitial},
 #line 82 "CSSValueKeywords.gperf"
       {"maroon", CSSValueMaroon},
-#line 377 "CSSValueKeywords.gperf"
+#line 383 "CSSValueKeywords.gperf"
       {"ease", CSSValueEase},
-#line 499 "CSSValueKeywords.gperf"
+#line 507 "CSSValueKeywords.gperf"
       {"salmon", CSSValueSalmon},
-#line 511 "CSSValueKeywords.gperf"
+#line 519 "CSSValueKeywords.gperf"
       {"tan", CSSValueTan},
-#line 354 "CSSValueKeywords.gperf"
+#line 358 "CSSValueKeywords.gperf"
       {"caret", CSSValueCaret},
-#line 512 "CSSValueKeywords.gperf"
+#line 520 "CSSValueKeywords.gperf"
       {"thistle", CSSValueThistle},
 #line 189 "CSSValueKeywords.gperf"
       {"table", CSSValueTable},
-#line 282 "CSSValueKeywords.gperf"
+#line 283 "CSSValueKeywords.gperf"
       {"thick", CSSValueThick},
-#line 480 "CSSValueKeywords.gperf"
+#line 488 "CSSValueKeywords.gperf"
       {"moccasin", CSSValueMoccasin},
-#line 545 "CSSValueKeywords.gperf"
+#line 553 "CSSValueKeywords.gperf"
       {"lr-tb", CSSValueLrTb},
 #line 162 "CSSValueKeywords.gperf"
       {"inside", CSSValueInside},
-#line 304 "CSSValueKeywords.gperf"
+#line 305 "CSSValueKeywords.gperf"
       {"slide", CSSValueSlide},
 #line 145 "CSSValueKeywords.gperf"
       {"middle", CSSValueMiddle},
-#line 393 "CSSValueKeywords.gperf"
+#line 401 "CSSValueKeywords.gperf"
       {"azure", CSSValueAzure},
 #line 75 "CSSValueKeywords.gperf"
       {"aqua", CSSValueAqua},
-#line 407 "CSSValueKeywords.gperf"
+#line 415 "CSSValueKeywords.gperf"
       {"cyan", CSSValueCyan},
-#line 549 "CSSValueKeywords.gperf"
+#line 557 "CSSValueKeywords.gperf"
       {"rl", CSSValueRl},
-#line 323 "CSSValueKeywords.gperf"
+#line 324 "CSSValueKeywords.gperf"
       {"space", CSSValueSpace},
-#line 397 "CSSValueKeywords.gperf"
+#line 405 "CSSValueKeywords.gperf"
       {"blueviolet", CSSValueBlueviolet},
 #line 184 "CSSValueKeywords.gperf"
       {"block", CSSValueBlock},
 #line 163 "CSSValueKeywords.gperf"
       {"disc", CSSValueDisc},
-#line 333 "CSSValueKeywords.gperf"
+#line 334 "CSSValueKeywords.gperf"
       {"listitem", CSSValueListitem},
 #line 16 "CSSValueKeywords.gperf"
       {"groove", CSSValueGroove},
-#line 235 "CSSValueKeywords.gperf"
+#line 236 "CSSValueKeywords.gperf"
       {"ltr", CSSValueLtr},
-#line 201 "CSSValueKeywords.gperf"
+#line 202 "CSSValueKeywords.gperf"
       {"auto", CSSValueAuto},
-#line 445 "CSSValueKeywords.gperf"
+#line 453 "CSSValueKeywords.gperf"
       {"khaki", CSSValueKhaki},
-#line 443 "CSSValueKeywords.gperf"
+#line 451 "CSSValueKeywords.gperf"
       {"indigo", CSSValueIndigo},
-#line 547 "CSSValueKeywords.gperf"
+#line 555 "CSSValueKeywords.gperf"
       {"tb-rl", CSSValueTbRl},
-#line 374 "CSSValueKeywords.gperf"
+#line 380 "CSSValueKeywords.gperf"
       {"paused", CSSValuePaused},
 #line 22 "CSSValueKeywords.gperf"
       {"double", CSSValueDouble},
@@ -384,159 +386,163 @@ findValue (register const char *str, register unsigned int len)
       {"super", CSSValueSuper},
 #line 63 "CSSValueKeywords.gperf"
       {"condensed", CSSValueCondensed},
-#line 240 "CSSValueKeywords.gperf"
+#line 241 "CSSValueKeywords.gperf"
       {"visible", CSSValueVisible},
 #line 37 "CSSValueKeywords.gperf"
       {"bold", CSSValueBold},
-#line 508 "CSSValueKeywords.gperf"
+#line 516 "CSSValueKeywords.gperf"
       {"snow", CSSValueSnow},
-#line 248 "CSSValueKeywords.gperf"
+#line 249 "CSSValueKeywords.gperf"
       {"blink", CSSValueBlink},
-#line 205 "CSSValueKeywords.gperf"
+#line 206 "CSSValueKeywords.gperf"
       {"move", CSSValueMove},
-#line 301 "CSSValueKeywords.gperf"
+#line 302 "CSSValueKeywords.gperf"
       {"slow", CSSValueSlow},
-#line 378 "CSSValueKeywords.gperf"
+#line 384 "CSSValueKeywords.gperf"
       {"linear", CSSValueLinear},
 #line 88 "CSSValueKeywords.gperf"
       {"silver", CSSValueSilver},
-#line 259 "CSSValueKeywords.gperf"
+#line 260 "CSSValueKeywords.gperf"
       {"landscape", CSSValueLandscape},
-#line 280 "CSSValueKeywords.gperf"
+#line 281 "CSSValueKeywords.gperf"
       {"show", CSSValueShow},
 #line 23 "CSSValueKeywords.gperf"
       {"caption", CSSValueCaption},
 #line 18 "CSSValueKeywords.gperf"
       {"outset", CSSValueOutset},
-#line 389 "CSSValueKeywords.gperf"
+#line 395 "CSSValueKeywords.gperf"
       {"stroke", CSSValueStroke},
-#line 519 "CSSValueKeywords.gperf"
+#line 527 "CSSValueKeywords.gperf"
       {"nonzero", CSSValueNonzero},
-#line 294 "CSSValueKeywords.gperf"
+#line 295 "CSSValueKeywords.gperf"
       {"single", CSSValueSingle},
 #line 11 "CSSValueKeywords.gperf"
       {"inherit", CSSValueInherit},
-#line 299 "CSSValueKeywords.gperf"
+#line 300 "CSSValueKeywords.gperf"
       {"up", CSSValueUp},
 #line 130 "CSSValueKeywords.gperf"
       {"no-repeat", CSSValueNoRepeat},
 #line 76 "CSSValueKeywords.gperf"
       {"black", CSSValueBlack},
-#line 222 "CSSValueKeywords.gperf"
+#line 223 "CSSValueKeywords.gperf"
       {"w-resize", CSSValueWResize},
-#line 420 "CSSValueKeywords.gperf"
+#line 428 "CSSValueKeywords.gperf"
       {"darksalmon", CSSValueDarksalmon},
-#line 303 "CSSValueKeywords.gperf"
+#line 304 "CSSValueKeywords.gperf"
       {"infinite", CSSValueInfinite},
-#line 224 "CSSValueKeywords.gperf"
+#line 225 "CSSValueKeywords.gperf"
       {"ns-resize", CSSValueNsResize},
 #line 108 "CSSValueKeywords.gperf"
       {"inactivecaption", CSSValueInactivecaption},
 #line 144 "CSSValueKeywords.gperf"
       {"baseline", CSSValueBaseline},
-#line 363 "CSSValueKeywords.gperf"
+#line 367 "CSSValueKeywords.gperf"
       {"round", CSSValueRound},
-#line 237 "CSSValueKeywords.gperf"
+#line 238 "CSSValueKeywords.gperf"
       {"capitalize", CSSValueCapitalize},
-#line 243 "CSSValueKeywords.gperf"
+#line 244 "CSSValueKeywords.gperf"
       {"absolute", CSSValueAbsolute},
-#line 478 "CSSValueKeywords.gperf"
+#line 486 "CSSValueKeywords.gperf"
       {"mintcream", CSSValueMintcream},
 #line 33 "CSSValueKeywords.gperf"
       {"oblique", CSSValueOblique},
-#line 326 "CSSValueKeywords.gperf"
+#line 327 "CSSValueKeywords.gperf"
       {"radio", CSSValueRadio},
 #line 53 "CSSValueKeywords.gperf"
       {"large", CSSValueLarge},
-#line 273 "CSSValueKeywords.gperf"
+#line 274 "CSSValueKeywords.gperf"
       {"portrait", CSSValuePortrait},
-#line 437 "CSSValueKeywords.gperf"
+#line 445 "CSSValueKeywords.gperf"
       {"gold", CSSValueGold},
 #line 57 "CSSValueKeywords.gperf"
       {"smaller", CSSValueSmaller},
-#line 426 "CSSValueKeywords.gperf"
+#line 434 "CSSValueKeywords.gperf"
       {"darkviolet", CSSValueDarkviolet},
-#line 371 "CSSValueKeywords.gperf"
+#line 377 "CSSValueKeywords.gperf"
       {"visual", CSSValueVisual},
-#line 442 "CSSValueKeywords.gperf"
+#line 450 "CSSValueKeywords.gperf"
       {"indianred", CSSValueIndianred},
 #line 85 "CSSValueKeywords.gperf"
       {"orange", CSSValueOrange},
 #line 161 "CSSValueKeywords.gperf"
       {"outside", CSSValueOutside},
-#line 204 "CSSValueKeywords.gperf"
+#line 205 "CSSValueKeywords.gperf"
       {"pointer", CSSValuePointer},
 #line 90 "CSSValueKeywords.gperf"
       {"white", CSSValueWhite},
-#line 514 "CSSValueKeywords.gperf"
+#line 522 "CSSValueKeywords.gperf"
       {"turquoise", CSSValueTurquoise},
-#line 211 "CSSValueKeywords.gperf"
+#line 212 "CSSValueKeywords.gperf"
       {"no-drop", CSSValueNoDrop},
-#line 546 "CSSValueKeywords.gperf"
+#line 554 "CSSValueKeywords.gperf"
       {"rl-tb", CSSValueRlTb},
-#line 387 "CSSValueKeywords.gperf"
+#line 393 "CSSValueKeywords.gperf"
       {"painted", CSSValuePainted},
-#line 207 "CSSValueKeywords.gperf"
+#line 208 "CSSValueKeywords.gperf"
       {"cell", CSSValueCell},
-#line 245 "CSSValueKeywords.gperf"
+#line 246 "CSSValueKeywords.gperf"
       {"avoid", CSSValueAvoid},
-#line 274 "CSSValueKeywords.gperf"
+#line 275 "CSSValueKeywords.gperf"
       {"pre", CSSValuePre},
 #line 165 "CSSValueKeywords.gperf"
       {"square", CSSValueSquare},
-#line 529 "CSSValueKeywords.gperf"
+#line 396 "CSSValueKeywords.gperf"
+      {"antialiased", CSSValueAntialiased},
+#line 537 "CSSValueKeywords.gperf"
       {"butt", CSSValueButt},
-#line 398 "CSSValueKeywords.gperf"
+#line 406 "CSSValueKeywords.gperf"
       {"brown", CSSValueBrown},
 #line 32 "CSSValueKeywords.gperf"
       {"italic", CSSValueItalic},
-#line 527 "CSSValueKeywords.gperf"
+#line 535 "CSSValueKeywords.gperf"
       {"crispedges", CSSValueCrispedges},
-#line 504 "CSSValueKeywords.gperf"
+#line 512 "CSSValueKeywords.gperf"
       {"skyblue", CSSValueSkyblue},
-#line 329 "CSSValueKeywords.gperf"
+#line 330 "CSSValueKeywords.gperf"
       {"button", CSSValueButton},
-#line 517 "CSSValueKeywords.gperf"
+#line 525 "CSSValueKeywords.gperf"
       {"whitesmoke", CSSValueWhitesmoke},
-#line 281 "CSSValueKeywords.gperf"
+#line 282 "CSSValueKeywords.gperf"
       {"static", CSSValueStatic},
-#line 236 "CSSValueKeywords.gperf"
+#line 237 "CSSValueKeywords.gperf"
       {"rtl", CSSValueRtl},
-#line 392 "CSSValueKeywords.gperf"
+#line 400 "CSSValueKeywords.gperf"
       {"aquamarine", CSSValueAquamarine},
-#line 309 "CSSValueKeywords.gperf"
+#line 310 "CSSValueKeywords.gperf"
       {"element", CSSValueElement},
-#line 291 "CSSValueKeywords.gperf"
+#line 292 "CSSValueKeywords.gperf"
       {"vertical", CSSValueVertical},
 #line 151 "CSSValueKeywords.gperf"
       {"bottom", CSSValueBottom},
 #line 114 "CSSValueKeywords.gperf"
       {"scrollbar", CSSValueScrollbar},
-#line 388 "CSSValueKeywords.gperf"
+#line 394 "CSSValueKeywords.gperf"
       {"fill", CSSValueFill},
-#line 364 "CSSValueKeywords.gperf"
+#line 368 "CSSValueKeywords.gperf"
       {"border", CSSValueBorder},
 #line 35 "CSSValueKeywords.gperf"
       {"small-caps", CSSValueSmallCaps},
-#line 210 "CSSValueKeywords.gperf"
+#line 211 "CSSValueKeywords.gperf"
       {"progress", CSSValueProgress},
-#line 373 "CSSValueKeywords.gperf"
+#line 379 "CSSValueKeywords.gperf"
       {"running", CSSValueRunning},
 #line 38 "CSSValueKeywords.gperf"
       {"bolder", CSSValueBolder},
-#line 390 "CSSValueKeywords.gperf"
+#line 398 "CSSValueKeywords.gperf"
       {"aliceblue", CSSValueAliceblue},
 #line 197 "CSSValueKeywords.gperf"
       {"table-cell", CSSValueTableCell},
-#line 379 "CSSValueKeywords.gperf"
+#line 375 "CSSValueKeywords.gperf"
+      {"cover", CSSValueCover},
+#line 385 "CSSValueKeywords.gperf"
       {"ease-in", CSSValueEaseIn},
 #line 92 "CSSValueKeywords.gperf"
       {"transparent", CSSValueTransparent},
-#line 503 "CSSValueKeywords.gperf"
+#line 511 "CSSValueKeywords.gperf"
       {"sienna", CSSValueSienna},
-#line 384 "CSSValueKeywords.gperf"
+#line 390 "CSSValueKeywords.gperf"
       {"visiblepainted", CSSValueVisiblepainted},
-#line 284 "CSSValueKeywords.gperf"
+#line 285 "CSSValueKeywords.gperf"
       {"underline", CSSValueUnderline},
 #line 17 "CSSValueKeywords.gperf"
       {"ridge", CSSValueRidge},
@@ -546,55 +552,55 @@ findValue (register const char *str, register unsigned int len)
       {"katakana", CSSValueKatakana},
 #line 124 "CSSValueKeywords.gperf"
       {"currentcolor", CSSValueCurrentcolor},
-#line 230 "CSSValueKeywords.gperf"
+#line 231 "CSSValueKeywords.gperf"
       {"wait", CSSValueWait},
-#line 298 "CSSValueKeywords.gperf"
+#line 299 "CSSValueKeywords.gperf"
       {"ahead", CSSValueAhead},
 #line 185 "CSSValueKeywords.gperf"
       {"list-item", CSSValueListItem},
-#line 370 "CSSValueKeywords.gperf"
+#line 376 "CSSValueKeywords.gperf"
       {"logical", CSSValueLogical},
 #line 186 "CSSValueKeywords.gperf"
       {"run-in", CSSValueRunIn},
-#line 258 "CSSValueKeywords.gperf"
+#line 259 "CSSValueKeywords.gperf"
       {"invert", CSSValueInvert},
-#line 368 "CSSValueKeywords.gperf"
+#line 372 "CSSValueKeywords.gperf"
       {"padding", CSSValuePadding},
-#line 305 "CSSValueKeywords.gperf"
+#line 306 "CSSValueKeywords.gperf"
       {"alternate", CSSValueAlternate},
-#line 256 "CSSValueKeywords.gperf"
+#line 257 "CSSValueKeywords.gperf"
       {"hide", CSSValueHide},
 #line 59 "CSSValueKeywords.gperf"
       {"wider", CSSValueWider},
-#line 232 "CSSValueKeywords.gperf"
+#line 233 "CSSValueKeywords.gperf"
       {"all-scroll", CSSValueAllScroll},
 #line 190 "CSSValueKeywords.gperf"
       {"inline-table", CSSValueInlineTable},
 #line 19 "CSSValueKeywords.gperf"
       {"dotted", CSSValueDotted},
-#line 530 "CSSValueKeywords.gperf"
+#line 538 "CSSValueKeywords.gperf"
       {"miter", CSSValueMiter},
-#line 465 "CSSValueKeywords.gperf"
+#line 473 "CSSValueKeywords.gperf"
       {"limegreen", CSSValueLimegreen},
-#line 311 "CSSValueKeywords.gperf"
+#line 312 "CSSValueKeywords.gperf"
       {"intrinsic", CSSValueIntrinsic},
 #line 141 "CSSValueKeywords.gperf"
       {"xor", CSSValueXor},
-#line 483 "CSSValueKeywords.gperf"
+#line 491 "CSSValueKeywords.gperf"
       {"olivedrab", CSSValueOlivedrab},
 #line 188 "CSSValueKeywords.gperf"
       {"inline-block", CSSValueInlineBlock},
 #line 134 "CSSValueKeywords.gperf"
       {"source-in", CSSValueSourceIn},
-#line 315 "CSSValueKeywords.gperf"
+#line 316 "CSSValueKeywords.gperf"
       {"discard", CSSValueDiscard},
-#line 489 "CSSValueKeywords.gperf"
+#line 497 "CSSValueKeywords.gperf"
       {"palevioletred", CSSValuePalevioletred},
 #line 27 "CSSValueKeywords.gperf"
       {"small-caption", CSSValueSmallCaption},
-#line 525 "CSSValueKeywords.gperf"
+#line 533 "CSSValueKeywords.gperf"
       {"optimizespeed", CSSValueOptimizespeed},
-#line 382 "CSSValueKeywords.gperf"
+#line 388 "CSSValueKeywords.gperf"
       {"document", CSSValueDocument},
 #line 89 "CSSValueKeywords.gperf"
       {"teal", CSSValueTeal},
@@ -602,15 +608,15 @@ findValue (register const char *str, register unsigned int len)
       {"larger", CSSValueLarger},
 #line 116 "CSSValueKeywords.gperf"
       {"threedface", CSSValueThreedface},
-#line 395 "CSSValueKeywords.gperf"
+#line 403 "CSSValueKeywords.gperf"
       {"bisque", CSSValueBisque},
-#line 375 "CSSValueKeywords.gperf"
+#line 381 "CSSValueKeywords.gperf"
       {"flat", CSSValueFlat},
-#line 400 "CSSValueKeywords.gperf"
+#line 408 "CSSValueKeywords.gperf"
       {"cadetblue", CSSValueCadetblue},
-#line 505 "CSSValueKeywords.gperf"
+#line 513 "CSSValueKeywords.gperf"
       {"slateblue", CSSValueSlateblue},
-#line 386 "CSSValueKeywords.gperf"
+#line 392 "CSSValueKeywords.gperf"
       {"visiblestroke", CSSValueVisiblestroke},
 #line 87 "CSSValueKeywords.gperf"
       {"red", CSSValueRed},
@@ -618,173 +624,173 @@ findValue (register const char *str, register unsigned int len)
       {"table-caption", CSSValueTableCaption},
 #line 136 "CSSValueKeywords.gperf"
       {"source-atop", CSSValueSourceAtop},
-#line 415 "CSSValueKeywords.gperf"
+#line 423 "CSSValueKeywords.gperf"
       {"darkmagenta", CSSValueDarkmagenta},
 #line 50 "CSSValueKeywords.gperf"
       {"x-small", CSSValueXSmall},
-#line 523 "CSSValueKeywords.gperf"
+#line 531 "CSSValueKeywords.gperf"
       {"srgb", CSSValueSrgb},
-#line 227 "CSSValueKeywords.gperf"
+#line 228 "CSSValueKeywords.gperf"
       {"col-resize", CSSValueColResize},
-#line 238 "CSSValueKeywords.gperf"
+#line 239 "CSSValueKeywords.gperf"
       {"uppercase", CSSValueUppercase},
-#line 302 "CSSValueKeywords.gperf"
+#line 303 "CSSValueKeywords.gperf"
       {"fast", CSSValueFast},
 #line 131 "CSSValueKeywords.gperf"
       {"clear", CSSValueClear},
-#line 419 "CSSValueKeywords.gperf"
+#line 427 "CSSValueKeywords.gperf"
       {"darkred", CSSValueDarkred},
-#line 487 "CSSValueKeywords.gperf"
+#line 495 "CSSValueKeywords.gperf"
       {"palegreen", CSSValuePalegreen},
-#line 319 "CSSValueKeywords.gperf"
+#line 320 "CSSValueKeywords.gperf"
       {"continuous", CSSValueContinuous},
 #line 80 "CSSValueKeywords.gperf"
       {"green", CSSValueGreen},
-#line 290 "CSSValueKeywords.gperf"
+#line 291 "CSSValueKeywords.gperf"
       {"horizontal", CSSValueHorizontal},
-#line 287 "CSSValueKeywords.gperf"
+#line 288 "CSSValueKeywords.gperf"
       {"start", CSSValueStart},
-#line 318 "CSSValueKeywords.gperf"
+#line 319 "CSSValueKeywords.gperf"
       {"wave", CSSValueWave},
 #line 166 "CSSValueKeywords.gperf"
       {"decimal", CSSValueDecimal},
 #line 156 "CSSValueKeywords.gperf"
       {"center", CSSValueCenter},
-#line 260 "CSSValueKeywords.gperf"
+#line 261 "CSSValueKeywords.gperf"
       {"level", CSSValueLevel},
 #line 25 "CSSValueKeywords.gperf"
       {"menu", CSSValueMenu},
-#line 266 "CSSValueKeywords.gperf"
+#line 267 "CSSValueKeywords.gperf"
       {"mix", CSSValueMix},
-#line 535 "CSSValueKeywords.gperf"
+#line 543 "CSSValueKeywords.gperf"
       {"central", CSSValueCentral},
 #line 154 "CSSValueKeywords.gperf"
       {"left", CSSValueLeft},
 #line 14 "CSSValueKeywords.gperf"
       {"hidden", CSSValueHidden},
-#line 492 "CSSValueKeywords.gperf"
+#line 500 "CSSValueKeywords.gperf"
       {"peru", CSSValuePeru},
-#line 467 "CSSValueKeywords.gperf"
+#line 475 "CSSValueKeywords.gperf"
       {"magenta", CSSValueMagenta},
-#line 277 "CSSValueKeywords.gperf"
+#line 278 "CSSValueKeywords.gperf"
       {"relative", CSSValueRelative},
 #line 132 "CSSValueKeywords.gperf"
       {"copy", CSSValueCopy},
-#line 300 "CSSValueKeywords.gperf"
+#line 301 "CSSValueKeywords.gperf"
       {"down", CSSValueDown},
 #line 52 "CSSValueKeywords.gperf"
       {"medium", CSSValueMedium},
-#line 219 "CSSValueKeywords.gperf"
+#line 220 "CSSValueKeywords.gperf"
       {"se-resize", CSSValueSeResize},
-#line 383 "CSSValueKeywords.gperf"
+#line 389 "CSSValueKeywords.gperf"
       {"reset", CSSValueReset},
-#line 497 "CSSValueKeywords.gperf"
+#line 505 "CSSValueKeywords.gperf"
       {"royalblue", CSSValueRoyalblue},
-#line 408 "CSSValueKeywords.gperf"
+#line 416 "CSSValueKeywords.gperf"
       {"darkblue", CSSValueDarkblue},
-#line 216 "CSSValueKeywords.gperf"
+#line 217 "CSSValueKeywords.gperf"
       {"ne-resize", CSSValueNeResize},
-#line 310 "CSSValueKeywords.gperf"
+#line 311 "CSSValueKeywords.gperf"
       {"ignore", CSSValueIgnore},
 #line 97 "CSSValueKeywords.gperf"
       {"appworkspace", CSSValueAppworkspace},
-#line 250 "CSSValueKeywords.gperf"
+#line 251 "CSSValueKeywords.gperf"
       {"close-quote", CSSValueCloseQuote},
-#line 385 "CSSValueKeywords.gperf"
+#line 391 "CSSValueKeywords.gperf"
       {"visiblefill", CSSValueVisiblefill},
-#line 484 "CSSValueKeywords.gperf"
+#line 492 "CSSValueKeywords.gperf"
       {"orangered", CSSValueOrangered},
 #line 120 "CSSValueKeywords.gperf"
       {"window", CSSValueWindow},
-#line 516 "CSSValueKeywords.gperf"
+#line 524 "CSSValueKeywords.gperf"
       {"wheat", CSSValueWheat},
-#line 485 "CSSValueKeywords.gperf"
+#line 493 "CSSValueKeywords.gperf"
       {"orchid", CSSValueOrchid},
-#line 438 "CSSValueKeywords.gperf"
+#line 446 "CSSValueKeywords.gperf"
       {"goldenrod", CSSValueGoldenrod},
 #line 127 "CSSValueKeywords.gperf"
       {"repeat", CSSValueRepeat},
-#line 255 "CSSValueKeywords.gperf"
+#line 256 "CSSValueKeywords.gperf"
       {"hand", CSSValueHand},
-#line 279 "CSSValueKeywords.gperf"
+#line 280 "CSSValueKeywords.gperf"
       {"separate", CSSValueSeparate},
-#line 267 "CSSValueKeywords.gperf"
+#line 268 "CSSValueKeywords.gperf"
       {"no-close-quote", CSSValueNoCloseQuote},
-#line 312 "CSSValueKeywords.gperf"
+#line 313 "CSSValueKeywords.gperf"
       {"min-intrinsic", CSSValueMinIntrinsic},
-#line 346 "CSSValueKeywords.gperf"
+#line 350 "CSSValueKeywords.gperf"
       {"menulist", CSSValueMenulist},
-#line 202 "CSSValueKeywords.gperf"
+#line 203 "CSSValueKeywords.gperf"
       {"crosshair", CSSValueCrosshair},
-#line 446 "CSSValueKeywords.gperf"
+#line 454 "CSSValueKeywords.gperf"
       {"lavender", CSSValueLavender},
 #line 133 "CSSValueKeywords.gperf"
       {"source-over", CSSValueSourceOver},
-#line 275 "CSSValueKeywords.gperf"
+#line 276 "CSSValueKeywords.gperf"
       {"pre-line", CSSValuePreLine},
-#line 412 "CSSValueKeywords.gperf"
+#line 420 "CSSValueKeywords.gperf"
       {"darkgreen", CSSValueDarkgreen},
-#line 422 "CSSValueKeywords.gperf"
+#line 430 "CSSValueKeywords.gperf"
       {"darkslateblue", CSSValueDarkslateblue},
-#line 268 "CSSValueKeywords.gperf"
+#line 269 "CSSValueKeywords.gperf"
       {"no-open-quote", CSSValueNoOpenQuote},
-#line 421 "CSSValueKeywords.gperf"
+#line 429 "CSSValueKeywords.gperf"
       {"darkseagreen", CSSValueDarkseagreen},
-#line 417 "CSSValueKeywords.gperf"
+#line 425 "CSSValueKeywords.gperf"
       {"darkorange", CSSValueDarkorange},
-#line 539 "CSSValueKeywords.gperf"
+#line 547 "CSSValueKeywords.gperf"
       {"alphabetic", CSSValueAlphabetic},
-#line 264 "CSSValueKeywords.gperf"
+#line 265 "CSSValueKeywords.gperf"
       {"lower", CSSValueLower},
-#line 380 "CSSValueKeywords.gperf"
+#line 386 "CSSValueKeywords.gperf"
       {"ease-out", CSSValueEaseOut},
-#line 543 "CSSValueKeywords.gperf"
+#line 551 "CSSValueKeywords.gperf"
       {"no-change", CSSValueNoChange},
-#line 286 "CSSValueKeywords.gperf"
+#line 287 "CSSValueKeywords.gperf"
       {"stretch", CSSValueStretch},
 #line 196 "CSSValueKeywords.gperf"
       {"table-column", CSSValueTableColumn},
-#line 239 "CSSValueKeywords.gperf"
+#line 240 "CSSValueKeywords.gperf"
       {"lowercase", CSSValueLowercase},
-#line 416 "CSSValueKeywords.gperf"
+#line 424 "CSSValueKeywords.gperf"
       {"darkolivegreen", CSSValueDarkolivegreen},
-#line 509 "CSSValueKeywords.gperf"
+#line 517 "CSSValueKeywords.gperf"
       {"springgreen", CSSValueSpringgreen},
-#line 531 "CSSValueKeywords.gperf"
+#line 539 "CSSValueKeywords.gperf"
       {"bevel", CSSValueBevel},
 #line 179 "CSSValueKeywords.gperf"
       {"hiragana", CSSValueHiragana},
-#line 521 "CSSValueKeywords.gperf"
+#line 529 "CSSValueKeywords.gperf"
       {"accumulate", CSSValueAccumulate},
-#line 246 "CSSValueKeywords.gperf"
+#line 247 "CSSValueKeywords.gperf"
       {"below", CSSValueBelow},
-#line 269 "CSSValueKeywords.gperf"
+#line 270 "CSSValueKeywords.gperf"
       {"nowrap", CSSValueNowrap},
 #line 69 "CSSValueKeywords.gperf"
       {"serif", CSSValueSerif},
-#line 435 "CSSValueKeywords.gperf"
+#line 443 "CSSValueKeywords.gperf"
       {"gainsboro", CSSValueGainsboro},
-#line 223 "CSSValueKeywords.gperf"
+#line 224 "CSSValueKeywords.gperf"
       {"ew-resize", CSSValueEwResize},
-#line 220 "CSSValueKeywords.gperf"
+#line 221 "CSSValueKeywords.gperf"
       {"sw-resize", CSSValueSwResize},
 #line 135 "CSSValueKeywords.gperf"
       {"source-out", CSSValueSourceOut},
-#line 394 "CSSValueKeywords.gperf"
+#line 402 "CSSValueKeywords.gperf"
       {"beige", CSSValueBeige},
 #line 60 "CSSValueKeywords.gperf"
       {"narrower", CSSValueNarrower},
-#line 217 "CSSValueKeywords.gperf"
+#line 218 "CSSValueKeywords.gperf"
       {"nw-resize", CSSValueNwResize},
-#line 332 "CSSValueKeywords.gperf"
+#line 333 "CSSValueKeywords.gperf"
       {"listbox", CSSValueListbox},
-#line 441 "CSSValueKeywords.gperf"
+#line 449 "CSSValueKeywords.gperf"
       {"hotpink", CSSValueHotpink},
 #line 99 "CSSValueKeywords.gperf"
       {"buttonface", CSSValueButtonface},
-#line 486 "CSSValueKeywords.gperf"
+#line 494 "CSSValueKeywords.gperf"
       {"palegoldenrod", CSSValuePalegoldenrod},
-#line 524 "CSSValueKeywords.gperf"
+#line 532 "CSSValueKeywords.gperf"
       {"linearrgb", CSSValueLinearrgb},
 #line 20 "CSSValueKeywords.gperf"
       {"dashed", CSSValueDashed},
@@ -792,61 +798,61 @@ findValue (register const char *str, register unsigned int len)
       {"infotext", CSSValueInfotext},
 #line 112 "CSSValueKeywords.gperf"
       {"match", CSSValueMatch},
-#line 321 "CSSValueKeywords.gperf"
+#line 322 "CSSValueKeywords.gperf"
       {"break-all", CSSValueBreakAll},
-#line 249 "CSSValueKeywords.gperf"
+#line 250 "CSSValueKeywords.gperf"
       {"both", CSSValueBoth},
-#line 401 "CSSValueKeywords.gperf"
+#line 409 "CSSValueKeywords.gperf"
       {"chartreuse", CSSValueChartreuse},
-#line 498 "CSSValueKeywords.gperf"
+#line 506 "CSSValueKeywords.gperf"
       {"saddlebrown", CSSValueSaddlebrown},
-#line 330 "CSSValueKeywords.gperf"
+#line 331 "CSSValueKeywords.gperf"
       {"button-bevel", CSSValueButtonBevel},
-#line 414 "CSSValueKeywords.gperf"
+#line 422 "CSSValueKeywords.gperf"
       {"darkkhaki", CSSValueDarkkhaki},
 #line 66 "CSSValueKeywords.gperf"
       {"expanded", CSSValueExpanded},
-#line 231 "CSSValueKeywords.gperf"
+#line 232 "CSSValueKeywords.gperf"
       {"help", CSSValueHelp},
-#line 432 "CSSValueKeywords.gperf"
+#line 440 "CSSValueKeywords.gperf"
       {"firebrick", CSSValueFirebrick},
-#line 520 "CSSValueKeywords.gperf"
+#line 528 "CSSValueKeywords.gperf"
       {"evenodd", CSSValueEvenodd},
 #line 142 "CSSValueKeywords.gperf"
       {"plus-darker", CSSValuePlusDarker},
-#line 272 "CSSValueKeywords.gperf"
+#line 273 "CSSValueKeywords.gperf"
       {"overline", CSSValueOverline},
-#line 409 "CSSValueKeywords.gperf"
+#line 417 "CSSValueKeywords.gperf"
       {"darkcyan", CSSValueDarkcyan},
-#line 292 "CSSValueKeywords.gperf"
+#line 293 "CSSValueKeywords.gperf"
       {"inline-axis", CSSValueInlineAxis},
 #line 107 "CSSValueKeywords.gperf"
       {"inactiveborder", CSSValueInactiveborder},
-#line 434 "CSSValueKeywords.gperf"
+#line 442 "CSSValueKeywords.gperf"
       {"forestgreen", CSSValueForestgreen},
 #line 103 "CSSValueKeywords.gperf"
       {"captiontext", CSSValueCaptiontext},
-#line 522 "CSSValueKeywords.gperf"
+#line 530 "CSSValueKeywords.gperf"
       {"new", CSSValueNew},
 #line 79 "CSSValueKeywords.gperf"
       {"gray", CSSValueGray},
 #line 194 "CSSValueKeywords.gperf"
       {"table-row", CSSValueTableRow},
-#line 541 "CSSValueKeywords.gperf"
+#line 549 "CSSValueKeywords.gperf"
       {"mathematical", CSSValueMathematical},
-#line 212 "CSSValueKeywords.gperf"
+#line 213 "CSSValueKeywords.gperf"
       {"not-allowed", CSSValueNotAllowed},
-#line 431 "CSSValueKeywords.gperf"
+#line 439 "CSSValueKeywords.gperf"
       {"dodgerblue", CSSValueDodgerblue},
-#line 479 "CSSValueKeywords.gperf"
+#line 487 "CSSValueKeywords.gperf"
       {"mistyrose", CSSValueMistyrose},
 #line 174 "CSSValueKeywords.gperf"
       {"upper-latin", CSSValueUpperLatin},
 #line 109 "CSSValueKeywords.gperf"
       {"inactivecaptiontext", CSSValueInactivecaptiontext},
-#line 501 "CSSValueKeywords.gperf"
+#line 509 "CSSValueKeywords.gperf"
       {"seagreen", CSSValueSeagreen},
-#line 351 "CSSValueKeywords.gperf"
+#line 355 "CSSValueKeywords.gperf"
       {"slider-vertical", CSSValueSliderVertical},
 #line 54 "CSSValueKeywords.gperf"
       {"x-large", CSSValueXLarge},
@@ -856,129 +862,131 @@ findValue (register const char *str, register unsigned int len)
       {"semi-condensed", CSSValueSemiCondensed},
 #line 78 "CSSValueKeywords.gperf"
       {"fuchsia", CSSValueFuchsia},
-#line 410 "CSSValueKeywords.gperf"
+#line 418 "CSSValueKeywords.gperf"
       {"darkgoldenrod", CSSValueDarkgoldenrod},
-#line 296 "CSSValueKeywords.gperf"
+#line 297 "CSSValueKeywords.gperf"
       {"forwards", CSSValueForwards},
-#line 502 "CSSValueKeywords.gperf"
+#line 510 "CSSValueKeywords.gperf"
       {"seashell", CSSValueSeashell},
-#line 297 "CSSValueKeywords.gperf"
+#line 298 "CSSValueKeywords.gperf"
       {"backwards", CSSValueBackwards},
 #line 119 "CSSValueKeywords.gperf"
       {"threedshadow", CSSValueThreedshadow},
-#line 376 "CSSValueKeywords.gperf"
+#line 382 "CSSValueKeywords.gperf"
       {"preserve-3d", CSSValuePreserve3d},
-#line 427 "CSSValueKeywords.gperf"
+#line 435 "CSSValueKeywords.gperf"
       {"deeppink", CSSValueDeeppink},
-#line 488 "CSSValueKeywords.gperf"
+#line 496 "CSSValueKeywords.gperf"
       {"paleturquoise", CSSValuePaleturquoise},
-#line 203 "CSSValueKeywords.gperf"
+#line 204 "CSSValueKeywords.gperf"
       {"default", CSSValueDefault},
 #line 138 "CSSValueKeywords.gperf"
       {"destination-in", CSSValueDestinationIn},
-#line 396 "CSSValueKeywords.gperf"
+#line 404 "CSSValueKeywords.gperf"
       {"blanchedalmond", CSSValueBlanchedalmond},
-#line 544 "CSSValueKeywords.gperf"
+#line 552 "CSSValueKeywords.gperf"
       {"reset-size", CSSValueResetSize},
-#line 510 "CSSValueKeywords.gperf"
+#line 518 "CSSValueKeywords.gperf"
       {"steelblue", CSSValueSteelblue},
 #line 70 "CSSValueKeywords.gperf"
       {"sans-serif", CSSValueSansSerif},
-#line 341 "CSSValueKeywords.gperf"
+#line 342 "CSSValueKeywords.gperf"
       {"media-slider", CSSValueMediaSlider},
-#line 229 "CSSValueKeywords.gperf"
+#line 230 "CSSValueKeywords.gperf"
       {"text", CSSValueText},
 #line 95 "CSSValueKeywords.gperf"
       {"activeborder", CSSValueActiveborder},
-#line 293 "CSSValueKeywords.gperf"
+#line 294 "CSSValueKeywords.gperf"
       {"block-axis", CSSValueBlockAxis},
-#line 289 "CSSValueKeywords.gperf"
+#line 290 "CSSValueKeywords.gperf"
       {"reverse", CSSValueReverse},
-#line 247 "CSSValueKeywords.gperf"
+#line 248 "CSSValueKeywords.gperf"
       {"bidi-override", CSSValueBidiOverride},
 #line 102 "CSSValueKeywords.gperf"
       {"buttontext", CSSValueButtontext},
 #line 140 "CSSValueKeywords.gperf"
       {"destination-atop", CSSValueDestinationAtop},
-#line 469 "CSSValueKeywords.gperf"
+#line 477 "CSSValueKeywords.gperf"
       {"mediumblue", CSSValueMediumblue},
-#line 476 "CSSValueKeywords.gperf"
+#line 484 "CSSValueKeywords.gperf"
       {"mediumvioletred", CSSValueMediumvioletred},
-#line 444 "CSSValueKeywords.gperf"
+#line 452 "CSSValueKeywords.gperf"
       {"ivory", CSSValueIvory},
-#line 381 "CSSValueKeywords.gperf"
+#line 387 "CSSValueKeywords.gperf"
       {"ease-in-out", CSSValueEaseInOut},
-#line 540 "CSSValueKeywords.gperf"
+#line 548 "CSSValueKeywords.gperf"
       {"hanging", CSSValueHanging},
-#line 367 "CSSValueKeywords.gperf"
+#line 371 "CSSValueKeywords.gperf"
       {"content-box", CSSValueContentBox},
-#line 458 "CSSValueKeywords.gperf"
+#line 466 "CSSValueKeywords.gperf"
       {"lightsalmon", CSSValueLightsalmon},
-#line 399 "CSSValueKeywords.gperf"
+#line 397 "CSSValueKeywords.gperf"
+      {"subpixel-antialiased", CSSValueSubpixelAntialiased},
+#line 407 "CSSValueKeywords.gperf"
       {"burlywood", CSSValueBurlywood},
-#line 436 "CSSValueKeywords.gperf"
+#line 444 "CSSValueKeywords.gperf"
       {"ghostwhite", CSSValueGhostwhite},
 #line 177 "CSSValueKeywords.gperf"
       {"georgian", CSSValueGeorgian},
-#line 418 "CSSValueKeywords.gperf"
+#line 426 "CSSValueKeywords.gperf"
       {"darkorchid", CSSValueDarkorchid},
-#line 244 "CSSValueKeywords.gperf"
+#line 245 "CSSValueKeywords.gperf"
       {"always", CSSValueAlways},
 #line 169 "CSSValueKeywords.gperf"
       {"upper-roman", CSSValueUpperRoman},
 #line 172 "CSSValueKeywords.gperf"
       {"lower-latin", CSSValueLowerLatin},
-#line 448 "CSSValueKeywords.gperf"
+#line 456 "CSSValueKeywords.gperf"
       {"lawngreen", CSSValueLawngreen},
 #line 49 "CSSValueKeywords.gperf"
       {"xx-small", CSSValueXxSmall},
-#line 473 "CSSValueKeywords.gperf"
+#line 481 "CSSValueKeywords.gperf"
       {"mediumslateblue", CSSValueMediumslateblue},
-#line 270 "CSSValueKeywords.gperf"
+#line 271 "CSSValueKeywords.gperf"
       {"open-quote", CSSValueOpenQuote},
-#line 472 "CSSValueKeywords.gperf"
+#line 480 "CSSValueKeywords.gperf"
       {"mediumseagreen", CSSValueMediumseagreen},
-#line 325 "CSSValueKeywords.gperf"
+#line 326 "CSSValueKeywords.gperf"
       {"checkbox", CSSValueCheckbox},
 #line 157 "CSSValueKeywords.gperf"
       {"justify", CSSValueJustify},
-#line 226 "CSSValueKeywords.gperf"
+#line 227 "CSSValueKeywords.gperf"
       {"nwse-resize", CSSValueNwseResize},
-#line 254 "CSSValueKeywords.gperf"
+#line 255 "CSSValueKeywords.gperf"
       {"fixed", CSSValueFixed},
 #line 72 "CSSValueKeywords.gperf"
       {"fantasy", CSSValueFantasy},
-#line 425 "CSSValueKeywords.gperf"
+#line 433 "CSSValueKeywords.gperf"
       {"darkturquoise", CSSValueDarkturquoise},
-#line 457 "CSSValueKeywords.gperf"
+#line 465 "CSSValueKeywords.gperf"
       {"lightpink", CSSValueLightpink},
-#line 276 "CSSValueKeywords.gperf"
+#line 277 "CSSValueKeywords.gperf"
       {"pre-wrap", CSSValuePreWrap},
 #line 125 "CSSValueKeywords.gperf"
       {"grey", CSSValueGrey},
-#line 471 "CSSValueKeywords.gperf"
+#line 479 "CSSValueKeywords.gperf"
       {"mediumpurple", CSSValueMediumpurple},
-#line 507 "CSSValueKeywords.gperf"
+#line 515 "CSSValueKeywords.gperf"
       {"slategrey", CSSValueSlategrey},
-#line 328 "CSSValueKeywords.gperf"
+#line 329 "CSSValueKeywords.gperf"
       {"square-button", CSSValueSquareButton},
-#line 506 "CSSValueKeywords.gperf"
+#line 514 "CSSValueKeywords.gperf"
       {"slategray", CSSValueSlategray},
-#line 430 "CSSValueKeywords.gperf"
+#line 438 "CSSValueKeywords.gperf"
       {"dimgrey", CSSValueDimgrey},
 #line 137 "CSSValueKeywords.gperf"
       {"destination-over", CSSValueDestinationOver},
-#line 429 "CSSValueKeywords.gperf"
+#line 437 "CSSValueKeywords.gperf"
       {"dimgray", CSSValueDimgray},
-#line 208 "CSSValueKeywords.gperf"
+#line 209 "CSSValueKeywords.gperf"
       {"context-menu", CSSValueContextMenu},
-#line 528 "CSSValueKeywords.gperf"
+#line 536 "CSSValueKeywords.gperf"
       {"geometricprecision", CSSValueGeometricprecision},
 #line 91 "CSSValueKeywords.gperf"
       {"yellow", CSSValueYellow},
-#line 316 "CSSValueKeywords.gperf"
+#line 317 "CSSValueKeywords.gperf"
       {"dot-dash", CSSValueDotDash},
-#line 477 "CSSValueKeywords.gperf"
+#line 485 "CSSValueKeywords.gperf"
       {"midnightblue", CSSValueMidnightblue},
 #line 155 "CSSValueKeywords.gperf"
       {"right", CSSValueRight},
@@ -986,49 +994,49 @@ findValue (register const char *str, register unsigned int len)
       {"background", CSSValueBackground},
 #line 39 "CSSValueKeywords.gperf"
       {"lighter", CSSValueLighter},
-#line 361 "CSSValueKeywords.gperf"
+#line 365 "CSSValueKeywords.gperf"
       {"textarea", CSSValueTextarea},
-#line 225 "CSSValueKeywords.gperf"
+#line 226 "CSSValueKeywords.gperf"
       {"nesw-resize", CSSValueNeswResize},
-#line 468 "CSSValueKeywords.gperf"
+#line 476 "CSSValueKeywords.gperf"
       {"mediumaquamarine", CSSValueMediumaquamarine},
 #line 110 "CSSValueKeywords.gperf"
       {"infobackground", CSSValueInfobackground},
 #line 113 "CSSValueKeywords.gperf"
       {"menutext", CSSValueMenutext},
-#line 542 "CSSValueKeywords.gperf"
+#line 550 "CSSValueKeywords.gperf"
       {"use-script", CSSValueUseScript},
-#line 481 "CSSValueKeywords.gperf"
+#line 489 "CSSValueKeywords.gperf"
       {"navajowhite", CSSValueNavajowhite},
 #line 61 "CSSValueKeywords.gperf"
       {"ultra-condensed", CSSValueUltraCondensed},
-#line 451 "CSSValueKeywords.gperf"
+#line 459 "CSSValueKeywords.gperf"
       {"lightcoral", CSSValueLightcoral},
 #line 143 "CSSValueKeywords.gperf"
       {"plus-lighter", CSSValuePlusLighter},
-#line 362 "CSSValueKeywords.gperf"
+#line 366 "CSSValueKeywords.gperf"
       {"caps-lock-indicator", CSSValueCapsLockIndicator},
 #line 168 "CSSValueKeywords.gperf"
       {"lower-roman", CSSValueLowerRoman},
-#line 495 "CSSValueKeywords.gperf"
+#line 503 "CSSValueKeywords.gperf"
       {"powderblue", CSSValuePowderblue},
 #line 101 "CSSValueKeywords.gperf"
       {"buttonshadow", CSSValueButtonshadow},
 #line 139 "CSSValueKeywords.gperf"
       {"destination-out", CSSValueDestinationOut},
-#line 534 "CSSValueKeywords.gperf"
+#line 542 "CSSValueKeywords.gperf"
       {"after-edge", CSSValueAfterEdge},
-#line 413 "CSSValueKeywords.gperf"
+#line 421 "CSSValueKeywords.gperf"
       {"darkgrey", CSSValueDarkgrey},
-#line 411 "CSSValueKeywords.gperf"
+#line 419 "CSSValueKeywords.gperf"
       {"darkgray", CSSValueDarkgray},
-#line 404 "CSSValueKeywords.gperf"
+#line 412 "CSSValueKeywords.gperf"
       {"cornflowerblue", CSSValueCornflowerblue},
-#line 327 "CSSValueKeywords.gperf"
+#line 328 "CSSValueKeywords.gperf"
       {"push-button", CSSValuePushButton},
 #line 31 "CSSValueKeywords.gperf"
       {"status-bar", CSSValueStatusBar},
-#line 228 "CSSValueKeywords.gperf"
+#line 229 "CSSValueKeywords.gperf"
       {"row-resize", CSSValueRowResize},
 #line 121 "CSSValueKeywords.gperf"
       {"windowframe", CSSValueWindowframe},
@@ -1036,71 +1044,71 @@ findValue (register const char *str, register unsigned int len)
       {"hebrew", CSSValueHebrew},
 #line 122 "CSSValueKeywords.gperf"
       {"windowtext", CSSValueWindowtext},
-#line 424 "CSSValueKeywords.gperf"
+#line 432 "CSSValueKeywords.gperf"
       {"darkslategrey", CSSValueDarkslategrey},
-#line 423 "CSSValueKeywords.gperf"
+#line 431 "CSSValueKeywords.gperf"
       {"darkslategray", CSSValueDarkslategray},
-#line 538 "CSSValueKeywords.gperf"
+#line 546 "CSSValueKeywords.gperf"
       {"ideographic", CSSValueIdeographic},
-#line 206 "CSSValueKeywords.gperf"
+#line 207 "CSSValueKeywords.gperf"
       {"vertical-text", CSSValueVerticalText},
 #line 173 "CSSValueKeywords.gperf"
       {"upper-alpha", CSSValueUpperAlpha},
-#line 391 "CSSValueKeywords.gperf"
+#line 399 "CSSValueKeywords.gperf"
       {"antiquewhite", CSSValueAntiquewhite},
 #line 115 "CSSValueKeywords.gperf"
       {"threeddarkshadow", CSSValueThreeddarkshadow},
-#line 526 "CSSValueKeywords.gperf"
+#line 534 "CSSValueKeywords.gperf"
       {"optimizequality", CSSValueOptimizequality},
 #line 148 "CSSValueKeywords.gperf"
       {"text-top", CSSValueTextTop},
-#line 433 "CSSValueKeywords.gperf"
+#line 441 "CSSValueKeywords.gperf"
       {"floralwhite", CSSValueFloralwhite},
 #line 178 "CSSValueKeywords.gperf"
       {"cjk-ideographic", CSSValueCjkIdeographic},
-#line 365 "CSSValueKeywords.gperf"
+#line 369 "CSSValueKeywords.gperf"
       {"border-box", CSSValueBorderBox},
-#line 440 "CSSValueKeywords.gperf"
+#line 448 "CSSValueKeywords.gperf"
       {"honeydew", CSSValueHoneydew},
-#line 271 "CSSValueKeywords.gperf"
+#line 272 "CSSValueKeywords.gperf"
       {"overlay", CSSValueOverlay},
-#line 322 "CSSValueKeywords.gperf"
+#line 323 "CSSValueKeywords.gperf"
       {"break-word", CSSValueBreakWord},
-#line 450 "CSSValueKeywords.gperf"
+#line 458 "CSSValueKeywords.gperf"
       {"lightblue", CSSValueLightblue},
-#line 500 "CSSValueKeywords.gperf"
+#line 508 "CSSValueKeywords.gperf"
       {"sandybrown", CSSValueSandybrown},
-#line 496 "CSSValueKeywords.gperf"
+#line 504 "CSSValueKeywords.gperf"
       {"rosybrown", CSSValueRosybrown},
-#line 439 "CSSValueKeywords.gperf"
+#line 447 "CSSValueKeywords.gperf"
       {"greenyellow", CSSValueGreenyellow},
-#line 532 "CSSValueKeywords.gperf"
+#line 540 "CSSValueKeywords.gperf"
       {"optimizelegibility", CSSValueOptimizelegibility},
-#line 369 "CSSValueKeywords.gperf"
+#line 373 "CSSValueKeywords.gperf"
       {"padding-box", CSSValuePaddingBox},
 #line 182 "CSSValueKeywords.gperf"
       {"katakana-iroha", CSSValueKatakanaIroha},
-#line 320 "CSSValueKeywords.gperf"
+#line 321 "CSSValueKeywords.gperf"
       {"skip-white-space", CSSValueSkipWhiteSpace},
-#line 470 "CSSValueKeywords.gperf"
+#line 478 "CSSValueKeywords.gperf"
       {"mediumorchid", CSSValueMediumorchid},
-#line 463 "CSSValueKeywords.gperf"
+#line 471 "CSSValueKeywords.gperf"
       {"lightsteelblue", CSSValueLightsteelblue},
-#line 455 "CSSValueKeywords.gperf"
+#line 463 "CSSValueKeywords.gperf"
       {"lightgreen", CSSValueLightgreen},
 #line 65 "CSSValueKeywords.gperf"
       {"semi-expanded", CSSValueSemiExpanded},
-#line 459 "CSSValueKeywords.gperf"
+#line 467 "CSSValueKeywords.gperf"
       {"lightseagreen", CSSValueLightseagreen},
-#line 347 "CSSValueKeywords.gperf"
+#line 351 "CSSValueKeywords.gperf"
       {"menulist-button", CSSValueMenulistButton},
-#line 350 "CSSValueKeywords.gperf"
+#line 354 "CSSValueKeywords.gperf"
       {"slider-horizontal", CSSValueSliderHorizontal},
 #line 128 "CSSValueKeywords.gperf"
       {"repeat-x", CSSValueRepeatX},
 #line 170 "CSSValueKeywords.gperf"
       {"lower-greek", CSSValueLowerGreek},
-#line 475 "CSSValueKeywords.gperf"
+#line 483 "CSSValueKeywords.gperf"
       {"mediumturquoise", CSSValueMediumturquoise},
 #line 171 "CSSValueKeywords.gperf"
       {"lower-alpha", CSSValueLowerAlpha},
@@ -1110,39 +1118,41 @@ findValue (register const char *str, register unsigned int len)
       {"graytext", CSSValueGraytext},
 #line 129 "CSSValueKeywords.gperf"
       {"repeat-y", CSSValueRepeatY},
-#line 490 "CSSValueKeywords.gperf"
+#line 498 "CSSValueKeywords.gperf"
       {"papayawhip", CSSValuePapayawhip},
-#line 360 "CSSValueKeywords.gperf"
+#line 364 "CSSValueKeywords.gperf"
       {"textfield", CSSValueTextfield},
 #line 149 "CSSValueKeywords.gperf"
       {"text-bottom", CSSValueTextBottom},
-#line 533 "CSSValueKeywords.gperf"
+#line 541 "CSSValueKeywords.gperf"
       {"before-edge", CSSValueBeforeEdge},
 #line 62 "CSSValueKeywords.gperf"
       {"extra-condensed", CSSValueExtraCondensed},
-#line 447 "CSSValueKeywords.gperf"
+#line 455 "CSSValueKeywords.gperf"
       {"lavenderblush", CSSValueLavenderblush},
+#line 345 "CSSValueKeywords.gperf"
+      {"media-volume-slider", CSSValueMediaVolumeSlider},
 #line 26 "CSSValueKeywords.gperf"
       {"message-box", CSSValueMessageBox},
-#line 348 "CSSValueKeywords.gperf"
+#line 352 "CSSValueKeywords.gperf"
       {"menulist-text", CSSValueMenulistText},
-#line 474 "CSSValueKeywords.gperf"
+#line 482 "CSSValueKeywords.gperf"
       {"mediumspringgreen", CSSValueMediumspringgreen},
-#line 452 "CSSValueKeywords.gperf"
+#line 460 "CSSValueKeywords.gperf"
       {"lightcyan", CSSValueLightcyan},
-#line 307 "CSSValueKeywords.gperf"
+#line 308 "CSSValueKeywords.gperf"
       {"read-write", CSSValueReadWrite},
-#line 257 "CSSValueKeywords.gperf"
+#line 258 "CSSValueKeywords.gperf"
       {"higher", CSSValueHigher},
-#line 518 "CSSValueKeywords.gperf"
+#line 526 "CSSValueKeywords.gperf"
       {"yellowgreen", CSSValueYellowgreen},
-#line 317 "CSSValueKeywords.gperf"
+#line 318 "CSSValueKeywords.gperf"
       {"dot-dot-dash", CSSValueDotDotDash},
-#line 449 "CSSValueKeywords.gperf"
+#line 457 "CSSValueKeywords.gperf"
       {"lemonchiffon", CSSValueLemonchiffon},
-#line 306 "CSSValueKeywords.gperf"
+#line 307 "CSSValueKeywords.gperf"
       {"read-only", CSSValueReadOnly},
-#line 355 "CSSValueKeywords.gperf"
+#line 359 "CSSValueKeywords.gperf"
       {"searchfield", CSSValueSearchfield},
 #line 181 "CSSValueKeywords.gperf"
       {"hiragana-iroha", CSSValueHiraganaIroha},
@@ -1150,79 +1160,83 @@ findValue (register const char *str, register unsigned int len)
       {"table-column-group", CSSValueTableColumnGroup},
 #line 118 "CSSValueKeywords.gperf"
       {"threedlightshadow", CSSValueThreedlightshadow},
-#line 335 "CSSValueKeywords.gperf"
+#line 201 "CSSValueKeywords.gperf"
+      {"-wap-marquee", CSSValueWapMarquee},
+#line 336 "CSSValueKeywords.gperf"
       {"media-mute-button", CSSValueMediaMuteButton},
 #line 68 "CSSValueKeywords.gperf"
       {"ultra-expanded", CSSValueUltraExpanded},
-#line 331 "CSSValueKeywords.gperf"
+#line 332 "CSSValueKeywords.gperf"
       {"default-button", CSSValueDefaultButton},
 #line 93 "CSSValueKeywords.gperf"
       {"-webkit-link", CSSValueWebkitLink},
 #line 167 "CSSValueKeywords.gperf"
       {"decimal-leading-zero", CSSValueDecimalLeadingZero},
-#line 353 "CSSValueKeywords.gperf"
+#line 357 "CSSValueKeywords.gperf"
       {"sliderthumb-vertical", CSSValueSliderthumbVertical},
 #line 94 "CSSValueKeywords.gperf"
       {"-webkit-activelink", CSSValueWebkitActivelink},
-#line 464 "CSSValueKeywords.gperf"
+#line 472 "CSSValueKeywords.gperf"
       {"lightyellow", CSSValueLightyellow},
-#line 428 "CSSValueKeywords.gperf"
+#line 436 "CSSValueKeywords.gperf"
       {"deepskyblue", CSSValueDeepskyblue},
 #line 191 "CSSValueKeywords.gperf"
       {"table-row-group", CSSValueTableRowGroup},
-#line 342 "CSSValueKeywords.gperf"
+#line 343 "CSSValueKeywords.gperf"
       {"media-sliderthumb", CSSValueMediaSliderthumb},
 #line 160 "CSSValueKeywords.gperf"
       {"-webkit-center", CSSValueWebkitCenter},
-#line 337 "CSSValueKeywords.gperf"
+#line 338 "CSSValueKeywords.gperf"
       {"media-seek-back-button", CSSValueMediaSeekBackButton},
 #line 30 "CSSValueKeywords.gperf"
       {"-webkit-control", CSSValueWebkitControl},
-#line 261 "CSSValueKeywords.gperf"
+#line 262 "CSSValueKeywords.gperf"
       {"line-through", CSSValueLineThrough},
 #line 153 "CSSValueKeywords.gperf"
       {"-webkit-auto", CSSValueWebkitAuto},
-#line 456 "CSSValueKeywords.gperf"
+#line 464 "CSSValueKeywords.gperf"
       {"lightgrey", CSSValueLightgrey},
-#line 454 "CSSValueKeywords.gperf"
+#line 462 "CSSValueKeywords.gperf"
       {"lightgray", CSSValueLightgray},
-#line 324 "CSSValueKeywords.gperf"
+#line 325 "CSSValueKeywords.gperf"
       {"after-white-space", CSSValueAfterWhiteSpace},
-#line 460 "CSSValueKeywords.gperf"
+#line 468 "CSSValueKeywords.gperf"
       {"lightskyblue", CSSValueLightskyblue},
-#line 491 "CSSValueKeywords.gperf"
+#line 499 "CSSValueKeywords.gperf"
       {"peachpuff", CSSValuePeachpuff},
-#line 336 "CSSValueKeywords.gperf"
+#line 337 "CSSValueKeywords.gperf"
       {"media-play-button", CSSValueMediaPlayButton},
-#line 339 "CSSValueKeywords.gperf"
+#line 340 "CSSValueKeywords.gperf"
       {"media-rewind-button", CSSValueMediaRewindButton},
 #line 117 "CSSValueKeywords.gperf"
       {"threedhighlight", CSSValueThreedhighlight},
 #line 67 "CSSValueKeywords.gperf"
       {"extra-expanded", CSSValueExtraExpanded},
-#line 462 "CSSValueKeywords.gperf"
+#line 470 "CSSValueKeywords.gperf"
       {"lightslategrey", CSSValueLightslategrey},
-#line 461 "CSSValueKeywords.gperf"
+#line 469 "CSSValueKeywords.gperf"
       {"lightslategray", CSSValueLightslategray},
-#line 213 "CSSValueKeywords.gperf"
+#line 214 "CSSValueKeywords.gperf"
       {"-webkit-zoom-in", CSSValueWebkitZoomIn},
 #line 193 "CSSValueKeywords.gperf"
       {"table-footer-group", CSSValueTableFooterGroup},
-#line 349 "CSSValueKeywords.gperf"
+#line 353 "CSSValueKeywords.gperf"
       {"menulist-textfield", CSSValueMenulistTextfield},
 #line 158 "CSSValueKeywords.gperf"
       {"-webkit-left", CSSValueWebkitLeft},
+#line 344 "CSSValueKeywords.gperf"
+      {"media-volume-slider-container", CSSValueMediaVolumeSliderContainer},
 #line 105 "CSSValueKeywords.gperf"
       {"highlight", CSSValueHighlight},
-#line 285 "CSSValueKeywords.gperf"
+#line 286 "CSSValueKeywords.gperf"
       {"-webkit-nowrap", CSSValueWebkitNowrap},
 #line 192 "CSSValueKeywords.gperf"
       {"table-header-group", CSSValueTableHeaderGroup},
-#line 265 "CSSValueKeywords.gperf"
+#line 266 "CSSValueKeywords.gperf"
       {"-webkit-marquee", CSSValueWebkitMarquee},
-#line 343 "CSSValueKeywords.gperf"
+#line 347 "CSSValueKeywords.gperf"
       {"media-controls-background", CSSValueMediaControlsBackground},
-#line 233 "CSSValueKeywords.gperf"
+#line 234 "CSSValueKeywords.gperf"
       {"-webkit-grab", CSSValueWebkitGrab},
 #line 29 "CSSValueKeywords.gperf"
       {"-webkit-small-control", CSSValueWebkitSmallControl},
@@ -1230,51 +1244,53 @@ findValue (register const char *str, register unsigned int len)
       {"-webkit-text", CSSValueWebkitText},
 #line 28 "CSSValueKeywords.gperf"
       {"-webkit-mini-control", CSSValueWebkitMiniControl},
-#line 334 "CSSValueKeywords.gperf"
+#line 335 "CSSValueKeywords.gperf"
       {"media-fullscreen-button", CSSValueMediaFullscreenButton},
-#line 214 "CSSValueKeywords.gperf"
+#line 215 "CSSValueKeywords.gperf"
       {"-webkit-zoom-out", CSSValueWebkitZoomOut},
 #line 100 "CSSValueKeywords.gperf"
       {"buttonhighlight", CSSValueButtonhighlight},
 #line 199 "CSSValueKeywords.gperf"
       {"-webkit-box", CSSValueWebkitBox},
-#line 352 "CSSValueKeywords.gperf"
-      {"sliderthumb-horizontal", CSSValueSliderthumbHorizontal},
 #line 356 "CSSValueKeywords.gperf"
+      {"sliderthumb-horizontal", CSSValueSliderthumbHorizontal},
+#line 360 "CSSValueKeywords.gperf"
       {"searchfield-decoration", CSSValueSearchfieldDecoration},
 #line 152 "CSSValueKeywords.gperf"
       {"-webkit-baseline-middle", CSSValueWebkitBaselineMiddle},
+#line 346 "CSSValueKeywords.gperf"
+      {"media-volume-sliderthumb", CSSValueMediaVolumeSliderthumb},
 #line 74 "CSSValueKeywords.gperf"
       {"-webkit-body", CSSValueWebkitBody},
-#line 453 "CSSValueKeywords.gperf"
+#line 461 "CSSValueKeywords.gperf"
       {"lightgoldenrodyellow", CSSValueLightgoldenrodyellow},
-#line 537 "CSSValueKeywords.gperf"
+#line 545 "CSSValueKeywords.gperf"
       {"text-after-edge", CSSValueTextAfterEdge},
-#line 345 "CSSValueKeywords.gperf"
+#line 349 "CSSValueKeywords.gperf"
       {"media-time-remaining-display", CSSValueMediaTimeRemainingDisplay},
 #line 159 "CSSValueKeywords.gperf"
       {"-webkit-right", CSSValueWebkitRight},
-#line 536 "CSSValueKeywords.gperf"
+#line 544 "CSSValueKeywords.gperf"
       {"text-before-edge", CSSValueTextBeforeEdge},
-#line 234 "CSSValueKeywords.gperf"
+#line 235 "CSSValueKeywords.gperf"
       {"-webkit-grabbing", CSSValueWebkitGrabbing},
 #line 200 "CSSValueKeywords.gperf"
       {"-webkit-inline-box", CSSValueWebkitInlineBox},
-#line 344 "CSSValueKeywords.gperf"
+#line 348 "CSSValueKeywords.gperf"
       {"media-current-time-display", CSSValueMediaCurrentTimeDisplay},
 #line 106 "CSSValueKeywords.gperf"
       {"highlighttext", CSSValueHighlighttext},
-#line 359 "CSSValueKeywords.gperf"
+#line 363 "CSSValueKeywords.gperf"
       {"searchfield-cancel-button", CSSValueSearchfieldCancelButton},
-#line 338 "CSSValueKeywords.gperf"
+#line 339 "CSSValueKeywords.gperf"
       {"media-seek-forward-button", CSSValueMediaSeekForwardButton},
-#line 340 "CSSValueKeywords.gperf"
+#line 341 "CSSValueKeywords.gperf"
       {"media-return-to-realtime-button", CSSValueMediaReturnToRealtimeButton},
-#line 357 "CSSValueKeywords.gperf"
+#line 361 "CSSValueKeywords.gperf"
       {"searchfield-results-decoration", CSSValueSearchfieldResultsDecoration},
-#line 358 "CSSValueKeywords.gperf"
+#line 362 "CSSValueKeywords.gperf"
       {"searchfield-results-button", CSSValueSearchfieldResultsButton},
-#line 308 "CSSValueKeywords.gperf"
+#line 309 "CSSValueKeywords.gperf"
       {"read-write-plaintext-only", CSSValueReadWritePlaintextOnly},
 #line 123 "CSSValueKeywords.gperf"
       {"-webkit-focus-ring-color", CSSValueWebkitFocusRingColor},
@@ -1306,373 +1322,371 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  38,  -1,  -1,  -1,  -1,
        -1,  39,  -1,  -1,  -1,  40,  41,  -1,  -1,  -1,
-       -1,  42,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  43,  -1,  -1,  -1,  44,  -1,  -1,  -1,  -1,
-       45,  -1,  -1,  -1,  -1,  46,  -1,  -1,  -1,  -1,
-       47,  -1,  48,  -1,  -1,  -1,  49,  -1,  -1,  -1,
-       50,  -1,  -1,  -1,  -1,  -1,  51,  -1,  -1,  -1,
-       52,  -1,  53,  -1,  -1,  -1,  -1,  54,  -1,  -1,
-       -1,  55,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       56,  -1,  -1,  -1,  -1,  57,  -1,  -1,  -1,  -1,
-       58,  59,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       60,  -1,  -1,  -1,  -1,  61,  -1,  -1,  -1,  -1,
-       62,  -1,  -1,  -1,  -1,  63,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  64,  65,  -1,  -1,  -1,
-       66,  -1,  67,  -1,  -1,  68,  -1,  69,  -1,  -1,
-       70,  71,  -1,  -1,  -1,  -1,  72,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  73,  -1,  -1,  -1,
-       -1,  74,  -1,  -1,  -1,  75,  -1,  -1,  -1,  -1,
-       76,  -1,  77,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  78,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  79,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       42,  43,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  44,  -1,  -1,  -1,  45,  -1,  -1,  -1,  -1,
+       46,  -1,  -1,  -1,  -1,  47,  -1,  -1,  -1,  -1,
+       48,  -1,  49,  -1,  -1,  -1,  50,  -1,  -1,  -1,
+       51,  -1,  -1,  -1,  -1,  -1,  52,  -1,  -1,  -1,
+       53,  -1,  54,  -1,  -1,  -1,  -1,  55,  -1,  -1,
+       -1,  56,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       57,  -1,  -1,  -1,  -1,  58,  -1,  -1,  -1,  -1,
+       59,  60,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       61,  -1,  -1,  -1,  -1,  62,  -1,  -1,  -1,  -1,
+       63,  -1,  -1,  -1,  -1,  64,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  65,  66,  -1,  -1,  -1,
+       67,  -1,  68,  -1,  -1,  69,  -1,  70,  -1,  -1,
+       71,  72,  -1,  -1,  -1,  -1,  73,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  74,  -1,  -1,  -1,
+       -1,  75,  -1,  -1,  -1,  76,  -1,  -1,  -1,  -1,
+       77,  -1,  78,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  79,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  80,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  81,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  82,  -1,  -1,  83,  84,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  85,  -1,  -1,
-       -1,  86,  87,  -1,  -1,  -1,  88,  -1,  -1,  -1,
-       -1,  89,  -1,  90,  -1,  91,  -1,  92,  -1,  -1,
-       93,  -1,  -1,  -1,  -1,  -1,  94,  95,  -1,  -1,
-       -1,  96,  -1,  -1,  -1,  -1,  97,  -1,  -1,  -1,
-       -1,  98,  99,  -1,  -1, 100,  -1,  -1,  -1,  -1,
-       -1, 101, 102,  -1,  -1,  -1, 103,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 104,  -1,  -1,  -1,
-      105,  -1, 106,  -1,  -1, 107,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 108,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 109,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 110,  -1, 111,  -1,  -1, 112,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 113,  -1,  -1,  -1,
-       -1,  -1, 114,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 115,  -1,  -1,  -1, 116, 117, 118,  -1,  -1,
-      119,  -1,  -1,  -1,  -1,  -1, 120, 121,  -1,  -1,
-      122, 123,  -1,  -1,  -1, 124, 125,  -1,  -1,  -1,
-      126,  -1, 127,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 128,  -1,  -1, 129,  -1,  -1,  -1,  -1,
-       -1, 130,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 131,  -1,  -1,  -1,  -1, 132, 133,  -1,  -1,
-       -1,  -1,  -1, 134,  -1,  -1,  -1, 135,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 136,  -1,  -1,  -1, 137,  -1,  -1,  -1,
-      138, 139,  -1,  -1,  -1, 140,  -1,  -1,  -1,  -1,
-       -1, 141,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 142,  -1,  -1,  -1,
-       -1, 143,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      144,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 145,  -1,  -1, 146, 147,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 148,  -1,
-      149,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      150, 151,  -1,  -1,  -1, 152, 153,  -1,  -1,  -1,
-      154,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      155, 156,  -1,  -1,  -1, 157,  -1,  -1,  -1,  -1,
-      158,  -1,  -1,  -1,  -1,  -1, 159, 160,  -1,  -1,
-      161, 162,  -1,  -1,  -1, 163,  -1,  -1,  -1,  -1,
-      164,  -1,  -1,  -1,  -1, 165,  -1,  -1,  -1,  -1,
-       -1, 166, 167,  -1,  -1, 168,  -1, 169,  -1,  -1,
-       -1, 170, 171,  -1,  -1,  -1, 172, 173,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      174, 175,  -1,  -1,  -1, 176, 177,  -1,  -1,  -1,
-       -1, 178,  -1,  -1,  -1,  -1, 179,  -1,  -1,  -1,
-      180, 181, 182,  -1,  -1, 183,  -1,  -1,  -1,  -1,
-      184,  -1,  -1,  -1,  -1, 185, 186, 187,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 188, 189, 190,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 191,  -1,  -1,  -1,
-       -1, 192,  -1,  -1,  -1,  -1, 193,  -1,  -1,  -1,
+       -1,  81,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  82,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  83,  -1,  -1,  84,  85,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  86,  -1,  -1,
+       -1,  87,  88,  -1,  -1,  -1,  89,  -1,  -1,  -1,
+       -1,  90,  -1,  91,  -1,  92,  -1,  93,  -1,  -1,
+       94,  -1,  -1,  -1,  -1,  -1,  95,  96,  -1,  -1,
+       -1,  97,  -1,  -1,  -1,  -1,  98,  -1,  -1,  -1,
+       -1,  99, 100,  -1,  -1, 101,  -1,  -1,  -1,  -1,
+       -1, 102, 103,  -1,  -1,  -1, 104,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 105,  -1,  -1,  -1,
+      106,  -1, 107,  -1,  -1, 108,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 109,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 110,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 111,  -1, 112,  -1,  -1, 113,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 114,  -1,  -1,  -1,
+       -1,  -1, 115,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 116,  -1,  -1,  -1, 117, 118, 119,  -1,  -1,
+      120,  -1,  -1,  -1,  -1,  -1, 121, 122,  -1,  -1,
+      123, 124,  -1,  -1,  -1, 125, 126,  -1,  -1,  -1,
+      127,  -1, 128,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 129,  -1,  -1, 130,  -1,  -1,  -1,  -1,
+       -1, 131,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 132,  -1,  -1,  -1,  -1, 133, 134,  -1,  -1,
+       -1,  -1,  -1, 135,  -1,  -1,  -1, 136,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 137,  -1,  -1,  -1, 138,  -1,  -1,  -1,
+      139, 140,  -1,  -1,  -1, 141,  -1,  -1,  -1,  -1,
+       -1, 142,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      143,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 144,  -1,  -1,  -1,
+       -1, 145,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      146,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 147,  -1,  -1, 148, 149,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 150,  -1,
+      151,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      152, 153,  -1,  -1,  -1, 154, 155,  -1,  -1,  -1,
+      156,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      157, 158,  -1,  -1,  -1, 159,  -1,  -1,  -1,  -1,
+      160,  -1,  -1,  -1,  -1,  -1, 161, 162,  -1,  -1,
+      163, 164,  -1,  -1,  -1, 165, 166,  -1,  -1,  -1,
+      167,  -1,  -1,  -1,  -1, 168,  -1,  -1,  -1,  -1,
+       -1, 169, 170,  -1,  -1, 171,  -1, 172,  -1,  -1,
+       -1, 173, 174,  -1,  -1,  -1, 175, 176,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      177, 178,  -1,  -1,  -1, 179, 180,  -1,  -1,  -1,
+       -1, 181,  -1,  -1,  -1,  -1, 182,  -1,  -1,  -1,
+      183, 184, 185,  -1,  -1, 186,  -1,  -1,  -1,  -1,
+      187,  -1,  -1,  -1,  -1, 188, 189, 190,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 191, 192, 193,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1, 194,  -1,  -1,  -1,
-      195,  -1, 196,  -1,  -1, 197,  -1,  -1,  -1,  -1,
-      198, 199,  -1,  -1,  -1, 200,  -1,  -1, 201,  -1,
-      202,  -1,  -1,  -1,  -1, 203,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 204,  -1,  -1, 205,  -1,
-       -1,  -1,  -1,  -1,  -1, 206,  -1,  -1,  -1,  -1,
-      207,  -1,  -1,  -1,  -1,  -1, 208, 209, 210,  -1,
-      211,  -1,  -1,  -1,  -1, 212,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 213,
-      214,  -1,  -1,  -1,  -1, 215, 216,  -1,  -1,  -1,
-       -1, 217,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      218, 219,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      220,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      221,  -1,  -1,  -1,  -1,  -1,  -1, 222,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 223,  -1,  -1,  -1,  -1,
-      224, 225,  -1,  -1,  -1, 226,  -1, 227,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 228, 229,  -1,  -1,  -1,
-       -1, 230,  -1,  -1,  -1, 231,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 232, 233,  -1, 234,  -1,
-       -1, 235,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      236,  -1, 237,  -1,  -1, 238,  -1,  -1,  -1,  -1,
-      239,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 240,  -1,  -1,  -1,  -1,  -1, 241,  -1,  -1,
-      242, 243, 244,  -1,  -1,  -1,  -1, 245,  -1,  -1,
-       -1, 246,  -1,  -1,  -1,  -1,  -1,  -1, 247,  -1,
-       -1, 248,  -1,  -1,  -1, 249, 250, 251,  -1,  -1,
-      252,  -1,  -1,  -1,  -1,  -1,  -1, 253,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 254,
-       -1, 255,  -1,  -1,  -1, 256,  -1,  -1,  -1,  -1,
-      257, 258,  -1,  -1,  -1,  -1,  -1, 259,  -1,  -1,
-      260,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 261,  -1,  -1,
-       -1, 262,  -1,  -1, 263,  -1,  -1, 264,  -1,  -1,
-       -1,  -1, 265,  -1,  -1,  -1,  -1, 266,  -1,  -1,
-       -1, 267,  -1,  -1,  -1, 268,  -1,  -1, 269,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      270,  -1,  -1,  -1,  -1, 271, 272,  -1,  -1,  -1,
-       -1,  -1,  -1, 273,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 274,  -1, 275,  -1,  -1,  -1,
-       -1,  -1, 276,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      277,  -1,  -1,  -1,  -1,  -1, 278,  -1,  -1,  -1,
-       -1, 279,  -1,  -1,  -1, 280,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 281,  -1,  -1,  -1,  -1,  -1, 282,  -1,
-       -1,  -1,  -1, 283,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 284, 285,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 286,  -1, 287,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 288,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 289,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 290,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 291,  -1,  -1,  -1,  -1,  -1, 292,  -1,  -1,
-      293,  -1, 294,  -1,  -1, 295,  -1,  -1,  -1,  -1,
-       -1, 296,  -1,  -1,  -1, 297,  -1,  -1,  -1,  -1,
-      298, 299, 300, 301,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 302,  -1, 303,  -1, 304,  -1,  -1,
-       -1, 305,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 306,  -1,  -1,  -1, 307, 308,  -1,  -1,
-       -1, 309,  -1,  -1,  -1,  -1, 310,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 311,  -1,  -1,  -1,  -1,  -1,  -1, 312,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 313,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 314,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 315,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      316,  -1,  -1,  -1,  -1,  -1, 317,  -1,  -1,  -1,
-       -1, 318, 319,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 320,  -1,  -1, 321,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 322, 323,  -1, 324,
-       -1,  -1, 325,  -1,  -1, 326,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 327, 328,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 329,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 330,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 331,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 332,  -1,  -1,  -1,  -1, 333,  -1,  -1,  -1,
-       -1, 334,  -1,  -1,  -1,  -1,  -1, 335,  -1,  -1,
-       -1, 336,  -1,  -1,  -1, 337,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 338,  -1,  -1,  -1,  -1,
-      339,  -1,  -1,  -1,  -1, 340,  -1,  -1,  -1,  -1,
-      341,  -1,  -1,  -1,  -1, 342, 343,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 344,  -1,  -1,  -1,
-       -1,  -1, 345,  -1,  -1,  -1, 346,  -1,  -1,  -1,
-       -1,  -1, 347,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 348,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      349,  -1,  -1,  -1,  -1, 350, 351, 352,  -1,  -1,
-      353,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 354,  -1,  -1,
-       -1, 355,  -1,  -1,  -1,  -1, 356,  -1, 357,  -1,
-       -1,  -1, 358,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 359,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 360, 361,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 362,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 363, 364,  -1, 365, 366,  -1,  -1,  -1, 367,
-       -1, 368,  -1,  -1,  -1,  -1,  -1, 369,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 370,  -1,
-       -1, 371, 372,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 373,  -1, 374,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 375,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 376, 377,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      378,  -1, 379,  -1,  -1,  -1, 380, 381,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 382,  -1,
-       -1, 383,  -1, 384,  -1,  -1, 385,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 386,  -1,  -1,  -1,
-       -1,  -1, 387,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      388,  -1, 389,  -1,  -1,  -1, 390, 391,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 392,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 393,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 394, 395, 396,  -1,
-       -1, 397,  -1,  -1,  -1, 398,  -1,  -1, 399,  -1,
-       -1,  -1,  -1,  -1,  -1, 400, 401,  -1,  -1,  -1,
-       -1,  -1, 402, 403,  -1,  -1, 404,  -1,  -1,  -1,
-       -1, 405,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 406,  -1,  -1,
-      407,  -1,  -1,  -1,  -1,  -1,  -1, 408, 409,  -1,
-       -1,  -1,  -1, 410,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 411,  -1,  -1,  -1,  -1, 412,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 413, 414,  -1, 415,  -1,
-       -1, 416,  -1,  -1, 417,  -1,  -1,  -1,  -1,  -1,
+       -1, 195,  -1,  -1,  -1,  -1, 196,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 197,  -1,  -1,  -1,
+      198,  -1, 199,  -1,  -1, 200,  -1,  -1,  -1,  -1,
+      201, 202,  -1,  -1,  -1, 203,  -1,  -1, 204,  -1,
+      205,  -1,  -1,  -1,  -1, 206,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 207,  -1,  -1, 208,  -1,
+       -1,  -1,  -1,  -1,  -1, 209,  -1,  -1,  -1,  -1,
+      210,  -1,  -1,  -1,  -1,  -1, 211, 212, 213,  -1,
+      214,  -1,  -1,  -1,  -1, 215,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 216,
+      217,  -1,  -1,  -1,  -1, 218, 219,  -1,  -1,  -1,
+       -1, 220,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      221, 222,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      223,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      224,  -1,  -1,  -1,  -1,  -1,  -1, 225,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 226,  -1,  -1,  -1,  -1,
+      227, 228,  -1,  -1,  -1, 229,  -1, 230,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 231, 232,  -1,  -1,  -1,
+       -1, 233,  -1,  -1,  -1, 234,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 235, 236,  -1, 237,  -1,
+       -1, 238,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      239,  -1, 240,  -1,  -1, 241,  -1,  -1,  -1,  -1,
+      242,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 243,  -1,  -1,  -1,  -1,  -1, 244,  -1,  -1,
+      245, 246, 247,  -1,  -1,  -1,  -1, 248,  -1,  -1,
+       -1, 249,  -1,  -1,  -1,  -1,  -1,  -1, 250,  -1,
+       -1, 251,  -1,  -1,  -1, 252, 253, 254,  -1,  -1,
+      255,  -1,  -1,  -1,  -1,  -1,  -1, 256,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 257,
+       -1, 258,  -1,  -1,  -1, 259,  -1,  -1,  -1,  -1,
+      260, 261,  -1,  -1,  -1,  -1,  -1, 262,  -1,  -1,
+      263,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 264,  -1,  -1,
+       -1, 265,  -1,  -1, 266,  -1,  -1, 267,  -1,  -1,
+       -1,  -1, 268,  -1,  -1,  -1,  -1, 269,  -1,  -1,
+       -1, 270,  -1,  -1,  -1, 271,  -1,  -1, 272,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      273,  -1,  -1,  -1,  -1, 274, 275,  -1,  -1,  -1,
+       -1,  -1,  -1, 276,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 277,  -1, 278,  -1,  -1,  -1,
+       -1,  -1, 279,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      280,  -1,  -1,  -1,  -1,  -1, 281,  -1,  -1,  -1,
+       -1, 282,  -1,  -1,  -1, 283,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 284,  -1,  -1,  -1,  -1,  -1, 285,  -1,
+       -1,  -1,  -1, 286,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 287, 288,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 289,  -1, 290,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 291,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 292,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 293,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 294,  -1,  -1,  -1,  -1,  -1, 295,  -1,  -1,
+      296,  -1, 297,  -1,  -1, 298,  -1,  -1,  -1,  -1,
+       -1, 299,  -1,  -1,  -1, 300,  -1,  -1,  -1,  -1,
+      301, 302, 303, 304,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 305,  -1, 306,  -1, 307,  -1,  -1,
+       -1, 308,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 309,  -1,  -1,  -1, 310, 311,  -1,  -1,
+       -1, 312,  -1,  -1,  -1,  -1, 313,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 314,  -1,  -1,  -1,  -1,  -1,  -1, 315,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 316,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 317,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 318,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      319,  -1,  -1,  -1,  -1,  -1, 320,  -1,  -1,  -1,
+       -1, 321, 322,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 323,  -1,  -1, 324,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 325, 326,  -1, 327,
+       -1,  -1, 328,  -1,  -1, 329,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 330, 331,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 332,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 333,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 334,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 335,  -1,  -1,  -1,  -1, 336,  -1,  -1,  -1,
+       -1, 337,  -1,  -1,  -1,  -1,  -1, 338,  -1,  -1,
+       -1, 339,  -1,  -1,  -1, 340,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 341,  -1,  -1,  -1,  -1,
+      342,  -1,  -1,  -1,  -1, 343,  -1,  -1,  -1,  -1,
+      344,  -1,  -1,  -1,  -1, 345, 346,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 347,  -1,  -1,  -1,
+       -1,  -1, 348,  -1,  -1,  -1, 349,  -1,  -1,  -1,
+       -1,  -1, 350,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 351,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      352,  -1,  -1,  -1,  -1, 353, 354, 355,  -1,  -1,
+      356,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 357,  -1,  -1,
+       -1, 358,  -1,  -1,  -1,  -1, 359, 360, 361,  -1,
+       -1,  -1, 362,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 363,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 364, 365,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 366,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 367, 368,  -1, 369, 370,  -1,  -1,  -1, 371,
+       -1, 372,  -1,  -1,  -1,  -1,  -1, 373,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 374,  -1,
+       -1, 375, 376,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 377,  -1, 378,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 379,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 380, 381,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      382,  -1, 383,  -1,  -1,  -1, 384, 385,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 386,  -1,
+       -1, 387,  -1, 388,  -1,  -1, 389,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 390,  -1,  -1,  -1,
+       -1,  -1, 391,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      392,  -1, 393,  -1,  -1,  -1, 394, 395,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 396,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 397,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 398, 399, 400,  -1,
+       -1, 401,  -1,  -1,  -1, 402,  -1,  -1, 403,  -1,
+       -1,  -1,  -1,  -1,  -1, 404, 405,  -1,  -1,  -1,
+       -1,  -1, 406, 407,  -1,  -1, 408,  -1,  -1,  -1,
+       -1, 409,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 410,  -1,  -1,
+      411,  -1,  -1,  -1,  -1,  -1,  -1, 412, 413,  -1,
+       -1,  -1,  -1, 414,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 415,  -1,  -1,  -1,  -1, 416,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 417, 418,  -1, 419,  -1,
+       -1, 420,  -1,  -1, 421,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 418,  -1,
-       -1,  -1,  -1, 419,  -1,  -1, 420,  -1,  -1,  -1,
-       -1,  -1, 421,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 422,  -1,
+       -1,  -1,  -1, 423,  -1,  -1, 424,  -1,  -1,  -1,
+       -1,  -1, 425,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 422,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 423,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 424,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 426,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 427,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 428,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      425,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 426,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      429,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 430,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 427,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 428,  -1,  -1,  -1, 429, 430,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 431,  -1,  -1,
-       -1,  -1, 432,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 433,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 434,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 431,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 432,  -1,  -1,  -1, 433, 434,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 435,  -1,  -1,
+       -1,  -1, 436,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 437,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 438,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 435,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 436,  -1,
-       -1,  -1,  -1,  -1, 437,  -1,  -1, 438,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1, 439,  -1,  -1,
-       -1,  -1, 440,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 441, 442, 443,  -1,  -1,
-       -1, 444,  -1,  -1,  -1,  -1,  -1, 445,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 440,  -1,
+       -1,  -1,  -1,  -1, 441,  -1,  -1, 442,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 443,  -1,  -1,
+       -1,  -1, 444,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 445, 446, 447,  -1,  -1,
+       -1, 448,  -1,  -1,  -1,  -1,  -1, 449,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      446, 447,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 448,  -1,  -1,  -1,  -1, 449,  -1,
+      450, 451,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 452,  -1,  -1,  -1,  -1, 453,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 450,  -1,  -1,
-       -1, 451,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      452,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 453,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 454,  -1,  -1,
+       -1, 455,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      456,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 457,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 454,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 455,
-       -1,  -1,  -1,  -1,  -1,  -1, 456,  -1,  -1,  -1,
-       -1, 457, 458,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 459,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 458,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 459,
        -1,  -1,  -1,  -1,  -1,  -1, 460,  -1,  -1,  -1,
+       -1, 461, 462,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 463,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 464,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 465,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 466,  -1,  -1,
+       -1, 467,  -1,  -1,  -1,  -1,  -1, 468,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 461,  -1,  -1,
-       -1, 462,  -1,  -1,  -1,  -1,  -1, 463,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 469,  -1,  -1,
+       -1, 470,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 464,  -1,  -1,
-       -1, 465,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 471,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 466,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 472,  -1,  -1,  -1,  -1,  -1,  -1,
+      473,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 467,  -1,  -1,  -1,  -1,  -1,  -1,
-      468,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      474, 475,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 476,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      469, 470,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 471,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 477,  -1,  -1,
+       -1, 478,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 479,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 472,  -1,  -1,
-       -1, 473,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 474,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 480,  -1,
+      481,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 482,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 483,  -1, 484,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      475,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 476,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 477,  -1, 478,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 485,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 479,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 486,  -1,  -1,
+       -1,  -1,  -1,  -1, 487,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 488,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 480,  -1,  -1,
-       -1,  -1,  -1,  -1, 481,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 482,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 489,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 490,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 483,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 484,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 485,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 491,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 486,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 487,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 488,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 489,  -1,  -1,
-       -1,  -1, 490,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 492,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 493,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 494,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 495,  -1,  -1,
+       -1,  -1, 496,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 491,  -1,
-       -1,  -1,  -1, 492,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 493, 494,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 497,  -1,
+       -1,  -1,  -1, 498,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      495,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 499, 500,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 496,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 497,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 498,  -1,  -1,
-       -1,  -1, 499,  -1,  -1,  -1,  -1,  -1, 500,  -1,
-       -1,  -1,  -1, 501,  -1,  -1,  -1, 502,  -1,  -1,
+      501,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 502,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1, 503,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 504,  -1,  -1,
+       -1,  -1, 505,  -1,  -1,  -1,  -1,  -1, 506,  -1,
+       -1,  -1,  -1, 507,  -1,  -1,  -1, 508,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 509,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 504,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 505,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 510,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 511,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1680,49 +1694,50 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 506,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 512,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 513,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 507,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 514,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 508,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 509,
+       -1,  -1,  -1,  -1,  -1,  -1, 515,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 516,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 510, 511,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 517, 518,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 512,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 513,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 519,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 520,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 514,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 515,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 516, 517,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 518,  -1,
+       -1,  -1, 521,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 522,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 523, 524,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 525,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 519,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 526,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      520,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 521,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      527,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 528,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1733,21 +1748,22 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 529,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 522,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 530,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 523,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 524,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 525,  -1,  -1,
+       -1,  -1,  -1,  -1, 531,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 532,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 533,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1762,9 +1778,9 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 526,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 527,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 528,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 534,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 535,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 536,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1774,7 +1790,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 529,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 537,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1786,11 +1802,11 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 530,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 538,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 531,  -1,
-       -1,  -1,  -1,  -1,  -1, 532,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 539,  -1,
+       -1,  -1,  -1,  -1,  -1, 540,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1818,7 +1834,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 533,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 541,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1840,7 +1856,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      534,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      542,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1861,7 +1877,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      535,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      543,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1875,7 +1891,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      536,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      544,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1908,7 +1924,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 537,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 545,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1934,7 +1950,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 538,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 546,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -2001,7 +2017,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 539
+       -1, 547
     };
 
   if (len <= MAX_WORD_LENGTH && len >= MIN_WORD_LENGTH)
@@ -2023,7 +2039,7 @@ findValue (register const char *str, register unsigned int len)
     }
   return 0;
 }
-#line 551 "CSSValueKeywords.gperf"
+#line 559 "CSSValueKeywords.gperf"
 
 static const char * const valueList[] = {
 "",
@@ -2217,6 +2233,7 @@ static const char * const valueList[] = {
 "table-caption", 
 "-webkit-box", 
 "-webkit-inline-box", 
+"-wap-marquee", 
 "auto", 
 "crosshair", 
 "default", 
@@ -2359,6 +2376,9 @@ static const char * const valueList[] = {
 "media-return-to-realtime-button", 
 "media-slider", 
 "media-sliderthumb", 
+"media-volume-slider-container", 
+"media-volume-slider", 
+"media-volume-sliderthumb", 
 "media-controls-background", 
 "media-current-time-display", 
 "media-time-remaining-display", 
@@ -2386,6 +2406,8 @@ static const char * const valueList[] = {
 "content-box", 
 "padding", 
 "padding-box", 
+"contain", 
+"cover", 
 "logical", 
 "visual", 
 "lines", 
@@ -2406,6 +2428,8 @@ static const char * const valueList[] = {
 "painted", 
 "fill", 
 "stroke", 
+"antialiased", 
+"subpixel-antialiased", 
 "aliceblue", 
 "antiquewhite", 
 "aquamarine", 
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.h b/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.h
index 6d2667d..d3b22e4 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.h
+++ b/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.h
@@ -194,357 +194,365 @@ const int CSSValueTableCell = 187;
 const int CSSValueTableCaption = 188;
 const int CSSValueWebkitBox = 189;
 const int CSSValueWebkitInlineBox = 190;
-const int CSSValueAuto = 191;
-const int CSSValueCrosshair = 192;
-const int CSSValueDefault = 193;
-const int CSSValuePointer = 194;
-const int CSSValueMove = 195;
-const int CSSValueVerticalText = 196;
-const int CSSValueCell = 197;
-const int CSSValueContextMenu = 198;
-const int CSSValueAlias = 199;
-const int CSSValueProgress = 200;
-const int CSSValueNoDrop = 201;
-const int CSSValueNotAllowed = 202;
-const int CSSValueWebkitZoomIn = 203;
-const int CSSValueWebkitZoomOut = 204;
-const int CSSValueEResize = 205;
-const int CSSValueNeResize = 206;
-const int CSSValueNwResize = 207;
-const int CSSValueNResize = 208;
-const int CSSValueSeResize = 209;
-const int CSSValueSwResize = 210;
-const int CSSValueSResize = 211;
-const int CSSValueWResize = 212;
-const int CSSValueEwResize = 213;
-const int CSSValueNsResize = 214;
-const int CSSValueNeswResize = 215;
-const int CSSValueNwseResize = 216;
-const int CSSValueColResize = 217;
-const int CSSValueRowResize = 218;
-const int CSSValueText = 219;
-const int CSSValueWait = 220;
-const int CSSValueHelp = 221;
-const int CSSValueAllScroll = 222;
-const int CSSValueWebkitGrab = 223;
-const int CSSValueWebkitGrabbing = 224;
-const int CSSValueLtr = 225;
-const int CSSValueRtl = 226;
-const int CSSValueCapitalize = 227;
-const int CSSValueUppercase = 228;
-const int CSSValueLowercase = 229;
-const int CSSValueVisible = 230;
-const int CSSValueCollapse = 231;
-const int CSSValueAbove = 232;
-const int CSSValueAbsolute = 233;
-const int CSSValueAlways = 234;
-const int CSSValueAvoid = 235;
-const int CSSValueBelow = 236;
-const int CSSValueBidiOverride = 237;
-const int CSSValueBlink = 238;
-const int CSSValueBoth = 239;
-const int CSSValueCloseQuote = 240;
-const int CSSValueCrop = 241;
-const int CSSValueCross = 242;
-const int CSSValueEmbed = 243;
-const int CSSValueFixed = 244;
-const int CSSValueHand = 245;
-const int CSSValueHide = 246;
-const int CSSValueHigher = 247;
-const int CSSValueInvert = 248;
-const int CSSValueLandscape = 249;
-const int CSSValueLevel = 250;
-const int CSSValueLineThrough = 251;
-const int CSSValueLocal = 252;
-const int CSSValueLoud = 253;
-const int CSSValueLower = 254;
-const int CSSValueWebkitMarquee = 255;
-const int CSSValueMix = 256;
-const int CSSValueNoCloseQuote = 257;
-const int CSSValueNoOpenQuote = 258;
-const int CSSValueNowrap = 259;
-const int CSSValueOpenQuote = 260;
-const int CSSValueOverlay = 261;
-const int CSSValueOverline = 262;
-const int CSSValuePortrait = 263;
-const int CSSValuePre = 264;
-const int CSSValuePreLine = 265;
-const int CSSValuePreWrap = 266;
-const int CSSValueRelative = 267;
-const int CSSValueScroll = 268;
-const int CSSValueSeparate = 269;
-const int CSSValueShow = 270;
-const int CSSValueStatic = 271;
-const int CSSValueThick = 272;
-const int CSSValueThin = 273;
-const int CSSValueUnderline = 274;
-const int CSSValueWebkitNowrap = 275;
-const int CSSValueStretch = 276;
-const int CSSValueStart = 277;
-const int CSSValueEnd = 278;
-const int CSSValueReverse = 279;
-const int CSSValueHorizontal = 280;
-const int CSSValueVertical = 281;
-const int CSSValueInlineAxis = 282;
-const int CSSValueBlockAxis = 283;
-const int CSSValueSingle = 284;
-const int CSSValueMultiple = 285;
-const int CSSValueForwards = 286;
-const int CSSValueBackwards = 287;
-const int CSSValueAhead = 288;
-const int CSSValueUp = 289;
-const int CSSValueDown = 290;
-const int CSSValueSlow = 291;
-const int CSSValueFast = 292;
-const int CSSValueInfinite = 293;
-const int CSSValueSlide = 294;
-const int CSSValueAlternate = 295;
-const int CSSValueReadOnly = 296;
-const int CSSValueReadWrite = 297;
-const int CSSValueReadWritePlaintextOnly = 298;
-const int CSSValueElement = 299;
-const int CSSValueIgnore = 300;
-const int CSSValueIntrinsic = 301;
-const int CSSValueMinIntrinsic = 302;
-const int CSSValueClip = 303;
-const int CSSValueEllipsis = 304;
-const int CSSValueDiscard = 305;
-const int CSSValueDotDash = 306;
-const int CSSValueDotDotDash = 307;
-const int CSSValueWave = 308;
-const int CSSValueContinuous = 309;
-const int CSSValueSkipWhiteSpace = 310;
-const int CSSValueBreakAll = 311;
-const int CSSValueBreakWord = 312;
-const int CSSValueSpace = 313;
-const int CSSValueAfterWhiteSpace = 314;
-const int CSSValueCheckbox = 315;
-const int CSSValueRadio = 316;
-const int CSSValuePushButton = 317;
-const int CSSValueSquareButton = 318;
-const int CSSValueButton = 319;
-const int CSSValueButtonBevel = 320;
-const int CSSValueDefaultButton = 321;
-const int CSSValueListbox = 322;
-const int CSSValueListitem = 323;
-const int CSSValueMediaFullscreenButton = 324;
-const int CSSValueMediaMuteButton = 325;
-const int CSSValueMediaPlayButton = 326;
-const int CSSValueMediaSeekBackButton = 327;
-const int CSSValueMediaSeekForwardButton = 328;
-const int CSSValueMediaRewindButton = 329;
-const int CSSValueMediaReturnToRealtimeButton = 330;
-const int CSSValueMediaSlider = 331;
-const int CSSValueMediaSliderthumb = 332;
-const int CSSValueMediaControlsBackground = 333;
-const int CSSValueMediaCurrentTimeDisplay = 334;
-const int CSSValueMediaTimeRemainingDisplay = 335;
-const int CSSValueMenulist = 336;
-const int CSSValueMenulistButton = 337;
-const int CSSValueMenulistText = 338;
-const int CSSValueMenulistTextfield = 339;
-const int CSSValueSliderHorizontal = 340;
-const int CSSValueSliderVertical = 341;
-const int CSSValueSliderthumbHorizontal = 342;
-const int CSSValueSliderthumbVertical = 343;
-const int CSSValueCaret = 344;
-const int CSSValueSearchfield = 345;
-const int CSSValueSearchfieldDecoration = 346;
-const int CSSValueSearchfieldResultsDecoration = 347;
-const int CSSValueSearchfieldResultsButton = 348;
-const int CSSValueSearchfieldCancelButton = 349;
-const int CSSValueTextfield = 350;
-const int CSSValueTextarea = 351;
-const int CSSValueCapsLockIndicator = 352;
-const int CSSValueRound = 353;
-const int CSSValueBorder = 354;
-const int CSSValueBorderBox = 355;
-const int CSSValueContent = 356;
-const int CSSValueContentBox = 357;
-const int CSSValuePadding = 358;
-const int CSSValuePaddingBox = 359;
-const int CSSValueLogical = 360;
-const int CSSValueVisual = 361;
-const int CSSValueLines = 362;
-const int CSSValueRunning = 363;
-const int CSSValuePaused = 364;
-const int CSSValueFlat = 365;
-const int CSSValuePreserve3d = 366;
-const int CSSValueEase = 367;
-const int CSSValueLinear = 368;
-const int CSSValueEaseIn = 369;
-const int CSSValueEaseOut = 370;
-const int CSSValueEaseInOut = 371;
-const int CSSValueDocument = 372;
-const int CSSValueReset = 373;
-const int CSSValueVisiblepainted = 374;
-const int CSSValueVisiblefill = 375;
-const int CSSValueVisiblestroke = 376;
-const int CSSValuePainted = 377;
-const int CSSValueFill = 378;
-const int CSSValueStroke = 379;
-const int CSSValueAliceblue = 380;
-const int CSSValueAntiquewhite = 381;
-const int CSSValueAquamarine = 382;
-const int CSSValueAzure = 383;
-const int CSSValueBeige = 384;
-const int CSSValueBisque = 385;
-const int CSSValueBlanchedalmond = 386;
-const int CSSValueBlueviolet = 387;
-const int CSSValueBrown = 388;
-const int CSSValueBurlywood = 389;
-const int CSSValueCadetblue = 390;
-const int CSSValueChartreuse = 391;
-const int CSSValueChocolate = 392;
-const int CSSValueCoral = 393;
-const int CSSValueCornflowerblue = 394;
-const int CSSValueCornsilk = 395;
-const int CSSValueCrimson = 396;
-const int CSSValueCyan = 397;
-const int CSSValueDarkblue = 398;
-const int CSSValueDarkcyan = 399;
-const int CSSValueDarkgoldenrod = 400;
-const int CSSValueDarkgray = 401;
-const int CSSValueDarkgreen = 402;
-const int CSSValueDarkgrey = 403;
-const int CSSValueDarkkhaki = 404;
-const int CSSValueDarkmagenta = 405;
-const int CSSValueDarkolivegreen = 406;
-const int CSSValueDarkorange = 407;
-const int CSSValueDarkorchid = 408;
-const int CSSValueDarkred = 409;
-const int CSSValueDarksalmon = 410;
-const int CSSValueDarkseagreen = 411;
-const int CSSValueDarkslateblue = 412;
-const int CSSValueDarkslategray = 413;
-const int CSSValueDarkslategrey = 414;
-const int CSSValueDarkturquoise = 415;
-const int CSSValueDarkviolet = 416;
-const int CSSValueDeeppink = 417;
-const int CSSValueDeepskyblue = 418;
-const int CSSValueDimgray = 419;
-const int CSSValueDimgrey = 420;
-const int CSSValueDodgerblue = 421;
-const int CSSValueFirebrick = 422;
-const int CSSValueFloralwhite = 423;
-const int CSSValueForestgreen = 424;
-const int CSSValueGainsboro = 425;
-const int CSSValueGhostwhite = 426;
-const int CSSValueGold = 427;
-const int CSSValueGoldenrod = 428;
-const int CSSValueGreenyellow = 429;
-const int CSSValueHoneydew = 430;
-const int CSSValueHotpink = 431;
-const int CSSValueIndianred = 432;
-const int CSSValueIndigo = 433;
-const int CSSValueIvory = 434;
-const int CSSValueKhaki = 435;
-const int CSSValueLavender = 436;
-const int CSSValueLavenderblush = 437;
-const int CSSValueLawngreen = 438;
-const int CSSValueLemonchiffon = 439;
-const int CSSValueLightblue = 440;
-const int CSSValueLightcoral = 441;
-const int CSSValueLightcyan = 442;
-const int CSSValueLightgoldenrodyellow = 443;
-const int CSSValueLightgray = 444;
-const int CSSValueLightgreen = 445;
-const int CSSValueLightgrey = 446;
-const int CSSValueLightpink = 447;
-const int CSSValueLightsalmon = 448;
-const int CSSValueLightseagreen = 449;
-const int CSSValueLightskyblue = 450;
-const int CSSValueLightslategray = 451;
-const int CSSValueLightslategrey = 452;
-const int CSSValueLightsteelblue = 453;
-const int CSSValueLightyellow = 454;
-const int CSSValueLimegreen = 455;
-const int CSSValueLinen = 456;
-const int CSSValueMagenta = 457;
-const int CSSValueMediumaquamarine = 458;
-const int CSSValueMediumblue = 459;
-const int CSSValueMediumorchid = 460;
-const int CSSValueMediumpurple = 461;
-const int CSSValueMediumseagreen = 462;
-const int CSSValueMediumslateblue = 463;
-const int CSSValueMediumspringgreen = 464;
-const int CSSValueMediumturquoise = 465;
-const int CSSValueMediumvioletred = 466;
-const int CSSValueMidnightblue = 467;
-const int CSSValueMintcream = 468;
-const int CSSValueMistyrose = 469;
-const int CSSValueMoccasin = 470;
-const int CSSValueNavajowhite = 471;
-const int CSSValueOldlace = 472;
-const int CSSValueOlivedrab = 473;
-const int CSSValueOrangered = 474;
-const int CSSValueOrchid = 475;
-const int CSSValuePalegoldenrod = 476;
-const int CSSValuePalegreen = 477;
-const int CSSValuePaleturquoise = 478;
-const int CSSValuePalevioletred = 479;
-const int CSSValuePapayawhip = 480;
-const int CSSValuePeachpuff = 481;
-const int CSSValuePeru = 482;
-const int CSSValuePink = 483;
-const int CSSValuePlum = 484;
-const int CSSValuePowderblue = 485;
-const int CSSValueRosybrown = 486;
-const int CSSValueRoyalblue = 487;
-const int CSSValueSaddlebrown = 488;
-const int CSSValueSalmon = 489;
-const int CSSValueSandybrown = 490;
-const int CSSValueSeagreen = 491;
-const int CSSValueSeashell = 492;
-const int CSSValueSienna = 493;
-const int CSSValueSkyblue = 494;
-const int CSSValueSlateblue = 495;
-const int CSSValueSlategray = 496;
-const int CSSValueSlategrey = 497;
-const int CSSValueSnow = 498;
-const int CSSValueSpringgreen = 499;
-const int CSSValueSteelblue = 500;
-const int CSSValueTan = 501;
-const int CSSValueThistle = 502;
-const int CSSValueTomato = 503;
-const int CSSValueTurquoise = 504;
-const int CSSValueViolet = 505;
-const int CSSValueWheat = 506;
-const int CSSValueWhitesmoke = 507;
-const int CSSValueYellowgreen = 508;
-const int CSSValueNonzero = 509;
-const int CSSValueEvenodd = 510;
-const int CSSValueAccumulate = 511;
-const int CSSValueNew = 512;
-const int CSSValueSrgb = 513;
-const int CSSValueLinearrgb = 514;
-const int CSSValueOptimizespeed = 515;
-const int CSSValueOptimizequality = 516;
-const int CSSValueCrispedges = 517;
-const int CSSValueGeometricprecision = 518;
-const int CSSValueButt = 519;
-const int CSSValueMiter = 520;
-const int CSSValueBevel = 521;
-const int CSSValueOptimizelegibility = 522;
-const int CSSValueBeforeEdge = 523;
-const int CSSValueAfterEdge = 524;
-const int CSSValueCentral = 525;
-const int CSSValueTextBeforeEdge = 526;
-const int CSSValueTextAfterEdge = 527;
-const int CSSValueIdeographic = 528;
-const int CSSValueAlphabetic = 529;
-const int CSSValueHanging = 530;
-const int CSSValueMathematical = 531;
-const int CSSValueUseScript = 532;
-const int CSSValueNoChange = 533;
-const int CSSValueResetSize = 534;
-const int CSSValueLrTb = 535;
-const int CSSValueRlTb = 536;
-const int CSSValueTbRl = 537;
-const int CSSValueLr = 538;
-const int CSSValueRl = 539;
-const int CSSValueTb = 540;
-const int numCSSValueKeywords = 541;
+const int CSSValueWapMarquee = 191;
+const int CSSValueAuto = 192;
+const int CSSValueCrosshair = 193;
+const int CSSValueDefault = 194;
+const int CSSValuePointer = 195;
+const int CSSValueMove = 196;
+const int CSSValueVerticalText = 197;
+const int CSSValueCell = 198;
+const int CSSValueContextMenu = 199;
+const int CSSValueAlias = 200;
+const int CSSValueProgress = 201;
+const int CSSValueNoDrop = 202;
+const int CSSValueNotAllowed = 203;
+const int CSSValueWebkitZoomIn = 204;
+const int CSSValueWebkitZoomOut = 205;
+const int CSSValueEResize = 206;
+const int CSSValueNeResize = 207;
+const int CSSValueNwResize = 208;
+const int CSSValueNResize = 209;
+const int CSSValueSeResize = 210;
+const int CSSValueSwResize = 211;
+const int CSSValueSResize = 212;
+const int CSSValueWResize = 213;
+const int CSSValueEwResize = 214;
+const int CSSValueNsResize = 215;
+const int CSSValueNeswResize = 216;
+const int CSSValueNwseResize = 217;
+const int CSSValueColResize = 218;
+const int CSSValueRowResize = 219;
+const int CSSValueText = 220;
+const int CSSValueWait = 221;
+const int CSSValueHelp = 222;
+const int CSSValueAllScroll = 223;
+const int CSSValueWebkitGrab = 224;
+const int CSSValueWebkitGrabbing = 225;
+const int CSSValueLtr = 226;
+const int CSSValueRtl = 227;
+const int CSSValueCapitalize = 228;
+const int CSSValueUppercase = 229;
+const int CSSValueLowercase = 230;
+const int CSSValueVisible = 231;
+const int CSSValueCollapse = 232;
+const int CSSValueAbove = 233;
+const int CSSValueAbsolute = 234;
+const int CSSValueAlways = 235;
+const int CSSValueAvoid = 236;
+const int CSSValueBelow = 237;
+const int CSSValueBidiOverride = 238;
+const int CSSValueBlink = 239;
+const int CSSValueBoth = 240;
+const int CSSValueCloseQuote = 241;
+const int CSSValueCrop = 242;
+const int CSSValueCross = 243;
+const int CSSValueEmbed = 244;
+const int CSSValueFixed = 245;
+const int CSSValueHand = 246;
+const int CSSValueHide = 247;
+const int CSSValueHigher = 248;
+const int CSSValueInvert = 249;
+const int CSSValueLandscape = 250;
+const int CSSValueLevel = 251;
+const int CSSValueLineThrough = 252;
+const int CSSValueLocal = 253;
+const int CSSValueLoud = 254;
+const int CSSValueLower = 255;
+const int CSSValueWebkitMarquee = 256;
+const int CSSValueMix = 257;
+const int CSSValueNoCloseQuote = 258;
+const int CSSValueNoOpenQuote = 259;
+const int CSSValueNowrap = 260;
+const int CSSValueOpenQuote = 261;
+const int CSSValueOverlay = 262;
+const int CSSValueOverline = 263;
+const int CSSValuePortrait = 264;
+const int CSSValuePre = 265;
+const int CSSValuePreLine = 266;
+const int CSSValuePreWrap = 267;
+const int CSSValueRelative = 268;
+const int CSSValueScroll = 269;
+const int CSSValueSeparate = 270;
+const int CSSValueShow = 271;
+const int CSSValueStatic = 272;
+const int CSSValueThick = 273;
+const int CSSValueThin = 274;
+const int CSSValueUnderline = 275;
+const int CSSValueWebkitNowrap = 276;
+const int CSSValueStretch = 277;
+const int CSSValueStart = 278;
+const int CSSValueEnd = 279;
+const int CSSValueReverse = 280;
+const int CSSValueHorizontal = 281;
+const int CSSValueVertical = 282;
+const int CSSValueInlineAxis = 283;
+const int CSSValueBlockAxis = 284;
+const int CSSValueSingle = 285;
+const int CSSValueMultiple = 286;
+const int CSSValueForwards = 287;
+const int CSSValueBackwards = 288;
+const int CSSValueAhead = 289;
+const int CSSValueUp = 290;
+const int CSSValueDown = 291;
+const int CSSValueSlow = 292;
+const int CSSValueFast = 293;
+const int CSSValueInfinite = 294;
+const int CSSValueSlide = 295;
+const int CSSValueAlternate = 296;
+const int CSSValueReadOnly = 297;
+const int CSSValueReadWrite = 298;
+const int CSSValueReadWritePlaintextOnly = 299;
+const int CSSValueElement = 300;
+const int CSSValueIgnore = 301;
+const int CSSValueIntrinsic = 302;
+const int CSSValueMinIntrinsic = 303;
+const int CSSValueClip = 304;
+const int CSSValueEllipsis = 305;
+const int CSSValueDiscard = 306;
+const int CSSValueDotDash = 307;
+const int CSSValueDotDotDash = 308;
+const int CSSValueWave = 309;
+const int CSSValueContinuous = 310;
+const int CSSValueSkipWhiteSpace = 311;
+const int CSSValueBreakAll = 312;
+const int CSSValueBreakWord = 313;
+const int CSSValueSpace = 314;
+const int CSSValueAfterWhiteSpace = 315;
+const int CSSValueCheckbox = 316;
+const int CSSValueRadio = 317;
+const int CSSValuePushButton = 318;
+const int CSSValueSquareButton = 319;
+const int CSSValueButton = 320;
+const int CSSValueButtonBevel = 321;
+const int CSSValueDefaultButton = 322;
+const int CSSValueListbox = 323;
+const int CSSValueListitem = 324;
+const int CSSValueMediaFullscreenButton = 325;
+const int CSSValueMediaMuteButton = 326;
+const int CSSValueMediaPlayButton = 327;
+const int CSSValueMediaSeekBackButton = 328;
+const int CSSValueMediaSeekForwardButton = 329;
+const int CSSValueMediaRewindButton = 330;
+const int CSSValueMediaReturnToRealtimeButton = 331;
+const int CSSValueMediaSlider = 332;
+const int CSSValueMediaSliderthumb = 333;
+const int CSSValueMediaVolumeSliderContainer = 334;
+const int CSSValueMediaVolumeSlider = 335;
+const int CSSValueMediaVolumeSliderthumb = 336;
+const int CSSValueMediaControlsBackground = 337;
+const int CSSValueMediaCurrentTimeDisplay = 338;
+const int CSSValueMediaTimeRemainingDisplay = 339;
+const int CSSValueMenulist = 340;
+const int CSSValueMenulistButton = 341;
+const int CSSValueMenulistText = 342;
+const int CSSValueMenulistTextfield = 343;
+const int CSSValueSliderHorizontal = 344;
+const int CSSValueSliderVertical = 345;
+const int CSSValueSliderthumbHorizontal = 346;
+const int CSSValueSliderthumbVertical = 347;
+const int CSSValueCaret = 348;
+const int CSSValueSearchfield = 349;
+const int CSSValueSearchfieldDecoration = 350;
+const int CSSValueSearchfieldResultsDecoration = 351;
+const int CSSValueSearchfieldResultsButton = 352;
+const int CSSValueSearchfieldCancelButton = 353;
+const int CSSValueTextfield = 354;
+const int CSSValueTextarea = 355;
+const int CSSValueCapsLockIndicator = 356;
+const int CSSValueRound = 357;
+const int CSSValueBorder = 358;
+const int CSSValueBorderBox = 359;
+const int CSSValueContent = 360;
+const int CSSValueContentBox = 361;
+const int CSSValuePadding = 362;
+const int CSSValuePaddingBox = 363;
+const int CSSValueContain = 364;
+const int CSSValueCover = 365;
+const int CSSValueLogical = 366;
+const int CSSValueVisual = 367;
+const int CSSValueLines = 368;
+const int CSSValueRunning = 369;
+const int CSSValuePaused = 370;
+const int CSSValueFlat = 371;
+const int CSSValuePreserve3d = 372;
+const int CSSValueEase = 373;
+const int CSSValueLinear = 374;
+const int CSSValueEaseIn = 375;
+const int CSSValueEaseOut = 376;
+const int CSSValueEaseInOut = 377;
+const int CSSValueDocument = 378;
+const int CSSValueReset = 379;
+const int CSSValueVisiblepainted = 380;
+const int CSSValueVisiblefill = 381;
+const int CSSValueVisiblestroke = 382;
+const int CSSValuePainted = 383;
+const int CSSValueFill = 384;
+const int CSSValueStroke = 385;
+const int CSSValueAntialiased = 386;
+const int CSSValueSubpixelAntialiased = 387;
+const int CSSValueAliceblue = 388;
+const int CSSValueAntiquewhite = 389;
+const int CSSValueAquamarine = 390;
+const int CSSValueAzure = 391;
+const int CSSValueBeige = 392;
+const int CSSValueBisque = 393;
+const int CSSValueBlanchedalmond = 394;
+const int CSSValueBlueviolet = 395;
+const int CSSValueBrown = 396;
+const int CSSValueBurlywood = 397;
+const int CSSValueCadetblue = 398;
+const int CSSValueChartreuse = 399;
+const int CSSValueChocolate = 400;
+const int CSSValueCoral = 401;
+const int CSSValueCornflowerblue = 402;
+const int CSSValueCornsilk = 403;
+const int CSSValueCrimson = 404;
+const int CSSValueCyan = 405;
+const int CSSValueDarkblue = 406;
+const int CSSValueDarkcyan = 407;
+const int CSSValueDarkgoldenrod = 408;
+const int CSSValueDarkgray = 409;
+const int CSSValueDarkgreen = 410;
+const int CSSValueDarkgrey = 411;
+const int CSSValueDarkkhaki = 412;
+const int CSSValueDarkmagenta = 413;
+const int CSSValueDarkolivegreen = 414;
+const int CSSValueDarkorange = 415;
+const int CSSValueDarkorchid = 416;
+const int CSSValueDarkred = 417;
+const int CSSValueDarksalmon = 418;
+const int CSSValueDarkseagreen = 419;
+const int CSSValueDarkslateblue = 420;
+const int CSSValueDarkslategray = 421;
+const int CSSValueDarkslategrey = 422;
+const int CSSValueDarkturquoise = 423;
+const int CSSValueDarkviolet = 424;
+const int CSSValueDeeppink = 425;
+const int CSSValueDeepskyblue = 426;
+const int CSSValueDimgray = 427;
+const int CSSValueDimgrey = 428;
+const int CSSValueDodgerblue = 429;
+const int CSSValueFirebrick = 430;
+const int CSSValueFloralwhite = 431;
+const int CSSValueForestgreen = 432;
+const int CSSValueGainsboro = 433;
+const int CSSValueGhostwhite = 434;
+const int CSSValueGold = 435;
+const int CSSValueGoldenrod = 436;
+const int CSSValueGreenyellow = 437;
+const int CSSValueHoneydew = 438;
+const int CSSValueHotpink = 439;
+const int CSSValueIndianred = 440;
+const int CSSValueIndigo = 441;
+const int CSSValueIvory = 442;
+const int CSSValueKhaki = 443;
+const int CSSValueLavender = 444;
+const int CSSValueLavenderblush = 445;
+const int CSSValueLawngreen = 446;
+const int CSSValueLemonchiffon = 447;
+const int CSSValueLightblue = 448;
+const int CSSValueLightcoral = 449;
+const int CSSValueLightcyan = 450;
+const int CSSValueLightgoldenrodyellow = 451;
+const int CSSValueLightgray = 452;
+const int CSSValueLightgreen = 453;
+const int CSSValueLightgrey = 454;
+const int CSSValueLightpink = 455;
+const int CSSValueLightsalmon = 456;
+const int CSSValueLightseagreen = 457;
+const int CSSValueLightskyblue = 458;
+const int CSSValueLightslategray = 459;
+const int CSSValueLightslategrey = 460;
+const int CSSValueLightsteelblue = 461;
+const int CSSValueLightyellow = 462;
+const int CSSValueLimegreen = 463;
+const int CSSValueLinen = 464;
+const int CSSValueMagenta = 465;
+const int CSSValueMediumaquamarine = 466;
+const int CSSValueMediumblue = 467;
+const int CSSValueMediumorchid = 468;
+const int CSSValueMediumpurple = 469;
+const int CSSValueMediumseagreen = 470;
+const int CSSValueMediumslateblue = 471;
+const int CSSValueMediumspringgreen = 472;
+const int CSSValueMediumturquoise = 473;
+const int CSSValueMediumvioletred = 474;
+const int CSSValueMidnightblue = 475;
+const int CSSValueMintcream = 476;
+const int CSSValueMistyrose = 477;
+const int CSSValueMoccasin = 478;
+const int CSSValueNavajowhite = 479;
+const int CSSValueOldlace = 480;
+const int CSSValueOlivedrab = 481;
+const int CSSValueOrangered = 482;
+const int CSSValueOrchid = 483;
+const int CSSValuePalegoldenrod = 484;
+const int CSSValuePalegreen = 485;
+const int CSSValuePaleturquoise = 486;
+const int CSSValuePalevioletred = 487;
+const int CSSValuePapayawhip = 488;
+const int CSSValuePeachpuff = 489;
+const int CSSValuePeru = 490;
+const int CSSValuePink = 491;
+const int CSSValuePlum = 492;
+const int CSSValuePowderblue = 493;
+const int CSSValueRosybrown = 494;
+const int CSSValueRoyalblue = 495;
+const int CSSValueSaddlebrown = 496;
+const int CSSValueSalmon = 497;
+const int CSSValueSandybrown = 498;
+const int CSSValueSeagreen = 499;
+const int CSSValueSeashell = 500;
+const int CSSValueSienna = 501;
+const int CSSValueSkyblue = 502;
+const int CSSValueSlateblue = 503;
+const int CSSValueSlategray = 504;
+const int CSSValueSlategrey = 505;
+const int CSSValueSnow = 506;
+const int CSSValueSpringgreen = 507;
+const int CSSValueSteelblue = 508;
+const int CSSValueTan = 509;
+const int CSSValueThistle = 510;
+const int CSSValueTomato = 511;
+const int CSSValueTurquoise = 512;
+const int CSSValueViolet = 513;
+const int CSSValueWheat = 514;
+const int CSSValueWhitesmoke = 515;
+const int CSSValueYellowgreen = 516;
+const int CSSValueNonzero = 517;
+const int CSSValueEvenodd = 518;
+const int CSSValueAccumulate = 519;
+const int CSSValueNew = 520;
+const int CSSValueSrgb = 521;
+const int CSSValueLinearrgb = 522;
+const int CSSValueOptimizespeed = 523;
+const int CSSValueOptimizequality = 524;
+const int CSSValueCrispedges = 525;
+const int CSSValueGeometricprecision = 526;
+const int CSSValueButt = 527;
+const int CSSValueMiter = 528;
+const int CSSValueBevel = 529;
+const int CSSValueOptimizelegibility = 530;
+const int CSSValueBeforeEdge = 531;
+const int CSSValueAfterEdge = 532;
+const int CSSValueCentral = 533;
+const int CSSValueTextBeforeEdge = 534;
+const int CSSValueTextAfterEdge = 535;
+const int CSSValueIdeographic = 536;
+const int CSSValueAlphabetic = 537;
+const int CSSValueHanging = 538;
+const int CSSValueMathematical = 539;
+const int CSSValueUseScript = 540;
+const int CSSValueNoChange = 541;
+const int CSSValueResetSize = 542;
+const int CSSValueLrTb = 543;
+const int CSSValueRlTb = 544;
+const int CSSValueTbRl = 545;
+const int CSSValueLr = 546;
+const int CSSValueRl = 547;
+const int CSSValueTb = 548;
+const int numCSSValueKeywords = 549;
 const size_t maxCSSValueKeywordLength = 31;
 
 const char* getValueName(unsigned short id);
diff --git a/src/3rdparty/webkit/WebCore/generated/ColorData.c b/src/3rdparty/webkit/WebCore/generated/ColorData.c
index 478566c..5d64dda 100644
--- a/src/3rdparty/webkit/WebCore/generated/ColorData.c
+++ b/src/3rdparty/webkit/WebCore/generated/ColorData.c
@@ -1,6 +1,5 @@
-#include <string.h>// bogus
 /* ANSI-C code produced by gperf version 3.0.3 */
-/* Command-line: gperf -CDEot -L ANSI-C --key-positions='*' -N findColor -D -s 2  */
+/* Command-line: gperf -CDEot -L ANSI-C --includes --key-positions='*' -N findColor -D -s 2  */
 
 #if !((' ' == 32) && ('!' == 33) && ('"' == 34) && ('#' == 35) \
       && ('%' == 37) && ('&' == 38) && ('\'' == 39) && ('(' == 40) \
@@ -30,6 +29,7 @@
 #endif
 
 struct NamedColor { const char *name; int RGBValue; };
+#include <string.h>
 /* maximum key range = 1053, duplicates = 0 */
 
 #ifdef __GNUC__
diff --git a/src/3rdparty/webkit/WebCore/generated/DocTypeStrings.cpp b/src/3rdparty/webkit/WebCore/generated/DocTypeStrings.cpp
index 686629c..d69b1b6 100644
--- a/src/3rdparty/webkit/WebCore/generated/DocTypeStrings.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/DocTypeStrings.cpp
@@ -1,6 +1,5 @@
-#include <string.h>// bogus
 /* ANSI-C code produced by gperf version 3.0.3 */
-/* Command-line: gperf -CEot -L ANSI-C --key-positions='*' -N findDoctypeEntry -F ,PubIDInfo::eAlmostStandards,PubIDInfo::eAlmostStandards  */
+/* Command-line: gperf -CEot -L ANSI-C --includes --key-positions='*' -N findDoctypeEntry -F ,PubIDInfo::eAlmostStandards,PubIDInfo::eAlmostStandards  */
 
 #if !((' ' == 32) && ('!' == 33) && ('"' == 34) && ('#' == 35) \
       && ('%' == 37) && ('&' == 38) && ('\'' == 39) && ('(' == 40) \
@@ -40,6 +39,7 @@ struct PubIDInfo {
     eMode mode_if_no_sysid;
     eMode mode_if_sysid;
 };
+#include <string.h>
 /* maximum key range = 712, duplicates = 0 */
 
 #ifdef __GNUC__
diff --git a/src/3rdparty/webkit/WebCore/generated/Grammar.cpp b/src/3rdparty/webkit/WebCore/generated/Grammar.cpp
index 76f90d7..973f104 100644
--- a/src/3rdparty/webkit/WebCore/generated/Grammar.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/Grammar.cpp
@@ -1,23 +1,24 @@
-
-/* A Bison parser, made by GNU Bison 2.4.1.  */
+/* A Bison parser, made by GNU Bison 2.3.  */
 
 /* Skeleton implementation for Bison's Yacc-like parsers in C
-   
-      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
+
+   Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
    Free Software Foundation, Inc.
-   
-   This program is free software: you can redistribute it and/or modify
+
+   This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation, either version 3 of the License, or
-   (at your option) any later version.
-   
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
-   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin Street, Fifth Floor,
+   Boston, MA 02110-1301, USA.  */
 
 /* As a special exception, you may create a larger work that contains
    part or all of the Bison parser skeleton and distribute that work
@@ -28,7 +29,7 @@
    special exception, which will cause the skeleton and the resulting
    Bison output files to be licensed under the GNU General Public
    License without this special exception.
-   
+
    This special exception was added by the Free Software Foundation in
    version 2.2 of Bison.  */
 
@@ -46,7 +47,7 @@
 #define YYBISON 1
 
 /* Bison version.  */
-#define YYBISON_VERSION "2.4.1"
+#define YYBISON_VERSION "2.3"
 
 /* Skeleton name.  */
 #define YYSKELETON_NAME "yacc.c"
@@ -54,28 +55,159 @@
 /* Pure parsers.  */
 #define YYPURE 1
 
-/* Push parsers.  */
-#define YYPUSH 0
-
-/* Pull parsers.  */
-#define YYPULL 1
-
 /* Using locations.  */
 #define YYLSP_NEEDED 1
 
 /* Substitute the variable and function names.  */
-#define yyparse         jscyyparse
-#define yylex           jscyylex
-#define yyerror         jscyyerror
-#define yylval          jscyylval
-#define yychar          jscyychar
-#define yydebug         jscyydebug
-#define yynerrs         jscyynerrs
-#define yylloc          jscyylloc
+#define yyparse jscyyparse
+#define yylex   jscyylex
+#define yyerror jscyyerror
+#define yylval  jscyylval
+#define yychar  jscyychar
+#define yydebug jscyydebug
+#define yynerrs jscyynerrs
+#define yylloc jscyylloc
+
+/* Tokens.  */
+#ifndef YYTOKENTYPE
+# define YYTOKENTYPE
+   /* Put the tokens into the symbol table, so that GDB and other debuggers
+      know about them.  */
+   enum yytokentype {
+     NULLTOKEN = 258,
+     TRUETOKEN = 259,
+     FALSETOKEN = 260,
+     BREAK = 261,
+     CASE = 262,
+     DEFAULT = 263,
+     FOR = 264,
+     NEW = 265,
+     VAR = 266,
+     CONSTTOKEN = 267,
+     CONTINUE = 268,
+     FUNCTION = 269,
+     RETURN = 270,
+     VOIDTOKEN = 271,
+     DELETETOKEN = 272,
+     IF = 273,
+     THISTOKEN = 274,
+     DO = 275,
+     WHILE = 276,
+     INTOKEN = 277,
+     INSTANCEOF = 278,
+     TYPEOF = 279,
+     SWITCH = 280,
+     WITH = 281,
+     RESERVED = 282,
+     THROW = 283,
+     TRY = 284,
+     CATCH = 285,
+     FINALLY = 286,
+     DEBUGGER = 287,
+     IF_WITHOUT_ELSE = 288,
+     ELSE = 289,
+     EQEQ = 290,
+     NE = 291,
+     STREQ = 292,
+     STRNEQ = 293,
+     LE = 294,
+     GE = 295,
+     OR = 296,
+     AND = 297,
+     PLUSPLUS = 298,
+     MINUSMINUS = 299,
+     LSHIFT = 300,
+     RSHIFT = 301,
+     URSHIFT = 302,
+     PLUSEQUAL = 303,
+     MINUSEQUAL = 304,
+     MULTEQUAL = 305,
+     DIVEQUAL = 306,
+     LSHIFTEQUAL = 307,
+     RSHIFTEQUAL = 308,
+     URSHIFTEQUAL = 309,
+     ANDEQUAL = 310,
+     MODEQUAL = 311,
+     XOREQUAL = 312,
+     OREQUAL = 313,
+     OPENBRACE = 314,
+     CLOSEBRACE = 315,
+     NUMBER = 316,
+     IDENT = 317,
+     STRING = 318,
+     AUTOPLUSPLUS = 319,
+     AUTOMINUSMINUS = 320
+   };
+#endif
+/* Tokens.  */
+#define NULLTOKEN 258
+#define TRUETOKEN 259
+#define FALSETOKEN 260
+#define BREAK 261
+#define CASE 262
+#define DEFAULT 263
+#define FOR 264
+#define NEW 265
+#define VAR 266
+#define CONSTTOKEN 267
+#define CONTINUE 268
+#define FUNCTION 269
+#define RETURN 270
+#define VOIDTOKEN 271
+#define DELETETOKEN 272
+#define IF 273
+#define THISTOKEN 274
+#define DO 275
+#define WHILE 276
+#define INTOKEN 277
+#define INSTANCEOF 278
+#define TYPEOF 279
+#define SWITCH 280
+#define WITH 281
+#define RESERVED 282
+#define THROW 283
+#define TRY 284
+#define CATCH 285
+#define FINALLY 286
+#define DEBUGGER 287
+#define IF_WITHOUT_ELSE 288
+#define ELSE 289
+#define EQEQ 290
+#define NE 291
+#define STREQ 292
+#define STRNEQ 293
+#define LE 294
+#define GE 295
+#define OR 296
+#define AND 297
+#define PLUSPLUS 298
+#define MINUSMINUS 299
+#define LSHIFT 300
+#define RSHIFT 301
+#define URSHIFT 302
+#define PLUSEQUAL 303
+#define MINUSEQUAL 304
+#define MULTEQUAL 305
+#define DIVEQUAL 306
+#define LSHIFTEQUAL 307
+#define RSHIFTEQUAL 308
+#define URSHIFTEQUAL 309
+#define ANDEQUAL 310
+#define MODEQUAL 311
+#define XOREQUAL 312
+#define OREQUAL 313
+#define OPENBRACE 314
+#define CLOSEBRACE 315
+#define NUMBER 316
+#define IDENT 317
+#define STRING 318
+#define AUTOPLUSPLUS 319
+#define AUTOMINUSMINUS 320
 
-/* Copy the first part of user declarations.  */
 
-/* Line 189 of yacc.c  */
+
+
+/* Copy the first part of user declarations.  */
 #line 3 "../../JavaScriptCore/parser/Grammar.y"
 
 
@@ -102,18 +234,12 @@
 
 #include "config.h"
 
-#include <string.h>
-#include <stdlib.h>
-#include "JSValue.h"
 #include "JSObject.h"
-#include "NodeConstructors.h"
-#include "Lexer.h"
 #include "JSString.h"
-#include "JSGlobalData.h"
-#include "CommonIdentifiers.h"
+#include "NodeConstructors.h"
 #include "NodeInfo.h"
-#include "Parser.h"
-#include <wtf/FastMalloc.h>
+#include <stdlib.h>
+#include <string.h>
 #include <wtf/MathExtras.h>
 
 #define YYMALLOC fastMalloc
@@ -122,46 +248,44 @@
 #define YYMAXDEPTH 10000
 #define YYENABLE_NLS 0
 
-/* default values for bison */
+// Default values for bison.
 #define YYDEBUG 0 // Set to 1 to debug a parse error.
 #define jscyydebug 0 // Set to 1 to debug a parse error.
 #if !PLATFORM(DARWIN)
-    // avoid triggering warnings in older bison
+// Avoid triggering warnings in older bison by not setting this on the Darwin platform.
+// FIXME: Is this still needed?
 #define YYERROR_VERBOSE
 #endif
 
 int jscyylex(void* lvalp, void* llocp, void* globalPtr);
 int jscyyerror(const char*);
+
 static inline bool allowAutomaticSemicolon(JSC::Lexer&, int);
 
 #define GLOBAL_DATA static_cast<JSGlobalData*>(globalPtr)
-#define LEXER (GLOBAL_DATA->lexer)
-
-#define AUTO_SEMICOLON do { if (!allowAutomaticSemicolon(*LEXER, yychar)) YYABORT; } while (0)
-#define SET_EXCEPTION_LOCATION(node, start, divot, end) node->setExceptionSourceCode((divot), (divot) - (start), (end) - (divot))
-#define DBG(l, s, e) (l)->setLoc((s).first_line, (e).last_line, (s).first_column + 1)
+#define AUTO_SEMICOLON do { if (!allowAutomaticSemicolon(*GLOBAL_DATA->lexer, yychar)) YYABORT; } while (0)
 
 using namespace JSC;
 using namespace std;
 
-static ExpressionNode* makeAssignNode(void*, ExpressionNode* loc, Operator, ExpressionNode* expr, bool locHasAssignments, bool exprHasAssignments, int start, int divot, int end);
-static ExpressionNode* makePrefixNode(void*, ExpressionNode* expr, Operator, int start, int divot, int end);
-static ExpressionNode* makePostfixNode(void*, ExpressionNode* expr, Operator, int start, int divot, int end);
-static PropertyNode* makeGetterOrSetterPropertyNode(void*, const Identifier &getOrSet, const Identifier& name, ParameterNode*, FunctionBodyNode*, const SourceCode&);
-static ExpressionNodeInfo makeFunctionCallNode(void*, ExpressionNodeInfo func, ArgumentsNodeInfo, int start, int divot, int end);
-static ExpressionNode* makeTypeOfNode(void*, ExpressionNode*);
-static ExpressionNode* makeDeleteNode(void*, ExpressionNode*, int start, int divot, int end);
-static ExpressionNode* makeNegateNode(void*, ExpressionNode*);
-static NumberNode* makeNumberNode(void*, double);
-static ExpressionNode* makeBitwiseNotNode(void*, ExpressionNode*);
-static ExpressionNode* makeMultNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
-static ExpressionNode* makeDivNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
-static ExpressionNode* makeAddNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
-static ExpressionNode* makeSubNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
-static ExpressionNode* makeLeftShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
-static ExpressionNode* makeRightShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
-static StatementNode* makeVarStatementNode(void*, ExpressionNode*);
-static ExpressionNode* combineCommaNodes(void*, ExpressionNode* list, ExpressionNode* init);
+static ExpressionNode* makeAssignNode(JSGlobalData*, ExpressionNode* left, Operator, ExpressionNode* right, bool leftHasAssignments, bool rightHasAssignments, int start, int divot, int end);
+static ExpressionNode* makePrefixNode(JSGlobalData*, ExpressionNode*, Operator, int start, int divot, int end);
+static ExpressionNode* makePostfixNode(JSGlobalData*, ExpressionNode*, Operator, int start, int divot, int end);
+static PropertyNode* makeGetterOrSetterPropertyNode(JSGlobalData*, const Identifier& getOrSet, const Identifier& name, ParameterNode*, FunctionBodyNode*, const SourceCode&);
+static ExpressionNodeInfo makeFunctionCallNode(JSGlobalData*, ExpressionNodeInfo function, ArgumentsNodeInfo, int start, int divot, int end);
+static ExpressionNode* makeTypeOfNode(JSGlobalData*, ExpressionNode*);
+static ExpressionNode* makeDeleteNode(JSGlobalData*, ExpressionNode*, int start, int divot, int end);
+static ExpressionNode* makeNegateNode(JSGlobalData*, ExpressionNode*);
+static NumberNode* makeNumberNode(JSGlobalData*, double);
+static ExpressionNode* makeBitwiseNotNode(JSGlobalData*, ExpressionNode*);
+static ExpressionNode* makeMultNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+static ExpressionNode* makeDivNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+static ExpressionNode* makeAddNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+static ExpressionNode* makeSubNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+static ExpressionNode* makeLeftShiftNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+static ExpressionNode* makeRightShiftNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+static StatementNode* makeVarStatementNode(JSGlobalData*, ExpressionNode*);
+static ExpressionNode* combineCommaNodes(JSGlobalData*, ExpressionNode* list, ExpressionNode* init);
 
 #if COMPILER(MSVC)
 
@@ -174,17 +298,17 @@ static ExpressionNode* combineCommaNodes(void*, ExpressionNode* list, Expression
 #define YYPARSE_PARAM globalPtr
 #define YYLEX_PARAM globalPtr
 
-template <typename T> NodeDeclarationInfo<T> createNodeDeclarationInfo(T node, ParserArenaData<DeclarationStacks::VarStack>* varDecls, 
-                                                                       ParserArenaData<DeclarationStacks::FunctionStack>* funcDecls,
-                                                                       CodeFeatures info,
-                                                                       int numConstants) 
+template <typename T> inline NodeDeclarationInfo<T> createNodeDeclarationInfo(T node,
+    ParserArenaData<DeclarationStacks::VarStack>* varDecls,
+    ParserArenaData<DeclarationStacks::FunctionStack>* funcDecls,
+    CodeFeatures info, int numConstants) 
 {
     ASSERT((info & ~AllFeatures) == 0);
     NodeDeclarationInfo<T> result = { node, varDecls, funcDecls, info, numConstants };
     return result;
 }
 
-template <typename T> NodeInfo<T> createNodeInfo(T node, CodeFeatures info, int numConstants)
+template <typename T> inline NodeInfo<T> createNodeInfo(T node, CodeFeatures info, int numConstants)
 {
     ASSERT((info & ~AllFeatures) == 0);
     NodeInfo<T> result = { node, info, numConstants };
@@ -210,28 +334,24 @@ template <typename T> inline T mergeDeclarationLists(T decls1, T decls2)
     return decls1;
 }
 
-static void appendToVarDeclarationList(void* globalPtr, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, const Identifier& ident, unsigned attrs)
+static inline void appendToVarDeclarationList(JSGlobalData* globalData, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, const Identifier& ident, unsigned attrs)
 {
     if (!varDecls)
-        varDecls = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
-
-    varDecls->data.append(make_pair(ident, attrs));
+        varDecls = new (globalData) ParserArenaData<DeclarationStacks::VarStack>;
 
+    varDecls->data.append(make_pair(&ident, attrs));
 }
 
-static inline void appendToVarDeclarationList(void* globalPtr, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, ConstDeclNode* decl)
+static inline void appendToVarDeclarationList(JSGlobalData* globalData, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, ConstDeclNode* decl)
 {
     unsigned attrs = DeclarationStacks::IsConstant;
     if (decl->hasInitializer())
         attrs |= DeclarationStacks::HasInitializer;        
-    appendToVarDeclarationList(globalPtr, varDecls, decl->ident(), attrs);
+    appendToVarDeclarationList(globalData, varDecls, decl->ident(), attrs);
 }
 
 
 
-/* Line 189 of yacc.c  */
-#line 234 "WebCore/tmp/../generated/Grammar.tab.c"
-
 /* Enabling traces.  */
 #ifndef YYDEBUG
 # define YYDEBUG 0
@@ -250,91 +370,13 @@ static inline void appendToVarDeclarationList(void* globalPtr, ParserArenaData<D
 # define YYTOKEN_TABLE 0
 #endif
 
-
-/* Tokens.  */
-#ifndef YYTOKENTYPE
-# define YYTOKENTYPE
-   /* Put the tokens into the symbol table, so that GDB and other debuggers
-      know about them.  */
-   enum yytokentype {
-     NULLTOKEN = 258,
-     TRUETOKEN = 259,
-     FALSETOKEN = 260,
-     BREAK = 261,
-     CASE = 262,
-     DEFAULT = 263,
-     FOR = 264,
-     NEW = 265,
-     VAR = 266,
-     CONSTTOKEN = 267,
-     CONTINUE = 268,
-     FUNCTION = 269,
-     RETURN = 270,
-     VOIDTOKEN = 271,
-     DELETETOKEN = 272,
-     IF = 273,
-     THISTOKEN = 274,
-     DO = 275,
-     WHILE = 276,
-     INTOKEN = 277,
-     INSTANCEOF = 278,
-     TYPEOF = 279,
-     SWITCH = 280,
-     WITH = 281,
-     RESERVED = 282,
-     THROW = 283,
-     TRY = 284,
-     CATCH = 285,
-     FINALLY = 286,
-     DEBUGGER = 287,
-     IF_WITHOUT_ELSE = 288,
-     ELSE = 289,
-     EQEQ = 290,
-     NE = 291,
-     STREQ = 292,
-     STRNEQ = 293,
-     LE = 294,
-     GE = 295,
-     OR = 296,
-     AND = 297,
-     PLUSPLUS = 298,
-     MINUSMINUS = 299,
-     LSHIFT = 300,
-     RSHIFT = 301,
-     URSHIFT = 302,
-     PLUSEQUAL = 303,
-     MINUSEQUAL = 304,
-     MULTEQUAL = 305,
-     DIVEQUAL = 306,
-     LSHIFTEQUAL = 307,
-     RSHIFTEQUAL = 308,
-     URSHIFTEQUAL = 309,
-     ANDEQUAL = 310,
-     MODEQUAL = 311,
-     XOREQUAL = 312,
-     OREQUAL = 313,
-     OPENBRACE = 314,
-     CLOSEBRACE = 315,
-     NUMBER = 316,
-     IDENT = 317,
-     STRING = 318,
-     AUTOPLUSPLUS = 319,
-     AUTOMINUSMINUS = 320
-   };
-#endif
-
-
-
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
+#line 146 "../../JavaScriptCore/parser/Grammar.y"
 {
-
-/* Line 214 of yacc.c  */
-#line 155 "../../JavaScriptCore/parser/Grammar.y"
-
     int                 intValue;
     double              doubleValue;
-    Identifier*         ident;
+    const Identifier*   ident;
 
     // expression subtrees
     ExpressionNodeInfo  expressionNode;
@@ -361,15 +403,13 @@ typedef union YYSTYPE
     ParameterListInfo   parameterList;
 
     Operator            op;
-
-
-
-/* Line 214 of yacc.c  */
-#line 369 "WebCore/tmp/../generated/Grammar.tab.c"
-} YYSTYPE;
-# define YYSTYPE_IS_TRIVIAL 1
+}
+/* Line 187 of yacc.c.  */
+#line 409 "WebCore/tmp/../generated/Grammar.tab.c"
+	YYSTYPE;
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
+# define YYSTYPE_IS_TRIVIAL 1
 #endif
 
 #if ! defined YYLTYPE && ! defined YYLTYPE_IS_DECLARED
@@ -387,10 +427,23 @@ typedef struct YYLTYPE
 
 
 /* Copy the second part of user declarations.  */
+#line 178 "../../JavaScriptCore/parser/Grammar.y"
+
 
+template <typename T> inline void setStatementLocation(StatementNode* statement, const T& start, const T& end)
+{
+    statement->setLoc(start.first_line, end.last_line);
+}
+
+static inline void setExceptionLocation(ThrowableExpressionData* node, unsigned start, unsigned divot, unsigned end)
+{
+    node->setExceptionSourceCode(divot, divot - start, end - divot);
+}
 
-/* Line 264 of yacc.c  */
-#line 394 "WebCore/tmp/../generated/Grammar.tab.c"
+
+
+/* Line 216 of yacc.c.  */
+#line 447 "WebCore/tmp/../generated/Grammar.tab.c"
 
 #ifdef short
 # undef short
@@ -465,14 +518,14 @@ typedef short int yytype_int16;
 #if (defined __STDC__ || defined __C99__FUNC__ \
      || defined __cplusplus || defined _MSC_VER)
 static int
-YYID (int yyi)
+YYID (int i)
 #else
 static int
-YYID (yyi)
-    int yyi;
+YYID (i)
+    int i;
 #endif
 {
-  return yyi;
+  return i;
 }
 #endif
 
@@ -554,9 +607,9 @@ void free (void *); /* INFRINGES ON USER NAME SPACE */
 /* A type that is properly aligned for any stack member.  */
 union yyalloc
 {
-  yytype_int16 yyss_alloc;
-  YYSTYPE yyvs_alloc;
-  YYLTYPE yyls_alloc;
+  yytype_int16 yyss;
+  YYSTYPE yyvs;
+    YYLTYPE yyls;
 };
 
 /* The size of the maximum gap between one aligned stack and the next.  */
@@ -591,12 +644,12 @@ union yyalloc
    elements in the stack, and YYPTR gives the new location of the
    stack.  Advance YYPTR to a properly aligned location for the next
    stack.  */
-# define YYSTACK_RELOCATE(Stack_alloc, Stack)				\
+# define YYSTACK_RELOCATE(Stack)					\
     do									\
       {									\
 	YYSIZE_T yynewbytes;						\
-	YYCOPY (&yyptr->Stack_alloc, Stack, yysize);			\
-	Stack = &yyptr->Stack_alloc;					\
+	YYCOPY (&yyptr->Stack, Stack, yysize);				\
+	Stack = &yyptr->Stack;						\
 	yynewbytes = yystacksize * sizeof (*Stack) + YYSTACK_GAP_MAXIMUM; \
 	yyptr += yynewbytes / sizeof (*yyptr);				\
       }									\
@@ -944,66 +997,66 @@ static const yytype_int16 yyrhs[] =
 /* YYRLINE[YYN] -- source line where rule number YYN was defined.  */
 static const yytype_uint16 yyrline[] =
 {
-       0,   288,   288,   289,   290,   291,   292,   293,   302,   314,
-     315,   316,   317,   318,   330,   334,   341,   342,   343,   345,
-     349,   350,   351,   352,   353,   357,   358,   359,   363,   367,
-     375,   376,   380,   381,   385,   386,   387,   391,   395,   402,
-     403,   407,   411,   418,   419,   426,   427,   434,   435,   436,
-     440,   446,   447,   448,   452,   459,   460,   464,   468,   475,
-     476,   480,   481,   485,   486,   487,   491,   492,   493,   497,
-     498,   499,   500,   501,   502,   503,   504,   505,   506,   507,
-     510,   511,   515,   516,   520,   521,   522,   523,   527,   528,
-     530,   532,   537,   538,   539,   543,   544,   546,   551,   552,
-     553,   554,   558,   559,   560,   561,   565,   566,   567,   568,
-     569,   570,   573,   579,   580,   581,   582,   583,   584,   591,
-     592,   593,   594,   595,   596,   600,   607,   608,   609,   610,
-     611,   615,   616,   618,   620,   622,   627,   628,   630,   631,
-     633,   638,   639,   643,   644,   649,   650,   654,   655,   659,
-     660,   665,   666,   671,   672,   676,   677,   682,   683,   688,
-     689,   693,   694,   699,   700,   705,   706,   710,   711,   716,
-     717,   721,   722,   727,   728,   733,   734,   739,   740,   747,
-     748,   755,   756,   763,   764,   765,   766,   767,   768,   769,
-     770,   771,   772,   773,   774,   778,   779,   783,   784,   788,
-     789,   793,   794,   795,   796,   797,   798,   799,   800,   801,
-     802,   803,   804,   805,   806,   807,   808,   809,   813,   815,
-     820,   822,   828,   835,   844,   852,   865,   872,   881,   889,
-     902,   904,   910,   918,   930,   931,   935,   939,   943,   947,
-     949,   954,   957,   967,   969,   971,   973,   979,   986,   995,
-    1001,  1012,  1013,  1017,  1018,  1022,  1026,  1030,  1034,  1041,
-    1044,  1047,  1050,  1056,  1059,  1062,  1065,  1071,  1077,  1083,
-    1084,  1093,  1094,  1098,  1104,  1114,  1115,  1119,  1120,  1124,
-    1130,  1134,  1141,  1147,  1153,  1163,  1165,  1170,  1171,  1182,
-    1183,  1190,  1191,  1201,  1204,  1210,  1211,  1215,  1216,  1221,
-    1228,  1239,  1240,  1241,  1242,  1243,  1244,  1245,  1249,  1250,
-    1251,  1252,  1253,  1257,  1258,  1262,  1263,  1264,  1266,  1270,
-    1271,  1272,  1273,  1274,  1278,  1279,  1280,  1284,  1285,  1288,
-    1290,  1294,  1295,  1299,  1300,  1301,  1302,  1303,  1307,  1308,
-    1309,  1310,  1314,  1315,  1319,  1320,  1324,  1325,  1326,  1327,
-    1331,  1332,  1333,  1334,  1338,  1339,  1343,  1344,  1348,  1349,
-    1353,  1354,  1358,  1359,  1360,  1364,  1365,  1366,  1370,  1371,
-    1372,  1373,  1374,  1375,  1376,  1377,  1378,  1379,  1380,  1383,
-    1384,  1388,  1389,  1393,  1394,  1395,  1396,  1400,  1401,  1402,
-    1403,  1407,  1408,  1409,  1413,  1414,  1415,  1419,  1420,  1421,
-    1422,  1426,  1427,  1428,  1429,  1433,  1434,  1435,  1436,  1437,
-    1438,  1439,  1443,  1444,  1445,  1446,  1447,  1448,  1452,  1453,
-    1454,  1455,  1456,  1457,  1458,  1462,  1463,  1464,  1465,  1466,
-    1470,  1471,  1472,  1473,  1474,  1478,  1479,  1480,  1481,  1482,
-    1486,  1487,  1491,  1492,  1496,  1497,  1501,  1502,  1506,  1507,
-    1511,  1512,  1516,  1517,  1521,  1522,  1526,  1527,  1531,  1532,
-    1536,  1537,  1541,  1542,  1546,  1547,  1551,  1552,  1556,  1557,
-    1561,  1562,  1566,  1567,  1571,  1572,  1576,  1577,  1581,  1582,
-    1586,  1587,  1591,  1592,  1593,  1594,  1595,  1596,  1597,  1598,
-    1599,  1600,  1601,  1602,  1606,  1607,  1611,  1612,  1616,  1617,
-    1621,  1622,  1623,  1624,  1625,  1626,  1627,  1628,  1629,  1630,
-    1631,  1632,  1633,  1634,  1635,  1636,  1637,  1641,  1642,  1646,
-    1647,  1651,  1652,  1653,  1654,  1658,  1659,  1660,  1661,  1665,
-    1666,  1670,  1671,  1675,  1676,  1680,  1684,  1688,  1692,  1693,
-    1697,  1698,  1702,  1703,  1704,  1705,  1706,  1707,  1708,  1709,
-    1712,  1714,  1717,  1719,  1723,  1724,  1725,  1726,  1730,  1731,
-    1732,  1733,  1737,  1738,  1739,  1740,  1744,  1748,  1752,  1753,
-    1756,  1758,  1762,  1763,  1767,  1768,  1772,  1773,  1777,  1781,
-    1782,  1786,  1787,  1788,  1792,  1793,  1797,  1798,  1802,  1803,
-    1804,  1805,  1809,  1810,  1813,  1815,  1819,  1820
+       0,   293,   293,   294,   295,   296,   297,   298,   309,   323,
+     324,   325,   326,   327,   339,   343,   350,   351,   352,   354,
+     358,   359,   360,   361,   362,   366,   367,   368,   372,   376,
+     384,   385,   389,   390,   394,   395,   396,   400,   404,   411,
+     412,   416,   420,   427,   428,   435,   436,   443,   444,   445,
+     449,   455,   456,   457,   461,   468,   469,   473,   477,   484,
+     485,   489,   490,   494,   495,   496,   500,   501,   502,   506,
+     507,   508,   509,   510,   511,   512,   513,   514,   515,   516,
+     519,   520,   524,   525,   529,   530,   531,   532,   536,   537,
+     539,   541,   546,   547,   548,   552,   553,   555,   560,   561,
+     562,   563,   567,   568,   569,   570,   574,   575,   576,   577,
+     578,   579,   582,   588,   589,   590,   591,   592,   593,   600,
+     601,   602,   603,   604,   605,   609,   616,   617,   618,   619,
+     620,   624,   625,   627,   629,   631,   636,   637,   639,   640,
+     642,   647,   648,   652,   653,   658,   659,   663,   664,   668,
+     669,   674,   675,   680,   681,   685,   686,   691,   692,   697,
+     698,   702,   703,   708,   709,   714,   715,   719,   720,   725,
+     726,   730,   731,   736,   737,   742,   743,   748,   749,   756,
+     757,   764,   765,   772,   773,   774,   775,   776,   777,   778,
+     779,   780,   781,   782,   783,   787,   788,   792,   793,   797,
+     798,   802,   803,   804,   805,   806,   807,   808,   809,   810,
+     811,   812,   813,   814,   815,   816,   817,   818,   822,   824,
+     829,   831,   837,   844,   853,   861,   874,   881,   890,   898,
+     911,   913,   919,   927,   939,   940,   944,   948,   952,   956,
+     958,   963,   966,   976,   978,   980,   982,   988,   995,  1004,
+    1010,  1021,  1022,  1026,  1027,  1031,  1035,  1039,  1043,  1050,
+    1053,  1056,  1059,  1065,  1068,  1071,  1074,  1080,  1086,  1092,
+    1093,  1102,  1103,  1107,  1113,  1123,  1124,  1128,  1129,  1133,
+    1139,  1143,  1150,  1156,  1162,  1172,  1174,  1179,  1180,  1191,
+    1192,  1199,  1200,  1210,  1213,  1219,  1220,  1224,  1225,  1230,
+    1237,  1248,  1249,  1250,  1251,  1252,  1253,  1254,  1258,  1259,
+    1260,  1261,  1262,  1266,  1267,  1271,  1272,  1273,  1275,  1279,
+    1280,  1281,  1282,  1283,  1287,  1288,  1289,  1293,  1294,  1297,
+    1299,  1303,  1304,  1308,  1309,  1310,  1311,  1312,  1316,  1317,
+    1318,  1319,  1323,  1324,  1328,  1329,  1333,  1334,  1335,  1336,
+    1340,  1341,  1342,  1343,  1347,  1348,  1352,  1353,  1357,  1358,
+    1362,  1363,  1367,  1368,  1369,  1373,  1374,  1375,  1379,  1380,
+    1381,  1382,  1383,  1384,  1385,  1386,  1387,  1388,  1389,  1392,
+    1393,  1397,  1398,  1402,  1403,  1404,  1405,  1409,  1410,  1411,
+    1412,  1416,  1417,  1418,  1422,  1423,  1424,  1428,  1429,  1430,
+    1431,  1435,  1436,  1437,  1438,  1442,  1443,  1444,  1445,  1446,
+    1447,  1448,  1452,  1453,  1454,  1455,  1456,  1457,  1461,  1462,
+    1463,  1464,  1465,  1466,  1467,  1471,  1472,  1473,  1474,  1475,
+    1479,  1480,  1481,  1482,  1483,  1487,  1488,  1489,  1490,  1491,
+    1495,  1496,  1500,  1501,  1505,  1506,  1510,  1511,  1515,  1516,
+    1520,  1521,  1525,  1526,  1530,  1531,  1535,  1536,  1540,  1541,
+    1545,  1546,  1550,  1551,  1555,  1556,  1560,  1561,  1565,  1566,
+    1570,  1571,  1575,  1576,  1580,  1581,  1585,  1586,  1590,  1591,
+    1595,  1596,  1600,  1601,  1602,  1603,  1604,  1605,  1606,  1607,
+    1608,  1609,  1610,  1611,  1615,  1616,  1620,  1621,  1625,  1626,
+    1630,  1631,  1632,  1633,  1634,  1635,  1636,  1637,  1638,  1639,
+    1640,  1641,  1642,  1643,  1644,  1645,  1646,  1650,  1651,  1655,
+    1656,  1660,  1661,  1662,  1663,  1667,  1668,  1669,  1670,  1674,
+    1675,  1679,  1680,  1684,  1685,  1689,  1693,  1697,  1701,  1702,
+    1706,  1707,  1711,  1712,  1713,  1714,  1715,  1716,  1717,  1718,
+    1721,  1723,  1726,  1728,  1732,  1733,  1734,  1735,  1739,  1740,
+    1741,  1742,  1746,  1747,  1748,  1749,  1753,  1757,  1761,  1762,
+    1765,  1767,  1771,  1772,  1776,  1777,  1781,  1782,  1786,  1790,
+    1791,  1795,  1796,  1797,  1801,  1802,  1806,  1807,  1811,  1812,
+    1813,  1814,  1818,  1819,  1822,  1824,  1828,  1829
 };
 #endif
 
@@ -2310,20 +2363,17 @@ yy_symbol_print (yyoutput, yytype, yyvaluep, yylocationp)
 #if (defined __STDC__ || defined __C99__FUNC__ \
      || defined __cplusplus || defined _MSC_VER)
 static void
-yy_stack_print (yytype_int16 *yybottom, yytype_int16 *yytop)
+yy_stack_print (yytype_int16 *bottom, yytype_int16 *top)
 #else
 static void
-yy_stack_print (yybottom, yytop)
-    yytype_int16 *yybottom;
-    yytype_int16 *yytop;
+yy_stack_print (bottom, top)
+    yytype_int16 *bottom;
+    yytype_int16 *top;
 #endif
 {
   YYFPRINTF (stderr, "Stack now");
-  for (; yybottom <= yytop; yybottom++)
-    {
-      int yybot = *yybottom;
-      YYFPRINTF (stderr, " %d", yybot);
-    }
+  for (; bottom <= top; ++bottom)
+    YYFPRINTF (stderr, " %d", *bottom);
   YYFPRINTF (stderr, "\n");
 }
 
@@ -2358,11 +2408,11 @@ yy_reduce_print (yyvsp, yylsp, yyrule)
   /* The symbols being reduced.  */
   for (yyi = 0; yyi < yynrhs; yyi++)
     {
-      YYFPRINTF (stderr, "   $%d = ", yyi + 1);
+      fprintf (stderr, "   $%d = ", yyi + 1);
       yy_symbol_print (stderr, yyrhs[yyprhs[yyrule] + yyi],
 		       &(yyvsp[(yyi + 1) - (yynrhs)])
 		       , &(yylsp[(yyi + 1) - (yynrhs)])		       );
-      YYFPRINTF (stderr, "\n");
+      fprintf (stderr, "\n");
     }
 }
 
@@ -2644,8 +2694,10 @@ yydestruct (yymsg, yytype, yyvaluep, yylocationp)
 	break;
     }
 }
+
 
 /* Prevent warnings from -Wmissing-prototypes.  */
+
 #ifdef YYPARSE_PARAM
 #if defined __STDC__ || defined __cplusplus
 int yyparse (void *YYPARSE_PARAM);
@@ -2664,9 +2716,10 @@ int yyparse ();
 
 
 
-/*-------------------------.
-| yyparse or yypush_parse.  |
-`-------------------------*/
+
+/*----------.
+| yyparse.  |
+`----------*/
 
 #ifdef YYPARSE_PARAM
 #if (defined __STDC__ || defined __C99__FUNC__ \
@@ -2690,97 +2743,88 @@ yyparse ()
 #endif
 #endif
 {
-/* The lookahead symbol.  */
+  /* The look-ahead symbol.  */
 int yychar;
 
-/* The semantic value of the lookahead symbol.  */
+/* The semantic value of the look-ahead symbol.  */
 YYSTYPE yylval;
 
-/* Location data for the lookahead symbol.  */
+/* Number of syntax errors so far.  */
+int yynerrs;
+/* Location data for the look-ahead symbol.  */
 YYLTYPE yylloc;
 
-    /* Number of syntax errors so far.  */
-    int yynerrs;
-
-    int yystate;
-    /* Number of tokens to shift before error messages enabled.  */
-    int yyerrstatus;
+  int yystate;
+  int yyn;
+  int yyresult;
+  /* Number of tokens to shift before error messages enabled.  */
+  int yyerrstatus;
+  /* Look-ahead token as an internal (translated) token number.  */
+  int yytoken = 0;
+#if YYERROR_VERBOSE
+  /* Buffer for error messages, and its allocated size.  */
+  char yymsgbuf[128];
+  char *yymsg = yymsgbuf;
+  YYSIZE_T yymsg_alloc = sizeof yymsgbuf;
+#endif
 
-    /* The stacks and their tools:
-       `yyss': related to states.
-       `yyvs': related to semantic values.
-       `yyls': related to locations.
+  /* Three stacks and their tools:
+     `yyss': related to states,
+     `yyvs': related to semantic values,
+     `yyls': related to locations.
 
-       Refer to the stacks thru separate pointers, to allow yyoverflow
-       to reallocate them elsewhere.  */
+     Refer to the stacks thru separate pointers, to allow yyoverflow
+     to reallocate them elsewhere.  */
 
-    /* The state stack.  */
-    yytype_int16 yyssa[YYINITDEPTH];
-    yytype_int16 *yyss;
-    yytype_int16 *yyssp;
+  /* The state stack.  */
+  yytype_int16 yyssa[YYINITDEPTH];
+  yytype_int16 *yyss = yyssa;
+  yytype_int16 *yyssp;
 
-    /* The semantic value stack.  */
-    YYSTYPE yyvsa[YYINITDEPTH];
-    YYSTYPE *yyvs;
-    YYSTYPE *yyvsp;
+  /* The semantic value stack.  */
+  YYSTYPE yyvsa[YYINITDEPTH];
+  YYSTYPE *yyvs = yyvsa;
+  YYSTYPE *yyvsp;
 
-    /* The location stack.  */
-    YYLTYPE yylsa[YYINITDEPTH];
-    YYLTYPE *yyls;
-    YYLTYPE *yylsp;
+  /* The location stack.  */
+  YYLTYPE yylsa[YYINITDEPTH];
+  YYLTYPE *yyls = yylsa;
+  YYLTYPE *yylsp;
+  /* The locations where the error started and ended.  */
+  YYLTYPE yyerror_range[2];
 
-    /* The locations where the error started and ended.  */
-    YYLTYPE yyerror_range[2];
+#define YYPOPSTACK(N)   (yyvsp -= (N), yyssp -= (N), yylsp -= (N))
 
-    YYSIZE_T yystacksize;
+  YYSIZE_T yystacksize = YYINITDEPTH;
 
-  int yyn;
-  int yyresult;
-  /* Lookahead token as an internal (translated) token number.  */
-  int yytoken;
   /* The variables used to return semantic value and location from the
      action routines.  */
   YYSTYPE yyval;
   YYLTYPE yyloc;
 
-#if YYERROR_VERBOSE
-  /* Buffer for error messages, and its allocated size.  */
-  char yymsgbuf[128];
-  char *yymsg = yymsgbuf;
-  YYSIZE_T yymsg_alloc = sizeof yymsgbuf;
-#endif
-
-#define YYPOPSTACK(N)   (yyvsp -= (N), yyssp -= (N), yylsp -= (N))
-
   /* The number of symbols on the RHS of the reduced rule.
      Keep to zero when no symbol should be popped.  */
   int yylen = 0;
 
-  yytoken = 0;
-  yyss = yyssa;
-  yyvs = yyvsa;
-  yyls = yylsa;
-  yystacksize = YYINITDEPTH;
-
   YYDPRINTF ((stderr, "Starting parse\n"));
 
   yystate = 0;
   yyerrstatus = 0;
   yynerrs = 0;
-  yychar = YYEMPTY; /* Cause a token to be read.  */
+  yychar = YYEMPTY;		/* Cause a token to be read.  */
 
   /* Initialize stack pointers.
      Waste one element of value and location stack
      so that they stay on the same level as the state stack.
      The wasted elements are never initialized.  */
+
   yyssp = yyss;
   yyvsp = yyvs;
   yylsp = yyls;
-
 #if YYLTYPE_IS_TRIVIAL
   /* Initialize the default location before parsing starts.  */
   yylloc.first_line   = yylloc.last_line   = 1;
-  yylloc.first_column = yylloc.last_column = 1;
+  yylloc.first_column = yylloc.last_column = 0;
 #endif
 
   goto yysetstate;
@@ -2819,7 +2863,6 @@ YYLTYPE yylloc;
 		    &yyvs1, yysize * sizeof (*yyvsp),
 		    &yyls1, yysize * sizeof (*yylsp),
 		    &yystacksize);
-
 	yyls = yyls1;
 	yyss = yyss1;
 	yyvs = yyvs1;
@@ -2841,9 +2884,9 @@ YYLTYPE yylloc;
 	  (union yyalloc *) YYSTACK_ALLOC (YYSTACK_BYTES (yystacksize));
 	if (! yyptr)
 	  goto yyexhaustedlab;
-	YYSTACK_RELOCATE (yyss_alloc, yyss);
-	YYSTACK_RELOCATE (yyvs_alloc, yyvs);
-	YYSTACK_RELOCATE (yyls_alloc, yyls);
+	YYSTACK_RELOCATE (yyss);
+	YYSTACK_RELOCATE (yyvs);
+	YYSTACK_RELOCATE (yyls);
 #  undef YYSTACK_RELOCATE
 	if (yyss1 != yyssa)
 	  YYSTACK_FREE (yyss1);
@@ -2864,9 +2907,6 @@ YYLTYPE yylloc;
 
   YYDPRINTF ((stderr, "Entering state %d\n", yystate));
 
-  if (yystate == YYFINAL)
-    YYACCEPT;
-
   goto yybackup;
 
 /*-----------.
@@ -2875,16 +2915,16 @@ YYLTYPE yylloc;
 yybackup:
 
   /* Do appropriate processing given the current state.  Read a
-     lookahead token if we need one and don't already have one.  */
+     look-ahead token if we need one and don't already have one.  */
 
-  /* First try to decide what to do without reference to lookahead token.  */
+  /* First try to decide what to do without reference to look-ahead token.  */
   yyn = yypact[yystate];
   if (yyn == YYPACT_NINF)
     goto yydefault;
 
-  /* Not known => get a lookahead token if don't already have one.  */
+  /* Not known => get a look-ahead token if don't already have one.  */
 
-  /* YYCHAR is either YYEMPTY or YYEOF or a valid lookahead symbol.  */
+  /* YYCHAR is either YYEMPTY or YYEOF or a valid look-ahead symbol.  */
   if (yychar == YYEMPTY)
     {
       YYDPRINTF ((stderr, "Reading a token: "));
@@ -2916,16 +2956,20 @@ yybackup:
       goto yyreduce;
     }
 
+  if (yyn == YYFINAL)
+    YYACCEPT;
+
   /* Count tokens shifted since error; after three, turn off error
      status.  */
   if (yyerrstatus)
     yyerrstatus--;
 
-  /* Shift the lookahead token.  */
+  /* Shift the look-ahead token.  */
   YY_SYMBOL_PRINT ("Shifting", yytoken, &yylval, &yylloc);
 
-  /* Discard the shifted token.  */
-  yychar = YYEMPTY;
+  /* Discard the shifted token unless it is eof.  */
+  if (yychar != YYEOF)
+    yychar = YYEMPTY;
 
   yystate = yyn;
   *++yyvsp = yylval;
@@ -2966,116 +3010,94 @@ yyreduce:
   switch (yyn)
     {
         case 2:
-
-/* Line 1455 of yacc.c  */
-#line 288 "../../JavaScriptCore/parser/Grammar.y"
+#line 293 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NullNode(GLOBAL_DATA), 0, 1); ;}
     break;
 
   case 3:
-
-/* Line 1455 of yacc.c  */
-#line 289 "../../JavaScriptCore/parser/Grammar.y"
+#line 294 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, true), 0, 1); ;}
     break;
 
   case 4:
-
-/* Line 1455 of yacc.c  */
-#line 290 "../../JavaScriptCore/parser/Grammar.y"
+#line 295 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, false), 0, 1); ;}
     break;
 
   case 5:
-
-/* Line 1455 of yacc.c  */
-#line 291 "../../JavaScriptCore/parser/Grammar.y"
+#line 296 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeNumberNode(GLOBAL_DATA, (yyvsp[(1) - (1)].doubleValue)), 0, 1); ;}
     break;
 
   case 6:
-
-/* Line 1455 of yacc.c  */
-#line 292 "../../JavaScriptCore/parser/Grammar.y"
+#line 297 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StringNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident)), 0, 1); ;}
     break;
 
   case 7:
-
-/* Line 1455 of yacc.c  */
-#line 293 "../../JavaScriptCore/parser/Grammar.y"
+#line 298 "../../JavaScriptCore/parser/Grammar.y"
     {
-                                            Lexer& l = *LEXER;
-                                            if (!l.scanRegExp())
+                                            Lexer& l = *GLOBAL_DATA->lexer;
+                                            const Identifier* pattern;
+                                            const Identifier* flags;
+                                            if (!l.scanRegExp(pattern, flags))
                                                 YYABORT;
-                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, l.pattern(), l.flags());
-                                            int size = l.pattern().size() + 2; // + 2 for the two /'s
-                                            SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (1)]).first_column, (yylsp[(1) - (1)]).first_column + size, (yylsp[(1) - (1)]).first_column + size);
+                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, *pattern, *flags);
+                                            int size = pattern->size() + 2; // + 2 for the two /'s
+                                            setExceptionLocation(node, (yylsp[(1) - (1)]).first_column, (yylsp[(1) - (1)]).first_column + size, (yylsp[(1) - (1)]).first_column + size);
                                             (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, 0, 0);
                                         ;}
     break;
 
   case 8:
-
-/* Line 1455 of yacc.c  */
-#line 302 "../../JavaScriptCore/parser/Grammar.y"
+#line 309 "../../JavaScriptCore/parser/Grammar.y"
     {
-                                            Lexer& l = *LEXER;
-                                            if (!l.scanRegExp())
+                                            Lexer& l = *GLOBAL_DATA->lexer;
+                                            const Identifier* pattern;
+                                            const Identifier* flags;
+                                            if (!l.scanRegExp(pattern, flags, '='))
                                                 YYABORT;
-                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, "=" + l.pattern(), l.flags());
-                                            int size = l.pattern().size() + 2; // + 2 for the two /'s
-                                            SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (1)]).first_column, (yylsp[(1) - (1)]).first_column + size, (yylsp[(1) - (1)]).first_column + size);
+                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, *pattern, *flags);
+                                            int size = pattern->size() + 2; // + 2 for the two /'s
+                                            setExceptionLocation(node, (yylsp[(1) - (1)]).first_column, (yylsp[(1) - (1)]).first_column + size, (yylsp[(1) - (1)]).first_column + size);
                                             (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, 0, 0);
                                         ;}
     break;
 
   case 9:
-
-/* Line 1455 of yacc.c  */
-#line 314 "../../JavaScriptCore/parser/Grammar.y"
+#line 323 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 10:
-
-/* Line 1455 of yacc.c  */
-#line 315 "../../JavaScriptCore/parser/Grammar.y"
+#line 324 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 11:
-
-/* Line 1455 of yacc.c  */
-#line 316 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, Identifier(GLOBAL_DATA, UString::from((yyvsp[(1) - (3)].doubleValue))), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+#line 325 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, (yyvsp[(1) - (3)].doubleValue), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 12:
-
-/* Line 1455 of yacc.c  */
-#line 317 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(globalPtr, *(yyvsp[(1) - (7)].ident), *(yyvsp[(2) - (7)].ident), 0, (yyvsp[(6) - (7)].functionBodyNode), LEXER->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), ClosureFeature, 0); DBG((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); if (!(yyval.propertyNode).m_node) YYABORT; ;}
+#line 326 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (7)].ident), *(yyvsp[(2) - (7)].ident), 0, (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), ClosureFeature, 0); setStatementLocation((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); if (!(yyval.propertyNode).m_node) YYABORT; ;}
     break;
 
   case 13:
-
-/* Line 1455 of yacc.c  */
-#line 319 "../../JavaScriptCore/parser/Grammar.y"
+#line 328 "../../JavaScriptCore/parser/Grammar.y"
     {
-                                                                 (yyval.propertyNode) = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(globalPtr, *(yyvsp[(1) - (8)].ident), *(yyvsp[(2) - (8)].ident), (yyvsp[(4) - (8)].parameterList).m_node.head, (yyvsp[(7) - (8)].functionBodyNode), LEXER->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line)), (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
+                                                                 (yyval.propertyNode) = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (8)].ident), *(yyvsp[(2) - (8)].ident), (yyvsp[(4) - (8)].parameterList).m_node.head, (yyvsp[(7) - (8)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line)), (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
                                                                  if ((yyvsp[(4) - (8)].parameterList).m_features & ArgumentsFeature)
                                                                      (yyvsp[(7) - (8)].functionBodyNode)->setUsesArguments(); 
-                                                                 DBG((yyvsp[(7) - (8)].functionBodyNode), (yylsp[(6) - (8)]), (yylsp[(8) - (8)])); 
+                                                                 setStatementLocation((yyvsp[(7) - (8)].functionBodyNode), (yylsp[(6) - (8)]), (yylsp[(8) - (8)])); 
                                                                  if (!(yyval.propertyNode).m_node) 
                                                                      YYABORT; 
                                                              ;}
     break;
 
   case 14:
-
-/* Line 1455 of yacc.c  */
-#line 330 "../../JavaScriptCore/parser/Grammar.y"
+#line 339 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.propertyList).m_node.head = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].propertyNode).m_node); 
                                           (yyval.propertyList).m_node.tail = (yyval.propertyList).m_node.head;
                                           (yyval.propertyList).m_features = (yyvsp[(1) - (1)].propertyNode).m_features;
@@ -3083,9 +3105,7 @@ yyreduce:
     break;
 
   case 15:
-
-/* Line 1455 of yacc.c  */
-#line 334 "../../JavaScriptCore/parser/Grammar.y"
+#line 343 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.propertyList).m_node.head = (yyvsp[(1) - (3)].propertyList).m_node.head;
                                           (yyval.propertyList).m_node.tail = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, (yyvsp[(3) - (3)].propertyNode).m_node, (yyvsp[(1) - (3)].propertyList).m_node.tail);
                                           (yyval.propertyList).m_features = (yyvsp[(1) - (3)].propertyList).m_features | (yyvsp[(3) - (3)].propertyNode).m_features;
@@ -3093,72 +3113,52 @@ yyreduce:
     break;
 
   case 17:
-
-/* Line 1455 of yacc.c  */
-#line 342 "../../JavaScriptCore/parser/Grammar.y"
+#line 351 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA), 0, 0); ;}
     break;
 
   case 18:
-
-/* Line 1455 of yacc.c  */
-#line 343 "../../JavaScriptCore/parser/Grammar.y"
+#line 352 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (3)].propertyList).m_node.head), (yyvsp[(2) - (3)].propertyList).m_features, (yyvsp[(2) - (3)].propertyList).m_numConstants); ;}
     break;
 
   case 19:
-
-/* Line 1455 of yacc.c  */
-#line 345 "../../JavaScriptCore/parser/Grammar.y"
+#line 354 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (4)].propertyList).m_node.head), (yyvsp[(2) - (4)].propertyList).m_features, (yyvsp[(2) - (4)].propertyList).m_numConstants); ;}
     break;
 
   case 20:
-
-/* Line 1455 of yacc.c  */
-#line 349 "../../JavaScriptCore/parser/Grammar.y"
+#line 358 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ThisNode(GLOBAL_DATA), ThisFeature, 0); ;}
     break;
 
   case 23:
-
-/* Line 1455 of yacc.c  */
-#line 352 "../../JavaScriptCore/parser/Grammar.y"
+#line 361 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), (yylsp[(1) - (1)]).first_column), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
     break;
 
   case 24:
-
-/* Line 1455 of yacc.c  */
-#line 353 "../../JavaScriptCore/parser/Grammar.y"
+#line 362 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = (yyvsp[(2) - (3)].expressionNode); ;}
     break;
 
   case 25:
-
-/* Line 1455 of yacc.c  */
-#line 357 "../../JavaScriptCore/parser/Grammar.y"
+#line 366 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].intValue)), 0, (yyvsp[(2) - (3)].intValue) ? 1 : 0); ;}
     break;
 
   case 26:
-
-/* Line 1455 of yacc.c  */
-#line 358 "../../JavaScriptCore/parser/Grammar.y"
+#line 367 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].elementList).m_node.head), (yyvsp[(2) - (3)].elementList).m_features, (yyvsp[(2) - (3)].elementList).m_numConstants); ;}
     break;
 
   case 27:
-
-/* Line 1455 of yacc.c  */
-#line 359 "../../JavaScriptCore/parser/Grammar.y"
+#line 368 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(4) - (5)].intValue), (yyvsp[(2) - (5)].elementList).m_node.head), (yyvsp[(2) - (5)].elementList).m_features, (yyvsp[(4) - (5)].intValue) ? (yyvsp[(2) - (5)].elementList).m_numConstants + 1 : (yyvsp[(2) - (5)].elementList).m_numConstants); ;}
     break;
 
   case 28:
-
-/* Line 1455 of yacc.c  */
-#line 363 "../../JavaScriptCore/parser/Grammar.y"
+#line 372 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.elementList).m_node.head = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].intValue), (yyvsp[(2) - (2)].expressionNode).m_node);
                                           (yyval.elementList).m_node.tail = (yyval.elementList).m_node.head;
                                           (yyval.elementList).m_features = (yyvsp[(2) - (2)].expressionNode).m_features;
@@ -3166,9 +3166,7 @@ yyreduce:
     break;
 
   case 29:
-
-/* Line 1455 of yacc.c  */
-#line 368 "../../JavaScriptCore/parser/Grammar.y"
+#line 377 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.elementList).m_node.head = (yyvsp[(1) - (4)].elementList).m_node.head;
                                           (yyval.elementList).m_node.tail = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, (yyvsp[(1) - (4)].elementList).m_node.tail, (yyvsp[(3) - (4)].intValue), (yyvsp[(4) - (4)].expressionNode).m_node);
                                           (yyval.elementList).m_features = (yyvsp[(1) - (4)].elementList).m_features | (yyvsp[(4) - (4)].expressionNode).m_features;
@@ -3176,198 +3174,152 @@ yyreduce:
     break;
 
   case 30:
-
-/* Line 1455 of yacc.c  */
-#line 375 "../../JavaScriptCore/parser/Grammar.y"
+#line 384 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.intValue) = 0; ;}
     break;
 
   case 32:
-
-/* Line 1455 of yacc.c  */
-#line 380 "../../JavaScriptCore/parser/Grammar.y"
+#line 389 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.intValue) = 1; ;}
     break;
 
   case 33:
-
-/* Line 1455 of yacc.c  */
-#line 381 "../../JavaScriptCore/parser/Grammar.y"
+#line 390 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.intValue) = (yyvsp[(1) - (2)].intValue) + 1; ;}
     break;
 
   case 35:
-
-/* Line 1455 of yacc.c  */
-#line 386 "../../JavaScriptCore/parser/Grammar.y"
+#line 395 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>((yyvsp[(1) - (1)].funcExprNode).m_node, (yyvsp[(1) - (1)].funcExprNode).m_features, (yyvsp[(1) - (1)].funcExprNode).m_numConstants); ;}
     break;
 
   case 36:
-
-/* Line 1455 of yacc.c  */
-#line 387 "../../JavaScriptCore/parser/Grammar.y"
+#line 396 "../../JavaScriptCore/parser/Grammar.y"
     { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
                                         ;}
     break;
 
   case 37:
-
-/* Line 1455 of yacc.c  */
-#line 391 "../../JavaScriptCore/parser/Grammar.y"
+#line 400 "../../JavaScriptCore/parser/Grammar.y"
     { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants);
                                         ;}
     break;
 
   case 38:
-
-/* Line 1455 of yacc.c  */
-#line 395 "../../JavaScriptCore/parser/Grammar.y"
+#line 404 "../../JavaScriptCore/parser/Grammar.y"
     { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].argumentsNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].argumentsNode).m_numConstants);
                                         ;}
     break;
 
   case 40:
-
-/* Line 1455 of yacc.c  */
-#line 403 "../../JavaScriptCore/parser/Grammar.y"
+#line 412 "../../JavaScriptCore/parser/Grammar.y"
     { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
                                         ;}
     break;
 
   case 41:
-
-/* Line 1455 of yacc.c  */
-#line 407 "../../JavaScriptCore/parser/Grammar.y"
+#line 416 "../../JavaScriptCore/parser/Grammar.y"
     { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants);
                                         ;}
     break;
 
   case 42:
-
-/* Line 1455 of yacc.c  */
-#line 411 "../../JavaScriptCore/parser/Grammar.y"
+#line 420 "../../JavaScriptCore/parser/Grammar.y"
     { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].argumentsNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].argumentsNode).m_numConstants);
                                         ;}
     break;
 
   case 44:
-
-/* Line 1455 of yacc.c  */
-#line 419 "../../JavaScriptCore/parser/Grammar.y"
+#line 428 "../../JavaScriptCore/parser/Grammar.y"
     { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); 
                                         ;}
     break;
 
   case 46:
-
-/* Line 1455 of yacc.c  */
-#line 427 "../../JavaScriptCore/parser/Grammar.y"
+#line 436 "../../JavaScriptCore/parser/Grammar.y"
     { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants);
                                         ;}
     break;
 
   case 47:
-
-/* Line 1455 of yacc.c  */
-#line 434 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = makeFunctionCallNode(globalPtr, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
+#line 443 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 48:
-
-/* Line 1455 of yacc.c  */
-#line 435 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = makeFunctionCallNode(globalPtr, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
+#line 444 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 49:
-
-/* Line 1455 of yacc.c  */
-#line 436 "../../JavaScriptCore/parser/Grammar.y"
+#line 445 "../../JavaScriptCore/parser/Grammar.y"
     { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
                                         ;}
     break;
 
   case 50:
-
-/* Line 1455 of yacc.c  */
-#line 440 "../../JavaScriptCore/parser/Grammar.y"
+#line 449 "../../JavaScriptCore/parser/Grammar.y"
     { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 51:
-
-/* Line 1455 of yacc.c  */
-#line 446 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = makeFunctionCallNode(globalPtr, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
+#line 455 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 52:
-
-/* Line 1455 of yacc.c  */
-#line 447 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = makeFunctionCallNode(globalPtr, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
+#line 456 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 53:
-
-/* Line 1455 of yacc.c  */
-#line 448 "../../JavaScriptCore/parser/Grammar.y"
+#line 457 "../../JavaScriptCore/parser/Grammar.y"
     { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
                                         ;}
     break;
 
   case 54:
-
-/* Line 1455 of yacc.c  */
-#line 452 "../../JavaScriptCore/parser/Grammar.y"
+#line 461 "../../JavaScriptCore/parser/Grammar.y"
     { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants); 
                                         ;}
     break;
 
   case 55:
-
-/* Line 1455 of yacc.c  */
-#line 459 "../../JavaScriptCore/parser/Grammar.y"
+#line 468 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA), 0, 0); ;}
     break;
 
   case 56:
-
-/* Line 1455 of yacc.c  */
-#line 460 "../../JavaScriptCore/parser/Grammar.y"
+#line 469 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA, (yyvsp[(2) - (3)].argumentList).m_node.head), (yyvsp[(2) - (3)].argumentList).m_features, (yyvsp[(2) - (3)].argumentList).m_numConstants); ;}
     break;
 
   case 57:
-
-/* Line 1455 of yacc.c  */
-#line 464 "../../JavaScriptCore/parser/Grammar.y"
+#line 473 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.argumentList).m_node.head = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].expressionNode).m_node);
                                           (yyval.argumentList).m_node.tail = (yyval.argumentList).m_node.head;
                                           (yyval.argumentList).m_features = (yyvsp[(1) - (1)].expressionNode).m_features;
@@ -3375,9 +3327,7 @@ yyreduce:
     break;
 
   case 58:
-
-/* Line 1455 of yacc.c  */
-#line 468 "../../JavaScriptCore/parser/Grammar.y"
+#line 477 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.argumentList).m_node.head = (yyvsp[(1) - (3)].argumentList).m_node.head;
                                           (yyval.argumentList).m_node.tail = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (3)].argumentList).m_node.tail, (yyvsp[(3) - (3)].expressionNode).m_node);
                                           (yyval.argumentList).m_features = (yyvsp[(1) - (3)].argumentList).m_features | (yyvsp[(3) - (3)].expressionNode).m_features;
@@ -3385,730 +3335,528 @@ yyreduce:
     break;
 
   case 64:
-
-/* Line 1455 of yacc.c  */
-#line 486 "../../JavaScriptCore/parser/Grammar.y"
+#line 495 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 65:
-
-/* Line 1455 of yacc.c  */
-#line 487 "../../JavaScriptCore/parser/Grammar.y"
+#line 496 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 67:
-
-/* Line 1455 of yacc.c  */
-#line 492 "../../JavaScriptCore/parser/Grammar.y"
+#line 501 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 68:
-
-/* Line 1455 of yacc.c  */
-#line 493 "../../JavaScriptCore/parser/Grammar.y"
+#line 502 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 69:
-
-/* Line 1455 of yacc.c  */
-#line 497 "../../JavaScriptCore/parser/Grammar.y"
+#line 506 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDeleteNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 70:
-
-/* Line 1455 of yacc.c  */
-#line 498 "../../JavaScriptCore/parser/Grammar.y"
+#line 507 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) VoidNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants + 1); ;}
     break;
 
   case 71:
-
-/* Line 1455 of yacc.c  */
-#line 499 "../../JavaScriptCore/parser/Grammar.y"
+#line 508 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeTypeOfNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 72:
-
-/* Line 1455 of yacc.c  */
-#line 500 "../../JavaScriptCore/parser/Grammar.y"
+#line 509 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 73:
-
-/* Line 1455 of yacc.c  */
-#line 501 "../../JavaScriptCore/parser/Grammar.y"
+#line 510 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 74:
-
-/* Line 1455 of yacc.c  */
-#line 502 "../../JavaScriptCore/parser/Grammar.y"
+#line 511 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 75:
-
-/* Line 1455 of yacc.c  */
-#line 503 "../../JavaScriptCore/parser/Grammar.y"
+#line 512 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 76:
-
-/* Line 1455 of yacc.c  */
-#line 504 "../../JavaScriptCore/parser/Grammar.y"
+#line 513 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 77:
-
-/* Line 1455 of yacc.c  */
-#line 505 "../../JavaScriptCore/parser/Grammar.y"
+#line 514 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeNegateNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 78:
-
-/* Line 1455 of yacc.c  */
-#line 506 "../../JavaScriptCore/parser/Grammar.y"
+#line 515 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeBitwiseNotNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 79:
-
-/* Line 1455 of yacc.c  */
-#line 507 "../../JavaScriptCore/parser/Grammar.y"
+#line 516 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalNotNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 85:
-
-/* Line 1455 of yacc.c  */
-#line 521 "../../JavaScriptCore/parser/Grammar.y"
+#line 530 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeMultNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 86:
-
-/* Line 1455 of yacc.c  */
-#line 522 "../../JavaScriptCore/parser/Grammar.y"
+#line 531 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDivNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 87:
-
-/* Line 1455 of yacc.c  */
-#line 523 "../../JavaScriptCore/parser/Grammar.y"
+#line 532 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 89:
-
-/* Line 1455 of yacc.c  */
-#line 529 "../../JavaScriptCore/parser/Grammar.y"
+#line 538 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeMultNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 90:
-
-/* Line 1455 of yacc.c  */
-#line 531 "../../JavaScriptCore/parser/Grammar.y"
+#line 540 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDivNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 91:
-
-/* Line 1455 of yacc.c  */
-#line 533 "../../JavaScriptCore/parser/Grammar.y"
+#line 542 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 93:
-
-/* Line 1455 of yacc.c  */
-#line 538 "../../JavaScriptCore/parser/Grammar.y"
+#line 547 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAddNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 94:
-
-/* Line 1455 of yacc.c  */
-#line 539 "../../JavaScriptCore/parser/Grammar.y"
+#line 548 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeSubNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 96:
-
-/* Line 1455 of yacc.c  */
-#line 545 "../../JavaScriptCore/parser/Grammar.y"
+#line 554 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAddNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 97:
-
-/* Line 1455 of yacc.c  */
-#line 547 "../../JavaScriptCore/parser/Grammar.y"
+#line 556 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeSubNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 99:
-
-/* Line 1455 of yacc.c  */
-#line 552 "../../JavaScriptCore/parser/Grammar.y"
+#line 561 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeLeftShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 100:
-
-/* Line 1455 of yacc.c  */
-#line 553 "../../JavaScriptCore/parser/Grammar.y"
+#line 562 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 101:
-
-/* Line 1455 of yacc.c  */
-#line 554 "../../JavaScriptCore/parser/Grammar.y"
+#line 563 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 103:
-
-/* Line 1455 of yacc.c  */
-#line 559 "../../JavaScriptCore/parser/Grammar.y"
+#line 568 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeLeftShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 104:
-
-/* Line 1455 of yacc.c  */
-#line 560 "../../JavaScriptCore/parser/Grammar.y"
+#line 569 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 105:
-
-/* Line 1455 of yacc.c  */
-#line 561 "../../JavaScriptCore/parser/Grammar.y"
+#line 570 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 107:
-
-/* Line 1455 of yacc.c  */
-#line 566 "../../JavaScriptCore/parser/Grammar.y"
+#line 575 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 108:
-
-/* Line 1455 of yacc.c  */
-#line 567 "../../JavaScriptCore/parser/Grammar.y"
+#line 576 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 109:
-
-/* Line 1455 of yacc.c  */
-#line 568 "../../JavaScriptCore/parser/Grammar.y"
+#line 577 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 110:
-
-/* Line 1455 of yacc.c  */
-#line 569 "../../JavaScriptCore/parser/Grammar.y"
+#line 578 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 111:
-
-/* Line 1455 of yacc.c  */
-#line 570 "../../JavaScriptCore/parser/Grammar.y"
+#line 579 "../../JavaScriptCore/parser/Grammar.y"
     { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 112:
-
-/* Line 1455 of yacc.c  */
-#line 573 "../../JavaScriptCore/parser/Grammar.y"
+#line 582 "../../JavaScriptCore/parser/Grammar.y"
     { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 114:
-
-/* Line 1455 of yacc.c  */
-#line 580 "../../JavaScriptCore/parser/Grammar.y"
+#line 589 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 115:
-
-/* Line 1455 of yacc.c  */
-#line 581 "../../JavaScriptCore/parser/Grammar.y"
+#line 590 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 116:
-
-/* Line 1455 of yacc.c  */
-#line 582 "../../JavaScriptCore/parser/Grammar.y"
+#line 591 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 117:
-
-/* Line 1455 of yacc.c  */
-#line 583 "../../JavaScriptCore/parser/Grammar.y"
+#line 592 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 118:
-
-/* Line 1455 of yacc.c  */
-#line 585 "../../JavaScriptCore/parser/Grammar.y"
+#line 594 "../../JavaScriptCore/parser/Grammar.y"
     { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 120:
-
-/* Line 1455 of yacc.c  */
-#line 592 "../../JavaScriptCore/parser/Grammar.y"
+#line 601 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 121:
-
-/* Line 1455 of yacc.c  */
-#line 593 "../../JavaScriptCore/parser/Grammar.y"
+#line 602 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 122:
-
-/* Line 1455 of yacc.c  */
-#line 594 "../../JavaScriptCore/parser/Grammar.y"
+#line 603 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 123:
-
-/* Line 1455 of yacc.c  */
-#line 595 "../../JavaScriptCore/parser/Grammar.y"
+#line 604 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 124:
-
-/* Line 1455 of yacc.c  */
-#line 597 "../../JavaScriptCore/parser/Grammar.y"
+#line 606 "../../JavaScriptCore/parser/Grammar.y"
     { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 125:
-
-/* Line 1455 of yacc.c  */
-#line 601 "../../JavaScriptCore/parser/Grammar.y"
+#line 610 "../../JavaScriptCore/parser/Grammar.y"
     { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 127:
-
-/* Line 1455 of yacc.c  */
-#line 608 "../../JavaScriptCore/parser/Grammar.y"
+#line 617 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 128:
-
-/* Line 1455 of yacc.c  */
-#line 609 "../../JavaScriptCore/parser/Grammar.y"
+#line 618 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 129:
-
-/* Line 1455 of yacc.c  */
-#line 610 "../../JavaScriptCore/parser/Grammar.y"
+#line 619 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 130:
-
-/* Line 1455 of yacc.c  */
-#line 611 "../../JavaScriptCore/parser/Grammar.y"
+#line 620 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 132:
-
-/* Line 1455 of yacc.c  */
-#line 617 "../../JavaScriptCore/parser/Grammar.y"
+#line 626 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 133:
-
-/* Line 1455 of yacc.c  */
-#line 619 "../../JavaScriptCore/parser/Grammar.y"
+#line 628 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 134:
-
-/* Line 1455 of yacc.c  */
-#line 621 "../../JavaScriptCore/parser/Grammar.y"
+#line 630 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 135:
-
-/* Line 1455 of yacc.c  */
-#line 623 "../../JavaScriptCore/parser/Grammar.y"
+#line 632 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 137:
-
-/* Line 1455 of yacc.c  */
-#line 629 "../../JavaScriptCore/parser/Grammar.y"
+#line 638 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 138:
-
-/* Line 1455 of yacc.c  */
-#line 630 "../../JavaScriptCore/parser/Grammar.y"
+#line 639 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 139:
-
-/* Line 1455 of yacc.c  */
-#line 632 "../../JavaScriptCore/parser/Grammar.y"
+#line 641 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 140:
-
-/* Line 1455 of yacc.c  */
-#line 634 "../../JavaScriptCore/parser/Grammar.y"
+#line 643 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 142:
-
-/* Line 1455 of yacc.c  */
-#line 639 "../../JavaScriptCore/parser/Grammar.y"
+#line 648 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 144:
-
-/* Line 1455 of yacc.c  */
-#line 645 "../../JavaScriptCore/parser/Grammar.y"
+#line 654 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 146:
-
-/* Line 1455 of yacc.c  */
-#line 650 "../../JavaScriptCore/parser/Grammar.y"
+#line 659 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 148:
-
-/* Line 1455 of yacc.c  */
-#line 655 "../../JavaScriptCore/parser/Grammar.y"
+#line 664 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 150:
-
-/* Line 1455 of yacc.c  */
-#line 661 "../../JavaScriptCore/parser/Grammar.y"
+#line 670 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 152:
-
-/* Line 1455 of yacc.c  */
-#line 667 "../../JavaScriptCore/parser/Grammar.y"
+#line 676 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 154:
-
-/* Line 1455 of yacc.c  */
-#line 672 "../../JavaScriptCore/parser/Grammar.y"
+#line 681 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 156:
-
-/* Line 1455 of yacc.c  */
-#line 678 "../../JavaScriptCore/parser/Grammar.y"
+#line 687 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 158:
-
-/* Line 1455 of yacc.c  */
-#line 684 "../../JavaScriptCore/parser/Grammar.y"
+#line 693 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 160:
-
-/* Line 1455 of yacc.c  */
-#line 689 "../../JavaScriptCore/parser/Grammar.y"
+#line 698 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 162:
-
-/* Line 1455 of yacc.c  */
-#line 695 "../../JavaScriptCore/parser/Grammar.y"
+#line 704 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 164:
-
-/* Line 1455 of yacc.c  */
-#line 701 "../../JavaScriptCore/parser/Grammar.y"
+#line 710 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 166:
-
-/* Line 1455 of yacc.c  */
-#line 706 "../../JavaScriptCore/parser/Grammar.y"
+#line 715 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 168:
-
-/* Line 1455 of yacc.c  */
-#line 712 "../../JavaScriptCore/parser/Grammar.y"
+#line 721 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 170:
-
-/* Line 1455 of yacc.c  */
-#line 717 "../../JavaScriptCore/parser/Grammar.y"
+#line 726 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 172:
-
-/* Line 1455 of yacc.c  */
-#line 723 "../../JavaScriptCore/parser/Grammar.y"
+#line 732 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 174:
-
-/* Line 1455 of yacc.c  */
-#line 729 "../../JavaScriptCore/parser/Grammar.y"
+#line 738 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 176:
-
-/* Line 1455 of yacc.c  */
-#line 735 "../../JavaScriptCore/parser/Grammar.y"
+#line 744 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 178:
-
-/* Line 1455 of yacc.c  */
-#line 741 "../../JavaScriptCore/parser/Grammar.y"
+#line 750 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature, 
                                                                                                      (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); 
                                         ;}
     break;
 
   case 180:
-
-/* Line 1455 of yacc.c  */
-#line 749 "../../JavaScriptCore/parser/Grammar.y"
+#line 758 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature, 
                                                                                                      (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants);
                                         ;}
     break;
 
   case 182:
-
-/* Line 1455 of yacc.c  */
-#line 757 "../../JavaScriptCore/parser/Grammar.y"
+#line 766 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature,
                                                                                                      (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); 
                                         ;}
     break;
 
   case 183:
-
-/* Line 1455 of yacc.c  */
-#line 763 "../../JavaScriptCore/parser/Grammar.y"
+#line 772 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.op) = OpEqual; ;}
     break;
 
   case 184:
-
-/* Line 1455 of yacc.c  */
-#line 764 "../../JavaScriptCore/parser/Grammar.y"
+#line 773 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.op) = OpPlusEq; ;}
     break;
 
   case 185:
-
-/* Line 1455 of yacc.c  */
-#line 765 "../../JavaScriptCore/parser/Grammar.y"
+#line 774 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.op) = OpMinusEq; ;}
     break;
 
   case 186:
-
-/* Line 1455 of yacc.c  */
-#line 766 "../../JavaScriptCore/parser/Grammar.y"
+#line 775 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.op) = OpMultEq; ;}
     break;
 
   case 187:
-
-/* Line 1455 of yacc.c  */
-#line 767 "../../JavaScriptCore/parser/Grammar.y"
+#line 776 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.op) = OpDivEq; ;}
     break;
 
   case 188:
-
-/* Line 1455 of yacc.c  */
-#line 768 "../../JavaScriptCore/parser/Grammar.y"
+#line 777 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.op) = OpLShift; ;}
     break;
 
   case 189:
-
-/* Line 1455 of yacc.c  */
-#line 769 "../../JavaScriptCore/parser/Grammar.y"
+#line 778 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.op) = OpRShift; ;}
     break;
 
   case 190:
-
-/* Line 1455 of yacc.c  */
-#line 770 "../../JavaScriptCore/parser/Grammar.y"
+#line 779 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.op) = OpURShift; ;}
     break;
 
   case 191:
-
-/* Line 1455 of yacc.c  */
-#line 771 "../../JavaScriptCore/parser/Grammar.y"
+#line 780 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.op) = OpAndEq; ;}
     break;
 
   case 192:
-
-/* Line 1455 of yacc.c  */
-#line 772 "../../JavaScriptCore/parser/Grammar.y"
+#line 781 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.op) = OpXOrEq; ;}
     break;
 
   case 193:
-
-/* Line 1455 of yacc.c  */
-#line 773 "../../JavaScriptCore/parser/Grammar.y"
+#line 782 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.op) = OpOrEq; ;}
     break;
 
   case 194:
-
-/* Line 1455 of yacc.c  */
-#line 774 "../../JavaScriptCore/parser/Grammar.y"
+#line 783 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.op) = OpModEq; ;}
     break;
 
   case 196:
-
-/* Line 1455 of yacc.c  */
-#line 779 "../../JavaScriptCore/parser/Grammar.y"
+#line 788 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 198:
-
-/* Line 1455 of yacc.c  */
-#line 784 "../../JavaScriptCore/parser/Grammar.y"
+#line 793 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 200:
-
-/* Line 1455 of yacc.c  */
-#line 789 "../../JavaScriptCore/parser/Grammar.y"
+#line 798 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 218:
-
-/* Line 1455 of yacc.c  */
-#line 813 "../../JavaScriptCore/parser/Grammar.y"
+#line 822 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, 0), 0, 0, 0, 0);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 219:
-
-/* Line 1455 of yacc.c  */
-#line 815 "../../JavaScriptCore/parser/Grammar.y"
+#line 824 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].sourceElements).m_node), (yyvsp[(2) - (3)].sourceElements).m_varDeclarations, (yyvsp[(2) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (3)].sourceElements).m_features, (yyvsp[(2) - (3)].sourceElements).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 220:
-
-/* Line 1455 of yacc.c  */
-#line 820 "../../JavaScriptCore/parser/Grammar.y"
+#line 829 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(makeVarStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].varDeclList).m_node), (yyvsp[(2) - (3)].varDeclList).m_varDeclarations, (yyvsp[(2) - (3)].varDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].varDeclList).m_features, (yyvsp[(2) - (3)].varDeclList).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 221:
-
-/* Line 1455 of yacc.c  */
-#line 822 "../../JavaScriptCore/parser/Grammar.y"
+#line 831 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(makeVarStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].varDeclList).m_node), (yyvsp[(2) - (3)].varDeclList).m_varDeclarations, (yyvsp[(2) - (3)].varDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].varDeclList).m_features, (yyvsp[(2) - (3)].varDeclList).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)]));
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)]));
                                           AUTO_SEMICOLON; ;}
     break;
 
   case 222:
-
-/* Line 1455 of yacc.c  */
-#line 828 "../../JavaScriptCore/parser/Grammar.y"
+#line 837 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.varDeclList).m_node = 0;
                                           (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (1)].ident), 0);
@@ -4119,11 +3867,9 @@ yyreduce:
     break;
 
   case 223:
-
-/* Line 1455 of yacc.c  */
-#line 835 "../../JavaScriptCore/parser/Grammar.y"
+#line 844 "../../JavaScriptCore/parser/Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column);
                                           (yyval.varDeclList).m_node = node;
                                           (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (2)].ident), DeclarationStacks::HasInitializer);
@@ -4134,9 +3880,7 @@ yyreduce:
     break;
 
   case 224:
-
-/* Line 1455 of yacc.c  */
-#line 845 "../../JavaScriptCore/parser/Grammar.y"
+#line 854 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.varDeclList).m_node = (yyvsp[(1) - (3)].varDeclList).m_node;
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (3)].varDeclList).m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (3)].ident), 0);
@@ -4147,11 +3891,9 @@ yyreduce:
     break;
 
   case 225:
-
-/* Line 1455 of yacc.c  */
-#line 853 "../../JavaScriptCore/parser/Grammar.y"
+#line 862 "../../JavaScriptCore/parser/Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
                                           (yyval.varDeclList).m_node = combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (4)].varDeclList).m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (4)].ident), DeclarationStacks::HasInitializer);
@@ -4162,9 +3904,7 @@ yyreduce:
     break;
 
   case 226:
-
-/* Line 1455 of yacc.c  */
-#line 865 "../../JavaScriptCore/parser/Grammar.y"
+#line 874 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.varDeclList).m_node = 0;
                                           (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (1)].ident), 0);
@@ -4175,11 +3915,9 @@ yyreduce:
     break;
 
   case 227:
-
-/* Line 1455 of yacc.c  */
-#line 872 "../../JavaScriptCore/parser/Grammar.y"
+#line 881 "../../JavaScriptCore/parser/Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column);
                                           (yyval.varDeclList).m_node = node;
                                           (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (2)].ident), DeclarationStacks::HasInitializer);
@@ -4190,9 +3928,7 @@ yyreduce:
     break;
 
   case 228:
-
-/* Line 1455 of yacc.c  */
-#line 882 "../../JavaScriptCore/parser/Grammar.y"
+#line 891 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.varDeclList).m_node = (yyvsp[(1) - (3)].varDeclList).m_node;
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (3)].varDeclList).m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (3)].ident), 0);
@@ -4203,11 +3939,9 @@ yyreduce:
     break;
 
   case 229:
-
-/* Line 1455 of yacc.c  */
-#line 890 "../../JavaScriptCore/parser/Grammar.y"
+#line 899 "../../JavaScriptCore/parser/Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
                                           (yyval.varDeclList).m_node = combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (4)].varDeclList).m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (4)].ident), DeclarationStacks::HasInitializer);
@@ -4218,25 +3952,19 @@ yyreduce:
     break;
 
   case 230:
-
-/* Line 1455 of yacc.c  */
-#line 902 "../../JavaScriptCore/parser/Grammar.y"
+#line 911 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 231:
-
-/* Line 1455 of yacc.c  */
-#line 905 "../../JavaScriptCore/parser/Grammar.y"
+#line 914 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
     break;
 
   case 232:
-
-/* Line 1455 of yacc.c  */
-#line 910 "../../JavaScriptCore/parser/Grammar.y"
+#line 919 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.constDeclList).m_node.head = (yyvsp[(1) - (1)].constDeclNode).m_node;
                                           (yyval.constDeclList).m_node.tail = (yyval.constDeclList).m_node.head;
                                           (yyval.constDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
@@ -4248,9 +3976,7 @@ yyreduce:
     break;
 
   case 233:
-
-/* Line 1455 of yacc.c  */
-#line 919 "../../JavaScriptCore/parser/Grammar.y"
+#line 928 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.constDeclList).m_node.head = (yyvsp[(1) - (3)].constDeclList).m_node.head;
                                           (yyvsp[(1) - (3)].constDeclList).m_node.tail->m_next = (yyvsp[(3) - (3)].constDeclNode).m_node;
                                           (yyval.constDeclList).m_node.tail = (yyvsp[(3) - (3)].constDeclNode).m_node;
@@ -4262,316 +3988,246 @@ yyreduce:
     break;
 
   case 234:
-
-/* Line 1455 of yacc.c  */
-#line 930 "../../JavaScriptCore/parser/Grammar.y"
+#line 939 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), 0), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
     break;
 
   case 235:
-
-/* Line 1455 of yacc.c  */
-#line 931 "../../JavaScriptCore/parser/Grammar.y"
+#line 940 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node), ((*(yyvsp[(1) - (2)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 236:
-
-/* Line 1455 of yacc.c  */
-#line 935 "../../JavaScriptCore/parser/Grammar.y"
+#line 944 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = (yyvsp[(2) - (2)].expressionNode); ;}
     break;
 
   case 237:
-
-/* Line 1455 of yacc.c  */
-#line 939 "../../JavaScriptCore/parser/Grammar.y"
+#line 948 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = (yyvsp[(2) - (2)].expressionNode); ;}
     break;
 
   case 238:
-
-/* Line 1455 of yacc.c  */
-#line 943 "../../JavaScriptCore/parser/Grammar.y"
+#line 952 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) EmptyStatementNode(GLOBAL_DATA), 0, 0, 0, 0); ;}
     break;
 
   case 239:
-
-/* Line 1455 of yacc.c  */
-#line 947 "../../JavaScriptCore/parser/Grammar.y"
+#line 956 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 240:
-
-/* Line 1455 of yacc.c  */
-#line 949 "../../JavaScriptCore/parser/Grammar.y"
+#line 958 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 241:
-
-/* Line 1455 of yacc.c  */
-#line 955 "../../JavaScriptCore/parser/Grammar.y"
+#line 964 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
 
   case 242:
-
-/* Line 1455 of yacc.c  */
-#line 958 "../../JavaScriptCore/parser/Grammar.y"
+#line 967 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfElseNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].statementNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node), 
                                                                                          mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_funcDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(3) - (7)].expressionNode).m_features | (yyvsp[(5) - (7)].statementNode).m_features | (yyvsp[(7) - (7)].statementNode).m_features,
                                                                                          (yyvsp[(3) - (7)].expressionNode).m_numConstants + (yyvsp[(5) - (7)].statementNode).m_numConstants + (yyvsp[(7) - (7)].statementNode).m_numConstants); 
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(4) - (7)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(4) - (7)])); ;}
     break;
 
   case 243:
-
-/* Line 1455 of yacc.c  */
-#line 967 "../../JavaScriptCore/parser/Grammar.y"
+#line 976 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
-                                             DBG((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(3) - (7)])); ;}
+                                             setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(3) - (7)])); ;}
     break;
 
   case 244:
-
-/* Line 1455 of yacc.c  */
-#line 969 "../../JavaScriptCore/parser/Grammar.y"
+#line 978 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
-                                             DBG((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(3) - (7)])); ;}
+                                             setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(3) - (7)])); ;}
     break;
 
   case 245:
-
-/* Line 1455 of yacc.c  */
-#line 971 "../../JavaScriptCore/parser/Grammar.y"
+#line 980 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WhileNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
 
   case 246:
-
-/* Line 1455 of yacc.c  */
-#line 974 "../../JavaScriptCore/parser/Grammar.y"
+#line 983 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, (yyvsp[(3) - (9)].expressionNode).m_node, (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, false), (yyvsp[(9) - (9)].statementNode).m_varDeclarations, (yyvsp[(9) - (9)].statementNode).m_funcDeclarations, 
                                                                                          (yyvsp[(3) - (9)].expressionNode).m_features | (yyvsp[(5) - (9)].expressionNode).m_features | (yyvsp[(7) - (9)].expressionNode).m_features | (yyvsp[(9) - (9)].statementNode).m_features,
                                                                                          (yyvsp[(3) - (9)].expressionNode).m_numConstants + (yyvsp[(5) - (9)].expressionNode).m_numConstants + (yyvsp[(7) - (9)].expressionNode).m_numConstants + (yyvsp[(9) - (9)].statementNode).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (9)]), (yylsp[(8) - (9)])); 
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (9)]), (yylsp[(8) - (9)])); 
                                         ;}
     break;
 
   case 247:
-
-/* Line 1455 of yacc.c  */
-#line 980 "../../JavaScriptCore/parser/Grammar.y"
+#line 989 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, (yyvsp[(4) - (10)].varDeclList).m_node, (yyvsp[(6) - (10)].expressionNode).m_node, (yyvsp[(8) - (10)].expressionNode).m_node, (yyvsp[(10) - (10)].statementNode).m_node, true),
                                                                                          mergeDeclarationLists((yyvsp[(4) - (10)].varDeclList).m_varDeclarations, (yyvsp[(10) - (10)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(4) - (10)].varDeclList).m_funcDeclarations, (yyvsp[(10) - (10)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(4) - (10)].varDeclList).m_features | (yyvsp[(6) - (10)].expressionNode).m_features | (yyvsp[(8) - (10)].expressionNode).m_features | (yyvsp[(10) - (10)].statementNode).m_features,
                                                                                          (yyvsp[(4) - (10)].varDeclList).m_numConstants + (yyvsp[(6) - (10)].expressionNode).m_numConstants + (yyvsp[(8) - (10)].expressionNode).m_numConstants + (yyvsp[(10) - (10)].statementNode).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (10)]), (yylsp[(9) - (10)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (10)]), (yylsp[(9) - (10)])); ;}
     break;
 
   case 248:
-
-/* Line 1455 of yacc.c  */
-#line 987 "../../JavaScriptCore/parser/Grammar.y"
+#line 996 "../../JavaScriptCore/parser/Grammar.y"
     {
                                             ForInNode* node = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node);
-                                            SET_EXCEPTION_LOCATION(node, (yylsp[(3) - (7)]).first_column, (yylsp[(3) - (7)]).last_column, (yylsp[(5) - (7)]).last_column);
+                                            setExceptionLocation(node, (yylsp[(3) - (7)]).first_column, (yylsp[(3) - (7)]).last_column, (yylsp[(5) - (7)]).last_column);
                                             (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, (yyvsp[(7) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations,
                                                                                            (yyvsp[(3) - (7)].expressionNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features | (yyvsp[(7) - (7)].statementNode).m_features,
                                                                                            (yyvsp[(3) - (7)].expressionNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants + (yyvsp[(7) - (7)].statementNode).m_numConstants);
-                                            DBG((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(6) - (7)]));
+                                            setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(6) - (7)]));
                                         ;}
     break;
 
   case 249:
-
-/* Line 1455 of yacc.c  */
-#line 996 "../../JavaScriptCore/parser/Grammar.y"
+#line 1005 "../../JavaScriptCore/parser/Grammar.y"
     { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (8)].ident), 0, (yyvsp[(6) - (8)].expressionNode).m_node, (yyvsp[(8) - (8)].statementNode).m_node, (yylsp[(5) - (8)]).first_column, (yylsp[(5) - (8)]).first_column - (yylsp[(4) - (8)]).first_column, (yylsp[(6) - (8)]).last_column - (yylsp[(5) - (8)]).first_column);
-                                          SET_EXCEPTION_LOCATION(forIn, (yylsp[(4) - (8)]).first_column, (yylsp[(5) - (8)]).first_column + 1, (yylsp[(6) - (8)]).last_column);
+                                          setExceptionLocation(forIn, (yylsp[(4) - (8)]).first_column, (yylsp[(5) - (8)]).first_column + 1, (yylsp[(6) - (8)]).last_column);
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyvsp[(8) - (8)].statementNode).m_varDeclarations, *(yyvsp[(4) - (8)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(forIn, (yyvsp[(8) - (8)].statementNode).m_varDeclarations, (yyvsp[(8) - (8)].statementNode).m_funcDeclarations, ((*(yyvsp[(4) - (8)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(6) - (8)].expressionNode).m_features | (yyvsp[(8) - (8)].statementNode).m_features, (yyvsp[(6) - (8)].expressionNode).m_numConstants + (yyvsp[(8) - (8)].statementNode).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (8)]), (yylsp[(7) - (8)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (8)]), (yylsp[(7) - (8)])); ;}
     break;
 
   case 250:
-
-/* Line 1455 of yacc.c  */
-#line 1002 "../../JavaScriptCore/parser/Grammar.y"
+#line 1011 "../../JavaScriptCore/parser/Grammar.y"
     { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (9)].ident), (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, (yylsp[(5) - (9)]).first_column, (yylsp[(5) - (9)]).first_column - (yylsp[(4) - (9)]).first_column, (yylsp[(5) - (9)]).last_column - (yylsp[(5) - (9)]).first_column);
-                                          SET_EXCEPTION_LOCATION(forIn, (yylsp[(4) - (9)]).first_column, (yylsp[(6) - (9)]).first_column + 1, (yylsp[(7) - (9)]).last_column);
+                                          setExceptionLocation(forIn, (yylsp[(4) - (9)]).first_column, (yylsp[(6) - (9)]).first_column + 1, (yylsp[(7) - (9)]).last_column);
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyvsp[(9) - (9)].statementNode).m_varDeclarations, *(yyvsp[(4) - (9)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(forIn, (yyvsp[(9) - (9)].statementNode).m_varDeclarations, (yyvsp[(9) - (9)].statementNode).m_funcDeclarations,
                                                                                          ((*(yyvsp[(4) - (9)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(5) - (9)].expressionNode).m_features | (yyvsp[(7) - (9)].expressionNode).m_features | (yyvsp[(9) - (9)].statementNode).m_features,
                                                                                          (yyvsp[(5) - (9)].expressionNode).m_numConstants + (yyvsp[(7) - (9)].expressionNode).m_numConstants + (yyvsp[(9) - (9)].statementNode).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (9)]), (yylsp[(8) - (9)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (9)]), (yylsp[(8) - (9)])); ;}
     break;
 
   case 251:
-
-/* Line 1455 of yacc.c  */
-#line 1012 "../../JavaScriptCore/parser/Grammar.y"
+#line 1021 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(0, 0, 0); ;}
     break;
 
   case 253:
-
-/* Line 1455 of yacc.c  */
-#line 1017 "../../JavaScriptCore/parser/Grammar.y"
+#line 1026 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(0, 0, 0); ;}
     break;
 
   case 255:
-
-/* Line 1455 of yacc.c  */
-#line 1022 "../../JavaScriptCore/parser/Grammar.y"
+#line 1031 "../../JavaScriptCore/parser/Grammar.y"
     { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
+                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 256:
-
-/* Line 1455 of yacc.c  */
-#line 1026 "../../JavaScriptCore/parser/Grammar.y"
+#line 1035 "../../JavaScriptCore/parser/Grammar.y"
     { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
+                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 257:
-
-/* Line 1455 of yacc.c  */
-#line 1030 "../../JavaScriptCore/parser/Grammar.y"
+#line 1039 "../../JavaScriptCore/parser/Grammar.y"
     { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 258:
-
-/* Line 1455 of yacc.c  */
-#line 1034 "../../JavaScriptCore/parser/Grammar.y"
+#line 1043 "../../JavaScriptCore/parser/Grammar.y"
     { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
     break;
 
   case 259:
-
-/* Line 1455 of yacc.c  */
-#line 1041 "../../JavaScriptCore/parser/Grammar.y"
+#line 1050 "../../JavaScriptCore/parser/Grammar.y"
     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
+                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column);
+                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 260:
-
-/* Line 1455 of yacc.c  */
-#line 1044 "../../JavaScriptCore/parser/Grammar.y"
+#line 1053 "../../JavaScriptCore/parser/Grammar.y"
     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA), 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
+                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column);
+                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA), 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 261:
-
-/* Line 1455 of yacc.c  */
-#line 1047 "../../JavaScriptCore/parser/Grammar.y"
+#line 1056 "../../JavaScriptCore/parser/Grammar.y"
     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
+                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 262:
-
-/* Line 1455 of yacc.c  */
-#line 1050 "../../JavaScriptCore/parser/Grammar.y"
+#line 1059 "../../JavaScriptCore/parser/Grammar.y"
     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident)), 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
+                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident)), 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
     break;
 
   case 263:
-
-/* Line 1455 of yacc.c  */
-#line 1056 "../../JavaScriptCore/parser/Grammar.y"
+#line 1065 "../../JavaScriptCore/parser/Grammar.y"
     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
+                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
+                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 264:
-
-/* Line 1455 of yacc.c  */
-#line 1059 "../../JavaScriptCore/parser/Grammar.y"
+#line 1068 "../../JavaScriptCore/parser/Grammar.y"
     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
+                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
+                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 265:
-
-/* Line 1455 of yacc.c  */
-#line 1062 "../../JavaScriptCore/parser/Grammar.y"
+#line 1071 "../../JavaScriptCore/parser/Grammar.y"
     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
+                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 266:
-
-/* Line 1455 of yacc.c  */
-#line 1065 "../../JavaScriptCore/parser/Grammar.y"
+#line 1074 "../../JavaScriptCore/parser/Grammar.y"
     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
+                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
     break;
 
   case 267:
-
-/* Line 1455 of yacc.c  */
-#line 1071 "../../JavaScriptCore/parser/Grammar.y"
+#line 1080 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WithNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node, (yylsp[(3) - (5)]).last_column, (yylsp[(3) - (5)]).last_column - (yylsp[(3) - (5)]).first_column),
                                                                                          (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features | WithFeature, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
 
   case 268:
-
-/* Line 1455 of yacc.c  */
-#line 1077 "../../JavaScriptCore/parser/Grammar.y"
+#line 1086 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) SwitchNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].caseBlockNode).m_node), (yyvsp[(5) - (5)].caseBlockNode).m_varDeclarations, (yyvsp[(5) - (5)].caseBlockNode).m_funcDeclarations,
                                                                                          (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].caseBlockNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].caseBlockNode).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
 
   case 269:
-
-/* Line 1455 of yacc.c  */
-#line 1083 "../../JavaScriptCore/parser/Grammar.y"
+#line 1092 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].clauseList).m_node.head, 0, 0), (yyvsp[(2) - (3)].clauseList).m_varDeclarations, (yyvsp[(2) - (3)].clauseList).m_funcDeclarations, (yyvsp[(2) - (3)].clauseList).m_features, (yyvsp[(2) - (3)].clauseList).m_numConstants); ;}
     break;
 
   case 270:
-
-/* Line 1455 of yacc.c  */
-#line 1085 "../../JavaScriptCore/parser/Grammar.y"
+#line 1094 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (5)].clauseList).m_node.head, (yyvsp[(3) - (5)].caseClauseNode).m_node, (yyvsp[(4) - (5)].clauseList).m_node.head),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (5)].clauseList).m_varDeclarations, (yyvsp[(3) - (5)].caseClauseNode).m_varDeclarations), (yyvsp[(4) - (5)].clauseList).m_varDeclarations),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (5)].clauseList).m_funcDeclarations, (yyvsp[(3) - (5)].caseClauseNode).m_funcDeclarations), (yyvsp[(4) - (5)].clauseList).m_funcDeclarations),
@@ -4580,16 +4236,12 @@ yyreduce:
     break;
 
   case 271:
-
-/* Line 1455 of yacc.c  */
-#line 1093 "../../JavaScriptCore/parser/Grammar.y"
+#line 1102 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.clauseList).m_node.head = 0; (yyval.clauseList).m_node.tail = 0; (yyval.clauseList).m_varDeclarations = 0; (yyval.clauseList).m_funcDeclarations = 0; (yyval.clauseList).m_features = 0; (yyval.clauseList).m_numConstants = 0; ;}
     break;
 
   case 273:
-
-/* Line 1455 of yacc.c  */
-#line 1098 "../../JavaScriptCore/parser/Grammar.y"
+#line 1107 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.clauseList).m_node.head = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].caseClauseNode).m_node);
                                           (yyval.clauseList).m_node.tail = (yyval.clauseList).m_node.head;
                                           (yyval.clauseList).m_varDeclarations = (yyvsp[(1) - (1)].caseClauseNode).m_varDeclarations;
@@ -4599,9 +4251,7 @@ yyreduce:
     break;
 
   case 274:
-
-/* Line 1455 of yacc.c  */
-#line 1104 "../../JavaScriptCore/parser/Grammar.y"
+#line 1113 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.clauseList).m_node.head = (yyvsp[(1) - (2)].clauseList).m_node.head;
                                           (yyval.clauseList).m_node.tail = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (2)].clauseList).m_node.tail, (yyvsp[(2) - (2)].caseClauseNode).m_node);
                                           (yyval.clauseList).m_varDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].clauseList).m_varDeclarations, (yyvsp[(2) - (2)].caseClauseNode).m_varDeclarations);
@@ -4612,223 +4262,173 @@ yyreduce:
     break;
 
   case 275:
-
-/* Line 1455 of yacc.c  */
-#line 1114 "../../JavaScriptCore/parser/Grammar.y"
+#line 1123 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node), 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 276:
-
-/* Line 1455 of yacc.c  */
-#line 1115 "../../JavaScriptCore/parser/Grammar.y"
+#line 1124 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].sourceElements).m_node), (yyvsp[(4) - (4)].sourceElements).m_varDeclarations, (yyvsp[(4) - (4)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (4)].expressionNode).m_features | (yyvsp[(4) - (4)].sourceElements).m_features, (yyvsp[(2) - (4)].expressionNode).m_numConstants + (yyvsp[(4) - (4)].sourceElements).m_numConstants); ;}
     break;
 
   case 277:
-
-/* Line 1455 of yacc.c  */
-#line 1119 "../../JavaScriptCore/parser/Grammar.y"
+#line 1128 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0), 0, 0, 0, 0); ;}
     break;
 
   case 278:
-
-/* Line 1455 of yacc.c  */
-#line 1120 "../../JavaScriptCore/parser/Grammar.y"
+#line 1129 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0, (yyvsp[(3) - (3)].sourceElements).m_node), (yyvsp[(3) - (3)].sourceElements).m_varDeclarations, (yyvsp[(3) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(3) - (3)].sourceElements).m_features, (yyvsp[(3) - (3)].sourceElements).m_numConstants); ;}
     break;
 
   case 279:
-
-/* Line 1455 of yacc.c  */
-#line 1124 "../../JavaScriptCore/parser/Grammar.y"
+#line 1133 "../../JavaScriptCore/parser/Grammar.y"
     { LabelNode* node = new (GLOBAL_DATA) LabelNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].statementNode).m_node);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, (yyvsp[(3) - (3)].statementNode).m_varDeclarations, (yyvsp[(3) - (3)].statementNode).m_funcDeclarations, (yyvsp[(3) - (3)].statementNode).m_features, (yyvsp[(3) - (3)].statementNode).m_numConstants); ;}
     break;
 
   case 280:
-
-/* Line 1455 of yacc.c  */
-#line 1130 "../../JavaScriptCore/parser/Grammar.y"
+#line 1139 "../../JavaScriptCore/parser/Grammar.y"
     { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)]));
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
+                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)]));
                                         ;}
     break;
 
   case 281:
-
-/* Line 1455 of yacc.c  */
-#line 1134 "../../JavaScriptCore/parser/Grammar.y"
+#line 1143 "../../JavaScriptCore/parser/Grammar.y"
     { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
-                                          SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; 
+                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
+                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; 
                                         ;}
     break;
 
   case 282:
-
-/* Line 1455 of yacc.c  */
-#line 1141 "../../JavaScriptCore/parser/Grammar.y"
+#line 1150 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (4)].statementNode).m_node, GLOBAL_DATA->propertyNames->nullIdentifier, false, 0, (yyvsp[(4) - (4)].statementNode).m_node),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (4)].statementNode).m_varDeclarations, (yyvsp[(4) - (4)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (4)].statementNode).m_funcDeclarations, (yyvsp[(4) - (4)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(2) - (4)].statementNode).m_features | (yyvsp[(4) - (4)].statementNode).m_features,
                                                                                          (yyvsp[(2) - (4)].statementNode).m_numConstants + (yyvsp[(4) - (4)].statementNode).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (4)]), (yylsp[(2) - (4)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (4)]), (yylsp[(2) - (4)])); ;}
     break;
 
   case 283:
-
-/* Line 1455 of yacc.c  */
-#line 1147 "../../JavaScriptCore/parser/Grammar.y"
+#line 1156 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, *(yyvsp[(5) - (7)].ident), ((yyvsp[(7) - (7)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (7)].statementNode).m_node, 0),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(7) - (7)].statementNode).m_features | CatchFeature,
                                                                                          (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(7) - (7)].statementNode).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(2) - (7)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(2) - (7)])); ;}
     break;
 
   case 284:
-
-/* Line 1455 of yacc.c  */
-#line 1154 "../../JavaScriptCore/parser/Grammar.y"
+#line 1163 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (9)].statementNode).m_node, *(yyvsp[(5) - (9)].ident), ((yyvsp[(7) - (9)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (9)].statementNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (9)].statementNode).m_varDeclarations, (yyvsp[(7) - (9)].statementNode).m_varDeclarations), (yyvsp[(9) - (9)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (9)].statementNode).m_funcDeclarations, (yyvsp[(7) - (9)].statementNode).m_funcDeclarations), (yyvsp[(9) - (9)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(2) - (9)].statementNode).m_features | (yyvsp[(7) - (9)].statementNode).m_features | (yyvsp[(9) - (9)].statementNode).m_features | CatchFeature,
                                                                                          (yyvsp[(2) - (9)].statementNode).m_numConstants + (yyvsp[(7) - (9)].statementNode).m_numConstants + (yyvsp[(9) - (9)].statementNode).m_numConstants);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (9)]), (yylsp[(2) - (9)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (9)]), (yylsp[(2) - (9)])); ;}
     break;
 
   case 285:
-
-/* Line 1455 of yacc.c  */
-#line 1163 "../../JavaScriptCore/parser/Grammar.y"
+#line 1172 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 286:
-
-/* Line 1455 of yacc.c  */
-#line 1165 "../../JavaScriptCore/parser/Grammar.y"
+#line 1174 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
-                                          DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
+                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 287:
-
-/* Line 1455 of yacc.c  */
-#line 1170 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), LEXER->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*(yyvsp[(2) - (7)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | ClosureFeature, 0); DBG((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); (yyval.statementNode).m_funcDeclarations->data.append(static_cast<FuncDeclNode*>((yyval.statementNode).m_node)); ;}
+#line 1179 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*(yyvsp[(2) - (7)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | ClosureFeature, 0); setStatementLocation((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); (yyval.statementNode).m_funcDeclarations->data.append(static_cast<FuncDeclNode*>((yyval.statementNode).m_node)->body()); ;}
     break;
 
   case 288:
-
-/* Line 1455 of yacc.c  */
-#line 1172 "../../JavaScriptCore/parser/Grammar.y"
-    { 
-          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), LEXER->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*(yyvsp[(2) - (8)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
+#line 1181 "../../JavaScriptCore/parser/Grammar.y"
+    {
+          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*(yyvsp[(2) - (8)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0);
           if ((yyvsp[(4) - (8)].parameterList).m_features & ArgumentsFeature)
-              (yyvsp[(7) - (8)].functionBodyNode)->setUsesArguments(); 
-          DBG((yyvsp[(7) - (8)].functionBodyNode), (yylsp[(6) - (8)]), (yylsp[(8) - (8)]));
-          (yyval.statementNode).m_funcDeclarations->data.append(static_cast<FuncDeclNode*>((yyval.statementNode).m_node));
+              (yyvsp[(7) - (8)].functionBodyNode)->setUsesArguments();
+          setStatementLocation((yyvsp[(7) - (8)].functionBodyNode), (yylsp[(6) - (8)]), (yylsp[(8) - (8)]));
+          (yyval.statementNode).m_funcDeclarations->data.append(static_cast<FuncDeclNode*>((yyval.statementNode).m_node)->body());
       ;}
     break;
 
   case 289:
-
-/* Line 1455 of yacc.c  */
-#line 1182 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.funcExprNode) = createNodeInfo(new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, (yyvsp[(5) - (6)].functionBodyNode), LEXER->sourceCode((yyvsp[(4) - (6)].intValue), (yyvsp[(6) - (6)].intValue), (yylsp[(4) - (6)]).first_line)), ClosureFeature, 0); DBG((yyvsp[(5) - (6)].functionBodyNode), (yylsp[(4) - (6)]), (yylsp[(6) - (6)])); ;}
+#line 1191 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, (yyvsp[(5) - (6)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(4) - (6)].intValue), (yyvsp[(6) - (6)].intValue), (yylsp[(4) - (6)]).first_line)), ClosureFeature, 0); setStatementLocation((yyvsp[(5) - (6)].functionBodyNode), (yylsp[(4) - (6)]), (yylsp[(6) - (6)])); ;}
     break;
 
   case 290:
-
-/* Line 1455 of yacc.c  */
-#line 1184 "../../JavaScriptCore/parser/Grammar.y"
-    { 
-          (yyval.funcExprNode) = createNodeInfo(new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, (yyvsp[(6) - (7)].functionBodyNode), LEXER->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line), (yyvsp[(3) - (7)].parameterList).m_node.head), (yyvsp[(3) - (7)].parameterList).m_features | ClosureFeature, 0); 
-          if ((yyvsp[(3) - (7)].parameterList).m_features & ArgumentsFeature) 
+#line 1193 "../../JavaScriptCore/parser/Grammar.y"
+    {
+          (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line), (yyvsp[(3) - (7)].parameterList).m_node.head), (yyvsp[(3) - (7)].parameterList).m_features | ClosureFeature, 0);
+          if ((yyvsp[(3) - (7)].parameterList).m_features & ArgumentsFeature)
               (yyvsp[(6) - (7)].functionBodyNode)->setUsesArguments();
-          DBG((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); 
+          setStatementLocation((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)]));
       ;}
     break;
 
   case 291:
-
-/* Line 1455 of yacc.c  */
-#line 1190 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.funcExprNode) = createNodeInfo(new FuncExprNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), LEXER->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), ClosureFeature, 0); DBG((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); ;}
+#line 1199 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), ClosureFeature, 0); setStatementLocation((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); ;}
     break;
 
   case 292:
-
-/* Line 1455 of yacc.c  */
-#line 1192 "../../JavaScriptCore/parser/Grammar.y"
-    { 
-          (yyval.funcExprNode) = createNodeInfo(new FuncExprNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), LEXER->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
+#line 1201 "../../JavaScriptCore/parser/Grammar.y"
+    {
+          (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
           if ((yyvsp[(4) - (8)].parameterList).m_features & ArgumentsFeature)
               (yyvsp[(7) - (8)].functionBodyNode)->setUsesArguments();
-          DBG((yyvsp[(7) - (8)].functionBodyNode), (yylsp[(6) - (8)]), (yylsp[(8) - (8)])); 
+          setStatementLocation((yyvsp[(7) - (8)].functionBodyNode), (yylsp[(6) - (8)]), (yylsp[(8) - (8)]));
       ;}
     break;
 
   case 293:
-
-/* Line 1455 of yacc.c  */
-#line 1201 "../../JavaScriptCore/parser/Grammar.y"
+#line 1210 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.parameterList).m_node.head = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident));
                                           (yyval.parameterList).m_features = (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
                                           (yyval.parameterList).m_node.tail = (yyval.parameterList).m_node.head; ;}
     break;
 
   case 294:
-
-/* Line 1455 of yacc.c  */
-#line 1204 "../../JavaScriptCore/parser/Grammar.y"
+#line 1213 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.parameterList).m_node.head = (yyvsp[(1) - (3)].parameterList).m_node.head;
                                           (yyval.parameterList).m_features = (yyvsp[(1) - (3)].parameterList).m_features | ((*(yyvsp[(3) - (3)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0);
                                           (yyval.parameterList).m_node.tail = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].parameterList).m_node.tail, *(yyvsp[(3) - (3)].ident));  ;}
     break;
 
   case 295:
-
-/* Line 1455 of yacc.c  */
-#line 1210 "../../JavaScriptCore/parser/Grammar.y"
+#line 1219 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.functionBodyNode) = FunctionBodyNode::create(GLOBAL_DATA); ;}
     break;
 
   case 296:
-
-/* Line 1455 of yacc.c  */
-#line 1211 "../../JavaScriptCore/parser/Grammar.y"
+#line 1220 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.functionBodyNode) = FunctionBodyNode::create(GLOBAL_DATA); ;}
     break;
 
   case 297:
-
-/* Line 1455 of yacc.c  */
-#line 1215 "../../JavaScriptCore/parser/Grammar.y"
+#line 1224 "../../JavaScriptCore/parser/Grammar.y"
     { GLOBAL_DATA->parser->didFinishParsing(new (GLOBAL_DATA) SourceElements(GLOBAL_DATA), 0, 0, NoFeatures, (yylsp[(0) - (0)]).last_line, 0); ;}
     break;
 
   case 298:
-
-/* Line 1455 of yacc.c  */
-#line 1216 "../../JavaScriptCore/parser/Grammar.y"
+#line 1225 "../../JavaScriptCore/parser/Grammar.y"
     { GLOBAL_DATA->parser->didFinishParsing((yyvsp[(1) - (1)].sourceElements).m_node, (yyvsp[(1) - (1)].sourceElements).m_varDeclarations, (yyvsp[(1) - (1)].sourceElements).m_funcDeclarations, (yyvsp[(1) - (1)].sourceElements).m_features, 
                                                                                 (yylsp[(1) - (1)]).last_line, (yyvsp[(1) - (1)].sourceElements).m_numConstants); ;}
     break;
 
   case 299:
-
-/* Line 1455 of yacc.c  */
-#line 1221 "../../JavaScriptCore/parser/Grammar.y"
+#line 1230 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.sourceElements).m_node = new (GLOBAL_DATA) SourceElements(GLOBAL_DATA);
                                           (yyval.sourceElements).m_node->append((yyvsp[(1) - (1)].statementNode).m_node);
                                           (yyval.sourceElements).m_varDeclarations = (yyvsp[(1) - (1)].statementNode).m_varDeclarations;
@@ -4839,9 +4439,7 @@ yyreduce:
     break;
 
   case 300:
-
-/* Line 1455 of yacc.c  */
-#line 1228 "../../JavaScriptCore/parser/Grammar.y"
+#line 1237 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.sourceElements).m_node->append((yyvsp[(2) - (2)].statementNode).m_node);
                                           (yyval.sourceElements).m_varDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].sourceElements).m_varDeclarations, (yyvsp[(2) - (2)].statementNode).m_varDeclarations);
                                           (yyval.sourceElements).m_funcDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (2)].statementNode).m_funcDeclarations);
@@ -4851,261 +4449,188 @@ yyreduce:
     break;
 
   case 304:
-
-/* Line 1455 of yacc.c  */
-#line 1242 "../../JavaScriptCore/parser/Grammar.y"
+#line 1251 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 305:
-
-/* Line 1455 of yacc.c  */
-#line 1243 "../../JavaScriptCore/parser/Grammar.y"
+#line 1252 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 306:
-
-/* Line 1455 of yacc.c  */
-#line 1244 "../../JavaScriptCore/parser/Grammar.y"
-    { Lexer& l = *LEXER; if (!l.scanRegExp()) YYABORT; ;}
+#line 1253 "../../JavaScriptCore/parser/Grammar.y"
+    { if (!GLOBAL_DATA->lexer->skipRegExp()) YYABORT; ;}
     break;
 
   case 307:
-
-/* Line 1455 of yacc.c  */
-#line 1245 "../../JavaScriptCore/parser/Grammar.y"
-    { Lexer& l = *LEXER; if (!l.scanRegExp()) YYABORT; ;}
+#line 1254 "../../JavaScriptCore/parser/Grammar.y"
+    { if (!GLOBAL_DATA->lexer->skipRegExp()) YYABORT; ;}
     break;
 
   case 308:
-
-/* Line 1455 of yacc.c  */
-#line 1249 "../../JavaScriptCore/parser/Grammar.y"
+#line 1258 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 309:
-
-/* Line 1455 of yacc.c  */
-#line 1250 "../../JavaScriptCore/parser/Grammar.y"
+#line 1259 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 310:
-
-/* Line 1455 of yacc.c  */
-#line 1251 "../../JavaScriptCore/parser/Grammar.y"
+#line 1260 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 311:
-
-/* Line 1455 of yacc.c  */
-#line 1252 "../../JavaScriptCore/parser/Grammar.y"
+#line 1261 "../../JavaScriptCore/parser/Grammar.y"
     { if (*(yyvsp[(1) - (7)].ident) != "get" && *(yyvsp[(1) - (7)].ident) != "set") YYABORT; ;}
     break;
 
   case 312:
-
-/* Line 1455 of yacc.c  */
-#line 1253 "../../JavaScriptCore/parser/Grammar.y"
+#line 1262 "../../JavaScriptCore/parser/Grammar.y"
     { if (*(yyvsp[(1) - (8)].ident) != "get" && *(yyvsp[(1) - (8)].ident) != "set") YYABORT; ;}
     break;
 
   case 316:
-
-/* Line 1455 of yacc.c  */
-#line 1263 "../../JavaScriptCore/parser/Grammar.y"
+#line 1272 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 317:
-
-/* Line 1455 of yacc.c  */
-#line 1264 "../../JavaScriptCore/parser/Grammar.y"
+#line 1273 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 318:
-
-/* Line 1455 of yacc.c  */
-#line 1266 "../../JavaScriptCore/parser/Grammar.y"
+#line 1275 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 322:
-
-/* Line 1455 of yacc.c  */
-#line 1273 "../../JavaScriptCore/parser/Grammar.y"
+#line 1282 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 517:
-
-/* Line 1455 of yacc.c  */
-#line 1641 "../../JavaScriptCore/parser/Grammar.y"
+#line 1650 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 518:
-
-/* Line 1455 of yacc.c  */
-#line 1642 "../../JavaScriptCore/parser/Grammar.y"
+#line 1651 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 520:
-
-/* Line 1455 of yacc.c  */
-#line 1647 "../../JavaScriptCore/parser/Grammar.y"
+#line 1656 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 521:
-
-/* Line 1455 of yacc.c  */
-#line 1651 "../../JavaScriptCore/parser/Grammar.y"
+#line 1660 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 522:
-
-/* Line 1455 of yacc.c  */
-#line 1652 "../../JavaScriptCore/parser/Grammar.y"
+#line 1661 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 525:
-
-/* Line 1455 of yacc.c  */
-#line 1658 "../../JavaScriptCore/parser/Grammar.y"
+#line 1667 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 526:
-
-/* Line 1455 of yacc.c  */
-#line 1659 "../../JavaScriptCore/parser/Grammar.y"
+#line 1668 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 530:
-
-/* Line 1455 of yacc.c  */
-#line 1666 "../../JavaScriptCore/parser/Grammar.y"
+#line 1675 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 533:
-
-/* Line 1455 of yacc.c  */
-#line 1675 "../../JavaScriptCore/parser/Grammar.y"
+#line 1684 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 534:
-
-/* Line 1455 of yacc.c  */
-#line 1676 "../../JavaScriptCore/parser/Grammar.y"
+#line 1685 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 539:
-
-/* Line 1455 of yacc.c  */
-#line 1693 "../../JavaScriptCore/parser/Grammar.y"
+#line 1702 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 555:
-
-/* Line 1455 of yacc.c  */
-#line 1724 "../../JavaScriptCore/parser/Grammar.y"
+#line 1733 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 557:
-
-/* Line 1455 of yacc.c  */
-#line 1726 "../../JavaScriptCore/parser/Grammar.y"
+#line 1735 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 559:
-
-/* Line 1455 of yacc.c  */
-#line 1731 "../../JavaScriptCore/parser/Grammar.y"
+#line 1740 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 561:
-
-/* Line 1455 of yacc.c  */
-#line 1733 "../../JavaScriptCore/parser/Grammar.y"
+#line 1742 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 563:
-
-/* Line 1455 of yacc.c  */
-#line 1738 "../../JavaScriptCore/parser/Grammar.y"
+#line 1747 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 565:
-
-/* Line 1455 of yacc.c  */
-#line 1740 "../../JavaScriptCore/parser/Grammar.y"
+#line 1749 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 568:
-
-/* Line 1455 of yacc.c  */
-#line 1752 "../../JavaScriptCore/parser/Grammar.y"
+#line 1761 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 569:
-
-/* Line 1455 of yacc.c  */
-#line 1753 "../../JavaScriptCore/parser/Grammar.y"
+#line 1762 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 578:
-
-/* Line 1455 of yacc.c  */
-#line 1777 "../../JavaScriptCore/parser/Grammar.y"
+#line 1786 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 580:
-
-/* Line 1455 of yacc.c  */
-#line 1782 "../../JavaScriptCore/parser/Grammar.y"
+#line 1791 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 585:
-
-/* Line 1455 of yacc.c  */
-#line 1793 "../../JavaScriptCore/parser/Grammar.y"
+#line 1802 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 592:
-
-/* Line 1455 of yacc.c  */
-#line 1809 "../../JavaScriptCore/parser/Grammar.y"
+#line 1818 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
 
-
-/* Line 1455 of yacc.c  */
-#line 5109 "WebCore/tmp/../generated/Grammar.tab.c"
+/* Line 1267 of yacc.c.  */
+#line 4634 "WebCore/tmp/../generated/Grammar.tab.c"
       default: break;
     }
   YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
@@ -5181,7 +4706,7 @@ yyerrlab:
 
   if (yyerrstatus == 3)
     {
-      /* If just tried and failed to reuse lookahead token after an
+      /* If just tried and failed to reuse look-ahead token after an
 	 error, discard it.  */
 
       if (yychar <= YYEOF)
@@ -5198,7 +4723,7 @@ yyerrlab:
 	}
     }
 
-  /* Else will try to reuse lookahead token after shifting the error
+  /* Else will try to reuse look-ahead token after shifting the error
      token.  */
   goto yyerrlab1;
 
@@ -5256,11 +4781,14 @@ yyerrlab1:
       YY_STACK_PRINT (yyss, yyssp);
     }
 
+  if (yyn == YYFINAL)
+    YYACCEPT;
+
   *++yyvsp = yylval;
 
   yyerror_range[1] = yylloc;
   /* Using YYLLOC is tempting, but would change the location of
-     the lookahead.  YYLOC is available though.  */
+     the look-ahead.  YYLOC is available though.  */
   YYLLOC_DEFAULT (yyloc, (yyerror_range - 1), 2);
   *++yylsp = yyloc;
 
@@ -5285,7 +4813,7 @@ yyabortlab:
   yyresult = 1;
   goto yyreturn;
 
-#if !defined(yyoverflow) || YYERROR_VERBOSE
+#ifndef yyoverflow
 /*-------------------------------------------------.
 | yyexhaustedlab -- memory exhaustion comes here.  |
 `-------------------------------------------------*/
@@ -5296,7 +4824,7 @@ yyexhaustedlab:
 #endif
 
 yyreturn:
-  if (yychar != YYEMPTY)
+  if (yychar != YYEOF && yychar != YYEMPTY)
      yydestruct ("Cleanup: discarding lookahead",
 		 yytoken, &yylval, &yylloc);
   /* Do not reclaim the symbols of the rule which action triggered
@@ -5322,31 +4850,31 @@ yyreturn:
 }
 
 
+#line 1834 "../../JavaScriptCore/parser/Grammar.y"
 
-/* Line 1675 of yacc.c  */
-#line 1825 "../../JavaScriptCore/parser/Grammar.y"
 
+#undef GLOBAL_DATA
 
-static ExpressionNode* makeAssignNode(void* globalPtr, ExpressionNode* loc, Operator op, ExpressionNode* expr, bool locHasAssignments, bool exprHasAssignments, int start, int divot, int end)
+static ExpressionNode* makeAssignNode(JSGlobalData* globalData, ExpressionNode* loc, Operator op, ExpressionNode* expr, bool locHasAssignments, bool exprHasAssignments, int start, int divot, int end)
 {
     if (!loc->isLocation())
-        return new (GLOBAL_DATA) AssignErrorNode(GLOBAL_DATA, loc, op, expr, divot, divot - start, end - divot);
+        return new (globalData) AssignErrorNode(globalData, loc, op, expr, divot, divot - start, end - divot);
 
     if (loc->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(loc);
         if (op == OpEqual) {
-            AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, resolve->identifier(), expr, exprHasAssignments);
-            SET_EXCEPTION_LOCATION(node, start, divot, end);
+            AssignResolveNode* node = new (globalData) AssignResolveNode(globalData, resolve->identifier(), expr, exprHasAssignments);
+            setExceptionLocation(node, start, divot, end);
             return node;
         } else
-            return new (GLOBAL_DATA) ReadModifyResolveNode(GLOBAL_DATA, resolve->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
+            return new (globalData) ReadModifyResolveNode(globalData, resolve->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
     }
     if (loc->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(loc);
         if (op == OpEqual)
-            return new (GLOBAL_DATA) AssignBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), expr, locHasAssignments, exprHasAssignments, bracket->divot(), bracket->divot() - start, end - bracket->divot());
+            return new (globalData) AssignBracketNode(globalData, bracket->base(), bracket->subscript(), expr, locHasAssignments, exprHasAssignments, bracket->divot(), bracket->divot() - start, end - bracket->divot());
         else {
-            ReadModifyBracketNode* node = new (GLOBAL_DATA) ReadModifyBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, expr, locHasAssignments, exprHasAssignments, divot, divot - start, end - divot);
+            ReadModifyBracketNode* node = new (globalData) ReadModifyBracketNode(globalData, bracket->base(), bracket->subscript(), op, expr, locHasAssignments, exprHasAssignments, divot, divot - start, end - divot);
             node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
             return node;
         }
@@ -5354,117 +4882,117 @@ static ExpressionNode* makeAssignNode(void* globalPtr, ExpressionNode* loc, Oper
     ASSERT(loc->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(loc);
     if (op == OpEqual)
-        return new (GLOBAL_DATA) AssignDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), expr, exprHasAssignments, dot->divot(), dot->divot() - start, end - dot->divot());
+        return new (globalData) AssignDotNode(globalData, dot->base(), dot->identifier(), expr, exprHasAssignments, dot->divot(), dot->divot() - start, end - dot->divot());
 
-    ReadModifyDotNode* node = new (GLOBAL_DATA) ReadModifyDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
+    ReadModifyDotNode* node = new (globalData) ReadModifyDotNode(globalData, dot->base(), dot->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return node;
 }
 
-static ExpressionNode* makePrefixNode(void* globalPtr, ExpressionNode* expr, Operator op, int start, int divot, int end)
+static ExpressionNode* makePrefixNode(JSGlobalData* globalData, ExpressionNode* expr, Operator op, int start, int divot, int end)
 {
     if (!expr->isLocation())
-        return new (GLOBAL_DATA) PrefixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
+        return new (globalData) PrefixErrorNode(globalData, expr, op, divot, divot - start, end - divot);
     
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (GLOBAL_DATA) PrefixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
+        return new (globalData) PrefixResolveNode(globalData, resolve->identifier(), op, divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PrefixBracketNode* node = new (GLOBAL_DATA) PrefixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
+        PrefixBracketNode* node = new (globalData) PrefixBracketNode(globalData, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->startOffset());
         return node;
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PrefixDotNode* node = new (GLOBAL_DATA) PrefixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
+    PrefixDotNode* node = new (globalData) PrefixDotNode(globalData, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->startOffset());
     return node;
 }
 
-static ExpressionNode* makePostfixNode(void* globalPtr, ExpressionNode* expr, Operator op, int start, int divot, int end)
+static ExpressionNode* makePostfixNode(JSGlobalData* globalData, ExpressionNode* expr, Operator op, int start, int divot, int end)
 { 
     if (!expr->isLocation())
-        return new (GLOBAL_DATA) PostfixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
+        return new (globalData) PostfixErrorNode(globalData, expr, op, divot, divot - start, end - divot);
     
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (GLOBAL_DATA) PostfixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
+        return new (globalData) PostfixResolveNode(globalData, resolve->identifier(), op, divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PostfixBracketNode* node = new (GLOBAL_DATA) PostfixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
+        PostfixBracketNode* node = new (globalData) PostfixBracketNode(globalData, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
         return node;
         
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PostfixDotNode* node = new (GLOBAL_DATA) PostfixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
+    PostfixDotNode* node = new (globalData) PostfixDotNode(globalData, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return node;
 }
 
-static ExpressionNodeInfo makeFunctionCallNode(void* globalPtr, ExpressionNodeInfo func, ArgumentsNodeInfo args, int start, int divot, int end)
+static ExpressionNodeInfo makeFunctionCallNode(JSGlobalData* globalData, ExpressionNodeInfo func, ArgumentsNodeInfo args, int start, int divot, int end)
 {
     CodeFeatures features = func.m_features | args.m_features;
     int numConstants = func.m_numConstants + args.m_numConstants;
     if (!func.m_node->isLocation())
-        return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) FunctionCallValueNode(GLOBAL_DATA, func.m_node, args.m_node, divot, divot - start, end - divot), features, numConstants);
+        return createNodeInfo<ExpressionNode*>(new (globalData) FunctionCallValueNode(globalData, func.m_node, args.m_node, divot, divot - start, end - divot), features, numConstants);
     if (func.m_node->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(func.m_node);
         const Identifier& identifier = resolve->identifier();
-        if (identifier == GLOBAL_DATA->propertyNames->eval)
-            return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EvalFunctionCallNode(GLOBAL_DATA, args.m_node, divot, divot - start, end - divot), EvalFeature | features, numConstants);
-        return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) FunctionCallResolveNode(GLOBAL_DATA, identifier, args.m_node, divot, divot - start, end - divot), features, numConstants);
+        if (identifier == globalData->propertyNames->eval)
+            return createNodeInfo<ExpressionNode*>(new (globalData) EvalFunctionCallNode(globalData, args.m_node, divot, divot - start, end - divot), EvalFeature | features, numConstants);
+        return createNodeInfo<ExpressionNode*>(new (globalData) FunctionCallResolveNode(globalData, identifier, args.m_node, divot, divot - start, end - divot), features, numConstants);
     }
     if (func.m_node->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(func.m_node);
-        FunctionCallBracketNode* node = new (GLOBAL_DATA) FunctionCallBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), args.m_node, divot, divot - start, end - divot);
+        FunctionCallBracketNode* node = new (globalData) FunctionCallBracketNode(globalData, bracket->base(), bracket->subscript(), args.m_node, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
         return createNodeInfo<ExpressionNode*>(node, features, numConstants);
     }
     ASSERT(func.m_node->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(func.m_node);
     FunctionCallDotNode* node;
-    if (dot->identifier() == GLOBAL_DATA->propertyNames->call)
-        node = new (GLOBAL_DATA) CallFunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
-    else if (dot->identifier() == GLOBAL_DATA->propertyNames->apply)
-        node = new (GLOBAL_DATA) ApplyFunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+    if (dot->identifier() == globalData->propertyNames->call)
+        node = new (globalData) CallFunctionCallDotNode(globalData, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+    else if (dot->identifier() == globalData->propertyNames->apply)
+        node = new (globalData) ApplyFunctionCallDotNode(globalData, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
     else
-        node = new (GLOBAL_DATA) FunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+        node = new (globalData) FunctionCallDotNode(globalData, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return createNodeInfo<ExpressionNode*>(node, features, numConstants);
 }
 
-static ExpressionNode* makeTypeOfNode(void* globalPtr, ExpressionNode* expr)
+static ExpressionNode* makeTypeOfNode(JSGlobalData* globalData, ExpressionNode* expr)
 {
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (GLOBAL_DATA) TypeOfResolveNode(GLOBAL_DATA, resolve->identifier());
+        return new (globalData) TypeOfResolveNode(globalData, resolve->identifier());
     }
-    return new (GLOBAL_DATA) TypeOfValueNode(GLOBAL_DATA, expr);
+    return new (globalData) TypeOfValueNode(globalData, expr);
 }
 
-static ExpressionNode* makeDeleteNode(void* globalPtr, ExpressionNode* expr, int start, int divot, int end)
+static ExpressionNode* makeDeleteNode(JSGlobalData* globalData, ExpressionNode* expr, int start, int divot, int end)
 {
     if (!expr->isLocation())
-        return new (GLOBAL_DATA) DeleteValueNode(GLOBAL_DATA, expr);
+        return new (globalData) DeleteValueNode(globalData, expr);
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (GLOBAL_DATA) DeleteResolveNode(GLOBAL_DATA, resolve->identifier(), divot, divot - start, end - divot);
+        return new (globalData) DeleteResolveNode(globalData, resolve->identifier(), divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        return new (GLOBAL_DATA) DeleteBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), divot, divot - start, end - divot);
+        return new (globalData) DeleteBracketNode(globalData, bracket->base(), bracket->subscript(), divot, divot - start, end - divot);
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    return new (GLOBAL_DATA) DeleteDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), divot, divot - start, end - divot);
+    return new (globalData) DeleteDotNode(globalData, dot->base(), dot->identifier(), divot, divot - start, end - divot);
 }
 
-static PropertyNode* makeGetterOrSetterPropertyNode(void* globalPtr, const Identifier& getOrSet, const Identifier& name, ParameterNode* params, FunctionBodyNode* body, const SourceCode& source)
+static PropertyNode* makeGetterOrSetterPropertyNode(JSGlobalData* globalData, const Identifier& getOrSet, const Identifier& name, ParameterNode* params, FunctionBodyNode* body, const SourceCode& source)
 {
     PropertyNode::Type type;
     if (getOrSet == "get")
@@ -5473,10 +5001,10 @@ static PropertyNode* makeGetterOrSetterPropertyNode(void* globalPtr, const Ident
         type = PropertyNode::Setter;
     else
         return 0;
-    return new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, name, new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, body, source, params), type);
+    return new (globalData) PropertyNode(globalData, name, new (globalData) FuncExprNode(globalData, globalData->propertyNames->nullIdentifier, body, source, params), type);
 }
 
-static ExpressionNode* makeNegateNode(void* globalPtr, ExpressionNode* n)
+static ExpressionNode* makeNegateNode(JSGlobalData* globalData, ExpressionNode* n)
 {
     if (n->isNumber()) {
         NumberNode* number = static_cast<NumberNode*>(n);
@@ -5487,92 +5015,92 @@ static ExpressionNode* makeNegateNode(void* globalPtr, ExpressionNode* n)
         }
     }
 
-    return new (GLOBAL_DATA) NegateNode(GLOBAL_DATA, n);
+    return new (globalData) NegateNode(globalData, n);
 }
 
-static NumberNode* makeNumberNode(void* globalPtr, double d)
+static NumberNode* makeNumberNode(JSGlobalData* globalData, double d)
 {
-    return new (GLOBAL_DATA) NumberNode(GLOBAL_DATA, d);
+    return new (globalData) NumberNode(globalData, d);
 }
 
-static ExpressionNode* makeBitwiseNotNode(void* globalPtr, ExpressionNode* expr)
+static ExpressionNode* makeBitwiseNotNode(JSGlobalData* globalData, ExpressionNode* expr)
 {
     if (expr->isNumber())
-        return makeNumberNode(globalPtr, ~toInt32(static_cast<NumberNode*>(expr)->value()));
-    return new (GLOBAL_DATA) BitwiseNotNode(GLOBAL_DATA, expr);
+        return makeNumberNode(globalData, ~toInt32(static_cast<NumberNode*>(expr)->value()));
+    return new (globalData) BitwiseNotNode(globalData, expr);
 }
 
-static ExpressionNode* makeMultNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+static ExpressionNode* makeMultNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     expr1 = expr1->stripUnaryPlus();
     expr2 = expr2->stripUnaryPlus();
 
     if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() * static_cast<NumberNode*>(expr2)->value());
+        return makeNumberNode(globalData, static_cast<NumberNode*>(expr1)->value() * static_cast<NumberNode*>(expr2)->value());
 
     if (expr1->isNumber() && static_cast<NumberNode*>(expr1)->value() == 1)
-        return new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, expr2);
+        return new (globalData) UnaryPlusNode(globalData, expr2);
 
     if (expr2->isNumber() && static_cast<NumberNode*>(expr2)->value() == 1)
-        return new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, expr1);
+        return new (globalData) UnaryPlusNode(globalData, expr1);
 
-    return new (GLOBAL_DATA) MultNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (globalData) MultNode(globalData, expr1, expr2, rightHasAssignments);
 }
 
-static ExpressionNode* makeDivNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+static ExpressionNode* makeDivNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     expr1 = expr1->stripUnaryPlus();
     expr2 = expr2->stripUnaryPlus();
 
     if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() / static_cast<NumberNode*>(expr2)->value());
-    return new (GLOBAL_DATA) DivNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+        return makeNumberNode(globalData, static_cast<NumberNode*>(expr1)->value() / static_cast<NumberNode*>(expr2)->value());
+    return new (globalData) DivNode(globalData, expr1, expr2, rightHasAssignments);
 }
 
-static ExpressionNode* makeAddNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+static ExpressionNode* makeAddNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() + static_cast<NumberNode*>(expr2)->value());
-    return new (GLOBAL_DATA) AddNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+        return makeNumberNode(globalData, static_cast<NumberNode*>(expr1)->value() + static_cast<NumberNode*>(expr2)->value());
+    return new (globalData) AddNode(globalData, expr1, expr2, rightHasAssignments);
 }
 
-static ExpressionNode* makeSubNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+static ExpressionNode* makeSubNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     expr1 = expr1->stripUnaryPlus();
     expr2 = expr2->stripUnaryPlus();
 
     if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() - static_cast<NumberNode*>(expr2)->value());
-    return new (GLOBAL_DATA) SubNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+        return makeNumberNode(globalData, static_cast<NumberNode*>(expr1)->value() - static_cast<NumberNode*>(expr2)->value());
+    return new (globalData) SubNode(globalData, expr1, expr2, rightHasAssignments);
 }
 
-static ExpressionNode* makeLeftShiftNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+static ExpressionNode* makeLeftShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalPtr, toInt32(static_cast<NumberNode*>(expr1)->value()) << (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new (GLOBAL_DATA) LeftShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+        return makeNumberNode(globalData, toInt32(static_cast<NumberNode*>(expr1)->value()) << (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
+    return new (globalData) LeftShiftNode(globalData, expr1, expr2, rightHasAssignments);
 }
 
-static ExpressionNode* makeRightShiftNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+static ExpressionNode* makeRightShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalPtr, toInt32(static_cast<NumberNode*>(expr1)->value()) >> (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new (GLOBAL_DATA) RightShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+        return makeNumberNode(globalData, toInt32(static_cast<NumberNode*>(expr1)->value()) >> (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
+    return new (globalData) RightShiftNode(globalData, expr1, expr2, rightHasAssignments);
 }
 
-/* called by yyparse on error */
-int yyerror(const char *)
+// Called by yyparse on error.
+int yyerror(const char*)
 {
     return 1;
 }
 
-/* may we automatically insert a semicolon ? */
+// May we automatically insert a semicolon?
 static bool allowAutomaticSemicolon(Lexer& lexer, int yychar)
 {
     return yychar == CLOSEBRACE || yychar == 0 || lexer.prevTerminator();
 }
 
-static ExpressionNode* combineCommaNodes(void* globalPtr, ExpressionNode* list, ExpressionNode* init)
+static ExpressionNode* combineCommaNodes(JSGlobalData* globalData, ExpressionNode* list, ExpressionNode* init)
 {
     if (!list)
         return init;
@@ -5580,18 +5108,16 @@ static ExpressionNode* combineCommaNodes(void* globalPtr, ExpressionNode* list,
         static_cast<CommaNode*>(list)->append(init);
         return list;
     }
-    return new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, list, init);
+    return new (globalData) CommaNode(globalData, list, init);
 }
 
 // We turn variable declarations into either assignments or empty
 // statements (which later get stripped out), because the actual
 // declaration work is hoisted up to the start of the function body
-static StatementNode* makeVarStatementNode(void* globalPtr, ExpressionNode* expr)
+static StatementNode* makeVarStatementNode(JSGlobalData* globalData, ExpressionNode* expr)
 {
     if (!expr)
-        return new (GLOBAL_DATA) EmptyStatementNode(GLOBAL_DATA);
-    return new (GLOBAL_DATA) VarStatementNode(GLOBAL_DATA, expr);
+        return new (globalData) EmptyStatementNode(globalData);
+    return new (globalData) VarStatementNode(globalData, expr);
 }
 
-#undef GLOBAL_DATA
-
diff --git a/src/3rdparty/webkit/WebCore/generated/Grammar.h b/src/3rdparty/webkit/WebCore/generated/Grammar.h
index 2f9d6f0..63b66ce 100644
--- a/src/3rdparty/webkit/WebCore/generated/Grammar.h
+++ b/src/3rdparty/webkit/WebCore/generated/Grammar.h
@@ -1,23 +1,24 @@
-
-/* A Bison parser, made by GNU Bison 2.4.1.  */
+/* A Bison parser, made by GNU Bison 2.3.  */
 
 /* Skeleton interface for Bison's Yacc-like parsers in C
-   
-      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
+
+   Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
    Free Software Foundation, Inc.
-   
-   This program is free software: you can redistribute it and/or modify
+
+   This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation, either version 3 of the License, or
-   (at your option) any later version.
-   
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
-   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin Street, Fifth Floor,
+   Boston, MA 02110-1301, USA.  */
 
 /* As a special exception, you may create a larger work that contains
    part or all of the Bison parser skeleton and distribute that work
@@ -28,11 +29,10 @@
    special exception, which will cause the skeleton and the resulting
    Bison output files to be licensed under the GNU General Public
    License without this special exception.
-   
+
    This special exception was added by the Free Software Foundation in
    version 2.2 of Bison.  */
 
-
 /* Tokens.  */
 #ifndef YYTOKENTYPE
 # define YYTOKENTYPE
@@ -104,19 +104,81 @@
      AUTOMINUSMINUS = 320
    };
 #endif
+/* Tokens.  */
+#define NULLTOKEN 258
+#define TRUETOKEN 259
+#define FALSETOKEN 260
+#define BREAK 261
+#define CASE 262
+#define DEFAULT 263
+#define FOR 264
+#define NEW 265
+#define VAR 266
+#define CONSTTOKEN 267
+#define CONTINUE 268
+#define FUNCTION 269
+#define RETURN 270
+#define VOIDTOKEN 271
+#define DELETETOKEN 272
+#define IF 273
+#define THISTOKEN 274
+#define DO 275
+#define WHILE 276
+#define INTOKEN 277
+#define INSTANCEOF 278
+#define TYPEOF 279
+#define SWITCH 280
+#define WITH 281
+#define RESERVED 282
+#define THROW 283
+#define TRY 284
+#define CATCH 285
+#define FINALLY 286
+#define DEBUGGER 287
+#define IF_WITHOUT_ELSE 288
+#define ELSE 289
+#define EQEQ 290
+#define NE 291
+#define STREQ 292
+#define STRNEQ 293
+#define LE 294
+#define GE 295
+#define OR 296
+#define AND 297
+#define PLUSPLUS 298
+#define MINUSMINUS 299
+#define LSHIFT 300
+#define RSHIFT 301
+#define URSHIFT 302
+#define PLUSEQUAL 303
+#define MINUSEQUAL 304
+#define MULTEQUAL 305
+#define DIVEQUAL 306
+#define LSHIFTEQUAL 307
+#define RSHIFTEQUAL 308
+#define URSHIFTEQUAL 309
+#define ANDEQUAL 310
+#define MODEQUAL 311
+#define XOREQUAL 312
+#define OREQUAL 313
+#define OPENBRACE 314
+#define CLOSEBRACE 315
+#define NUMBER 316
+#define IDENT 317
+#define STRING 318
+#define AUTOPLUSPLUS 319
+#define AUTOMINUSMINUS 320
+
 
 
 
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
+#line 146 "../../JavaScriptCore/parser/Grammar.y"
 {
-
-/* Line 1676 of yacc.c  */
-#line 155 "../../JavaScriptCore/parser/Grammar.y"
-
     int                 intValue;
     double              doubleValue;
-    Identifier*         ident;
+    const Identifier*   ident;
 
     // expression subtrees
     ExpressionNodeInfo  expressionNode;
@@ -143,15 +205,13 @@ typedef union YYSTYPE
     ParameterListInfo   parameterList;
 
     Operator            op;
-
-
-
-/* Line 1676 of yacc.c  */
-#line 151 "WebCore/tmp/../generated/Grammar.tab.h"
-} YYSTYPE;
-# define YYSTYPE_IS_TRIVIAL 1
+}
+/* Line 1489 of yacc.c.  */
+#line 211 "WebCore/tmp/../generated/Grammar.tab.h"
+	YYSTYPE;
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
+# define YYSTYPE_IS_TRIVIAL 1
 #endif
 
 
@@ -170,4 +230,3 @@ typedef struct YYLTYPE
 #endif
 
 
-
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLElementFactory.cpp b/src/3rdparty/webkit/WebCore/generated/HTMLElementFactory.cpp
index 4a8430c..4cb475f 100644
--- a/src/3rdparty/webkit/WebCore/generated/HTMLElementFactory.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLElementFactory.cpp
@@ -1,8 +1,9 @@
 /*
- * THIS FILE IS AUTOMATICALLY GENERATED, DO NOT EDIT.
+ * THIS FILE WAS AUTOMATICALLY GENERATED, DO NOT EDIT.
  *
+ * This file was generated by the dom/make_names.pl script.
  *
- * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,20 +24,13 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-
 #include "config.h"
 #include "HTMLElementFactory.h"
 
 #include "HTMLNames.h"
-#if ENABLE(DASHBOARD_SUPPORT)
-#include "Document.h"
-#include "Settings.h"
-#endif
-
-#include "HTMLFormElement.h"
 #include "HTMLAnchorElement.h"
 #include "HTMLElement.h"
 #include "HTMLAppletElement.h"
@@ -52,6 +46,7 @@
 #include "HTMLTableCaptionElement.h"
 #include "HTMLTableColElement.h"
 #include "HTMLDataGridElement.h"
+#include "HTMLDataListElement.h"
 #include "HTMLDataGridCellElement.h"
 #include "HTMLDataGridColElement.h"
 #include "HTMLModElement.h"
@@ -104,6 +99,11 @@
 #include "HTMLVideoElement.h"
 #include <wtf/HashMap.h>
 
+#if ENABLE(DASHBOARD_SUPPORT)
+#include "Document.h"
+#include "Settings.h"
+#endif
+
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -113,363 +113,364 @@ typedef HashMap<AtomicStringImpl*, ConstructorFunction> FunctionMap;
 
 static FunctionMap* gFunctionMap = 0;
 
-static PassRefPtr<HTMLElement> anchorConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> anchorConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLAnchorElement(tagName, doc);
+    return HTMLAnchorElement::create(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> appletConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> appletConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLAppletElement(tagName, doc);
+    return HTMLAppletElement::create(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> areaConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> areaConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLAreaElement(tagName, doc);
+    return HTMLAreaElement::create(tagName, document);
 }
 
 #if ENABLE(VIDEO)
 
-static PassRefPtr<HTMLElement> audioConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> audioConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
     if (!MediaPlayer::isAvailable())
-        return new HTMLElement(tagName, doc);
-    return new HTMLAudioElement(tagName, doc);
+        return HTMLElement::create(tagName, document);
+    return new HTMLAudioElement(tagName, document);
 }
 
 #endif
-
-static PassRefPtr<HTMLElement> baseConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> baseConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLBaseElement(tagName, doc);
+    return new HTMLBaseElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> basefontConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> basefontConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLBaseFontElement(tagName, doc);
+    return new HTMLBaseFontElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> blockquoteConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> blockquoteConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLBlockquoteElement(tagName, doc);
+    return new HTMLBlockquoteElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> bodyConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> bodyConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLBodyElement(tagName, doc);
+    return new HTMLBodyElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> brConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> brConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLBRElement(tagName, doc);
+    return new HTMLBRElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> buttonConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+static PassRefPtr<HTMLElement> buttonConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement* formElement, bool)
 {
-    return new HTMLButtonElement(tagName, doc, formElement);
+    return new HTMLButtonElement(tagName, document, formElement);
 }
 
-static PassRefPtr<HTMLElement> canvasConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> canvasConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLCanvasElement(tagName, doc);
+    return new HTMLCanvasElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> tablecaptionConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> tablecaptionConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLTableCaptionElement(tagName, doc);
+    return new HTMLTableCaptionElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> tablecolConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> tablecolConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLTableColElement(tagName, doc);
+    return new HTMLTableColElement(tagName, document);
 }
 
 #if ENABLE(DATAGRID)
 
-static PassRefPtr<HTMLElement> datagridConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> datagridConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLDataGridElement(tagName, doc);
+    return new HTMLDataGridElement(tagName, document);
 }
 
 #endif
+#if ENABLE(DATALIST)
 
+static PassRefPtr<HTMLElement> datalistConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
+{
+    return new HTMLDataListElement(tagName, document);
+}
+
+#endif
 #if ENABLE(DATAGRID)
 
-static PassRefPtr<HTMLElement> datagridcellConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> datagridcellConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLDataGridCellElement(tagName, doc);
+    return new HTMLDataGridCellElement(tagName, document);
 }
 
 #endif
-
 #if ENABLE(DATAGRID)
 
-static PassRefPtr<HTMLElement> datagridcolConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> datagridcolConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLDataGridColElement(tagName, doc);
+    return new HTMLDataGridColElement(tagName, document);
 }
 
 #endif
-
-static PassRefPtr<HTMLElement> modConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> modConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLModElement(tagName, doc);
+    return new HTMLModElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> directoryConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> directoryConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLDirectoryElement(tagName, doc);
+    return new HTMLDirectoryElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> divConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> divConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLDivElement(tagName, doc);
+    return new HTMLDivElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> dlistConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> dlistConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLDListElement(tagName, doc);
+    return new HTMLDListElement(tagName, document);
 }
 
 #if ENABLE(DATAGRID)
 
-static PassRefPtr<HTMLElement> datagridrowConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> datagridrowConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLDataGridRowElement(tagName, doc);
+    return new HTMLDataGridRowElement(tagName, document);
 }
 
 #endif
-
-static PassRefPtr<HTMLElement> embedConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> embedConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLEmbedElement(tagName, doc);
+    return HTMLEmbedElement::create(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> fieldsetConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+static PassRefPtr<HTMLElement> fieldsetConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement* formElement, bool)
 {
-    return new HTMLFieldSetElement(tagName, doc, formElement);
+    return new HTMLFieldSetElement(tagName, document, formElement);
 }
 
-static PassRefPtr<HTMLElement> fontConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> fontConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLFontElement(tagName, doc);
+    return new HTMLFontElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> formConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> formConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLFormElement(tagName, doc);
+    return new HTMLFormElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> frameConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> frameConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLFrameElement(tagName, doc);
+    return HTMLFrameElement::create(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> framesetConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> framesetConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLFrameSetElement(tagName, doc);
+    return new HTMLFrameSetElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> headingConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> headingConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLHeadingElement(tagName, doc);
+    return new HTMLHeadingElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> headConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> headConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLHeadElement(tagName, doc);
+    return new HTMLHeadElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> hrConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> hrConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLHRElement(tagName, doc);
+    return new HTMLHRElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> htmlConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> htmlConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLHtmlElement(tagName, doc);
+    return new HTMLHtmlElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> iframeConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> iframeConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLIFrameElement(tagName, doc);
+    return HTMLIFrameElement::create(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> imageConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+static PassRefPtr<HTMLElement> imageConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement* formElement, bool)
 {
-    return new HTMLImageElement(tagName, doc, formElement);
+    return new HTMLImageElement(tagName, document, formElement);
 }
 
-static PassRefPtr<HTMLElement> inputConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+static PassRefPtr<HTMLElement> inputConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement* formElement, bool)
 {
-    return new HTMLInputElement(tagName, doc, formElement);
+    return new HTMLInputElement(tagName, document, formElement);
 }
 
-static PassRefPtr<HTMLElement> isindexConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+static PassRefPtr<HTMLElement> isindexConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement* formElement, bool)
 {
-    return new HTMLIsIndexElement(tagName, doc, formElement);
+    return new HTMLIsIndexElement(tagName, document, formElement);
 }
 
-static PassRefPtr<HTMLElement> keygenConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+static PassRefPtr<HTMLElement> keygenConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement* formElement, bool)
 {
-    return new HTMLKeygenElement(tagName, doc, formElement);
+    return new HTMLKeygenElement(tagName, document, formElement);
 }
 
-static PassRefPtr<HTMLElement> labelConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> labelConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLLabelElement(tagName, doc);
+    return new HTMLLabelElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> legendConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+static PassRefPtr<HTMLElement> legendConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement* formElement, bool)
 {
-    return new HTMLLegendElement(tagName, doc, formElement);
+    return new HTMLLegendElement(tagName, document, formElement);
 }
 
-static PassRefPtr<HTMLElement> liConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> liConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLLIElement(tagName, doc);
+    return new HTMLLIElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> linkConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool createdByParser)
+static PassRefPtr<HTMLElement> linkConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool createdByParser)
 {
-    return new HTMLLinkElement(tagName, doc, createdByParser);
+    return new HTMLLinkElement(tagName, document, createdByParser);
 }
 
-static PassRefPtr<HTMLElement> preConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> preConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLPreElement(tagName, doc);
+    return new HTMLPreElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> mapConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> mapConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLMapElement(tagName, doc);
+    return new HTMLMapElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> marqueeConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> marqueeConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLMarqueeElement(tagName, doc);
+    return new HTMLMarqueeElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> menuConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> menuConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLMenuElement(tagName, doc);
+    return new HTMLMenuElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> metaConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> metaConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLMetaElement(tagName, doc);
+    return new HTMLMetaElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> objectConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool createdByParser)
+static PassRefPtr<HTMLElement> objectConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool createdByParser)
 {
-    return new HTMLObjectElement(tagName, doc, createdByParser);
+    return HTMLObjectElement::create(tagName, document, createdByParser);
 }
 
-static PassRefPtr<HTMLElement> olistConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> olistConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLOListElement(tagName, doc);
+    return new HTMLOListElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> optgroupConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+static PassRefPtr<HTMLElement> optgroupConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement* formElement, bool)
 {
-    return new HTMLOptGroupElement(tagName, doc, formElement);
+    return new HTMLOptGroupElement(tagName, document, formElement);
 }
 
-static PassRefPtr<HTMLElement> optionConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+static PassRefPtr<HTMLElement> optionConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement* formElement, bool)
 {
-    return new HTMLOptionElement(tagName, doc, formElement);
+    return new HTMLOptionElement(tagName, document, formElement);
 }
 
-static PassRefPtr<HTMLElement> paragraphConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> paragraphConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLParagraphElement(tagName, doc);
+    return new HTMLParagraphElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> paramConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> paramConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLParamElement(tagName, doc);
+    return new HTMLParamElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> quoteConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> quoteConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLQuoteElement(tagName, doc);
+    return new HTMLQuoteElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> scriptConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool createdByParser)
+static PassRefPtr<HTMLElement> scriptConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool createdByParser)
 {
-    return new HTMLScriptElement(tagName, doc, createdByParser);
+    return new HTMLScriptElement(tagName, document, createdByParser);
 }
 
-static PassRefPtr<HTMLElement> selectConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+static PassRefPtr<HTMLElement> selectConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement* formElement, bool)
 {
-    return new HTMLSelectElement(tagName, doc, formElement);
+    return new HTMLSelectElement(tagName, document, formElement);
 }
 
 #if ENABLE(VIDEO)
 
-static PassRefPtr<HTMLElement> sourceConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> sourceConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
     if (!MediaPlayer::isAvailable())
-        return new HTMLElement(tagName, doc);
-    return new HTMLSourceElement(tagName, doc);
+        return HTMLElement::create(tagName, document);
+    return new HTMLSourceElement(tagName, document);
 }
 
 #endif
-
-static PassRefPtr<HTMLElement> styleConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool createdByParser)
+static PassRefPtr<HTMLElement> styleConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool createdByParser)
 {
-    return new HTMLStyleElement(tagName, doc, createdByParser);
+    return new HTMLStyleElement(tagName, document, createdByParser);
 }
 
-static PassRefPtr<HTMLElement> tableConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> tableConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLTableElement(tagName, doc);
+    return new HTMLTableElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> tablesectionConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> tablesectionConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLTableSectionElement(tagName, doc);
+    return new HTMLTableSectionElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> tablecellConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> tablecellConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLTableCellElement(tagName, doc);
+    return new HTMLTableCellElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> textareaConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+static PassRefPtr<HTMLElement> textareaConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement* formElement, bool)
 {
-    return new HTMLTextAreaElement(tagName, doc, formElement);
+    return new HTMLTextAreaElement(tagName, document, formElement);
 }
 
-static PassRefPtr<HTMLElement> titleConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> titleConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLTitleElement(tagName, doc);
+    return new HTMLTitleElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> tablerowConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> tablerowConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLTableRowElement(tagName, doc);
+    return new HTMLTableRowElement(tagName, document);
 }
 
-static PassRefPtr<HTMLElement> ulistConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> ulistConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
-    return new HTMLUListElement(tagName, doc);
+    return new HTMLUListElement(tagName, document);
 }
 
 #if ENABLE(VIDEO)
 
-static PassRefPtr<HTMLElement> videoConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+static PassRefPtr<HTMLElement> videoConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
     if (!MediaPlayer::isAvailable())
-        return new HTMLElement(tagName, doc);
-    return new HTMLVideoElement(tagName, doc);
+        return HTMLElement::create(tagName, document);
+    return new HTMLVideoElement(tagName, document);
 }
 
 #endif
-
-static PassRefPtr<HTMLElement> imgToimageConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+static PassRefPtr<HTMLElement> imgToimageConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement* formElement, bool)
 {
-    return new HTMLImageElement(QualifiedName(tagName.prefix(), imgTag.localName(), tagName.namespaceURI()), doc, formElement);
+    return new HTMLImageElement(QualifiedName(tagName.prefix(), imgTag.localName(), tagName.namespaceURI()), document, formElement);
 }
 
 static void addTag(const QualifiedName& tag, ConstructorFunction func)
@@ -477,10 +478,10 @@ static void addTag(const QualifiedName& tag, ConstructorFunction func)
     gFunctionMap->set(tag.localName().impl(), func);
 }
 
-static inline void createFunctionMapIfNecessary()
+static void createFunctionMap()
 {
-    if (gFunctionMap)
-        return;
+    ASSERT(!gFunctionMap);
+
     // Create the table.
     gFunctionMap = new FunctionMap;
     
@@ -506,6 +507,10 @@ static inline void createFunctionMapIfNecessary()
     addTag(datagridTag, datagridConstructor);
 #endif
 
+#if ENABLE(DATALIST)
+    addTag(datalistTag, datalistConstructor);
+#endif
+
 #if ENABLE(DATAGRID)
     addTag(dcellTag, datagridcellConstructor);
 #endif
@@ -585,17 +590,16 @@ static inline void createFunctionMapIfNecessary()
     addTag(xmpTag, preConstructor);
 }
 
-PassRefPtr<HTMLElement> HTMLElementFactory::createHTMLElement(const QualifiedName& qName, Document* doc, HTMLFormElement* formElement, bool createdByParser)
+PassRefPtr<HTMLElement> HTMLElementFactory::createHTMLElement(const QualifiedName& qName, Document* document, HTMLFormElement* formElement, bool createdByParser)
 {
-    // Don't make elements without a document
-    if (!doc)
+    if (!document)
         return 0;
 
-    createFunctionMapIfNecessary();
-    ConstructorFunction func = gFunctionMap->get(qName.localName().impl());
-    if (func)
-        return func(qName, doc, formElement, createdByParser);
-    return new HTMLElement(qName, doc);
+    if (!gFunctionMap)
+        createFunctionMap();
+    if (ConstructorFunction function = gFunctionMap->get(qName.localName().impl()))
+        return function(qName, document, formElement, createdByParser);
+    return HTMLElement::create(qName, document);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLElementFactory.h b/src/3rdparty/webkit/WebCore/generated/HTMLElementFactory.h
index 566d9cd..90cab6f 100644
--- a/src/3rdparty/webkit/WebCore/generated/HTMLElementFactory.h
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLElementFactory.h
@@ -1,8 +1,9 @@
 /*
- * THIS FILE IS AUTOMATICALLY GENERATED, DO NOT EDIT.
+ * THIS FILE WAS AUTOMATICALLY GENERATED, DO NOT EDIT.
  *
+ * This file was generated by the dom/make_names.pl script.
  *
- * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,10 +24,9 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-
 #ifndef HTMLElementFactory_h
 #define HTMLElementFactory_h
 
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLEntityNames.c b/src/3rdparty/webkit/WebCore/generated/HTMLEntityNames.c
index 993e106..761f29d 100644
--- a/src/3rdparty/webkit/WebCore/generated/HTMLEntityNames.c
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLEntityNames.c
@@ -1,5 +1,5 @@
 /* ANSI-C code produced by gperf version 3.0.3 */
-/* Command-line: gperf -a -L ANSI-C -C -G -c -o -t --key-positions='*' -N findEntity -D -s 2  */
+/* Command-line: gperf -a -L ANSI-C -C -G -c -o -t --includes --key-positions='*' -N findEntity -D -s 2  */
 
 #if !((' ' == 32) && ('!' == 33) && ('"' == 34) && ('#' == 35) \
       && ('%' == 37) && ('&' == 38) && ('\'' == 39) && ('(' == 40) \
@@ -59,6 +59,7 @@ struct Entity {
     const char *name;
     int code;
 };
+#include <string.h>
 
 #define TOTAL_KEYWORDS 262
 #define MIN_WORD_LENGTH 2
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp b/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
index 44458f7..d259fc2 100644
--- a/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
@@ -1,8 +1,9 @@
 /*
- * THIS FILE IS AUTOMATICALLY GENERATED, DO NOT EDIT.
+ * THIS FILE WAS AUTOMATICALLY GENERATED, DO NOT EDIT.
  *
+ * This file was generated by the dom/make_names.pl script.
  *
- * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,10 +24,9 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-
 #include "config.h"
 #ifdef SKIP_STATIC_CONSTRUCTORS_ON_GCC
 #define DOM_HTMLNAMES_HIDE_GLOBALS 1
@@ -69,6 +69,7 @@ DEFINE_GLOBAL(QualifiedName, codeTag, nullAtom, "code", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, colTag, nullAtom, "col", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, colgroupTag, nullAtom, "colgroup", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, datagridTag, nullAtom, "datagrid", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, datalistTag, nullAtom, "datalist", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, dcellTag, nullAtom, "dcell", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, dcolTag, nullAtom, "dcol", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, ddTag, nullAtom, "dd", xhtmlNamespaceURI);
@@ -114,6 +115,7 @@ DEFINE_GLOBAL(QualifiedName, mapTag, nullAtom, "map", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, marqueeTag, nullAtom, "marquee", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, menuTag, nullAtom, "menu", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, metaTag, nullAtom, "meta", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, navTag, nullAtom, "nav", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, nobrTag, nullAtom, "nobr", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, noembedTag, nullAtom, "noembed", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, noframesTag, nullAtom, "noframes", xhtmlNamespaceURI);
@@ -188,6 +190,7 @@ WebCore::QualifiedName** getHTMLTags(size_t* size)
         (WebCore::QualifiedName*)&colTag,
         (WebCore::QualifiedName*)&colgroupTag,
         (WebCore::QualifiedName*)&datagridTag,
+        (WebCore::QualifiedName*)&datalistTag,
         (WebCore::QualifiedName*)&dcellTag,
         (WebCore::QualifiedName*)&dcolTag,
         (WebCore::QualifiedName*)&ddTag,
@@ -233,6 +236,7 @@ WebCore::QualifiedName** getHTMLTags(size_t* size)
         (WebCore::QualifiedName*)&marqueeTag,
         (WebCore::QualifiedName*)&menuTag,
         (WebCore::QualifiedName*)&metaTag,
+        (WebCore::QualifiedName*)&navTag,
         (WebCore::QualifiedName*)&nobrTag,
         (WebCore::QualifiedName*)&noembedTag,
         (WebCore::QualifiedName*)&noframesTag,
@@ -279,7 +283,7 @@ WebCore::QualifiedName** getHTMLTags(size_t* size)
         (WebCore::QualifiedName*)&wbrTag,
         (WebCore::QualifiedName*)&xmpTag,
     };
-    *size = 114;
+    *size = 116;
     return HTMLTags;
 }
 
@@ -304,9 +308,11 @@ DEFINE_GLOBAL(QualifiedName, aria_labelledbyAttr, nullAtom, "aria_labelledby", x
 DEFINE_GLOBAL(QualifiedName, aria_levelAttr, nullAtom, "aria_level", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_pressedAttr, nullAtom, "aria_pressed", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_readonlyAttr, nullAtom, "aria_readonly", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_requiredAttr, nullAtom, "aria_required", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_valuemaxAttr, nullAtom, "aria_valuemax", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_valueminAttr, nullAtom, "aria_valuemin", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_valuenowAttr, nullAtom, "aria_valuenow", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_valuetextAttr, nullAtom, "aria_valuetext", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, autobufferAttr, nullAtom, "autobuffer", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, autocompleteAttr, nullAtom, "autocomplete", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, autofocusAttr, nullAtom, "autofocus", xhtmlNamespaceURI);
@@ -357,6 +363,7 @@ DEFINE_GLOBAL(QualifiedName, expandedAttr, nullAtom, "expanded", xhtmlNamespaceU
 DEFINE_GLOBAL(QualifiedName, faceAttr, nullAtom, "face", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, focusedAttr, nullAtom, "focused", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, forAttr, nullAtom, "for", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, formnovalidateAttr, nullAtom, "formnovalidate", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, frameAttr, nullAtom, "frame", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, frameborderAttr, nullAtom, "frameborder", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, headersAttr, nullAtom, "headers", xhtmlNamespaceURI);
@@ -376,6 +383,7 @@ DEFINE_GLOBAL(QualifiedName, langAttr, nullAtom, "lang", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, languageAttr, nullAtom, "language", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, leftmarginAttr, nullAtom, "leftmargin", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, linkAttr, nullAtom, "link", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, listAttr, nullAtom, "list", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, longdescAttr, nullAtom, "longdesc", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, loopAttr, nullAtom, "loop", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, loopendAttr, nullAtom, "loopend", xhtmlNamespaceURI);
@@ -395,6 +403,7 @@ DEFINE_GLOBAL(QualifiedName, nameAttr, nullAtom, "name", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, nohrefAttr, nullAtom, "nohref", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, noresizeAttr, nullAtom, "noresize", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, noshadeAttr, nullAtom, "noshade", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, novalidateAttr, nullAtom, "novalidate", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, nowrapAttr, nullAtom, "nowrap", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, objectAttr, nullAtom, "object", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onabortAttr, nullAtom, "onabort", xhtmlNamespaceURI);
@@ -423,13 +432,16 @@ DEFINE_GLOBAL(QualifiedName, onemptiedAttr, nullAtom, "onemptied", xhtmlNamespac
 DEFINE_GLOBAL(QualifiedName, onendedAttr, nullAtom, "onended", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onerrorAttr, nullAtom, "onerror", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onfocusAttr, nullAtom, "onfocus", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onhashchangeAttr, nullAtom, "onhashchange", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, oninputAttr, nullAtom, "oninput", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, oninvalidAttr, nullAtom, "oninvalid", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onkeydownAttr, nullAtom, "onkeydown", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onkeypressAttr, nullAtom, "onkeypress", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onkeyupAttr, nullAtom, "onkeyup", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onloadAttr, nullAtom, "onload", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onloadeddataAttr, nullAtom, "onloadeddata", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onloadedmetadataAttr, nullAtom, "onloadedmetadata", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onloadendAttr, nullAtom, "onloadend", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onloadstartAttr, nullAtom, "onloadstart", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onmousedownAttr, nullAtom, "onmousedown", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onmousemoveAttr, nullAtom, "onmousemove", xhtmlNamespaceURI);
@@ -439,6 +451,8 @@ DEFINE_GLOBAL(QualifiedName, onmouseupAttr, nullAtom, "onmouseup", xhtmlNamespac
 DEFINE_GLOBAL(QualifiedName, onmousewheelAttr, nullAtom, "onmousewheel", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onofflineAttr, nullAtom, "onoffline", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, ononlineAttr, nullAtom, "ononline", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onpagehideAttr, nullAtom, "onpagehide", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onpageshowAttr, nullAtom, "onpageshow", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onpasteAttr, nullAtom, "onpaste", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onpauseAttr, nullAtom, "onpause", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onplayAttr, nullAtom, "onplay", xhtmlNamespaceURI);
@@ -545,9 +559,11 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&aria_levelAttr,
         (WebCore::QualifiedName*)&aria_pressedAttr,
         (WebCore::QualifiedName*)&aria_readonlyAttr,
+        (WebCore::QualifiedName*)&aria_requiredAttr,
         (WebCore::QualifiedName*)&aria_valuemaxAttr,
         (WebCore::QualifiedName*)&aria_valueminAttr,
         (WebCore::QualifiedName*)&aria_valuenowAttr,
+        (WebCore::QualifiedName*)&aria_valuetextAttr,
         (WebCore::QualifiedName*)&autobufferAttr,
         (WebCore::QualifiedName*)&autocompleteAttr,
         (WebCore::QualifiedName*)&autofocusAttr,
@@ -598,6 +614,7 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&faceAttr,
         (WebCore::QualifiedName*)&focusedAttr,
         (WebCore::QualifiedName*)&forAttr,
+        (WebCore::QualifiedName*)&formnovalidateAttr,
         (WebCore::QualifiedName*)&frameAttr,
         (WebCore::QualifiedName*)&frameborderAttr,
         (WebCore::QualifiedName*)&headersAttr,
@@ -617,6 +634,7 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&languageAttr,
         (WebCore::QualifiedName*)&leftmarginAttr,
         (WebCore::QualifiedName*)&linkAttr,
+        (WebCore::QualifiedName*)&listAttr,
         (WebCore::QualifiedName*)&longdescAttr,
         (WebCore::QualifiedName*)&loopAttr,
         (WebCore::QualifiedName*)&loopendAttr,
@@ -636,6 +654,7 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&nohrefAttr,
         (WebCore::QualifiedName*)&noresizeAttr,
         (WebCore::QualifiedName*)&noshadeAttr,
+        (WebCore::QualifiedName*)&novalidateAttr,
         (WebCore::QualifiedName*)&nowrapAttr,
         (WebCore::QualifiedName*)&objectAttr,
         (WebCore::QualifiedName*)&onabortAttr,
@@ -664,13 +683,16 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&onendedAttr,
         (WebCore::QualifiedName*)&onerrorAttr,
         (WebCore::QualifiedName*)&onfocusAttr,
+        (WebCore::QualifiedName*)&onhashchangeAttr,
         (WebCore::QualifiedName*)&oninputAttr,
+        (WebCore::QualifiedName*)&oninvalidAttr,
         (WebCore::QualifiedName*)&onkeydownAttr,
         (WebCore::QualifiedName*)&onkeypressAttr,
         (WebCore::QualifiedName*)&onkeyupAttr,
         (WebCore::QualifiedName*)&onloadAttr,
         (WebCore::QualifiedName*)&onloadeddataAttr,
         (WebCore::QualifiedName*)&onloadedmetadataAttr,
+        (WebCore::QualifiedName*)&onloadendAttr,
         (WebCore::QualifiedName*)&onloadstartAttr,
         (WebCore::QualifiedName*)&onmousedownAttr,
         (WebCore::QualifiedName*)&onmousemoveAttr,
@@ -680,6 +702,8 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&onmousewheelAttr,
         (WebCore::QualifiedName*)&onofflineAttr,
         (WebCore::QualifiedName*)&ononlineAttr,
+        (WebCore::QualifiedName*)&onpagehideAttr,
+        (WebCore::QualifiedName*)&onpageshowAttr,
         (WebCore::QualifiedName*)&onpasteAttr,
         (WebCore::QualifiedName*)&onpauseAttr,
         (WebCore::QualifiedName*)&onplayAttr,
@@ -762,7 +786,7 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&widthAttr,
         (WebCore::QualifiedName*)&wrapAttr,
     };
-    *size = 236;
+    *size = 246;
     return HTMLAttr;
 }
 
@@ -811,6 +835,7 @@ void init()
     const char *colTagString = "col";
     const char *colgroupTagString = "colgroup";
     const char *datagridTagString = "datagrid";
+    const char *datalistTagString = "datalist";
     const char *dcellTagString = "dcell";
     const char *dcolTagString = "dcol";
     const char *ddTagString = "dd";
@@ -856,6 +881,7 @@ void init()
     const char *marqueeTagString = "marquee";
     const char *menuTagString = "menu";
     const char *metaTagString = "meta";
+    const char *navTagString = "nav";
     const char *nobrTagString = "nobr";
     const char *noembedTagString = "noembed";
     const char *noframesTagString = "noframes";
@@ -925,6 +951,7 @@ void init()
     new ((void*)&colTag) QualifiedName(nullAtom, colTagString, xhtmlNS);
     new ((void*)&colgroupTag) QualifiedName(nullAtom, colgroupTagString, xhtmlNS);
     new ((void*)&datagridTag) QualifiedName(nullAtom, datagridTagString, xhtmlNS);
+    new ((void*)&datalistTag) QualifiedName(nullAtom, datalistTagString, xhtmlNS);
     new ((void*)&dcellTag) QualifiedName(nullAtom, dcellTagString, xhtmlNS);
     new ((void*)&dcolTag) QualifiedName(nullAtom, dcolTagString, xhtmlNS);
     new ((void*)&ddTag) QualifiedName(nullAtom, ddTagString, xhtmlNS);
@@ -970,6 +997,7 @@ void init()
     new ((void*)&marqueeTag) QualifiedName(nullAtom, marqueeTagString, xhtmlNS);
     new ((void*)&menuTag) QualifiedName(nullAtom, menuTagString, xhtmlNS);
     new ((void*)&metaTag) QualifiedName(nullAtom, metaTagString, xhtmlNS);
+    new ((void*)&navTag) QualifiedName(nullAtom, navTagString, xhtmlNS);
     new ((void*)&nobrTag) QualifiedName(nullAtom, nobrTagString, xhtmlNS);
     new ((void*)&noembedTag) QualifiedName(nullAtom, noembedTagString, xhtmlNS);
     new ((void*)&noframesTag) QualifiedName(nullAtom, noframesTagString, xhtmlNS);
@@ -1036,9 +1064,11 @@ void init()
     const char *aria_levelAttrString = "aria-level";
     const char *aria_pressedAttrString = "aria-pressed";
     const char *aria_readonlyAttrString = "aria-readonly";
+    const char *aria_requiredAttrString = "aria-required";
     const char *aria_valuemaxAttrString = "aria-valuemax";
     const char *aria_valueminAttrString = "aria-valuemin";
     const char *aria_valuenowAttrString = "aria-valuenow";
+    const char *aria_valuetextAttrString = "aria-valuetext";
     const char *autobufferAttrString = "autobuffer";
     const char *autocompleteAttrString = "autocomplete";
     const char *autofocusAttrString = "autofocus";
@@ -1088,6 +1118,7 @@ void init()
     const char *faceAttrString = "face";
     const char *focusedAttrString = "focused";
     const char *forAttrString = "for";
+    const char *formnovalidateAttrString = "formnovalidate";
     const char *frameAttrString = "frame";
     const char *frameborderAttrString = "frameborder";
     const char *headersAttrString = "headers";
@@ -1107,6 +1138,7 @@ void init()
     const char *languageAttrString = "language";
     const char *leftmarginAttrString = "leftmargin";
     const char *linkAttrString = "link";
+    const char *listAttrString = "list";
     const char *longdescAttrString = "longdesc";
     const char *loopAttrString = "loop";
     const char *loopendAttrString = "loopend";
@@ -1126,6 +1158,7 @@ void init()
     const char *nohrefAttrString = "nohref";
     const char *noresizeAttrString = "noresize";
     const char *noshadeAttrString = "noshade";
+    const char *novalidateAttrString = "novalidate";
     const char *nowrapAttrString = "nowrap";
     const char *objectAttrString = "object";
     const char *onabortAttrString = "onabort";
@@ -1154,13 +1187,16 @@ void init()
     const char *onendedAttrString = "onended";
     const char *onerrorAttrString = "onerror";
     const char *onfocusAttrString = "onfocus";
+    const char *onhashchangeAttrString = "onhashchange";
     const char *oninputAttrString = "oninput";
+    const char *oninvalidAttrString = "oninvalid";
     const char *onkeydownAttrString = "onkeydown";
     const char *onkeypressAttrString = "onkeypress";
     const char *onkeyupAttrString = "onkeyup";
     const char *onloadAttrString = "onload";
     const char *onloadeddataAttrString = "onloadeddata";
     const char *onloadedmetadataAttrString = "onloadedmetadata";
+    const char *onloadendAttrString = "onloadend";
     const char *onloadstartAttrString = "onloadstart";
     const char *onmousedownAttrString = "onmousedown";
     const char *onmousemoveAttrString = "onmousemove";
@@ -1170,6 +1206,8 @@ void init()
     const char *onmousewheelAttrString = "onmousewheel";
     const char *onofflineAttrString = "onoffline";
     const char *ononlineAttrString = "ononline";
+    const char *onpagehideAttrString = "onpagehide";
+    const char *onpageshowAttrString = "onpageshow";
     const char *onpasteAttrString = "onpaste";
     const char *onpauseAttrString = "onpause";
     const char *onplayAttrString = "onplay";
@@ -1271,9 +1309,11 @@ void init()
     new ((void*)&aria_levelAttr) QualifiedName(nullAtom, aria_levelAttrString, nullAtom);
     new ((void*)&aria_pressedAttr) QualifiedName(nullAtom, aria_pressedAttrString, nullAtom);
     new ((void*)&aria_readonlyAttr) QualifiedName(nullAtom, aria_readonlyAttrString, nullAtom);
+    new ((void*)&aria_requiredAttr) QualifiedName(nullAtom, aria_requiredAttrString, nullAtom);
     new ((void*)&aria_valuemaxAttr) QualifiedName(nullAtom, aria_valuemaxAttrString, nullAtom);
     new ((void*)&aria_valueminAttr) QualifiedName(nullAtom, aria_valueminAttrString, nullAtom);
     new ((void*)&aria_valuenowAttr) QualifiedName(nullAtom, aria_valuenowAttrString, nullAtom);
+    new ((void*)&aria_valuetextAttr) QualifiedName(nullAtom, aria_valuetextAttrString, nullAtom);
     new ((void*)&autobufferAttr) QualifiedName(nullAtom, autobufferAttrString, nullAtom);
     new ((void*)&autocompleteAttr) QualifiedName(nullAtom, autocompleteAttrString, nullAtom);
     new ((void*)&autofocusAttr) QualifiedName(nullAtom, autofocusAttrString, nullAtom);
@@ -1324,6 +1364,7 @@ void init()
     new ((void*)&faceAttr) QualifiedName(nullAtom, faceAttrString, nullAtom);
     new ((void*)&focusedAttr) QualifiedName(nullAtom, focusedAttrString, nullAtom);
     new ((void*)&forAttr) QualifiedName(nullAtom, forAttrString, nullAtom);
+    new ((void*)&formnovalidateAttr) QualifiedName(nullAtom, formnovalidateAttrString, nullAtom);
     new ((void*)&frameAttr) QualifiedName(nullAtom, frameAttrString, nullAtom);
     new ((void*)&frameborderAttr) QualifiedName(nullAtom, frameborderAttrString, nullAtom);
     new ((void*)&headersAttr) QualifiedName(nullAtom, headersAttrString, nullAtom);
@@ -1343,6 +1384,7 @@ void init()
     new ((void*)&languageAttr) QualifiedName(nullAtom, languageAttrString, nullAtom);
     new ((void*)&leftmarginAttr) QualifiedName(nullAtom, leftmarginAttrString, nullAtom);
     new ((void*)&linkAttr) QualifiedName(nullAtom, linkAttrString, nullAtom);
+    new ((void*)&listAttr) QualifiedName(nullAtom, listAttrString, nullAtom);
     new ((void*)&longdescAttr) QualifiedName(nullAtom, longdescAttrString, nullAtom);
     new ((void*)&loopAttr) QualifiedName(nullAtom, loopAttrString, nullAtom);
     new ((void*)&loopendAttr) QualifiedName(nullAtom, loopendAttrString, nullAtom);
@@ -1362,6 +1404,7 @@ void init()
     new ((void*)&nohrefAttr) QualifiedName(nullAtom, nohrefAttrString, nullAtom);
     new ((void*)&noresizeAttr) QualifiedName(nullAtom, noresizeAttrString, nullAtom);
     new ((void*)&noshadeAttr) QualifiedName(nullAtom, noshadeAttrString, nullAtom);
+    new ((void*)&novalidateAttr) QualifiedName(nullAtom, novalidateAttrString, nullAtom);
     new ((void*)&nowrapAttr) QualifiedName(nullAtom, nowrapAttrString, nullAtom);
     new ((void*)&objectAttr) QualifiedName(nullAtom, objectAttrString, nullAtom);
     new ((void*)&onabortAttr) QualifiedName(nullAtom, onabortAttrString, nullAtom);
@@ -1390,13 +1433,16 @@ void init()
     new ((void*)&onendedAttr) QualifiedName(nullAtom, onendedAttrString, nullAtom);
     new ((void*)&onerrorAttr) QualifiedName(nullAtom, onerrorAttrString, nullAtom);
     new ((void*)&onfocusAttr) QualifiedName(nullAtom, onfocusAttrString, nullAtom);
+    new ((void*)&onhashchangeAttr) QualifiedName(nullAtom, onhashchangeAttrString, nullAtom);
     new ((void*)&oninputAttr) QualifiedName(nullAtom, oninputAttrString, nullAtom);
+    new ((void*)&oninvalidAttr) QualifiedName(nullAtom, oninvalidAttrString, nullAtom);
     new ((void*)&onkeydownAttr) QualifiedName(nullAtom, onkeydownAttrString, nullAtom);
     new ((void*)&onkeypressAttr) QualifiedName(nullAtom, onkeypressAttrString, nullAtom);
     new ((void*)&onkeyupAttr) QualifiedName(nullAtom, onkeyupAttrString, nullAtom);
     new ((void*)&onloadAttr) QualifiedName(nullAtom, onloadAttrString, nullAtom);
     new ((void*)&onloadeddataAttr) QualifiedName(nullAtom, onloadeddataAttrString, nullAtom);
     new ((void*)&onloadedmetadataAttr) QualifiedName(nullAtom, onloadedmetadataAttrString, nullAtom);
+    new ((void*)&onloadendAttr) QualifiedName(nullAtom, onloadendAttrString, nullAtom);
     new ((void*)&onloadstartAttr) QualifiedName(nullAtom, onloadstartAttrString, nullAtom);
     new ((void*)&onmousedownAttr) QualifiedName(nullAtom, onmousedownAttrString, nullAtom);
     new ((void*)&onmousemoveAttr) QualifiedName(nullAtom, onmousemoveAttrString, nullAtom);
@@ -1406,6 +1452,8 @@ void init()
     new ((void*)&onmousewheelAttr) QualifiedName(nullAtom, onmousewheelAttrString, nullAtom);
     new ((void*)&onofflineAttr) QualifiedName(nullAtom, onofflineAttrString, nullAtom);
     new ((void*)&ononlineAttr) QualifiedName(nullAtom, ononlineAttrString, nullAtom);
+    new ((void*)&onpagehideAttr) QualifiedName(nullAtom, onpagehideAttrString, nullAtom);
+    new ((void*)&onpageshowAttr) QualifiedName(nullAtom, onpageshowAttrString, nullAtom);
     new ((void*)&onpasteAttr) QualifiedName(nullAtom, onpasteAttrString, nullAtom);
     new ((void*)&onpauseAttr) QualifiedName(nullAtom, onpauseAttrString, nullAtom);
     new ((void*)&onplayAttr) QualifiedName(nullAtom, onplayAttrString, nullAtom);
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLNames.h b/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
index a2544e6..a7fb532 100644
--- a/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
@@ -1,8 +1,9 @@
 /*
- * THIS FILE IS AUTOMATICALLY GENERATED, DO NOT EDIT.
+ * THIS FILE WAS AUTOMATICALLY GENERATED, DO NOT EDIT.
  *
+ * This file was generated by the dom/make_names.pl script.
  *
- * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,10 +24,9 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-
 #ifndef DOM_HTMLNAMES_H
 #define DOM_HTMLNAMES_H
 
@@ -65,6 +65,7 @@ extern const WebCore::QualifiedName codeTag;
 extern const WebCore::QualifiedName colTag;
 extern const WebCore::QualifiedName colgroupTag;
 extern const WebCore::QualifiedName datagridTag;
+extern const WebCore::QualifiedName datalistTag;
 extern const WebCore::QualifiedName dcellTag;
 extern const WebCore::QualifiedName dcolTag;
 extern const WebCore::QualifiedName ddTag;
@@ -110,6 +111,7 @@ extern const WebCore::QualifiedName mapTag;
 extern const WebCore::QualifiedName marqueeTag;
 extern const WebCore::QualifiedName menuTag;
 extern const WebCore::QualifiedName metaTag;
+extern const WebCore::QualifiedName navTag;
 extern const WebCore::QualifiedName nobrTag;
 extern const WebCore::QualifiedName noembedTag;
 extern const WebCore::QualifiedName noframesTag;
@@ -176,9 +178,11 @@ extern const WebCore::QualifiedName aria_labelledbyAttr;
 extern const WebCore::QualifiedName aria_levelAttr;
 extern const WebCore::QualifiedName aria_pressedAttr;
 extern const WebCore::QualifiedName aria_readonlyAttr;
+extern const WebCore::QualifiedName aria_requiredAttr;
 extern const WebCore::QualifiedName aria_valuemaxAttr;
 extern const WebCore::QualifiedName aria_valueminAttr;
 extern const WebCore::QualifiedName aria_valuenowAttr;
+extern const WebCore::QualifiedName aria_valuetextAttr;
 extern const WebCore::QualifiedName autobufferAttr;
 extern const WebCore::QualifiedName autocompleteAttr;
 extern const WebCore::QualifiedName autofocusAttr;
@@ -230,6 +234,7 @@ extern const WebCore::QualifiedName expandedAttr;
 extern const WebCore::QualifiedName faceAttr;
 extern const WebCore::QualifiedName focusedAttr;
 extern const WebCore::QualifiedName forAttr;
+extern const WebCore::QualifiedName formnovalidateAttr;
 extern const WebCore::QualifiedName frameAttr;
 extern const WebCore::QualifiedName frameborderAttr;
 extern const WebCore::QualifiedName headersAttr;
@@ -249,6 +254,7 @@ extern const WebCore::QualifiedName langAttr;
 extern const WebCore::QualifiedName languageAttr;
 extern const WebCore::QualifiedName leftmarginAttr;
 extern const WebCore::QualifiedName linkAttr;
+extern const WebCore::QualifiedName listAttr;
 extern const WebCore::QualifiedName longdescAttr;
 extern const WebCore::QualifiedName loopAttr;
 extern const WebCore::QualifiedName loopendAttr;
@@ -268,6 +274,7 @@ extern const WebCore::QualifiedName nameAttr;
 extern const WebCore::QualifiedName nohrefAttr;
 extern const WebCore::QualifiedName noresizeAttr;
 extern const WebCore::QualifiedName noshadeAttr;
+extern const WebCore::QualifiedName novalidateAttr;
 extern const WebCore::QualifiedName nowrapAttr;
 extern const WebCore::QualifiedName objectAttr;
 extern const WebCore::QualifiedName onabortAttr;
@@ -296,13 +303,16 @@ extern const WebCore::QualifiedName onemptiedAttr;
 extern const WebCore::QualifiedName onendedAttr;
 extern const WebCore::QualifiedName onerrorAttr;
 extern const WebCore::QualifiedName onfocusAttr;
+extern const WebCore::QualifiedName onhashchangeAttr;
 extern const WebCore::QualifiedName oninputAttr;
+extern const WebCore::QualifiedName oninvalidAttr;
 extern const WebCore::QualifiedName onkeydownAttr;
 extern const WebCore::QualifiedName onkeypressAttr;
 extern const WebCore::QualifiedName onkeyupAttr;
 extern const WebCore::QualifiedName onloadAttr;
 extern const WebCore::QualifiedName onloadeddataAttr;
 extern const WebCore::QualifiedName onloadedmetadataAttr;
+extern const WebCore::QualifiedName onloadendAttr;
 extern const WebCore::QualifiedName onloadstartAttr;
 extern const WebCore::QualifiedName onmousedownAttr;
 extern const WebCore::QualifiedName onmousemoveAttr;
@@ -312,6 +322,8 @@ extern const WebCore::QualifiedName onmouseupAttr;
 extern const WebCore::QualifiedName onmousewheelAttr;
 extern const WebCore::QualifiedName onofflineAttr;
 extern const WebCore::QualifiedName ononlineAttr;
+extern const WebCore::QualifiedName onpagehideAttr;
+extern const WebCore::QualifiedName onpageshowAttr;
 extern const WebCore::QualifiedName onpasteAttr;
 extern const WebCore::QualifiedName onpauseAttr;
 extern const WebCore::QualifiedName onplayAttr;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.cpp b/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.cpp
index d591cad..7c6452d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.cpp
@@ -78,6 +78,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSAbstractWorkerPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -94,6 +95,11 @@ bool JSAbstractWorkerConstructor::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticValueSlot<JSAbstractWorkerConstructor, DOMObject>(exec, &JSAbstractWorkerConstructorTable, this, propertyName, slot);
 }
 
+bool JSAbstractWorkerConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSAbstractWorkerConstructor, DOMObject>(exec, &JSAbstractWorkerConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSAbstractWorkerPrototypeTableValues[4] =
@@ -123,6 +129,11 @@ bool JSAbstractWorkerPrototype::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticFunctionSlot<JSObject>(exec, &JSAbstractWorkerPrototypeTable, this, propertyName, slot);
 }
 
+bool JSAbstractWorkerPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSAbstractWorkerPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSAbstractWorker::s_info = { "AbstractWorker", 0, &JSAbstractWorkerTable, 0 };
 
 JSAbstractWorker::JSAbstractWorker(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<AbstractWorker> impl)
@@ -146,6 +157,11 @@ bool JSAbstractWorker::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSAbstractWorker, Base>(exec, &JSAbstractWorkerTable, this, propertyName, slot);
 }
 
+bool JSAbstractWorker::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSAbstractWorker, Base>(exec, &JSAbstractWorkerTable, this, propertyName, descriptor);
+}
+
 JSValue jsAbstractWorkerOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSAbstractWorker* castedThis = static_cast<JSAbstractWorker*>(asObject(slot.slotBase()));
@@ -186,7 +202,7 @@ JSValue JSAbstractWorker::getConstructor(ExecState* exec, JSGlobalObject* global
 JSValue JSC_HOST_CALL jsAbstractWorkerPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSAbstractWorker::s_info))
+    if (!thisValue.inherits(&JSAbstractWorker::s_info))
         return throwError(exec, TypeError);
     JSAbstractWorker* castedThisObj = static_cast<JSAbstractWorker*>(asObject(thisValue));
     return castedThisObj->addEventListener(exec, args);
@@ -195,7 +211,7 @@ JSValue JSC_HOST_CALL jsAbstractWorkerPrototypeFunctionAddEventListener(ExecStat
 JSValue JSC_HOST_CALL jsAbstractWorkerPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSAbstractWorker::s_info))
+    if (!thisValue.inherits(&JSAbstractWorker::s_info))
         return throwError(exec, TypeError);
     JSAbstractWorker* castedThisObj = static_cast<JSAbstractWorker*>(asObject(thisValue));
     return castedThisObj->removeEventListener(exec, args);
@@ -204,7 +220,7 @@ JSValue JSC_HOST_CALL jsAbstractWorkerPrototypeFunctionRemoveEventListener(ExecS
 JSValue JSC_HOST_CALL jsAbstractWorkerPrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSAbstractWorker::s_info))
+    if (!thisValue.inherits(&JSAbstractWorker::s_info))
         return throwError(exec, TypeError);
     JSAbstractWorker* castedThisObj = static_cast<JSAbstractWorker*>(asObject(thisValue));
     AbstractWorker* imp = static_cast<AbstractWorker*>(castedThisObj->impl());
@@ -219,7 +235,7 @@ JSValue JSC_HOST_CALL jsAbstractWorkerPrototypeFunctionDispatchEvent(ExecState*
 
 AbstractWorker* toAbstractWorker(JSC::JSValue value)
 {
-    return value.isObject(&JSAbstractWorker::s_info) ? static_cast<JSAbstractWorker*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSAbstractWorker::s_info) ? static_cast<JSAbstractWorker*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.h b/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.h
index a2c92a5..b1bb87b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.h
@@ -39,6 +39,7 @@ public:
     virtual ~JSAbstractWorker();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -48,7 +49,7 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void mark();
+    virtual void markChildren(JSC::MarkStack&);
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 
@@ -71,6 +72,7 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp b/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp
index c4f5639..2bff88d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp
@@ -78,6 +78,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSAttrPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -94,6 +95,11 @@ bool JSAttrConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSAttrConstructor, DOMObject>(exec, &JSAttrConstructorTable, this, propertyName, slot);
 }
 
+bool JSAttrConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSAttrConstructor, DOMObject>(exec, &JSAttrConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSAttrPrototypeTableValues[1] =
@@ -132,6 +138,11 @@ bool JSAttr::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName,
     return getStaticValueSlot<JSAttr, Base>(exec, &JSAttrTable, this, propertyName, slot);
 }
 
+bool JSAttr::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSAttr, Base>(exec, &JSAttrTable, this, propertyName, descriptor);
+}
+
 JSValue jsAttrName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSAttr* castedThis = static_cast<JSAttr*>(asObject(slot.slotBase()));
@@ -194,7 +205,7 @@ JSValue JSAttr::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
 
 Attr* toAttr(JSC::JSValue value)
 {
-    return value.isObject(&JSAttr::s_info) ? static_cast<JSAttr*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSAttr::s_info) ? static_cast<JSAttr*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSAttr.h b/src/3rdparty/webkit/WebCore/generated/JSAttr.h
index a3b2165..e7fd69c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSAttr.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSAttr.h
@@ -34,6 +34,7 @@ public:
     JSAttr(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<Attr>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp
index c799f7f..a01207f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp
@@ -89,6 +89,11 @@ bool JSBarInfo::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return getStaticValueSlot<JSBarInfo, Base>(exec, &JSBarInfoTable, this, propertyName, slot);
 }
 
+bool JSBarInfo::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSBarInfo, Base>(exec, &JSBarInfoTable, this, propertyName, descriptor);
+}
+
 JSValue jsBarInfoVisible(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSBarInfo* castedThis = static_cast<JSBarInfo*>(asObject(slot.slotBase()));
@@ -103,7 +108,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, BarInfo
 }
 BarInfo* toBarInfo(JSC::JSValue value)
 {
-    return value.isObject(&JSBarInfo::s_info) ? static_cast<JSBarInfo*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSBarInfo::s_info) ? static_cast<JSBarInfo*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h
index 5698443..76344eb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSBarInfo();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp
index f3ef364..d11224e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp
@@ -67,6 +67,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSCDATASectionPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -83,6 +84,11 @@ bool JSCDATASectionConstructor::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSCDATASectionConstructor, DOMObject>(exec, &JSCDATASectionConstructorTable, this, propertyName, slot);
 }
 
+bool JSCDATASectionConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCDATASectionConstructor, DOMObject>(exec, &JSCDATASectionConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSCDATASectionPrototypeTableValues[1] =
@@ -121,6 +127,11 @@ bool JSCDATASection::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSCDATASection, Base>(exec, &JSCDATASectionTable, this, propertyName, slot);
 }
 
+bool JSCDATASection::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCDATASection, Base>(exec, &JSCDATASectionTable, this, propertyName, descriptor);
+}
+
 JSValue jsCDATASectionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSCDATASection* domObject = static_cast<JSCDATASection*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h
index b45da05..7c5ace5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h
@@ -33,6 +33,7 @@ public:
     JSCDATASection(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CDATASection>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp
index f0a2203..4dee9a0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp
@@ -69,6 +69,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSCSSCharsetRulePrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -85,6 +86,11 @@ bool JSCSSCharsetRuleConstructor::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticValueSlot<JSCSSCharsetRuleConstructor, DOMObject>(exec, &JSCSSCharsetRuleConstructorTable, this, propertyName, slot);
 }
 
+bool JSCSSCharsetRuleConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCSSCharsetRuleConstructor, DOMObject>(exec, &JSCSSCharsetRuleConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSCSSCharsetRulePrototypeTableValues[1] =
@@ -123,6 +129,11 @@ bool JSCSSCharsetRule::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSCSSCharsetRule, Base>(exec, &JSCSSCharsetRuleTable, this, propertyName, slot);
 }
 
+bool JSCSSCharsetRule::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCSSCharsetRule, Base>(exec, &JSCSSCharsetRuleTable, this, propertyName, descriptor);
+}
+
 JSValue jsCSSCharsetRuleEncoding(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSCSSCharsetRule* castedThis = static_cast<JSCSSCharsetRule*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h
index d7e303c..de2bca6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h
@@ -33,6 +33,7 @@ public:
     JSCSSCharsetRule(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CSSCharsetRule>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp
index b8a1735..580c31c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp
@@ -71,6 +71,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSCSSFontFaceRulePrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -87,6 +88,11 @@ bool JSCSSFontFaceRuleConstructor::getOwnPropertySlot(ExecState* exec, const Ide
     return getStaticValueSlot<JSCSSFontFaceRuleConstructor, DOMObject>(exec, &JSCSSFontFaceRuleConstructorTable, this, propertyName, slot);
 }
 
+bool JSCSSFontFaceRuleConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCSSFontFaceRuleConstructor, DOMObject>(exec, &JSCSSFontFaceRuleConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSCSSFontFaceRulePrototypeTableValues[1] =
@@ -125,6 +131,11 @@ bool JSCSSFontFaceRule::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSCSSFontFaceRule, Base>(exec, &JSCSSFontFaceRuleTable, this, propertyName, slot);
 }
 
+bool JSCSSFontFaceRule::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCSSFontFaceRule, Base>(exec, &JSCSSFontFaceRuleTable, this, propertyName, descriptor);
+}
+
 JSValue jsCSSFontFaceRuleStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSCSSFontFaceRule* castedThis = static_cast<JSCSSFontFaceRule*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h
index 26ced76..16a8765 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h
@@ -33,6 +33,7 @@ public:
     JSCSSFontFaceRule(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CSSFontFaceRule>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp
index 874eab3..5dc1fba 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp
@@ -75,6 +75,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSCSSImportRulePrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -91,6 +92,11 @@ bool JSCSSImportRuleConstructor::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSCSSImportRuleConstructor, DOMObject>(exec, &JSCSSImportRuleConstructorTable, this, propertyName, slot);
 }
 
+bool JSCSSImportRuleConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCSSImportRuleConstructor, DOMObject>(exec, &JSCSSImportRuleConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSCSSImportRulePrototypeTableValues[1] =
@@ -129,6 +135,11 @@ bool JSCSSImportRule::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSCSSImportRule, Base>(exec, &JSCSSImportRuleTable, this, propertyName, slot);
 }
 
+bool JSCSSImportRule::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCSSImportRule, Base>(exec, &JSCSSImportRuleTable, this, propertyName, descriptor);
+}
+
 JSValue jsCSSImportRuleHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSCSSImportRule* castedThis = static_cast<JSCSSImportRule*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h
index a90a44a..22bb523 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h
@@ -33,6 +33,7 @@ public:
     JSCSSImportRule(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CSSImportRule>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.cpp
index 1b82aa6..f491df2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.cpp
@@ -75,6 +75,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSCSSMediaRulePrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -91,6 +92,11 @@ bool JSCSSMediaRuleConstructor::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSCSSMediaRuleConstructor, DOMObject>(exec, &JSCSSMediaRuleConstructorTable, this, propertyName, slot);
 }
 
+bool JSCSSMediaRuleConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCSSMediaRuleConstructor, DOMObject>(exec, &JSCSSMediaRuleConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSCSSMediaRulePrototypeTableValues[3] =
@@ -119,6 +125,11 @@ bool JSCSSMediaRulePrototype::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticFunctionSlot<JSObject>(exec, &JSCSSMediaRulePrototypeTable, this, propertyName, slot);
 }
 
+bool JSCSSMediaRulePrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSCSSMediaRulePrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSCSSMediaRule::s_info = { "CSSMediaRule", &JSCSSRule::s_info, &JSCSSMediaRuleTable, 0 };
 
 JSCSSMediaRule::JSCSSMediaRule(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CSSMediaRule> impl)
@@ -136,6 +147,11 @@ bool JSCSSMediaRule::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSCSSMediaRule, Base>(exec, &JSCSSMediaRuleTable, this, propertyName, slot);
 }
 
+bool JSCSSMediaRule::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCSSMediaRule, Base>(exec, &JSCSSMediaRuleTable, this, propertyName, descriptor);
+}
+
 JSValue jsCSSMediaRuleMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSCSSMediaRule* castedThis = static_cast<JSCSSMediaRule*>(asObject(slot.slotBase()));
@@ -165,7 +181,7 @@ JSValue JSCSSMediaRule::getConstructor(ExecState* exec, JSGlobalObject* globalOb
 JSValue JSC_HOST_CALL jsCSSMediaRulePrototypeFunctionInsertRule(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCSSMediaRule::s_info))
+    if (!thisValue.inherits(&JSCSSMediaRule::s_info))
         return throwError(exec, TypeError);
     JSCSSMediaRule* castedThisObj = static_cast<JSCSSMediaRule*>(asObject(thisValue));
     CSSMediaRule* imp = static_cast<CSSMediaRule*>(castedThisObj->impl());
@@ -182,7 +198,7 @@ JSValue JSC_HOST_CALL jsCSSMediaRulePrototypeFunctionInsertRule(ExecState* exec,
 JSValue JSC_HOST_CALL jsCSSMediaRulePrototypeFunctionDeleteRule(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCSSMediaRule::s_info))
+    if (!thisValue.inherits(&JSCSSMediaRule::s_info))
         return throwError(exec, TypeError);
     JSCSSMediaRule* castedThisObj = static_cast<JSCSSMediaRule*>(asObject(thisValue));
     CSSMediaRule* imp = static_cast<CSSMediaRule*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.h
index 51f3d6a..34acdab 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.h
@@ -33,6 +33,7 @@ public:
     JSCSSMediaRule(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CSSMediaRule>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -52,9 +53,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSCSSMediaRulePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.cpp
index d9b3837..87486ec 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.cpp
@@ -73,6 +73,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSCSSPageRulePrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -89,6 +90,11 @@ bool JSCSSPageRuleConstructor::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticValueSlot<JSCSSPageRuleConstructor, DOMObject>(exec, &JSCSSPageRuleConstructorTable, this, propertyName, slot);
 }
 
+bool JSCSSPageRuleConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCSSPageRuleConstructor, DOMObject>(exec, &JSCSSPageRuleConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSCSSPageRulePrototypeTableValues[1] =
@@ -127,6 +133,11 @@ bool JSCSSPageRule::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSCSSPageRule, Base>(exec, &JSCSSPageRuleTable, this, propertyName, slot);
 }
 
+bool JSCSSPageRule::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCSSPageRule, Base>(exec, &JSCSSPageRuleTable, this, propertyName, descriptor);
+}
+
 JSValue jsCSSPageRuleSelectorText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSCSSPageRule* castedThis = static_cast<JSCSSPageRule*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.h
index 88050f1..fe56b18 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.h
@@ -33,6 +33,7 @@ public:
     JSCSSPageRule(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CSSPageRule>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.cpp
index 58c9487..84cee2b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.cpp
@@ -104,6 +104,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSCSSPrimitiveValuePrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -120,6 +121,11 @@ bool JSCSSPrimitiveValueConstructor::getOwnPropertySlot(ExecState* exec, const I
     return getStaticValueSlot<JSCSSPrimitiveValueConstructor, DOMObject>(exec, &JSCSSPrimitiveValueConstructorTable, this, propertyName, slot);
 }
 
+bool JSCSSPrimitiveValueConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCSSPrimitiveValueConstructor, DOMObject>(exec, &JSCSSPrimitiveValueConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSCSSPrimitiveValuePrototypeTableValues[34] =
@@ -179,6 +185,11 @@ bool JSCSSPrimitiveValuePrototype::getOwnPropertySlot(ExecState* exec, const Ide
     return getStaticPropertySlot<JSCSSPrimitiveValuePrototype, JSObject>(exec, &JSCSSPrimitiveValuePrototypeTable, this, propertyName, slot);
 }
 
+bool JSCSSPrimitiveValuePrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSCSSPrimitiveValuePrototype, JSObject>(exec, &JSCSSPrimitiveValuePrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSCSSPrimitiveValue::s_info = { "CSSPrimitiveValue", &JSCSSValue::s_info, &JSCSSPrimitiveValueTable, 0 };
 
 JSCSSPrimitiveValue::JSCSSPrimitiveValue(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CSSPrimitiveValue> impl)
@@ -196,6 +207,11 @@ bool JSCSSPrimitiveValue::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSCSSPrimitiveValue, Base>(exec, &JSCSSPrimitiveValueTable, this, propertyName, slot);
 }
 
+bool JSCSSPrimitiveValue::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCSSPrimitiveValue, Base>(exec, &JSCSSPrimitiveValueTable, this, propertyName, descriptor);
+}
+
 JSValue jsCSSPrimitiveValuePrimitiveType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSCSSPrimitiveValue* castedThis = static_cast<JSCSSPrimitiveValue*>(asObject(slot.slotBase()));
@@ -217,7 +233,7 @@ JSValue JSCSSPrimitiveValue::getConstructor(ExecState* exec, JSGlobalObject* glo
 JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionSetFloatValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCSSPrimitiveValue::s_info))
+    if (!thisValue.inherits(&JSCSSPrimitiveValue::s_info))
         return throwError(exec, TypeError);
     JSCSSPrimitiveValue* castedThisObj = static_cast<JSCSSPrimitiveValue*>(asObject(thisValue));
     CSSPrimitiveValue* imp = static_cast<CSSPrimitiveValue*>(castedThisObj->impl());
@@ -233,7 +249,7 @@ JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionSetFloatValue(ExecStat
 JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetFloatValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCSSPrimitiveValue::s_info))
+    if (!thisValue.inherits(&JSCSSPrimitiveValue::s_info))
         return throwError(exec, TypeError);
     JSCSSPrimitiveValue* castedThisObj = static_cast<JSCSSPrimitiveValue*>(asObject(thisValue));
     CSSPrimitiveValue* imp = static_cast<CSSPrimitiveValue*>(castedThisObj->impl());
@@ -249,7 +265,7 @@ JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetFloatValue(ExecStat
 JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionSetStringValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCSSPrimitiveValue::s_info))
+    if (!thisValue.inherits(&JSCSSPrimitiveValue::s_info))
         return throwError(exec, TypeError);
     JSCSSPrimitiveValue* castedThisObj = static_cast<JSCSSPrimitiveValue*>(asObject(thisValue));
     CSSPrimitiveValue* imp = static_cast<CSSPrimitiveValue*>(castedThisObj->impl());
@@ -265,7 +281,7 @@ JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionSetStringValue(ExecSta
 JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetStringValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCSSPrimitiveValue::s_info))
+    if (!thisValue.inherits(&JSCSSPrimitiveValue::s_info))
         return throwError(exec, TypeError);
     JSCSSPrimitiveValue* castedThisObj = static_cast<JSCSSPrimitiveValue*>(asObject(thisValue));
     CSSPrimitiveValue* imp = static_cast<CSSPrimitiveValue*>(castedThisObj->impl());
@@ -280,7 +296,7 @@ JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetStringValue(ExecSta
 JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetCounterValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCSSPrimitiveValue::s_info))
+    if (!thisValue.inherits(&JSCSSPrimitiveValue::s_info))
         return throwError(exec, TypeError);
     JSCSSPrimitiveValue* castedThisObj = static_cast<JSCSSPrimitiveValue*>(asObject(thisValue));
     CSSPrimitiveValue* imp = static_cast<CSSPrimitiveValue*>(castedThisObj->impl());
@@ -295,7 +311,7 @@ JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetCounterValue(ExecSt
 JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetRectValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCSSPrimitiveValue::s_info))
+    if (!thisValue.inherits(&JSCSSPrimitiveValue::s_info))
         return throwError(exec, TypeError);
     JSCSSPrimitiveValue* castedThisObj = static_cast<JSCSSPrimitiveValue*>(asObject(thisValue));
     CSSPrimitiveValue* imp = static_cast<CSSPrimitiveValue*>(castedThisObj->impl());
@@ -310,7 +326,7 @@ JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetRectValue(ExecState
 JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetRGBColorValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCSSPrimitiveValue::s_info))
+    if (!thisValue.inherits(&JSCSSPrimitiveValue::s_info))
         return throwError(exec, TypeError);
     JSCSSPrimitiveValue* castedThisObj = static_cast<JSCSSPrimitiveValue*>(asObject(thisValue));
     CSSPrimitiveValue* imp = static_cast<CSSPrimitiveValue*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.h b/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.h
index c1c8acc..dddef9f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.h
@@ -33,6 +33,7 @@ public:
     JSCSSPrimitiveValue(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CSSPrimitiveValue>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -52,9 +53,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSCSSPrimitiveValuePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp
index ff28352..329c7d6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp
@@ -86,6 +86,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSCSSRulePrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -102,6 +103,11 @@ bool JSCSSRuleConstructor::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSCSSRuleConstructor, DOMObject>(exec, &JSCSSRuleConstructorTable, this, propertyName, slot);
 }
 
+bool JSCSSRuleConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCSSRuleConstructor, DOMObject>(exec, &JSCSSRuleConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSCSSRulePrototypeTableValues[11] =
@@ -138,6 +144,11 @@ bool JSCSSRulePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSCSSRulePrototype, JSObject>(exec, &JSCSSRulePrototypeTable, this, propertyName, slot);
 }
 
+bool JSCSSRulePrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCSSRulePrototype, JSObject>(exec, &JSCSSRulePrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSCSSRule::s_info = { "CSSRule", 0, &JSCSSRuleTable, 0 };
 
 JSCSSRule::JSCSSRule(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CSSRule> impl)
@@ -161,6 +172,11 @@ bool JSCSSRule::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return getStaticValueSlot<JSCSSRule, Base>(exec, &JSCSSRuleTable, this, propertyName, slot);
 }
 
+bool JSCSSRule::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCSSRule, Base>(exec, &JSCSSRuleTable, this, propertyName, descriptor);
+}
+
 JSValue jsCSSRuleType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSCSSRule* castedThis = static_cast<JSCSSRule*>(asObject(slot.slotBase()));
@@ -270,7 +286,7 @@ JSValue jsCSSRuleWEBKIT_KEYFRAME_RULE(ExecState* exec, const Identifier&, const
 
 CSSRule* toCSSRule(JSC::JSValue value)
 {
-    return value.isObject(&JSCSSRule::s_info) ? static_cast<JSCSSRule*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSCSSRule::s_info) ? static_cast<JSCSSRule*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.h
index c5a0c8d..2d74d26 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSCSSRule();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -63,9 +64,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSCSSRulePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp
index e720825..3a71cc3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp
@@ -73,6 +73,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSCSSRuleListPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -89,6 +90,11 @@ bool JSCSSRuleListConstructor::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticValueSlot<JSCSSRuleListConstructor, DOMObject>(exec, &JSCSSRuleListConstructorTable, this, propertyName, slot);
 }
 
+bool JSCSSRuleListConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCSSRuleListConstructor, DOMObject>(exec, &JSCSSRuleListConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSCSSRuleListPrototypeTableValues[2] =
@@ -116,6 +122,11 @@ bool JSCSSRuleListPrototype::getOwnPropertySlot(ExecState* exec, const Identifie
     return getStaticFunctionSlot<JSObject>(exec, &JSCSSRuleListPrototypeTable, this, propertyName, slot);
 }
 
+bool JSCSSRuleListPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSCSSRuleListPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSCSSRuleList::s_info = { "CSSRuleList", 0, &JSCSSRuleListTable, 0 };
 
 JSCSSRuleList::JSCSSRuleList(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CSSRuleList> impl)
@@ -150,6 +161,26 @@ bool JSCSSRuleList::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSCSSRuleList, Base>(exec, &JSCSSRuleListTable, this, propertyName, slot);
 }
 
+bool JSCSSRuleList::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    const HashEntry* entry = JSCSSRuleListTable.entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        slot.setCustom(this, entry->propertyGetter());
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<CSSRuleList*>(impl())->length()) {
+        PropertySlot slot;
+        slot.setCustomIndex(this, index, indexGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly);
+        return true;
+    }
+    return getStaticValueDescriptor<JSCSSRuleList, Base>(exec, &JSCSSRuleListTable, this, propertyName, descriptor);
+}
+
 bool JSCSSRuleList::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
 {
     if (propertyName < static_cast<CSSRuleList*>(impl())->length()) {
@@ -172,11 +203,11 @@ JSValue jsCSSRuleListConstructor(ExecState* exec, const Identifier&, const Prope
     JSCSSRuleList* domObject = static_cast<JSCSSRuleList*>(asObject(slot.slotBase()));
     return JSCSSRuleList::getConstructor(exec, domObject->globalObject());
 }
-void JSCSSRuleList::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSCSSRuleList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     for (unsigned i = 0; i < static_cast<CSSRuleList*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getPropertyNames(exec, propertyNames, listedAttributes);
+     Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 JSValue JSCSSRuleList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -187,7 +218,7 @@ JSValue JSCSSRuleList::getConstructor(ExecState* exec, JSGlobalObject* globalObj
 JSValue JSC_HOST_CALL jsCSSRuleListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCSSRuleList::s_info))
+    if (!thisValue.inherits(&JSCSSRuleList::s_info))
         return throwError(exec, TypeError);
     JSCSSRuleList* castedThisObj = static_cast<JSCSSRuleList*>(asObject(thisValue));
     CSSRuleList* imp = static_cast<CSSRuleList*>(castedThisObj->impl());
@@ -210,7 +241,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CSSRule
 }
 CSSRuleList* toCSSRuleList(JSC::JSValue value)
 {
-    return value.isObject(&JSCSSRuleList::s_info) ? static_cast<JSCSSRuleList*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSCSSRuleList::s_info) ? static_cast<JSCSSRuleList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.h b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.h
index b48bf2b..0f24081 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSCSSRuleList();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -46,7 +47,9 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype);
+    virtual void markChildren(JSC::MarkStack&);
+
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     CSSRuleList* impl() const { return m_impl.get(); }
 
@@ -65,6 +68,7 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp
index f0e32e3..d0ccb9b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp
@@ -80,6 +80,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSCSSStyleDeclarationPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -96,6 +97,11 @@ bool JSCSSStyleDeclarationConstructor::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSCSSStyleDeclarationConstructor, DOMObject>(exec, &JSCSSStyleDeclarationConstructorTable, this, propertyName, slot);
 }
 
+bool JSCSSStyleDeclarationConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCSSStyleDeclarationConstructor, DOMObject>(exec, &JSCSSStyleDeclarationConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSCSSStyleDeclarationPrototypeTableValues[9] =
@@ -130,6 +136,11 @@ bool JSCSSStyleDeclarationPrototype::getOwnPropertySlot(ExecState* exec, const I
     return getStaticFunctionSlot<JSObject>(exec, &JSCSSStyleDeclarationPrototypeTable, this, propertyName, slot);
 }
 
+bool JSCSSStyleDeclarationPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSCSSStyleDeclarationPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSCSSStyleDeclaration::s_info = { "CSSStyleDeclaration", 0, &JSCSSStyleDeclarationTable, 0 };
 
 JSCSSStyleDeclaration::JSCSSStyleDeclaration(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CSSStyleDeclaration> impl)
@@ -168,6 +179,32 @@ bool JSCSSStyleDeclaration::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSCSSStyleDeclaration, Base>(exec, &JSCSSStyleDeclarationTable, this, propertyName, slot);
 }
 
+bool JSCSSStyleDeclaration::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    const HashEntry* entry = JSCSSStyleDeclarationTable.entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        slot.setCustom(this, entry->propertyGetter());
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<CSSStyleDeclaration*>(impl())->length()) {
+        PropertySlot slot;
+        slot.setCustomIndex(this, index, indexGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly);
+        return true;
+    }
+    if (canGetItemsForName(exec, static_cast<CSSStyleDeclaration*>(impl()), propertyName)) {
+        PropertySlot slot;
+        slot.setCustom(this, nameGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    return getStaticValueDescriptor<JSCSSStyleDeclaration, Base>(exec, &JSCSSStyleDeclarationTable, this, propertyName, descriptor);
+}
+
 bool JSCSSStyleDeclaration::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
 {
     if (propertyName < static_cast<CSSStyleDeclaration*>(impl())->length()) {
@@ -221,11 +258,11 @@ void setJSCSSStyleDeclarationCssText(ExecState* exec, JSObject* thisObject, JSVa
     setDOMException(exec, ec);
 }
 
-void JSCSSStyleDeclaration::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSCSSStyleDeclaration::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     for (unsigned i = 0; i < static_cast<CSSStyleDeclaration*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getPropertyNames(exec, propertyNames, listedAttributes);
+     Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 JSValue JSCSSStyleDeclaration::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -236,7 +273,7 @@ JSValue JSCSSStyleDeclaration::getConstructor(ExecState* exec, JSGlobalObject* g
 JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionGetPropertyValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCSSStyleDeclaration::s_info))
+    if (!thisValue.inherits(&JSCSSStyleDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleDeclaration* castedThisObj = static_cast<JSCSSStyleDeclaration*>(asObject(thisValue));
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThisObj->impl());
@@ -250,7 +287,7 @@ JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionGetPropertyValue(Exe
 JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionGetPropertyCSSValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCSSStyleDeclaration::s_info))
+    if (!thisValue.inherits(&JSCSSStyleDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleDeclaration* castedThisObj = static_cast<JSCSSStyleDeclaration*>(asObject(thisValue));
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThisObj->impl());
@@ -264,7 +301,7 @@ JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionGetPropertyCSSValue(
 JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionRemoveProperty(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCSSStyleDeclaration::s_info))
+    if (!thisValue.inherits(&JSCSSStyleDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleDeclaration* castedThisObj = static_cast<JSCSSStyleDeclaration*>(asObject(thisValue));
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThisObj->impl());
@@ -280,7 +317,7 @@ JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionRemoveProperty(ExecS
 JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionGetPropertyPriority(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCSSStyleDeclaration::s_info))
+    if (!thisValue.inherits(&JSCSSStyleDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleDeclaration* castedThisObj = static_cast<JSCSSStyleDeclaration*>(asObject(thisValue));
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThisObj->impl());
@@ -294,7 +331,7 @@ JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionGetPropertyPriority(
 JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionSetProperty(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCSSStyleDeclaration::s_info))
+    if (!thisValue.inherits(&JSCSSStyleDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleDeclaration* castedThisObj = static_cast<JSCSSStyleDeclaration*>(asObject(thisValue));
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThisObj->impl());
@@ -311,7 +348,7 @@ JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionSetProperty(ExecStat
 JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCSSStyleDeclaration::s_info))
+    if (!thisValue.inherits(&JSCSSStyleDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleDeclaration* castedThisObj = static_cast<JSCSSStyleDeclaration*>(asObject(thisValue));
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThisObj->impl());
@@ -325,7 +362,7 @@ JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionItem(ExecState* exec
 JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionGetPropertyShorthand(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCSSStyleDeclaration::s_info))
+    if (!thisValue.inherits(&JSCSSStyleDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleDeclaration* castedThisObj = static_cast<JSCSSStyleDeclaration*>(asObject(thisValue));
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThisObj->impl());
@@ -339,7 +376,7 @@ JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionGetPropertyShorthand
 JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionIsPropertyImplicit(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCSSStyleDeclaration::s_info))
+    if (!thisValue.inherits(&JSCSSStyleDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleDeclaration* castedThisObj = static_cast<JSCSSStyleDeclaration*>(asObject(thisValue));
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThisObj->impl());
@@ -362,7 +399,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CSSStyl
 }
 CSSStyleDeclaration* toCSSStyleDeclaration(JSC::JSValue value)
 {
-    return value.isObject(&JSCSSStyleDeclaration::s_info) ? static_cast<JSCSSStyleDeclaration*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSCSSStyleDeclaration::s_info) ? static_cast<JSCSSStyleDeclaration*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.h b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.h
index a4a35e6..2f64fef 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSCSSStyleDeclaration();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
@@ -48,7 +49,9 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype);
+    virtual void markChildren(JSC::MarkStack&);
+
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     CSSStyleDeclaration* impl() const { return m_impl.get(); }
 
@@ -70,6 +73,7 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.cpp
index 4e07880..b2fd4fa 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.cpp
@@ -73,6 +73,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSCSSStyleRulePrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -89,6 +90,11 @@ bool JSCSSStyleRuleConstructor::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSCSSStyleRuleConstructor, DOMObject>(exec, &JSCSSStyleRuleConstructorTable, this, propertyName, slot);
 }
 
+bool JSCSSStyleRuleConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCSSStyleRuleConstructor, DOMObject>(exec, &JSCSSStyleRuleConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSCSSStyleRulePrototypeTableValues[1] =
@@ -127,6 +133,11 @@ bool JSCSSStyleRule::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSCSSStyleRule, Base>(exec, &JSCSSStyleRuleTable, this, propertyName, slot);
 }
 
+bool JSCSSStyleRule::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCSSStyleRule, Base>(exec, &JSCSSStyleRuleTable, this, propertyName, descriptor);
+}
+
 JSValue jsCSSStyleRuleSelectorText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSCSSStyleRule* castedThis = static_cast<JSCSSStyleRule*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.h
index aaefdf3..603b38a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.h
@@ -33,6 +33,7 @@ public:
     JSCSSStyleRule(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CSSStyleRule>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.cpp
index 7e74594..a316a6d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.cpp
@@ -76,6 +76,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSCSSStyleSheetPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -92,6 +93,11 @@ bool JSCSSStyleSheetConstructor::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSCSSStyleSheetConstructor, DOMObject>(exec, &JSCSSStyleSheetConstructorTable, this, propertyName, slot);
 }
 
+bool JSCSSStyleSheetConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCSSStyleSheetConstructor, DOMObject>(exec, &JSCSSStyleSheetConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSCSSStyleSheetPrototypeTableValues[5] =
@@ -122,6 +128,11 @@ bool JSCSSStyleSheetPrototype::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticFunctionSlot<JSObject>(exec, &JSCSSStyleSheetPrototypeTable, this, propertyName, slot);
 }
 
+bool JSCSSStyleSheetPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSCSSStyleSheetPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSCSSStyleSheet::s_info = { "CSSStyleSheet", &JSStyleSheet::s_info, &JSCSSStyleSheetTable, 0 };
 
 JSCSSStyleSheet::JSCSSStyleSheet(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CSSStyleSheet> impl)
@@ -139,6 +150,11 @@ bool JSCSSStyleSheet::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSCSSStyleSheet, Base>(exec, &JSCSSStyleSheetTable, this, propertyName, slot);
 }
 
+bool JSCSSStyleSheet::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCSSStyleSheet, Base>(exec, &JSCSSStyleSheetTable, this, propertyName, descriptor);
+}
+
 JSValue jsCSSStyleSheetOwnerRule(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSCSSStyleSheet* castedThis = static_cast<JSCSSStyleSheet*>(asObject(slot.slotBase()));
@@ -176,7 +192,7 @@ JSValue JSCSSStyleSheet::getConstructor(ExecState* exec, JSGlobalObject* globalO
 JSValue JSC_HOST_CALL jsCSSStyleSheetPrototypeFunctionInsertRule(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCSSStyleSheet::s_info))
+    if (!thisValue.inherits(&JSCSSStyleSheet::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleSheet* castedThisObj = static_cast<JSCSSStyleSheet*>(asObject(thisValue));
     CSSStyleSheet* imp = static_cast<CSSStyleSheet*>(castedThisObj->impl());
@@ -193,7 +209,7 @@ JSValue JSC_HOST_CALL jsCSSStyleSheetPrototypeFunctionInsertRule(ExecState* exec
 JSValue JSC_HOST_CALL jsCSSStyleSheetPrototypeFunctionDeleteRule(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCSSStyleSheet::s_info))
+    if (!thisValue.inherits(&JSCSSStyleSheet::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleSheet* castedThisObj = static_cast<JSCSSStyleSheet*>(asObject(thisValue));
     CSSStyleSheet* imp = static_cast<CSSStyleSheet*>(castedThisObj->impl());
@@ -208,7 +224,7 @@ JSValue JSC_HOST_CALL jsCSSStyleSheetPrototypeFunctionDeleteRule(ExecState* exec
 JSValue JSC_HOST_CALL jsCSSStyleSheetPrototypeFunctionAddRule(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCSSStyleSheet::s_info))
+    if (!thisValue.inherits(&JSCSSStyleSheet::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleSheet* castedThisObj = static_cast<JSCSSStyleSheet*>(asObject(thisValue));
     CSSStyleSheet* imp = static_cast<CSSStyleSheet*>(castedThisObj->impl());
@@ -235,7 +251,7 @@ JSValue JSC_HOST_CALL jsCSSStyleSheetPrototypeFunctionAddRule(ExecState* exec, J
 JSValue JSC_HOST_CALL jsCSSStyleSheetPrototypeFunctionRemoveRule(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCSSStyleSheet::s_info))
+    if (!thisValue.inherits(&JSCSSStyleSheet::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleSheet* castedThisObj = static_cast<JSCSSStyleSheet*>(asObject(thisValue));
     CSSStyleSheet* imp = static_cast<CSSStyleSheet*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.h b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.h
index 0881232..de40214 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.h
@@ -33,6 +33,7 @@ public:
     JSCSSStyleSheet(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CSSStyleSheet>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -52,9 +53,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSCSSStyleSheetPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp
index 68c5bb8..58c0990 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp
@@ -75,6 +75,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSCSSValuePrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -91,6 +92,11 @@ bool JSCSSValueConstructor::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSCSSValueConstructor, DOMObject>(exec, &JSCSSValueConstructorTable, this, propertyName, slot);
 }
 
+bool JSCSSValueConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCSSValueConstructor, DOMObject>(exec, &JSCSSValueConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSCSSValuePrototypeTableValues[5] =
@@ -121,6 +127,11 @@ bool JSCSSValuePrototype::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSCSSValuePrototype, JSObject>(exec, &JSCSSValuePrototypeTable, this, propertyName, slot);
 }
 
+bool JSCSSValuePrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCSSValuePrototype, JSObject>(exec, &JSCSSValuePrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSCSSValue::s_info = { "CSSValue", 0, &JSCSSValueTable, 0 };
 
 JSCSSValue::JSCSSValue(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CSSValue> impl)
@@ -144,6 +155,11 @@ bool JSCSSValue::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSCSSValue, Base>(exec, &JSCSSValueTable, this, propertyName, slot);
 }
 
+bool JSCSSValue::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCSSValue, Base>(exec, &JSCSSValueTable, this, propertyName, descriptor);
+}
+
 JSValue jsCSSValueCssText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSCSSValue* castedThis = static_cast<JSCSSValue*>(asObject(slot.slotBase()));
@@ -207,7 +223,7 @@ JSValue jsCSSValueCSS_CUSTOM(ExecState* exec, const Identifier&, const PropertyS
 
 CSSValue* toCSSValue(JSC::JSValue value)
 {
-    return value.isObject(&JSCSSValue::s_info) ? static_cast<JSCSSValue*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSCSSValue::s_info) ? static_cast<JSCSSValue*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.h b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.h
index 82f03fd..f39cef3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSCSSValue();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -63,9 +64,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSCSSValuePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.cpp
index ed40bf3..4cff13d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.cpp
@@ -73,6 +73,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSCSSValueListPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -89,6 +90,11 @@ bool JSCSSValueListConstructor::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSCSSValueListConstructor, DOMObject>(exec, &JSCSSValueListConstructorTable, this, propertyName, slot);
 }
 
+bool JSCSSValueListConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCSSValueListConstructor, DOMObject>(exec, &JSCSSValueListConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSCSSValueListPrototypeTableValues[2] =
@@ -116,6 +122,11 @@ bool JSCSSValueListPrototype::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticFunctionSlot<JSObject>(exec, &JSCSSValueListPrototypeTable, this, propertyName, slot);
 }
 
+bool JSCSSValueListPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSCSSValueListPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSCSSValueList::s_info = { "CSSValueList", &JSCSSValue::s_info, &JSCSSValueListTable, 0 };
 
 JSCSSValueList::JSCSSValueList(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CSSValueList> impl)
@@ -144,6 +155,26 @@ bool JSCSSValueList::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSCSSValueList, Base>(exec, &JSCSSValueListTable, this, propertyName, slot);
 }
 
+bool JSCSSValueList::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    const HashEntry* entry = JSCSSValueListTable.entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        slot.setCustom(this, entry->propertyGetter());
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<CSSValueList*>(impl())->length()) {
+        PropertySlot slot;
+        slot.setCustomIndex(this, index, indexGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly);
+        return true;
+    }
+    return getStaticValueDescriptor<JSCSSValueList, Base>(exec, &JSCSSValueListTable, this, propertyName, descriptor);
+}
+
 bool JSCSSValueList::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
 {
     if (propertyName < static_cast<CSSValueList*>(impl())->length()) {
@@ -166,11 +197,11 @@ JSValue jsCSSValueListConstructor(ExecState* exec, const Identifier&, const Prop
     JSCSSValueList* domObject = static_cast<JSCSSValueList*>(asObject(slot.slotBase()));
     return JSCSSValueList::getConstructor(exec, domObject->globalObject());
 }
-void JSCSSValueList::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSCSSValueList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     for (unsigned i = 0; i < static_cast<CSSValueList*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getPropertyNames(exec, propertyNames, listedAttributes);
+     Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 JSValue JSCSSValueList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -181,7 +212,7 @@ JSValue JSCSSValueList::getConstructor(ExecState* exec, JSGlobalObject* globalOb
 JSValue JSC_HOST_CALL jsCSSValueListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCSSValueList::s_info))
+    if (!thisValue.inherits(&JSCSSValueList::s_info))
         return throwError(exec, TypeError);
     JSCSSValueList* castedThisObj = static_cast<JSCSSValueList*>(asObject(thisValue));
     CSSValueList* imp = static_cast<CSSValueList*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.h b/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.h
index d166141..c06529a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.h
@@ -33,6 +33,7 @@ public:
     JSCSSValueList(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CSSValueList>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -42,7 +43,7 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSCSSValueListPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp
index 921e894..419ba7d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp
@@ -77,6 +77,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSCSSVariablesDeclarationPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -93,6 +94,11 @@ bool JSCSSVariablesDeclarationConstructor::getOwnPropertySlot(ExecState* exec, c
     return getStaticValueSlot<JSCSSVariablesDeclarationConstructor, DOMObject>(exec, &JSCSSVariablesDeclarationConstructorTable, this, propertyName, slot);
 }
 
+bool JSCSSVariablesDeclarationConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCSSVariablesDeclarationConstructor, DOMObject>(exec, &JSCSSVariablesDeclarationConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSCSSVariablesDeclarationPrototypeTableValues[5] =
@@ -123,6 +129,11 @@ bool JSCSSVariablesDeclarationPrototype::getOwnPropertySlot(ExecState* exec, con
     return getStaticFunctionSlot<JSObject>(exec, &JSCSSVariablesDeclarationPrototypeTable, this, propertyName, slot);
 }
 
+bool JSCSSVariablesDeclarationPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSCSSVariablesDeclarationPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSCSSVariablesDeclaration::s_info = { "CSSVariablesDeclaration", 0, &JSCSSVariablesDeclarationTable, 0 };
 
 JSCSSVariablesDeclaration::JSCSSVariablesDeclaration(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CSSVariablesDeclaration> impl)
@@ -157,6 +168,26 @@ bool JSCSSVariablesDeclaration::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSCSSVariablesDeclaration, Base>(exec, &JSCSSVariablesDeclarationTable, this, propertyName, slot);
 }
 
+bool JSCSSVariablesDeclaration::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    const HashEntry* entry = JSCSSVariablesDeclarationTable.entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        slot.setCustom(this, entry->propertyGetter());
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<CSSVariablesDeclaration*>(impl())->length()) {
+        PropertySlot slot;
+        slot.setCustomIndex(this, index, indexGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly);
+        return true;
+    }
+    return getStaticValueDescriptor<JSCSSVariablesDeclaration, Base>(exec, &JSCSSVariablesDeclarationTable, this, propertyName, descriptor);
+}
+
 bool JSCSSVariablesDeclaration::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
 {
     if (propertyName < static_cast<CSSVariablesDeclaration*>(impl())->length()) {
@@ -206,11 +237,11 @@ void setJSCSSVariablesDeclarationCssText(ExecState* exec, JSObject* thisObject,
     imp->setCssText(value.toString(exec));
 }
 
-void JSCSSVariablesDeclaration::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSCSSVariablesDeclaration::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     for (unsigned i = 0; i < static_cast<CSSVariablesDeclaration*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getPropertyNames(exec, propertyNames, listedAttributes);
+     Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 JSValue JSCSSVariablesDeclaration::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -221,7 +252,7 @@ JSValue JSCSSVariablesDeclaration::getConstructor(ExecState* exec, JSGlobalObjec
 JSValue JSC_HOST_CALL jsCSSVariablesDeclarationPrototypeFunctionGetVariableValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCSSVariablesDeclaration::s_info))
+    if (!thisValue.inherits(&JSCSSVariablesDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSVariablesDeclaration* castedThisObj = static_cast<JSCSSVariablesDeclaration*>(asObject(thisValue));
     CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(castedThisObj->impl());
@@ -235,7 +266,7 @@ JSValue JSC_HOST_CALL jsCSSVariablesDeclarationPrototypeFunctionGetVariableValue
 JSValue JSC_HOST_CALL jsCSSVariablesDeclarationPrototypeFunctionRemoveVariable(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCSSVariablesDeclaration::s_info))
+    if (!thisValue.inherits(&JSCSSVariablesDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSVariablesDeclaration* castedThisObj = static_cast<JSCSSVariablesDeclaration*>(asObject(thisValue));
     CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(castedThisObj->impl());
@@ -251,7 +282,7 @@ JSValue JSC_HOST_CALL jsCSSVariablesDeclarationPrototypeFunctionRemoveVariable(E
 JSValue JSC_HOST_CALL jsCSSVariablesDeclarationPrototypeFunctionSetVariable(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCSSVariablesDeclaration::s_info))
+    if (!thisValue.inherits(&JSCSSVariablesDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSVariablesDeclaration* castedThisObj = static_cast<JSCSSVariablesDeclaration*>(asObject(thisValue));
     CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(castedThisObj->impl());
@@ -267,7 +298,7 @@ JSValue JSC_HOST_CALL jsCSSVariablesDeclarationPrototypeFunctionSetVariable(Exec
 JSValue JSC_HOST_CALL jsCSSVariablesDeclarationPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCSSVariablesDeclaration::s_info))
+    if (!thisValue.inherits(&JSCSSVariablesDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSVariablesDeclaration* castedThisObj = static_cast<JSCSSVariablesDeclaration*>(asObject(thisValue));
     CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(castedThisObj->impl());
@@ -290,7 +321,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CSSVari
 }
 CSSVariablesDeclaration* toCSSVariablesDeclaration(JSC::JSValue value)
 {
-    return value.isObject(&JSCSSVariablesDeclaration::s_info) ? static_cast<JSCSSVariablesDeclaration*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSCSSVariablesDeclaration::s_info) ? static_cast<JSCSSVariablesDeclaration*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.h b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.h
index 45a3e9d..10c7ae7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSCSSVariablesDeclaration();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
@@ -47,7 +48,7 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     CSSVariablesDeclaration* impl() const { return m_impl.get(); }
 
@@ -66,9 +67,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSCSSVariablesDeclarationPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.cpp
index 241a4f1..b3efd0f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.cpp
@@ -73,6 +73,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSCSSVariablesRulePrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -89,6 +90,11 @@ bool JSCSSVariablesRuleConstructor::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSCSSVariablesRuleConstructor, DOMObject>(exec, &JSCSSVariablesRuleConstructorTable, this, propertyName, slot);
 }
 
+bool JSCSSVariablesRuleConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCSSVariablesRuleConstructor, DOMObject>(exec, &JSCSSVariablesRuleConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSCSSVariablesRulePrototypeTableValues[1] =
@@ -127,6 +133,11 @@ bool JSCSSVariablesRule::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSCSSVariablesRule, Base>(exec, &JSCSSVariablesRuleTable, this, propertyName, slot);
 }
 
+bool JSCSSVariablesRule::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCSSVariablesRule, Base>(exec, &JSCSSVariablesRuleTable, this, propertyName, descriptor);
+}
+
 JSValue jsCSSVariablesRuleMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSCSSVariablesRule* castedThis = static_cast<JSCSSVariablesRule*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.h
index b2f49db..97941f9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.h
@@ -33,6 +33,7 @@ public:
     JSCSSVariablesRule(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CSSVariablesRule>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.cpp
new file mode 100644
index 0000000..685bd6d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.cpp
@@ -0,0 +1,159 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasArray.h"
+
+#include "CanvasArray.h"
+#include <runtime/Error.h>
+#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSCanvasArray);
+
+/* Hash table */
+
+static const HashTableValue JSCanvasArrayTableValues[2] =
+{
+    { "length", DontDelete|ReadOnly, (intptr_t)jsCanvasArrayLength, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSCanvasArrayTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSCanvasArrayTableValues, 0 };
+#else
+    { 2, 1, JSCanvasArrayTableValues, 0 };
+#endif
+
+/* Hash table for prototype */
+
+static const HashTableValue JSCanvasArrayPrototypeTableValues[3] =
+{
+    { "sizeInBytes", DontDelete|Function, (intptr_t)jsCanvasArrayPrototypeFunctionSizeInBytes, (intptr_t)0 },
+    { "alignedSizeInBytes", DontDelete|Function, (intptr_t)jsCanvasArrayPrototypeFunctionAlignedSizeInBytes, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSCanvasArrayPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 3, JSCanvasArrayPrototypeTableValues, 0 };
+#else
+    { 4, 3, JSCanvasArrayPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSCanvasArrayPrototype::s_info = { "CanvasArrayPrototype", 0, &JSCanvasArrayPrototypeTable, 0 };
+
+JSObject* JSCanvasArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSCanvasArray>(exec, globalObject);
+}
+
+bool JSCanvasArrayPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSCanvasArrayPrototypeTable, this, propertyName, slot);
+}
+
+bool JSCanvasArrayPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSCanvasArrayPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSCanvasArray::s_info = { "CanvasArray", 0, &JSCanvasArrayTable, 0 };
+
+JSCanvasArray::JSCanvasArray(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasArray> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
+    , m_impl(impl)
+{
+}
+
+JSCanvasArray::~JSCanvasArray()
+{
+    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+}
+
+JSObject* JSCanvasArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSCanvasArrayPrototype(JSCanvasArrayPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSCanvasArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSCanvasArray, Base>(exec, &JSCanvasArrayTable, this, propertyName, slot);
+}
+
+bool JSCanvasArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCanvasArray, Base>(exec, &JSCanvasArrayTable, this, propertyName, descriptor);
+}
+
+JSValue jsCanvasArrayLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSCanvasArray* castedThis = static_cast<JSCanvasArray*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    CanvasArray* imp = static_cast<CanvasArray*>(castedThis->impl());
+    return jsNumber(exec, imp->length());
+}
+
+JSValue JSC_HOST_CALL jsCanvasArrayPrototypeFunctionSizeInBytes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasArray::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasArray* castedThisObj = static_cast<JSCanvasArray*>(asObject(thisValue));
+    CanvasArray* imp = static_cast<CanvasArray*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsNumber(exec, imp->sizeInBytes());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasArrayPrototypeFunctionAlignedSizeInBytes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasArray::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasArray* castedThisObj = static_cast<JSCanvasArray*>(asObject(thisValue));
+    CanvasArray* imp = static_cast<CanvasArray*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsNumber(exec, imp->alignedSizeInBytes());
+    return result;
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasArray>(exec, globalObject, object);
+}
+CanvasArray* toCanvasArray(JSC::JSValue value)
+{
+    return value.inherits(&JSCanvasArray::s_info) ? static_cast<JSCanvasArray*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.h
new file mode 100644
index 0000000..f22d023
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.h
@@ -0,0 +1,87 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSCanvasArray_h
+#define JSCanvasArray_h
+
+#if ENABLE(3D_CANVAS)
+
+#include "DOMObjectWithSVGContext.h"
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class CanvasArray;
+
+class JSCanvasArray : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
+public:
+    JSCanvasArray(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasArray>);
+    virtual ~JSCanvasArray();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    CanvasArray* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<CanvasArray> m_impl;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasArray*);
+CanvasArray* toCanvasArray(JSC::JSValue);
+
+class JSCanvasArrayPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+    }
+    JSCanvasArrayPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsCanvasArrayPrototypeFunctionSizeInBytes(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasArrayPrototypeFunctionAlignedSizeInBytes(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsCanvasArrayLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.cpp
new file mode 100644
index 0000000..644e3ed
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.cpp
@@ -0,0 +1,120 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasArrayBuffer.h"
+
+#include "CanvasArrayBuffer.h"
+#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSCanvasArrayBuffer);
+
+/* Hash table */
+
+static const HashTableValue JSCanvasArrayBufferTableValues[2] =
+{
+    { "byteLength", DontDelete|ReadOnly, (intptr_t)jsCanvasArrayBufferByteLength, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSCanvasArrayBufferTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSCanvasArrayBufferTableValues, 0 };
+#else
+    { 2, 1, JSCanvasArrayBufferTableValues, 0 };
+#endif
+
+/* Hash table for prototype */
+
+static const HashTableValue JSCanvasArrayBufferPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSCanvasArrayBufferPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSCanvasArrayBufferPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSCanvasArrayBufferPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSCanvasArrayBufferPrototype::s_info = { "CanvasArrayBufferPrototype", 0, &JSCanvasArrayBufferPrototypeTable, 0 };
+
+JSObject* JSCanvasArrayBufferPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSCanvasArrayBuffer>(exec, globalObject);
+}
+
+const ClassInfo JSCanvasArrayBuffer::s_info = { "CanvasArrayBuffer", 0, &JSCanvasArrayBufferTable, 0 };
+
+JSCanvasArrayBuffer::JSCanvasArrayBuffer(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasArrayBuffer> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
+    , m_impl(impl)
+{
+}
+
+JSCanvasArrayBuffer::~JSCanvasArrayBuffer()
+{
+    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+}
+
+JSObject* JSCanvasArrayBuffer::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSCanvasArrayBufferPrototype(JSCanvasArrayBufferPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSCanvasArrayBuffer::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSCanvasArrayBuffer, Base>(exec, &JSCanvasArrayBufferTable, this, propertyName, slot);
+}
+
+bool JSCanvasArrayBuffer::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCanvasArrayBuffer, Base>(exec, &JSCanvasArrayBufferTable, this, propertyName, descriptor);
+}
+
+JSValue jsCanvasArrayBufferByteLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSCanvasArrayBuffer* castedThis = static_cast<JSCanvasArrayBuffer*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    CanvasArrayBuffer* imp = static_cast<CanvasArrayBuffer*>(castedThis->impl());
+    return jsNumber(exec, imp->byteLength());
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasArrayBuffer* object)
+{
+    return getDOMObjectWrapper<JSCanvasArrayBuffer>(exec, globalObject, object);
+}
+CanvasArrayBuffer* toCanvasArrayBuffer(JSC::JSValue value)
+{
+    return value.inherits(&JSCanvasArrayBuffer::s_info) ? static_cast<JSCanvasArrayBuffer*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.h
new file mode 100644
index 0000000..b2a7482
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.h
@@ -0,0 +1,77 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSCanvasArrayBuffer_h
+#define JSCanvasArrayBuffer_h
+
+#if ENABLE(3D_CANVAS)
+
+#include "DOMObjectWithSVGContext.h"
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class CanvasArrayBuffer;
+
+class JSCanvasArrayBuffer : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
+public:
+    JSCanvasArrayBuffer(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasArrayBuffer>);
+    virtual ~JSCanvasArrayBuffer();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    CanvasArrayBuffer* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<CanvasArrayBuffer> m_impl;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasArrayBuffer*);
+CanvasArrayBuffer* toCanvasArrayBuffer(JSC::JSValue);
+
+class JSCanvasArrayBufferPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    JSCanvasArrayBufferPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Attributes
+
+JSC::JSValue jsCanvasArrayBufferByteLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasByteArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasByteArray.cpp
new file mode 100644
index 0000000..2b9bf08
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasByteArray.cpp
@@ -0,0 +1,137 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasByteArray.h"
+
+#include "CanvasByteArray.h"
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSCanvasByteArray);
+
+/* Hash table for prototype */
+
+static const HashTableValue JSCanvasByteArrayPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSCanvasByteArrayPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSCanvasByteArrayPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSCanvasByteArrayPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSCanvasByteArrayPrototype::s_info = { "CanvasByteArrayPrototype", 0, &JSCanvasByteArrayPrototypeTable, 0 };
+
+JSObject* JSCanvasByteArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSCanvasByteArray>(exec, globalObject);
+}
+
+const ClassInfo JSCanvasByteArray::s_info = { "CanvasByteArray", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasByteArray::JSCanvasByteArray(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasByteArray> impl)
+    : JSCanvasArray(structure, globalObject, impl)
+{
+}
+
+JSObject* JSCanvasByteArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSCanvasByteArrayPrototype(JSCanvasByteArrayPrototype::createStructure(JSCanvasArrayPrototype::self(exec, globalObject)));
+}
+
+bool JSCanvasByteArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<CanvasByteArray*>(impl())->length()) {
+        slot.setValue(getByIndex(exec, index));
+        return true;
+    }
+    return Base::getOwnPropertySlot(exec, propertyName, slot);
+}
+
+bool JSCanvasByteArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<CanvasByteArray*>(impl())->length()) {
+        descriptor.setDescriptor(getByIndex(exec, index), DontDelete);
+        return true;
+    }
+    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
+bool JSCanvasByteArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    if (propertyName < static_cast<CanvasByteArray*>(impl())->length()) {
+        slot.setValue(getByIndex(exec, propertyName));
+        return true;
+    }
+    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
+}
+
+void JSCanvasByteArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok) {
+        indexSetter(exec, index, value);
+        return;
+    }
+    Base::put(exec, propertyName, value, slot);
+}
+
+void JSCanvasByteArray::put(ExecState* exec, unsigned propertyName, JSValue value)
+{
+    indexSetter(exec, propertyName, value);
+    return;
+}
+
+void JSCanvasByteArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    for (unsigned i = 0; i < static_cast<CanvasByteArray*>(impl())->length(); ++i)
+        propertyNames.add(Identifier::from(exec, i));
+     Base::getOwnPropertyNames(exec, propertyNames);
+}
+
+
+JSValue JSCanvasByteArray::getByIndex(ExecState* exec, unsigned index)
+{
+    return jsNumber(exec, static_cast<CanvasByteArray*>(impl())->item(index));
+}
+CanvasByteArray* toCanvasByteArray(JSC::JSValue value)
+{
+    return value.inherits(&JSCanvasByteArray::s_info) ? static_cast<JSCanvasByteArray*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasByteArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasByteArray.h
new file mode 100644
index 0000000..705adc4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasByteArray.h
@@ -0,0 +1,77 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSCanvasByteArray_h
+#define JSCanvasByteArray_h
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasByteArray.h"
+#include "JSCanvasArray.h"
+
+namespace WebCore {
+
+class CanvasByteArray;
+
+class JSCanvasByteArray : public JSCanvasArray {
+    typedef JSCanvasArray Base;
+public:
+    JSCanvasByteArray(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasByteArray>);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    CanvasByteArray* impl() const
+    {
+        return static_cast<CanvasByteArray*>(Base::impl());
+    }
+    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
+    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasByteArray*);
+CanvasByteArray* toCanvasByteArray(JSC::JSValue);
+
+class JSCanvasByteArrayPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    JSCanvasByteArrayPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasFloatArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasFloatArray.cpp
new file mode 100644
index 0000000..2417cb6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasFloatArray.cpp
@@ -0,0 +1,137 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasFloatArray.h"
+
+#include "CanvasFloatArray.h"
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSCanvasFloatArray);
+
+/* Hash table for prototype */
+
+static const HashTableValue JSCanvasFloatArrayPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSCanvasFloatArrayPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSCanvasFloatArrayPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSCanvasFloatArrayPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSCanvasFloatArrayPrototype::s_info = { "CanvasFloatArrayPrototype", 0, &JSCanvasFloatArrayPrototypeTable, 0 };
+
+JSObject* JSCanvasFloatArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSCanvasFloatArray>(exec, globalObject);
+}
+
+const ClassInfo JSCanvasFloatArray::s_info = { "CanvasFloatArray", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasFloatArray::JSCanvasFloatArray(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasFloatArray> impl)
+    : JSCanvasArray(structure, globalObject, impl)
+{
+}
+
+JSObject* JSCanvasFloatArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSCanvasFloatArrayPrototype(JSCanvasFloatArrayPrototype::createStructure(JSCanvasArrayPrototype::self(exec, globalObject)));
+}
+
+bool JSCanvasFloatArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<CanvasFloatArray*>(impl())->length()) {
+        slot.setValue(getByIndex(exec, index));
+        return true;
+    }
+    return Base::getOwnPropertySlot(exec, propertyName, slot);
+}
+
+bool JSCanvasFloatArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<CanvasFloatArray*>(impl())->length()) {
+        descriptor.setDescriptor(getByIndex(exec, index), DontDelete);
+        return true;
+    }
+    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
+bool JSCanvasFloatArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    if (propertyName < static_cast<CanvasFloatArray*>(impl())->length()) {
+        slot.setValue(getByIndex(exec, propertyName));
+        return true;
+    }
+    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
+}
+
+void JSCanvasFloatArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok) {
+        indexSetter(exec, index, value);
+        return;
+    }
+    Base::put(exec, propertyName, value, slot);
+}
+
+void JSCanvasFloatArray::put(ExecState* exec, unsigned propertyName, JSValue value)
+{
+    indexSetter(exec, propertyName, value);
+    return;
+}
+
+void JSCanvasFloatArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    for (unsigned i = 0; i < static_cast<CanvasFloatArray*>(impl())->length(); ++i)
+        propertyNames.add(Identifier::from(exec, i));
+     Base::getOwnPropertyNames(exec, propertyNames);
+}
+
+
+JSValue JSCanvasFloatArray::getByIndex(ExecState* exec, unsigned index)
+{
+    return jsNumber(exec, static_cast<CanvasFloatArray*>(impl())->item(index));
+}
+CanvasFloatArray* toCanvasFloatArray(JSC::JSValue value)
+{
+    return value.inherits(&JSCanvasFloatArray::s_info) ? static_cast<JSCanvasFloatArray*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasFloatArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasFloatArray.h
new file mode 100644
index 0000000..8783867
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasFloatArray.h
@@ -0,0 +1,77 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSCanvasFloatArray_h
+#define JSCanvasFloatArray_h
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasFloatArray.h"
+#include "JSCanvasArray.h"
+
+namespace WebCore {
+
+class CanvasFloatArray;
+
+class JSCanvasFloatArray : public JSCanvasArray {
+    typedef JSCanvasArray Base;
+public:
+    JSCanvasFloatArray(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasFloatArray>);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    CanvasFloatArray* impl() const
+    {
+        return static_cast<CanvasFloatArray*>(Base::impl());
+    }
+    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
+    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasFloatArray*);
+CanvasFloatArray* toCanvasFloatArray(JSC::JSValue);
+
+class JSCanvasFloatArrayPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    JSCanvasFloatArrayPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.cpp
index ef5fa3a..70f71bc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.cpp
@@ -59,6 +59,11 @@ bool JSCanvasGradientPrototype::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticFunctionSlot<JSObject>(exec, &JSCanvasGradientPrototypeTable, this, propertyName, slot);
 }
 
+bool JSCanvasGradientPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSCanvasGradientPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSCanvasGradient::s_info = { "CanvasGradient", 0, 0, 0 };
 
 JSCanvasGradient::JSCanvasGradient(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasGradient> impl)
@@ -80,7 +85,7 @@ JSObject* JSCanvasGradient::createPrototype(ExecState* exec, JSGlobalObject* glo
 JSValue JSC_HOST_CALL jsCanvasGradientPrototypeFunctionAddColorStop(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasGradient::s_info))
+    if (!thisValue.inherits(&JSCanvasGradient::s_info))
         return throwError(exec, TypeError);
     JSCanvasGradient* castedThisObj = static_cast<JSCanvasGradient*>(asObject(thisValue));
     CanvasGradient* imp = static_cast<CanvasGradient*>(castedThisObj->impl());
@@ -99,7 +104,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasG
 }
 CanvasGradient* toCanvasGradient(JSC::JSValue value)
 {
-    return value.isObject(&JSCanvasGradient::s_info) ? static_cast<JSCanvasGradient*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSCanvasGradient::s_info) ? static_cast<JSCanvasGradient*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.h
index f2673f0..7d6b331 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.h
@@ -55,9 +55,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSCanvasGradientPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasIntArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasIntArray.cpp
new file mode 100644
index 0000000..e3fce1f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasIntArray.cpp
@@ -0,0 +1,137 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasIntArray.h"
+
+#include "CanvasIntArray.h"
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSCanvasIntArray);
+
+/* Hash table for prototype */
+
+static const HashTableValue JSCanvasIntArrayPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSCanvasIntArrayPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSCanvasIntArrayPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSCanvasIntArrayPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSCanvasIntArrayPrototype::s_info = { "CanvasIntArrayPrototype", 0, &JSCanvasIntArrayPrototypeTable, 0 };
+
+JSObject* JSCanvasIntArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSCanvasIntArray>(exec, globalObject);
+}
+
+const ClassInfo JSCanvasIntArray::s_info = { "CanvasIntArray", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasIntArray::JSCanvasIntArray(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasIntArray> impl)
+    : JSCanvasArray(structure, globalObject, impl)
+{
+}
+
+JSObject* JSCanvasIntArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSCanvasIntArrayPrototype(JSCanvasIntArrayPrototype::createStructure(JSCanvasArrayPrototype::self(exec, globalObject)));
+}
+
+bool JSCanvasIntArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<CanvasIntArray*>(impl())->length()) {
+        slot.setValue(getByIndex(exec, index));
+        return true;
+    }
+    return Base::getOwnPropertySlot(exec, propertyName, slot);
+}
+
+bool JSCanvasIntArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<CanvasIntArray*>(impl())->length()) {
+        descriptor.setDescriptor(getByIndex(exec, index), DontDelete);
+        return true;
+    }
+    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
+bool JSCanvasIntArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    if (propertyName < static_cast<CanvasIntArray*>(impl())->length()) {
+        slot.setValue(getByIndex(exec, propertyName));
+        return true;
+    }
+    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
+}
+
+void JSCanvasIntArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok) {
+        indexSetter(exec, index, value);
+        return;
+    }
+    Base::put(exec, propertyName, value, slot);
+}
+
+void JSCanvasIntArray::put(ExecState* exec, unsigned propertyName, JSValue value)
+{
+    indexSetter(exec, propertyName, value);
+    return;
+}
+
+void JSCanvasIntArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    for (unsigned i = 0; i < static_cast<CanvasIntArray*>(impl())->length(); ++i)
+        propertyNames.add(Identifier::from(exec, i));
+     Base::getOwnPropertyNames(exec, propertyNames);
+}
+
+
+JSValue JSCanvasIntArray::getByIndex(ExecState* exec, unsigned index)
+{
+    return jsNumber(exec, static_cast<CanvasIntArray*>(impl())->item(index));
+}
+CanvasIntArray* toCanvasIntArray(JSC::JSValue value)
+{
+    return value.inherits(&JSCanvasIntArray::s_info) ? static_cast<JSCanvasIntArray*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasIntArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasIntArray.h
new file mode 100644
index 0000000..81c077b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasIntArray.h
@@ -0,0 +1,77 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSCanvasIntArray_h
+#define JSCanvasIntArray_h
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasIntArray.h"
+#include "JSCanvasArray.h"
+
+namespace WebCore {
+
+class CanvasIntArray;
+
+class JSCanvasIntArray : public JSCanvasArray {
+    typedef JSCanvasArray Base;
+public:
+    JSCanvasIntArray(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasIntArray>);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    CanvasIntArray* impl() const
+    {
+        return static_cast<CanvasIntArray*>(Base::impl());
+    }
+    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
+    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasIntArray*);
+CanvasIntArray* toCanvasIntArray(JSC::JSValue);
+
+class JSCanvasIntArrayPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    JSCanvasIntArrayPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.cpp
index 3facb35..c806e5d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.cpp
@@ -75,7 +75,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasP
 }
 CanvasPattern* toCanvasPattern(JSC::JSValue value)
 {
-    return value.isObject(&JSCanvasPattern::s_info) ? static_cast<JSCanvasPattern*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSCanvasPattern::s_info) ? static_cast<JSCanvasPattern*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.cpp
new file mode 100644
index 0000000..aedc360
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.cpp
@@ -0,0 +1,167 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSCanvasRenderingContext.h"
+
+#include "CanvasRenderingContext.h"
+#include "HTMLCanvasElement.h"
+#include "JSHTMLCanvasElement.h"
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSCanvasRenderingContext);
+
+/* Hash table */
+
+static const HashTableValue JSCanvasRenderingContextTableValues[3] =
+{
+    { "canvas", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContextCanvas, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCanvasRenderingContextConstructor, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSCanvasRenderingContextTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 1, JSCanvasRenderingContextTableValues, 0 };
+#else
+    { 4, 3, JSCanvasRenderingContextTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSCanvasRenderingContextConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSCanvasRenderingContextConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSCanvasRenderingContextConstructorTableValues, 0 };
+#else
+    { 1, 0, JSCanvasRenderingContextConstructorTableValues, 0 };
+#endif
+
+class JSCanvasRenderingContextConstructor : public DOMConstructorObject {
+public:
+    JSCanvasRenderingContextConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSCanvasRenderingContextConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSCanvasRenderingContextPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+    }
+};
+
+const ClassInfo JSCanvasRenderingContextConstructor::s_info = { "CanvasRenderingContextConstructor", 0, &JSCanvasRenderingContextConstructorTable, 0 };
+
+bool JSCanvasRenderingContextConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSCanvasRenderingContextConstructor, DOMObject>(exec, &JSCanvasRenderingContextConstructorTable, this, propertyName, slot);
+}
+
+bool JSCanvasRenderingContextConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCanvasRenderingContextConstructor, DOMObject>(exec, &JSCanvasRenderingContextConstructorTable, this, propertyName, descriptor);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSCanvasRenderingContextPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSCanvasRenderingContextPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSCanvasRenderingContextPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSCanvasRenderingContextPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSCanvasRenderingContextPrototype::s_info = { "CanvasRenderingContextPrototype", 0, &JSCanvasRenderingContextPrototypeTable, 0 };
+
+JSObject* JSCanvasRenderingContextPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSCanvasRenderingContext>(exec, globalObject);
+}
+
+const ClassInfo JSCanvasRenderingContext::s_info = { "CanvasRenderingContext", 0, &JSCanvasRenderingContextTable, 0 };
+
+JSCanvasRenderingContext::JSCanvasRenderingContext(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasRenderingContext> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
+    , m_impl(impl)
+{
+}
+
+JSCanvasRenderingContext::~JSCanvasRenderingContext()
+{
+    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+}
+
+JSObject* JSCanvasRenderingContext::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSCanvasRenderingContextPrototype(JSCanvasRenderingContextPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSCanvasRenderingContext::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSCanvasRenderingContext, Base>(exec, &JSCanvasRenderingContextTable, this, propertyName, slot);
+}
+
+bool JSCanvasRenderingContext::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCanvasRenderingContext, Base>(exec, &JSCanvasRenderingContextTable, this, propertyName, descriptor);
+}
+
+JSValue jsCanvasRenderingContextCanvas(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSCanvasRenderingContext* castedThis = static_cast<JSCanvasRenderingContext*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    CanvasRenderingContext* imp = static_cast<CanvasRenderingContext*>(castedThis->impl());
+    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->canvas()));
+}
+
+JSValue jsCanvasRenderingContextConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSCanvasRenderingContext* domObject = static_cast<JSCanvasRenderingContext*>(asObject(slot.slotBase()));
+    return JSCanvasRenderingContext::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSCanvasRenderingContext::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSCanvasRenderingContextConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
+CanvasRenderingContext* toCanvasRenderingContext(JSC::JSValue value)
+{
+    return value.inherits(&JSCanvasRenderingContext::s_info) ? static_cast<JSCanvasRenderingContext*>(asObject(value))->impl() : 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.h
new file mode 100644
index 0000000..9eeb2be
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.h
@@ -0,0 +1,75 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSCanvasRenderingContext_h
+#define JSCanvasRenderingContext_h
+
+#include "DOMObjectWithSVGContext.h"
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class CanvasRenderingContext;
+
+class JSCanvasRenderingContext : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
+public:
+    JSCanvasRenderingContext(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasRenderingContext>);
+    virtual ~JSCanvasRenderingContext();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+    CanvasRenderingContext* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<CanvasRenderingContext> m_impl;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasRenderingContext*);
+CanvasRenderingContext* toCanvasRenderingContext(JSC::JSValue);
+
+class JSCanvasRenderingContextPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    JSCanvasRenderingContextPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Attributes
+
+JSC::JSValue jsCanvasRenderingContextCanvas(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContextConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.cpp
index a42f8ab..def483a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.cpp
@@ -25,10 +25,8 @@
 #include "CanvasPattern.h"
 #include "CanvasRenderingContext2D.h"
 #include "CanvasStyle.h"
-#include "HTMLCanvasElement.h"
 #include "ImageData.h"
 #include "JSCanvasGradient.h"
-#include "JSHTMLCanvasElement.h"
 #include "JSImageData.h"
 #include "JSTextMetrics.h"
 #include "KURL.h"
@@ -47,9 +45,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSCanvasRenderingContext2D);
 
 /* Hash table */
 
-static const HashTableValue JSCanvasRenderingContext2DTableValues[18] =
+static const HashTableValue JSCanvasRenderingContext2DTableValues[17] =
 {
-    { "canvas", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext2DCanvas, (intptr_t)0 },
     { "globalAlpha", DontDelete, (intptr_t)jsCanvasRenderingContext2DGlobalAlpha, (intptr_t)setJSCanvasRenderingContext2DGlobalAlpha },
     { "globalCompositeOperation", DontDelete, (intptr_t)jsCanvasRenderingContext2DGlobalCompositeOperation, (intptr_t)setJSCanvasRenderingContext2DGlobalCompositeOperation },
     { "lineWidth", DontDelete, (intptr_t)jsCanvasRenderingContext2DLineWidth, (intptr_t)setJSCanvasRenderingContext2DLineWidth },
@@ -73,7 +70,7 @@ static JSC_CONST_HASHTABLE HashTable JSCanvasRenderingContext2DTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 8191, JSCanvasRenderingContext2DTableValues, 0 };
 #else
-    { 67, 63, JSCanvasRenderingContext2DTableValues, 0 };
+    { 36, 31, JSCanvasRenderingContext2DTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -98,6 +95,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSCanvasRenderingContext2DPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -114,6 +112,11 @@ bool JSCanvasRenderingContext2DConstructor::getOwnPropertySlot(ExecState* exec,
     return getStaticValueSlot<JSCanvasRenderingContext2DConstructor, DOMObject>(exec, &JSCanvasRenderingContext2DConstructorTable, this, propertyName, slot);
 }
 
+bool JSCanvasRenderingContext2DConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCanvasRenderingContext2DConstructor, DOMObject>(exec, &JSCanvasRenderingContext2DConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSCanvasRenderingContext2DPrototypeTableValues[45] =
@@ -184,22 +187,21 @@ bool JSCanvasRenderingContext2DPrototype::getOwnPropertySlot(ExecState* exec, co
     return getStaticFunctionSlot<JSObject>(exec, &JSCanvasRenderingContext2DPrototypeTable, this, propertyName, slot);
 }
 
-const ClassInfo JSCanvasRenderingContext2D::s_info = { "CanvasRenderingContext2D", 0, &JSCanvasRenderingContext2DTable, 0 };
-
-JSCanvasRenderingContext2D::JSCanvasRenderingContext2D(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasRenderingContext2D> impl)
-    : DOMObjectWithGlobalPointer(structure, globalObject)
-    , m_impl(impl)
+bool JSCanvasRenderingContext2DPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSCanvasRenderingContext2DPrototypeTable, this, propertyName, descriptor);
 }
 
-JSCanvasRenderingContext2D::~JSCanvasRenderingContext2D()
+const ClassInfo JSCanvasRenderingContext2D::s_info = { "CanvasRenderingContext2D", &JSCanvasRenderingContext::s_info, &JSCanvasRenderingContext2DTable, 0 };
+
+JSCanvasRenderingContext2D::JSCanvasRenderingContext2D(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasRenderingContext2D> impl)
+    : JSCanvasRenderingContext(structure, globalObject, impl)
 {
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
 }
 
 JSObject* JSCanvasRenderingContext2D::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCanvasRenderingContext2DPrototype(JSCanvasRenderingContext2DPrototype::createStructure(globalObject->objectPrototype()));
+    return new (exec) JSCanvasRenderingContext2DPrototype(JSCanvasRenderingContext2DPrototype::createStructure(JSCanvasRenderingContextPrototype::self(exec, globalObject)));
 }
 
 bool JSCanvasRenderingContext2D::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -207,12 +209,9 @@ bool JSCanvasRenderingContext2D::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSCanvasRenderingContext2D, Base>(exec, &JSCanvasRenderingContext2DTable, this, propertyName, slot);
 }
 
-JSValue jsCanvasRenderingContext2DCanvas(ExecState* exec, const Identifier&, const PropertySlot& slot)
+bool JSCanvasRenderingContext2D::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
-    UNUSED_PARAM(exec);
-    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->canvas()));
+    return getStaticValueDescriptor<JSCanvasRenderingContext2D, Base>(exec, &JSCanvasRenderingContext2DTable, this, propertyName, descriptor);
 }
 
 JSValue jsCanvasRenderingContext2DGlobalAlpha(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -437,7 +436,7 @@ JSValue JSCanvasRenderingContext2D::getConstructor(ExecState* exec, JSGlobalObje
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSave(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -449,7 +448,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSave(ExecState*
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionRestore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -461,7 +460,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionRestore(ExecSta
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionScale(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -475,7 +474,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionScale(ExecState
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionRotate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -488,7 +487,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionRotate(ExecStat
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionTranslate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -502,7 +501,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionTranslate(ExecS
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionTransform(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -520,7 +519,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionTransform(ExecS
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetTransform(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -538,7 +537,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetTransform(Ex
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionCreateLinearGradient(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -557,7 +556,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionCreateLinearGra
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionCreateRadialGradient(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -578,7 +577,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionCreateRadialGra
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionClearRect(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -594,7 +593,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionClearRect(ExecS
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionFillRect(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -610,7 +609,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionFillRect(ExecSt
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionBeginPath(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -622,7 +621,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionBeginPath(ExecS
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionClosePath(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -634,7 +633,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionClosePath(ExecS
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionMoveTo(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -648,7 +647,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionMoveTo(ExecStat
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionLineTo(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -662,7 +661,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionLineTo(ExecStat
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionQuadraticCurveTo(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -678,7 +677,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionQuadraticCurveT
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionBezierCurveTo(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -696,7 +695,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionBezierCurveTo(E
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionArcTo(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -715,7 +714,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionArcTo(ExecState
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionRect(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -731,7 +730,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionRect(ExecState*
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionArc(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -751,7 +750,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionArc(ExecState*
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionFill(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -763,7 +762,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionFill(ExecState*
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionStroke(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -775,7 +774,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionStroke(ExecStat
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionClip(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -787,7 +786,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionClip(ExecState*
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionIsPointInPath(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -802,7 +801,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionIsPointInPath(E
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionFillText(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->fillText(exec, args);
@@ -811,7 +810,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionFillText(ExecSt
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionStrokeText(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->strokeText(exec, args);
@@ -820,7 +819,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionStrokeText(Exec
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionMeasureText(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -834,7 +833,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionMeasureText(Exe
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetAlpha(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -847,7 +846,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetAlpha(ExecSt
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetCompositeOperation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -860,7 +859,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetCompositeOpe
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetLineWidth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -873,7 +872,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetLineWidth(Ex
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetLineCap(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -886,7 +885,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetLineCap(Exec
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetLineJoin(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -899,7 +898,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetLineJoin(Exe
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetMiterLimit(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -912,7 +911,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetMiterLimit(E
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionClearShadow(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -924,7 +923,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionClearShadow(Exe
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetStrokeColor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->setStrokeColor(exec, args);
@@ -933,7 +932,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetStrokeColor(
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetFillColor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->setFillColor(exec, args);
@@ -942,7 +941,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetFillColor(Ex
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionStrokeRect(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->strokeRect(exec, args);
@@ -951,7 +950,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionStrokeRect(Exec
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionDrawImage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->drawImage(exec, args);
@@ -960,7 +959,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionDrawImage(ExecS
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionDrawImageFromRect(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->drawImageFromRect(exec, args);
@@ -969,7 +968,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionDrawImageFromRe
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetShadow(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->setShadow(exec, args);
@@ -978,7 +977,7 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetShadow(ExecS
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionCreatePattern(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->createPattern(exec, args);
@@ -987,22 +986,24 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionCreatePattern(E
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionCreateImageData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
     float sw = args.at(0).toFloat(exec);
     float sh = args.at(1).toFloat(exec);
 
 
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->createImageData(sw, sh)));
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->createImageData(sw, sh, ec)));
+    setDOMException(exec, ec);
     return result;
 }
 
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionGetImageData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -1021,19 +1022,11 @@ JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionGetImageData(Ex
 JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionPutImageData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
+    if (!thisValue.inherits(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->putImageData(exec, args);
 }
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasRenderingContext2D* object)
-{
-    return getDOMObjectWrapper<JSCanvasRenderingContext2D>(exec, globalObject, object);
-}
-CanvasRenderingContext2D* toCanvasRenderingContext2D(JSC::JSValue value)
-{
-    return value.isObject(&JSCanvasRenderingContext2D::s_info) ? static_cast<JSCanvasRenderingContext2D*>(asObject(value))->impl() : 0;
-}
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.h
index cee9884..3038827 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.h
@@ -21,22 +21,19 @@
 #ifndef JSCanvasRenderingContext2D_h
 #define JSCanvasRenderingContext2D_h
 
-#include "DOMObjectWithSVGContext.h"
-#include "JSDOMBinding.h"
-#include <runtime/JSGlobalObject.h>
-#include <runtime/ObjectPrototype.h>
+#include "JSCanvasRenderingContext.h"
 
 namespace WebCore {
 
 class CanvasRenderingContext2D;
 
-class JSCanvasRenderingContext2D : public DOMObjectWithGlobalPointer {
-    typedef DOMObjectWithGlobalPointer Base;
+class JSCanvasRenderingContext2D : public JSCanvasRenderingContext {
+    typedef JSCanvasRenderingContext Base;
 public:
     JSCanvasRenderingContext2D(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasRenderingContext2D>);
-    virtual ~JSCanvasRenderingContext2D();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -65,14 +62,8 @@ public:
     JSC::JSValue setShadow(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue createPattern(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue putImageData(JSC::ExecState*, const JSC::ArgList&);
-    CanvasRenderingContext2D* impl() const { return m_impl.get(); }
-
-private:
-    RefPtr<CanvasRenderingContext2D> m_impl;
 };
 
-JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasRenderingContext2D*);
-CanvasRenderingContext2D* toCanvasRenderingContext2D(JSC::JSValue);
 
 class JSCanvasRenderingContext2DPrototype : public JSC::JSObject {
     typedef JSC::JSObject Base;
@@ -81,9 +72,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSCanvasRenderingContext2DPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
@@ -136,7 +128,6 @@ JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionGetImageDa
 JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionPutImageData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsCanvasRenderingContext2DCanvas(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsCanvasRenderingContext2DGlobalAlpha(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSCanvasRenderingContext2DGlobalAlpha(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsCanvasRenderingContext2DGlobalCompositeOperation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.cpp
new file mode 100644
index 0000000..2862fca
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.cpp
@@ -0,0 +1,4465 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasRenderingContext3D.h"
+
+#include "CanvasBuffer.h"
+#include "CanvasFloatArray.h"
+#include "CanvasFramebuffer.h"
+#include "CanvasIntArray.h"
+#include "CanvasProgram.h"
+#include "CanvasRenderbuffer.h"
+#include "CanvasRenderingContext3D.h"
+#include "CanvasShader.h"
+#include "CanvasTexture.h"
+#include "CanvasUnsignedByteArray.h"
+#include "JSCanvasBuffer.h"
+#include "JSCanvasFloatArray.h"
+#include "JSCanvasFramebuffer.h"
+#include "JSCanvasIntArray.h"
+#include "JSCanvasProgram.h"
+#include "JSCanvasRenderbuffer.h"
+#include "JSCanvasShader.h"
+#include "JSCanvasTexture.h"
+#include "JSCanvasUnsignedByteArray.h"
+#include "KURL.h"
+#include <runtime/Error.h>
+#include <runtime/JSNumberCell.h>
+#include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSCanvasRenderingContext3D);
+
+/* Hash table */
+
+static const HashTableValue JSCanvasRenderingContext3DTableValues[2] =
+{
+    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCanvasRenderingContext3DConstructor, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSCanvasRenderingContext3DTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSCanvasRenderingContext3DTableValues, 0 };
+#else
+    { 2, 1, JSCanvasRenderingContext3DTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSCanvasRenderingContext3DConstructorTableValues[303] =
+{
+    { "DEPTH_BUFFER_BIT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_BUFFER_BIT, (intptr_t)0 },
+    { "STENCIL_BUFFER_BIT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BUFFER_BIT, (intptr_t)0 },
+    { "COLOR_BUFFER_BIT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOLOR_BUFFER_BIT, (intptr_t)0 },
+    { "FALSE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFALSE, (intptr_t)0 },
+    { "TRUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTRUE, (intptr_t)0 },
+    { "POINTS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPOINTS, (intptr_t)0 },
+    { "LINES", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINES, (intptr_t)0 },
+    { "LINE_LOOP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINE_LOOP, (intptr_t)0 },
+    { "LINE_STRIP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINE_STRIP, (intptr_t)0 },
+    { "TRIANGLES", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTRIANGLES, (intptr_t)0 },
+    { "TRIANGLE_STRIP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTRIANGLE_STRIP, (intptr_t)0 },
+    { "TRIANGLE_FAN", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTRIANGLE_FAN, (intptr_t)0 },
+    { "ZERO", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DZERO, (intptr_t)0 },
+    { "ONE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE, (intptr_t)0 },
+    { "SRC_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSRC_COLOR, (intptr_t)0 },
+    { "ONE_MINUS_SRC_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_SRC_COLOR, (intptr_t)0 },
+    { "SRC_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSRC_ALPHA, (intptr_t)0 },
+    { "ONE_MINUS_SRC_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_SRC_ALPHA, (intptr_t)0 },
+    { "DST_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDST_ALPHA, (intptr_t)0 },
+    { "ONE_MINUS_DST_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_DST_ALPHA, (intptr_t)0 },
+    { "DST_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDST_COLOR, (intptr_t)0 },
+    { "ONE_MINUS_DST_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_DST_COLOR, (intptr_t)0 },
+    { "SRC_ALPHA_SATURATE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSRC_ALPHA_SATURATE, (intptr_t)0 },
+    { "FUNC_ADD", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFUNC_ADD, (intptr_t)0 },
+    { "BLEND_EQUATION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_EQUATION, (intptr_t)0 },
+    { "BLEND_EQUATION_RGB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_EQUATION_RGB, (intptr_t)0 },
+    { "BLEND_EQUATION_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_EQUATION_ALPHA, (intptr_t)0 },
+    { "FUNC_SUBTRACT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFUNC_SUBTRACT, (intptr_t)0 },
+    { "FUNC_REVERSE_SUBTRACT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFUNC_REVERSE_SUBTRACT, (intptr_t)0 },
+    { "BLEND_DST_RGB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_DST_RGB, (intptr_t)0 },
+    { "BLEND_SRC_RGB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_SRC_RGB, (intptr_t)0 },
+    { "BLEND_DST_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_DST_ALPHA, (intptr_t)0 },
+    { "BLEND_SRC_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_SRC_ALPHA, (intptr_t)0 },
+    { "CONSTANT_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCONSTANT_COLOR, (intptr_t)0 },
+    { "ONE_MINUS_CONSTANT_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_CONSTANT_COLOR, (intptr_t)0 },
+    { "CONSTANT_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCONSTANT_ALPHA, (intptr_t)0 },
+    { "ONE_MINUS_CONSTANT_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_CONSTANT_ALPHA, (intptr_t)0 },
+    { "BLEND_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_COLOR, (intptr_t)0 },
+    { "ARRAY_BUFFER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DARRAY_BUFFER, (intptr_t)0 },
+    { "ELEMENT_ARRAY_BUFFER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DELEMENT_ARRAY_BUFFER, (intptr_t)0 },
+    { "ARRAY_BUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DARRAY_BUFFER_BINDING, (intptr_t)0 },
+    { "ELEMENT_ARRAY_BUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DELEMENT_ARRAY_BUFFER_BINDING, (intptr_t)0 },
+    { "STREAM_DRAW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTREAM_DRAW, (intptr_t)0 },
+    { "STATIC_DRAW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTATIC_DRAW, (intptr_t)0 },
+    { "DYNAMIC_DRAW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDYNAMIC_DRAW, (intptr_t)0 },
+    { "BUFFER_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBUFFER_SIZE, (intptr_t)0 },
+    { "BUFFER_USAGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBUFFER_USAGE, (intptr_t)0 },
+    { "CURRENT_VERTEX_ATTRIB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCURRENT_VERTEX_ATTRIB, (intptr_t)0 },
+    { "FRONT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRONT, (intptr_t)0 },
+    { "BACK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBACK, (intptr_t)0 },
+    { "FRONT_AND_BACK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRONT_AND_BACK, (intptr_t)0 },
+    { "TEXTURE_2D", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_2D, (intptr_t)0 },
+    { "CULL_FACE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCULL_FACE, (intptr_t)0 },
+    { "BLEND", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND, (intptr_t)0 },
+    { "DITHER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDITHER, (intptr_t)0 },
+    { "STENCIL_TEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_TEST, (intptr_t)0 },
+    { "DEPTH_TEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_TEST, (intptr_t)0 },
+    { "SCISSOR_TEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSCISSOR_TEST, (intptr_t)0 },
+    { "POLYGON_OFFSET_FILL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPOLYGON_OFFSET_FILL, (intptr_t)0 },
+    { "SAMPLE_ALPHA_TO_COVERAGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_ALPHA_TO_COVERAGE, (intptr_t)0 },
+    { "SAMPLE_COVERAGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_COVERAGE, (intptr_t)0 },
+    { "NO_ERROR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNO_ERROR, (intptr_t)0 },
+    { "INVALID_ENUM", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVALID_ENUM, (intptr_t)0 },
+    { "INVALID_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVALID_VALUE, (intptr_t)0 },
+    { "INVALID_OPERATION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVALID_OPERATION, (intptr_t)0 },
+    { "OUT_OF_MEMORY", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DOUT_OF_MEMORY, (intptr_t)0 },
+    { "CW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCW, (intptr_t)0 },
+    { "CCW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCCW, (intptr_t)0 },
+    { "LINE_WIDTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINE_WIDTH, (intptr_t)0 },
+    { "ALIASED_POINT_SIZE_RANGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALIASED_POINT_SIZE_RANGE, (intptr_t)0 },
+    { "ALIASED_LINE_WIDTH_RANGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALIASED_LINE_WIDTH_RANGE, (intptr_t)0 },
+    { "CULL_FACE_MODE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCULL_FACE_MODE, (intptr_t)0 },
+    { "FRONT_FACE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRONT_FACE, (intptr_t)0 },
+    { "DEPTH_RANGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_RANGE, (intptr_t)0 },
+    { "DEPTH_WRITEMASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_WRITEMASK, (intptr_t)0 },
+    { "DEPTH_CLEAR_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_CLEAR_VALUE, (intptr_t)0 },
+    { "DEPTH_FUNC", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_FUNC, (intptr_t)0 },
+    { "STENCIL_CLEAR_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_CLEAR_VALUE, (intptr_t)0 },
+    { "STENCIL_FUNC", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_FUNC, (intptr_t)0 },
+    { "STENCIL_FAIL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_FAIL, (intptr_t)0 },
+    { "STENCIL_PASS_DEPTH_FAIL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_PASS_DEPTH_FAIL, (intptr_t)0 },
+    { "STENCIL_PASS_DEPTH_PASS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_PASS_DEPTH_PASS, (intptr_t)0 },
+    { "STENCIL_REF", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_REF, (intptr_t)0 },
+    { "STENCIL_VALUE_MASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_VALUE_MASK, (intptr_t)0 },
+    { "STENCIL_WRITEMASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_WRITEMASK, (intptr_t)0 },
+    { "STENCIL_BACK_FUNC", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_FUNC, (intptr_t)0 },
+    { "STENCIL_BACK_FAIL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_FAIL, (intptr_t)0 },
+    { "STENCIL_BACK_PASS_DEPTH_FAIL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_PASS_DEPTH_FAIL, (intptr_t)0 },
+    { "STENCIL_BACK_PASS_DEPTH_PASS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_PASS_DEPTH_PASS, (intptr_t)0 },
+    { "STENCIL_BACK_REF", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_REF, (intptr_t)0 },
+    { "STENCIL_BACK_VALUE_MASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_VALUE_MASK, (intptr_t)0 },
+    { "STENCIL_BACK_WRITEMASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_WRITEMASK, (intptr_t)0 },
+    { "VIEWPORT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVIEWPORT, (intptr_t)0 },
+    { "SCISSOR_BOX", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSCISSOR_BOX, (intptr_t)0 },
+    { "COLOR_CLEAR_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOLOR_CLEAR_VALUE, (intptr_t)0 },
+    { "COLOR_WRITEMASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOLOR_WRITEMASK, (intptr_t)0 },
+    { "UNPACK_ALIGNMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNPACK_ALIGNMENT, (intptr_t)0 },
+    { "PACK_ALIGNMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPACK_ALIGNMENT, (intptr_t)0 },
+    { "MAX_TEXTURE_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_TEXTURE_SIZE, (intptr_t)0 },
+    { "MAX_VIEWPORT_DIMS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VIEWPORT_DIMS, (intptr_t)0 },
+    { "SUBPIXEL_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSUBPIXEL_BITS, (intptr_t)0 },
+    { "RED_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRED_BITS, (intptr_t)0 },
+    { "GREEN_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DGREEN_BITS, (intptr_t)0 },
+    { "BLUE_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLUE_BITS, (intptr_t)0 },
+    { "ALPHA_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALPHA_BITS, (intptr_t)0 },
+    { "DEPTH_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_BITS, (intptr_t)0 },
+    { "STENCIL_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BITS, (intptr_t)0 },
+    { "POLYGON_OFFSET_UNITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPOLYGON_OFFSET_UNITS, (intptr_t)0 },
+    { "POLYGON_OFFSET_FACTOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPOLYGON_OFFSET_FACTOR, (intptr_t)0 },
+    { "TEXTURE_BINDING_2D", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_BINDING_2D, (intptr_t)0 },
+    { "SAMPLE_BUFFERS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_BUFFERS, (intptr_t)0 },
+    { "SAMPLES", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLES, (intptr_t)0 },
+    { "SAMPLE_COVERAGE_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_COVERAGE_VALUE, (intptr_t)0 },
+    { "SAMPLE_COVERAGE_INVERT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_COVERAGE_INVERT, (intptr_t)0 },
+    { "NUM_COMPRESSED_TEXTURE_FORMATS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNUM_COMPRESSED_TEXTURE_FORMATS, (intptr_t)0 },
+    { "COMPRESSED_TEXTURE_FORMATS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOMPRESSED_TEXTURE_FORMATS, (intptr_t)0 },
+    { "DONT_CARE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDONT_CARE, (intptr_t)0 },
+    { "FASTEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFASTEST, (intptr_t)0 },
+    { "NICEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNICEST, (intptr_t)0 },
+    { "GENERATE_MIPMAP_HINT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DGENERATE_MIPMAP_HINT, (intptr_t)0 },
+    { "BYTE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBYTE, (intptr_t)0 },
+    { "UNSIGNED_BYTE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_BYTE, (intptr_t)0 },
+    { "SHORT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHORT, (intptr_t)0 },
+    { "UNSIGNED_SHORT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_SHORT, (intptr_t)0 },
+    { "INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINT, (intptr_t)0 },
+    { "UNSIGNED_INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_INT, (intptr_t)0 },
+    { "FLOAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT, (intptr_t)0 },
+    { "FIXED", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFIXED, (intptr_t)0 },
+    { "DEPTH_COMPONENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_COMPONENT, (intptr_t)0 },
+    { "ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALPHA, (intptr_t)0 },
+    { "RGB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGB, (intptr_t)0 },
+    { "RGBA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGBA, (intptr_t)0 },
+    { "LUMINANCE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLUMINANCE, (intptr_t)0 },
+    { "LUMINANCE_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLUMINANCE_ALPHA, (intptr_t)0 },
+    { "UNSIGNED_SHORT_4_4_4_4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_SHORT_4_4_4_4, (intptr_t)0 },
+    { "UNSIGNED_SHORT_5_5_5_1", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_SHORT_5_5_5_1, (intptr_t)0 },
+    { "UNSIGNED_SHORT_5_6_5", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_SHORT_5_6_5, (intptr_t)0 },
+    { "FRAGMENT_SHADER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAGMENT_SHADER, (intptr_t)0 },
+    { "VERTEX_SHADER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_SHADER, (intptr_t)0 },
+    { "MAX_VERTEX_ATTRIBS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VERTEX_ATTRIBS, (intptr_t)0 },
+    { "MAX_VERTEX_UNIFORM_VECTORS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VERTEX_UNIFORM_VECTORS, (intptr_t)0 },
+    { "MAX_VARYING_VECTORS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VARYING_VECTORS, (intptr_t)0 },
+    { "MAX_COMBINED_TEXTURE_IMAGE_UNITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_COMBINED_TEXTURE_IMAGE_UNITS, (intptr_t)0 },
+    { "MAX_VERTEX_TEXTURE_IMAGE_UNITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VERTEX_TEXTURE_IMAGE_UNITS, (intptr_t)0 },
+    { "MAX_TEXTURE_IMAGE_UNITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_TEXTURE_IMAGE_UNITS, (intptr_t)0 },
+    { "MAX_FRAGMENT_UNIFORM_VECTORS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_FRAGMENT_UNIFORM_VECTORS, (intptr_t)0 },
+    { "SHADER_TYPE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADER_TYPE, (intptr_t)0 },
+    { "DELETE_STATUS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDELETE_STATUS, (intptr_t)0 },
+    { "LINK_STATUS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINK_STATUS, (intptr_t)0 },
+    { "VALIDATE_STATUS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVALIDATE_STATUS, (intptr_t)0 },
+    { "ATTACHED_SHADERS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DATTACHED_SHADERS, (intptr_t)0 },
+    { "ACTIVE_UNIFORMS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_UNIFORMS, (intptr_t)0 },
+    { "ACTIVE_UNIFORM_MAX_LENGTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_UNIFORM_MAX_LENGTH, (intptr_t)0 },
+    { "ACTIVE_ATTRIBUTES", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_ATTRIBUTES, (intptr_t)0 },
+    { "ACTIVE_ATTRIBUTE_MAX_LENGTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_ATTRIBUTE_MAX_LENGTH, (intptr_t)0 },
+    { "SHADING_LANGUAGE_VERSION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADING_LANGUAGE_VERSION, (intptr_t)0 },
+    { "CURRENT_PROGRAM", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCURRENT_PROGRAM, (intptr_t)0 },
+    { "NEVER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNEVER, (intptr_t)0 },
+    { "LESS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLESS, (intptr_t)0 },
+    { "EQUAL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DEQUAL, (intptr_t)0 },
+    { "LEQUAL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLEQUAL, (intptr_t)0 },
+    { "GREATER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DGREATER, (intptr_t)0 },
+    { "NOTEQUAL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNOTEQUAL, (intptr_t)0 },
+    { "GEQUAL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DGEQUAL, (intptr_t)0 },
+    { "ALWAYS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALWAYS, (intptr_t)0 },
+    { "KEEP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DKEEP, (intptr_t)0 },
+    { "REPLACE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DREPLACE, (intptr_t)0 },
+    { "INCR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINCR, (intptr_t)0 },
+    { "DECR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDECR, (intptr_t)0 },
+    { "INVERT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVERT, (intptr_t)0 },
+    { "INCR_WRAP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINCR_WRAP, (intptr_t)0 },
+    { "DECR_WRAP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDECR_WRAP, (intptr_t)0 },
+    { "VENDOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVENDOR, (intptr_t)0 },
+    { "RENDERER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERER, (intptr_t)0 },
+    { "VERSION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERSION, (intptr_t)0 },
+    { "EXTENSIONS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DEXTENSIONS, (intptr_t)0 },
+    { "NEAREST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNEAREST, (intptr_t)0 },
+    { "LINEAR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINEAR, (intptr_t)0 },
+    { "NEAREST_MIPMAP_NEAREST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNEAREST_MIPMAP_NEAREST, (intptr_t)0 },
+    { "LINEAR_MIPMAP_NEAREST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINEAR_MIPMAP_NEAREST, (intptr_t)0 },
+    { "NEAREST_MIPMAP_LINEAR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNEAREST_MIPMAP_LINEAR, (intptr_t)0 },
+    { "LINEAR_MIPMAP_LINEAR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINEAR_MIPMAP_LINEAR, (intptr_t)0 },
+    { "TEXTURE_MAG_FILTER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_MAG_FILTER, (intptr_t)0 },
+    { "TEXTURE_MIN_FILTER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_MIN_FILTER, (intptr_t)0 },
+    { "TEXTURE_WRAP_S", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_WRAP_S, (intptr_t)0 },
+    { "TEXTURE_WRAP_T", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_WRAP_T, (intptr_t)0 },
+    { "TEXTURE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE, (intptr_t)0 },
+    { "TEXTURE_CUBE_MAP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP, (intptr_t)0 },
+    { "TEXTURE_BINDING_CUBE_MAP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_BINDING_CUBE_MAP, (intptr_t)0 },
+    { "TEXTURE_CUBE_MAP_POSITIVE_X", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_X, (intptr_t)0 },
+    { "TEXTURE_CUBE_MAP_NEGATIVE_X", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_X, (intptr_t)0 },
+    { "TEXTURE_CUBE_MAP_POSITIVE_Y", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_Y, (intptr_t)0 },
+    { "TEXTURE_CUBE_MAP_NEGATIVE_Y", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_Y, (intptr_t)0 },
+    { "TEXTURE_CUBE_MAP_POSITIVE_Z", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_Z, (intptr_t)0 },
+    { "TEXTURE_CUBE_MAP_NEGATIVE_Z", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_Z, (intptr_t)0 },
+    { "MAX_CUBE_MAP_TEXTURE_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_CUBE_MAP_TEXTURE_SIZE, (intptr_t)0 },
+    { "TEXTURE0", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE0, (intptr_t)0 },
+    { "TEXTURE1", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE1, (intptr_t)0 },
+    { "TEXTURE2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE2, (intptr_t)0 },
+    { "TEXTURE3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE3, (intptr_t)0 },
+    { "TEXTURE4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE4, (intptr_t)0 },
+    { "TEXTURE5", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE5, (intptr_t)0 },
+    { "TEXTURE6", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE6, (intptr_t)0 },
+    { "TEXTURE7", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE7, (intptr_t)0 },
+    { "TEXTURE8", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE8, (intptr_t)0 },
+    { "TEXTURE9", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE9, (intptr_t)0 },
+    { "TEXTURE10", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE10, (intptr_t)0 },
+    { "TEXTURE11", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE11, (intptr_t)0 },
+    { "TEXTURE12", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE12, (intptr_t)0 },
+    { "TEXTURE13", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE13, (intptr_t)0 },
+    { "TEXTURE14", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE14, (intptr_t)0 },
+    { "TEXTURE15", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE15, (intptr_t)0 },
+    { "TEXTURE16", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE16, (intptr_t)0 },
+    { "TEXTURE17", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE17, (intptr_t)0 },
+    { "TEXTURE18", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE18, (intptr_t)0 },
+    { "TEXTURE19", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE19, (intptr_t)0 },
+    { "TEXTURE20", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE20, (intptr_t)0 },
+    { "TEXTURE21", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE21, (intptr_t)0 },
+    { "TEXTURE22", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE22, (intptr_t)0 },
+    { "TEXTURE23", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE23, (intptr_t)0 },
+    { "TEXTURE24", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE24, (intptr_t)0 },
+    { "TEXTURE25", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE25, (intptr_t)0 },
+    { "TEXTURE26", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE26, (intptr_t)0 },
+    { "TEXTURE27", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE27, (intptr_t)0 },
+    { "TEXTURE28", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE28, (intptr_t)0 },
+    { "TEXTURE29", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE29, (intptr_t)0 },
+    { "TEXTURE30", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE30, (intptr_t)0 },
+    { "TEXTURE31", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE31, (intptr_t)0 },
+    { "ACTIVE_TEXTURE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_TEXTURE, (intptr_t)0 },
+    { "REPEAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DREPEAT, (intptr_t)0 },
+    { "CLAMP_TO_EDGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCLAMP_TO_EDGE, (intptr_t)0 },
+    { "MIRRORED_REPEAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMIRRORED_REPEAT, (intptr_t)0 },
+    { "FLOAT_VEC2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_VEC2, (intptr_t)0 },
+    { "FLOAT_VEC3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_VEC3, (intptr_t)0 },
+    { "FLOAT_VEC4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_VEC4, (intptr_t)0 },
+    { "INT_VEC2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINT_VEC2, (intptr_t)0 },
+    { "INT_VEC3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINT_VEC3, (intptr_t)0 },
+    { "INT_VEC4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINT_VEC4, (intptr_t)0 },
+    { "BOOL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBOOL, (intptr_t)0 },
+    { "BOOL_VEC2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBOOL_VEC2, (intptr_t)0 },
+    { "BOOL_VEC3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBOOL_VEC3, (intptr_t)0 },
+    { "BOOL_VEC4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBOOL_VEC4, (intptr_t)0 },
+    { "FLOAT_MAT2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_MAT2, (intptr_t)0 },
+    { "FLOAT_MAT3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_MAT3, (intptr_t)0 },
+    { "FLOAT_MAT4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_MAT4, (intptr_t)0 },
+    { "SAMPLER_2D", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLER_2D, (intptr_t)0 },
+    { "SAMPLER_CUBE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLER_CUBE, (intptr_t)0 },
+    { "VERTEX_ATTRIB_ARRAY_ENABLED", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_ENABLED, (intptr_t)0 },
+    { "VERTEX_ATTRIB_ARRAY_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_SIZE, (intptr_t)0 },
+    { "VERTEX_ATTRIB_ARRAY_STRIDE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_STRIDE, (intptr_t)0 },
+    { "VERTEX_ATTRIB_ARRAY_TYPE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_TYPE, (intptr_t)0 },
+    { "VERTEX_ATTRIB_ARRAY_NORMALIZED", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_NORMALIZED, (intptr_t)0 },
+    { "VERTEX_ATTRIB_ARRAY_POINTER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_POINTER, (intptr_t)0 },
+    { "VERTEX_ATTRIB_ARRAY_BUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_BUFFER_BINDING, (intptr_t)0 },
+    { "IMPLEMENTATION_COLOR_READ_TYPE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DIMPLEMENTATION_COLOR_READ_TYPE, (intptr_t)0 },
+    { "IMPLEMENTATION_COLOR_READ_FORMAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DIMPLEMENTATION_COLOR_READ_FORMAT, (intptr_t)0 },
+    { "COMPILE_STATUS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOMPILE_STATUS, (intptr_t)0 },
+    { "INFO_LOG_LENGTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINFO_LOG_LENGTH, (intptr_t)0 },
+    { "SHADER_SOURCE_LENGTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADER_SOURCE_LENGTH, (intptr_t)0 },
+    { "SHADER_COMPILER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADER_COMPILER, (intptr_t)0 },
+    { "SHADER_BINARY_FORMATS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADER_BINARY_FORMATS, (intptr_t)0 },
+    { "NUM_SHADER_BINARY_FORMATS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNUM_SHADER_BINARY_FORMATS, (intptr_t)0 },
+    { "LOW_FLOAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLOW_FLOAT, (intptr_t)0 },
+    { "MEDIUM_FLOAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMEDIUM_FLOAT, (intptr_t)0 },
+    { "HIGH_FLOAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DHIGH_FLOAT, (intptr_t)0 },
+    { "LOW_INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLOW_INT, (intptr_t)0 },
+    { "MEDIUM_INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMEDIUM_INT, (intptr_t)0 },
+    { "HIGH_INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DHIGH_INT, (intptr_t)0 },
+    { "FRAMEBUFFER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER, (intptr_t)0 },
+    { "RENDERBUFFER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER, (intptr_t)0 },
+    { "RGBA4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGBA4, (intptr_t)0 },
+    { "RGB5_A1", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGB5_A1, (intptr_t)0 },
+    { "RGB565", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGB565, (intptr_t)0 },
+    { "DEPTH_COMPONENT16", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_COMPONENT16, (intptr_t)0 },
+    { "STENCIL_INDEX", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_INDEX, (intptr_t)0 },
+    { "STENCIL_INDEX8", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_INDEX8, (intptr_t)0 },
+    { "RENDERBUFFER_WIDTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_WIDTH, (intptr_t)0 },
+    { "RENDERBUFFER_HEIGHT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_HEIGHT, (intptr_t)0 },
+    { "RENDERBUFFER_INTERNAL_FORMAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_INTERNAL_FORMAT, (intptr_t)0 },
+    { "RENDERBUFFER_RED_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_RED_SIZE, (intptr_t)0 },
+    { "RENDERBUFFER_GREEN_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_GREEN_SIZE, (intptr_t)0 },
+    { "RENDERBUFFER_BLUE_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_BLUE_SIZE, (intptr_t)0 },
+    { "RENDERBUFFER_ALPHA_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_ALPHA_SIZE, (intptr_t)0 },
+    { "RENDERBUFFER_DEPTH_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_DEPTH_SIZE, (intptr_t)0 },
+    { "RENDERBUFFER_STENCIL_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_STENCIL_SIZE, (intptr_t)0 },
+    { "FRAMEBUFFER_ATTACHMENT_OBJECT_TYPE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_OBJECT_TYPE, (intptr_t)0 },
+    { "FRAMEBUFFER_ATTACHMENT_OBJECT_NAME", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_OBJECT_NAME, (intptr_t)0 },
+    { "FRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL, (intptr_t)0 },
+    { "FRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE, (intptr_t)0 },
+    { "COLOR_ATTACHMENT0", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOLOR_ATTACHMENT0, (intptr_t)0 },
+    { "DEPTH_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_ATTACHMENT, (intptr_t)0 },
+    { "STENCIL_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_ATTACHMENT, (intptr_t)0 },
+    { "NONE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNONE, (intptr_t)0 },
+    { "FRAMEBUFFER_COMPLETE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_COMPLETE, (intptr_t)0 },
+    { "FRAMEBUFFER_INCOMPLETE_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_ATTACHMENT, (intptr_t)0 },
+    { "FRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT, (intptr_t)0 },
+    { "FRAMEBUFFER_INCOMPLETE_DIMENSIONS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_DIMENSIONS, (intptr_t)0 },
+    { "FRAMEBUFFER_UNSUPPORTED", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_UNSUPPORTED, (intptr_t)0 },
+    { "FRAMEBUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_BINDING, (intptr_t)0 },
+    { "RENDERBUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_BINDING, (intptr_t)0 },
+    { "MAX_RENDERBUFFER_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_RENDERBUFFER_SIZE, (intptr_t)0 },
+    { "INVALID_FRAMEBUFFER_OPERATION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVALID_FRAMEBUFFER_OPERATION, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSCanvasRenderingContext3DConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 32767, JSCanvasRenderingContext3DConstructorTableValues, 0 };
+#else
+    { 1063, 1023, JSCanvasRenderingContext3DConstructorTableValues, 0 };
+#endif
+
+class JSCanvasRenderingContext3DConstructor : public DOMConstructorObject {
+public:
+    JSCanvasRenderingContext3DConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSCanvasRenderingContext3DConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSCanvasRenderingContext3DPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+    }
+};
+
+const ClassInfo JSCanvasRenderingContext3DConstructor::s_info = { "CanvasRenderingContext3DConstructor", 0, &JSCanvasRenderingContext3DConstructorTable, 0 };
+
+bool JSCanvasRenderingContext3DConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSCanvasRenderingContext3DConstructor, DOMObject>(exec, &JSCanvasRenderingContext3DConstructorTable, this, propertyName, slot);
+}
+
+bool JSCanvasRenderingContext3DConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCanvasRenderingContext3DConstructor, DOMObject>(exec, &JSCanvasRenderingContext3DConstructorTable, this, propertyName, descriptor);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSCanvasRenderingContext3DPrototypeTableValues[450] =
+{
+    { "DEPTH_BUFFER_BIT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_BUFFER_BIT, (intptr_t)0 },
+    { "STENCIL_BUFFER_BIT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BUFFER_BIT, (intptr_t)0 },
+    { "COLOR_BUFFER_BIT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOLOR_BUFFER_BIT, (intptr_t)0 },
+    { "FALSE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFALSE, (intptr_t)0 },
+    { "TRUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTRUE, (intptr_t)0 },
+    { "POINTS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPOINTS, (intptr_t)0 },
+    { "LINES", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINES, (intptr_t)0 },
+    { "LINE_LOOP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINE_LOOP, (intptr_t)0 },
+    { "LINE_STRIP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINE_STRIP, (intptr_t)0 },
+    { "TRIANGLES", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTRIANGLES, (intptr_t)0 },
+    { "TRIANGLE_STRIP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTRIANGLE_STRIP, (intptr_t)0 },
+    { "TRIANGLE_FAN", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTRIANGLE_FAN, (intptr_t)0 },
+    { "ZERO", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DZERO, (intptr_t)0 },
+    { "ONE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE, (intptr_t)0 },
+    { "SRC_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSRC_COLOR, (intptr_t)0 },
+    { "ONE_MINUS_SRC_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_SRC_COLOR, (intptr_t)0 },
+    { "SRC_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSRC_ALPHA, (intptr_t)0 },
+    { "ONE_MINUS_SRC_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_SRC_ALPHA, (intptr_t)0 },
+    { "DST_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDST_ALPHA, (intptr_t)0 },
+    { "ONE_MINUS_DST_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_DST_ALPHA, (intptr_t)0 },
+    { "DST_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDST_COLOR, (intptr_t)0 },
+    { "ONE_MINUS_DST_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_DST_COLOR, (intptr_t)0 },
+    { "SRC_ALPHA_SATURATE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSRC_ALPHA_SATURATE, (intptr_t)0 },
+    { "FUNC_ADD", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFUNC_ADD, (intptr_t)0 },
+    { "BLEND_EQUATION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_EQUATION, (intptr_t)0 },
+    { "BLEND_EQUATION_RGB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_EQUATION_RGB, (intptr_t)0 },
+    { "BLEND_EQUATION_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_EQUATION_ALPHA, (intptr_t)0 },
+    { "FUNC_SUBTRACT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFUNC_SUBTRACT, (intptr_t)0 },
+    { "FUNC_REVERSE_SUBTRACT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFUNC_REVERSE_SUBTRACT, (intptr_t)0 },
+    { "BLEND_DST_RGB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_DST_RGB, (intptr_t)0 },
+    { "BLEND_SRC_RGB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_SRC_RGB, (intptr_t)0 },
+    { "BLEND_DST_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_DST_ALPHA, (intptr_t)0 },
+    { "BLEND_SRC_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_SRC_ALPHA, (intptr_t)0 },
+    { "CONSTANT_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCONSTANT_COLOR, (intptr_t)0 },
+    { "ONE_MINUS_CONSTANT_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_CONSTANT_COLOR, (intptr_t)0 },
+    { "CONSTANT_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCONSTANT_ALPHA, (intptr_t)0 },
+    { "ONE_MINUS_CONSTANT_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_CONSTANT_ALPHA, (intptr_t)0 },
+    { "BLEND_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_COLOR, (intptr_t)0 },
+    { "ARRAY_BUFFER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DARRAY_BUFFER, (intptr_t)0 },
+    { "ELEMENT_ARRAY_BUFFER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DELEMENT_ARRAY_BUFFER, (intptr_t)0 },
+    { "ARRAY_BUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DARRAY_BUFFER_BINDING, (intptr_t)0 },
+    { "ELEMENT_ARRAY_BUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DELEMENT_ARRAY_BUFFER_BINDING, (intptr_t)0 },
+    { "STREAM_DRAW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTREAM_DRAW, (intptr_t)0 },
+    { "STATIC_DRAW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTATIC_DRAW, (intptr_t)0 },
+    { "DYNAMIC_DRAW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDYNAMIC_DRAW, (intptr_t)0 },
+    { "BUFFER_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBUFFER_SIZE, (intptr_t)0 },
+    { "BUFFER_USAGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBUFFER_USAGE, (intptr_t)0 },
+    { "CURRENT_VERTEX_ATTRIB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCURRENT_VERTEX_ATTRIB, (intptr_t)0 },
+    { "FRONT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRONT, (intptr_t)0 },
+    { "BACK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBACK, (intptr_t)0 },
+    { "FRONT_AND_BACK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRONT_AND_BACK, (intptr_t)0 },
+    { "TEXTURE_2D", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_2D, (intptr_t)0 },
+    { "CULL_FACE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCULL_FACE, (intptr_t)0 },
+    { "BLEND", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND, (intptr_t)0 },
+    { "DITHER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDITHER, (intptr_t)0 },
+    { "STENCIL_TEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_TEST, (intptr_t)0 },
+    { "DEPTH_TEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_TEST, (intptr_t)0 },
+    { "SCISSOR_TEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSCISSOR_TEST, (intptr_t)0 },
+    { "POLYGON_OFFSET_FILL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPOLYGON_OFFSET_FILL, (intptr_t)0 },
+    { "SAMPLE_ALPHA_TO_COVERAGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_ALPHA_TO_COVERAGE, (intptr_t)0 },
+    { "SAMPLE_COVERAGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_COVERAGE, (intptr_t)0 },
+    { "NO_ERROR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNO_ERROR, (intptr_t)0 },
+    { "INVALID_ENUM", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVALID_ENUM, (intptr_t)0 },
+    { "INVALID_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVALID_VALUE, (intptr_t)0 },
+    { "INVALID_OPERATION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVALID_OPERATION, (intptr_t)0 },
+    { "OUT_OF_MEMORY", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DOUT_OF_MEMORY, (intptr_t)0 },
+    { "CW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCW, (intptr_t)0 },
+    { "CCW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCCW, (intptr_t)0 },
+    { "LINE_WIDTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINE_WIDTH, (intptr_t)0 },
+    { "ALIASED_POINT_SIZE_RANGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALIASED_POINT_SIZE_RANGE, (intptr_t)0 },
+    { "ALIASED_LINE_WIDTH_RANGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALIASED_LINE_WIDTH_RANGE, (intptr_t)0 },
+    { "CULL_FACE_MODE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCULL_FACE_MODE, (intptr_t)0 },
+    { "FRONT_FACE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRONT_FACE, (intptr_t)0 },
+    { "DEPTH_RANGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_RANGE, (intptr_t)0 },
+    { "DEPTH_WRITEMASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_WRITEMASK, (intptr_t)0 },
+    { "DEPTH_CLEAR_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_CLEAR_VALUE, (intptr_t)0 },
+    { "DEPTH_FUNC", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_FUNC, (intptr_t)0 },
+    { "STENCIL_CLEAR_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_CLEAR_VALUE, (intptr_t)0 },
+    { "STENCIL_FUNC", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_FUNC, (intptr_t)0 },
+    { "STENCIL_FAIL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_FAIL, (intptr_t)0 },
+    { "STENCIL_PASS_DEPTH_FAIL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_PASS_DEPTH_FAIL, (intptr_t)0 },
+    { "STENCIL_PASS_DEPTH_PASS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_PASS_DEPTH_PASS, (intptr_t)0 },
+    { "STENCIL_REF", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_REF, (intptr_t)0 },
+    { "STENCIL_VALUE_MASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_VALUE_MASK, (intptr_t)0 },
+    { "STENCIL_WRITEMASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_WRITEMASK, (intptr_t)0 },
+    { "STENCIL_BACK_FUNC", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_FUNC, (intptr_t)0 },
+    { "STENCIL_BACK_FAIL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_FAIL, (intptr_t)0 },
+    { "STENCIL_BACK_PASS_DEPTH_FAIL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_PASS_DEPTH_FAIL, (intptr_t)0 },
+    { "STENCIL_BACK_PASS_DEPTH_PASS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_PASS_DEPTH_PASS, (intptr_t)0 },
+    { "STENCIL_BACK_REF", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_REF, (intptr_t)0 },
+    { "STENCIL_BACK_VALUE_MASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_VALUE_MASK, (intptr_t)0 },
+    { "STENCIL_BACK_WRITEMASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_WRITEMASK, (intptr_t)0 },
+    { "VIEWPORT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVIEWPORT, (intptr_t)0 },
+    { "SCISSOR_BOX", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSCISSOR_BOX, (intptr_t)0 },
+    { "COLOR_CLEAR_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOLOR_CLEAR_VALUE, (intptr_t)0 },
+    { "COLOR_WRITEMASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOLOR_WRITEMASK, (intptr_t)0 },
+    { "UNPACK_ALIGNMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNPACK_ALIGNMENT, (intptr_t)0 },
+    { "PACK_ALIGNMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPACK_ALIGNMENT, (intptr_t)0 },
+    { "MAX_TEXTURE_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_TEXTURE_SIZE, (intptr_t)0 },
+    { "MAX_VIEWPORT_DIMS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VIEWPORT_DIMS, (intptr_t)0 },
+    { "SUBPIXEL_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSUBPIXEL_BITS, (intptr_t)0 },
+    { "RED_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRED_BITS, (intptr_t)0 },
+    { "GREEN_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DGREEN_BITS, (intptr_t)0 },
+    { "BLUE_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLUE_BITS, (intptr_t)0 },
+    { "ALPHA_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALPHA_BITS, (intptr_t)0 },
+    { "DEPTH_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_BITS, (intptr_t)0 },
+    { "STENCIL_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BITS, (intptr_t)0 },
+    { "POLYGON_OFFSET_UNITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPOLYGON_OFFSET_UNITS, (intptr_t)0 },
+    { "POLYGON_OFFSET_FACTOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPOLYGON_OFFSET_FACTOR, (intptr_t)0 },
+    { "TEXTURE_BINDING_2D", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_BINDING_2D, (intptr_t)0 },
+    { "SAMPLE_BUFFERS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_BUFFERS, (intptr_t)0 },
+    { "SAMPLES", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLES, (intptr_t)0 },
+    { "SAMPLE_COVERAGE_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_COVERAGE_VALUE, (intptr_t)0 },
+    { "SAMPLE_COVERAGE_INVERT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_COVERAGE_INVERT, (intptr_t)0 },
+    { "NUM_COMPRESSED_TEXTURE_FORMATS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNUM_COMPRESSED_TEXTURE_FORMATS, (intptr_t)0 },
+    { "COMPRESSED_TEXTURE_FORMATS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOMPRESSED_TEXTURE_FORMATS, (intptr_t)0 },
+    { "DONT_CARE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDONT_CARE, (intptr_t)0 },
+    { "FASTEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFASTEST, (intptr_t)0 },
+    { "NICEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNICEST, (intptr_t)0 },
+    { "GENERATE_MIPMAP_HINT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DGENERATE_MIPMAP_HINT, (intptr_t)0 },
+    { "BYTE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBYTE, (intptr_t)0 },
+    { "UNSIGNED_BYTE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_BYTE, (intptr_t)0 },
+    { "SHORT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHORT, (intptr_t)0 },
+    { "UNSIGNED_SHORT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_SHORT, (intptr_t)0 },
+    { "INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINT, (intptr_t)0 },
+    { "UNSIGNED_INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_INT, (intptr_t)0 },
+    { "FLOAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT, (intptr_t)0 },
+    { "FIXED", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFIXED, (intptr_t)0 },
+    { "DEPTH_COMPONENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_COMPONENT, (intptr_t)0 },
+    { "ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALPHA, (intptr_t)0 },
+    { "RGB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGB, (intptr_t)0 },
+    { "RGBA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGBA, (intptr_t)0 },
+    { "LUMINANCE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLUMINANCE, (intptr_t)0 },
+    { "LUMINANCE_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLUMINANCE_ALPHA, (intptr_t)0 },
+    { "UNSIGNED_SHORT_4_4_4_4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_SHORT_4_4_4_4, (intptr_t)0 },
+    { "UNSIGNED_SHORT_5_5_5_1", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_SHORT_5_5_5_1, (intptr_t)0 },
+    { "UNSIGNED_SHORT_5_6_5", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_SHORT_5_6_5, (intptr_t)0 },
+    { "FRAGMENT_SHADER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAGMENT_SHADER, (intptr_t)0 },
+    { "VERTEX_SHADER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_SHADER, (intptr_t)0 },
+    { "MAX_VERTEX_ATTRIBS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VERTEX_ATTRIBS, (intptr_t)0 },
+    { "MAX_VERTEX_UNIFORM_VECTORS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VERTEX_UNIFORM_VECTORS, (intptr_t)0 },
+    { "MAX_VARYING_VECTORS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VARYING_VECTORS, (intptr_t)0 },
+    { "MAX_COMBINED_TEXTURE_IMAGE_UNITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_COMBINED_TEXTURE_IMAGE_UNITS, (intptr_t)0 },
+    { "MAX_VERTEX_TEXTURE_IMAGE_UNITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VERTEX_TEXTURE_IMAGE_UNITS, (intptr_t)0 },
+    { "MAX_TEXTURE_IMAGE_UNITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_TEXTURE_IMAGE_UNITS, (intptr_t)0 },
+    { "MAX_FRAGMENT_UNIFORM_VECTORS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_FRAGMENT_UNIFORM_VECTORS, (intptr_t)0 },
+    { "SHADER_TYPE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADER_TYPE, (intptr_t)0 },
+    { "DELETE_STATUS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDELETE_STATUS, (intptr_t)0 },
+    { "LINK_STATUS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINK_STATUS, (intptr_t)0 },
+    { "VALIDATE_STATUS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVALIDATE_STATUS, (intptr_t)0 },
+    { "ATTACHED_SHADERS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DATTACHED_SHADERS, (intptr_t)0 },
+    { "ACTIVE_UNIFORMS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_UNIFORMS, (intptr_t)0 },
+    { "ACTIVE_UNIFORM_MAX_LENGTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_UNIFORM_MAX_LENGTH, (intptr_t)0 },
+    { "ACTIVE_ATTRIBUTES", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_ATTRIBUTES, (intptr_t)0 },
+    { "ACTIVE_ATTRIBUTE_MAX_LENGTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_ATTRIBUTE_MAX_LENGTH, (intptr_t)0 },
+    { "SHADING_LANGUAGE_VERSION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADING_LANGUAGE_VERSION, (intptr_t)0 },
+    { "CURRENT_PROGRAM", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCURRENT_PROGRAM, (intptr_t)0 },
+    { "NEVER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNEVER, (intptr_t)0 },
+    { "LESS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLESS, (intptr_t)0 },
+    { "EQUAL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DEQUAL, (intptr_t)0 },
+    { "LEQUAL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLEQUAL, (intptr_t)0 },
+    { "GREATER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DGREATER, (intptr_t)0 },
+    { "NOTEQUAL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNOTEQUAL, (intptr_t)0 },
+    { "GEQUAL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DGEQUAL, (intptr_t)0 },
+    { "ALWAYS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALWAYS, (intptr_t)0 },
+    { "KEEP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DKEEP, (intptr_t)0 },
+    { "REPLACE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DREPLACE, (intptr_t)0 },
+    { "INCR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINCR, (intptr_t)0 },
+    { "DECR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDECR, (intptr_t)0 },
+    { "INVERT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVERT, (intptr_t)0 },
+    { "INCR_WRAP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINCR_WRAP, (intptr_t)0 },
+    { "DECR_WRAP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDECR_WRAP, (intptr_t)0 },
+    { "VENDOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVENDOR, (intptr_t)0 },
+    { "RENDERER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERER, (intptr_t)0 },
+    { "VERSION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERSION, (intptr_t)0 },
+    { "EXTENSIONS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DEXTENSIONS, (intptr_t)0 },
+    { "NEAREST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNEAREST, (intptr_t)0 },
+    { "LINEAR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINEAR, (intptr_t)0 },
+    { "NEAREST_MIPMAP_NEAREST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNEAREST_MIPMAP_NEAREST, (intptr_t)0 },
+    { "LINEAR_MIPMAP_NEAREST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINEAR_MIPMAP_NEAREST, (intptr_t)0 },
+    { "NEAREST_MIPMAP_LINEAR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNEAREST_MIPMAP_LINEAR, (intptr_t)0 },
+    { "LINEAR_MIPMAP_LINEAR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINEAR_MIPMAP_LINEAR, (intptr_t)0 },
+    { "TEXTURE_MAG_FILTER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_MAG_FILTER, (intptr_t)0 },
+    { "TEXTURE_MIN_FILTER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_MIN_FILTER, (intptr_t)0 },
+    { "TEXTURE_WRAP_S", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_WRAP_S, (intptr_t)0 },
+    { "TEXTURE_WRAP_T", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_WRAP_T, (intptr_t)0 },
+    { "TEXTURE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE, (intptr_t)0 },
+    { "TEXTURE_CUBE_MAP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP, (intptr_t)0 },
+    { "TEXTURE_BINDING_CUBE_MAP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_BINDING_CUBE_MAP, (intptr_t)0 },
+    { "TEXTURE_CUBE_MAP_POSITIVE_X", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_X, (intptr_t)0 },
+    { "TEXTURE_CUBE_MAP_NEGATIVE_X", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_X, (intptr_t)0 },
+    { "TEXTURE_CUBE_MAP_POSITIVE_Y", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_Y, (intptr_t)0 },
+    { "TEXTURE_CUBE_MAP_NEGATIVE_Y", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_Y, (intptr_t)0 },
+    { "TEXTURE_CUBE_MAP_POSITIVE_Z", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_Z, (intptr_t)0 },
+    { "TEXTURE_CUBE_MAP_NEGATIVE_Z", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_Z, (intptr_t)0 },
+    { "MAX_CUBE_MAP_TEXTURE_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_CUBE_MAP_TEXTURE_SIZE, (intptr_t)0 },
+    { "TEXTURE0", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE0, (intptr_t)0 },
+    { "TEXTURE1", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE1, (intptr_t)0 },
+    { "TEXTURE2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE2, (intptr_t)0 },
+    { "TEXTURE3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE3, (intptr_t)0 },
+    { "TEXTURE4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE4, (intptr_t)0 },
+    { "TEXTURE5", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE5, (intptr_t)0 },
+    { "TEXTURE6", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE6, (intptr_t)0 },
+    { "TEXTURE7", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE7, (intptr_t)0 },
+    { "TEXTURE8", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE8, (intptr_t)0 },
+    { "TEXTURE9", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE9, (intptr_t)0 },
+    { "TEXTURE10", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE10, (intptr_t)0 },
+    { "TEXTURE11", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE11, (intptr_t)0 },
+    { "TEXTURE12", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE12, (intptr_t)0 },
+    { "TEXTURE13", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE13, (intptr_t)0 },
+    { "TEXTURE14", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE14, (intptr_t)0 },
+    { "TEXTURE15", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE15, (intptr_t)0 },
+    { "TEXTURE16", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE16, (intptr_t)0 },
+    { "TEXTURE17", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE17, (intptr_t)0 },
+    { "TEXTURE18", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE18, (intptr_t)0 },
+    { "TEXTURE19", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE19, (intptr_t)0 },
+    { "TEXTURE20", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE20, (intptr_t)0 },
+    { "TEXTURE21", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE21, (intptr_t)0 },
+    { "TEXTURE22", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE22, (intptr_t)0 },
+    { "TEXTURE23", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE23, (intptr_t)0 },
+    { "TEXTURE24", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE24, (intptr_t)0 },
+    { "TEXTURE25", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE25, (intptr_t)0 },
+    { "TEXTURE26", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE26, (intptr_t)0 },
+    { "TEXTURE27", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE27, (intptr_t)0 },
+    { "TEXTURE28", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE28, (intptr_t)0 },
+    { "TEXTURE29", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE29, (intptr_t)0 },
+    { "TEXTURE30", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE30, (intptr_t)0 },
+    { "TEXTURE31", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE31, (intptr_t)0 },
+    { "ACTIVE_TEXTURE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_TEXTURE, (intptr_t)0 },
+    { "REPEAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DREPEAT, (intptr_t)0 },
+    { "CLAMP_TO_EDGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCLAMP_TO_EDGE, (intptr_t)0 },
+    { "MIRRORED_REPEAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMIRRORED_REPEAT, (intptr_t)0 },
+    { "FLOAT_VEC2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_VEC2, (intptr_t)0 },
+    { "FLOAT_VEC3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_VEC3, (intptr_t)0 },
+    { "FLOAT_VEC4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_VEC4, (intptr_t)0 },
+    { "INT_VEC2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINT_VEC2, (intptr_t)0 },
+    { "INT_VEC3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINT_VEC3, (intptr_t)0 },
+    { "INT_VEC4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINT_VEC4, (intptr_t)0 },
+    { "BOOL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBOOL, (intptr_t)0 },
+    { "BOOL_VEC2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBOOL_VEC2, (intptr_t)0 },
+    { "BOOL_VEC3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBOOL_VEC3, (intptr_t)0 },
+    { "BOOL_VEC4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBOOL_VEC4, (intptr_t)0 },
+    { "FLOAT_MAT2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_MAT2, (intptr_t)0 },
+    { "FLOAT_MAT3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_MAT3, (intptr_t)0 },
+    { "FLOAT_MAT4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_MAT4, (intptr_t)0 },
+    { "SAMPLER_2D", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLER_2D, (intptr_t)0 },
+    { "SAMPLER_CUBE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLER_CUBE, (intptr_t)0 },
+    { "VERTEX_ATTRIB_ARRAY_ENABLED", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_ENABLED, (intptr_t)0 },
+    { "VERTEX_ATTRIB_ARRAY_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_SIZE, (intptr_t)0 },
+    { "VERTEX_ATTRIB_ARRAY_STRIDE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_STRIDE, (intptr_t)0 },
+    { "VERTEX_ATTRIB_ARRAY_TYPE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_TYPE, (intptr_t)0 },
+    { "VERTEX_ATTRIB_ARRAY_NORMALIZED", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_NORMALIZED, (intptr_t)0 },
+    { "VERTEX_ATTRIB_ARRAY_POINTER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_POINTER, (intptr_t)0 },
+    { "VERTEX_ATTRIB_ARRAY_BUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_BUFFER_BINDING, (intptr_t)0 },
+    { "IMPLEMENTATION_COLOR_READ_TYPE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DIMPLEMENTATION_COLOR_READ_TYPE, (intptr_t)0 },
+    { "IMPLEMENTATION_COLOR_READ_FORMAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DIMPLEMENTATION_COLOR_READ_FORMAT, (intptr_t)0 },
+    { "COMPILE_STATUS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOMPILE_STATUS, (intptr_t)0 },
+    { "INFO_LOG_LENGTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINFO_LOG_LENGTH, (intptr_t)0 },
+    { "SHADER_SOURCE_LENGTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADER_SOURCE_LENGTH, (intptr_t)0 },
+    { "SHADER_COMPILER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADER_COMPILER, (intptr_t)0 },
+    { "SHADER_BINARY_FORMATS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADER_BINARY_FORMATS, (intptr_t)0 },
+    { "NUM_SHADER_BINARY_FORMATS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNUM_SHADER_BINARY_FORMATS, (intptr_t)0 },
+    { "LOW_FLOAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLOW_FLOAT, (intptr_t)0 },
+    { "MEDIUM_FLOAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMEDIUM_FLOAT, (intptr_t)0 },
+    { "HIGH_FLOAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DHIGH_FLOAT, (intptr_t)0 },
+    { "LOW_INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLOW_INT, (intptr_t)0 },
+    { "MEDIUM_INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMEDIUM_INT, (intptr_t)0 },
+    { "HIGH_INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DHIGH_INT, (intptr_t)0 },
+    { "FRAMEBUFFER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER, (intptr_t)0 },
+    { "RENDERBUFFER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER, (intptr_t)0 },
+    { "RGBA4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGBA4, (intptr_t)0 },
+    { "RGB5_A1", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGB5_A1, (intptr_t)0 },
+    { "RGB565", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGB565, (intptr_t)0 },
+    { "DEPTH_COMPONENT16", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_COMPONENT16, (intptr_t)0 },
+    { "STENCIL_INDEX", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_INDEX, (intptr_t)0 },
+    { "STENCIL_INDEX8", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_INDEX8, (intptr_t)0 },
+    { "RENDERBUFFER_WIDTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_WIDTH, (intptr_t)0 },
+    { "RENDERBUFFER_HEIGHT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_HEIGHT, (intptr_t)0 },
+    { "RENDERBUFFER_INTERNAL_FORMAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_INTERNAL_FORMAT, (intptr_t)0 },
+    { "RENDERBUFFER_RED_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_RED_SIZE, (intptr_t)0 },
+    { "RENDERBUFFER_GREEN_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_GREEN_SIZE, (intptr_t)0 },
+    { "RENDERBUFFER_BLUE_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_BLUE_SIZE, (intptr_t)0 },
+    { "RENDERBUFFER_ALPHA_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_ALPHA_SIZE, (intptr_t)0 },
+    { "RENDERBUFFER_DEPTH_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_DEPTH_SIZE, (intptr_t)0 },
+    { "RENDERBUFFER_STENCIL_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_STENCIL_SIZE, (intptr_t)0 },
+    { "FRAMEBUFFER_ATTACHMENT_OBJECT_TYPE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_OBJECT_TYPE, (intptr_t)0 },
+    { "FRAMEBUFFER_ATTACHMENT_OBJECT_NAME", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_OBJECT_NAME, (intptr_t)0 },
+    { "FRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL, (intptr_t)0 },
+    { "FRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE, (intptr_t)0 },
+    { "COLOR_ATTACHMENT0", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOLOR_ATTACHMENT0, (intptr_t)0 },
+    { "DEPTH_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_ATTACHMENT, (intptr_t)0 },
+    { "STENCIL_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_ATTACHMENT, (intptr_t)0 },
+    { "NONE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNONE, (intptr_t)0 },
+    { "FRAMEBUFFER_COMPLETE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_COMPLETE, (intptr_t)0 },
+    { "FRAMEBUFFER_INCOMPLETE_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_ATTACHMENT, (intptr_t)0 },
+    { "FRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT, (intptr_t)0 },
+    { "FRAMEBUFFER_INCOMPLETE_DIMENSIONS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_DIMENSIONS, (intptr_t)0 },
+    { "FRAMEBUFFER_UNSUPPORTED", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_UNSUPPORTED, (intptr_t)0 },
+    { "FRAMEBUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_BINDING, (intptr_t)0 },
+    { "RENDERBUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_BINDING, (intptr_t)0 },
+    { "MAX_RENDERBUFFER_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_RENDERBUFFER_SIZE, (intptr_t)0 },
+    { "INVALID_FRAMEBUFFER_OPERATION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVALID_FRAMEBUFFER_OPERATION, (intptr_t)0 },
+    { "sizeInBytes", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionSizeInBytes, (intptr_t)1 },
+    { "activeTexture", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionActiveTexture, (intptr_t)1 },
+    { "attachShader", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionAttachShader, (intptr_t)2 },
+    { "bindAttribLocation", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBindAttribLocation, (intptr_t)3 },
+    { "bindBuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBindBuffer, (intptr_t)2 },
+    { "bindFramebuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBindFramebuffer, (intptr_t)2 },
+    { "bindRenderbuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBindRenderbuffer, (intptr_t)2 },
+    { "bindTexture", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBindTexture, (intptr_t)2 },
+    { "blendColor", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBlendColor, (intptr_t)4 },
+    { "blendEquation", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBlendEquation, (intptr_t)1 },
+    { "blendEquationSeparate", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBlendEquationSeparate, (intptr_t)2 },
+    { "blendFunc", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBlendFunc, (intptr_t)2 },
+    { "blendFuncSeparate", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBlendFuncSeparate, (intptr_t)4 },
+    { "bufferData", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBufferData, (intptr_t)0 },
+    { "bufferSubData", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBufferSubData, (intptr_t)0 },
+    { "checkFramebufferStatus", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCheckFramebufferStatus, (intptr_t)1 },
+    { "clear", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionClear, (intptr_t)1 },
+    { "clearColor", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionClearColor, (intptr_t)4 },
+    { "clearDepth", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionClearDepth, (intptr_t)1 },
+    { "clearStencil", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionClearStencil, (intptr_t)1 },
+    { "colorMask", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionColorMask, (intptr_t)4 },
+    { "compileShader", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCompileShader, (intptr_t)1 },
+    { "copyTexImage2D", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCopyTexImage2D, (intptr_t)8 },
+    { "copyTexSubImage2D", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCopyTexSubImage2D, (intptr_t)8 },
+    { "createBuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCreateBuffer, (intptr_t)0 },
+    { "createFramebuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCreateFramebuffer, (intptr_t)0 },
+    { "createProgram", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCreateProgram, (intptr_t)0 },
+    { "createRenderbuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCreateRenderbuffer, (intptr_t)0 },
+    { "createShader", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCreateShader, (intptr_t)1 },
+    { "createTexture", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCreateTexture, (intptr_t)0 },
+    { "cullFace", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCullFace, (intptr_t)1 },
+    { "deleteBuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDeleteBuffer, (intptr_t)1 },
+    { "deleteFramebuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDeleteFramebuffer, (intptr_t)1 },
+    { "deleteProgram", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDeleteProgram, (intptr_t)1 },
+    { "deleteRenderbuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDeleteRenderbuffer, (intptr_t)1 },
+    { "deleteShader", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDeleteShader, (intptr_t)1 },
+    { "deleteTexture", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDeleteTexture, (intptr_t)1 },
+    { "depthFunc", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDepthFunc, (intptr_t)1 },
+    { "depthMask", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDepthMask, (intptr_t)1 },
+    { "depthRange", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDepthRange, (intptr_t)2 },
+    { "detachShader", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDetachShader, (intptr_t)2 },
+    { "disable", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDisable, (intptr_t)1 },
+    { "disableVertexAttribArray", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDisableVertexAttribArray, (intptr_t)1 },
+    { "drawArrays", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDrawArrays, (intptr_t)3 },
+    { "drawElements", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDrawElements, (intptr_t)4 },
+    { "enable", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionEnable, (intptr_t)1 },
+    { "enableVertexAttribArray", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionEnableVertexAttribArray, (intptr_t)1 },
+    { "finish", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionFinish, (intptr_t)0 },
+    { "flush", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionFlush, (intptr_t)0 },
+    { "framebufferRenderbuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionFramebufferRenderbuffer, (intptr_t)4 },
+    { "framebufferTexture2D", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionFramebufferTexture2D, (intptr_t)5 },
+    { "frontFace", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionFrontFace, (intptr_t)1 },
+    { "generateMipmap", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGenerateMipmap, (intptr_t)1 },
+    { "getAttribLocation", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetAttribLocation, (intptr_t)2 },
+    { "getBoolean", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetBoolean, (intptr_t)1 },
+    { "getBooleanv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetBooleanv, (intptr_t)1 },
+    { "getBufferParameteri", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetBufferParameteri, (intptr_t)2 },
+    { "getBufferParameteriv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetBufferParameteriv, (intptr_t)2 },
+    { "getError", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetError, (intptr_t)0 },
+    { "getFloat", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetFloat, (intptr_t)1 },
+    { "getFloatv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetFloatv, (intptr_t)1 },
+    { "getFramebufferAttachmentParameteri", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetFramebufferAttachmentParameteri, (intptr_t)3 },
+    { "getFramebufferAttachmentParameteriv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetFramebufferAttachmentParameteriv, (intptr_t)3 },
+    { "getInteger", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetInteger, (intptr_t)1 },
+    { "getIntegerv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetIntegerv, (intptr_t)1 },
+    { "getProgrami", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetProgrami, (intptr_t)2 },
+    { "getProgramiv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetProgramiv, (intptr_t)2 },
+    { "getProgramInfoLog", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetProgramInfoLog, (intptr_t)1 },
+    { "getRenderbufferParameteri", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetRenderbufferParameteri, (intptr_t)2 },
+    { "getRenderbufferParameteriv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetRenderbufferParameteriv, (intptr_t)2 },
+    { "getShaderi", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetShaderi, (intptr_t)2 },
+    { "getShaderiv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetShaderiv, (intptr_t)2 },
+    { "getShaderInfoLog", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetShaderInfoLog, (intptr_t)1 },
+    { "getShaderSource", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetShaderSource, (intptr_t)1 },
+    { "getString", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetString, (intptr_t)1 },
+    { "getTexParameterf", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetTexParameterf, (intptr_t)2 },
+    { "getTexParameterfv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetTexParameterfv, (intptr_t)2 },
+    { "getTexParameteri", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetTexParameteri, (intptr_t)2 },
+    { "getTexParameteriv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetTexParameteriv, (intptr_t)2 },
+    { "getUniformf", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetUniformf, (intptr_t)2 },
+    { "getUniformfv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetUniformfv, (intptr_t)2 },
+    { "getUniformi", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetUniformi, (intptr_t)2 },
+    { "getUniformiv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetUniformiv, (intptr_t)2 },
+    { "getUniformLocation", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetUniformLocation, (intptr_t)2 },
+    { "getVertexAttribf", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribf, (intptr_t)2 },
+    { "getVertexAttribfv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribfv, (intptr_t)2 },
+    { "getVertexAttribi", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribi, (intptr_t)2 },
+    { "getVertexAttribiv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribiv, (intptr_t)2 },
+    { "getVertexAttribOffset", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribOffset, (intptr_t)2 },
+    { "hint", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionHint, (intptr_t)2 },
+    { "isBuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionIsBuffer, (intptr_t)1 },
+    { "isEnabled", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionIsEnabled, (intptr_t)1 },
+    { "isFramebuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionIsFramebuffer, (intptr_t)1 },
+    { "isProgram", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionIsProgram, (intptr_t)1 },
+    { "isRenderbuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionIsRenderbuffer, (intptr_t)1 },
+    { "isShader", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionIsShader, (intptr_t)1 },
+    { "isTexture", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionIsTexture, (intptr_t)1 },
+    { "lineWidth", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionLineWidth, (intptr_t)1 },
+    { "linkProgram", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionLinkProgram, (intptr_t)1 },
+    { "pixelStorei", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionPixelStorei, (intptr_t)2 },
+    { "polygonOffset", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionPolygonOffset, (intptr_t)2 },
+    { "releaseShaderCompiler", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionReleaseShaderCompiler, (intptr_t)0 },
+    { "renderbufferStorage", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionRenderbufferStorage, (intptr_t)4 },
+    { "sampleCoverage", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionSampleCoverage, (intptr_t)2 },
+    { "scissor", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionScissor, (intptr_t)4 },
+    { "shaderSource", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionShaderSource, (intptr_t)2 },
+    { "stencilFunc", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionStencilFunc, (intptr_t)3 },
+    { "stencilFuncSeparate", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionStencilFuncSeparate, (intptr_t)4 },
+    { "stencilMask", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionStencilMask, (intptr_t)1 },
+    { "stencilMaskSeparate", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionStencilMaskSeparate, (intptr_t)2 },
+    { "stencilOp", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionStencilOp, (intptr_t)3 },
+    { "stencilOpSeparate", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionStencilOpSeparate, (intptr_t)4 },
+    { "texParameterf", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionTexParameterf, (intptr_t)3 },
+    { "texParameteri", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionTexParameteri, (intptr_t)3 },
+    { "texImage2D", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionTexImage2D, (intptr_t)0 },
+    { "texSubImage2D", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionTexSubImage2D, (intptr_t)0 },
+    { "uniform1f", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform1f, (intptr_t)2 },
+    { "uniform1fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform1fv, (intptr_t)2 },
+    { "uniform1i", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform1i, (intptr_t)2 },
+    { "uniform1iv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform1iv, (intptr_t)2 },
+    { "uniform2f", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform2f, (intptr_t)3 },
+    { "uniform2fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform2fv, (intptr_t)2 },
+    { "uniform2i", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform2i, (intptr_t)3 },
+    { "uniform2iv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform2iv, (intptr_t)2 },
+    { "uniform3f", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform3f, (intptr_t)4 },
+    { "uniform3fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform3fv, (intptr_t)2 },
+    { "uniform3i", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform3i, (intptr_t)4 },
+    { "uniform3iv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform3iv, (intptr_t)2 },
+    { "uniform4f", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform4f, (intptr_t)5 },
+    { "uniform4fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform4fv, (intptr_t)2 },
+    { "uniform4i", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform4i, (intptr_t)5 },
+    { "uniform4iv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform4iv, (intptr_t)2 },
+    { "uniformMatrix2fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniformMatrix2fv, (intptr_t)3 },
+    { "uniformMatrix3fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniformMatrix3fv, (intptr_t)3 },
+    { "uniformMatrix4fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniformMatrix4fv, (intptr_t)3 },
+    { "useProgram", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUseProgram, (intptr_t)1 },
+    { "validateProgram", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionValidateProgram, (intptr_t)1 },
+    { "vertexAttrib1f", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib1f, (intptr_t)2 },
+    { "vertexAttrib1fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib1fv, (intptr_t)2 },
+    { "vertexAttrib2f", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib2f, (intptr_t)3 },
+    { "vertexAttrib2fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib2fv, (intptr_t)2 },
+    { "vertexAttrib3f", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib3f, (intptr_t)4 },
+    { "vertexAttrib3fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib3fv, (intptr_t)2 },
+    { "vertexAttrib4f", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib4f, (intptr_t)5 },
+    { "vertexAttrib4fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib4fv, (intptr_t)2 },
+    { "vertexAttribPointer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionVertexAttribPointer, (intptr_t)6 },
+    { "viewport", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionViewport, (intptr_t)4 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSCanvasRenderingContext3DPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 65535, JSCanvasRenderingContext3DPrototypeTableValues, 0 };
+#else
+    { 1103, 1023, JSCanvasRenderingContext3DPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSCanvasRenderingContext3DPrototype::s_info = { "CanvasRenderingContext3DPrototype", 0, &JSCanvasRenderingContext3DPrototypeTable, 0 };
+
+JSObject* JSCanvasRenderingContext3DPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSCanvasRenderingContext3D>(exec, globalObject);
+}
+
+bool JSCanvasRenderingContext3DPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticPropertySlot<JSCanvasRenderingContext3DPrototype, JSObject>(exec, &JSCanvasRenderingContext3DPrototypeTable, this, propertyName, slot);
+}
+
+bool JSCanvasRenderingContext3DPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSCanvasRenderingContext3DPrototype, JSObject>(exec, &JSCanvasRenderingContext3DPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSCanvasRenderingContext3D::s_info = { "CanvasRenderingContext3D", &JSCanvasRenderingContext::s_info, &JSCanvasRenderingContext3DTable, 0 };
+
+JSCanvasRenderingContext3D::JSCanvasRenderingContext3D(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasRenderingContext3D> impl)
+    : JSCanvasRenderingContext(structure, globalObject, impl)
+{
+}
+
+JSObject* JSCanvasRenderingContext3D::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSCanvasRenderingContext3DPrototype(JSCanvasRenderingContext3DPrototype::createStructure(JSCanvasRenderingContextPrototype::self(exec, globalObject)));
+}
+
+bool JSCanvasRenderingContext3D::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSCanvasRenderingContext3D, Base>(exec, &JSCanvasRenderingContext3DTable, this, propertyName, slot);
+}
+
+bool JSCanvasRenderingContext3D::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCanvasRenderingContext3D, Base>(exec, &JSCanvasRenderingContext3DTable, this, propertyName, descriptor);
+}
+
+JSValue jsCanvasRenderingContext3DConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSCanvasRenderingContext3D* domObject = static_cast<JSCanvasRenderingContext3D*>(asObject(slot.slotBase()));
+    return JSCanvasRenderingContext3D::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSCanvasRenderingContext3D::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSCanvasRenderingContext3DConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionSizeInBytes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    unsigned type = args.at(0).toInt32(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->sizeInBytes(type, ec));
+    setDOMException(exec, ec);
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionActiveTexture(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned texture = args.at(0).toInt32(exec);
+
+    imp->activeTexture(texture);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionAttachShader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasProgram* program = toCanvasProgram(args.at(0));
+    CanvasShader* shader = toCanvasShader(args.at(1));
+
+    imp->attachShader(program, shader);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindAttribLocation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasProgram* program = toCanvasProgram(args.at(0));
+    unsigned index = args.at(1).toInt32(exec);
+    const UString& name = args.at(2).toString(exec);
+
+    imp->bindAttribLocation(program, index, name);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindBuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    CanvasBuffer* buffer = toCanvasBuffer(args.at(1));
+
+    imp->bindBuffer(target, buffer);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindFramebuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    CanvasFramebuffer* framebuffer = toCanvasFramebuffer(args.at(1));
+
+    imp->bindFramebuffer(target, framebuffer);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindRenderbuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    CanvasRenderbuffer* renderbuffer = toCanvasRenderbuffer(args.at(1));
+
+    imp->bindRenderbuffer(target, renderbuffer);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindTexture(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    CanvasTexture* texture = toCanvasTexture(args.at(1));
+
+    imp->bindTexture(target, texture);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendColor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    double red = args.at(0).toNumber(exec);
+    double green = args.at(1).toNumber(exec);
+    double blue = args.at(2).toNumber(exec);
+    double alpha = args.at(3).toNumber(exec);
+
+    imp->blendColor(red, green, blue, alpha);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendEquation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned mode = args.at(0).toInt32(exec);
+
+    imp->blendEquation(mode);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendEquationSeparate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned modeRGB = args.at(0).toInt32(exec);
+    unsigned modeAlpha = args.at(1).toInt32(exec);
+
+    imp->blendEquationSeparate(modeRGB, modeAlpha);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendFunc(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned sfactor = args.at(0).toInt32(exec);
+    unsigned dfactor = args.at(1).toInt32(exec);
+
+    imp->blendFunc(sfactor, dfactor);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendFuncSeparate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned srcRGB = args.at(0).toInt32(exec);
+    unsigned dstRGB = args.at(1).toInt32(exec);
+    unsigned srcAlpha = args.at(2).toInt32(exec);
+    unsigned dstAlpha = args.at(3).toInt32(exec);
+
+    imp->blendFuncSeparate(srcRGB, dstRGB, srcAlpha, dstAlpha);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBufferData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    return castedThisObj->bufferData(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBufferSubData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    return castedThisObj->bufferSubData(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCheckFramebufferStatus(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->checkFramebufferStatus(target));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned mask = args.at(0).toInt32(exec);
+
+    imp->clear(mask);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionClearColor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    double red = args.at(0).toNumber(exec);
+    double green = args.at(1).toNumber(exec);
+    double blue = args.at(2).toNumber(exec);
+    double alpha = args.at(3).toNumber(exec);
+
+    imp->clearColor(red, green, blue, alpha);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionClearDepth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    double depth = args.at(0).toNumber(exec);
+
+    imp->clearDepth(depth);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionClearStencil(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    int s = args.at(0).toInt32(exec);
+
+    imp->clearStencil(s);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionColorMask(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    bool red = args.at(0).toBoolean(exec);
+    bool green = args.at(1).toBoolean(exec);
+    bool blue = args.at(2).toBoolean(exec);
+    bool alpha = args.at(3).toBoolean(exec);
+
+    imp->colorMask(red, green, blue, alpha);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCompileShader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasShader* shader = toCanvasShader(args.at(0));
+
+    imp->compileShader(shader);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCopyTexImage2D(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    int level = args.at(1).toInt32(exec);
+    unsigned internalformat = args.at(2).toInt32(exec);
+    int x = args.at(3).toInt32(exec);
+    int y = args.at(4).toInt32(exec);
+    unsigned width = args.at(5).toInt32(exec);
+    unsigned height = args.at(6).toInt32(exec);
+    int border = args.at(7).toInt32(exec);
+
+    imp->copyTexImage2D(target, level, internalformat, x, y, width, height, border);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCopyTexSubImage2D(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    int level = args.at(1).toInt32(exec);
+    int xoffset = args.at(2).toInt32(exec);
+    int yoffset = args.at(3).toInt32(exec);
+    int x = args.at(4).toInt32(exec);
+    int y = args.at(5).toInt32(exec);
+    unsigned width = args.at(6).toInt32(exec);
+    unsigned height = args.at(7).toInt32(exec);
+
+    imp->copyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateBuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->createBuffer()));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateFramebuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->createFramebuffer()));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateProgram(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->createProgram()));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateRenderbuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->createRenderbuffer()));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateShader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned type = args.at(0).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->createShader(type)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateTexture(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->createTexture()));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCullFace(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned mode = args.at(0).toInt32(exec);
+
+    imp->cullFace(mode);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteBuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasBuffer* buffer = toCanvasBuffer(args.at(0));
+
+    imp->deleteBuffer(buffer);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteFramebuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasFramebuffer* framebuffer = toCanvasFramebuffer(args.at(0));
+
+    imp->deleteFramebuffer(framebuffer);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteProgram(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasProgram* program = toCanvasProgram(args.at(0));
+
+    imp->deleteProgram(program);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteRenderbuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasRenderbuffer* renderbuffer = toCanvasRenderbuffer(args.at(0));
+
+    imp->deleteRenderbuffer(renderbuffer);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteShader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasShader* shader = toCanvasShader(args.at(0));
+
+    imp->deleteShader(shader);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteTexture(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasTexture* texture = toCanvasTexture(args.at(0));
+
+    imp->deleteTexture(texture);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDepthFunc(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned func = args.at(0).toInt32(exec);
+
+    imp->depthFunc(func);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDepthMask(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    bool flag = args.at(0).toBoolean(exec);
+
+    imp->depthMask(flag);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDepthRange(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    double zNear = args.at(0).toNumber(exec);
+    double zFar = args.at(1).toNumber(exec);
+
+    imp->depthRange(zNear, zFar);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDetachShader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasProgram* program = toCanvasProgram(args.at(0));
+    CanvasShader* shader = toCanvasShader(args.at(1));
+
+    imp->detachShader(program, shader);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDisable(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned cap = args.at(0).toInt32(exec);
+
+    imp->disable(cap);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDisableVertexAttribArray(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned index = args.at(0).toInt32(exec);
+
+    imp->disableVertexAttribArray(index);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDrawArrays(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned mode = args.at(0).toInt32(exec);
+    int first = args.at(1).toInt32(exec);
+    unsigned count = args.at(2).toInt32(exec);
+
+    imp->drawArrays(mode, first, count);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDrawElements(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned mode = args.at(0).toInt32(exec);
+    int count = args.at(1).toInt32(exec);
+    unsigned type = args.at(2).toInt32(exec);
+    unsigned offset = args.at(3).toInt32(exec);
+
+    imp->drawElements(mode, count, type, offset);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionEnable(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned cap = args.at(0).toInt32(exec);
+
+    imp->enable(cap);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionEnableVertexAttribArray(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned index = args.at(0).toInt32(exec);
+
+    imp->enableVertexAttribArray(index);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFinish(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+
+    imp->finish();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFlush(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+
+    imp->flush();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFramebufferRenderbuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned attachment = args.at(1).toInt32(exec);
+    unsigned renderbuffertarget = args.at(2).toInt32(exec);
+    CanvasRenderbuffer* renderbuffer = toCanvasRenderbuffer(args.at(3));
+
+    imp->framebufferRenderbuffer(target, attachment, renderbuffertarget, renderbuffer);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFramebufferTexture2D(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned attachment = args.at(1).toInt32(exec);
+    unsigned textarget = args.at(2).toInt32(exec);
+    CanvasTexture* texture = toCanvasTexture(args.at(3));
+    int level = args.at(4).toInt32(exec);
+
+    imp->framebufferTexture2D(target, attachment, textarget, texture, level);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFrontFace(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned mode = args.at(0).toInt32(exec);
+
+    imp->frontFace(mode);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGenerateMipmap(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+
+    imp->generateMipmap(target);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetAttribLocation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasProgram* program = toCanvasProgram(args.at(0));
+    const UString& name = args.at(1).toString(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->getAttribLocation(program, name));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetBoolean(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned pname = args.at(0).toInt32(exec);
+
+
+    JSC::JSValue result = jsBoolean(imp->getBoolean(pname));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetBooleanv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned pname = args.at(0).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getBooleanv(pname)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetBufferParameteri(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned pname = args.at(1).toInt32(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->getBufferParameteri(target, pname));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetBufferParameteriv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned pname = args.at(1).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getBufferParameteriv(target, pname)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetError(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsNumber(exec, imp->getError());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetFloat(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned pname = args.at(0).toInt32(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->getFloat(pname));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetFloatv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned pname = args.at(0).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getFloatv(pname)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetFramebufferAttachmentParameteri(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned attachment = args.at(1).toInt32(exec);
+    unsigned pname = args.at(2).toInt32(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->getFramebufferAttachmentParameteri(target, attachment, pname));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetFramebufferAttachmentParameteriv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned attachment = args.at(1).toInt32(exec);
+    unsigned pname = args.at(2).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getFramebufferAttachmentParameteriv(target, attachment, pname)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetInteger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned pname = args.at(0).toInt32(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->getInteger(pname));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetIntegerv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned pname = args.at(0).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getIntegerv(pname)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetProgrami(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasProgram* program = toCanvasProgram(args.at(0));
+    unsigned pname = args.at(1).toInt32(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->getProgrami(program, pname));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetProgramiv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasProgram* program = toCanvasProgram(args.at(0));
+    unsigned pname = args.at(1).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getProgramiv(program, pname)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetProgramInfoLog(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasProgram* program = toCanvasProgram(args.at(0));
+
+
+    JSC::JSValue result = jsString(exec, imp->getProgramInfoLog(program));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetRenderbufferParameteri(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned pname = args.at(1).toInt32(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->getRenderbufferParameteri(target, pname));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetRenderbufferParameteriv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned pname = args.at(1).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getRenderbufferParameteriv(target, pname)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetShaderi(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasShader* shader = toCanvasShader(args.at(0));
+    unsigned pname = args.at(1).toInt32(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->getShaderi(shader, pname));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetShaderiv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasShader* shader = toCanvasShader(args.at(0));
+    unsigned pname = args.at(1).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getShaderiv(shader, pname)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetShaderInfoLog(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasShader* shader = toCanvasShader(args.at(0));
+
+
+    JSC::JSValue result = jsString(exec, imp->getShaderInfoLog(shader));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetShaderSource(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasShader* shader = toCanvasShader(args.at(0));
+
+
+    JSC::JSValue result = jsString(exec, imp->getShaderSource(shader));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned name = args.at(0).toInt32(exec);
+
+
+    JSC::JSValue result = jsString(exec, imp->getString(name));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetTexParameterf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned pname = args.at(1).toInt32(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->getTexParameterf(target, pname));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetTexParameterfv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned pname = args.at(1).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getTexParameterfv(target, pname)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetTexParameteri(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned pname = args.at(1).toInt32(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->getTexParameteri(target, pname));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetTexParameteriv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned pname = args.at(1).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getTexParameteriv(target, pname)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasProgram* program = toCanvasProgram(args.at(0));
+    int location = args.at(1).toInt32(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->getUniformf(program, location));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformfv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasProgram* program = toCanvasProgram(args.at(0));
+    int location = args.at(1).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getUniformfv(program, location)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformi(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasProgram* program = toCanvasProgram(args.at(0));
+    int location = args.at(1).toInt32(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->getUniformi(program, location));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformiv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasProgram* program = toCanvasProgram(args.at(0));
+    int location = args.at(1).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getUniformiv(program, location)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformLocation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasProgram* program = toCanvasProgram(args.at(0));
+    const UString& name = args.at(1).toString(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->getUniformLocation(program, name));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned index = args.at(0).toInt32(exec);
+    unsigned pname = args.at(1).toInt32(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->getVertexAttribf(index, pname));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribfv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned index = args.at(0).toInt32(exec);
+    unsigned pname = args.at(1).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getVertexAttribfv(index, pname)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribi(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned index = args.at(0).toInt32(exec);
+    unsigned pname = args.at(1).toInt32(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->getVertexAttribi(index, pname));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribiv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned index = args.at(0).toInt32(exec);
+    unsigned pname = args.at(1).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getVertexAttribiv(index, pname)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribOffset(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned index = args.at(0).toInt32(exec);
+    unsigned pname = args.at(1).toInt32(exec);
+
+
+    JSC::JSValue result = jsNumber(exec, imp->getVertexAttribOffset(index, pname));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionHint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned mode = args.at(1).toInt32(exec);
+
+    imp->hint(target, mode);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsBuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasBuffer* buffer = toCanvasBuffer(args.at(0));
+
+
+    JSC::JSValue result = jsBoolean(imp->isBuffer(buffer));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned cap = args.at(0).toInt32(exec);
+
+
+    JSC::JSValue result = jsBoolean(imp->isEnabled(cap));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsFramebuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasFramebuffer* framebuffer = toCanvasFramebuffer(args.at(0));
+
+
+    JSC::JSValue result = jsBoolean(imp->isFramebuffer(framebuffer));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsProgram(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasProgram* program = toCanvasProgram(args.at(0));
+
+
+    JSC::JSValue result = jsBoolean(imp->isProgram(program));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsRenderbuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasRenderbuffer* renderbuffer = toCanvasRenderbuffer(args.at(0));
+
+
+    JSC::JSValue result = jsBoolean(imp->isRenderbuffer(renderbuffer));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsShader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasShader* shader = toCanvasShader(args.at(0));
+
+
+    JSC::JSValue result = jsBoolean(imp->isShader(shader));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsTexture(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasTexture* texture = toCanvasTexture(args.at(0));
+
+
+    JSC::JSValue result = jsBoolean(imp->isTexture(texture));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionLineWidth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    double width = args.at(0).toNumber(exec);
+
+    imp->lineWidth(width);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionLinkProgram(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasProgram* program = toCanvasProgram(args.at(0));
+
+    imp->linkProgram(program);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionPixelStorei(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned pname = args.at(0).toInt32(exec);
+    int param = args.at(1).toInt32(exec);
+
+    imp->pixelStorei(pname, param);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionPolygonOffset(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    double factor = args.at(0).toNumber(exec);
+    double units = args.at(1).toNumber(exec);
+
+    imp->polygonOffset(factor, units);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionReleaseShaderCompiler(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+
+    imp->releaseShaderCompiler();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionRenderbufferStorage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned internalformat = args.at(1).toInt32(exec);
+    unsigned width = args.at(2).toInt32(exec);
+    unsigned height = args.at(3).toInt32(exec);
+
+    imp->renderbufferStorage(target, internalformat, width, height);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionSampleCoverage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    double value = args.at(0).toNumber(exec);
+    bool invert = args.at(1).toBoolean(exec);
+
+    imp->sampleCoverage(value, invert);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionScissor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    int x = args.at(0).toInt32(exec);
+    int y = args.at(1).toInt32(exec);
+    unsigned width = args.at(2).toInt32(exec);
+    unsigned height = args.at(3).toInt32(exec);
+
+    imp->scissor(x, y, width, height);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionShaderSource(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasShader* shader = toCanvasShader(args.at(0));
+    const UString& string = args.at(1).toString(exec);
+
+    imp->shaderSource(shader, string);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilFunc(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned func = args.at(0).toInt32(exec);
+    int ref = args.at(1).toInt32(exec);
+    unsigned mask = args.at(2).toInt32(exec);
+
+    imp->stencilFunc(func, ref, mask);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilFuncSeparate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned face = args.at(0).toInt32(exec);
+    unsigned func = args.at(1).toInt32(exec);
+    int ref = args.at(2).toInt32(exec);
+    unsigned mask = args.at(3).toInt32(exec);
+
+    imp->stencilFuncSeparate(face, func, ref, mask);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilMask(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned mask = args.at(0).toInt32(exec);
+
+    imp->stencilMask(mask);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilMaskSeparate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned face = args.at(0).toInt32(exec);
+    unsigned mask = args.at(1).toInt32(exec);
+
+    imp->stencilMaskSeparate(face, mask);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilOp(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned fail = args.at(0).toInt32(exec);
+    unsigned zfail = args.at(1).toInt32(exec);
+    unsigned zpass = args.at(2).toInt32(exec);
+
+    imp->stencilOp(fail, zfail, zpass);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilOpSeparate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned face = args.at(0).toInt32(exec);
+    unsigned fail = args.at(1).toInt32(exec);
+    unsigned zfail = args.at(2).toInt32(exec);
+    unsigned zpass = args.at(3).toInt32(exec);
+
+    imp->stencilOpSeparate(face, fail, zfail, zpass);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionTexParameterf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned pname = args.at(1).toInt32(exec);
+    float param = args.at(2).toFloat(exec);
+
+    imp->texParameterf(target, pname, param);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionTexParameteri(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned pname = args.at(1).toInt32(exec);
+    int param = args.at(2).toInt32(exec);
+
+    imp->texParameteri(target, pname, param);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionTexImage2D(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    return castedThisObj->texImage2D(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionTexSubImage2D(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    return castedThisObj->texSubImage2D(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform1f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    int location = args.at(0).toInt32(exec);
+    float x = args.at(1).toFloat(exec);
+
+    imp->uniform1f(location, x);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform1fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    return castedThisObj->uniform1fv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform1i(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    int location = args.at(0).toInt32(exec);
+    int x = args.at(1).toInt32(exec);
+
+    imp->uniform1i(location, x);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform1iv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    return castedThisObj->uniform1iv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform2f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    int location = args.at(0).toInt32(exec);
+    float x = args.at(1).toFloat(exec);
+    float y = args.at(2).toFloat(exec);
+
+    imp->uniform2f(location, x, y);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform2fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    return castedThisObj->uniform2fv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform2i(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    int location = args.at(0).toInt32(exec);
+    int x = args.at(1).toInt32(exec);
+    int y = args.at(2).toInt32(exec);
+
+    imp->uniform2i(location, x, y);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform2iv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    return castedThisObj->uniform2iv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform3f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    int location = args.at(0).toInt32(exec);
+    float x = args.at(1).toFloat(exec);
+    float y = args.at(2).toFloat(exec);
+    float z = args.at(3).toFloat(exec);
+
+    imp->uniform3f(location, x, y, z);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform3fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    return castedThisObj->uniform3fv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform3i(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    int location = args.at(0).toInt32(exec);
+    int x = args.at(1).toInt32(exec);
+    int y = args.at(2).toInt32(exec);
+    int z = args.at(3).toInt32(exec);
+
+    imp->uniform3i(location, x, y, z);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform3iv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    return castedThisObj->uniform3iv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform4f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    int location = args.at(0).toInt32(exec);
+    float x = args.at(1).toFloat(exec);
+    float y = args.at(2).toFloat(exec);
+    float z = args.at(3).toFloat(exec);
+    float w = args.at(4).toFloat(exec);
+
+    imp->uniform4f(location, x, y, z, w);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform4fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    return castedThisObj->uniform4fv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform4i(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    int location = args.at(0).toInt32(exec);
+    int x = args.at(1).toInt32(exec);
+    int y = args.at(2).toInt32(exec);
+    int z = args.at(3).toInt32(exec);
+    int w = args.at(4).toInt32(exec);
+
+    imp->uniform4i(location, x, y, z, w);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform4iv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    return castedThisObj->uniform4iv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniformMatrix2fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    return castedThisObj->uniformMatrix2fv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniformMatrix3fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    return castedThisObj->uniformMatrix3fv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniformMatrix4fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    return castedThisObj->uniformMatrix4fv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUseProgram(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasProgram* program = toCanvasProgram(args.at(0));
+
+    imp->useProgram(program);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionValidateProgram(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    CanvasProgram* program = toCanvasProgram(args.at(0));
+
+    imp->validateProgram(program);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib1f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned indx = args.at(0).toInt32(exec);
+    float x = args.at(1).toFloat(exec);
+
+    imp->vertexAttrib1f(indx, x);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib1fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    return castedThisObj->vertexAttrib1fv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib2f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned indx = args.at(0).toInt32(exec);
+    float x = args.at(1).toFloat(exec);
+    float y = args.at(2).toFloat(exec);
+
+    imp->vertexAttrib2f(indx, x, y);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib2fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    return castedThisObj->vertexAttrib2fv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib3f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned indx = args.at(0).toInt32(exec);
+    float x = args.at(1).toFloat(exec);
+    float y = args.at(2).toFloat(exec);
+    float z = args.at(3).toFloat(exec);
+
+    imp->vertexAttrib3f(indx, x, y, z);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib3fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    return castedThisObj->vertexAttrib3fv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib4f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned indx = args.at(0).toInt32(exec);
+    float x = args.at(1).toFloat(exec);
+    float y = args.at(2).toFloat(exec);
+    float z = args.at(3).toFloat(exec);
+    float w = args.at(4).toFloat(exec);
+
+    imp->vertexAttrib4f(indx, x, y, z, w);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib4fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    return castedThisObj->vertexAttrib4fv(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttribPointer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    unsigned indx = args.at(0).toInt32(exec);
+    int size = args.at(1).toInt32(exec);
+    unsigned type = args.at(2).toInt32(exec);
+    bool normalized = args.at(3).toBoolean(exec);
+    int stride = args.at(4).toInt32(exec);
+    unsigned offset = args.at(5).toInt32(exec);
+
+    imp->vertexAttribPointer(indx, size, type, normalized, stride, offset);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionViewport(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
+        return throwError(exec, TypeError);
+    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
+    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
+    int x = args.at(0).toInt32(exec);
+    int y = args.at(1).toInt32(exec);
+    unsigned width = args.at(2).toInt32(exec);
+    unsigned height = args.at(3).toInt32(exec);
+
+    imp->viewport(x, y, width, height);
+    return jsUndefined();
+}
+
+// Constant getters
+
+JSValue jsCanvasRenderingContext3DDEPTH_BUFFER_BIT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x00000100));
+}
+
+JSValue jsCanvasRenderingContext3DSTENCIL_BUFFER_BIT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x00000400));
+}
+
+JSValue jsCanvasRenderingContext3DCOLOR_BUFFER_BIT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x00004000));
+}
+
+JSValue jsCanvasRenderingContext3DFALSE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0));
+}
+
+JSValue jsCanvasRenderingContext3DTRUE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(1));
+}
+
+JSValue jsCanvasRenderingContext3DPOINTS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0000));
+}
+
+JSValue jsCanvasRenderingContext3DLINES(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0001));
+}
+
+JSValue jsCanvasRenderingContext3DLINE_LOOP(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0002));
+}
+
+JSValue jsCanvasRenderingContext3DLINE_STRIP(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0003));
+}
+
+JSValue jsCanvasRenderingContext3DTRIANGLES(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0004));
+}
+
+JSValue jsCanvasRenderingContext3DTRIANGLE_STRIP(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0005));
+}
+
+JSValue jsCanvasRenderingContext3DTRIANGLE_FAN(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0006));
+}
+
+JSValue jsCanvasRenderingContext3DZERO(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0));
+}
+
+JSValue jsCanvasRenderingContext3DONE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(1));
+}
+
+JSValue jsCanvasRenderingContext3DSRC_COLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0300));
+}
+
+JSValue jsCanvasRenderingContext3DONE_MINUS_SRC_COLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0301));
+}
+
+JSValue jsCanvasRenderingContext3DSRC_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0302));
+}
+
+JSValue jsCanvasRenderingContext3DONE_MINUS_SRC_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0303));
+}
+
+JSValue jsCanvasRenderingContext3DDST_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0304));
+}
+
+JSValue jsCanvasRenderingContext3DONE_MINUS_DST_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0305));
+}
+
+JSValue jsCanvasRenderingContext3DDST_COLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0306));
+}
+
+JSValue jsCanvasRenderingContext3DONE_MINUS_DST_COLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0307));
+}
+
+JSValue jsCanvasRenderingContext3DSRC_ALPHA_SATURATE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0308));
+}
+
+JSValue jsCanvasRenderingContext3DFUNC_ADD(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8006));
+}
+
+JSValue jsCanvasRenderingContext3DBLEND_EQUATION(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8009));
+}
+
+JSValue jsCanvasRenderingContext3DBLEND_EQUATION_RGB(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8009));
+}
+
+JSValue jsCanvasRenderingContext3DBLEND_EQUATION_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x883D));
+}
+
+JSValue jsCanvasRenderingContext3DFUNC_SUBTRACT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x800A));
+}
+
+JSValue jsCanvasRenderingContext3DFUNC_REVERSE_SUBTRACT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x800B));
+}
+
+JSValue jsCanvasRenderingContext3DBLEND_DST_RGB(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x80C8));
+}
+
+JSValue jsCanvasRenderingContext3DBLEND_SRC_RGB(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x80C9));
+}
+
+JSValue jsCanvasRenderingContext3DBLEND_DST_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x80CA));
+}
+
+JSValue jsCanvasRenderingContext3DBLEND_SRC_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x80CB));
+}
+
+JSValue jsCanvasRenderingContext3DCONSTANT_COLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8001));
+}
+
+JSValue jsCanvasRenderingContext3DONE_MINUS_CONSTANT_COLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8002));
+}
+
+JSValue jsCanvasRenderingContext3DCONSTANT_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8003));
+}
+
+JSValue jsCanvasRenderingContext3DONE_MINUS_CONSTANT_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8004));
+}
+
+JSValue jsCanvasRenderingContext3DBLEND_COLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8005));
+}
+
+JSValue jsCanvasRenderingContext3DARRAY_BUFFER(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8892));
+}
+
+JSValue jsCanvasRenderingContext3DELEMENT_ARRAY_BUFFER(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8893));
+}
+
+JSValue jsCanvasRenderingContext3DARRAY_BUFFER_BINDING(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8894));
+}
+
+JSValue jsCanvasRenderingContext3DELEMENT_ARRAY_BUFFER_BINDING(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8895));
+}
+
+JSValue jsCanvasRenderingContext3DSTREAM_DRAW(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x88E0));
+}
+
+JSValue jsCanvasRenderingContext3DSTATIC_DRAW(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x88E4));
+}
+
+JSValue jsCanvasRenderingContext3DDYNAMIC_DRAW(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x88E8));
+}
+
+JSValue jsCanvasRenderingContext3DBUFFER_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8764));
+}
+
+JSValue jsCanvasRenderingContext3DBUFFER_USAGE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8765));
+}
+
+JSValue jsCanvasRenderingContext3DCURRENT_VERTEX_ATTRIB(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8626));
+}
+
+JSValue jsCanvasRenderingContext3DFRONT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0404));
+}
+
+JSValue jsCanvasRenderingContext3DBACK(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0405));
+}
+
+JSValue jsCanvasRenderingContext3DFRONT_AND_BACK(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0408));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE_2D(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0DE1));
+}
+
+JSValue jsCanvasRenderingContext3DCULL_FACE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B44));
+}
+
+JSValue jsCanvasRenderingContext3DBLEND(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0BE2));
+}
+
+JSValue jsCanvasRenderingContext3DDITHER(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0BD0));
+}
+
+JSValue jsCanvasRenderingContext3DSTENCIL_TEST(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B90));
+}
+
+JSValue jsCanvasRenderingContext3DDEPTH_TEST(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B71));
+}
+
+JSValue jsCanvasRenderingContext3DSCISSOR_TEST(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0C11));
+}
+
+JSValue jsCanvasRenderingContext3DPOLYGON_OFFSET_FILL(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8037));
+}
+
+JSValue jsCanvasRenderingContext3DSAMPLE_ALPHA_TO_COVERAGE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x809E));
+}
+
+JSValue jsCanvasRenderingContext3DSAMPLE_COVERAGE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x80A0));
+}
+
+JSValue jsCanvasRenderingContext3DNO_ERROR(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0));
+}
+
+JSValue jsCanvasRenderingContext3DINVALID_ENUM(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0500));
+}
+
+JSValue jsCanvasRenderingContext3DINVALID_VALUE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0501));
+}
+
+JSValue jsCanvasRenderingContext3DINVALID_OPERATION(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0502));
+}
+
+JSValue jsCanvasRenderingContext3DOUT_OF_MEMORY(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0505));
+}
+
+JSValue jsCanvasRenderingContext3DCW(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0900));
+}
+
+JSValue jsCanvasRenderingContext3DCCW(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0901));
+}
+
+JSValue jsCanvasRenderingContext3DLINE_WIDTH(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B21));
+}
+
+JSValue jsCanvasRenderingContext3DALIASED_POINT_SIZE_RANGE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x846D));
+}
+
+JSValue jsCanvasRenderingContext3DALIASED_LINE_WIDTH_RANGE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x846E));
+}
+
+JSValue jsCanvasRenderingContext3DCULL_FACE_MODE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B45));
+}
+
+JSValue jsCanvasRenderingContext3DFRONT_FACE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B46));
+}
+
+JSValue jsCanvasRenderingContext3DDEPTH_RANGE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B70));
+}
+
+JSValue jsCanvasRenderingContext3DDEPTH_WRITEMASK(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B72));
+}
+
+JSValue jsCanvasRenderingContext3DDEPTH_CLEAR_VALUE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B73));
+}
+
+JSValue jsCanvasRenderingContext3DDEPTH_FUNC(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B74));
+}
+
+JSValue jsCanvasRenderingContext3DSTENCIL_CLEAR_VALUE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B91));
+}
+
+JSValue jsCanvasRenderingContext3DSTENCIL_FUNC(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B92));
+}
+
+JSValue jsCanvasRenderingContext3DSTENCIL_FAIL(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B94));
+}
+
+JSValue jsCanvasRenderingContext3DSTENCIL_PASS_DEPTH_FAIL(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B95));
+}
+
+JSValue jsCanvasRenderingContext3DSTENCIL_PASS_DEPTH_PASS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B96));
+}
+
+JSValue jsCanvasRenderingContext3DSTENCIL_REF(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B97));
+}
+
+JSValue jsCanvasRenderingContext3DSTENCIL_VALUE_MASK(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B93));
+}
+
+JSValue jsCanvasRenderingContext3DSTENCIL_WRITEMASK(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0B98));
+}
+
+JSValue jsCanvasRenderingContext3DSTENCIL_BACK_FUNC(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8800));
+}
+
+JSValue jsCanvasRenderingContext3DSTENCIL_BACK_FAIL(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8801));
+}
+
+JSValue jsCanvasRenderingContext3DSTENCIL_BACK_PASS_DEPTH_FAIL(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8802));
+}
+
+JSValue jsCanvasRenderingContext3DSTENCIL_BACK_PASS_DEPTH_PASS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8803));
+}
+
+JSValue jsCanvasRenderingContext3DSTENCIL_BACK_REF(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CA3));
+}
+
+JSValue jsCanvasRenderingContext3DSTENCIL_BACK_VALUE_MASK(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CA4));
+}
+
+JSValue jsCanvasRenderingContext3DSTENCIL_BACK_WRITEMASK(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CA5));
+}
+
+JSValue jsCanvasRenderingContext3DVIEWPORT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0BA2));
+}
+
+JSValue jsCanvasRenderingContext3DSCISSOR_BOX(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0C10));
+}
+
+JSValue jsCanvasRenderingContext3DCOLOR_CLEAR_VALUE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0C22));
+}
+
+JSValue jsCanvasRenderingContext3DCOLOR_WRITEMASK(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0C23));
+}
+
+JSValue jsCanvasRenderingContext3DUNPACK_ALIGNMENT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0CF5));
+}
+
+JSValue jsCanvasRenderingContext3DPACK_ALIGNMENT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0D05));
+}
+
+JSValue jsCanvasRenderingContext3DMAX_TEXTURE_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0D33));
+}
+
+JSValue jsCanvasRenderingContext3DMAX_VIEWPORT_DIMS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0D3A));
+}
+
+JSValue jsCanvasRenderingContext3DSUBPIXEL_BITS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0D50));
+}
+
+JSValue jsCanvasRenderingContext3DRED_BITS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0D52));
+}
+
+JSValue jsCanvasRenderingContext3DGREEN_BITS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0D53));
+}
+
+JSValue jsCanvasRenderingContext3DBLUE_BITS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0D54));
+}
+
+JSValue jsCanvasRenderingContext3DALPHA_BITS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0D55));
+}
+
+JSValue jsCanvasRenderingContext3DDEPTH_BITS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0D56));
+}
+
+JSValue jsCanvasRenderingContext3DSTENCIL_BITS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0D57));
+}
+
+JSValue jsCanvasRenderingContext3DPOLYGON_OFFSET_UNITS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x2A00));
+}
+
+JSValue jsCanvasRenderingContext3DPOLYGON_OFFSET_FACTOR(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8038));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE_BINDING_2D(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8069));
+}
+
+JSValue jsCanvasRenderingContext3DSAMPLE_BUFFERS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x80A8));
+}
+
+JSValue jsCanvasRenderingContext3DSAMPLES(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x80A9));
+}
+
+JSValue jsCanvasRenderingContext3DSAMPLE_COVERAGE_VALUE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x80AA));
+}
+
+JSValue jsCanvasRenderingContext3DSAMPLE_COVERAGE_INVERT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x80AB));
+}
+
+JSValue jsCanvasRenderingContext3DNUM_COMPRESSED_TEXTURE_FORMATS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x86A2));
+}
+
+JSValue jsCanvasRenderingContext3DCOMPRESSED_TEXTURE_FORMATS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x86A3));
+}
+
+JSValue jsCanvasRenderingContext3DDONT_CARE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x1100));
+}
+
+JSValue jsCanvasRenderingContext3DFASTEST(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x1101));
+}
+
+JSValue jsCanvasRenderingContext3DNICEST(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x1102));
+}
+
+JSValue jsCanvasRenderingContext3DGENERATE_MIPMAP_HINT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8192));
+}
+
+JSValue jsCanvasRenderingContext3DBYTE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x1400));
+}
+
+JSValue jsCanvasRenderingContext3DUNSIGNED_BYTE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x1401));
+}
+
+JSValue jsCanvasRenderingContext3DSHORT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x1402));
+}
+
+JSValue jsCanvasRenderingContext3DUNSIGNED_SHORT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x1403));
+}
+
+JSValue jsCanvasRenderingContext3DINT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x1404));
+}
+
+JSValue jsCanvasRenderingContext3DUNSIGNED_INT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x1405));
+}
+
+JSValue jsCanvasRenderingContext3DFLOAT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x1406));
+}
+
+JSValue jsCanvasRenderingContext3DFIXED(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x140C));
+}
+
+JSValue jsCanvasRenderingContext3DDEPTH_COMPONENT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x1902));
+}
+
+JSValue jsCanvasRenderingContext3DALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x1906));
+}
+
+JSValue jsCanvasRenderingContext3DRGB(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x1907));
+}
+
+JSValue jsCanvasRenderingContext3DRGBA(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x1908));
+}
+
+JSValue jsCanvasRenderingContext3DLUMINANCE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x1909));
+}
+
+JSValue jsCanvasRenderingContext3DLUMINANCE_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x190A));
+}
+
+JSValue jsCanvasRenderingContext3DUNSIGNED_SHORT_4_4_4_4(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8033));
+}
+
+JSValue jsCanvasRenderingContext3DUNSIGNED_SHORT_5_5_5_1(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8034));
+}
+
+JSValue jsCanvasRenderingContext3DUNSIGNED_SHORT_5_6_5(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8363));
+}
+
+JSValue jsCanvasRenderingContext3DFRAGMENT_SHADER(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B30));
+}
+
+JSValue jsCanvasRenderingContext3DVERTEX_SHADER(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B31));
+}
+
+JSValue jsCanvasRenderingContext3DMAX_VERTEX_ATTRIBS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8869));
+}
+
+JSValue jsCanvasRenderingContext3DMAX_VERTEX_UNIFORM_VECTORS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8DFB));
+}
+
+JSValue jsCanvasRenderingContext3DMAX_VARYING_VECTORS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8DFC));
+}
+
+JSValue jsCanvasRenderingContext3DMAX_COMBINED_TEXTURE_IMAGE_UNITS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B4D));
+}
+
+JSValue jsCanvasRenderingContext3DMAX_VERTEX_TEXTURE_IMAGE_UNITS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B4C));
+}
+
+JSValue jsCanvasRenderingContext3DMAX_TEXTURE_IMAGE_UNITS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8872));
+}
+
+JSValue jsCanvasRenderingContext3DMAX_FRAGMENT_UNIFORM_VECTORS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8DFD));
+}
+
+JSValue jsCanvasRenderingContext3DSHADER_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B4F));
+}
+
+JSValue jsCanvasRenderingContext3DDELETE_STATUS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B80));
+}
+
+JSValue jsCanvasRenderingContext3DLINK_STATUS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B82));
+}
+
+JSValue jsCanvasRenderingContext3DVALIDATE_STATUS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B83));
+}
+
+JSValue jsCanvasRenderingContext3DATTACHED_SHADERS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B85));
+}
+
+JSValue jsCanvasRenderingContext3DACTIVE_UNIFORMS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B86));
+}
+
+JSValue jsCanvasRenderingContext3DACTIVE_UNIFORM_MAX_LENGTH(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B87));
+}
+
+JSValue jsCanvasRenderingContext3DACTIVE_ATTRIBUTES(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B89));
+}
+
+JSValue jsCanvasRenderingContext3DACTIVE_ATTRIBUTE_MAX_LENGTH(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B8A));
+}
+
+JSValue jsCanvasRenderingContext3DSHADING_LANGUAGE_VERSION(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B8C));
+}
+
+JSValue jsCanvasRenderingContext3DCURRENT_PROGRAM(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B8D));
+}
+
+JSValue jsCanvasRenderingContext3DNEVER(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0200));
+}
+
+JSValue jsCanvasRenderingContext3DLESS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0201));
+}
+
+JSValue jsCanvasRenderingContext3DEQUAL(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0202));
+}
+
+JSValue jsCanvasRenderingContext3DLEQUAL(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0203));
+}
+
+JSValue jsCanvasRenderingContext3DGREATER(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0204));
+}
+
+JSValue jsCanvasRenderingContext3DNOTEQUAL(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0205));
+}
+
+JSValue jsCanvasRenderingContext3DGEQUAL(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0206));
+}
+
+JSValue jsCanvasRenderingContext3DALWAYS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0207));
+}
+
+JSValue jsCanvasRenderingContext3DKEEP(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x1E00));
+}
+
+JSValue jsCanvasRenderingContext3DREPLACE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x1E01));
+}
+
+JSValue jsCanvasRenderingContext3DINCR(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x1E02));
+}
+
+JSValue jsCanvasRenderingContext3DDECR(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x1E03));
+}
+
+JSValue jsCanvasRenderingContext3DINVERT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x150A));
+}
+
+JSValue jsCanvasRenderingContext3DINCR_WRAP(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8507));
+}
+
+JSValue jsCanvasRenderingContext3DDECR_WRAP(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8508));
+}
+
+JSValue jsCanvasRenderingContext3DVENDOR(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x1F00));
+}
+
+JSValue jsCanvasRenderingContext3DRENDERER(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x1F01));
+}
+
+JSValue jsCanvasRenderingContext3DVERSION(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x1F02));
+}
+
+JSValue jsCanvasRenderingContext3DEXTENSIONS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x1F03));
+}
+
+JSValue jsCanvasRenderingContext3DNEAREST(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x2600));
+}
+
+JSValue jsCanvasRenderingContext3DLINEAR(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x2601));
+}
+
+JSValue jsCanvasRenderingContext3DNEAREST_MIPMAP_NEAREST(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x2700));
+}
+
+JSValue jsCanvasRenderingContext3DLINEAR_MIPMAP_NEAREST(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x2701));
+}
+
+JSValue jsCanvasRenderingContext3DNEAREST_MIPMAP_LINEAR(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x2702));
+}
+
+JSValue jsCanvasRenderingContext3DLINEAR_MIPMAP_LINEAR(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x2703));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE_MAG_FILTER(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x2800));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE_MIN_FILTER(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x2801));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE_WRAP_S(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x2802));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE_WRAP_T(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x2803));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x1702));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8513));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE_BINDING_CUBE_MAP(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8514));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_X(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8515));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_X(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8516));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_Y(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8517));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_Y(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8518));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_Z(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8519));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_Z(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x851A));
+}
+
+JSValue jsCanvasRenderingContext3DMAX_CUBE_MAP_TEXTURE_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x851C));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE0(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84C0));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE1(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84C1));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE2(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84C2));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE3(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84C3));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE4(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84C4));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE5(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84C5));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE6(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84C6));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE7(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84C7));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE8(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84C8));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE9(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84C9));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE10(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84CA));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE11(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84CB));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE12(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84CC));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE13(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84CD));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE14(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84CE));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE15(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84CF));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE16(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84D0));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE17(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84D1));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE18(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84D2));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE19(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84D3));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE20(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84D4));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE21(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84D5));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE22(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84D6));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE23(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84D7));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE24(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84D8));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE25(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84D9));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE26(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84DA));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE27(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84DB));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE28(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84DC));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE29(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84DD));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE30(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84DE));
+}
+
+JSValue jsCanvasRenderingContext3DTEXTURE31(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84DF));
+}
+
+JSValue jsCanvasRenderingContext3DACTIVE_TEXTURE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84E0));
+}
+
+JSValue jsCanvasRenderingContext3DREPEAT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x2901));
+}
+
+JSValue jsCanvasRenderingContext3DCLAMP_TO_EDGE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x812F));
+}
+
+JSValue jsCanvasRenderingContext3DMIRRORED_REPEAT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8370));
+}
+
+JSValue jsCanvasRenderingContext3DFLOAT_VEC2(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B50));
+}
+
+JSValue jsCanvasRenderingContext3DFLOAT_VEC3(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B51));
+}
+
+JSValue jsCanvasRenderingContext3DFLOAT_VEC4(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B52));
+}
+
+JSValue jsCanvasRenderingContext3DINT_VEC2(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B53));
+}
+
+JSValue jsCanvasRenderingContext3DINT_VEC3(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B54));
+}
+
+JSValue jsCanvasRenderingContext3DINT_VEC4(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B55));
+}
+
+JSValue jsCanvasRenderingContext3DBOOL(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B56));
+}
+
+JSValue jsCanvasRenderingContext3DBOOL_VEC2(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B57));
+}
+
+JSValue jsCanvasRenderingContext3DBOOL_VEC3(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B58));
+}
+
+JSValue jsCanvasRenderingContext3DBOOL_VEC4(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B59));
+}
+
+JSValue jsCanvasRenderingContext3DFLOAT_MAT2(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B5A));
+}
+
+JSValue jsCanvasRenderingContext3DFLOAT_MAT3(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B5B));
+}
+
+JSValue jsCanvasRenderingContext3DFLOAT_MAT4(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B5C));
+}
+
+JSValue jsCanvasRenderingContext3DSAMPLER_2D(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B5E));
+}
+
+JSValue jsCanvasRenderingContext3DSAMPLER_CUBE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B60));
+}
+
+JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_ENABLED(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8622));
+}
+
+JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8623));
+}
+
+JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_STRIDE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8624));
+}
+
+JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8625));
+}
+
+JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_NORMALIZED(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x886A));
+}
+
+JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_POINTER(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8645));
+}
+
+JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_BUFFER_BINDING(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x889F));
+}
+
+JSValue jsCanvasRenderingContext3DIMPLEMENTATION_COLOR_READ_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B9A));
+}
+
+JSValue jsCanvasRenderingContext3DIMPLEMENTATION_COLOR_READ_FORMAT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B9B));
+}
+
+JSValue jsCanvasRenderingContext3DCOMPILE_STATUS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B81));
+}
+
+JSValue jsCanvasRenderingContext3DINFO_LOG_LENGTH(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B84));
+}
+
+JSValue jsCanvasRenderingContext3DSHADER_SOURCE_LENGTH(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8B88));
+}
+
+JSValue jsCanvasRenderingContext3DSHADER_COMPILER(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8DFA));
+}
+
+JSValue jsCanvasRenderingContext3DSHADER_BINARY_FORMATS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8DF8));
+}
+
+JSValue jsCanvasRenderingContext3DNUM_SHADER_BINARY_FORMATS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8DF9));
+}
+
+JSValue jsCanvasRenderingContext3DLOW_FLOAT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8DF0));
+}
+
+JSValue jsCanvasRenderingContext3DMEDIUM_FLOAT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8DF1));
+}
+
+JSValue jsCanvasRenderingContext3DHIGH_FLOAT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8DF2));
+}
+
+JSValue jsCanvasRenderingContext3DLOW_INT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8DF3));
+}
+
+JSValue jsCanvasRenderingContext3DMEDIUM_INT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8DF4));
+}
+
+JSValue jsCanvasRenderingContext3DHIGH_INT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8DF5));
+}
+
+JSValue jsCanvasRenderingContext3DFRAMEBUFFER(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D40));
+}
+
+JSValue jsCanvasRenderingContext3DRENDERBUFFER(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D41));
+}
+
+JSValue jsCanvasRenderingContext3DRGBA4(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8056));
+}
+
+JSValue jsCanvasRenderingContext3DRGB5_A1(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8057));
+}
+
+JSValue jsCanvasRenderingContext3DRGB565(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D62));
+}
+
+JSValue jsCanvasRenderingContext3DDEPTH_COMPONENT16(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x81A5));
+}
+
+JSValue jsCanvasRenderingContext3DSTENCIL_INDEX(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x1901));
+}
+
+JSValue jsCanvasRenderingContext3DSTENCIL_INDEX8(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D48));
+}
+
+JSValue jsCanvasRenderingContext3DRENDERBUFFER_WIDTH(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D42));
+}
+
+JSValue jsCanvasRenderingContext3DRENDERBUFFER_HEIGHT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D43));
+}
+
+JSValue jsCanvasRenderingContext3DRENDERBUFFER_INTERNAL_FORMAT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D44));
+}
+
+JSValue jsCanvasRenderingContext3DRENDERBUFFER_RED_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D50));
+}
+
+JSValue jsCanvasRenderingContext3DRENDERBUFFER_GREEN_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D51));
+}
+
+JSValue jsCanvasRenderingContext3DRENDERBUFFER_BLUE_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D52));
+}
+
+JSValue jsCanvasRenderingContext3DRENDERBUFFER_ALPHA_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D53));
+}
+
+JSValue jsCanvasRenderingContext3DRENDERBUFFER_DEPTH_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D54));
+}
+
+JSValue jsCanvasRenderingContext3DRENDERBUFFER_STENCIL_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D55));
+}
+
+JSValue jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_OBJECT_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CD0));
+}
+
+JSValue jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_OBJECT_NAME(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CD1));
+}
+
+JSValue jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CD2));
+}
+
+JSValue jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CD3));
+}
+
+JSValue jsCanvasRenderingContext3DCOLOR_ATTACHMENT0(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CE0));
+}
+
+JSValue jsCanvasRenderingContext3DDEPTH_ATTACHMENT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D00));
+}
+
+JSValue jsCanvasRenderingContext3DSTENCIL_ATTACHMENT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8D20));
+}
+
+JSValue jsCanvasRenderingContext3DNONE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0));
+}
+
+JSValue jsCanvasRenderingContext3DFRAMEBUFFER_COMPLETE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CD5));
+}
+
+JSValue jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_ATTACHMENT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CD6));
+}
+
+JSValue jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CD7));
+}
+
+JSValue jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_DIMENSIONS(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CD9));
+}
+
+JSValue jsCanvasRenderingContext3DFRAMEBUFFER_UNSUPPORTED(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CDD));
+}
+
+JSValue jsCanvasRenderingContext3DFRAMEBUFFER_BINDING(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CA6));
+}
+
+JSValue jsCanvasRenderingContext3DRENDERBUFFER_BINDING(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x8CA7));
+}
+
+JSValue jsCanvasRenderingContext3DMAX_RENDERBUFFER_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x84E8));
+}
+
+JSValue jsCanvasRenderingContext3DINVALID_FRAMEBUFFER_OPERATION(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0x0506));
+}
+
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.h
new file mode 100644
index 0000000..503fba8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.h
@@ -0,0 +1,548 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSCanvasRenderingContext3D_h
+#define JSCanvasRenderingContext3D_h
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasRenderingContext.h"
+
+namespace WebCore {
+
+class CanvasRenderingContext3D;
+
+class JSCanvasRenderingContext3D : public JSCanvasRenderingContext {
+    typedef JSCanvasRenderingContext Base;
+public:
+    JSCanvasRenderingContext3D(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasRenderingContext3D>);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+
+    // Custom functions
+    JSC::JSValue bufferData(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue bufferSubData(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue texImage2D(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue texSubImage2D(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue uniform1fv(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue uniform1iv(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue uniform2fv(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue uniform2iv(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue uniform3fv(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue uniform3iv(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue uniform4fv(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue uniform4iv(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue uniformMatrix2fv(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue uniformMatrix3fv(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue uniformMatrix4fv(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue vertexAttrib1fv(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue vertexAttrib2fv(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue vertexAttrib3fv(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue vertexAttrib4fv(JSC::ExecState*, const JSC::ArgList&);
+};
+
+
+class JSCanvasRenderingContext3DPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+    }
+    JSCanvasRenderingContext3DPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionSizeInBytes(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionActiveTexture(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionAttachShader(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindAttribLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindBuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindFramebuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindRenderbuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindTexture(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendEquation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendEquationSeparate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendFunc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendFuncSeparate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBufferData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBufferSubData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCheckFramebufferStatus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionClearColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionClearDepth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionClearStencil(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionColorMask(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCompileShader(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCopyTexImage2D(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCopyTexSubImage2D(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateBuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateFramebuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateProgram(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateRenderbuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateShader(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateTexture(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCullFace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteBuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteFramebuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteProgram(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteRenderbuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteShader(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteTexture(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDepthFunc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDepthMask(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDepthRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDetachShader(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDisable(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDisableVertexAttribArray(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDrawArrays(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDrawElements(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionEnable(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionEnableVertexAttribArray(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFinish(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFlush(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFramebufferRenderbuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFramebufferTexture2D(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFrontFace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGenerateMipmap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetAttribLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetBoolean(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetBooleanv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetBufferParameteri(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetBufferParameteriv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetError(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetFloat(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetFloatv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetFramebufferAttachmentParameteri(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetFramebufferAttachmentParameteriv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetInteger(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetIntegerv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetProgrami(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetProgramiv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetProgramInfoLog(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetRenderbufferParameteri(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetRenderbufferParameteriv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetShaderi(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetShaderiv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetShaderInfoLog(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetShaderSource(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetTexParameterf(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetTexParameterfv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetTexParameteri(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetTexParameteriv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformf(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformfv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformi(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformiv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribf(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribfv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribi(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribiv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribOffset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionHint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsBuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsFramebuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsProgram(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsRenderbuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsShader(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsTexture(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionLineWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionLinkProgram(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionPixelStorei(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionPolygonOffset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionReleaseShaderCompiler(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionRenderbufferStorage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionSampleCoverage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionScissor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionShaderSource(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilFunc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilFuncSeparate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilMask(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilMaskSeparate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilOp(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilOpSeparate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionTexParameterf(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionTexParameteri(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionTexImage2D(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionTexSubImage2D(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform1f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform1fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform1i(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform1iv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform2f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform2fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform2i(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform2iv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform3f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform3fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform3i(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform3iv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform4f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform4fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform4i(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform4iv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniformMatrix2fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniformMatrix3fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniformMatrix4fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUseProgram(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionValidateProgram(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib1f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib1fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib2f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib2fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib3f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib3fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib4f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib4fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttribPointer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionViewport(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsCanvasRenderingContext3DConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+// Constants
+
+JSC::JSValue jsCanvasRenderingContext3DDEPTH_BUFFER_BIT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSTENCIL_BUFFER_BIT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DCOLOR_BUFFER_BIT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DFALSE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTRUE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DPOINTS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DLINES(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DLINE_LOOP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DLINE_STRIP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTRIANGLES(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTRIANGLE_STRIP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTRIANGLE_FAN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DZERO(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DONE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSRC_COLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DONE_MINUS_SRC_COLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSRC_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DONE_MINUS_SRC_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DDST_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DONE_MINUS_DST_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DDST_COLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DONE_MINUS_DST_COLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSRC_ALPHA_SATURATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DFUNC_ADD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DBLEND_EQUATION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DBLEND_EQUATION_RGB(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DBLEND_EQUATION_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DFUNC_SUBTRACT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DFUNC_REVERSE_SUBTRACT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DBLEND_DST_RGB(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DBLEND_SRC_RGB(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DBLEND_DST_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DBLEND_SRC_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DCONSTANT_COLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DONE_MINUS_CONSTANT_COLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DCONSTANT_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DONE_MINUS_CONSTANT_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DBLEND_COLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DARRAY_BUFFER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DELEMENT_ARRAY_BUFFER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DARRAY_BUFFER_BINDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DELEMENT_ARRAY_BUFFER_BINDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSTREAM_DRAW(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSTATIC_DRAW(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DDYNAMIC_DRAW(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DBUFFER_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DBUFFER_USAGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DCURRENT_VERTEX_ATTRIB(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DFRONT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DBACK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DFRONT_AND_BACK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE_2D(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DCULL_FACE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DBLEND(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DDITHER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSTENCIL_TEST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DDEPTH_TEST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSCISSOR_TEST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DPOLYGON_OFFSET_FILL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSAMPLE_ALPHA_TO_COVERAGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSAMPLE_COVERAGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DNO_ERROR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DINVALID_ENUM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DINVALID_VALUE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DINVALID_OPERATION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DOUT_OF_MEMORY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DCW(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DCCW(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DLINE_WIDTH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DALIASED_POINT_SIZE_RANGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DALIASED_LINE_WIDTH_RANGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DCULL_FACE_MODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DFRONT_FACE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DDEPTH_RANGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DDEPTH_WRITEMASK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DDEPTH_CLEAR_VALUE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DDEPTH_FUNC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSTENCIL_CLEAR_VALUE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSTENCIL_FUNC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSTENCIL_FAIL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSTENCIL_PASS_DEPTH_FAIL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSTENCIL_PASS_DEPTH_PASS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSTENCIL_REF(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSTENCIL_VALUE_MASK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSTENCIL_WRITEMASK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSTENCIL_BACK_FUNC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSTENCIL_BACK_FAIL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSTENCIL_BACK_PASS_DEPTH_FAIL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSTENCIL_BACK_PASS_DEPTH_PASS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSTENCIL_BACK_REF(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSTENCIL_BACK_VALUE_MASK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSTENCIL_BACK_WRITEMASK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DVIEWPORT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSCISSOR_BOX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DCOLOR_CLEAR_VALUE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DCOLOR_WRITEMASK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DUNPACK_ALIGNMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DPACK_ALIGNMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DMAX_TEXTURE_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DMAX_VIEWPORT_DIMS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSUBPIXEL_BITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DRED_BITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DGREEN_BITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DBLUE_BITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DALPHA_BITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DDEPTH_BITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSTENCIL_BITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DPOLYGON_OFFSET_UNITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DPOLYGON_OFFSET_FACTOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE_BINDING_2D(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSAMPLE_BUFFERS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSAMPLES(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSAMPLE_COVERAGE_VALUE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSAMPLE_COVERAGE_INVERT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DNUM_COMPRESSED_TEXTURE_FORMATS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DCOMPRESSED_TEXTURE_FORMATS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DDONT_CARE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DFASTEST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DNICEST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DGENERATE_MIPMAP_HINT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DBYTE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DUNSIGNED_BYTE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSHORT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DUNSIGNED_SHORT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DINT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DUNSIGNED_INT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DFLOAT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DFIXED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DDEPTH_COMPONENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DRGB(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DRGBA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DLUMINANCE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DLUMINANCE_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DUNSIGNED_SHORT_4_4_4_4(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DUNSIGNED_SHORT_5_5_5_1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DUNSIGNED_SHORT_5_6_5(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DFRAGMENT_SHADER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DVERTEX_SHADER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DMAX_VERTEX_ATTRIBS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DMAX_VERTEX_UNIFORM_VECTORS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DMAX_VARYING_VECTORS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DMAX_COMBINED_TEXTURE_IMAGE_UNITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DMAX_VERTEX_TEXTURE_IMAGE_UNITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DMAX_TEXTURE_IMAGE_UNITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DMAX_FRAGMENT_UNIFORM_VECTORS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSHADER_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DDELETE_STATUS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DLINK_STATUS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DVALIDATE_STATUS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DATTACHED_SHADERS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DACTIVE_UNIFORMS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DACTIVE_UNIFORM_MAX_LENGTH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DACTIVE_ATTRIBUTES(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DACTIVE_ATTRIBUTE_MAX_LENGTH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSHADING_LANGUAGE_VERSION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DCURRENT_PROGRAM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DNEVER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DLESS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DEQUAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DLEQUAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DGREATER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DNOTEQUAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DGEQUAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DALWAYS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DKEEP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DREPLACE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DINCR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DDECR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DINVERT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DINCR_WRAP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DDECR_WRAP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DVENDOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DRENDERER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DVERSION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DEXTENSIONS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DNEAREST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DLINEAR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DNEAREST_MIPMAP_NEAREST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DLINEAR_MIPMAP_NEAREST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DNEAREST_MIPMAP_LINEAR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DLINEAR_MIPMAP_LINEAR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE_MAG_FILTER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE_MIN_FILTER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE_WRAP_S(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE_WRAP_T(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE_BINDING_CUBE_MAP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_X(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_X(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_Y(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_Y(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_Z(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_Z(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DMAX_CUBE_MAP_TEXTURE_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE0(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE3(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE4(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE5(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE6(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE7(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE8(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE9(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE10(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE11(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE12(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE13(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE14(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE15(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE16(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE17(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE18(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE19(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE20(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE21(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE22(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE23(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE24(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE25(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE26(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE27(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE28(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE29(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE30(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DTEXTURE31(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DACTIVE_TEXTURE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DREPEAT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DCLAMP_TO_EDGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DMIRRORED_REPEAT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DFLOAT_VEC2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DFLOAT_VEC3(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DFLOAT_VEC4(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DINT_VEC2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DINT_VEC3(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DINT_VEC4(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DBOOL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DBOOL_VEC2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DBOOL_VEC3(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DBOOL_VEC4(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DFLOAT_MAT2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DFLOAT_MAT3(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DFLOAT_MAT4(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSAMPLER_2D(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSAMPLER_CUBE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_ENABLED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_STRIDE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_NORMALIZED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_POINTER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_BUFFER_BINDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DIMPLEMENTATION_COLOR_READ_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DIMPLEMENTATION_COLOR_READ_FORMAT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DCOMPILE_STATUS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DINFO_LOG_LENGTH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSHADER_SOURCE_LENGTH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSHADER_COMPILER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSHADER_BINARY_FORMATS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DNUM_SHADER_BINARY_FORMATS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DLOW_FLOAT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DMEDIUM_FLOAT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DHIGH_FLOAT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DLOW_INT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DMEDIUM_INT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DHIGH_INT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DRGBA4(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DRGB5_A1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DRGB565(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DDEPTH_COMPONENT16(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSTENCIL_INDEX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSTENCIL_INDEX8(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_WIDTH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_HEIGHT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_INTERNAL_FORMAT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_RED_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_GREEN_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_BLUE_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_ALPHA_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_DEPTH_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_STENCIL_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_OBJECT_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_OBJECT_NAME(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DCOLOR_ATTACHMENT0(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DDEPTH_ATTACHMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DSTENCIL_ATTACHMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DNONE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_COMPLETE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_ATTACHMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_DIMENSIONS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_UNSUPPORTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_BINDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_BINDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DMAX_RENDERBUFFER_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext3DINVALID_FRAMEBUFFER_OPERATION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasShortArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasShortArray.cpp
new file mode 100644
index 0000000..8a4ab5f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasShortArray.cpp
@@ -0,0 +1,137 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasShortArray.h"
+
+#include "CanvasShortArray.h"
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSCanvasShortArray);
+
+/* Hash table for prototype */
+
+static const HashTableValue JSCanvasShortArrayPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSCanvasShortArrayPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSCanvasShortArrayPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSCanvasShortArrayPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSCanvasShortArrayPrototype::s_info = { "CanvasShortArrayPrototype", 0, &JSCanvasShortArrayPrototypeTable, 0 };
+
+JSObject* JSCanvasShortArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSCanvasShortArray>(exec, globalObject);
+}
+
+const ClassInfo JSCanvasShortArray::s_info = { "CanvasShortArray", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasShortArray::JSCanvasShortArray(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasShortArray> impl)
+    : JSCanvasArray(structure, globalObject, impl)
+{
+}
+
+JSObject* JSCanvasShortArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSCanvasShortArrayPrototype(JSCanvasShortArrayPrototype::createStructure(JSCanvasArrayPrototype::self(exec, globalObject)));
+}
+
+bool JSCanvasShortArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<CanvasShortArray*>(impl())->length()) {
+        slot.setValue(getByIndex(exec, index));
+        return true;
+    }
+    return Base::getOwnPropertySlot(exec, propertyName, slot);
+}
+
+bool JSCanvasShortArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<CanvasShortArray*>(impl())->length()) {
+        descriptor.setDescriptor(getByIndex(exec, index), DontDelete);
+        return true;
+    }
+    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
+bool JSCanvasShortArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    if (propertyName < static_cast<CanvasShortArray*>(impl())->length()) {
+        slot.setValue(getByIndex(exec, propertyName));
+        return true;
+    }
+    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
+}
+
+void JSCanvasShortArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok) {
+        indexSetter(exec, index, value);
+        return;
+    }
+    Base::put(exec, propertyName, value, slot);
+}
+
+void JSCanvasShortArray::put(ExecState* exec, unsigned propertyName, JSValue value)
+{
+    indexSetter(exec, propertyName, value);
+    return;
+}
+
+void JSCanvasShortArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    for (unsigned i = 0; i < static_cast<CanvasShortArray*>(impl())->length(); ++i)
+        propertyNames.add(Identifier::from(exec, i));
+     Base::getOwnPropertyNames(exec, propertyNames);
+}
+
+
+JSValue JSCanvasShortArray::getByIndex(ExecState* exec, unsigned index)
+{
+    return jsNumber(exec, static_cast<CanvasShortArray*>(impl())->item(index));
+}
+CanvasShortArray* toCanvasShortArray(JSC::JSValue value)
+{
+    return value.inherits(&JSCanvasShortArray::s_info) ? static_cast<JSCanvasShortArray*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasShortArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasShortArray.h
new file mode 100644
index 0000000..284de7b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasShortArray.h
@@ -0,0 +1,77 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSCanvasShortArray_h
+#define JSCanvasShortArray_h
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasShortArray.h"
+#include "JSCanvasArray.h"
+
+namespace WebCore {
+
+class CanvasShortArray;
+
+class JSCanvasShortArray : public JSCanvasArray {
+    typedef JSCanvasArray Base;
+public:
+    JSCanvasShortArray(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasShortArray>);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    CanvasShortArray* impl() const
+    {
+        return static_cast<CanvasShortArray*>(Base::impl());
+    }
+    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
+    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasShortArray*);
+CanvasShortArray* toCanvasShortArray(JSC::JSValue);
+
+class JSCanvasShortArrayPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    JSCanvasShortArrayPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedByteArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedByteArray.cpp
new file mode 100644
index 0000000..52f4c36
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedByteArray.cpp
@@ -0,0 +1,137 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedByteArray.h"
+
+#include "CanvasUnsignedByteArray.h"
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSCanvasUnsignedByteArray);
+
+/* Hash table for prototype */
+
+static const HashTableValue JSCanvasUnsignedByteArrayPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSCanvasUnsignedByteArrayPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSCanvasUnsignedByteArrayPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSCanvasUnsignedByteArrayPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSCanvasUnsignedByteArrayPrototype::s_info = { "CanvasUnsignedByteArrayPrototype", 0, &JSCanvasUnsignedByteArrayPrototypeTable, 0 };
+
+JSObject* JSCanvasUnsignedByteArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSCanvasUnsignedByteArray>(exec, globalObject);
+}
+
+const ClassInfo JSCanvasUnsignedByteArray::s_info = { "CanvasUnsignedByteArray", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasUnsignedByteArray::JSCanvasUnsignedByteArray(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasUnsignedByteArray> impl)
+    : JSCanvasArray(structure, globalObject, impl)
+{
+}
+
+JSObject* JSCanvasUnsignedByteArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSCanvasUnsignedByteArrayPrototype(JSCanvasUnsignedByteArrayPrototype::createStructure(JSCanvasArrayPrototype::self(exec, globalObject)));
+}
+
+bool JSCanvasUnsignedByteArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<CanvasUnsignedByteArray*>(impl())->length()) {
+        slot.setValue(getByIndex(exec, index));
+        return true;
+    }
+    return Base::getOwnPropertySlot(exec, propertyName, slot);
+}
+
+bool JSCanvasUnsignedByteArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<CanvasUnsignedByteArray*>(impl())->length()) {
+        descriptor.setDescriptor(getByIndex(exec, index), DontDelete);
+        return true;
+    }
+    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
+bool JSCanvasUnsignedByteArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    if (propertyName < static_cast<CanvasUnsignedByteArray*>(impl())->length()) {
+        slot.setValue(getByIndex(exec, propertyName));
+        return true;
+    }
+    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
+}
+
+void JSCanvasUnsignedByteArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok) {
+        indexSetter(exec, index, value);
+        return;
+    }
+    Base::put(exec, propertyName, value, slot);
+}
+
+void JSCanvasUnsignedByteArray::put(ExecState* exec, unsigned propertyName, JSValue value)
+{
+    indexSetter(exec, propertyName, value);
+    return;
+}
+
+void JSCanvasUnsignedByteArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    for (unsigned i = 0; i < static_cast<CanvasUnsignedByteArray*>(impl())->length(); ++i)
+        propertyNames.add(Identifier::from(exec, i));
+     Base::getOwnPropertyNames(exec, propertyNames);
+}
+
+
+JSValue JSCanvasUnsignedByteArray::getByIndex(ExecState* exec, unsigned index)
+{
+    return jsNumber(exec, static_cast<CanvasUnsignedByteArray*>(impl())->item(index));
+}
+CanvasUnsignedByteArray* toCanvasUnsignedByteArray(JSC::JSValue value)
+{
+    return value.inherits(&JSCanvasUnsignedByteArray::s_info) ? static_cast<JSCanvasUnsignedByteArray*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedByteArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedByteArray.h
new file mode 100644
index 0000000..a413d11
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedByteArray.h
@@ -0,0 +1,77 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSCanvasUnsignedByteArray_h
+#define JSCanvasUnsignedByteArray_h
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasUnsignedByteArray.h"
+#include "JSCanvasArray.h"
+
+namespace WebCore {
+
+class CanvasUnsignedByteArray;
+
+class JSCanvasUnsignedByteArray : public JSCanvasArray {
+    typedef JSCanvasArray Base;
+public:
+    JSCanvasUnsignedByteArray(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasUnsignedByteArray>);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    CanvasUnsignedByteArray* impl() const
+    {
+        return static_cast<CanvasUnsignedByteArray*>(Base::impl());
+    }
+    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
+    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasUnsignedByteArray*);
+CanvasUnsignedByteArray* toCanvasUnsignedByteArray(JSC::JSValue);
+
+class JSCanvasUnsignedByteArrayPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    JSCanvasUnsignedByteArrayPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedIntArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedIntArray.cpp
new file mode 100644
index 0000000..d8c71b9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedIntArray.cpp
@@ -0,0 +1,137 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedIntArray.h"
+
+#include "CanvasUnsignedIntArray.h"
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSCanvasUnsignedIntArray);
+
+/* Hash table for prototype */
+
+static const HashTableValue JSCanvasUnsignedIntArrayPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSCanvasUnsignedIntArrayPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSCanvasUnsignedIntArrayPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSCanvasUnsignedIntArrayPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSCanvasUnsignedIntArrayPrototype::s_info = { "CanvasUnsignedIntArrayPrototype", 0, &JSCanvasUnsignedIntArrayPrototypeTable, 0 };
+
+JSObject* JSCanvasUnsignedIntArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSCanvasUnsignedIntArray>(exec, globalObject);
+}
+
+const ClassInfo JSCanvasUnsignedIntArray::s_info = { "CanvasUnsignedIntArray", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasUnsignedIntArray::JSCanvasUnsignedIntArray(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasUnsignedIntArray> impl)
+    : JSCanvasArray(structure, globalObject, impl)
+{
+}
+
+JSObject* JSCanvasUnsignedIntArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSCanvasUnsignedIntArrayPrototype(JSCanvasUnsignedIntArrayPrototype::createStructure(JSCanvasArrayPrototype::self(exec, globalObject)));
+}
+
+bool JSCanvasUnsignedIntArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<CanvasUnsignedIntArray*>(impl())->length()) {
+        slot.setValue(getByIndex(exec, index));
+        return true;
+    }
+    return Base::getOwnPropertySlot(exec, propertyName, slot);
+}
+
+bool JSCanvasUnsignedIntArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<CanvasUnsignedIntArray*>(impl())->length()) {
+        descriptor.setDescriptor(getByIndex(exec, index), DontDelete);
+        return true;
+    }
+    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
+bool JSCanvasUnsignedIntArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    if (propertyName < static_cast<CanvasUnsignedIntArray*>(impl())->length()) {
+        slot.setValue(getByIndex(exec, propertyName));
+        return true;
+    }
+    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
+}
+
+void JSCanvasUnsignedIntArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok) {
+        indexSetter(exec, index, value);
+        return;
+    }
+    Base::put(exec, propertyName, value, slot);
+}
+
+void JSCanvasUnsignedIntArray::put(ExecState* exec, unsigned propertyName, JSValue value)
+{
+    indexSetter(exec, propertyName, value);
+    return;
+}
+
+void JSCanvasUnsignedIntArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    for (unsigned i = 0; i < static_cast<CanvasUnsignedIntArray*>(impl())->length(); ++i)
+        propertyNames.add(Identifier::from(exec, i));
+     Base::getOwnPropertyNames(exec, propertyNames);
+}
+
+
+JSValue JSCanvasUnsignedIntArray::getByIndex(ExecState* exec, unsigned index)
+{
+    return jsNumber(exec, static_cast<CanvasUnsignedIntArray*>(impl())->item(index));
+}
+CanvasUnsignedIntArray* toCanvasUnsignedIntArray(JSC::JSValue value)
+{
+    return value.inherits(&JSCanvasUnsignedIntArray::s_info) ? static_cast<JSCanvasUnsignedIntArray*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedIntArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedIntArray.h
new file mode 100644
index 0000000..9ab8391
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedIntArray.h
@@ -0,0 +1,77 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSCanvasUnsignedIntArray_h
+#define JSCanvasUnsignedIntArray_h
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasUnsignedIntArray.h"
+#include "JSCanvasArray.h"
+
+namespace WebCore {
+
+class CanvasUnsignedIntArray;
+
+class JSCanvasUnsignedIntArray : public JSCanvasArray {
+    typedef JSCanvasArray Base;
+public:
+    JSCanvasUnsignedIntArray(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasUnsignedIntArray>);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    CanvasUnsignedIntArray* impl() const
+    {
+        return static_cast<CanvasUnsignedIntArray*>(Base::impl());
+    }
+    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
+    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasUnsignedIntArray*);
+CanvasUnsignedIntArray* toCanvasUnsignedIntArray(JSC::JSValue);
+
+class JSCanvasUnsignedIntArrayPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    JSCanvasUnsignedIntArrayPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedShortArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedShortArray.cpp
new file mode 100644
index 0000000..f553bfb
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedShortArray.cpp
@@ -0,0 +1,137 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedShortArray.h"
+
+#include "CanvasUnsignedShortArray.h"
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSCanvasUnsignedShortArray);
+
+/* Hash table for prototype */
+
+static const HashTableValue JSCanvasUnsignedShortArrayPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSCanvasUnsignedShortArrayPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSCanvasUnsignedShortArrayPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSCanvasUnsignedShortArrayPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSCanvasUnsignedShortArrayPrototype::s_info = { "CanvasUnsignedShortArrayPrototype", 0, &JSCanvasUnsignedShortArrayPrototypeTable, 0 };
+
+JSObject* JSCanvasUnsignedShortArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSCanvasUnsignedShortArray>(exec, globalObject);
+}
+
+const ClassInfo JSCanvasUnsignedShortArray::s_info = { "CanvasUnsignedShortArray", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasUnsignedShortArray::JSCanvasUnsignedShortArray(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasUnsignedShortArray> impl)
+    : JSCanvasArray(structure, globalObject, impl)
+{
+}
+
+JSObject* JSCanvasUnsignedShortArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSCanvasUnsignedShortArrayPrototype(JSCanvasUnsignedShortArrayPrototype::createStructure(JSCanvasArrayPrototype::self(exec, globalObject)));
+}
+
+bool JSCanvasUnsignedShortArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<CanvasUnsignedShortArray*>(impl())->length()) {
+        slot.setValue(getByIndex(exec, index));
+        return true;
+    }
+    return Base::getOwnPropertySlot(exec, propertyName, slot);
+}
+
+bool JSCanvasUnsignedShortArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<CanvasUnsignedShortArray*>(impl())->length()) {
+        descriptor.setDescriptor(getByIndex(exec, index), DontDelete);
+        return true;
+    }
+    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
+bool JSCanvasUnsignedShortArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    if (propertyName < static_cast<CanvasUnsignedShortArray*>(impl())->length()) {
+        slot.setValue(getByIndex(exec, propertyName));
+        return true;
+    }
+    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
+}
+
+void JSCanvasUnsignedShortArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok) {
+        indexSetter(exec, index, value);
+        return;
+    }
+    Base::put(exec, propertyName, value, slot);
+}
+
+void JSCanvasUnsignedShortArray::put(ExecState* exec, unsigned propertyName, JSValue value)
+{
+    indexSetter(exec, propertyName, value);
+    return;
+}
+
+void JSCanvasUnsignedShortArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    for (unsigned i = 0; i < static_cast<CanvasUnsignedShortArray*>(impl())->length(); ++i)
+        propertyNames.add(Identifier::from(exec, i));
+     Base::getOwnPropertyNames(exec, propertyNames);
+}
+
+
+JSValue JSCanvasUnsignedShortArray::getByIndex(ExecState* exec, unsigned index)
+{
+    return jsNumber(exec, static_cast<CanvasUnsignedShortArray*>(impl())->item(index));
+}
+CanvasUnsignedShortArray* toCanvasUnsignedShortArray(JSC::JSValue value)
+{
+    return value.inherits(&JSCanvasUnsignedShortArray::s_info) ? static_cast<JSCanvasUnsignedShortArray*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedShortArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedShortArray.h
new file mode 100644
index 0000000..1f9e352
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedShortArray.h
@@ -0,0 +1,77 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSCanvasUnsignedShortArray_h
+#define JSCanvasUnsignedShortArray_h
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasUnsignedShortArray.h"
+#include "JSCanvasArray.h"
+
+namespace WebCore {
+
+class CanvasUnsignedShortArray;
+
+class JSCanvasUnsignedShortArray : public JSCanvasArray {
+    typedef JSCanvasArray Base;
+public:
+    JSCanvasUnsignedShortArray(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasUnsignedShortArray>);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    CanvasUnsignedShortArray* impl() const
+    {
+        return static_cast<CanvasUnsignedShortArray*>(Base::impl());
+    }
+    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
+    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasUnsignedShortArray*);
+CanvasUnsignedShortArray* toCanvasUnsignedShortArray(JSC::JSValue);
+
+class JSCanvasUnsignedShortArrayPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    JSCanvasUnsignedShortArrayPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCharacterData.cpp b/src/3rdparty/webkit/WebCore/generated/JSCharacterData.cpp
index 5c86d07..7d3d892 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCharacterData.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCharacterData.cpp
@@ -74,6 +74,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSCharacterDataPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -90,6 +91,11 @@ bool JSCharacterDataConstructor::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSCharacterDataConstructor, DOMObject>(exec, &JSCharacterDataConstructorTable, this, propertyName, slot);
 }
 
+bool JSCharacterDataConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCharacterDataConstructor, DOMObject>(exec, &JSCharacterDataConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSCharacterDataPrototypeTableValues[6] =
@@ -121,6 +127,11 @@ bool JSCharacterDataPrototype::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticFunctionSlot<JSObject>(exec, &JSCharacterDataPrototypeTable, this, propertyName, slot);
 }
 
+bool JSCharacterDataPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSCharacterDataPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSCharacterData::s_info = { "CharacterData", &JSNode::s_info, &JSCharacterDataTable, 0 };
 
 JSCharacterData::JSCharacterData(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CharacterData> impl)
@@ -138,6 +149,11 @@ bool JSCharacterData::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSCharacterData, Base>(exec, &JSCharacterDataTable, this, propertyName, slot);
 }
 
+bool JSCharacterData::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCharacterData, Base>(exec, &JSCharacterDataTable, this, propertyName, descriptor);
+}
+
 JSValue jsCharacterDataData(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSCharacterData* castedThis = static_cast<JSCharacterData*>(asObject(slot.slotBase()));
@@ -180,7 +196,7 @@ JSValue JSCharacterData::getConstructor(ExecState* exec, JSGlobalObject* globalO
 JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionSubstringData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCharacterData::s_info))
+    if (!thisValue.inherits(&JSCharacterData::s_info))
         return throwError(exec, TypeError);
     JSCharacterData* castedThisObj = static_cast<JSCharacterData*>(asObject(thisValue));
     CharacterData* imp = static_cast<CharacterData*>(castedThisObj->impl());
@@ -205,7 +221,7 @@ JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionSubstringData(ExecState* e
 JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionAppendData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCharacterData::s_info))
+    if (!thisValue.inherits(&JSCharacterData::s_info))
         return throwError(exec, TypeError);
     JSCharacterData* castedThisObj = static_cast<JSCharacterData*>(asObject(thisValue));
     CharacterData* imp = static_cast<CharacterData*>(castedThisObj->impl());
@@ -220,7 +236,7 @@ JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionAppendData(ExecState* exec
 JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionInsertData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCharacterData::s_info))
+    if (!thisValue.inherits(&JSCharacterData::s_info))
         return throwError(exec, TypeError);
     JSCharacterData* castedThisObj = static_cast<JSCharacterData*>(asObject(thisValue));
     CharacterData* imp = static_cast<CharacterData*>(castedThisObj->impl());
@@ -240,7 +256,7 @@ JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionInsertData(ExecState* exec
 JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionDeleteData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCharacterData::s_info))
+    if (!thisValue.inherits(&JSCharacterData::s_info))
         return throwError(exec, TypeError);
     JSCharacterData* castedThisObj = static_cast<JSCharacterData*>(asObject(thisValue));
     CharacterData* imp = static_cast<CharacterData*>(castedThisObj->impl());
@@ -264,7 +280,7 @@ JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionDeleteData(ExecState* exec
 JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionReplaceData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCharacterData::s_info))
+    if (!thisValue.inherits(&JSCharacterData::s_info))
         return throwError(exec, TypeError);
     JSCharacterData* castedThisObj = static_cast<JSCharacterData*>(asObject(thisValue));
     CharacterData* imp = static_cast<CharacterData*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCharacterData.h b/src/3rdparty/webkit/WebCore/generated/JSCharacterData.h
index 1f6091f..d672467 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCharacterData.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCharacterData.h
@@ -33,6 +33,7 @@ public:
     JSCharacterData(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CharacterData>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -53,9 +54,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSCharacterDataPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp b/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp
index ba2e756..ea5d079 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp
@@ -74,6 +74,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSClientRectPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -90,6 +91,11 @@ bool JSClientRectConstructor::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSClientRectConstructor, DOMObject>(exec, &JSClientRectConstructorTable, this, propertyName, slot);
 }
 
+bool JSClientRectConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSClientRectConstructor, DOMObject>(exec, &JSClientRectConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSClientRectPrototypeTableValues[1] =
@@ -134,6 +140,11 @@ bool JSClientRect::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<JSClientRect, Base>(exec, &JSClientRectTable, this, propertyName, slot);
 }
 
+bool JSClientRect::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSClientRect, Base>(exec, &JSClientRectTable, this, propertyName, descriptor);
+}
+
 JSValue jsClientRectTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSClientRect* castedThis = static_cast<JSClientRect*>(asObject(slot.slotBase()));
@@ -198,7 +209,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, ClientR
 }
 ClientRect* toClientRect(JSC::JSValue value)
 {
-    return value.isObject(&JSClientRect::s_info) ? static_cast<JSClientRect*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSClientRect::s_info) ? static_cast<JSClientRect*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRect.h b/src/3rdparty/webkit/WebCore/generated/JSClientRect.h
index 9e6e951..117a8fd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClientRect.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRect.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSClientRect();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp
index d8426ef..e840f61 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp
@@ -74,6 +74,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSClientRectListPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -90,6 +91,11 @@ bool JSClientRectListConstructor::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticValueSlot<JSClientRectListConstructor, DOMObject>(exec, &JSClientRectListConstructorTable, this, propertyName, slot);
 }
 
+bool JSClientRectListConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSClientRectListConstructor, DOMObject>(exec, &JSClientRectListConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSClientRectListPrototypeTableValues[2] =
@@ -117,6 +123,11 @@ bool JSClientRectListPrototype::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticFunctionSlot<JSObject>(exec, &JSClientRectListPrototypeTable, this, propertyName, slot);
 }
 
+bool JSClientRectListPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSClientRectListPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSClientRectList::s_info = { "ClientRectList", 0, &JSClientRectListTable, 0 };
 
 JSClientRectList::JSClientRectList(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<ClientRectList> impl)
@@ -151,6 +162,26 @@ bool JSClientRectList::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSClientRectList, Base>(exec, &JSClientRectListTable, this, propertyName, slot);
 }
 
+bool JSClientRectList::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    const HashEntry* entry = JSClientRectListTable.entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        slot.setCustom(this, entry->propertyGetter());
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<ClientRectList*>(impl())->length()) {
+        PropertySlot slot;
+        slot.setCustomIndex(this, index, indexGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly);
+        return true;
+    }
+    return getStaticValueDescriptor<JSClientRectList, Base>(exec, &JSClientRectListTable, this, propertyName, descriptor);
+}
+
 bool JSClientRectList::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
 {
     if (propertyName < static_cast<ClientRectList*>(impl())->length()) {
@@ -173,11 +204,11 @@ JSValue jsClientRectListConstructor(ExecState* exec, const Identifier&, const Pr
     JSClientRectList* domObject = static_cast<JSClientRectList*>(asObject(slot.slotBase()));
     return JSClientRectList::getConstructor(exec, domObject->globalObject());
 }
-void JSClientRectList::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSClientRectList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     for (unsigned i = 0; i < static_cast<ClientRectList*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getPropertyNames(exec, propertyNames, listedAttributes);
+     Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 JSValue JSClientRectList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -188,7 +219,7 @@ JSValue JSClientRectList::getConstructor(ExecState* exec, JSGlobalObject* global
 JSValue JSC_HOST_CALL jsClientRectListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSClientRectList::s_info))
+    if (!thisValue.inherits(&JSClientRectList::s_info))
         return throwError(exec, TypeError);
     JSClientRectList* castedThisObj = static_cast<JSClientRectList*>(asObject(thisValue));
     ClientRectList* imp = static_cast<ClientRectList*>(castedThisObj->impl());
@@ -215,7 +246,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, ClientR
 }
 ClientRectList* toClientRectList(JSC::JSValue value)
 {
-    return value.isObject(&JSClientRectList::s_info) ? static_cast<JSClientRectList*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSClientRectList::s_info) ? static_cast<JSClientRectList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRectList.h b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.h
index 34868a3..89e1ef5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClientRectList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSClientRectList();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -46,7 +47,7 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     ClientRectList* impl() const { return m_impl.get(); }
 
@@ -65,9 +66,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSClientRectListPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp b/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
index aea76dc..708c546 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
@@ -75,6 +75,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSClipboardPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -91,6 +92,11 @@ bool JSClipboardConstructor::getOwnPropertySlot(ExecState* exec, const Identifie
     return getStaticValueSlot<JSClipboardConstructor, DOMObject>(exec, &JSClipboardConstructorTable, this, propertyName, slot);
 }
 
+bool JSClipboardConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSClipboardConstructor, DOMObject>(exec, &JSClipboardConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSClipboardPrototypeTableValues[5] =
@@ -121,6 +127,11 @@ bool JSClipboardPrototype::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticFunctionSlot<JSObject>(exec, &JSClipboardPrototypeTable, this, propertyName, slot);
 }
 
+bool JSClipboardPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSClipboardPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSClipboard::s_info = { "Clipboard", 0, &JSClipboardTable, 0 };
 
 JSClipboard::JSClipboard(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<Clipboard> impl)
@@ -144,6 +155,11 @@ bool JSClipboard::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return getStaticValueSlot<JSClipboard, Base>(exec, &JSClipboardTable, this, propertyName, slot);
 }
 
+bool JSClipboard::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSClipboard, Base>(exec, &JSClipboardTable, this, propertyName, descriptor);
+}
+
 JSValue jsClipboardDropEffect(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSClipboard* castedThis = static_cast<JSClipboard*>(asObject(slot.slotBase()));
@@ -204,7 +220,7 @@ JSValue JSClipboard::getConstructor(ExecState* exec, JSGlobalObject* globalObjec
 JSValue JSC_HOST_CALL jsClipboardPrototypeFunctionClearData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSClipboard::s_info))
+    if (!thisValue.inherits(&JSClipboard::s_info))
         return throwError(exec, TypeError);
     JSClipboard* castedThisObj = static_cast<JSClipboard*>(asObject(thisValue));
     return castedThisObj->clearData(exec, args);
@@ -213,7 +229,7 @@ JSValue JSC_HOST_CALL jsClipboardPrototypeFunctionClearData(ExecState* exec, JSO
 JSValue JSC_HOST_CALL jsClipboardPrototypeFunctionGetData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSClipboard::s_info))
+    if (!thisValue.inherits(&JSClipboard::s_info))
         return throwError(exec, TypeError);
     JSClipboard* castedThisObj = static_cast<JSClipboard*>(asObject(thisValue));
     return castedThisObj->getData(exec, args);
@@ -222,7 +238,7 @@ JSValue JSC_HOST_CALL jsClipboardPrototypeFunctionGetData(ExecState* exec, JSObj
 JSValue JSC_HOST_CALL jsClipboardPrototypeFunctionSetData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSClipboard::s_info))
+    if (!thisValue.inherits(&JSClipboard::s_info))
         return throwError(exec, TypeError);
     JSClipboard* castedThisObj = static_cast<JSClipboard*>(asObject(thisValue));
     return castedThisObj->setData(exec, args);
@@ -231,7 +247,7 @@ JSValue JSC_HOST_CALL jsClipboardPrototypeFunctionSetData(ExecState* exec, JSObj
 JSValue JSC_HOST_CALL jsClipboardPrototypeFunctionSetDragImage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSClipboard::s_info))
+    if (!thisValue.inherits(&JSClipboard::s_info))
         return throwError(exec, TypeError);
     JSClipboard* castedThisObj = static_cast<JSClipboard*>(asObject(thisValue));
     return castedThisObj->setDragImage(exec, args);
@@ -243,7 +259,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Clipboa
 }
 Clipboard* toClipboard(JSC::JSValue value)
 {
-    return value.isObject(&JSClipboard::s_info) ? static_cast<JSClipboard*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSClipboard::s_info) ? static_cast<JSClipboard*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClipboard.h b/src/3rdparty/webkit/WebCore/generated/JSClipboard.h
index 68fbdf5..6b822ef 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClipboard.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSClipboard.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSClipboard();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -72,9 +73,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSClipboardPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSComment.cpp b/src/3rdparty/webkit/WebCore/generated/JSComment.cpp
index a1476cc..32da401 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSComment.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSComment.cpp
@@ -67,6 +67,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSCommentPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -83,6 +84,11 @@ bool JSCommentConstructor::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSCommentConstructor, DOMObject>(exec, &JSCommentConstructorTable, this, propertyName, slot);
 }
 
+bool JSCommentConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCommentConstructor, DOMObject>(exec, &JSCommentConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSCommentPrototypeTableValues[1] =
@@ -121,6 +127,11 @@ bool JSComment::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return getStaticValueSlot<JSComment, Base>(exec, &JSCommentTable, this, propertyName, slot);
 }
 
+bool JSComment::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSComment, Base>(exec, &JSCommentTable, this, propertyName, descriptor);
+}
+
 JSValue jsCommentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSComment* domObject = static_cast<JSComment*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSComment.h b/src/3rdparty/webkit/WebCore/generated/JSComment.h
index f7d34aa..7af8da1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSComment.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSComment.h
@@ -33,6 +33,7 @@ public:
     JSComment(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<Comment>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSConsole.cpp b/src/3rdparty/webkit/WebCore/generated/JSConsole.cpp
index 110c7e1..1f8c6d8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSConsole.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSConsole.cpp
@@ -89,6 +89,11 @@ bool JSConsolePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticFunctionSlot<JSObject>(exec, &JSConsolePrototypeTable, this, propertyName, slot);
 }
 
+bool JSConsolePrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSConsolePrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSConsole::s_info = { "Console", 0, &JSConsoleTable, 0 };
 
 JSConsole::JSConsole(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<Console> impl)
@@ -112,6 +117,11 @@ bool JSConsole::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return getStaticValueSlot<JSConsole, Base>(exec, &JSConsoleTable, this, propertyName, slot);
 }
 
+bool JSConsole::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSConsole, Base>(exec, &JSConsoleTable, this, propertyName, descriptor);
+}
+
 JSValue jsConsoleProfiles(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSConsole* castedThis = static_cast<JSConsole*>(asObject(slot.slotBase()));
@@ -121,7 +131,7 @@ JSValue jsConsoleProfiles(ExecState* exec, const Identifier&, const PropertySlot
 JSValue JSC_HOST_CALL jsConsolePrototypeFunctionDebug(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSConsole::s_info))
+    if (!thisValue.inherits(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -134,7 +144,7 @@ JSValue JSC_HOST_CALL jsConsolePrototypeFunctionDebug(ExecState* exec, JSObject*
 JSValue JSC_HOST_CALL jsConsolePrototypeFunctionError(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSConsole::s_info))
+    if (!thisValue.inherits(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -147,7 +157,7 @@ JSValue JSC_HOST_CALL jsConsolePrototypeFunctionError(ExecState* exec, JSObject*
 JSValue JSC_HOST_CALL jsConsolePrototypeFunctionInfo(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSConsole::s_info))
+    if (!thisValue.inherits(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -160,7 +170,7 @@ JSValue JSC_HOST_CALL jsConsolePrototypeFunctionInfo(ExecState* exec, JSObject*,
 JSValue JSC_HOST_CALL jsConsolePrototypeFunctionLog(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSConsole::s_info))
+    if (!thisValue.inherits(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -173,7 +183,7 @@ JSValue JSC_HOST_CALL jsConsolePrototypeFunctionLog(ExecState* exec, JSObject*,
 JSValue JSC_HOST_CALL jsConsolePrototypeFunctionWarn(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSConsole::s_info))
+    if (!thisValue.inherits(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -186,7 +196,7 @@ JSValue JSC_HOST_CALL jsConsolePrototypeFunctionWarn(ExecState* exec, JSObject*,
 JSValue JSC_HOST_CALL jsConsolePrototypeFunctionDir(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSConsole::s_info))
+    if (!thisValue.inherits(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -199,7 +209,7 @@ JSValue JSC_HOST_CALL jsConsolePrototypeFunctionDir(ExecState* exec, JSObject*,
 JSValue JSC_HOST_CALL jsConsolePrototypeFunctionDirxml(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSConsole::s_info))
+    if (!thisValue.inherits(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -212,7 +222,7 @@ JSValue JSC_HOST_CALL jsConsolePrototypeFunctionDirxml(ExecState* exec, JSObject
 JSValue JSC_HOST_CALL jsConsolePrototypeFunctionTrace(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSConsole::s_info))
+    if (!thisValue.inherits(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -225,7 +235,7 @@ JSValue JSC_HOST_CALL jsConsolePrototypeFunctionTrace(ExecState* exec, JSObject*
 JSValue JSC_HOST_CALL jsConsolePrototypeFunctionAssert(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSConsole::s_info))
+    if (!thisValue.inherits(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -239,7 +249,7 @@ JSValue JSC_HOST_CALL jsConsolePrototypeFunctionAssert(ExecState* exec, JSObject
 JSValue JSC_HOST_CALL jsConsolePrototypeFunctionCount(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSConsole::s_info))
+    if (!thisValue.inherits(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -252,7 +262,7 @@ JSValue JSC_HOST_CALL jsConsolePrototypeFunctionCount(ExecState* exec, JSObject*
 JSValue JSC_HOST_CALL jsConsolePrototypeFunctionProfile(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSConsole::s_info))
+    if (!thisValue.inherits(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -266,7 +276,7 @@ JSValue JSC_HOST_CALL jsConsolePrototypeFunctionProfile(ExecState* exec, JSObjec
 JSValue JSC_HOST_CALL jsConsolePrototypeFunctionProfileEnd(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSConsole::s_info))
+    if (!thisValue.inherits(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -280,7 +290,7 @@ JSValue JSC_HOST_CALL jsConsolePrototypeFunctionProfileEnd(ExecState* exec, JSOb
 JSValue JSC_HOST_CALL jsConsolePrototypeFunctionTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSConsole::s_info))
+    if (!thisValue.inherits(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -293,7 +303,7 @@ JSValue JSC_HOST_CALL jsConsolePrototypeFunctionTime(ExecState* exec, JSObject*,
 JSValue JSC_HOST_CALL jsConsolePrototypeFunctionTimeEnd(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSConsole::s_info))
+    if (!thisValue.inherits(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -307,7 +317,7 @@ JSValue JSC_HOST_CALL jsConsolePrototypeFunctionTimeEnd(ExecState* exec, JSObjec
 JSValue JSC_HOST_CALL jsConsolePrototypeFunctionGroup(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSConsole::s_info))
+    if (!thisValue.inherits(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -320,7 +330,7 @@ JSValue JSC_HOST_CALL jsConsolePrototypeFunctionGroup(ExecState* exec, JSObject*
 JSValue JSC_HOST_CALL jsConsolePrototypeFunctionGroupEnd(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSConsole::s_info))
+    if (!thisValue.inherits(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -335,7 +345,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Console
 }
 Console* toConsole(JSC::JSValue value)
 {
-    return value.isObject(&JSConsole::s_info) ? static_cast<JSConsole*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSConsole::s_info) ? static_cast<JSConsole*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSConsole.h b/src/3rdparty/webkit/WebCore/generated/JSConsole.h
index f66f53f..731deb6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSConsole.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSConsole.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSConsole();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -64,9 +65,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSConsolePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCoordinates.cpp b/src/3rdparty/webkit/WebCore/generated/JSCoordinates.cpp
index bddd8a9..21efdc8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCoordinates.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCoordinates.cpp
@@ -22,10 +22,7 @@
 #include "JSCoordinates.h"
 
 #include "Coordinates.h"
-#include "KURL.h"
-#include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
-#include <runtime/JSString.h>
 #include <wtf/GetPtr.h>
 
 using namespace JSC;
@@ -57,9 +54,8 @@ static JSC_CONST_HASHTABLE HashTable JSCoordinatesTable =
 
 /* Hash table for prototype */
 
-static const HashTableValue JSCoordinatesPrototypeTableValues[2] =
+static const HashTableValue JSCoordinatesPrototypeTableValues[1] =
 {
-    { "toString", DontDelete|DontEnum|Function, (intptr_t)jsCoordinatesPrototypeFunctionToString, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -67,7 +63,7 @@ static JSC_CONST_HASHTABLE HashTable JSCoordinatesPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 0, JSCoordinatesPrototypeTableValues, 0 };
 #else
-    { 2, 1, JSCoordinatesPrototypeTableValues, 0 };
+    { 1, 0, JSCoordinatesPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSCoordinatesPrototype::s_info = { "CoordinatesPrototype", 0, &JSCoordinatesPrototypeTable, 0 };
@@ -77,11 +73,6 @@ JSObject* JSCoordinatesPrototype::self(ExecState* exec, JSGlobalObject* globalOb
     return getDOMPrototype<JSCoordinates>(exec, globalObject);
 }
 
-bool JSCoordinatesPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    return getStaticFunctionSlot<JSObject>(exec, &JSCoordinatesPrototypeTable, this, propertyName, slot);
-}
-
 const ClassInfo JSCoordinates::s_info = { "Coordinates", 0, &JSCoordinatesTable, 0 };
 
 JSCoordinates::JSCoordinates(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<Coordinates> impl)
@@ -105,6 +96,11 @@ bool JSCoordinates::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSCoordinates, Base>(exec, &JSCoordinatesTable, this, propertyName, slot);
 }
 
+bool JSCoordinates::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCoordinates, Base>(exec, &JSCoordinatesTable, this, propertyName, descriptor);
+}
+
 JSValue jsCoordinatesLatitude(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSCoordinates* castedThis = static_cast<JSCoordinates*>(asObject(slot.slotBase()));
@@ -153,26 +149,13 @@ JSValue jsCoordinatesSpeed(ExecState* exec, const Identifier&, const PropertySlo
     return castedThis->speed(exec);
 }
 
-JSValue JSC_HOST_CALL jsCoordinatesPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSCoordinates::s_info))
-        return throwError(exec, TypeError);
-    JSCoordinates* castedThisObj = static_cast<JSCoordinates*>(asObject(thisValue));
-    Coordinates* imp = static_cast<Coordinates*>(castedThisObj->impl());
-
-
-    JSC::JSValue result = jsString(exec, imp->toString());
-    return result;
-}
-
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Coordinates* object)
 {
     return getDOMObjectWrapper<JSCoordinates>(exec, globalObject, object);
 }
 Coordinates* toCoordinates(JSC::JSValue value)
 {
-    return value.isObject(&JSCoordinates::s_info) ? static_cast<JSCoordinates*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSCoordinates::s_info) ? static_cast<JSCoordinates*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCoordinates.h b/src/3rdparty/webkit/WebCore/generated/JSCoordinates.h
index d209540..ba5c804 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCoordinates.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCoordinates.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSCoordinates();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -66,17 +67,9 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
-    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
-    }
     JSCoordinatesPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
 
-// Functions
-
-JSC::JSValue JSC_HOST_CALL jsCoordinatesPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
 JSC::JSValue jsCoordinatesLatitude(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp b/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp
index 0269696..d7bc5f1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp
@@ -72,6 +72,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSCounterPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -88,6 +89,11 @@ bool JSCounterConstructor::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSCounterConstructor, DOMObject>(exec, &JSCounterConstructorTable, this, propertyName, slot);
 }
 
+bool JSCounterConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCounterConstructor, DOMObject>(exec, &JSCounterConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSCounterPrototypeTableValues[1] =
@@ -132,6 +138,11 @@ bool JSCounter::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return getStaticValueSlot<JSCounter, Base>(exec, &JSCounterTable, this, propertyName, slot);
 }
 
+bool JSCounter::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCounter, Base>(exec, &JSCounterTable, this, propertyName, descriptor);
+}
+
 JSValue jsCounterIdentifier(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSCounter* castedThis = static_cast<JSCounter*>(asObject(slot.slotBase()));
@@ -172,7 +183,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Counter
 }
 Counter* toCounter(JSC::JSValue value)
 {
-    return value.isObject(&JSCounter::s_info) ? static_cast<JSCounter*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSCounter::s_info) ? static_cast<JSCounter*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCounter.h b/src/3rdparty/webkit/WebCore/generated/JSCounter.h
index cdfc523..9c26a46 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCounter.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCounter.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSCounter();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.cpp
index bf55e99..e28b6ec 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.cpp
@@ -101,6 +101,11 @@ bool JSDOMApplicationCachePrototype::getOwnPropertySlot(ExecState* exec, const I
     return getStaticPropertySlot<JSDOMApplicationCachePrototype, JSObject>(exec, &JSDOMApplicationCachePrototypeTable, this, propertyName, slot);
 }
 
+bool JSDOMApplicationCachePrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSDOMApplicationCachePrototype, JSObject>(exec, &JSDOMApplicationCachePrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSDOMApplicationCache::s_info = { "DOMApplicationCache", 0, &JSDOMApplicationCacheTable, 0 };
 
 JSDOMApplicationCache::JSDOMApplicationCache(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<DOMApplicationCache> impl)
@@ -124,6 +129,11 @@ bool JSDOMApplicationCache::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSDOMApplicationCache, Base>(exec, &JSDOMApplicationCacheTable, this, propertyName, slot);
 }
 
+bool JSDOMApplicationCache::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSDOMApplicationCache, Base>(exec, &JSDOMApplicationCacheTable, this, propertyName, descriptor);
+}
+
 JSValue jsDOMApplicationCacheStatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()));
@@ -316,7 +326,7 @@ void setJSDOMApplicationCacheOnobsolete(ExecState* exec, JSObject* thisObject, J
 JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionUpdate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDOMApplicationCache::s_info))
+    if (!thisValue.inherits(&JSDOMApplicationCache::s_info))
         return throwError(exec, TypeError);
     JSDOMApplicationCache* castedThisObj = static_cast<JSDOMApplicationCache*>(asObject(thisValue));
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(castedThisObj->impl());
@@ -330,7 +340,7 @@ JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionUpdate(ExecState* ex
 JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionSwapCache(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDOMApplicationCache::s_info))
+    if (!thisValue.inherits(&JSDOMApplicationCache::s_info))
         return throwError(exec, TypeError);
     JSDOMApplicationCache* castedThisObj = static_cast<JSDOMApplicationCache*>(asObject(thisValue));
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(castedThisObj->impl());
@@ -344,7 +354,7 @@ JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionSwapCache(ExecState*
 JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDOMApplicationCache::s_info))
+    if (!thisValue.inherits(&JSDOMApplicationCache::s_info))
         return throwError(exec, TypeError);
     JSDOMApplicationCache* castedThisObj = static_cast<JSDOMApplicationCache*>(asObject(thisValue));
     return castedThisObj->addEventListener(exec, args);
@@ -353,7 +363,7 @@ JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionAddEventListener(Exe
 JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDOMApplicationCache::s_info))
+    if (!thisValue.inherits(&JSDOMApplicationCache::s_info))
         return throwError(exec, TypeError);
     JSDOMApplicationCache* castedThisObj = static_cast<JSDOMApplicationCache*>(asObject(thisValue));
     return castedThisObj->removeEventListener(exec, args);
@@ -362,7 +372,7 @@ JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionRemoveEventListener(
 JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDOMApplicationCache::s_info))
+    if (!thisValue.inherits(&JSDOMApplicationCache::s_info))
         return throwError(exec, TypeError);
     JSDOMApplicationCache* castedThisObj = static_cast<JSDOMApplicationCache*>(asObject(thisValue));
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(castedThisObj->impl());
@@ -413,7 +423,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMAppl
 }
 DOMApplicationCache* toDOMApplicationCache(JSC::JSValue value)
 {
-    return value.isObject(&JSDOMApplicationCache::s_info) ? static_cast<JSDOMApplicationCache*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSDOMApplicationCache::s_info) ? static_cast<JSDOMApplicationCache*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.h b/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.h
index 6938f25..28feddc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.h
@@ -39,6 +39,7 @@ public:
     virtual ~JSDOMApplicationCache();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -48,7 +49,7 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void mark();
+    virtual void markChildren(JSC::MarkStack&);
 
 
     // Custom functions
@@ -70,6 +71,7 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp
index da10b12..94df8dd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp
@@ -96,6 +96,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSDOMCoreExceptionPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -112,6 +113,11 @@ bool JSDOMCoreExceptionConstructor::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSDOMCoreExceptionConstructor, DOMObject>(exec, &JSDOMCoreExceptionConstructorTable, this, propertyName, slot);
 }
 
+bool JSDOMCoreExceptionConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSDOMCoreExceptionConstructor, DOMObject>(exec, &JSDOMCoreExceptionConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSDOMCoreExceptionPrototypeTableValues[24] =
@@ -161,6 +167,11 @@ bool JSDOMCoreExceptionPrototype::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticPropertySlot<JSDOMCoreExceptionPrototype, JSObject>(exec, &JSDOMCoreExceptionPrototypeTable, this, propertyName, slot);
 }
 
+bool JSDOMCoreExceptionPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSDOMCoreExceptionPrototype, JSObject>(exec, &JSDOMCoreExceptionPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSDOMCoreException::s_info = { "DOMException", 0, &JSDOMCoreExceptionTable, 0 };
 
 JSDOMCoreException::JSDOMCoreException(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<DOMCoreException> impl)
@@ -184,6 +195,11 @@ bool JSDOMCoreException::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSDOMCoreException, Base>(exec, &JSDOMCoreExceptionTable, this, propertyName, slot);
 }
 
+bool JSDOMCoreException::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSDOMCoreException, Base>(exec, &JSDOMCoreExceptionTable, this, propertyName, descriptor);
+}
+
 JSValue jsDOMCoreExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSDOMCoreException* castedThis = static_cast<JSDOMCoreException*>(asObject(slot.slotBase()));
@@ -221,7 +237,7 @@ JSValue JSDOMCoreException::getConstructor(ExecState* exec, JSGlobalObject* glob
 JSValue JSC_HOST_CALL jsDOMCoreExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDOMCoreException::s_info))
+    if (!thisValue.inherits(&JSDOMCoreException::s_info))
         return throwError(exec, TypeError);
     JSDOMCoreException* castedThisObj = static_cast<JSDOMCoreException*>(asObject(thisValue));
     DOMCoreException* imp = static_cast<DOMCoreException*>(castedThisObj->impl());
@@ -349,7 +365,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMCore
 }
 DOMCoreException* toDOMCoreException(JSC::JSValue value)
 {
-    return value.isObject(&JSDOMCoreException::s_info) ? static_cast<JSDOMCoreException*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSDOMCoreException::s_info) ? static_cast<JSDOMCoreException*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.h b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.h
index e0a45f9..f46b9d7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSDOMCoreException();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -62,9 +63,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSDOMCoreExceptionPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp
index 6941521..27eb530 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp
@@ -77,6 +77,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSDOMImplementationPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -93,6 +94,11 @@ bool JSDOMImplementationConstructor::getOwnPropertySlot(ExecState* exec, const I
     return getStaticValueSlot<JSDOMImplementationConstructor, DOMObject>(exec, &JSDOMImplementationConstructorTable, this, propertyName, slot);
 }
 
+bool JSDOMImplementationConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSDOMImplementationConstructor, DOMObject>(exec, &JSDOMImplementationConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSDOMImplementationPrototypeTableValues[6] =
@@ -124,6 +130,11 @@ bool JSDOMImplementationPrototype::getOwnPropertySlot(ExecState* exec, const Ide
     return getStaticFunctionSlot<JSObject>(exec, &JSDOMImplementationPrototypeTable, this, propertyName, slot);
 }
 
+bool JSDOMImplementationPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSDOMImplementationPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSDOMImplementation::s_info = { "DOMImplementation", 0, &JSDOMImplementationTable, 0 };
 
 JSDOMImplementation::JSDOMImplementation(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<DOMImplementation> impl)
@@ -147,6 +158,11 @@ bool JSDOMImplementation::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSDOMImplementation, Base>(exec, &JSDOMImplementationTable, this, propertyName, slot);
 }
 
+bool JSDOMImplementation::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSDOMImplementation, Base>(exec, &JSDOMImplementationTable, this, propertyName, descriptor);
+}
+
 JSValue jsDOMImplementationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSDOMImplementation* domObject = static_cast<JSDOMImplementation*>(asObject(slot.slotBase()));
@@ -160,7 +176,7 @@ JSValue JSDOMImplementation::getConstructor(ExecState* exec, JSGlobalObject* glo
 JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionHasFeature(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDOMImplementation::s_info))
+    if (!thisValue.inherits(&JSDOMImplementation::s_info))
         return throwError(exec, TypeError);
     JSDOMImplementation* castedThisObj = static_cast<JSDOMImplementation*>(asObject(thisValue));
     DOMImplementation* imp = static_cast<DOMImplementation*>(castedThisObj->impl());
@@ -175,7 +191,7 @@ JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionHasFeature(ExecState*
 JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionCreateDocumentType(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDOMImplementation::s_info))
+    if (!thisValue.inherits(&JSDOMImplementation::s_info))
         return throwError(exec, TypeError);
     JSDOMImplementation* castedThisObj = static_cast<JSDOMImplementation*>(asObject(thisValue));
     DOMImplementation* imp = static_cast<DOMImplementation*>(castedThisObj->impl());
@@ -193,7 +209,7 @@ JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionCreateDocumentType(Exe
 JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionCreateDocument(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDOMImplementation::s_info))
+    if (!thisValue.inherits(&JSDOMImplementation::s_info))
         return throwError(exec, TypeError);
     JSDOMImplementation* castedThisObj = static_cast<JSDOMImplementation*>(asObject(thisValue));
     DOMImplementation* imp = static_cast<DOMImplementation*>(castedThisObj->impl());
@@ -211,7 +227,7 @@ JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionCreateDocument(ExecSta
 JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionCreateCSSStyleSheet(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDOMImplementation::s_info))
+    if (!thisValue.inherits(&JSDOMImplementation::s_info))
         return throwError(exec, TypeError);
     JSDOMImplementation* castedThisObj = static_cast<JSDOMImplementation*>(asObject(thisValue));
     DOMImplementation* imp = static_cast<DOMImplementation*>(castedThisObj->impl());
@@ -228,7 +244,7 @@ JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionCreateCSSStyleSheet(Ex
 JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionCreateHTMLDocument(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDOMImplementation::s_info))
+    if (!thisValue.inherits(&JSDOMImplementation::s_info))
         return throwError(exec, TypeError);
     JSDOMImplementation* castedThisObj = static_cast<JSDOMImplementation*>(asObject(thisValue));
     DOMImplementation* imp = static_cast<DOMImplementation*>(castedThisObj->impl());
@@ -245,7 +261,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMImpl
 }
 DOMImplementation* toDOMImplementation(JSC::JSValue value)
 {
-    return value.isObject(&JSDOMImplementation::s_info) ? static_cast<JSDOMImplementation*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSDOMImplementation::s_info) ? static_cast<JSDOMImplementation*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.h b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.h
index b811110..1d1a436 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSDOMImplementation();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -62,9 +63,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSDOMImplementationPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp
index 31dd1fc..8ff4a03 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp
@@ -71,6 +71,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSDOMParserPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -96,6 +97,11 @@ bool JSDOMParserConstructor::getOwnPropertySlot(ExecState* exec, const Identifie
     return getStaticValueSlot<JSDOMParserConstructor, DOMObject>(exec, &JSDOMParserConstructorTable, this, propertyName, slot);
 }
 
+bool JSDOMParserConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSDOMParserConstructor, DOMObject>(exec, &JSDOMParserConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSDOMParserPrototypeTableValues[2] =
@@ -123,6 +129,11 @@ bool JSDOMParserPrototype::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticFunctionSlot<JSObject>(exec, &JSDOMParserPrototypeTable, this, propertyName, slot);
 }
 
+bool JSDOMParserPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSDOMParserPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSDOMParser::s_info = { "DOMParser", 0, &JSDOMParserTable, 0 };
 
 JSDOMParser::JSDOMParser(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<DOMParser> impl)
@@ -146,6 +157,11 @@ bool JSDOMParser::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return getStaticValueSlot<JSDOMParser, Base>(exec, &JSDOMParserTable, this, propertyName, slot);
 }
 
+bool JSDOMParser::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSDOMParser, Base>(exec, &JSDOMParserTable, this, propertyName, descriptor);
+}
+
 JSValue jsDOMParserConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSDOMParser* domObject = static_cast<JSDOMParser*>(asObject(slot.slotBase()));
@@ -159,7 +175,7 @@ JSValue JSDOMParser::getConstructor(ExecState* exec, JSGlobalObject* globalObjec
 JSValue JSC_HOST_CALL jsDOMParserPrototypeFunctionParseFromString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDOMParser::s_info))
+    if (!thisValue.inherits(&JSDOMParser::s_info))
         return throwError(exec, TypeError);
     JSDOMParser* castedThisObj = static_cast<JSDOMParser*>(asObject(thisValue));
     DOMParser* imp = static_cast<DOMParser*>(castedThisObj->impl());
@@ -177,7 +193,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMPars
 }
 DOMParser* toDOMParser(JSC::JSValue value)
 {
-    return value.isObject(&JSDOMParser::s_info) ? static_cast<JSDOMParser*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSDOMParser::s_info) ? static_cast<JSDOMParser*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.h b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.h
index 2271e18..7c95a9c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSDOMParser();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -62,9 +63,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSDOMParserPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.cpp
index ffb842a..daf65df 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.cpp
@@ -104,6 +104,11 @@ bool JSDOMSelectionPrototype::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticFunctionSlot<JSObject>(exec, &JSDOMSelectionPrototypeTable, this, propertyName, slot);
 }
 
+bool JSDOMSelectionPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSDOMSelectionPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSDOMSelection::s_info = { "DOMSelection", 0, &JSDOMSelectionTable, 0 };
 
 JSDOMSelection::JSDOMSelection(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<DOMSelection> impl)
@@ -127,6 +132,11 @@ bool JSDOMSelection::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSDOMSelection, Base>(exec, &JSDOMSelectionTable, this, propertyName, slot);
 }
 
+bool JSDOMSelection::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSDOMSelection, Base>(exec, &JSDOMSelectionTable, this, propertyName, descriptor);
+}
+
 JSValue jsDOMSelectionAnchorNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slot.slotBase()));
@@ -218,7 +228,7 @@ JSValue jsDOMSelectionType(ExecState* exec, const Identifier&, const PropertySlo
 JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionCollapse(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDOMSelection::s_info))
+    if (!thisValue.inherits(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
@@ -234,7 +244,7 @@ JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionCollapse(ExecState* exec, J
 JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionCollapseToEnd(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDOMSelection::s_info))
+    if (!thisValue.inherits(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
@@ -246,7 +256,7 @@ JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionCollapseToEnd(ExecState* ex
 JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionCollapseToStart(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDOMSelection::s_info))
+    if (!thisValue.inherits(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
@@ -258,7 +268,7 @@ JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionCollapseToStart(ExecState*
 JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionDeleteFromDocument(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDOMSelection::s_info))
+    if (!thisValue.inherits(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
@@ -270,7 +280,7 @@ JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionDeleteFromDocument(ExecStat
 JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionContainsNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDOMSelection::s_info))
+    if (!thisValue.inherits(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
@@ -285,7 +295,7 @@ JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionContainsNode(ExecState* exe
 JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionSelectAllChildren(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDOMSelection::s_info))
+    if (!thisValue.inherits(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
@@ -300,7 +310,7 @@ JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionSelectAllChildren(ExecState
 JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionExtend(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDOMSelection::s_info))
+    if (!thisValue.inherits(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
@@ -316,7 +326,7 @@ JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionExtend(ExecState* exec, JSO
 JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionGetRangeAt(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDOMSelection::s_info))
+    if (!thisValue.inherits(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
@@ -332,7 +342,7 @@ JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionGetRangeAt(ExecState* exec,
 JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionRemoveAllRanges(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDOMSelection::s_info))
+    if (!thisValue.inherits(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
@@ -344,7 +354,7 @@ JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionRemoveAllRanges(ExecState*
 JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionAddRange(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDOMSelection::s_info))
+    if (!thisValue.inherits(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
@@ -357,7 +367,7 @@ JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionAddRange(ExecState* exec, J
 JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDOMSelection::s_info))
+    if (!thisValue.inherits(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
@@ -370,7 +380,7 @@ JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionToString(ExecState* exec, J
 JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionModify(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDOMSelection::s_info))
+    if (!thisValue.inherits(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
@@ -385,7 +395,7 @@ JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionModify(ExecState* exec, JSO
 JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionSetBaseAndExtent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDOMSelection::s_info))
+    if (!thisValue.inherits(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
@@ -403,7 +413,7 @@ JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionSetBaseAndExtent(ExecState*
 JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionSetPosition(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDOMSelection::s_info))
+    if (!thisValue.inherits(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
@@ -419,7 +429,7 @@ JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionSetPosition(ExecState* exec
 JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionEmpty(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDOMSelection::s_info))
+    if (!thisValue.inherits(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
@@ -434,7 +444,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMSele
 }
 DOMSelection* toDOMSelection(JSC::JSValue value)
 {
-    return value.isObject(&JSDOMSelection::s_info) ? static_cast<JSDOMSelection*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSDOMSelection::s_info) ? static_cast<JSDOMSelection*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.h b/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.h
index a0fae0a..d513589 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSDOMSelection();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -61,9 +62,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSDOMSelectionPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp
index 364a975..414a1bb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp
@@ -52,7 +52,16 @@
 #include "JSCSSValueList.h"
 #include "JSCSSVariablesDeclaration.h"
 #include "JSCSSVariablesRule.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasByteArray.h"
+#include "JSCanvasFloatArray.h"
+#include "JSCanvasIntArray.h"
 #include "JSCanvasRenderingContext2D.h"
+#include "JSCanvasRenderingContext3D.h"
+#include "JSCanvasShortArray.h"
+#include "JSCanvasUnsignedByteArray.h"
+#include "JSCanvasUnsignedIntArray.h"
+#include "JSCanvasUnsignedShortArray.h"
 #include "JSCharacterData.h"
 #include "JSClientRect.h"
 #include "JSClientRectList.h"
@@ -79,6 +88,7 @@
 #include "JSEvent.h"
 #include "JSEventException.h"
 #include "JSEventListener.h"
+#include "JSEventSource.h"
 #include "JSFile.h"
 #include "JSFileList.h"
 #include "JSHTMLAnchorElement.h"
@@ -147,6 +157,7 @@
 #include "JSHTMLUListElement.h"
 #include "JSHTMLVideoElement.h"
 #include "JSKeyboardEvent.h"
+#include "JSMedia.h"
 #include "JSMediaError.h"
 #include "JSMediaList.h"
 #include "JSMessageChannel.h"
@@ -163,6 +174,7 @@
 #include "JSNodeList.h"
 #include "JSNotation.h"
 #include "JSOverflowEvent.h"
+#include "JSPageTransitionEvent.h"
 #include "JSPlugin.h"
 #include "JSPluginArray.h"
 #include "JSProcessingInstruction.h"
@@ -186,6 +198,7 @@
 #include "JSSVGTransform.h"
 #include "JSSVGUnitTypes.h"
 #include "JSScreen.h"
+#include "JSSharedWorker.h"
 #include "JSStorage.h"
 #include "JSStorageEvent.h"
 #include "JSStyleSheet.h"
@@ -211,6 +224,7 @@
 #include "JSXPathException.h"
 #include "JSXPathResult.h"
 #include "KURL.h"
+#include "Media.h"
 #include "Navigator.h"
 #include "RegisteredEventListener.h"
 #include "Screen.h"
@@ -229,7 +243,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSDOMWindow);
 
 /* Hash table */
 
-static const HashTableValue JSDOMWindowTableValues[276] =
+static const HashTableValue JSDOMWindowTableValues[293] =
 {
     { "screen", DontDelete|ReadOnly, (intptr_t)jsDOMWindowScreen, (intptr_t)0 },
     { "history", DontDelete|ReadOnly, (intptr_t)jsDOMWindowHistory, (intptr_t)0 },
@@ -271,6 +285,7 @@ static const HashTableValue JSDOMWindowTableValues[276] =
     { "parent", DontDelete, (intptr_t)jsDOMWindowParent, (intptr_t)setJSDOMWindowParent },
     { "top", DontDelete, (intptr_t)jsDOMWindowTop, (intptr_t)setJSDOMWindowTop },
     { "document", DontDelete|ReadOnly, (intptr_t)jsDOMWindowDocument, (intptr_t)0 },
+    { "media", DontDelete|ReadOnly, (intptr_t)jsDOMWindowMedia, (intptr_t)0 },
     { "devicePixelRatio", DontDelete, (intptr_t)jsDOMWindowDevicePixelRatio, (intptr_t)setJSDOMWindowDevicePixelRatio },
     { "applicationCache", DontDelete|ReadOnly, (intptr_t)jsDOMWindowApplicationCache, (intptr_t)0 },
     { "sessionStorage", DontDelete|ReadOnly, (intptr_t)jsDOMWindowSessionStorage, (intptr_t)0 },
@@ -297,7 +312,9 @@ static const HashTableValue JSDOMWindowTableValues[276] =
     { "onended", DontDelete, (intptr_t)jsDOMWindowOnended, (intptr_t)setJSDOMWindowOnended },
     { "onerror", DontDelete, (intptr_t)jsDOMWindowOnerror, (intptr_t)setJSDOMWindowOnerror },
     { "onfocus", DontDelete, (intptr_t)jsDOMWindowOnfocus, (intptr_t)setJSDOMWindowOnfocus },
+    { "onhashchange", DontDelete, (intptr_t)jsDOMWindowOnhashchange, (intptr_t)setJSDOMWindowOnhashchange },
     { "oninput", DontDelete, (intptr_t)jsDOMWindowOninput, (intptr_t)setJSDOMWindowOninput },
+    { "oninvalid", DontDelete, (intptr_t)jsDOMWindowOninvalid, (intptr_t)setJSDOMWindowOninvalid },
     { "onkeydown", DontDelete, (intptr_t)jsDOMWindowOnkeydown, (intptr_t)setJSDOMWindowOnkeydown },
     { "onkeypress", DontDelete, (intptr_t)jsDOMWindowOnkeypress, (intptr_t)setJSDOMWindowOnkeypress },
     { "onkeyup", DontDelete, (intptr_t)jsDOMWindowOnkeyup, (intptr_t)setJSDOMWindowOnkeyup },
@@ -314,6 +331,8 @@ static const HashTableValue JSDOMWindowTableValues[276] =
     { "onmousewheel", DontDelete, (intptr_t)jsDOMWindowOnmousewheel, (intptr_t)setJSDOMWindowOnmousewheel },
     { "onoffline", DontDelete, (intptr_t)jsDOMWindowOnoffline, (intptr_t)setJSDOMWindowOnoffline },
     { "ononline", DontDelete, (intptr_t)jsDOMWindowOnonline, (intptr_t)setJSDOMWindowOnonline },
+    { "onpagehide", DontDelete, (intptr_t)jsDOMWindowOnpagehide, (intptr_t)setJSDOMWindowOnpagehide },
+    { "onpageshow", DontDelete, (intptr_t)jsDOMWindowOnpageshow, (intptr_t)setJSDOMWindowOnpageshow },
     { "onpause", DontDelete, (intptr_t)jsDOMWindowOnpause, (intptr_t)setJSDOMWindowOnpause },
     { "onplay", DontDelete, (intptr_t)jsDOMWindowOnplay, (intptr_t)setJSDOMWindowOnplay },
     { "onplaying", DontDelete, (intptr_t)jsDOMWindowOnplaying, (intptr_t)setJSDOMWindowOnplaying },
@@ -449,12 +468,40 @@ static const HashTableValue JSDOMWindowTableValues[276] =
     { "Image", DontDelete, (intptr_t)jsDOMWindowImageConstructor, (intptr_t)setJSDOMWindowImageConstructor },
     { "Option", DontDelete, (intptr_t)jsDOMWindowOptionConstructor, (intptr_t)setJSDOMWindowOptionConstructor },
     { "CanvasRenderingContext2D", DontDelete, (intptr_t)jsDOMWindowCanvasRenderingContext2DConstructor, (intptr_t)setJSDOMWindowCanvasRenderingContext2DConstructor },
+#if ENABLE(3D_CANVAS)
+    { "CanvasRenderingContext3D", DontDelete, (intptr_t)jsDOMWindowCanvasRenderingContext3DConstructor, (intptr_t)setJSDOMWindowCanvasRenderingContext3DConstructor },
+#endif
     { "TextMetrics", DontDelete, (intptr_t)jsDOMWindowTextMetricsConstructor, (intptr_t)setJSDOMWindowTextMetricsConstructor },
+#if ENABLE(3D_CANVAS)
+    { "CanvasArrayBuffer", DontDelete, (intptr_t)jsDOMWindowCanvasArrayBufferConstructor, (intptr_t)setJSDOMWindowCanvasArrayBufferConstructor },
+#endif
+#if ENABLE(3D_CANVAS)
+    { "CanvasByteArray", DontDelete, (intptr_t)jsDOMWindowCanvasByteArrayConstructor, (intptr_t)setJSDOMWindowCanvasByteArrayConstructor },
+#endif
+#if ENABLE(3D_CANVAS)
+    { "CanvasUnsignedByteArray", DontDelete, (intptr_t)jsDOMWindowCanvasUnsignedByteArrayConstructor, (intptr_t)setJSDOMWindowCanvasUnsignedByteArrayConstructor },
+#endif
+#if ENABLE(3D_CANVAS)
+    { "CanvasShortArray", DontDelete, (intptr_t)jsDOMWindowCanvasShortArrayConstructor, (intptr_t)setJSDOMWindowCanvasShortArrayConstructor },
+#endif
+#if ENABLE(3D_CANVAS)
+    { "CanvasUnsignedShortArray", DontDelete, (intptr_t)jsDOMWindowCanvasUnsignedShortArrayConstructor, (intptr_t)setJSDOMWindowCanvasUnsignedShortArrayConstructor },
+#endif
+#if ENABLE(3D_CANVAS)
+    { "CanvasIntArray", DontDelete, (intptr_t)jsDOMWindowCanvasIntArrayConstructor, (intptr_t)setJSDOMWindowCanvasIntArrayConstructor },
+#endif
+#if ENABLE(3D_CANVAS)
+    { "CanvasUnsignedIntArray", DontDelete, (intptr_t)jsDOMWindowCanvasUnsignedIntArrayConstructor, (intptr_t)setJSDOMWindowCanvasUnsignedIntArrayConstructor },
+#endif
+#if ENABLE(3D_CANVAS)
+    { "CanvasFloatArray", DontDelete, (intptr_t)jsDOMWindowCanvasFloatArrayConstructor, (intptr_t)setJSDOMWindowCanvasFloatArrayConstructor },
+#endif
     { "Event", DontDelete, (intptr_t)jsDOMWindowEventConstructor, (intptr_t)setJSDOMWindowEventConstructor },
     { "KeyboardEvent", DontDelete, (intptr_t)jsDOMWindowKeyboardEventConstructor, (intptr_t)setJSDOMWindowKeyboardEventConstructor },
     { "MouseEvent", DontDelete, (intptr_t)jsDOMWindowMouseEventConstructor, (intptr_t)setJSDOMWindowMouseEventConstructor },
     { "MutationEvent", DontDelete, (intptr_t)jsDOMWindowMutationEventConstructor, (intptr_t)setJSDOMWindowMutationEventConstructor },
     { "OverflowEvent", DontDelete, (intptr_t)jsDOMWindowOverflowEventConstructor, (intptr_t)setJSDOMWindowOverflowEventConstructor },
+    { "PageTransitionEvent", DontDelete, (intptr_t)jsDOMWindowPageTransitionEventConstructor, (intptr_t)setJSDOMWindowPageTransitionEventConstructor },
     { "ProgressEvent", DontDelete, (intptr_t)jsDOMWindowProgressEventConstructor, (intptr_t)setJSDOMWindowProgressEventConstructor },
     { "TextEvent", DontDelete, (intptr_t)jsDOMWindowTextEventConstructor, (intptr_t)setJSDOMWindowTextEventConstructor },
     { "UIEvent", DontDelete, (intptr_t)jsDOMWindowUIEventConstructor, (intptr_t)setJSDOMWindowUIEventConstructor },
@@ -473,6 +520,7 @@ static const HashTableValue JSDOMWindowTableValues[276] =
     { "NodeFilter", DontDelete, (intptr_t)jsDOMWindowNodeFilterConstructor, (intptr_t)setJSDOMWindowNodeFilterConstructor },
     { "Range", DontDelete, (intptr_t)jsDOMWindowRangeConstructor, (intptr_t)setJSDOMWindowRangeConstructor },
     { "RangeException", DontDelete, (intptr_t)jsDOMWindowRangeExceptionConstructor, (intptr_t)setJSDOMWindowRangeExceptionConstructor },
+    { "EventSource", DontDelete, (intptr_t)jsDOMWindowEventSourceConstructor, (intptr_t)setJSDOMWindowEventSourceConstructor },
     { "XMLDocument", DontDelete, (intptr_t)jsDOMWindowXMLDocumentConstructor, (intptr_t)setJSDOMWindowXMLDocumentConstructor },
     { "DOMParser", DontDelete, (intptr_t)jsDOMWindowDOMParserConstructor, (intptr_t)setJSDOMWindowDOMParserConstructor },
     { "XMLSerializer", DontDelete, (intptr_t)jsDOMWindowXMLSerializerConstructor, (intptr_t)setJSDOMWindowXMLSerializerConstructor },
@@ -482,6 +530,7 @@ static const HashTableValue JSDOMWindowTableValues[276] =
     { "MessagePort", DontDelete, (intptr_t)jsDOMWindowMessagePortConstructor, (intptr_t)setJSDOMWindowMessagePortConstructor },
     { "MessageChannel", DontDelete, (intptr_t)jsDOMWindowMessageChannelConstructor, (intptr_t)setJSDOMWindowMessageChannelConstructor },
     { "Worker", DontDelete, (intptr_t)jsDOMWindowWorkerConstructor, (intptr_t)setJSDOMWindowWorkerConstructor },
+    { "SharedWorker", DontDelete, (intptr_t)jsDOMWindowSharedWorkerConstructor, (intptr_t)setJSDOMWindowSharedWorkerConstructor },
     { "Plugin", DontDelete, (intptr_t)jsDOMWindowPluginConstructor, (intptr_t)setJSDOMWindowPluginConstructor },
     { "PluginArray", DontDelete, (intptr_t)jsDOMWindowPluginArrayConstructor, (intptr_t)setJSDOMWindowPluginArrayConstructor },
     { "MimeType", DontDelete, (intptr_t)jsDOMWindowMimeTypeConstructor, (intptr_t)setJSDOMWindowMimeTypeConstructor },
@@ -527,9 +576,9 @@ static const HashTableValue JSDOMWindowTableValues[276] =
 
 static JSC_CONST_HASHTABLE HashTable JSDOMWindowTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 32767, JSDOMWindowTableValues, 0 };
+    { 65535, JSDOMWindowTableValues, 0 };
 #else
-    { 1062, 1023, JSDOMWindowTableValues, 0 };
+    { 1067, 1023, JSDOMWindowTableValues, 0 };
 #endif
 
 /* Hash table for prototype */
@@ -594,6 +643,11 @@ bool JSDOMWindowPrototype::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticFunctionSlot<JSObject>(exec, &JSDOMWindowPrototypeTable, this, propertyName, slot);
 }
 
+bool JSDOMWindowPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSDOMWindowPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSDOMWindow::s_info = { "DOMWindow", &JSDOMWindowBase::s_info, &JSDOMWindowTable, 0 };
 
 JSDOMWindow::JSDOMWindow(PassRefPtr<Structure> structure, PassRefPtr<DOMWindow> impl, JSDOMWindowShell* shell)
@@ -977,6 +1031,16 @@ JSValue jsDOMWindowDocument(ExecState* exec, const Identifier&, const PropertySl
     return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->document()));
 }
 
+JSValue jsDOMWindowMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
+    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->media()));
+}
+
 JSValue jsDOMWindowDevicePixelRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
@@ -1321,6 +1385,20 @@ JSValue jsDOMWindowOnfocus(ExecState* exec, const Identifier&, const PropertySlo
     return jsNull();
 }
 
+JSValue jsDOMWindowOnhashchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
+    if (EventListener* listener = imp->onhashchange()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
 JSValue jsDOMWindowOninput(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
@@ -1335,6 +1413,20 @@ JSValue jsDOMWindowOninput(ExecState* exec, const Identifier&, const PropertySlo
     return jsNull();
 }
 
+JSValue jsDOMWindowOninvalid(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
+    if (EventListener* listener = imp->oninvalid()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
 JSValue jsDOMWindowOnkeydown(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
@@ -1559,6 +1651,34 @@ JSValue jsDOMWindowOnonline(ExecState* exec, const Identifier&, const PropertySl
     return jsNull();
 }
 
+JSValue jsDOMWindowOnpagehide(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
+    if (EventListener* listener = imp->onpagehide()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnpageshow(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
+    if (EventListener* listener = imp->onpageshow()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
 JSValue jsDOMWindowOnpause(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
@@ -2741,6 +2861,16 @@ JSValue jsDOMWindowCanvasRenderingContext2DConstructor(ExecState* exec, const Id
     return JSCanvasRenderingContext2D::getConstructor(exec, castedThis);
 }
 
+#if ENABLE(3D_CANVAS)
+JSValue jsDOMWindowCanvasRenderingContext3DConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSCanvasRenderingContext3D::getConstructor(exec, castedThis);
+}
+#endif
+
 JSValue jsDOMWindowTextMetricsConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
@@ -2749,6 +2879,86 @@ JSValue jsDOMWindowTextMetricsConstructor(ExecState* exec, const Identifier&, co
     return JSTextMetrics::getConstructor(exec, castedThis);
 }
 
+#if ENABLE(3D_CANVAS)
+JSValue jsDOMWindowCanvasArrayBufferConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return castedThis->canvasArrayBuffer(exec);
+}
+#endif
+
+#if ENABLE(3D_CANVAS)
+JSValue jsDOMWindowCanvasByteArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return castedThis->canvasByteArray(exec);
+}
+#endif
+
+#if ENABLE(3D_CANVAS)
+JSValue jsDOMWindowCanvasUnsignedByteArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return castedThis->canvasUnsignedByteArray(exec);
+}
+#endif
+
+#if ENABLE(3D_CANVAS)
+JSValue jsDOMWindowCanvasShortArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return castedThis->canvasShortArray(exec);
+}
+#endif
+
+#if ENABLE(3D_CANVAS)
+JSValue jsDOMWindowCanvasUnsignedShortArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return castedThis->canvasUnsignedShortArray(exec);
+}
+#endif
+
+#if ENABLE(3D_CANVAS)
+JSValue jsDOMWindowCanvasIntArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return castedThis->canvasIntArray(exec);
+}
+#endif
+
+#if ENABLE(3D_CANVAS)
+JSValue jsDOMWindowCanvasUnsignedIntArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return castedThis->canvasUnsignedIntArray(exec);
+}
+#endif
+
+#if ENABLE(3D_CANVAS)
+JSValue jsDOMWindowCanvasFloatArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return castedThis->canvasFloatArray(exec);
+}
+#endif
+
 JSValue jsDOMWindowEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
@@ -2789,6 +2999,14 @@ JSValue jsDOMWindowOverflowEventConstructor(ExecState* exec, const Identifier&,
     return JSOverflowEvent::getConstructor(exec, castedThis);
 }
 
+JSValue jsDOMWindowPageTransitionEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSPageTransitionEvent::getConstructor(exec, castedThis);
+}
+
 JSValue jsDOMWindowProgressEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
@@ -2933,6 +3151,14 @@ JSValue jsDOMWindowRangeExceptionConstructor(ExecState* exec, const Identifier&,
     return JSRangeException::getConstructor(exec, castedThis);
 }
 
+JSValue jsDOMWindowEventSourceConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return castedThis->eventSource(exec);
+}
+
 JSValue jsDOMWindowXMLDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
@@ -3005,6 +3231,14 @@ JSValue jsDOMWindowWorkerConstructor(ExecState* exec, const Identifier&, const P
     return castedThis->worker(exec);
 }
 
+JSValue jsDOMWindowSharedWorkerConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return castedThis->sharedWorker(exec);
+}
+
 JSValue jsDOMWindowPluginConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
@@ -3726,6 +3960,16 @@ void setJSDOMWindowOnfocus(ExecState* exec, JSObject* thisObject, JSValue value)
     imp->setOnfocus(globalObject->createJSAttributeEventListener(value));
 }
 
+void setJSDOMWindowOnhashchange(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnhashchange(globalObject->createJSAttributeEventListener(value));
+}
+
 void setJSDOMWindowOninput(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -3736,6 +3980,16 @@ void setJSDOMWindowOninput(ExecState* exec, JSObject* thisObject, JSValue value)
     imp->setOninput(globalObject->createJSAttributeEventListener(value));
 }
 
+void setJSDOMWindowOninvalid(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOninvalid(globalObject->createJSAttributeEventListener(value));
+}
+
 void setJSDOMWindowOnkeydown(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -3896,6 +4150,26 @@ void setJSDOMWindowOnonline(ExecState* exec, JSObject* thisObject, JSValue value
     imp->setOnonline(globalObject->createJSAttributeEventListener(value));
 }
 
+void setJSDOMWindowOnpagehide(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnpagehide(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnpageshow(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnpageshow(globalObject->createJSAttributeEventListener(value));
+}
+
 void setJSDOMWindowOnpause(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -4976,6 +5250,14 @@ void setJSDOMWindowCanvasRenderingContext2DConstructor(ExecState* exec, JSObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasRenderingContext2D"), value);
 }
 
+void setJSDOMWindowCanvasRenderingContext3DConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasRenderingContext3D"), value);
+}
+
 void setJSDOMWindowTextMetricsConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -4984,6 +5266,70 @@ void setJSDOMWindowTextMetricsConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "TextMetrics"), value);
 }
 
+void setJSDOMWindowCanvasArrayBufferConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasArrayBuffer"), value);
+}
+
+void setJSDOMWindowCanvasByteArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasByteArray"), value);
+}
+
+void setJSDOMWindowCanvasUnsignedByteArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasUnsignedByteArray"), value);
+}
+
+void setJSDOMWindowCanvasShortArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasShortArray"), value);
+}
+
+void setJSDOMWindowCanvasUnsignedShortArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasUnsignedShortArray"), value);
+}
+
+void setJSDOMWindowCanvasIntArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasIntArray"), value);
+}
+
+void setJSDOMWindowCanvasUnsignedIntArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasUnsignedIntArray"), value);
+}
+
+void setJSDOMWindowCanvasFloatArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasFloatArray"), value);
+}
+
 void setJSDOMWindowEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5024,6 +5370,14 @@ void setJSDOMWindowOverflowEventConstructor(ExecState* exec, JSObject* thisObjec
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "OverflowEvent"), value);
 }
 
+void setJSDOMWindowPageTransitionEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "PageTransitionEvent"), value);
+}
+
 void setJSDOMWindowProgressEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5168,6 +5522,14 @@ void setJSDOMWindowRangeExceptionConstructor(ExecState* exec, JSObject* thisObje
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "RangeException"), value);
 }
 
+void setJSDOMWindowEventSourceConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "EventSource"), value);
+}
+
 void setJSDOMWindowXMLDocumentConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5240,6 +5602,14 @@ void setJSDOMWindowWorkerConstructor(ExecState* exec, JSObject* thisObject, JSVa
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Worker"), value);
 }
 
+void setJSDOMWindowSharedWorkerConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SharedWorker"), value);
+}
+
 void setJSDOMWindowPluginConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h
index a87339e..5b1b58e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h
@@ -36,6 +36,7 @@ public:
     JSDOMWindow(PassRefPtr<JSC::Structure>, PassRefPtr<DOMWindow>, JSDOMWindowShell*);
     virtual ~JSDOMWindow();
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -45,10 +46,11 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::ImplementsHasInstance | JSC::NeedsThisConversion));
     }
 
-    virtual void mark();
+    virtual void markChildren(JSC::MarkStack&);
 
-    virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&, bool checkDontDelete = true);
-    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype);
+    virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
+    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier&, unsigned& attributes) const;
     virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);
     virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction);
@@ -63,11 +65,21 @@ public:
     JSC::JSValue crypto(JSC::ExecState*) const;
     JSC::JSValue image(JSC::ExecState*) const;
     JSC::JSValue option(JSC::ExecState*) const;
+    JSC::JSValue canvasArrayBuffer(JSC::ExecState*) const;
+    JSC::JSValue canvasByteArray(JSC::ExecState*) const;
+    JSC::JSValue canvasUnsignedByteArray(JSC::ExecState*) const;
+    JSC::JSValue canvasShortArray(JSC::ExecState*) const;
+    JSC::JSValue canvasUnsignedShortArray(JSC::ExecState*) const;
+    JSC::JSValue canvasIntArray(JSC::ExecState*) const;
+    JSC::JSValue canvasUnsignedIntArray(JSC::ExecState*) const;
+    JSC::JSValue canvasFloatArray(JSC::ExecState*) const;
     JSC::JSValue webKitCSSMatrix(JSC::ExecState*) const;
     JSC::JSValue webKitPoint(JSC::ExecState*) const;
+    JSC::JSValue eventSource(JSC::ExecState*) const;
     JSC::JSValue xmlHttpRequest(JSC::ExecState*) const;
     JSC::JSValue messageChannel(JSC::ExecState*) const;
     JSC::JSValue worker(JSC::ExecState*) const;
+    JSC::JSValue sharedWorker(JSC::ExecState*) const;
     JSC::JSValue audio(JSC::ExecState*) const;
 
     // Custom functions
@@ -95,6 +107,7 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
@@ -213,6 +226,7 @@ void setJSDOMWindowParent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSDOMWindowTop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowDocument(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsDOMWindowDevicePixelRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSDOMWindowDevicePixelRatio(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowApplicationCache(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
@@ -262,8 +276,12 @@ JSC::JSValue jsDOMWindowOnerror(JSC::ExecState*, const JSC::Identifier&, const J
 void setJSDOMWindowOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowOnfocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSDOMWindowOnfocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnhashchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnhashchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowOninput(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSDOMWindowOninput(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOninvalid(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOninvalid(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowOnkeydown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSDOMWindowOnkeydown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowOnkeypress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
@@ -296,6 +314,10 @@ JSC::JSValue jsDOMWindowOnoffline(JSC::ExecState*, const JSC::Identifier&, const
 void setJSDOMWindowOnoffline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowOnonline(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSDOMWindowOnonline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnpagehide(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnpagehide(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnpageshow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnpageshow(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowOnpause(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSDOMWindowOnpause(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowOnplay(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
@@ -554,8 +576,26 @@ JSC::JSValue jsDOMWindowOptionConstructor(JSC::ExecState*, const JSC::Identifier
 void setJSDOMWindowOptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowCanvasRenderingContext2DConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSDOMWindowCanvasRenderingContext2DConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCanvasRenderingContext3DConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCanvasRenderingContext3DConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowTextMetricsConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSDOMWindowTextMetricsConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCanvasArrayBufferConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCanvasArrayBufferConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCanvasByteArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCanvasByteArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCanvasUnsignedByteArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCanvasUnsignedByteArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCanvasShortArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCanvasShortArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCanvasUnsignedShortArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCanvasUnsignedShortArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCanvasIntArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCanvasIntArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCanvasUnsignedIntArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCanvasUnsignedIntArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCanvasFloatArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCanvasFloatArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSDOMWindowEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowKeyboardEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
@@ -566,6 +606,8 @@ JSC::JSValue jsDOMWindowMutationEventConstructor(JSC::ExecState*, const JSC::Ide
 void setJSDOMWindowMutationEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowOverflowEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSDOMWindowOverflowEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowPageTransitionEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowPageTransitionEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowProgressEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSDOMWindowProgressEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowTextEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
@@ -602,6 +644,8 @@ JSC::JSValue jsDOMWindowRangeConstructor(JSC::ExecState*, const JSC::Identifier&
 void setJSDOMWindowRangeConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowRangeExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSDOMWindowRangeExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowEventSourceConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowEventSourceConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowXMLDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSDOMWindowXMLDocumentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowDOMParserConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
@@ -620,6 +664,8 @@ JSC::JSValue jsDOMWindowMessageChannelConstructor(JSC::ExecState*, const JSC::Id
 void setJSDOMWindowMessageChannelConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowWorkerConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSDOMWindowWorkerConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSharedWorkerConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSharedWorkerConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowPluginConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSDOMWindowPluginConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowPluginArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp
index 1f60693..59eafb1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp
@@ -85,6 +85,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSDataGridColumnPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -101,6 +102,11 @@ bool JSDataGridColumnConstructor::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticValueSlot<JSDataGridColumnConstructor, DOMObject>(exec, &JSDataGridColumnConstructorTable, this, propertyName, slot);
 }
 
+bool JSDataGridColumnConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSDataGridColumnConstructor, DOMObject>(exec, &JSDataGridColumnConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSDataGridColumnPrototypeTableValues[7] =
@@ -133,6 +139,11 @@ bool JSDataGridColumnPrototype::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSDataGridColumnPrototype, JSObject>(exec, &JSDataGridColumnPrototypeTable, this, propertyName, slot);
 }
 
+bool JSDataGridColumnPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSDataGridColumnPrototype, JSObject>(exec, &JSDataGridColumnPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSDataGridColumn::s_info = { "DataGridColumn", 0, &JSDataGridColumnTable, 0 };
 
 JSDataGridColumn::JSDataGridColumn(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<DataGridColumn> impl)
@@ -156,6 +167,11 @@ bool JSDataGridColumn::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSDataGridColumn, Base>(exec, &JSDataGridColumnTable, this, propertyName, slot);
 }
 
+bool JSDataGridColumn::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSDataGridColumn, Base>(exec, &JSDataGridColumnTable, this, propertyName, descriptor);
+}
+
 JSValue jsDataGridColumnId(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSDataGridColumn* castedThis = static_cast<JSDataGridColumn*>(asObject(slot.slotBase()));
@@ -293,7 +309,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DataGri
 }
 DataGridColumn* toDataGridColumn(JSC::JSValue value)
 {
-    return value.isObject(&JSDataGridColumn::s_info) ? static_cast<JSDataGridColumn*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSDataGridColumn::s_info) ? static_cast<JSDataGridColumn*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.h b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.h
index cbb59be..70021d0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.h
@@ -39,6 +39,7 @@ public:
     virtual ~JSDataGridColumn();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -65,9 +66,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSDataGridColumnPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp
index 220d81d..2ec302a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp
@@ -80,6 +80,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSDataGridColumnListPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -96,6 +97,11 @@ bool JSDataGridColumnListConstructor::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSDataGridColumnListConstructor, DOMObject>(exec, &JSDataGridColumnListConstructorTable, this, propertyName, slot);
 }
 
+bool JSDataGridColumnListConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSDataGridColumnListConstructor, DOMObject>(exec, &JSDataGridColumnListConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSDataGridColumnListPrototypeTableValues[6] =
@@ -127,6 +133,11 @@ bool JSDataGridColumnListPrototype::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticFunctionSlot<JSObject>(exec, &JSDataGridColumnListPrototypeTable, this, propertyName, slot);
 }
 
+bool JSDataGridColumnListPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSDataGridColumnListPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSDataGridColumnList::s_info = { "DataGridColumnList", 0, &JSDataGridColumnListTable, 0 };
 
 JSDataGridColumnList::JSDataGridColumnList(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<DataGridColumnList> impl)
@@ -165,6 +176,32 @@ bool JSDataGridColumnList::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSDataGridColumnList, Base>(exec, &JSDataGridColumnListTable, this, propertyName, slot);
 }
 
+bool JSDataGridColumnList::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    const HashEntry* entry = JSDataGridColumnListTable.entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        slot.setCustom(this, entry->propertyGetter());
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<DataGridColumnList*>(impl())->length()) {
+        PropertySlot slot;
+        slot.setCustomIndex(this, index, indexGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly);
+        return true;
+    }
+    if (canGetItemsForName(exec, static_cast<DataGridColumnList*>(impl()), propertyName)) {
+        PropertySlot slot;
+        slot.setCustom(this, nameGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    return getStaticValueDescriptor<JSDataGridColumnList, Base>(exec, &JSDataGridColumnListTable, this, propertyName, descriptor);
+}
+
 bool JSDataGridColumnList::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
 {
     if (propertyName < static_cast<DataGridColumnList*>(impl())->length()) {
@@ -203,11 +240,11 @@ JSValue jsDataGridColumnListConstructor(ExecState* exec, const Identifier&, cons
     JSDataGridColumnList* domObject = static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()));
     return JSDataGridColumnList::getConstructor(exec, domObject->globalObject());
 }
-void JSDataGridColumnList::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSDataGridColumnList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     for (unsigned i = 0; i < static_cast<DataGridColumnList*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getPropertyNames(exec, propertyNames, listedAttributes);
+     Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 JSValue JSDataGridColumnList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -218,7 +255,7 @@ JSValue JSDataGridColumnList::getConstructor(ExecState* exec, JSGlobalObject* gl
 JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDataGridColumnList::s_info))
+    if (!thisValue.inherits(&JSDataGridColumnList::s_info))
         return throwError(exec, TypeError);
     JSDataGridColumnList* castedThisObj = static_cast<JSDataGridColumnList*>(asObject(thisValue));
     DataGridColumnList* imp = static_cast<DataGridColumnList*>(castedThisObj->impl());
@@ -236,7 +273,7 @@ JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionItem(ExecState* exec,
 JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionAdd(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDataGridColumnList::s_info))
+    if (!thisValue.inherits(&JSDataGridColumnList::s_info))
         return throwError(exec, TypeError);
     JSDataGridColumnList* castedThisObj = static_cast<JSDataGridColumnList*>(asObject(thisValue));
     DataGridColumnList* imp = static_cast<DataGridColumnList*>(castedThisObj->impl());
@@ -254,7 +291,7 @@ JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionAdd(ExecState* exec,
 JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionRemove(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDataGridColumnList::s_info))
+    if (!thisValue.inherits(&JSDataGridColumnList::s_info))
         return throwError(exec, TypeError);
     JSDataGridColumnList* castedThisObj = static_cast<JSDataGridColumnList*>(asObject(thisValue));
     DataGridColumnList* imp = static_cast<DataGridColumnList*>(castedThisObj->impl());
@@ -267,7 +304,7 @@ JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionRemove(ExecState* exe
 JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionMove(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDataGridColumnList::s_info))
+    if (!thisValue.inherits(&JSDataGridColumnList::s_info))
         return throwError(exec, TypeError);
     JSDataGridColumnList* castedThisObj = static_cast<JSDataGridColumnList*>(asObject(thisValue));
     DataGridColumnList* imp = static_cast<DataGridColumnList*>(castedThisObj->impl());
@@ -281,7 +318,7 @@ JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionMove(ExecState* exec,
 JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDataGridColumnList::s_info))
+    if (!thisValue.inherits(&JSDataGridColumnList::s_info))
         return throwError(exec, TypeError);
     JSDataGridColumnList* castedThisObj = static_cast<JSDataGridColumnList*>(asObject(thisValue));
     DataGridColumnList* imp = static_cast<DataGridColumnList*>(castedThisObj->impl());
@@ -302,7 +339,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DataGri
 }
 DataGridColumnList* toDataGridColumnList(JSC::JSValue value)
 {
-    return value.isObject(&JSDataGridColumnList::s_info) ? static_cast<JSDataGridColumnList*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSDataGridColumnList::s_info) ? static_cast<JSDataGridColumnList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.h b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.h
index 986081a..05681f3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.h
@@ -39,6 +39,7 @@ public:
     virtual ~JSDataGridColumnList();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -48,7 +49,7 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     DataGridColumnList* impl() const { return m_impl.get(); }
 
@@ -70,9 +71,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSDataGridColumnListPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDatabase.cpp b/src/3rdparty/webkit/WebCore/generated/JSDatabase.cpp
index 6f02f71..16b0888 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDatabase.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDatabase.cpp
@@ -53,18 +53,19 @@ static JSC_CONST_HASHTABLE HashTable JSDatabaseTable =
 
 /* Hash table for prototype */
 
-static const HashTableValue JSDatabasePrototypeTableValues[3] =
+static const HashTableValue JSDatabasePrototypeTableValues[4] =
 {
     { "changeVersion", DontDelete|Function, (intptr_t)jsDatabasePrototypeFunctionChangeVersion, (intptr_t)5 },
     { "transaction", DontDelete|Function, (intptr_t)jsDatabasePrototypeFunctionTransaction, (intptr_t)3 },
+    { "readTransaction", DontDelete|Function, (intptr_t)jsDatabasePrototypeFunctionReadTransaction, (intptr_t)3 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSDatabasePrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 1, JSDatabasePrototypeTableValues, 0 };
+    { 3, JSDatabasePrototypeTableValues, 0 };
 #else
-    { 4, 3, JSDatabasePrototypeTableValues, 0 };
+    { 8, 7, JSDatabasePrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSDatabasePrototype::s_info = { "DatabasePrototype", 0, &JSDatabasePrototypeTable, 0 };
@@ -79,6 +80,11 @@ bool JSDatabasePrototype::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticFunctionSlot<JSObject>(exec, &JSDatabasePrototypeTable, this, propertyName, slot);
 }
 
+bool JSDatabasePrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSDatabasePrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSDatabase::s_info = { "Database", 0, &JSDatabaseTable, 0 };
 
 JSDatabase::JSDatabase(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<Database> impl)
@@ -102,6 +108,11 @@ bool JSDatabase::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSDatabase, Base>(exec, &JSDatabaseTable, this, propertyName, slot);
 }
 
+bool JSDatabase::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSDatabase, Base>(exec, &JSDatabaseTable, this, propertyName, descriptor);
+}
+
 JSValue jsDatabaseVersion(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSDatabase* castedThis = static_cast<JSDatabase*>(asObject(slot.slotBase()));
@@ -113,7 +124,7 @@ JSValue jsDatabaseVersion(ExecState* exec, const Identifier&, const PropertySlot
 JSValue JSC_HOST_CALL jsDatabasePrototypeFunctionChangeVersion(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDatabase::s_info))
+    if (!thisValue.inherits(&JSDatabase::s_info))
         return throwError(exec, TypeError);
     JSDatabase* castedThisObj = static_cast<JSDatabase*>(asObject(thisValue));
     return castedThisObj->changeVersion(exec, args);
@@ -122,19 +133,28 @@ JSValue JSC_HOST_CALL jsDatabasePrototypeFunctionChangeVersion(ExecState* exec,
 JSValue JSC_HOST_CALL jsDatabasePrototypeFunctionTransaction(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDatabase::s_info))
+    if (!thisValue.inherits(&JSDatabase::s_info))
         return throwError(exec, TypeError);
     JSDatabase* castedThisObj = static_cast<JSDatabase*>(asObject(thisValue));
     return castedThisObj->transaction(exec, args);
 }
 
+JSValue JSC_HOST_CALL jsDatabasePrototypeFunctionReadTransaction(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSDatabase::s_info))
+        return throwError(exec, TypeError);
+    JSDatabase* castedThisObj = static_cast<JSDatabase*>(asObject(thisValue));
+    return castedThisObj->readTransaction(exec, args);
+}
+
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Database* object)
 {
     return getDOMObjectWrapper<JSDatabase>(exec, globalObject, object);
 }
 Database* toDatabase(JSC::JSValue value)
 {
-    return value.isObject(&JSDatabase::s_info) ? static_cast<JSDatabase*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSDatabase::s_info) ? static_cast<JSDatabase*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDatabase.h b/src/3rdparty/webkit/WebCore/generated/JSDatabase.h
index 8ca36a5..54ddf82a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDatabase.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDatabase.h
@@ -39,6 +39,7 @@ public:
     virtual ~JSDatabase();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -51,6 +52,7 @@ public:
     // Custom functions
     JSC::JSValue changeVersion(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue transaction(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue readTransaction(JSC::ExecState*, const JSC::ArgList&);
     Database* impl() const { return m_impl.get(); }
 
 private:
@@ -67,9 +69,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSDatabasePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
@@ -78,6 +81,7 @@ public:
 
 JSC::JSValue JSC_HOST_CALL jsDatabasePrototypeFunctionChangeVersion(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsDatabasePrototypeFunctionTransaction(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDatabasePrototypeFunctionReadTransaction(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
 JSC::JSValue jsDatabaseVersion(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.cpp b/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.cpp
index 373bb30..c30ff51 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.cpp
@@ -27,7 +27,6 @@
 #include "DedicatedWorkerContext.h"
 #include "EventListener.h"
 #include "JSEventListener.h"
-#include "JSMessagePort.h"
 #include <runtime/Error.h>
 #include <wtf/GetPtr.h>
 
@@ -83,6 +82,11 @@ bool JSDedicatedWorkerContextPrototype::getOwnPropertySlot(ExecState* exec, cons
     return getStaticFunctionSlot<JSObject>(exec, getJSDedicatedWorkerContextPrototypeTable(exec), this, propertyName, slot);
 }
 
+bool JSDedicatedWorkerContextPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, getJSDedicatedWorkerContextPrototypeTable(exec), this, propertyName, descriptor);
+}
+
 static const HashTable* getJSDedicatedWorkerContextTable(ExecState* exec)
 {
     return getHashTableForGlobalData(exec->globalData(), &JSDedicatedWorkerContextTable);
@@ -99,6 +103,11 @@ bool JSDedicatedWorkerContext::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticValueSlot<JSDedicatedWorkerContext, Base>(exec, getJSDedicatedWorkerContextTable(exec), this, propertyName, slot);
 }
 
+bool JSDedicatedWorkerContext::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSDedicatedWorkerContext, Base>(exec, getJSDedicatedWorkerContextTable(exec), this, propertyName, descriptor);
+}
+
 JSValue jsDedicatedWorkerContextOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSDedicatedWorkerContext* castedThis = static_cast<JSDedicatedWorkerContext*>(asObject(slot.slotBase()));
@@ -130,27 +139,12 @@ JSValue JSC_HOST_CALL jsDedicatedWorkerContextPrototypeFunctionPostMessage(ExecS
     JSDedicatedWorkerContext* castedThisObj = toJSDedicatedWorkerContext(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
-    DedicatedWorkerContext* imp = static_cast<DedicatedWorkerContext*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    const UString& message = args.at(0).toString(exec);
-
-    int argsCount = args.size();
-    if (argsCount < 2) {
-        imp->postMessage(message, ec);
-        setDOMException(exec, ec);
-        return jsUndefined();
-    }
-
-    MessagePort* messagePort = toMessagePort(args.at(1));
-
-    imp->postMessage(message, messagePort, ec);
-    setDOMException(exec, ec);
-    return jsUndefined();
+    return castedThisObj->postMessage(exec, args);
 }
 
 DedicatedWorkerContext* toDedicatedWorkerContext(JSC::JSValue value)
 {
-    return value.isObject(&JSDedicatedWorkerContext::s_info) ? static_cast<JSDedicatedWorkerContext*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSDedicatedWorkerContext::s_info) ? static_cast<JSDedicatedWorkerContext*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.h b/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.h
index 6054c80..d6caa8d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.h
@@ -35,6 +35,7 @@ class JSDedicatedWorkerContext : public JSWorkerContext {
 public:
     JSDedicatedWorkerContext(PassRefPtr<JSC::Structure>, PassRefPtr<DedicatedWorkerContext>);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -44,8 +45,11 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void mark();
+    virtual void markChildren(JSC::MarkStack&);
 
+
+    // Custom functions
+    JSC::JSValue postMessage(JSC::ExecState*, const JSC::ArgList&);
     DedicatedWorkerContext* impl() const
     {
         return static_cast<DedicatedWorkerContext*>(Base::impl());
@@ -61,6 +65,7 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp b/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp
index 68b7ccc..772be76 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp
@@ -96,7 +96,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSDocument);
 
 /* Hash table */
 
-static const HashTableValue JSDocumentTableValues[69] =
+static const HashTableValue JSDocumentTableValues[70] =
 {
     { "doctype", DontDelete|ReadOnly, (intptr_t)jsDocumentDoctype, (intptr_t)0 },
     { "implementation", DontDelete|ReadOnly, (intptr_t)jsDocumentImplementation, (intptr_t)0 },
@@ -143,6 +143,7 @@ static const HashTableValue JSDocumentTableValues[69] =
     { "onerror", DontDelete|DontEnum, (intptr_t)jsDocumentOnerror, (intptr_t)setJSDocumentOnerror },
     { "onfocus", DontDelete|DontEnum, (intptr_t)jsDocumentOnfocus, (intptr_t)setJSDocumentOnfocus },
     { "oninput", DontDelete|DontEnum, (intptr_t)jsDocumentOninput, (intptr_t)setJSDocumentOninput },
+    { "oninvalid", DontDelete|DontEnum, (intptr_t)jsDocumentOninvalid, (intptr_t)setJSDocumentOninvalid },
     { "onkeydown", DontDelete|DontEnum, (intptr_t)jsDocumentOnkeydown, (intptr_t)setJSDocumentOnkeydown },
     { "onkeypress", DontDelete|DontEnum, (intptr_t)jsDocumentOnkeypress, (intptr_t)setJSDocumentOnkeypress },
     { "onkeyup", DontDelete|DontEnum, (intptr_t)jsDocumentOnkeyup, (intptr_t)setJSDocumentOnkeyup },
@@ -173,7 +174,7 @@ static JSC_CONST_HASHTABLE HashTable JSDocumentTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 2047, JSDocumentTableValues, 0 };
 #else
-    { 259, 255, JSDocumentTableValues, 0 };
+    { 260, 255, JSDocumentTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -198,6 +199,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSDocumentPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -214,9 +216,14 @@ bool JSDocumentConstructor::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSDocumentConstructor, DOMObject>(exec, &JSDocumentConstructorTable, this, propertyName, slot);
 }
 
+bool JSDocumentConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSDocumentConstructor, DOMObject>(exec, &JSDocumentConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
-static const HashTableValue JSDocumentPrototypeTableValues[37] =
+static const HashTableValue JSDocumentPrototypeTableValues[38] =
 {
     { "createElement", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateElement, (intptr_t)1 },
     { "createDocumentFragment", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateDocumentFragment, (intptr_t)0 },
@@ -249,6 +256,7 @@ static const HashTableValue JSDocumentPrototypeTableValues[37] =
     { "queryCommandValue", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionQueryCommandValue, (intptr_t)1 },
     { "getElementsByName", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionGetElementsByName, (intptr_t)1 },
     { "elementFromPoint", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionElementFromPoint, (intptr_t)2 },
+    { "caretRangeFromPoint", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCaretRangeFromPoint, (intptr_t)2 },
     { "getSelection", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionGetSelection, (intptr_t)0 },
     { "getCSSCanvasContext", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionGetCSSCanvasContext, (intptr_t)4 },
     { "getElementsByClassName", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionGetElementsByClassName, (intptr_t)1 },
@@ -276,6 +284,11 @@ bool JSDocumentPrototype::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticFunctionSlot<JSObject>(exec, &JSDocumentPrototypeTable, this, propertyName, slot);
 }
 
+bool JSDocumentPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSDocumentPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSDocument::s_info = { "Document", &JSNode::s_info, &JSDocumentTable, 0 };
 
 JSDocument::JSDocument(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<Document> impl)
@@ -715,6 +728,18 @@ JSValue jsDocumentOninput(ExecState* exec, const Identifier&, const PropertySlot
     return jsNull();
 }
 
+JSValue jsDocumentOninvalid(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(castedThis->impl());
+    if (EventListener* listener = imp->oninvalid()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
 JSValue jsDocumentOnkeydown(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
@@ -1214,6 +1239,16 @@ void setJSDocumentOninput(ExecState* exec, JSObject* thisObject, JSValue value)
     imp->setOninput(globalObject->createJSAttributeEventListener(value));
 }
 
+void setJSDocumentOninvalid(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOninvalid(globalObject->createJSAttributeEventListener(value));
+}
+
 void setJSDocumentOnkeydown(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
@@ -1442,7 +1477,7 @@ JSValue JSDocument::getConstructor(ExecState* exec, JSGlobalObject* globalObject
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1458,7 +1493,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateElement(ExecState* exec,
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateDocumentFragment(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1471,7 +1506,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateDocumentFragment(ExecStat
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateTextNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1485,7 +1520,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateTextNode(ExecState* exec,
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateComment(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1499,7 +1534,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateComment(ExecState* exec,
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateCDATASection(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1515,7 +1550,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateCDATASection(ExecState* e
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateProcessingInstruction(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1532,7 +1567,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateProcessingInstruction(Exe
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1548,7 +1583,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateAttribute(ExecState* exec
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateEntityReference(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1564,7 +1599,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateEntityReference(ExecState
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementsByTagName(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1578,7 +1613,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementsByTagName(ExecState*
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionImportNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1595,7 +1630,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionImportNode(ExecState* exec, JSO
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateElementNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1612,7 +1647,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateElementNS(ExecState* exec
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateAttributeNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1629,7 +1664,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateAttributeNS(ExecState* ex
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementsByTagNameNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1644,7 +1679,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementsByTagNameNS(ExecStat
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementById(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1658,7 +1693,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementById(ExecState* exec,
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionAdoptNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1674,7 +1709,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionAdoptNode(ExecState* exec, JSOb
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1690,7 +1725,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateEvent(ExecState* exec, JS
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateRange(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1703,7 +1738,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateRange(ExecState* exec, JS
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateNodeIterator(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1722,7 +1757,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateNodeIterator(ExecState* e
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateTreeWalker(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1741,7 +1776,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateTreeWalker(ExecState* exe
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetOverrideStyle(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1756,7 +1791,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetOverrideStyle(ExecState* exe
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateExpression(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1780,7 +1815,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateExpression(ExecState* exe
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateNSResolver(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1794,7 +1829,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateNSResolver(ExecState* exe
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionEvaluate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1821,7 +1856,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionEvaluate(ExecState* exec, JSObj
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionExecCommand(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1837,7 +1872,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionExecCommand(ExecState* exec, JS
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1851,7 +1886,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandEnabled(ExecState*
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandIndeterm(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1865,7 +1900,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandIndeterm(ExecState*
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandState(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1879,7 +1914,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandState(ExecState* ex
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandSupported(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1893,7 +1928,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandSupported(ExecState
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1907,7 +1942,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandValue(ExecState* ex
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementsByName(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1921,7 +1956,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementsByName(ExecState* ex
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionElementFromPoint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1933,10 +1968,25 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionElementFromPoint(ExecState* exe
     return result;
 }
 
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCaretRangeFromPoint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSDocument::s_info))
+        return throwError(exec, TypeError);
+    JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
+    Document* imp = static_cast<Document*>(castedThisObj->impl());
+    int x = args.at(0).toInt32(exec);
+    int y = args.at(1).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->caretRangeFromPoint(x, y)));
+    return result;
+}
+
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetSelection(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1949,7 +1999,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetSelection(ExecState* exec, J
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetCSSCanvasContext(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1966,7 +2016,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetCSSCanvasContext(ExecState*
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementsByClassName(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1980,7 +2030,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementsByClassName(ExecStat
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQuerySelector(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -1996,7 +2046,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQuerySelector(ExecState* exec,
 JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQuerySelectorAll(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocument::s_info))
+    if (!thisValue.inherits(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
@@ -2011,7 +2061,7 @@ JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQuerySelectorAll(ExecState* exe
 
 Document* toDocument(JSC::JSValue value)
 {
-    return value.isObject(&JSDocument::s_info) ? static_cast<JSDocument*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSDocument::s_info) ? static_cast<JSDocument*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocument.h b/src/3rdparty/webkit/WebCore/generated/JSDocument.h
index 470c671..73a5327 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocument.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocument.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSDocument();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -46,7 +47,7 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void mark();
+    virtual void markChildren(JSC::MarkStack&);
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 
@@ -64,6 +65,11 @@ ALWAYS_INLINE bool JSDocument::getOwnPropertySlot(JSC::ExecState* exec, const JS
     return JSC::getStaticValueSlot<JSDocument, Base>(exec, s_info.staticPropHashTable, this, propertyName, slot);
 }
 
+ALWAYS_INLINE bool JSDocument::getOwnPropertyDescriptor(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertyDescriptor& descriptor)
+{
+    return JSC::getStaticValueDescriptor<JSDocument, Base>(exec, s_info.staticPropHashTable, this, propertyName, descriptor);
+}
+
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Document*);
 Document* toDocument(JSC::JSValue);
 
@@ -74,6 +80,7 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
@@ -114,6 +121,7 @@ JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandSupported(JSC:
 JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementsByName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionElementFromPoint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCaretRangeFromPoint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetSelection(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetCSSCanvasContext(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementsByClassName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
@@ -192,6 +200,8 @@ JSC::JSValue jsDocumentOnfocus(JSC::ExecState*, const JSC::Identifier&, const JS
 void setJSDocumentOnfocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDocumentOninput(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSDocumentOninput(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOninvalid(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOninvalid(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDocumentOnkeydown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSDocumentOnkeydown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDocumentOnkeypress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.cpp b/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.cpp
index 0a1a7e9..6d6f5be 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.cpp
@@ -73,6 +73,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSDocumentFragmentPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -89,6 +90,11 @@ bool JSDocumentFragmentConstructor::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSDocumentFragmentConstructor, DOMObject>(exec, &JSDocumentFragmentConstructorTable, this, propertyName, slot);
 }
 
+bool JSDocumentFragmentConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSDocumentFragmentConstructor, DOMObject>(exec, &JSDocumentFragmentConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSDocumentFragmentPrototypeTableValues[3] =
@@ -117,6 +123,11 @@ bool JSDocumentFragmentPrototype::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticFunctionSlot<JSObject>(exec, &JSDocumentFragmentPrototypeTable, this, propertyName, slot);
 }
 
+bool JSDocumentFragmentPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSDocumentFragmentPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSDocumentFragment::s_info = { "DocumentFragment", &JSNode::s_info, &JSDocumentFragmentTable, 0 };
 
 JSDocumentFragment::JSDocumentFragment(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<DocumentFragment> impl)
@@ -134,6 +145,11 @@ bool JSDocumentFragment::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSDocumentFragment, Base>(exec, &JSDocumentFragmentTable, this, propertyName, slot);
 }
 
+bool JSDocumentFragment::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSDocumentFragment, Base>(exec, &JSDocumentFragmentTable, this, propertyName, descriptor);
+}
+
 JSValue jsDocumentFragmentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSDocumentFragment* domObject = static_cast<JSDocumentFragment*>(asObject(slot.slotBase()));
@@ -147,7 +163,7 @@ JSValue JSDocumentFragment::getConstructor(ExecState* exec, JSGlobalObject* glob
 JSValue JSC_HOST_CALL jsDocumentFragmentPrototypeFunctionQuerySelector(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocumentFragment::s_info))
+    if (!thisValue.inherits(&JSDocumentFragment::s_info))
         return throwError(exec, TypeError);
     JSDocumentFragment* castedThisObj = static_cast<JSDocumentFragment*>(asObject(thisValue));
     DocumentFragment* imp = static_cast<DocumentFragment*>(castedThisObj->impl());
@@ -163,7 +179,7 @@ JSValue JSC_HOST_CALL jsDocumentFragmentPrototypeFunctionQuerySelector(ExecState
 JSValue JSC_HOST_CALL jsDocumentFragmentPrototypeFunctionQuerySelectorAll(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSDocumentFragment::s_info))
+    if (!thisValue.inherits(&JSDocumentFragment::s_info))
         return throwError(exec, TypeError);
     JSDocumentFragment* castedThisObj = static_cast<JSDocumentFragment*>(asObject(thisValue));
     DocumentFragment* imp = static_cast<DocumentFragment*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.h b/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.h
index d49b298..e742d36 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.h
@@ -33,6 +33,7 @@ public:
     JSDocumentFragment(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<DocumentFragment>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -52,9 +53,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSDocumentFragmentPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocumentType.cpp b/src/3rdparty/webkit/WebCore/generated/JSDocumentType.cpp
index a0df483..b27ab99 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocumentType.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocumentType.cpp
@@ -77,6 +77,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSDocumentTypePrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -93,6 +94,11 @@ bool JSDocumentTypeConstructor::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSDocumentTypeConstructor, DOMObject>(exec, &JSDocumentTypeConstructorTable, this, propertyName, slot);
 }
 
+bool JSDocumentTypeConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSDocumentTypeConstructor, DOMObject>(exec, &JSDocumentTypeConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSDocumentTypePrototypeTableValues[1] =
@@ -131,6 +137,11 @@ bool JSDocumentType::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSDocumentType, Base>(exec, &JSDocumentTypeTable, this, propertyName, slot);
 }
 
+bool JSDocumentType::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSDocumentType, Base>(exec, &JSDocumentTypeTable, this, propertyName, descriptor);
+}
+
 JSValue jsDocumentTypeName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSDocumentType* castedThis = static_cast<JSDocumentType*>(asObject(slot.slotBase()));
@@ -191,7 +202,7 @@ JSValue JSDocumentType::getConstructor(ExecState* exec, JSGlobalObject* globalOb
 
 DocumentType* toDocumentType(JSC::JSValue value)
 {
-    return value.isObject(&JSDocumentType::s_info) ? static_cast<JSDocumentType*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSDocumentType::s_info) ? static_cast<JSDocumentType*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocumentType.h b/src/3rdparty/webkit/WebCore/generated/JSDocumentType.h
index e6569c8..a55ab72 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocumentType.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocumentType.h
@@ -34,6 +34,7 @@ public:
     JSDocumentType(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<DocumentType>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSElement.cpp
index 9c101b5..f487532 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSElement.cpp
@@ -53,7 +53,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSElement);
 
 /* Hash table */
 
-static const HashTableValue JSElementTableValues[60] =
+static const HashTableValue JSElementTableValues[61] =
 {
     { "tagName", DontDelete|ReadOnly, (intptr_t)jsElementTagName, (intptr_t)0 },
     { "style", DontDelete|ReadOnly, (intptr_t)jsElementStyle, (intptr_t)0 },
@@ -91,6 +91,7 @@ static const HashTableValue JSElementTableValues[60] =
     { "onerror", DontDelete|DontEnum, (intptr_t)jsElementOnerror, (intptr_t)setJSElementOnerror },
     { "onfocus", DontDelete|DontEnum, (intptr_t)jsElementOnfocus, (intptr_t)setJSElementOnfocus },
     { "oninput", DontDelete|DontEnum, (intptr_t)jsElementOninput, (intptr_t)setJSElementOninput },
+    { "oninvalid", DontDelete|DontEnum, (intptr_t)jsElementOninvalid, (intptr_t)setJSElementOninvalid },
     { "onkeydown", DontDelete|DontEnum, (intptr_t)jsElementOnkeydown, (intptr_t)setJSElementOnkeydown },
     { "onkeypress", DontDelete|DontEnum, (intptr_t)jsElementOnkeypress, (intptr_t)setJSElementOnkeypress },
     { "onkeyup", DontDelete|DontEnum, (intptr_t)jsElementOnkeyup, (intptr_t)setJSElementOnkeyup },
@@ -146,6 +147,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -162,6 +164,11 @@ bool JSElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSElementConstructor, DOMObject>(exec, &JSElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSElementConstructor, DOMObject>(exec, &JSElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSElementPrototypeTableValues[28] =
@@ -215,6 +222,11 @@ bool JSElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticFunctionSlot<JSObject>(exec, &JSElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSElement::s_info = { "Element", &JSNode::s_info, &JSElementTable, 0 };
 
 JSElement::JSElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<Element> impl)
@@ -579,6 +591,18 @@ JSValue jsElementOninput(ExecState* exec, const Identifier&, const PropertySlot&
     return jsNull();
 }
 
+JSValue jsElementOninvalid(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(castedThis->impl());
+    if (EventListener* listener = imp->oninvalid()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
 JSValue jsElementOnkeydown(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
@@ -1025,6 +1049,16 @@ void setJSElementOninput(ExecState* exec, JSObject* thisObject, JSValue value)
     imp->setOninput(globalObject->createJSAttributeEventListener(value));
 }
 
+void setJSElementOninvalid(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOninvalid(globalObject->createJSAttributeEventListener(value));
+}
+
 void setJSElementOnkeydown(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
@@ -1253,7 +1287,7 @@ JSValue JSElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
 JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSElement::s_info))
+    if (!thisValue.inherits(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -1267,7 +1301,7 @@ JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetAttribute(ExecState* exec, JS
 JSValue JSC_HOST_CALL jsElementPrototypeFunctionSetAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSElement::s_info))
+    if (!thisValue.inherits(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     return castedThisObj->setAttribute(exec, args);
@@ -1276,7 +1310,7 @@ JSValue JSC_HOST_CALL jsElementPrototypeFunctionSetAttribute(ExecState* exec, JS
 JSValue JSC_HOST_CALL jsElementPrototypeFunctionRemoveAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSElement::s_info))
+    if (!thisValue.inherits(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -1291,7 +1325,7 @@ JSValue JSC_HOST_CALL jsElementPrototypeFunctionRemoveAttribute(ExecState* exec,
 JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetAttributeNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSElement::s_info))
+    if (!thisValue.inherits(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -1305,7 +1339,7 @@ JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetAttributeNode(ExecState* exec
 JSValue JSC_HOST_CALL jsElementPrototypeFunctionSetAttributeNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSElement::s_info))
+    if (!thisValue.inherits(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     return castedThisObj->setAttributeNode(exec, args);
@@ -1314,7 +1348,7 @@ JSValue JSC_HOST_CALL jsElementPrototypeFunctionSetAttributeNode(ExecState* exec
 JSValue JSC_HOST_CALL jsElementPrototypeFunctionRemoveAttributeNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSElement::s_info))
+    if (!thisValue.inherits(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -1330,7 +1364,7 @@ JSValue JSC_HOST_CALL jsElementPrototypeFunctionRemoveAttributeNode(ExecState* e
 JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetElementsByTagName(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSElement::s_info))
+    if (!thisValue.inherits(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -1344,7 +1378,7 @@ JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetElementsByTagName(ExecState*
 JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetAttributeNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSElement::s_info))
+    if (!thisValue.inherits(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -1359,7 +1393,7 @@ JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetAttributeNS(ExecState* exec,
 JSValue JSC_HOST_CALL jsElementPrototypeFunctionSetAttributeNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSElement::s_info))
+    if (!thisValue.inherits(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     return castedThisObj->setAttributeNS(exec, args);
@@ -1368,7 +1402,7 @@ JSValue JSC_HOST_CALL jsElementPrototypeFunctionSetAttributeNS(ExecState* exec,
 JSValue JSC_HOST_CALL jsElementPrototypeFunctionRemoveAttributeNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSElement::s_info))
+    if (!thisValue.inherits(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -1384,7 +1418,7 @@ JSValue JSC_HOST_CALL jsElementPrototypeFunctionRemoveAttributeNS(ExecState* exe
 JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetElementsByTagNameNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSElement::s_info))
+    if (!thisValue.inherits(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -1399,7 +1433,7 @@ JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetElementsByTagNameNS(ExecState
 JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetAttributeNodeNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSElement::s_info))
+    if (!thisValue.inherits(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -1414,7 +1448,7 @@ JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetAttributeNodeNS(ExecState* ex
 JSValue JSC_HOST_CALL jsElementPrototypeFunctionSetAttributeNodeNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSElement::s_info))
+    if (!thisValue.inherits(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     return castedThisObj->setAttributeNodeNS(exec, args);
@@ -1423,7 +1457,7 @@ JSValue JSC_HOST_CALL jsElementPrototypeFunctionSetAttributeNodeNS(ExecState* ex
 JSValue JSC_HOST_CALL jsElementPrototypeFunctionHasAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSElement::s_info))
+    if (!thisValue.inherits(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -1437,7 +1471,7 @@ JSValue JSC_HOST_CALL jsElementPrototypeFunctionHasAttribute(ExecState* exec, JS
 JSValue JSC_HOST_CALL jsElementPrototypeFunctionHasAttributeNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSElement::s_info))
+    if (!thisValue.inherits(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -1452,7 +1486,7 @@ JSValue JSC_HOST_CALL jsElementPrototypeFunctionHasAttributeNS(ExecState* exec,
 JSValue JSC_HOST_CALL jsElementPrototypeFunctionFocus(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSElement::s_info))
+    if (!thisValue.inherits(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -1464,7 +1498,7 @@ JSValue JSC_HOST_CALL jsElementPrototypeFunctionFocus(ExecState* exec, JSObject*
 JSValue JSC_HOST_CALL jsElementPrototypeFunctionBlur(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSElement::s_info))
+    if (!thisValue.inherits(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -1476,7 +1510,7 @@ JSValue JSC_HOST_CALL jsElementPrototypeFunctionBlur(ExecState* exec, JSObject*,
 JSValue JSC_HOST_CALL jsElementPrototypeFunctionScrollIntoView(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSElement::s_info))
+    if (!thisValue.inherits(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -1496,7 +1530,7 @@ JSValue JSC_HOST_CALL jsElementPrototypeFunctionScrollIntoView(ExecState* exec,
 JSValue JSC_HOST_CALL jsElementPrototypeFunctionContains(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSElement::s_info))
+    if (!thisValue.inherits(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -1510,7 +1544,7 @@ JSValue JSC_HOST_CALL jsElementPrototypeFunctionContains(ExecState* exec, JSObje
 JSValue JSC_HOST_CALL jsElementPrototypeFunctionScrollIntoViewIfNeeded(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSElement::s_info))
+    if (!thisValue.inherits(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -1530,7 +1564,7 @@ JSValue JSC_HOST_CALL jsElementPrototypeFunctionScrollIntoViewIfNeeded(ExecState
 JSValue JSC_HOST_CALL jsElementPrototypeFunctionScrollByLines(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSElement::s_info))
+    if (!thisValue.inherits(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -1543,7 +1577,7 @@ JSValue JSC_HOST_CALL jsElementPrototypeFunctionScrollByLines(ExecState* exec, J
 JSValue JSC_HOST_CALL jsElementPrototypeFunctionScrollByPages(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSElement::s_info))
+    if (!thisValue.inherits(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -1556,7 +1590,7 @@ JSValue JSC_HOST_CALL jsElementPrototypeFunctionScrollByPages(ExecState* exec, J
 JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetElementsByClassName(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSElement::s_info))
+    if (!thisValue.inherits(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -1570,7 +1604,7 @@ JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetElementsByClassName(ExecState
 JSValue JSC_HOST_CALL jsElementPrototypeFunctionQuerySelector(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSElement::s_info))
+    if (!thisValue.inherits(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -1586,7 +1620,7 @@ JSValue JSC_HOST_CALL jsElementPrototypeFunctionQuerySelector(ExecState* exec, J
 JSValue JSC_HOST_CALL jsElementPrototypeFunctionQuerySelectorAll(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSElement::s_info))
+    if (!thisValue.inherits(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -1602,7 +1636,7 @@ JSValue JSC_HOST_CALL jsElementPrototypeFunctionQuerySelectorAll(ExecState* exec
 JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetClientRects(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSElement::s_info))
+    if (!thisValue.inherits(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -1615,7 +1649,7 @@ JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetClientRects(ExecState* exec,
 JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetBoundingClientRect(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSElement::s_info))
+    if (!thisValue.inherits(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -1627,7 +1661,7 @@ JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetBoundingClientRect(ExecState*
 
 Element* toElement(JSC::JSValue value)
 {
-    return value.isObject(&JSElement::s_info) ? static_cast<JSElement*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSElement::s_info) ? static_cast<JSElement*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSElement.h b/src/3rdparty/webkit/WebCore/generated/JSElement.h
index b7a2747..8d72032 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSElement.h
@@ -36,6 +36,7 @@ public:
     JSElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<Element>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -45,6 +46,8 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
+    virtual void markChildren(JSC::MarkStack&);
+
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 
     // Custom functions
@@ -63,6 +66,11 @@ ALWAYS_INLINE bool JSElement::getOwnPropertySlot(JSC::ExecState* exec, const JSC
     return JSC::getStaticValueSlot<JSElement, Base>(exec, s_info.staticPropHashTable, this, propertyName, slot);
 }
 
+ALWAYS_INLINE bool JSElement::getOwnPropertyDescriptor(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertyDescriptor& descriptor)
+{
+    return JSC::getStaticValueDescriptor<JSElement, Base>(exec, s_info.staticPropHashTable, this, propertyName, descriptor);
+}
+
 Element* toElement(JSC::JSValue);
 JSC::JSValue toJSNewlyCreated(JSC::ExecState*, JSDOMGlobalObject*, Element*);
 
@@ -73,6 +81,7 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
@@ -165,6 +174,8 @@ JSC::JSValue jsElementOnfocus(JSC::ExecState*, const JSC::Identifier&, const JSC
 void setJSElementOnfocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsElementOninput(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSElementOninput(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOninvalid(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOninvalid(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsElementOnkeydown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSElementOnkeydown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsElementOnkeypress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEntity.cpp b/src/3rdparty/webkit/WebCore/generated/JSEntity.cpp
index 3b519ce..6970d69 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEntity.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEntity.cpp
@@ -71,6 +71,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSEntityPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -87,6 +88,11 @@ bool JSEntityConstructor::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSEntityConstructor, DOMObject>(exec, &JSEntityConstructorTable, this, propertyName, slot);
 }
 
+bool JSEntityConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSEntityConstructor, DOMObject>(exec, &JSEntityConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSEntityPrototypeTableValues[1] =
@@ -125,6 +131,11 @@ bool JSEntity::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNam
     return getStaticValueSlot<JSEntity, Base>(exec, &JSEntityTable, this, propertyName, slot);
 }
 
+bool JSEntity::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSEntity, Base>(exec, &JSEntityTable, this, propertyName, descriptor);
+}
+
 JSValue jsEntityPublicId(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSEntity* castedThis = static_cast<JSEntity*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEntity.h b/src/3rdparty/webkit/WebCore/generated/JSEntity.h
index 323d70c..fdfa0bc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEntity.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEntity.h
@@ -33,6 +33,7 @@ public:
     JSEntity(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<Entity>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEntityReference.cpp b/src/3rdparty/webkit/WebCore/generated/JSEntityReference.cpp
index 5e18f07..d59f043 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEntityReference.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEntityReference.cpp
@@ -67,6 +67,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSEntityReferencePrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -83,6 +84,11 @@ bool JSEntityReferenceConstructor::getOwnPropertySlot(ExecState* exec, const Ide
     return getStaticValueSlot<JSEntityReferenceConstructor, DOMObject>(exec, &JSEntityReferenceConstructorTable, this, propertyName, slot);
 }
 
+bool JSEntityReferenceConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSEntityReferenceConstructor, DOMObject>(exec, &JSEntityReferenceConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSEntityReferencePrototypeTableValues[1] =
@@ -121,6 +127,11 @@ bool JSEntityReference::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSEntityReference, Base>(exec, &JSEntityReferenceTable, this, propertyName, slot);
 }
 
+bool JSEntityReference::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSEntityReference, Base>(exec, &JSEntityReferenceTable, this, propertyName, descriptor);
+}
+
 JSValue jsEntityReferenceConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSEntityReference* domObject = static_cast<JSEntityReference*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEntityReference.h b/src/3rdparty/webkit/WebCore/generated/JSEntityReference.h
index 261e2e9..3894faf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEntityReference.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEntityReference.h
@@ -33,6 +33,7 @@ public:
     JSEntityReference(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<EntityReference>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.cpp
index 24bf5f2..e01e7d8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.cpp
@@ -77,6 +77,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSErrorEventPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -93,6 +94,11 @@ bool JSErrorEventConstructor::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSErrorEventConstructor, DOMObject>(exec, &JSErrorEventConstructorTable, this, propertyName, slot);
 }
 
+bool JSErrorEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSErrorEventConstructor, DOMObject>(exec, &JSErrorEventConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSErrorEventPrototypeTableValues[2] =
@@ -124,6 +130,11 @@ bool JSErrorEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticFunctionSlot<JSObject>(exec, getJSErrorEventPrototypeTable(exec), this, propertyName, slot);
 }
 
+bool JSErrorEventPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, getJSErrorEventPrototypeTable(exec), this, propertyName, descriptor);
+}
+
 static const HashTable* getJSErrorEventTable(ExecState* exec)
 {
     return getHashTableForGlobalData(exec->globalData(), &JSErrorEventTable);
@@ -145,6 +156,11 @@ bool JSErrorEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<JSErrorEvent, Base>(exec, getJSErrorEventTable(exec), this, propertyName, slot);
 }
 
+bool JSErrorEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSErrorEvent, Base>(exec, getJSErrorEventTable(exec), this, propertyName, descriptor);
+}
+
 JSValue jsErrorEventMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSErrorEvent* castedThis = static_cast<JSErrorEvent*>(asObject(slot.slotBase()));
@@ -182,7 +198,7 @@ JSValue JSErrorEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObje
 JSValue JSC_HOST_CALL jsErrorEventPrototypeFunctionInitErrorEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSErrorEvent::s_info))
+    if (!thisValue.inherits(&JSErrorEvent::s_info))
         return throwError(exec, TypeError);
     JSErrorEvent* castedThisObj = static_cast<JSErrorEvent*>(asObject(thisValue));
     ErrorEvent* imp = static_cast<ErrorEvent*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.h b/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.h
index bcf57de..1102551 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.h
@@ -35,6 +35,7 @@ public:
     JSErrorEvent(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<ErrorEvent>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -54,9 +55,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSErrorEventPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp
index 58865e0..9d9b7f2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp
@@ -103,6 +103,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSEventPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -119,6 +120,11 @@ bool JSEventConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSEventConstructor, DOMObject>(exec, &JSEventConstructorTable, this, propertyName, slot);
 }
 
+bool JSEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSEventConstructor, DOMObject>(exec, &JSEventConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSEventPrototypeTableValues[23] =
@@ -171,6 +177,11 @@ bool JSEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticPropertySlot<JSEventPrototype, JSObject>(exec, getJSEventPrototypeTable(exec), this, propertyName, slot);
 }
 
+bool JSEventPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSEventPrototype, JSObject>(exec, getJSEventPrototypeTable(exec), this, propertyName, descriptor);
+}
+
 static const HashTable* getJSEventTable(ExecState* exec)
 {
     return getHashTableForGlobalData(exec->globalData(), &JSEventTable);
@@ -198,6 +209,11 @@ bool JSEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName
     return getStaticValueSlot<JSEvent, Base>(exec, getJSEventTable(exec), this, propertyName, slot);
 }
 
+bool JSEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSEvent, Base>(exec, getJSEventTable(exec), this, propertyName, descriptor);
+}
+
 JSValue jsEventType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSEvent* castedThis = static_cast<JSEvent*>(asObject(slot.slotBase()));
@@ -314,7 +330,7 @@ JSValue JSEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
 JSValue JSC_HOST_CALL jsEventPrototypeFunctionStopPropagation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSEvent::s_info))
+    if (!thisValue.inherits(&JSEvent::s_info))
         return throwError(exec, TypeError);
     JSEvent* castedThisObj = static_cast<JSEvent*>(asObject(thisValue));
     Event* imp = static_cast<Event*>(castedThisObj->impl());
@@ -326,7 +342,7 @@ JSValue JSC_HOST_CALL jsEventPrototypeFunctionStopPropagation(ExecState* exec, J
 JSValue JSC_HOST_CALL jsEventPrototypeFunctionPreventDefault(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSEvent::s_info))
+    if (!thisValue.inherits(&JSEvent::s_info))
         return throwError(exec, TypeError);
     JSEvent* castedThisObj = static_cast<JSEvent*>(asObject(thisValue));
     Event* imp = static_cast<Event*>(castedThisObj->impl());
@@ -338,7 +354,7 @@ JSValue JSC_HOST_CALL jsEventPrototypeFunctionPreventDefault(ExecState* exec, JS
 JSValue JSC_HOST_CALL jsEventPrototypeFunctionInitEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSEvent::s_info))
+    if (!thisValue.inherits(&JSEvent::s_info))
         return throwError(exec, TypeError);
     JSEvent* castedThisObj = static_cast<JSEvent*>(asObject(thisValue));
     Event* imp = static_cast<Event*>(castedThisObj->impl());
@@ -449,7 +465,7 @@ JSValue jsEventCHANGE(ExecState* exec, const Identifier&, const PropertySlot&)
 
 Event* toEvent(JSC::JSValue value)
 {
-    return value.isObject(&JSEvent::s_info) ? static_cast<JSEvent*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSEvent::s_info) ? static_cast<JSEvent*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEvent.h b/src/3rdparty/webkit/WebCore/generated/JSEvent.h
index f56b889..21c0186 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEvent.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSEvent();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -66,9 +67,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSEventPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp b/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp
index b92465a..df2cebc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp
@@ -75,6 +75,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSEventExceptionPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -91,6 +92,11 @@ bool JSEventExceptionConstructor::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticValueSlot<JSEventExceptionConstructor, DOMObject>(exec, &JSEventExceptionConstructorTable, this, propertyName, slot);
 }
 
+bool JSEventExceptionConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSEventExceptionConstructor, DOMObject>(exec, &JSEventExceptionConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSEventExceptionPrototypeTableValues[3] =
@@ -123,6 +129,11 @@ bool JSEventExceptionPrototype::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticPropertySlot<JSEventExceptionPrototype, JSObject>(exec, getJSEventExceptionPrototypeTable(exec), this, propertyName, slot);
 }
 
+bool JSEventExceptionPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSEventExceptionPrototype, JSObject>(exec, getJSEventExceptionPrototypeTable(exec), this, propertyName, descriptor);
+}
+
 static const HashTable* getJSEventExceptionTable(ExecState* exec)
 {
     return getHashTableForGlobalData(exec->globalData(), &JSEventExceptionTable);
@@ -150,6 +161,11 @@ bool JSEventException::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSEventException, Base>(exec, getJSEventExceptionTable(exec), this, propertyName, slot);
 }
 
+bool JSEventException::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSEventException, Base>(exec, getJSEventExceptionTable(exec), this, propertyName, descriptor);
+}
+
 JSValue jsEventExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSEventException* castedThis = static_cast<JSEventException*>(asObject(slot.slotBase()));
@@ -187,7 +203,7 @@ JSValue JSEventException::getConstructor(ExecState* exec, JSGlobalObject* global
 JSValue JSC_HOST_CALL jsEventExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSEventException::s_info))
+    if (!thisValue.inherits(&JSEventException::s_info))
         return throwError(exec, TypeError);
     JSEventException* castedThisObj = static_cast<JSEventException*>(asObject(thisValue));
     EventException* imp = static_cast<EventException*>(castedThisObj->impl());
@@ -210,7 +226,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, EventEx
 }
 EventException* toEventException(JSC::JSValue value)
 {
-    return value.isObject(&JSEventException::s_info) ? static_cast<JSEventException*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSEventException::s_info) ? static_cast<JSEventException*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventException.h b/src/3rdparty/webkit/WebCore/generated/JSEventException.h
index 433e440..f18c825 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEventException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEventException.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSEventException();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -62,9 +63,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSEventExceptionPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventSource.cpp b/src/3rdparty/webkit/WebCore/generated/JSEventSource.cpp
new file mode 100644
index 0000000..8fe292b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSEventSource.cpp
@@ -0,0 +1,300 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(EVENTSOURCE)
+
+#include "JSEventSource.h"
+
+#include "Event.h"
+#include "EventListener.h"
+#include "EventSource.h"
+#include "Frame.h"
+#include "JSDOMGlobalObject.h"
+#include "JSEvent.h"
+#include "JSEventListener.h"
+#include "KURL.h"
+#include <runtime/Error.h>
+#include <runtime/JSNumberCell.h>
+#include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSEventSource);
+
+/* Hash table */
+
+static const HashTableValue JSEventSourceTableValues[6] =
+{
+    { "URL", DontDelete|ReadOnly, (intptr_t)jsEventSourceURL, (intptr_t)0 },
+    { "readyState", DontDelete|ReadOnly, (intptr_t)jsEventSourceReadyState, (intptr_t)0 },
+    { "onopen", DontDelete, (intptr_t)jsEventSourceOnopen, (intptr_t)setJSEventSourceOnopen },
+    { "onmessage", DontDelete, (intptr_t)jsEventSourceOnmessage, (intptr_t)setJSEventSourceOnmessage },
+    { "onerror", DontDelete, (intptr_t)jsEventSourceOnerror, (intptr_t)setJSEventSourceOnerror },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSEventSourceTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 127, JSEventSourceTableValues, 0 };
+#else
+    { 17, 15, JSEventSourceTableValues, 0 };
+#endif
+
+/* Hash table for prototype */
+
+static const HashTableValue JSEventSourcePrototypeTableValues[8] =
+{
+    { "CONNECTING", DontDelete|ReadOnly, (intptr_t)jsEventSourceCONNECTING, (intptr_t)0 },
+    { "OPEN", DontDelete|ReadOnly, (intptr_t)jsEventSourceOPEN, (intptr_t)0 },
+    { "CLOSED", DontDelete|ReadOnly, (intptr_t)jsEventSourceCLOSED, (intptr_t)0 },
+    { "close", DontDelete|Function, (intptr_t)jsEventSourcePrototypeFunctionClose, (intptr_t)0 },
+    { "addEventListener", DontDelete|Function, (intptr_t)jsEventSourcePrototypeFunctionAddEventListener, (intptr_t)3 },
+    { "removeEventListener", DontDelete|Function, (intptr_t)jsEventSourcePrototypeFunctionRemoveEventListener, (intptr_t)3 },
+    { "dispatchEvent", DontDelete|Function, (intptr_t)jsEventSourcePrototypeFunctionDispatchEvent, (intptr_t)1 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSEventSourcePrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 127, JSEventSourcePrototypeTableValues, 0 };
+#else
+    { 17, 15, JSEventSourcePrototypeTableValues, 0 };
+#endif
+
+static const HashTable* getJSEventSourcePrototypeTable(ExecState* exec)
+{
+    return getHashTableForGlobalData(exec->globalData(), &JSEventSourcePrototypeTable);
+}
+const ClassInfo JSEventSourcePrototype::s_info = { "EventSourcePrototype", 0, 0, getJSEventSourcePrototypeTable };
+
+JSObject* JSEventSourcePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSEventSource>(exec, globalObject);
+}
+
+bool JSEventSourcePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticPropertySlot<JSEventSourcePrototype, JSObject>(exec, getJSEventSourcePrototypeTable(exec), this, propertyName, slot);
+}
+
+bool JSEventSourcePrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSEventSourcePrototype, JSObject>(exec, getJSEventSourcePrototypeTable(exec), this, propertyName, descriptor);
+}
+
+static const HashTable* getJSEventSourceTable(ExecState* exec)
+{
+    return getHashTableForGlobalData(exec->globalData(), &JSEventSourceTable);
+}
+const ClassInfo JSEventSource::s_info = { "EventSource", 0, 0, getJSEventSourceTable };
+
+JSEventSource::JSEventSource(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<EventSource> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
+    , m_impl(impl)
+{
+}
+
+JSEventSource::~JSEventSource()
+{
+    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+}
+
+JSObject* JSEventSource::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSEventSourcePrototype(JSEventSourcePrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSEventSource::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSEventSource, Base>(exec, getJSEventSourceTable(exec), this, propertyName, slot);
+}
+
+bool JSEventSource::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSEventSource, Base>(exec, getJSEventSourceTable(exec), this, propertyName, descriptor);
+}
+
+JSValue jsEventSourceURL(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSEventSource* castedThis = static_cast<JSEventSource*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    EventSource* imp = static_cast<EventSource*>(castedThis->impl());
+    return jsString(exec, imp->url());
+}
+
+JSValue jsEventSourceReadyState(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSEventSource* castedThis = static_cast<JSEventSource*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    EventSource* imp = static_cast<EventSource*>(castedThis->impl());
+    return jsNumber(exec, imp->readyState());
+}
+
+JSValue jsEventSourceOnopen(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSEventSource* castedThis = static_cast<JSEventSource*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    EventSource* imp = static_cast<EventSource*>(castedThis->impl());
+    if (EventListener* listener = imp->onopen()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsEventSourceOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSEventSource* castedThis = static_cast<JSEventSource*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    EventSource* imp = static_cast<EventSource*>(castedThis->impl());
+    if (EventListener* listener = imp->onmessage()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsEventSourceOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSEventSource* castedThis = static_cast<JSEventSource*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    EventSource* imp = static_cast<EventSource*>(castedThis->impl());
+    if (EventListener* listener = imp->onerror()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+void JSEventSource::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    lookupPut<JSEventSource, Base>(exec, propertyName, value, getJSEventSourceTable(exec), this, slot);
+}
+
+void setJSEventSourceOnopen(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    EventSource* imp = static_cast<EventSource*>(static_cast<JSEventSource*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnopen(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSEventSourceOnmessage(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    EventSource* imp = static_cast<EventSource*>(static_cast<JSEventSource*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnmessage(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSEventSourceOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    EventSource* imp = static_cast<EventSource*>(static_cast<JSEventSource*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
+}
+
+JSValue JSC_HOST_CALL jsEventSourcePrototypeFunctionClose(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSEventSource::s_info))
+        return throwError(exec, TypeError);
+    JSEventSource* castedThisObj = static_cast<JSEventSource*>(asObject(thisValue));
+    EventSource* imp = static_cast<EventSource*>(castedThisObj->impl());
+
+    imp->close();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsEventSourcePrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSEventSource::s_info))
+        return throwError(exec, TypeError);
+    JSEventSource* castedThisObj = static_cast<JSEventSource*>(asObject(thisValue));
+    return castedThisObj->addEventListener(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsEventSourcePrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSEventSource::s_info))
+        return throwError(exec, TypeError);
+    JSEventSource* castedThisObj = static_cast<JSEventSource*>(asObject(thisValue));
+    return castedThisObj->removeEventListener(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsEventSourcePrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSEventSource::s_info))
+        return throwError(exec, TypeError);
+    JSEventSource* castedThisObj = static_cast<JSEventSource*>(asObject(thisValue));
+    EventSource* imp = static_cast<EventSource*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    Event* evt = toEvent(args.at(0));
+
+
+    JSC::JSValue result = jsBoolean(imp->dispatchEvent(evt, ec));
+    setDOMException(exec, ec);
+    return result;
+}
+
+// Constant getters
+
+JSValue jsEventSourceCONNECTING(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0));
+}
+
+JSValue jsEventSourceOPEN(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(1));
+}
+
+JSValue jsEventSourceCLOSED(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(2));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, EventSource* object)
+{
+    return getDOMObjectWrapper<JSEventSource>(exec, globalObject, object);
+}
+EventSource* toEventSource(JSC::JSValue value)
+{
+    return value.inherits(&JSEventSource::s_info) ? static_cast<JSEventSource*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(EVENTSOURCE)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventSource.h b/src/3rdparty/webkit/WebCore/generated/JSEventSource.h
new file mode 100644
index 0000000..c7bdf23
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSEventSource.h
@@ -0,0 +1,108 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSEventSource_h
+#define JSEventSource_h
+
+#if ENABLE(EVENTSOURCE)
+
+#include "DOMObjectWithSVGContext.h"
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class EventSource;
+
+class JSEventSource : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
+public:
+    JSEventSource(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<EventSource>);
+    virtual ~JSEventSource();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    virtual void markChildren(JSC::MarkStack&);
+
+
+    // Custom functions
+    JSC::JSValue addEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeEventListener(JSC::ExecState*, const JSC::ArgList&);
+    EventSource* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<EventSource> m_impl;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, EventSource*);
+EventSource* toEventSource(JSC::JSValue);
+
+class JSEventSourcePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+    JSEventSourcePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsEventSourcePrototypeFunctionClose(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsEventSourcePrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsEventSourcePrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsEventSourcePrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsEventSourceURL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventSourceReadyState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventSourceOnopen(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSEventSourceOnopen(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsEventSourceOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSEventSourceOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsEventSourceOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSEventSourceOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+// Constants
+
+JSC::JSValue jsEventSourceCONNECTING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventSourceOPEN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventSourceCLOSED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif // ENABLE(EVENTSOURCE)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFile.cpp b/src/3rdparty/webkit/WebCore/generated/JSFile.cpp
index 86c9f1f..5fa637e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSFile.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSFile.cpp
@@ -72,6 +72,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSFilePrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -88,6 +89,11 @@ bool JSFileConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSFileConstructor, DOMObject>(exec, &JSFileConstructorTable, this, propertyName, slot);
 }
 
+bool JSFileConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSFileConstructor, DOMObject>(exec, &JSFileConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSFilePrototypeTableValues[1] =
@@ -132,6 +138,11 @@ bool JSFile::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName,
     return getStaticValueSlot<JSFile, Base>(exec, &JSFileTable, this, propertyName, slot);
 }
 
+bool JSFile::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSFile, Base>(exec, &JSFileTable, this, propertyName, descriptor);
+}
+
 JSValue jsFileFileName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSFile* castedThis = static_cast<JSFile*>(asObject(slot.slotBase()));
@@ -164,7 +175,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, File* o
 }
 File* toFile(JSC::JSValue value)
 {
-    return value.isObject(&JSFile::s_info) ? static_cast<JSFile*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSFile::s_info) ? static_cast<JSFile*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFile.h b/src/3rdparty/webkit/WebCore/generated/JSFile.h
index afeaaf5..e614ec1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSFile.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSFile.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSFile();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp b/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp
index 088744e..5fb8b0c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp
@@ -74,6 +74,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSFileListPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -90,6 +91,11 @@ bool JSFileListConstructor::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSFileListConstructor, DOMObject>(exec, &JSFileListConstructorTable, this, propertyName, slot);
 }
 
+bool JSFileListConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSFileListConstructor, DOMObject>(exec, &JSFileListConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSFileListPrototypeTableValues[2] =
@@ -117,6 +123,11 @@ bool JSFileListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticFunctionSlot<JSObject>(exec, &JSFileListPrototypeTable, this, propertyName, slot);
 }
 
+bool JSFileListPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSFileListPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSFileList::s_info = { "FileList", 0, &JSFileListTable, 0 };
 
 JSFileList::JSFileList(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<FileList> impl)
@@ -151,6 +162,26 @@ bool JSFileList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSFileList, Base>(exec, &JSFileListTable, this, propertyName, slot);
 }
 
+bool JSFileList::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    const HashEntry* entry = JSFileListTable.entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        slot.setCustom(this, entry->propertyGetter());
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<FileList*>(impl())->length()) {
+        PropertySlot slot;
+        slot.setCustomIndex(this, index, indexGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly);
+        return true;
+    }
+    return getStaticValueDescriptor<JSFileList, Base>(exec, &JSFileListTable, this, propertyName, descriptor);
+}
+
 bool JSFileList::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
 {
     if (propertyName < static_cast<FileList*>(impl())->length()) {
@@ -173,11 +204,11 @@ JSValue jsFileListConstructor(ExecState* exec, const Identifier&, const Property
     JSFileList* domObject = static_cast<JSFileList*>(asObject(slot.slotBase()));
     return JSFileList::getConstructor(exec, domObject->globalObject());
 }
-void JSFileList::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSFileList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     for (unsigned i = 0; i < static_cast<FileList*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getPropertyNames(exec, propertyNames, listedAttributes);
+     Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 JSValue JSFileList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -188,7 +219,7 @@ JSValue JSFileList::getConstructor(ExecState* exec, JSGlobalObject* globalObject
 JSValue JSC_HOST_CALL jsFileListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSFileList::s_info))
+    if (!thisValue.inherits(&JSFileList::s_info))
         return throwError(exec, TypeError);
     JSFileList* castedThisObj = static_cast<JSFileList*>(asObject(thisValue));
     FileList* imp = static_cast<FileList*>(castedThisObj->impl());
@@ -215,7 +246,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, FileLis
 }
 FileList* toFileList(JSC::JSValue value)
 {
-    return value.isObject(&JSFileList::s_info) ? static_cast<JSFileList*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSFileList::s_info) ? static_cast<JSFileList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFileList.h b/src/3rdparty/webkit/WebCore/generated/JSFileList.h
index 421fad0..a238ba4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSFileList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSFileList.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSFileList();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -46,7 +47,7 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     FileList* impl() const { return m_impl.get(); }
 
@@ -65,9 +66,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSFileListPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSGeolocation.cpp b/src/3rdparty/webkit/WebCore/generated/JSGeolocation.cpp
index 481852c..7a1e5f0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSGeolocation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSGeolocation.cpp
@@ -77,6 +77,11 @@ bool JSGeolocationPrototype::getOwnPropertySlot(ExecState* exec, const Identifie
     return getStaticFunctionSlot<JSObject>(exec, &JSGeolocationPrototypeTable, this, propertyName, slot);
 }
 
+bool JSGeolocationPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSGeolocationPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSGeolocation::s_info = { "Geolocation", 0, &JSGeolocationTable, 0 };
 
 JSGeolocation::JSGeolocation(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<Geolocation> impl)
@@ -100,6 +105,11 @@ bool JSGeolocation::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSGeolocation, Base>(exec, &JSGeolocationTable, this, propertyName, slot);
 }
 
+bool JSGeolocation::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSGeolocation, Base>(exec, &JSGeolocationTable, this, propertyName, descriptor);
+}
+
 JSValue jsGeolocationLastPosition(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSGeolocation* castedThis = static_cast<JSGeolocation*>(asObject(slot.slotBase()));
@@ -111,7 +121,7 @@ JSValue jsGeolocationLastPosition(ExecState* exec, const Identifier&, const Prop
 JSValue JSC_HOST_CALL jsGeolocationPrototypeFunctionGetCurrentPosition(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSGeolocation::s_info))
+    if (!thisValue.inherits(&JSGeolocation::s_info))
         return throwError(exec, TypeError);
     JSGeolocation* castedThisObj = static_cast<JSGeolocation*>(asObject(thisValue));
     return castedThisObj->getCurrentPosition(exec, args);
@@ -120,7 +130,7 @@ JSValue JSC_HOST_CALL jsGeolocationPrototypeFunctionGetCurrentPosition(ExecState
 JSValue JSC_HOST_CALL jsGeolocationPrototypeFunctionWatchPosition(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSGeolocation::s_info))
+    if (!thisValue.inherits(&JSGeolocation::s_info))
         return throwError(exec, TypeError);
     JSGeolocation* castedThisObj = static_cast<JSGeolocation*>(asObject(thisValue));
     return castedThisObj->watchPosition(exec, args);
@@ -129,7 +139,7 @@ JSValue JSC_HOST_CALL jsGeolocationPrototypeFunctionWatchPosition(ExecState* exe
 JSValue JSC_HOST_CALL jsGeolocationPrototypeFunctionClearWatch(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSGeolocation::s_info))
+    if (!thisValue.inherits(&JSGeolocation::s_info))
         return throwError(exec, TypeError);
     JSGeolocation* castedThisObj = static_cast<JSGeolocation*>(asObject(thisValue));
     Geolocation* imp = static_cast<Geolocation*>(castedThisObj->impl());
@@ -145,7 +155,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Geoloca
 }
 Geolocation* toGeolocation(JSC::JSValue value)
 {
-    return value.isObject(&JSGeolocation::s_info) ? static_cast<JSGeolocation*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSGeolocation::s_info) ? static_cast<JSGeolocation*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSGeolocation.h b/src/3rdparty/webkit/WebCore/generated/JSGeolocation.h
index 38af988..351af5b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSGeolocation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSGeolocation.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSGeolocation();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -65,9 +66,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSGeolocationPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSGeoposition.cpp b/src/3rdparty/webkit/WebCore/generated/JSGeoposition.cpp
index 348f0a5..400e0d4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSGeoposition.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSGeoposition.cpp
@@ -24,10 +24,7 @@
 #include "Coordinates.h"
 #include "Geoposition.h"
 #include "JSCoordinates.h"
-#include "KURL.h"
-#include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
-#include <runtime/JSString.h>
 #include <wtf/GetPtr.h>
 
 using namespace JSC;
@@ -54,9 +51,8 @@ static JSC_CONST_HASHTABLE HashTable JSGeopositionTable =
 
 /* Hash table for prototype */
 
-static const HashTableValue JSGeopositionPrototypeTableValues[2] =
+static const HashTableValue JSGeopositionPrototypeTableValues[1] =
 {
-    { "toString", DontDelete|DontEnum|Function, (intptr_t)jsGeopositionPrototypeFunctionToString, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -64,7 +60,7 @@ static JSC_CONST_HASHTABLE HashTable JSGeopositionPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 0, JSGeopositionPrototypeTableValues, 0 };
 #else
-    { 2, 1, JSGeopositionPrototypeTableValues, 0 };
+    { 1, 0, JSGeopositionPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSGeopositionPrototype::s_info = { "GeopositionPrototype", 0, &JSGeopositionPrototypeTable, 0 };
@@ -74,11 +70,6 @@ JSObject* JSGeopositionPrototype::self(ExecState* exec, JSGlobalObject* globalOb
     return getDOMPrototype<JSGeoposition>(exec, globalObject);
 }
 
-bool JSGeopositionPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    return getStaticFunctionSlot<JSObject>(exec, &JSGeopositionPrototypeTable, this, propertyName, slot);
-}
-
 const ClassInfo JSGeoposition::s_info = { "Geoposition", 0, &JSGeopositionTable, 0 };
 
 JSGeoposition::JSGeoposition(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<Geoposition> impl)
@@ -102,6 +93,11 @@ bool JSGeoposition::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSGeoposition, Base>(exec, &JSGeopositionTable, this, propertyName, slot);
 }
 
+bool JSGeoposition::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSGeoposition, Base>(exec, &JSGeopositionTable, this, propertyName, descriptor);
+}
+
 JSValue jsGeopositionCoords(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSGeoposition* castedThis = static_cast<JSGeoposition*>(asObject(slot.slotBase()));
@@ -118,26 +114,13 @@ JSValue jsGeopositionTimestamp(ExecState* exec, const Identifier&, const Propert
     return jsNumber(exec, imp->timestamp());
 }
 
-JSValue JSC_HOST_CALL jsGeopositionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSGeoposition::s_info))
-        return throwError(exec, TypeError);
-    JSGeoposition* castedThisObj = static_cast<JSGeoposition*>(asObject(thisValue));
-    Geoposition* imp = static_cast<Geoposition*>(castedThisObj->impl());
-
-
-    JSC::JSValue result = jsString(exec, imp->toString());
-    return result;
-}
-
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Geoposition* object)
 {
     return getDOMObjectWrapper<JSGeoposition>(exec, globalObject, object);
 }
 Geoposition* toGeoposition(JSC::JSValue value)
 {
-    return value.isObject(&JSGeoposition::s_info) ? static_cast<JSGeoposition*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSGeoposition::s_info) ? static_cast<JSGeoposition*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSGeoposition.h b/src/3rdparty/webkit/WebCore/generated/JSGeoposition.h
index 8d5a2ba..c970cac 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSGeoposition.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSGeoposition.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSGeoposition();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -60,17 +61,9 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
-    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
-    }
     JSGeopositionPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
 
-// Functions
-
-JSC::JSValue JSC_HOST_CALL jsGeopositionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
 JSC::JSValue jsGeopositionCoords(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.cpp
index 1e30146..985ffc4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.cpp
@@ -90,6 +90,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLAnchorElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -106,6 +107,11 @@ bool JSHTMLAnchorElementConstructor::getOwnPropertySlot(ExecState* exec, const I
     return getStaticValueSlot<JSHTMLAnchorElementConstructor, DOMObject>(exec, &JSHTMLAnchorElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLAnchorElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLAnchorElementConstructor, DOMObject>(exec, &JSHTMLAnchorElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLAnchorElementPrototypeTableValues[2] =
@@ -133,6 +139,11 @@ bool JSHTMLAnchorElementPrototype::getOwnPropertySlot(ExecState* exec, const Ide
     return getStaticFunctionSlot<JSObject>(exec, &JSHTMLAnchorElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSHTMLAnchorElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSHTMLAnchorElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSHTMLAnchorElement::s_info = { "HTMLAnchorElement", &JSHTMLElement::s_info, &JSHTMLAnchorElementTable, 0 };
 
 JSHTMLAnchorElement::JSHTMLAnchorElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLAnchorElement> impl)
@@ -150,6 +161,11 @@ bool JSHTMLAnchorElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLAnchorElement, Base>(exec, &JSHTMLAnchorElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLAnchorElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLAnchorElement, Base>(exec, &JSHTMLAnchorElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLAnchorElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLAnchorElement* castedThis = static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()));
@@ -386,7 +402,7 @@ JSValue JSHTMLAnchorElement::getConstructor(ExecState* exec, JSGlobalObject* glo
 JSValue JSC_HOST_CALL jsHTMLAnchorElementPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLAnchorElement::s_info))
+    if (!thisValue.inherits(&JSHTMLAnchorElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLAnchorElement* castedThisObj = static_cast<JSHTMLAnchorElement*>(asObject(thisValue));
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.h
index e9a99b3..887dd75 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLAnchorElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLAnchorElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -53,9 +54,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSHTMLAnchorElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.cpp
index 8731f25..8c171ea 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.cpp
@@ -83,6 +83,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLAppletElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -99,6 +100,11 @@ bool JSHTMLAppletElementConstructor::getOwnPropertySlot(ExecState* exec, const I
     return getStaticValueSlot<JSHTMLAppletElementConstructor, DOMObject>(exec, &JSHTMLAppletElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLAppletElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLAppletElementConstructor, DOMObject>(exec, &JSHTMLAppletElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLAppletElementPrototypeTableValues[1] =
@@ -143,6 +149,19 @@ bool JSHTMLAppletElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLAppletElement, Base>(exec, &JSHTMLAppletElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLAppletElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    if (canGetItemsForName(exec, static_cast<HTMLAppletElement*>(impl()), propertyName)) {
+        PropertySlot slot;
+        slot.setCustom(this, nameGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    if (getOwnPropertyDescriptorDelegate(exec, propertyName, descriptor))
+        return true;
+    return getStaticValueDescriptor<JSHTMLAppletElement, Base>(exec, &JSHTMLAppletElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLAppletElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLAppletElement* castedThis = static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.h
index 256bfb6..89eab88 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.h
@@ -34,7 +34,9 @@ public:
     JSHTMLAppletElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLAppletElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    bool getOwnPropertyDescriptorDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.cpp
index 5fa1204..7494730 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.cpp
@@ -84,6 +84,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLAreaElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -100,6 +101,11 @@ bool JSHTMLAreaElementConstructor::getOwnPropertySlot(ExecState* exec, const Ide
     return getStaticValueSlot<JSHTMLAreaElementConstructor, DOMObject>(exec, &JSHTMLAreaElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLAreaElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLAreaElementConstructor, DOMObject>(exec, &JSHTMLAreaElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLAreaElementPrototypeTableValues[1] =
@@ -138,6 +144,11 @@ bool JSHTMLAreaElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSHTMLAreaElement, Base>(exec, &JSHTMLAreaElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLAreaElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLAreaElement, Base>(exec, &JSHTMLAreaElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLAreaElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLAreaElement* castedThis = static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.h
index 4b43021..543b869 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLAreaElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLAreaElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.cpp
index 6c8ae85..e3a9c3c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.cpp
@@ -70,6 +70,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLAudioElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -86,6 +87,11 @@ bool JSHTMLAudioElementConstructor::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSHTMLAudioElementConstructor, DOMObject>(exec, &JSHTMLAudioElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLAudioElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLAudioElementConstructor, DOMObject>(exec, &JSHTMLAudioElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLAudioElementPrototypeTableValues[1] =
@@ -124,6 +130,11 @@ bool JSHTMLAudioElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLAudioElement, Base>(exec, &JSHTMLAudioElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLAudioElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLAudioElement, Base>(exec, &JSHTMLAudioElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLAudioElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLAudioElement* domObject = static_cast<JSHTMLAudioElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.h
index bb3e51d..36a6ff9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.h
@@ -35,6 +35,7 @@ public:
     JSHTMLAudioElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLAudioElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.cpp
index 3cac476..e468422 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.cpp
@@ -71,6 +71,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLBRElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -87,6 +88,11 @@ bool JSHTMLBRElementConstructor::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSHTMLBRElementConstructor, DOMObject>(exec, &JSHTMLBRElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLBRElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLBRElementConstructor, DOMObject>(exec, &JSHTMLBRElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLBRElementPrototypeTableValues[1] =
@@ -125,6 +131,11 @@ bool JSHTMLBRElement::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSHTMLBRElement, Base>(exec, &JSHTMLBRElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLBRElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLBRElement, Base>(exec, &JSHTMLBRElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLBRElementClear(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLBRElement* castedThis = static_cast<JSHTMLBRElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.h
index d6b124b..5fb1337 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLBRElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLBRElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.cpp
index 10e393c..8430c51 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.cpp
@@ -72,6 +72,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLBaseElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -88,6 +89,11 @@ bool JSHTMLBaseElementConstructor::getOwnPropertySlot(ExecState* exec, const Ide
     return getStaticValueSlot<JSHTMLBaseElementConstructor, DOMObject>(exec, &JSHTMLBaseElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLBaseElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLBaseElementConstructor, DOMObject>(exec, &JSHTMLBaseElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLBaseElementPrototypeTableValues[1] =
@@ -126,6 +132,11 @@ bool JSHTMLBaseElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSHTMLBaseElement, Base>(exec, &JSHTMLBaseElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLBaseElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLBaseElement, Base>(exec, &JSHTMLBaseElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLBaseElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLBaseElement* castedThis = static_cast<JSHTMLBaseElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.h
index 0064963..5f83f5a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLBaseElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLBaseElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.cpp
index 277770b..dcb1114 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.cpp
@@ -74,6 +74,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLBaseFontElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -90,6 +91,11 @@ bool JSHTMLBaseFontElementConstructor::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSHTMLBaseFontElementConstructor, DOMObject>(exec, &JSHTMLBaseFontElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLBaseFontElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLBaseFontElementConstructor, DOMObject>(exec, &JSHTMLBaseFontElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLBaseFontElementPrototypeTableValues[1] =
@@ -128,6 +134,11 @@ bool JSHTMLBaseFontElement::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSHTMLBaseFontElement, Base>(exec, &JSHTMLBaseFontElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLBaseFontElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLBaseFontElement, Base>(exec, &JSHTMLBaseFontElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLBaseFontElementColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLBaseFontElement* castedThis = static_cast<JSHTMLBaseFontElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.h
index fcaa363..55cdf82 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLBaseFontElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLBaseFontElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.cpp
index bdf10b7..11c118a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.cpp
@@ -71,6 +71,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLBlockquoteElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -87,6 +88,11 @@ bool JSHTMLBlockquoteElementConstructor::getOwnPropertySlot(ExecState* exec, con
     return getStaticValueSlot<JSHTMLBlockquoteElementConstructor, DOMObject>(exec, &JSHTMLBlockquoteElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLBlockquoteElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLBlockquoteElementConstructor, DOMObject>(exec, &JSHTMLBlockquoteElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLBlockquoteElementPrototypeTableValues[1] =
@@ -125,6 +131,11 @@ bool JSHTMLBlockquoteElement::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSHTMLBlockquoteElement, Base>(exec, &JSHTMLBlockquoteElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLBlockquoteElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLBlockquoteElement, Base>(exec, &JSHTMLBlockquoteElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLBlockquoteElementCite(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLBlockquoteElement* castedThis = static_cast<JSHTMLBlockquoteElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.h
index a2046b3..fbd66c3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLBlockquoteElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLBlockquoteElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.cpp
index 7628bd6..9933687 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.cpp
@@ -39,7 +39,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLBodyElement);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLBodyElementTableValues[15] =
+static const HashTableValue JSHTMLBodyElementTableValues[16] =
 {
     { "aLink", DontDelete, (intptr_t)jsHTMLBodyElementALink, (intptr_t)setJSHTMLBodyElementALink },
     { "background", DontDelete, (intptr_t)jsHTMLBodyElementBackground, (intptr_t)setJSHTMLBodyElementBackground },
@@ -48,6 +48,7 @@ static const HashTableValue JSHTMLBodyElementTableValues[15] =
     { "text", DontDelete, (intptr_t)jsHTMLBodyElementText, (intptr_t)setJSHTMLBodyElementText },
     { "vLink", DontDelete, (intptr_t)jsHTMLBodyElementVLink, (intptr_t)setJSHTMLBodyElementVLink },
     { "onbeforeunload", DontDelete|DontEnum, (intptr_t)jsHTMLBodyElementOnbeforeunload, (intptr_t)setJSHTMLBodyElementOnbeforeunload },
+    { "onhashchange", DontDelete|DontEnum, (intptr_t)jsHTMLBodyElementOnhashchange, (intptr_t)setJSHTMLBodyElementOnhashchange },
     { "onmessage", DontDelete|DontEnum, (intptr_t)jsHTMLBodyElementOnmessage, (intptr_t)setJSHTMLBodyElementOnmessage },
     { "onoffline", DontDelete|DontEnum, (intptr_t)jsHTMLBodyElementOnoffline, (intptr_t)setJSHTMLBodyElementOnoffline },
     { "ononline", DontDelete|DontEnum, (intptr_t)jsHTMLBodyElementOnonline, (intptr_t)setJSHTMLBodyElementOnonline },
@@ -62,7 +63,7 @@ static JSC_CONST_HASHTABLE HashTable JSHTMLBodyElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 63, JSHTMLBodyElementTableValues, 0 };
 #else
-    { 34, 31, JSHTMLBodyElementTableValues, 0 };
+    { 35, 31, JSHTMLBodyElementTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -87,6 +88,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLBodyElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -103,6 +105,11 @@ bool JSHTMLBodyElementConstructor::getOwnPropertySlot(ExecState* exec, const Ide
     return getStaticValueSlot<JSHTMLBodyElementConstructor, DOMObject>(exec, &JSHTMLBodyElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLBodyElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLBodyElementConstructor, DOMObject>(exec, &JSHTMLBodyElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLBodyElementPrototypeTableValues[1] =
@@ -141,6 +148,11 @@ bool JSHTMLBodyElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSHTMLBodyElement, Base>(exec, &JSHTMLBodyElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLBodyElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLBodyElement, Base>(exec, &JSHTMLBodyElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLBodyElementALink(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()));
@@ -201,6 +213,18 @@ JSValue jsHTMLBodyElementOnbeforeunload(ExecState* exec, const Identifier&, cons
     return jsNull();
 }
 
+JSValue jsHTMLBodyElementOnhashchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(castedThis->impl());
+    if (EventListener* listener = imp->onhashchange()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
 JSValue jsHTMLBodyElementOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()));
@@ -329,6 +353,16 @@ void setJSHTMLBodyElementOnbeforeunload(ExecState* exec, JSObject* thisObject, J
     imp->setOnbeforeunload(globalObject->createJSAttributeEventListener(value));
 }
 
+void setJSHTMLBodyElementOnhashchange(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnhashchange(globalObject->createJSAttributeEventListener(value));
+}
+
 void setJSHTMLBodyElementOnmessage(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.h
index 706a3c4..4ea4bf7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLBodyElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLBodyElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -71,6 +72,8 @@ JSC::JSValue jsHTMLBodyElementVLink(JSC::ExecState*, const JSC::Identifier&, con
 void setJSHTMLBodyElementVLink(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLBodyElementOnbeforeunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSHTMLBodyElementOnbeforeunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBodyElementOnhashchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBodyElementOnhashchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLBodyElementOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSHTMLBodyElementOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLBodyElementOnoffline(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.cpp
index c0c7322..7bb9836 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.cpp
@@ -39,9 +39,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLButtonElement);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLButtonElementTableValues[11] =
+static const HashTableValue JSHTMLButtonElementTableValues[12] =
 {
     { "form", DontDelete|ReadOnly, (intptr_t)jsHTMLButtonElementForm, (intptr_t)0 },
+    { "formNoValidate", DontDelete, (intptr_t)jsHTMLButtonElementFormNoValidate, (intptr_t)setJSHTMLButtonElementFormNoValidate },
     { "validity", DontDelete|ReadOnly, (intptr_t)jsHTMLButtonElementValidity, (intptr_t)0 },
     { "accessKey", DontDelete, (intptr_t)jsHTMLButtonElementAccessKey, (intptr_t)setJSHTMLButtonElementAccessKey },
     { "disabled", DontDelete, (intptr_t)jsHTMLButtonElementDisabled, (intptr_t)setJSHTMLButtonElementDisabled },
@@ -58,7 +59,7 @@ static JSC_CONST_HASHTABLE HashTable JSHTMLButtonElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 127, JSHTMLButtonElementTableValues, 0 };
 #else
-    { 33, 31, JSHTMLButtonElementTableValues, 0 };
+    { 34, 31, JSHTMLButtonElementTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -83,6 +84,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLButtonElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -99,19 +101,26 @@ bool JSHTMLButtonElementConstructor::getOwnPropertySlot(ExecState* exec, const I
     return getStaticValueSlot<JSHTMLButtonElementConstructor, DOMObject>(exec, &JSHTMLButtonElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLButtonElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLButtonElementConstructor, DOMObject>(exec, &JSHTMLButtonElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
-static const HashTableValue JSHTMLButtonElementPrototypeTableValues[2] =
+static const HashTableValue JSHTMLButtonElementPrototypeTableValues[4] =
 {
+    { "checkValidity", DontDelete|Function, (intptr_t)jsHTMLButtonElementPrototypeFunctionCheckValidity, (intptr_t)0 },
+    { "setCustomValidity", DontDelete|Function, (intptr_t)jsHTMLButtonElementPrototypeFunctionSetCustomValidity, (intptr_t)1 },
     { "click", DontDelete|Function, (intptr_t)jsHTMLButtonElementPrototypeFunctionClick, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSHTMLButtonElementPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSHTMLButtonElementPrototypeTableValues, 0 };
+    { 7, JSHTMLButtonElementPrototypeTableValues, 0 };
 #else
-    { 2, 1, JSHTMLButtonElementPrototypeTableValues, 0 };
+    { 8, 7, JSHTMLButtonElementPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSHTMLButtonElementPrototype::s_info = { "HTMLButtonElementPrototype", 0, &JSHTMLButtonElementPrototypeTable, 0 };
@@ -126,6 +135,11 @@ bool JSHTMLButtonElementPrototype::getOwnPropertySlot(ExecState* exec, const Ide
     return getStaticFunctionSlot<JSObject>(exec, &JSHTMLButtonElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSHTMLButtonElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSHTMLButtonElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSHTMLButtonElement::s_info = { "HTMLButtonElement", &JSHTMLElement::s_info, &JSHTMLButtonElementTable, 0 };
 
 JSHTMLButtonElement::JSHTMLButtonElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLButtonElement> impl)
@@ -143,6 +157,11 @@ bool JSHTMLButtonElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLButtonElement, Base>(exec, &JSHTMLButtonElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLButtonElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLButtonElement, Base>(exec, &JSHTMLButtonElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLButtonElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLButtonElement* castedThis = static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()));
@@ -151,6 +170,14 @@ JSValue jsHTMLButtonElementForm(ExecState* exec, const Identifier&, const Proper
     return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->form()));
 }
 
+JSValue jsHTMLButtonElementFormNoValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSHTMLButtonElement* castedThis = static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(castedThis->impl());
+    return jsBoolean(imp->formNoValidate());
+}
+
 JSValue jsHTMLButtonElementValidity(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLButtonElement* castedThis = static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()));
@@ -225,6 +252,12 @@ void JSHTMLButtonElement::put(ExecState* exec, const Identifier& propertyName, J
     lookupPut<JSHTMLButtonElement, Base>(exec, propertyName, value, &JSHTMLButtonElementTable, this, slot);
 }
 
+void setJSHTMLButtonElementFormNoValidate(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(thisObject)->impl());
+    imp->setFormNoValidate(value.toBoolean(exec));
+}
+
 void setJSHTMLButtonElementAccessKey(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(thisObject)->impl());
@@ -260,10 +293,36 @@ JSValue JSHTMLButtonElement::getConstructor(ExecState* exec, JSGlobalObject* glo
     return getDOMConstructor<JSHTMLButtonElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
+JSValue JSC_HOST_CALL jsHTMLButtonElementPrototypeFunctionCheckValidity(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSHTMLButtonElement::s_info))
+        return throwError(exec, TypeError);
+    JSHTMLButtonElement* castedThisObj = static_cast<JSHTMLButtonElement*>(asObject(thisValue));
+    HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsBoolean(imp->checkValidity());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsHTMLButtonElementPrototypeFunctionSetCustomValidity(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSHTMLButtonElement::s_info))
+        return throwError(exec, TypeError);
+    JSHTMLButtonElement* castedThisObj = static_cast<JSHTMLButtonElement*>(asObject(thisValue));
+    HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(castedThisObj->impl());
+    const UString& error = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
+
+    imp->setCustomValidity(error);
+    return jsUndefined();
+}
+
 JSValue JSC_HOST_CALL jsHTMLButtonElementPrototypeFunctionClick(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLButtonElement::s_info))
+    if (!thisValue.inherits(&JSHTMLButtonElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLButtonElement* castedThisObj = static_cast<JSHTMLButtonElement*>(asObject(thisValue));
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.h
index 9fa59ff..7dca4bf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLButtonElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLButtonElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -53,19 +54,24 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSHTMLButtonElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
 
 // Functions
 
+JSC::JSValue JSC_HOST_CALL jsHTMLButtonElementPrototypeFunctionCheckValidity(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLButtonElementPrototypeFunctionSetCustomValidity(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsHTMLButtonElementPrototypeFunctionClick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
 JSC::JSValue jsHTMLButtonElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLButtonElementFormNoValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLButtonElementFormNoValidate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLButtonElementValidity(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsHTMLButtonElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSHTMLButtonElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.cpp
index 5c5533f..579e22e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.cpp
@@ -74,6 +74,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLCanvasElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -90,6 +91,11 @@ bool JSHTMLCanvasElementConstructor::getOwnPropertySlot(ExecState* exec, const I
     return getStaticValueSlot<JSHTMLCanvasElementConstructor, DOMObject>(exec, &JSHTMLCanvasElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLCanvasElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLCanvasElementConstructor, DOMObject>(exec, &JSHTMLCanvasElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLCanvasElementPrototypeTableValues[3] =
@@ -118,6 +124,11 @@ bool JSHTMLCanvasElementPrototype::getOwnPropertySlot(ExecState* exec, const Ide
     return getStaticFunctionSlot<JSObject>(exec, &JSHTMLCanvasElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSHTMLCanvasElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSHTMLCanvasElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSHTMLCanvasElement::s_info = { "HTMLCanvasElement", &JSHTMLElement::s_info, &JSHTMLCanvasElementTable, 0 };
 
 JSHTMLCanvasElement::JSHTMLCanvasElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLCanvasElement> impl)
@@ -135,6 +146,11 @@ bool JSHTMLCanvasElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLCanvasElement, Base>(exec, &JSHTMLCanvasElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLCanvasElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLCanvasElement, Base>(exec, &JSHTMLCanvasElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLCanvasElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLCanvasElement* castedThis = static_cast<JSHTMLCanvasElement*>(asObject(slot.slotBase()));
@@ -181,7 +197,7 @@ JSValue JSHTMLCanvasElement::getConstructor(ExecState* exec, JSGlobalObject* glo
 JSValue JSC_HOST_CALL jsHTMLCanvasElementPrototypeFunctionToDataURL(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLCanvasElement::s_info))
+    if (!thisValue.inherits(&JSHTMLCanvasElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLCanvasElement* castedThisObj = static_cast<JSHTMLCanvasElement*>(asObject(thisValue));
     HTMLCanvasElement* imp = static_cast<HTMLCanvasElement*>(castedThisObj->impl());
@@ -197,7 +213,7 @@ JSValue JSC_HOST_CALL jsHTMLCanvasElementPrototypeFunctionToDataURL(ExecState* e
 JSValue JSC_HOST_CALL jsHTMLCanvasElementPrototypeFunctionGetContext(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLCanvasElement::s_info))
+    if (!thisValue.inherits(&JSHTMLCanvasElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLCanvasElement* castedThisObj = static_cast<JSHTMLCanvasElement*>(asObject(thisValue));
     HTMLCanvasElement* imp = static_cast<HTMLCanvasElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.h
index 5ccb23a..31c2ada 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLCanvasElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLCanvasElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -42,6 +43,8 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
+    virtual void markChildren(JSC::MarkStack&);
+
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 };
 
@@ -53,6 +56,7 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp
index b0ac470..b93fb61 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp
@@ -77,6 +77,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLCollectionPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -93,6 +94,11 @@ bool JSHTMLCollectionConstructor::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticValueSlot<JSHTMLCollectionConstructor, DOMObject>(exec, &JSHTMLCollectionConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLCollectionConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLCollectionConstructor, DOMObject>(exec, &JSHTMLCollectionConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLCollectionPrototypeTableValues[4] =
@@ -122,6 +128,11 @@ bool JSHTMLCollectionPrototype::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticFunctionSlot<JSObject>(exec, &JSHTMLCollectionPrototypeTable, this, propertyName, slot);
 }
 
+bool JSHTMLCollectionPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSHTMLCollectionPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSHTMLCollection::s_info = { "HTMLCollection", 0, &JSHTMLCollectionTable, 0 };
 
 JSHTMLCollection::JSHTMLCollection(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLCollection> impl)
@@ -164,6 +175,36 @@ bool JSHTMLCollection::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSHTMLCollection, Base>(exec, &JSHTMLCollectionTable, this, propertyName, slot);
 }
 
+bool JSHTMLCollection::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    JSValue proto = prototype();
+    if (proto.isObject() && static_cast<JSObject*>(asObject(proto))->hasProperty(exec, propertyName))
+        return false;
+
+    const HashEntry* entry = JSHTMLCollectionTable.entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        slot.setCustom(this, entry->propertyGetter());
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<HTMLCollection*>(impl())->length()) {
+        PropertySlot slot;
+        slot.setCustomIndex(this, index, indexGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly);
+        return true;
+    }
+    if (canGetItemsForName(exec, static_cast<HTMLCollection*>(impl()), propertyName)) {
+        PropertySlot slot;
+        slot.setCustom(this, nameGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    return getStaticValueDescriptor<JSHTMLCollection, Base>(exec, &JSHTMLCollectionTable, this, propertyName, descriptor);
+}
+
 bool JSHTMLCollection::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
 {
     if (propertyName < static_cast<HTMLCollection*>(impl())->length()) {
@@ -186,11 +227,11 @@ JSValue jsHTMLCollectionConstructor(ExecState* exec, const Identifier&, const Pr
     JSHTMLCollection* domObject = static_cast<JSHTMLCollection*>(asObject(slot.slotBase()));
     return JSHTMLCollection::getConstructor(exec, domObject->globalObject());
 }
-void JSHTMLCollection::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSHTMLCollection::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     for (unsigned i = 0; i < static_cast<HTMLCollection*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getPropertyNames(exec, propertyNames, listedAttributes);
+     Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 JSValue JSHTMLCollection::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -201,7 +242,7 @@ JSValue JSHTMLCollection::getConstructor(ExecState* exec, JSGlobalObject* global
 JSValue JSC_HOST_CALL jsHTMLCollectionPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLCollection::s_info))
+    if (!thisValue.inherits(&JSHTMLCollection::s_info))
         return throwError(exec, TypeError);
     JSHTMLCollection* castedThisObj = static_cast<JSHTMLCollection*>(asObject(thisValue));
     return castedThisObj->item(exec, args);
@@ -210,7 +251,7 @@ JSValue JSC_HOST_CALL jsHTMLCollectionPrototypeFunctionItem(ExecState* exec, JSO
 JSValue JSC_HOST_CALL jsHTMLCollectionPrototypeFunctionNamedItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLCollection::s_info))
+    if (!thisValue.inherits(&JSHTMLCollection::s_info))
         return throwError(exec, TypeError);
     JSHTMLCollection* castedThisObj = static_cast<JSHTMLCollection*>(asObject(thisValue));
     return castedThisObj->namedItem(exec, args);
@@ -219,7 +260,7 @@ JSValue JSC_HOST_CALL jsHTMLCollectionPrototypeFunctionNamedItem(ExecState* exec
 JSValue JSC_HOST_CALL jsHTMLCollectionPrototypeFunctionTags(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLCollection::s_info))
+    if (!thisValue.inherits(&JSHTMLCollection::s_info))
         return throwError(exec, TypeError);
     JSHTMLCollection* castedThisObj = static_cast<JSHTMLCollection*>(asObject(thisValue));
     HTMLCollection* imp = static_cast<HTMLCollection*>(castedThisObj->impl());
@@ -238,7 +279,7 @@ JSValue JSHTMLCollection::indexGetter(ExecState* exec, const Identifier&, const
 }
 HTMLCollection* toHTMLCollection(JSC::JSValue value)
 {
-    return value.isObject(&JSHTMLCollection::s_info) ? static_cast<JSHTMLCollection*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSHTMLCollection::s_info) ? static_cast<JSHTMLCollection*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.h
index c5f7ff2..3e513cf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.h
@@ -38,6 +38,7 @@ public:
     virtual ~JSHTMLCollection();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -49,7 +50,7 @@ public:
 
     virtual JSC::CallType getCallData(JSC::CallData&);
 
-    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 
     // Custom functions
@@ -75,9 +76,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSHTMLCollectionPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.cpp
index 3e7c701..ee57717 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.cpp
@@ -68,6 +68,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLDListElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -84,6 +85,11 @@ bool JSHTMLDListElementConstructor::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSHTMLDListElementConstructor, DOMObject>(exec, &JSHTMLDListElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLDListElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLDListElementConstructor, DOMObject>(exec, &JSHTMLDListElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLDListElementPrototypeTableValues[1] =
@@ -122,6 +128,11 @@ bool JSHTMLDListElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLDListElement, Base>(exec, &JSHTMLDListElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLDListElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLDListElement, Base>(exec, &JSHTMLDListElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLDListElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLDListElement* castedThis = static_cast<JSHTMLDListElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.h
index ea25315..7e7f6a9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLDListElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLDListElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.cpp
index 91b63d8..14725e5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.cpp
@@ -78,6 +78,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLDataGridCellElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -94,6 +95,11 @@ bool JSHTMLDataGridCellElementConstructor::getOwnPropertySlot(ExecState* exec, c
     return getStaticValueSlot<JSHTMLDataGridCellElementConstructor, DOMObject>(exec, &JSHTMLDataGridCellElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLDataGridCellElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLDataGridCellElementConstructor, DOMObject>(exec, &JSHTMLDataGridCellElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLDataGridCellElementPrototypeTableValues[1] =
@@ -132,6 +138,11 @@ bool JSHTMLDataGridCellElement::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSHTMLDataGridCellElement, Base>(exec, &JSHTMLDataGridCellElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLDataGridCellElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLDataGridCellElement, Base>(exec, &JSHTMLDataGridCellElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLDataGridCellElementLabel(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLDataGridCellElement* castedThis = static_cast<JSHTMLDataGridCellElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.h
index 05496ea..6a29895 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.h
@@ -35,6 +35,7 @@ public:
     JSHTMLDataGridCellElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLDataGridCellElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.cpp
index 7ecccbc..c82bb46 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.cpp
@@ -78,6 +78,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLDataGridColElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -94,6 +95,11 @@ bool JSHTMLDataGridColElementConstructor::getOwnPropertySlot(ExecState* exec, co
     return getStaticValueSlot<JSHTMLDataGridColElementConstructor, DOMObject>(exec, &JSHTMLDataGridColElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLDataGridColElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLDataGridColElementConstructor, DOMObject>(exec, &JSHTMLDataGridColElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLDataGridColElementPrototypeTableValues[1] =
@@ -132,6 +138,11 @@ bool JSHTMLDataGridColElement::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticValueSlot<JSHTMLDataGridColElement, Base>(exec, &JSHTMLDataGridColElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLDataGridColElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLDataGridColElement, Base>(exec, &JSHTMLDataGridColElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLDataGridColElementLabel(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLDataGridColElement* castedThis = static_cast<JSHTMLDataGridColElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.h
index bb21910..f35d266 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.h
@@ -35,6 +35,7 @@ public:
     JSHTMLDataGridColElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLDataGridColElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.cpp
index 8da3253..3f0a822 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.cpp
@@ -77,6 +77,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLDataGridElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -93,6 +94,11 @@ bool JSHTMLDataGridElementConstructor::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSHTMLDataGridElementConstructor, DOMObject>(exec, &JSHTMLDataGridElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLDataGridElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLDataGridElementConstructor, DOMObject>(exec, &JSHTMLDataGridElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLDataGridElementPrototypeTableValues[1] =
@@ -131,6 +137,11 @@ bool JSHTMLDataGridElement::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSHTMLDataGridElement, Base>(exec, &JSHTMLDataGridElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLDataGridElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLDataGridElement, Base>(exec, &JSHTMLDataGridElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLDataGridElementDataSource(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLDataGridElement* castedThis = static_cast<JSHTMLDataGridElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.h
index bec8e23..b660b7d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.h
@@ -35,6 +35,7 @@ public:
     JSHTMLDataGridElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLDataGridElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.cpp
index af98411..0a77dfa 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.cpp
@@ -73,6 +73,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLDataGridRowElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -89,6 +90,11 @@ bool JSHTMLDataGridRowElementConstructor::getOwnPropertySlot(ExecState* exec, co
     return getStaticValueSlot<JSHTMLDataGridRowElementConstructor, DOMObject>(exec, &JSHTMLDataGridRowElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLDataGridRowElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLDataGridRowElementConstructor, DOMObject>(exec, &JSHTMLDataGridRowElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLDataGridRowElementPrototypeTableValues[1] =
@@ -127,6 +133,11 @@ bool JSHTMLDataGridRowElement::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticValueSlot<JSHTMLDataGridRowElement, Base>(exec, &JSHTMLDataGridRowElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLDataGridRowElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLDataGridRowElement, Base>(exec, &JSHTMLDataGridRowElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLDataGridRowElementSelected(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLDataGridRowElement* castedThis = static_cast<JSHTMLDataGridRowElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.h
index c7f77dd..bc1faf7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.h
@@ -35,6 +35,7 @@ public:
     JSHTMLDataGridRowElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLDataGridRowElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataListElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataListElement.cpp
new file mode 100644
index 0000000..b144137
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataListElement.cpp
@@ -0,0 +1,162 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(DATALIST)
+
+#include "JSHTMLDataListElement.h"
+
+#include "HTMLCollection.h"
+#include "HTMLDataListElement.h"
+#include "JSHTMLCollection.h"
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLDataListElement);
+
+/* Hash table */
+
+static const HashTableValue JSHTMLDataListElementTableValues[3] =
+{
+    { "options", DontDelete|ReadOnly, (intptr_t)jsHTMLDataListElementOptions, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLDataListElementConstructor, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSHTMLDataListElementTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 1, JSHTMLDataListElementTableValues, 0 };
+#else
+    { 4, 3, JSHTMLDataListElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSHTMLDataListElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSHTMLDataListElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSHTMLDataListElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSHTMLDataListElementConstructorTableValues, 0 };
+#endif
+
+class JSHTMLDataListElementConstructor : public DOMConstructorObject {
+public:
+    JSHTMLDataListElementConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSHTMLDataListElementConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSHTMLDataListElementPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+    }
+};
+
+const ClassInfo JSHTMLDataListElementConstructor::s_info = { "HTMLDataListElementConstructor", 0, &JSHTMLDataListElementConstructorTable, 0 };
+
+bool JSHTMLDataListElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSHTMLDataListElementConstructor, DOMObject>(exec, &JSHTMLDataListElementConstructorTable, this, propertyName, slot);
+}
+
+bool JSHTMLDataListElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLDataListElementConstructor, DOMObject>(exec, &JSHTMLDataListElementConstructorTable, this, propertyName, descriptor);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSHTMLDataListElementPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSHTMLDataListElementPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSHTMLDataListElementPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSHTMLDataListElementPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSHTMLDataListElementPrototype::s_info = { "HTMLDataListElementPrototype", 0, &JSHTMLDataListElementPrototypeTable, 0 };
+
+JSObject* JSHTMLDataListElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSHTMLDataListElement>(exec, globalObject);
+}
+
+const ClassInfo JSHTMLDataListElement::s_info = { "HTMLDataListElement", &JSHTMLElement::s_info, &JSHTMLDataListElementTable, 0 };
+
+JSHTMLDataListElement::JSHTMLDataListElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLDataListElement> impl)
+    : JSHTMLElement(structure, globalObject, impl)
+{
+}
+
+JSObject* JSHTMLDataListElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSHTMLDataListElementPrototype(JSHTMLDataListElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
+}
+
+bool JSHTMLDataListElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSHTMLDataListElement, Base>(exec, &JSHTMLDataListElementTable, this, propertyName, slot);
+}
+
+bool JSHTMLDataListElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLDataListElement, Base>(exec, &JSHTMLDataListElementTable, this, propertyName, descriptor);
+}
+
+JSValue jsHTMLDataListElementOptions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSHTMLDataListElement* castedThis = static_cast<JSHTMLDataListElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    HTMLDataListElement* imp = static_cast<HTMLDataListElement*>(castedThis->impl());
+    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->options()));
+}
+
+JSValue jsHTMLDataListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSHTMLDataListElement* domObject = static_cast<JSHTMLDataListElement*>(asObject(slot.slotBase()));
+    return JSHTMLDataListElement::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSHTMLDataListElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSHTMLDataListElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
+
+}
+
+#endif // ENABLE(DATALIST)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDefinitionSrcElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataListElement.h
index 2afb3e9..3556d11 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDefinitionSrcElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataListElement.h
@@ -18,41 +18,52 @@
     Boston, MA 02110-1301, USA.
 */
 
-#ifndef JSSVGDefinitionSrcElement_h
-#define JSSVGDefinitionSrcElement_h
+#ifndef JSHTMLDataListElement_h
+#define JSHTMLDataListElement_h
 
-#if ENABLE(SVG) && ENABLE(SVG_FONTS)
+#if ENABLE(DATALIST)
 
-#include "JSSVGElement.h"
-#include "SVGElement.h"
+#include "JSHTMLElement.h"
 
 namespace WebCore {
 
-class SVGDefinitionSrcElement;
+class HTMLDataListElement;
 
-class JSSVGDefinitionSrcElement : public JSSVGElement {
-    typedef JSSVGElement Base;
+class JSHTMLDataListElement : public JSHTMLElement {
+    typedef JSHTMLElement Base;
 public:
-    JSSVGDefinitionSrcElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGDefinitionSrcElement>);
+    JSHTMLDataListElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLDataListElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 };
 
 
-class JSSVGDefinitionSrcElementPrototype : public JSC::JSObject {
+class JSHTMLDataListElementPrototype : public JSC::JSObject {
     typedef JSC::JSObject Base;
 public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
-    JSSVGDefinitionSrcElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+    JSHTMLDataListElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
 
+// Attributes
+
+JSC::JSValue jsHTMLDataListElementOptions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDataListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FONTS)
+#endif // ENABLE(DATALIST)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.cpp
index a6d86c0..d7c9643 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.cpp
@@ -68,6 +68,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLDirectoryElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -84,6 +85,11 @@ bool JSHTMLDirectoryElementConstructor::getOwnPropertySlot(ExecState* exec, cons
     return getStaticValueSlot<JSHTMLDirectoryElementConstructor, DOMObject>(exec, &JSHTMLDirectoryElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLDirectoryElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLDirectoryElementConstructor, DOMObject>(exec, &JSHTMLDirectoryElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLDirectoryElementPrototypeTableValues[1] =
@@ -122,6 +128,11 @@ bool JSHTMLDirectoryElement::getOwnPropertySlot(ExecState* exec, const Identifie
     return getStaticValueSlot<JSHTMLDirectoryElement, Base>(exec, &JSHTMLDirectoryElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLDirectoryElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLDirectoryElement, Base>(exec, &JSHTMLDirectoryElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLDirectoryElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLDirectoryElement* castedThis = static_cast<JSHTMLDirectoryElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.h
index 675587c..9b7dc7e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLDirectoryElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLDirectoryElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.cpp
index 15153e1..b97aeac 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.cpp
@@ -70,6 +70,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLDivElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -86,6 +87,11 @@ bool JSHTMLDivElementConstructor::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticValueSlot<JSHTMLDivElementConstructor, DOMObject>(exec, &JSHTMLDivElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLDivElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLDivElementConstructor, DOMObject>(exec, &JSHTMLDivElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLDivElementPrototypeTableValues[1] =
@@ -124,6 +130,11 @@ bool JSHTMLDivElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSHTMLDivElement, Base>(exec, &JSHTMLDivElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLDivElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLDivElement, Base>(exec, &JSHTMLDivElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLDivElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLDivElement* castedThis = static_cast<JSHTMLDivElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.h
index eeaa89b..98e2426 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLDivElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLDivElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.cpp
index f7c3859..caf3cab 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.cpp
@@ -91,6 +91,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLDocumentPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -107,6 +108,11 @@ bool JSHTMLDocumentConstructor::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSHTMLDocumentConstructor, DOMObject>(exec, &JSHTMLDocumentConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLDocumentConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLDocumentConstructor, DOMObject>(exec, &JSHTMLDocumentConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLDocumentPrototypeTableValues[9] =
@@ -141,6 +147,11 @@ bool JSHTMLDocumentPrototype::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticFunctionSlot<JSObject>(exec, &JSHTMLDocumentPrototypeTable, this, propertyName, slot);
 }
 
+bool JSHTMLDocumentPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSHTMLDocumentPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSHTMLDocument::s_info = { "HTMLDocument", &JSDocument::s_info, &JSHTMLDocumentTable, 0 };
 
 JSHTMLDocument::JSHTMLDocument(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLDocument> impl)
@@ -162,6 +173,17 @@ bool JSHTMLDocument::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSHTMLDocument, Base>(exec, &JSHTMLDocumentTable, this, propertyName, slot);
 }
 
+bool JSHTMLDocument::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    if (canGetItemsForName(exec, static_cast<HTMLDocument*>(impl()), propertyName)) {
+        PropertySlot slot;
+        slot.setCustom(this, nameGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    return getStaticValueDescriptor<JSHTMLDocument, Base>(exec, &JSHTMLDocumentTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLDocumentEmbeds(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLDocument* castedThis = static_cast<JSHTMLDocument*>(asObject(slot.slotBase()));
@@ -345,7 +367,7 @@ JSValue JSHTMLDocument::getConstructor(ExecState* exec, JSGlobalObject* globalOb
 JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionOpen(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLDocument::s_info))
+    if (!thisValue.inherits(&JSHTMLDocument::s_info))
         return throwError(exec, TypeError);
     JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(asObject(thisValue));
     return castedThisObj->open(exec, args);
@@ -354,7 +376,7 @@ JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionOpen(ExecState* exec, JSObj
 JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionClose(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLDocument::s_info))
+    if (!thisValue.inherits(&JSHTMLDocument::s_info))
         return throwError(exec, TypeError);
     JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(asObject(thisValue));
     HTMLDocument* imp = static_cast<HTMLDocument*>(castedThisObj->impl());
@@ -366,7 +388,7 @@ JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionClose(ExecState* exec, JSOb
 JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionWrite(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLDocument::s_info))
+    if (!thisValue.inherits(&JSHTMLDocument::s_info))
         return throwError(exec, TypeError);
     JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(asObject(thisValue));
     return castedThisObj->write(exec, args);
@@ -375,7 +397,7 @@ JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionWrite(ExecState* exec, JSOb
 JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionWriteln(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLDocument::s_info))
+    if (!thisValue.inherits(&JSHTMLDocument::s_info))
         return throwError(exec, TypeError);
     JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(asObject(thisValue));
     return castedThisObj->writeln(exec, args);
@@ -384,7 +406,7 @@ JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionWriteln(ExecState* exec, JS
 JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLDocument::s_info))
+    if (!thisValue.inherits(&JSHTMLDocument::s_info))
         return throwError(exec, TypeError);
     JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(asObject(thisValue));
     HTMLDocument* imp = static_cast<HTMLDocument*>(castedThisObj->impl());
@@ -396,7 +418,7 @@ JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionClear(ExecState* exec, JSOb
 JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionCaptureEvents(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLDocument::s_info))
+    if (!thisValue.inherits(&JSHTMLDocument::s_info))
         return throwError(exec, TypeError);
     JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(asObject(thisValue));
     HTMLDocument* imp = static_cast<HTMLDocument*>(castedThisObj->impl());
@@ -408,7 +430,7 @@ JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionCaptureEvents(ExecState* ex
 JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionReleaseEvents(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLDocument::s_info))
+    if (!thisValue.inherits(&JSHTMLDocument::s_info))
         return throwError(exec, TypeError);
     JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(asObject(thisValue));
     HTMLDocument* imp = static_cast<HTMLDocument*>(castedThisObj->impl());
@@ -420,7 +442,7 @@ JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionReleaseEvents(ExecState* ex
 JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionHasFocus(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLDocument::s_info))
+    if (!thisValue.inherits(&JSHTMLDocument::s_info))
         return throwError(exec, TypeError);
     JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(asObject(thisValue));
     HTMLDocument* imp = static_cast<HTMLDocument*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.h
index 110c7e4..6fd01a7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.h
@@ -33,6 +33,7 @@ public:
     JSHTMLDocument(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLDocument>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -65,9 +66,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSHTMLDocumentPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.cpp
index 7fe918a..14d7fae 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.cpp
@@ -90,6 +90,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -106,6 +107,11 @@ bool JSHTMLElementConstructor::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticValueSlot<JSHTMLElementConstructor, DOMObject>(exec, &JSHTMLElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLElementConstructor, DOMObject>(exec, &JSHTMLElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLElementPrototypeTableValues[4] =
@@ -135,6 +141,11 @@ bool JSHTMLElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifie
     return getStaticFunctionSlot<JSObject>(exec, &JSHTMLElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSHTMLElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSHTMLElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSHTMLElement::s_info = { "HTMLElement", &JSElement::s_info, &JSHTMLElementTable, 0 };
 
 JSHTMLElement::JSHTMLElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLElement> impl)
@@ -152,6 +163,11 @@ bool JSHTMLElement::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSHTMLElement, Base>(exec, &JSHTMLElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLElement, Base>(exec, &JSHTMLElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLElementId(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLElement* castedThis = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
@@ -362,7 +378,7 @@ JSValue JSHTMLElement::getConstructor(ExecState* exec, JSGlobalObject* globalObj
 JSValue JSC_HOST_CALL jsHTMLElementPrototypeFunctionInsertAdjacentElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLElement::s_info))
+    if (!thisValue.inherits(&JSHTMLElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLElement* castedThisObj = static_cast<JSHTMLElement*>(asObject(thisValue));
     HTMLElement* imp = static_cast<HTMLElement*>(castedThisObj->impl());
@@ -379,7 +395,7 @@ JSValue JSC_HOST_CALL jsHTMLElementPrototypeFunctionInsertAdjacentElement(ExecSt
 JSValue JSC_HOST_CALL jsHTMLElementPrototypeFunctionInsertAdjacentHTML(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLElement::s_info))
+    if (!thisValue.inherits(&JSHTMLElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLElement* castedThisObj = static_cast<JSHTMLElement*>(asObject(thisValue));
     HTMLElement* imp = static_cast<HTMLElement*>(castedThisObj->impl());
@@ -395,7 +411,7 @@ JSValue JSC_HOST_CALL jsHTMLElementPrototypeFunctionInsertAdjacentHTML(ExecState
 JSValue JSC_HOST_CALL jsHTMLElementPrototypeFunctionInsertAdjacentText(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLElement::s_info))
+    if (!thisValue.inherits(&JSHTMLElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLElement* castedThisObj = static_cast<JSHTMLElement*>(asObject(thisValue));
     HTMLElement* imp = static_cast<HTMLElement*>(castedThisObj->impl());
@@ -410,7 +426,7 @@ JSValue JSC_HOST_CALL jsHTMLElementPrototypeFunctionInsertAdjacentText(ExecState
 
 HTMLElement* toHTMLElement(JSC::JSValue value)
 {
-    return value.isObject(&JSHTMLElement::s_info) ? static_cast<JSHTMLElement*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSHTMLElement::s_info) ? static_cast<JSHTMLElement*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.h
index 7675732..7c3fcc2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.h
@@ -34,6 +34,7 @@ public:
     JSHTMLElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -61,9 +62,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSHTMLElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLElementWrapperFactory.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLElementWrapperFactory.cpp
index 1e9dc42..4921ebd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLElementWrapperFactory.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLElementWrapperFactory.cpp
@@ -1,8 +1,9 @@
 /*
- * THIS FILE IS AUTOMATICALLY GENERATED, DO NOT EDIT.
+ * THIS FILE WAS AUTOMATICALLY GENERATED, DO NOT EDIT.
  *
+ * This file was generated by the dom/make_names.pl script.
  *
- * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,10 +24,9 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-
 #include "config.h"
 
 #include "JSHTMLElementWrapperFactory.h"
@@ -44,6 +44,7 @@
 #include "JSHTMLTableCaptionElement.h"
 #include "JSHTMLTableColElement.h"
 #include "JSHTMLDataGridElement.h"
+#include "JSHTMLDataListElement.h"
 #include "JSHTMLDataGridCellElement.h"
 #include "JSHTMLDataGridColElement.h"
 #include "JSHTMLModElement.h"
@@ -111,6 +112,7 @@
 #include "HTMLTableCaptionElement.h"
 #include "HTMLTableColElement.h"
 #include "HTMLDataGridElement.h"
+#include "HTMLDataListElement.h"
 #include "HTMLDataGridCellElement.h"
 #include "HTMLDataGridColElement.h"
 #include "HTMLModElement.h"
@@ -252,6 +254,15 @@ static JSNode* createHTMLDataGridElementWrapper(ExecState* exec, JSDOMGlobalObje
 
 #endif
 
+#if ENABLE(DATALIST)
+
+static JSNode* createHTMLDataListElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, HTMLDataListElement, element.get());
+}
+
+#endif
+
 #if ENABLE(DATAGRID)
 
 static JSNode* createHTMLDataGridCellElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLElement> element)
@@ -545,6 +556,9 @@ JSNode* createJSHTMLWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, Pa
 #if ENABLE(DATAGRID)
        map.set(datagridTag.localName().impl(), createHTMLDataGridElementWrapper);
 #endif
+#if ENABLE(DATALIST)
+       map.set(datalistTag.localName().impl(), createHTMLDataListElementWrapper);
+#endif
 #if ENABLE(DATAGRID)
        map.set(dcellTag.localName().impl(), createHTMLDataGridCellElementWrapper);
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLElementWrapperFactory.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLElementWrapperFactory.h
index 826f4fe..7016db4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLElementWrapperFactory.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLElementWrapperFactory.h
@@ -1,8 +1,9 @@
 /*
- * THIS FILE IS AUTOMATICALLY GENERATED, DO NOT EDIT.
+ * THIS FILE WAS AUTOMATICALLY GENERATED, DO NOT EDIT.
  *
+ * This file was generated by the dom/make_names.pl script.
  *
- * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,10 +24,9 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-
 #ifndef JSHTMLElementWrapperFactory_h
 #define JSHTMLElementWrapperFactory_h
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.cpp
index 430ca1c..5d9ca91 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.cpp
@@ -23,6 +23,7 @@
 
 #include "AtomicString.h"
 #include "HTMLEmbedElement.h"
+#include "HTMLNames.h"
 #include "JSDOMBinding.h"
 #include "JSHTMLEmbedElementCustom.h"
 #include "JSSVGDocument.h"
@@ -81,6 +82,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLEmbedElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -97,6 +99,11 @@ bool JSHTMLEmbedElementConstructor::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSHTMLEmbedElementConstructor, DOMObject>(exec, &JSHTMLEmbedElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLEmbedElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLEmbedElementConstructor, DOMObject>(exec, &JSHTMLEmbedElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLEmbedElementPrototypeTableValues[2] =
@@ -124,6 +131,11 @@ bool JSHTMLEmbedElementPrototype::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticFunctionSlot<JSObject>(exec, &JSHTMLEmbedElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSHTMLEmbedElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSHTMLEmbedElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSHTMLEmbedElement::s_info = { "HTMLEmbedElement", &JSHTMLElement::s_info, &JSHTMLEmbedElementTable, 0 };
 
 JSHTMLEmbedElement::JSHTMLEmbedElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLEmbedElement> impl)
@@ -147,12 +159,25 @@ bool JSHTMLEmbedElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLEmbedElement, Base>(exec, &JSHTMLEmbedElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLEmbedElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    if (canGetItemsForName(exec, static_cast<HTMLEmbedElement*>(impl()), propertyName)) {
+        PropertySlot slot;
+        slot.setCustom(this, nameGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    if (getOwnPropertyDescriptorDelegate(exec, propertyName, descriptor))
+        return true;
+    return getStaticValueDescriptor<JSHTMLEmbedElement, Base>(exec, &JSHTMLEmbedElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLEmbedElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLEmbedElement* castedThis = static_cast<JSHTMLEmbedElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(castedThis->impl());
-    return jsString(exec, imp->align());
+    return jsString(exec, imp->getAttribute(HTMLNames::alignAttr));
 }
 
 JSValue jsHTMLEmbedElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -160,7 +185,7 @@ JSValue jsHTMLEmbedElementHeight(ExecState* exec, const Identifier&, const Prope
     JSHTMLEmbedElement* castedThis = static_cast<JSHTMLEmbedElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(castedThis->impl());
-    return jsString(exec, imp->height());
+    return jsString(exec, imp->getAttribute(HTMLNames::heightAttr));
 }
 
 JSValue jsHTMLEmbedElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -168,7 +193,7 @@ JSValue jsHTMLEmbedElementName(ExecState* exec, const Identifier&, const Propert
     JSHTMLEmbedElement* castedThis = static_cast<JSHTMLEmbedElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(castedThis->impl());
-    return jsString(exec, imp->name());
+    return jsString(exec, imp->getAttribute(HTMLNames::nameAttr));
 }
 
 JSValue jsHTMLEmbedElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -176,7 +201,7 @@ JSValue jsHTMLEmbedElementSrc(ExecState* exec, const Identifier&, const Property
     JSHTMLEmbedElement* castedThis = static_cast<JSHTMLEmbedElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(castedThis->impl());
-    return jsString(exec, imp->src());
+    return jsString(exec, imp->getAttribute(HTMLNames::srcAttr));
 }
 
 JSValue jsHTMLEmbedElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -184,7 +209,7 @@ JSValue jsHTMLEmbedElementType(ExecState* exec, const Identifier&, const Propert
     JSHTMLEmbedElement* castedThis = static_cast<JSHTMLEmbedElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(castedThis->impl());
-    return jsString(exec, imp->type());
+    return jsString(exec, imp->getAttribute(HTMLNames::typeAttr));
 }
 
 JSValue jsHTMLEmbedElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -192,7 +217,7 @@ JSValue jsHTMLEmbedElementWidth(ExecState* exec, const Identifier&, const Proper
     JSHTMLEmbedElement* castedThis = static_cast<JSHTMLEmbedElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(castedThis->impl());
-    return jsString(exec, imp->width());
+    return jsString(exec, imp->getAttribute(HTMLNames::widthAttr));
 }
 
 JSValue jsHTMLEmbedElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -210,37 +235,37 @@ void JSHTMLEmbedElement::put(ExecState* exec, const Identifier& propertyName, JS
 void setJSHTMLEmbedElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(thisObject)->impl());
-    imp->setAlign(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::alignAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLEmbedElementHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(thisObject)->impl());
-    imp->setHeight(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::heightAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLEmbedElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(thisObject)->impl());
-    imp->setName(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::nameAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLEmbedElementSrc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(thisObject)->impl());
-    imp->setSrc(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::srcAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLEmbedElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(thisObject)->impl());
-    imp->setType(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::typeAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLEmbedElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(thisObject)->impl());
-    imp->setWidth(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::widthAttr, valueToStringWithNullCheck(exec, value));
 }
 
 JSValue JSHTMLEmbedElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -251,7 +276,7 @@ JSValue JSHTMLEmbedElement::getConstructor(ExecState* exec, JSGlobalObject* glob
 JSValue JSC_HOST_CALL jsHTMLEmbedElementPrototypeFunctionGetSVGDocument(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLEmbedElement::s_info))
+    if (!thisValue.inherits(&JSHTMLEmbedElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLEmbedElement* castedThisObj = static_cast<JSHTMLEmbedElement*>(asObject(thisValue));
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.h
index 92eb7fe..8730952 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.h
@@ -34,7 +34,9 @@ public:
     JSHTMLEmbedElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLEmbedElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    bool getOwnPropertyDescriptorDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
@@ -61,9 +63,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSHTMLEmbedElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.cpp
index ddf115f..d642323 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.cpp
@@ -26,6 +26,7 @@
 #include "JSHTMLFormElement.h"
 #include "JSValidityState.h"
 #include "ValidityState.h"
+#include <runtime/Error.h>
 #include <wtf/GetPtr.h>
 
 using namespace JSC;
@@ -74,6 +75,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLFieldSetElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -90,18 +92,25 @@ bool JSHTMLFieldSetElementConstructor::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSHTMLFieldSetElementConstructor, DOMObject>(exec, &JSHTMLFieldSetElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLFieldSetElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLFieldSetElementConstructor, DOMObject>(exec, &JSHTMLFieldSetElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
-static const HashTableValue JSHTMLFieldSetElementPrototypeTableValues[1] =
+static const HashTableValue JSHTMLFieldSetElementPrototypeTableValues[3] =
 {
+    { "checkValidity", DontDelete|Function, (intptr_t)jsHTMLFieldSetElementPrototypeFunctionCheckValidity, (intptr_t)0 },
+    { "setCustomValidity", DontDelete|Function, (intptr_t)jsHTMLFieldSetElementPrototypeFunctionSetCustomValidity, (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSHTMLFieldSetElementPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSHTMLFieldSetElementPrototypeTableValues, 0 };
+    { 1, JSHTMLFieldSetElementPrototypeTableValues, 0 };
 #else
-    { 1, 0, JSHTMLFieldSetElementPrototypeTableValues, 0 };
+    { 4, 3, JSHTMLFieldSetElementPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSHTMLFieldSetElementPrototype::s_info = { "HTMLFieldSetElementPrototype", 0, &JSHTMLFieldSetElementPrototypeTable, 0 };
@@ -111,6 +120,16 @@ JSObject* JSHTMLFieldSetElementPrototype::self(ExecState* exec, JSGlobalObject*
     return getDOMPrototype<JSHTMLFieldSetElement>(exec, globalObject);
 }
 
+bool JSHTMLFieldSetElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSHTMLFieldSetElementPrototypeTable, this, propertyName, slot);
+}
+
+bool JSHTMLFieldSetElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSHTMLFieldSetElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSHTMLFieldSetElement::s_info = { "HTMLFieldSetElement", &JSHTMLElement::s_info, &JSHTMLFieldSetElementTable, 0 };
 
 JSHTMLFieldSetElement::JSHTMLFieldSetElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLFieldSetElement> impl)
@@ -128,6 +147,11 @@ bool JSHTMLFieldSetElement::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSHTMLFieldSetElement, Base>(exec, &JSHTMLFieldSetElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLFieldSetElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLFieldSetElement, Base>(exec, &JSHTMLFieldSetElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLFieldSetElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLFieldSetElement* castedThis = static_cast<JSHTMLFieldSetElement*>(asObject(slot.slotBase()));
@@ -162,5 +186,31 @@ JSValue JSHTMLFieldSetElement::getConstructor(ExecState* exec, JSGlobalObject* g
     return getDOMConstructor<JSHTMLFieldSetElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
+JSValue JSC_HOST_CALL jsHTMLFieldSetElementPrototypeFunctionCheckValidity(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSHTMLFieldSetElement::s_info))
+        return throwError(exec, TypeError);
+    JSHTMLFieldSetElement* castedThisObj = static_cast<JSHTMLFieldSetElement*>(asObject(thisValue));
+    HTMLFieldSetElement* imp = static_cast<HTMLFieldSetElement*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsBoolean(imp->checkValidity());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsHTMLFieldSetElementPrototypeFunctionSetCustomValidity(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSHTMLFieldSetElement::s_info))
+        return throwError(exec, TypeError);
+    JSHTMLFieldSetElement* castedThisObj = static_cast<JSHTMLFieldSetElement*>(asObject(thisValue));
+    HTMLFieldSetElement* imp = static_cast<HTMLFieldSetElement*>(castedThisObj->impl());
+    const UString& error = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
+
+    imp->setCustomValidity(error);
+    return jsUndefined();
+}
+
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.h
index d339d21..b2cb1b1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLFieldSetElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLFieldSetElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -51,9 +52,19 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+    }
     JSHTMLFieldSetElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
 
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsHTMLFieldSetElementPrototypeFunctionCheckValidity(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLFieldSetElementPrototypeFunctionSetCustomValidity(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
 JSC::JSValue jsHTMLFieldSetElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.cpp
index 4ed60a2..18100b7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.cpp
@@ -72,6 +72,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLFontElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -88,6 +89,11 @@ bool JSHTMLFontElementConstructor::getOwnPropertySlot(ExecState* exec, const Ide
     return getStaticValueSlot<JSHTMLFontElementConstructor, DOMObject>(exec, &JSHTMLFontElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLFontElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLFontElementConstructor, DOMObject>(exec, &JSHTMLFontElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLFontElementPrototypeTableValues[1] =
@@ -126,6 +132,11 @@ bool JSHTMLFontElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSHTMLFontElement, Base>(exec, &JSHTMLFontElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLFontElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLFontElement, Base>(exec, &JSHTMLFontElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLFontElementColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLFontElement* castedThis = static_cast<JSHTMLFontElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.h
index 6edf8fe..8a46e7d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLFontElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLFontElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.cpp
index e01b1c3..b278f23 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.cpp
@@ -40,11 +40,12 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLFormElement);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLFormElementTableValues[11] =
+static const HashTableValue JSHTMLFormElementTableValues[12] =
 {
     { "elements", DontDelete|ReadOnly, (intptr_t)jsHTMLFormElementElements, (intptr_t)0 },
     { "length", DontDelete|ReadOnly, (intptr_t)jsHTMLFormElementLength, (intptr_t)0 },
     { "name", DontDelete, (intptr_t)jsHTMLFormElementName, (intptr_t)setJSHTMLFormElementName },
+    { "noValidate", DontDelete, (intptr_t)jsHTMLFormElementNoValidate, (intptr_t)setJSHTMLFormElementNoValidate },
     { "acceptCharset", DontDelete, (intptr_t)jsHTMLFormElementAcceptCharset, (intptr_t)setJSHTMLFormElementAcceptCharset },
     { "action", DontDelete, (intptr_t)jsHTMLFormElementAction, (intptr_t)setJSHTMLFormElementAction },
     { "encoding", DontDelete, (intptr_t)jsHTMLFormElementEncoding, (intptr_t)setJSHTMLFormElementEncoding },
@@ -59,7 +60,7 @@ static JSC_CONST_HASHTABLE HashTable JSHTMLFormElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 4095, JSHTMLFormElementTableValues, 0 };
 #else
-    { 34, 31, JSHTMLFormElementTableValues, 0 };
+    { 35, 31, JSHTMLFormElementTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -84,6 +85,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLFormElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -100,20 +102,26 @@ bool JSHTMLFormElementConstructor::getOwnPropertySlot(ExecState* exec, const Ide
     return getStaticValueSlot<JSHTMLFormElementConstructor, DOMObject>(exec, &JSHTMLFormElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLFormElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLFormElementConstructor, DOMObject>(exec, &JSHTMLFormElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
-static const HashTableValue JSHTMLFormElementPrototypeTableValues[3] =
+static const HashTableValue JSHTMLFormElementPrototypeTableValues[4] =
 {
     { "submit", DontDelete|Function, (intptr_t)jsHTMLFormElementPrototypeFunctionSubmit, (intptr_t)0 },
     { "reset", DontDelete|Function, (intptr_t)jsHTMLFormElementPrototypeFunctionReset, (intptr_t)0 },
+    { "checkValidity", DontDelete|Function, (intptr_t)jsHTMLFormElementPrototypeFunctionCheckValidity, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSHTMLFormElementPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 3, JSHTMLFormElementPrototypeTableValues, 0 };
+    { 15, JSHTMLFormElementPrototypeTableValues, 0 };
 #else
-    { 4, 3, JSHTMLFormElementPrototypeTableValues, 0 };
+    { 9, 7, JSHTMLFormElementPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSHTMLFormElementPrototype::s_info = { "HTMLFormElementPrototype", 0, &JSHTMLFormElementPrototypeTable, 0 };
@@ -128,6 +136,11 @@ bool JSHTMLFormElementPrototype::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticFunctionSlot<JSObject>(exec, &JSHTMLFormElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSHTMLFormElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSHTMLFormElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSHTMLFormElement::s_info = { "HTMLFormElement", &JSHTMLElement::s_info, &JSHTMLFormElementTable, 0 };
 
 JSHTMLFormElement::JSHTMLFormElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLFormElement> impl)
@@ -160,6 +173,32 @@ bool JSHTMLFormElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSHTMLFormElement, Base>(exec, &JSHTMLFormElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLFormElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<HTMLFormElement*>(impl())->length()) {
+        PropertySlot slot;
+        slot.setCustomIndex(this, index, indexGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly);
+        return true;
+    }
+    if (canGetItemsForName(exec, static_cast<HTMLFormElement*>(impl()), propertyName)) {
+        PropertySlot slot;
+        slot.setCustom(this, nameGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    const HashEntry* entry = JSHTMLFormElementTable.entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        slot.setCustom(this, entry->propertyGetter());
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+    return getStaticValueDescriptor<JSHTMLFormElement, Base>(exec, &JSHTMLFormElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLFormElementElements(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLFormElement* castedThis = static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()));
@@ -184,6 +223,14 @@ JSValue jsHTMLFormElementName(ExecState* exec, const Identifier&, const Property
     return jsString(exec, imp->name());
 }
 
+JSValue jsHTMLFormElementNoValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSHTMLFormElement* castedThis = static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    HTMLFormElement* imp = static_cast<HTMLFormElement*>(castedThis->impl());
+    return jsBoolean(imp->noValidate());
+}
+
 JSValue jsHTMLFormElementAcceptCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLFormElement* castedThis = static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()));
@@ -248,6 +295,12 @@ void setJSHTMLFormElementName(ExecState* exec, JSObject* thisObject, JSValue val
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
+void setJSHTMLFormElementNoValidate(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(thisObject)->impl());
+    imp->setNoValidate(value.toBoolean(exec));
+}
+
 void setJSHTMLFormElementAcceptCharset(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(thisObject)->impl());
@@ -284,11 +337,11 @@ void setJSHTMLFormElementTarget(ExecState* exec, JSObject* thisObject, JSValue v
     imp->setTarget(valueToStringWithNullCheck(exec, value));
 }
 
-void JSHTMLFormElement::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSHTMLFormElement::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     for (unsigned i = 0; i < static_cast<HTMLFormElement*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getPropertyNames(exec, propertyNames, listedAttributes);
+     Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 JSValue JSHTMLFormElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -299,7 +352,7 @@ JSValue JSHTMLFormElement::getConstructor(ExecState* exec, JSGlobalObject* globa
 JSValue JSC_HOST_CALL jsHTMLFormElementPrototypeFunctionSubmit(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLFormElement::s_info))
+    if (!thisValue.inherits(&JSHTMLFormElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLFormElement* castedThisObj = static_cast<JSHTMLFormElement*>(asObject(thisValue));
     return castedThisObj->submit(exec, args);
@@ -308,7 +361,7 @@ JSValue JSC_HOST_CALL jsHTMLFormElementPrototypeFunctionSubmit(ExecState* exec,
 JSValue JSC_HOST_CALL jsHTMLFormElementPrototypeFunctionReset(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLFormElement::s_info))
+    if (!thisValue.inherits(&JSHTMLFormElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLFormElement* castedThisObj = static_cast<JSHTMLFormElement*>(asObject(thisValue));
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(castedThisObj->impl());
@@ -317,6 +370,19 @@ JSValue JSC_HOST_CALL jsHTMLFormElementPrototypeFunctionReset(ExecState* exec, J
     return jsUndefined();
 }
 
+JSValue JSC_HOST_CALL jsHTMLFormElementPrototypeFunctionCheckValidity(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSHTMLFormElement::s_info))
+        return throwError(exec, TypeError);
+    JSHTMLFormElement* castedThisObj = static_cast<JSHTMLFormElement*>(asObject(thisValue));
+    HTMLFormElement* imp = static_cast<HTMLFormElement*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsBoolean(imp->checkValidity());
+    return result;
+}
+
 
 JSValue JSHTMLFormElement::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.h
index c7be16d..cde3be2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLFormElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLFormElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -42,7 +43,7 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 
     // Custom functions
@@ -61,9 +62,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSHTMLFormElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
@@ -72,12 +74,15 @@ public:
 
 JSC::JSValue JSC_HOST_CALL jsHTMLFormElementPrototypeFunctionSubmit(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsHTMLFormElementPrototypeFunctionReset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLFormElementPrototypeFunctionCheckValidity(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
 JSC::JSValue jsHTMLFormElementElements(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsHTMLFormElementLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsHTMLFormElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSHTMLFormElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFormElementNoValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFormElementNoValidate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLFormElementAcceptCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSHTMLFormElementAcceptCharset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLFormElementAction(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.cpp
index 2a87785..d00cfd2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.cpp
@@ -24,6 +24,7 @@
 #include "DOMWindow.h"
 #include "Document.h"
 #include "HTMLFrameElement.h"
+#include "HTMLNames.h"
 #include "JSDOMBinding.h"
 #include "JSDOMWindow.h"
 #include "JSDocument.h"
@@ -91,6 +92,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLFrameElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -107,6 +109,11 @@ bool JSHTMLFrameElementConstructor::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSHTMLFrameElementConstructor, DOMObject>(exec, &JSHTMLFrameElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLFrameElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLFrameElementConstructor, DOMObject>(exec, &JSHTMLFrameElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLFrameElementPrototypeTableValues[2] =
@@ -134,6 +141,11 @@ bool JSHTMLFrameElementPrototype::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticFunctionSlot<JSObject>(exec, &JSHTMLFrameElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSHTMLFrameElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSHTMLFrameElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSHTMLFrameElement::s_info = { "HTMLFrameElement", &JSHTMLElement::s_info, &JSHTMLFrameElementTable, 0 };
 
 JSHTMLFrameElement::JSHTMLFrameElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLFrameElement> impl)
@@ -151,12 +163,17 @@ bool JSHTMLFrameElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLFrameElement, Base>(exec, &JSHTMLFrameElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLFrameElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLFrameElement, Base>(exec, &JSHTMLFrameElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLFrameElementFrameBorder(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->frameBorder());
+    return jsString(exec, imp->getAttribute(HTMLNames::frameborderAttr));
 }
 
 JSValue jsHTMLFrameElementLongDesc(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -164,7 +181,7 @@ JSValue jsHTMLFrameElementLongDesc(ExecState* exec, const Identifier&, const Pro
     JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->longDesc());
+    return jsString(exec, imp->getAttribute(HTMLNames::longdescAttr));
 }
 
 JSValue jsHTMLFrameElementMarginHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -172,7 +189,7 @@ JSValue jsHTMLFrameElementMarginHeight(ExecState* exec, const Identifier&, const
     JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->marginHeight());
+    return jsString(exec, imp->getAttribute(HTMLNames::marginheightAttr));
 }
 
 JSValue jsHTMLFrameElementMarginWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -180,7 +197,7 @@ JSValue jsHTMLFrameElementMarginWidth(ExecState* exec, const Identifier&, const
     JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->marginWidth());
+    return jsString(exec, imp->getAttribute(HTMLNames::marginwidthAttr));
 }
 
 JSValue jsHTMLFrameElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -188,7 +205,7 @@ JSValue jsHTMLFrameElementName(ExecState* exec, const Identifier&, const Propert
     JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->name());
+    return jsString(exec, imp->getAttribute(HTMLNames::nameAttr));
 }
 
 JSValue jsHTMLFrameElementNoResize(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -204,7 +221,7 @@ JSValue jsHTMLFrameElementScrolling(ExecState* exec, const Identifier&, const Pr
     JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->scrolling());
+    return jsString(exec, imp->getAttribute(HTMLNames::scrollingAttr));
 }
 
 JSValue jsHTMLFrameElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -212,7 +229,7 @@ JSValue jsHTMLFrameElementSrc(ExecState* exec, const Identifier&, const Property
     JSHTMLFrameElement* castedThis = static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->src());
+    return jsString(exec, imp->getURLAttribute(HTMLNames::srcAttr));
 }
 
 JSValue jsHTMLFrameElementContentDocument(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -267,31 +284,31 @@ void JSHTMLFrameElement::put(ExecState* exec, const Identifier& propertyName, JS
 void setJSHTMLFrameElementFrameBorder(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(thisObject)->impl());
-    imp->setFrameBorder(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::frameborderAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLFrameElementLongDesc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(thisObject)->impl());
-    imp->setLongDesc(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::longdescAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLFrameElementMarginHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(thisObject)->impl());
-    imp->setMarginHeight(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::marginheightAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLFrameElementMarginWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(thisObject)->impl());
-    imp->setMarginWidth(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::marginwidthAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLFrameElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(thisObject)->impl());
-    imp->setName(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::nameAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLFrameElementNoResize(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -303,7 +320,7 @@ void setJSHTMLFrameElementNoResize(ExecState* exec, JSObject* thisObject, JSValu
 void setJSHTMLFrameElementScrolling(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(thisObject)->impl());
-    imp->setScrolling(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::scrollingAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLFrameElementSrc(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -324,7 +341,7 @@ JSValue JSHTMLFrameElement::getConstructor(ExecState* exec, JSGlobalObject* glob
 JSValue JSC_HOST_CALL jsHTMLFrameElementPrototypeFunctionGetSVGDocument(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLFrameElement::s_info))
+    if (!thisValue.inherits(&JSHTMLFrameElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLFrameElement* castedThisObj = static_cast<JSHTMLFrameElement*>(asObject(thisValue));
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.h
index c89f3f8..e919bc0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLFrameElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLFrameElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -57,9 +58,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSHTMLFrameElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.cpp
index f720492..c326cc7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.cpp
@@ -39,11 +39,12 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLFrameSetElement);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLFrameSetElementTableValues[11] =
+static const HashTableValue JSHTMLFrameSetElementTableValues[12] =
 {
     { "cols", DontDelete, (intptr_t)jsHTMLFrameSetElementCols, (intptr_t)setJSHTMLFrameSetElementCols },
     { "rows", DontDelete, (intptr_t)jsHTMLFrameSetElementRows, (intptr_t)setJSHTMLFrameSetElementRows },
     { "onbeforeunload", DontDelete|DontEnum, (intptr_t)jsHTMLFrameSetElementOnbeforeunload, (intptr_t)setJSHTMLFrameSetElementOnbeforeunload },
+    { "onhashchange", DontDelete|DontEnum, (intptr_t)jsHTMLFrameSetElementOnhashchange, (intptr_t)setJSHTMLFrameSetElementOnhashchange },
     { "onmessage", DontDelete|DontEnum, (intptr_t)jsHTMLFrameSetElementOnmessage, (intptr_t)setJSHTMLFrameSetElementOnmessage },
     { "onoffline", DontDelete|DontEnum, (intptr_t)jsHTMLFrameSetElementOnoffline, (intptr_t)setJSHTMLFrameSetElementOnoffline },
     { "ononline", DontDelete|DontEnum, (intptr_t)jsHTMLFrameSetElementOnonline, (intptr_t)setJSHTMLFrameSetElementOnonline },
@@ -83,6 +84,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLFrameSetElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -99,6 +101,11 @@ bool JSHTMLFrameSetElementConstructor::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSHTMLFrameSetElementConstructor, DOMObject>(exec, &JSHTMLFrameSetElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLFrameSetElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLFrameSetElementConstructor, DOMObject>(exec, &JSHTMLFrameSetElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLFrameSetElementPrototypeTableValues[1] =
@@ -141,6 +148,17 @@ bool JSHTMLFrameSetElement::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSHTMLFrameSetElement, Base>(exec, &JSHTMLFrameSetElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLFrameSetElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    if (canGetItemsForName(exec, static_cast<HTMLFrameSetElement*>(impl()), propertyName)) {
+        PropertySlot slot;
+        slot.setCustom(this, nameGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    return getStaticValueDescriptor<JSHTMLFrameSetElement, Base>(exec, &JSHTMLFrameSetElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLFrameSetElementCols(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLFrameSetElement* castedThis = static_cast<JSHTMLFrameSetElement*>(asObject(slot.slotBase()));
@@ -169,6 +187,18 @@ JSValue jsHTMLFrameSetElementOnbeforeunload(ExecState* exec, const Identifier&,
     return jsNull();
 }
 
+JSValue jsHTMLFrameSetElementOnhashchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSHTMLFrameSetElement* castedThis = static_cast<JSHTMLFrameSetElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(castedThis->impl());
+    if (EventListener* listener = imp->onhashchange()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
 JSValue jsHTMLFrameSetElementOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLFrameSetElement* castedThis = static_cast<JSHTMLFrameSetElement*>(asObject(slot.slotBase()));
@@ -273,6 +303,16 @@ void setJSHTMLFrameSetElementOnbeforeunload(ExecState* exec, JSObject* thisObjec
     imp->setOnbeforeunload(globalObject->createJSAttributeEventListener(value));
 }
 
+void setJSHTMLFrameSetElementOnhashchange(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnhashchange(globalObject->createJSAttributeEventListener(value));
+}
+
 void setJSHTMLFrameSetElementOnmessage(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.h
index 5b0f82f..ebeddda 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLFrameSetElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLFrameSetElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -66,6 +67,8 @@ JSC::JSValue jsHTMLFrameSetElementRows(JSC::ExecState*, const JSC::Identifier&,
 void setJSHTMLFrameSetElementRows(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLFrameSetElementOnbeforeunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSHTMLFrameSetElementOnbeforeunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameSetElementOnhashchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameSetElementOnhashchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLFrameSetElementOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSHTMLFrameSetElementOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLFrameSetElementOnoffline(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.cpp
index 2c4232c..ef8adb2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.cpp
@@ -73,6 +73,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLHRElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -89,6 +90,11 @@ bool JSHTMLHRElementConstructor::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSHTMLHRElementConstructor, DOMObject>(exec, &JSHTMLHRElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLHRElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLHRElementConstructor, DOMObject>(exec, &JSHTMLHRElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLHRElementPrototypeTableValues[1] =
@@ -127,6 +133,11 @@ bool JSHTMLHRElement::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSHTMLHRElement, Base>(exec, &JSHTMLHRElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLHRElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLHRElement, Base>(exec, &JSHTMLHRElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLHRElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLHRElement* castedThis = static_cast<JSHTMLHRElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.h
index c420fae..fac7072 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLHRElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLHRElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.cpp
index e04d2d9..4bc4dc9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.cpp
@@ -70,6 +70,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLHeadElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -86,6 +87,11 @@ bool JSHTMLHeadElementConstructor::getOwnPropertySlot(ExecState* exec, const Ide
     return getStaticValueSlot<JSHTMLHeadElementConstructor, DOMObject>(exec, &JSHTMLHeadElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLHeadElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLHeadElementConstructor, DOMObject>(exec, &JSHTMLHeadElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLHeadElementPrototypeTableValues[1] =
@@ -124,6 +130,11 @@ bool JSHTMLHeadElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSHTMLHeadElement, Base>(exec, &JSHTMLHeadElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLHeadElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLHeadElement, Base>(exec, &JSHTMLHeadElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLHeadElementProfile(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLHeadElement* castedThis = static_cast<JSHTMLHeadElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.h
index 9545349..7876cbe 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLHeadElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLHeadElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.cpp
index 57b3c23..ff0b818 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.cpp
@@ -70,6 +70,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLHeadingElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -86,6 +87,11 @@ bool JSHTMLHeadingElementConstructor::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSHTMLHeadingElementConstructor, DOMObject>(exec, &JSHTMLHeadingElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLHeadingElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLHeadingElementConstructor, DOMObject>(exec, &JSHTMLHeadingElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLHeadingElementPrototypeTableValues[1] =
@@ -124,6 +130,11 @@ bool JSHTMLHeadingElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLHeadingElement, Base>(exec, &JSHTMLHeadingElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLHeadingElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLHeadingElement, Base>(exec, &JSHTMLHeadingElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLHeadingElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLHeadingElement* castedThis = static_cast<JSHTMLHeadingElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.h
index 590d603..a2eace9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLHeadingElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLHeadingElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.cpp
index 8060fc1..7a77b9b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.cpp
@@ -70,6 +70,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLHtmlElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -86,6 +87,11 @@ bool JSHTMLHtmlElementConstructor::getOwnPropertySlot(ExecState* exec, const Ide
     return getStaticValueSlot<JSHTMLHtmlElementConstructor, DOMObject>(exec, &JSHTMLHtmlElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLHtmlElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLHtmlElementConstructor, DOMObject>(exec, &JSHTMLHtmlElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLHtmlElementPrototypeTableValues[1] =
@@ -124,6 +130,11 @@ bool JSHTMLHtmlElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSHTMLHtmlElement, Base>(exec, &JSHTMLHtmlElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLHtmlElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLHtmlElement, Base>(exec, &JSHTMLHtmlElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLHtmlElementVersion(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLHtmlElement* castedThis = static_cast<JSHTMLHtmlElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.h
index fb6150a..075e498 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLHtmlElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLHtmlElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.cpp
index b11b753..370c96e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.cpp
@@ -24,6 +24,7 @@
 #include "DOMWindow.h"
 #include "Document.h"
 #include "HTMLIFrameElement.h"
+#include "HTMLNames.h"
 #include "JSDOMBinding.h"
 #include "JSDOMWindow.h"
 #include "JSDocument.h"
@@ -89,6 +90,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLIFrameElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -105,6 +107,11 @@ bool JSHTMLIFrameElementConstructor::getOwnPropertySlot(ExecState* exec, const I
     return getStaticValueSlot<JSHTMLIFrameElementConstructor, DOMObject>(exec, &JSHTMLIFrameElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLIFrameElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLIFrameElementConstructor, DOMObject>(exec, &JSHTMLIFrameElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLIFrameElementPrototypeTableValues[2] =
@@ -132,6 +139,11 @@ bool JSHTMLIFrameElementPrototype::getOwnPropertySlot(ExecState* exec, const Ide
     return getStaticFunctionSlot<JSObject>(exec, &JSHTMLIFrameElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSHTMLIFrameElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSHTMLIFrameElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSHTMLIFrameElement::s_info = { "HTMLIFrameElement", &JSHTMLElement::s_info, &JSHTMLIFrameElementTable, 0 };
 
 JSHTMLIFrameElement::JSHTMLIFrameElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLIFrameElement> impl)
@@ -149,12 +161,17 @@ bool JSHTMLIFrameElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLIFrameElement, Base>(exec, &JSHTMLIFrameElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLIFrameElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLIFrameElement, Base>(exec, &JSHTMLIFrameElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLIFrameElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->align());
+    return jsString(exec, imp->getAttribute(HTMLNames::alignAttr));
 }
 
 JSValue jsHTMLIFrameElementFrameBorder(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -162,7 +179,7 @@ JSValue jsHTMLIFrameElementFrameBorder(ExecState* exec, const Identifier&, const
     JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->frameBorder());
+    return jsString(exec, imp->getAttribute(HTMLNames::frameborderAttr));
 }
 
 JSValue jsHTMLIFrameElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -170,7 +187,7 @@ JSValue jsHTMLIFrameElementHeight(ExecState* exec, const Identifier&, const Prop
     JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->height());
+    return jsString(exec, imp->getAttribute(HTMLNames::heightAttr));
 }
 
 JSValue jsHTMLIFrameElementLongDesc(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -178,7 +195,7 @@ JSValue jsHTMLIFrameElementLongDesc(ExecState* exec, const Identifier&, const Pr
     JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->longDesc());
+    return jsString(exec, imp->getAttribute(HTMLNames::longdescAttr));
 }
 
 JSValue jsHTMLIFrameElementMarginHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -186,7 +203,7 @@ JSValue jsHTMLIFrameElementMarginHeight(ExecState* exec, const Identifier&, cons
     JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->marginHeight());
+    return jsString(exec, imp->getAttribute(HTMLNames::marginheightAttr));
 }
 
 JSValue jsHTMLIFrameElementMarginWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -194,7 +211,7 @@ JSValue jsHTMLIFrameElementMarginWidth(ExecState* exec, const Identifier&, const
     JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->marginWidth());
+    return jsString(exec, imp->getAttribute(HTMLNames::marginwidthAttr));
 }
 
 JSValue jsHTMLIFrameElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -202,7 +219,7 @@ JSValue jsHTMLIFrameElementName(ExecState* exec, const Identifier&, const Proper
     JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->name());
+    return jsString(exec, imp->getAttribute(HTMLNames::nameAttr));
 }
 
 JSValue jsHTMLIFrameElementScrolling(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -210,7 +227,7 @@ JSValue jsHTMLIFrameElementScrolling(ExecState* exec, const Identifier&, const P
     JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->scrolling());
+    return jsString(exec, imp->getAttribute(HTMLNames::scrollingAttr));
 }
 
 JSValue jsHTMLIFrameElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -218,7 +235,7 @@ JSValue jsHTMLIFrameElementSrc(ExecState* exec, const Identifier&, const Propert
     JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->src());
+    return jsString(exec, imp->getAttribute(HTMLNames::srcAttr));
 }
 
 JSValue jsHTMLIFrameElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -226,7 +243,7 @@ JSValue jsHTMLIFrameElementWidth(ExecState* exec, const Identifier&, const Prope
     JSHTMLIFrameElement* castedThis = static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThis->impl());
-    return jsString(exec, imp->width());
+    return jsString(exec, imp->getAttribute(HTMLNames::widthAttr));
 }
 
 JSValue jsHTMLIFrameElementContentDocument(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -257,49 +274,49 @@ void JSHTMLIFrameElement::put(ExecState* exec, const Identifier& propertyName, J
 void setJSHTMLIFrameElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
-    imp->setAlign(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::alignAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLIFrameElementFrameBorder(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
-    imp->setFrameBorder(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::frameborderAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLIFrameElementHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
-    imp->setHeight(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::heightAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLIFrameElementLongDesc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
-    imp->setLongDesc(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::longdescAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLIFrameElementMarginHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
-    imp->setMarginHeight(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::marginheightAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLIFrameElementMarginWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
-    imp->setMarginWidth(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::marginwidthAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLIFrameElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
-    imp->setName(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::nameAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLIFrameElementScrolling(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
-    imp->setScrolling(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::scrollingAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLIFrameElementSrc(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -310,7 +327,7 @@ void setJSHTMLIFrameElementSrc(ExecState* exec, JSObject* thisObject, JSValue va
 void setJSHTMLIFrameElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
-    imp->setWidth(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::widthAttr, valueToStringWithNullCheck(exec, value));
 }
 
 JSValue JSHTMLIFrameElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -321,7 +338,7 @@ JSValue JSHTMLIFrameElement::getConstructor(ExecState* exec, JSGlobalObject* glo
 JSValue JSC_HOST_CALL jsHTMLIFrameElementPrototypeFunctionGetSVGDocument(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLIFrameElement::s_info))
+    if (!thisValue.inherits(&JSHTMLIFrameElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLIFrameElement* castedThisObj = static_cast<JSHTMLIFrameElement*>(asObject(thisValue));
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.h
index a1a62be..4e373b8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLIFrameElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLIFrameElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -56,9 +57,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSHTMLIFrameElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.cpp
index 0fdb334..9dc4d72 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.cpp
@@ -89,6 +89,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLImageElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -105,6 +106,11 @@ bool JSHTMLImageElementConstructor::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSHTMLImageElementConstructor, DOMObject>(exec, &JSHTMLImageElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLImageElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLImageElementConstructor, DOMObject>(exec, &JSHTMLImageElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLImageElementPrototypeTableValues[1] =
@@ -143,6 +149,11 @@ bool JSHTMLImageElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLImageElement, Base>(exec, &JSHTMLImageElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLImageElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLImageElement, Base>(exec, &JSHTMLImageElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLImageElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLImageElement* castedThis = static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.h
index ec618c0..168741e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLImageElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLImageElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.cpp
index 8499893..d15af5c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.cpp
@@ -43,11 +43,12 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLInputElement);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLInputElementTableValues[30] =
+static const HashTableValue JSHTMLInputElementTableValues[31] =
 {
     { "defaultValue", DontDelete, (intptr_t)jsHTMLInputElementDefaultValue, (intptr_t)setJSHTMLInputElementDefaultValue },
     { "defaultChecked", DontDelete, (intptr_t)jsHTMLInputElementDefaultChecked, (intptr_t)setJSHTMLInputElementDefaultChecked },
     { "form", DontDelete|ReadOnly, (intptr_t)jsHTMLInputElementForm, (intptr_t)0 },
+    { "formNoValidate", DontDelete, (intptr_t)jsHTMLInputElementFormNoValidate, (intptr_t)setJSHTMLInputElementFormNoValidate },
     { "validity", DontDelete|ReadOnly, (intptr_t)jsHTMLInputElementValidity, (intptr_t)0 },
     { "accept", DontDelete, (intptr_t)jsHTMLInputElementAccept, (intptr_t)setJSHTMLInputElementAccept },
     { "accessKey", DontDelete, (intptr_t)jsHTMLInputElementAccessKey, (intptr_t)setJSHTMLInputElementAccessKey },
@@ -81,7 +82,7 @@ static JSC_CONST_HASHTABLE HashTable JSHTMLInputElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 2047, JSHTMLInputElementTableValues, 0 };
 #else
-    { 71, 63, JSHTMLInputElementTableValues, 0 };
+    { 72, 63, JSHTMLInputElementTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -106,6 +107,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLInputElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -122,10 +124,17 @@ bool JSHTMLInputElementConstructor::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSHTMLInputElementConstructor, DOMObject>(exec, &JSHTMLInputElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLInputElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLInputElementConstructor, DOMObject>(exec, &JSHTMLInputElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
-static const HashTableValue JSHTMLInputElementPrototypeTableValues[4] =
+static const HashTableValue JSHTMLInputElementPrototypeTableValues[6] =
 {
+    { "checkValidity", DontDelete|Function, (intptr_t)jsHTMLInputElementPrototypeFunctionCheckValidity, (intptr_t)0 },
+    { "setCustomValidity", DontDelete|Function, (intptr_t)jsHTMLInputElementPrototypeFunctionSetCustomValidity, (intptr_t)1 },
     { "select", DontDelete|Function, (intptr_t)jsHTMLInputElementPrototypeFunctionSelect, (intptr_t)0 },
     { "click", DontDelete|Function, (intptr_t)jsHTMLInputElementPrototypeFunctionClick, (intptr_t)0 },
     { "setSelectionRange", DontDelete|Function, (intptr_t)jsHTMLInputElementPrototypeFunctionSetSelectionRange, (intptr_t)2 },
@@ -136,7 +145,7 @@ static JSC_CONST_HASHTABLE HashTable JSHTMLInputElementPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 15, JSHTMLInputElementPrototypeTableValues, 0 };
 #else
-    { 9, 7, JSHTMLInputElementPrototypeTableValues, 0 };
+    { 16, 15, JSHTMLInputElementPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSHTMLInputElementPrototype::s_info = { "HTMLInputElementPrototype", 0, &JSHTMLInputElementPrototypeTable, 0 };
@@ -151,6 +160,11 @@ bool JSHTMLInputElementPrototype::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticFunctionSlot<JSObject>(exec, &JSHTMLInputElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSHTMLInputElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSHTMLInputElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSHTMLInputElement::s_info = { "HTMLInputElement", &JSHTMLElement::s_info, &JSHTMLInputElementTable, 0 };
 
 JSHTMLInputElement::JSHTMLInputElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLInputElement> impl)
@@ -168,6 +182,11 @@ bool JSHTMLInputElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLInputElement, Base>(exec, &JSHTMLInputElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLInputElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLInputElement, Base>(exec, &JSHTMLInputElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLInputElementDefaultValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
@@ -192,6 +211,14 @@ JSValue jsHTMLInputElementForm(ExecState* exec, const Identifier&, const Propert
     return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->form()));
 }
 
+JSValue jsHTMLInputElementFormNoValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThis->impl());
+    return jsBoolean(imp->formNoValidate());
+}
+
 JSValue jsHTMLInputElementValidity(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLInputElement* castedThis = static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()));
@@ -408,6 +435,12 @@ void setJSHTMLInputElementDefaultChecked(ExecState* exec, JSObject* thisObject,
     imp->setDefaultChecked(value.toBoolean(exec));
 }
 
+void setJSHTMLInputElementFormNoValidate(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    imp->setFormNoValidate(value.toBoolean(exec));
+}
+
 void setJSHTMLInputElementAccept(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
@@ -543,10 +576,36 @@ JSValue JSHTMLInputElement::getConstructor(ExecState* exec, JSGlobalObject* glob
     return getDOMConstructor<JSHTMLInputElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
+JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionCheckValidity(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSHTMLInputElement::s_info))
+        return throwError(exec, TypeError);
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(asObject(thisValue));
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsBoolean(imp->checkValidity());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionSetCustomValidity(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSHTMLInputElement::s_info))
+        return throwError(exec, TypeError);
+    JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(asObject(thisValue));
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
+    const UString& error = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
+
+    imp->setCustomValidity(error);
+    return jsUndefined();
+}
+
 JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionSelect(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLInputElement::s_info))
+    if (!thisValue.inherits(&JSHTMLInputElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(asObject(thisValue));
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
@@ -558,7 +617,7 @@ JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionSelect(ExecState* exec,
 JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionClick(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLInputElement::s_info))
+    if (!thisValue.inherits(&JSHTMLInputElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(asObject(thisValue));
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
@@ -570,7 +629,7 @@ JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionClick(ExecState* exec,
 JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionSetSelectionRange(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLInputElement::s_info))
+    if (!thisValue.inherits(&JSHTMLInputElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(asObject(thisValue));
     return castedThisObj->setSelectionRange(exec, args);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.h
index 8a5f61a..057488b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLInputElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLInputElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -63,15 +64,18 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSHTMLInputElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
 
 // Functions
 
+JSC::JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionCheckValidity(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionSetCustomValidity(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionSelect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionClick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionSetSelectionRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
@@ -82,6 +86,8 @@ void setJSHTMLInputElementDefaultValue(JSC::ExecState*, JSC::JSObject*, JSC::JSV
 JSC::JSValue jsHTMLInputElementDefaultChecked(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSHTMLInputElementDefaultChecked(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLInputElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementFormNoValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementFormNoValidate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLInputElementValidity(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsHTMLInputElementAccept(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSHTMLInputElementAccept(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.cpp
index b937fb5..cf06ba6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.cpp
@@ -73,6 +73,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLIsIndexElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -89,6 +90,11 @@ bool JSHTMLIsIndexElementConstructor::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSHTMLIsIndexElementConstructor, DOMObject>(exec, &JSHTMLIsIndexElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLIsIndexElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLIsIndexElementConstructor, DOMObject>(exec, &JSHTMLIsIndexElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLIsIndexElementPrototypeTableValues[1] =
@@ -127,6 +133,11 @@ bool JSHTMLIsIndexElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLIsIndexElement, Base>(exec, &JSHTMLIsIndexElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLIsIndexElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLIsIndexElement, Base>(exec, &JSHTMLIsIndexElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLIsIndexElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLIsIndexElement* castedThis = static_cast<JSHTMLIsIndexElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.h
index 335e785..5fc1153 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLIsIndexElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLIsIndexElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.cpp
index f82c7b0..4c75a70 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.cpp
@@ -72,6 +72,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLLIElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -88,6 +89,11 @@ bool JSHTMLLIElementConstructor::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSHTMLLIElementConstructor, DOMObject>(exec, &JSHTMLLIElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLLIElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLLIElementConstructor, DOMObject>(exec, &JSHTMLLIElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLLIElementPrototypeTableValues[1] =
@@ -126,6 +132,11 @@ bool JSHTMLLIElement::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSHTMLLIElement, Base>(exec, &JSHTMLLIElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLLIElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLLIElement, Base>(exec, &JSHTMLLIElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLLIElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLLIElement* castedThis = static_cast<JSHTMLLIElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.h
index 92ee1a6..2c243d3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLLIElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLLIElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.cpp
index c765a38..afc4371 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.cpp
@@ -74,6 +74,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLLabelElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -90,6 +91,11 @@ bool JSHTMLLabelElementConstructor::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSHTMLLabelElementConstructor, DOMObject>(exec, &JSHTMLLabelElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLLabelElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLLabelElementConstructor, DOMObject>(exec, &JSHTMLLabelElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLLabelElementPrototypeTableValues[1] =
@@ -128,6 +134,11 @@ bool JSHTMLLabelElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLLabelElement, Base>(exec, &JSHTMLLabelElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLLabelElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLLabelElement, Base>(exec, &JSHTMLLabelElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLLabelElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLLabelElement* castedThis = static_cast<JSHTMLLabelElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.h
index 4ec25cc..a321b35 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLLabelElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLLabelElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.cpp
index 1094cf4..462051b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.cpp
@@ -74,6 +74,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLLegendElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -90,6 +91,11 @@ bool JSHTMLLegendElementConstructor::getOwnPropertySlot(ExecState* exec, const I
     return getStaticValueSlot<JSHTMLLegendElementConstructor, DOMObject>(exec, &JSHTMLLegendElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLLegendElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLLegendElementConstructor, DOMObject>(exec, &JSHTMLLegendElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLLegendElementPrototypeTableValues[1] =
@@ -128,6 +134,11 @@ bool JSHTMLLegendElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLLegendElement, Base>(exec, &JSHTMLLegendElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLLegendElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLLegendElement, Base>(exec, &JSHTMLLegendElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLLegendElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLLegendElement* castedThis = static_cast<JSHTMLLegendElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.h
index 507a8ba..cea7805 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLLegendElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLLegendElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.cpp
index 6163872..c0c3d05 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.cpp
@@ -81,6 +81,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLLinkElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -97,6 +98,11 @@ bool JSHTMLLinkElementConstructor::getOwnPropertySlot(ExecState* exec, const Ide
     return getStaticValueSlot<JSHTMLLinkElementConstructor, DOMObject>(exec, &JSHTMLLinkElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLLinkElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLLinkElementConstructor, DOMObject>(exec, &JSHTMLLinkElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLLinkElementPrototypeTableValues[1] =
@@ -135,6 +141,11 @@ bool JSHTMLLinkElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSHTMLLinkElement, Base>(exec, &JSHTMLLinkElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLLinkElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLLinkElement, Base>(exec, &JSHTMLLinkElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLLinkElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLLinkElement* castedThis = static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.h
index 4d3e094..d50d793 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLLinkElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLLinkElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.cpp
index ab7fcd6..a199930 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.cpp
@@ -73,6 +73,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLMapElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -89,6 +90,11 @@ bool JSHTMLMapElementConstructor::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticValueSlot<JSHTMLMapElementConstructor, DOMObject>(exec, &JSHTMLMapElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLMapElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLMapElementConstructor, DOMObject>(exec, &JSHTMLMapElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLMapElementPrototypeTableValues[1] =
@@ -127,6 +133,11 @@ bool JSHTMLMapElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSHTMLMapElement, Base>(exec, &JSHTMLMapElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLMapElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLMapElement, Base>(exec, &JSHTMLMapElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLMapElementAreas(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLMapElement* castedThis = static_cast<JSHTMLMapElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.h
index 23d3a90..25a8f9a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLMapElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLMapElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.cpp
index be92487..798f07b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.cpp
@@ -68,6 +68,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLMarqueeElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -84,6 +85,11 @@ bool JSHTMLMarqueeElementConstructor::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSHTMLMarqueeElementConstructor, DOMObject>(exec, &JSHTMLMarqueeElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLMarqueeElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLMarqueeElementConstructor, DOMObject>(exec, &JSHTMLMarqueeElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLMarqueeElementPrototypeTableValues[3] =
@@ -112,6 +118,11 @@ bool JSHTMLMarqueeElementPrototype::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticFunctionSlot<JSObject>(exec, &JSHTMLMarqueeElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSHTMLMarqueeElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSHTMLMarqueeElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSHTMLMarqueeElement::s_info = { "HTMLMarqueeElement", &JSHTMLElement::s_info, &JSHTMLMarqueeElementTable, 0 };
 
 JSHTMLMarqueeElement::JSHTMLMarqueeElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLMarqueeElement> impl)
@@ -129,6 +140,11 @@ bool JSHTMLMarqueeElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLMarqueeElement, Base>(exec, &JSHTMLMarqueeElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLMarqueeElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLMarqueeElement, Base>(exec, &JSHTMLMarqueeElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLMarqueeElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLMarqueeElement* domObject = static_cast<JSHTMLMarqueeElement*>(asObject(slot.slotBase()));
@@ -142,7 +158,7 @@ JSValue JSHTMLMarqueeElement::getConstructor(ExecState* exec, JSGlobalObject* gl
 JSValue JSC_HOST_CALL jsHTMLMarqueeElementPrototypeFunctionStart(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLMarqueeElement::s_info))
+    if (!thisValue.inherits(&JSHTMLMarqueeElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLMarqueeElement* castedThisObj = static_cast<JSHTMLMarqueeElement*>(asObject(thisValue));
     HTMLMarqueeElement* imp = static_cast<HTMLMarqueeElement*>(castedThisObj->impl());
@@ -154,7 +170,7 @@ JSValue JSC_HOST_CALL jsHTMLMarqueeElementPrototypeFunctionStart(ExecState* exec
 JSValue JSC_HOST_CALL jsHTMLMarqueeElementPrototypeFunctionStop(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLMarqueeElement::s_info))
+    if (!thisValue.inherits(&JSHTMLMarqueeElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLMarqueeElement* castedThisObj = static_cast<JSHTMLMarqueeElement*>(asObject(thisValue));
     HTMLMarqueeElement* imp = static_cast<HTMLMarqueeElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.h
index b1ec1af..a572a39 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLMarqueeElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLMarqueeElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -52,9 +53,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSHTMLMarqueeElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.cpp
index 2778b6e..98ec564 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.cpp
@@ -111,6 +111,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLMediaElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -127,6 +128,11 @@ bool JSHTMLMediaElementConstructor::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSHTMLMediaElementConstructor, DOMObject>(exec, &JSHTMLMediaElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLMediaElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLMediaElementConstructor, DOMObject>(exec, &JSHTMLMediaElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLMediaElementPrototypeTableValues[15] =
@@ -167,6 +173,11 @@ bool JSHTMLMediaElementPrototype::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticPropertySlot<JSHTMLMediaElementPrototype, JSObject>(exec, &JSHTMLMediaElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSHTMLMediaElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSHTMLMediaElementPrototype, JSObject>(exec, &JSHTMLMediaElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSHTMLMediaElement::s_info = { "HTMLMediaElement", &JSHTMLElement::s_info, &JSHTMLMediaElementTable, 0 };
 
 JSHTMLMediaElement::JSHTMLMediaElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLMediaElement> impl)
@@ -184,6 +195,11 @@ bool JSHTMLMediaElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLMediaElement, Base>(exec, &JSHTMLMediaElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLMediaElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLMediaElement, Base>(exec, &JSHTMLMediaElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLMediaElementError(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLMediaElement* castedThis = static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()));
@@ -456,7 +472,7 @@ JSValue JSHTMLMediaElement::getConstructor(ExecState* exec, JSGlobalObject* glob
 JSValue JSC_HOST_CALL jsHTMLMediaElementPrototypeFunctionLoad(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLMediaElement::s_info))
+    if (!thisValue.inherits(&JSHTMLMediaElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLMediaElement* castedThisObj = static_cast<JSHTMLMediaElement*>(asObject(thisValue));
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThisObj->impl());
@@ -470,7 +486,7 @@ JSValue JSC_HOST_CALL jsHTMLMediaElementPrototypeFunctionLoad(ExecState* exec, J
 JSValue JSC_HOST_CALL jsHTMLMediaElementPrototypeFunctionCanPlayType(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLMediaElement::s_info))
+    if (!thisValue.inherits(&JSHTMLMediaElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLMediaElement* castedThisObj = static_cast<JSHTMLMediaElement*>(asObject(thisValue));
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThisObj->impl());
@@ -484,7 +500,7 @@ JSValue JSC_HOST_CALL jsHTMLMediaElementPrototypeFunctionCanPlayType(ExecState*
 JSValue JSC_HOST_CALL jsHTMLMediaElementPrototypeFunctionPlay(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLMediaElement::s_info))
+    if (!thisValue.inherits(&JSHTMLMediaElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLMediaElement* castedThisObj = static_cast<JSHTMLMediaElement*>(asObject(thisValue));
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThisObj->impl());
@@ -496,7 +512,7 @@ JSValue JSC_HOST_CALL jsHTMLMediaElementPrototypeFunctionPlay(ExecState* exec, J
 JSValue JSC_HOST_CALL jsHTMLMediaElementPrototypeFunctionPause(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLMediaElement::s_info))
+    if (!thisValue.inherits(&JSHTMLMediaElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLMediaElement* castedThisObj = static_cast<JSHTMLMediaElement*>(asObject(thisValue));
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.h
index 01e1e10..503739b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.h
@@ -35,6 +35,7 @@ public:
     JSHTMLMediaElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLMediaElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSHTMLMediaElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.cpp
index 5319a46..3829891 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.cpp
@@ -68,6 +68,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLMenuElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -84,6 +85,11 @@ bool JSHTMLMenuElementConstructor::getOwnPropertySlot(ExecState* exec, const Ide
     return getStaticValueSlot<JSHTMLMenuElementConstructor, DOMObject>(exec, &JSHTMLMenuElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLMenuElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLMenuElementConstructor, DOMObject>(exec, &JSHTMLMenuElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLMenuElementPrototypeTableValues[1] =
@@ -122,6 +128,11 @@ bool JSHTMLMenuElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSHTMLMenuElement, Base>(exec, &JSHTMLMenuElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLMenuElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLMenuElement, Base>(exec, &JSHTMLMenuElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLMenuElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLMenuElement* castedThis = static_cast<JSHTMLMenuElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.h
index 0002e55..afad6f4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLMenuElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLMenuElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.cpp
index c1df168..508043f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.cpp
@@ -73,6 +73,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLMetaElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -89,6 +90,11 @@ bool JSHTMLMetaElementConstructor::getOwnPropertySlot(ExecState* exec, const Ide
     return getStaticValueSlot<JSHTMLMetaElementConstructor, DOMObject>(exec, &JSHTMLMetaElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLMetaElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLMetaElementConstructor, DOMObject>(exec, &JSHTMLMetaElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLMetaElementPrototypeTableValues[1] =
@@ -127,6 +133,11 @@ bool JSHTMLMetaElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSHTMLMetaElement, Base>(exec, &JSHTMLMetaElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLMetaElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLMetaElement, Base>(exec, &JSHTMLMetaElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLMetaElementContent(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLMetaElement* castedThis = static_cast<JSHTMLMetaElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.h
index acb73af..ffd8daa 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLMetaElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLMetaElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.cpp
index 27b71e9..1a8f17c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.cpp
@@ -71,6 +71,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLModElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -87,6 +88,11 @@ bool JSHTMLModElementConstructor::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticValueSlot<JSHTMLModElementConstructor, DOMObject>(exec, &JSHTMLModElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLModElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLModElementConstructor, DOMObject>(exec, &JSHTMLModElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLModElementPrototypeTableValues[1] =
@@ -125,6 +131,11 @@ bool JSHTMLModElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSHTMLModElement, Base>(exec, &JSHTMLModElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLModElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLModElement, Base>(exec, &JSHTMLModElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLModElementCite(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLModElement* castedThis = static_cast<JSHTMLModElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.h
index b9cfe5b..3e61813 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLModElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLModElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.cpp
index 189107c..7d6e688 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.cpp
@@ -73,6 +73,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLOListElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -89,6 +90,11 @@ bool JSHTMLOListElementConstructor::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSHTMLOListElementConstructor, DOMObject>(exec, &JSHTMLOListElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLOListElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLOListElementConstructor, DOMObject>(exec, &JSHTMLOListElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLOListElementPrototypeTableValues[1] =
@@ -127,6 +133,11 @@ bool JSHTMLOListElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLOListElement, Base>(exec, &JSHTMLOListElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLOListElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLOListElement, Base>(exec, &JSHTMLOListElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLOListElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLOListElement* castedThis = static_cast<JSHTMLOListElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.h
index 57dcb6a..c286a2f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLOListElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLOListElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.cpp
index 4ca8e94..c5edfe5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.cpp
@@ -24,6 +24,7 @@
 #include "AtomicString.h"
 #include "Document.h"
 #include "HTMLFormElement.h"
+#include "HTMLNames.h"
 #include "HTMLObjectElement.h"
 #include "JSDOMBinding.h"
 #include "JSDocument.h"
@@ -45,7 +46,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLObjectElement);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLObjectElementTableValues[20] =
+static const HashTableValue JSHTMLObjectElementTableValues[21] =
 {
     { "form", DontDelete|ReadOnly, (intptr_t)jsHTMLObjectElementForm, (intptr_t)0 },
     { "code", DontDelete, (intptr_t)jsHTMLObjectElementCode, (intptr_t)setJSHTMLObjectElementCode },
@@ -64,6 +65,7 @@ static const HashTableValue JSHTMLObjectElementTableValues[20] =
     { "useMap", DontDelete, (intptr_t)jsHTMLObjectElementUseMap, (intptr_t)setJSHTMLObjectElementUseMap },
     { "vspace", DontDelete, (intptr_t)jsHTMLObjectElementVspace, (intptr_t)setJSHTMLObjectElementVspace },
     { "width", DontDelete, (intptr_t)jsHTMLObjectElementWidth, (intptr_t)setJSHTMLObjectElementWidth },
+    { "willValidate", DontDelete|ReadOnly, (intptr_t)jsHTMLObjectElementWillValidate, (intptr_t)0 },
     { "contentDocument", DontDelete|ReadOnly, (intptr_t)jsHTMLObjectElementContentDocument, (intptr_t)0 },
     { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLObjectElementConstructor, (intptr_t)0 },
     { 0, 0, 0, 0 }
@@ -98,6 +100,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLObjectElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -114,6 +117,11 @@ bool JSHTMLObjectElementConstructor::getOwnPropertySlot(ExecState* exec, const I
     return getStaticValueSlot<JSHTMLObjectElementConstructor, DOMObject>(exec, &JSHTMLObjectElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLObjectElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLObjectElementConstructor, DOMObject>(exec, &JSHTMLObjectElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLObjectElementPrototypeTableValues[2] =
@@ -141,6 +149,11 @@ bool JSHTMLObjectElementPrototype::getOwnPropertySlot(ExecState* exec, const Ide
     return getStaticFunctionSlot<JSObject>(exec, &JSHTMLObjectElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSHTMLObjectElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSHTMLObjectElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSHTMLObjectElement::s_info = { "HTMLObjectElement", &JSHTMLElement::s_info, &JSHTMLObjectElementTable, 0 };
 
 JSHTMLObjectElement::JSHTMLObjectElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLObjectElement> impl)
@@ -164,6 +177,19 @@ bool JSHTMLObjectElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLObjectElement, Base>(exec, &JSHTMLObjectElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLObjectElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    if (canGetItemsForName(exec, static_cast<HTMLObjectElement*>(impl()), propertyName)) {
+        PropertySlot slot;
+        slot.setCustom(this, nameGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    if (getOwnPropertyDescriptorDelegate(exec, propertyName, descriptor))
+        return true;
+    return getStaticValueDescriptor<JSHTMLObjectElement, Base>(exec, &JSHTMLObjectElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLObjectElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
@@ -177,7 +203,7 @@ JSValue jsHTMLObjectElementCode(ExecState* exec, const Identifier&, const Proper
     JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsString(exec, imp->code());
+    return jsString(exec, imp->getAttribute(HTMLNames::codeAttr));
 }
 
 JSValue jsHTMLObjectElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -185,7 +211,7 @@ JSValue jsHTMLObjectElementAlign(ExecState* exec, const Identifier&, const Prope
     JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsString(exec, imp->align());
+    return jsString(exec, imp->getAttribute(HTMLNames::alignAttr));
 }
 
 JSValue jsHTMLObjectElementArchive(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -193,7 +219,7 @@ JSValue jsHTMLObjectElementArchive(ExecState* exec, const Identifier&, const Pro
     JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsString(exec, imp->archive());
+    return jsString(exec, imp->getAttribute(HTMLNames::archiveAttr));
 }
 
 JSValue jsHTMLObjectElementBorder(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -201,7 +227,7 @@ JSValue jsHTMLObjectElementBorder(ExecState* exec, const Identifier&, const Prop
     JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsString(exec, imp->border());
+    return jsString(exec, imp->getAttribute(HTMLNames::borderAttr));
 }
 
 JSValue jsHTMLObjectElementCodeBase(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -209,7 +235,7 @@ JSValue jsHTMLObjectElementCodeBase(ExecState* exec, const Identifier&, const Pr
     JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsString(exec, imp->codeBase());
+    return jsString(exec, imp->getAttribute(HTMLNames::codebaseAttr));
 }
 
 JSValue jsHTMLObjectElementCodeType(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -217,7 +243,7 @@ JSValue jsHTMLObjectElementCodeType(ExecState* exec, const Identifier&, const Pr
     JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsString(exec, imp->codeType());
+    return jsString(exec, imp->getAttribute(HTMLNames::codetypeAttr));
 }
 
 JSValue jsHTMLObjectElementData(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -225,7 +251,7 @@ JSValue jsHTMLObjectElementData(ExecState* exec, const Identifier&, const Proper
     JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsString(exec, imp->data());
+    return jsString(exec, imp->getURLAttribute(HTMLNames::dataAttr));
 }
 
 JSValue jsHTMLObjectElementDeclare(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -241,7 +267,7 @@ JSValue jsHTMLObjectElementHeight(ExecState* exec, const Identifier&, const Prop
     JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsString(exec, imp->height());
+    return jsString(exec, imp->getAttribute(HTMLNames::heightAttr));
 }
 
 JSValue jsHTMLObjectElementHspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -257,7 +283,7 @@ JSValue jsHTMLObjectElementName(ExecState* exec, const Identifier&, const Proper
     JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsString(exec, imp->name());
+    return jsString(exec, imp->getAttribute(HTMLNames::nameAttr));
 }
 
 JSValue jsHTMLObjectElementStandby(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -265,7 +291,7 @@ JSValue jsHTMLObjectElementStandby(ExecState* exec, const Identifier&, const Pro
     JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsString(exec, imp->standby());
+    return jsString(exec, imp->getAttribute(HTMLNames::standbyAttr));
 }
 
 JSValue jsHTMLObjectElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -273,7 +299,7 @@ JSValue jsHTMLObjectElementType(ExecState* exec, const Identifier&, const Proper
     JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsString(exec, imp->type());
+    return jsString(exec, imp->getAttribute(HTMLNames::typeAttr));
 }
 
 JSValue jsHTMLObjectElementUseMap(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -281,7 +307,7 @@ JSValue jsHTMLObjectElementUseMap(ExecState* exec, const Identifier&, const Prop
     JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsString(exec, imp->useMap());
+    return jsString(exec, imp->getAttribute(HTMLNames::usemapAttr));
 }
 
 JSValue jsHTMLObjectElementVspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -297,7 +323,15 @@ JSValue jsHTMLObjectElementWidth(ExecState* exec, const Identifier&, const Prope
     JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
     UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
-    return jsString(exec, imp->width());
+    return jsString(exec, imp->getAttribute(HTMLNames::widthAttr));
+}
+
+JSValue jsHTMLObjectElementWillValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSHTMLObjectElement* castedThis = static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThis->impl());
+    return jsBoolean(imp->willValidate());
 }
 
 JSValue jsHTMLObjectElementContentDocument(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -322,43 +356,43 @@ void JSHTMLObjectElement::put(ExecState* exec, const Identifier& propertyName, J
 void setJSHTMLObjectElementCode(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
-    imp->setCode(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::codeAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLObjectElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
-    imp->setAlign(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::alignAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLObjectElementArchive(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
-    imp->setArchive(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::archiveAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLObjectElementBorder(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
-    imp->setBorder(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::borderAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLObjectElementCodeBase(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
-    imp->setCodeBase(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::codebaseAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLObjectElementCodeType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
-    imp->setCodeType(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::codetypeAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLObjectElementData(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
-    imp->setData(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::dataAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLObjectElementDeclare(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -370,7 +404,7 @@ void setJSHTMLObjectElementDeclare(ExecState* exec, JSObject* thisObject, JSValu
 void setJSHTMLObjectElementHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
-    imp->setHeight(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::heightAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLObjectElementHspace(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -382,25 +416,25 @@ void setJSHTMLObjectElementHspace(ExecState* exec, JSObject* thisObject, JSValue
 void setJSHTMLObjectElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
-    imp->setName(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::nameAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLObjectElementStandby(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
-    imp->setStandby(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::standbyAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLObjectElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
-    imp->setType(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::typeAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLObjectElementUseMap(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
-    imp->setUseMap(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::usemapAttr, valueToStringWithNullCheck(exec, value));
 }
 
 void setJSHTMLObjectElementVspace(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -412,7 +446,7 @@ void setJSHTMLObjectElementVspace(ExecState* exec, JSObject* thisObject, JSValue
 void setJSHTMLObjectElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
-    imp->setWidth(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::widthAttr, valueToStringWithNullCheck(exec, value));
 }
 
 JSValue JSHTMLObjectElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -423,7 +457,7 @@ JSValue JSHTMLObjectElement::getConstructor(ExecState* exec, JSGlobalObject* glo
 JSValue JSC_HOST_CALL jsHTMLObjectElementPrototypeFunctionGetSVGDocument(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLObjectElement::s_info))
+    if (!thisValue.inherits(&JSHTMLObjectElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLObjectElement* castedThisObj = static_cast<JSHTMLObjectElement*>(asObject(thisValue));
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.h
index 7414b0c..8146590 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.h
@@ -34,7 +34,9 @@ public:
     JSHTMLObjectElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLObjectElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    bool getOwnPropertyDescriptorDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
@@ -61,9 +63,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSHTMLObjectElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
@@ -106,6 +109,7 @@ JSC::JSValue jsHTMLObjectElementVspace(JSC::ExecState*, const JSC::Identifier&,
 void setJSHTMLObjectElementVspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLObjectElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSHTMLObjectElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementWillValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsHTMLObjectElementContentDocument(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsHTMLObjectElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.cpp
index 0ed746e..02328c5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.cpp
@@ -71,6 +71,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLOptGroupElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -87,6 +88,11 @@ bool JSHTMLOptGroupElementConstructor::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSHTMLOptGroupElementConstructor, DOMObject>(exec, &JSHTMLOptGroupElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLOptGroupElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLOptGroupElementConstructor, DOMObject>(exec, &JSHTMLOptGroupElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLOptGroupElementPrototypeTableValues[1] =
@@ -125,6 +131,11 @@ bool JSHTMLOptGroupElement::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSHTMLOptGroupElement, Base>(exec, &JSHTMLOptGroupElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLOptGroupElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLOptGroupElement, Base>(exec, &JSHTMLOptGroupElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLOptGroupElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLOptGroupElement* castedThis = static_cast<JSHTMLOptGroupElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.h
index d489b26..6982b21 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLOptGroupElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLOptGroupElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.cpp
index 65d92e6..7966afb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.cpp
@@ -80,6 +80,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLOptionElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -96,6 +97,11 @@ bool JSHTMLOptionElementConstructor::getOwnPropertySlot(ExecState* exec, const I
     return getStaticValueSlot<JSHTMLOptionElementConstructor, DOMObject>(exec, &JSHTMLOptionElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLOptionElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLOptionElementConstructor, DOMObject>(exec, &JSHTMLOptionElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLOptionElementPrototypeTableValues[1] =
@@ -134,6 +140,11 @@ bool JSHTMLOptionElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLOptionElement, Base>(exec, &JSHTMLOptionElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLOptionElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLOptionElement, Base>(exec, &JSHTMLOptionElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLOptionElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLOptionElement* castedThis = static_cast<JSHTMLOptionElement*>(asObject(slot.slotBase()));
@@ -253,7 +264,7 @@ JSValue JSHTMLOptionElement::getConstructor(ExecState* exec, JSGlobalObject* glo
 
 HTMLOptionElement* toHTMLOptionElement(JSC::JSValue value)
 {
-    return value.isObject(&JSHTMLOptionElement::s_info) ? static_cast<JSHTMLOptionElement*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSHTMLOptionElement::s_info) ? static_cast<JSHTMLOptionElement*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.h
index be93183..9c2ccae 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.h
@@ -34,6 +34,7 @@ public:
     JSHTMLOptionElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLOptionElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.cpp
index bebf56a..4834e69 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.cpp
@@ -76,6 +76,11 @@ bool JSHTMLOptionsCollectionPrototype::getOwnPropertySlot(ExecState* exec, const
     return getStaticFunctionSlot<JSObject>(exec, &JSHTMLOptionsCollectionPrototypeTable, this, propertyName, slot);
 }
 
+bool JSHTMLOptionsCollectionPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSHTMLOptionsCollectionPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSHTMLOptionsCollection::s_info = { "HTMLOptionsCollection", &JSHTMLCollection::s_info, &JSHTMLOptionsCollectionTable, 0 };
 
 JSHTMLOptionsCollection::JSHTMLOptionsCollection(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLOptionsCollection> impl)
@@ -93,6 +98,11 @@ bool JSHTMLOptionsCollection::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSHTMLOptionsCollection, Base>(exec, &JSHTMLOptionsCollectionTable, this, propertyName, slot);
 }
 
+bool JSHTMLOptionsCollection::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLOptionsCollection, Base>(exec, &JSHTMLOptionsCollectionTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLOptionsCollectionSelectedIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLOptionsCollection* castedThis = static_cast<JSHTMLOptionsCollection*>(asObject(slot.slotBase()));
@@ -138,7 +148,7 @@ void setJSHTMLOptionsCollectionLength(ExecState* exec, JSObject* thisObject, JSV
 JSValue JSC_HOST_CALL jsHTMLOptionsCollectionPrototypeFunctionAdd(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLOptionsCollection::s_info))
+    if (!thisValue.inherits(&JSHTMLOptionsCollection::s_info))
         return throwError(exec, TypeError);
     JSHTMLOptionsCollection* castedThisObj = static_cast<JSHTMLOptionsCollection*>(asObject(thisValue));
     return castedThisObj->add(exec, args);
@@ -147,7 +157,7 @@ JSValue JSC_HOST_CALL jsHTMLOptionsCollectionPrototypeFunctionAdd(ExecState* exe
 JSValue JSC_HOST_CALL jsHTMLOptionsCollectionPrototypeFunctionRemove(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLOptionsCollection::s_info))
+    if (!thisValue.inherits(&JSHTMLOptionsCollection::s_info))
         return throwError(exec, TypeError);
     JSHTMLOptionsCollection* castedThisObj = static_cast<JSHTMLOptionsCollection*>(asObject(thisValue));
     return castedThisObj->remove(exec, args);
@@ -155,7 +165,7 @@ JSValue JSC_HOST_CALL jsHTMLOptionsCollectionPrototypeFunctionRemove(ExecState*
 
 HTMLOptionsCollection* toHTMLOptionsCollection(JSC::JSValue value)
 {
-    return value.isObject(&JSHTMLOptionsCollection::s_info) ? static_cast<JSHTMLOptionsCollection*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSHTMLOptionsCollection::s_info) ? static_cast<JSHTMLOptionsCollection*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.h
index de86695..3969a60 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.h
@@ -34,6 +34,7 @@ public:
     JSHTMLOptionsCollection(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLOptionsCollection>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
@@ -68,9 +69,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSHTMLOptionsCollectionPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.cpp
index f8e9fd6..8981630 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.cpp
@@ -70,6 +70,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLParagraphElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -86,6 +87,11 @@ bool JSHTMLParagraphElementConstructor::getOwnPropertySlot(ExecState* exec, cons
     return getStaticValueSlot<JSHTMLParagraphElementConstructor, DOMObject>(exec, &JSHTMLParagraphElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLParagraphElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLParagraphElementConstructor, DOMObject>(exec, &JSHTMLParagraphElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLParagraphElementPrototypeTableValues[1] =
@@ -124,6 +130,11 @@ bool JSHTMLParagraphElement::getOwnPropertySlot(ExecState* exec, const Identifie
     return getStaticValueSlot<JSHTMLParagraphElement, Base>(exec, &JSHTMLParagraphElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLParagraphElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLParagraphElement, Base>(exec, &JSHTMLParagraphElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLParagraphElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLParagraphElement* castedThis = static_cast<JSHTMLParagraphElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.h
index 1fa7ea5..6947809 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLParagraphElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLParagraphElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.cpp
index 717ff80..a869850 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.cpp
@@ -73,6 +73,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLParamElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -89,6 +90,11 @@ bool JSHTMLParamElementConstructor::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSHTMLParamElementConstructor, DOMObject>(exec, &JSHTMLParamElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLParamElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLParamElementConstructor, DOMObject>(exec, &JSHTMLParamElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLParamElementPrototypeTableValues[1] =
@@ -127,6 +133,11 @@ bool JSHTMLParamElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLParamElement, Base>(exec, &JSHTMLParamElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLParamElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLParamElement, Base>(exec, &JSHTMLParamElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLParamElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLParamElement* castedThis = static_cast<JSHTMLParamElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.h
index 12b80d6..c14d84b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLParamElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLParamElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.cpp
index 2b7320a..62823fd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.cpp
@@ -70,6 +70,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLPreElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -86,6 +87,11 @@ bool JSHTMLPreElementConstructor::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticValueSlot<JSHTMLPreElementConstructor, DOMObject>(exec, &JSHTMLPreElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLPreElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLPreElementConstructor, DOMObject>(exec, &JSHTMLPreElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLPreElementPrototypeTableValues[1] =
@@ -124,6 +130,11 @@ bool JSHTMLPreElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSHTMLPreElement, Base>(exec, &JSHTMLPreElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLPreElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLPreElement, Base>(exec, &JSHTMLPreElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLPreElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLPreElement* castedThis = static_cast<JSHTMLPreElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.h
index 439a7b3..3a2d066 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLPreElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLPreElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.cpp
index 84fce1b..0fa8659 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.cpp
@@ -70,6 +70,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLQuoteElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -86,6 +87,11 @@ bool JSHTMLQuoteElementConstructor::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSHTMLQuoteElementConstructor, DOMObject>(exec, &JSHTMLQuoteElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLQuoteElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLQuoteElementConstructor, DOMObject>(exec, &JSHTMLQuoteElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLQuoteElementPrototypeTableValues[1] =
@@ -124,6 +130,11 @@ bool JSHTMLQuoteElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLQuoteElement, Base>(exec, &JSHTMLQuoteElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLQuoteElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLQuoteElement, Base>(exec, &JSHTMLQuoteElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLQuoteElementCite(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLQuoteElement* castedThis = static_cast<JSHTMLQuoteElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.h
index 26d985c..d90105c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLQuoteElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLQuoteElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.cpp
index 42d4410..6b731b9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.cpp
@@ -76,6 +76,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLScriptElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -92,6 +93,11 @@ bool JSHTMLScriptElementConstructor::getOwnPropertySlot(ExecState* exec, const I
     return getStaticValueSlot<JSHTMLScriptElementConstructor, DOMObject>(exec, &JSHTMLScriptElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLScriptElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLScriptElementConstructor, DOMObject>(exec, &JSHTMLScriptElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLScriptElementPrototypeTableValues[1] =
@@ -130,6 +136,11 @@ bool JSHTMLScriptElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLScriptElement, Base>(exec, &JSHTMLScriptElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLScriptElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLScriptElement, Base>(exec, &JSHTMLScriptElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLScriptElementText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLScriptElement* castedThis = static_cast<JSHTMLScriptElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.h
index a028470..24e8e03 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLScriptElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLScriptElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.cpp
index 223a576..bd66528 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.cpp
@@ -95,6 +95,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLSelectElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -111,10 +112,17 @@ bool JSHTMLSelectElementConstructor::getOwnPropertySlot(ExecState* exec, const I
     return getStaticValueSlot<JSHTMLSelectElementConstructor, DOMObject>(exec, &JSHTMLSelectElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLSelectElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLSelectElementConstructor, DOMObject>(exec, &JSHTMLSelectElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
-static const HashTableValue JSHTMLSelectElementPrototypeTableValues[5] =
+static const HashTableValue JSHTMLSelectElementPrototypeTableValues[7] =
 {
+    { "checkValidity", DontDelete|Function, (intptr_t)jsHTMLSelectElementPrototypeFunctionCheckValidity, (intptr_t)0 },
+    { "setCustomValidity", DontDelete|Function, (intptr_t)jsHTMLSelectElementPrototypeFunctionSetCustomValidity, (intptr_t)1 },
     { "add", DontDelete|Function, (intptr_t)jsHTMLSelectElementPrototypeFunctionAdd, (intptr_t)2 },
     { "remove", DontDelete|Function, (intptr_t)jsHTMLSelectElementPrototypeFunctionRemove, (intptr_t)0 },
     { "item", DontDelete|Function, (intptr_t)jsHTMLSelectElementPrototypeFunctionItem, (intptr_t)1 },
@@ -126,7 +134,7 @@ static JSC_CONST_HASHTABLE HashTable JSHTMLSelectElementPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 15, JSHTMLSelectElementPrototypeTableValues, 0 };
 #else
-    { 9, 7, JSHTMLSelectElementPrototypeTableValues, 0 };
+    { 16, 15, JSHTMLSelectElementPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSHTMLSelectElementPrototype::s_info = { "HTMLSelectElementPrototype", 0, &JSHTMLSelectElementPrototypeTable, 0 };
@@ -141,6 +149,11 @@ bool JSHTMLSelectElementPrototype::getOwnPropertySlot(ExecState* exec, const Ide
     return getStaticFunctionSlot<JSObject>(exec, &JSHTMLSelectElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSHTMLSelectElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSHTMLSelectElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSHTMLSelectElement::s_info = { "HTMLSelectElement", &JSHTMLElement::s_info, &JSHTMLSelectElementTable, 0 };
 
 JSHTMLSelectElement::JSHTMLSelectElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLSelectElement> impl)
@@ -169,6 +182,26 @@ bool JSHTMLSelectElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLSelectElement, Base>(exec, &JSHTMLSelectElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLSelectElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    const HashEntry* entry = JSHTMLSelectElementTable.entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        slot.setCustom(this, entry->propertyGetter());
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<HTMLSelectElement*>(impl())->length()) {
+        PropertySlot slot;
+        slot.setCustomIndex(this, index, indexGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete);
+        return true;
+    }
+    return getStaticValueDescriptor<JSHTMLSelectElement, Base>(exec, &JSHTMLSelectElementTable, this, propertyName, descriptor);
+}
+
 bool JSHTMLSelectElement::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
 {
     if (propertyName < static_cast<HTMLSelectElement*>(impl())->length()) {
@@ -354,11 +387,11 @@ void setJSHTMLSelectElementSize(ExecState* exec, JSObject* thisObject, JSValue v
     imp->setSize(value.toInt32(exec));
 }
 
-void JSHTMLSelectElement::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSHTMLSelectElement::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     for (unsigned i = 0; i < static_cast<HTMLSelectElement*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getPropertyNames(exec, propertyNames, listedAttributes);
+     Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 JSValue JSHTMLSelectElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -366,10 +399,36 @@ JSValue JSHTMLSelectElement::getConstructor(ExecState* exec, JSGlobalObject* glo
     return getDOMConstructor<JSHTMLSelectElementConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
+JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionCheckValidity(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSHTMLSelectElement::s_info))
+        return throwError(exec, TypeError);
+    JSHTMLSelectElement* castedThisObj = static_cast<JSHTMLSelectElement*>(asObject(thisValue));
+    HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsBoolean(imp->checkValidity());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionSetCustomValidity(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSHTMLSelectElement::s_info))
+        return throwError(exec, TypeError);
+    JSHTMLSelectElement* castedThisObj = static_cast<JSHTMLSelectElement*>(asObject(thisValue));
+    HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThisObj->impl());
+    const UString& error = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
+
+    imp->setCustomValidity(error);
+    return jsUndefined();
+}
+
 JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionAdd(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLSelectElement::s_info))
+    if (!thisValue.inherits(&JSHTMLSelectElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLSelectElement* castedThisObj = static_cast<JSHTMLSelectElement*>(asObject(thisValue));
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThisObj->impl());
@@ -385,7 +444,7 @@ JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionAdd(ExecState* exec, J
 JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionRemove(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLSelectElement::s_info))
+    if (!thisValue.inherits(&JSHTMLSelectElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLSelectElement* castedThisObj = static_cast<JSHTMLSelectElement*>(asObject(thisValue));
     return castedThisObj->remove(exec, args);
@@ -394,7 +453,7 @@ JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionRemove(ExecState* exec
 JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLSelectElement::s_info))
+    if (!thisValue.inherits(&JSHTMLSelectElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLSelectElement* castedThisObj = static_cast<JSHTMLSelectElement*>(asObject(thisValue));
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThisObj->impl());
@@ -412,7 +471,7 @@ JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionItem(ExecState* exec,
 JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionNamedItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLSelectElement::s_info))
+    if (!thisValue.inherits(&JSHTMLSelectElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLSelectElement* castedThisObj = static_cast<JSHTMLSelectElement*>(asObject(thisValue));
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.h
index 11cf587..851305b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLSelectElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLSelectElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
@@ -44,7 +45,7 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 
     // Custom functions
@@ -61,15 +62,18 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSHTMLSelectElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
 
 // Functions
 
+JSC::JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionCheckValidity(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionSetCustomValidity(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionAdd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionRemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.cpp
index d4a7d72..7a261f8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.cpp
@@ -75,6 +75,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLSourceElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -91,6 +92,11 @@ bool JSHTMLSourceElementConstructor::getOwnPropertySlot(ExecState* exec, const I
     return getStaticValueSlot<JSHTMLSourceElementConstructor, DOMObject>(exec, &JSHTMLSourceElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLSourceElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLSourceElementConstructor, DOMObject>(exec, &JSHTMLSourceElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLSourceElementPrototypeTableValues[1] =
@@ -129,6 +135,11 @@ bool JSHTMLSourceElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLSourceElement, Base>(exec, &JSHTMLSourceElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLSourceElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLSourceElement, Base>(exec, &JSHTMLSourceElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLSourceElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLSourceElement* castedThis = static_cast<JSHTMLSourceElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.h
index 7c00c0e..75e4014 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.h
@@ -35,6 +35,7 @@ public:
     JSHTMLSourceElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLSourceElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.cpp
index 4de3dc8..ddc1109 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.cpp
@@ -75,6 +75,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLStyleElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -91,6 +92,11 @@ bool JSHTMLStyleElementConstructor::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSHTMLStyleElementConstructor, DOMObject>(exec, &JSHTMLStyleElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLStyleElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLStyleElementConstructor, DOMObject>(exec, &JSHTMLStyleElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLStyleElementPrototypeTableValues[1] =
@@ -129,6 +135,11 @@ bool JSHTMLStyleElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLStyleElement, Base>(exec, &JSHTMLStyleElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLStyleElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLStyleElement, Base>(exec, &JSHTMLStyleElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLStyleElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLStyleElement* castedThis = static_cast<JSHTMLStyleElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.h
index 3698a23..11e57f9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLStyleElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLStyleElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.cpp
index 6206931..760c811 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.cpp
@@ -70,6 +70,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLTableCaptionElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -86,6 +87,11 @@ bool JSHTMLTableCaptionElementConstructor::getOwnPropertySlot(ExecState* exec, c
     return getStaticValueSlot<JSHTMLTableCaptionElementConstructor, DOMObject>(exec, &JSHTMLTableCaptionElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLTableCaptionElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLTableCaptionElementConstructor, DOMObject>(exec, &JSHTMLTableCaptionElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLTableCaptionElementPrototypeTableValues[1] =
@@ -124,6 +130,11 @@ bool JSHTMLTableCaptionElement::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSHTMLTableCaptionElement, Base>(exec, &JSHTMLTableCaptionElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLTableCaptionElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLTableCaptionElement, Base>(exec, &JSHTMLTableCaptionElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLTableCaptionElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLTableCaptionElement* castedThis = static_cast<JSHTMLTableCaptionElement*>(asObject(slot.slotBase()));
@@ -155,7 +166,7 @@ JSValue JSHTMLTableCaptionElement::getConstructor(ExecState* exec, JSGlobalObjec
 
 HTMLTableCaptionElement* toHTMLTableCaptionElement(JSC::JSValue value)
 {
-    return value.isObject(&JSHTMLTableCaptionElement::s_info) ? static_cast<JSHTMLTableCaptionElement*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSHTMLTableCaptionElement::s_info) ? static_cast<JSHTMLTableCaptionElement*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.h
index 5071186..3baa4d8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.h
@@ -34,6 +34,7 @@ public:
     JSHTMLTableCaptionElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLTableCaptionElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.cpp
index 02a8e96..ff3157e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.cpp
@@ -85,6 +85,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLTableCellElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -101,6 +102,11 @@ bool JSHTMLTableCellElementConstructor::getOwnPropertySlot(ExecState* exec, cons
     return getStaticValueSlot<JSHTMLTableCellElementConstructor, DOMObject>(exec, &JSHTMLTableCellElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLTableCellElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLTableCellElementConstructor, DOMObject>(exec, &JSHTMLTableCellElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLTableCellElementPrototypeTableValues[1] =
@@ -139,6 +145,11 @@ bool JSHTMLTableCellElement::getOwnPropertySlot(ExecState* exec, const Identifie
     return getStaticValueSlot<JSHTMLTableCellElement, Base>(exec, &JSHTMLTableCellElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLTableCellElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLTableCellElement, Base>(exec, &JSHTMLTableCellElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLTableCellElementCellIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLTableCellElement* castedThis = static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.h
index 3575ad9..2191462 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLTableCellElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLTableCellElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.cpp
index 033a6e0..4dcd547 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.cpp
@@ -76,6 +76,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLTableColElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -92,6 +93,11 @@ bool JSHTMLTableColElementConstructor::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSHTMLTableColElementConstructor, DOMObject>(exec, &JSHTMLTableColElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLTableColElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLTableColElementConstructor, DOMObject>(exec, &JSHTMLTableColElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLTableColElementPrototypeTableValues[1] =
@@ -130,6 +136,11 @@ bool JSHTMLTableColElement::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSHTMLTableColElement, Base>(exec, &JSHTMLTableColElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLTableColElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLTableColElement, Base>(exec, &JSHTMLTableColElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLTableColElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLTableColElement* castedThis = static_cast<JSHTMLTableColElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.h
index 87584cd..a7e8525 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLTableColElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLTableColElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.cpp
index 55e43e0..6ebde1d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.cpp
@@ -92,6 +92,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLTableElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -108,6 +109,11 @@ bool JSHTMLTableElementConstructor::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSHTMLTableElementConstructor, DOMObject>(exec, &JSHTMLTableElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLTableElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLTableElementConstructor, DOMObject>(exec, &JSHTMLTableElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLTableElementPrototypeTableValues[9] =
@@ -142,6 +148,11 @@ bool JSHTMLTableElementPrototype::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticFunctionSlot<JSObject>(exec, &JSHTMLTableElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSHTMLTableElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSHTMLTableElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSHTMLTableElement::s_info = { "HTMLTableElement", &JSHTMLElement::s_info, &JSHTMLTableElementTable, 0 };
 
 JSHTMLTableElement::JSHTMLTableElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLTableElement> impl)
@@ -159,6 +170,11 @@ bool JSHTMLTableElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLTableElement, Base>(exec, &JSHTMLTableElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLTableElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLTableElement, Base>(exec, &JSHTMLTableElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLTableElementCaption(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLTableElement* castedThis = static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()));
@@ -367,7 +383,7 @@ JSValue JSHTMLTableElement::getConstructor(ExecState* exec, JSGlobalObject* glob
 JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionCreateTHead(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLTableElement::s_info))
+    if (!thisValue.inherits(&JSHTMLTableElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(asObject(thisValue));
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
@@ -380,7 +396,7 @@ JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionCreateTHead(ExecState*
 JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionDeleteTHead(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLTableElement::s_info))
+    if (!thisValue.inherits(&JSHTMLTableElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(asObject(thisValue));
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
@@ -392,7 +408,7 @@ JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionDeleteTHead(ExecState*
 JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionCreateTFoot(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLTableElement::s_info))
+    if (!thisValue.inherits(&JSHTMLTableElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(asObject(thisValue));
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
@@ -405,7 +421,7 @@ JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionCreateTFoot(ExecState*
 JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionDeleteTFoot(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLTableElement::s_info))
+    if (!thisValue.inherits(&JSHTMLTableElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(asObject(thisValue));
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
@@ -417,7 +433,7 @@ JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionDeleteTFoot(ExecState*
 JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionCreateCaption(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLTableElement::s_info))
+    if (!thisValue.inherits(&JSHTMLTableElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(asObject(thisValue));
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
@@ -430,7 +446,7 @@ JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionCreateCaption(ExecState
 JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionDeleteCaption(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLTableElement::s_info))
+    if (!thisValue.inherits(&JSHTMLTableElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(asObject(thisValue));
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
@@ -442,7 +458,7 @@ JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionDeleteCaption(ExecState
 JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionInsertRow(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLTableElement::s_info))
+    if (!thisValue.inherits(&JSHTMLTableElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(asObject(thisValue));
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
@@ -458,7 +474,7 @@ JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionInsertRow(ExecState* ex
 JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionDeleteRow(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLTableElement::s_info))
+    if (!thisValue.inherits(&JSHTMLTableElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(asObject(thisValue));
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.h
index ebef7fd..0e3d18c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLTableElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLTableElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -53,9 +54,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSHTMLTableElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.cpp
index 3305604..cd14dbf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.cpp
@@ -83,6 +83,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLTableRowElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -99,6 +100,11 @@ bool JSHTMLTableRowElementConstructor::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSHTMLTableRowElementConstructor, DOMObject>(exec, &JSHTMLTableRowElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLTableRowElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLTableRowElementConstructor, DOMObject>(exec, &JSHTMLTableRowElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLTableRowElementPrototypeTableValues[3] =
@@ -127,6 +133,11 @@ bool JSHTMLTableRowElementPrototype::getOwnPropertySlot(ExecState* exec, const I
     return getStaticFunctionSlot<JSObject>(exec, &JSHTMLTableRowElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSHTMLTableRowElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSHTMLTableRowElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSHTMLTableRowElement::s_info = { "HTMLTableRowElement", &JSHTMLElement::s_info, &JSHTMLTableRowElementTable, 0 };
 
 JSHTMLTableRowElement::JSHTMLTableRowElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLTableRowElement> impl)
@@ -144,6 +155,11 @@ bool JSHTMLTableRowElement::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSHTMLTableRowElement, Base>(exec, &JSHTMLTableRowElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLTableRowElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLTableRowElement, Base>(exec, &JSHTMLTableRowElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLTableRowElementRowIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLTableRowElement* castedThis = static_cast<JSHTMLTableRowElement*>(asObject(slot.slotBase()));
@@ -256,7 +272,7 @@ JSValue JSHTMLTableRowElement::getConstructor(ExecState* exec, JSGlobalObject* g
 JSValue JSC_HOST_CALL jsHTMLTableRowElementPrototypeFunctionInsertCell(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLTableRowElement::s_info))
+    if (!thisValue.inherits(&JSHTMLTableRowElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableRowElement* castedThisObj = static_cast<JSHTMLTableRowElement*>(asObject(thisValue));
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(castedThisObj->impl());
@@ -272,7 +288,7 @@ JSValue JSC_HOST_CALL jsHTMLTableRowElementPrototypeFunctionInsertCell(ExecState
 JSValue JSC_HOST_CALL jsHTMLTableRowElementPrototypeFunctionDeleteCell(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLTableRowElement::s_info))
+    if (!thisValue.inherits(&JSHTMLTableRowElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableRowElement* castedThisObj = static_cast<JSHTMLTableRowElement*>(asObject(thisValue));
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.h
index 3a592b4..e152d7a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLTableRowElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLTableRowElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -53,9 +54,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSHTMLTableRowElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.cpp
index fa3c5b5..51df6ad 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.cpp
@@ -79,6 +79,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLTableSectionElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -95,6 +96,11 @@ bool JSHTMLTableSectionElementConstructor::getOwnPropertySlot(ExecState* exec, c
     return getStaticValueSlot<JSHTMLTableSectionElementConstructor, DOMObject>(exec, &JSHTMLTableSectionElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLTableSectionElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLTableSectionElementConstructor, DOMObject>(exec, &JSHTMLTableSectionElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLTableSectionElementPrototypeTableValues[3] =
@@ -123,6 +129,11 @@ bool JSHTMLTableSectionElementPrototype::getOwnPropertySlot(ExecState* exec, con
     return getStaticFunctionSlot<JSObject>(exec, &JSHTMLTableSectionElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSHTMLTableSectionElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSHTMLTableSectionElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSHTMLTableSectionElement::s_info = { "HTMLTableSectionElement", &JSHTMLElement::s_info, &JSHTMLTableSectionElementTable, 0 };
 
 JSHTMLTableSectionElement::JSHTMLTableSectionElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLTableSectionElement> impl)
@@ -140,6 +151,11 @@ bool JSHTMLTableSectionElement::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSHTMLTableSectionElement, Base>(exec, &JSHTMLTableSectionElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLTableSectionElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLTableSectionElement, Base>(exec, &JSHTMLTableSectionElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLTableSectionElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLTableSectionElement* castedThis = static_cast<JSHTMLTableSectionElement*>(asObject(slot.slotBase()));
@@ -222,7 +238,7 @@ JSValue JSHTMLTableSectionElement::getConstructor(ExecState* exec, JSGlobalObjec
 JSValue JSC_HOST_CALL jsHTMLTableSectionElementPrototypeFunctionInsertRow(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLTableSectionElement::s_info))
+    if (!thisValue.inherits(&JSHTMLTableSectionElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableSectionElement* castedThisObj = static_cast<JSHTMLTableSectionElement*>(asObject(thisValue));
     HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(castedThisObj->impl());
@@ -238,7 +254,7 @@ JSValue JSC_HOST_CALL jsHTMLTableSectionElementPrototypeFunctionInsertRow(ExecSt
 JSValue JSC_HOST_CALL jsHTMLTableSectionElementPrototypeFunctionDeleteRow(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLTableSectionElement::s_info))
+    if (!thisValue.inherits(&JSHTMLTableSectionElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableSectionElement* castedThisObj = static_cast<JSHTMLTableSectionElement*>(asObject(thisValue));
     HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(castedThisObj->impl());
@@ -252,7 +268,7 @@ JSValue JSC_HOST_CALL jsHTMLTableSectionElementPrototypeFunctionDeleteRow(ExecSt
 
 HTMLTableSectionElement* toHTMLTableSectionElement(JSC::JSValue value)
 {
-    return value.isObject(&JSHTMLTableSectionElement::s_info) ? static_cast<JSHTMLTableSectionElement*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSHTMLTableSectionElement::s_info) ? static_cast<JSHTMLTableSectionElement*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.h
index 0734bdb..36231b5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.h
@@ -34,6 +34,7 @@ public:
     JSHTMLTableSectionElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLTableSectionElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -59,9 +60,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSHTMLTableSectionElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.cpp
index 0a2c779..ffe9716 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.cpp
@@ -22,6 +22,7 @@
 #include "JSHTMLTextAreaElement.h"
 
 #include "HTMLFormElement.h"
+#include "HTMLNames.h"
 #include "HTMLTextAreaElement.h"
 #include "JSHTMLFormElement.h"
 #include "JSValidityState.h"
@@ -40,7 +41,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLTextAreaElement);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLTextAreaElementTableValues[18] =
+static const HashTableValue JSHTMLTextAreaElementTableValues[20] =
 {
     { "defaultValue", DontDelete, (intptr_t)jsHTMLTextAreaElementDefaultValue, (intptr_t)setJSHTMLTextAreaElementDefaultValue },
     { "form", DontDelete|ReadOnly, (intptr_t)jsHTMLTextAreaElementForm, (intptr_t)0 },
@@ -50,11 +51,13 @@ static const HashTableValue JSHTMLTextAreaElementTableValues[18] =
     { "disabled", DontDelete, (intptr_t)jsHTMLTextAreaElementDisabled, (intptr_t)setJSHTMLTextAreaElementDisabled },
     { "autofocus", DontDelete, (intptr_t)jsHTMLTextAreaElementAutofocus, (intptr_t)setJSHTMLTextAreaElementAutofocus },
     { "name", DontDelete, (intptr_t)jsHTMLTextAreaElementName, (intptr_t)setJSHTMLTextAreaElementName },
+    { "placeholder", DontDelete, (intptr_t)jsHTMLTextAreaElementPlaceholder, (intptr_t)setJSHTMLTextAreaElementPlaceholder },
     { "readOnly", DontDelete, (intptr_t)jsHTMLTextAreaElementReadOnly, (intptr_t)setJSHTMLTextAreaElementReadOnly },
     { "required", DontDelete, (intptr_t)jsHTMLTextAreaElementRequired, (intptr_t)setJSHTMLTextAreaElementRequired },
     { "rows", DontDelete, (intptr_t)jsHTMLTextAreaElementRows, (intptr_t)setJSHTMLTextAreaElementRows },
     { "type", DontDelete|ReadOnly, (intptr_t)jsHTMLTextAreaElementType, (intptr_t)0 },
     { "value", DontDelete, (intptr_t)jsHTMLTextAreaElementValue, (intptr_t)setJSHTMLTextAreaElementValue },
+    { "textLength", DontDelete|ReadOnly, (intptr_t)jsHTMLTextAreaElementTextLength, (intptr_t)0 },
     { "willValidate", DontDelete|ReadOnly, (intptr_t)jsHTMLTextAreaElementWillValidate, (intptr_t)0 },
     { "selectionStart", DontDelete, (intptr_t)jsHTMLTextAreaElementSelectionStart, (intptr_t)setJSHTMLTextAreaElementSelectionStart },
     { "selectionEnd", DontDelete, (intptr_t)jsHTMLTextAreaElementSelectionEnd, (intptr_t)setJSHTMLTextAreaElementSelectionEnd },
@@ -91,6 +94,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLTextAreaElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -107,11 +111,18 @@ bool JSHTMLTextAreaElementConstructor::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSHTMLTextAreaElementConstructor, DOMObject>(exec, &JSHTMLTextAreaElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLTextAreaElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLTextAreaElementConstructor, DOMObject>(exec, &JSHTMLTextAreaElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
-static const HashTableValue JSHTMLTextAreaElementPrototypeTableValues[3] =
+static const HashTableValue JSHTMLTextAreaElementPrototypeTableValues[5] =
 {
     { "select", DontDelete|Function, (intptr_t)jsHTMLTextAreaElementPrototypeFunctionSelect, (intptr_t)0 },
+    { "checkValidity", DontDelete|Function, (intptr_t)jsHTMLTextAreaElementPrototypeFunctionCheckValidity, (intptr_t)0 },
+    { "setCustomValidity", DontDelete|Function, (intptr_t)jsHTMLTextAreaElementPrototypeFunctionSetCustomValidity, (intptr_t)1 },
     { "setSelectionRange", DontDelete|Function, (intptr_t)jsHTMLTextAreaElementPrototypeFunctionSetSelectionRange, (intptr_t)2 },
     { 0, 0, 0, 0 }
 };
@@ -120,7 +131,7 @@ static JSC_CONST_HASHTABLE HashTable JSHTMLTextAreaElementPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 15, JSHTMLTextAreaElementPrototypeTableValues, 0 };
 #else
-    { 5, 3, JSHTMLTextAreaElementPrototypeTableValues, 0 };
+    { 9, 7, JSHTMLTextAreaElementPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSHTMLTextAreaElementPrototype::s_info = { "HTMLTextAreaElementPrototype", 0, &JSHTMLTextAreaElementPrototypeTable, 0 };
@@ -135,6 +146,11 @@ bool JSHTMLTextAreaElementPrototype::getOwnPropertySlot(ExecState* exec, const I
     return getStaticFunctionSlot<JSObject>(exec, &JSHTMLTextAreaElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSHTMLTextAreaElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSHTMLTextAreaElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSHTMLTextAreaElement::s_info = { "HTMLTextAreaElement", &JSHTMLElement::s_info, &JSHTMLTextAreaElementTable, 0 };
 
 JSHTMLTextAreaElement::JSHTMLTextAreaElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLTextAreaElement> impl)
@@ -152,6 +168,11 @@ bool JSHTMLTextAreaElement::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSHTMLTextAreaElement, Base>(exec, &JSHTMLTextAreaElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLTextAreaElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLTextAreaElement, Base>(exec, &JSHTMLTextAreaElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLTextAreaElementDefaultValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()));
@@ -216,6 +237,14 @@ JSValue jsHTMLTextAreaElementName(ExecState* exec, const Identifier&, const Prop
     return jsString(exec, imp->name());
 }
 
+JSValue jsHTMLTextAreaElementPlaceholder(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThis->impl());
+    return jsString(exec, imp->getAttribute(HTMLNames::placeholderAttr));
+}
+
 JSValue jsHTMLTextAreaElementReadOnly(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()));
@@ -256,6 +285,14 @@ JSValue jsHTMLTextAreaElementValue(ExecState* exec, const Identifier&, const Pro
     return jsString(exec, imp->value());
 }
 
+JSValue jsHTMLTextAreaElementTextLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThis->impl());
+    return jsNumber(exec, imp->textLength());
+}
+
 JSValue jsHTMLTextAreaElementWillValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLTextAreaElement* castedThis = static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()));
@@ -326,6 +363,12 @@ void setJSHTMLTextAreaElementName(ExecState* exec, JSObject* thisObject, JSValue
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
+void setJSHTMLTextAreaElementPlaceholder(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
+    imp->setAttribute(HTMLNames::placeholderAttr, valueToStringWithNullCheck(exec, value));
+}
+
 void setJSHTMLTextAreaElementReadOnly(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
@@ -370,7 +413,7 @@ JSValue JSHTMLTextAreaElement::getConstructor(ExecState* exec, JSGlobalObject* g
 JSValue JSC_HOST_CALL jsHTMLTextAreaElementPrototypeFunctionSelect(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLTextAreaElement::s_info))
+    if (!thisValue.inherits(&JSHTMLTextAreaElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTextAreaElement* castedThisObj = static_cast<JSHTMLTextAreaElement*>(asObject(thisValue));
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThisObj->impl());
@@ -379,10 +422,36 @@ JSValue JSC_HOST_CALL jsHTMLTextAreaElementPrototypeFunctionSelect(ExecState* ex
     return jsUndefined();
 }
 
+JSValue JSC_HOST_CALL jsHTMLTextAreaElementPrototypeFunctionCheckValidity(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSHTMLTextAreaElement::s_info))
+        return throwError(exec, TypeError);
+    JSHTMLTextAreaElement* castedThisObj = static_cast<JSHTMLTextAreaElement*>(asObject(thisValue));
+    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsBoolean(imp->checkValidity());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsHTMLTextAreaElementPrototypeFunctionSetCustomValidity(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSHTMLTextAreaElement::s_info))
+        return throwError(exec, TypeError);
+    JSHTMLTextAreaElement* castedThisObj = static_cast<JSHTMLTextAreaElement*>(asObject(thisValue));
+    HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThisObj->impl());
+    const UString& error = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
+
+    imp->setCustomValidity(error);
+    return jsUndefined();
+}
+
 JSValue JSC_HOST_CALL jsHTMLTextAreaElementPrototypeFunctionSetSelectionRange(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHTMLTextAreaElement::s_info))
+    if (!thisValue.inherits(&JSHTMLTextAreaElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTextAreaElement* castedThisObj = static_cast<JSHTMLTextAreaElement*>(asObject(thisValue));
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.h
index 52b05dd..313af9f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLTextAreaElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLTextAreaElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -53,9 +54,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSHTMLTextAreaElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
@@ -63,6 +65,8 @@ public:
 // Functions
 
 JSC::JSValue JSC_HOST_CALL jsHTMLTextAreaElementPrototypeFunctionSelect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTextAreaElementPrototypeFunctionCheckValidity(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTextAreaElementPrototypeFunctionSetCustomValidity(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsHTMLTextAreaElementPrototypeFunctionSetSelectionRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
@@ -80,6 +84,8 @@ JSC::JSValue jsHTMLTextAreaElementAutofocus(JSC::ExecState*, const JSC::Identifi
 void setJSHTMLTextAreaElementAutofocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLTextAreaElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSHTMLTextAreaElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTextAreaElementPlaceholder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTextAreaElementPlaceholder(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLTextAreaElementReadOnly(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSHTMLTextAreaElementReadOnly(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLTextAreaElementRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
@@ -89,6 +95,7 @@ void setJSHTMLTextAreaElementRows(JSC::ExecState*, JSC::JSObject*, JSC::JSValue)
 JSC::JSValue jsHTMLTextAreaElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsHTMLTextAreaElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSHTMLTextAreaElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTextAreaElementTextLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsHTMLTextAreaElementWillValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsHTMLTextAreaElementSelectionStart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSHTMLTextAreaElementSelectionStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.cpp
index 04bf7e0..1bee1c0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.cpp
@@ -70,6 +70,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLTitleElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -86,6 +87,11 @@ bool JSHTMLTitleElementConstructor::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSHTMLTitleElementConstructor, DOMObject>(exec, &JSHTMLTitleElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLTitleElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLTitleElementConstructor, DOMObject>(exec, &JSHTMLTitleElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLTitleElementPrototypeTableValues[1] =
@@ -124,6 +130,11 @@ bool JSHTMLTitleElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLTitleElement, Base>(exec, &JSHTMLTitleElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLTitleElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLTitleElement, Base>(exec, &JSHTMLTitleElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLTitleElementText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLTitleElement* castedThis = static_cast<JSHTMLTitleElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.h
index fa8c4c6..d48d5db 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLTitleElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLTitleElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.cpp
index 017a317..3924ca9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.cpp
@@ -71,6 +71,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLUListElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -87,6 +88,11 @@ bool JSHTMLUListElementConstructor::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSHTMLUListElementConstructor, DOMObject>(exec, &JSHTMLUListElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLUListElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLUListElementConstructor, DOMObject>(exec, &JSHTMLUListElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLUListElementPrototypeTableValues[1] =
@@ -125,6 +131,11 @@ bool JSHTMLUListElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLUListElement, Base>(exec, &JSHTMLUListElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLUListElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLUListElement, Base>(exec, &JSHTMLUListElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLUListElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLUListElement* castedThis = static_cast<JSHTMLUListElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.h
index 9c1cc10..681adaa 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.h
@@ -33,6 +33,7 @@ public:
     JSHTMLUListElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLUListElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.cpp
index 152ae5f..73428bb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.cpp
@@ -78,6 +78,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSHTMLVideoElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -94,6 +95,11 @@ bool JSHTMLVideoElementConstructor::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSHTMLVideoElementConstructor, DOMObject>(exec, &JSHTMLVideoElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSHTMLVideoElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLVideoElementConstructor, DOMObject>(exec, &JSHTMLVideoElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSHTMLVideoElementPrototypeTableValues[1] =
@@ -132,6 +138,11 @@ bool JSHTMLVideoElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLVideoElement, Base>(exec, &JSHTMLVideoElementTable, this, propertyName, slot);
 }
 
+bool JSHTMLVideoElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSHTMLVideoElement, Base>(exec, &JSHTMLVideoElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsHTMLVideoElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLVideoElement* castedThis = static_cast<JSHTMLVideoElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.h
index 15bcc89..5466b10 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.h
@@ -35,6 +35,7 @@ public:
     JSHTMLVideoElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<HTMLVideoElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHistory.cpp b/src/3rdparty/webkit/WebCore/generated/JSHistory.cpp
index fc8c0b6..d7c2b04 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHistory.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHistory.cpp
@@ -77,6 +77,11 @@ bool JSHistoryPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticFunctionSlot<JSObject>(exec, &JSHistoryPrototypeTable, this, propertyName, slot);
 }
 
+bool JSHistoryPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSHistoryPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSHistory::s_info = { "History", 0, &JSHistoryTable, 0 };
 
 JSHistory::JSHistory(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<History> impl)
@@ -102,6 +107,13 @@ bool JSHistory::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return getStaticValueSlot<JSHistory, Base>(exec, &JSHistoryTable, this, propertyName, slot);
 }
 
+bool JSHistory::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    if (getOwnPropertyDescriptorDelegate(exec, propertyName, descriptor))
+        return true;
+    return getStaticValueDescriptor<JSHistory, Base>(exec, &JSHistoryTable, this, propertyName, descriptor);
+}
+
 JSValue jsHistoryLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHistory* castedThis = static_cast<JSHistory*>(asObject(slot.slotBase()));
@@ -120,7 +132,7 @@ void JSHistory::put(ExecState* exec, const Identifier& propertyName, JSValue val
 JSValue JSC_HOST_CALL jsHistoryPrototypeFunctionBack(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHistory::s_info))
+    if (!thisValue.inherits(&JSHistory::s_info))
         return throwError(exec, TypeError);
     JSHistory* castedThisObj = static_cast<JSHistory*>(asObject(thisValue));
     History* imp = static_cast<History*>(castedThisObj->impl());
@@ -132,7 +144,7 @@ JSValue JSC_HOST_CALL jsHistoryPrototypeFunctionBack(ExecState* exec, JSObject*,
 JSValue JSC_HOST_CALL jsHistoryPrototypeFunctionForward(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHistory::s_info))
+    if (!thisValue.inherits(&JSHistory::s_info))
         return throwError(exec, TypeError);
     JSHistory* castedThisObj = static_cast<JSHistory*>(asObject(thisValue));
     History* imp = static_cast<History*>(castedThisObj->impl());
@@ -144,7 +156,7 @@ JSValue JSC_HOST_CALL jsHistoryPrototypeFunctionForward(ExecState* exec, JSObjec
 JSValue JSC_HOST_CALL jsHistoryPrototypeFunctionGo(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSHistory::s_info))
+    if (!thisValue.inherits(&JSHistory::s_info))
         return throwError(exec, TypeError);
     JSHistory* castedThisObj = static_cast<JSHistory*>(asObject(thisValue));
     History* imp = static_cast<History*>(castedThisObj->impl());
@@ -160,7 +172,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, History
 }
 History* toHistory(JSC::JSValue value)
 {
-    return value.isObject(&JSHistory::s_info) ? static_cast<JSHistory*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSHistory::s_info) ? static_cast<JSHistory*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHistory.h b/src/3rdparty/webkit/WebCore/generated/JSHistory.h
index 6e17de0..fcc8ccf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHistory.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHistory.h
@@ -37,7 +37,9 @@ public:
     virtual ~JSHistory();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    bool getOwnPropertyDescriptorDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
@@ -48,8 +50,8 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&, bool checkDontDelete = true);
-    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype);
+    virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     History* impl() const { return m_impl.get(); }
 
 private:
@@ -66,9 +68,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSHistoryPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp b/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp
index 841b1a2..b918220 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp
@@ -70,6 +70,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSImageDataPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -86,6 +87,11 @@ bool JSImageDataConstructor::getOwnPropertySlot(ExecState* exec, const Identifie
     return getStaticValueSlot<JSImageDataConstructor, DOMObject>(exec, &JSImageDataConstructorTable, this, propertyName, slot);
 }
 
+bool JSImageDataConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSImageDataConstructor, DOMObject>(exec, &JSImageDataConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSImageDataPrototypeTableValues[1] =
@@ -130,6 +136,11 @@ bool JSImageData::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return getStaticValueSlot<JSImageData, Base>(exec, &JSImageDataTable, this, propertyName, slot);
 }
 
+bool JSImageData::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSImageData, Base>(exec, &JSImageDataTable, this, propertyName, descriptor);
+}
+
 JSValue jsImageDataWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSImageData* castedThis = static_cast<JSImageData*>(asObject(slot.slotBase()));
@@ -158,7 +169,7 @@ JSValue JSImageData::getConstructor(ExecState* exec, JSGlobalObject* globalObjec
 
 ImageData* toImageData(JSC::JSValue value)
 {
-    return value.isObject(&JSImageData::s_info) ? static_cast<JSImageData*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSImageData::s_info) ? static_cast<JSImageData*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSImageData.h b/src/3rdparty/webkit/WebCore/generated/JSImageData.h
index 5b6ab1d..4e1e22d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSImageData.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSImageData.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSImageData();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.cpp b/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.cpp
index 78e5420..c77185c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.cpp
@@ -72,6 +72,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSInspectorBackendPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -88,9 +89,14 @@ bool JSInspectorBackendConstructor::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSInspectorBackendConstructor, DOMObject>(exec, &JSInspectorBackendConstructorTable, this, propertyName, slot);
 }
 
+bool JSInspectorBackendConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSInspectorBackendConstructor, DOMObject>(exec, &JSInspectorBackendConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
-static const HashTableValue JSInspectorBackendPrototypeTableValues[48] =
+static const HashTableValue JSInspectorBackendPrototypeTableValues[66] =
 {
     { "hideDOMNodeHighlight", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionHideDOMNodeHighlight, (intptr_t)0 },
     { "highlightDOMNode", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionHighlightDOMNode, (intptr_t)1 },
@@ -99,7 +105,7 @@ static const HashTableValue JSInspectorBackendPrototypeTableValues[48] =
     { "attach", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionAttach, (intptr_t)0 },
     { "detach", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDetach, (intptr_t)0 },
     { "closeWindow", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionCloseWindow, (intptr_t)0 },
-    { "clearMessages", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionClearMessages, (intptr_t)0 },
+    { "clearMessages", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionClearMessages, (intptr_t)1 },
     { "toggleNodeSearch", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionToggleNodeSearch, (intptr_t)0 },
     { "isWindowVisible", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionIsWindowVisible, (intptr_t)0 },
     { "searchingForNode", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSearchingForNode, (intptr_t)0 },
@@ -113,6 +119,9 @@ static const HashTableValue JSInspectorBackendPrototypeTableValues[48] =
     { "localizedStringsURL", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionLocalizedStringsURL, (intptr_t)0 },
     { "hiddenPanels", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionHiddenPanels, (intptr_t)0 },
     { "platform", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionPlatform, (intptr_t)0 },
+    { "enableTimeline", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionEnableTimeline, (intptr_t)1 },
+    { "disableTimeline", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDisableTimeline, (intptr_t)1 },
+    { "timelineEnabled", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionTimelineEnabled, (intptr_t)0 },
     { "moveByUnrestricted", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionMoveByUnrestricted, (intptr_t)2 },
     { "setAttachedWindowHeight", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSetAttachedWindowHeight, (intptr_t)1 },
     { "wrapCallback", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionWrapCallback, (intptr_t)1 },
@@ -120,10 +129,13 @@ static const HashTableValue JSInspectorBackendPrototypeTableValues[48] =
     { "enableResourceTracking", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionEnableResourceTracking, (intptr_t)1 },
     { "disableResourceTracking", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDisableResourceTracking, (intptr_t)1 },
     { "storeLastActivePanel", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionStoreLastActivePanel, (intptr_t)1 },
+    { "getCookies", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionGetCookies, (intptr_t)1 },
+    { "deleteCookie", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDeleteCookie, (intptr_t)1 },
     { "debuggerEnabled", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDebuggerEnabled, (intptr_t)0 },
     { "enableDebugger", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionEnableDebugger, (intptr_t)1 },
     { "disableDebugger", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDisableDebugger, (intptr_t)1 },
-    { "addBreakpoint", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionAddBreakpoint, (intptr_t)2 },
+    { "addBreakpoint", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionAddBreakpoint, (intptr_t)3 },
+    { "updateBreakpoint", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionUpdateBreakpoint, (intptr_t)3 },
     { "removeBreakpoint", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionRemoveBreakpoint, (intptr_t)2 },
     { "pauseInDebugger", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionPauseInDebugger, (intptr_t)0 },
     { "resumeDebugger", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionResumeDebugger, (intptr_t)0 },
@@ -139,14 +151,26 @@ static const HashTableValue JSInspectorBackendPrototypeTableValues[48] =
     { "startProfiling", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionStartProfiling, (intptr_t)0 },
     { "stopProfiling", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionStopProfiling, (intptr_t)0 },
     { "profiles", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionProfiles, (intptr_t)0 },
+    { "dispatchOnInjectedScript", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionDispatchOnInjectedScript, (intptr_t)3 },
+    { "getChildNodes", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionGetChildNodes, (intptr_t)2 },
+    { "setAttribute", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSetAttribute, (intptr_t)4 },
+    { "removeAttribute", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionRemoveAttribute, (intptr_t)3 },
+    { "setTextNodeValue", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSetTextNodeValue, (intptr_t)3 },
+    { "nodeForId", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionNodeForId, (intptr_t)1 },
+    { "wrapObject", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionWrapObject, (intptr_t)1 },
+    { "unwrapObject", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionUnwrapObject, (intptr_t)1 },
+    { "pushNodePathToFrontend", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionPushNodePathToFrontend, (intptr_t)2 },
+    { "addNodesToSearchResult", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionAddNodesToSearchResult, (intptr_t)1 },
+    { "selectDatabase", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSelectDatabase, (intptr_t)1 },
+    { "selectDOMStorage", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSelectDOMStorage, (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSInspectorBackendPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 2047, JSInspectorBackendPrototypeTableValues, 0 };
+    { 4095, JSInspectorBackendPrototypeTableValues, 0 };
 #else
-    { 137, 127, JSInspectorBackendPrototypeTableValues, 0 };
+    { 262, 255, JSInspectorBackendPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSInspectorBackendPrototype::s_info = { "InspectorBackendPrototype", 0, &JSInspectorBackendPrototypeTable, 0 };
@@ -161,6 +185,11 @@ bool JSInspectorBackendPrototype::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticFunctionSlot<JSObject>(exec, &JSInspectorBackendPrototypeTable, this, propertyName, slot);
 }
 
+bool JSInspectorBackendPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSInspectorBackendPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSInspectorBackend::s_info = { "InspectorBackend", 0, &JSInspectorBackendTable, 0 };
 
 JSInspectorBackend::JSInspectorBackend(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<InspectorBackend> impl)
@@ -184,6 +213,11 @@ bool JSInspectorBackend::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSInspectorBackend, Base>(exec, &JSInspectorBackendTable, this, propertyName, slot);
 }
 
+bool JSInspectorBackend::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSInspectorBackend, Base>(exec, &JSInspectorBackendTable, this, propertyName, descriptor);
+}
+
 JSValue jsInspectorBackendConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSInspectorBackend* domObject = static_cast<JSInspectorBackend*>(asObject(slot.slotBase()));
@@ -197,7 +231,7 @@ JSValue JSInspectorBackend::getConstructor(ExecState* exec, JSGlobalObject* glob
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionHideDOMNodeHighlight(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -209,7 +243,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionHideDOMNodeHighlight(Ex
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionHighlightDOMNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     return castedThisObj->highlightDOMNode(exec, args);
@@ -218,7 +252,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionHighlightDOMNode(ExecSt
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionLoaded(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -230,7 +264,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionLoaded(ExecState* exec,
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionWindowUnloading(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -242,7 +276,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionWindowUnloading(ExecSta
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAttach(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -254,7 +288,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAttach(ExecState* exec,
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDetach(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -266,7 +300,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDetach(ExecState* exec,
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionCloseWindow(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -278,19 +312,20 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionCloseWindow(ExecState*
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionClearMessages(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    bool clearUI = args.at(0).toBoolean(exec);
 
-    imp->clearMessages();
+    imp->clearMessages(clearUI);
     return jsUndefined();
 }
 
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionToggleNodeSearch(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -302,7 +337,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionToggleNodeSearch(ExecSt
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionIsWindowVisible(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -315,7 +350,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionIsWindowVisible(ExecSta
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSearchingForNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -328,7 +363,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSearchingForNode(ExecSt
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAddResourceSourceToFrame(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -342,7 +377,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAddResourceSourceToFram
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAddSourceToFrame(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -358,7 +393,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAddSourceToFrame(ExecSt
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSearch(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     return castedThisObj->search(exec, args);
@@ -367,7 +402,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSearch(ExecState* exec,
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDatabaseTableNames(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     return castedThisObj->databaseTableNames(exec, args);
@@ -376,7 +411,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDatabaseTableNames(Exec
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetting(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     return castedThisObj->setting(exec, args);
@@ -385,7 +420,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetting(ExecState* exec
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetSetting(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     return castedThisObj->setSetting(exec, args);
@@ -394,7 +429,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetSetting(ExecState* e
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionInspectedWindow(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     return castedThisObj->inspectedWindow(exec, args);
@@ -403,7 +438,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionInspectedWindow(ExecSta
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionLocalizedStringsURL(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -416,7 +451,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionLocalizedStringsURL(Exe
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionHiddenPanels(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -429,7 +464,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionHiddenPanels(ExecState*
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPlatform(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -439,10 +474,49 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPlatform(ExecState* exe
     return result;
 }
 
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionEnableTimeline(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    bool always = args.at(0).toBoolean(exec);
+
+    imp->enableTimeline(always);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDisableTimeline(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    bool always = args.at(0).toBoolean(exec);
+
+    imp->disableTimeline(always);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionTimelineEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsBoolean(imp->timelineEnabled());
+    return result;
+}
+
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionMoveByUnrestricted(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -456,7 +530,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionMoveByUnrestricted(Exec
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetAttachedWindowHeight(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -469,7 +543,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetAttachedWindowHeight
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionWrapCallback(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     return castedThisObj->wrapCallback(exec, args);
@@ -478,7 +552,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionWrapCallback(ExecState*
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionResourceTrackingEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -491,7 +565,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionResourceTrackingEnabled
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionEnableResourceTracking(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -504,7 +578,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionEnableResourceTracking(
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDisableResourceTracking(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -517,7 +591,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDisableResourceTracking
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStoreLastActivePanel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -527,10 +601,36 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStoreLastActivePanel(Ex
     return jsUndefined();
 }
 
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetCookies(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    int callId = args.at(0).toInt32(exec);
+
+    imp->getCookies(callId);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDeleteCookie(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    const UString& cookieName = args.at(0).toString(exec);
+
+    imp->deleteCookie(cookieName);
+    return jsUndefined();
+}
+
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDebuggerEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -543,7 +643,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDebuggerEnabled(ExecSta
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionEnableDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -556,7 +656,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionEnableDebugger(ExecStat
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDisableDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -569,21 +669,37 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDisableDebugger(ExecSta
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAddBreakpoint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
     const UString& sourceID = args.at(0).toString(exec);
     unsigned lineNumber = args.at(1).toInt32(exec);
+    const UString& condition = args.at(2).toString(exec);
 
-    imp->addBreakpoint(sourceID, lineNumber);
+    imp->addBreakpoint(sourceID, lineNumber, condition);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionUpdateBreakpoint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    const UString& sourceID = args.at(0).toString(exec);
+    unsigned lineNumber = args.at(1).toInt32(exec);
+    const UString& condition = args.at(2).toString(exec);
+
+    imp->updateBreakpoint(sourceID, lineNumber, condition);
     return jsUndefined();
 }
 
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveBreakpoint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -597,7 +713,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveBreakpoint(ExecSt
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPauseInDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -609,7 +725,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPauseInDebugger(ExecSta
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionResumeDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -621,7 +737,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionResumeDebugger(ExecStat
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStepOverStatementInDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -633,7 +749,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStepOverStatementInDebu
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStepIntoStatementInDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -645,7 +761,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStepIntoStatementInDebu
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStepOutOfFunctionInDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -657,7 +773,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStepOutOfFunctionInDebu
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionCurrentCallFrame(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     return castedThisObj->currentCallFrame(exec, args);
@@ -666,7 +782,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionCurrentCallFrame(ExecSt
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPauseOnExceptions(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -679,7 +795,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPauseOnExceptions(ExecS
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetPauseOnExceptions(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -692,7 +808,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetPauseOnExceptions(Ex
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionProfilerEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -705,7 +821,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionProfilerEnabled(ExecSta
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionEnableProfiler(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -718,7 +834,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionEnableProfiler(ExecStat
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDisableProfiler(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -731,7 +847,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDisableProfiler(ExecSta
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStartProfiling(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -743,7 +859,7 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStartProfiling(ExecStat
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStopProfiling(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
@@ -755,19 +871,161 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStopProfiling(ExecState
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionProfiles(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSInspectorBackend::s_info))
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
         return throwError(exec, TypeError);
     JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
     return castedThisObj->profiles(exec, args);
 }
 
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDispatchOnInjectedScript(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    int callId = args.at(0).toInt32(exec);
+    const UString& methodName = args.at(1).toString(exec);
+    const UString& arguments = args.at(2).toString(exec);
+
+    imp->dispatchOnInjectedScript(callId, methodName, arguments);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetChildNodes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    int callId = args.at(0).toInt32(exec);
+    int nodeId = args.at(1).toInt32(exec);
+
+    imp->getChildNodes(callId, nodeId);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    int callId = args.at(0).toInt32(exec);
+    int elementId = args.at(1).toInt32(exec);
+    const UString& name = args.at(2).toString(exec);
+    const UString& value = args.at(3).toString(exec);
+
+    imp->setAttribute(callId, elementId, name, value);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    int callId = args.at(0).toInt32(exec);
+    int elementId = args.at(1).toInt32(exec);
+    const UString& name = args.at(2).toString(exec);
+
+    imp->removeAttribute(callId, elementId, name);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetTextNodeValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    int callId = args.at(0).toInt32(exec);
+    int nodeId = args.at(1).toInt32(exec);
+    const UString& value = args.at(2).toString(exec);
+
+    imp->setTextNodeValue(callId, nodeId, value);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionNodeForId(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    return castedThisObj->nodeForId(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionWrapObject(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    return castedThisObj->wrapObject(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionUnwrapObject(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    return castedThisObj->unwrapObject(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPushNodePathToFrontend(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    return castedThisObj->pushNodePathToFrontend(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAddNodesToSearchResult(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    const UString& nodeIds = args.at(0).toString(exec);
+
+    imp->addNodesToSearchResult(nodeIds);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSelectDatabase(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    return castedThisObj->selectDatabase(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSelectDOMStorage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    return castedThisObj->selectDOMStorage(exec, args);
+}
+
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, InspectorBackend* object)
 {
     return getDOMObjectWrapper<JSInspectorBackend>(exec, globalObject, object);
 }
 InspectorBackend* toInspectorBackend(JSC::JSValue value)
 {
-    return value.isObject(&JSInspectorBackend::s_info) ? static_cast<JSInspectorBackend*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSInspectorBackend::s_info) ? static_cast<JSInspectorBackend*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.h b/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.h
index da9a09e..102a5b4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSInspectorBackend();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -57,6 +58,12 @@ public:
     JSC::JSValue wrapCallback(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue currentCallFrame(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue profiles(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue nodeForId(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue wrapObject(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue unwrapObject(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue pushNodePathToFrontend(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue selectDatabase(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue selectDOMStorage(JSC::ExecState*, const JSC::ArgList&);
     InspectorBackend* impl() const { return m_impl.get(); }
 
 private:
@@ -73,9 +80,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSInspectorBackendPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
@@ -103,6 +111,9 @@ JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionInspectedWindow(JS
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionLocalizedStringsURL(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionHiddenPanels(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPlatform(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionEnableTimeline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDisableTimeline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionTimelineEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionMoveByUnrestricted(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetAttachedWindowHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionWrapCallback(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
@@ -110,10 +121,13 @@ JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionResourceTrackingEn
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionEnableResourceTracking(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDisableResourceTracking(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStoreLastActivePanel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetCookies(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDeleteCookie(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDebuggerEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionEnableDebugger(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDisableDebugger(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAddBreakpoint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionUpdateBreakpoint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveBreakpoint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPauseInDebugger(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionResumeDebugger(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
@@ -129,6 +143,18 @@ JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDisableProfiler(JS
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStartProfiling(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionStopProfiling(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionProfiles(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionDispatchOnInjectedScript(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetChildNodes(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetTextNodeValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionNodeForId(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionWrapObject(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionUnwrapObject(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionPushNodePathToFrontend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionAddNodesToSearchResult(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSelectDatabase(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSelectDOMStorage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
 JSC::JSValue jsInspectorBackendConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.cpp b/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.cpp
index dc9389f..9ec80b0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.cpp
@@ -86,6 +86,11 @@ bool JSJavaScriptCallFramePrototype::getOwnPropertySlot(ExecState* exec, const I
     return getStaticFunctionSlot<JSObject>(exec, &JSJavaScriptCallFramePrototypeTable, this, propertyName, slot);
 }
 
+bool JSJavaScriptCallFramePrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSJavaScriptCallFramePrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSJavaScriptCallFrame::s_info = { "JavaScriptCallFrame", 0, &JSJavaScriptCallFrameTable, 0 };
 
 JSJavaScriptCallFrame::JSJavaScriptCallFrame(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<JavaScriptCallFrame> impl)
@@ -109,6 +114,11 @@ bool JSJavaScriptCallFrame::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSJavaScriptCallFrame, Base>(exec, &JSJavaScriptCallFrameTable, this, propertyName, slot);
 }
 
+bool JSJavaScriptCallFrame::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSJavaScriptCallFrame, Base>(exec, &JSJavaScriptCallFrameTable, this, propertyName, descriptor);
+}
+
 JSValue jsJavaScriptCallFrameCaller(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSJavaScriptCallFrame* castedThis = static_cast<JSJavaScriptCallFrame*>(asObject(slot.slotBase()));
@@ -162,7 +172,7 @@ JSValue jsJavaScriptCallFrameType(ExecState* exec, const Identifier&, const Prop
 JSValue JSC_HOST_CALL jsJavaScriptCallFramePrototypeFunctionEvaluate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSJavaScriptCallFrame::s_info))
+    if (!thisValue.inherits(&JSJavaScriptCallFrame::s_info))
         return throwError(exec, TypeError);
     JSJavaScriptCallFrame* castedThisObj = static_cast<JSJavaScriptCallFrame*>(asObject(thisValue));
     return castedThisObj->evaluate(exec, args);
@@ -174,7 +184,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, JavaScr
 }
 JavaScriptCallFrame* toJavaScriptCallFrame(JSC::JSValue value)
 {
-    return value.isObject(&JSJavaScriptCallFrame::s_info) ? static_cast<JSJavaScriptCallFrame*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSJavaScriptCallFrame::s_info) ? static_cast<JSJavaScriptCallFrame*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.h b/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.h
index 3dff1bc..bd63cf5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.h
@@ -39,6 +39,7 @@ public:
     virtual ~JSJavaScriptCallFrame();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -71,9 +72,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSJavaScriptCallFramePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.cpp
index 2c5d0bd..3d28a47 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.cpp
@@ -79,6 +79,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSKeyboardEventPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -95,6 +96,11 @@ bool JSKeyboardEventConstructor::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSKeyboardEventConstructor, DOMObject>(exec, &JSKeyboardEventConstructorTable, this, propertyName, slot);
 }
 
+bool JSKeyboardEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSKeyboardEventConstructor, DOMObject>(exec, &JSKeyboardEventConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSKeyboardEventPrototypeTableValues[2] =
@@ -122,6 +128,11 @@ bool JSKeyboardEventPrototype::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticFunctionSlot<JSObject>(exec, &JSKeyboardEventPrototypeTable, this, propertyName, slot);
 }
 
+bool JSKeyboardEventPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSKeyboardEventPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSKeyboardEvent::s_info = { "KeyboardEvent", &JSUIEvent::s_info, &JSKeyboardEventTable, 0 };
 
 JSKeyboardEvent::JSKeyboardEvent(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<KeyboardEvent> impl)
@@ -139,6 +150,11 @@ bool JSKeyboardEvent::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSKeyboardEvent, Base>(exec, &JSKeyboardEventTable, this, propertyName, slot);
 }
 
+bool JSKeyboardEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSKeyboardEvent, Base>(exec, &JSKeyboardEventTable, this, propertyName, descriptor);
+}
+
 JSValue jsKeyboardEventKeyIdentifier(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSKeyboardEvent* castedThis = static_cast<JSKeyboardEvent*>(asObject(slot.slotBase()));
@@ -208,7 +224,7 @@ JSValue JSKeyboardEvent::getConstructor(ExecState* exec, JSGlobalObject* globalO
 JSValue JSC_HOST_CALL jsKeyboardEventPrototypeFunctionInitKeyboardEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSKeyboardEvent::s_info))
+    if (!thisValue.inherits(&JSKeyboardEvent::s_info))
         return throwError(exec, TypeError);
     JSKeyboardEvent* castedThisObj = static_cast<JSKeyboardEvent*>(asObject(thisValue));
     KeyboardEvent* imp = static_cast<KeyboardEvent*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.h b/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.h
index b1ead27..1061c26 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.h
@@ -33,6 +33,7 @@ public:
     JSKeyboardEvent(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<KeyboardEvent>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -52,9 +53,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSKeyboardEventPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSLocation.cpp b/src/3rdparty/webkit/WebCore/generated/JSLocation.cpp
index f6d9be4..9df3a4d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSLocation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSLocation.cpp
@@ -86,6 +86,11 @@ bool JSLocationPrototype::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticFunctionSlot<JSObject>(exec, &JSLocationPrototypeTable, this, propertyName, slot);
 }
 
+bool JSLocationPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSLocationPrototypeTable, this, propertyName, descriptor);
+}
+
 void JSLocationPrototype::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (putDelegate(exec, propertyName, value, slot))
@@ -118,6 +123,13 @@ bool JSLocation::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSLocation, Base>(exec, &JSLocationTable, this, propertyName, slot);
 }
 
+bool JSLocation::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    if (getOwnPropertyDescriptorDelegate(exec, propertyName, descriptor))
+        return true;
+    return getStaticValueDescriptor<JSLocation, Base>(exec, &JSLocationTable, this, propertyName, descriptor);
+}
+
 JSValue jsLocationHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSLocation* castedThis = static_cast<JSLocation*>(asObject(slot.slotBase()));
@@ -232,7 +244,7 @@ void setJSLocationHash(ExecState* exec, JSObject* thisObject, JSValue value)
 JSValue JSC_HOST_CALL jsLocationPrototypeFunctionAssign(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSLocation::s_info))
+    if (!thisValue.inherits(&JSLocation::s_info))
         return throwError(exec, TypeError);
     JSLocation* castedThisObj = static_cast<JSLocation*>(asObject(thisValue));
     return castedThisObj->assign(exec, args);
@@ -241,7 +253,7 @@ JSValue JSC_HOST_CALL jsLocationPrototypeFunctionAssign(ExecState* exec, JSObjec
 JSValue JSC_HOST_CALL jsLocationPrototypeFunctionReplace(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSLocation::s_info))
+    if (!thisValue.inherits(&JSLocation::s_info))
         return throwError(exec, TypeError);
     JSLocation* castedThisObj = static_cast<JSLocation*>(asObject(thisValue));
     return castedThisObj->replace(exec, args);
@@ -250,7 +262,7 @@ JSValue JSC_HOST_CALL jsLocationPrototypeFunctionReplace(ExecState* exec, JSObje
 JSValue JSC_HOST_CALL jsLocationPrototypeFunctionReload(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSLocation::s_info))
+    if (!thisValue.inherits(&JSLocation::s_info))
         return throwError(exec, TypeError);
     JSLocation* castedThisObj = static_cast<JSLocation*>(asObject(thisValue));
     return castedThisObj->reload(exec, args);
@@ -259,7 +271,7 @@ JSValue JSC_HOST_CALL jsLocationPrototypeFunctionReload(ExecState* exec, JSObjec
 JSValue JSC_HOST_CALL jsLocationPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSLocation::s_info))
+    if (!thisValue.inherits(&JSLocation::s_info))
         return throwError(exec, TypeError);
     JSLocation* castedThisObj = static_cast<JSLocation*>(asObject(thisValue));
     return castedThisObj->toString(exec, args);
@@ -271,7 +283,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Locatio
 }
 Location* toLocation(JSC::JSValue value)
 {
-    return value.isObject(&JSLocation::s_info) ? static_cast<JSLocation*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSLocation::s_info) ? static_cast<JSLocation*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSLocation.h b/src/3rdparty/webkit/WebCore/generated/JSLocation.h
index 09ae2a0..54b41ce 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSLocation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSLocation.h
@@ -37,7 +37,9 @@ public:
     virtual ~JSLocation();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    bool getOwnPropertyDescriptorDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
@@ -48,8 +50,8 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&, bool checkDontDelete = true);
-    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype);
+    virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);
 
     // Custom attributes
@@ -83,9 +85,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMedia.cpp b/src/3rdparty/webkit/WebCore/generated/JSMedia.cpp
new file mode 100644
index 0000000..26dffa8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSMedia.cpp
@@ -0,0 +1,197 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSMedia.h"
+
+#include "KURL.h"
+#include "Media.h"
+#include <runtime/Error.h>
+#include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSMedia);
+
+/* Hash table */
+
+static const HashTableValue JSMediaTableValues[3] =
+{
+    { "type", DontDelete|ReadOnly, (intptr_t)jsMediaType, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)jsMediaConstructor, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSMediaTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 3, JSMediaTableValues, 0 };
+#else
+    { 4, 3, JSMediaTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSMediaConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSMediaConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSMediaConstructorTableValues, 0 };
+#else
+    { 1, 0, JSMediaConstructorTableValues, 0 };
+#endif
+
+class JSMediaConstructor : public DOMConstructorObject {
+public:
+    JSMediaConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSMediaConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSMediaPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+    }
+};
+
+const ClassInfo JSMediaConstructor::s_info = { "MediaConstructor", 0, &JSMediaConstructorTable, 0 };
+
+bool JSMediaConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSMediaConstructor, DOMObject>(exec, &JSMediaConstructorTable, this, propertyName, slot);
+}
+
+bool JSMediaConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSMediaConstructor, DOMObject>(exec, &JSMediaConstructorTable, this, propertyName, descriptor);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSMediaPrototypeTableValues[2] =
+{
+    { "matchMedium", DontDelete|Function, (intptr_t)jsMediaPrototypeFunctionMatchMedium, (intptr_t)1 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSMediaPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSMediaPrototypeTableValues, 0 };
+#else
+    { 2, 1, JSMediaPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSMediaPrototype::s_info = { "MediaPrototype", 0, &JSMediaPrototypeTable, 0 };
+
+JSObject* JSMediaPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSMedia>(exec, globalObject);
+}
+
+bool JSMediaPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSMediaPrototypeTable, this, propertyName, slot);
+}
+
+bool JSMediaPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSMediaPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSMedia::s_info = { "Media", 0, &JSMediaTable, 0 };
+
+JSMedia::JSMedia(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<Media> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
+    , m_impl(impl)
+{
+}
+
+JSMedia::~JSMedia()
+{
+    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+}
+
+JSObject* JSMedia::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSMediaPrototype(JSMediaPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSMedia::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSMedia, Base>(exec, &JSMediaTable, this, propertyName, slot);
+}
+
+bool JSMedia::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSMedia, Base>(exec, &JSMediaTable, this, propertyName, descriptor);
+}
+
+JSValue jsMediaType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSMedia* castedThis = static_cast<JSMedia*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    Media* imp = static_cast<Media*>(castedThis->impl());
+    return jsString(exec, imp->type());
+}
+
+JSValue jsMediaConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSMedia* domObject = static_cast<JSMedia*>(asObject(slot.slotBase()));
+    return JSMedia::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSMedia::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSMediaConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
+JSValue JSC_HOST_CALL jsMediaPrototypeFunctionMatchMedium(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSMedia::s_info))
+        return throwError(exec, TypeError);
+    JSMedia* castedThisObj = static_cast<JSMedia*>(asObject(thisValue));
+    Media* imp = static_cast<Media*>(castedThisObj->impl());
+    const UString& mediaquery = args.at(0).toString(exec);
+
+
+    JSC::JSValue result = jsBoolean(imp->matchMedium(mediaquery));
+    return result;
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Media* object)
+{
+    return getDOMObjectWrapper<JSMedia>(exec, globalObject, object);
+}
+Media* toMedia(JSC::JSValue value)
+{
+    return value.inherits(&JSMedia::s_info) ? static_cast<JSMedia*>(asObject(value))->impl() : 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMedia.h b/src/3rdparty/webkit/WebCore/generated/JSMedia.h
new file mode 100644
index 0000000..d59673b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSMedia.h
@@ -0,0 +1,84 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSMedia_h
+#define JSMedia_h
+
+#include "DOMObjectWithSVGContext.h"
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class Media;
+
+class JSMedia : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
+public:
+    JSMedia(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<Media>);
+    virtual ~JSMedia();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+    Media* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<Media> m_impl;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Media*);
+Media* toMedia(JSC::JSValue);
+
+class JSMediaPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+    }
+    JSMediaPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsMediaPrototypeFunctionMatchMedium(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsMediaType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMediaConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp b/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp
index 37b1b43..5a906ae 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp
@@ -76,6 +76,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSMediaErrorPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -92,6 +93,11 @@ bool JSMediaErrorConstructor::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSMediaErrorConstructor, DOMObject>(exec, &JSMediaErrorConstructorTable, this, propertyName, slot);
 }
 
+bool JSMediaErrorConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSMediaErrorConstructor, DOMObject>(exec, &JSMediaErrorConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSMediaErrorPrototypeTableValues[5] =
@@ -122,6 +128,11 @@ bool JSMediaErrorPrototype::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSMediaErrorPrototype, JSObject>(exec, &JSMediaErrorPrototypeTable, this, propertyName, slot);
 }
 
+bool JSMediaErrorPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSMediaErrorPrototype, JSObject>(exec, &JSMediaErrorPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSMediaError::s_info = { "MediaError", 0, &JSMediaErrorTable, 0 };
 
 JSMediaError::JSMediaError(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<MediaError> impl)
@@ -145,6 +156,11 @@ bool JSMediaError::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<JSMediaError, Base>(exec, &JSMediaErrorTable, this, propertyName, slot);
 }
 
+bool JSMediaError::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSMediaError, Base>(exec, &JSMediaErrorTable, this, propertyName, descriptor);
+}
+
 JSValue jsMediaErrorCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSMediaError* castedThis = static_cast<JSMediaError*>(asObject(slot.slotBase()));
@@ -191,7 +207,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, MediaEr
 }
 MediaError* toMediaError(JSC::JSValue value)
 {
-    return value.isObject(&JSMediaError::s_info) ? static_cast<JSMediaError*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSMediaError::s_info) ? static_cast<JSMediaError*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMediaError.h b/src/3rdparty/webkit/WebCore/generated/JSMediaError.h
index 5a159b9..519a7d6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMediaError.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMediaError.h
@@ -39,6 +39,7 @@ public:
     virtual ~JSMediaError();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -64,9 +65,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSMediaErrorPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp b/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp
index 73a2d13..8c5e097 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp
@@ -73,6 +73,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSMediaListPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -89,6 +90,11 @@ bool JSMediaListConstructor::getOwnPropertySlot(ExecState* exec, const Identifie
     return getStaticValueSlot<JSMediaListConstructor, DOMObject>(exec, &JSMediaListConstructorTable, this, propertyName, slot);
 }
 
+bool JSMediaListConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSMediaListConstructor, DOMObject>(exec, &JSMediaListConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSMediaListPrototypeTableValues[4] =
@@ -118,6 +124,11 @@ bool JSMediaListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticFunctionSlot<JSObject>(exec, &JSMediaListPrototypeTable, this, propertyName, slot);
 }
 
+bool JSMediaListPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSMediaListPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSMediaList::s_info = { "MediaList", 0, &JSMediaListTable, 0 };
 
 JSMediaList::JSMediaList(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<MediaList> impl)
@@ -152,6 +163,26 @@ bool JSMediaList::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return getStaticValueSlot<JSMediaList, Base>(exec, &JSMediaListTable, this, propertyName, slot);
 }
 
+bool JSMediaList::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    const HashEntry* entry = JSMediaListTable.entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        slot.setCustom(this, entry->propertyGetter());
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<MediaList*>(impl())->length()) {
+        PropertySlot slot;
+        slot.setCustomIndex(this, index, indexGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly);
+        return true;
+    }
+    return getStaticValueDescriptor<JSMediaList, Base>(exec, &JSMediaListTable, this, propertyName, descriptor);
+}
+
 bool JSMediaList::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
 {
     if (propertyName < static_cast<MediaList*>(impl())->length()) {
@@ -195,11 +226,11 @@ void setJSMediaListMediaText(ExecState* exec, JSObject* thisObject, JSValue valu
     setDOMException(exec, ec);
 }
 
-void JSMediaList::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSMediaList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     for (unsigned i = 0; i < static_cast<MediaList*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getPropertyNames(exec, propertyNames, listedAttributes);
+     Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 JSValue JSMediaList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -210,7 +241,7 @@ JSValue JSMediaList::getConstructor(ExecState* exec, JSGlobalObject* globalObjec
 JSValue JSC_HOST_CALL jsMediaListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSMediaList::s_info))
+    if (!thisValue.inherits(&JSMediaList::s_info))
         return throwError(exec, TypeError);
     JSMediaList* castedThisObj = static_cast<JSMediaList*>(asObject(thisValue));
     MediaList* imp = static_cast<MediaList*>(castedThisObj->impl());
@@ -224,7 +255,7 @@ JSValue JSC_HOST_CALL jsMediaListPrototypeFunctionItem(ExecState* exec, JSObject
 JSValue JSC_HOST_CALL jsMediaListPrototypeFunctionDeleteMedium(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSMediaList::s_info))
+    if (!thisValue.inherits(&JSMediaList::s_info))
         return throwError(exec, TypeError);
     JSMediaList* castedThisObj = static_cast<JSMediaList*>(asObject(thisValue));
     MediaList* imp = static_cast<MediaList*>(castedThisObj->impl());
@@ -239,7 +270,7 @@ JSValue JSC_HOST_CALL jsMediaListPrototypeFunctionDeleteMedium(ExecState* exec,
 JSValue JSC_HOST_CALL jsMediaListPrototypeFunctionAppendMedium(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSMediaList::s_info))
+    if (!thisValue.inherits(&JSMediaList::s_info))
         return throwError(exec, TypeError);
     JSMediaList* castedThisObj = static_cast<JSMediaList*>(asObject(thisValue));
     MediaList* imp = static_cast<MediaList*>(castedThisObj->impl());
@@ -263,7 +294,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, MediaLi
 }
 MediaList* toMediaList(JSC::JSValue value)
 {
-    return value.isObject(&JSMediaList::s_info) ? static_cast<JSMediaList*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSMediaList::s_info) ? static_cast<JSMediaList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMediaList.h b/src/3rdparty/webkit/WebCore/generated/JSMediaList.h
index 506eb7c..b32485f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMediaList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMediaList.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSMediaList();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
@@ -47,7 +48,7 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     MediaList* impl() const { return m_impl.get(); }
 
@@ -66,9 +67,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSMediaListPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.cpp b/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.cpp
index 9304f83..accf6e3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.cpp
@@ -100,6 +100,11 @@ bool JSMessageChannel::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSMessageChannel, Base>(exec, getJSMessageChannelTable(exec), this, propertyName, slot);
 }
 
+bool JSMessageChannel::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSMessageChannel, Base>(exec, getJSMessageChannelTable(exec), this, propertyName, descriptor);
+}
+
 JSValue jsMessageChannelPort1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSMessageChannel* castedThis = static_cast<JSMessageChannel*>(asObject(slot.slotBase()));
@@ -122,7 +127,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Message
 }
 MessageChannel* toMessageChannel(JSC::JSValue value)
 {
-    return value.isObject(&JSMessageChannel::s_info) ? static_cast<JSMessageChannel*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSMessageChannel::s_info) ? static_cast<JSMessageChannel*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.h b/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.h
index a56f7c3..216fbac 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSMessageChannel();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -45,7 +46,7 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void mark();
+    virtual void markChildren(JSC::MarkStack&);
 
     MessageChannel* impl() const { return m_impl.get(); }
 
@@ -62,6 +63,10 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
     JSMessageChannelPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.cpp
index 293655d..0c3c47b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.cpp
@@ -23,10 +23,8 @@
 
 #include "DOMWindow.h"
 #include "JSDOMWindow.h"
-#include "JSMessagePort.h"
 #include "KURL.h"
 #include "MessageEvent.h"
-#include "MessagePort.h"
 #include <runtime/Error.h>
 #include <runtime/JSString.h>
 #include <wtf/GetPtr.h>
@@ -45,7 +43,7 @@ static const HashTableValue JSMessageEventTableValues[7] =
     { "origin", DontDelete|ReadOnly, (intptr_t)jsMessageEventOrigin, (intptr_t)0 },
     { "lastEventId", DontDelete|ReadOnly, (intptr_t)jsMessageEventLastEventId, (intptr_t)0 },
     { "source", DontDelete|ReadOnly, (intptr_t)jsMessageEventSource, (intptr_t)0 },
-    { "messagePort", DontDelete|ReadOnly, (intptr_t)jsMessageEventMessagePort, (intptr_t)0 },
+    { "ports", DontDelete|ReadOnly, (intptr_t)jsMessageEventPorts, (intptr_t)0 },
     { "constructor", DontEnum|ReadOnly, (intptr_t)jsMessageEventConstructor, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
@@ -79,6 +77,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSMessageEventPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -95,6 +94,11 @@ bool JSMessageEventConstructor::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSMessageEventConstructor, DOMObject>(exec, &JSMessageEventConstructorTable, this, propertyName, slot);
 }
 
+bool JSMessageEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSMessageEventConstructor, DOMObject>(exec, &JSMessageEventConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSMessageEventPrototypeTableValues[2] =
@@ -126,6 +130,11 @@ bool JSMessageEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticFunctionSlot<JSObject>(exec, getJSMessageEventPrototypeTable(exec), this, propertyName, slot);
 }
 
+bool JSMessageEventPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, getJSMessageEventPrototypeTable(exec), this, propertyName, descriptor);
+}
+
 static const HashTable* getJSMessageEventTable(ExecState* exec)
 {
     return getHashTableForGlobalData(exec->globalData(), &JSMessageEventTable);
@@ -147,6 +156,11 @@ bool JSMessageEvent::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSMessageEvent, Base>(exec, getJSMessageEventTable(exec), this, propertyName, slot);
 }
 
+bool JSMessageEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSMessageEvent, Base>(exec, getJSMessageEventTable(exec), this, propertyName, descriptor);
+}
+
 JSValue jsMessageEventData(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSMessageEvent* castedThis = static_cast<JSMessageEvent*>(asObject(slot.slotBase()));
@@ -179,12 +193,10 @@ JSValue jsMessageEventSource(ExecState* exec, const Identifier&, const PropertyS
     return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->source()));
 }
 
-JSValue jsMessageEventMessagePort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessageEventPorts(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSMessageEvent* castedThis = static_cast<JSMessageEvent*>(asObject(slot.slotBase()));
-    UNUSED_PARAM(exec);
-    MessageEvent* imp = static_cast<MessageEvent*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->messagePort()));
+    return castedThis->ports(exec);
 }
 
 JSValue jsMessageEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -200,21 +212,10 @@ JSValue JSMessageEvent::getConstructor(ExecState* exec, JSGlobalObject* globalOb
 JSValue JSC_HOST_CALL jsMessageEventPrototypeFunctionInitMessageEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSMessageEvent::s_info))
+    if (!thisValue.inherits(&JSMessageEvent::s_info))
         return throwError(exec, TypeError);
     JSMessageEvent* castedThisObj = static_cast<JSMessageEvent*>(asObject(thisValue));
-    MessageEvent* imp = static_cast<MessageEvent*>(castedThisObj->impl());
-    const UString& typeArg = args.at(0).toString(exec);
-    bool canBubbleArg = args.at(1).toBoolean(exec);
-    bool cancelableArg = args.at(2).toBoolean(exec);
-    const UString& dataArg = args.at(3).toString(exec);
-    const UString& originArg = args.at(4).toString(exec);
-    const UString& lastEventIdArg = args.at(5).toString(exec);
-    DOMWindow* sourceArg = toDOMWindow(args.at(6));
-    MessagePort* messagePort = toMessagePort(args.at(7));
-
-    imp->initMessageEvent(typeArg, canBubbleArg, cancelableArg, dataArg, originArg, lastEventIdArg, sourceArg, messagePort);
-    return jsUndefined();
+    return castedThisObj->initMessageEvent(exec, args);
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.h b/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.h
index 34a0b9f..070fb31 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.h
@@ -33,6 +33,7 @@ public:
     JSMessageEvent(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<MessageEvent>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,6 +43,12 @@ public:
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+
+    // Custom attributes
+    JSC::JSValue ports(JSC::ExecState*) const;
+
+    // Custom functions
+    JSC::JSValue initMessageEvent(JSC::ExecState*, const JSC::ArgList&);
 };
 
 
@@ -52,9 +59,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSMessageEventPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
@@ -68,7 +76,7 @@ JSC::JSValue jsMessageEventData(JSC::ExecState*, const JSC::Identifier&, const J
 JSC::JSValue jsMessageEventOrigin(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsMessageEventLastEventId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsMessageEventSource(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsMessageEventMessagePort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMessageEventPorts(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsMessageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp b/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp
index 2969c22..7cbcc88 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp
@@ -27,7 +27,6 @@
 #include "JSDOMGlobalObject.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
-#include "JSMessagePort.h"
 #include "MessagePort.h"
 #include "PlatformString.h"
 #include <runtime/Error.h>
@@ -77,6 +76,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSMessagePortPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -93,6 +93,11 @@ bool JSMessagePortConstructor::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticValueSlot<JSMessagePortConstructor, DOMObject>(exec, &JSMessagePortConstructorTable, this, propertyName, slot);
 }
 
+bool JSMessagePortConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSMessagePortConstructor, DOMObject>(exec, &JSMessagePortConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSMessagePortPrototypeTableValues[7] =
@@ -129,6 +134,11 @@ bool JSMessagePortPrototype::getOwnPropertySlot(ExecState* exec, const Identifie
     return getStaticFunctionSlot<JSObject>(exec, getJSMessagePortPrototypeTable(exec), this, propertyName, slot);
 }
 
+bool JSMessagePortPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, getJSMessagePortPrototypeTable(exec), this, propertyName, descriptor);
+}
+
 static const HashTable* getJSMessagePortTable(ExecState* exec)
 {
     return getHashTableForGlobalData(exec->globalData(), &JSMessagePortTable);
@@ -156,6 +166,11 @@ bool JSMessagePort::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSMessagePort, Base>(exec, getJSMessagePortTable(exec), this, propertyName, slot);
 }
 
+bool JSMessagePort::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSMessagePort, Base>(exec, getJSMessagePortTable(exec), this, propertyName, descriptor);
+}
+
 JSValue jsMessagePortOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSMessagePort* castedThis = static_cast<JSMessagePort*>(asObject(slot.slotBase()));
@@ -196,31 +211,16 @@ JSValue JSMessagePort::getConstructor(ExecState* exec, JSGlobalObject* globalObj
 JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionPostMessage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSMessagePort::s_info))
+    if (!thisValue.inherits(&JSMessagePort::s_info))
         return throwError(exec, TypeError);
     JSMessagePort* castedThisObj = static_cast<JSMessagePort*>(asObject(thisValue));
-    MessagePort* imp = static_cast<MessagePort*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    const UString& message = args.at(0).toString(exec);
-
-    int argsCount = args.size();
-    if (argsCount < 2) {
-        imp->postMessage(message, ec);
-        setDOMException(exec, ec);
-        return jsUndefined();
-    }
-
-    MessagePort* messagePort = toMessagePort(args.at(1));
-
-    imp->postMessage(message, messagePort, ec);
-    setDOMException(exec, ec);
-    return jsUndefined();
+    return castedThisObj->postMessage(exec, args);
 }
 
 JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionStart(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSMessagePort::s_info))
+    if (!thisValue.inherits(&JSMessagePort::s_info))
         return throwError(exec, TypeError);
     JSMessagePort* castedThisObj = static_cast<JSMessagePort*>(asObject(thisValue));
     MessagePort* imp = static_cast<MessagePort*>(castedThisObj->impl());
@@ -232,7 +232,7 @@ JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionStart(ExecState* exec, JSObj
 JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionClose(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSMessagePort::s_info))
+    if (!thisValue.inherits(&JSMessagePort::s_info))
         return throwError(exec, TypeError);
     JSMessagePort* castedThisObj = static_cast<JSMessagePort*>(asObject(thisValue));
     MessagePort* imp = static_cast<MessagePort*>(castedThisObj->impl());
@@ -244,7 +244,7 @@ JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionClose(ExecState* exec, JSObj
 JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSMessagePort::s_info))
+    if (!thisValue.inherits(&JSMessagePort::s_info))
         return throwError(exec, TypeError);
     JSMessagePort* castedThisObj = static_cast<JSMessagePort*>(asObject(thisValue));
     return castedThisObj->addEventListener(exec, args);
@@ -253,7 +253,7 @@ JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionAddEventListener(ExecState*
 JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSMessagePort::s_info))
+    if (!thisValue.inherits(&JSMessagePort::s_info))
         return throwError(exec, TypeError);
     JSMessagePort* castedThisObj = static_cast<JSMessagePort*>(asObject(thisValue));
     return castedThisObj->removeEventListener(exec, args);
@@ -262,7 +262,7 @@ JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionRemoveEventListener(ExecStat
 JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSMessagePort::s_info))
+    if (!thisValue.inherits(&JSMessagePort::s_info))
         return throwError(exec, TypeError);
     JSMessagePort* castedThisObj = static_cast<JSMessagePort*>(asObject(thisValue));
     MessagePort* imp = static_cast<MessagePort*>(castedThisObj->impl());
@@ -281,7 +281,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Message
 }
 MessagePort* toMessagePort(JSC::JSValue value)
 {
-    return value.isObject(&JSMessagePort::s_info) ? static_cast<JSMessagePort*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSMessagePort::s_info) ? static_cast<JSMessagePort*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessagePort.h b/src/3rdparty/webkit/WebCore/generated/JSMessagePort.h
index 7db5838..ce6274e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessagePort.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessagePort.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSMessagePort();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -46,11 +47,12 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void mark();
+    virtual void markChildren(JSC::MarkStack&);
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 
     // Custom functions
+    JSC::JSValue postMessage(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue addEventListener(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue removeEventListener(JSC::ExecState*, const JSC::ArgList&);
     MessagePort* impl() const { return m_impl.get(); }
@@ -69,6 +71,7 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp b/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp
index e5ef403..0857400 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp
@@ -75,6 +75,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSMimeTypePrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -91,6 +92,11 @@ bool JSMimeTypeConstructor::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSMimeTypeConstructor, DOMObject>(exec, &JSMimeTypeConstructorTable, this, propertyName, slot);
 }
 
+bool JSMimeTypeConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSMimeTypeConstructor, DOMObject>(exec, &JSMimeTypeConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSMimeTypePrototypeTableValues[1] =
@@ -135,6 +141,11 @@ bool JSMimeType::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSMimeType, Base>(exec, &JSMimeTypeTable, this, propertyName, slot);
 }
 
+bool JSMimeType::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSMimeType, Base>(exec, &JSMimeTypeTable, this, propertyName, descriptor);
+}
+
 JSValue jsMimeTypeType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSMimeType* castedThis = static_cast<JSMimeType*>(asObject(slot.slotBase()));
@@ -183,7 +194,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, MimeTyp
 }
 MimeType* toMimeType(JSC::JSValue value)
 {
-    return value.isObject(&JSMimeType::s_info) ? static_cast<JSMimeType*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSMimeType::s_info) ? static_cast<JSMimeType*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMimeType.h b/src/3rdparty/webkit/WebCore/generated/JSMimeType.h
index 662945a..5f0dc2d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMimeType.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMimeType.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSMimeType();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp
index e1fab3f..5cc3fd4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp
@@ -74,6 +74,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSMimeTypeArrayPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -90,6 +91,11 @@ bool JSMimeTypeArrayConstructor::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSMimeTypeArrayConstructor, DOMObject>(exec, &JSMimeTypeArrayConstructorTable, this, propertyName, slot);
 }
 
+bool JSMimeTypeArrayConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSMimeTypeArrayConstructor, DOMObject>(exec, &JSMimeTypeArrayConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSMimeTypeArrayPrototypeTableValues[3] =
@@ -118,6 +124,11 @@ bool JSMimeTypeArrayPrototype::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticFunctionSlot<JSObject>(exec, &JSMimeTypeArrayPrototypeTable, this, propertyName, slot);
 }
 
+bool JSMimeTypeArrayPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSMimeTypeArrayPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSMimeTypeArray::s_info = { "MimeTypeArray", 0, &JSMimeTypeArrayTable, 0 };
 
 JSMimeTypeArray::JSMimeTypeArray(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<MimeTypeArray> impl)
@@ -156,6 +167,32 @@ bool JSMimeTypeArray::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSMimeTypeArray, Base>(exec, &JSMimeTypeArrayTable, this, propertyName, slot);
 }
 
+bool JSMimeTypeArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    const HashEntry* entry = JSMimeTypeArrayTable.entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        slot.setCustom(this, entry->propertyGetter());
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<MimeTypeArray*>(impl())->length()) {
+        PropertySlot slot;
+        slot.setCustomIndex(this, index, indexGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly);
+        return true;
+    }
+    if (canGetItemsForName(exec, static_cast<MimeTypeArray*>(impl()), propertyName)) {
+        PropertySlot slot;
+        slot.setCustom(this, nameGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    return getStaticValueDescriptor<JSMimeTypeArray, Base>(exec, &JSMimeTypeArrayTable, this, propertyName, descriptor);
+}
+
 bool JSMimeTypeArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
 {
     if (propertyName < static_cast<MimeTypeArray*>(impl())->length()) {
@@ -178,11 +215,11 @@ JSValue jsMimeTypeArrayConstructor(ExecState* exec, const Identifier&, const Pro
     JSMimeTypeArray* domObject = static_cast<JSMimeTypeArray*>(asObject(slot.slotBase()));
     return JSMimeTypeArray::getConstructor(exec, domObject->globalObject());
 }
-void JSMimeTypeArray::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSMimeTypeArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     for (unsigned i = 0; i < static_cast<MimeTypeArray*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getPropertyNames(exec, propertyNames, listedAttributes);
+     Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 JSValue JSMimeTypeArray::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -193,7 +230,7 @@ JSValue JSMimeTypeArray::getConstructor(ExecState* exec, JSGlobalObject* globalO
 JSValue JSC_HOST_CALL jsMimeTypeArrayPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSMimeTypeArray::s_info))
+    if (!thisValue.inherits(&JSMimeTypeArray::s_info))
         return throwError(exec, TypeError);
     JSMimeTypeArray* castedThisObj = static_cast<JSMimeTypeArray*>(asObject(thisValue));
     MimeTypeArray* imp = static_cast<MimeTypeArray*>(castedThisObj->impl());
@@ -207,7 +244,7 @@ JSValue JSC_HOST_CALL jsMimeTypeArrayPrototypeFunctionItem(ExecState* exec, JSOb
 JSValue JSC_HOST_CALL jsMimeTypeArrayPrototypeFunctionNamedItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSMimeTypeArray::s_info))
+    if (!thisValue.inherits(&JSMimeTypeArray::s_info))
         return throwError(exec, TypeError);
     JSMimeTypeArray* castedThisObj = static_cast<JSMimeTypeArray*>(asObject(thisValue));
     MimeTypeArray* imp = static_cast<MimeTypeArray*>(castedThisObj->impl());
@@ -230,7 +267,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, MimeTyp
 }
 MimeTypeArray* toMimeTypeArray(JSC::JSValue value)
 {
-    return value.isObject(&JSMimeTypeArray::s_info) ? static_cast<JSMimeTypeArray*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSMimeTypeArray::s_info) ? static_cast<JSMimeTypeArray*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.h b/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.h
index 184a79b..c95fe3c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSMimeTypeArray();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -46,7 +47,7 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     MimeTypeArray* impl() const { return m_impl.get(); }
 
@@ -68,9 +69,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSMimeTypeArrayPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.cpp
index 1ba4b0e..0cfbfd5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.cpp
@@ -93,6 +93,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSMouseEventPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -109,6 +110,11 @@ bool JSMouseEventConstructor::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSMouseEventConstructor, DOMObject>(exec, &JSMouseEventConstructorTable, this, propertyName, slot);
 }
 
+bool JSMouseEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSMouseEventConstructor, DOMObject>(exec, &JSMouseEventConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSMouseEventPrototypeTableValues[2] =
@@ -136,6 +142,11 @@ bool JSMouseEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticFunctionSlot<JSObject>(exec, &JSMouseEventPrototypeTable, this, propertyName, slot);
 }
 
+bool JSMouseEventPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSMouseEventPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSMouseEvent::s_info = { "MouseEvent", &JSUIEvent::s_info, &JSMouseEventTable, 0 };
 
 JSMouseEvent::JSMouseEvent(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<MouseEvent> impl)
@@ -153,6 +164,11 @@ bool JSMouseEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<JSMouseEvent, Base>(exec, &JSMouseEventTable, this, propertyName, slot);
 }
 
+bool JSMouseEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSMouseEvent, Base>(exec, &JSMouseEventTable, this, propertyName, descriptor);
+}
+
 JSValue jsMouseEventScreenX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSMouseEvent* castedThis = static_cast<JSMouseEvent*>(asObject(slot.slotBase()));
@@ -302,7 +318,7 @@ JSValue JSMouseEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObje
 JSValue JSC_HOST_CALL jsMouseEventPrototypeFunctionInitMouseEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSMouseEvent::s_info))
+    if (!thisValue.inherits(&JSMouseEvent::s_info))
         return throwError(exec, TypeError);
     JSMouseEvent* castedThisObj = static_cast<JSMouseEvent*>(asObject(thisValue));
     MouseEvent* imp = static_cast<MouseEvent*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.h b/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.h
index 73727e5..968edb1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.h
@@ -33,6 +33,7 @@ public:
     JSMouseEvent(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<MouseEvent>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -52,9 +53,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSMouseEventPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.cpp
index 7632b91..6cbf4b0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.cpp
@@ -81,6 +81,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSMutationEventPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -97,6 +98,11 @@ bool JSMutationEventConstructor::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSMutationEventConstructor, DOMObject>(exec, &JSMutationEventConstructorTable, this, propertyName, slot);
 }
 
+bool JSMutationEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSMutationEventConstructor, DOMObject>(exec, &JSMutationEventConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSMutationEventPrototypeTableValues[5] =
@@ -127,6 +133,11 @@ bool JSMutationEventPrototype::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticPropertySlot<JSMutationEventPrototype, JSObject>(exec, &JSMutationEventPrototypeTable, this, propertyName, slot);
 }
 
+bool JSMutationEventPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSMutationEventPrototype, JSObject>(exec, &JSMutationEventPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSMutationEvent::s_info = { "MutationEvent", &JSEvent::s_info, &JSMutationEventTable, 0 };
 
 JSMutationEvent::JSMutationEvent(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<MutationEvent> impl)
@@ -144,6 +155,11 @@ bool JSMutationEvent::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSMutationEvent, Base>(exec, &JSMutationEventTable, this, propertyName, slot);
 }
 
+bool JSMutationEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSMutationEvent, Base>(exec, &JSMutationEventTable, this, propertyName, descriptor);
+}
+
 JSValue jsMutationEventRelatedNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSMutationEvent* castedThis = static_cast<JSMutationEvent*>(asObject(slot.slotBase()));
@@ -197,7 +213,7 @@ JSValue JSMutationEvent::getConstructor(ExecState* exec, JSGlobalObject* globalO
 JSValue JSC_HOST_CALL jsMutationEventPrototypeFunctionInitMutationEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSMutationEvent::s_info))
+    if (!thisValue.inherits(&JSMutationEvent::s_info))
         return throwError(exec, TypeError);
     JSMutationEvent* castedThisObj = static_cast<JSMutationEvent*>(asObject(thisValue));
     MutationEvent* imp = static_cast<MutationEvent*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.h b/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.h
index faa1b64..fb609ae 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.h
@@ -33,6 +33,7 @@ public:
     JSMutationEvent(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<MutationEvent>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -52,9 +53,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSMutationEventPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp
index 84dd68e..71d3cef 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp
@@ -74,6 +74,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSNamedNodeMapPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -90,6 +91,11 @@ bool JSNamedNodeMapConstructor::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSNamedNodeMapConstructor, DOMObject>(exec, &JSNamedNodeMapConstructorTable, this, propertyName, slot);
 }
 
+bool JSNamedNodeMapConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSNamedNodeMapConstructor, DOMObject>(exec, &JSNamedNodeMapConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSNamedNodeMapPrototypeTableValues[8] =
@@ -123,6 +129,11 @@ bool JSNamedNodeMapPrototype::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticFunctionSlot<JSObject>(exec, &JSNamedNodeMapPrototypeTable, this, propertyName, slot);
 }
 
+bool JSNamedNodeMapPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSNamedNodeMapPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSNamedNodeMap::s_info = { "NamedNodeMap", 0, &JSNamedNodeMapTable, 0 };
 
 JSNamedNodeMap::JSNamedNodeMap(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<NamedNodeMap> impl)
@@ -165,6 +176,36 @@ bool JSNamedNodeMap::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSNamedNodeMap, Base>(exec, &JSNamedNodeMapTable, this, propertyName, slot);
 }
 
+bool JSNamedNodeMap::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    JSValue proto = prototype();
+    if (proto.isObject() && static_cast<JSObject*>(asObject(proto))->hasProperty(exec, propertyName))
+        return false;
+
+    const HashEntry* entry = JSNamedNodeMapTable.entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        slot.setCustom(this, entry->propertyGetter());
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<NamedNodeMap*>(impl())->length()) {
+        PropertySlot slot;
+        slot.setCustomIndex(this, index, indexGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly);
+        return true;
+    }
+    if (canGetItemsForName(exec, static_cast<NamedNodeMap*>(impl()), propertyName)) {
+        PropertySlot slot;
+        slot.setCustom(this, nameGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    return getStaticValueDescriptor<JSNamedNodeMap, Base>(exec, &JSNamedNodeMapTable, this, propertyName, descriptor);
+}
+
 bool JSNamedNodeMap::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
 {
     if (propertyName < static_cast<NamedNodeMap*>(impl())->length()) {
@@ -187,11 +228,11 @@ JSValue jsNamedNodeMapConstructor(ExecState* exec, const Identifier&, const Prop
     JSNamedNodeMap* domObject = static_cast<JSNamedNodeMap*>(asObject(slot.slotBase()));
     return JSNamedNodeMap::getConstructor(exec, domObject->globalObject());
 }
-void JSNamedNodeMap::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSNamedNodeMap::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     for (unsigned i = 0; i < static_cast<NamedNodeMap*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getPropertyNames(exec, propertyNames, listedAttributes);
+     Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 JSValue JSNamedNodeMap::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -202,7 +243,7 @@ JSValue JSNamedNodeMap::getConstructor(ExecState* exec, JSGlobalObject* globalOb
 JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionGetNamedItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNamedNodeMap::s_info))
+    if (!thisValue.inherits(&JSNamedNodeMap::s_info))
         return throwError(exec, TypeError);
     JSNamedNodeMap* castedThisObj = static_cast<JSNamedNodeMap*>(asObject(thisValue));
     NamedNodeMap* imp = static_cast<NamedNodeMap*>(castedThisObj->impl());
@@ -216,7 +257,7 @@ JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionGetNamedItem(ExecState* exe
 JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionSetNamedItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNamedNodeMap::s_info))
+    if (!thisValue.inherits(&JSNamedNodeMap::s_info))
         return throwError(exec, TypeError);
     JSNamedNodeMap* castedThisObj = static_cast<JSNamedNodeMap*>(asObject(thisValue));
     NamedNodeMap* imp = static_cast<NamedNodeMap*>(castedThisObj->impl());
@@ -232,7 +273,7 @@ JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionSetNamedItem(ExecState* exe
 JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionRemoveNamedItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNamedNodeMap::s_info))
+    if (!thisValue.inherits(&JSNamedNodeMap::s_info))
         return throwError(exec, TypeError);
     JSNamedNodeMap* castedThisObj = static_cast<JSNamedNodeMap*>(asObject(thisValue));
     NamedNodeMap* imp = static_cast<NamedNodeMap*>(castedThisObj->impl());
@@ -248,7 +289,7 @@ JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionRemoveNamedItem(ExecState*
 JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNamedNodeMap::s_info))
+    if (!thisValue.inherits(&JSNamedNodeMap::s_info))
         return throwError(exec, TypeError);
     JSNamedNodeMap* castedThisObj = static_cast<JSNamedNodeMap*>(asObject(thisValue));
     NamedNodeMap* imp = static_cast<NamedNodeMap*>(castedThisObj->impl());
@@ -262,7 +303,7 @@ JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionItem(ExecState* exec, JSObj
 JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionGetNamedItemNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNamedNodeMap::s_info))
+    if (!thisValue.inherits(&JSNamedNodeMap::s_info))
         return throwError(exec, TypeError);
     JSNamedNodeMap* castedThisObj = static_cast<JSNamedNodeMap*>(asObject(thisValue));
     NamedNodeMap* imp = static_cast<NamedNodeMap*>(castedThisObj->impl());
@@ -277,7 +318,7 @@ JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionGetNamedItemNS(ExecState* e
 JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionSetNamedItemNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNamedNodeMap::s_info))
+    if (!thisValue.inherits(&JSNamedNodeMap::s_info))
         return throwError(exec, TypeError);
     JSNamedNodeMap* castedThisObj = static_cast<JSNamedNodeMap*>(asObject(thisValue));
     NamedNodeMap* imp = static_cast<NamedNodeMap*>(castedThisObj->impl());
@@ -293,7 +334,7 @@ JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionSetNamedItemNS(ExecState* e
 JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionRemoveNamedItemNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNamedNodeMap::s_info))
+    if (!thisValue.inherits(&JSNamedNodeMap::s_info))
         return throwError(exec, TypeError);
     JSNamedNodeMap* castedThisObj = static_cast<JSNamedNodeMap*>(asObject(thisValue));
     NamedNodeMap* imp = static_cast<NamedNodeMap*>(castedThisObj->impl());
@@ -319,7 +360,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, NamedNo
 }
 NamedNodeMap* toNamedNodeMap(JSC::JSValue value)
 {
-    return value.isObject(&JSNamedNodeMap::s_info) ? static_cast<JSNamedNodeMap*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSNamedNodeMap::s_info) ? static_cast<JSNamedNodeMap*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h
index 7038f4d..3b73a2d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSNamedNodeMap();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -46,7 +47,7 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     NamedNodeMap* impl() const { return m_impl.get(); }
 
@@ -68,9 +69,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSNamedNodeMapPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNavigator.cpp b/src/3rdparty/webkit/WebCore/generated/JSNavigator.cpp
index 19dfdee..bf18b74 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNavigator.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNavigator.cpp
@@ -67,17 +67,18 @@ static JSC_CONST_HASHTABLE HashTable JSNavigatorTable =
 
 /* Hash table for prototype */
 
-static const HashTableValue JSNavigatorPrototypeTableValues[2] =
+static const HashTableValue JSNavigatorPrototypeTableValues[3] =
 {
     { "javaEnabled", DontDelete|Function, (intptr_t)jsNavigatorPrototypeFunctionJavaEnabled, (intptr_t)0 },
+    { "getStorageUpdates", DontDelete|Function, (intptr_t)jsNavigatorPrototypeFunctionGetStorageUpdates, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSNavigatorPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSNavigatorPrototypeTableValues, 0 };
+    { 1, JSNavigatorPrototypeTableValues, 0 };
 #else
-    { 2, 1, JSNavigatorPrototypeTableValues, 0 };
+    { 4, 3, JSNavigatorPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSNavigatorPrototype::s_info = { "NavigatorPrototype", 0, &JSNavigatorPrototypeTable, 0 };
@@ -92,6 +93,11 @@ bool JSNavigatorPrototype::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticFunctionSlot<JSObject>(exec, &JSNavigatorPrototypeTable, this, propertyName, slot);
 }
 
+bool JSNavigatorPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSNavigatorPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSNavigator::s_info = { "Navigator", 0, &JSNavigatorTable, 0 };
 
 JSNavigator::JSNavigator(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<Navigator> impl)
@@ -115,6 +121,11 @@ bool JSNavigator::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return getStaticValueSlot<JSNavigator, Base>(exec, &JSNavigatorTable, this, propertyName, slot);
 }
 
+bool JSNavigator::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSNavigator, Base>(exec, &JSNavigatorTable, this, propertyName, descriptor);
+}
+
 JSValue jsNavigatorAppCodeName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slot.slotBase()));
@@ -230,7 +241,7 @@ JSValue jsNavigatorOnLine(ExecState* exec, const Identifier&, const PropertySlot
 JSValue JSC_HOST_CALL jsNavigatorPrototypeFunctionJavaEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNavigator::s_info))
+    if (!thisValue.inherits(&JSNavigator::s_info))
         return throwError(exec, TypeError);
     JSNavigator* castedThisObj = static_cast<JSNavigator*>(asObject(thisValue));
     Navigator* imp = static_cast<Navigator*>(castedThisObj->impl());
@@ -240,13 +251,25 @@ JSValue JSC_HOST_CALL jsNavigatorPrototypeFunctionJavaEnabled(ExecState* exec, J
     return result;
 }
 
+JSValue JSC_HOST_CALL jsNavigatorPrototypeFunctionGetStorageUpdates(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSNavigator::s_info))
+        return throwError(exec, TypeError);
+    JSNavigator* castedThisObj = static_cast<JSNavigator*>(asObject(thisValue));
+    Navigator* imp = static_cast<Navigator*>(castedThisObj->impl());
+
+    imp->getStorageUpdates();
+    return jsUndefined();
+}
+
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Navigator* object)
 {
     return getDOMObjectWrapper<JSNavigator>(exec, globalObject, object);
 }
 Navigator* toNavigator(JSC::JSValue value)
 {
-    return value.isObject(&JSNavigator::s_info) ? static_cast<JSNavigator*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSNavigator::s_info) ? static_cast<JSNavigator*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNavigator.h b/src/3rdparty/webkit/WebCore/generated/JSNavigator.h
index b332f74..08706b2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNavigator.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNavigator.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSNavigator();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -45,7 +46,7 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void mark();
+    virtual void markChildren(JSC::MarkStack&);
 
     Navigator* impl() const { return m_impl.get(); }
 
@@ -63,6 +64,7 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
@@ -73,6 +75,7 @@ public:
 // Functions
 
 JSC::JSValue JSC_HOST_CALL jsNavigatorPrototypeFunctionJavaEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNavigatorPrototypeFunctionGetStorageUpdates(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
 JSC::JSValue jsNavigatorAppCodeName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNode.cpp b/src/3rdparty/webkit/WebCore/generated/JSNode.cpp
index 98d82ce..59f6004 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNode.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNode.cpp
@@ -118,6 +118,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSNodePrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -134,6 +135,11 @@ bool JSNodeConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSNodeConstructor, DOMObject>(exec, &JSNodeConstructorTable, this, propertyName, slot);
 }
 
+bool JSNodeConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSNodeConstructor, DOMObject>(exec, &JSNodeConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSNodePrototypeTableValues[37] =
@@ -196,6 +202,11 @@ bool JSNodePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticPropertySlot<JSNodePrototype, JSObject>(exec, &JSNodePrototypeTable, this, propertyName, slot);
 }
 
+bool JSNodePrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSNodePrototype, JSObject>(exec, &JSNodePrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSNode::s_info = { "Node", 0, &JSNodeTable, 0 };
 
 JSNode::JSNode(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<Node> impl)
@@ -393,7 +404,7 @@ JSValue JSNode::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
 JSValue JSC_HOST_CALL jsNodePrototypeFunctionInsertBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNode::s_info))
+    if (!thisValue.inherits(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     return castedThisObj->insertBefore(exec, args);
@@ -402,7 +413,7 @@ JSValue JSC_HOST_CALL jsNodePrototypeFunctionInsertBefore(ExecState* exec, JSObj
 JSValue JSC_HOST_CALL jsNodePrototypeFunctionReplaceChild(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNode::s_info))
+    if (!thisValue.inherits(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     return castedThisObj->replaceChild(exec, args);
@@ -411,7 +422,7 @@ JSValue JSC_HOST_CALL jsNodePrototypeFunctionReplaceChild(ExecState* exec, JSObj
 JSValue JSC_HOST_CALL jsNodePrototypeFunctionRemoveChild(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNode::s_info))
+    if (!thisValue.inherits(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     return castedThisObj->removeChild(exec, args);
@@ -420,7 +431,7 @@ JSValue JSC_HOST_CALL jsNodePrototypeFunctionRemoveChild(ExecState* exec, JSObje
 JSValue JSC_HOST_CALL jsNodePrototypeFunctionAppendChild(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNode::s_info))
+    if (!thisValue.inherits(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     return castedThisObj->appendChild(exec, args);
@@ -429,7 +440,7 @@ JSValue JSC_HOST_CALL jsNodePrototypeFunctionAppendChild(ExecState* exec, JSObje
 JSValue JSC_HOST_CALL jsNodePrototypeFunctionHasChildNodes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNode::s_info))
+    if (!thisValue.inherits(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
@@ -442,7 +453,7 @@ JSValue JSC_HOST_CALL jsNodePrototypeFunctionHasChildNodes(ExecState* exec, JSOb
 JSValue JSC_HOST_CALL jsNodePrototypeFunctionCloneNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNode::s_info))
+    if (!thisValue.inherits(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
@@ -456,7 +467,7 @@ JSValue JSC_HOST_CALL jsNodePrototypeFunctionCloneNode(ExecState* exec, JSObject
 JSValue JSC_HOST_CALL jsNodePrototypeFunctionNormalize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNode::s_info))
+    if (!thisValue.inherits(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
@@ -468,7 +479,7 @@ JSValue JSC_HOST_CALL jsNodePrototypeFunctionNormalize(ExecState* exec, JSObject
 JSValue JSC_HOST_CALL jsNodePrototypeFunctionIsSupported(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNode::s_info))
+    if (!thisValue.inherits(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
@@ -483,7 +494,7 @@ JSValue JSC_HOST_CALL jsNodePrototypeFunctionIsSupported(ExecState* exec, JSObje
 JSValue JSC_HOST_CALL jsNodePrototypeFunctionHasAttributes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNode::s_info))
+    if (!thisValue.inherits(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
@@ -496,7 +507,7 @@ JSValue JSC_HOST_CALL jsNodePrototypeFunctionHasAttributes(ExecState* exec, JSOb
 JSValue JSC_HOST_CALL jsNodePrototypeFunctionIsSameNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNode::s_info))
+    if (!thisValue.inherits(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
@@ -510,7 +521,7 @@ JSValue JSC_HOST_CALL jsNodePrototypeFunctionIsSameNode(ExecState* exec, JSObjec
 JSValue JSC_HOST_CALL jsNodePrototypeFunctionIsEqualNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNode::s_info))
+    if (!thisValue.inherits(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
@@ -524,7 +535,7 @@ JSValue JSC_HOST_CALL jsNodePrototypeFunctionIsEqualNode(ExecState* exec, JSObje
 JSValue JSC_HOST_CALL jsNodePrototypeFunctionLookupPrefix(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNode::s_info))
+    if (!thisValue.inherits(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
@@ -538,7 +549,7 @@ JSValue JSC_HOST_CALL jsNodePrototypeFunctionLookupPrefix(ExecState* exec, JSObj
 JSValue JSC_HOST_CALL jsNodePrototypeFunctionIsDefaultNamespace(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNode::s_info))
+    if (!thisValue.inherits(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
@@ -552,7 +563,7 @@ JSValue JSC_HOST_CALL jsNodePrototypeFunctionIsDefaultNamespace(ExecState* exec,
 JSValue JSC_HOST_CALL jsNodePrototypeFunctionLookupNamespaceURI(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNode::s_info))
+    if (!thisValue.inherits(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
@@ -566,7 +577,7 @@ JSValue JSC_HOST_CALL jsNodePrototypeFunctionLookupNamespaceURI(ExecState* exec,
 JSValue JSC_HOST_CALL jsNodePrototypeFunctionCompareDocumentPosition(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNode::s_info))
+    if (!thisValue.inherits(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
@@ -580,7 +591,7 @@ JSValue JSC_HOST_CALL jsNodePrototypeFunctionCompareDocumentPosition(ExecState*
 JSValue JSC_HOST_CALL jsNodePrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNode::s_info))
+    if (!thisValue.inherits(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     return castedThisObj->addEventListener(exec, args);
@@ -589,7 +600,7 @@ JSValue JSC_HOST_CALL jsNodePrototypeFunctionAddEventListener(ExecState* exec, J
 JSValue JSC_HOST_CALL jsNodePrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNode::s_info))
+    if (!thisValue.inherits(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     return castedThisObj->removeEventListener(exec, args);
@@ -598,7 +609,7 @@ JSValue JSC_HOST_CALL jsNodePrototypeFunctionRemoveEventListener(ExecState* exec
 JSValue JSC_HOST_CALL jsNodePrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNode::s_info))
+    if (!thisValue.inherits(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
@@ -705,7 +716,7 @@ JSValue jsNodeDOCUMENT_POSITION_IMPLEMENTATION_SPECIFIC(ExecState* exec, const I
 
 Node* toNode(JSC::JSValue value)
 {
-    return value.isObject(&JSNode::s_info) ? static_cast<JSNode*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSNode::s_info) ? static_cast<JSNode*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNode.h b/src/3rdparty/webkit/WebCore/generated/JSNode.h
index d4d1f59..33410d6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNode.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNode.h
@@ -39,6 +39,7 @@ public:
     virtual ~JSNode();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -48,7 +49,7 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void mark();
+    virtual void markChildren(JSC::MarkStack&);
 
     virtual void pushEventHandlerScope(JSC::ExecState*, JSC::ScopeChain&) const;
 
@@ -72,6 +73,11 @@ ALWAYS_INLINE bool JSNode::getOwnPropertySlot(JSC::ExecState* exec, const JSC::I
     return JSC::getStaticValueSlot<JSNode, Base>(exec, s_info.staticPropHashTable, this, propertyName, slot);
 }
 
+ALWAYS_INLINE bool JSNode::getOwnPropertyDescriptor(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertyDescriptor& descriptor)
+{
+    return JSC::getStaticValueDescriptor<JSNode, Base>(exec, s_info.staticPropHashTable, this, propertyName, descriptor);
+}
+
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Node*);
 Node* toNode(JSC::JSValue);
 JSC::JSValue toJSNewlyCreated(JSC::ExecState*, JSDOMGlobalObject*, Node*);
@@ -83,6 +89,7 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp b/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp
index ead0b47..e4c50ba 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp
@@ -84,6 +84,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSNodeFilterPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -100,6 +101,11 @@ bool JSNodeFilterConstructor::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSNodeFilterConstructor, DOMObject>(exec, &JSNodeFilterConstructorTable, this, propertyName, slot);
 }
 
+bool JSNodeFilterConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSNodeFilterConstructor, DOMObject>(exec, &JSNodeFilterConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSNodeFilterPrototypeTableValues[18] =
@@ -143,6 +149,11 @@ bool JSNodeFilterPrototype::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticPropertySlot<JSNodeFilterPrototype, JSObject>(exec, &JSNodeFilterPrototypeTable, this, propertyName, slot);
 }
 
+bool JSNodeFilterPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSNodeFilterPrototype, JSObject>(exec, &JSNodeFilterPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSNodeFilter::s_info = { "NodeFilter", 0, &JSNodeFilterTable, 0 };
 
 JSNodeFilter::JSNodeFilter(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<NodeFilter> impl)
@@ -166,6 +177,11 @@ bool JSNodeFilter::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<JSNodeFilter, Base>(exec, &JSNodeFilterTable, this, propertyName, slot);
 }
 
+bool JSNodeFilter::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSNodeFilter, Base>(exec, &JSNodeFilterTable, this, propertyName, descriptor);
+}
+
 JSValue jsNodeFilterConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSNodeFilter* domObject = static_cast<JSNodeFilter*>(asObject(slot.slotBase()));
@@ -179,7 +195,7 @@ JSValue JSNodeFilter::getConstructor(ExecState* exec, JSGlobalObject* globalObje
 JSValue JSC_HOST_CALL jsNodeFilterPrototypeFunctionAcceptNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNodeFilter::s_info))
+    if (!thisValue.inherits(&JSNodeFilter::s_info))
         return throwError(exec, TypeError);
     JSNodeFilter* castedThisObj = static_cast<JSNodeFilter*>(asObject(thisValue));
     return castedThisObj->acceptNode(exec, args);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.h b/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.h
index b955a03..03d0b85 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSNodeFilter();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -45,7 +46,7 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void mark();
+    virtual void markChildren(JSC::MarkStack&);
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 
@@ -67,6 +68,7 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp b/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp
index 81613a0..0f4167d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp
@@ -79,6 +79,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSNodeIteratorPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -95,6 +96,11 @@ bool JSNodeIteratorConstructor::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSNodeIteratorConstructor, DOMObject>(exec, &JSNodeIteratorConstructorTable, this, propertyName, slot);
 }
 
+bool JSNodeIteratorConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSNodeIteratorConstructor, DOMObject>(exec, &JSNodeIteratorConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSNodeIteratorPrototypeTableValues[4] =
@@ -124,6 +130,11 @@ bool JSNodeIteratorPrototype::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticFunctionSlot<JSObject>(exec, &JSNodeIteratorPrototypeTable, this, propertyName, slot);
 }
 
+bool JSNodeIteratorPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSNodeIteratorPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSNodeIterator::s_info = { "NodeIterator", 0, &JSNodeIteratorTable, 0 };
 
 JSNodeIterator::JSNodeIterator(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<NodeIterator> impl)
@@ -147,6 +158,11 @@ bool JSNodeIterator::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSNodeIterator, Base>(exec, &JSNodeIteratorTable, this, propertyName, slot);
 }
 
+bool JSNodeIterator::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSNodeIterator, Base>(exec, &JSNodeIteratorTable, this, propertyName, descriptor);
+}
+
 JSValue jsNodeIteratorRoot(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSNodeIterator* castedThis = static_cast<JSNodeIterator*>(asObject(slot.slotBase()));
@@ -208,7 +224,7 @@ JSValue JSNodeIterator::getConstructor(ExecState* exec, JSGlobalObject* globalOb
 JSValue JSC_HOST_CALL jsNodeIteratorPrototypeFunctionNextNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNodeIterator::s_info))
+    if (!thisValue.inherits(&JSNodeIterator::s_info))
         return throwError(exec, TypeError);
     JSNodeIterator* castedThisObj = static_cast<JSNodeIterator*>(asObject(thisValue));
     return castedThisObj->nextNode(exec, args);
@@ -217,7 +233,7 @@ JSValue JSC_HOST_CALL jsNodeIteratorPrototypeFunctionNextNode(ExecState* exec, J
 JSValue JSC_HOST_CALL jsNodeIteratorPrototypeFunctionPreviousNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNodeIterator::s_info))
+    if (!thisValue.inherits(&JSNodeIterator::s_info))
         return throwError(exec, TypeError);
     JSNodeIterator* castedThisObj = static_cast<JSNodeIterator*>(asObject(thisValue));
     return castedThisObj->previousNode(exec, args);
@@ -226,7 +242,7 @@ JSValue JSC_HOST_CALL jsNodeIteratorPrototypeFunctionPreviousNode(ExecState* exe
 JSValue JSC_HOST_CALL jsNodeIteratorPrototypeFunctionDetach(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNodeIterator::s_info))
+    if (!thisValue.inherits(&JSNodeIterator::s_info))
         return throwError(exec, TypeError);
     JSNodeIterator* castedThisObj = static_cast<JSNodeIterator*>(asObject(thisValue));
     NodeIterator* imp = static_cast<NodeIterator*>(castedThisObj->impl());
@@ -241,7 +257,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, NodeIte
 }
 NodeIterator* toNodeIterator(JSC::JSValue value)
 {
-    return value.isObject(&JSNodeIterator::s_info) ? static_cast<JSNodeIterator*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSNodeIterator::s_info) ? static_cast<JSNodeIterator*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.h b/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.h
index e521a05..a030f7d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSNodeIterator();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -45,7 +46,7 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void mark();
+    virtual void markChildren(JSC::MarkStack&);
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 
@@ -68,6 +69,7 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp b/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp
index c8fa413..892ba5b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp
@@ -75,6 +75,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSNodeListPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -91,6 +92,11 @@ bool JSNodeListConstructor::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSNodeListConstructor, DOMObject>(exec, &JSNodeListConstructorTable, this, propertyName, slot);
 }
 
+bool JSNodeListConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSNodeListConstructor, DOMObject>(exec, &JSNodeListConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSNodeListPrototypeTableValues[2] =
@@ -118,6 +124,11 @@ bool JSNodeListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticFunctionSlot<JSObject>(exec, &JSNodeListPrototypeTable, this, propertyName, slot);
 }
 
+bool JSNodeListPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSNodeListPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSNodeList::s_info = { "NodeList", 0, &JSNodeListTable, 0 };
 
 JSNodeList::JSNodeList(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<NodeList> impl)
@@ -156,6 +167,32 @@ bool JSNodeList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSNodeList, Base>(exec, &JSNodeListTable, this, propertyName, slot);
 }
 
+bool JSNodeList::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    const HashEntry* entry = JSNodeListTable.entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        slot.setCustom(this, entry->propertyGetter());
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<NodeList*>(impl())->length()) {
+        PropertySlot slot;
+        slot.setCustomIndex(this, index, indexGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly);
+        return true;
+    }
+    if (canGetItemsForName(exec, static_cast<NodeList*>(impl()), propertyName)) {
+        PropertySlot slot;
+        slot.setCustom(this, nameGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    return getStaticValueDescriptor<JSNodeList, Base>(exec, &JSNodeListTable, this, propertyName, descriptor);
+}
+
 bool JSNodeList::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
 {
     if (propertyName < static_cast<NodeList*>(impl())->length()) {
@@ -178,11 +215,11 @@ JSValue jsNodeListConstructor(ExecState* exec, const Identifier&, const Property
     JSNodeList* domObject = static_cast<JSNodeList*>(asObject(slot.slotBase()));
     return JSNodeList::getConstructor(exec, domObject->globalObject());
 }
-void JSNodeList::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSNodeList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     for (unsigned i = 0; i < static_cast<NodeList*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getPropertyNames(exec, propertyNames, listedAttributes);
+     Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 JSValue JSNodeList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -193,7 +230,7 @@ JSValue JSNodeList::getConstructor(ExecState* exec, JSGlobalObject* globalObject
 JSValue JSC_HOST_CALL jsNodeListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSNodeList::s_info))
+    if (!thisValue.inherits(&JSNodeList::s_info))
         return throwError(exec, TypeError);
     JSNodeList* castedThisObj = static_cast<JSNodeList*>(asObject(thisValue));
     NodeList* imp = static_cast<NodeList*>(castedThisObj->impl());
@@ -220,7 +257,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, NodeLis
 }
 NodeList* toNodeList(JSC::JSValue value)
 {
-    return value.isObject(&JSNodeList::s_info) ? static_cast<JSNodeList*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSNodeList::s_info) ? static_cast<JSNodeList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeList.h b/src/3rdparty/webkit/WebCore/generated/JSNodeList.h
index 5314d58..9947754 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeList.h
@@ -38,6 +38,7 @@ public:
     virtual ~JSNodeList();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -49,7 +50,7 @@ public:
 
     virtual JSC::CallType getCallData(JSC::CallData&);
 
-    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     NodeList* impl() const { return m_impl.get(); }
 
@@ -71,9 +72,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSNodeListPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNotation.cpp b/src/3rdparty/webkit/WebCore/generated/JSNotation.cpp
index 31b9d18..8377987 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNotation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNotation.cpp
@@ -70,6 +70,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSNotationPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -86,6 +87,11 @@ bool JSNotationConstructor::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSNotationConstructor, DOMObject>(exec, &JSNotationConstructorTable, this, propertyName, slot);
 }
 
+bool JSNotationConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSNotationConstructor, DOMObject>(exec, &JSNotationConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSNotationPrototypeTableValues[1] =
@@ -124,6 +130,11 @@ bool JSNotation::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSNotation, Base>(exec, &JSNotationTable, this, propertyName, slot);
 }
 
+bool JSNotation::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSNotation, Base>(exec, &JSNotationTable, this, propertyName, descriptor);
+}
+
 JSValue jsNotationPublicId(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSNotation* castedThis = static_cast<JSNotation*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNotation.h b/src/3rdparty/webkit/WebCore/generated/JSNotation.h
index 5928834..bd23be1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNotation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNotation.h
@@ -33,6 +33,7 @@ public:
     JSNotation(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<Notation>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.cpp
index 69715e3..215853b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.cpp
@@ -75,6 +75,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSOverflowEventPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -91,6 +92,11 @@ bool JSOverflowEventConstructor::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSOverflowEventConstructor, DOMObject>(exec, &JSOverflowEventConstructorTable, this, propertyName, slot);
 }
 
+bool JSOverflowEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSOverflowEventConstructor, DOMObject>(exec, &JSOverflowEventConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSOverflowEventPrototypeTableValues[5] =
@@ -121,6 +127,11 @@ bool JSOverflowEventPrototype::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticPropertySlot<JSOverflowEventPrototype, JSObject>(exec, &JSOverflowEventPrototypeTable, this, propertyName, slot);
 }
 
+bool JSOverflowEventPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSOverflowEventPrototype, JSObject>(exec, &JSOverflowEventPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSOverflowEvent::s_info = { "OverflowEvent", &JSEvent::s_info, &JSOverflowEventTable, 0 };
 
 JSOverflowEvent::JSOverflowEvent(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<OverflowEvent> impl)
@@ -138,6 +149,11 @@ bool JSOverflowEvent::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSOverflowEvent, Base>(exec, &JSOverflowEventTable, this, propertyName, slot);
 }
 
+bool JSOverflowEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSOverflowEvent, Base>(exec, &JSOverflowEventTable, this, propertyName, descriptor);
+}
+
 JSValue jsOverflowEventOrient(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSOverflowEvent* castedThis = static_cast<JSOverflowEvent*>(asObject(slot.slotBase()));
@@ -175,7 +191,7 @@ JSValue JSOverflowEvent::getConstructor(ExecState* exec, JSGlobalObject* globalO
 JSValue JSC_HOST_CALL jsOverflowEventPrototypeFunctionInitOverflowEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSOverflowEvent::s_info))
+    if (!thisValue.inherits(&JSOverflowEvent::s_info))
         return throwError(exec, TypeError);
     JSOverflowEvent* castedThisObj = static_cast<JSOverflowEvent*>(asObject(thisValue));
     OverflowEvent* imp = static_cast<OverflowEvent*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.h b/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.h
index f179a71..2b75c9d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.h
@@ -33,6 +33,7 @@ public:
     JSOverflowEvent(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<OverflowEvent>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -52,9 +53,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSOverflowEventPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.cpp
new file mode 100644
index 0000000..4e365d0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.cpp
@@ -0,0 +1,183 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSPageTransitionEvent.h"
+
+#include "PageTransitionEvent.h"
+#include <runtime/Error.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSPageTransitionEvent);
+
+/* Hash table */
+
+static const HashTableValue JSPageTransitionEventTableValues[3] =
+{
+    { "persisted", DontDelete|ReadOnly, (intptr_t)jsPageTransitionEventPersisted, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)jsPageTransitionEventConstructor, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSPageTransitionEventTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 1, JSPageTransitionEventTableValues, 0 };
+#else
+    { 4, 3, JSPageTransitionEventTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSPageTransitionEventConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSPageTransitionEventConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSPageTransitionEventConstructorTableValues, 0 };
+#else
+    { 1, 0, JSPageTransitionEventConstructorTableValues, 0 };
+#endif
+
+class JSPageTransitionEventConstructor : public DOMConstructorObject {
+public:
+    JSPageTransitionEventConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSPageTransitionEventConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSPageTransitionEventPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+    }
+};
+
+const ClassInfo JSPageTransitionEventConstructor::s_info = { "PageTransitionEventConstructor", 0, &JSPageTransitionEventConstructorTable, 0 };
+
+bool JSPageTransitionEventConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSPageTransitionEventConstructor, DOMObject>(exec, &JSPageTransitionEventConstructorTable, this, propertyName, slot);
+}
+
+bool JSPageTransitionEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSPageTransitionEventConstructor, DOMObject>(exec, &JSPageTransitionEventConstructorTable, this, propertyName, descriptor);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSPageTransitionEventPrototypeTableValues[2] =
+{
+    { "initPageTransitionEvent", DontDelete|Function, (intptr_t)jsPageTransitionEventPrototypeFunctionInitPageTransitionEvent, (intptr_t)4 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSPageTransitionEventPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSPageTransitionEventPrototypeTableValues, 0 };
+#else
+    { 2, 1, JSPageTransitionEventPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSPageTransitionEventPrototype::s_info = { "PageTransitionEventPrototype", 0, &JSPageTransitionEventPrototypeTable, 0 };
+
+JSObject* JSPageTransitionEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSPageTransitionEvent>(exec, globalObject);
+}
+
+bool JSPageTransitionEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSPageTransitionEventPrototypeTable, this, propertyName, slot);
+}
+
+bool JSPageTransitionEventPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSPageTransitionEventPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSPageTransitionEvent::s_info = { "PageTransitionEvent", &JSEvent::s_info, &JSPageTransitionEventTable, 0 };
+
+JSPageTransitionEvent::JSPageTransitionEvent(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<PageTransitionEvent> impl)
+    : JSEvent(structure, globalObject, impl)
+{
+}
+
+JSObject* JSPageTransitionEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSPageTransitionEventPrototype(JSPageTransitionEventPrototype::createStructure(JSEventPrototype::self(exec, globalObject)));
+}
+
+bool JSPageTransitionEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSPageTransitionEvent, Base>(exec, &JSPageTransitionEventTable, this, propertyName, slot);
+}
+
+bool JSPageTransitionEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSPageTransitionEvent, Base>(exec, &JSPageTransitionEventTable, this, propertyName, descriptor);
+}
+
+JSValue jsPageTransitionEventPersisted(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSPageTransitionEvent* castedThis = static_cast<JSPageTransitionEvent*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    PageTransitionEvent* imp = static_cast<PageTransitionEvent*>(castedThis->impl());
+    return jsBoolean(imp->persisted());
+}
+
+JSValue jsPageTransitionEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSPageTransitionEvent* domObject = static_cast<JSPageTransitionEvent*>(asObject(slot.slotBase()));
+    return JSPageTransitionEvent::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSPageTransitionEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSPageTransitionEventConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
+JSValue JSC_HOST_CALL jsPageTransitionEventPrototypeFunctionInitPageTransitionEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSPageTransitionEvent::s_info))
+        return throwError(exec, TypeError);
+    JSPageTransitionEvent* castedThisObj = static_cast<JSPageTransitionEvent*>(asObject(thisValue));
+    PageTransitionEvent* imp = static_cast<PageTransitionEvent*>(castedThisObj->impl());
+    const UString& typeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
+    bool persisted = args.at(3).toBoolean(exec);
+
+    imp->initPageTransitionEvent(typeArg, canBubbleArg, cancelableArg, persisted);
+    return jsUndefined();
+}
+
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.h b/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.h
new file mode 100644
index 0000000..5f9cd3b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSPageTransitionEvent.h
@@ -0,0 +1,74 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSPageTransitionEvent_h
+#define JSPageTransitionEvent_h
+
+#include "JSEvent.h"
+
+namespace WebCore {
+
+class PageTransitionEvent;
+
+class JSPageTransitionEvent : public JSEvent {
+    typedef JSEvent Base;
+public:
+    JSPageTransitionEvent(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<PageTransitionEvent>);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+};
+
+
+class JSPageTransitionEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+    }
+    JSPageTransitionEventPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsPageTransitionEventPrototypeFunctionInitPageTransitionEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsPageTransitionEventPersisted(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPageTransitionEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp b/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp
index 7628617..e23dc5a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp
@@ -79,6 +79,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSPluginPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -95,6 +96,11 @@ bool JSPluginConstructor::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSPluginConstructor, DOMObject>(exec, &JSPluginConstructorTable, this, propertyName, slot);
 }
 
+bool JSPluginConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSPluginConstructor, DOMObject>(exec, &JSPluginConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSPluginPrototypeTableValues[3] =
@@ -123,6 +129,11 @@ bool JSPluginPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticFunctionSlot<JSObject>(exec, &JSPluginPrototypeTable, this, propertyName, slot);
 }
 
+bool JSPluginPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSPluginPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSPlugin::s_info = { "Plugin", 0, &JSPluginTable, 0 };
 
 JSPlugin::JSPlugin(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<Plugin> impl)
@@ -161,6 +172,32 @@ bool JSPlugin::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNam
     return getStaticValueSlot<JSPlugin, Base>(exec, &JSPluginTable, this, propertyName, slot);
 }
 
+bool JSPlugin::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    const HashEntry* entry = JSPluginTable.entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        slot.setCustom(this, entry->propertyGetter());
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<Plugin*>(impl())->length()) {
+        PropertySlot slot;
+        slot.setCustomIndex(this, index, indexGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly);
+        return true;
+    }
+    if (canGetItemsForName(exec, static_cast<Plugin*>(impl()), propertyName)) {
+        PropertySlot slot;
+        slot.setCustom(this, nameGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    return getStaticValueDescriptor<JSPlugin, Base>(exec, &JSPluginTable, this, propertyName, descriptor);
+}
+
 bool JSPlugin::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
 {
     if (propertyName < static_cast<Plugin*>(impl())->length()) {
@@ -207,11 +244,11 @@ JSValue jsPluginConstructor(ExecState* exec, const Identifier&, const PropertySl
     JSPlugin* domObject = static_cast<JSPlugin*>(asObject(slot.slotBase()));
     return JSPlugin::getConstructor(exec, domObject->globalObject());
 }
-void JSPlugin::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSPlugin::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     for (unsigned i = 0; i < static_cast<Plugin*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getPropertyNames(exec, propertyNames, listedAttributes);
+     Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 JSValue JSPlugin::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -222,7 +259,7 @@ JSValue JSPlugin::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
 JSValue JSC_HOST_CALL jsPluginPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSPlugin::s_info))
+    if (!thisValue.inherits(&JSPlugin::s_info))
         return throwError(exec, TypeError);
     JSPlugin* castedThisObj = static_cast<JSPlugin*>(asObject(thisValue));
     Plugin* imp = static_cast<Plugin*>(castedThisObj->impl());
@@ -236,7 +273,7 @@ JSValue JSC_HOST_CALL jsPluginPrototypeFunctionItem(ExecState* exec, JSObject*,
 JSValue JSC_HOST_CALL jsPluginPrototypeFunctionNamedItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSPlugin::s_info))
+    if (!thisValue.inherits(&JSPlugin::s_info))
         return throwError(exec, TypeError);
     JSPlugin* castedThisObj = static_cast<JSPlugin*>(asObject(thisValue));
     Plugin* imp = static_cast<Plugin*>(castedThisObj->impl());
@@ -259,7 +296,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Plugin*
 }
 Plugin* toPlugin(JSC::JSValue value)
 {
-    return value.isObject(&JSPlugin::s_info) ? static_cast<JSPlugin*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSPlugin::s_info) ? static_cast<JSPlugin*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPlugin.h b/src/3rdparty/webkit/WebCore/generated/JSPlugin.h
index 18f9b78..e0860f8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPlugin.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSPlugin.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSPlugin();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -46,7 +47,7 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     Plugin* impl() const { return m_impl.get(); }
 
@@ -68,9 +69,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSPluginPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp
index 45a49e2..9f46e08 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp
@@ -74,6 +74,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSPluginArrayPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -90,6 +91,11 @@ bool JSPluginArrayConstructor::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticValueSlot<JSPluginArrayConstructor, DOMObject>(exec, &JSPluginArrayConstructorTable, this, propertyName, slot);
 }
 
+bool JSPluginArrayConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSPluginArrayConstructor, DOMObject>(exec, &JSPluginArrayConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSPluginArrayPrototypeTableValues[4] =
@@ -119,6 +125,11 @@ bool JSPluginArrayPrototype::getOwnPropertySlot(ExecState* exec, const Identifie
     return getStaticFunctionSlot<JSObject>(exec, &JSPluginArrayPrototypeTable, this, propertyName, slot);
 }
 
+bool JSPluginArrayPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSPluginArrayPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSPluginArray::s_info = { "PluginArray", 0, &JSPluginArrayTable, 0 };
 
 JSPluginArray::JSPluginArray(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<PluginArray> impl)
@@ -157,6 +168,32 @@ bool JSPluginArray::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSPluginArray, Base>(exec, &JSPluginArrayTable, this, propertyName, slot);
 }
 
+bool JSPluginArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    const HashEntry* entry = JSPluginArrayTable.entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        slot.setCustom(this, entry->propertyGetter());
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<PluginArray*>(impl())->length()) {
+        PropertySlot slot;
+        slot.setCustomIndex(this, index, indexGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly);
+        return true;
+    }
+    if (canGetItemsForName(exec, static_cast<PluginArray*>(impl()), propertyName)) {
+        PropertySlot slot;
+        slot.setCustom(this, nameGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    return getStaticValueDescriptor<JSPluginArray, Base>(exec, &JSPluginArrayTable, this, propertyName, descriptor);
+}
+
 bool JSPluginArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
 {
     if (propertyName < static_cast<PluginArray*>(impl())->length()) {
@@ -179,11 +216,11 @@ JSValue jsPluginArrayConstructor(ExecState* exec, const Identifier&, const Prope
     JSPluginArray* domObject = static_cast<JSPluginArray*>(asObject(slot.slotBase()));
     return JSPluginArray::getConstructor(exec, domObject->globalObject());
 }
-void JSPluginArray::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSPluginArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     for (unsigned i = 0; i < static_cast<PluginArray*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getPropertyNames(exec, propertyNames, listedAttributes);
+     Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 JSValue JSPluginArray::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -194,7 +231,7 @@ JSValue JSPluginArray::getConstructor(ExecState* exec, JSGlobalObject* globalObj
 JSValue JSC_HOST_CALL jsPluginArrayPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSPluginArray::s_info))
+    if (!thisValue.inherits(&JSPluginArray::s_info))
         return throwError(exec, TypeError);
     JSPluginArray* castedThisObj = static_cast<JSPluginArray*>(asObject(thisValue));
     PluginArray* imp = static_cast<PluginArray*>(castedThisObj->impl());
@@ -208,7 +245,7 @@ JSValue JSC_HOST_CALL jsPluginArrayPrototypeFunctionItem(ExecState* exec, JSObje
 JSValue JSC_HOST_CALL jsPluginArrayPrototypeFunctionNamedItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSPluginArray::s_info))
+    if (!thisValue.inherits(&JSPluginArray::s_info))
         return throwError(exec, TypeError);
     JSPluginArray* castedThisObj = static_cast<JSPluginArray*>(asObject(thisValue));
     PluginArray* imp = static_cast<PluginArray*>(castedThisObj->impl());
@@ -222,7 +259,7 @@ JSValue JSC_HOST_CALL jsPluginArrayPrototypeFunctionNamedItem(ExecState* exec, J
 JSValue JSC_HOST_CALL jsPluginArrayPrototypeFunctionRefresh(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSPluginArray::s_info))
+    if (!thisValue.inherits(&JSPluginArray::s_info))
         return throwError(exec, TypeError);
     JSPluginArray* castedThisObj = static_cast<JSPluginArray*>(asObject(thisValue));
     PluginArray* imp = static_cast<PluginArray*>(castedThisObj->impl());
@@ -244,7 +281,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, PluginA
 }
 PluginArray* toPluginArray(JSC::JSValue value)
 {
-    return value.isObject(&JSPluginArray::s_info) ? static_cast<JSPluginArray*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSPluginArray::s_info) ? static_cast<JSPluginArray*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPluginArray.h b/src/3rdparty/webkit/WebCore/generated/JSPluginArray.h
index c2827aa..cc2ec61 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPluginArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSPluginArray.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSPluginArray();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -46,7 +47,7 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     PluginArray* impl() const { return m_impl.get(); }
 
@@ -68,9 +69,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSPluginArrayPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp b/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp
index c0c1a10..03c0ba3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp
@@ -76,6 +76,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSPositionErrorPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -92,6 +93,11 @@ bool JSPositionErrorConstructor::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSPositionErrorConstructor, DOMObject>(exec, &JSPositionErrorConstructorTable, this, propertyName, slot);
 }
 
+bool JSPositionErrorConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSPositionErrorConstructor, DOMObject>(exec, &JSPositionErrorConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSPositionErrorPrototypeTableValues[5] =
@@ -122,6 +128,11 @@ bool JSPositionErrorPrototype::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticValueSlot<JSPositionErrorPrototype, JSObject>(exec, &JSPositionErrorPrototypeTable, this, propertyName, slot);
 }
 
+bool JSPositionErrorPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSPositionErrorPrototype, JSObject>(exec, &JSPositionErrorPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSPositionError::s_info = { "PositionError", 0, &JSPositionErrorTable, 0 };
 
 JSPositionError::JSPositionError(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<PositionError> impl)
@@ -145,6 +156,11 @@ bool JSPositionError::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSPositionError, Base>(exec, &JSPositionErrorTable, this, propertyName, slot);
 }
 
+bool JSPositionError::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSPositionError, Base>(exec, &JSPositionErrorTable, this, propertyName, descriptor);
+}
+
 JSValue jsPositionErrorCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSPositionError* castedThis = static_cast<JSPositionError*>(asObject(slot.slotBase()));
@@ -199,7 +215,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Positio
 }
 PositionError* toPositionError(JSC::JSValue value)
 {
-    return value.isObject(&JSPositionError::s_info) ? static_cast<JSPositionError*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSPositionError::s_info) ? static_cast<JSPositionError*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPositionError.h b/src/3rdparty/webkit/WebCore/generated/JSPositionError.h
index a7478fc..30a1b69 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPositionError.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSPositionError.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSPositionError();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -62,9 +63,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSPositionErrorPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.cpp b/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.cpp
index c945742..13c47c2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.cpp
@@ -73,6 +73,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSProcessingInstructionPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -89,6 +90,11 @@ bool JSProcessingInstructionConstructor::getOwnPropertySlot(ExecState* exec, con
     return getStaticValueSlot<JSProcessingInstructionConstructor, DOMObject>(exec, &JSProcessingInstructionConstructorTable, this, propertyName, slot);
 }
 
+bool JSProcessingInstructionConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSProcessingInstructionConstructor, DOMObject>(exec, &JSProcessingInstructionConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSProcessingInstructionPrototypeTableValues[1] =
@@ -127,6 +133,11 @@ bool JSProcessingInstruction::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSProcessingInstruction, Base>(exec, &JSProcessingInstructionTable, this, propertyName, slot);
 }
 
+bool JSProcessingInstruction::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSProcessingInstruction, Base>(exec, &JSProcessingInstructionTable, this, propertyName, descriptor);
+}
+
 JSValue jsProcessingInstructionTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSProcessingInstruction* castedThis = static_cast<JSProcessingInstruction*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.h b/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.h
index 0b2b7df..c68d7f5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.h
@@ -33,6 +33,7 @@ public:
     JSProcessingInstruction(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<ProcessingInstruction>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.cpp
index bb7be66..1d586f1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.cpp
@@ -72,6 +72,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSProgressEventPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -88,6 +89,11 @@ bool JSProgressEventConstructor::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSProgressEventConstructor, DOMObject>(exec, &JSProgressEventConstructorTable, this, propertyName, slot);
 }
 
+bool JSProgressEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSProgressEventConstructor, DOMObject>(exec, &JSProgressEventConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSProgressEventPrototypeTableValues[2] =
@@ -115,6 +121,11 @@ bool JSProgressEventPrototype::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticFunctionSlot<JSObject>(exec, &JSProgressEventPrototypeTable, this, propertyName, slot);
 }
 
+bool JSProgressEventPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSProgressEventPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSProgressEvent::s_info = { "ProgressEvent", &JSEvent::s_info, &JSProgressEventTable, 0 };
 
 JSProgressEvent::JSProgressEvent(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<ProgressEvent> impl)
@@ -132,6 +143,11 @@ bool JSProgressEvent::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSProgressEvent, Base>(exec, &JSProgressEventTable, this, propertyName, slot);
 }
 
+bool JSProgressEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSProgressEvent, Base>(exec, &JSProgressEventTable, this, propertyName, descriptor);
+}
+
 JSValue jsProgressEventLengthComputable(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSProgressEvent* castedThis = static_cast<JSProgressEvent*>(asObject(slot.slotBase()));
@@ -169,7 +185,7 @@ JSValue JSProgressEvent::getConstructor(ExecState* exec, JSGlobalObject* globalO
 JSValue JSC_HOST_CALL jsProgressEventPrototypeFunctionInitProgressEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSProgressEvent::s_info))
+    if (!thisValue.inherits(&JSProgressEvent::s_info))
         return throwError(exec, TypeError);
     JSProgressEvent* castedThisObj = static_cast<JSProgressEvent*>(asObject(thisValue));
     ProgressEvent* imp = static_cast<ProgressEvent*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.h b/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.h
index 7e436be..f1e5670 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.h
@@ -33,6 +33,7 @@ public:
     JSProgressEvent(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<ProgressEvent>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -52,9 +53,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSProgressEventPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRGBColor.cpp b/src/3rdparty/webkit/WebCore/generated/JSRGBColor.cpp
index 27d17a9..f3b1a35 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRGBColor.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRGBColor.cpp
@@ -72,6 +72,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSRGBColorPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -88,6 +89,11 @@ bool JSRGBColorConstructor::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSRGBColorConstructor, DOMObject>(exec, &JSRGBColorConstructorTable, this, propertyName, slot);
 }
 
+bool JSRGBColorConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSRGBColorConstructor, DOMObject>(exec, &JSRGBColorConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSRGBColorPrototypeTableValues[1] =
@@ -132,6 +138,11 @@ bool JSRGBColor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSRGBColor, Base>(exec, &JSRGBColorTable, this, propertyName, slot);
 }
 
+bool JSRGBColor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSRGBColor, Base>(exec, &JSRGBColorTable, this, propertyName, descriptor);
+}
+
 JSValue jsRGBColorRed(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSRGBColor* castedThis = static_cast<JSRGBColor*>(asObject(slot.slotBase()));
@@ -172,7 +183,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, RGBColo
 }
 RGBColor* toRGBColor(JSC::JSValue value)
 {
-    return value.isObject(&JSRGBColor::s_info) ? static_cast<JSRGBColor*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSRGBColor::s_info) ? static_cast<JSRGBColor*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRGBColor.h b/src/3rdparty/webkit/WebCore/generated/JSRGBColor.h
index 8116d7b..008f316 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRGBColor.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSRGBColor.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSRGBColor();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRange.cpp b/src/3rdparty/webkit/WebCore/generated/JSRange.cpp
index cefe592..dffeb8a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRange.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRange.cpp
@@ -90,6 +90,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSRangePrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -106,9 +107,14 @@ bool JSRangeConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSRangeConstructor, DOMObject>(exec, &JSRangeConstructorTable, this, propertyName, slot);
 }
 
+bool JSRangeConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSRangeConstructor, DOMObject>(exec, &JSRangeConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
-static const HashTableValue JSRangePrototypeTableValues[32] =
+static const HashTableValue JSRangePrototypeTableValues[33] =
 {
     { "START_TO_START", DontDelete|ReadOnly, (intptr_t)jsRangeSTART_TO_START, (intptr_t)0 },
     { "START_TO_END", DontDelete|ReadOnly, (intptr_t)jsRangeSTART_TO_END, (intptr_t)0 },
@@ -141,6 +147,7 @@ static const HashTableValue JSRangePrototypeTableValues[32] =
     { "compareNode", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionCompareNode, (intptr_t)1 },
     { "comparePoint", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionComparePoint, (intptr_t)2 },
     { "isPointInRange", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionIsPointInRange, (intptr_t)2 },
+    { "expand", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionExpand, (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -148,7 +155,7 @@ static JSC_CONST_HASHTABLE HashTable JSRangePrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 1023, JSRangePrototypeTableValues, 0 };
 #else
-    { 71, 63, JSRangePrototypeTableValues, 0 };
+    { 72, 63, JSRangePrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSRangePrototype::s_info = { "RangePrototype", 0, &JSRangePrototypeTable, 0 };
@@ -163,6 +170,11 @@ bool JSRangePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticPropertySlot<JSRangePrototype, JSObject>(exec, &JSRangePrototypeTable, this, propertyName, slot);
 }
 
+bool JSRangePrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSRangePrototype, JSObject>(exec, &JSRangePrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSRange::s_info = { "Range", 0, &JSRangeTable, 0 };
 
 JSRange::JSRange(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<Range> impl)
@@ -186,6 +198,11 @@ bool JSRange::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName
     return getStaticValueSlot<JSRange, Base>(exec, &JSRangeTable, this, propertyName, slot);
 }
 
+bool JSRange::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSRange, Base>(exec, &JSRangeTable, this, propertyName, descriptor);
+}
+
 JSValue jsRangeStartContainer(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSRange* castedThis = static_cast<JSRange*>(asObject(slot.slotBase()));
@@ -259,7 +276,7 @@ JSValue JSRange::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
 JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetStart(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSRange::s_info))
+    if (!thisValue.inherits(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
@@ -275,7 +292,7 @@ JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetStart(ExecState* exec, JSObject
 JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetEnd(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSRange::s_info))
+    if (!thisValue.inherits(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
@@ -291,7 +308,7 @@ JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetEnd(ExecState* exec, JSObject*,
 JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetStartBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSRange::s_info))
+    if (!thisValue.inherits(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
@@ -306,7 +323,7 @@ JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetStartBefore(ExecState* exec, JS
 JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetStartAfter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSRange::s_info))
+    if (!thisValue.inherits(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
@@ -321,7 +338,7 @@ JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetStartAfter(ExecState* exec, JSO
 JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetEndBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSRange::s_info))
+    if (!thisValue.inherits(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
@@ -336,7 +353,7 @@ JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetEndBefore(ExecState* exec, JSOb
 JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetEndAfter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSRange::s_info))
+    if (!thisValue.inherits(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
@@ -351,7 +368,7 @@ JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetEndAfter(ExecState* exec, JSObj
 JSValue JSC_HOST_CALL jsRangePrototypeFunctionCollapse(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSRange::s_info))
+    if (!thisValue.inherits(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
@@ -366,7 +383,7 @@ JSValue JSC_HOST_CALL jsRangePrototypeFunctionCollapse(ExecState* exec, JSObject
 JSValue JSC_HOST_CALL jsRangePrototypeFunctionSelectNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSRange::s_info))
+    if (!thisValue.inherits(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
@@ -381,7 +398,7 @@ JSValue JSC_HOST_CALL jsRangePrototypeFunctionSelectNode(ExecState* exec, JSObje
 JSValue JSC_HOST_CALL jsRangePrototypeFunctionSelectNodeContents(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSRange::s_info))
+    if (!thisValue.inherits(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
@@ -396,7 +413,7 @@ JSValue JSC_HOST_CALL jsRangePrototypeFunctionSelectNodeContents(ExecState* exec
 JSValue JSC_HOST_CALL jsRangePrototypeFunctionCompareBoundaryPoints(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSRange::s_info))
+    if (!thisValue.inherits(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
@@ -413,7 +430,7 @@ JSValue JSC_HOST_CALL jsRangePrototypeFunctionCompareBoundaryPoints(ExecState* e
 JSValue JSC_HOST_CALL jsRangePrototypeFunctionDeleteContents(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSRange::s_info))
+    if (!thisValue.inherits(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
@@ -427,7 +444,7 @@ JSValue JSC_HOST_CALL jsRangePrototypeFunctionDeleteContents(ExecState* exec, JS
 JSValue JSC_HOST_CALL jsRangePrototypeFunctionExtractContents(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSRange::s_info))
+    if (!thisValue.inherits(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
@@ -442,7 +459,7 @@ JSValue JSC_HOST_CALL jsRangePrototypeFunctionExtractContents(ExecState* exec, J
 JSValue JSC_HOST_CALL jsRangePrototypeFunctionCloneContents(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSRange::s_info))
+    if (!thisValue.inherits(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
@@ -457,7 +474,7 @@ JSValue JSC_HOST_CALL jsRangePrototypeFunctionCloneContents(ExecState* exec, JSO
 JSValue JSC_HOST_CALL jsRangePrototypeFunctionInsertNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSRange::s_info))
+    if (!thisValue.inherits(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
@@ -472,7 +489,7 @@ JSValue JSC_HOST_CALL jsRangePrototypeFunctionInsertNode(ExecState* exec, JSObje
 JSValue JSC_HOST_CALL jsRangePrototypeFunctionSurroundContents(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSRange::s_info))
+    if (!thisValue.inherits(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
@@ -487,7 +504,7 @@ JSValue JSC_HOST_CALL jsRangePrototypeFunctionSurroundContents(ExecState* exec,
 JSValue JSC_HOST_CALL jsRangePrototypeFunctionCloneRange(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSRange::s_info))
+    if (!thisValue.inherits(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
@@ -502,7 +519,7 @@ JSValue JSC_HOST_CALL jsRangePrototypeFunctionCloneRange(ExecState* exec, JSObje
 JSValue JSC_HOST_CALL jsRangePrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSRange::s_info))
+    if (!thisValue.inherits(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
@@ -517,7 +534,7 @@ JSValue JSC_HOST_CALL jsRangePrototypeFunctionToString(ExecState* exec, JSObject
 JSValue JSC_HOST_CALL jsRangePrototypeFunctionDetach(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSRange::s_info))
+    if (!thisValue.inherits(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
@@ -531,7 +548,7 @@ JSValue JSC_HOST_CALL jsRangePrototypeFunctionDetach(ExecState* exec, JSObject*,
 JSValue JSC_HOST_CALL jsRangePrototypeFunctionCreateContextualFragment(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSRange::s_info))
+    if (!thisValue.inherits(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
@@ -547,7 +564,7 @@ JSValue JSC_HOST_CALL jsRangePrototypeFunctionCreateContextualFragment(ExecState
 JSValue JSC_HOST_CALL jsRangePrototypeFunctionIntersectsNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSRange::s_info))
+    if (!thisValue.inherits(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
@@ -563,7 +580,7 @@ JSValue JSC_HOST_CALL jsRangePrototypeFunctionIntersectsNode(ExecState* exec, JS
 JSValue JSC_HOST_CALL jsRangePrototypeFunctionCompareNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSRange::s_info))
+    if (!thisValue.inherits(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
@@ -579,7 +596,7 @@ JSValue JSC_HOST_CALL jsRangePrototypeFunctionCompareNode(ExecState* exec, JSObj
 JSValue JSC_HOST_CALL jsRangePrototypeFunctionComparePoint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSRange::s_info))
+    if (!thisValue.inherits(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
@@ -596,7 +613,7 @@ JSValue JSC_HOST_CALL jsRangePrototypeFunctionComparePoint(ExecState* exec, JSOb
 JSValue JSC_HOST_CALL jsRangePrototypeFunctionIsPointInRange(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSRange::s_info))
+    if (!thisValue.inherits(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
@@ -610,6 +627,21 @@ JSValue JSC_HOST_CALL jsRangePrototypeFunctionIsPointInRange(ExecState* exec, JS
     return result;
 }
 
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionExpand(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSRange::s_info))
+        return throwError(exec, TypeError);
+    JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
+    Range* imp = static_cast<Range*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    const UString& unit = args.at(0).toString(exec);
+
+    imp->expand(unit, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
 // Constant getters
 
 JSValue jsRangeSTART_TO_START(ExecState* exec, const Identifier&, const PropertySlot&)
@@ -658,7 +690,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Range*
 }
 Range* toRange(JSC::JSValue value)
 {
-    return value.isObject(&JSRange::s_info) ? static_cast<JSRange*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSRange::s_info) ? static_cast<JSRange*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRange.h b/src/3rdparty/webkit/WebCore/generated/JSRange.h
index a97f759..1752888 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRange.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSRange.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSRange();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -62,9 +63,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSRangePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
@@ -94,6 +96,7 @@ JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionIntersectsNode(JSC::ExecState
 JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionCompareNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionComparePoint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionIsPointInRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionExpand(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
 JSC::JSValue jsRangeStartContainer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp b/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp
index fb8addf..1ef3ced 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp
@@ -76,6 +76,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSRangeExceptionPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -92,6 +93,11 @@ bool JSRangeExceptionConstructor::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticValueSlot<JSRangeExceptionConstructor, DOMObject>(exec, &JSRangeExceptionConstructorTable, this, propertyName, slot);
 }
 
+bool JSRangeExceptionConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSRangeExceptionConstructor, DOMObject>(exec, &JSRangeExceptionConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSRangeExceptionPrototypeTableValues[4] =
@@ -121,6 +127,11 @@ bool JSRangeExceptionPrototype::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticPropertySlot<JSRangeExceptionPrototype, JSObject>(exec, &JSRangeExceptionPrototypeTable, this, propertyName, slot);
 }
 
+bool JSRangeExceptionPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSRangeExceptionPrototype, JSObject>(exec, &JSRangeExceptionPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSRangeException::s_info = { "RangeException", 0, &JSRangeExceptionTable, 0 };
 
 JSRangeException::JSRangeException(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<RangeException> impl)
@@ -144,6 +155,11 @@ bool JSRangeException::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSRangeException, Base>(exec, &JSRangeExceptionTable, this, propertyName, slot);
 }
 
+bool JSRangeException::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSRangeException, Base>(exec, &JSRangeExceptionTable, this, propertyName, descriptor);
+}
+
 JSValue jsRangeExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSRangeException* castedThis = static_cast<JSRangeException*>(asObject(slot.slotBase()));
@@ -181,7 +197,7 @@ JSValue JSRangeException::getConstructor(ExecState* exec, JSGlobalObject* global
 JSValue JSC_HOST_CALL jsRangeExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSRangeException::s_info))
+    if (!thisValue.inherits(&JSRangeException::s_info))
         return throwError(exec, TypeError);
     JSRangeException* castedThisObj = static_cast<JSRangeException*>(asObject(thisValue));
     RangeException* imp = static_cast<RangeException*>(castedThisObj->impl());
@@ -209,7 +225,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, RangeEx
 }
 RangeException* toRangeException(JSC::JSValue value)
 {
-    return value.isObject(&JSRangeException::s_info) ? static_cast<JSRangeException*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSRangeException::s_info) ? static_cast<JSRangeException*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRangeException.h b/src/3rdparty/webkit/WebCore/generated/JSRangeException.h
index 7afd133..f9520aa 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRangeException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSRangeException.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSRangeException();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -62,9 +63,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSRangeExceptionPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRect.cpp b/src/3rdparty/webkit/WebCore/generated/JSRect.cpp
index 998f649..b717102 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRect.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRect.cpp
@@ -73,6 +73,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSRectPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -89,6 +90,11 @@ bool JSRectConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSRectConstructor, DOMObject>(exec, &JSRectConstructorTable, this, propertyName, slot);
 }
 
+bool JSRectConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSRectConstructor, DOMObject>(exec, &JSRectConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSRectPrototypeTableValues[1] =
@@ -133,6 +139,11 @@ bool JSRect::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName,
     return getStaticValueSlot<JSRect, Base>(exec, &JSRectTable, this, propertyName, slot);
 }
 
+bool JSRect::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSRect, Base>(exec, &JSRectTable, this, propertyName, descriptor);
+}
+
 JSValue jsRectTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSRect* castedThis = static_cast<JSRect*>(asObject(slot.slotBase()));
@@ -181,7 +192,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Rect* o
 }
 Rect* toRect(JSC::JSValue value)
 {
-    return value.isObject(&JSRect::s_info) ? static_cast<JSRect*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSRect::s_info) ? static_cast<JSRect*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRect.h b/src/3rdparty/webkit/WebCore/generated/JSRect.h
index 4b1e427..3ed565d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRect.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSRect.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSRect();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLError.cpp b/src/3rdparty/webkit/WebCore/generated/JSSQLError.cpp
index bb987c3..a004498 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLError.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLError.cpp
@@ -96,6 +96,11 @@ bool JSSQLError::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSSQLError, Base>(exec, &JSSQLErrorTable, this, propertyName, slot);
 }
 
+bool JSSQLError::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSQLError, Base>(exec, &JSSQLErrorTable, this, propertyName, descriptor);
+}
+
 JSValue jsSQLErrorCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSQLError* castedThis = static_cast<JSSQLError*>(asObject(slot.slotBase()));
@@ -118,7 +123,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SQLErro
 }
 SQLError* toSQLError(JSC::JSValue value)
 {
-    return value.isObject(&JSSQLError::s_info) ? static_cast<JSSQLError*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSQLError::s_info) ? static_cast<JSSQLError*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLError.h b/src/3rdparty/webkit/WebCore/generated/JSSQLError.h
index 04aad81..53941d4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLError.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLError.h
@@ -39,6 +39,7 @@ public:
     virtual ~JSSQLError();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.cpp b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.cpp
index 11d8ffc..7218490 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.cpp
@@ -97,6 +97,11 @@ bool JSSQLResultSet::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSSQLResultSet, Base>(exec, &JSSQLResultSetTable, this, propertyName, slot);
 }
 
+bool JSSQLResultSet::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSQLResultSet, Base>(exec, &JSSQLResultSetTable, this, propertyName, descriptor);
+}
+
 JSValue jsSQLResultSetRows(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSQLResultSet* castedThis = static_cast<JSSQLResultSet*>(asObject(slot.slotBase()));
@@ -129,7 +134,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SQLResu
 }
 SQLResultSet* toSQLResultSet(JSC::JSValue value)
 {
-    return value.isObject(&JSSQLResultSet::s_info) ? static_cast<JSSQLResultSet*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSQLResultSet::s_info) ? static_cast<JSSQLResultSet*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.h b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.h
index 401bc3a..3cea415 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.h
@@ -39,6 +39,7 @@ public:
     virtual ~JSSQLResultSet();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.cpp
index a166fb0..7fa87e5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.cpp
@@ -77,6 +77,11 @@ bool JSSQLResultSetRowListPrototype::getOwnPropertySlot(ExecState* exec, const I
     return getStaticFunctionSlot<JSObject>(exec, &JSSQLResultSetRowListPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSQLResultSetRowListPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSQLResultSetRowListPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSQLResultSetRowList::s_info = { "SQLResultSetRowList", 0, &JSSQLResultSetRowListTable, 0 };
 
 JSSQLResultSetRowList::JSSQLResultSetRowList(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SQLResultSetRowList> impl)
@@ -100,6 +105,11 @@ bool JSSQLResultSetRowList::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSSQLResultSetRowList, Base>(exec, &JSSQLResultSetRowListTable, this, propertyName, slot);
 }
 
+bool JSSQLResultSetRowList::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSQLResultSetRowList, Base>(exec, &JSSQLResultSetRowListTable, this, propertyName, descriptor);
+}
+
 JSValue jsSQLResultSetRowListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSQLResultSetRowList* castedThis = static_cast<JSSQLResultSetRowList*>(asObject(slot.slotBase()));
@@ -111,7 +121,7 @@ JSValue jsSQLResultSetRowListLength(ExecState* exec, const Identifier&, const Pr
 JSValue JSC_HOST_CALL jsSQLResultSetRowListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSQLResultSetRowList::s_info))
+    if (!thisValue.inherits(&JSSQLResultSetRowList::s_info))
         return throwError(exec, TypeError);
     JSSQLResultSetRowList* castedThisObj = static_cast<JSSQLResultSetRowList*>(asObject(thisValue));
     return castedThisObj->item(exec, args);
@@ -123,7 +133,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SQLResu
 }
 SQLResultSetRowList* toSQLResultSetRowList(JSC::JSValue value)
 {
-    return value.isObject(&JSSQLResultSetRowList::s_info) ? static_cast<JSSQLResultSetRowList*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSQLResultSetRowList::s_info) ? static_cast<JSSQLResultSetRowList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.h b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.h
index 22fb844..1d01f42 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.h
@@ -39,6 +39,7 @@ public:
     virtual ~JSSQLResultSetRowList();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -66,9 +67,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSQLResultSetRowListPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.cpp b/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.cpp
index f8c6d67..485cda6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.cpp
@@ -61,6 +61,11 @@ bool JSSQLTransactionPrototype::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticFunctionSlot<JSObject>(exec, &JSSQLTransactionPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSQLTransactionPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSQLTransactionPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSQLTransaction::s_info = { "SQLTransaction", 0, 0, 0 };
 
 JSSQLTransaction::JSSQLTransaction(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SQLTransaction> impl)
@@ -82,7 +87,7 @@ JSObject* JSSQLTransaction::createPrototype(ExecState* exec, JSGlobalObject* glo
 JSValue JSC_HOST_CALL jsSQLTransactionPrototypeFunctionExecuteSql(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSQLTransaction::s_info))
+    if (!thisValue.inherits(&JSSQLTransaction::s_info))
         return throwError(exec, TypeError);
     JSSQLTransaction* castedThisObj = static_cast<JSSQLTransaction*>(asObject(thisValue));
     return castedThisObj->executeSql(exec, args);
@@ -94,7 +99,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SQLTran
 }
 SQLTransaction* toSQLTransaction(JSC::JSValue value)
 {
-    return value.isObject(&JSSQLTransaction::s_info) ? static_cast<JSSQLTransaction*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSQLTransaction::s_info) ? static_cast<JSSQLTransaction*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.h b/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.h
index bb72108..7da46d2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.h
@@ -60,9 +60,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSQLTransactionPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.cpp
index dd66b1f..21fce8b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.cpp
@@ -109,6 +109,11 @@ bool JSSVGAElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifie
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGAElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGAElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGAElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGAElement::s_info = { "SVGAElement", &JSSVGElement::s_info, &JSSVGAElementTable, 0 };
 
 JSSVGAElement::JSSVGAElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAElement> impl)
@@ -126,6 +131,11 @@ bool JSSVGAElement::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSSVGAElement, Base>(exec, &JSSVGAElementTable, this, propertyName, slot);
 }
 
+bool JSSVGAElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAElement, Base>(exec, &JSSVGAElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGAElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGAElement* castedThis = static_cast<JSSVGAElement*>(asObject(slot.slotBase()));
@@ -255,7 +265,7 @@ void setJSSVGAElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue val
 JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGAElement::s_info))
+    if (!thisValue.inherits(&JSSVGAElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAElement* castedThisObj = static_cast<JSSVGAElement*>(asObject(thisValue));
     SVGAElement* imp = static_cast<SVGAElement*>(castedThisObj->impl());
@@ -269,7 +279,7 @@ JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionHasExtension(ExecState* exec
 JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGAElement::s_info))
+    if (!thisValue.inherits(&JSSVGAElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAElement* castedThisObj = static_cast<JSSVGAElement*>(asObject(thisValue));
     SVGAElement* imp = static_cast<SVGAElement*>(castedThisObj->impl());
@@ -283,7 +293,7 @@ JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetPresentationAttribute(Exe
 JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGAElement::s_info))
+    if (!thisValue.inherits(&JSSVGAElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAElement* castedThisObj = static_cast<JSSVGAElement*>(asObject(thisValue));
     SVGAElement* imp = static_cast<SVGAElement*>(castedThisObj->impl());
@@ -296,7 +306,7 @@ JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetBBox(ExecState* exec, JSO
 JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGAElement::s_info))
+    if (!thisValue.inherits(&JSSVGAElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAElement* castedThisObj = static_cast<JSSVGAElement*>(asObject(thisValue));
     SVGAElement* imp = static_cast<SVGAElement*>(castedThisObj->impl());
@@ -309,7 +319,7 @@ JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetCTM(ExecState* exec, JSOb
 JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGAElement::s_info))
+    if (!thisValue.inherits(&JSSVGAElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAElement* castedThisObj = static_cast<JSSVGAElement*>(asObject(thisValue));
     SVGAElement* imp = static_cast<SVGAElement*>(castedThisObj->impl());
@@ -322,7 +332,7 @@ JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetScreenCTM(ExecState* exec
 JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGAElement::s_info))
+    if (!thisValue.inherits(&JSSVGAElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAElement* castedThisObj = static_cast<JSSVGAElement*>(asObject(thisValue));
     SVGAElement* imp = static_cast<SVGAElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.h
index 09d21e3..132aff6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGAElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGAElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.cpp
index 8f8a5fa..54d796f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.cpp
@@ -91,6 +91,11 @@ bool JSSVGAltGlyphElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGAltGlyphElement, Base>(exec, &JSSVGAltGlyphElementTable, this, propertyName, slot);
 }
 
+bool JSSVGAltGlyphElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAltGlyphElement, Base>(exec, &JSSVGAltGlyphElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGAltGlyphElementGlyphRef(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGAltGlyphElement* castedThis = static_cast<JSSVGAltGlyphElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.h
index 5df51fe..59a246c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGAltGlyphElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAltGlyphElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.cpp
index be80003..1551f8e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.cpp
@@ -83,6 +83,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSSVGAnglePrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -99,6 +100,11 @@ bool JSSVGAngleConstructor::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSSVGAngleConstructor, DOMObject>(exec, &JSSVGAngleConstructorTable, this, propertyName, slot);
 }
 
+bool JSSVGAngleConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAngleConstructor, DOMObject>(exec, &JSSVGAngleConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGAnglePrototypeTableValues[8] =
@@ -132,6 +138,11 @@ bool JSSVGAnglePrototype::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticPropertySlot<JSSVGAnglePrototype, JSObject>(exec, &JSSVGAnglePrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGAnglePrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSSVGAnglePrototype, JSObject>(exec, &JSSVGAnglePrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGAngle::s_info = { "SVGAngle", 0, &JSSVGAngleTable, 0 };
 
 JSSVGAngle::JSSVGAngle(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAngle> impl, SVGElement* context)
@@ -155,6 +166,11 @@ bool JSSVGAngle::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSSVGAngle, Base>(exec, &JSSVGAngleTable, this, propertyName, slot);
 }
 
+bool JSSVGAngle::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAngle, Base>(exec, &JSSVGAngleTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGAngleUnitType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGAngle* castedThis = static_cast<JSSVGAngle*>(asObject(slot.slotBase()));
@@ -229,7 +245,7 @@ JSValue JSSVGAngle::getConstructor(ExecState* exec, JSGlobalObject* globalObject
 JSValue JSC_HOST_CALL jsSVGAnglePrototypeFunctionNewValueSpecifiedUnits(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGAngle::s_info))
+    if (!thisValue.inherits(&JSSVGAngle::s_info))
         return throwError(exec, TypeError);
     JSSVGAngle* castedThisObj = static_cast<JSSVGAngle*>(asObject(thisValue));
     SVGAngle* imp = static_cast<SVGAngle*>(castedThisObj->impl());
@@ -243,7 +259,7 @@ JSValue JSC_HOST_CALL jsSVGAnglePrototypeFunctionNewValueSpecifiedUnits(ExecStat
 JSValue JSC_HOST_CALL jsSVGAnglePrototypeFunctionConvertToSpecifiedUnits(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGAngle::s_info))
+    if (!thisValue.inherits(&JSSVGAngle::s_info))
         return throwError(exec, TypeError);
     JSSVGAngle* castedThisObj = static_cast<JSSVGAngle*>(asObject(thisValue));
     SVGAngle* imp = static_cast<SVGAngle*>(castedThisObj->impl());
@@ -286,7 +302,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGAngl
 }
 SVGAngle* toSVGAngle(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGAngle::s_info) ? static_cast<JSSVGAngle*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGAngle::s_info) ? static_cast<JSSVGAngle*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.h
index 92cf6b5..5348157 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.h
@@ -40,6 +40,7 @@ public:
     virtual ~JSSVGAngle();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -66,9 +67,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGAnglePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.cpp
index e123d2f..3375a94 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.cpp
@@ -94,6 +94,11 @@ bool JSSVGAnimatedAngle::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGAnimatedAngle, Base>(exec, &JSSVGAnimatedAngleTable, this, propertyName, slot);
 }
 
+bool JSSVGAnimatedAngle::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimatedAngle, Base>(exec, &JSSVGAnimatedAngleTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGAnimatedAngleBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGAnimatedAngle* castedThis = static_cast<JSSVGAnimatedAngle*>(asObject(slot.slotBase()));
@@ -116,7 +121,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGAnim
 }
 SVGAnimatedAngle* toSVGAnimatedAngle(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGAnimatedAngle::s_info) ? static_cast<JSSVGAnimatedAngle*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGAnimatedAngle::s_info) ? static_cast<JSSVGAnimatedAngle*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.h
index fb2a73f..ee4b15a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.h
@@ -38,6 +38,7 @@ public:
     virtual ~JSSVGAnimatedAngle();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.cpp
index 983dd2a..29d0622 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.cpp
@@ -92,6 +92,11 @@ bool JSSVGAnimatedBoolean::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGAnimatedBoolean, Base>(exec, &JSSVGAnimatedBooleanTable, this, propertyName, slot);
 }
 
+bool JSSVGAnimatedBoolean::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimatedBoolean, Base>(exec, &JSSVGAnimatedBooleanTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGAnimatedBooleanBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGAnimatedBoolean* castedThis = static_cast<JSSVGAnimatedBoolean*>(asObject(slot.slotBase()));
@@ -127,7 +132,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGAnim
 }
 SVGAnimatedBoolean* toSVGAnimatedBoolean(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGAnimatedBoolean::s_info) ? static_cast<JSSVGAnimatedBoolean*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGAnimatedBoolean::s_info) ? static_cast<JSSVGAnimatedBoolean*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.h
index 599e2a0..31c227f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.h
@@ -38,6 +38,7 @@ public:
     virtual ~JSSVGAnimatedBoolean();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.cpp
index 2cf3ad9..c7b31ce 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.cpp
@@ -93,6 +93,11 @@ bool JSSVGAnimatedEnumeration::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticValueSlot<JSSVGAnimatedEnumeration, Base>(exec, &JSSVGAnimatedEnumerationTable, this, propertyName, slot);
 }
 
+bool JSSVGAnimatedEnumeration::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimatedEnumeration, Base>(exec, &JSSVGAnimatedEnumerationTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGAnimatedEnumerationBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGAnimatedEnumeration* castedThis = static_cast<JSSVGAnimatedEnumeration*>(asObject(slot.slotBase()));
@@ -128,7 +133,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGAnim
 }
 SVGAnimatedEnumeration* toSVGAnimatedEnumeration(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGAnimatedEnumeration::s_info) ? static_cast<JSSVGAnimatedEnumeration*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGAnimatedEnumeration::s_info) ? static_cast<JSSVGAnimatedEnumeration*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.h
index 20403ab..4828ea1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.h
@@ -38,6 +38,7 @@ public:
     virtual ~JSSVGAnimatedEnumeration();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.cpp
index 6602bcd..e49b71a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.cpp
@@ -93,6 +93,11 @@ bool JSSVGAnimatedInteger::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGAnimatedInteger, Base>(exec, &JSSVGAnimatedIntegerTable, this, propertyName, slot);
 }
 
+bool JSSVGAnimatedInteger::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimatedInteger, Base>(exec, &JSSVGAnimatedIntegerTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGAnimatedIntegerBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGAnimatedInteger* castedThis = static_cast<JSSVGAnimatedInteger*>(asObject(slot.slotBase()));
@@ -128,7 +133,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGAnim
 }
 SVGAnimatedInteger* toSVGAnimatedInteger(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGAnimatedInteger::s_info) ? static_cast<JSSVGAnimatedInteger*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGAnimatedInteger::s_info) ? static_cast<JSSVGAnimatedInteger*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.h
index 9045693..b2ae6dc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.h
@@ -38,6 +38,7 @@ public:
     virtual ~JSSVGAnimatedInteger();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.cpp
index bcc5a81..7a5358d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.cpp
@@ -93,6 +93,11 @@ bool JSSVGAnimatedLength::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGAnimatedLength, Base>(exec, &JSSVGAnimatedLengthTable, this, propertyName, slot);
 }
 
+bool JSSVGAnimatedLength::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimatedLength, Base>(exec, &JSSVGAnimatedLengthTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGAnimatedLengthBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGAnimatedLength* castedThis = static_cast<JSSVGAnimatedLength*>(asObject(slot.slotBase()));
@@ -115,7 +120,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGAnim
 }
 SVGAnimatedLength* toSVGAnimatedLength(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGAnimatedLength::s_info) ? static_cast<JSSVGAnimatedLength*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGAnimatedLength::s_info) ? static_cast<JSSVGAnimatedLength*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.h
index 7e3ba12..c2458c1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.h
@@ -38,6 +38,7 @@ public:
     virtual ~JSSVGAnimatedLength();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.cpp
index 6dc24ab..e4d23bc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.cpp
@@ -94,6 +94,11 @@ bool JSSVGAnimatedLengthList::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSSVGAnimatedLengthList, Base>(exec, &JSSVGAnimatedLengthListTable, this, propertyName, slot);
 }
 
+bool JSSVGAnimatedLengthList::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimatedLengthList, Base>(exec, &JSSVGAnimatedLengthListTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGAnimatedLengthListBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGAnimatedLengthList* castedThis = static_cast<JSSVGAnimatedLengthList*>(asObject(slot.slotBase()));
@@ -116,7 +121,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGAnim
 }
 SVGAnimatedLengthList* toSVGAnimatedLengthList(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGAnimatedLengthList::s_info) ? static_cast<JSSVGAnimatedLengthList*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGAnimatedLengthList::s_info) ? static_cast<JSSVGAnimatedLengthList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.h
index 288ccfc..2b7d3b5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.h
@@ -38,6 +38,7 @@ public:
     virtual ~JSSVGAnimatedLengthList();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.cpp
index 9081e47..cf3c932 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.cpp
@@ -93,6 +93,11 @@ bool JSSVGAnimatedNumber::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGAnimatedNumber, Base>(exec, &JSSVGAnimatedNumberTable, this, propertyName, slot);
 }
 
+bool JSSVGAnimatedNumber::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimatedNumber, Base>(exec, &JSSVGAnimatedNumberTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGAnimatedNumberBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGAnimatedNumber* castedThis = static_cast<JSSVGAnimatedNumber*>(asObject(slot.slotBase()));
@@ -128,7 +133,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGAnim
 }
 SVGAnimatedNumber* toSVGAnimatedNumber(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGAnimatedNumber::s_info) ? static_cast<JSSVGAnimatedNumber*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGAnimatedNumber::s_info) ? static_cast<JSSVGAnimatedNumber*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.h
index eab3888..7b1797b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.h
@@ -38,6 +38,7 @@ public:
     virtual ~JSSVGAnimatedNumber();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.cpp
index 224936f..39857a1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.cpp
@@ -94,6 +94,11 @@ bool JSSVGAnimatedNumberList::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSSVGAnimatedNumberList, Base>(exec, &JSSVGAnimatedNumberListTable, this, propertyName, slot);
 }
 
+bool JSSVGAnimatedNumberList::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimatedNumberList, Base>(exec, &JSSVGAnimatedNumberListTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGAnimatedNumberListBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGAnimatedNumberList* castedThis = static_cast<JSSVGAnimatedNumberList*>(asObject(slot.slotBase()));
@@ -116,7 +121,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGAnim
 }
 SVGAnimatedNumberList* toSVGAnimatedNumberList(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGAnimatedNumberList::s_info) ? static_cast<JSSVGAnimatedNumberList*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGAnimatedNumberList::s_info) ? static_cast<JSSVGAnimatedNumberList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.h
index c37905c..8089364 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.h
@@ -38,6 +38,7 @@ public:
     virtual ~JSSVGAnimatedNumberList();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.cpp
index 6a602c4..7196a26 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.cpp
@@ -94,6 +94,11 @@ bool JSSVGAnimatedPreserveAspectRatio::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSSVGAnimatedPreserveAspectRatio, Base>(exec, &JSSVGAnimatedPreserveAspectRatioTable, this, propertyName, slot);
 }
 
+bool JSSVGAnimatedPreserveAspectRatio::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimatedPreserveAspectRatio, Base>(exec, &JSSVGAnimatedPreserveAspectRatioTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGAnimatedPreserveAspectRatioBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGAnimatedPreserveAspectRatio* castedThis = static_cast<JSSVGAnimatedPreserveAspectRatio*>(asObject(slot.slotBase()));
@@ -116,7 +121,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGAnim
 }
 SVGAnimatedPreserveAspectRatio* toSVGAnimatedPreserveAspectRatio(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGAnimatedPreserveAspectRatio::s_info) ? static_cast<JSSVGAnimatedPreserveAspectRatio*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGAnimatedPreserveAspectRatio::s_info) ? static_cast<JSSVGAnimatedPreserveAspectRatio*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.h
index 172691a..5bca921 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.h
@@ -38,6 +38,7 @@ public:
     virtual ~JSSVGAnimatedPreserveAspectRatio();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.cpp
index 34bd262..483071b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.cpp
@@ -94,6 +94,11 @@ bool JSSVGAnimatedRect::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSSVGAnimatedRect, Base>(exec, &JSSVGAnimatedRectTable, this, propertyName, slot);
 }
 
+bool JSSVGAnimatedRect::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimatedRect, Base>(exec, &JSSVGAnimatedRectTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGAnimatedRectBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGAnimatedRect* castedThis = static_cast<JSSVGAnimatedRect*>(asObject(slot.slotBase()));
@@ -116,7 +121,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGAnim
 }
 SVGAnimatedRect* toSVGAnimatedRect(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGAnimatedRect::s_info) ? static_cast<JSSVGAnimatedRect*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGAnimatedRect::s_info) ? static_cast<JSSVGAnimatedRect*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.h
index c71c0b3..79f1c24 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.h
@@ -38,6 +38,7 @@ public:
     virtual ~JSSVGAnimatedRect();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.cpp
index 52c8129..3346799 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.cpp
@@ -95,6 +95,11 @@ bool JSSVGAnimatedString::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGAnimatedString, Base>(exec, &JSSVGAnimatedStringTable, this, propertyName, slot);
 }
 
+bool JSSVGAnimatedString::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimatedString, Base>(exec, &JSSVGAnimatedStringTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGAnimatedStringBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGAnimatedString* castedThis = static_cast<JSSVGAnimatedString*>(asObject(slot.slotBase()));
@@ -130,7 +135,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGAnim
 }
 SVGAnimatedString* toSVGAnimatedString(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGAnimatedString::s_info) ? static_cast<JSSVGAnimatedString*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGAnimatedString::s_info) ? static_cast<JSSVGAnimatedString*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.h
index 6380728..be817be 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.h
@@ -38,6 +38,7 @@ public:
     virtual ~JSSVGAnimatedString();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.cpp
index 077f379..ec0dcd1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.cpp
@@ -94,6 +94,11 @@ bool JSSVGAnimatedTransformList::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSSVGAnimatedTransformList, Base>(exec, &JSSVGAnimatedTransformListTable, this, propertyName, slot);
 }
 
+bool JSSVGAnimatedTransformList::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimatedTransformList, Base>(exec, &JSSVGAnimatedTransformListTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGAnimatedTransformListBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGAnimatedTransformList* castedThis = static_cast<JSSVGAnimatedTransformList*>(asObject(slot.slotBase()));
@@ -116,7 +121,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGAnim
 }
 SVGAnimatedTransformList* toSVGAnimatedTransformList(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGAnimatedTransformList::s_info) ? static_cast<JSSVGAnimatedTransformList*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGAnimatedTransformList::s_info) ? static_cast<JSSVGAnimatedTransformList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.h
index 358905c..d871e62 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.h
@@ -38,6 +38,7 @@ public:
     virtual ~JSSVGAnimatedTransformList();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.cpp
index 48a51e4..6311dc7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.cpp
@@ -93,6 +93,11 @@ bool JSSVGAnimationElementPrototype::getOwnPropertySlot(ExecState* exec, const I
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGAnimationElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGAnimationElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGAnimationElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGAnimationElement::s_info = { "SVGAnimationElement", &JSSVGElement::s_info, &JSSVGAnimationElementTable, 0 };
 
 JSSVGAnimationElement::JSSVGAnimationElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGAnimationElement> impl)
@@ -110,6 +115,11 @@ bool JSSVGAnimationElement::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSSVGAnimationElement, Base>(exec, &JSSVGAnimationElementTable, this, propertyName, slot);
 }
 
+bool JSSVGAnimationElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGAnimationElement, Base>(exec, &JSSVGAnimationElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGAnimationElementTargetElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGAnimationElement* castedThis = static_cast<JSSVGAnimationElement*>(asObject(slot.slotBase()));
@@ -154,7 +164,7 @@ JSValue jsSVGAnimationElementExternalResourcesRequired(ExecState* exec, const Id
 JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionGetStartTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGAnimationElement::s_info))
+    if (!thisValue.inherits(&JSSVGAnimationElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAnimationElement* castedThisObj = static_cast<JSSVGAnimationElement*>(asObject(thisValue));
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(castedThisObj->impl());
@@ -167,7 +177,7 @@ JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionGetStartTime(ExecSta
 JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionGetCurrentTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGAnimationElement::s_info))
+    if (!thisValue.inherits(&JSSVGAnimationElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAnimationElement* castedThisObj = static_cast<JSSVGAnimationElement*>(asObject(thisValue));
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(castedThisObj->impl());
@@ -180,7 +190,7 @@ JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionGetCurrentTime(ExecS
 JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionGetSimpleDuration(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGAnimationElement::s_info))
+    if (!thisValue.inherits(&JSSVGAnimationElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAnimationElement* castedThisObj = static_cast<JSSVGAnimationElement*>(asObject(thisValue));
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(castedThisObj->impl());
@@ -195,7 +205,7 @@ JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionGetSimpleDuration(Ex
 JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGAnimationElement::s_info))
+    if (!thisValue.inherits(&JSSVGAnimationElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAnimationElement* castedThisObj = static_cast<JSSVGAnimationElement*>(asObject(thisValue));
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(castedThisObj->impl());
@@ -209,63 +219,51 @@ JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionHasExtension(ExecSta
 JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionBeginElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGAnimationElement::s_info))
+    if (!thisValue.inherits(&JSSVGAnimationElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAnimationElement* castedThisObj = static_cast<JSSVGAnimationElement*>(asObject(thisValue));
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-
 
-    JSC::JSValue result = jsBoolean(imp->beginElement(ec));
-    setDOMException(exec, ec);
-    return result;
+    imp->beginElement();
+    return jsUndefined();
 }
 
 JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionBeginElementAt(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGAnimationElement::s_info))
+    if (!thisValue.inherits(&JSSVGAnimationElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAnimationElement* castedThisObj = static_cast<JSSVGAnimationElement*>(asObject(thisValue));
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
     float offset = args.at(0).toFloat(exec);
 
-
-    JSC::JSValue result = jsBoolean(imp->beginElementAt(offset, ec));
-    setDOMException(exec, ec);
-    return result;
+    imp->beginElementAt(offset);
+    return jsUndefined();
 }
 
 JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionEndElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGAnimationElement::s_info))
+    if (!thisValue.inherits(&JSSVGAnimationElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAnimationElement* castedThisObj = static_cast<JSSVGAnimationElement*>(asObject(thisValue));
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-
 
-    JSC::JSValue result = jsBoolean(imp->endElement(ec));
-    setDOMException(exec, ec);
-    return result;
+    imp->endElement();
+    return jsUndefined();
 }
 
 JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionEndElementAt(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGAnimationElement::s_info))
+    if (!thisValue.inherits(&JSSVGAnimationElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAnimationElement* castedThisObj = static_cast<JSSVGAnimationElement*>(asObject(thisValue));
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
     float offset = args.at(0).toFloat(exec);
 
-
-    JSC::JSValue result = jsBoolean(imp->endElementAt(offset, ec));
-    setDOMException(exec, ec);
-    return result;
+    imp->endElementAt(offset);
+    return jsUndefined();
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.h
index 4a48a7b..794e7f9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGAnimationElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGAnimationElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -54,9 +55,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGAnimationElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.cpp
index 92213c7..f38a8b1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.cpp
@@ -111,6 +111,11 @@ bool JSSVGCircleElementPrototype::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGCircleElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGCircleElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGCircleElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGCircleElement::s_info = { "SVGCircleElement", &JSSVGElement::s_info, &JSSVGCircleElementTable, 0 };
 
 JSSVGCircleElement::JSSVGCircleElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGCircleElement> impl)
@@ -128,6 +133,11 @@ bool JSSVGCircleElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGCircleElement, Base>(exec, &JSSVGCircleElementTable, this, propertyName, slot);
 }
 
+bool JSSVGCircleElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGCircleElement, Base>(exec, &JSSVGCircleElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGCircleElementCx(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGCircleElement* castedThis = static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()));
@@ -266,7 +276,7 @@ void setJSSVGCircleElementXmlspace(ExecState* exec, JSObject* thisObject, JSValu
 JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGCircleElement::s_info))
+    if (!thisValue.inherits(&JSSVGCircleElement::s_info))
         return throwError(exec, TypeError);
     JSSVGCircleElement* castedThisObj = static_cast<JSSVGCircleElement*>(asObject(thisValue));
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThisObj->impl());
@@ -280,7 +290,7 @@ JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionHasExtension(ExecState*
 JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGCircleElement::s_info))
+    if (!thisValue.inherits(&JSSVGCircleElement::s_info))
         return throwError(exec, TypeError);
     JSSVGCircleElement* castedThisObj = static_cast<JSSVGCircleElement*>(asObject(thisValue));
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThisObj->impl());
@@ -294,7 +304,7 @@ JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetPresentationAttribut
 JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGCircleElement::s_info))
+    if (!thisValue.inherits(&JSSVGCircleElement::s_info))
         return throwError(exec, TypeError);
     JSSVGCircleElement* castedThisObj = static_cast<JSSVGCircleElement*>(asObject(thisValue));
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThisObj->impl());
@@ -307,7 +317,7 @@ JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetBBox(ExecState* exec
 JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGCircleElement::s_info))
+    if (!thisValue.inherits(&JSSVGCircleElement::s_info))
         return throwError(exec, TypeError);
     JSSVGCircleElement* castedThisObj = static_cast<JSSVGCircleElement*>(asObject(thisValue));
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThisObj->impl());
@@ -320,7 +330,7 @@ JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetCTM(ExecState* exec,
 JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGCircleElement::s_info))
+    if (!thisValue.inherits(&JSSVGCircleElement::s_info))
         return throwError(exec, TypeError);
     JSSVGCircleElement* castedThisObj = static_cast<JSSVGCircleElement*>(asObject(thisValue));
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThisObj->impl());
@@ -333,7 +343,7 @@ JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetScreenCTM(ExecState*
 JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGCircleElement::s_info))
+    if (!thisValue.inherits(&JSSVGCircleElement::s_info))
         return throwError(exec, TypeError);
     JSSVGCircleElement* castedThisObj = static_cast<JSSVGCircleElement*>(asObject(thisValue));
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.h
index 6dfad23..606d1ea 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGCircleElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGCircleElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGCircleElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.cpp
index c67ced4..e487399 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.cpp
@@ -109,6 +109,11 @@ bool JSSVGClipPathElementPrototype::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGClipPathElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGClipPathElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGClipPathElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGClipPathElement::s_info = { "SVGClipPathElement", &JSSVGElement::s_info, &JSSVGClipPathElementTable, 0 };
 
 JSSVGClipPathElement::JSSVGClipPathElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGClipPathElement> impl)
@@ -126,6 +131,11 @@ bool JSSVGClipPathElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGClipPathElement, Base>(exec, &JSSVGClipPathElementTable, this, propertyName, slot);
 }
 
+bool JSSVGClipPathElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGClipPathElement, Base>(exec, &JSSVGClipPathElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGClipPathElementClipPathUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGClipPathElement* castedThis = static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()));
@@ -246,7 +256,7 @@ void setJSSVGClipPathElementXmlspace(ExecState* exec, JSObject* thisObject, JSVa
 JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGClipPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGClipPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGClipPathElement* castedThisObj = static_cast<JSSVGClipPathElement*>(asObject(thisValue));
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThisObj->impl());
@@ -260,7 +270,7 @@ JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionHasExtension(ExecStat
 JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGClipPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGClipPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGClipPathElement* castedThisObj = static_cast<JSSVGClipPathElement*>(asObject(thisValue));
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThisObj->impl());
@@ -274,7 +284,7 @@ JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetPresentationAttrib
 JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGClipPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGClipPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGClipPathElement* castedThisObj = static_cast<JSSVGClipPathElement*>(asObject(thisValue));
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThisObj->impl());
@@ -287,7 +297,7 @@ JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetBBox(ExecState* ex
 JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGClipPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGClipPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGClipPathElement* castedThisObj = static_cast<JSSVGClipPathElement*>(asObject(thisValue));
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThisObj->impl());
@@ -300,7 +310,7 @@ JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetCTM(ExecState* exe
 JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGClipPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGClipPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGClipPathElement* castedThisObj = static_cast<JSSVGClipPathElement*>(asObject(thisValue));
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThisObj->impl());
@@ -313,7 +323,7 @@ JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetScreenCTM(ExecStat
 JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGClipPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGClipPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGClipPathElement* castedThisObj = static_cast<JSSVGClipPathElement*>(asObject(thisValue));
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.h
index b27abca..f190920 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGClipPathElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGClipPathElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGClipPathElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGColor.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGColor.cpp
index 59c2549..b91ba1f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGColor.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGColor.cpp
@@ -80,6 +80,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSSVGColorPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -96,6 +97,11 @@ bool JSSVGColorConstructor::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSSVGColorConstructor, DOMObject>(exec, &JSSVGColorConstructorTable, this, propertyName, slot);
 }
 
+bool JSSVGColorConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGColorConstructor, DOMObject>(exec, &JSSVGColorConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGColorPrototypeTableValues[8] =
@@ -129,6 +135,11 @@ bool JSSVGColorPrototype::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticPropertySlot<JSSVGColorPrototype, JSObject>(exec, &JSSVGColorPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGColorPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSSVGColorPrototype, JSObject>(exec, &JSSVGColorPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGColor::s_info = { "SVGColor", &JSCSSValue::s_info, &JSSVGColorTable, 0 };
 
 JSSVGColor::JSSVGColor(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGColor> impl)
@@ -146,6 +157,11 @@ bool JSSVGColor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSSVGColor, Base>(exec, &JSSVGColorTable, this, propertyName, slot);
 }
 
+bool JSSVGColor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGColor, Base>(exec, &JSSVGColorTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGColorColorType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGColor* castedThis = static_cast<JSSVGColor*>(asObject(slot.slotBase()));
@@ -175,7 +191,7 @@ JSValue JSSVGColor::getConstructor(ExecState* exec, JSGlobalObject* globalObject
 JSValue JSC_HOST_CALL jsSVGColorPrototypeFunctionSetRGBColor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGColor::s_info))
+    if (!thisValue.inherits(&JSSVGColor::s_info))
         return throwError(exec, TypeError);
     JSSVGColor* castedThisObj = static_cast<JSSVGColor*>(asObject(thisValue));
     SVGColor* imp = static_cast<SVGColor*>(castedThisObj->impl());
@@ -190,7 +206,7 @@ JSValue JSC_HOST_CALL jsSVGColorPrototypeFunctionSetRGBColor(ExecState* exec, JS
 JSValue JSC_HOST_CALL jsSVGColorPrototypeFunctionSetRGBColorICCColor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGColor::s_info))
+    if (!thisValue.inherits(&JSSVGColor::s_info))
         return throwError(exec, TypeError);
     JSSVGColor* castedThisObj = static_cast<JSSVGColor*>(asObject(thisValue));
     SVGColor* imp = static_cast<SVGColor*>(castedThisObj->impl());
@@ -206,7 +222,7 @@ JSValue JSC_HOST_CALL jsSVGColorPrototypeFunctionSetRGBColorICCColor(ExecState*
 JSValue JSC_HOST_CALL jsSVGColorPrototypeFunctionSetColor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGColor::s_info))
+    if (!thisValue.inherits(&JSSVGColor::s_info))
         return throwError(exec, TypeError);
     JSSVGColor* castedThisObj = static_cast<JSSVGColor*>(asObject(thisValue));
     SVGColor* imp = static_cast<SVGColor*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGColor.h b/src/3rdparty/webkit/WebCore/generated/JSSVGColor.h
index 9161bfc..8df68dd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGColor.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGColor.h
@@ -36,6 +36,7 @@ public:
     JSSVGColor(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGColor>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGColorPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.cpp
index be144bb..842a2aa 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.cpp
@@ -86,6 +86,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSSVGComponentTransferFunctionElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -102,6 +103,11 @@ bool JSSVGComponentTransferFunctionElementConstructor::getOwnPropertySlot(ExecSt
     return getStaticValueSlot<JSSVGComponentTransferFunctionElementConstructor, DOMObject>(exec, &JSSVGComponentTransferFunctionElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSSVGComponentTransferFunctionElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGComponentTransferFunctionElementConstructor, DOMObject>(exec, &JSSVGComponentTransferFunctionElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGComponentTransferFunctionElementPrototypeTableValues[7] =
@@ -134,6 +140,11 @@ bool JSSVGComponentTransferFunctionElementPrototype::getOwnPropertySlot(ExecStat
     return getStaticValueSlot<JSSVGComponentTransferFunctionElementPrototype, JSObject>(exec, &JSSVGComponentTransferFunctionElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGComponentTransferFunctionElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGComponentTransferFunctionElementPrototype, JSObject>(exec, &JSSVGComponentTransferFunctionElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGComponentTransferFunctionElement::s_info = { "SVGComponentTransferFunctionElement", &JSSVGElement::s_info, &JSSVGComponentTransferFunctionElementTable, 0 };
 
 JSSVGComponentTransferFunctionElement::JSSVGComponentTransferFunctionElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGComponentTransferFunctionElement> impl)
@@ -151,6 +162,11 @@ bool JSSVGComponentTransferFunctionElement::getOwnPropertySlot(ExecState* exec,
     return getStaticValueSlot<JSSVGComponentTransferFunctionElement, Base>(exec, &JSSVGComponentTransferFunctionElementTable, this, propertyName, slot);
 }
 
+bool JSSVGComponentTransferFunctionElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGComponentTransferFunctionElement, Base>(exec, &JSSVGComponentTransferFunctionElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGComponentTransferFunctionElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGComponentTransferFunctionElement* castedThis = static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.h
index 6cc0d9e..48b858e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGComponentTransferFunctionElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGComponentTransferFunctionElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGComponentTransferFunctionElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.cpp
index ed17541..3846aea 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.cpp
@@ -87,6 +87,11 @@ bool JSSVGCursorElementPrototype::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGCursorElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGCursorElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGCursorElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGCursorElement::s_info = { "SVGCursorElement", &JSSVGElement::s_info, &JSSVGCursorElementTable, 0 };
 
 JSSVGCursorElement::JSSVGCursorElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGCursorElement> impl)
@@ -104,6 +109,11 @@ bool JSSVGCursorElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGCursorElement, Base>(exec, &JSSVGCursorElementTable, this, propertyName, slot);
 }
 
+bool JSSVGCursorElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGCursorElement, Base>(exec, &JSSVGCursorElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGCursorElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGCursorElement* castedThis = static_cast<JSSVGCursorElement*>(asObject(slot.slotBase()));
@@ -167,7 +177,7 @@ JSValue jsSVGCursorElementExternalResourcesRequired(ExecState* exec, const Ident
 JSValue JSC_HOST_CALL jsSVGCursorElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGCursorElement::s_info))
+    if (!thisValue.inherits(&JSSVGCursorElement::s_info))
         return throwError(exec, TypeError);
     JSSVGCursorElement* castedThisObj = static_cast<JSSVGCursorElement*>(asObject(thisValue));
     SVGCursorElement* imp = static_cast<SVGCursorElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.h
index 81921c4..967a398 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGCursorElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGCursorElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -54,9 +55,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGCursorElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDefinitionSrcElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGDefinitionSrcElement.cpp
deleted file mode 100644
index 9550465..0000000
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDefinitionSrcElement.cpp
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(SVG) && ENABLE(SVG_FONTS)
-
-#include "JSSVGDefinitionSrcElement.h"
-
-#include "SVGDefinitionSrcElement.h"
-#include <wtf/GetPtr.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSSVGDefinitionSrcElement);
-
-/* Hash table for prototype */
-
-static const HashTableValue JSSVGDefinitionSrcElementPrototypeTableValues[1] =
-{
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSSVGDefinitionSrcElementPrototypeTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSSVGDefinitionSrcElementPrototypeTableValues, 0 };
-#else
-    { 1, 0, JSSVGDefinitionSrcElementPrototypeTableValues, 0 };
-#endif
-
-const ClassInfo JSSVGDefinitionSrcElementPrototype::s_info = { "SVGDefinitionSrcElementPrototype", 0, &JSSVGDefinitionSrcElementPrototypeTable, 0 };
-
-JSObject* JSSVGDefinitionSrcElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return getDOMPrototype<JSSVGDefinitionSrcElement>(exec, globalObject);
-}
-
-const ClassInfo JSSVGDefinitionSrcElement::s_info = { "SVGDefinitionSrcElement", &JSSVGElement::s_info, 0, 0 };
-
-JSSVGDefinitionSrcElement::JSSVGDefinitionSrcElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGDefinitionSrcElement> impl)
-    : JSSVGElement(structure, globalObject, impl)
-{
-}
-
-JSObject* JSSVGDefinitionSrcElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return new (exec) JSSVGDefinitionSrcElementPrototype(JSSVGDefinitionSrcElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
-}
-
-
-}
-
-#endif // ENABLE(SVG) && ENABLE(SVG_FONTS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.cpp
index f5e8ac7..4c493c4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.cpp
@@ -107,6 +107,11 @@ bool JSSVGDefsElementPrototype::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGDefsElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGDefsElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGDefsElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGDefsElement::s_info = { "SVGDefsElement", &JSSVGElement::s_info, &JSSVGDefsElementTable, 0 };
 
 JSSVGDefsElement::JSSVGDefsElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGDefsElement> impl)
@@ -124,6 +129,11 @@ bool JSSVGDefsElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGDefsElement, Base>(exec, &JSSVGDefsElementTable, this, propertyName, slot);
 }
 
+bool JSSVGDefsElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGDefsElement, Base>(exec, &JSSVGDefsElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGDefsElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGDefsElement* castedThis = static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()));
@@ -235,7 +245,7 @@ void setJSSVGDefsElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue
 JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGDefsElement::s_info))
+    if (!thisValue.inherits(&JSSVGDefsElement::s_info))
         return throwError(exec, TypeError);
     JSSVGDefsElement* castedThisObj = static_cast<JSSVGDefsElement*>(asObject(thisValue));
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThisObj->impl());
@@ -249,7 +259,7 @@ JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionHasExtension(ExecState* e
 JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGDefsElement::s_info))
+    if (!thisValue.inherits(&JSSVGDefsElement::s_info))
         return throwError(exec, TypeError);
     JSSVGDefsElement* castedThisObj = static_cast<JSSVGDefsElement*>(asObject(thisValue));
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThisObj->impl());
@@ -263,7 +273,7 @@ JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetPresentationAttribute(
 JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGDefsElement::s_info))
+    if (!thisValue.inherits(&JSSVGDefsElement::s_info))
         return throwError(exec, TypeError);
     JSSVGDefsElement* castedThisObj = static_cast<JSSVGDefsElement*>(asObject(thisValue));
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThisObj->impl());
@@ -276,7 +286,7 @@ JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetBBox(ExecState* exec,
 JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGDefsElement::s_info))
+    if (!thisValue.inherits(&JSSVGDefsElement::s_info))
         return throwError(exec, TypeError);
     JSSVGDefsElement* castedThisObj = static_cast<JSSVGDefsElement*>(asObject(thisValue));
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThisObj->impl());
@@ -289,7 +299,7 @@ JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetCTM(ExecState* exec, J
 JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGDefsElement::s_info))
+    if (!thisValue.inherits(&JSSVGDefsElement::s_info))
         return throwError(exec, TypeError);
     JSSVGDefsElement* castedThisObj = static_cast<JSSVGDefsElement*>(asObject(thisValue));
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThisObj->impl());
@@ -302,7 +312,7 @@ JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetScreenCTM(ExecState* e
 JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGDefsElement::s_info))
+    if (!thisValue.inherits(&JSSVGDefsElement::s_info))
         return throwError(exec, TypeError);
     JSSVGDefsElement* castedThisObj = static_cast<JSSVGDefsElement*>(asObject(thisValue));
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.h
index b960226..aefa6aa 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGDefsElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGDefsElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGDefsElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.cpp
index 55ab055..6cfa649 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.cpp
@@ -87,6 +87,11 @@ bool JSSVGDescElementPrototype::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGDescElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGDescElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGDescElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGDescElement::s_info = { "SVGDescElement", &JSSVGElement::s_info, &JSSVGDescElementTable, 0 };
 
 JSSVGDescElement::JSSVGDescElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGDescElement> impl)
@@ -104,6 +109,11 @@ bool JSSVGDescElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGDescElement, Base>(exec, &JSSVGDescElementTable, this, propertyName, slot);
 }
 
+bool JSSVGDescElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGDescElement, Base>(exec, &JSSVGDescElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGDescElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGDescElement* castedThis = static_cast<JSSVGDescElement*>(asObject(slot.slotBase()));
@@ -157,7 +167,7 @@ void setJSSVGDescElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue
 JSValue JSC_HOST_CALL jsSVGDescElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGDescElement::s_info))
+    if (!thisValue.inherits(&JSSVGDescElement::s_info))
         return throwError(exec, TypeError);
     JSSVGDescElement* castedThisObj = static_cast<JSSVGDescElement*>(asObject(thisValue));
     SVGDescElement* imp = static_cast<SVGDescElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.h
index 179d7b3..2f34a23 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGDescElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGDescElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGDescElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.cpp
index 0e7d8fd..f0f6d2a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.cpp
@@ -80,6 +80,11 @@ bool JSSVGDocumentPrototype::getOwnPropertySlot(ExecState* exec, const Identifie
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGDocumentPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGDocumentPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGDocumentPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGDocument::s_info = { "SVGDocument", &JSDocument::s_info, &JSSVGDocumentTable, 0 };
 
 JSSVGDocument::JSSVGDocument(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGDocument> impl)
@@ -97,6 +102,11 @@ bool JSSVGDocument::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSSVGDocument, Base>(exec, &JSSVGDocumentTable, this, propertyName, slot);
 }
 
+bool JSSVGDocument::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGDocument, Base>(exec, &JSSVGDocumentTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGDocumentRootElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGDocument* castedThis = static_cast<JSSVGDocument*>(asObject(slot.slotBase()));
@@ -108,7 +118,7 @@ JSValue jsSVGDocumentRootElement(ExecState* exec, const Identifier&, const Prope
 JSValue JSC_HOST_CALL jsSVGDocumentPrototypeFunctionCreateEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGDocument::s_info))
+    if (!thisValue.inherits(&JSSVGDocument::s_info))
         return throwError(exec, TypeError);
     JSSVGDocument* castedThisObj = static_cast<JSSVGDocument*>(asObject(thisValue));
     SVGDocument* imp = static_cast<SVGDocument*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.h b/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.h
index 8f279c9..fc38a2f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.h
@@ -36,6 +36,7 @@ public:
     JSSVGDocument(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGDocument>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -54,9 +55,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGDocumentPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGElement.cpp
index f6a775b..208d2ae 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElement.cpp
@@ -94,6 +94,11 @@ bool JSSVGElement::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<JSSVGElement, Base>(exec, &JSSVGElementTable, this, propertyName, slot);
 }
 
+bool JSSVGElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGElement, Base>(exec, &JSSVGElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGElementId(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGElement* castedThis = static_cast<JSSVGElement*>(asObject(slot.slotBase()));
@@ -149,7 +154,7 @@ void setJSSVGElementXmlbase(ExecState* exec, JSObject* thisObject, JSValue value
 
 SVGElement* toSVGElement(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGElement::s_info) ? static_cast<JSSVGElement*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGElement::s_info) ? static_cast<JSSVGElement*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGElement.h
index cb2ae10..4358599 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.cpp
index 979d2ac..e933025 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.cpp
@@ -138,6 +138,11 @@ bool JSSVGElementInstancePrototype::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGElementInstancePrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGElementInstancePrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGElementInstancePrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGElementInstance::s_info = { "SVGElementInstance", 0, &JSSVGElementInstanceTable, 0 };
 
 JSSVGElementInstance::JSSVGElementInstance(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElementInstance> impl)
@@ -161,6 +166,11 @@ bool JSSVGElementInstance::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGElementInstance, Base>(exec, &JSSVGElementInstanceTable, this, propertyName, slot);
 }
 
+bool JSSVGElementInstance::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGElementInstance, Base>(exec, &JSSVGElementInstanceTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGElementInstanceCorrespondingElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGElementInstance* castedThis = static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()));
@@ -1113,7 +1123,7 @@ void setJSSVGElementInstanceOnunload(ExecState* exec, JSObject* thisObject, JSVa
 JSValue JSC_HOST_CALL jsSVGElementInstancePrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGElementInstance::s_info))
+    if (!thisValue.inherits(&JSSVGElementInstance::s_info))
         return throwError(exec, TypeError);
     JSSVGElementInstance* castedThisObj = static_cast<JSSVGElementInstance*>(asObject(thisValue));
     return castedThisObj->addEventListener(exec, args);
@@ -1122,7 +1132,7 @@ JSValue JSC_HOST_CALL jsSVGElementInstancePrototypeFunctionAddEventListener(Exec
 JSValue JSC_HOST_CALL jsSVGElementInstancePrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGElementInstance::s_info))
+    if (!thisValue.inherits(&JSSVGElementInstance::s_info))
         return throwError(exec, TypeError);
     JSSVGElementInstance* castedThisObj = static_cast<JSSVGElementInstance*>(asObject(thisValue));
     return castedThisObj->removeEventListener(exec, args);
@@ -1131,7 +1141,7 @@ JSValue JSC_HOST_CALL jsSVGElementInstancePrototypeFunctionRemoveEventListener(E
 JSValue JSC_HOST_CALL jsSVGElementInstancePrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGElementInstance::s_info))
+    if (!thisValue.inherits(&JSSVGElementInstance::s_info))
         return throwError(exec, TypeError);
     JSSVGElementInstance* castedThisObj = static_cast<JSSVGElementInstance*>(asObject(thisValue));
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThisObj->impl());
@@ -1146,7 +1156,7 @@ JSValue JSC_HOST_CALL jsSVGElementInstancePrototypeFunctionDispatchEvent(ExecSta
 
 SVGElementInstance* toSVGElementInstance(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGElementInstance::s_info) ? static_cast<JSSVGElementInstance*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGElementInstance::s_info) ? static_cast<JSSVGElementInstance*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.h b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.h
index 2922b42..7783d36 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.h
@@ -40,6 +40,7 @@ public:
     virtual ~JSSVGElementInstance();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -49,7 +50,7 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void mark();
+    virtual void markChildren(JSC::MarkStack&);
 
     virtual void pushEventHandlerScope(JSC::ExecState*, JSC::ScopeChain&) const;
 
@@ -73,6 +74,7 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.cpp
index 1f965aa..27f8939 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.cpp
@@ -79,6 +79,11 @@ bool JSSVGElementInstanceListPrototype::getOwnPropertySlot(ExecState* exec, cons
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGElementInstanceListPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGElementInstanceListPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGElementInstanceListPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGElementInstanceList::s_info = { "SVGElementInstanceList", 0, &JSSVGElementInstanceListTable, 0 };
 
 JSSVGElementInstanceList::JSSVGElementInstanceList(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElementInstanceList> impl)
@@ -102,6 +107,11 @@ bool JSSVGElementInstanceList::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticValueSlot<JSSVGElementInstanceList, Base>(exec, &JSSVGElementInstanceListTable, this, propertyName, slot);
 }
 
+bool JSSVGElementInstanceList::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGElementInstanceList, Base>(exec, &JSSVGElementInstanceListTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGElementInstanceListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGElementInstanceList* castedThis = static_cast<JSSVGElementInstanceList*>(asObject(slot.slotBase()));
@@ -113,7 +123,7 @@ JSValue jsSVGElementInstanceListLength(ExecState* exec, const Identifier&, const
 JSValue JSC_HOST_CALL jsSVGElementInstanceListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGElementInstanceList::s_info))
+    if (!thisValue.inherits(&JSSVGElementInstanceList::s_info))
         return throwError(exec, TypeError);
     JSSVGElementInstanceList* castedThisObj = static_cast<JSSVGElementInstanceList*>(asObject(thisValue));
     SVGElementInstanceList* imp = static_cast<SVGElementInstanceList*>(castedThisObj->impl());
@@ -130,7 +140,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGElem
 }
 SVGElementInstanceList* toSVGElementInstanceList(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGElementInstanceList::s_info) ? static_cast<JSSVGElementInstanceList*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGElementInstanceList::s_info) ? static_cast<JSSVGElementInstanceList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.h
index fa9f853..2fb2656 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.h
@@ -40,6 +40,7 @@ public:
     virtual ~JSSVGElementInstanceList();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -64,9 +65,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGElementInstanceListPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElementWrapperFactory.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGElementWrapperFactory.cpp
index 3b44712..358e63a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElementWrapperFactory.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElementWrapperFactory.cpp
@@ -1,8 +1,9 @@
 /*
- * THIS FILE IS AUTOMATICALLY GENERATED, DO NOT EDIT.
+ * THIS FILE WAS AUTOMATICALLY GENERATED, DO NOT EDIT.
  *
+ * This file was generated by the dom/make_names.pl script.
  *
- * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,10 +24,9 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-
 #include "config.h"
 
 #if ENABLE(SVG)
@@ -40,7 +40,6 @@
 #include "JSSVGCircleElement.h"
 #include "JSSVGClipPathElement.h"
 #include "JSSVGCursorElement.h"
-#include "JSSVGDefinitionSrcElement.h"
 #include "JSSVGDefsElement.h"
 #include "JSSVGDescElement.h"
 #include "JSSVGEllipseElement.h"
@@ -92,7 +91,6 @@
 #include "SVGCircleElement.h"
 #include "SVGClipPathElement.h"
 #include "SVGCursorElement.h"
-#include "SVGDefinitionSrcElement.h"
 #include "SVGDefsElement.h"
 #include "SVGDescElement.h"
 #include "SVGEllipseElement.h"
@@ -185,11 +183,6 @@ static JSNode* createSVGCursorElementWrapper(ExecState* exec, JSDOMGlobalObject*
     return CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGCursorElement, element.get());
 }
 
-static JSNode* createSVGDefinitionSrcElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGDefinitionSrcElement, element.get());
-}
-
 static JSNode* createSVGDefsElementWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<SVGElement> element)
 {
     return CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGDefsElement, element.get());
@@ -398,7 +391,6 @@ JSNode* createJSSVGWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, Pas
        map.set(circleTag.localName().impl(), createSVGCircleElementWrapper);
        map.set(clipPathTag.localName().impl(), createSVGClipPathElementWrapper);
        map.set(cursorTag.localName().impl(), createSVGCursorElementWrapper);
-       map.set(definition_srcTag.localName().impl(), createSVGDefinitionSrcElementWrapper);
        map.set(defsTag.localName().impl(), createSVGDefsElementWrapper);
        map.set(descTag.localName().impl(), createSVGDescElementWrapper);
        map.set(ellipseTag.localName().impl(), createSVGEllipseElementWrapper);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElementWrapperFactory.h b/src/3rdparty/webkit/WebCore/generated/JSSVGElementWrapperFactory.h
index 843ba7e..39b5ca8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElementWrapperFactory.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElementWrapperFactory.h
@@ -1,8 +1,9 @@
 /*
- * THIS FILE IS AUTOMATICALLY GENERATED, DO NOT EDIT.
+ * THIS FILE WAS AUTOMATICALLY GENERATED, DO NOT EDIT.
  *
+ * This file was generated by the dom/make_names.pl script.
  *
- * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,10 +24,9 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-
 #ifndef JSSVGElementWrapperFactory_h
 #define JSSVGElementWrapperFactory_h
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.cpp
index 0297726..0a2156e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.cpp
@@ -112,6 +112,11 @@ bool JSSVGEllipseElementPrototype::getOwnPropertySlot(ExecState* exec, const Ide
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGEllipseElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGEllipseElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGEllipseElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGEllipseElement::s_info = { "SVGEllipseElement", &JSSVGElement::s_info, &JSSVGEllipseElementTable, 0 };
 
 JSSVGEllipseElement::JSSVGEllipseElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGEllipseElement> impl)
@@ -129,6 +134,11 @@ bool JSSVGEllipseElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGEllipseElement, Base>(exec, &JSSVGEllipseElementTable, this, propertyName, slot);
 }
 
+bool JSSVGEllipseElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGEllipseElement, Base>(exec, &JSSVGEllipseElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGEllipseElementCx(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGEllipseElement* castedThis = static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()));
@@ -276,7 +286,7 @@ void setJSSVGEllipseElementXmlspace(ExecState* exec, JSObject* thisObject, JSVal
 JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGEllipseElement::s_info))
+    if (!thisValue.inherits(&JSSVGEllipseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGEllipseElement* castedThisObj = static_cast<JSSVGEllipseElement*>(asObject(thisValue));
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThisObj->impl());
@@ -290,7 +300,7 @@ JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionHasExtension(ExecState
 JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGEllipseElement::s_info))
+    if (!thisValue.inherits(&JSSVGEllipseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGEllipseElement* castedThisObj = static_cast<JSSVGEllipseElement*>(asObject(thisValue));
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThisObj->impl());
@@ -304,7 +314,7 @@ JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetPresentationAttribu
 JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGEllipseElement::s_info))
+    if (!thisValue.inherits(&JSSVGEllipseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGEllipseElement* castedThisObj = static_cast<JSSVGEllipseElement*>(asObject(thisValue));
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThisObj->impl());
@@ -317,7 +327,7 @@ JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetBBox(ExecState* exe
 JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGEllipseElement::s_info))
+    if (!thisValue.inherits(&JSSVGEllipseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGEllipseElement* castedThisObj = static_cast<JSSVGEllipseElement*>(asObject(thisValue));
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThisObj->impl());
@@ -330,7 +340,7 @@ JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetCTM(ExecState* exec
 JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGEllipseElement::s_info))
+    if (!thisValue.inherits(&JSSVGEllipseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGEllipseElement* castedThisObj = static_cast<JSSVGEllipseElement*>(asObject(thisValue));
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThisObj->impl());
@@ -343,7 +353,7 @@ JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetScreenCTM(ExecState
 JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGEllipseElement::s_info))
+    if (!thisValue.inherits(&JSSVGEllipseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGEllipseElement* castedThisObj = static_cast<JSSVGEllipseElement*>(asObject(thisValue));
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.h
index 37d23e3..3dae90a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGEllipseElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGEllipseElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGEllipseElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGException.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGException.cpp
index bb8942d..b863c54 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGException.cpp
@@ -80,6 +80,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSSVGExceptionPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -96,6 +97,11 @@ bool JSSVGExceptionConstructor::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSSVGExceptionConstructor, DOMObject>(exec, &JSSVGExceptionConstructorTable, this, propertyName, slot);
 }
 
+bool JSSVGExceptionConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGExceptionConstructor, DOMObject>(exec, &JSSVGExceptionConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGExceptionPrototypeTableValues[5] =
@@ -126,6 +132,11 @@ bool JSSVGExceptionPrototype::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticPropertySlot<JSSVGExceptionPrototype, JSObject>(exec, &JSSVGExceptionPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGExceptionPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSSVGExceptionPrototype, JSObject>(exec, &JSSVGExceptionPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGException::s_info = { "SVGException", 0, &JSSVGExceptionTable, 0 };
 
 JSSVGException::JSSVGException(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGException> impl, SVGElement* context)
@@ -149,6 +160,11 @@ bool JSSVGException::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSSVGException, Base>(exec, &JSSVGExceptionTable, this, propertyName, slot);
 }
 
+bool JSSVGException::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGException, Base>(exec, &JSSVGExceptionTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGException* castedThis = static_cast<JSSVGException*>(asObject(slot.slotBase()));
@@ -186,7 +202,7 @@ JSValue JSSVGException::getConstructor(ExecState* exec, JSGlobalObject* globalOb
 JSValue JSC_HOST_CALL jsSVGExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGException::s_info))
+    if (!thisValue.inherits(&JSSVGException::s_info))
         return throwError(exec, TypeError);
     JSSVGException* castedThisObj = static_cast<JSSVGException*>(asObject(thisValue));
     SVGException* imp = static_cast<SVGException*>(castedThisObj->impl());
@@ -219,7 +235,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGExce
 }
 SVGException* toSVGException(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGException::s_info) ? static_cast<JSSVGException*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGException::s_info) ? static_cast<JSSVGException*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGException.h b/src/3rdparty/webkit/WebCore/generated/JSSVGException.h
index 15b893d..2c41ba7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGException.h
@@ -40,6 +40,7 @@ public:
     virtual ~JSSVGException();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -65,9 +66,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGExceptionPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.cpp
index a3ecf1c..bf961de 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.cpp
@@ -95,6 +95,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSSVGFEBlendElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -111,6 +112,11 @@ bool JSSVGFEBlendElementConstructor::getOwnPropertySlot(ExecState* exec, const I
     return getStaticValueSlot<JSSVGFEBlendElementConstructor, DOMObject>(exec, &JSSVGFEBlendElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSSVGFEBlendElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEBlendElementConstructor, DOMObject>(exec, &JSSVGFEBlendElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFEBlendElementPrototypeTableValues[8] =
@@ -144,6 +150,11 @@ bool JSSVGFEBlendElementPrototype::getOwnPropertySlot(ExecState* exec, const Ide
     return getStaticPropertySlot<JSSVGFEBlendElementPrototype, JSObject>(exec, &JSSVGFEBlendElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGFEBlendElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSSVGFEBlendElementPrototype, JSObject>(exec, &JSSVGFEBlendElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGFEBlendElement::s_info = { "SVGFEBlendElement", &JSSVGElement::s_info, &JSSVGFEBlendElementTable, 0 };
 
 JSSVGFEBlendElement::JSSVGFEBlendElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGFEBlendElement> impl)
@@ -161,6 +172,11 @@ bool JSSVGFEBlendElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGFEBlendElement, Base>(exec, &JSSVGFEBlendElementTable, this, propertyName, slot);
 }
 
+bool JSSVGFEBlendElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEBlendElement, Base>(exec, &JSSVGFEBlendElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGFEBlendElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGFEBlendElement* castedThis = static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()));
@@ -263,7 +279,7 @@ JSValue JSSVGFEBlendElement::getConstructor(ExecState* exec, JSGlobalObject* glo
 JSValue JSC_HOST_CALL jsSVGFEBlendElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGFEBlendElement::s_info))
+    if (!thisValue.inherits(&JSSVGFEBlendElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEBlendElement* castedThisObj = static_cast<JSSVGFEBlendElement*>(asObject(thisValue));
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.h
index 88033bb..76eff2c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGFEBlendElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFEBlendElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGFEBlendElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.cpp
index 6aa69fc..6566c12 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.cpp
@@ -95,6 +95,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSSVGFEColorMatrixElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -111,6 +112,11 @@ bool JSSVGFEColorMatrixElementConstructor::getOwnPropertySlot(ExecState* exec, c
     return getStaticValueSlot<JSSVGFEColorMatrixElementConstructor, DOMObject>(exec, &JSSVGFEColorMatrixElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSSVGFEColorMatrixElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEColorMatrixElementConstructor, DOMObject>(exec, &JSSVGFEColorMatrixElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFEColorMatrixElementPrototypeTableValues[7] =
@@ -143,6 +149,11 @@ bool JSSVGFEColorMatrixElementPrototype::getOwnPropertySlot(ExecState* exec, con
     return getStaticPropertySlot<JSSVGFEColorMatrixElementPrototype, JSObject>(exec, &JSSVGFEColorMatrixElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGFEColorMatrixElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSSVGFEColorMatrixElementPrototype, JSObject>(exec, &JSSVGFEColorMatrixElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGFEColorMatrixElement::s_info = { "SVGFEColorMatrixElement", &JSSVGElement::s_info, &JSSVGFEColorMatrixElementTable, 0 };
 
 JSSVGFEColorMatrixElement::JSSVGFEColorMatrixElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGFEColorMatrixElement> impl)
@@ -160,6 +171,11 @@ bool JSSVGFEColorMatrixElement::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSSVGFEColorMatrixElement, Base>(exec, &JSSVGFEColorMatrixElementTable, this, propertyName, slot);
 }
 
+bool JSSVGFEColorMatrixElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEColorMatrixElement, Base>(exec, &JSSVGFEColorMatrixElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGFEColorMatrixElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGFEColorMatrixElement* castedThis = static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()));
@@ -262,7 +278,7 @@ JSValue JSSVGFEColorMatrixElement::getConstructor(ExecState* exec, JSGlobalObjec
 JSValue JSC_HOST_CALL jsSVGFEColorMatrixElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGFEColorMatrixElement::s_info))
+    if (!thisValue.inherits(&JSSVGFEColorMatrixElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEColorMatrixElement* castedThisObj = static_cast<JSSVGFEColorMatrixElement*>(asObject(thisValue));
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.h
index 3a6aa67..6a1334d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGFEColorMatrixElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFEColorMatrixElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGFEColorMatrixElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.cpp
index a0be501..79ebddf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.cpp
@@ -90,6 +90,11 @@ bool JSSVGFEComponentTransferElementPrototype::getOwnPropertySlot(ExecState* exe
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGFEComponentTransferElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGFEComponentTransferElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGFEComponentTransferElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGFEComponentTransferElement::s_info = { "SVGFEComponentTransferElement", &JSSVGElement::s_info, &JSSVGFEComponentTransferElementTable, 0 };
 
 JSSVGFEComponentTransferElement::JSSVGFEComponentTransferElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGFEComponentTransferElement> impl)
@@ -107,6 +112,11 @@ bool JSSVGFEComponentTransferElement::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSSVGFEComponentTransferElement, Base>(exec, &JSSVGFEComponentTransferElementTable, this, propertyName, slot);
 }
 
+bool JSSVGFEComponentTransferElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEComponentTransferElement, Base>(exec, &JSSVGFEComponentTransferElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGFEComponentTransferElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGFEComponentTransferElement* castedThis = static_cast<JSSVGFEComponentTransferElement*>(asObject(slot.slotBase()));
@@ -181,7 +191,7 @@ JSValue jsSVGFEComponentTransferElementStyle(ExecState* exec, const Identifier&,
 JSValue JSC_HOST_CALL jsSVGFEComponentTransferElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGFEComponentTransferElement::s_info))
+    if (!thisValue.inherits(&JSSVGFEComponentTransferElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEComponentTransferElement* castedThisObj = static_cast<JSSVGFEComponentTransferElement*>(asObject(thisValue));
     SVGFEComponentTransferElement* imp = static_cast<SVGFEComponentTransferElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.h
index c50b12b..8381619 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGFEComponentTransferElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFEComponentTransferElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -54,9 +55,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGFEComponentTransferElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.cpp
index 42fe70a..973c76c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.cpp
@@ -101,6 +101,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSSVGFECompositeElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -117,6 +118,11 @@ bool JSSVGFECompositeElementConstructor::getOwnPropertySlot(ExecState* exec, con
     return getStaticValueSlot<JSSVGFECompositeElementConstructor, DOMObject>(exec, &JSSVGFECompositeElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSSVGFECompositeElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFECompositeElementConstructor, DOMObject>(exec, &JSSVGFECompositeElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFECompositeElementPrototypeTableValues[9] =
@@ -151,6 +157,11 @@ bool JSSVGFECompositeElementPrototype::getOwnPropertySlot(ExecState* exec, const
     return getStaticPropertySlot<JSSVGFECompositeElementPrototype, JSObject>(exec, &JSSVGFECompositeElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGFECompositeElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSSVGFECompositeElementPrototype, JSObject>(exec, &JSSVGFECompositeElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGFECompositeElement::s_info = { "SVGFECompositeElement", &JSSVGElement::s_info, &JSSVGFECompositeElementTable, 0 };
 
 JSSVGFECompositeElement::JSSVGFECompositeElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGFECompositeElement> impl)
@@ -168,6 +179,11 @@ bool JSSVGFECompositeElement::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSSVGFECompositeElement, Base>(exec, &JSSVGFECompositeElementTable, this, propertyName, slot);
 }
 
+bool JSSVGFECompositeElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFECompositeElement, Base>(exec, &JSSVGFECompositeElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGFECompositeElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGFECompositeElement* castedThis = static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()));
@@ -306,7 +322,7 @@ JSValue JSSVGFECompositeElement::getConstructor(ExecState* exec, JSGlobalObject*
 JSValue JSC_HOST_CALL jsSVGFECompositeElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGFECompositeElement::s_info))
+    if (!thisValue.inherits(&JSSVGFECompositeElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFECompositeElement* castedThisObj = static_cast<JSSVGFECompositeElement*>(asObject(thisValue));
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.h
index 826db95..c13f009 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGFECompositeElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFECompositeElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGFECompositeElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.cpp
index 01492c4..b8d72f8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.cpp
@@ -95,6 +95,11 @@ bool JSSVGFEDiffuseLightingElementPrototype::getOwnPropertySlot(ExecState* exec,
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGFEDiffuseLightingElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGFEDiffuseLightingElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGFEDiffuseLightingElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGFEDiffuseLightingElement::s_info = { "SVGFEDiffuseLightingElement", &JSSVGElement::s_info, &JSSVGFEDiffuseLightingElementTable, 0 };
 
 JSSVGFEDiffuseLightingElement::JSSVGFEDiffuseLightingElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGFEDiffuseLightingElement> impl)
@@ -112,6 +117,11 @@ bool JSSVGFEDiffuseLightingElement::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSSVGFEDiffuseLightingElement, Base>(exec, &JSSVGFEDiffuseLightingElementTable, this, propertyName, slot);
 }
 
+bool JSSVGFEDiffuseLightingElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEDiffuseLightingElement, Base>(exec, &JSSVGFEDiffuseLightingElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGFEDiffuseLightingElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGFEDiffuseLightingElement* castedThis = static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()));
@@ -222,7 +232,7 @@ JSValue jsSVGFEDiffuseLightingElementStyle(ExecState* exec, const Identifier&, c
 JSValue JSC_HOST_CALL jsSVGFEDiffuseLightingElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGFEDiffuseLightingElement::s_info))
+    if (!thisValue.inherits(&JSSVGFEDiffuseLightingElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEDiffuseLightingElement* castedThisObj = static_cast<JSSVGFEDiffuseLightingElement*>(asObject(thisValue));
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.h
index 26e6e91..0f4a120 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGFEDiffuseLightingElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFEDiffuseLightingElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -54,9 +55,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGFEDiffuseLightingElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.cpp
index a3441e4..18e675e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.cpp
@@ -97,6 +97,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSSVGFEDisplacementMapElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -113,6 +114,11 @@ bool JSSVGFEDisplacementMapElementConstructor::getOwnPropertySlot(ExecState* exe
     return getStaticValueSlot<JSSVGFEDisplacementMapElementConstructor, DOMObject>(exec, &JSSVGFEDisplacementMapElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSSVGFEDisplacementMapElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEDisplacementMapElementConstructor, DOMObject>(exec, &JSSVGFEDisplacementMapElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFEDisplacementMapElementPrototypeTableValues[7] =
@@ -145,6 +151,11 @@ bool JSSVGFEDisplacementMapElementPrototype::getOwnPropertySlot(ExecState* exec,
     return getStaticPropertySlot<JSSVGFEDisplacementMapElementPrototype, JSObject>(exec, &JSSVGFEDisplacementMapElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGFEDisplacementMapElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSSVGFEDisplacementMapElementPrototype, JSObject>(exec, &JSSVGFEDisplacementMapElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGFEDisplacementMapElement::s_info = { "SVGFEDisplacementMapElement", &JSSVGElement::s_info, &JSSVGFEDisplacementMapElementTable, 0 };
 
 JSSVGFEDisplacementMapElement::JSSVGFEDisplacementMapElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGFEDisplacementMapElement> impl)
@@ -162,6 +173,11 @@ bool JSSVGFEDisplacementMapElement::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSSVGFEDisplacementMapElement, Base>(exec, &JSSVGFEDisplacementMapElementTable, this, propertyName, slot);
 }
 
+bool JSSVGFEDisplacementMapElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEDisplacementMapElement, Base>(exec, &JSSVGFEDisplacementMapElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGFEDisplacementMapElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGFEDisplacementMapElement* castedThis = static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()));
@@ -282,7 +298,7 @@ JSValue JSSVGFEDisplacementMapElement::getConstructor(ExecState* exec, JSGlobalO
 JSValue JSC_HOST_CALL jsSVGFEDisplacementMapElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGFEDisplacementMapElement::s_info))
+    if (!thisValue.inherits(&JSSVGFEDisplacementMapElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEDisplacementMapElement* castedThisObj = static_cast<JSSVGFEDisplacementMapElement*>(asObject(thisValue));
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.h
index 3c7db0f..93261bf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGFEDisplacementMapElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFEDisplacementMapElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGFEDisplacementMapElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.cpp
index f494d91..e7dbe0a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.cpp
@@ -88,6 +88,11 @@ bool JSSVGFEDistantLightElement::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSSVGFEDistantLightElement, Base>(exec, &JSSVGFEDistantLightElementTable, this, propertyName, slot);
 }
 
+bool JSSVGFEDistantLightElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEDistantLightElement, Base>(exec, &JSSVGFEDistantLightElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGFEDistantLightElementAzimuth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGFEDistantLightElement* castedThis = static_cast<JSSVGFEDistantLightElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.h
index c6d46e7..4e05afb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGFEDistantLightElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFEDistantLightElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.cpp
index dc392f2..b592c33 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.cpp
@@ -86,6 +86,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSSVGFEFloodElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -102,6 +103,11 @@ bool JSSVGFEFloodElementConstructor::getOwnPropertySlot(ExecState* exec, const I
     return getStaticValueSlot<JSSVGFEFloodElementConstructor, DOMObject>(exec, &JSSVGFEFloodElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSSVGFEFloodElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEFloodElementConstructor, DOMObject>(exec, &JSSVGFEFloodElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFEFloodElementPrototypeTableValues[2] =
@@ -129,6 +135,11 @@ bool JSSVGFEFloodElementPrototype::getOwnPropertySlot(ExecState* exec, const Ide
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGFEFloodElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGFEFloodElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGFEFloodElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGFEFloodElement::s_info = { "SVGFEFloodElement", &JSSVGElement::s_info, &JSSVGFEFloodElementTable, 0 };
 
 JSSVGFEFloodElement::JSSVGFEFloodElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGFEFloodElement> impl)
@@ -146,6 +157,11 @@ bool JSSVGFEFloodElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGFEFloodElement, Base>(exec, &JSSVGFEFloodElementTable, this, propertyName, slot);
 }
 
+bool JSSVGFEFloodElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEFloodElement, Base>(exec, &JSSVGFEFloodElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGFEFloodElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGFEFloodElement* castedThis = static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()));
@@ -230,7 +246,7 @@ JSValue JSSVGFEFloodElement::getConstructor(ExecState* exec, JSGlobalObject* glo
 JSValue JSC_HOST_CALL jsSVGFEFloodElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGFEFloodElement::s_info))
+    if (!thisValue.inherits(&JSSVGFEFloodElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEFloodElement* castedThisObj = static_cast<JSSVGFEFloodElement*>(asObject(thisValue));
     SVGFEFloodElement* imp = static_cast<SVGFEFloodElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.h
index 46aa9a5..4aeb0f3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGFEFloodElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFEFloodElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGFEFloodElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.cpp
index e1ee3bd..927487c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.cpp
@@ -94,6 +94,11 @@ bool JSSVGFEGaussianBlurElementPrototype::getOwnPropertySlot(ExecState* exec, co
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGFEGaussianBlurElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGFEGaussianBlurElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGFEGaussianBlurElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGFEGaussianBlurElement::s_info = { "SVGFEGaussianBlurElement", &JSSVGElement::s_info, &JSSVGFEGaussianBlurElementTable, 0 };
 
 JSSVGFEGaussianBlurElement::JSSVGFEGaussianBlurElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGFEGaussianBlurElement> impl)
@@ -111,6 +116,11 @@ bool JSSVGFEGaussianBlurElement::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSSVGFEGaussianBlurElement, Base>(exec, &JSSVGFEGaussianBlurElementTable, this, propertyName, slot);
 }
 
+bool JSSVGFEGaussianBlurElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEGaussianBlurElement, Base>(exec, &JSSVGFEGaussianBlurElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGFEGaussianBlurElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGFEGaussianBlurElement* castedThis = static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()));
@@ -203,7 +213,7 @@ JSValue jsSVGFEGaussianBlurElementStyle(ExecState* exec, const Identifier&, cons
 JSValue JSC_HOST_CALL jsSVGFEGaussianBlurElementPrototypeFunctionSetStdDeviation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGFEGaussianBlurElement::s_info))
+    if (!thisValue.inherits(&JSSVGFEGaussianBlurElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEGaussianBlurElement* castedThisObj = static_cast<JSSVGFEGaussianBlurElement*>(asObject(thisValue));
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(castedThisObj->impl());
@@ -217,7 +227,7 @@ JSValue JSC_HOST_CALL jsSVGFEGaussianBlurElementPrototypeFunctionSetStdDeviation
 JSValue JSC_HOST_CALL jsSVGFEGaussianBlurElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGFEGaussianBlurElement::s_info))
+    if (!thisValue.inherits(&JSSVGFEGaussianBlurElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEGaussianBlurElement* castedThisObj = static_cast<JSSVGFEGaussianBlurElement*>(asObject(thisValue));
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.h
index dc02e5a..9574b50 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGFEGaussianBlurElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFEGaussianBlurElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -54,9 +55,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGFEGaussianBlurElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.cpp
index 9b26250..97541b7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.cpp
@@ -96,6 +96,11 @@ bool JSSVGFEImageElementPrototype::getOwnPropertySlot(ExecState* exec, const Ide
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGFEImageElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGFEImageElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGFEImageElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGFEImageElement::s_info = { "SVGFEImageElement", &JSSVGElement::s_info, &JSSVGFEImageElementTable, 0 };
 
 JSSVGFEImageElement::JSSVGFEImageElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGFEImageElement> impl)
@@ -113,6 +118,11 @@ bool JSSVGFEImageElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGFEImageElement, Base>(exec, &JSSVGFEImageElementTable, this, propertyName, slot);
 }
 
+bool JSSVGFEImageElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEImageElement, Base>(exec, &JSSVGFEImageElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGFEImageElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGFEImageElement* castedThis = static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()));
@@ -229,7 +239,7 @@ void setJSSVGFEImageElementXmlspace(ExecState* exec, JSObject* thisObject, JSVal
 JSValue JSC_HOST_CALL jsSVGFEImageElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGFEImageElement::s_info))
+    if (!thisValue.inherits(&JSSVGFEImageElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEImageElement* castedThisObj = static_cast<JSSVGFEImageElement*>(asObject(thisValue));
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.h
index 8b2d03e..f3d98e4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGFEImageElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFEImageElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGFEImageElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.cpp
index 0d512aa..b564ec5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.cpp
@@ -89,6 +89,11 @@ bool JSSVGFEMergeElementPrototype::getOwnPropertySlot(ExecState* exec, const Ide
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGFEMergeElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGFEMergeElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGFEMergeElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGFEMergeElement::s_info = { "SVGFEMergeElement", &JSSVGElement::s_info, &JSSVGFEMergeElementTable, 0 };
 
 JSSVGFEMergeElement::JSSVGFEMergeElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGFEMergeElement> impl)
@@ -106,6 +111,11 @@ bool JSSVGFEMergeElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGFEMergeElement, Base>(exec, &JSSVGFEMergeElementTable, this, propertyName, slot);
 }
 
+bool JSSVGFEMergeElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEMergeElement, Base>(exec, &JSSVGFEMergeElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGFEMergeElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGFEMergeElement* castedThis = static_cast<JSSVGFEMergeElement*>(asObject(slot.slotBase()));
@@ -171,7 +181,7 @@ JSValue jsSVGFEMergeElementStyle(ExecState* exec, const Identifier&, const Prope
 JSValue JSC_HOST_CALL jsSVGFEMergeElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGFEMergeElement::s_info))
+    if (!thisValue.inherits(&JSSVGFEMergeElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEMergeElement* castedThisObj = static_cast<JSSVGFEMergeElement*>(asObject(thisValue));
     SVGFEMergeElement* imp = static_cast<SVGFEMergeElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.h
index 0d64712..6d0769b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGFEMergeElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFEMergeElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -54,9 +55,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGFEMergeElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.cpp
index 3358b9d..50f55bf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.cpp
@@ -87,6 +87,11 @@ bool JSSVGFEMergeNodeElement::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSSVGFEMergeNodeElement, Base>(exec, &JSSVGFEMergeNodeElementTable, this, propertyName, slot);
 }
 
+bool JSSVGFEMergeNodeElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEMergeNodeElement, Base>(exec, &JSSVGFEMergeNodeElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGFEMergeNodeElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGFEMergeNodeElement* castedThis = static_cast<JSSVGFEMergeNodeElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.h
index da757a6..6484423 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGFEMergeNodeElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFEMergeNodeElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.cpp
index dc30cf8..82d29d1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.cpp
@@ -93,6 +93,11 @@ bool JSSVGFEOffsetElementPrototype::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGFEOffsetElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGFEOffsetElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGFEOffsetElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGFEOffsetElement::s_info = { "SVGFEOffsetElement", &JSSVGElement::s_info, &JSSVGFEOffsetElementTable, 0 };
 
 JSSVGFEOffsetElement::JSSVGFEOffsetElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGFEOffsetElement> impl)
@@ -110,6 +115,11 @@ bool JSSVGFEOffsetElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGFEOffsetElement, Base>(exec, &JSSVGFEOffsetElementTable, this, propertyName, slot);
 }
 
+bool JSSVGFEOffsetElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEOffsetElement, Base>(exec, &JSSVGFEOffsetElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGFEOffsetElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGFEOffsetElement* castedThis = static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()));
@@ -202,7 +212,7 @@ JSValue jsSVGFEOffsetElementStyle(ExecState* exec, const Identifier&, const Prop
 JSValue JSC_HOST_CALL jsSVGFEOffsetElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGFEOffsetElement::s_info))
+    if (!thisValue.inherits(&JSSVGFEOffsetElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEOffsetElement* castedThisObj = static_cast<JSSVGFEOffsetElement*>(asObject(thisValue));
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.h
index 7ee3daf..9bb1b7a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGFEOffsetElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFEOffsetElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -54,9 +55,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGFEOffsetElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.cpp
index 724a55d..ebd49d5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.cpp
@@ -89,6 +89,11 @@ bool JSSVGFEPointLightElement::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticValueSlot<JSSVGFEPointLightElement, Base>(exec, &JSSVGFEPointLightElementTable, this, propertyName, slot);
 }
 
+bool JSSVGFEPointLightElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFEPointLightElement, Base>(exec, &JSSVGFEPointLightElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGFEPointLightElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGFEPointLightElement* castedThis = static_cast<JSSVGFEPointLightElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.h
index cfbc255..1797583 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGFEPointLightElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFEPointLightElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.cpp
index a481c18..bb41c92 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.cpp
@@ -94,6 +94,11 @@ bool JSSVGFESpecularLightingElementPrototype::getOwnPropertySlot(ExecState* exec
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGFESpecularLightingElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGFESpecularLightingElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGFESpecularLightingElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGFESpecularLightingElement::s_info = { "SVGFESpecularLightingElement", &JSSVGElement::s_info, &JSSVGFESpecularLightingElementTable, 0 };
 
 JSSVGFESpecularLightingElement::JSSVGFESpecularLightingElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGFESpecularLightingElement> impl)
@@ -111,6 +116,11 @@ bool JSSVGFESpecularLightingElement::getOwnPropertySlot(ExecState* exec, const I
     return getStaticValueSlot<JSSVGFESpecularLightingElement, Base>(exec, &JSSVGFESpecularLightingElementTable, this, propertyName, slot);
 }
 
+bool JSSVGFESpecularLightingElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFESpecularLightingElement, Base>(exec, &JSSVGFESpecularLightingElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGFESpecularLightingElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGFESpecularLightingElement* castedThis = static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()));
@@ -212,7 +222,7 @@ JSValue jsSVGFESpecularLightingElementStyle(ExecState* exec, const Identifier&,
 JSValue JSC_HOST_CALL jsSVGFESpecularLightingElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGFESpecularLightingElement::s_info))
+    if (!thisValue.inherits(&JSSVGFESpecularLightingElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFESpecularLightingElement* castedThisObj = static_cast<JSSVGFESpecularLightingElement*>(asObject(thisValue));
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.h
index 41d7575..c64b040 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGFESpecularLightingElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFESpecularLightingElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -54,9 +55,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGFESpecularLightingElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.cpp
index e6a70ea..b466be1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.cpp
@@ -94,6 +94,11 @@ bool JSSVGFESpotLightElement::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSSVGFESpotLightElement, Base>(exec, &JSSVGFESpotLightElementTable, this, propertyName, slot);
 }
 
+bool JSSVGFESpotLightElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFESpotLightElement, Base>(exec, &JSSVGFESpotLightElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGFESpotLightElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGFESpotLightElement* castedThis = static_cast<JSSVGFESpotLightElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.h
index bb2dfa5..5ee6daa 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGFESpotLightElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFESpotLightElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.cpp
index 8d80422..d3bdf20 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.cpp
@@ -90,6 +90,11 @@ bool JSSVGFETileElementPrototype::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGFETileElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGFETileElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGFETileElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGFETileElement::s_info = { "SVGFETileElement", &JSSVGElement::s_info, &JSSVGFETileElementTable, 0 };
 
 JSSVGFETileElement::JSSVGFETileElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGFETileElement> impl)
@@ -107,6 +112,11 @@ bool JSSVGFETileElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGFETileElement, Base>(exec, &JSSVGFETileElementTable, this, propertyName, slot);
 }
 
+bool JSSVGFETileElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFETileElement, Base>(exec, &JSSVGFETileElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGFETileElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGFETileElement* castedThis = static_cast<JSSVGFETileElement*>(asObject(slot.slotBase()));
@@ -181,7 +191,7 @@ JSValue jsSVGFETileElementStyle(ExecState* exec, const Identifier&, const Proper
 JSValue JSC_HOST_CALL jsSVGFETileElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGFETileElement::s_info))
+    if (!thisValue.inherits(&JSSVGFETileElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFETileElement* castedThisObj = static_cast<JSSVGFETileElement*>(asObject(thisValue));
     SVGFETileElement* imp = static_cast<SVGFETileElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.h
index 13d9cbb..0c421d3c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGFETileElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFETileElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -54,9 +55,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGFETileElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.cpp
index ae917a1..3b44a5e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.cpp
@@ -100,6 +100,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSSVGFETurbulenceElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -116,6 +117,11 @@ bool JSSVGFETurbulenceElementConstructor::getOwnPropertySlot(ExecState* exec, co
     return getStaticValueSlot<JSSVGFETurbulenceElementConstructor, DOMObject>(exec, &JSSVGFETurbulenceElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSSVGFETurbulenceElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFETurbulenceElementConstructor, DOMObject>(exec, &JSSVGFETurbulenceElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFETurbulenceElementPrototypeTableValues[8] =
@@ -149,6 +155,11 @@ bool JSSVGFETurbulenceElementPrototype::getOwnPropertySlot(ExecState* exec, cons
     return getStaticPropertySlot<JSSVGFETurbulenceElementPrototype, JSObject>(exec, &JSSVGFETurbulenceElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGFETurbulenceElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSSVGFETurbulenceElementPrototype, JSObject>(exec, &JSSVGFETurbulenceElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGFETurbulenceElement::s_info = { "SVGFETurbulenceElement", &JSSVGElement::s_info, &JSSVGFETurbulenceElementTable, 0 };
 
 JSSVGFETurbulenceElement::JSSVGFETurbulenceElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGFETurbulenceElement> impl)
@@ -166,6 +177,11 @@ bool JSSVGFETurbulenceElement::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticValueSlot<JSSVGFETurbulenceElement, Base>(exec, &JSSVGFETurbulenceElementTable, this, propertyName, slot);
 }
 
+bool JSSVGFETurbulenceElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFETurbulenceElement, Base>(exec, &JSSVGFETurbulenceElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGFETurbulenceElementBaseFrequencyX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGFETurbulenceElement* castedThis = static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()));
@@ -295,7 +311,7 @@ JSValue JSSVGFETurbulenceElement::getConstructor(ExecState* exec, JSGlobalObject
 JSValue JSC_HOST_CALL jsSVGFETurbulenceElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGFETurbulenceElement::s_info))
+    if (!thisValue.inherits(&JSSVGFETurbulenceElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFETurbulenceElement* castedThisObj = static_cast<JSSVGFETurbulenceElement*>(asObject(thisValue));
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.h
index 94c35c3..f6309fb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGFETurbulenceElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFETurbulenceElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGFETurbulenceElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.cpp
index 2bc864a..075497a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.cpp
@@ -102,6 +102,11 @@ bool JSSVGFilterElementPrototype::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGFilterElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGFilterElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGFilterElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGFilterElement::s_info = { "SVGFilterElement", &JSSVGElement::s_info, &JSSVGFilterElementTable, 0 };
 
 JSSVGFilterElement::JSSVGFilterElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGFilterElement> impl)
@@ -119,6 +124,11 @@ bool JSSVGFilterElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGFilterElement, Base>(exec, &JSSVGFilterElementTable, this, propertyName, slot);
 }
 
+bool JSSVGFilterElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGFilterElement, Base>(exec, &JSSVGFilterElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGFilterElementFilterUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGFilterElement* castedThis = static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()));
@@ -262,7 +272,7 @@ void setJSSVGFilterElementXmlspace(ExecState* exec, JSObject* thisObject, JSValu
 JSValue JSC_HOST_CALL jsSVGFilterElementPrototypeFunctionSetFilterRes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGFilterElement::s_info))
+    if (!thisValue.inherits(&JSSVGFilterElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFilterElement* castedThisObj = static_cast<JSSVGFilterElement*>(asObject(thisValue));
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(castedThisObj->impl());
@@ -276,7 +286,7 @@ JSValue JSC_HOST_CALL jsSVGFilterElementPrototypeFunctionSetFilterRes(ExecState*
 JSValue JSC_HOST_CALL jsSVGFilterElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGFilterElement::s_info))
+    if (!thisValue.inherits(&JSSVGFilterElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFilterElement* castedThisObj = static_cast<JSSVGFilterElement*>(asObject(thisValue));
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.h
index d5b1a2d..8c73dba 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGFilterElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGFilterElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGFilterElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.cpp
index 50ad695..10ca1b3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.cpp
@@ -112,6 +112,11 @@ bool JSSVGForeignObjectElementPrototype::getOwnPropertySlot(ExecState* exec, con
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGForeignObjectElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGForeignObjectElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGForeignObjectElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGForeignObjectElement::s_info = { "SVGForeignObjectElement", &JSSVGElement::s_info, &JSSVGForeignObjectElementTable, 0 };
 
 JSSVGForeignObjectElement::JSSVGForeignObjectElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGForeignObjectElement> impl)
@@ -129,6 +134,11 @@ bool JSSVGForeignObjectElement::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSSVGForeignObjectElement, Base>(exec, &JSSVGForeignObjectElementTable, this, propertyName, slot);
 }
 
+bool JSSVGForeignObjectElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGForeignObjectElement, Base>(exec, &JSSVGForeignObjectElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGForeignObjectElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGForeignObjectElement* castedThis = static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()));
@@ -276,7 +286,7 @@ void setJSSVGForeignObjectElementXmlspace(ExecState* exec, JSObject* thisObject,
 JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGForeignObjectElement::s_info))
+    if (!thisValue.inherits(&JSSVGForeignObjectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGForeignObjectElement* castedThisObj = static_cast<JSSVGForeignObjectElement*>(asObject(thisValue));
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThisObj->impl());
@@ -290,7 +300,7 @@ JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionHasExtension(Exe
 JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGForeignObjectElement::s_info))
+    if (!thisValue.inherits(&JSSVGForeignObjectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGForeignObjectElement* castedThisObj = static_cast<JSSVGForeignObjectElement*>(asObject(thisValue));
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThisObj->impl());
@@ -304,7 +314,7 @@ JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetPresentationA
 JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGForeignObjectElement::s_info))
+    if (!thisValue.inherits(&JSSVGForeignObjectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGForeignObjectElement* castedThisObj = static_cast<JSSVGForeignObjectElement*>(asObject(thisValue));
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThisObj->impl());
@@ -317,7 +327,7 @@ JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetBBox(ExecStat
 JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGForeignObjectElement::s_info))
+    if (!thisValue.inherits(&JSSVGForeignObjectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGForeignObjectElement* castedThisObj = static_cast<JSSVGForeignObjectElement*>(asObject(thisValue));
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThisObj->impl());
@@ -330,7 +340,7 @@ JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetCTM(ExecState
 JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGForeignObjectElement::s_info))
+    if (!thisValue.inherits(&JSSVGForeignObjectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGForeignObjectElement* castedThisObj = static_cast<JSSVGForeignObjectElement*>(asObject(thisValue));
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThisObj->impl());
@@ -343,7 +353,7 @@ JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetScreenCTM(Exe
 JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGForeignObjectElement::s_info))
+    if (!thisValue.inherits(&JSSVGForeignObjectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGForeignObjectElement* castedThisObj = static_cast<JSSVGForeignObjectElement*>(asObject(thisValue));
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.h
index 006f61e..b58aae8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGForeignObjectElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGForeignObjectElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGForeignObjectElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.cpp
index d9f0222..8aefd3a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.cpp
@@ -107,6 +107,11 @@ bool JSSVGGElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifie
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGGElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGGElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGGElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGGElement::s_info = { "SVGGElement", &JSSVGElement::s_info, &JSSVGGElementTable, 0 };
 
 JSSVGGElement::JSSVGGElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGGElement> impl)
@@ -124,6 +129,11 @@ bool JSSVGGElement::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSSVGGElement, Base>(exec, &JSSVGGElementTable, this, propertyName, slot);
 }
 
+bool JSSVGGElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGGElement, Base>(exec, &JSSVGGElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGGElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGGElement* castedThis = static_cast<JSSVGGElement*>(asObject(slot.slotBase()));
@@ -235,7 +245,7 @@ void setJSSVGGElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue val
 JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGGElement::s_info))
+    if (!thisValue.inherits(&JSSVGGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGGElement* castedThisObj = static_cast<JSSVGGElement*>(asObject(thisValue));
     SVGGElement* imp = static_cast<SVGGElement*>(castedThisObj->impl());
@@ -249,7 +259,7 @@ JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionHasExtension(ExecState* exec
 JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGGElement::s_info))
+    if (!thisValue.inherits(&JSSVGGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGGElement* castedThisObj = static_cast<JSSVGGElement*>(asObject(thisValue));
     SVGGElement* imp = static_cast<SVGGElement*>(castedThisObj->impl());
@@ -263,7 +273,7 @@ JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetPresentationAttribute(Exe
 JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGGElement::s_info))
+    if (!thisValue.inherits(&JSSVGGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGGElement* castedThisObj = static_cast<JSSVGGElement*>(asObject(thisValue));
     SVGGElement* imp = static_cast<SVGGElement*>(castedThisObj->impl());
@@ -276,7 +286,7 @@ JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetBBox(ExecState* exec, JSO
 JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGGElement::s_info))
+    if (!thisValue.inherits(&JSSVGGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGGElement* castedThisObj = static_cast<JSSVGGElement*>(asObject(thisValue));
     SVGGElement* imp = static_cast<SVGGElement*>(castedThisObj->impl());
@@ -289,7 +299,7 @@ JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetCTM(ExecState* exec, JSOb
 JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGGElement::s_info))
+    if (!thisValue.inherits(&JSSVGGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGGElement* castedThisObj = static_cast<JSSVGGElement*>(asObject(thisValue));
     SVGGElement* imp = static_cast<SVGGElement*>(castedThisObj->impl());
@@ -302,7 +312,7 @@ JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetScreenCTM(ExecState* exec
 JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGGElement::s_info))
+    if (!thisValue.inherits(&JSSVGGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGGElement* castedThisObj = static_cast<JSSVGGElement*>(asObject(thisValue));
     SVGGElement* imp = static_cast<SVGGElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.h
index 920096b..284c1df 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGGElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGGElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGGElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.cpp
index faea429..9af4bb9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.cpp
@@ -91,6 +91,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSSVGGradientElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -107,6 +108,11 @@ bool JSSVGGradientElementConstructor::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSSVGGradientElementConstructor, DOMObject>(exec, &JSSVGGradientElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSSVGGradientElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGGradientElementConstructor, DOMObject>(exec, &JSSVGGradientElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGGradientElementPrototypeTableValues[6] =
@@ -138,6 +144,11 @@ bool JSSVGGradientElementPrototype::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticPropertySlot<JSSVGGradientElementPrototype, JSObject>(exec, &JSSVGGradientElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGGradientElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSSVGGradientElementPrototype, JSObject>(exec, &JSSVGGradientElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGGradientElement::s_info = { "SVGGradientElement", &JSSVGElement::s_info, &JSSVGGradientElementTable, 0 };
 
 JSSVGGradientElement::JSSVGGradientElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGGradientElement> impl)
@@ -155,6 +166,11 @@ bool JSSVGGradientElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGGradientElement, Base>(exec, &JSSVGGradientElementTable, this, propertyName, slot);
 }
 
+bool JSSVGGradientElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGGradientElement, Base>(exec, &JSSVGGradientElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGGradientElementGradientUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGGradientElement* castedThis = static_cast<JSSVGGradientElement*>(asObject(slot.slotBase()));
@@ -230,7 +246,7 @@ JSValue JSSVGGradientElement::getConstructor(ExecState* exec, JSGlobalObject* gl
 JSValue JSC_HOST_CALL jsSVGGradientElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGGradientElement::s_info))
+    if (!thisValue.inherits(&JSSVGGradientElement::s_info))
         return throwError(exec, TypeError);
     JSSVGGradientElement* castedThisObj = static_cast<JSSVGGradientElement*>(asObject(thisValue));
     SVGGradientElement* imp = static_cast<SVGGradientElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.h
index 6600e21..5ddd6e7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGGradientElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGGradientElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGGradientElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.cpp
index 64efb43..cd675d5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.cpp
@@ -115,6 +115,11 @@ bool JSSVGImageElementPrototype::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGImageElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGImageElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGImageElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGImageElement::s_info = { "SVGImageElement", &JSSVGElement::s_info, &JSSVGImageElementTable, 0 };
 
 JSSVGImageElement::JSSVGImageElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGImageElement> impl)
@@ -132,6 +137,11 @@ bool JSSVGImageElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSSVGImageElement, Base>(exec, &JSSVGImageElementTable, this, propertyName, slot);
 }
 
+bool JSSVGImageElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGImageElement, Base>(exec, &JSSVGImageElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGImageElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGImageElement* castedThis = static_cast<JSSVGImageElement*>(asObject(slot.slotBase()));
@@ -297,7 +307,7 @@ void setJSSVGImageElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue
 JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGImageElement::s_info))
+    if (!thisValue.inherits(&JSSVGImageElement::s_info))
         return throwError(exec, TypeError);
     JSSVGImageElement* castedThisObj = static_cast<JSSVGImageElement*>(asObject(thisValue));
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThisObj->impl());
@@ -311,7 +321,7 @@ JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionHasExtension(ExecState*
 JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGImageElement::s_info))
+    if (!thisValue.inherits(&JSSVGImageElement::s_info))
         return throwError(exec, TypeError);
     JSSVGImageElement* castedThisObj = static_cast<JSSVGImageElement*>(asObject(thisValue));
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThisObj->impl());
@@ -325,7 +335,7 @@ JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetPresentationAttribute
 JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGImageElement::s_info))
+    if (!thisValue.inherits(&JSSVGImageElement::s_info))
         return throwError(exec, TypeError);
     JSSVGImageElement* castedThisObj = static_cast<JSSVGImageElement*>(asObject(thisValue));
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThisObj->impl());
@@ -338,7 +348,7 @@ JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetBBox(ExecState* exec,
 JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGImageElement::s_info))
+    if (!thisValue.inherits(&JSSVGImageElement::s_info))
         return throwError(exec, TypeError);
     JSSVGImageElement* castedThisObj = static_cast<JSSVGImageElement*>(asObject(thisValue));
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThisObj->impl());
@@ -351,7 +361,7 @@ JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetCTM(ExecState* exec,
 JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGImageElement::s_info))
+    if (!thisValue.inherits(&JSSVGImageElement::s_info))
         return throwError(exec, TypeError);
     JSSVGImageElement* castedThisObj = static_cast<JSSVGImageElement*>(asObject(thisValue));
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThisObj->impl());
@@ -364,7 +374,7 @@ JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetScreenCTM(ExecState*
 JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGImageElement::s_info))
+    if (!thisValue.inherits(&JSSVGImageElement::s_info))
         return throwError(exec, TypeError);
     JSSVGImageElement* castedThisObj = static_cast<JSSVGImageElement*>(asObject(thisValue));
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.h
index ef21823..9631aca 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGImageElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGImageElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGImageElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLength.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGLength.cpp
index dd7522d..aa4d0bc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLength.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLength.cpp
@@ -89,6 +89,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSSVGLengthPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -105,6 +106,11 @@ bool JSSVGLengthConstructor::getOwnPropertySlot(ExecState* exec, const Identifie
     return getStaticValueSlot<JSSVGLengthConstructor, DOMObject>(exec, &JSSVGLengthConstructorTable, this, propertyName, slot);
 }
 
+bool JSSVGLengthConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGLengthConstructor, DOMObject>(exec, &JSSVGLengthConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGLengthPrototypeTableValues[14] =
@@ -144,6 +150,11 @@ bool JSSVGLengthPrototype::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticPropertySlot<JSSVGLengthPrototype, JSObject>(exec, &JSSVGLengthPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGLengthPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSSVGLengthPrototype, JSObject>(exec, &JSSVGLengthPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGLength::s_info = { "SVGLength", 0, &JSSVGLengthTable, 0 };
 
 JSSVGLength::JSSVGLength(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<JSSVGPODTypeWrapper<SVGLength> > impl, SVGElement* context)
@@ -168,6 +179,11 @@ bool JSSVGLength::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return getStaticValueSlot<JSSVGLength, Base>(exec, &JSSVGLengthTable, this, propertyName, slot);
 }
 
+bool JSSVGLength::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGLength, Base>(exec, &JSSVGLengthTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGLengthUnitType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGLength* castedThis = static_cast<JSSVGLength*>(asObject(slot.slotBase()));
@@ -237,7 +253,7 @@ JSValue JSSVGLength::getConstructor(ExecState* exec, JSGlobalObject* globalObjec
 JSValue JSC_HOST_CALL jsSVGLengthPrototypeFunctionNewValueSpecifiedUnits(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGLength::s_info))
+    if (!thisValue.inherits(&JSSVGLength::s_info))
         return throwError(exec, TypeError);
     JSSVGLength* castedThisObj = static_cast<JSSVGLength*>(asObject(thisValue));
     JSSVGPODTypeWrapper<SVGLength>* wrapper = castedThisObj->impl();
@@ -253,7 +269,7 @@ JSValue JSC_HOST_CALL jsSVGLengthPrototypeFunctionNewValueSpecifiedUnits(ExecSta
 JSValue JSC_HOST_CALL jsSVGLengthPrototypeFunctionConvertToSpecifiedUnits(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGLength::s_info))
+    if (!thisValue.inherits(&JSSVGLength::s_info))
         return throwError(exec, TypeError);
     JSSVGLength* castedThisObj = static_cast<JSSVGLength*>(asObject(thisValue));
     return castedThisObj->convertToSpecifiedUnits(exec, args);
@@ -322,7 +338,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, JSSVGPO
 }
 SVGLength toSVGLength(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGLength::s_info) ? (SVGLength) *static_cast<JSSVGLength*>(asObject(value))->impl() : SVGLength();
+    return value.inherits(&JSSVGLength::s_info) ? (SVGLength) *static_cast<JSSVGLength*>(asObject(value))->impl() : SVGLength();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLength.h b/src/3rdparty/webkit/WebCore/generated/JSSVGLength.h
index 1bf382a..de2c927 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLength.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLength.h
@@ -40,6 +40,7 @@ public:
     virtual ~JSSVGLength();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -72,9 +73,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGLengthPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.cpp
index 7157d65..23b36a0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.cpp
@@ -85,6 +85,11 @@ bool JSSVGLengthListPrototype::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGLengthListPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGLengthListPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGLengthListPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGLengthList::s_info = { "SVGLengthList", 0, &JSSVGLengthListTable, 0 };
 
 JSSVGLengthList::JSSVGLengthList(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGLengthList> impl, SVGElement* context)
@@ -108,6 +113,11 @@ bool JSSVGLengthList::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSSVGLengthList, Base>(exec, &JSSVGLengthListTable, this, propertyName, slot);
 }
 
+bool JSSVGLengthList::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGLengthList, Base>(exec, &JSSVGLengthListTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGLengthListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGLengthList* castedThis = static_cast<JSSVGLengthList*>(asObject(slot.slotBase()));
@@ -119,7 +129,7 @@ JSValue jsSVGLengthListNumberOfItems(ExecState* exec, const Identifier&, const P
 JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGLengthList::s_info))
+    if (!thisValue.inherits(&JSSVGLengthList::s_info))
         return throwError(exec, TypeError);
     JSSVGLengthList* castedThisObj = static_cast<JSSVGLengthList*>(asObject(thisValue));
     SVGLengthList* imp = static_cast<SVGLengthList*>(castedThisObj->impl());
@@ -133,7 +143,7 @@ JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionClear(ExecState* exec, JSO
 JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGLengthList::s_info))
+    if (!thisValue.inherits(&JSSVGLengthList::s_info))
         return throwError(exec, TypeError);
     JSSVGLengthList* castedThisObj = static_cast<JSSVGLengthList*>(asObject(thisValue));
     SVGLengthList* imp = static_cast<SVGLengthList*>(castedThisObj->impl());
@@ -149,7 +159,7 @@ JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionInitialize(ExecState* exec
 JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGLengthList::s_info))
+    if (!thisValue.inherits(&JSSVGLengthList::s_info))
         return throwError(exec, TypeError);
     JSSVGLengthList* castedThisObj = static_cast<JSSVGLengthList*>(asObject(thisValue));
     SVGLengthList* imp = static_cast<SVGLengthList*>(castedThisObj->impl());
@@ -165,7 +175,7 @@ JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionGetItem(ExecState* exec, J
 JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGLengthList::s_info))
+    if (!thisValue.inherits(&JSSVGLengthList::s_info))
         return throwError(exec, TypeError);
     JSSVGLengthList* castedThisObj = static_cast<JSSVGLengthList*>(asObject(thisValue));
     SVGLengthList* imp = static_cast<SVGLengthList*>(castedThisObj->impl());
@@ -182,7 +192,7 @@ JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionInsertItemBefore(ExecState
 JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGLengthList::s_info))
+    if (!thisValue.inherits(&JSSVGLengthList::s_info))
         return throwError(exec, TypeError);
     JSSVGLengthList* castedThisObj = static_cast<JSSVGLengthList*>(asObject(thisValue));
     SVGLengthList* imp = static_cast<SVGLengthList*>(castedThisObj->impl());
@@ -199,7 +209,7 @@ JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionReplaceItem(ExecState* exe
 JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGLengthList::s_info))
+    if (!thisValue.inherits(&JSSVGLengthList::s_info))
         return throwError(exec, TypeError);
     JSSVGLengthList* castedThisObj = static_cast<JSSVGLengthList*>(asObject(thisValue));
     SVGLengthList* imp = static_cast<SVGLengthList*>(castedThisObj->impl());
@@ -215,7 +225,7 @@ JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionRemoveItem(ExecState* exec
 JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGLengthList::s_info))
+    if (!thisValue.inherits(&JSSVGLengthList::s_info))
         return throwError(exec, TypeError);
     JSSVGLengthList* castedThisObj = static_cast<JSSVGLengthList*>(asObject(thisValue));
     SVGLengthList* imp = static_cast<SVGLengthList*>(castedThisObj->impl());
@@ -234,7 +244,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGLeng
 }
 SVGLengthList* toSVGLengthList(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGLengthList::s_info) ? static_cast<JSSVGLengthList*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGLengthList::s_info) ? static_cast<JSSVGLengthList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.h
index 88500a0..d51e341 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.h
@@ -40,6 +40,7 @@ public:
     virtual ~JSSVGLengthList();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -64,9 +65,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGLengthListPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.cpp
index 26f31a9..9ab6c9f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.cpp
@@ -112,6 +112,11 @@ bool JSSVGLineElementPrototype::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGLineElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGLineElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGLineElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGLineElement::s_info = { "SVGLineElement", &JSSVGElement::s_info, &JSSVGLineElementTable, 0 };
 
 JSSVGLineElement::JSSVGLineElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGLineElement> impl)
@@ -129,6 +134,11 @@ bool JSSVGLineElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGLineElement, Base>(exec, &JSSVGLineElementTable, this, propertyName, slot);
 }
 
+bool JSSVGLineElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGLineElement, Base>(exec, &JSSVGLineElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGLineElementX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGLineElement* castedThis = static_cast<JSSVGLineElement*>(asObject(slot.slotBase()));
@@ -276,7 +286,7 @@ void setJSSVGLineElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue
 JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGLineElement::s_info))
+    if (!thisValue.inherits(&JSSVGLineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGLineElement* castedThisObj = static_cast<JSSVGLineElement*>(asObject(thisValue));
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThisObj->impl());
@@ -290,7 +300,7 @@ JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionHasExtension(ExecState* e
 JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGLineElement::s_info))
+    if (!thisValue.inherits(&JSSVGLineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGLineElement* castedThisObj = static_cast<JSSVGLineElement*>(asObject(thisValue));
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThisObj->impl());
@@ -304,7 +314,7 @@ JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetPresentationAttribute(
 JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGLineElement::s_info))
+    if (!thisValue.inherits(&JSSVGLineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGLineElement* castedThisObj = static_cast<JSSVGLineElement*>(asObject(thisValue));
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThisObj->impl());
@@ -317,7 +327,7 @@ JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetBBox(ExecState* exec,
 JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGLineElement::s_info))
+    if (!thisValue.inherits(&JSSVGLineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGLineElement* castedThisObj = static_cast<JSSVGLineElement*>(asObject(thisValue));
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThisObj->impl());
@@ -330,7 +340,7 @@ JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetCTM(ExecState* exec, J
 JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGLineElement::s_info))
+    if (!thisValue.inherits(&JSSVGLineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGLineElement* castedThisObj = static_cast<JSSVGLineElement*>(asObject(thisValue));
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThisObj->impl());
@@ -343,7 +353,7 @@ JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetScreenCTM(ExecState* e
 JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGLineElement::s_info))
+    if (!thisValue.inherits(&JSSVGLineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGLineElement* castedThisObj = static_cast<JSSVGLineElement*>(asObject(thisValue));
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.h
index d31e6dc..1ac4ed6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGLineElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGLineElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGLineElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.cpp
index 1e3ff9a..cadaec7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.cpp
@@ -90,6 +90,11 @@ bool JSSVGLinearGradientElement::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSSVGLinearGradientElement, Base>(exec, &JSSVGLinearGradientElementTable, this, propertyName, slot);
 }
 
+bool JSSVGLinearGradientElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGLinearGradientElement, Base>(exec, &JSSVGLinearGradientElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGLinearGradientElementX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGLinearGradientElement* castedThis = static_cast<JSSVGLinearGradientElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.h
index 737db34..104e1c4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGLinearGradientElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGLinearGradientElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.cpp
index d7a3b82..d8121e2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.cpp
@@ -106,6 +106,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSSVGMarkerElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -122,6 +123,11 @@ bool JSSVGMarkerElementConstructor::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSSVGMarkerElementConstructor, DOMObject>(exec, &JSSVGMarkerElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSSVGMarkerElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGMarkerElementConstructor, DOMObject>(exec, &JSSVGMarkerElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGMarkerElementPrototypeTableValues[10] =
@@ -157,6 +163,11 @@ bool JSSVGMarkerElementPrototype::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticPropertySlot<JSSVGMarkerElementPrototype, JSObject>(exec, &JSSVGMarkerElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGMarkerElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSSVGMarkerElementPrototype, JSObject>(exec, &JSSVGMarkerElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGMarkerElement::s_info = { "SVGMarkerElement", &JSSVGElement::s_info, &JSSVGMarkerElementTable, 0 };
 
 JSSVGMarkerElement::JSSVGMarkerElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGMarkerElement> impl)
@@ -174,6 +185,11 @@ bool JSSVGMarkerElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGMarkerElement, Base>(exec, &JSSVGMarkerElementTable, this, propertyName, slot);
 }
 
+bool JSSVGMarkerElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGMarkerElement, Base>(exec, &JSSVGMarkerElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGMarkerElementRefX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGMarkerElement* castedThis = static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()));
@@ -327,7 +343,7 @@ JSValue JSSVGMarkerElement::getConstructor(ExecState* exec, JSGlobalObject* glob
 JSValue JSC_HOST_CALL jsSVGMarkerElementPrototypeFunctionSetOrientToAuto(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGMarkerElement::s_info))
+    if (!thisValue.inherits(&JSSVGMarkerElement::s_info))
         return throwError(exec, TypeError);
     JSSVGMarkerElement* castedThisObj = static_cast<JSSVGMarkerElement*>(asObject(thisValue));
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(castedThisObj->impl());
@@ -339,7 +355,7 @@ JSValue JSC_HOST_CALL jsSVGMarkerElementPrototypeFunctionSetOrientToAuto(ExecSta
 JSValue JSC_HOST_CALL jsSVGMarkerElementPrototypeFunctionSetOrientToAngle(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGMarkerElement::s_info))
+    if (!thisValue.inherits(&JSSVGMarkerElement::s_info))
         return throwError(exec, TypeError);
     JSSVGMarkerElement* castedThisObj = static_cast<JSSVGMarkerElement*>(asObject(thisValue));
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(castedThisObj->impl());
@@ -352,7 +368,7 @@ JSValue JSC_HOST_CALL jsSVGMarkerElementPrototypeFunctionSetOrientToAngle(ExecSt
 JSValue JSC_HOST_CALL jsSVGMarkerElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGMarkerElement::s_info))
+    if (!thisValue.inherits(&JSSVGMarkerElement::s_info))
         return throwError(exec, TypeError);
     JSSVGMarkerElement* castedThisObj = static_cast<JSSVGMarkerElement*>(asObject(thisValue));
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.h
index 4aad9ee..4298cf2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGMarkerElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGMarkerElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -56,9 +57,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGMarkerElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.cpp
index 4919818..6ac9375 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.cpp
@@ -103,6 +103,11 @@ bool JSSVGMaskElementPrototype::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGMaskElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGMaskElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGMaskElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGMaskElement::s_info = { "SVGMaskElement", &JSSVGElement::s_info, &JSSVGMaskElementTable, 0 };
 
 JSSVGMaskElement::JSSVGMaskElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGMaskElement> impl)
@@ -120,6 +125,11 @@ bool JSSVGMaskElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGMaskElement, Base>(exec, &JSSVGMaskElementTable, this, propertyName, slot);
 }
 
+bool JSSVGMaskElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGMaskElement, Base>(exec, &JSSVGMaskElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGMaskElementMaskUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGMaskElement* castedThis = static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()));
@@ -260,7 +270,7 @@ void setJSSVGMaskElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue
 JSValue JSC_HOST_CALL jsSVGMaskElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGMaskElement::s_info))
+    if (!thisValue.inherits(&JSSVGMaskElement::s_info))
         return throwError(exec, TypeError);
     JSSVGMaskElement* castedThisObj = static_cast<JSSVGMaskElement*>(asObject(thisValue));
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(castedThisObj->impl());
@@ -274,7 +284,7 @@ JSValue JSC_HOST_CALL jsSVGMaskElementPrototypeFunctionHasExtension(ExecState* e
 JSValue JSC_HOST_CALL jsSVGMaskElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGMaskElement::s_info))
+    if (!thisValue.inherits(&JSSVGMaskElement::s_info))
         return throwError(exec, TypeError);
     JSSVGMaskElement* castedThisObj = static_cast<JSSVGMaskElement*>(asObject(thisValue));
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.h
index f8f7abf..cf23acb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGMaskElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGMaskElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGMaskElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.cpp
index d38cbec..348aeb3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.cpp
@@ -92,6 +92,11 @@ bool JSSVGMatrixPrototype::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGMatrixPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGMatrixPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGMatrixPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGMatrix::s_info = { "SVGMatrix", 0, &JSSVGMatrixTable, 0 };
 
 JSSVGMatrix::JSSVGMatrix(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<JSSVGPODTypeWrapper<TransformationMatrix> > impl, SVGElement* context)
@@ -115,6 +120,11 @@ bool JSSVGMatrix::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return getStaticValueSlot<JSSVGMatrix, Base>(exec, &JSSVGMatrixTable, this, propertyName, slot);
 }
 
+bool JSSVGMatrix::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGMatrix, Base>(exec, &JSSVGMatrixTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGMatrixA(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGMatrix* castedThis = static_cast<JSSVGMatrix*>(asObject(slot.slotBase()));
@@ -213,7 +223,7 @@ void setJSSVGMatrixF(ExecState* exec, JSObject* thisObject, JSValue value)
 JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionMultiply(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGMatrix::s_info))
+    if (!thisValue.inherits(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
     JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
@@ -228,7 +238,7 @@ JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionMultiply(ExecState* exec, JSOb
 JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionInverse(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGMatrix::s_info))
+    if (!thisValue.inherits(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
     return castedThisObj->inverse(exec, args);
@@ -237,7 +247,7 @@ JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionInverse(ExecState* exec, JSObj
 JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionTranslate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGMatrix::s_info))
+    if (!thisValue.inherits(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
     JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
@@ -253,7 +263,7 @@ JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionTranslate(ExecState* exec, JSO
 JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionScale(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGMatrix::s_info))
+    if (!thisValue.inherits(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
     JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
@@ -268,7 +278,7 @@ JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionScale(ExecState* exec, JSObjec
 JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionScaleNonUniform(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGMatrix::s_info))
+    if (!thisValue.inherits(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
     JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
@@ -284,7 +294,7 @@ JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionScaleNonUniform(ExecState* exe
 JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionRotate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGMatrix::s_info))
+    if (!thisValue.inherits(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
     JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
@@ -299,7 +309,7 @@ JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionRotate(ExecState* exec, JSObje
 JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionRotateFromVector(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGMatrix::s_info))
+    if (!thisValue.inherits(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
     return castedThisObj->rotateFromVector(exec, args);
@@ -308,7 +318,7 @@ JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionRotateFromVector(ExecState* ex
 JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionFlipX(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGMatrix::s_info))
+    if (!thisValue.inherits(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
     JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
@@ -322,7 +332,7 @@ JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionFlipX(ExecState* exec, JSObjec
 JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionFlipY(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGMatrix::s_info))
+    if (!thisValue.inherits(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
     JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
@@ -336,7 +346,7 @@ JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionFlipY(ExecState* exec, JSObjec
 JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionSkewX(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGMatrix::s_info))
+    if (!thisValue.inherits(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
     JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
@@ -351,7 +361,7 @@ JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionSkewX(ExecState* exec, JSObjec
 JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionSkewY(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGMatrix::s_info))
+    if (!thisValue.inherits(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
     JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
@@ -369,7 +379,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, JSSVGPO
 }
 TransformationMatrix toSVGMatrix(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGMatrix::s_info) ? (TransformationMatrix) *static_cast<JSSVGMatrix*>(asObject(value))->impl() : TransformationMatrix();
+    return value.inherits(&JSSVGMatrix::s_info) ? (TransformationMatrix) *static_cast<JSSVGMatrix*>(asObject(value))->impl() : TransformationMatrix();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.h b/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.h
index b4a07f7..e21b789 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.h
@@ -40,6 +40,7 @@ public:
     virtual ~JSSVGMatrix();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -69,9 +70,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGMatrixPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.cpp
index 3131b44..0024f12 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.cpp
@@ -92,6 +92,11 @@ bool JSSVGNumber::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return getStaticValueSlot<JSSVGNumber, Base>(exec, &JSSVGNumberTable, this, propertyName, slot);
 }
 
+bool JSSVGNumber::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGNumber, Base>(exec, &JSSVGNumberTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGNumberValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGNumber* castedThis = static_cast<JSSVGNumber*>(asObject(slot.slotBase()));
@@ -118,7 +123,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, JSSVGPO
 }
 float toSVGNumber(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGNumber::s_info) ? (float) *static_cast<JSSVGNumber*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGNumber::s_info) ? (float) *static_cast<JSSVGNumber*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.h b/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.h
index de5e023..ac8fa05 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.h
@@ -39,6 +39,7 @@ public:
     virtual ~JSSVGNumber();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.cpp
index 8a635dd..b5076f7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.cpp
@@ -84,6 +84,11 @@ bool JSSVGNumberListPrototype::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGNumberListPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGNumberListPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGNumberListPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGNumberList::s_info = { "SVGNumberList", 0, &JSSVGNumberListTable, 0 };
 
 JSSVGNumberList::JSSVGNumberList(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGNumberList> impl, SVGElement* context)
@@ -107,6 +112,11 @@ bool JSSVGNumberList::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSSVGNumberList, Base>(exec, &JSSVGNumberListTable, this, propertyName, slot);
 }
 
+bool JSSVGNumberList::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGNumberList, Base>(exec, &JSSVGNumberListTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGNumberListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGNumberList* castedThis = static_cast<JSSVGNumberList*>(asObject(slot.slotBase()));
@@ -118,7 +128,7 @@ JSValue jsSVGNumberListNumberOfItems(ExecState* exec, const Identifier&, const P
 JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGNumberList::s_info))
+    if (!thisValue.inherits(&JSSVGNumberList::s_info))
         return throwError(exec, TypeError);
     JSSVGNumberList* castedThisObj = static_cast<JSSVGNumberList*>(asObject(thisValue));
     SVGNumberList* imp = static_cast<SVGNumberList*>(castedThisObj->impl());
@@ -132,7 +142,7 @@ JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionClear(ExecState* exec, JSO
 JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGNumberList::s_info))
+    if (!thisValue.inherits(&JSSVGNumberList::s_info))
         return throwError(exec, TypeError);
     JSSVGNumberList* castedThisObj = static_cast<JSSVGNumberList*>(asObject(thisValue));
     SVGNumberList* imp = static_cast<SVGNumberList*>(castedThisObj->impl());
@@ -148,7 +158,7 @@ JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionInitialize(ExecState* exec
 JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGNumberList::s_info))
+    if (!thisValue.inherits(&JSSVGNumberList::s_info))
         return throwError(exec, TypeError);
     JSSVGNumberList* castedThisObj = static_cast<JSSVGNumberList*>(asObject(thisValue));
     SVGNumberList* imp = static_cast<SVGNumberList*>(castedThisObj->impl());
@@ -164,7 +174,7 @@ JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionGetItem(ExecState* exec, J
 JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGNumberList::s_info))
+    if (!thisValue.inherits(&JSSVGNumberList::s_info))
         return throwError(exec, TypeError);
     JSSVGNumberList* castedThisObj = static_cast<JSSVGNumberList*>(asObject(thisValue));
     SVGNumberList* imp = static_cast<SVGNumberList*>(castedThisObj->impl());
@@ -181,7 +191,7 @@ JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionInsertItemBefore(ExecState
 JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGNumberList::s_info))
+    if (!thisValue.inherits(&JSSVGNumberList::s_info))
         return throwError(exec, TypeError);
     JSSVGNumberList* castedThisObj = static_cast<JSSVGNumberList*>(asObject(thisValue));
     SVGNumberList* imp = static_cast<SVGNumberList*>(castedThisObj->impl());
@@ -198,7 +208,7 @@ JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionReplaceItem(ExecState* exe
 JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGNumberList::s_info))
+    if (!thisValue.inherits(&JSSVGNumberList::s_info))
         return throwError(exec, TypeError);
     JSSVGNumberList* castedThisObj = static_cast<JSSVGNumberList*>(asObject(thisValue));
     SVGNumberList* imp = static_cast<SVGNumberList*>(castedThisObj->impl());
@@ -214,7 +224,7 @@ JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionRemoveItem(ExecState* exec
 JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGNumberList::s_info))
+    if (!thisValue.inherits(&JSSVGNumberList::s_info))
         return throwError(exec, TypeError);
     JSSVGNumberList* castedThisObj = static_cast<JSSVGNumberList*>(asObject(thisValue));
     SVGNumberList* imp = static_cast<SVGNumberList*>(castedThisObj->impl());
@@ -233,7 +243,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGNumb
 }
 SVGNumberList* toSVGNumberList(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGNumberList::s_info) ? static_cast<JSSVGNumberList*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGNumberList::s_info) ? static_cast<JSSVGNumberList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.h
index 9e7b0b5..4f5fe3e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.h
@@ -40,6 +40,7 @@ public:
     virtual ~JSSVGNumberList();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -64,9 +65,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGNumberListPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.cpp
index 732860a..f1a8922 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.cpp
@@ -86,6 +86,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSSVGPaintPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -102,6 +103,11 @@ bool JSSVGPaintConstructor::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSSVGPaintConstructor, DOMObject>(exec, &JSSVGPaintConstructorTable, this, propertyName, slot);
 }
 
+bool JSSVGPaintConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPaintConstructor, DOMObject>(exec, &JSSVGPaintConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGPaintPrototypeTableValues[13] =
@@ -140,6 +146,11 @@ bool JSSVGPaintPrototype::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticPropertySlot<JSSVGPaintPrototype, JSObject>(exec, &JSSVGPaintPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGPaintPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSSVGPaintPrototype, JSObject>(exec, &JSSVGPaintPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGPaint::s_info = { "SVGPaint", &JSSVGColor::s_info, &JSSVGPaintTable, 0 };
 
 JSSVGPaint::JSSVGPaint(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPaint> impl)
@@ -157,6 +168,11 @@ bool JSSVGPaint::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSSVGPaint, Base>(exec, &JSSVGPaintTable, this, propertyName, slot);
 }
 
+bool JSSVGPaint::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPaint, Base>(exec, &JSSVGPaintTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGPaintPaintType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGPaint* castedThis = static_cast<JSSVGPaint*>(asObject(slot.slotBase()));
@@ -186,7 +202,7 @@ JSValue JSSVGPaint::getConstructor(ExecState* exec, JSGlobalObject* globalObject
 JSValue JSC_HOST_CALL jsSVGPaintPrototypeFunctionSetUri(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPaint::s_info))
+    if (!thisValue.inherits(&JSSVGPaint::s_info))
         return throwError(exec, TypeError);
     JSSVGPaint* castedThisObj = static_cast<JSSVGPaint*>(asObject(thisValue));
     SVGPaint* imp = static_cast<SVGPaint*>(castedThisObj->impl());
@@ -199,7 +215,7 @@ JSValue JSC_HOST_CALL jsSVGPaintPrototypeFunctionSetUri(ExecState* exec, JSObjec
 JSValue JSC_HOST_CALL jsSVGPaintPrototypeFunctionSetPaint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPaint::s_info))
+    if (!thisValue.inherits(&JSSVGPaint::s_info))
         return throwError(exec, TypeError);
     JSSVGPaint* castedThisObj = static_cast<JSSVGPaint*>(asObject(thisValue));
     SVGPaint* imp = static_cast<SVGPaint*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.h
index a751b9d..3d00aee 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.h
@@ -36,6 +36,7 @@ public:
     JSSVGPaint(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPaint>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGPaintPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.cpp
index fd5c679..4248be6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.cpp
@@ -168,6 +168,11 @@ bool JSSVGPathElementPrototype::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGPathElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGPathElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGPathElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGPathElement::s_info = { "SVGPathElement", &JSSVGElement::s_info, &JSSVGPathElementTable, 0 };
 
 JSSVGPathElement::JSSVGPathElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathElement> impl)
@@ -185,6 +190,11 @@ bool JSSVGPathElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGPathElement, Base>(exec, &JSSVGPathElementTable, this, propertyName, slot);
 }
 
+bool JSSVGPathElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathElement, Base>(exec, &JSSVGPathElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGPathElementPathLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGPathElement* castedThis = static_cast<JSSVGPathElement*>(asObject(slot.slotBase()));
@@ -337,7 +347,7 @@ void setJSSVGPathElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue
 JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetTotalLength(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
@@ -350,7 +360,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetTotalLength(ExecState*
 JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetPointAtLength(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
@@ -364,7 +374,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetPointAtLength(ExecStat
 JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetPathSegAtLength(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
@@ -378,7 +388,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetPathSegAtLength(ExecSt
 JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegClosePath(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
@@ -391,7 +401,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegClosePath
 JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoAbs(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
@@ -406,7 +416,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoAbs
 JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoRel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
@@ -421,7 +431,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoRel
 JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoAbs(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
@@ -436,7 +446,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoAbs
 JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoRel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
@@ -451,7 +461,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoRel
 JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicAbs(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
@@ -470,7 +480,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCu
 JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicRel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
@@ -489,7 +499,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCu
 JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticAbs(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
@@ -506,7 +516,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQu
 JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticRel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
@@ -523,7 +533,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQu
 JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcAbs(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
@@ -543,7 +553,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcAbs(Ex
 JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcRel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
@@ -563,7 +573,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcRel(Ex
 JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalAbs(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
@@ -577,7 +587,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHor
 JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalRel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
@@ -591,7 +601,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHor
 JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalAbs(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
@@ -605,7 +615,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVer
 JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalRel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
@@ -619,7 +629,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVer
 JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothAbs(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
@@ -636,7 +646,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCu
 JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothRel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
@@ -653,7 +663,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCu
 JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothAbs(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
@@ -668,7 +678,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQu
 JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothRel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
@@ -683,7 +693,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQu
 JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
@@ -697,7 +707,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionHasExtension(ExecState* e
 JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
@@ -711,7 +721,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetPresentationAttribute(
 JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
@@ -724,7 +734,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetBBox(ExecState* exec,
 JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
@@ -737,7 +747,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetCTM(ExecState* exec, J
 JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
@@ -750,7 +760,7 @@ JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetScreenCTM(ExecState* e
 JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathElement::s_info))
+    if (!thisValue.inherits(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.h
index e96b612..69c0b65 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGPathElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGPathElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.cpp
index 04e3078..978e494 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.cpp
@@ -95,6 +95,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSSVGPathSegPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -111,6 +112,11 @@ bool JSSVGPathSegConstructor::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSSVGPathSegConstructor, DOMObject>(exec, &JSSVGPathSegConstructorTable, this, propertyName, slot);
 }
 
+bool JSSVGPathSegConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegConstructor, DOMObject>(exec, &JSSVGPathSegConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGPathSegPrototypeTableValues[21] =
@@ -157,6 +163,11 @@ bool JSSVGPathSegPrototype::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSSVGPathSegPrototype, JSObject>(exec, &JSSVGPathSegPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGPathSegPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegPrototype, JSObject>(exec, &JSSVGPathSegPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGPathSeg::s_info = { "SVGPathSeg", 0, &JSSVGPathSegTable, 0 };
 
 JSSVGPathSeg::JSSVGPathSeg(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSeg> impl, SVGElement* context)
@@ -180,6 +191,11 @@ bool JSSVGPathSeg::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<JSSVGPathSeg, Base>(exec, &JSSVGPathSegTable, this, propertyName, slot);
 }
 
+bool JSSVGPathSeg::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSeg, Base>(exec, &JSSVGPathSegTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGPathSegPathSegType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGPathSeg* castedThis = static_cast<JSSVGPathSeg*>(asObject(slot.slotBase()));
@@ -310,7 +326,7 @@ JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_REL(ExecState* exec, const
 
 SVGPathSeg* toSVGPathSeg(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGPathSeg::s_info) ? static_cast<JSSVGPathSeg*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGPathSeg::s_info) ? static_cast<JSSVGPathSeg*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.h
index 7fb1ab4..b7cb99a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.h
@@ -40,6 +40,7 @@ public:
     virtual ~JSSVGPathSeg();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -65,9 +66,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGPathSegPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.cpp
index 1edda2e..2548378 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.cpp
@@ -93,6 +93,11 @@ bool JSSVGPathSegArcAbs::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGPathSegArcAbs, Base>(exec, &JSSVGPathSegArcAbsTable, this, propertyName, slot);
 }
 
+bool JSSVGPathSegArcAbs::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegArcAbs, Base>(exec, &JSSVGPathSegArcAbsTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGPathSegArcAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGPathSegArcAbs* castedThis = static_cast<JSSVGPathSegArcAbs*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.h
index d91b14a..82f0574 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.h
@@ -36,6 +36,7 @@ public:
     JSSVGPathSegArcAbs(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegArcAbs>, SVGElement* context);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.cpp
index 0c5bc66..cd41570 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.cpp
@@ -93,6 +93,11 @@ bool JSSVGPathSegArcRel::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGPathSegArcRel, Base>(exec, &JSSVGPathSegArcRelTable, this, propertyName, slot);
 }
 
+bool JSSVGPathSegArcRel::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegArcRel, Base>(exec, &JSSVGPathSegArcRelTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGPathSegArcRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGPathSegArcRel* castedThis = static_cast<JSSVGPathSegArcRel*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.h
index 4bb6d0a..9d395ad 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.h
@@ -36,6 +36,7 @@ public:
     JSSVGPathSegArcRel(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegArcRel>, SVGElement* context);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.cpp
index 012e821..e7ceaf5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.cpp
@@ -92,6 +92,11 @@ bool JSSVGPathSegCurvetoCubicAbs::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticValueSlot<JSSVGPathSegCurvetoCubicAbs, Base>(exec, &JSSVGPathSegCurvetoCubicAbsTable, this, propertyName, slot);
 }
 
+bool JSSVGPathSegCurvetoCubicAbs::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegCurvetoCubicAbs, Base>(exec, &JSSVGPathSegCurvetoCubicAbsTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGPathSegCurvetoCubicAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGPathSegCurvetoCubicAbs* castedThis = static_cast<JSSVGPathSegCurvetoCubicAbs*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.h
index e53a208..6a7ac39 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.h
@@ -36,6 +36,7 @@ public:
     JSSVGPathSegCurvetoCubicAbs(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegCurvetoCubicAbs>, SVGElement* context);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.cpp
index c2b5c9b..3a9222c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.cpp
@@ -92,6 +92,11 @@ bool JSSVGPathSegCurvetoCubicRel::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticValueSlot<JSSVGPathSegCurvetoCubicRel, Base>(exec, &JSSVGPathSegCurvetoCubicRelTable, this, propertyName, slot);
 }
 
+bool JSSVGPathSegCurvetoCubicRel::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegCurvetoCubicRel, Base>(exec, &JSSVGPathSegCurvetoCubicRelTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGPathSegCurvetoCubicRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGPathSegCurvetoCubicRel* castedThis = static_cast<JSSVGPathSegCurvetoCubicRel*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.h
index 0f79a95..3246237 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.h
@@ -36,6 +36,7 @@ public:
     JSSVGPathSegCurvetoCubicRel(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegCurvetoCubicRel>, SVGElement* context);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.cpp
index 2ac3d0e..b1acef9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.cpp
@@ -90,6 +90,11 @@ bool JSSVGPathSegCurvetoCubicSmoothAbs::getOwnPropertySlot(ExecState* exec, cons
     return getStaticValueSlot<JSSVGPathSegCurvetoCubicSmoothAbs, Base>(exec, &JSSVGPathSegCurvetoCubicSmoothAbsTable, this, propertyName, slot);
 }
 
+bool JSSVGPathSegCurvetoCubicSmoothAbs::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegCurvetoCubicSmoothAbs, Base>(exec, &JSSVGPathSegCurvetoCubicSmoothAbsTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGPathSegCurvetoCubicSmoothAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGPathSegCurvetoCubicSmoothAbs* castedThis = static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.h
index b242e39..ace4e3a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.h
@@ -36,6 +36,7 @@ public:
     JSSVGPathSegCurvetoCubicSmoothAbs(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegCurvetoCubicSmoothAbs>, SVGElement* context);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.cpp
index ed122a3..c5aaeb6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.cpp
@@ -90,6 +90,11 @@ bool JSSVGPathSegCurvetoCubicSmoothRel::getOwnPropertySlot(ExecState* exec, cons
     return getStaticValueSlot<JSSVGPathSegCurvetoCubicSmoothRel, Base>(exec, &JSSVGPathSegCurvetoCubicSmoothRelTable, this, propertyName, slot);
 }
 
+bool JSSVGPathSegCurvetoCubicSmoothRel::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegCurvetoCubicSmoothRel, Base>(exec, &JSSVGPathSegCurvetoCubicSmoothRelTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGPathSegCurvetoCubicSmoothRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGPathSegCurvetoCubicSmoothRel* castedThis = static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.h
index 557ae46..39df37b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.h
@@ -36,6 +36,7 @@ public:
     JSSVGPathSegCurvetoCubicSmoothRel(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegCurvetoCubicSmoothRel>, SVGElement* context);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.cpp
index eb8515d..3e415ac 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.cpp
@@ -90,6 +90,11 @@ bool JSSVGPathSegCurvetoQuadraticAbs::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSSVGPathSegCurvetoQuadraticAbs, Base>(exec, &JSSVGPathSegCurvetoQuadraticAbsTable, this, propertyName, slot);
 }
 
+bool JSSVGPathSegCurvetoQuadraticAbs::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegCurvetoQuadraticAbs, Base>(exec, &JSSVGPathSegCurvetoQuadraticAbsTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGPathSegCurvetoQuadraticAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGPathSegCurvetoQuadraticAbs* castedThis = static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.h
index 9112598..aa55d0b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.h
@@ -36,6 +36,7 @@ public:
     JSSVGPathSegCurvetoQuadraticAbs(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegCurvetoQuadraticAbs>, SVGElement* context);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.cpp
index c62f6ac..1bd92a3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.cpp
@@ -90,6 +90,11 @@ bool JSSVGPathSegCurvetoQuadraticRel::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSSVGPathSegCurvetoQuadraticRel, Base>(exec, &JSSVGPathSegCurvetoQuadraticRelTable, this, propertyName, slot);
 }
 
+bool JSSVGPathSegCurvetoQuadraticRel::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegCurvetoQuadraticRel, Base>(exec, &JSSVGPathSegCurvetoQuadraticRelTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGPathSegCurvetoQuadraticRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGPathSegCurvetoQuadraticRel* castedThis = static_cast<JSSVGPathSegCurvetoQuadraticRel*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.h
index cfbb1b3..b6197f4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.h
@@ -36,6 +36,7 @@ public:
     JSSVGPathSegCurvetoQuadraticRel(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegCurvetoQuadraticRel>, SVGElement* context);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.cpp
index ea5f5da..ca5299c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.cpp
@@ -88,6 +88,11 @@ bool JSSVGPathSegCurvetoQuadraticSmoothAbs::getOwnPropertySlot(ExecState* exec,
     return getStaticValueSlot<JSSVGPathSegCurvetoQuadraticSmoothAbs, Base>(exec, &JSSVGPathSegCurvetoQuadraticSmoothAbsTable, this, propertyName, slot);
 }
 
+bool JSSVGPathSegCurvetoQuadraticSmoothAbs::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegCurvetoQuadraticSmoothAbs, Base>(exec, &JSSVGPathSegCurvetoQuadraticSmoothAbsTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGPathSegCurvetoQuadraticSmoothAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGPathSegCurvetoQuadraticSmoothAbs* castedThis = static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.h
index 48967a1..5cb6c06 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.h
@@ -36,6 +36,7 @@ public:
     JSSVGPathSegCurvetoQuadraticSmoothAbs(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegCurvetoQuadraticSmoothAbs>, SVGElement* context);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.cpp
index 56a7163..7a0bd04 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.cpp
@@ -88,6 +88,11 @@ bool JSSVGPathSegCurvetoQuadraticSmoothRel::getOwnPropertySlot(ExecState* exec,
     return getStaticValueSlot<JSSVGPathSegCurvetoQuadraticSmoothRel, Base>(exec, &JSSVGPathSegCurvetoQuadraticSmoothRelTable, this, propertyName, slot);
 }
 
+bool JSSVGPathSegCurvetoQuadraticSmoothRel::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegCurvetoQuadraticSmoothRel, Base>(exec, &JSSVGPathSegCurvetoQuadraticSmoothRelTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGPathSegCurvetoQuadraticSmoothRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGPathSegCurvetoQuadraticSmoothRel* castedThis = static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.h
index 8e78609..9a81373 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.h
@@ -36,6 +36,7 @@ public:
     JSSVGPathSegCurvetoQuadraticSmoothRel(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegCurvetoQuadraticSmoothRel>, SVGElement* context);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.cpp
index cb3049b..c56577c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.cpp
@@ -88,6 +88,11 @@ bool JSSVGPathSegLinetoAbs::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSSVGPathSegLinetoAbs, Base>(exec, &JSSVGPathSegLinetoAbsTable, this, propertyName, slot);
 }
 
+bool JSSVGPathSegLinetoAbs::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegLinetoAbs, Base>(exec, &JSSVGPathSegLinetoAbsTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGPathSegLinetoAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGPathSegLinetoAbs* castedThis = static_cast<JSSVGPathSegLinetoAbs*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.h
index 8e403de..8a68ab9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.h
@@ -36,6 +36,7 @@ public:
     JSSVGPathSegLinetoAbs(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegLinetoAbs>, SVGElement* context);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.cpp
index 2a6a087..24194e5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.cpp
@@ -87,6 +87,11 @@ bool JSSVGPathSegLinetoHorizontalAbs::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSSVGPathSegLinetoHorizontalAbs, Base>(exec, &JSSVGPathSegLinetoHorizontalAbsTable, this, propertyName, slot);
 }
 
+bool JSSVGPathSegLinetoHorizontalAbs::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegLinetoHorizontalAbs, Base>(exec, &JSSVGPathSegLinetoHorizontalAbsTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGPathSegLinetoHorizontalAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGPathSegLinetoHorizontalAbs* castedThis = static_cast<JSSVGPathSegLinetoHorizontalAbs*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.h
index 237124a..c43defa 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.h
@@ -36,6 +36,7 @@ public:
     JSSVGPathSegLinetoHorizontalAbs(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegLinetoHorizontalAbs>, SVGElement* context);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.cpp
index 68c5b37..ace7517 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.cpp
@@ -87,6 +87,11 @@ bool JSSVGPathSegLinetoHorizontalRel::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSSVGPathSegLinetoHorizontalRel, Base>(exec, &JSSVGPathSegLinetoHorizontalRelTable, this, propertyName, slot);
 }
 
+bool JSSVGPathSegLinetoHorizontalRel::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegLinetoHorizontalRel, Base>(exec, &JSSVGPathSegLinetoHorizontalRelTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGPathSegLinetoHorizontalRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGPathSegLinetoHorizontalRel* castedThis = static_cast<JSSVGPathSegLinetoHorizontalRel*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.h
index 8c76dbf..6927541 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.h
@@ -36,6 +36,7 @@ public:
     JSSVGPathSegLinetoHorizontalRel(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegLinetoHorizontalRel>, SVGElement* context);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.cpp
index d90984d..3f6a40b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.cpp
@@ -88,6 +88,11 @@ bool JSSVGPathSegLinetoRel::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSSVGPathSegLinetoRel, Base>(exec, &JSSVGPathSegLinetoRelTable, this, propertyName, slot);
 }
 
+bool JSSVGPathSegLinetoRel::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegLinetoRel, Base>(exec, &JSSVGPathSegLinetoRelTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGPathSegLinetoRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGPathSegLinetoRel* castedThis = static_cast<JSSVGPathSegLinetoRel*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.h
index 7d6e156..be79f8f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.h
@@ -36,6 +36,7 @@ public:
     JSSVGPathSegLinetoRel(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegLinetoRel>, SVGElement* context);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.cpp
index a51ca33..27a7253 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.cpp
@@ -87,6 +87,11 @@ bool JSSVGPathSegLinetoVerticalAbs::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSSVGPathSegLinetoVerticalAbs, Base>(exec, &JSSVGPathSegLinetoVerticalAbsTable, this, propertyName, slot);
 }
 
+bool JSSVGPathSegLinetoVerticalAbs::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegLinetoVerticalAbs, Base>(exec, &JSSVGPathSegLinetoVerticalAbsTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGPathSegLinetoVerticalAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGPathSegLinetoVerticalAbs* castedThis = static_cast<JSSVGPathSegLinetoVerticalAbs*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.h
index 8a2b51d..fbbec1a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.h
@@ -36,6 +36,7 @@ public:
     JSSVGPathSegLinetoVerticalAbs(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegLinetoVerticalAbs>, SVGElement* context);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.cpp
index 03873cb..9fb9aac 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.cpp
@@ -87,6 +87,11 @@ bool JSSVGPathSegLinetoVerticalRel::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSSVGPathSegLinetoVerticalRel, Base>(exec, &JSSVGPathSegLinetoVerticalRelTable, this, propertyName, slot);
 }
 
+bool JSSVGPathSegLinetoVerticalRel::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegLinetoVerticalRel, Base>(exec, &JSSVGPathSegLinetoVerticalRelTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGPathSegLinetoVerticalRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGPathSegLinetoVerticalRel* castedThis = static_cast<JSSVGPathSegLinetoVerticalRel*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.h
index 25f03a0..a566b79 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.h
@@ -36,6 +36,7 @@ public:
     JSSVGPathSegLinetoVerticalRel(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegLinetoVerticalRel>, SVGElement* context);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.cpp
index fddc132..1c0c405 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.cpp
@@ -84,6 +84,11 @@ bool JSSVGPathSegListPrototype::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGPathSegListPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGPathSegListPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGPathSegListPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGPathSegList::s_info = { "SVGPathSegList", 0, &JSSVGPathSegListTable, 0 };
 
 JSSVGPathSegList::JSSVGPathSegList(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPathSegList> impl, SVGElement* context)
@@ -107,6 +112,11 @@ bool JSSVGPathSegList::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGPathSegList, Base>(exec, &JSSVGPathSegListTable, this, propertyName, slot);
 }
 
+bool JSSVGPathSegList::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegList, Base>(exec, &JSSVGPathSegListTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGPathSegListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGPathSegList* castedThis = static_cast<JSSVGPathSegList*>(asObject(slot.slotBase()));
@@ -118,7 +128,7 @@ JSValue jsSVGPathSegListNumberOfItems(ExecState* exec, const Identifier&, const
 JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathSegList::s_info))
+    if (!thisValue.inherits(&JSSVGPathSegList::s_info))
         return throwError(exec, TypeError);
     JSSVGPathSegList* castedThisObj = static_cast<JSSVGPathSegList*>(asObject(thisValue));
     return castedThisObj->clear(exec, args);
@@ -127,7 +137,7 @@ JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionClear(ExecState* exec, JS
 JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathSegList::s_info))
+    if (!thisValue.inherits(&JSSVGPathSegList::s_info))
         return throwError(exec, TypeError);
     JSSVGPathSegList* castedThisObj = static_cast<JSSVGPathSegList*>(asObject(thisValue));
     return castedThisObj->initialize(exec, args);
@@ -136,7 +146,7 @@ JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionInitialize(ExecState* exe
 JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathSegList::s_info))
+    if (!thisValue.inherits(&JSSVGPathSegList::s_info))
         return throwError(exec, TypeError);
     JSSVGPathSegList* castedThisObj = static_cast<JSSVGPathSegList*>(asObject(thisValue));
     return castedThisObj->getItem(exec, args);
@@ -145,7 +155,7 @@ JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionGetItem(ExecState* exec,
 JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathSegList::s_info))
+    if (!thisValue.inherits(&JSSVGPathSegList::s_info))
         return throwError(exec, TypeError);
     JSSVGPathSegList* castedThisObj = static_cast<JSSVGPathSegList*>(asObject(thisValue));
     return castedThisObj->insertItemBefore(exec, args);
@@ -154,7 +164,7 @@ JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionInsertItemBefore(ExecStat
 JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathSegList::s_info))
+    if (!thisValue.inherits(&JSSVGPathSegList::s_info))
         return throwError(exec, TypeError);
     JSSVGPathSegList* castedThisObj = static_cast<JSSVGPathSegList*>(asObject(thisValue));
     return castedThisObj->replaceItem(exec, args);
@@ -163,7 +173,7 @@ JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionReplaceItem(ExecState* ex
 JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathSegList::s_info))
+    if (!thisValue.inherits(&JSSVGPathSegList::s_info))
         return throwError(exec, TypeError);
     JSSVGPathSegList* castedThisObj = static_cast<JSSVGPathSegList*>(asObject(thisValue));
     return castedThisObj->removeItem(exec, args);
@@ -172,7 +182,7 @@ JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionRemoveItem(ExecState* exe
 JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPathSegList::s_info))
+    if (!thisValue.inherits(&JSSVGPathSegList::s_info))
         return throwError(exec, TypeError);
     JSSVGPathSegList* castedThisObj = static_cast<JSSVGPathSegList*>(asObject(thisValue));
     return castedThisObj->appendItem(exec, args);
@@ -184,7 +194,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGPath
 }
 SVGPathSegList* toSVGPathSegList(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGPathSegList::s_info) ? static_cast<JSSVGPathSegList*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGPathSegList::s_info) ? static_cast<JSSVGPathSegList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.h
index dfa9d56..7d97202 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.h
@@ -40,6 +40,7 @@ public:
     virtual ~JSSVGPathSegList();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -73,9 +74,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGPathSegListPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.cpp
index 836096b..c79b510 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.cpp
@@ -88,6 +88,11 @@ bool JSSVGPathSegMovetoAbs::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSSVGPathSegMovetoAbs, Base>(exec, &JSSVGPathSegMovetoAbsTable, this, propertyName, slot);
 }
 
+bool JSSVGPathSegMovetoAbs::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegMovetoAbs, Base>(exec, &JSSVGPathSegMovetoAbsTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGPathSegMovetoAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGPathSegMovetoAbs* castedThis = static_cast<JSSVGPathSegMovetoAbs*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.h
index d072b5d..178eb80 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.h
@@ -36,6 +36,7 @@ public:
     JSSVGPathSegMovetoAbs(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegMovetoAbs>, SVGElement* context);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.cpp
index ee180ac..f64dd70 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.cpp
@@ -88,6 +88,11 @@ bool JSSVGPathSegMovetoRel::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSSVGPathSegMovetoRel, Base>(exec, &JSSVGPathSegMovetoRelTable, this, propertyName, slot);
 }
 
+bool JSSVGPathSegMovetoRel::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPathSegMovetoRel, Base>(exec, &JSSVGPathSegMovetoRelTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGPathSegMovetoRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGPathSegMovetoRel* castedThis = static_cast<JSSVGPathSegMovetoRel*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.h
index c82f216..c964373 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.h
@@ -36,6 +36,7 @@ public:
     JSSVGPathSegMovetoRel(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPathSegMovetoRel>, SVGElement* context);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.cpp
index 90c5ce0..9ba311c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.cpp
@@ -110,6 +110,11 @@ bool JSSVGPatternElementPrototype::getOwnPropertySlot(ExecState* exec, const Ide
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGPatternElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGPatternElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGPatternElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGPatternElement::s_info = { "SVGPatternElement", &JSSVGElement::s_info, &JSSVGPatternElementTable, 0 };
 
 JSSVGPatternElement::JSSVGPatternElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPatternElement> impl)
@@ -127,6 +132,11 @@ bool JSSVGPatternElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGPatternElement, Base>(exec, &JSSVGPatternElementTable, this, propertyName, slot);
 }
 
+bool JSSVGPatternElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPatternElement, Base>(exec, &JSSVGPatternElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGPatternElementPatternUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGPatternElement* castedThis = static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()));
@@ -303,7 +313,7 @@ void setJSSVGPatternElementXmlspace(ExecState* exec, JSObject* thisObject, JSVal
 JSValue JSC_HOST_CALL jsSVGPatternElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPatternElement::s_info))
+    if (!thisValue.inherits(&JSSVGPatternElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPatternElement* castedThisObj = static_cast<JSSVGPatternElement*>(asObject(thisValue));
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(castedThisObj->impl());
@@ -317,7 +327,7 @@ JSValue JSC_HOST_CALL jsSVGPatternElementPrototypeFunctionHasExtension(ExecState
 JSValue JSC_HOST_CALL jsSVGPatternElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPatternElement::s_info))
+    if (!thisValue.inherits(&JSSVGPatternElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPatternElement* castedThisObj = static_cast<JSSVGPatternElement*>(asObject(thisValue));
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.h
index db19b4b..8b0770a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGPatternElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPatternElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGPatternElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.cpp
index 8eff1ca..94faf9e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.cpp
@@ -79,6 +79,11 @@ bool JSSVGPointPrototype::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGPointPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGPointPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGPointPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGPoint::s_info = { "SVGPoint", 0, &JSSVGPointTable, 0 };
 
 JSSVGPoint::JSSVGPoint(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<JSSVGPODTypeWrapper<FloatPoint> > impl, SVGElement* context)
@@ -102,6 +107,11 @@ bool JSSVGPoint::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSSVGPoint, Base>(exec, &JSSVGPointTable, this, propertyName, slot);
 }
 
+bool JSSVGPoint::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPoint, Base>(exec, &JSSVGPointTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGPointX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGPoint* castedThis = static_cast<JSSVGPoint*>(asObject(slot.slotBase()));
@@ -140,7 +150,7 @@ void setJSSVGPointY(ExecState* exec, JSObject* thisObject, JSValue value)
 JSValue JSC_HOST_CALL jsSVGPointPrototypeFunctionMatrixTransform(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPoint::s_info))
+    if (!thisValue.inherits(&JSSVGPoint::s_info))
         return throwError(exec, TypeError);
     JSSVGPoint* castedThisObj = static_cast<JSSVGPoint*>(asObject(thisValue));
     JSSVGPODTypeWrapper<FloatPoint>* wrapper = castedThisObj->impl();
@@ -159,7 +169,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, JSSVGPO
 }
 FloatPoint toSVGPoint(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGPoint::s_info) ? (FloatPoint) *static_cast<JSSVGPoint*>(asObject(value))->impl() : FloatPoint();
+    return value.inherits(&JSSVGPoint::s_info) ? (FloatPoint) *static_cast<JSSVGPoint*>(asObject(value))->impl() : FloatPoint();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.h
index 3f1b35c..ab7ba92 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.h
@@ -40,6 +40,7 @@ public:
     virtual ~JSSVGPoint();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -65,9 +66,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGPointPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.cpp
index b01266d..7953759 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.cpp
@@ -83,6 +83,11 @@ bool JSSVGPointListPrototype::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGPointListPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGPointListPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGPointListPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGPointList::s_info = { "SVGPointList", 0, &JSSVGPointListTable, 0 };
 
 JSSVGPointList::JSSVGPointList(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPointList> impl, SVGElement* context)
@@ -106,6 +111,11 @@ bool JSSVGPointList::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSSVGPointList, Base>(exec, &JSSVGPointListTable, this, propertyName, slot);
 }
 
+bool JSSVGPointList::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPointList, Base>(exec, &JSSVGPointListTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGPointListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGPointList* castedThis = static_cast<JSSVGPointList*>(asObject(slot.slotBase()));
@@ -117,7 +127,7 @@ JSValue jsSVGPointListNumberOfItems(ExecState* exec, const Identifier&, const Pr
 JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPointList::s_info))
+    if (!thisValue.inherits(&JSSVGPointList::s_info))
         return throwError(exec, TypeError);
     JSSVGPointList* castedThisObj = static_cast<JSSVGPointList*>(asObject(thisValue));
     return castedThisObj->clear(exec, args);
@@ -126,7 +136,7 @@ JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionClear(ExecState* exec, JSOb
 JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPointList::s_info))
+    if (!thisValue.inherits(&JSSVGPointList::s_info))
         return throwError(exec, TypeError);
     JSSVGPointList* castedThisObj = static_cast<JSSVGPointList*>(asObject(thisValue));
     return castedThisObj->initialize(exec, args);
@@ -135,7 +145,7 @@ JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionInitialize(ExecState* exec,
 JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPointList::s_info))
+    if (!thisValue.inherits(&JSSVGPointList::s_info))
         return throwError(exec, TypeError);
     JSSVGPointList* castedThisObj = static_cast<JSSVGPointList*>(asObject(thisValue));
     return castedThisObj->getItem(exec, args);
@@ -144,7 +154,7 @@ JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionGetItem(ExecState* exec, JS
 JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPointList::s_info))
+    if (!thisValue.inherits(&JSSVGPointList::s_info))
         return throwError(exec, TypeError);
     JSSVGPointList* castedThisObj = static_cast<JSSVGPointList*>(asObject(thisValue));
     return castedThisObj->insertItemBefore(exec, args);
@@ -153,7 +163,7 @@ JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionInsertItemBefore(ExecState*
 JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPointList::s_info))
+    if (!thisValue.inherits(&JSSVGPointList::s_info))
         return throwError(exec, TypeError);
     JSSVGPointList* castedThisObj = static_cast<JSSVGPointList*>(asObject(thisValue));
     return castedThisObj->replaceItem(exec, args);
@@ -162,7 +172,7 @@ JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionReplaceItem(ExecState* exec
 JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPointList::s_info))
+    if (!thisValue.inherits(&JSSVGPointList::s_info))
         return throwError(exec, TypeError);
     JSSVGPointList* castedThisObj = static_cast<JSSVGPointList*>(asObject(thisValue));
     return castedThisObj->removeItem(exec, args);
@@ -171,7 +181,7 @@ JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionRemoveItem(ExecState* exec,
 JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPointList::s_info))
+    if (!thisValue.inherits(&JSSVGPointList::s_info))
         return throwError(exec, TypeError);
     JSSVGPointList* castedThisObj = static_cast<JSSVGPointList*>(asObject(thisValue));
     return castedThisObj->appendItem(exec, args);
@@ -183,7 +193,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGPoin
 }
 SVGPointList* toSVGPointList(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGPointList::s_info) ? static_cast<JSSVGPointList*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGPointList::s_info) ? static_cast<JSSVGPointList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.h
index 3e39aae..88fc2ec 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.h
@@ -40,6 +40,7 @@ public:
     virtual ~JSSVGPointList();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -73,9 +74,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGPointListPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.cpp
index 8e517a1..7ac341d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.cpp
@@ -111,6 +111,11 @@ bool JSSVGPolygonElementPrototype::getOwnPropertySlot(ExecState* exec, const Ide
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGPolygonElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGPolygonElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGPolygonElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGPolygonElement::s_info = { "SVGPolygonElement", &JSSVGElement::s_info, &JSSVGPolygonElementTable, 0 };
 
 JSSVGPolygonElement::JSSVGPolygonElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPolygonElement> impl)
@@ -128,6 +133,11 @@ bool JSSVGPolygonElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGPolygonElement, Base>(exec, &JSSVGPolygonElementTable, this, propertyName, slot);
 }
 
+bool JSSVGPolygonElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPolygonElement, Base>(exec, &JSSVGPolygonElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGPolygonElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGPolygonElement* castedThis = static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()));
@@ -255,7 +265,7 @@ void setJSSVGPolygonElementXmlspace(ExecState* exec, JSObject* thisObject, JSVal
 JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPolygonElement::s_info))
+    if (!thisValue.inherits(&JSSVGPolygonElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolygonElement* castedThisObj = static_cast<JSSVGPolygonElement*>(asObject(thisValue));
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThisObj->impl());
@@ -269,7 +279,7 @@ JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionHasExtension(ExecState
 JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPolygonElement::s_info))
+    if (!thisValue.inherits(&JSSVGPolygonElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolygonElement* castedThisObj = static_cast<JSSVGPolygonElement*>(asObject(thisValue));
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThisObj->impl());
@@ -283,7 +293,7 @@ JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetPresentationAttribu
 JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPolygonElement::s_info))
+    if (!thisValue.inherits(&JSSVGPolygonElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolygonElement* castedThisObj = static_cast<JSSVGPolygonElement*>(asObject(thisValue));
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThisObj->impl());
@@ -296,7 +306,7 @@ JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetBBox(ExecState* exe
 JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPolygonElement::s_info))
+    if (!thisValue.inherits(&JSSVGPolygonElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolygonElement* castedThisObj = static_cast<JSSVGPolygonElement*>(asObject(thisValue));
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThisObj->impl());
@@ -309,7 +319,7 @@ JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetCTM(ExecState* exec
 JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPolygonElement::s_info))
+    if (!thisValue.inherits(&JSSVGPolygonElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolygonElement* castedThisObj = static_cast<JSSVGPolygonElement*>(asObject(thisValue));
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThisObj->impl());
@@ -322,7 +332,7 @@ JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetScreenCTM(ExecState
 JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPolygonElement::s_info))
+    if (!thisValue.inherits(&JSSVGPolygonElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolygonElement* castedThisObj = static_cast<JSSVGPolygonElement*>(asObject(thisValue));
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.h
index f07549c..259cd80 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGPolygonElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPolygonElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGPolygonElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.cpp
index 6bd7b70..aaf9257 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.cpp
@@ -111,6 +111,11 @@ bool JSSVGPolylineElementPrototype::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGPolylineElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGPolylineElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGPolylineElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGPolylineElement::s_info = { "SVGPolylineElement", &JSSVGElement::s_info, &JSSVGPolylineElementTable, 0 };
 
 JSSVGPolylineElement::JSSVGPolylineElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPolylineElement> impl)
@@ -128,6 +133,11 @@ bool JSSVGPolylineElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGPolylineElement, Base>(exec, &JSSVGPolylineElementTable, this, propertyName, slot);
 }
 
+bool JSSVGPolylineElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPolylineElement, Base>(exec, &JSSVGPolylineElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGPolylineElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGPolylineElement* castedThis = static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()));
@@ -255,7 +265,7 @@ void setJSSVGPolylineElementXmlspace(ExecState* exec, JSObject* thisObject, JSVa
 JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPolylineElement::s_info))
+    if (!thisValue.inherits(&JSSVGPolylineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolylineElement* castedThisObj = static_cast<JSSVGPolylineElement*>(asObject(thisValue));
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThisObj->impl());
@@ -269,7 +279,7 @@ JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionHasExtension(ExecStat
 JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPolylineElement::s_info))
+    if (!thisValue.inherits(&JSSVGPolylineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolylineElement* castedThisObj = static_cast<JSSVGPolylineElement*>(asObject(thisValue));
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThisObj->impl());
@@ -283,7 +293,7 @@ JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetPresentationAttrib
 JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPolylineElement::s_info))
+    if (!thisValue.inherits(&JSSVGPolylineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolylineElement* castedThisObj = static_cast<JSSVGPolylineElement*>(asObject(thisValue));
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThisObj->impl());
@@ -296,7 +306,7 @@ JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetBBox(ExecState* ex
 JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPolylineElement::s_info))
+    if (!thisValue.inherits(&JSSVGPolylineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolylineElement* castedThisObj = static_cast<JSSVGPolylineElement*>(asObject(thisValue));
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThisObj->impl());
@@ -309,7 +319,7 @@ JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetCTM(ExecState* exe
 JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPolylineElement::s_info))
+    if (!thisValue.inherits(&JSSVGPolylineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolylineElement* castedThisObj = static_cast<JSSVGPolylineElement*>(asObject(thisValue));
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThisObj->impl());
@@ -322,7 +332,7 @@ JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetScreenCTM(ExecStat
 JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGPolylineElement::s_info))
+    if (!thisValue.inherits(&JSSVGPolylineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolylineElement* castedThisObj = static_cast<JSSVGPolylineElement*>(asObject(thisValue));
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.h
index 8260e0d..fde0862 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGPolylineElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGPolylineElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGPolylineElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.cpp
index dd40aff..1ae7ea1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.cpp
@@ -87,6 +87,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSSVGPreserveAspectRatioPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -103,6 +104,11 @@ bool JSSVGPreserveAspectRatioConstructor::getOwnPropertySlot(ExecState* exec, co
     return getStaticValueSlot<JSSVGPreserveAspectRatioConstructor, DOMObject>(exec, &JSSVGPreserveAspectRatioConstructorTable, this, propertyName, slot);
 }
 
+bool JSSVGPreserveAspectRatioConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPreserveAspectRatioConstructor, DOMObject>(exec, &JSSVGPreserveAspectRatioConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGPreserveAspectRatioPrototypeTableValues[15] =
@@ -143,6 +149,11 @@ bool JSSVGPreserveAspectRatioPrototype::getOwnPropertySlot(ExecState* exec, cons
     return getStaticValueSlot<JSSVGPreserveAspectRatioPrototype, JSObject>(exec, &JSSVGPreserveAspectRatioPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGPreserveAspectRatioPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPreserveAspectRatioPrototype, JSObject>(exec, &JSSVGPreserveAspectRatioPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGPreserveAspectRatio::s_info = { "SVGPreserveAspectRatio", 0, &JSSVGPreserveAspectRatioTable, 0 };
 
 JSSVGPreserveAspectRatio::JSSVGPreserveAspectRatio(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGPreserveAspectRatio> impl, SVGElement* context)
@@ -166,6 +177,11 @@ bool JSSVGPreserveAspectRatio::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticValueSlot<JSSVGPreserveAspectRatio, Base>(exec, &JSSVGPreserveAspectRatioTable, this, propertyName, slot);
 }
 
+bool JSSVGPreserveAspectRatio::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGPreserveAspectRatio, Base>(exec, &JSSVGPreserveAspectRatioTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGPreserveAspectRatioAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGPreserveAspectRatio* castedThis = static_cast<JSSVGPreserveAspectRatio*>(asObject(slot.slotBase()));
@@ -291,7 +307,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGPres
 }
 SVGPreserveAspectRatio* toSVGPreserveAspectRatio(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGPreserveAspectRatio::s_info) ? static_cast<JSSVGPreserveAspectRatio*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGPreserveAspectRatio::s_info) ? static_cast<JSSVGPreserveAspectRatio*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.h
index 7835542..ffc8914 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.h
@@ -40,6 +40,7 @@ public:
     virtual ~JSSVGPreserveAspectRatio();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -66,9 +67,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGPreserveAspectRatioPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.cpp
index b6e6e63..ce7f97d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.cpp
@@ -91,6 +91,11 @@ bool JSSVGRadialGradientElement::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSSVGRadialGradientElement, Base>(exec, &JSSVGRadialGradientElementTable, this, propertyName, slot);
 }
 
+bool JSSVGRadialGradientElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGRadialGradientElement, Base>(exec, &JSSVGRadialGradientElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGRadialGradientElementCx(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGRadialGradientElement* castedThis = static_cast<JSSVGRadialGradientElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.h
index 575f511..4fc45d7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGRadialGradientElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGRadialGradientElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRect.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGRect.cpp
index 6dc78d7..fc762eb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRect.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRect.cpp
@@ -96,6 +96,11 @@ bool JSSVGRect::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return getStaticValueSlot<JSSVGRect, Base>(exec, &JSSVGRectTable, this, propertyName, slot);
 }
 
+bool JSSVGRect::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGRect, Base>(exec, &JSSVGRectTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGRectX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGRect* castedThis = static_cast<JSSVGRect*>(asObject(slot.slotBase()));
@@ -167,7 +172,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, JSSVGPO
 }
 FloatRect toSVGRect(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGRect::s_info) ? (FloatRect) *static_cast<JSSVGRect*>(asObject(value))->impl() : FloatRect();
+    return value.inherits(&JSSVGRect::s_info) ? (FloatRect) *static_cast<JSSVGRect*>(asObject(value))->impl() : FloatRect();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRect.h b/src/3rdparty/webkit/WebCore/generated/JSSVGRect.h
index 4a077d6..4e7e46b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRect.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRect.h
@@ -40,6 +40,7 @@ public:
     virtual ~JSSVGRect();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.cpp
index 9f1f76d..3c511c1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.cpp
@@ -114,6 +114,11 @@ bool JSSVGRectElementPrototype::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGRectElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGRectElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGRectElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGRectElement::s_info = { "SVGRectElement", &JSSVGElement::s_info, &JSSVGRectElementTable, 0 };
 
 JSSVGRectElement::JSSVGRectElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGRectElement> impl)
@@ -131,6 +136,11 @@ bool JSSVGRectElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGRectElement, Base>(exec, &JSSVGRectElementTable, this, propertyName, slot);
 }
 
+bool JSSVGRectElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGRectElement, Base>(exec, &JSSVGRectElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGRectElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGRectElement* castedThis = static_cast<JSSVGRectElement*>(asObject(slot.slotBase()));
@@ -296,7 +306,7 @@ void setJSSVGRectElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue
 JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGRectElement::s_info))
+    if (!thisValue.inherits(&JSSVGRectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGRectElement* castedThisObj = static_cast<JSSVGRectElement*>(asObject(thisValue));
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThisObj->impl());
@@ -310,7 +320,7 @@ JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionHasExtension(ExecState* e
 JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGRectElement::s_info))
+    if (!thisValue.inherits(&JSSVGRectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGRectElement* castedThisObj = static_cast<JSSVGRectElement*>(asObject(thisValue));
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThisObj->impl());
@@ -324,7 +334,7 @@ JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetPresentationAttribute(
 JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGRectElement::s_info))
+    if (!thisValue.inherits(&JSSVGRectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGRectElement* castedThisObj = static_cast<JSSVGRectElement*>(asObject(thisValue));
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThisObj->impl());
@@ -337,7 +347,7 @@ JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetBBox(ExecState* exec,
 JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGRectElement::s_info))
+    if (!thisValue.inherits(&JSSVGRectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGRectElement* castedThisObj = static_cast<JSSVGRectElement*>(asObject(thisValue));
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThisObj->impl());
@@ -350,7 +360,7 @@ JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetCTM(ExecState* exec, J
 JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGRectElement::s_info))
+    if (!thisValue.inherits(&JSSVGRectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGRectElement* castedThisObj = static_cast<JSSVGRectElement*>(asObject(thisValue));
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThisObj->impl());
@@ -363,7 +373,7 @@ JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetScreenCTM(ExecState* e
 JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGRectElement::s_info))
+    if (!thisValue.inherits(&JSSVGRectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGRectElement* castedThisObj = static_cast<JSSVGRectElement*>(asObject(thisValue));
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.h
index d20104b..04b07bc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGRectElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGRectElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGRectElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.cpp
index 9934b0b..730a7a0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.cpp
@@ -76,6 +76,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSSVGRenderingIntentPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -92,6 +93,11 @@ bool JSSVGRenderingIntentConstructor::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSSVGRenderingIntentConstructor, DOMObject>(exec, &JSSVGRenderingIntentConstructorTable, this, propertyName, slot);
 }
 
+bool JSSVGRenderingIntentConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGRenderingIntentConstructor, DOMObject>(exec, &JSSVGRenderingIntentConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGRenderingIntentPrototypeTableValues[7] =
@@ -124,6 +130,11 @@ bool JSSVGRenderingIntentPrototype::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSSVGRenderingIntentPrototype, JSObject>(exec, &JSSVGRenderingIntentPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGRenderingIntentPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGRenderingIntentPrototype, JSObject>(exec, &JSSVGRenderingIntentPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGRenderingIntent::s_info = { "SVGRenderingIntent", 0, &JSSVGRenderingIntentTable, 0 };
 
 JSSVGRenderingIntent::JSSVGRenderingIntent(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGRenderingIntent> impl, SVGElement* context)
@@ -147,6 +158,11 @@ bool JSSVGRenderingIntent::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGRenderingIntent, Base>(exec, &JSSVGRenderingIntentTable, this, propertyName, slot);
 }
 
+bool JSSVGRenderingIntent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGRenderingIntent, Base>(exec, &JSSVGRenderingIntentTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGRenderingIntentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     UNUSED_PARAM(slot);
@@ -195,7 +211,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGRend
 }
 SVGRenderingIntent* toSVGRenderingIntent(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGRenderingIntent::s_info) ? static_cast<JSSVGRenderingIntent*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGRenderingIntent::s_info) ? static_cast<JSSVGRenderingIntent*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.h b/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.h
index 8dad637..bd3e68c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.h
@@ -40,6 +40,7 @@ public:
     virtual ~JSSVGRenderingIntent();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -65,9 +66,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGRenderingIntentPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.cpp
index 5fec42f..5301c4e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.cpp
@@ -163,6 +163,11 @@ bool JSSVGSVGElementPrototype::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticPropertySlot<JSSVGSVGElementPrototype, JSObject>(exec, &JSSVGSVGElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGSVGElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSSVGSVGElementPrototype, JSObject>(exec, &JSSVGSVGElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGSVGElement::s_info = { "SVGSVGElement", &JSSVGElement::s_info, &JSSVGSVGElementTable, 0 };
 
 JSSVGSVGElement::JSSVGSVGElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGSVGElement> impl)
@@ -180,6 +185,11 @@ bool JSSVGSVGElement::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSSVGSVGElement, Base>(exec, &JSSVGSVGElementTable, this, propertyName, slot);
 }
 
+bool JSSVGSVGElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGSVGElement, Base>(exec, &JSSVGSVGElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGSVGElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGSVGElement* castedThis = static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()));
@@ -454,7 +464,7 @@ void setJSSVGSVGElementZoomAndPan(ExecState* exec, JSObject* thisObject, JSValue
 JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionSuspendRedraw(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
+    if (!thisValue.inherits(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -468,22 +478,20 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionSuspendRedraw(ExecState* e
 JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionUnsuspendRedraw(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
+    if (!thisValue.inherits(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
     unsigned suspendHandleId = args.at(0).toInt32(exec);
 
-    imp->unsuspendRedraw(suspendHandleId, ec);
-    setDOMException(exec, ec);
+    imp->unsuspendRedraw(suspendHandleId);
     return jsUndefined();
 }
 
 JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionUnsuspendRedrawAll(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
+    if (!thisValue.inherits(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -495,7 +503,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionUnsuspendRedrawAll(ExecSta
 JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionForceRedraw(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
+    if (!thisValue.inherits(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -507,7 +515,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionForceRedraw(ExecState* exe
 JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionPauseAnimations(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
+    if (!thisValue.inherits(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -519,7 +527,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionPauseAnimations(ExecState*
 JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionUnpauseAnimations(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
+    if (!thisValue.inherits(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -531,7 +539,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionUnpauseAnimations(ExecStat
 JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionAnimationsPaused(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
+    if (!thisValue.inherits(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -544,7 +552,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionAnimationsPaused(ExecState
 JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetCurrentTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
+    if (!thisValue.inherits(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -557,7 +565,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetCurrentTime(ExecState*
 JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionSetCurrentTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
+    if (!thisValue.inherits(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -570,7 +578,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionSetCurrentTime(ExecState*
 JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetIntersectionList(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
+    if (!thisValue.inherits(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -585,7 +593,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetIntersectionList(ExecSt
 JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetEnclosureList(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
+    if (!thisValue.inherits(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -600,7 +608,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetEnclosureList(ExecState
 JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCheckIntersection(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
+    if (!thisValue.inherits(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -615,7 +623,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCheckIntersection(ExecStat
 JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCheckEnclosure(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
+    if (!thisValue.inherits(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -630,7 +638,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCheckEnclosure(ExecState*
 JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionDeselectAll(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
+    if (!thisValue.inherits(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -642,7 +650,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionDeselectAll(ExecState* exe
 JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGNumber(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
+    if (!thisValue.inherits(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -655,7 +663,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGNumber(ExecState*
 JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGLength(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
+    if (!thisValue.inherits(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -668,7 +676,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGLength(ExecState*
 JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGAngle(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
+    if (!thisValue.inherits(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -681,7 +689,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGAngle(ExecState*
 JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGPoint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
+    if (!thisValue.inherits(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -694,7 +702,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGPoint(ExecState*
 JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGMatrix(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
+    if (!thisValue.inherits(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -707,7 +715,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGMatrix(ExecState*
 JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGRect(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
+    if (!thisValue.inherits(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -720,7 +728,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGRect(ExecState* e
 JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGTransform(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
+    if (!thisValue.inherits(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -733,7 +741,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGTransform(ExecSta
 JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGTransformFromMatrix(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
+    if (!thisValue.inherits(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -747,7 +755,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGTransformFromMatr
 JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
+    if (!thisValue.inherits(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -761,7 +769,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionHasExtension(ExecState* ex
 JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
+    if (!thisValue.inherits(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -775,7 +783,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetPresentationAttribute(E
 JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
+    if (!thisValue.inherits(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -788,7 +796,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetBBox(ExecState* exec, J
 JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
+    if (!thisValue.inherits(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -801,7 +809,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetCTM(ExecState* exec, JS
 JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
+    if (!thisValue.inherits(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -814,7 +822,7 @@ JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetScreenCTM(ExecState* ex
 JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
+    if (!thisValue.inherits(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.h
index 2883b06..d8409cd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGSVGElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGSVGElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGSVGElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.cpp
index 69a4169..f279368 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.cpp
@@ -92,6 +92,11 @@ bool JSSVGScriptElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGScriptElement, Base>(exec, &JSSVGScriptElementTable, this, propertyName, slot);
 }
 
+bool JSSVGScriptElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGScriptElement, Base>(exec, &JSSVGScriptElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGScriptElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGScriptElement* castedThis = static_cast<JSSVGScriptElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.h
index b0c5143..b02e886 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGScriptElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGScriptElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.cpp
index ed15447..2b5112e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.cpp
@@ -85,6 +85,11 @@ bool JSSVGStopElementPrototype::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGStopElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGStopElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGStopElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGStopElement::s_info = { "SVGStopElement", &JSSVGElement::s_info, &JSSVGStopElementTable, 0 };
 
 JSSVGStopElement::JSSVGStopElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGStopElement> impl)
@@ -102,6 +107,11 @@ bool JSSVGStopElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGStopElement, Base>(exec, &JSSVGStopElementTable, this, propertyName, slot);
 }
 
+bool JSSVGStopElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGStopElement, Base>(exec, &JSSVGStopElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGStopElementOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGStopElement* castedThis = static_cast<JSSVGStopElement*>(asObject(slot.slotBase()));
@@ -131,7 +141,7 @@ JSValue jsSVGStopElementStyle(ExecState* exec, const Identifier&, const Property
 JSValue JSC_HOST_CALL jsSVGStopElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGStopElement::s_info))
+    if (!thisValue.inherits(&JSSVGStopElement::s_info))
         return throwError(exec, TypeError);
     JSSVGStopElement* castedThisObj = static_cast<JSSVGStopElement*>(asObject(thisValue));
     SVGStopElement* imp = static_cast<SVGStopElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.h
index b2bd243..ae9bee9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGStopElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGStopElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -54,9 +55,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGStopElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.cpp
index 3ccbeaf..cddb511 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.cpp
@@ -85,6 +85,11 @@ bool JSSVGStringListPrototype::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGStringListPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGStringListPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGStringListPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGStringList::s_info = { "SVGStringList", 0, &JSSVGStringListTable, 0 };
 
 JSSVGStringList::JSSVGStringList(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGStringList> impl, SVGElement* context)
@@ -108,6 +113,11 @@ bool JSSVGStringList::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSSVGStringList, Base>(exec, &JSSVGStringListTable, this, propertyName, slot);
 }
 
+bool JSSVGStringList::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGStringList, Base>(exec, &JSSVGStringListTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGStringListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGStringList* castedThis = static_cast<JSSVGStringList*>(asObject(slot.slotBase()));
@@ -119,7 +129,7 @@ JSValue jsSVGStringListNumberOfItems(ExecState* exec, const Identifier&, const P
 JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGStringList::s_info))
+    if (!thisValue.inherits(&JSSVGStringList::s_info))
         return throwError(exec, TypeError);
     JSSVGStringList* castedThisObj = static_cast<JSSVGStringList*>(asObject(thisValue));
     SVGStringList* imp = static_cast<SVGStringList*>(castedThisObj->impl());
@@ -133,7 +143,7 @@ JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionClear(ExecState* exec, JSO
 JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGStringList::s_info))
+    if (!thisValue.inherits(&JSSVGStringList::s_info))
         return throwError(exec, TypeError);
     JSSVGStringList* castedThisObj = static_cast<JSSVGStringList*>(asObject(thisValue));
     SVGStringList* imp = static_cast<SVGStringList*>(castedThisObj->impl());
@@ -149,7 +159,7 @@ JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionInitialize(ExecState* exec
 JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGStringList::s_info))
+    if (!thisValue.inherits(&JSSVGStringList::s_info))
         return throwError(exec, TypeError);
     JSSVGStringList* castedThisObj = static_cast<JSSVGStringList*>(asObject(thisValue));
     SVGStringList* imp = static_cast<SVGStringList*>(castedThisObj->impl());
@@ -165,7 +175,7 @@ JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionGetItem(ExecState* exec, J
 JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGStringList::s_info))
+    if (!thisValue.inherits(&JSSVGStringList::s_info))
         return throwError(exec, TypeError);
     JSSVGStringList* castedThisObj = static_cast<JSSVGStringList*>(asObject(thisValue));
     SVGStringList* imp = static_cast<SVGStringList*>(castedThisObj->impl());
@@ -182,7 +192,7 @@ JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionInsertItemBefore(ExecState
 JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGStringList::s_info))
+    if (!thisValue.inherits(&JSSVGStringList::s_info))
         return throwError(exec, TypeError);
     JSSVGStringList* castedThisObj = static_cast<JSSVGStringList*>(asObject(thisValue));
     SVGStringList* imp = static_cast<SVGStringList*>(castedThisObj->impl());
@@ -199,7 +209,7 @@ JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionReplaceItem(ExecState* exe
 JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGStringList::s_info))
+    if (!thisValue.inherits(&JSSVGStringList::s_info))
         return throwError(exec, TypeError);
     JSSVGStringList* castedThisObj = static_cast<JSSVGStringList*>(asObject(thisValue));
     SVGStringList* imp = static_cast<SVGStringList*>(castedThisObj->impl());
@@ -215,7 +225,7 @@ JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionRemoveItem(ExecState* exec
 JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGStringList::s_info))
+    if (!thisValue.inherits(&JSSVGStringList::s_info))
         return throwError(exec, TypeError);
     JSSVGStringList* castedThisObj = static_cast<JSSVGStringList*>(asObject(thisValue));
     SVGStringList* imp = static_cast<SVGStringList*>(castedThisObj->impl());
@@ -234,7 +244,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGStri
 }
 SVGStringList* toSVGStringList(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGStringList::s_info) ? static_cast<JSSVGStringList*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGStringList::s_info) ? static_cast<JSSVGStringList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.h
index c880b8c..c048ddb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.h
@@ -40,6 +40,7 @@ public:
     virtual ~JSSVGStringList();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -64,9 +65,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGStringListPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.cpp
index 2e0c093..988a3dc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.cpp
@@ -37,12 +37,13 @@ ASSERT_CLASS_FITS_IN_CELL(JSSVGStyleElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGStyleElementTableValues[5] =
+static const HashTableValue JSSVGStyleElementTableValues[6] =
 {
-    { "xmlspace", DontDelete, (intptr_t)jsSVGStyleElementXmlspace, (intptr_t)setJSSVGStyleElementXmlspace },
     { "type", DontDelete, (intptr_t)jsSVGStyleElementType, (intptr_t)setJSSVGStyleElementType },
     { "media", DontDelete, (intptr_t)jsSVGStyleElementMedia, (intptr_t)setJSSVGStyleElementMedia },
     { "title", DontDelete, (intptr_t)jsSVGStyleElementTitle, (intptr_t)setJSSVGStyleElementTitle },
+    { "xmllang", DontDelete, (intptr_t)jsSVGStyleElementXmllang, (intptr_t)setJSSVGStyleElementXmllang },
+    { "xmlspace", DontDelete, (intptr_t)jsSVGStyleElementXmlspace, (intptr_t)setJSSVGStyleElementXmlspace },
     { 0, 0, 0, 0 }
 };
 
@@ -50,7 +51,7 @@ static JSC_CONST_HASHTABLE HashTable JSSVGStyleElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 31, JSSVGStyleElementTableValues, 0 };
 #else
-    { 9, 7, JSSVGStyleElementTableValues, 0 };
+    { 17, 15, JSSVGStyleElementTableValues, 0 };
 #endif
 
 /* Hash table for prototype */
@@ -91,12 +92,9 @@ bool JSSVGStyleElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSSVGStyleElement, Base>(exec, &JSSVGStyleElementTable, this, propertyName, slot);
 }
 
-JSValue jsSVGStyleElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+bool JSSVGStyleElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
-    JSSVGStyleElement* castedThis = static_cast<JSSVGStyleElement*>(asObject(slot.slotBase()));
-    UNUSED_PARAM(exec);
-    SVGStyleElement* imp = static_cast<SVGStyleElement*>(castedThis->impl());
-    return jsString(exec, imp->xmlspace());
+    return getStaticValueDescriptor<JSSVGStyleElement, Base>(exec, &JSSVGStyleElementTable, this, propertyName, descriptor);
 }
 
 JSValue jsSVGStyleElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -123,17 +121,25 @@ JSValue jsSVGStyleElementTitle(ExecState* exec, const Identifier&, const Propert
     return jsString(exec, imp->title());
 }
 
-void JSSVGStyleElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+JSValue jsSVGStyleElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
-    lookupPut<JSSVGStyleElement, Base>(exec, propertyName, value, &JSSVGStyleElementTable, this, slot);
+    JSSVGStyleElement* castedThis = static_cast<JSSVGStyleElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    SVGStyleElement* imp = static_cast<SVGStyleElement*>(castedThis->impl());
+    return jsString(exec, imp->xmllang());
 }
 
-void setJSSVGStyleElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
+JSValue jsSVGStyleElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
-    SVGStyleElement* imp = static_cast<SVGStyleElement*>(static_cast<JSSVGStyleElement*>(thisObject)->impl());
-    ExceptionCode ec = 0;
-    imp->setXmlspace(value.toString(exec), ec);
-    setDOMException(exec, ec);
+    JSSVGStyleElement* castedThis = static_cast<JSSVGStyleElement*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    SVGStyleElement* imp = static_cast<SVGStyleElement*>(castedThis->impl());
+    return jsString(exec, imp->xmlspace());
+}
+
+void JSSVGStyleElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    lookupPut<JSSVGStyleElement, Base>(exec, propertyName, value, &JSSVGStyleElementTable, this, slot);
 }
 
 void setJSSVGStyleElementType(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -160,6 +166,18 @@ void setJSSVGStyleElementTitle(ExecState* exec, JSObject* thisObject, JSValue va
     setDOMException(exec, ec);
 }
 
+void setJSSVGStyleElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    SVGStyleElement* imp = static_cast<SVGStyleElement*>(static_cast<JSSVGStyleElement*>(thisObject)->impl());
+    imp->setXmllang(value.toString(exec));
+}
+
+void setJSSVGStyleElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    SVGStyleElement* imp = static_cast<SVGStyleElement*>(static_cast<JSSVGStyleElement*>(thisObject)->impl());
+    imp->setXmlspace(value.toString(exec));
+}
+
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.h
index adf3ee2..a011095 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGStyleElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGStyleElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -59,14 +60,16 @@ public:
 
 // Attributes
 
-JSC::JSValue jsSVGStyleElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGStyleElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsSVGStyleElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSSVGStyleElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsSVGStyleElementMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSSVGStyleElementMedia(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsSVGStyleElementTitle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSSVGStyleElementTitle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGStyleElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGStyleElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGStyleElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGStyleElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.cpp
index b8c180f..4710e2c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.cpp
@@ -107,6 +107,11 @@ bool JSSVGSwitchElementPrototype::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGSwitchElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGSwitchElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGSwitchElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGSwitchElement::s_info = { "SVGSwitchElement", &JSSVGElement::s_info, &JSSVGSwitchElementTable, 0 };
 
 JSSVGSwitchElement::JSSVGSwitchElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGSwitchElement> impl)
@@ -124,6 +129,11 @@ bool JSSVGSwitchElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGSwitchElement, Base>(exec, &JSSVGSwitchElementTable, this, propertyName, slot);
 }
 
+bool JSSVGSwitchElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGSwitchElement, Base>(exec, &JSSVGSwitchElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGSwitchElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGSwitchElement* castedThis = static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()));
@@ -235,7 +245,7 @@ void setJSSVGSwitchElementXmlspace(ExecState* exec, JSObject* thisObject, JSValu
 JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSwitchElement::s_info))
+    if (!thisValue.inherits(&JSSVGSwitchElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSwitchElement* castedThisObj = static_cast<JSSVGSwitchElement*>(asObject(thisValue));
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThisObj->impl());
@@ -249,7 +259,7 @@ JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionHasExtension(ExecState*
 JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSwitchElement::s_info))
+    if (!thisValue.inherits(&JSSVGSwitchElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSwitchElement* castedThisObj = static_cast<JSSVGSwitchElement*>(asObject(thisValue));
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThisObj->impl());
@@ -263,7 +273,7 @@ JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetPresentationAttribut
 JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSwitchElement::s_info))
+    if (!thisValue.inherits(&JSSVGSwitchElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSwitchElement* castedThisObj = static_cast<JSSVGSwitchElement*>(asObject(thisValue));
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThisObj->impl());
@@ -276,7 +286,7 @@ JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetBBox(ExecState* exec
 JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSwitchElement::s_info))
+    if (!thisValue.inherits(&JSSVGSwitchElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSwitchElement* castedThisObj = static_cast<JSSVGSwitchElement*>(asObject(thisValue));
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThisObj->impl());
@@ -289,7 +299,7 @@ JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetCTM(ExecState* exec,
 JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSwitchElement::s_info))
+    if (!thisValue.inherits(&JSSVGSwitchElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSwitchElement* castedThisObj = static_cast<JSSVGSwitchElement*>(asObject(thisValue));
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThisObj->impl());
@@ -302,7 +312,7 @@ JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetScreenCTM(ExecState*
 JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSwitchElement::s_info))
+    if (!thisValue.inherits(&JSSVGSwitchElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSwitchElement* castedThisObj = static_cast<JSSVGSwitchElement*>(asObject(thisValue));
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.h
index 7273622..a50ae04 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGSwitchElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGSwitchElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGSwitchElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.cpp
index c5d16b0..23d564c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.cpp
@@ -93,6 +93,11 @@ bool JSSVGSymbolElementPrototype::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGSymbolElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGSymbolElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGSymbolElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGSymbolElement::s_info = { "SVGSymbolElement", &JSSVGElement::s_info, &JSSVGSymbolElementTable, 0 };
 
 JSSVGSymbolElement::JSSVGSymbolElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGSymbolElement> impl)
@@ -110,6 +115,11 @@ bool JSSVGSymbolElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGSymbolElement, Base>(exec, &JSSVGSymbolElementTable, this, propertyName, slot);
 }
 
+bool JSSVGSymbolElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGSymbolElement, Base>(exec, &JSSVGSymbolElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGSymbolElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGSymbolElement* castedThis = static_cast<JSSVGSymbolElement*>(asObject(slot.slotBase()));
@@ -190,7 +200,7 @@ void setJSSVGSymbolElementXmlspace(ExecState* exec, JSObject* thisObject, JSValu
 JSValue JSC_HOST_CALL jsSVGSymbolElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGSymbolElement::s_info))
+    if (!thisValue.inherits(&JSSVGSymbolElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSymbolElement* castedThisObj = static_cast<JSSVGSymbolElement*>(asObject(thisValue));
     SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.h
index 11aaced..38bda49 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGSymbolElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGSymbolElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGSymbolElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.cpp
index 8577776..399a01c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.cpp
@@ -87,6 +87,11 @@ bool JSSVGTRefElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGTRefElement, Base>(exec, &JSSVGTRefElementTable, this, propertyName, slot);
 }
 
+bool JSSVGTRefElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGTRefElement, Base>(exec, &JSSVGTRefElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGTRefElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGTRefElement* castedThis = static_cast<JSSVGTRefElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.h
index eabb96d..9aeb83b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGTRefElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGTRefElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.cpp
index ff8c8aa..773569d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.cpp
@@ -102,6 +102,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSSVGTextContentElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -118,6 +119,11 @@ bool JSSVGTextContentElementConstructor::getOwnPropertySlot(ExecState* exec, con
     return getStaticValueSlot<JSSVGTextContentElementConstructor, DOMObject>(exec, &JSSVGTextContentElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSSVGTextContentElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGTextContentElementConstructor, DOMObject>(exec, &JSSVGTextContentElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGTextContentElementPrototypeTableValues[15] =
@@ -158,6 +164,11 @@ bool JSSVGTextContentElementPrototype::getOwnPropertySlot(ExecState* exec, const
     return getStaticPropertySlot<JSSVGTextContentElementPrototype, JSObject>(exec, &JSSVGTextContentElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGTextContentElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSSVGTextContentElementPrototype, JSObject>(exec, &JSSVGTextContentElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGTextContentElement::s_info = { "SVGTextContentElement", &JSSVGElement::s_info, &JSSVGTextContentElementTable, 0 };
 
 JSSVGTextContentElement::JSSVGTextContentElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGTextContentElement> impl)
@@ -175,6 +186,11 @@ bool JSSVGTextContentElement::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSSVGTextContentElement, Base>(exec, &JSSVGTextContentElementTable, this, propertyName, slot);
 }
 
+bool JSSVGTextContentElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGTextContentElement, Base>(exec, &JSSVGTextContentElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGTextContentElementTextLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGTextContentElement* castedThis = static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()));
@@ -289,7 +305,7 @@ JSValue JSSVGTextContentElement::getConstructor(ExecState* exec, JSGlobalObject*
 JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetNumberOfChars(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
+    if (!thisValue.inherits(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
@@ -302,7 +318,7 @@ JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetNumberOfChars(E
 JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetComputedTextLength(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
+    if (!thisValue.inherits(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
@@ -315,7 +331,7 @@ JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetComputedTextLen
 JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetSubStringLength(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
+    if (!thisValue.inherits(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
@@ -340,7 +356,7 @@ JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetSubStringLength
 JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetStartPositionOfChar(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
+    if (!thisValue.inherits(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
@@ -360,7 +376,7 @@ JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetStartPositionOf
 JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetEndPositionOfChar(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
+    if (!thisValue.inherits(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
@@ -380,7 +396,7 @@ JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetEndPositionOfCh
 JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetExtentOfChar(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
+    if (!thisValue.inherits(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
@@ -400,7 +416,7 @@ JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetExtentOfChar(Ex
 JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetRotationOfChar(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
+    if (!thisValue.inherits(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
@@ -420,7 +436,7 @@ JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetRotationOfChar(
 JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetCharNumAtPosition(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
+    if (!thisValue.inherits(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
@@ -434,7 +450,7 @@ JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetCharNumAtPositi
 JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionSelectSubString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
+    if (!thisValue.inherits(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
@@ -458,7 +474,7 @@ JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionSelectSubString(Ex
 JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
+    if (!thisValue.inherits(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
@@ -472,7 +488,7 @@ JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionHasExtension(ExecS
 JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
+    if (!thisValue.inherits(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.h
index 0c90d83..1e01a93 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGTextContentElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGTextContentElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -56,9 +57,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGTextContentElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.cpp
index 4f1dda6..4bed869 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.cpp
@@ -86,6 +86,11 @@ bool JSSVGTextElementPrototype::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGTextElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGTextElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGTextElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGTextElement::s_info = { "SVGTextElement", &JSSVGTextPositioningElement::s_info, &JSSVGTextElementTable, 0 };
 
 JSSVGTextElement::JSSVGTextElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGTextElement> impl)
@@ -103,6 +108,11 @@ bool JSSVGTextElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGTextElement, Base>(exec, &JSSVGTextElementTable, this, propertyName, slot);
 }
 
+bool JSSVGTextElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGTextElement, Base>(exec, &JSSVGTextElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGTextElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGTextElement* castedThis = static_cast<JSSVGTextElement*>(asObject(slot.slotBase()));
@@ -131,7 +141,7 @@ JSValue jsSVGTextElementFarthestViewportElement(ExecState* exec, const Identifie
 JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTextElement::s_info))
+    if (!thisValue.inherits(&JSSVGTextElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextElement* castedThisObj = static_cast<JSSVGTextElement*>(asObject(thisValue));
     SVGTextElement* imp = static_cast<SVGTextElement*>(castedThisObj->impl());
@@ -144,7 +154,7 @@ JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetBBox(ExecState* exec,
 JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTextElement::s_info))
+    if (!thisValue.inherits(&JSSVGTextElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextElement* castedThisObj = static_cast<JSSVGTextElement*>(asObject(thisValue));
     SVGTextElement* imp = static_cast<SVGTextElement*>(castedThisObj->impl());
@@ -157,7 +167,7 @@ JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetCTM(ExecState* exec, J
 JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTextElement::s_info))
+    if (!thisValue.inherits(&JSSVGTextElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextElement* castedThisObj = static_cast<JSSVGTextElement*>(asObject(thisValue));
     SVGTextElement* imp = static_cast<SVGTextElement*>(castedThisObj->impl());
@@ -170,7 +180,7 @@ JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetScreenCTM(ExecState* e
 JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTextElement::s_info))
+    if (!thisValue.inherits(&JSSVGTextElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextElement* castedThisObj = static_cast<JSSVGTextElement*>(asObject(thisValue));
     SVGTextElement* imp = static_cast<SVGTextElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.h
index 357640a..1ccad7d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGTextElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGTextElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -54,9 +55,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGTextElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.cpp
index ebc5ad8..c8f85e4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.cpp
@@ -83,6 +83,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSSVGTextPathElementPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -99,6 +100,11 @@ bool JSSVGTextPathElementConstructor::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSSVGTextPathElementConstructor, DOMObject>(exec, &JSSVGTextPathElementConstructorTable, this, propertyName, slot);
 }
 
+bool JSSVGTextPathElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGTextPathElementConstructor, DOMObject>(exec, &JSSVGTextPathElementConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGTextPathElementPrototypeTableValues[7] =
@@ -131,6 +137,11 @@ bool JSSVGTextPathElementPrototype::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSSVGTextPathElementPrototype, JSObject>(exec, &JSSVGTextPathElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGTextPathElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGTextPathElementPrototype, JSObject>(exec, &JSSVGTextPathElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGTextPathElement::s_info = { "SVGTextPathElement", &JSSVGTextContentElement::s_info, &JSSVGTextPathElementTable, 0 };
 
 JSSVGTextPathElement::JSSVGTextPathElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGTextPathElement> impl)
@@ -148,6 +159,11 @@ bool JSSVGTextPathElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGTextPathElement, Base>(exec, &JSSVGTextPathElementTable, this, propertyName, slot);
 }
 
+bool JSSVGTextPathElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGTextPathElement, Base>(exec, &JSSVGTextPathElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGTextPathElementStartOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGTextPathElement* castedThis = static_cast<JSSVGTextPathElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.h
index 382f8f0..58e6ed9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGTextPathElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGTextPathElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGTextPathElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.cpp
index 88260e7..8de9bed 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.cpp
@@ -92,6 +92,11 @@ bool JSSVGTextPositioningElement::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticValueSlot<JSSVGTextPositioningElement, Base>(exec, &JSSVGTextPositioningElementTable, this, propertyName, slot);
 }
 
+bool JSSVGTextPositioningElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGTextPositioningElement, Base>(exec, &JSSVGTextPositioningElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGTextPositioningElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGTextPositioningElement* castedThis = static_cast<JSSVGTextPositioningElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.h
index b34c095..066902c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGTextPositioningElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGTextPositioningElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.cpp
index 438ed3f..29272e4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.cpp
@@ -87,6 +87,11 @@ bool JSSVGTitleElementPrototype::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGTitleElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGTitleElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGTitleElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGTitleElement::s_info = { "SVGTitleElement", &JSSVGElement::s_info, &JSSVGTitleElementTable, 0 };
 
 JSSVGTitleElement::JSSVGTitleElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGTitleElement> impl)
@@ -104,6 +109,11 @@ bool JSSVGTitleElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSSVGTitleElement, Base>(exec, &JSSVGTitleElementTable, this, propertyName, slot);
 }
 
+bool JSSVGTitleElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGTitleElement, Base>(exec, &JSSVGTitleElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGTitleElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGTitleElement* castedThis = static_cast<JSSVGTitleElement*>(asObject(slot.slotBase()));
@@ -157,7 +167,7 @@ void setJSSVGTitleElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue
 JSValue JSC_HOST_CALL jsSVGTitleElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTitleElement::s_info))
+    if (!thisValue.inherits(&JSSVGTitleElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTitleElement* castedThisObj = static_cast<JSSVGTitleElement*>(asObject(thisValue));
     SVGTitleElement* imp = static_cast<SVGTitleElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.h
index 91a49fd..0c15920 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGTitleElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGTitleElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGTitleElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.cpp
index d50dfc5..5478323 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.cpp
@@ -83,6 +83,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSSVGTransformPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -99,6 +100,11 @@ bool JSSVGTransformConstructor::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSSVGTransformConstructor, DOMObject>(exec, &JSSVGTransformConstructorTable, this, propertyName, slot);
 }
 
+bool JSSVGTransformConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGTransformConstructor, DOMObject>(exec, &JSSVGTransformConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGTransformPrototypeTableValues[14] =
@@ -138,6 +144,11 @@ bool JSSVGTransformPrototype::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticPropertySlot<JSSVGTransformPrototype, JSObject>(exec, &JSSVGTransformPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGTransformPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSSVGTransformPrototype, JSObject>(exec, &JSSVGTransformPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGTransform::s_info = { "SVGTransform", 0, &JSSVGTransformTable, 0 };
 
 JSSVGTransform::JSSVGTransform(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<JSSVGPODTypeWrapper<SVGTransform> > impl, SVGElement* context)
@@ -161,6 +172,11 @@ bool JSSVGTransform::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSSVGTransform, Base>(exec, &JSSVGTransformTable, this, propertyName, slot);
 }
 
+bool JSSVGTransform::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGTransform, Base>(exec, &JSSVGTransformTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGTransformType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGTransform* castedThis = static_cast<JSSVGTransform*>(asObject(slot.slotBase()));
@@ -198,7 +214,7 @@ JSValue JSSVGTransform::getConstructor(ExecState* exec, JSGlobalObject* globalOb
 JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetMatrix(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTransform::s_info))
+    if (!thisValue.inherits(&JSSVGTransform::s_info))
         return throwError(exec, TypeError);
     JSSVGTransform* castedThisObj = static_cast<JSSVGTransform*>(asObject(thisValue));
     JSSVGPODTypeWrapper<SVGTransform>* wrapper = castedThisObj->impl();
@@ -213,7 +229,7 @@ JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetMatrix(ExecState* exec,
 JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetTranslate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTransform::s_info))
+    if (!thisValue.inherits(&JSSVGTransform::s_info))
         return throwError(exec, TypeError);
     JSSVGTransform* castedThisObj = static_cast<JSSVGTransform*>(asObject(thisValue));
     JSSVGPODTypeWrapper<SVGTransform>* wrapper = castedThisObj->impl();
@@ -229,7 +245,7 @@ JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetTranslate(ExecState* exe
 JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetScale(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTransform::s_info))
+    if (!thisValue.inherits(&JSSVGTransform::s_info))
         return throwError(exec, TypeError);
     JSSVGTransform* castedThisObj = static_cast<JSSVGTransform*>(asObject(thisValue));
     JSSVGPODTypeWrapper<SVGTransform>* wrapper = castedThisObj->impl();
@@ -245,7 +261,7 @@ JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetScale(ExecState* exec, J
 JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetRotate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTransform::s_info))
+    if (!thisValue.inherits(&JSSVGTransform::s_info))
         return throwError(exec, TypeError);
     JSSVGTransform* castedThisObj = static_cast<JSSVGTransform*>(asObject(thisValue));
     JSSVGPODTypeWrapper<SVGTransform>* wrapper = castedThisObj->impl();
@@ -262,7 +278,7 @@ JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetRotate(ExecState* exec,
 JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetSkewX(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTransform::s_info))
+    if (!thisValue.inherits(&JSSVGTransform::s_info))
         return throwError(exec, TypeError);
     JSSVGTransform* castedThisObj = static_cast<JSSVGTransform*>(asObject(thisValue));
     JSSVGPODTypeWrapper<SVGTransform>* wrapper = castedThisObj->impl();
@@ -277,7 +293,7 @@ JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetSkewX(ExecState* exec, J
 JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetSkewY(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTransform::s_info))
+    if (!thisValue.inherits(&JSSVGTransform::s_info))
         return throwError(exec, TypeError);
     JSSVGTransform* castedThisObj = static_cast<JSSVGTransform*>(asObject(thisValue));
     JSSVGPODTypeWrapper<SVGTransform>* wrapper = castedThisObj->impl();
@@ -332,7 +348,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, JSSVGPO
 }
 SVGTransform toSVGTransform(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGTransform::s_info) ? (SVGTransform) *static_cast<JSSVGTransform*>(asObject(value))->impl() : SVGTransform();
+    return value.inherits(&JSSVGTransform::s_info) ? (SVGTransform) *static_cast<JSSVGTransform*>(asObject(value))->impl() : SVGTransform();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.h
index 90b8ef9..92e59e4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.h
@@ -40,6 +40,7 @@ public:
     virtual ~JSSVGTransform();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -65,9 +66,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGTransformPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.cpp
index 676271d..61a430c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.cpp
@@ -88,6 +88,11 @@ bool JSSVGTransformListPrototype::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGTransformListPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGTransformListPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGTransformListPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGTransformList::s_info = { "SVGTransformList", 0, &JSSVGTransformListTable, 0 };
 
 JSSVGTransformList::JSSVGTransformList(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGTransformList> impl, SVGElement* context)
@@ -111,6 +116,11 @@ bool JSSVGTransformList::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGTransformList, Base>(exec, &JSSVGTransformListTable, this, propertyName, slot);
 }
 
+bool JSSVGTransformList::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGTransformList, Base>(exec, &JSSVGTransformListTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGTransformListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGTransformList* castedThis = static_cast<JSSVGTransformList*>(asObject(slot.slotBase()));
@@ -122,7 +132,7 @@ JSValue jsSVGTransformListNumberOfItems(ExecState* exec, const Identifier&, cons
 JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTransformList::s_info))
+    if (!thisValue.inherits(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
     return castedThisObj->clear(exec, args);
@@ -131,7 +141,7 @@ JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionClear(ExecState* exec,
 JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTransformList::s_info))
+    if (!thisValue.inherits(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
     return castedThisObj->initialize(exec, args);
@@ -140,7 +150,7 @@ JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionInitialize(ExecState* e
 JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTransformList::s_info))
+    if (!thisValue.inherits(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
     return castedThisObj->getItem(exec, args);
@@ -149,7 +159,7 @@ JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionGetItem(ExecState* exec
 JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTransformList::s_info))
+    if (!thisValue.inherits(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
     return castedThisObj->insertItemBefore(exec, args);
@@ -158,7 +168,7 @@ JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionInsertItemBefore(ExecSt
 JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTransformList::s_info))
+    if (!thisValue.inherits(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
     return castedThisObj->replaceItem(exec, args);
@@ -167,7 +177,7 @@ JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionReplaceItem(ExecState*
 JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTransformList::s_info))
+    if (!thisValue.inherits(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
     return castedThisObj->removeItem(exec, args);
@@ -176,7 +186,7 @@ JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionRemoveItem(ExecState* e
 JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTransformList::s_info))
+    if (!thisValue.inherits(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
     return castedThisObj->appendItem(exec, args);
@@ -185,7 +195,7 @@ JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionAppendItem(ExecState* e
 JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionCreateSVGTransformFromMatrix(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTransformList::s_info))
+    if (!thisValue.inherits(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
     SVGTransformList* imp = static_cast<SVGTransformList*>(castedThisObj->impl());
@@ -199,7 +209,7 @@ JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionCreateSVGTransformFromM
 JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionConsolidate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGTransformList::s_info))
+    if (!thisValue.inherits(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
     SVGTransformList* imp = static_cast<SVGTransformList*>(castedThisObj->impl());
@@ -215,7 +225,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGTran
 }
 SVGTransformList* toSVGTransformList(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGTransformList::s_info) ? static_cast<JSSVGTransformList*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGTransformList::s_info) ? static_cast<JSSVGTransformList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.h
index 463d0e4..5b16ad0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.h
@@ -40,6 +40,7 @@ public:
     virtual ~JSSVGTransformList();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -73,9 +74,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGTransformListPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.cpp
index 4eebca7..eefc9a8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.cpp
@@ -73,6 +73,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSSVGUnitTypesPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -89,6 +90,11 @@ bool JSSVGUnitTypesConstructor::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSSVGUnitTypesConstructor, DOMObject>(exec, &JSSVGUnitTypesConstructorTable, this, propertyName, slot);
 }
 
+bool JSSVGUnitTypesConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGUnitTypesConstructor, DOMObject>(exec, &JSSVGUnitTypesConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGUnitTypesPrototypeTableValues[4] =
@@ -118,6 +124,11 @@ bool JSSVGUnitTypesPrototype::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSSVGUnitTypesPrototype, JSObject>(exec, &JSSVGUnitTypesPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGUnitTypesPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGUnitTypesPrototype, JSObject>(exec, &JSSVGUnitTypesPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGUnitTypes::s_info = { "SVGUnitTypes", 0, &JSSVGUnitTypesTable, 0 };
 
 JSSVGUnitTypes::JSSVGUnitTypes(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGUnitTypes> impl, SVGElement* context)
@@ -141,6 +152,11 @@ bool JSSVGUnitTypes::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSSVGUnitTypes, Base>(exec, &JSSVGUnitTypesTable, this, propertyName, slot);
 }
 
+bool JSSVGUnitTypes::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGUnitTypes, Base>(exec, &JSSVGUnitTypesTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGUnitTypesConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     UNUSED_PARAM(slot);
@@ -174,7 +190,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SVGUnit
 }
 SVGUnitTypes* toSVGUnitTypes(JSC::JSValue value)
 {
-    return value.isObject(&JSSVGUnitTypes::s_info) ? static_cast<JSSVGUnitTypes*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSSVGUnitTypes::s_info) ? static_cast<JSSVGUnitTypes*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.h b/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.h
index 8ec3a94..85cc276 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.h
@@ -40,6 +40,7 @@ public:
     virtual ~JSSVGUnitTypes();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -65,9 +66,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGUnitTypesPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.cpp
index 43c337e..696745e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.cpp
@@ -117,6 +117,11 @@ bool JSSVGUseElementPrototype::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticFunctionSlot<JSObject>(exec, &JSSVGUseElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGUseElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSSVGUseElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGUseElement::s_info = { "SVGUseElement", &JSSVGElement::s_info, &JSSVGUseElementTable, 0 };
 
 JSSVGUseElement::JSSVGUseElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGUseElement> impl)
@@ -134,6 +139,11 @@ bool JSSVGUseElement::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSSVGUseElement, Base>(exec, &JSSVGUseElementTable, this, propertyName, slot);
 }
 
+bool JSSVGUseElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGUseElement, Base>(exec, &JSSVGUseElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGUseElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGUseElement* castedThis = static_cast<JSSVGUseElement*>(asObject(slot.slotBase()));
@@ -306,7 +316,7 @@ void setJSSVGUseElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue v
 JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGUseElement::s_info))
+    if (!thisValue.inherits(&JSSVGUseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGUseElement* castedThisObj = static_cast<JSSVGUseElement*>(asObject(thisValue));
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThisObj->impl());
@@ -320,7 +330,7 @@ JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionHasExtension(ExecState* ex
 JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGUseElement::s_info))
+    if (!thisValue.inherits(&JSSVGUseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGUseElement* castedThisObj = static_cast<JSSVGUseElement*>(asObject(thisValue));
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThisObj->impl());
@@ -334,7 +344,7 @@ JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetPresentationAttribute(E
 JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGUseElement::s_info))
+    if (!thisValue.inherits(&JSSVGUseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGUseElement* castedThisObj = static_cast<JSSVGUseElement*>(asObject(thisValue));
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThisObj->impl());
@@ -347,7 +357,7 @@ JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetBBox(ExecState* exec, J
 JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGUseElement::s_info))
+    if (!thisValue.inherits(&JSSVGUseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGUseElement* castedThisObj = static_cast<JSSVGUseElement*>(asObject(thisValue));
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThisObj->impl());
@@ -360,7 +370,7 @@ JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetCTM(ExecState* exec, JS
 JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGUseElement::s_info))
+    if (!thisValue.inherits(&JSSVGUseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGUseElement* castedThisObj = static_cast<JSSVGUseElement*>(asObject(thisValue));
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThisObj->impl());
@@ -373,7 +383,7 @@ JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetScreenCTM(ExecState* ex
 JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSSVGUseElement::s_info))
+    if (!thisValue.inherits(&JSSVGUseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGUseElement* castedThisObj = static_cast<JSSVGUseElement*>(asObject(thisValue));
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.h
index 889f7fd..bbc1be5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGUseElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGUseElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGUseElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.cpp
index 0f54e33..f0e82b7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.cpp
@@ -87,6 +87,11 @@ bool JSSVGViewElementPrototype::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSSVGViewElementPrototype, JSObject>(exec, &JSSVGViewElementPrototypeTable, this, propertyName, slot);
 }
 
+bool JSSVGViewElementPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGViewElementPrototype, JSObject>(exec, &JSSVGViewElementPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSSVGViewElement::s_info = { "SVGViewElement", &JSSVGElement::s_info, &JSSVGViewElementTable, 0 };
 
 JSSVGViewElement::JSSVGViewElement(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SVGViewElement> impl)
@@ -104,6 +109,11 @@ bool JSSVGViewElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGViewElement, Base>(exec, &JSSVGViewElementTable, this, propertyName, slot);
 }
 
+bool JSSVGViewElement::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGViewElement, Base>(exec, &JSSVGViewElementTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGViewElementViewTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGViewElement* castedThis = static_cast<JSSVGViewElement*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.h
index 40f2ad9..2f481bf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.h
@@ -36,6 +36,7 @@ public:
     JSSVGViewElement(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGViewElement>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -55,9 +56,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSSVGViewElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.cpp
index 6ff7a9e..73bcf78 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.cpp
@@ -93,6 +93,11 @@ bool JSSVGZoomEvent::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSSVGZoomEvent, Base>(exec, &JSSVGZoomEventTable, this, propertyName, slot);
 }
 
+bool JSSVGZoomEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSVGZoomEvent, Base>(exec, &JSSVGZoomEventTable, this, propertyName, descriptor);
+}
+
 JSValue jsSVGZoomEventZoomRectScreen(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSSVGZoomEvent* castedThis = static_cast<JSSVGZoomEvent*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.h b/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.h
index c96afe8..217f296 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.h
@@ -36,6 +36,7 @@ public:
     JSSVGZoomEvent(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SVGZoomEvent>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSScreen.cpp b/src/3rdparty/webkit/WebCore/generated/JSScreen.cpp
index a1fc8b7..daa84c4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSScreen.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSScreen.cpp
@@ -97,6 +97,11 @@ bool JSScreen::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNam
     return getStaticValueSlot<JSScreen, Base>(exec, &JSScreenTable, this, propertyName, slot);
 }
 
+bool JSScreen::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSScreen, Base>(exec, &JSScreenTable, this, propertyName, descriptor);
+}
+
 JSValue jsScreenHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSScreen* castedThis = static_cast<JSScreen*>(asObject(slot.slotBase()));
@@ -167,7 +172,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Screen*
 }
 Screen* toScreen(JSC::JSValue value)
 {
-    return value.isObject(&JSScreen::s_info) ? static_cast<JSScreen*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSScreen::s_info) ? static_cast<JSScreen*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSScreen.h b/src/3rdparty/webkit/WebCore/generated/JSScreen.h
index d55e9c5..c46a192 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSScreen.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSScreen.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSScreen();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSharedWorker.cpp b/src/3rdparty/webkit/WebCore/generated/JSSharedWorker.cpp
new file mode 100644
index 0000000..3e34846
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSSharedWorker.cpp
@@ -0,0 +1,115 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(SHARED_WORKERS)
+
+#include "JSSharedWorker.h"
+
+#include "JSMessagePort.h"
+#include "MessagePort.h"
+#include "SharedWorker.h"
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSSharedWorker);
+
+/* Hash table */
+
+static const HashTableValue JSSharedWorkerTableValues[2] =
+{
+    { "port", DontDelete|ReadOnly, (intptr_t)jsSharedWorkerPort, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSharedWorkerTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSharedWorkerTableValues, 0 };
+#else
+    { 2, 1, JSSharedWorkerTableValues, 0 };
+#endif
+
+/* Hash table for prototype */
+
+static const HashTableValue JSSharedWorkerPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSharedWorkerPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSharedWorkerPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSSharedWorkerPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSSharedWorkerPrototype::s_info = { "SharedWorkerPrototype", 0, &JSSharedWorkerPrototypeTable, 0 };
+
+JSObject* JSSharedWorkerPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSSharedWorker>(exec, globalObject);
+}
+
+const ClassInfo JSSharedWorker::s_info = { "SharedWorker", &JSAbstractWorker::s_info, &JSSharedWorkerTable, 0 };
+
+JSSharedWorker::JSSharedWorker(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<SharedWorker> impl)
+    : JSAbstractWorker(structure, globalObject, impl)
+{
+}
+
+JSObject* JSSharedWorker::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSSharedWorkerPrototype(JSSharedWorkerPrototype::createStructure(JSAbstractWorkerPrototype::self(exec, globalObject)));
+}
+
+bool JSSharedWorker::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSharedWorker, Base>(exec, &JSSharedWorkerTable, this, propertyName, slot);
+}
+
+bool JSSharedWorker::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSharedWorker, Base>(exec, &JSSharedWorkerTable, this, propertyName, descriptor);
+}
+
+JSValue jsSharedWorkerPort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSSharedWorker* castedThis = static_cast<JSSharedWorker*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    SharedWorker* imp = static_cast<SharedWorker*>(castedThis->impl());
+    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->port()));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, SharedWorker* object)
+{
+    return getDOMObjectWrapper<JSSharedWorker>(exec, globalObject, object);
+}
+SharedWorker* toSharedWorker(JSC::JSValue value)
+{
+    return value.inherits(&JSSharedWorker::s_info) ? static_cast<JSSharedWorker*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(SHARED_WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSharedWorker.h b/src/3rdparty/webkit/WebCore/generated/JSSharedWorker.h
new file mode 100644
index 0000000..f2ec40b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSSharedWorker.h
@@ -0,0 +1,80 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSSharedWorker_h
+#define JSSharedWorker_h
+
+#if ENABLE(SHARED_WORKERS)
+
+#include "JSAbstractWorker.h"
+#include "SharedWorker.h"
+
+namespace WebCore {
+
+class SharedWorker;
+
+class JSSharedWorker : public JSAbstractWorker {
+    typedef JSAbstractWorker Base;
+public:
+    JSSharedWorker(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<SharedWorker>);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    virtual void markChildren(JSC::MarkStack&);
+
+    SharedWorker* impl() const
+    {
+        return static_cast<SharedWorker*>(Base::impl());
+    }
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, SharedWorker*);
+SharedWorker* toSharedWorker(JSC::JSValue);
+
+class JSSharedWorkerPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+    JSSharedWorkerPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Attributes
+
+JSC::JSValue jsSharedWorkerPort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif // ENABLE(SHARED_WORKERS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSharedWorkerContext.cpp b/src/3rdparty/webkit/WebCore/generated/JSSharedWorkerContext.cpp
new file mode 100644
index 0000000..5f2f364
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSSharedWorkerContext.cpp
@@ -0,0 +1,142 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(SHARED_WORKERS)
+
+#include "JSSharedWorkerContext.h"
+
+#include "EventListener.h"
+#include "JSEventListener.h"
+#include "KURL.h"
+#include "SharedWorkerContext.h"
+#include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSSharedWorkerContext);
+
+/* Hash table */
+
+static const HashTableValue JSSharedWorkerContextTableValues[3] =
+{
+    { "name", DontDelete|ReadOnly, (intptr_t)jsSharedWorkerContextName, (intptr_t)0 },
+    { "onconnect", DontDelete, (intptr_t)jsSharedWorkerContextOnconnect, (intptr_t)setJSSharedWorkerContextOnconnect },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSharedWorkerContextTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 1, JSSharedWorkerContextTableValues, 0 };
+#else
+    { 4, 3, JSSharedWorkerContextTableValues, 0 };
+#endif
+
+/* Hash table for prototype */
+
+static const HashTableValue JSSharedWorkerContextPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSSharedWorkerContextPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSharedWorkerContextPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSSharedWorkerContextPrototypeTableValues, 0 };
+#endif
+
+static const HashTable* getJSSharedWorkerContextPrototypeTable(ExecState* exec)
+{
+    return getHashTableForGlobalData(exec->globalData(), &JSSharedWorkerContextPrototypeTable);
+}
+const ClassInfo JSSharedWorkerContextPrototype::s_info = { "SharedWorkerContextPrototype", 0, 0, getJSSharedWorkerContextPrototypeTable };
+
+void* JSSharedWorkerContextPrototype::operator new(size_t size, JSGlobalData* globalData)
+{
+    return globalData->heap.allocate(size);
+}
+
+static const HashTable* getJSSharedWorkerContextTable(ExecState* exec)
+{
+    return getHashTableForGlobalData(exec->globalData(), &JSSharedWorkerContextTable);
+}
+const ClassInfo JSSharedWorkerContext::s_info = { "SharedWorkerContext", &JSWorkerContext::s_info, 0, getJSSharedWorkerContextTable };
+
+JSSharedWorkerContext::JSSharedWorkerContext(PassRefPtr<Structure> structure, PassRefPtr<SharedWorkerContext> impl)
+    : JSWorkerContext(structure, impl)
+{
+}
+
+bool JSSharedWorkerContext::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSharedWorkerContext, Base>(exec, getJSSharedWorkerContextTable(exec), this, propertyName, slot);
+}
+
+bool JSSharedWorkerContext::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSSharedWorkerContext, Base>(exec, getJSSharedWorkerContextTable(exec), this, propertyName, descriptor);
+}
+
+JSValue jsSharedWorkerContextName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSSharedWorkerContext* castedThis = static_cast<JSSharedWorkerContext*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    SharedWorkerContext* imp = static_cast<SharedWorkerContext*>(castedThis->impl());
+    return jsString(exec, imp->name());
+}
+
+JSValue jsSharedWorkerContextOnconnect(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSSharedWorkerContext* castedThis = static_cast<JSSharedWorkerContext*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    SharedWorkerContext* imp = static_cast<SharedWorkerContext*>(castedThis->impl());
+    if (EventListener* listener = imp->onconnect()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+void JSSharedWorkerContext::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    lookupPut<JSSharedWorkerContext, Base>(exec, propertyName, value, getJSSharedWorkerContextTable(exec), this, slot);
+}
+
+void setJSSharedWorkerContextOnconnect(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    SharedWorkerContext* imp = static_cast<SharedWorkerContext*>(static_cast<JSSharedWorkerContext*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSSharedWorkerContext*>(thisObject);
+    imp->setOnconnect(globalObject->createJSAttributeEventListener(value));
+}
+
+SharedWorkerContext* toSharedWorkerContext(JSC::JSValue value)
+{
+    return value.inherits(&JSSharedWorkerContext::s_info) ? static_cast<JSSharedWorkerContext*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(SHARED_WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSharedWorkerContext.h b/src/3rdparty/webkit/WebCore/generated/JSSharedWorkerContext.h
new file mode 100644
index 0000000..96ad865
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSSharedWorkerContext.h
@@ -0,0 +1,81 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSSharedWorkerContext_h
+#define JSSharedWorkerContext_h
+
+#if ENABLE(SHARED_WORKERS)
+
+#include "JSWorkerContext.h"
+#include "SharedWorkerContext.h"
+
+namespace WebCore {
+
+class SharedWorkerContext;
+
+class JSSharedWorkerContext : public JSWorkerContext {
+    typedef JSWorkerContext Base;
+public:
+    JSSharedWorkerContext(PassRefPtr<JSC::Structure>, PassRefPtr<SharedWorkerContext>);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    virtual void markChildren(JSC::MarkStack&);
+
+    SharedWorkerContext* impl() const
+    {
+        return static_cast<SharedWorkerContext*>(Base::impl());
+    }
+};
+
+SharedWorkerContext* toSharedWorkerContext(JSC::JSValue);
+
+class JSSharedWorkerContextPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    void* operator new(size_t, JSC::JSGlobalData*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+    JSSharedWorkerContextPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Attributes
+
+JSC::JSValue jsSharedWorkerContextName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSharedWorkerContextOnconnect(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSharedWorkerContextOnconnect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+
+} // namespace WebCore
+
+#endif // ENABLE(SHARED_WORKERS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStorage.cpp b/src/3rdparty/webkit/WebCore/generated/JSStorage.cpp
index 41680a9..ed5b9f8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStorage.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSStorage.cpp
@@ -30,7 +30,6 @@
 #include "Storage.h"
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
-#include <runtime/JSString.h>
 #include <wtf/GetPtr.h>
 
 using namespace JSC;
@@ -77,6 +76,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSStoragePrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -93,6 +93,11 @@ bool JSStorageConstructor::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSStorageConstructor, DOMObject>(exec, &JSStorageConstructorTable, this, propertyName, slot);
 }
 
+bool JSStorageConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSStorageConstructor, DOMObject>(exec, &JSStorageConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSStoragePrototypeTableValues[6] =
@@ -124,6 +129,11 @@ bool JSStoragePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticFunctionSlot<JSObject>(exec, &JSStoragePrototypeTable, this, propertyName, slot);
 }
 
+bool JSStoragePrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSStoragePrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSStorage::s_info = { "Storage", 0, &JSStorageTable, 0 };
 
 JSStorage::JSStorage(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<Storage> impl)
@@ -156,6 +166,24 @@ bool JSStorage::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return getStaticValueSlot<JSStorage, Base>(exec, &JSStorageTable, this, propertyName, slot);
 }
 
+bool JSStorage::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    const HashEntry* entry = JSStorageTable.entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        slot.setCustom(this, entry->propertyGetter());
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+    if (canGetItemsForName(exec, static_cast<Storage*>(impl()), propertyName)) {
+        PropertySlot slot;
+        slot.setCustom(this, nameGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    return getStaticValueDescriptor<JSStorage, Base>(exec, &JSStorageTable, this, propertyName, descriptor);
+}
+
 JSValue jsStorageLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSStorage* castedThis = static_cast<JSStorage*>(asObject(slot.slotBase()));
@@ -184,23 +212,21 @@ JSValue JSStorage::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
 JSValue JSC_HOST_CALL jsStoragePrototypeFunctionKey(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSStorage::s_info))
+    if (!thisValue.inherits(&JSStorage::s_info))
         return throwError(exec, TypeError);
     JSStorage* castedThisObj = static_cast<JSStorage*>(asObject(thisValue));
     Storage* imp = static_cast<Storage*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
     unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValue result = jsString(exec, imp->key(index, ec));
-    setDOMException(exec, ec);
+    JSC::JSValue result = jsStringOrNull(exec, imp->key(index));
     return result;
 }
 
 JSValue JSC_HOST_CALL jsStoragePrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSStorage::s_info))
+    if (!thisValue.inherits(&JSStorage::s_info))
         return throwError(exec, TypeError);
     JSStorage* castedThisObj = static_cast<JSStorage*>(asObject(thisValue));
     Storage* imp = static_cast<Storage*>(castedThisObj->impl());
@@ -214,7 +240,7 @@ JSValue JSC_HOST_CALL jsStoragePrototypeFunctionGetItem(ExecState* exec, JSObjec
 JSValue JSC_HOST_CALL jsStoragePrototypeFunctionSetItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSStorage::s_info))
+    if (!thisValue.inherits(&JSStorage::s_info))
         return throwError(exec, TypeError);
     JSStorage* castedThisObj = static_cast<JSStorage*>(asObject(thisValue));
     Storage* imp = static_cast<Storage*>(castedThisObj->impl());
@@ -230,7 +256,7 @@ JSValue JSC_HOST_CALL jsStoragePrototypeFunctionSetItem(ExecState* exec, JSObjec
 JSValue JSC_HOST_CALL jsStoragePrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSStorage::s_info))
+    if (!thisValue.inherits(&JSStorage::s_info))
         return throwError(exec, TypeError);
     JSStorage* castedThisObj = static_cast<JSStorage*>(asObject(thisValue));
     Storage* imp = static_cast<Storage*>(castedThisObj->impl());
@@ -243,7 +269,7 @@ JSValue JSC_HOST_CALL jsStoragePrototypeFunctionRemoveItem(ExecState* exec, JSOb
 JSValue JSC_HOST_CALL jsStoragePrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSStorage::s_info))
+    if (!thisValue.inherits(&JSStorage::s_info))
         return throwError(exec, TypeError);
     JSStorage* castedThisObj = static_cast<JSStorage*>(asObject(thisValue));
     Storage* imp = static_cast<Storage*>(castedThisObj->impl());
@@ -258,7 +284,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Storage
 }
 Storage* toStorage(JSC::JSValue value)
 {
-    return value.isObject(&JSStorage::s_info) ? static_cast<JSStorage*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSStorage::s_info) ? static_cast<JSStorage*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStorage.h b/src/3rdparty/webkit/WebCore/generated/JSStorage.h
index 42e32d6..56626f7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStorage.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSStorage.h
@@ -39,6 +39,7 @@ public:
     virtual ~JSStorage();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
@@ -49,8 +50,8 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&, bool checkDontDelete = true);
-    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype);
+    virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     Storage* impl() const { return m_impl.get(); }
 
@@ -71,9 +72,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSStoragePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.cpp
index d2730d7..ba9c160 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.cpp
@@ -83,6 +83,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSStorageEventPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -99,6 +100,11 @@ bool JSStorageEventConstructor::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSStorageEventConstructor, DOMObject>(exec, &JSStorageEventConstructorTable, this, propertyName, slot);
 }
 
+bool JSStorageEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSStorageEventConstructor, DOMObject>(exec, &JSStorageEventConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSStorageEventPrototypeTableValues[2] =
@@ -126,6 +132,11 @@ bool JSStorageEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticFunctionSlot<JSObject>(exec, &JSStorageEventPrototypeTable, this, propertyName, slot);
 }
 
+bool JSStorageEventPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSStorageEventPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSStorageEvent::s_info = { "StorageEvent", &JSEvent::s_info, &JSStorageEventTable, 0 };
 
 JSStorageEvent::JSStorageEvent(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<StorageEvent> impl)
@@ -143,6 +154,11 @@ bool JSStorageEvent::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSStorageEvent, Base>(exec, &JSStorageEventTable, this, propertyName, slot);
 }
 
+bool JSStorageEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSStorageEvent, Base>(exec, &JSStorageEventTable, this, propertyName, descriptor);
+}
+
 JSValue jsStorageEventKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSStorageEvent* castedThis = static_cast<JSStorageEvent*>(asObject(slot.slotBase()));
@@ -204,7 +220,7 @@ JSValue JSStorageEvent::getConstructor(ExecState* exec, JSGlobalObject* globalOb
 JSValue JSC_HOST_CALL jsStorageEventPrototypeFunctionInitStorageEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSStorageEvent::s_info))
+    if (!thisValue.inherits(&JSStorageEvent::s_info))
         return throwError(exec, TypeError);
     JSStorageEvent* castedThisObj = static_cast<JSStorageEvent*>(asObject(thisValue));
     StorageEvent* imp = static_cast<StorageEvent*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.h b/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.h
index 1bf6d21..c6a78f5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.h
@@ -35,6 +35,7 @@ public:
     JSStorageEvent(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<StorageEvent>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -54,9 +55,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSStorageEventPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.cpp b/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.cpp
index ab090d1..8b4c79b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.cpp
@@ -80,6 +80,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSStyleSheetPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -96,6 +97,11 @@ bool JSStyleSheetConstructor::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSStyleSheetConstructor, DOMObject>(exec, &JSStyleSheetConstructorTable, this, propertyName, slot);
 }
 
+bool JSStyleSheetConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSStyleSheetConstructor, DOMObject>(exec, &JSStyleSheetConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSStyleSheetPrototypeTableValues[1] =
@@ -140,6 +146,11 @@ bool JSStyleSheet::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<JSStyleSheet, Base>(exec, &JSStyleSheetTable, this, propertyName, slot);
 }
 
+bool JSStyleSheet::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSStyleSheet, Base>(exec, &JSStyleSheetTable, this, propertyName, descriptor);
+}
+
 JSValue jsStyleSheetType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSStyleSheet* castedThis = static_cast<JSStyleSheet*>(asObject(slot.slotBase()));
@@ -219,7 +230,7 @@ JSValue JSStyleSheet::getConstructor(ExecState* exec, JSGlobalObject* globalObje
 
 StyleSheet* toStyleSheet(JSC::JSValue value)
 {
-    return value.isObject(&JSStyleSheet::s_info) ? static_cast<JSStyleSheet*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSStyleSheet::s_info) ? static_cast<JSStyleSheet*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.h b/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.h
index ccd0d0f..1f47f35 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSStyleSheet();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -46,7 +47,7 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void mark();
+    virtual void markChildren(JSC::MarkStack&);
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     StyleSheet* impl() const { return m_impl.get(); }
@@ -64,6 +65,10 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
     JSStyleSheetPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.cpp b/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.cpp
index 909d8e5..0f24ff3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.cpp
@@ -74,6 +74,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSStyleSheetListPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -90,6 +91,11 @@ bool JSStyleSheetListConstructor::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticValueSlot<JSStyleSheetListConstructor, DOMObject>(exec, &JSStyleSheetListConstructorTable, this, propertyName, slot);
 }
 
+bool JSStyleSheetListConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSStyleSheetListConstructor, DOMObject>(exec, &JSStyleSheetListConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSStyleSheetListPrototypeTableValues[2] =
@@ -117,6 +123,11 @@ bool JSStyleSheetListPrototype::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticFunctionSlot<JSObject>(exec, &JSStyleSheetListPrototypeTable, this, propertyName, slot);
 }
 
+bool JSStyleSheetListPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSStyleSheetListPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSStyleSheetList::s_info = { "StyleSheetList", 0, &JSStyleSheetListTable, 0 };
 
 JSStyleSheetList::JSStyleSheetList(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<StyleSheetList> impl)
@@ -155,6 +166,32 @@ bool JSStyleSheetList::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSStyleSheetList, Base>(exec, &JSStyleSheetListTable, this, propertyName, slot);
 }
 
+bool JSStyleSheetList::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    const HashEntry* entry = JSStyleSheetListTable.entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        slot.setCustom(this, entry->propertyGetter());
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<StyleSheetList*>(impl())->length()) {
+        PropertySlot slot;
+        slot.setCustomIndex(this, index, indexGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly);
+        return true;
+    }
+    if (canGetItemsForName(exec, static_cast<StyleSheetList*>(impl()), propertyName)) {
+        PropertySlot slot;
+        slot.setCustom(this, nameGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    return getStaticValueDescriptor<JSStyleSheetList, Base>(exec, &JSStyleSheetListTable, this, propertyName, descriptor);
+}
+
 bool JSStyleSheetList::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
 {
     if (propertyName < static_cast<StyleSheetList*>(impl())->length()) {
@@ -177,11 +214,11 @@ JSValue jsStyleSheetListConstructor(ExecState* exec, const Identifier&, const Pr
     JSStyleSheetList* domObject = static_cast<JSStyleSheetList*>(asObject(slot.slotBase()));
     return JSStyleSheetList::getConstructor(exec, domObject->globalObject());
 }
-void JSStyleSheetList::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSStyleSheetList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     for (unsigned i = 0; i < static_cast<StyleSheetList*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getPropertyNames(exec, propertyNames, listedAttributes);
+     Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 JSValue JSStyleSheetList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -192,7 +229,7 @@ JSValue JSStyleSheetList::getConstructor(ExecState* exec, JSGlobalObject* global
 JSValue JSC_HOST_CALL jsStyleSheetListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSStyleSheetList::s_info))
+    if (!thisValue.inherits(&JSStyleSheetList::s_info))
         return throwError(exec, TypeError);
     JSStyleSheetList* castedThisObj = static_cast<JSStyleSheetList*>(asObject(thisValue));
     StyleSheetList* imp = static_cast<StyleSheetList*>(castedThisObj->impl());
@@ -215,7 +252,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, StyleSh
 }
 StyleSheetList* toStyleSheetList(JSC::JSValue value)
 {
-    return value.isObject(&JSStyleSheetList::s_info) ? static_cast<JSStyleSheetList*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSStyleSheetList::s_info) ? static_cast<JSStyleSheetList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.h b/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.h
index 589ea80..fa1af25 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSStyleSheetList();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -46,7 +47,9 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype);
+    virtual void markChildren(JSC::MarkStack&);
+
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     StyleSheetList* impl() const { return m_impl.get(); }
 
@@ -68,6 +71,7 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSText.cpp b/src/3rdparty/webkit/WebCore/generated/JSText.cpp
index e5ad3b2..d49c359 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSText.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSText.cpp
@@ -73,6 +73,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSTextPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -89,6 +90,11 @@ bool JSTextConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSTextConstructor, DOMObject>(exec, &JSTextConstructorTable, this, propertyName, slot);
 }
 
+bool JSTextConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSTextConstructor, DOMObject>(exec, &JSTextConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSTextPrototypeTableValues[3] =
@@ -117,6 +123,11 @@ bool JSTextPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticFunctionSlot<JSObject>(exec, &JSTextPrototypeTable, this, propertyName, slot);
 }
 
+bool JSTextPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSTextPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSText::s_info = { "Text", &JSCharacterData::s_info, &JSTextTable, 0 };
 
 JSText::JSText(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<Text> impl)
@@ -134,6 +145,11 @@ bool JSText::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName,
     return getStaticValueSlot<JSText, Base>(exec, &JSTextTable, this, propertyName, slot);
 }
 
+bool JSText::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSText, Base>(exec, &JSTextTable, this, propertyName, descriptor);
+}
+
 JSValue jsTextWholeText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSText* castedThis = static_cast<JSText*>(asObject(slot.slotBase()));
@@ -155,7 +171,7 @@ JSValue JSText::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
 JSValue JSC_HOST_CALL jsTextPrototypeFunctionSplitText(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSText::s_info))
+    if (!thisValue.inherits(&JSText::s_info))
         return throwError(exec, TypeError);
     JSText* castedThisObj = static_cast<JSText*>(asObject(thisValue));
     Text* imp = static_cast<Text*>(castedThisObj->impl());
@@ -175,7 +191,7 @@ JSValue JSC_HOST_CALL jsTextPrototypeFunctionSplitText(ExecState* exec, JSObject
 JSValue JSC_HOST_CALL jsTextPrototypeFunctionReplaceWholeText(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSText::s_info))
+    if (!thisValue.inherits(&JSText::s_info))
         return throwError(exec, TypeError);
     JSText* castedThisObj = static_cast<JSText*>(asObject(thisValue));
     Text* imp = static_cast<Text*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSText.h b/src/3rdparty/webkit/WebCore/generated/JSText.h
index eff516f..6571115 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSText.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSText.h
@@ -33,6 +33,7 @@ public:
     JSText(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<Text>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -53,9 +54,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSTextPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTextEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSTextEvent.cpp
index 721e0a3..1caa153 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTextEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSTextEvent.cpp
@@ -72,6 +72,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSTextEventPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -88,6 +89,11 @@ bool JSTextEventConstructor::getOwnPropertySlot(ExecState* exec, const Identifie
     return getStaticValueSlot<JSTextEventConstructor, DOMObject>(exec, &JSTextEventConstructorTable, this, propertyName, slot);
 }
 
+bool JSTextEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSTextEventConstructor, DOMObject>(exec, &JSTextEventConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSTextEventPrototypeTableValues[2] =
@@ -115,6 +121,11 @@ bool JSTextEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticFunctionSlot<JSObject>(exec, &JSTextEventPrototypeTable, this, propertyName, slot);
 }
 
+bool JSTextEventPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSTextEventPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSTextEvent::s_info = { "TextEvent", &JSUIEvent::s_info, &JSTextEventTable, 0 };
 
 JSTextEvent::JSTextEvent(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<TextEvent> impl)
@@ -132,6 +143,11 @@ bool JSTextEvent::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return getStaticValueSlot<JSTextEvent, Base>(exec, &JSTextEventTable, this, propertyName, slot);
 }
 
+bool JSTextEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSTextEvent, Base>(exec, &JSTextEventTable, this, propertyName, descriptor);
+}
+
 JSValue jsTextEventData(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSTextEvent* castedThis = static_cast<JSTextEvent*>(asObject(slot.slotBase()));
@@ -153,7 +169,7 @@ JSValue JSTextEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObjec
 JSValue JSC_HOST_CALL jsTextEventPrototypeFunctionInitTextEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSTextEvent::s_info))
+    if (!thisValue.inherits(&JSTextEvent::s_info))
         return throwError(exec, TypeError);
     JSTextEvent* castedThisObj = static_cast<JSTextEvent*>(asObject(thisValue));
     TextEvent* imp = static_cast<TextEvent*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTextEvent.h b/src/3rdparty/webkit/WebCore/generated/JSTextEvent.h
index 548d0f6..293966c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTextEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSTextEvent.h
@@ -33,6 +33,7 @@ public:
     JSTextEvent(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<TextEvent>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -52,9 +53,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSTextEventPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.cpp b/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.cpp
index 5b05886..9b28792 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.cpp
@@ -69,6 +69,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSTextMetricsPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -85,6 +86,11 @@ bool JSTextMetricsConstructor::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticValueSlot<JSTextMetricsConstructor, DOMObject>(exec, &JSTextMetricsConstructorTable, this, propertyName, slot);
 }
 
+bool JSTextMetricsConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSTextMetricsConstructor, DOMObject>(exec, &JSTextMetricsConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSTextMetricsPrototypeTableValues[1] =
@@ -129,6 +135,11 @@ bool JSTextMetrics::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSTextMetrics, Base>(exec, &JSTextMetricsTable, this, propertyName, slot);
 }
 
+bool JSTextMetrics::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSTextMetrics, Base>(exec, &JSTextMetricsTable, this, propertyName, descriptor);
+}
+
 JSValue jsTextMetricsWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSTextMetrics* castedThis = static_cast<JSTextMetrics*>(asObject(slot.slotBase()));
@@ -153,7 +164,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, TextMet
 }
 TextMetrics* toTextMetrics(JSC::JSValue value)
 {
-    return value.isObject(&JSTextMetrics::s_info) ? static_cast<JSTextMetrics*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSTextMetrics::s_info) ? static_cast<JSTextMetrics*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.h b/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.h
index 0e18cfc..8a17301 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSTextMetrics();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.cpp b/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.cpp
index 95ff627..6dc04d2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.cpp
@@ -19,6 +19,9 @@
 */
 
 #include "config.h"
+
+#if ENABLE(VIDEO)
+
 #include "JSTimeRanges.h"
 
 #include "TimeRanges.h"
@@ -75,6 +78,11 @@ bool JSTimeRangesPrototype::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticFunctionSlot<JSObject>(exec, &JSTimeRangesPrototypeTable, this, propertyName, slot);
 }
 
+bool JSTimeRangesPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSTimeRangesPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSTimeRanges::s_info = { "TimeRanges", 0, &JSTimeRangesTable, 0 };
 
 JSTimeRanges::JSTimeRanges(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<TimeRanges> impl)
@@ -98,6 +106,11 @@ bool JSTimeRanges::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<JSTimeRanges, Base>(exec, &JSTimeRangesTable, this, propertyName, slot);
 }
 
+bool JSTimeRanges::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSTimeRanges, Base>(exec, &JSTimeRangesTable, this, propertyName, descriptor);
+}
+
 JSValue jsTimeRangesLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSTimeRanges* castedThis = static_cast<JSTimeRanges*>(asObject(slot.slotBase()));
@@ -109,7 +122,7 @@ JSValue jsTimeRangesLength(ExecState* exec, const Identifier&, const PropertySlo
 JSValue JSC_HOST_CALL jsTimeRangesPrototypeFunctionStart(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSTimeRanges::s_info))
+    if (!thisValue.inherits(&JSTimeRanges::s_info))
         return throwError(exec, TypeError);
     JSTimeRanges* castedThisObj = static_cast<JSTimeRanges*>(asObject(thisValue));
     TimeRanges* imp = static_cast<TimeRanges*>(castedThisObj->impl());
@@ -125,7 +138,7 @@ JSValue JSC_HOST_CALL jsTimeRangesPrototypeFunctionStart(ExecState* exec, JSObje
 JSValue JSC_HOST_CALL jsTimeRangesPrototypeFunctionEnd(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSTimeRanges::s_info))
+    if (!thisValue.inherits(&JSTimeRanges::s_info))
         return throwError(exec, TypeError);
     JSTimeRanges* castedThisObj = static_cast<JSTimeRanges*>(asObject(thisValue));
     TimeRanges* imp = static_cast<TimeRanges*>(castedThisObj->impl());
@@ -144,7 +157,9 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, TimeRan
 }
 TimeRanges* toTimeRanges(JSC::JSValue value)
 {
-    return value.isObject(&JSTimeRanges::s_info) ? static_cast<JSTimeRanges*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSTimeRanges::s_info) ? static_cast<JSTimeRanges*>(asObject(value))->impl() : 0;
 }
 
 }
+
+#endif // ENABLE(VIDEO)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.h b/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.h
index b59d905..480a2bd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.h
@@ -21,6 +21,8 @@
 #ifndef JSTimeRanges_h
 #define JSTimeRanges_h
 
+#if ENABLE(VIDEO)
+
 #include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
@@ -37,6 +39,7 @@ public:
     virtual ~JSTimeRanges();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -61,9 +64,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSTimeRangesPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
@@ -78,4 +82,6 @@ JSC::JSValue jsTimeRangesLength(JSC::ExecState*, const JSC::Identifier&, const J
 
 } // namespace WebCore
 
+#endif // ENABLE(VIDEO)
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.cpp b/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.cpp
index 88ec3ed..290be89 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.cpp
@@ -78,6 +78,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSTreeWalkerPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -94,6 +95,11 @@ bool JSTreeWalkerConstructor::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSTreeWalkerConstructor, DOMObject>(exec, &JSTreeWalkerConstructorTable, this, propertyName, slot);
 }
 
+bool JSTreeWalkerConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSTreeWalkerConstructor, DOMObject>(exec, &JSTreeWalkerConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSTreeWalkerPrototypeTableValues[8] =
@@ -127,6 +133,11 @@ bool JSTreeWalkerPrototype::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticFunctionSlot<JSObject>(exec, &JSTreeWalkerPrototypeTable, this, propertyName, slot);
 }
 
+bool JSTreeWalkerPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSTreeWalkerPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSTreeWalker::s_info = { "TreeWalker", 0, &JSTreeWalkerTable, 0 };
 
 JSTreeWalker::JSTreeWalker(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<TreeWalker> impl)
@@ -150,6 +161,11 @@ bool JSTreeWalker::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<JSTreeWalker, Base>(exec, &JSTreeWalkerTable, this, propertyName, slot);
 }
 
+bool JSTreeWalker::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSTreeWalker, Base>(exec, &JSTreeWalkerTable, this, propertyName, descriptor);
+}
+
 JSValue jsTreeWalkerRoot(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSTreeWalker* castedThis = static_cast<JSTreeWalker*>(asObject(slot.slotBase()));
@@ -216,7 +232,7 @@ JSValue JSTreeWalker::getConstructor(ExecState* exec, JSGlobalObject* globalObje
 JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionParentNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSTreeWalker::s_info))
+    if (!thisValue.inherits(&JSTreeWalker::s_info))
         return throwError(exec, TypeError);
     JSTreeWalker* castedThisObj = static_cast<JSTreeWalker*>(asObject(thisValue));
     return castedThisObj->parentNode(exec, args);
@@ -225,7 +241,7 @@ JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionParentNode(ExecState* exec, J
 JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionFirstChild(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSTreeWalker::s_info))
+    if (!thisValue.inherits(&JSTreeWalker::s_info))
         return throwError(exec, TypeError);
     JSTreeWalker* castedThisObj = static_cast<JSTreeWalker*>(asObject(thisValue));
     return castedThisObj->firstChild(exec, args);
@@ -234,7 +250,7 @@ JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionFirstChild(ExecState* exec, J
 JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionLastChild(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSTreeWalker::s_info))
+    if (!thisValue.inherits(&JSTreeWalker::s_info))
         return throwError(exec, TypeError);
     JSTreeWalker* castedThisObj = static_cast<JSTreeWalker*>(asObject(thisValue));
     return castedThisObj->lastChild(exec, args);
@@ -243,7 +259,7 @@ JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionLastChild(ExecState* exec, JS
 JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionPreviousSibling(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSTreeWalker::s_info))
+    if (!thisValue.inherits(&JSTreeWalker::s_info))
         return throwError(exec, TypeError);
     JSTreeWalker* castedThisObj = static_cast<JSTreeWalker*>(asObject(thisValue));
     return castedThisObj->previousSibling(exec, args);
@@ -252,7 +268,7 @@ JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionPreviousSibling(ExecState* ex
 JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionNextSibling(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSTreeWalker::s_info))
+    if (!thisValue.inherits(&JSTreeWalker::s_info))
         return throwError(exec, TypeError);
     JSTreeWalker* castedThisObj = static_cast<JSTreeWalker*>(asObject(thisValue));
     return castedThisObj->nextSibling(exec, args);
@@ -261,7 +277,7 @@ JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionNextSibling(ExecState* exec,
 JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionPreviousNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSTreeWalker::s_info))
+    if (!thisValue.inherits(&JSTreeWalker::s_info))
         return throwError(exec, TypeError);
     JSTreeWalker* castedThisObj = static_cast<JSTreeWalker*>(asObject(thisValue));
     return castedThisObj->previousNode(exec, args);
@@ -270,7 +286,7 @@ JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionPreviousNode(ExecState* exec,
 JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionNextNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSTreeWalker::s_info))
+    if (!thisValue.inherits(&JSTreeWalker::s_info))
         return throwError(exec, TypeError);
     JSTreeWalker* castedThisObj = static_cast<JSTreeWalker*>(asObject(thisValue));
     return castedThisObj->nextNode(exec, args);
@@ -282,7 +298,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, TreeWal
 }
 TreeWalker* toTreeWalker(JSC::JSValue value)
 {
-    return value.isObject(&JSTreeWalker::s_info) ? static_cast<JSTreeWalker*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSTreeWalker::s_info) ? static_cast<JSTreeWalker*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.h b/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.h
index bf007bb..357f4d8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSTreeWalker();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -46,7 +47,7 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void mark();
+    virtual void markChildren(JSC::MarkStack&);
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 
@@ -74,6 +75,7 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSUIEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSUIEvent.cpp
index 98891f3..6391329 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSUIEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSUIEvent.cpp
@@ -80,6 +80,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSUIEventPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -96,6 +97,11 @@ bool JSUIEventConstructor::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSUIEventConstructor, DOMObject>(exec, &JSUIEventConstructorTable, this, propertyName, slot);
 }
 
+bool JSUIEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSUIEventConstructor, DOMObject>(exec, &JSUIEventConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSUIEventPrototypeTableValues[2] =
@@ -123,6 +129,11 @@ bool JSUIEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticFunctionSlot<JSObject>(exec, &JSUIEventPrototypeTable, this, propertyName, slot);
 }
 
+bool JSUIEventPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSUIEventPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSUIEvent::s_info = { "UIEvent", &JSEvent::s_info, &JSUIEventTable, 0 };
 
 JSUIEvent::JSUIEvent(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<UIEvent> impl)
@@ -140,6 +151,11 @@ bool JSUIEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return getStaticValueSlot<JSUIEvent, Base>(exec, &JSUIEventTable, this, propertyName, slot);
 }
 
+bool JSUIEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSUIEvent, Base>(exec, &JSUIEventTable, this, propertyName, descriptor);
+}
+
 JSValue jsUIEventView(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSUIEvent* castedThis = static_cast<JSUIEvent*>(asObject(slot.slotBase()));
@@ -225,7 +241,7 @@ JSValue JSUIEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
 JSValue JSC_HOST_CALL jsUIEventPrototypeFunctionInitUIEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSUIEvent::s_info))
+    if (!thisValue.inherits(&JSUIEvent::s_info))
         return throwError(exec, TypeError);
     JSUIEvent* castedThisObj = static_cast<JSUIEvent*>(asObject(thisValue));
     UIEvent* imp = static_cast<UIEvent*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSUIEvent.h b/src/3rdparty/webkit/WebCore/generated/JSUIEvent.h
index 587296b..3376293 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSUIEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSUIEvent.h
@@ -33,6 +33,7 @@ public:
     JSUIEvent(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<UIEvent>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -52,9 +53,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSUIEventPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSValidityState.cpp b/src/3rdparty/webkit/WebCore/generated/JSValidityState.cpp
index e99ec02..68fe415 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSValidityState.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSValidityState.cpp
@@ -97,6 +97,11 @@ bool JSValidityState::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSValidityState, Base>(exec, &JSValidityStateTable, this, propertyName, slot);
 }
 
+bool JSValidityState::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSValidityState, Base>(exec, &JSValidityStateTable, this, propertyName, descriptor);
+}
+
 JSValue jsValidityStateValueMissing(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSValidityState* castedThis = static_cast<JSValidityState*>(asObject(slot.slotBase()));
@@ -175,7 +180,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Validit
 }
 ValidityState* toValidityState(JSC::JSValue value)
 {
-    return value.isObject(&JSValidityState::s_info) ? static_cast<JSValidityState*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSValidityState::s_info) ? static_cast<JSValidityState*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSValidityState.h b/src/3rdparty/webkit/WebCore/generated/JSValidityState.h
index dab1307..2bd75dc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSValidityState.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSValidityState.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSValidityState();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.cpp b/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.cpp
index 8558c88..186a349 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.cpp
@@ -58,6 +58,11 @@ bool JSVoidCallbackPrototype::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticFunctionSlot<JSObject>(exec, &JSVoidCallbackPrototypeTable, this, propertyName, slot);
 }
 
+bool JSVoidCallbackPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSVoidCallbackPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSVoidCallback::s_info = { "VoidCallback", 0, 0, 0 };
 
 JSVoidCallback::JSVoidCallback(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<VoidCallback> impl)
@@ -79,7 +84,7 @@ JSObject* JSVoidCallback::createPrototype(ExecState* exec, JSGlobalObject* globa
 JSValue JSC_HOST_CALL jsVoidCallbackPrototypeFunctionHandleEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSVoidCallback::s_info))
+    if (!thisValue.inherits(&JSVoidCallback::s_info))
         return throwError(exec, TypeError);
     JSVoidCallback* castedThisObj = static_cast<JSVoidCallback*>(asObject(thisValue));
     VoidCallback* imp = static_cast<VoidCallback*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.h b/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.h
index ce61d3c..2d38eca 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.h
@@ -55,9 +55,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSVoidCallbackPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.cpp
index 9c15afd..64b8117 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.cpp
@@ -73,6 +73,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSWebKitAnimationEventPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -89,6 +90,11 @@ bool JSWebKitAnimationEventConstructor::getOwnPropertySlot(ExecState* exec, cons
     return getStaticValueSlot<JSWebKitAnimationEventConstructor, DOMObject>(exec, &JSWebKitAnimationEventConstructorTable, this, propertyName, slot);
 }
 
+bool JSWebKitAnimationEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSWebKitAnimationEventConstructor, DOMObject>(exec, &JSWebKitAnimationEventConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSWebKitAnimationEventPrototypeTableValues[2] =
@@ -116,6 +122,11 @@ bool JSWebKitAnimationEventPrototype::getOwnPropertySlot(ExecState* exec, const
     return getStaticFunctionSlot<JSObject>(exec, &JSWebKitAnimationEventPrototypeTable, this, propertyName, slot);
 }
 
+bool JSWebKitAnimationEventPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSWebKitAnimationEventPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSWebKitAnimationEvent::s_info = { "WebKitAnimationEvent", &JSEvent::s_info, &JSWebKitAnimationEventTable, 0 };
 
 JSWebKitAnimationEvent::JSWebKitAnimationEvent(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<WebKitAnimationEvent> impl)
@@ -133,6 +144,11 @@ bool JSWebKitAnimationEvent::getOwnPropertySlot(ExecState* exec, const Identifie
     return getStaticValueSlot<JSWebKitAnimationEvent, Base>(exec, &JSWebKitAnimationEventTable, this, propertyName, slot);
 }
 
+bool JSWebKitAnimationEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSWebKitAnimationEvent, Base>(exec, &JSWebKitAnimationEventTable, this, propertyName, descriptor);
+}
+
 JSValue jsWebKitAnimationEventAnimationName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSWebKitAnimationEvent* castedThis = static_cast<JSWebKitAnimationEvent*>(asObject(slot.slotBase()));
@@ -162,7 +178,7 @@ JSValue JSWebKitAnimationEvent::getConstructor(ExecState* exec, JSGlobalObject*
 JSValue JSC_HOST_CALL jsWebKitAnimationEventPrototypeFunctionInitWebKitAnimationEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSWebKitAnimationEvent::s_info))
+    if (!thisValue.inherits(&JSWebKitAnimationEvent::s_info))
         return throwError(exec, TypeError);
     JSWebKitAnimationEvent* castedThisObj = static_cast<JSWebKitAnimationEvent*>(asObject(thisValue));
     WebKitAnimationEvent* imp = static_cast<WebKitAnimationEvent*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.h
index c6969d8..ece445e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.h
@@ -33,6 +33,7 @@ public:
     JSWebKitAnimationEvent(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<WebKitAnimationEvent>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -52,9 +53,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSWebKitAnimationEventPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.cpp
index 2a71209..67e6b2e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.cpp
@@ -74,6 +74,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSWebKitCSSKeyframeRulePrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -90,6 +91,11 @@ bool JSWebKitCSSKeyframeRuleConstructor::getOwnPropertySlot(ExecState* exec, con
     return getStaticValueSlot<JSWebKitCSSKeyframeRuleConstructor, DOMObject>(exec, &JSWebKitCSSKeyframeRuleConstructorTable, this, propertyName, slot);
 }
 
+bool JSWebKitCSSKeyframeRuleConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSWebKitCSSKeyframeRuleConstructor, DOMObject>(exec, &JSWebKitCSSKeyframeRuleConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSWebKitCSSKeyframeRulePrototypeTableValues[1] =
@@ -128,6 +134,11 @@ bool JSWebKitCSSKeyframeRule::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSWebKitCSSKeyframeRule, Base>(exec, &JSWebKitCSSKeyframeRuleTable, this, propertyName, slot);
 }
 
+bool JSWebKitCSSKeyframeRule::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSWebKitCSSKeyframeRule, Base>(exec, &JSWebKitCSSKeyframeRuleTable, this, propertyName, descriptor);
+}
+
 JSValue jsWebKitCSSKeyframeRuleKeyText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSWebKitCSSKeyframeRule* castedThis = static_cast<JSWebKitCSSKeyframeRule*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.h
index 36d05a8..09061fe 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.h
@@ -33,6 +33,7 @@ public:
     JSWebKitCSSKeyframeRule(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<WebKitCSSKeyframeRule>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.cpp
index f4cbcfc..611de59 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.cpp
@@ -76,6 +76,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSWebKitCSSKeyframesRulePrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -92,6 +93,11 @@ bool JSWebKitCSSKeyframesRuleConstructor::getOwnPropertySlot(ExecState* exec, co
     return getStaticValueSlot<JSWebKitCSSKeyframesRuleConstructor, DOMObject>(exec, &JSWebKitCSSKeyframesRuleConstructorTable, this, propertyName, slot);
 }
 
+bool JSWebKitCSSKeyframesRuleConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSWebKitCSSKeyframesRuleConstructor, DOMObject>(exec, &JSWebKitCSSKeyframesRuleConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSWebKitCSSKeyframesRulePrototypeTableValues[4] =
@@ -121,6 +127,11 @@ bool JSWebKitCSSKeyframesRulePrototype::getOwnPropertySlot(ExecState* exec, cons
     return getStaticFunctionSlot<JSObject>(exec, &JSWebKitCSSKeyframesRulePrototypeTable, this, propertyName, slot);
 }
 
+bool JSWebKitCSSKeyframesRulePrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSWebKitCSSKeyframesRulePrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSWebKitCSSKeyframesRule::s_info = { "WebKitCSSKeyframesRule", &JSCSSRule::s_info, &JSWebKitCSSKeyframesRuleTable, 0 };
 
 JSWebKitCSSKeyframesRule::JSWebKitCSSKeyframesRule(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<WebKitCSSKeyframesRule> impl)
@@ -149,6 +160,26 @@ bool JSWebKitCSSKeyframesRule::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticValueSlot<JSWebKitCSSKeyframesRule, Base>(exec, &JSWebKitCSSKeyframesRuleTable, this, propertyName, slot);
 }
 
+bool JSWebKitCSSKeyframesRule::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    const HashEntry* entry = JSWebKitCSSKeyframesRuleTable.entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        slot.setCustom(this, entry->propertyGetter());
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<WebKitCSSKeyframesRule*>(impl())->length()) {
+        PropertySlot slot;
+        slot.setCustomIndex(this, index, indexGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly);
+        return true;
+    }
+    return getStaticValueDescriptor<JSWebKitCSSKeyframesRule, Base>(exec, &JSWebKitCSSKeyframesRuleTable, this, propertyName, descriptor);
+}
+
 bool JSWebKitCSSKeyframesRule::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
 {
     if (propertyName < static_cast<WebKitCSSKeyframesRule*>(impl())->length()) {
@@ -190,11 +221,11 @@ void setJSWebKitCSSKeyframesRuleName(ExecState* exec, JSObject* thisObject, JSVa
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-void JSWebKitCSSKeyframesRule::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, unsigned listedAttributes)
+void JSWebKitCSSKeyframesRule::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     for (unsigned i = 0; i < static_cast<WebKitCSSKeyframesRule*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getPropertyNames(exec, propertyNames, listedAttributes);
+     Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 JSValue JSWebKitCSSKeyframesRule::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -205,7 +236,7 @@ JSValue JSWebKitCSSKeyframesRule::getConstructor(ExecState* exec, JSGlobalObject
 JSValue JSC_HOST_CALL jsWebKitCSSKeyframesRulePrototypeFunctionInsertRule(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSWebKitCSSKeyframesRule::s_info))
+    if (!thisValue.inherits(&JSWebKitCSSKeyframesRule::s_info))
         return throwError(exec, TypeError);
     JSWebKitCSSKeyframesRule* castedThisObj = static_cast<JSWebKitCSSKeyframesRule*>(asObject(thisValue));
     WebKitCSSKeyframesRule* imp = static_cast<WebKitCSSKeyframesRule*>(castedThisObj->impl());
@@ -218,7 +249,7 @@ JSValue JSC_HOST_CALL jsWebKitCSSKeyframesRulePrototypeFunctionInsertRule(ExecSt
 JSValue JSC_HOST_CALL jsWebKitCSSKeyframesRulePrototypeFunctionDeleteRule(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSWebKitCSSKeyframesRule::s_info))
+    if (!thisValue.inherits(&JSWebKitCSSKeyframesRule::s_info))
         return throwError(exec, TypeError);
     JSWebKitCSSKeyframesRule* castedThisObj = static_cast<JSWebKitCSSKeyframesRule*>(asObject(thisValue));
     WebKitCSSKeyframesRule* imp = static_cast<WebKitCSSKeyframesRule*>(castedThisObj->impl());
@@ -231,7 +262,7 @@ JSValue JSC_HOST_CALL jsWebKitCSSKeyframesRulePrototypeFunctionDeleteRule(ExecSt
 JSValue JSC_HOST_CALL jsWebKitCSSKeyframesRulePrototypeFunctionFindRule(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSWebKitCSSKeyframesRule::s_info))
+    if (!thisValue.inherits(&JSWebKitCSSKeyframesRule::s_info))
         return throwError(exec, TypeError);
     JSWebKitCSSKeyframesRule* castedThisObj = static_cast<JSWebKitCSSKeyframesRule*>(asObject(thisValue));
     WebKitCSSKeyframesRule* imp = static_cast<WebKitCSSKeyframesRule*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.h
index 4cdbd0d..250f7ca 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.h
@@ -33,6 +33,7 @@ public:
     JSWebKitCSSKeyframesRule(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<WebKitCSSKeyframesRule>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
@@ -43,7 +44,7 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, unsigned listedAttributes = JSC::Structure::Prototype);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
@@ -56,9 +57,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSWebKitCSSKeyframesRulePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.cpp
index bfd9a37..583c026 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.cpp
@@ -105,6 +105,11 @@ bool JSWebKitCSSMatrixPrototype::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticFunctionSlot<JSObject>(exec, &JSWebKitCSSMatrixPrototypeTable, this, propertyName, slot);
 }
 
+bool JSWebKitCSSMatrixPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSWebKitCSSMatrixPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSWebKitCSSMatrix::s_info = { "WebKitCSSMatrix", 0, &JSWebKitCSSMatrixTable, 0 };
 
 JSWebKitCSSMatrix::JSWebKitCSSMatrix(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<WebKitCSSMatrix> impl)
@@ -128,6 +133,11 @@ bool JSWebKitCSSMatrix::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSWebKitCSSMatrix, Base>(exec, &JSWebKitCSSMatrixTable, this, propertyName, slot);
 }
 
+bool JSWebKitCSSMatrix::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSWebKitCSSMatrix, Base>(exec, &JSWebKitCSSMatrixTable, this, propertyName, descriptor);
+}
+
 JSValue jsWebKitCSSMatrixA(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSWebKitCSSMatrix* castedThis = static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()));
@@ -444,7 +454,7 @@ void setJSWebKitCSSMatrixM44(ExecState* exec, JSObject* thisObject, JSValue valu
 JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionSetMatrixValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSWebKitCSSMatrix::s_info))
+    if (!thisValue.inherits(&JSWebKitCSSMatrix::s_info))
         return throwError(exec, TypeError);
     JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(asObject(thisValue));
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
@@ -459,7 +469,7 @@ JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionSetMatrixValue(ExecState
 JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionMultiply(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSWebKitCSSMatrix::s_info))
+    if (!thisValue.inherits(&JSWebKitCSSMatrix::s_info))
         return throwError(exec, TypeError);
     JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(asObject(thisValue));
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
@@ -473,7 +483,7 @@ JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionMultiply(ExecState* exec
 JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionInverse(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSWebKitCSSMatrix::s_info))
+    if (!thisValue.inherits(&JSWebKitCSSMatrix::s_info))
         return throwError(exec, TypeError);
     JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(asObject(thisValue));
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
@@ -488,7 +498,7 @@ JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionInverse(ExecState* exec,
 JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionTranslate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSWebKitCSSMatrix::s_info))
+    if (!thisValue.inherits(&JSWebKitCSSMatrix::s_info))
         return throwError(exec, TypeError);
     JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(asObject(thisValue));
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
@@ -504,7 +514,7 @@ JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionTranslate(ExecState* exe
 JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionScale(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSWebKitCSSMatrix::s_info))
+    if (!thisValue.inherits(&JSWebKitCSSMatrix::s_info))
         return throwError(exec, TypeError);
     JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(asObject(thisValue));
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
@@ -520,7 +530,7 @@ JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionScale(ExecState* exec, J
 JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionRotate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSWebKitCSSMatrix::s_info))
+    if (!thisValue.inherits(&JSWebKitCSSMatrix::s_info))
         return throwError(exec, TypeError);
     JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(asObject(thisValue));
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
@@ -536,7 +546,7 @@ JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionRotate(ExecState* exec,
 JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionRotateAxisAngle(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSWebKitCSSMatrix::s_info))
+    if (!thisValue.inherits(&JSWebKitCSSMatrix::s_info))
         return throwError(exec, TypeError);
     JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(asObject(thisValue));
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
@@ -553,7 +563,7 @@ JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionRotateAxisAngle(ExecStat
 JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSWebKitCSSMatrix::s_info))
+    if (!thisValue.inherits(&JSWebKitCSSMatrix::s_info))
         return throwError(exec, TypeError);
     JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(asObject(thisValue));
     WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
@@ -569,7 +579,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebKitC
 }
 WebKitCSSMatrix* toWebKitCSSMatrix(JSC::JSValue value)
 {
-    return value.isObject(&JSWebKitCSSMatrix::s_info) ? static_cast<JSWebKitCSSMatrix*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSWebKitCSSMatrix::s_info) ? static_cast<JSWebKitCSSMatrix*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.h
index 2e44fcf..ca6f2c6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSWebKitCSSMatrix();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -62,9 +63,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSWebKitCSSMatrixPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.cpp
index ca3b003..f00e22a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.cpp
@@ -90,6 +90,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSWebKitCSSTransformValuePrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -106,6 +107,11 @@ bool JSWebKitCSSTransformValueConstructor::getOwnPropertySlot(ExecState* exec, c
     return getStaticValueSlot<JSWebKitCSSTransformValueConstructor, DOMObject>(exec, &JSWebKitCSSTransformValueConstructorTable, this, propertyName, slot);
 }
 
+bool JSWebKitCSSTransformValueConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSWebKitCSSTransformValueConstructor, DOMObject>(exec, &JSWebKitCSSTransformValueConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSWebKitCSSTransformValuePrototypeTableValues[22] =
@@ -153,6 +159,11 @@ bool JSWebKitCSSTransformValuePrototype::getOwnPropertySlot(ExecState* exec, con
     return getStaticValueSlot<JSWebKitCSSTransformValuePrototype, JSObject>(exec, &JSWebKitCSSTransformValuePrototypeTable, this, propertyName, slot);
 }
 
+bool JSWebKitCSSTransformValuePrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSWebKitCSSTransformValuePrototype, JSObject>(exec, &JSWebKitCSSTransformValuePrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSWebKitCSSTransformValue::s_info = { "WebKitCSSTransformValue", &JSCSSValueList::s_info, &JSWebKitCSSTransformValueTable, 0 };
 
 JSWebKitCSSTransformValue::JSWebKitCSSTransformValue(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<WebKitCSSTransformValue> impl)
@@ -170,6 +181,11 @@ bool JSWebKitCSSTransformValue::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSWebKitCSSTransformValue, Base>(exec, &JSWebKitCSSTransformValueTable, this, propertyName, slot);
 }
 
+bool JSWebKitCSSTransformValue::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSWebKitCSSTransformValue, Base>(exec, &JSWebKitCSSTransformValueTable, this, propertyName, descriptor);
+}
+
 JSValue jsWebKitCSSTransformValueOperationType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSWebKitCSSTransformValue* castedThis = static_cast<JSWebKitCSSTransformValue*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.h
index 58e7f5c..6195d22 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.h
@@ -33,6 +33,7 @@ public:
     JSWebKitCSSTransformValue(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<WebKitCSSTransformValue>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -52,9 +53,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSWebKitCSSTransformValuePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.cpp
index bba55c0..3cba2f7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.cpp
@@ -91,6 +91,11 @@ bool JSWebKitPoint::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSWebKitPoint, Base>(exec, &JSWebKitPointTable, this, propertyName, slot);
 }
 
+bool JSWebKitPoint::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSWebKitPoint, Base>(exec, &JSWebKitPointTable, this, propertyName, descriptor);
+}
+
 JSValue jsWebKitPointX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSWebKitPoint* castedThis = static_cast<JSWebKitPoint*>(asObject(slot.slotBase()));
@@ -130,7 +135,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebKitP
 }
 WebKitPoint* toWebKitPoint(JSC::JSValue value)
 {
-    return value.isObject(&JSWebKitPoint::s_info) ? static_cast<JSWebKitPoint*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSWebKitPoint::s_info) ? static_cast<JSWebKitPoint*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.h
index fdc8d47..6b7ef22 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSWebKitPoint();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.cpp
index ec0aa0d..0b375dc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.cpp
@@ -73,6 +73,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSWebKitTransitionEventPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -89,6 +90,11 @@ bool JSWebKitTransitionEventConstructor::getOwnPropertySlot(ExecState* exec, con
     return getStaticValueSlot<JSWebKitTransitionEventConstructor, DOMObject>(exec, &JSWebKitTransitionEventConstructorTable, this, propertyName, slot);
 }
 
+bool JSWebKitTransitionEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSWebKitTransitionEventConstructor, DOMObject>(exec, &JSWebKitTransitionEventConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSWebKitTransitionEventPrototypeTableValues[2] =
@@ -116,6 +122,11 @@ bool JSWebKitTransitionEventPrototype::getOwnPropertySlot(ExecState* exec, const
     return getStaticFunctionSlot<JSObject>(exec, &JSWebKitTransitionEventPrototypeTable, this, propertyName, slot);
 }
 
+bool JSWebKitTransitionEventPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSWebKitTransitionEventPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSWebKitTransitionEvent::s_info = { "WebKitTransitionEvent", &JSEvent::s_info, &JSWebKitTransitionEventTable, 0 };
 
 JSWebKitTransitionEvent::JSWebKitTransitionEvent(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<WebKitTransitionEvent> impl)
@@ -133,6 +144,11 @@ bool JSWebKitTransitionEvent::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSWebKitTransitionEvent, Base>(exec, &JSWebKitTransitionEventTable, this, propertyName, slot);
 }
 
+bool JSWebKitTransitionEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSWebKitTransitionEvent, Base>(exec, &JSWebKitTransitionEventTable, this, propertyName, descriptor);
+}
+
 JSValue jsWebKitTransitionEventPropertyName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSWebKitTransitionEvent* castedThis = static_cast<JSWebKitTransitionEvent*>(asObject(slot.slotBase()));
@@ -162,7 +178,7 @@ JSValue JSWebKitTransitionEvent::getConstructor(ExecState* exec, JSGlobalObject*
 JSValue JSC_HOST_CALL jsWebKitTransitionEventPrototypeFunctionInitWebKitTransitionEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSWebKitTransitionEvent::s_info))
+    if (!thisValue.inherits(&JSWebKitTransitionEvent::s_info))
         return throwError(exec, TypeError);
     JSWebKitTransitionEvent* castedThisObj = static_cast<JSWebKitTransitionEvent*>(asObject(thisValue));
     WebKitTransitionEvent* imp = static_cast<WebKitTransitionEvent*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.h
index d8bf92a..71a01ca 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.h
@@ -33,6 +33,7 @@ public:
     JSWebKitTransitionEvent(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<WebKitTransitionEvent>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -52,9 +53,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSWebKitTransitionEventPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebSocket.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebSocket.cpp
new file mode 100644
index 0000000..9e69c8c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebSocket.cpp
@@ -0,0 +1,280 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "JSWebSocket.h"
+
+#include "EventListener.h"
+#include "Frame.h"
+#include "JSDOMGlobalObject.h"
+#include "JSEventListener.h"
+#include "KURL.h"
+#include "WebSocket.h"
+#include <runtime/Error.h>
+#include <runtime/JSNumberCell.h>
+#include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSWebSocket);
+
+/* Hash table */
+
+static const HashTableValue JSWebSocketTableValues[7] =
+{
+    { "URL", DontDelete|ReadOnly, (intptr_t)jsWebSocketURL, (intptr_t)0 },
+    { "readyState", DontDelete|ReadOnly, (intptr_t)jsWebSocketReadyState, (intptr_t)0 },
+    { "bufferedAmount", DontDelete|ReadOnly, (intptr_t)jsWebSocketBufferedAmount, (intptr_t)0 },
+    { "onopen", DontDelete, (intptr_t)jsWebSocketOnopen, (intptr_t)setJSWebSocketOnopen },
+    { "onmessage", DontDelete, (intptr_t)jsWebSocketOnmessage, (intptr_t)setJSWebSocketOnmessage },
+    { "onclose", DontDelete, (intptr_t)jsWebSocketOnclose, (intptr_t)setJSWebSocketOnclose },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSWebSocketTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 127, JSWebSocketTableValues, 0 };
+#else
+    { 17, 15, JSWebSocketTableValues, 0 };
+#endif
+
+/* Hash table for prototype */
+
+static const HashTableValue JSWebSocketPrototypeTableValues[6] =
+{
+    { "CONNECTING", DontDelete|ReadOnly, (intptr_t)jsWebSocketCONNECTING, (intptr_t)0 },
+    { "OPEN", DontDelete|ReadOnly, (intptr_t)jsWebSocketOPEN, (intptr_t)0 },
+    { "CLOSED", DontDelete|ReadOnly, (intptr_t)jsWebSocketCLOSED, (intptr_t)0 },
+    { "send", DontDelete|Function, (intptr_t)jsWebSocketPrototypeFunctionSend, (intptr_t)1 },
+    { "close", DontDelete|Function, (intptr_t)jsWebSocketPrototypeFunctionClose, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSWebSocketPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 127, JSWebSocketPrototypeTableValues, 0 };
+#else
+    { 17, 15, JSWebSocketPrototypeTableValues, 0 };
+#endif
+
+static const HashTable* getJSWebSocketPrototypeTable(ExecState* exec)
+{
+    return getHashTableForGlobalData(exec->globalData(), &JSWebSocketPrototypeTable);
+}
+const ClassInfo JSWebSocketPrototype::s_info = { "WebSocketPrototype", 0, 0, getJSWebSocketPrototypeTable };
+
+JSObject* JSWebSocketPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSWebSocket>(exec, globalObject);
+}
+
+bool JSWebSocketPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticPropertySlot<JSWebSocketPrototype, JSObject>(exec, getJSWebSocketPrototypeTable(exec), this, propertyName, slot);
+}
+
+bool JSWebSocketPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSWebSocketPrototype, JSObject>(exec, getJSWebSocketPrototypeTable(exec), this, propertyName, descriptor);
+}
+
+static const HashTable* getJSWebSocketTable(ExecState* exec)
+{
+    return getHashTableForGlobalData(exec->globalData(), &JSWebSocketTable);
+}
+const ClassInfo JSWebSocket::s_info = { "WebSocket", 0, 0, getJSWebSocketTable };
+
+JSWebSocket::JSWebSocket(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<WebSocket> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
+    , m_impl(impl)
+{
+}
+
+JSWebSocket::~JSWebSocket()
+{
+    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+}
+
+JSObject* JSWebSocket::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSWebSocketPrototype(JSWebSocketPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSWebSocket::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSWebSocket, Base>(exec, getJSWebSocketTable(exec), this, propertyName, slot);
+}
+
+bool JSWebSocket::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSWebSocket, Base>(exec, getJSWebSocketTable(exec), this, propertyName, descriptor);
+}
+
+JSValue jsWebSocketURL(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSWebSocket* castedThis = static_cast<JSWebSocket*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    WebSocket* imp = static_cast<WebSocket*>(castedThis->impl());
+    return jsString(exec, imp->url());
+}
+
+JSValue jsWebSocketReadyState(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSWebSocket* castedThis = static_cast<JSWebSocket*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    WebSocket* imp = static_cast<WebSocket*>(castedThis->impl());
+    return jsNumber(exec, imp->readyState());
+}
+
+JSValue jsWebSocketBufferedAmount(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSWebSocket* castedThis = static_cast<JSWebSocket*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    WebSocket* imp = static_cast<WebSocket*>(castedThis->impl());
+    return jsNumber(exec, imp->bufferedAmount());
+}
+
+JSValue jsWebSocketOnopen(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSWebSocket* castedThis = static_cast<JSWebSocket*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    WebSocket* imp = static_cast<WebSocket*>(castedThis->impl());
+    if (EventListener* listener = imp->onopen()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsWebSocketOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSWebSocket* castedThis = static_cast<JSWebSocket*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    WebSocket* imp = static_cast<WebSocket*>(castedThis->impl());
+    if (EventListener* listener = imp->onmessage()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsWebSocketOnclose(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSWebSocket* castedThis = static_cast<JSWebSocket*>(asObject(slot.slotBase()));
+    UNUSED_PARAM(exec);
+    WebSocket* imp = static_cast<WebSocket*>(castedThis->impl());
+    if (EventListener* listener = imp->onclose()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+void JSWebSocket::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    lookupPut<JSWebSocket, Base>(exec, propertyName, value, getJSWebSocketTable(exec), this, slot);
+}
+
+void setJSWebSocketOnopen(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    WebSocket* imp = static_cast<WebSocket*>(static_cast<JSWebSocket*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnopen(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSWebSocketOnmessage(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    WebSocket* imp = static_cast<WebSocket*>(static_cast<JSWebSocket*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnmessage(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSWebSocketOnclose(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    WebSocket* imp = static_cast<WebSocket*>(static_cast<JSWebSocket*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnclose(globalObject->createJSAttributeEventListener(value));
+}
+
+JSValue JSC_HOST_CALL jsWebSocketPrototypeFunctionSend(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebSocket::s_info))
+        return throwError(exec, TypeError);
+    JSWebSocket* castedThisObj = static_cast<JSWebSocket*>(asObject(thisValue));
+    return castedThisObj->send(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWebSocketPrototypeFunctionClose(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSWebSocket::s_info))
+        return throwError(exec, TypeError);
+    JSWebSocket* castedThisObj = static_cast<JSWebSocket*>(asObject(thisValue));
+    WebSocket* imp = static_cast<WebSocket*>(castedThisObj->impl());
+
+    imp->close();
+    return jsUndefined();
+}
+
+// Constant getters
+
+JSValue jsWebSocketCONNECTING(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0));
+}
+
+JSValue jsWebSocketOPEN(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(1));
+}
+
+JSValue jsWebSocketCLOSED(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(2));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebSocket* object)
+{
+    return getDOMObjectWrapper<JSWebSocket>(exec, globalObject, object);
+}
+WebSocket* toWebSocket(JSC::JSValue value)
+{
+    return value.inherits(&JSWebSocket::s_info) ? static_cast<JSWebSocket*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(WEB_SOCKETS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebSocket.h b/src/3rdparty/webkit/WebCore/generated/JSWebSocket.h
new file mode 100644
index 0000000..0b2e9cb
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebSocket.h
@@ -0,0 +1,106 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSWebSocket_h
+#define JSWebSocket_h
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "DOMObjectWithSVGContext.h"
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class WebSocket;
+
+class JSWebSocket : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
+public:
+    JSWebSocket(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<WebSocket>);
+    virtual ~JSWebSocket();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    virtual void markChildren(JSC::MarkStack&);
+
+
+    // Custom functions
+    JSC::JSValue send(JSC::ExecState*, const JSC::ArgList&);
+    WebSocket* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<WebSocket> m_impl;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, WebSocket*);
+WebSocket* toWebSocket(JSC::JSValue);
+
+class JSWebSocketPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+    JSWebSocketPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsWebSocketPrototypeFunctionSend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebSocketPrototypeFunctionClose(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsWebSocketURL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebSocketReadyState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebSocketBufferedAmount(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebSocketOnopen(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebSocketOnopen(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebSocketOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebSocketOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebSocketOnclose(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebSocketOnclose(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+// Constants
+
+JSC::JSValue jsWebSocketCONNECTING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebSocketOPEN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebSocketCLOSED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_SOCKETS)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.cpp
index fa29330..687ac97 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.cpp
@@ -83,6 +83,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSWheelEventPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -99,6 +100,11 @@ bool JSWheelEventConstructor::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSWheelEventConstructor, DOMObject>(exec, &JSWheelEventConstructorTable, this, propertyName, slot);
 }
 
+bool JSWheelEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSWheelEventConstructor, DOMObject>(exec, &JSWheelEventConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSWheelEventPrototypeTableValues[1] =
@@ -137,6 +143,11 @@ bool JSWheelEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<JSWheelEvent, Base>(exec, &JSWheelEventTable, this, propertyName, slot);
 }
 
+bool JSWheelEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSWheelEvent, Base>(exec, &JSWheelEventTable, this, propertyName, descriptor);
+}
+
 JSValue jsWheelEventScreenX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSWheelEvent* castedThis = static_cast<JSWheelEvent*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.h b/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.h
index 78fdc12..993994b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.h
@@ -33,6 +33,7 @@ public:
     JSWheelEvent(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<WheelEvent>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorker.cpp b/src/3rdparty/webkit/WebCore/generated/JSWorker.cpp
index 0e238e4..1b8d897 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorker.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorker.cpp
@@ -28,7 +28,6 @@
 #include "Frame.h"
 #include "JSDOMGlobalObject.h"
 #include "JSEventListener.h"
-#include "JSMessagePort.h"
 #include "Worker.h"
 #include <runtime/Error.h>
 #include <wtf/GetPtr.h>
@@ -82,6 +81,11 @@ bool JSWorkerPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticFunctionSlot<JSObject>(exec, &JSWorkerPrototypeTable, this, propertyName, slot);
 }
 
+bool JSWorkerPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSWorkerPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSWorker::s_info = { "Worker", &JSAbstractWorker::s_info, &JSWorkerTable, 0 };
 
 JSWorker::JSWorker(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<Worker> impl)
@@ -99,6 +103,11 @@ bool JSWorker::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNam
     return getStaticValueSlot<JSWorker, Base>(exec, &JSWorkerTable, this, propertyName, slot);
 }
 
+bool JSWorker::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSWorker, Base>(exec, &JSWorkerTable, this, propertyName, descriptor);
+}
+
 JSValue jsWorkerOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSWorker* castedThis = static_cast<JSWorker*>(asObject(slot.slotBase()));
@@ -129,31 +138,16 @@ void setJSWorkerOnmessage(ExecState* exec, JSObject* thisObject, JSValue value)
 JSValue JSC_HOST_CALL jsWorkerPrototypeFunctionPostMessage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSWorker::s_info))
+    if (!thisValue.inherits(&JSWorker::s_info))
         return throwError(exec, TypeError);
     JSWorker* castedThisObj = static_cast<JSWorker*>(asObject(thisValue));
-    Worker* imp = static_cast<Worker*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    const UString& message = args.at(0).toString(exec);
-
-    int argsCount = args.size();
-    if (argsCount < 2) {
-        imp->postMessage(message, ec);
-        setDOMException(exec, ec);
-        return jsUndefined();
-    }
-
-    MessagePort* messagePort = toMessagePort(args.at(1));
-
-    imp->postMessage(message, messagePort, ec);
-    setDOMException(exec, ec);
-    return jsUndefined();
+    return castedThisObj->postMessage(exec, args);
 }
 
 JSValue JSC_HOST_CALL jsWorkerPrototypeFunctionTerminate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSWorker::s_info))
+    if (!thisValue.inherits(&JSWorker::s_info))
         return throwError(exec, TypeError);
     JSWorker* castedThisObj = static_cast<JSWorker*>(asObject(thisValue));
     Worker* imp = static_cast<Worker*>(castedThisObj->impl());
@@ -168,7 +162,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Worker*
 }
 Worker* toWorker(JSC::JSValue value)
 {
-    return value.isObject(&JSWorker::s_info) ? static_cast<JSWorker*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSWorker::s_info) ? static_cast<JSWorker*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorker.h b/src/3rdparty/webkit/WebCore/generated/JSWorker.h
index f04866b..f33b791 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorker.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorker.h
@@ -36,6 +36,7 @@ public:
     JSWorker(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<Worker>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -45,8 +46,11 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void mark();
+    virtual void markChildren(JSC::MarkStack&);
 
+
+    // Custom functions
+    JSC::JSValue postMessage(JSC::ExecState*, const JSC::ArgList&);
     Worker* impl() const
     {
         return static_cast<Worker*>(Base::impl());
@@ -63,6 +67,7 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.cpp b/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.cpp
index 59a8dcd..c5217d5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.cpp
@@ -28,6 +28,7 @@
 #include "EventListener.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
+#include "JSEventSource.h"
 #include "JSMessageChannel.h"
 #include "JSMessageEvent.h"
 #include "JSWorkerContext.h"
@@ -48,7 +49,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSWorkerContext);
 
 /* Hash table */
 
-static const HashTableValue JSWorkerContextTableValues[9] =
+static const HashTableValue JSWorkerContextTableValues[10] =
 {
     { "self", DontDelete, (intptr_t)jsWorkerContextSelf, (intptr_t)setJSWorkerContextSelf },
     { "location", DontDelete, (intptr_t)jsWorkerContextLocation, (intptr_t)setJSWorkerContextLocation },
@@ -57,6 +58,7 @@ static const HashTableValue JSWorkerContextTableValues[9] =
     { "MessageEvent", DontDelete, (intptr_t)jsWorkerContextMessageEventConstructor, (intptr_t)setJSWorkerContextMessageEventConstructor },
     { "WorkerLocation", DontDelete, (intptr_t)jsWorkerContextWorkerLocationConstructor, (intptr_t)setJSWorkerContextWorkerLocationConstructor },
     { "MessageChannel", DontDelete, (intptr_t)jsWorkerContextMessageChannelConstructor, (intptr_t)setJSWorkerContextMessageChannelConstructor },
+    { "EventSource", DontDelete, (intptr_t)jsWorkerContextEventSourceConstructor, (intptr_t)setJSWorkerContextEventSourceConstructor },
     { "XMLHttpRequest", DontDelete, (intptr_t)jsWorkerContextXMLHttpRequestConstructor, (intptr_t)setJSWorkerContextXMLHttpRequestConstructor },
     { 0, 0, 0, 0 }
 };
@@ -65,7 +67,7 @@ static JSC_CONST_HASHTABLE HashTable JSWorkerContextTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 127, JSWorkerContextTableValues, 0 };
 #else
-    { 18, 15, JSWorkerContextTableValues, 0 };
+    { 34, 31, JSWorkerContextTableValues, 0 };
 #endif
 
 /* Hash table for prototype */
@@ -107,6 +109,11 @@ bool JSWorkerContextPrototype::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticFunctionSlot<JSObject>(exec, getJSWorkerContextPrototypeTable(exec), this, propertyName, slot);
 }
 
+bool JSWorkerContextPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, getJSWorkerContextPrototypeTable(exec), this, propertyName, descriptor);
+}
+
 static const HashTable* getJSWorkerContextTable(ExecState* exec)
 {
     return getHashTableForGlobalData(exec->globalData(), &JSWorkerContextTable);
@@ -125,6 +132,13 @@ bool JSWorkerContext::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSWorkerContext, Base>(exec, getJSWorkerContextTable(exec), this, propertyName, slot);
 }
 
+bool JSWorkerContext::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    if (getOwnPropertyDescriptorDelegate(exec, propertyName, descriptor))
+        return true;
+    return getStaticValueDescriptor<JSWorkerContext, Base>(exec, getJSWorkerContextTable(exec), this, propertyName, descriptor);
+}
+
 JSValue jsWorkerContextSelf(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSWorkerContext* castedThis = static_cast<JSWorkerContext*>(asObject(slot.slotBase()));
@@ -179,6 +193,12 @@ JSValue jsWorkerContextMessageChannelConstructor(ExecState* exec, const Identifi
     return castedThis->messageChannel(exec);
 }
 
+JSValue jsWorkerContextEventSourceConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSWorkerContext* castedThis = static_cast<JSWorkerContext*>(asObject(slot.slotBase()));
+    return castedThis->eventSource(exec);
+}
+
 JSValue jsWorkerContextXMLHttpRequestConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSWorkerContext* castedThis = static_cast<JSWorkerContext*>(asObject(slot.slotBase()));
@@ -234,6 +254,12 @@ void setJSWorkerContextMessageChannelConstructor(ExecState* exec, JSObject* this
     static_cast<JSWorkerContext*>(thisObject)->putDirect(Identifier(exec, "MessageChannel"), value);
 }
 
+void setJSWorkerContextEventSourceConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    // Shadowing a built-in constructor
+    static_cast<JSWorkerContext*>(thisObject)->putDirect(Identifier(exec, "EventSource"), value);
+}
+
 void setJSWorkerContextXMLHttpRequestConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     // Shadowing a built-in constructor
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.h b/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.h
index 5ce05b7..1b4086e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.h
@@ -34,7 +34,9 @@ class JSWorkerContext : public JSWorkerContextBase {
 public:
     JSWorkerContext(PassRefPtr<JSC::Structure>, PassRefPtr<WorkerContext>);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    bool getOwnPropertyDescriptorDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -44,11 +46,12 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void mark();
+    virtual void markChildren(JSC::MarkStack&);
 
 
     // Custom attributes
     JSC::JSValue messageChannel(JSC::ExecState*) const;
+    JSC::JSValue eventSource(JSC::ExecState*) const;
     JSC::JSValue xmlHttpRequest(JSC::ExecState*) const;
 
     // Custom functions
@@ -67,6 +70,7 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
@@ -101,6 +105,8 @@ JSC::JSValue jsWorkerContextWorkerLocationConstructor(JSC::ExecState*, const JSC
 void setJSWorkerContextWorkerLocationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsWorkerContextMessageChannelConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSWorkerContextMessageChannelConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWorkerContextEventSourceConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWorkerContextEventSourceConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsWorkerContextXMLHttpRequestConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSWorkerContextXMLHttpRequestConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.cpp b/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.cpp
index d45c06a..343fd91 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.cpp
@@ -81,6 +81,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSWorkerLocationPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -97,6 +98,11 @@ bool JSWorkerLocationConstructor::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticValueSlot<JSWorkerLocationConstructor, DOMObject>(exec, &JSWorkerLocationConstructorTable, this, propertyName, slot);
 }
 
+bool JSWorkerLocationConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSWorkerLocationConstructor, DOMObject>(exec, &JSWorkerLocationConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSWorkerLocationPrototypeTableValues[2] =
@@ -128,6 +134,11 @@ bool JSWorkerLocationPrototype::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticFunctionSlot<JSObject>(exec, getJSWorkerLocationPrototypeTable(exec), this, propertyName, slot);
 }
 
+bool JSWorkerLocationPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, getJSWorkerLocationPrototypeTable(exec), this, propertyName, descriptor);
+}
+
 static const HashTable* getJSWorkerLocationTable(ExecState* exec)
 {
     return getHashTableForGlobalData(exec->globalData(), &JSWorkerLocationTable);
@@ -155,6 +166,11 @@ bool JSWorkerLocation::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSWorkerLocation, Base>(exec, getJSWorkerLocationTable(exec), this, propertyName, slot);
 }
 
+bool JSWorkerLocation::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSWorkerLocation, Base>(exec, getJSWorkerLocationTable(exec), this, propertyName, descriptor);
+}
+
 JSValue jsWorkerLocationHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSWorkerLocation* castedThis = static_cast<JSWorkerLocation*>(asObject(slot.slotBase()));
@@ -232,7 +248,7 @@ JSValue JSWorkerLocation::getConstructor(ExecState* exec, JSGlobalObject* global
 JSValue JSC_HOST_CALL jsWorkerLocationPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSWorkerLocation::s_info))
+    if (!thisValue.inherits(&JSWorkerLocation::s_info))
         return throwError(exec, TypeError);
     JSWorkerLocation* castedThisObj = static_cast<JSWorkerLocation*>(asObject(thisValue));
     WorkerLocation* imp = static_cast<WorkerLocation*>(castedThisObj->impl());
@@ -248,7 +264,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WorkerL
 }
 WorkerLocation* toWorkerLocation(JSC::JSValue value)
 {
-    return value.isObject(&JSWorkerLocation::s_info) ? static_cast<JSWorkerLocation*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSWorkerLocation::s_info) ? static_cast<JSWorkerLocation*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.h b/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.h
index 40c72c2..1c53d1e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.h
@@ -39,6 +39,7 @@ public:
     virtual ~JSWorkerLocation();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -64,9 +65,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSWorkerLocationPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.cpp b/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.cpp
index bc082b8..618fd6e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.cpp
@@ -106,6 +106,11 @@ bool JSWorkerNavigator::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSWorkerNavigator, Base>(exec, getJSWorkerNavigatorTable(exec), this, propertyName, slot);
 }
 
+bool JSWorkerNavigator::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSWorkerNavigator, Base>(exec, getJSWorkerNavigatorTable(exec), this, propertyName, descriptor);
+}
+
 JSValue jsWorkerNavigatorAppName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSWorkerNavigator* castedThis = static_cast<JSWorkerNavigator*>(asObject(slot.slotBase()));
@@ -152,7 +157,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WorkerN
 }
 WorkerNavigator* toWorkerNavigator(JSC::JSValue value)
 {
-    return value.isObject(&JSWorkerNavigator::s_info) ? static_cast<JSWorkerNavigator*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSWorkerNavigator::s_info) ? static_cast<JSWorkerNavigator*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.h b/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.h
index a6c4046..0bea1f1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.h
@@ -39,6 +39,7 @@ public:
     virtual ~JSWorkerNavigator();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.cpp
index 1817d28..0d5643e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.cpp
@@ -116,6 +116,11 @@ bool JSXMLHttpRequestPrototype::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticPropertySlot<JSXMLHttpRequestPrototype, JSObject>(exec, getJSXMLHttpRequestPrototypeTable(exec), this, propertyName, slot);
 }
 
+bool JSXMLHttpRequestPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSXMLHttpRequestPrototype, JSObject>(exec, getJSXMLHttpRequestPrototypeTable(exec), this, propertyName, descriptor);
+}
+
 static const HashTable* getJSXMLHttpRequestTable(ExecState* exec)
 {
     return getHashTableForGlobalData(exec->globalData(), &JSXMLHttpRequestTable);
@@ -143,6 +148,11 @@ bool JSXMLHttpRequest::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSXMLHttpRequest, Base>(exec, getJSXMLHttpRequestTable(exec), this, propertyName, slot);
 }
 
+bool JSXMLHttpRequest::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSXMLHttpRequest, Base>(exec, getJSXMLHttpRequestTable(exec), this, propertyName, descriptor);
+}
+
 JSValue jsXMLHttpRequestOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSXMLHttpRequest* castedThis = static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()));
@@ -349,7 +359,7 @@ void setJSXMLHttpRequestWithCredentials(ExecState* exec, JSObject* thisObject, J
 JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionOpen(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
+    if (!thisValue.inherits(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     return castedThisObj->open(exec, args);
@@ -358,7 +368,7 @@ JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionOpen(ExecState* exec, JSO
 JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionSetRequestHeader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
+    if (!thisValue.inherits(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     return castedThisObj->setRequestHeader(exec, args);
@@ -367,7 +377,7 @@ JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionSetRequestHeader(ExecStat
 JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionSend(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
+    if (!thisValue.inherits(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     return castedThisObj->send(exec, args);
@@ -376,7 +386,7 @@ JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionSend(ExecState* exec, JSO
 JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionAbort(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
+    if (!thisValue.inherits(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(castedThisObj->impl());
@@ -388,7 +398,7 @@ JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionAbort(ExecState* exec, JS
 JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionGetAllResponseHeaders(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
+    if (!thisValue.inherits(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(castedThisObj->impl());
@@ -403,7 +413,7 @@ JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionGetAllResponseHeaders(Exe
 JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionGetResponseHeader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
+    if (!thisValue.inherits(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     return castedThisObj->getResponseHeader(exec, args);
@@ -412,7 +422,7 @@ JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionGetResponseHeader(ExecSta
 JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionOverrideMimeType(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
+    if (!thisValue.inherits(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     return castedThisObj->overrideMimeType(exec, args);
@@ -421,7 +431,7 @@ JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionOverrideMimeType(ExecStat
 JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
+    if (!thisValue.inherits(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     return castedThisObj->addEventListener(exec, args);
@@ -430,7 +440,7 @@ JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionAddEventListener(ExecStat
 JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
+    if (!thisValue.inherits(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     return castedThisObj->removeEventListener(exec, args);
@@ -439,7 +449,7 @@ JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionRemoveEventListener(ExecS
 JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
+    if (!thisValue.inherits(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(castedThisObj->impl());
@@ -485,7 +495,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, XMLHttp
 }
 XMLHttpRequest* toXMLHttpRequest(JSC::JSValue value)
 {
-    return value.isObject(&JSXMLHttpRequest::s_info) ? static_cast<JSXMLHttpRequest*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSXMLHttpRequest::s_info) ? static_cast<JSXMLHttpRequest*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.h b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.h
index b64b305..71a6f02 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSXMLHttpRequest();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -46,7 +47,7 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void mark();
+    virtual void markChildren(JSC::MarkStack&);
 
 
     // Custom attributes
@@ -76,6 +77,7 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.cpp
index 6f81324..e0bb84c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.cpp
@@ -76,6 +76,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSXMLHttpRequestExceptionPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -92,6 +93,11 @@ bool JSXMLHttpRequestExceptionConstructor::getOwnPropertySlot(ExecState* exec, c
     return getStaticValueSlot<JSXMLHttpRequestExceptionConstructor, DOMObject>(exec, &JSXMLHttpRequestExceptionConstructorTable, this, propertyName, slot);
 }
 
+bool JSXMLHttpRequestExceptionConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSXMLHttpRequestExceptionConstructor, DOMObject>(exec, &JSXMLHttpRequestExceptionConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSXMLHttpRequestExceptionPrototypeTableValues[4] =
@@ -125,6 +131,11 @@ bool JSXMLHttpRequestExceptionPrototype::getOwnPropertySlot(ExecState* exec, con
     return getStaticPropertySlot<JSXMLHttpRequestExceptionPrototype, JSObject>(exec, getJSXMLHttpRequestExceptionPrototypeTable(exec), this, propertyName, slot);
 }
 
+bool JSXMLHttpRequestExceptionPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSXMLHttpRequestExceptionPrototype, JSObject>(exec, getJSXMLHttpRequestExceptionPrototypeTable(exec), this, propertyName, descriptor);
+}
+
 static const HashTable* getJSXMLHttpRequestExceptionTable(ExecState* exec)
 {
     return getHashTableForGlobalData(exec->globalData(), &JSXMLHttpRequestExceptionTable);
@@ -152,6 +163,11 @@ bool JSXMLHttpRequestException::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSXMLHttpRequestException, Base>(exec, getJSXMLHttpRequestExceptionTable(exec), this, propertyName, slot);
 }
 
+bool JSXMLHttpRequestException::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSXMLHttpRequestException, Base>(exec, getJSXMLHttpRequestExceptionTable(exec), this, propertyName, descriptor);
+}
+
 JSValue jsXMLHttpRequestExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSXMLHttpRequestException* castedThis = static_cast<JSXMLHttpRequestException*>(asObject(slot.slotBase()));
@@ -189,7 +205,7 @@ JSValue JSXMLHttpRequestException::getConstructor(ExecState* exec, JSGlobalObjec
 JSValue JSC_HOST_CALL jsXMLHttpRequestExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSXMLHttpRequestException::s_info))
+    if (!thisValue.inherits(&JSXMLHttpRequestException::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequestException* castedThisObj = static_cast<JSXMLHttpRequestException*>(asObject(thisValue));
     XMLHttpRequestException* imp = static_cast<XMLHttpRequestException*>(castedThisObj->impl());
@@ -217,7 +233,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, XMLHttp
 }
 XMLHttpRequestException* toXMLHttpRequestException(JSC::JSValue value)
 {
-    return value.isObject(&JSXMLHttpRequestException::s_info) ? static_cast<JSXMLHttpRequestException*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSXMLHttpRequestException::s_info) ? static_cast<JSXMLHttpRequestException*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.h b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.h
index 4923f6f..eca10f3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSXMLHttpRequestException();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -62,9 +63,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSXMLHttpRequestExceptionPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.cpp
index 12c1329..e197dd5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.cpp
@@ -70,6 +70,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSXMLHttpRequestProgressEventPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -86,6 +87,11 @@ bool JSXMLHttpRequestProgressEventConstructor::getOwnPropertySlot(ExecState* exe
     return getStaticValueSlot<JSXMLHttpRequestProgressEventConstructor, DOMObject>(exec, &JSXMLHttpRequestProgressEventConstructorTable, this, propertyName, slot);
 }
 
+bool JSXMLHttpRequestProgressEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSXMLHttpRequestProgressEventConstructor, DOMObject>(exec, &JSXMLHttpRequestProgressEventConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSXMLHttpRequestProgressEventPrototypeTableValues[1] =
@@ -132,6 +138,11 @@ bool JSXMLHttpRequestProgressEvent::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSXMLHttpRequestProgressEvent, Base>(exec, getJSXMLHttpRequestProgressEventTable(exec), this, propertyName, slot);
 }
 
+bool JSXMLHttpRequestProgressEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSXMLHttpRequestProgressEvent, Base>(exec, getJSXMLHttpRequestProgressEventTable(exec), this, propertyName, descriptor);
+}
+
 JSValue jsXMLHttpRequestProgressEventPosition(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSXMLHttpRequestProgressEvent* castedThis = static_cast<JSXMLHttpRequestProgressEvent*>(asObject(slot.slotBase()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.h b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.h
index d1ff5f6..144485e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.h
@@ -33,6 +33,7 @@ public:
     JSXMLHttpRequestProgressEvent(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<XMLHttpRequestProgressEvent>);
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.cpp
index b72aefa..d806fd24 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.cpp
@@ -79,6 +79,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSXMLHttpRequestUploadPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -95,6 +96,11 @@ bool JSXMLHttpRequestUploadConstructor::getOwnPropertySlot(ExecState* exec, cons
     return getStaticValueSlot<JSXMLHttpRequestUploadConstructor, DOMObject>(exec, &JSXMLHttpRequestUploadConstructorTable, this, propertyName, slot);
 }
 
+bool JSXMLHttpRequestUploadConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSXMLHttpRequestUploadConstructor, DOMObject>(exec, &JSXMLHttpRequestUploadConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSXMLHttpRequestUploadPrototypeTableValues[4] =
@@ -128,6 +134,11 @@ bool JSXMLHttpRequestUploadPrototype::getOwnPropertySlot(ExecState* exec, const
     return getStaticFunctionSlot<JSObject>(exec, getJSXMLHttpRequestUploadPrototypeTable(exec), this, propertyName, slot);
 }
 
+bool JSXMLHttpRequestUploadPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, getJSXMLHttpRequestUploadPrototypeTable(exec), this, propertyName, descriptor);
+}
+
 static const HashTable* getJSXMLHttpRequestUploadTable(ExecState* exec)
 {
     return getHashTableForGlobalData(exec->globalData(), &JSXMLHttpRequestUploadTable);
@@ -155,6 +166,11 @@ bool JSXMLHttpRequestUpload::getOwnPropertySlot(ExecState* exec, const Identifie
     return getStaticValueSlot<JSXMLHttpRequestUpload, Base>(exec, getJSXMLHttpRequestUploadTable(exec), this, propertyName, slot);
 }
 
+bool JSXMLHttpRequestUpload::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSXMLHttpRequestUpload, Base>(exec, getJSXMLHttpRequestUploadTable(exec), this, propertyName, descriptor);
+}
+
 JSValue jsXMLHttpRequestUploadOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSXMLHttpRequestUpload* castedThis = static_cast<JSXMLHttpRequestUpload*>(asObject(slot.slotBase()));
@@ -283,7 +299,7 @@ JSValue JSXMLHttpRequestUpload::getConstructor(ExecState* exec, JSGlobalObject*
 JSValue JSC_HOST_CALL jsXMLHttpRequestUploadPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSXMLHttpRequestUpload::s_info))
+    if (!thisValue.inherits(&JSXMLHttpRequestUpload::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequestUpload* castedThisObj = static_cast<JSXMLHttpRequestUpload*>(asObject(thisValue));
     return castedThisObj->addEventListener(exec, args);
@@ -292,7 +308,7 @@ JSValue JSC_HOST_CALL jsXMLHttpRequestUploadPrototypeFunctionAddEventListener(Ex
 JSValue JSC_HOST_CALL jsXMLHttpRequestUploadPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSXMLHttpRequestUpload::s_info))
+    if (!thisValue.inherits(&JSXMLHttpRequestUpload::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequestUpload* castedThisObj = static_cast<JSXMLHttpRequestUpload*>(asObject(thisValue));
     return castedThisObj->removeEventListener(exec, args);
@@ -301,7 +317,7 @@ JSValue JSC_HOST_CALL jsXMLHttpRequestUploadPrototypeFunctionRemoveEventListener
 JSValue JSC_HOST_CALL jsXMLHttpRequestUploadPrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSXMLHttpRequestUpload::s_info))
+    if (!thisValue.inherits(&JSXMLHttpRequestUpload::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequestUpload* castedThisObj = static_cast<JSXMLHttpRequestUpload*>(asObject(thisValue));
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(castedThisObj->impl());
@@ -320,7 +336,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, XMLHttp
 }
 XMLHttpRequestUpload* toXMLHttpRequestUpload(JSC::JSValue value)
 {
-    return value.isObject(&JSXMLHttpRequestUpload::s_info) ? static_cast<JSXMLHttpRequestUpload*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSXMLHttpRequestUpload::s_info) ? static_cast<JSXMLHttpRequestUpload*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.h b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.h
index eca3e0e..1fea17c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSXMLHttpRequestUpload();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
@@ -46,7 +47,7 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    virtual void mark();
+    virtual void markChildren(JSC::MarkStack&);
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 
@@ -69,6 +70,7 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.cpp
index 5816fd0..c4aca93 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.cpp
@@ -71,6 +71,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSXMLSerializerPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -96,6 +97,11 @@ bool JSXMLSerializerConstructor::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSXMLSerializerConstructor, DOMObject>(exec, &JSXMLSerializerConstructorTable, this, propertyName, slot);
 }
 
+bool JSXMLSerializerConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSXMLSerializerConstructor, DOMObject>(exec, &JSXMLSerializerConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSXMLSerializerPrototypeTableValues[2] =
@@ -123,6 +129,11 @@ bool JSXMLSerializerPrototype::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticFunctionSlot<JSObject>(exec, &JSXMLSerializerPrototypeTable, this, propertyName, slot);
 }
 
+bool JSXMLSerializerPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSXMLSerializerPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSXMLSerializer::s_info = { "XMLSerializer", 0, &JSXMLSerializerTable, 0 };
 
 JSXMLSerializer::JSXMLSerializer(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<XMLSerializer> impl)
@@ -146,6 +157,11 @@ bool JSXMLSerializer::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSXMLSerializer, Base>(exec, &JSXMLSerializerTable, this, propertyName, slot);
 }
 
+bool JSXMLSerializer::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSXMLSerializer, Base>(exec, &JSXMLSerializerTable, this, propertyName, descriptor);
+}
+
 JSValue jsXMLSerializerConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSXMLSerializer* domObject = static_cast<JSXMLSerializer*>(asObject(slot.slotBase()));
@@ -159,7 +175,7 @@ JSValue JSXMLSerializer::getConstructor(ExecState* exec, JSGlobalObject* globalO
 JSValue JSC_HOST_CALL jsXMLSerializerPrototypeFunctionSerializeToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSXMLSerializer::s_info))
+    if (!thisValue.inherits(&JSXMLSerializer::s_info))
         return throwError(exec, TypeError);
     JSXMLSerializer* castedThisObj = static_cast<JSXMLSerializer*>(asObject(thisValue));
     XMLSerializer* imp = static_cast<XMLSerializer*>(castedThisObj->impl());
@@ -178,7 +194,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, XMLSeri
 }
 XMLSerializer* toXMLSerializer(JSC::JSValue value)
 {
-    return value.isObject(&JSXMLSerializer::s_info) ? static_cast<JSXMLSerializer*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSXMLSerializer::s_info) ? static_cast<JSXMLSerializer*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.h b/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.h
index 9f4fabc..40e6ccf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.h
@@ -37,6 +37,7 @@ public:
     virtual ~JSXMLSerializer();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -62,9 +63,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSXMLSerializerPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.cpp
index be242bd..33e8643 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.cpp
@@ -80,6 +80,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSXPathEvaluatorPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -105,6 +106,11 @@ bool JSXPathEvaluatorConstructor::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticValueSlot<JSXPathEvaluatorConstructor, DOMObject>(exec, &JSXPathEvaluatorConstructorTable, this, propertyName, slot);
 }
 
+bool JSXPathEvaluatorConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSXPathEvaluatorConstructor, DOMObject>(exec, &JSXPathEvaluatorConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSXPathEvaluatorPrototypeTableValues[4] =
@@ -134,6 +140,11 @@ bool JSXPathEvaluatorPrototype::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticFunctionSlot<JSObject>(exec, &JSXPathEvaluatorPrototypeTable, this, propertyName, slot);
 }
 
+bool JSXPathEvaluatorPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSXPathEvaluatorPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSXPathEvaluator::s_info = { "XPathEvaluator", 0, &JSXPathEvaluatorTable, 0 };
 
 JSXPathEvaluator::JSXPathEvaluator(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<XPathEvaluator> impl)
@@ -157,6 +168,11 @@ bool JSXPathEvaluator::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSXPathEvaluator, Base>(exec, &JSXPathEvaluatorTable, this, propertyName, slot);
 }
 
+bool JSXPathEvaluator::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSXPathEvaluator, Base>(exec, &JSXPathEvaluatorTable, this, propertyName, descriptor);
+}
+
 JSValue jsXPathEvaluatorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSXPathEvaluator* domObject = static_cast<JSXPathEvaluator*>(asObject(slot.slotBase()));
@@ -170,7 +186,7 @@ JSValue JSXPathEvaluator::getConstructor(ExecState* exec, JSGlobalObject* global
 JSValue JSC_HOST_CALL jsXPathEvaluatorPrototypeFunctionCreateExpression(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSXPathEvaluator::s_info))
+    if (!thisValue.inherits(&JSXPathEvaluator::s_info))
         return throwError(exec, TypeError);
     JSXPathEvaluator* castedThisObj = static_cast<JSXPathEvaluator*>(asObject(thisValue));
     XPathEvaluator* imp = static_cast<XPathEvaluator*>(castedThisObj->impl());
@@ -194,7 +210,7 @@ JSValue JSC_HOST_CALL jsXPathEvaluatorPrototypeFunctionCreateExpression(ExecStat
 JSValue JSC_HOST_CALL jsXPathEvaluatorPrototypeFunctionCreateNSResolver(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSXPathEvaluator::s_info))
+    if (!thisValue.inherits(&JSXPathEvaluator::s_info))
         return throwError(exec, TypeError);
     JSXPathEvaluator* castedThisObj = static_cast<JSXPathEvaluator*>(asObject(thisValue));
     XPathEvaluator* imp = static_cast<XPathEvaluator*>(castedThisObj->impl());
@@ -208,7 +224,7 @@ JSValue JSC_HOST_CALL jsXPathEvaluatorPrototypeFunctionCreateNSResolver(ExecStat
 JSValue JSC_HOST_CALL jsXPathEvaluatorPrototypeFunctionEvaluate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSXPathEvaluator::s_info))
+    if (!thisValue.inherits(&JSXPathEvaluator::s_info))
         return throwError(exec, TypeError);
     JSXPathEvaluator* castedThisObj = static_cast<JSXPathEvaluator*>(asObject(thisValue));
     XPathEvaluator* imp = static_cast<XPathEvaluator*>(castedThisObj->impl());
@@ -238,7 +254,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, XPathEv
 }
 XPathEvaluator* toXPathEvaluator(JSC::JSValue value)
 {
-    return value.isObject(&JSXPathEvaluator::s_info) ? static_cast<JSXPathEvaluator*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSXPathEvaluator::s_info) ? static_cast<JSXPathEvaluator*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.h b/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.h
index 3a860dc..081a98e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.h
@@ -39,6 +39,7 @@ public:
     virtual ~JSXPathEvaluator();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -64,9 +65,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSXPathEvaluatorPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathException.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathException.cpp
index f4864f9..d822318 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathException.cpp
@@ -79,6 +79,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSXPathExceptionPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -95,6 +96,11 @@ bool JSXPathExceptionConstructor::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticValueSlot<JSXPathExceptionConstructor, DOMObject>(exec, &JSXPathExceptionConstructorTable, this, propertyName, slot);
 }
 
+bool JSXPathExceptionConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSXPathExceptionConstructor, DOMObject>(exec, &JSXPathExceptionConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSXPathExceptionPrototypeTableValues[4] =
@@ -124,6 +130,11 @@ bool JSXPathExceptionPrototype::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticPropertySlot<JSXPathExceptionPrototype, JSObject>(exec, &JSXPathExceptionPrototypeTable, this, propertyName, slot);
 }
 
+bool JSXPathExceptionPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSXPathExceptionPrototype, JSObject>(exec, &JSXPathExceptionPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSXPathException::s_info = { "XPathException", 0, &JSXPathExceptionTable, 0 };
 
 JSXPathException::JSXPathException(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<XPathException> impl)
@@ -147,6 +158,11 @@ bool JSXPathException::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSXPathException, Base>(exec, &JSXPathExceptionTable, this, propertyName, slot);
 }
 
+bool JSXPathException::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSXPathException, Base>(exec, &JSXPathExceptionTable, this, propertyName, descriptor);
+}
+
 JSValue jsXPathExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSXPathException* castedThis = static_cast<JSXPathException*>(asObject(slot.slotBase()));
@@ -184,7 +200,7 @@ JSValue JSXPathException::getConstructor(ExecState* exec, JSGlobalObject* global
 JSValue JSC_HOST_CALL jsXPathExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSXPathException::s_info))
+    if (!thisValue.inherits(&JSXPathException::s_info))
         return throwError(exec, TypeError);
     JSXPathException* castedThisObj = static_cast<JSXPathException*>(asObject(thisValue));
     XPathException* imp = static_cast<XPathException*>(castedThisObj->impl());
@@ -212,7 +228,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, XPathEx
 }
 XPathException* toXPathException(JSC::JSValue value)
 {
-    return value.isObject(&JSXPathException::s_info) ? static_cast<JSXPathException*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSXPathException::s_info) ? static_cast<JSXPathException*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathException.h b/src/3rdparty/webkit/WebCore/generated/JSXPathException.h
index 370ef36..a2b7785 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathException.h
@@ -39,6 +39,7 @@ public:
     virtual ~JSXPathException();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -64,9 +65,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSXPathExceptionPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.cpp
index 286b257..a5f4ce3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.cpp
@@ -74,6 +74,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSXPathExpressionPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -90,6 +91,11 @@ bool JSXPathExpressionConstructor::getOwnPropertySlot(ExecState* exec, const Ide
     return getStaticValueSlot<JSXPathExpressionConstructor, DOMObject>(exec, &JSXPathExpressionConstructorTable, this, propertyName, slot);
 }
 
+bool JSXPathExpressionConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSXPathExpressionConstructor, DOMObject>(exec, &JSXPathExpressionConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSXPathExpressionPrototypeTableValues[2] =
@@ -117,6 +123,11 @@ bool JSXPathExpressionPrototype::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticFunctionSlot<JSObject>(exec, &JSXPathExpressionPrototypeTable, this, propertyName, slot);
 }
 
+bool JSXPathExpressionPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSXPathExpressionPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSXPathExpression::s_info = { "XPathExpression", 0, &JSXPathExpressionTable, 0 };
 
 JSXPathExpression::JSXPathExpression(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<XPathExpression> impl)
@@ -140,6 +151,11 @@ bool JSXPathExpression::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSXPathExpression, Base>(exec, &JSXPathExpressionTable, this, propertyName, slot);
 }
 
+bool JSXPathExpression::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSXPathExpression, Base>(exec, &JSXPathExpressionTable, this, propertyName, descriptor);
+}
+
 JSValue jsXPathExpressionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSXPathExpression* domObject = static_cast<JSXPathExpression*>(asObject(slot.slotBase()));
@@ -153,7 +169,7 @@ JSValue JSXPathExpression::getConstructor(ExecState* exec, JSGlobalObject* globa
 JSValue JSC_HOST_CALL jsXPathExpressionPrototypeFunctionEvaluate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSXPathExpression::s_info))
+    if (!thisValue.inherits(&JSXPathExpression::s_info))
         return throwError(exec, TypeError);
     JSXPathExpression* castedThisObj = static_cast<JSXPathExpression*>(asObject(thisValue));
     XPathExpression* imp = static_cast<XPathExpression*>(castedThisObj->impl());
@@ -174,7 +190,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, XPathEx
 }
 XPathExpression* toXPathExpression(JSC::JSValue value)
 {
-    return value.isObject(&JSXPathExpression::s_info) ? static_cast<JSXPathExpression*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSXPathExpression::s_info) ? static_cast<JSXPathExpression*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.h b/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.h
index 082560c..0b6aa02 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.h
@@ -39,6 +39,7 @@ public:
     virtual ~JSXPathExpression();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -64,9 +65,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSXPathExpressionPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.cpp
index 2943d17..e9dbaa0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.cpp
@@ -64,6 +64,11 @@ bool JSXPathNSResolverPrototype::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticFunctionSlot<JSObject>(exec, &JSXPathNSResolverPrototypeTable, this, propertyName, slot);
 }
 
+bool JSXPathNSResolverPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSXPathNSResolverPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSXPathNSResolver::s_info = { "XPathNSResolver", 0, 0, 0 };
 
 JSXPathNSResolver::JSXPathNSResolver(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<XPathNSResolver> impl)
@@ -85,7 +90,7 @@ JSObject* JSXPathNSResolver::createPrototype(ExecState* exec, JSGlobalObject* gl
 JSValue JSC_HOST_CALL jsXPathNSResolverPrototypeFunctionLookupNamespaceURI(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSXPathNSResolver::s_info))
+    if (!thisValue.inherits(&JSXPathNSResolver::s_info))
         return throwError(exec, TypeError);
     JSXPathNSResolver* castedThisObj = static_cast<JSXPathNSResolver*>(asObject(thisValue));
     XPathNSResolver* imp = static_cast<XPathNSResolver*>(castedThisObj->impl());
@@ -102,7 +107,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, XPathNS
 }
 XPathNSResolver* toXPathNSResolver(JSC::JSValue value)
 {
-    return value.isObject(&JSXPathNSResolver::s_info) ? static_cast<JSXPathNSResolver*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSXPathNSResolver::s_info) ? static_cast<JSXPathNSResolver*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.h b/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.h
index f0bb95b..b126eaf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.h
@@ -57,9 +57,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSXPathNSResolverPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathResult.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathResult.cpp
index c969067..44f7bdd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathResult.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathResult.cpp
@@ -93,6 +93,7 @@ public:
         putDirect(exec->propertyNames().prototype, JSXPathResultPrototype::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -109,6 +110,11 @@ bool JSXPathResultConstructor::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticValueSlot<JSXPathResultConstructor, DOMObject>(exec, &JSXPathResultConstructorTable, this, propertyName, slot);
 }
 
+bool JSXPathResultConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSXPathResultConstructor, DOMObject>(exec, &JSXPathResultConstructorTable, this, propertyName, descriptor);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSXPathResultPrototypeTableValues[13] =
@@ -147,6 +153,11 @@ bool JSXPathResultPrototype::getOwnPropertySlot(ExecState* exec, const Identifie
     return getStaticPropertySlot<JSXPathResultPrototype, JSObject>(exec, &JSXPathResultPrototypeTable, this, propertyName, slot);
 }
 
+bool JSXPathResultPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticPropertyDescriptor<JSXPathResultPrototype, JSObject>(exec, &JSXPathResultPrototypeTable, this, propertyName, descriptor);
+}
+
 const ClassInfo JSXPathResult::s_info = { "XPathResult", 0, &JSXPathResultTable, 0 };
 
 JSXPathResult::JSXPathResult(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<XPathResult> impl)
@@ -170,6 +181,11 @@ bool JSXPathResult::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSXPathResult, Base>(exec, &JSXPathResultTable, this, propertyName, slot);
 }
 
+bool JSXPathResult::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSXPathResult, Base>(exec, &JSXPathResultTable, this, propertyName, descriptor);
+}
+
 JSValue jsXPathResultResultType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSXPathResult* castedThis = static_cast<JSXPathResult*>(asObject(slot.slotBase()));
@@ -249,7 +265,7 @@ JSValue JSXPathResult::getConstructor(ExecState* exec, JSGlobalObject* globalObj
 JSValue JSC_HOST_CALL jsXPathResultPrototypeFunctionIterateNext(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSXPathResult::s_info))
+    if (!thisValue.inherits(&JSXPathResult::s_info))
         return throwError(exec, TypeError);
     JSXPathResult* castedThisObj = static_cast<JSXPathResult*>(asObject(thisValue));
     XPathResult* imp = static_cast<XPathResult*>(castedThisObj->impl());
@@ -264,7 +280,7 @@ JSValue JSC_HOST_CALL jsXPathResultPrototypeFunctionIterateNext(ExecState* exec,
 JSValue JSC_HOST_CALL jsXPathResultPrototypeFunctionSnapshotItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
-    if (!thisValue.isObject(&JSXPathResult::s_info))
+    if (!thisValue.inherits(&JSXPathResult::s_info))
         return throwError(exec, TypeError);
     JSXPathResult* castedThisObj = static_cast<JSXPathResult*>(asObject(thisValue));
     XPathResult* imp = static_cast<XPathResult*>(castedThisObj->impl());
@@ -335,7 +351,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, XPathRe
 }
 XPathResult* toXPathResult(JSC::JSValue value)
 {
-    return value.isObject(&JSXPathResult::s_info) ? static_cast<JSXPathResult*>(asObject(value))->impl() : 0;
+    return value.inherits(&JSXPathResult::s_info) ? static_cast<JSXPathResult*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathResult.h b/src/3rdparty/webkit/WebCore/generated/JSXPathResult.h
index c63c32f..f595915 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathResult.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathResult.h
@@ -39,6 +39,7 @@ public:
     virtual ~JSXPathResult();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -64,9 +65,10 @@ public:
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
     }
     JSXPathResultPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.cpp b/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.cpp
new file mode 100644
index 0000000..9e5ccd3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.cpp
@@ -0,0 +1,186 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(XSLT)
+
+#include "JSXSLTProcessor.h"
+
+#include "Document.h"
+#include "DocumentFragment.h"
+#include "NodeFilter.h"
+#include "XSLTProcessor.h"
+#include <runtime/Error.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSXSLTProcessor);
+
+/* Hash table for prototype */
+
+static const HashTableValue JSXSLTProcessorPrototypeTableValues[9] =
+{
+    { "importStylesheet", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionImportStylesheet, (intptr_t)1 },
+    { "transformToFragment", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionTransformToFragment, (intptr_t)2 },
+    { "transformToDocument", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionTransformToDocument, (intptr_t)1 },
+    { "setParameter", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionSetParameter, (intptr_t)3 },
+    { "getParameter", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionGetParameter, (intptr_t)2 },
+    { "removeParameter", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionRemoveParameter, (intptr_t)2 },
+    { "clearParameters", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionClearParameters, (intptr_t)0 },
+    { "reset", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionReset, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSXSLTProcessorPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 63, JSXSLTProcessorPrototypeTableValues, 0 };
+#else
+    { 17, 15, JSXSLTProcessorPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSXSLTProcessorPrototype::s_info = { "XSLTProcessorPrototype", 0, &JSXSLTProcessorPrototypeTable, 0 };
+
+JSObject* JSXSLTProcessorPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSXSLTProcessor>(exec, globalObject);
+}
+
+bool JSXSLTProcessorPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSXSLTProcessorPrototypeTable, this, propertyName, slot);
+}
+
+bool JSXSLTProcessorPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSXSLTProcessorPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSXSLTProcessor::s_info = { "XSLTProcessor", 0, 0, 0 };
+
+JSXSLTProcessor::JSXSLTProcessor(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<XSLTProcessor> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
+    , m_impl(impl)
+{
+}
+
+JSXSLTProcessor::~JSXSLTProcessor()
+{
+    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+}
+
+JSObject* JSXSLTProcessor::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSXSLTProcessorPrototype(JSXSLTProcessorPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+JSValue JSC_HOST_CALL jsXSLTProcessorPrototypeFunctionImportStylesheet(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSXSLTProcessor::s_info))
+        return throwError(exec, TypeError);
+    JSXSLTProcessor* castedThisObj = static_cast<JSXSLTProcessor*>(asObject(thisValue));
+    return castedThisObj->importStylesheet(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsXSLTProcessorPrototypeFunctionTransformToFragment(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSXSLTProcessor::s_info))
+        return throwError(exec, TypeError);
+    JSXSLTProcessor* castedThisObj = static_cast<JSXSLTProcessor*>(asObject(thisValue));
+    return castedThisObj->transformToFragment(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsXSLTProcessorPrototypeFunctionTransformToDocument(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSXSLTProcessor::s_info))
+        return throwError(exec, TypeError);
+    JSXSLTProcessor* castedThisObj = static_cast<JSXSLTProcessor*>(asObject(thisValue));
+    return castedThisObj->transformToDocument(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsXSLTProcessorPrototypeFunctionSetParameter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSXSLTProcessor::s_info))
+        return throwError(exec, TypeError);
+    JSXSLTProcessor* castedThisObj = static_cast<JSXSLTProcessor*>(asObject(thisValue));
+    return castedThisObj->setParameter(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsXSLTProcessorPrototypeFunctionGetParameter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSXSLTProcessor::s_info))
+        return throwError(exec, TypeError);
+    JSXSLTProcessor* castedThisObj = static_cast<JSXSLTProcessor*>(asObject(thisValue));
+    return castedThisObj->getParameter(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsXSLTProcessorPrototypeFunctionRemoveParameter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSXSLTProcessor::s_info))
+        return throwError(exec, TypeError);
+    JSXSLTProcessor* castedThisObj = static_cast<JSXSLTProcessor*>(asObject(thisValue));
+    return castedThisObj->removeParameter(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsXSLTProcessorPrototypeFunctionClearParameters(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSXSLTProcessor::s_info))
+        return throwError(exec, TypeError);
+    JSXSLTProcessor* castedThisObj = static_cast<JSXSLTProcessor*>(asObject(thisValue));
+    XSLTProcessor* imp = static_cast<XSLTProcessor*>(castedThisObj->impl());
+
+    imp->clearParameters();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsXSLTProcessorPrototypeFunctionReset(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSXSLTProcessor::s_info))
+        return throwError(exec, TypeError);
+    JSXSLTProcessor* castedThisObj = static_cast<JSXSLTProcessor*>(asObject(thisValue));
+    XSLTProcessor* imp = static_cast<XSLTProcessor*>(castedThisObj->impl());
+
+    imp->reset();
+    return jsUndefined();
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, XSLTProcessor* object)
+{
+    return getDOMObjectWrapper<JSXSLTProcessor>(exec, globalObject, object);
+}
+XSLTProcessor* toXSLTProcessor(JSC::JSValue value)
+{
+    return value.inherits(&JSXSLTProcessor::s_info) ? static_cast<JSXSLTProcessor*>(asObject(value))->impl() : 0;
+}
+
+}
+
+#endif // ENABLE(XSLT)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.h b/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.h
new file mode 100644
index 0000000..34215aa
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.h
@@ -0,0 +1,91 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSXSLTProcessor_h
+#define JSXSLTProcessor_h
+
+#if ENABLE(XSLT)
+
+#include "DOMObjectWithSVGContext.h"
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class XSLTProcessor;
+
+class JSXSLTProcessor : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
+public:
+    JSXSLTProcessor(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<XSLTProcessor>);
+    virtual ~JSXSLTProcessor();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+
+    // Custom functions
+    JSC::JSValue importStylesheet(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue transformToFragment(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue transformToDocument(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setParameter(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue getParameter(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeParameter(JSC::ExecState*, const JSC::ArgList&);
+    XSLTProcessor* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<XSLTProcessor> m_impl;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, XSLTProcessor*);
+XSLTProcessor* toXSLTProcessor(JSC::JSValue);
+
+class JSXSLTProcessorPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+    }
+    JSXSLTProcessorPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsXSLTProcessorPrototypeFunctionImportStylesheet(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXSLTProcessorPrototypeFunctionTransformToFragment(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXSLTProcessorPrototypeFunctionTransformToDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXSLTProcessorPrototypeFunctionSetParameter(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXSLTProcessorPrototypeFunctionGetParameter(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXSLTProcessorPrototypeFunctionRemoveParameter(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXSLTProcessorPrototypeFunctionClearParameters(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXSLTProcessorPrototypeFunctionReset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+
+} // namespace WebCore
+
+#endif // ENABLE(XSLT)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/SVGElementFactory.cpp b/src/3rdparty/webkit/WebCore/generated/SVGElementFactory.cpp
index 3b5318b..fb93b9b 100644
--- a/src/3rdparty/webkit/WebCore/generated/SVGElementFactory.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/SVGElementFactory.cpp
@@ -1,8 +1,9 @@
 /*
- * THIS FILE IS AUTOMATICALLY GENERATED, DO NOT EDIT.
+ * THIS FILE WAS AUTOMATICALLY GENERATED, DO NOT EDIT.
  *
+ * This file was generated by the dom/make_names.pl script.
  *
- * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,19 +24,13 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-
 #include "config.h"
 #include "SVGElementFactory.h"
 
 #include "SVGNames.h"
-#if ENABLE(DASHBOARD_SUPPORT)
-#include "Document.h"
-#include "Settings.h"
-#endif
-
 #include "SVGAElement.h"
 #include "SVGAltGlyphElement.h"
 #include "SVGAnimateElement.h"
@@ -45,7 +40,6 @@
 #include "SVGCircleElement.h"
 #include "SVGClipPathElement.h"
 #include "SVGCursorElement.h"
-#include "SVGDefinitionSrcElement.h"
 #include "SVGDefsElement.h"
 #include "SVGDescElement.h"
 #include "SVGEllipseElement.h"
@@ -89,6 +83,11 @@
 #include "SVGViewElement.h"
 #include <wtf/HashMap.h>
 
+#if ENABLE(DASHBOARD_SUPPORT)
+#include "Document.h"
+#include "Settings.h"
+#endif
+
 namespace WebCore {
 
 using namespace SVGNames;
@@ -99,259 +98,254 @@ typedef HashMap<AtomicStringImpl*, ConstructorFunction> FunctionMap;
 static FunctionMap* gFunctionMap = 0;
 
 #if ENABLE(SVG)
-static PassRefPtr<SVGElement> aConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> aConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGAElement(tagName, doc);
+    return new SVGAElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> altglyphConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> altglyphConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGAltGlyphElement(tagName, doc);
+    return new SVGAltGlyphElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> animateConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> animateConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGAnimateElement(tagName, doc);
+    return new SVGAnimateElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> animatecolorConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> animatecolorConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGAnimateColorElement(tagName, doc);
+    return new SVGAnimateColorElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> animatemotionConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> animatemotionConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGAnimateMotionElement(tagName, doc);
+    return new SVGAnimateMotionElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> animatetransformConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> animatetransformConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGAnimateTransformElement(tagName, doc);
+    return new SVGAnimateTransformElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> circleConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> circleConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGCircleElement(tagName, doc);
+    return new SVGCircleElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> clippathConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> clippathConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGClipPathElement(tagName, doc);
+    return new SVGClipPathElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> cursorConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> cursorConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGCursorElement(tagName, doc);
+    return new SVGCursorElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> definitionsrcConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> defsConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGDefinitionSrcElement(tagName, doc);
+    return new SVGDefsElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> defsConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> descConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGDefsElement(tagName, doc);
+    return new SVGDescElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> descConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> ellipseConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGDescElement(tagName, doc);
+    return new SVGEllipseElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> ellipseConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> fontConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGEllipseElement(tagName, doc);
+    return new SVGFontElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> fontConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> fontfaceConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGFontElement(tagName, doc);
+    return new SVGFontFaceElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> fontfaceConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> fontfaceformatConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGFontFaceElement(tagName, doc);
+    return new SVGFontFaceFormatElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> fontfaceformatConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> fontfacenameConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGFontFaceFormatElement(tagName, doc);
+    return new SVGFontFaceNameElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> fontfacenameConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> fontfacesrcConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGFontFaceNameElement(tagName, doc);
+    return new SVGFontFaceSrcElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> fontfacesrcConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> fontfaceuriConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGFontFaceSrcElement(tagName, doc);
+    return new SVGFontFaceUriElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> fontfaceuriConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> foreignobjectConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGFontFaceUriElement(tagName, doc);
+    return new SVGForeignObjectElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> foreignobjectConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> gConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGForeignObjectElement(tagName, doc);
+    return new SVGGElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> gConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> glyphConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGGElement(tagName, doc);
+    return new SVGGlyphElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> glyphConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> hkernConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGGlyphElement(tagName, doc);
+    return new SVGHKernElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> hkernConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> imageConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGHKernElement(tagName, doc);
+    return new SVGImageElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> imageConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> lineConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGImageElement(tagName, doc);
+    return new SVGLineElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> lineConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> lineargradientConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGLineElement(tagName, doc);
+    return new SVGLinearGradientElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> lineargradientConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> markerConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGLinearGradientElement(tagName, doc);
+    return new SVGMarkerElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> markerConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> maskConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGMarkerElement(tagName, doc);
+    return new SVGMaskElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> maskConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> metadataConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGMaskElement(tagName, doc);
+    return new SVGMetadataElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> metadataConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> missingglyphConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGMetadataElement(tagName, doc);
+    return new SVGMissingGlyphElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> missingglyphConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> mpathConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGMissingGlyphElement(tagName, doc);
+    return new SVGMPathElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> mpathConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> pathConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGMPathElement(tagName, doc);
+    return new SVGPathElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> pathConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> patternConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGPathElement(tagName, doc);
+    return new SVGPatternElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> patternConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> polygonConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGPatternElement(tagName, doc);
+    return new SVGPolygonElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> polygonConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> polylineConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGPolygonElement(tagName, doc);
+    return new SVGPolylineElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> polylineConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> radialgradientConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGPolylineElement(tagName, doc);
+    return new SVGRadialGradientElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> radialgradientConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> rectConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGRadialGradientElement(tagName, doc);
+    return new SVGRectElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> rectConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> scriptConstructor(const QualifiedName& tagName, Document* document, bool createdByParser)
 {
-    return new SVGRectElement(tagName, doc);
+    return new SVGScriptElement(tagName, document, createdByParser);
 }
 
-static PassRefPtr<SVGElement> scriptConstructor(const QualifiedName& tagName, Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> setConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGScriptElement(tagName, doc, createdByParser);
+    return new SVGSetElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> setConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> stopConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGSetElement(tagName, doc);
+    return new SVGStopElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> stopConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> styleConstructor(const QualifiedName& tagName, Document* document, bool createdByParser)
 {
-    return new SVGStopElement(tagName, doc);
+    return new SVGStyleElement(tagName, document, createdByParser);
 }
 
-static PassRefPtr<SVGElement> styleConstructor(const QualifiedName& tagName, Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> svgConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGStyleElement(tagName, doc, createdByParser);
+    return new SVGSVGElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> svgConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> switchConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGSVGElement(tagName, doc);
+    return new SVGSwitchElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> switchConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> symbolConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGSwitchElement(tagName, doc);
+    return new SVGSymbolElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> symbolConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> textConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGSymbolElement(tagName, doc);
+    return new SVGTextElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> textConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> textpathConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGTextElement(tagName, doc);
+    return new SVGTextPathElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> textpathConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> titleConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGTextPathElement(tagName, doc);
+    return new SVGTitleElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> titleConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> trefConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGTitleElement(tagName, doc);
+    return new SVGTRefElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> trefConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> tspanConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGTRefElement(tagName, doc);
+    return new SVGTSpanElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> tspanConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> useConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGTSpanElement(tagName, doc);
+    return new SVGUseElement(tagName, document);
 }
 
-static PassRefPtr<SVGElement> useConstructor(const QualifiedName& tagName, Document* doc, bool)
+static PassRefPtr<SVGElement> viewConstructor(const QualifiedName& tagName, Document* document, bool)
 {
-    return new SVGUseElement(tagName, doc);
-}
-
-static PassRefPtr<SVGElement> viewConstructor(const QualifiedName& tagName, Document* doc, bool)
-{
-    return new SVGViewElement(tagName, doc);
+    return new SVGViewElement(tagName, document);
 }
 
 #endif
@@ -361,10 +355,10 @@ static void addTag(const QualifiedName& tag, ConstructorFunction func)
     gFunctionMap->set(tag.localName().impl(), func);
 }
 
-static inline void createFunctionMapIfNecessary()
+static void createFunctionMap()
 {
-    if (gFunctionMap)
-        return;
+    ASSERT(!gFunctionMap);
+
     // Create the table.
     gFunctionMap = new FunctionMap;
     
@@ -378,7 +372,6 @@ static inline void createFunctionMapIfNecessary()
     addTag(circleTag, circleConstructor);
     addTag(clipPathTag, clippathConstructor);
     addTag(cursorTag, cursorConstructor);
-    addTag(definition_srcTag, definitionsrcConstructor);
     addTag(defsTag, defsConstructor);
     addTag(descTag, descConstructor);
     addTag(ellipseTag, ellipseConstructor);
@@ -423,23 +416,22 @@ static inline void createFunctionMapIfNecessary()
 }
 #endif
 
-PassRefPtr<SVGElement> SVGElementFactory::createSVGElement(const QualifiedName& qName, Document* doc, bool createdByParser)
+PassRefPtr<SVGElement> SVGElementFactory::createSVGElement(const QualifiedName& qName, Document* document, bool createdByParser)
 {
 #if ENABLE(SVG)
-    // Don't make elements without a document
-    if (!doc)
+    if (!document)
         return 0;
 
 #if ENABLE(DASHBOARD_SUPPORT)
-    Settings* settings = doc->settings();
+    Settings* settings = document->settings();
     if (settings && settings->usesDashboardBackwardCompatibilityMode())
         return 0;
 #endif
-    createFunctionMapIfNecessary();
-    ConstructorFunction func = gFunctionMap->get(qName.localName().impl());
-    if (func)
-        return func(qName, doc, createdByParser);
-    return new SVGElement(qName, doc);
+    if (!gFunctionMap)
+        createFunctionMap();
+    if (ConstructorFunction function = gFunctionMap->get(qName.localName().impl()))
+        return function(qName, document, createdByParser);
+    return SVGElement::create(qName, document);
 #else
     return 0;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/SVGElementFactory.h b/src/3rdparty/webkit/WebCore/generated/SVGElementFactory.h
index edbf308..12ffb3f 100644
--- a/src/3rdparty/webkit/WebCore/generated/SVGElementFactory.h
+++ b/src/3rdparty/webkit/WebCore/generated/SVGElementFactory.h
@@ -1,8 +1,9 @@
 /*
- * THIS FILE IS AUTOMATICALLY GENERATED, DO NOT EDIT.
+ * THIS FILE WAS AUTOMATICALLY GENERATED, DO NOT EDIT.
  *
+ * This file was generated by the dom/make_names.pl script.
  *
- * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,10 +24,9 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-
 #ifndef SVGElementFactory_h
 #define SVGElementFactory_h
 
diff --git a/src/3rdparty/webkit/WebCore/generated/SVGNames.cpp b/src/3rdparty/webkit/WebCore/generated/SVGNames.cpp
index 445a59f..f5706be 100644
--- a/src/3rdparty/webkit/WebCore/generated/SVGNames.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/SVGNames.cpp
@@ -1,8 +1,9 @@
 /*
- * THIS FILE IS AUTOMATICALLY GENERATED, DO NOT EDIT.
+ * THIS FILE WAS AUTOMATICALLY GENERATED, DO NOT EDIT.
  *
+ * This file was generated by the dom/make_names.pl script.
  *
- * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,10 +24,9 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-
 #include "config.h"
 #ifdef SKIP_STATIC_CONSTRUCTORS_ON_GCC
 #define DOM_SVGNAMES_HIDE_GLOBALS 1
@@ -54,7 +54,6 @@ DEFINE_GLOBAL(QualifiedName, animateTransformTag, nullAtom, "animateTransform",
 DEFINE_GLOBAL(QualifiedName, circleTag, nullAtom, "circle", svgNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, clipPathTag, nullAtom, "clipPath", svgNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, cursorTag, nullAtom, "cursor", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, definition_srcTag, nullAtom, "definition_src", svgNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, defsTag, nullAtom, "defs", svgNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, descTag, nullAtom, "desc", svgNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, ellipseTag, nullAtom, "ellipse", svgNamespaceURI);
@@ -110,7 +109,6 @@ WebCore::QualifiedName** getSVGTags(size_t* size)
         (WebCore::QualifiedName*)&circleTag,
         (WebCore::QualifiedName*)&clipPathTag,
         (WebCore::QualifiedName*)&cursorTag,
-        (WebCore::QualifiedName*)&definition_srcTag,
         (WebCore::QualifiedName*)&defsTag,
         (WebCore::QualifiedName*)&descTag,
         (WebCore::QualifiedName*)&ellipseTag,
@@ -153,7 +151,7 @@ WebCore::QualifiedName** getSVGTags(size_t* size)
         (WebCore::QualifiedName*)&useTag,
         (WebCore::QualifiedName*)&viewTag,
     };
-    *size = 51;
+    *size = 50;
     return SVGTags;
 }
 
@@ -672,7 +670,6 @@ char animateTransformTagString[] = "animateTransform";
 char circleTagString[] = "circle";
 char clipPathTagString[] = "clipPath";
 char cursorTagString[] = "cursor";
-char definition_srcTagString[] = "definition-src";
 char defsTagString[] = "defs";
 char descTagString[] = "desc";
 char ellipseTagString[] = "ellipse";
@@ -989,7 +986,6 @@ void init()
     new ((void*)&circleTag) QualifiedName(nullAtom, circleTagString, svgNS);
     new ((void*)&clipPathTag) QualifiedName(nullAtom, clipPathTagString, svgNS);
     new ((void*)&cursorTag) QualifiedName(nullAtom, cursorTagString, svgNS);
-    new ((void*)&definition_srcTag) QualifiedName(nullAtom, definition_srcTagString, svgNS);
     new ((void*)&defsTag) QualifiedName(nullAtom, defsTagString, svgNS);
     new ((void*)&descTag) QualifiedName(nullAtom, descTagString, svgNS);
     new ((void*)&ellipseTag) QualifiedName(nullAtom, ellipseTagString, svgNS);
diff --git a/src/3rdparty/webkit/WebCore/generated/SVGNames.h b/src/3rdparty/webkit/WebCore/generated/SVGNames.h
index 89703ff..9fbd740 100644
--- a/src/3rdparty/webkit/WebCore/generated/SVGNames.h
+++ b/src/3rdparty/webkit/WebCore/generated/SVGNames.h
@@ -1,8 +1,9 @@
 /*
- * THIS FILE IS AUTOMATICALLY GENERATED, DO NOT EDIT.
+ * THIS FILE WAS AUTOMATICALLY GENERATED, DO NOT EDIT.
  *
+ * This file was generated by the dom/make_names.pl script.
  *
- * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,10 +24,9 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-
 #ifndef DOM_SVGNAMES_H
 #define DOM_SVGNAMES_H
 
@@ -59,8 +59,6 @@ extern const WebCore::QualifiedName clipPathTag;
 extern char clipPathTagString[];
 extern const WebCore::QualifiedName cursorTag;
 extern char cursorTagString[];
-extern const WebCore::QualifiedName definition_srcTag;
-extern char definition_srcTagString[];
 extern const WebCore::QualifiedName defsTag;
 extern char defsTagString[];
 extern const WebCore::QualifiedName descTag;
diff --git a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h
index dfc9f6d..6f0af23 100644
--- a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h
+++ b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h
@@ -1,8 +1,8 @@
 namespace WebCore {
-extern const char htmlUserAgentStyleSheet[8548];
+extern const char htmlUserAgentStyleSheet[8636];
 extern const char quirksUserAgentStyleSheet[359];
 extern const char svgUserAgentStyleSheet[358];
 extern const char sourceUserAgentStyleSheet[2004];
-extern const char wmlUserAgentStyleSheet[2956];
-extern const char mediaControlsUserAgentStyleSheet[2346];
+extern const char wmlUserAgentStyleSheet[3039];
+extern const char mediaControlsUserAgentStyleSheet[2582];
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp
index 53f1f84..8b8d7f3 100644
--- a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp
@@ -1,5 +1,5 @@
 namespace WebCore {
-extern const char htmlUserAgentStyleSheet[8548] = {
+extern const char htmlUserAgentStyleSheet[8636] = {
     110, 97, 109, 101, 115, 112, 97, 99, 101, 32, 34, 104, 116, 116, 112, 58,
     47, 47, 119, 119, 119, 46, 119, 51, 46, 111, 114, 103, 47, 49, 57, 57,
     57, 47, 120, 104, 116, 109, 108, 34, 59, 32, 104, 116, 109, 108, 32, 123,
@@ -21,520 +21,525 @@ extern const char htmlUserAgentStyleSheet[8548] = {
     100, 105, 118, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 98,
     108, 111, 99, 107, 32, 125, 32, 108, 97, 121, 101, 114, 32, 123, 32, 100,
     105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 32, 125, 32,
-    109, 97, 114, 113, 117, 101, 101, 32, 123, 32, 100, 105, 115, 112, 108, 97,
-    121, 58, 32, 105, 110, 108, 105, 110, 101, 45, 98, 108, 111, 99, 107, 59,
-    32, 111, 118, 101, 114, 102, 108, 111, 119, 58, 32, 45, 119, 101, 98, 107,
-    105, 116, 45, 109, 97, 114, 113, 117, 101, 101, 32, 125, 32, 97, 100, 100,
-    114, 101, 115, 115, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32,
-    98, 108, 111, 99, 107, 32, 125, 32, 98, 108, 111, 99, 107, 113, 117, 111,
-    116, 101, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 98, 108,
-    111, 99, 107, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 49, 95, 95,
-    113, 101, 109, 32, 52, 48, 112, 120, 32, 49, 101, 109, 32, 52, 48, 112,
-    120, 32, 125, 32, 113, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58,
-    32, 105, 110, 108, 105, 110, 101, 32, 125, 32, 113, 58, 98, 101, 102, 111,
-    114, 101, 32, 123, 32, 99, 111, 110, 116, 101, 110, 116, 58, 32, 39, 34,
-    39, 32, 125, 32, 113, 58, 97, 102, 116, 101, 114, 32, 123, 32, 99, 111,
-    110, 116, 101, 110, 116, 58, 32, 39, 34, 39, 32, 125, 32, 99, 101, 110,
-    116, 101, 114, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 98,
-    108, 111, 99, 107, 59, 32, 116, 101, 120, 116, 45, 97, 108, 105, 103, 110,
-    58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 99, 101, 110, 116, 101, 114,
-    32, 125, 32, 104, 114, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58,
-    32, 98, 108, 111, 99, 107, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32,
-    48, 46, 53, 101, 109, 32, 97, 117, 116, 111, 59, 32, 98, 111, 114, 100,
-    101, 114, 45, 115, 116, 121, 108, 101, 58, 32, 105, 110, 115, 101, 116, 59,
-    32, 98, 111, 114, 100, 101, 114, 45, 119, 105, 100, 116, 104, 58, 32, 49,
-    112, 120, 32, 125, 32, 109, 97, 112, 32, 123, 32, 100, 105, 115, 112, 108,
-    97, 121, 58, 32, 105, 110, 108, 105, 110, 101, 32, 125, 32, 104, 49, 32,
-    123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107,
-    59, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 50, 101, 109,
-    59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 46, 54, 55, 95, 95, 113,
-    101, 109, 32, 48, 32, 46, 54, 55, 101, 109, 32, 48, 59, 32, 102, 111,
-    110, 116, 45, 119, 101, 105, 103, 104, 116, 58, 32, 98, 111, 108, 100, 32,
-    125, 32, 104, 50, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32,
-    98, 108, 111, 99, 107, 59, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101,
-    58, 32, 49, 46, 53, 101, 109, 59, 32, 109, 97, 114, 103, 105, 110, 58,
-    32, 46, 56, 51, 95, 95, 113, 101, 109, 32, 48, 32, 46, 56, 51, 101,
+    110, 97, 118, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 98,
+    108, 111, 99, 107, 32, 125, 32, 109, 97, 114, 113, 117, 101, 101, 32, 123,
+    32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 105, 110, 108, 105, 110, 101,
+    45, 98, 108, 111, 99, 107, 59, 32, 111, 118, 101, 114, 102, 108, 111, 119,
+    58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 109, 97, 114, 113, 117, 101,
+    101, 32, 125, 32, 97, 100, 100, 114, 101, 115, 115, 32, 123, 32, 100, 105,
+    115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 32, 125, 32, 98,
+    108, 111, 99, 107, 113, 117, 111, 116, 101, 32, 123, 32, 100, 105, 115, 112,
+    108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 109, 97, 114, 103,
+    105, 110, 58, 32, 49, 95, 95, 113, 101, 109, 32, 52, 48, 112, 120, 32,
+    49, 101, 109, 32, 52, 48, 112, 120, 32, 125, 32, 113, 32, 123, 32, 100,
+    105, 115, 112, 108, 97, 121, 58, 32, 105, 110, 108, 105, 110, 101, 32, 125,
+    32, 113, 58, 98, 101, 102, 111, 114, 101, 32, 123, 32, 99, 111, 110, 116,
+    101, 110, 116, 58, 32, 39, 34, 39, 32, 125, 32, 113, 58, 97, 102, 116,
+    101, 114, 32, 123, 32, 99, 111, 110, 116, 101, 110, 116, 58, 32, 39, 34,
+    39, 32, 125, 32, 99, 101, 110, 116, 101, 114, 32, 123, 32, 100, 105, 115,
+    112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 116, 101, 120,
+    116, 45, 97, 108, 105, 103, 110, 58, 32, 45, 119, 101, 98, 107, 105, 116,
+    45, 99, 101, 110, 116, 101, 114, 32, 125, 32, 104, 114, 32, 123, 32, 100,
+    105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 109,
+    97, 114, 103, 105, 110, 58, 32, 48, 46, 53, 101, 109, 32, 97, 117, 116,
+    111, 59, 32, 98, 111, 114, 100, 101, 114, 45, 115, 116, 121, 108, 101, 58,
+    32, 105, 110, 115, 101, 116, 59, 32, 98, 111, 114, 100, 101, 114, 45, 119,
+    105, 100, 116, 104, 58, 32, 49, 112, 120, 32, 125, 32, 109, 97, 112, 32,
+    123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 105, 110, 108, 105, 110,
+    101, 32, 125, 32, 104, 49, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121,
+    58, 32, 98, 108, 111, 99, 107, 59, 32, 102, 111, 110, 116, 45, 115, 105,
+    122, 101, 58, 32, 50, 101, 109, 59, 32, 109, 97, 114, 103, 105, 110, 58,
+    32, 46, 54, 55, 95, 95, 113, 101, 109, 32, 48, 32, 46, 54, 55, 101,
     109, 32, 48, 59, 32, 102, 111, 110, 116, 45, 119, 101, 105, 103, 104, 116,
-    58, 32, 98, 111, 108, 100, 32, 125, 32, 104, 51, 32, 123, 32, 100, 105,
+    58, 32, 98, 111, 108, 100, 32, 125, 32, 104, 50, 32, 123, 32, 100, 105,
     115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 102, 111,
-    110, 116, 45, 115, 105, 122, 101, 58, 32, 49, 46, 49, 55, 101, 109, 59,
-    32, 109, 97, 114, 103, 105, 110, 58, 32, 49, 95, 95, 113, 101, 109, 32,
-    48, 32, 49, 101, 109, 32, 48, 59, 32, 102, 111, 110, 116, 45, 119, 101,
-    105, 103, 104, 116, 58, 32, 98, 111, 108, 100, 32, 125, 32, 104, 52, 32,
-    123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107,
-    59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 49, 46, 51, 51, 95, 95,
-    113, 101, 109, 32, 48, 32, 49, 46, 51, 51, 101, 109, 32, 48, 59, 32,
+    110, 116, 45, 115, 105, 122, 101, 58, 32, 49, 46, 53, 101, 109, 59, 32,
+    109, 97, 114, 103, 105, 110, 58, 32, 46, 56, 51, 95, 95, 113, 101, 109,
+    32, 48, 32, 46, 56, 51, 101, 109, 32, 48, 59, 32, 102, 111, 110, 116,
+    45, 119, 101, 105, 103, 104, 116, 58, 32, 98, 111, 108, 100, 32, 125, 32,
+    104, 51, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 98, 108,
+    111, 99, 107, 59, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32,
+    49, 46, 49, 55, 101, 109, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32,
+    49, 95, 95, 113, 101, 109, 32, 48, 32, 49, 101, 109, 32, 48, 59, 32,
     102, 111, 110, 116, 45, 119, 101, 105, 103, 104, 116, 58, 32, 98, 111, 108,
-    100, 32, 125, 32, 104, 53, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121,
+    100, 32, 125, 32, 104, 52, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121,
+    58, 32, 98, 108, 111, 99, 107, 59, 32, 109, 97, 114, 103, 105, 110, 58,
+    32, 49, 46, 51, 51, 95, 95, 113, 101, 109, 32, 48, 32, 49, 46, 51,
+    51, 101, 109, 32, 48, 59, 32, 102, 111, 110, 116, 45, 119, 101, 105, 103,
+    104, 116, 58, 32, 98, 111, 108, 100, 32, 125, 32, 104, 53, 32, 123, 32,
+    100, 105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32,
+    102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 46, 56, 51, 101, 109,
+    59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 49, 46, 54, 55, 95, 95,
+    113, 101, 109, 32, 48, 32, 49, 46, 54, 55, 101, 109, 32, 48, 59, 32,
+    102, 111, 110, 116, 45, 119, 101, 105, 103, 104, 116, 58, 32, 98, 111, 108,
+    100, 32, 125, 32, 104, 54, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121,
     58, 32, 98, 108, 111, 99, 107, 59, 32, 102, 111, 110, 116, 45, 115, 105,
-    122, 101, 58, 32, 46, 56, 51, 101, 109, 59, 32, 109, 97, 114, 103, 105,
-    110, 58, 32, 49, 46, 54, 55, 95, 95, 113, 101, 109, 32, 48, 32, 49,
-    46, 54, 55, 101, 109, 32, 48, 59, 32, 102, 111, 110, 116, 45, 119, 101,
-    105, 103, 104, 116, 58, 32, 98, 111, 108, 100, 32, 125, 32, 104, 54, 32,
-    123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107,
-    59, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 46, 54, 55,
-    101, 109, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 50, 46, 51, 51,
-    95, 95, 113, 101, 109, 32, 48, 32, 50, 46, 51, 51, 101, 109, 32, 48,
-    59, 32, 102, 111, 110, 116, 45, 119, 101, 105, 103, 104, 116, 58, 32, 98,
-    111, 108, 100, 32, 125, 32, 116, 97, 98, 108, 101, 32, 123, 32, 100, 105,
-    115, 112, 108, 97, 121, 58, 32, 116, 97, 98, 108, 101, 59, 32, 98, 111,
-    114, 100, 101, 114, 45, 99, 111, 108, 108, 97, 112, 115, 101, 58, 32, 115,
-    101, 112, 97, 114, 97, 116, 101, 59, 32, 98, 111, 114, 100, 101, 114, 45,
-    115, 112, 97, 99, 105, 110, 103, 58, 32, 50, 112, 120, 59, 32, 98, 111,
-    114, 100, 101, 114, 45, 99, 111, 108, 111, 114, 58, 32, 103, 114, 97, 121,
-    32, 125, 32, 116, 104, 101, 97, 100, 32, 123, 32, 100, 105, 115, 112, 108,
-    97, 121, 58, 32, 116, 97, 98, 108, 101, 45, 104, 101, 97, 100, 101, 114,
-    45, 103, 114, 111, 117, 112, 59, 32, 118, 101, 114, 116, 105, 99, 97, 108,
-    45, 97, 108, 105, 103, 110, 58, 32, 109, 105, 100, 100, 108, 101, 59, 32,
-    98, 111, 114, 100, 101, 114, 45, 99, 111, 108, 111, 114, 58, 32, 105, 110,
-    104, 101, 114, 105, 116, 32, 125, 32, 116, 98, 111, 100, 121, 32, 123, 32,
-    100, 105, 115, 112, 108, 97, 121, 58, 32, 116, 97, 98, 108, 101, 45, 114,
-    111, 119, 45, 103, 114, 111, 117, 112, 59, 32, 118, 101, 114, 116, 105, 99,
-    97, 108, 45, 97, 108, 105, 103, 110, 58, 32, 109, 105, 100, 100, 108, 101,
-    59, 32, 98, 111, 114, 100, 101, 114, 45, 99, 111, 108, 111, 114, 58, 32,
-    105, 110, 104, 101, 114, 105, 116, 32, 125, 32, 116, 102, 111, 111, 116, 32,
+    122, 101, 58, 32, 46, 54, 55, 101, 109, 59, 32, 109, 97, 114, 103, 105,
+    110, 58, 32, 50, 46, 51, 51, 95, 95, 113, 101, 109, 32, 48, 32, 50,
+    46, 51, 51, 101, 109, 32, 48, 59, 32, 102, 111, 110, 116, 45, 119, 101,
+    105, 103, 104, 116, 58, 32, 98, 111, 108, 100, 32, 125, 32, 116, 97, 98,
+    108, 101, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 116, 97,
+    98, 108, 101, 59, 32, 98, 111, 114, 100, 101, 114, 45, 99, 111, 108, 108,
+    97, 112, 115, 101, 58, 32, 115, 101, 112, 97, 114, 97, 116, 101, 59, 32,
+    98, 111, 114, 100, 101, 114, 45, 115, 112, 97, 99, 105, 110, 103, 58, 32,
+    50, 112, 120, 59, 32, 98, 111, 114, 100, 101, 114, 45, 99, 111, 108, 111,
+    114, 58, 32, 103, 114, 97, 121, 32, 125, 32, 116, 104, 101, 97, 100, 32,
     123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 116, 97, 98, 108, 101,
-    45, 102, 111, 111, 116, 101, 114, 45, 103, 114, 111, 117, 112, 59, 32, 118,
+    45, 104, 101, 97, 100, 101, 114, 45, 103, 114, 111, 117, 112, 59, 32, 118,
     101, 114, 116, 105, 99, 97, 108, 45, 97, 108, 105, 103, 110, 58, 32, 109,
     105, 100, 100, 108, 101, 59, 32, 98, 111, 114, 100, 101, 114, 45, 99, 111,
     108, 111, 114, 58, 32, 105, 110, 104, 101, 114, 105, 116, 32, 125, 32, 116,
-    97, 98, 108, 101, 32, 62, 32, 116, 114, 32, 123, 32, 118, 101, 114, 116,
-    105, 99, 97, 108, 45, 97, 108, 105, 103, 110, 58, 32, 109, 105, 100, 100,
-    108, 101, 59, 32, 125, 32, 99, 111, 108, 32, 123, 32, 100, 105, 115, 112,
-    108, 97, 121, 58, 32, 116, 97, 98, 108, 101, 45, 99, 111, 108, 117, 109,
-    110, 32, 125, 32, 99, 111, 108, 103, 114, 111, 117, 112, 32, 123, 32, 100,
-    105, 115, 112, 108, 97, 121, 58, 32, 116, 97, 98, 108, 101, 45, 99, 111,
-    108, 117, 109, 110, 45, 103, 114, 111, 117, 112, 32, 125, 32, 116, 114, 32,
-    123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 116, 97, 98, 108, 101,
-    45, 114, 111, 119, 59, 32, 118, 101, 114, 116, 105, 99, 97, 108, 45, 97,
-    108, 105, 103, 110, 58, 32, 105, 110, 104, 101, 114, 105, 116, 59, 32, 98,
-    111, 114, 100, 101, 114, 45, 99, 111, 108, 111, 114, 58, 32, 105, 110, 104,
-    101, 114, 105, 116, 32, 125, 32, 116, 100, 44, 32, 116, 104, 32, 123, 32,
-    100, 105, 115, 112, 108, 97, 121, 58, 32, 116, 97, 98, 108, 101, 45, 99,
-    101, 108, 108, 59, 32, 118, 101, 114, 116, 105, 99, 97, 108, 45, 97, 108,
-    105, 103, 110, 58, 32, 105, 110, 104, 101, 114, 105, 116, 32, 125, 32, 116,
-    104, 32, 123, 32, 102, 111, 110, 116, 45, 119, 101, 105, 103, 104, 116, 58,
-    32, 98, 111, 108, 100, 32, 125, 32, 99, 97, 112, 116, 105, 111, 110, 32,
-    123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 116, 97, 98, 108, 101,
-    45, 99, 97, 112, 116, 105, 111, 110, 59, 32, 116, 101, 120, 116, 45, 97,
-    108, 105, 103, 110, 58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 99, 101,
-    110, 116, 101, 114, 32, 125, 32, 117, 108, 44, 32, 109, 101, 110, 117, 44,
-    32, 100, 105, 114, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32,
-    98, 108, 111, 99, 107, 59, 32, 108, 105, 115, 116, 45, 115, 116, 121, 108,
-    101, 45, 116, 121, 112, 101, 58, 32, 100, 105, 115, 99, 59, 32, 109, 97,
-    114, 103, 105, 110, 58, 32, 49, 95, 95, 113, 101, 109, 32, 48, 32, 49,
-    101, 109, 32, 48, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 112, 97,
-    100, 100, 105, 110, 103, 45, 115, 116, 97, 114, 116, 58, 32, 52, 48, 112,
-    120, 32, 125, 32, 111, 108, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121,
-    58, 32, 98, 108, 111, 99, 107, 59, 32, 108, 105, 115, 116, 45, 115, 116,
-    121, 108, 101, 45, 116, 121, 112, 101, 58, 32, 100, 101, 99, 105, 109, 97,
-    108, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 49, 95, 95, 113, 101,
-    109, 32, 48, 32, 49, 101, 109, 32, 48, 59, 32, 45, 119, 101, 98, 107,
-    105, 116, 45, 112, 97, 100, 100, 105, 110, 103, 45, 115, 116, 97, 114, 116,
-    58, 32, 52, 48, 112, 120, 32, 125, 32, 108, 105, 32, 123, 32, 100, 105,
-    115, 112, 108, 97, 121, 58, 32, 108, 105, 115, 116, 45, 105, 116, 101, 109,
-    32, 125, 32, 117, 108, 32, 117, 108, 44, 32, 111, 108, 32, 117, 108, 32,
-    123, 32, 108, 105, 115, 116, 45, 115, 116, 121, 108, 101, 45, 116, 121, 112,
-    101, 58, 32, 99, 105, 114, 99, 108, 101, 32, 125, 32, 111, 108, 32, 111,
-    108, 32, 117, 108, 44, 32, 111, 108, 32, 117, 108, 32, 117, 108, 44, 32,
-    117, 108, 32, 111, 108, 32, 117, 108, 44, 32, 117, 108, 32, 117, 108, 32,
-    117, 108, 32, 123, 32, 108, 105, 115, 116, 45, 115, 116, 121, 108, 101, 45,
-    116, 121, 112, 101, 58, 32, 115, 113, 117, 97, 114, 101, 32, 125, 32, 100,
-    100, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111,
-    99, 107, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 109, 97, 114, 103,
-    105, 110, 45, 115, 116, 97, 114, 116, 58, 32, 52, 48, 112, 120, 32, 125,
-    32, 100, 108, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 98,
-    108, 111, 99, 107, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 49, 95,
-    95, 113, 101, 109, 32, 48, 32, 49, 101, 109, 32, 48, 32, 125, 32, 100,
-    116, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111,
-    99, 107, 32, 125, 32, 111, 108, 32, 117, 108, 44, 32, 117, 108, 32, 111,
-    108, 44, 32, 117, 108, 32, 117, 108, 44, 32, 111, 108, 32, 111, 108, 32,
-    123, 32, 109, 97, 114, 103, 105, 110, 45, 116, 111, 112, 58, 32, 48, 59,
-    32, 109, 97, 114, 103, 105, 110, 45, 98, 111, 116, 116, 111, 109, 58, 32,
-    48, 32, 125, 32, 102, 111, 114, 109, 32, 123, 32, 100, 105, 115, 112, 108,
-    97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 109, 97, 114, 103, 105,
-    110, 45, 116, 111, 112, 58, 32, 48, 95, 95, 113, 101, 109, 32, 125, 32,
-    108, 97, 98, 101, 108, 32, 123, 32, 99, 117, 114, 115, 111, 114, 58, 32,
-    100, 101, 102, 97, 117, 108, 116, 59, 32, 125, 32, 108, 101, 103, 101, 110,
-    100, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111,
-    99, 107, 59, 32, 112, 97, 100, 100, 105, 110, 103, 45, 108, 101, 102, 116,
-    58, 32, 50, 112, 120, 59, 32, 112, 97, 100, 100, 105, 110, 103, 45, 114,
-    105, 103, 104, 116, 58, 32, 50, 112, 120, 59, 32, 98, 111, 114, 100, 101,
-    114, 58, 32, 110, 111, 110, 101, 32, 125, 32, 102, 105, 101, 108, 100, 115,
-    101, 116, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 98, 108,
-    111, 99, 107, 59, 32, 109, 97, 114, 103, 105, 110, 45, 108, 101, 102, 116,
-    58, 32, 50, 112, 120, 59, 32, 109, 97, 114, 103, 105, 110, 45, 114, 105,
-    103, 104, 116, 58, 32, 50, 112, 120, 59, 32, 112, 97, 100, 100, 105, 110,
-    103, 58, 32, 48, 46, 51, 53, 101, 109, 32, 48, 46, 55, 53, 101, 109,
-    32, 48, 46, 54, 50, 53, 101, 109, 59, 32, 98, 111, 114, 100, 101, 114,
-    58, 32, 50, 112, 120, 32, 103, 114, 111, 111, 118, 101, 32, 84, 104, 114,
-    101, 101, 68, 70, 97, 99, 101, 32, 125, 32, 98, 117, 116, 116, 111, 110,
-    32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97,
-    114, 97, 110, 99, 101, 58, 32, 98, 117, 116, 116, 111, 110, 59, 32, 125,
-    32, 105, 110, 112, 117, 116, 44, 32, 116, 101, 120, 116, 97, 114, 101, 97,
-    44, 32, 107, 101, 121, 103, 101, 110, 44, 32, 115, 101, 108, 101, 99, 116,
-    44, 32, 98, 117, 116, 116, 111, 110, 44, 32, 105, 115, 105, 110, 100, 101,
-    120, 44, 32, 100, 97, 116, 97, 103, 114, 105, 100, 32, 123, 32, 109, 97,
-    114, 103, 105, 110, 58, 32, 48, 95, 95, 113, 101, 109, 59, 32, 102, 111,
-    110, 116, 58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 115, 109, 97, 108,
-    108, 45, 99, 111, 110, 116, 114, 111, 108, 59, 32, 99, 111, 108, 111, 114,
-    58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 108, 101, 116, 116, 101,
-    114, 45, 115, 112, 97, 99, 105, 110, 103, 58, 32, 110, 111, 114, 109, 97,
-    108, 59, 32, 119, 111, 114, 100, 45, 115, 112, 97, 99, 105, 110, 103, 58,
-    32, 110, 111, 114, 109, 97, 108, 59, 32, 108, 105, 110, 101, 45, 104, 101,
-    105, 103, 104, 116, 58, 32, 110, 111, 114, 109, 97, 108, 59, 32, 116, 101,
-    120, 116, 45, 116, 114, 97, 110, 115, 102, 111, 114, 109, 58, 32, 110, 111,
-    110, 101, 59, 32, 116, 101, 120, 116, 45, 105, 110, 100, 101, 110, 116, 58,
-    32, 48, 59, 32, 116, 101, 120, 116, 45, 115, 104, 97, 100, 111, 119, 58,
-    32, 110, 111, 110, 101, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32,
-    105, 110, 108, 105, 110, 101, 45, 98, 108, 111, 99, 107, 59, 32, 116, 101,
-    120, 116, 45, 97, 108, 105, 103, 110, 58, 32, 45, 119, 101, 98, 107, 105,
-    116, 45, 97, 117, 116, 111, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91,
-    116, 121, 112, 101, 61, 34, 104, 105, 100, 100, 101, 110, 34, 93, 32, 123,
-    32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111, 110, 101, 32, 125,
-    32, 105, 110, 112, 117, 116, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121,
-    112, 101, 61, 34, 112, 97, 115, 115, 119, 111, 114, 100, 34, 93, 44, 32,
-    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 101, 97, 114,
-    99, 104, 34, 93, 44, 32, 105, 115, 105, 110, 100, 101, 120, 32, 123, 32,
-    45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110,
-    99, 101, 58, 32, 116, 101, 120, 116, 102, 105, 101, 108, 100, 59, 32, 112,
-    97, 100, 100, 105, 110, 103, 58, 32, 49, 112, 120, 59, 32, 98, 97, 99,
-    107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 119,
-    104, 105, 116, 101, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 50, 112,
-    120, 32, 105, 110, 115, 101, 116, 59, 32, 45, 119, 101, 98, 107, 105, 116,
-    45, 114, 116, 108, 45, 111, 114, 100, 101, 114, 105, 110, 103, 58, 32, 108,
-    111, 103, 105, 99, 97, 108, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45,
-    117, 115, 101, 114, 45, 115, 101, 108, 101, 99, 116, 58, 32, 116, 101, 120,
-    116, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32, 97, 117, 116, 111, 59,
-    32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115,
-    101, 97, 114, 99, 104, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105,
-    116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 115, 101,
-    97, 114, 99, 104, 102, 105, 101, 108, 100, 59, 32, 45, 119, 101, 98, 107,
-    105, 116, 45, 98, 111, 120, 45, 115, 105, 122, 105, 110, 103, 58, 32, 98,
-    111, 114, 100, 101, 114, 45, 98, 111, 120, 59, 32, 125, 32, 105, 110, 112,
-    117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 101, 97, 114, 99, 104, 34,
-    93, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 115, 101, 97, 114, 99,
-    104, 45, 99, 97, 110, 99, 101, 108, 45, 98, 117, 116, 116, 111, 110, 32,
-    123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114,
-    97, 110, 99, 101, 58, 32, 115, 101, 97, 114, 99, 104, 102, 105, 101, 108,
-    100, 45, 99, 97, 110, 99, 101, 108, 45, 98, 117, 116, 116, 111, 110, 59,
-    32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 105, 110, 108, 105, 110, 101,
-    45, 98, 108, 111, 99, 107, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91,
-    116, 121, 112, 101, 61, 34, 115, 101, 97, 114, 99, 104, 34, 93, 58, 58,
-    45, 119, 101, 98, 107, 105, 116, 45, 115, 101, 97, 114, 99, 104, 45, 100,
-    101, 99, 111, 114, 97, 116, 105, 111, 110, 32, 123, 32, 45, 119, 101, 98,
-    107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32,
-    115, 101, 97, 114, 99, 104, 102, 105, 101, 108, 100, 45, 100, 101, 99, 111,
-    114, 97, 116, 105, 111, 110, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58,
+    98, 111, 100, 121, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32,
+    116, 97, 98, 108, 101, 45, 114, 111, 119, 45, 103, 114, 111, 117, 112, 59,
+    32, 118, 101, 114, 116, 105, 99, 97, 108, 45, 97, 108, 105, 103, 110, 58,
+    32, 109, 105, 100, 100, 108, 101, 59, 32, 98, 111, 114, 100, 101, 114, 45,
+    99, 111, 108, 111, 114, 58, 32, 105, 110, 104, 101, 114, 105, 116, 32, 125,
+    32, 116, 102, 111, 111, 116, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121,
+    58, 32, 116, 97, 98, 108, 101, 45, 102, 111, 111, 116, 101, 114, 45, 103,
+    114, 111, 117, 112, 59, 32, 118, 101, 114, 116, 105, 99, 97, 108, 45, 97,
+    108, 105, 103, 110, 58, 32, 109, 105, 100, 100, 108, 101, 59, 32, 98, 111,
+    114, 100, 101, 114, 45, 99, 111, 108, 111, 114, 58, 32, 105, 110, 104, 101,
+    114, 105, 116, 32, 125, 32, 116, 97, 98, 108, 101, 32, 62, 32, 116, 114,
+    32, 123, 32, 118, 101, 114, 116, 105, 99, 97, 108, 45, 97, 108, 105, 103,
+    110, 58, 32, 109, 105, 100, 100, 108, 101, 59, 32, 125, 32, 99, 111, 108,
+    32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 116, 97, 98, 108,
+    101, 45, 99, 111, 108, 117, 109, 110, 32, 125, 32, 99, 111, 108, 103, 114,
+    111, 117, 112, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 116,
+    97, 98, 108, 101, 45, 99, 111, 108, 117, 109, 110, 45, 103, 114, 111, 117,
+    112, 32, 125, 32, 116, 114, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121,
+    58, 32, 116, 97, 98, 108, 101, 45, 114, 111, 119, 59, 32, 118, 101, 114,
+    116, 105, 99, 97, 108, 45, 97, 108, 105, 103, 110, 58, 32, 105, 110, 104,
+    101, 114, 105, 116, 59, 32, 98, 111, 114, 100, 101, 114, 45, 99, 111, 108,
+    111, 114, 58, 32, 105, 110, 104, 101, 114, 105, 116, 32, 125, 32, 116, 100,
+    44, 32, 116, 104, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32,
+    116, 97, 98, 108, 101, 45, 99, 101, 108, 108, 59, 32, 118, 101, 114, 116,
+    105, 99, 97, 108, 45, 97, 108, 105, 103, 110, 58, 32, 105, 110, 104, 101,
+    114, 105, 116, 32, 125, 32, 116, 104, 32, 123, 32, 102, 111, 110, 116, 45,
+    119, 101, 105, 103, 104, 116, 58, 32, 98, 111, 108, 100, 32, 125, 32, 99,
+    97, 112, 116, 105, 111, 110, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121,
+    58, 32, 116, 97, 98, 108, 101, 45, 99, 97, 112, 116, 105, 111, 110, 59,
+    32, 116, 101, 120, 116, 45, 97, 108, 105, 103, 110, 58, 32, 45, 119, 101,
+    98, 107, 105, 116, 45, 99, 101, 110, 116, 101, 114, 32, 125, 32, 117, 108,
+    44, 32, 109, 101, 110, 117, 44, 32, 100, 105, 114, 32, 123, 32, 100, 105,
+    115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 108, 105,
+    115, 116, 45, 115, 116, 121, 108, 101, 45, 116, 121, 112, 101, 58, 32, 100,
+    105, 115, 99, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 49, 95, 95,
+    113, 101, 109, 32, 48, 32, 49, 101, 109, 32, 48, 59, 32, 45, 119, 101,
+    98, 107, 105, 116, 45, 112, 97, 100, 100, 105, 110, 103, 45, 115, 116, 97,
+    114, 116, 58, 32, 52, 48, 112, 120, 32, 125, 32, 111, 108, 32, 123, 32,
+    100, 105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32,
+    108, 105, 115, 116, 45, 115, 116, 121, 108, 101, 45, 116, 121, 112, 101, 58,
+    32, 100, 101, 99, 105, 109, 97, 108, 59, 32, 109, 97, 114, 103, 105, 110,
+    58, 32, 49, 95, 95, 113, 101, 109, 32, 48, 32, 49, 101, 109, 32, 48,
+    59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 112, 97, 100, 100, 105, 110,
+    103, 45, 115, 116, 97, 114, 116, 58, 32, 52, 48, 112, 120, 32, 125, 32,
+    108, 105, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 108, 105,
+    115, 116, 45, 105, 116, 101, 109, 32, 125, 32, 117, 108, 32, 117, 108, 44,
+    32, 111, 108, 32, 117, 108, 32, 123, 32, 108, 105, 115, 116, 45, 115, 116,
+    121, 108, 101, 45, 116, 121, 112, 101, 58, 32, 99, 105, 114, 99, 108, 101,
+    32, 125, 32, 111, 108, 32, 111, 108, 32, 117, 108, 44, 32, 111, 108, 32,
+    117, 108, 32, 117, 108, 44, 32, 117, 108, 32, 111, 108, 32, 117, 108, 44,
+    32, 117, 108, 32, 117, 108, 32, 117, 108, 32, 123, 32, 108, 105, 115, 116,
+    45, 115, 116, 121, 108, 101, 45, 116, 121, 112, 101, 58, 32, 115, 113, 117,
+    97, 114, 101, 32, 125, 32, 100, 100, 32, 123, 32, 100, 105, 115, 112, 108,
+    97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 45, 119, 101, 98, 107,
+    105, 116, 45, 109, 97, 114, 103, 105, 110, 45, 115, 116, 97, 114, 116, 58,
+    32, 52, 48, 112, 120, 32, 125, 32, 100, 108, 32, 123, 32, 100, 105, 115,
+    112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 109, 97, 114,
+    103, 105, 110, 58, 32, 49, 95, 95, 113, 101, 109, 32, 48, 32, 49, 101,
+    109, 32, 48, 32, 125, 32, 100, 116, 32, 123, 32, 100, 105, 115, 112, 108,
+    97, 121, 58, 32, 98, 108, 111, 99, 107, 32, 125, 32, 111, 108, 32, 117,
+    108, 44, 32, 117, 108, 32, 111, 108, 44, 32, 117, 108, 32, 117, 108, 44,
+    32, 111, 108, 32, 111, 108, 32, 123, 32, 109, 97, 114, 103, 105, 110, 45,
+    116, 111, 112, 58, 32, 48, 59, 32, 109, 97, 114, 103, 105, 110, 45, 98,
+    111, 116, 116, 111, 109, 58, 32, 48, 32, 125, 32, 102, 111, 114, 109, 32,
+    123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107,
+    59, 32, 109, 97, 114, 103, 105, 110, 45, 116, 111, 112, 58, 32, 48, 95,
+    95, 113, 101, 109, 32, 125, 32, 108, 97, 98, 101, 108, 32, 123, 32, 99,
+    117, 114, 115, 111, 114, 58, 32, 100, 101, 102, 97, 117, 108, 116, 59, 32,
+    125, 32, 108, 101, 103, 101, 110, 100, 32, 123, 32, 100, 105, 115, 112, 108,
+    97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 112, 97, 100, 100, 105,
+    110, 103, 45, 108, 101, 102, 116, 58, 32, 50, 112, 120, 59, 32, 112, 97,
+    100, 100, 105, 110, 103, 45, 114, 105, 103, 104, 116, 58, 32, 50, 112, 120,
+    59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 110, 111, 110, 101, 32, 125,
+    32, 102, 105, 101, 108, 100, 115, 101, 116, 32, 123, 32, 100, 105, 115, 112,
+    108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 109, 97, 114, 103,
+    105, 110, 45, 108, 101, 102, 116, 58, 32, 50, 112, 120, 59, 32, 109, 97,
+    114, 103, 105, 110, 45, 114, 105, 103, 104, 116, 58, 32, 50, 112, 120, 59,
+    32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 48, 46, 51, 53, 101, 109,
+    32, 48, 46, 55, 53, 101, 109, 32, 48, 46, 54, 50, 53, 101, 109, 59,
+    32, 98, 111, 114, 100, 101, 114, 58, 32, 50, 112, 120, 32, 103, 114, 111,
+    111, 118, 101, 32, 84, 104, 114, 101, 101, 68, 70, 97, 99, 101, 32, 125,
+    32, 98, 117, 116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105,
+    116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 98, 117,
+    116, 116, 111, 110, 59, 32, 125, 32, 105, 110, 112, 117, 116, 44, 32, 116,
+    101, 120, 116, 97, 114, 101, 97, 44, 32, 107, 101, 121, 103, 101, 110, 44,
+    32, 115, 101, 108, 101, 99, 116, 44, 32, 98, 117, 116, 116, 111, 110, 44,
+    32, 105, 115, 105, 110, 100, 101, 120, 44, 32, 100, 97, 116, 97, 103, 114,
+    105, 100, 32, 123, 32, 109, 97, 114, 103, 105, 110, 58, 32, 48, 95, 95,
+    113, 101, 109, 59, 32, 102, 111, 110, 116, 58, 32, 45, 119, 101, 98, 107,
+    105, 116, 45, 115, 109, 97, 108, 108, 45, 99, 111, 110, 116, 114, 111, 108,
+    59, 32, 99, 111, 108, 111, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108,
+    59, 32, 108, 101, 116, 116, 101, 114, 45, 115, 112, 97, 99, 105, 110, 103,
+    58, 32, 110, 111, 114, 109, 97, 108, 59, 32, 119, 111, 114, 100, 45, 115,
+    112, 97, 99, 105, 110, 103, 58, 32, 110, 111, 114, 109, 97, 108, 59, 32,
+    108, 105, 110, 101, 45, 104, 101, 105, 103, 104, 116, 58, 32, 110, 111, 114,
+    109, 97, 108, 59, 32, 116, 101, 120, 116, 45, 116, 114, 97, 110, 115, 102,
+    111, 114, 109, 58, 32, 110, 111, 110, 101, 59, 32, 116, 101, 120, 116, 45,
+    105, 110, 100, 101, 110, 116, 58, 32, 48, 59, 32, 116, 101, 120, 116, 45,
+    115, 104, 97, 100, 111, 119, 58, 32, 110, 111, 110, 101, 59, 32, 100, 105,
+    115, 112, 108, 97, 121, 58, 32, 105, 110, 108, 105, 110, 101, 45, 98, 108,
+    111, 99, 107, 59, 32, 116, 101, 120, 116, 45, 97, 108, 105, 103, 110, 58,
+    32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 117, 116, 111, 59, 32, 125,
+    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 104, 105, 100,
+    100, 101, 110, 34, 93, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58,
+    32, 110, 111, 110, 101, 32, 125, 32, 105, 110, 112, 117, 116, 44, 32, 105,
+    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 112, 97, 115, 115, 119,
+    111, 114, 100, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
+    101, 61, 34, 115, 101, 97, 114, 99, 104, 34, 93, 44, 32, 105, 115, 105,
+    110, 100, 101, 120, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97,
+    112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 116, 101, 120, 116, 102,
+    105, 101, 108, 100, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 49,
+    112, 120, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99,
+    111, 108, 111, 114, 58, 32, 119, 104, 105, 116, 101, 59, 32, 98, 111, 114,
+    100, 101, 114, 58, 32, 50, 112, 120, 32, 105, 110, 115, 101, 116, 59, 32,
+    45, 119, 101, 98, 107, 105, 116, 45, 114, 116, 108, 45, 111, 114, 100, 101,
+    114, 105, 110, 103, 58, 32, 108, 111, 103, 105, 99, 97, 108, 59, 32, 45,
+    119, 101, 98, 107, 105, 116, 45, 117, 115, 101, 114, 45, 115, 101, 108, 101,
+    99, 116, 58, 32, 116, 101, 120, 116, 59, 32, 99, 117, 114, 115, 111, 114,
+    58, 32, 97, 117, 116, 111, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91,
+    116, 121, 112, 101, 61, 34, 115, 101, 97, 114, 99, 104, 34, 93, 32, 123,
+    32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97,
+    110, 99, 101, 58, 32, 115, 101, 97, 114, 99, 104, 102, 105, 101, 108, 100,
+    59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105,
+    122, 105, 110, 103, 58, 32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120,
+    59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
+    115, 101, 97, 114, 99, 104, 34, 93, 58, 58, 45, 119, 101, 98, 107, 105,
+    116, 45, 115, 101, 97, 114, 99, 104, 45, 99, 97, 110, 99, 101, 108, 45,
+    98, 117, 116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116,
+    45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 115, 101, 97,
+    114, 99, 104, 102, 105, 101, 108, 100, 45, 99, 97, 110, 99, 101, 108, 45,
+    98, 117, 116, 116, 111, 110, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58,
     32, 105, 110, 108, 105, 110, 101, 45, 98, 108, 111, 99, 107, 59, 32, 125,
     32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 101, 97,
     114, 99, 104, 34, 93, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 115,
-    101, 97, 114, 99, 104, 45, 114, 101, 115, 117, 108, 116, 115, 45, 100, 101,
-    99, 111, 114, 97, 116, 105, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107,
-    105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 115,
-    101, 97, 114, 99, 104, 102, 105, 101, 108, 100, 45, 114, 101, 115, 117, 108,
-    116, 115, 45, 100, 101, 99, 111, 114, 97, 116, 105, 111, 110, 59, 32, 100,
+    101, 97, 114, 99, 104, 45, 100, 101, 99, 111, 114, 97, 116, 105, 111, 110,
+    32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97,
+    114, 97, 110, 99, 101, 58, 32, 115, 101, 97, 114, 99, 104, 102, 105, 101,
+    108, 100, 45, 100, 101, 99, 111, 114, 97, 116, 105, 111, 110, 59, 32, 100,
     105, 115, 112, 108, 97, 121, 58, 32, 105, 110, 108, 105, 110, 101, 45, 98,
     108, 111, 99, 107, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121,
     112, 101, 61, 34, 115, 101, 97, 114, 99, 104, 34, 93, 58, 58, 45, 119,
     101, 98, 107, 105, 116, 45, 115, 101, 97, 114, 99, 104, 45, 114, 101, 115,
-    117, 108, 116, 115, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 45, 119,
-    101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101,
-    58, 32, 115, 101, 97, 114, 99, 104, 102, 105, 101, 108, 100, 45, 114, 101,
-    115, 117, 108, 116, 115, 45, 98, 117, 116, 116, 111, 110, 59, 32, 100, 105,
-    115, 112, 108, 97, 121, 58, 32, 105, 110, 108, 105, 110, 101, 45, 98, 108,
-    111, 99, 107, 59, 32, 125, 32, 116, 101, 120, 116, 97, 114, 101, 97, 32,
+    117, 108, 116, 115, 45, 100, 101, 99, 111, 114, 97, 116, 105, 111, 110, 32,
     123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114,
-    97, 110, 99, 101, 58, 32, 116, 101, 120, 116, 97, 114, 101, 97, 59, 32,
-    98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114,
-    58, 32, 119, 104, 105, 116, 101, 59, 32, 98, 111, 114, 100, 101, 114, 58,
-    32, 49, 112, 120, 32, 115, 111, 108, 105, 100, 59, 32, 45, 119, 101, 98,
-    107, 105, 116, 45, 114, 116, 108, 45, 111, 114, 100, 101, 114, 105, 110, 103,
-    58, 32, 108, 111, 103, 105, 99, 97, 108, 59, 32, 45, 119, 101, 98, 107,
-    105, 116, 45, 117, 115, 101, 114, 45, 115, 101, 108, 101, 99, 116, 58, 32,
-    116, 101, 120, 116, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111,
-    120, 45, 111, 114, 105, 101, 110, 116, 58, 32, 118, 101, 114, 116, 105, 99,
-    97, 108, 59, 32, 114, 101, 115, 105, 122, 101, 58, 32, 97, 117, 116, 111,
-    59, 32, 99, 117, 114, 115, 111, 114, 58, 32, 97, 117, 116, 111, 59, 32,
-    112, 97, 100, 100, 105, 110, 103, 58, 32, 50, 112, 120, 59, 32, 119, 104,
-    105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 112, 114, 101, 45, 119,
-    114, 97, 112, 59, 32, 119, 111, 114, 100, 45, 119, 114, 97, 112, 58, 32,
-    98, 114, 101, 97, 107, 45, 119, 111, 114, 100, 59, 32, 125, 32, 105, 110,
-    112, 117, 116, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 105, 110, 112,
-    117, 116, 45, 112, 108, 97, 99, 101, 104, 111, 108, 100, 101, 114, 44, 32,
-    105, 115, 105, 110, 100, 101, 120, 58, 58, 45, 119, 101, 98, 107, 105, 116,
-    45, 105, 110, 112, 117, 116, 45, 112, 108, 97, 99, 101, 104, 111, 108, 100,
-    101, 114, 32, 123, 32, 99, 111, 108, 111, 114, 58, 32, 100, 97, 114, 107,
-    71, 114, 97, 121, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121,
-    112, 101, 61, 34, 112, 97, 115, 115, 119, 111, 114, 100, 34, 93, 32, 123,
-    32, 45, 119, 101, 98, 107, 105, 116, 45, 116, 101, 120, 116, 45, 115, 101,
-    99, 117, 114, 105, 116, 121, 58, 32, 100, 105, 115, 99, 32, 33, 105, 109,
-    112, 111, 114, 116, 97, 110, 116, 59, 32, 125, 32, 105, 110, 112, 117, 116,
-    91, 116, 121, 112, 101, 61, 34, 104, 105, 100, 100, 101, 110, 34, 93, 44,
-    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 105, 109, 97,
-    103, 101, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
-    61, 34, 102, 105, 108, 101, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107,
-    105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 105,
-    110, 105, 116, 105, 97, 108, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58,
-    32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 98, 97, 99, 107, 103, 114,
-    111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 105, 110, 105, 116,
-    105, 97, 108, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 105, 110, 105,
-    116, 105, 97, 108, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121,
-    112, 101, 61, 34, 102, 105, 108, 101, 34, 93, 32, 123, 32, 45, 119, 101,
-    98, 107, 105, 116, 45, 98, 111, 120, 45, 97, 108, 105, 103, 110, 58, 32,
-    98, 97, 115, 101, 108, 105, 110, 101, 59, 32, 116, 101, 120, 116, 45, 97,
-    108, 105, 103, 110, 58, 32, 115, 116, 97, 114, 116, 32, 33, 105, 109, 112,
-    111, 114, 116, 97, 110, 116, 59, 32, 125, 32, 105, 110, 112, 117, 116, 58,
-    45, 119, 101, 98, 107, 105, 116, 45, 97, 117, 116, 111, 102, 105, 108, 108,
-    32, 123, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111,
-    108, 111, 114, 58, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45,
-    105, 109, 97, 103, 101, 58, 110, 111, 110, 101, 32, 33, 105, 109, 112, 111,
-    114, 116, 97, 110, 116, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116,
-    121, 112, 101, 61, 34, 114, 97, 100, 105, 111, 34, 93, 44, 32, 105, 110,
-    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 99, 104, 101, 99, 107, 98,
-    111, 120, 34, 93, 32, 123, 32, 109, 97, 114, 103, 105, 110, 58, 32, 51,
-    112, 120, 32, 48, 46, 53, 101, 120, 59, 32, 112, 97, 100, 100, 105, 110,
-    103, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 98, 97, 99, 107,
-    103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 105, 110,
-    105, 116, 105, 97, 108, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 105,
-    110, 105, 116, 105, 97, 108, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91,
-    116, 121, 112, 101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 44, 32,
-    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 117, 98, 109,
-    105, 116, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
-    61, 34, 114, 101, 115, 101, 116, 34, 93, 44, 32, 105, 110, 112, 117, 116,
-    91, 116, 121, 112, 101, 61, 34, 102, 105, 108, 101, 34, 93, 58, 58, 45,
-    119, 101, 98, 107, 105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111,
-    97, 100, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98,
-    107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32,
-    112, 117, 115, 104, 45, 98, 117, 116, 116, 111, 110, 59, 32, 119, 104, 105,
-    116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 112, 114, 101, 32, 125, 32,
-    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 98, 117, 116, 116,
-    111, 110, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
-    61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 44, 32, 105, 110, 112, 117,
-    116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116, 34, 93, 44,
-    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108,
-    101, 34, 93, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 102, 105, 108,
-    101, 45, 117, 112, 108, 111, 97, 100, 45, 98, 117, 116, 116, 111, 110, 44,
-    32, 98, 117, 116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105,
-    116, 45, 98, 111, 120, 45, 97, 108, 105, 103, 110, 58, 32, 99, 101, 110,
-    116, 101, 114, 59, 32, 116, 101, 120, 116, 45, 97, 108, 105, 103, 110, 58,
-    32, 99, 101, 110, 116, 101, 114, 59, 32, 99, 117, 114, 115, 111, 114, 58,
-    32, 100, 101, 102, 97, 117, 108, 116, 59, 32, 99, 111, 108, 111, 114, 58,
-    32, 66, 117, 116, 116, 111, 110, 84, 101, 120, 116, 59, 32, 112, 97, 100,
-    100, 105, 110, 103, 58, 32, 50, 112, 120, 32, 54, 112, 120, 32, 51, 112,
-    120, 32, 54, 112, 120, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 50,
-    112, 120, 32, 111, 117, 116, 115, 101, 116, 32, 66, 117, 116, 116, 111, 110,
-    70, 97, 99, 101, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100,
-    45, 99, 111, 108, 111, 114, 58, 32, 66, 117, 116, 116, 111, 110, 70, 97,
-    99, 101, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45,
-    115, 105, 122, 105, 110, 103, 58, 32, 98, 111, 114, 100, 101, 114, 45, 98,
-    111, 120, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61,
-    34, 114, 97, 110, 103, 101, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107,
-    105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 115,
-    108, 105, 100, 101, 114, 45, 104, 111, 114, 105, 122, 111, 110, 116, 97, 108,
-    59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 105, 110, 105, 116, 105,
-    97, 108, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 105, 110, 105, 116,
-    105, 97, 108, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 50, 112, 120,
+    97, 110, 99, 101, 58, 32, 115, 101, 97, 114, 99, 104, 102, 105, 101, 108,
+    100, 45, 114, 101, 115, 117, 108, 116, 115, 45, 100, 101, 99, 111, 114, 97,
+    116, 105, 111, 110, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 105,
+    110, 108, 105, 110, 101, 45, 98, 108, 111, 99, 107, 59, 32, 125, 32, 105,
+    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 101, 97, 114, 99,
+    104, 34, 93, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 115, 101, 97,
+    114, 99, 104, 45, 114, 101, 115, 117, 108, 116, 115, 45, 98, 117, 116, 116,
+    111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112,
+    101, 97, 114, 97, 110, 99, 101, 58, 32, 115, 101, 97, 114, 99, 104, 102,
+    105, 101, 108, 100, 45, 114, 101, 115, 117, 108, 116, 115, 45, 98, 117, 116,
+    116, 111, 110, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 105, 110,
+    108, 105, 110, 101, 45, 98, 108, 111, 99, 107, 59, 32, 125, 32, 116, 101,
+    120, 116, 97, 114, 101, 97, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116,
+    45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 116, 101, 120,
+    116, 97, 114, 101, 97, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110,
+    100, 45, 99, 111, 108, 111, 114, 58, 32, 119, 104, 105, 116, 101, 59, 32,
+    98, 111, 114, 100, 101, 114, 58, 32, 49, 112, 120, 32, 115, 111, 108, 105,
+    100, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 114, 116, 108, 45, 111,
+    114, 100, 101, 114, 105, 110, 103, 58, 32, 108, 111, 103, 105, 99, 97, 108,
+    59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 117, 115, 101, 114, 45, 115,
+    101, 108, 101, 99, 116, 58, 32, 116, 101, 120, 116, 59, 32, 45, 119, 101,
+    98, 107, 105, 116, 45, 98, 111, 120, 45, 111, 114, 105, 101, 110, 116, 58,
+    32, 118, 101, 114, 116, 105, 99, 97, 108, 59, 32, 114, 101, 115, 105, 122,
+    101, 58, 32, 97, 117, 116, 111, 59, 32, 99, 117, 114, 115, 111, 114, 58,
+    32, 97, 117, 116, 111, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32,
+    50, 112, 120, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101,
+    58, 32, 112, 114, 101, 45, 119, 114, 97, 112, 59, 32, 119, 111, 114, 100,
+    45, 119, 114, 97, 112, 58, 32, 98, 114, 101, 97, 107, 45, 119, 111, 114,
+    100, 59, 32, 125, 32, 105, 110, 112, 117, 116, 58, 58, 45, 119, 101, 98,
+    107, 105, 116, 45, 105, 110, 112, 117, 116, 45, 112, 108, 97, 99, 101, 104,
+    111, 108, 100, 101, 114, 44, 32, 105, 115, 105, 110, 100, 101, 120, 58, 58,
+    45, 119, 101, 98, 107, 105, 116, 45, 105, 110, 112, 117, 116, 45, 112, 108,
+    97, 99, 101, 104, 111, 108, 100, 101, 114, 44, 32, 116, 101, 120, 116, 97,
+    114, 101, 97, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 105, 110, 112,
+    117, 116, 45, 112, 108, 97, 99, 101, 104, 111, 108, 100, 101, 114, 32, 123,
+    32, 99, 111, 108, 111, 114, 58, 32, 100, 97, 114, 107, 71, 114, 97, 121,
     59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
-    114, 97, 110, 103, 101, 34, 93, 58, 58, 45, 119, 101, 98, 107, 105, 116,
-    45, 115, 108, 105, 100, 101, 114, 45, 116, 104, 117, 109, 98, 32, 123, 32,
-    45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110,
-    99, 101, 58, 32, 115, 108, 105, 100, 101, 114, 116, 104, 117, 109, 98, 45,
-    104, 111, 114, 105, 122, 111, 110, 116, 97, 108, 59, 32, 125, 32, 105, 110,
-    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 98, 117, 116, 116, 111, 110,
-    34, 93, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 105, 110, 112,
-    117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 117, 98, 109, 105, 116, 34,
-    93, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 105, 110, 112, 117,
-    116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116, 34, 93, 58,
-    100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 105, 110, 112, 117, 116, 91,
-    116, 121, 112, 101, 61, 34, 102, 105, 108, 101, 34, 93, 58, 100, 105, 115,
-    97, 98, 108, 101, 100, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 102,
-    105, 108, 101, 45, 117, 112, 108, 111, 97, 100, 45, 98, 117, 116, 116, 111,
-    110, 44, 32, 98, 117, 116, 116, 111, 110, 58, 100, 105, 115, 97, 98, 108,
-    101, 100, 44, 32, 115, 101, 108, 101, 99, 116, 58, 100, 105, 115, 97, 98,
-    108, 101, 100, 44, 32, 107, 101, 121, 103, 101, 110, 58, 100, 105, 115, 97,
-    98, 108, 101, 100, 44, 32, 111, 112, 116, 103, 114, 111, 117, 112, 58, 100,
-    105, 115, 97, 98, 108, 101, 100, 44, 32, 111, 112, 116, 105, 111, 110, 58,
-    100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 100, 97, 116, 97, 103, 114,
-    105, 100, 58, 100, 105, 115, 97, 98, 108, 101, 100, 32, 123, 32, 99, 111,
-    108, 111, 114, 58, 32, 71, 114, 97, 121, 84, 101, 120, 116, 32, 125, 32,
-    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 98, 117, 116, 116,
-    111, 110, 34, 93, 58, 97, 99, 116, 105, 118, 101, 44, 32, 105, 110, 112,
-    117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 117, 98, 109, 105, 116, 34,
-    93, 58, 97, 99, 116, 105, 118, 101, 44, 32, 105, 110, 112, 117, 116, 91,
-    116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116, 34, 93, 58, 97, 99,
-    116, 105, 118, 101, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
-    61, 34, 102, 105, 108, 101, 34, 93, 58, 97, 99, 116, 105, 118, 101, 58,
+    112, 97, 115, 115, 119, 111, 114, 100, 34, 93, 32, 123, 32, 45, 119, 101,
+    98, 107, 105, 116, 45, 116, 101, 120, 116, 45, 115, 101, 99, 117, 114, 105,
+    116, 121, 58, 32, 100, 105, 115, 99, 32, 33, 105, 109, 112, 111, 114, 116,
+    97, 110, 116, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
+    101, 61, 34, 104, 105, 100, 100, 101, 110, 34, 93, 44, 32, 105, 110, 112,
+    117, 116, 91, 116, 121, 112, 101, 61, 34, 105, 109, 97, 103, 101, 34, 93,
+    44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105,
+    108, 101, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97,
+    112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 105, 110, 105, 116, 105,
+    97, 108, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 105, 110, 105,
+    116, 105, 97, 108, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100,
+    45, 99, 111, 108, 111, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59,
+    32, 98, 111, 114, 100, 101, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108,
+    59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
+    102, 105, 108, 101, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116,
+    45, 98, 111, 120, 45, 97, 108, 105, 103, 110, 58, 32, 98, 97, 115, 101,
+    108, 105, 110, 101, 59, 32, 116, 101, 120, 116, 45, 97, 108, 105, 103, 110,
+    58, 32, 115, 116, 97, 114, 116, 32, 33, 105, 109, 112, 111, 114, 116, 97,
+    110, 116, 59, 32, 125, 32, 105, 110, 112, 117, 116, 58, 45, 119, 101, 98,
+    107, 105, 116, 45, 97, 117, 116, 111, 102, 105, 108, 108, 32, 123, 32, 98,
+    97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58,
+    32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 105, 109, 97, 103,
+    101, 58, 110, 111, 110, 101, 32, 33, 105, 109, 112, 111, 114, 116, 97, 110,
+    116, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61,
+    34, 114, 97, 100, 105, 111, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91,
+    116, 121, 112, 101, 61, 34, 99, 104, 101, 99, 107, 98, 111, 120, 34, 93,
+    32, 123, 32, 109, 97, 114, 103, 105, 110, 58, 32, 51, 112, 120, 32, 48,
+    46, 53, 101, 120, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 105,
+    110, 105, 116, 105, 97, 108, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117,
+    110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 105, 110, 105, 116, 105, 97,
+    108, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 105, 110, 105, 116, 105,
+    97, 108, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
+    61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 44, 32, 105, 110, 112, 117,
+    116, 91, 116, 121, 112, 101, 61, 34, 115, 117, 98, 109, 105, 116, 34, 93,
+    44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101,
+    115, 101, 116, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
+    101, 61, 34, 102, 105, 108, 101, 34, 93, 58, 58, 45, 119, 101, 98, 107,
+    105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100, 45, 98,
+    117, 116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45,
+    97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 112, 117, 115, 104,
+    45, 98, 117, 116, 116, 111, 110, 59, 32, 119, 104, 105, 116, 101, 45, 115,
+    112, 97, 99, 101, 58, 32, 112, 114, 101, 32, 125, 32, 105, 110, 112, 117,
+    116, 91, 116, 121, 112, 101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93,
+    44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 117,
+    98, 109, 105, 116, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121,
+    112, 101, 61, 34, 114, 101, 115, 101, 116, 34, 93, 44, 32, 105, 110, 112,
+    117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108, 101, 34, 93, 58,
     58, 45, 119, 101, 98, 107, 105, 116, 45, 102, 105, 108, 101, 45, 117, 112,
     108, 111, 97, 100, 45, 98, 117, 116, 116, 111, 110, 44, 32, 98, 117, 116,
-    116, 111, 110, 58, 97, 99, 116, 105, 118, 101, 32, 123, 32, 98, 111, 114,
-    100, 101, 114, 45, 115, 116, 121, 108, 101, 58, 32, 105, 110, 115, 101, 116,
-    32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 98,
-    117, 116, 116, 111, 110, 34, 93, 58, 97, 99, 116, 105, 118, 101, 58, 100,
+    116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111,
+    120, 45, 97, 108, 105, 103, 110, 58, 32, 99, 101, 110, 116, 101, 114, 59,
+    32, 116, 101, 120, 116, 45, 97, 108, 105, 103, 110, 58, 32, 99, 101, 110,
+    116, 101, 114, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32, 100, 101, 102,
+    97, 117, 108, 116, 59, 32, 99, 111, 108, 111, 114, 58, 32, 66, 117, 116,
+    116, 111, 110, 84, 101, 120, 116, 59, 32, 112, 97, 100, 100, 105, 110, 103,
+    58, 32, 50, 112, 120, 32, 54, 112, 120, 32, 51, 112, 120, 32, 54, 112,
+    120, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 50, 112, 120, 32, 111,
+    117, 116, 115, 101, 116, 32, 66, 117, 116, 116, 111, 110, 70, 97, 99, 101,
+    59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108,
+    111, 114, 58, 32, 66, 117, 116, 116, 111, 110, 70, 97, 99, 101, 59, 32,
+    45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105, 122, 105,
+    110, 103, 58, 32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120, 32, 125,
+    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 97, 110,
+    103, 101, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97,
+    112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 115, 108, 105, 100, 101,
+    114, 45, 104, 111, 114, 105, 122, 111, 110, 116, 97, 108, 59, 32, 112, 97,
+    100, 100, 105, 110, 103, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32,
+    98, 111, 114, 100, 101, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59,
+    32, 109, 97, 114, 103, 105, 110, 58, 32, 50, 112, 120, 59, 32, 125, 32,
+    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 97, 110, 103,
+    101, 34, 93, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 115, 108, 105,
+    100, 101, 114, 45, 116, 104, 117, 109, 98, 32, 123, 32, 45, 119, 101, 98,
+    107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32,
+    115, 108, 105, 100, 101, 114, 116, 104, 117, 109, 98, 45, 104, 111, 114, 105,
+    122, 111, 110, 116, 97, 108, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91,
+    116, 121, 112, 101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 58, 100,
     105, 115, 97, 98, 108, 101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116,
+    121, 112, 101, 61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 58, 100, 105,
+    115, 97, 98, 108, 101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121,
+    112, 101, 61, 34, 114, 101, 115, 101, 116, 34, 93, 58, 100, 105, 115, 97,
+    98, 108, 101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
+    61, 34, 102, 105, 108, 101, 34, 93, 58, 100, 105, 115, 97, 98, 108, 101,
+    100, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 102, 105, 108, 101, 45,
+    117, 112, 108, 111, 97, 100, 45, 98, 117, 116, 116, 111, 110, 44, 32, 98,
+    117, 116, 116, 111, 110, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32,
+    115, 101, 108, 101, 99, 116, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44,
+    32, 107, 101, 121, 103, 101, 110, 58, 100, 105, 115, 97, 98, 108, 101, 100,
+    44, 32, 111, 112, 116, 103, 114, 111, 117, 112, 58, 100, 105, 115, 97, 98,
+    108, 101, 100, 44, 32, 111, 112, 116, 105, 111, 110, 58, 100, 105, 115, 97,
+    98, 108, 101, 100, 44, 32, 100, 97, 116, 97, 103, 114, 105, 100, 58, 100,
+    105, 115, 97, 98, 108, 101, 100, 32, 123, 32, 99, 111, 108, 111, 114, 58,
+    32, 71, 114, 97, 121, 84, 101, 120, 116, 32, 125, 32, 105, 110, 112, 117,
+    116, 91, 116, 121, 112, 101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93,
+    58, 97, 99, 116, 105, 118, 101, 44, 32, 105, 110, 112, 117, 116, 91, 116,
     121, 112, 101, 61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 58, 97, 99,
-    116, 105, 118, 101, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 105,
-    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116,
+    116, 105, 118, 101, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
+    61, 34, 114, 101, 115, 101, 116, 34, 93, 58, 97, 99, 116, 105, 118, 101,
+    44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105,
+    108, 101, 34, 93, 58, 97, 99, 116, 105, 118, 101, 58, 58, 45, 119, 101,
+    98, 107, 105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100,
+    45, 98, 117, 116, 116, 111, 110, 44, 32, 98, 117, 116, 116, 111, 110, 58,
+    97, 99, 116, 105, 118, 101, 32, 123, 32, 98, 111, 114, 100, 101, 114, 45,
+    115, 116, 121, 108, 101, 58, 32, 105, 110, 115, 101, 116, 32, 125, 32, 105,
+    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 98, 117, 116, 116, 111,
+    110, 34, 93, 58, 97, 99, 116, 105, 118, 101, 58, 100, 105, 115, 97, 98,
+    108, 101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61,
+    34, 115, 117, 98, 109, 105, 116, 34, 93, 58, 97, 99, 116, 105, 118, 101,
+    58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 105, 110, 112, 117, 116,
+    91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116, 34, 93, 58, 97,
+    99, 116, 105, 118, 101, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32,
+    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108, 101,
     34, 93, 58, 97, 99, 116, 105, 118, 101, 58, 100, 105, 115, 97, 98, 108,
-    101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
-    102, 105, 108, 101, 34, 93, 58, 97, 99, 116, 105, 118, 101, 58, 100, 105,
-    115, 97, 98, 108, 101, 100, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45,
-    102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100, 45, 98, 117, 116, 116,
-    111, 110, 44, 32, 98, 117, 116, 116, 111, 110, 58, 97, 99, 116, 105, 118,
-    101, 58, 100, 105, 115, 97, 98, 108, 101, 100, 32, 123, 32, 98, 111, 114,
-    100, 101, 114, 45, 115, 116, 121, 108, 101, 58, 32, 111, 117, 116, 115, 101,
-    116, 32, 125, 32, 97, 114, 101, 97, 44, 32, 112, 97, 114, 97, 109, 32,
-    123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111, 110, 101, 32,
-    125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 99, 104,
-    101, 99, 107, 98, 111, 120, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107,
-    105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 99,
-    104, 101, 99, 107, 98, 111, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116,
+    101, 100, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 102, 105, 108, 101,
+    45, 117, 112, 108, 111, 97, 100, 45, 98, 117, 116, 116, 111, 110, 44, 32,
+    98, 117, 116, 116, 111, 110, 58, 97, 99, 116, 105, 118, 101, 58, 100, 105,
+    115, 97, 98, 108, 101, 100, 32, 123, 32, 98, 111, 114, 100, 101, 114, 45,
+    115, 116, 121, 108, 101, 58, 32, 111, 117, 116, 115, 101, 116, 32, 125, 32,
+    97, 114, 101, 97, 44, 32, 112, 97, 114, 97, 109, 32, 123, 32, 100, 105,
+    115, 112, 108, 97, 121, 58, 32, 110, 111, 110, 101, 32, 125, 32, 105, 110,
+    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 99, 104, 101, 99, 107, 98,
+    111, 120, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97,
+    112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 99, 104, 101, 99, 107,
+    98, 111, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120,
+    45, 115, 105, 122, 105, 110, 103, 58, 32, 98, 111, 114, 100, 101, 114, 45,
+    98, 111, 120, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
+    101, 61, 34, 114, 97, 100, 105, 111, 34, 93, 32, 123, 32, 45, 119, 101,
+    98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58,
+    32, 114, 97, 100, 105, 111, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45,
+    98, 111, 120, 45, 115, 105, 122, 105, 110, 103, 58, 32, 98, 111, 114, 100,
+    101, 114, 45, 98, 111, 120, 59, 32, 125, 32, 107, 101, 121, 103, 101, 110,
+    44, 32, 115, 101, 108, 101, 99, 116, 32, 123, 32, 45, 119, 101, 98, 107,
+    105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109,
+    101, 110, 117, 108, 105, 115, 116, 59, 32, 45, 119, 101, 98, 107, 105, 116,
     45, 98, 111, 120, 45, 115, 105, 122, 105, 110, 103, 58, 32, 98, 111, 114,
-    100, 101, 114, 45, 98, 111, 120, 59, 32, 125, 32, 105, 110, 112, 117, 116,
-    91, 116, 121, 112, 101, 61, 34, 114, 97, 100, 105, 111, 34, 93, 32, 123,
-    32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97,
-    110, 99, 101, 58, 32, 114, 97, 100, 105, 111, 59, 32, 45, 119, 101, 98,
-    107, 105, 116, 45, 98, 111, 120, 45, 115, 105, 122, 105, 110, 103, 58, 32,
-    98, 111, 114, 100, 101, 114, 45, 98, 111, 120, 59, 32, 125, 32, 107, 101,
-    121, 103, 101, 110, 44, 32, 115, 101, 108, 101, 99, 116, 32, 123, 32, 45,
-    119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99,
-    101, 58, 32, 109, 101, 110, 117, 108, 105, 115, 116, 59, 32, 45, 119, 101,
-    98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105, 122, 105, 110, 103, 58,
-    32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120, 59, 32, 45, 119, 101,
-    98, 107, 105, 116, 45, 98, 111, 120, 45, 97, 108, 105, 103, 110, 58, 32,
-    99, 101, 110, 116, 101, 114, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32,
-    49, 112, 120, 32, 115, 111, 108, 105, 100, 59, 32, 45, 119, 101, 98, 107,
-    105, 116, 45, 98, 111, 114, 100, 101, 114, 45, 114, 97, 100, 105, 117, 115,
-    58, 32, 53, 112, 120, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97,
-    99, 101, 58, 32, 112, 114, 101, 59, 32, 45, 119, 101, 98, 107, 105, 116,
-    45, 114, 116, 108, 45, 111, 114, 100, 101, 114, 105, 110, 103, 58, 32, 108,
-    111, 103, 105, 99, 97, 108, 59, 32, 99, 111, 108, 111, 114, 58, 32, 98,
-    108, 97, 99, 107, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100,
-    45, 99, 111, 108, 111, 114, 58, 32, 119, 104, 105, 116, 101, 59, 32, 99,
-    117, 114, 115, 111, 114, 58, 32, 100, 101, 102, 97, 117, 108, 116, 59, 32,
-    125, 32, 115, 101, 108, 101, 99, 116, 91, 115, 105, 122, 101, 93, 44, 32,
-    115, 101, 108, 101, 99, 116, 91, 109, 117, 108, 116, 105, 112, 108, 101, 93,
-    44, 32, 115, 101, 108, 101, 99, 116, 91, 115, 105, 122, 101, 93, 91, 109,
-    117, 108, 116, 105, 112, 108, 101, 93, 32, 123, 32, 45, 119, 101, 98, 107,
-    105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 108,
-    105, 115, 116, 98, 111, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45,
-    98, 111, 120, 45, 97, 108, 105, 103, 110, 58, 32, 115, 116, 97, 114, 116,
-    59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 49, 112, 120, 32, 105, 110,
-    115, 101, 116, 32, 103, 114, 97, 121, 59, 32, 45, 119, 101, 98, 107, 105,
-    116, 45, 98, 111, 114, 100, 101, 114, 45, 114, 97, 100, 105, 117, 115, 58,
-    32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 119, 104, 105, 116, 101, 45,
-    115, 112, 97, 99, 101, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32,
-    125, 32, 115, 101, 108, 101, 99, 116, 91, 115, 105, 122, 101, 61, 34, 48,
-    34, 93, 44, 32, 115, 101, 108, 101, 99, 116, 91, 115, 105, 122, 101, 61,
-    34, 49, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97,
-    112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 110, 117, 108,
-    105, 115, 116, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120,
-    45, 97, 108, 105, 103, 110, 58, 32, 99, 101, 110, 116, 101, 114, 59, 32,
-    98, 111, 114, 100, 101, 114, 58, 32, 49, 112, 120, 32, 115, 111, 108, 105,
-    100, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 114, 100, 101,
-    114, 45, 114, 97, 100, 105, 117, 115, 58, 32, 53, 112, 120, 59, 32, 119,
-    104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 112, 114, 101, 59,
-    32, 125, 32, 111, 112, 116, 103, 114, 111, 117, 112, 32, 123, 32, 102, 111,
+    100, 101, 114, 45, 98, 111, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116,
+    45, 98, 111, 120, 45, 97, 108, 105, 103, 110, 58, 32, 99, 101, 110, 116,
+    101, 114, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 49, 112, 120, 32,
+    115, 111, 108, 105, 100, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98,
+    111, 114, 100, 101, 114, 45, 114, 97, 100, 105, 117, 115, 58, 32, 53, 112,
+    120, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32,
+    112, 114, 101, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 114, 116, 108,
+    45, 111, 114, 100, 101, 114, 105, 110, 103, 58, 32, 108, 111, 103, 105, 99,
+    97, 108, 59, 32, 99, 111, 108, 111, 114, 58, 32, 98, 108, 97, 99, 107,
+    59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108,
+    111, 114, 58, 32, 119, 104, 105, 116, 101, 59, 32, 99, 117, 114, 115, 111,
+    114, 58, 32, 100, 101, 102, 97, 117, 108, 116, 59, 32, 125, 32, 115, 101,
+    108, 101, 99, 116, 91, 115, 105, 122, 101, 93, 44, 32, 115, 101, 108, 101,
+    99, 116, 91, 109, 117, 108, 116, 105, 112, 108, 101, 93, 44, 32, 115, 101,
+    108, 101, 99, 116, 91, 115, 105, 122, 101, 93, 91, 109, 117, 108, 116, 105,
+    112, 108, 101, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97,
+    112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 108, 105, 115, 116, 98,
+    111, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45,
+    97, 108, 105, 103, 110, 58, 32, 115, 116, 97, 114, 116, 59, 32, 98, 111,
+    114, 100, 101, 114, 58, 32, 49, 112, 120, 32, 105, 110, 115, 101, 116, 32,
+    103, 114, 97, 121, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111,
+    114, 100, 101, 114, 45, 114, 97, 100, 105, 117, 115, 58, 32, 105, 110, 105,
+    116, 105, 97, 108, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99,
+    101, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 125, 32, 115, 101,
+    108, 101, 99, 116, 91, 115, 105, 122, 101, 61, 34, 48, 34, 93, 44, 32,
+    115, 101, 108, 101, 99, 116, 91, 115, 105, 122, 101, 61, 34, 49, 34, 93,
+    32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97,
+    114, 97, 110, 99, 101, 58, 32, 109, 101, 110, 117, 108, 105, 115, 116, 59,
+    32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 97, 108, 105,
+    103, 110, 58, 32, 99, 101, 110, 116, 101, 114, 59, 32, 98, 111, 114, 100,
+    101, 114, 58, 32, 49, 112, 120, 32, 115, 111, 108, 105, 100, 59, 32, 45,
+    119, 101, 98, 107, 105, 116, 45, 98, 111, 114, 100, 101, 114, 45, 114, 97,
+    100, 105, 117, 115, 58, 32, 53, 112, 120, 59, 32, 119, 104, 105, 116, 101,
+    45, 115, 112, 97, 99, 101, 58, 32, 112, 114, 101, 59, 32, 125, 32, 100,
+    97, 116, 97, 108, 105, 115, 116, 32, 123, 32, 100, 105, 115, 112, 108, 97,
+    121, 58, 32, 110, 111, 110, 101, 59, 32, 125, 32, 111, 112, 116, 103, 114,
+    111, 117, 112, 32, 123, 32, 102, 111, 110, 116, 45, 119, 101, 105, 103, 104,
+    116, 58, 32, 98, 111, 108, 100, 101, 114, 59, 32, 125, 32, 111, 112, 116,
+    105, 111, 110, 32, 123, 32, 102, 111, 110, 116, 45, 119, 101, 105, 103, 104,
+    116, 58, 32, 110, 111, 114, 109, 97, 108, 59, 32, 125, 32, 100, 97, 116,
+    97, 103, 114, 105, 100, 32, 123, 32, 104, 101, 105, 103, 104, 116, 58, 32,
+    49, 53, 48, 112, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97,
+    112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 100, 97, 116, 97, 103,
+    114, 105, 100, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120,
+    45, 115, 105, 122, 105, 110, 103, 58, 32, 98, 111, 114, 100, 101, 114, 45,
+    98, 111, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 114, 116, 108,
+    45, 111, 114, 100, 101, 114, 105, 110, 103, 58, 32, 108, 111, 103, 105, 99,
+    97, 108, 59, 32, 99, 111, 108, 111, 114, 58, 32, 98, 108, 97, 99, 107,
+    59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108,
+    111, 114, 58, 32, 119, 104, 105, 116, 101, 59, 32, 99, 117, 114, 115, 111,
+    114, 58, 32, 100, 101, 102, 97, 117, 108, 116, 59, 32, 98, 111, 114, 100,
+    101, 114, 58, 32, 49, 112, 120, 32, 105, 110, 115, 101, 116, 32, 103, 114,
+    97, 121, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58,
+    32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 125, 32, 117, 44, 32, 105,
+    110, 115, 32, 123, 32, 116, 101, 120, 116, 45, 100, 101, 99, 111, 114, 97,
+    116, 105, 111, 110, 58, 32, 117, 110, 100, 101, 114, 108, 105, 110, 101, 32,
+    125, 32, 115, 116, 114, 111, 110, 103, 44, 32, 98, 32, 123, 32, 102, 111,
     110, 116, 45, 119, 101, 105, 103, 104, 116, 58, 32, 98, 111, 108, 100, 101,
-    114, 59, 32, 125, 32, 111, 112, 116, 105, 111, 110, 32, 123, 32, 102, 111,
-    110, 116, 45, 119, 101, 105, 103, 104, 116, 58, 32, 110, 111, 114, 109, 97,
-    108, 59, 32, 125, 32, 100, 97, 116, 97, 103, 114, 105, 100, 32, 123, 32,
-    104, 101, 105, 103, 104, 116, 58, 32, 49, 53, 48, 112, 120, 59, 32, 45,
-    119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99,
-    101, 58, 32, 100, 97, 116, 97, 103, 114, 105, 100, 59, 32, 45, 119, 101,
-    98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105, 122, 105, 110, 103, 58,
-    32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120, 59, 32, 45, 119, 101,
-    98, 107, 105, 116, 45, 114, 116, 108, 45, 111, 114, 100, 101, 114, 105, 110,
-    103, 58, 32, 108, 111, 103, 105, 99, 97, 108, 59, 32, 99, 111, 108, 111,
-    114, 58, 32, 98, 108, 97, 99, 107, 59, 32, 98, 97, 99, 107, 103, 114,
-    111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 119, 104, 105, 116,
-    101, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32, 100, 101, 102, 97, 117,
-    108, 116, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 49, 112, 120, 32,
-    105, 110, 115, 101, 116, 32, 103, 114, 97, 121, 59, 32, 119, 104, 105, 116,
-    101, 45, 115, 112, 97, 99, 101, 58, 32, 105, 110, 105, 116, 105, 97, 108,
-    59, 32, 125, 32, 117, 44, 32, 105, 110, 115, 32, 123, 32, 116, 101, 120,
-    116, 45, 100, 101, 99, 111, 114, 97, 116, 105, 111, 110, 58, 32, 117, 110,
-    100, 101, 114, 108, 105, 110, 101, 32, 125, 32, 115, 116, 114, 111, 110, 103,
-    44, 32, 98, 32, 123, 32, 102, 111, 110, 116, 45, 119, 101, 105, 103, 104,
-    116, 58, 32, 98, 111, 108, 100, 101, 114, 32, 125, 32, 105, 44, 32, 99,
-    105, 116, 101, 44, 32, 101, 109, 44, 32, 118, 97, 114, 44, 32, 97, 100,
-    100, 114, 101, 115, 115, 32, 123, 32, 102, 111, 110, 116, 45, 115, 116, 121,
-    108, 101, 58, 32, 105, 116, 97, 108, 105, 99, 32, 125, 32, 116, 116, 44,
-    32, 99, 111, 100, 101, 44, 32, 107, 98, 100, 44, 32, 115, 97, 109, 112,
-    32, 123, 32, 102, 111, 110, 116, 45, 102, 97, 109, 105, 108, 121, 58, 32,
-    109, 111, 110, 111, 115, 112, 97, 99, 101, 32, 125, 32, 112, 114, 101, 44,
-    32, 120, 109, 112, 44, 32, 112, 108, 97, 105, 110, 116, 101, 120, 116, 44,
-    32, 108, 105, 115, 116, 105, 110, 103, 32, 123, 32, 100, 105, 115, 112, 108,
-    97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 102, 111, 110, 116, 45,
+    114, 32, 125, 32, 105, 44, 32, 99, 105, 116, 101, 44, 32, 101, 109, 44,
+    32, 118, 97, 114, 44, 32, 97, 100, 100, 114, 101, 115, 115, 32, 123, 32,
+    102, 111, 110, 116, 45, 115, 116, 121, 108, 101, 58, 32, 105, 116, 97, 108,
+    105, 99, 32, 125, 32, 116, 116, 44, 32, 99, 111, 100, 101, 44, 32, 107,
+    98, 100, 44, 32, 115, 97, 109, 112, 32, 123, 32, 102, 111, 110, 116, 45,
     102, 97, 109, 105, 108, 121, 58, 32, 109, 111, 110, 111, 115, 112, 97, 99,
-    101, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32,
-    112, 114, 101, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 49, 95, 95,
-    113, 101, 109, 32, 48, 32, 125, 32, 98, 105, 103, 32, 123, 32, 102, 111,
-    110, 116, 45, 115, 105, 122, 101, 58, 32, 108, 97, 114, 103, 101, 114, 32,
-    125, 32, 115, 109, 97, 108, 108, 32, 123, 32, 102, 111, 110, 116, 45, 115,
-    105, 122, 101, 58, 32, 115, 109, 97, 108, 108, 101, 114, 32, 125, 32, 115,
-    44, 32, 115, 116, 114, 105, 107, 101, 44, 32, 100, 101, 108, 32, 123, 32,
-    116, 101, 120, 116, 45, 100, 101, 99, 111, 114, 97, 116, 105, 111, 110, 58,
-    32, 108, 105, 110, 101, 45, 116, 104, 114, 111, 117, 103, 104, 32, 125, 32,
-    115, 117, 98, 32, 123, 32, 118, 101, 114, 116, 105, 99, 97, 108, 45, 97,
-    108, 105, 103, 110, 58, 32, 115, 117, 98, 59, 32, 102, 111, 110, 116, 45,
-    115, 105, 122, 101, 58, 32, 115, 109, 97, 108, 108, 101, 114, 32, 125, 32,
-    115, 117, 112, 32, 123, 32, 118, 101, 114, 116, 105, 99, 97, 108, 45, 97,
-    108, 105, 103, 110, 58, 32, 115, 117, 112, 101, 114, 59, 32, 102, 111, 110,
-    116, 45, 115, 105, 122, 101, 58, 32, 115, 109, 97, 108, 108, 101, 114, 32,
-    125, 32, 110, 111, 98, 114, 32, 123, 32, 119, 104, 105, 116, 101, 45, 115,
-    112, 97, 99, 101, 58, 32, 110, 111, 119, 114, 97, 112, 32, 125, 32, 58,
-    102, 111, 99, 117, 115, 32, 123, 32, 111, 117, 116, 108, 105, 110, 101, 58,
-    32, 97, 117, 116, 111, 32, 53, 112, 120, 32, 45, 119, 101, 98, 107, 105,
-    116, 45, 102, 111, 99, 117, 115, 45, 114, 105, 110, 103, 45, 99, 111, 108,
-    111, 114, 32, 125, 32, 104, 116, 109, 108, 58, 102, 111, 99, 117, 115, 44,
-    32, 98, 111, 100, 121, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112,
-    117, 116, 91, 114, 101, 97, 100, 111, 110, 108, 121, 93, 58, 102, 111, 99,
-    117, 115, 32, 123, 32, 111, 117, 116, 108, 105, 110, 101, 58, 32, 110, 111,
-    110, 101, 32, 125, 32, 105, 110, 112, 117, 116, 58, 102, 111, 99, 117, 115,
-    44, 32, 116, 101, 120, 116, 97, 114, 101, 97, 58, 102, 111, 99, 117, 115,
-    44, 32, 105, 115, 105, 110, 100, 101, 120, 58, 102, 111, 99, 117, 115, 44,
-    32, 107, 101, 121, 103, 101, 110, 58, 102, 111, 99, 117, 115, 44, 32, 115,
-    101, 108, 101, 99, 116, 58, 102, 111, 99, 117, 115, 32, 123, 32, 111, 117,
-    116, 108, 105, 110, 101, 45, 111, 102, 102, 115, 101, 116, 58, 32, 45, 50,
-    112, 120, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61,
-    34, 98, 117, 116, 116, 111, 110, 34, 93, 58, 102, 111, 99, 117, 115, 44,
-    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 99, 104, 101,
-    99, 107, 98, 111, 120, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105,
-    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108, 101, 34,
+    101, 32, 125, 32, 112, 114, 101, 44, 32, 120, 109, 112, 44, 32, 112, 108,
+    97, 105, 110, 116, 101, 120, 116, 44, 32, 108, 105, 115, 116, 105, 110, 103,
+    32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99,
+    107, 59, 32, 102, 111, 110, 116, 45, 102, 97, 109, 105, 108, 121, 58, 32,
+    109, 111, 110, 111, 115, 112, 97, 99, 101, 59, 32, 119, 104, 105, 116, 101,
+    45, 115, 112, 97, 99, 101, 58, 32, 112, 114, 101, 59, 32, 109, 97, 114,
+    103, 105, 110, 58, 32, 49, 95, 95, 113, 101, 109, 32, 48, 32, 125, 32,
+    98, 105, 103, 32, 123, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58,
+    32, 108, 97, 114, 103, 101, 114, 32, 125, 32, 115, 109, 97, 108, 108, 32,
+    123, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 115, 109, 97,
+    108, 108, 101, 114, 32, 125, 32, 115, 44, 32, 115, 116, 114, 105, 107, 101,
+    44, 32, 100, 101, 108, 32, 123, 32, 116, 101, 120, 116, 45, 100, 101, 99,
+    111, 114, 97, 116, 105, 111, 110, 58, 32, 108, 105, 110, 101, 45, 116, 104,
+    114, 111, 117, 103, 104, 32, 125, 32, 115, 117, 98, 32, 123, 32, 118, 101,
+    114, 116, 105, 99, 97, 108, 45, 97, 108, 105, 103, 110, 58, 32, 115, 117,
+    98, 59, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 115, 109,
+    97, 108, 108, 101, 114, 32, 125, 32, 115, 117, 112, 32, 123, 32, 118, 101,
+    114, 116, 105, 99, 97, 108, 45, 97, 108, 105, 103, 110, 58, 32, 115, 117,
+    112, 101, 114, 59, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32,
+    115, 109, 97, 108, 108, 101, 114, 32, 125, 32, 110, 111, 98, 114, 32, 123,
+    32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 110, 111,
+    119, 114, 97, 112, 32, 125, 32, 58, 102, 111, 99, 117, 115, 32, 123, 32,
+    111, 117, 116, 108, 105, 110, 101, 58, 32, 97, 117, 116, 111, 32, 53, 112,
+    120, 32, 45, 119, 101, 98, 107, 105, 116, 45, 102, 111, 99, 117, 115, 45,
+    114, 105, 110, 103, 45, 99, 111, 108, 111, 114, 32, 125, 32, 104, 116, 109,
+    108, 58, 102, 111, 99, 117, 115, 44, 32, 98, 111, 100, 121, 58, 102, 111,
+    99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 114, 101, 97, 100, 111,
+    110, 108, 121, 93, 58, 102, 111, 99, 117, 115, 32, 123, 32, 111, 117, 116,
+    108, 105, 110, 101, 58, 32, 110, 111, 110, 101, 32, 125, 32, 105, 110, 112,
+    117, 116, 58, 102, 111, 99, 117, 115, 44, 32, 116, 101, 120, 116, 97, 114,
+    101, 97, 58, 102, 111, 99, 117, 115, 44, 32, 105, 115, 105, 110, 100, 101,
+    120, 58, 102, 111, 99, 117, 115, 44, 32, 107, 101, 121, 103, 101, 110, 58,
+    102, 111, 99, 117, 115, 44, 32, 115, 101, 108, 101, 99, 116, 58, 102, 111,
+    99, 117, 115, 32, 123, 32, 111, 117, 116, 108, 105, 110, 101, 45, 111, 102,
+    102, 115, 101, 116, 58, 32, 45, 50, 112, 120, 32, 125, 32, 105, 110, 112,
+    117, 116, 91, 116, 121, 112, 101, 61, 34, 98, 117, 116, 116, 111, 110, 34,
     93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116,
-    121, 112, 101, 61, 34, 104, 105, 100, 100, 101, 110, 34, 93, 58, 102, 111,
-    99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61,
-    34, 105, 109, 97, 103, 101, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32,
-    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 97, 100, 105,
-    111, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116,
-    91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116, 34, 93, 58, 102,
+    121, 112, 101, 61, 34, 99, 104, 101, 99, 107, 98, 111, 120, 34, 93, 58,
+    102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
+    101, 61, 34, 102, 105, 108, 101, 34, 93, 58, 102, 111, 99, 117, 115, 44,
+    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 104, 105, 100,
+    100, 101, 110, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112,
+    117, 116, 91, 116, 121, 112, 101, 61, 34, 105, 109, 97, 103, 101, 34, 93,
+    58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121,
+    112, 101, 61, 34, 114, 97, 100, 105, 111, 34, 93, 58, 102, 111, 99, 117,
+    115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114,
+    101, 115, 101, 116, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110,
+    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 101, 97, 114, 99, 104,
+    34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91,
+    116, 121, 112, 101, 61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 58, 102,
     111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
-    61, 34, 115, 101, 97, 114, 99, 104, 34, 93, 58, 102, 111, 99, 117, 115,
-    44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 117,
-    98, 109, 105, 116, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110,
-    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108, 101, 34, 93,
-    58, 102, 111, 99, 117, 115, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45,
-    102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100, 45, 98, 117, 116, 116,
-    111, 110, 32, 123, 32, 111, 117, 116, 108, 105, 110, 101, 45, 111, 102, 102,
-    115, 101, 116, 58, 32, 48, 32, 125, 32, 97, 58, 45, 119, 101, 98, 107,
-    105, 116, 45, 97, 110, 121, 45, 108, 105, 110, 107, 32, 123, 32, 99, 111,
-    108, 111, 114, 58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 108, 105, 110,
-    107, 59, 32, 116, 101, 120, 116, 45, 100, 101, 99, 111, 114, 97, 116, 105,
-    111, 110, 58, 32, 117, 110, 100, 101, 114, 108, 105, 110, 101, 59, 32, 99,
-    117, 114, 115, 111, 114, 58, 32, 97, 117, 116, 111, 59, 32, 125, 32, 97,
-    58, 45, 119, 101, 98, 107, 105, 116, 45, 97, 110, 121, 45, 108, 105, 110,
-    107, 58, 97, 99, 116, 105, 118, 101, 32, 123, 32, 99, 111, 108, 111, 114,
-    58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 99, 116, 105, 118, 101,
-    108, 105, 110, 107, 32, 125, 32, 110, 111, 102, 114, 97, 109, 101, 115, 32,
-    123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111, 110, 101, 32,
-    125, 32, 102, 114, 97, 109, 101, 115, 101, 116, 44, 32, 102, 114, 97, 109,
-    101, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111,
-    99, 107, 32, 125, 32, 102, 114, 97, 109, 101, 115, 101, 116, 32, 123, 32,
-    98, 111, 114, 100, 101, 114, 45, 99, 111, 108, 111, 114, 58, 32, 105, 110,
-    104, 101, 114, 105, 116, 32, 125, 32, 105, 102, 114, 97, 109, 101, 32, 123,
-    32, 98, 111, 114, 100, 101, 114, 58, 32, 50, 112, 120, 32, 105, 110, 115,
-    101, 116, 32, 125
+    61, 34, 102, 105, 108, 101, 34, 93, 58, 102, 111, 99, 117, 115, 58, 58,
+    45, 119, 101, 98, 107, 105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108,
+    111, 97, 100, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 111, 117, 116,
+    108, 105, 110, 101, 45, 111, 102, 102, 115, 101, 116, 58, 32, 48, 32, 125,
+    32, 97, 58, 45, 119, 101, 98, 107, 105, 116, 45, 97, 110, 121, 45, 108,
+    105, 110, 107, 32, 123, 32, 99, 111, 108, 111, 114, 58, 32, 45, 119, 101,
+    98, 107, 105, 116, 45, 108, 105, 110, 107, 59, 32, 116, 101, 120, 116, 45,
+    100, 101, 99, 111, 114, 97, 116, 105, 111, 110, 58, 32, 117, 110, 100, 101,
+    114, 108, 105, 110, 101, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32, 97,
+    117, 116, 111, 59, 32, 125, 32, 97, 58, 45, 119, 101, 98, 107, 105, 116,
+    45, 97, 110, 121, 45, 108, 105, 110, 107, 58, 97, 99, 116, 105, 118, 101,
+    32, 123, 32, 99, 111, 108, 111, 114, 58, 32, 45, 119, 101, 98, 107, 105,
+    116, 45, 97, 99, 116, 105, 118, 101, 108, 105, 110, 107, 32, 125, 32, 110,
+    111, 102, 114, 97, 109, 101, 115, 32, 123, 32, 100, 105, 115, 112, 108, 97,
+    121, 58, 32, 110, 111, 110, 101, 32, 125, 32, 102, 114, 97, 109, 101, 115,
+    101, 116, 44, 32, 102, 114, 97, 109, 101, 32, 123, 32, 100, 105, 115, 112,
+    108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 32, 125, 32, 102, 114, 97,
+    109, 101, 115, 101, 116, 32, 123, 32, 98, 111, 114, 100, 101, 114, 45, 99,
+    111, 108, 111, 114, 58, 32, 105, 110, 104, 101, 114, 105, 116, 32, 125, 32,
+    105, 102, 114, 97, 109, 101, 32, 123, 32, 98, 111, 114, 100, 101, 114, 58,
+    32, 50, 112, 120, 32, 105, 110, 115, 101, 116, 32, 125
 };
 extern const char quirksUserAgentStyleSheet[359] = {
     105, 109, 103, 91, 97, 108, 105, 103, 110, 61, 34, 108, 101, 102, 116, 34,
@@ -714,7 +719,7 @@ extern const char sourceUserAgentStyleSheet[2004] = {
     112, 120, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 48, 32, 52, 112,
     120, 59, 32, 125
 };
-extern const char wmlUserAgentStyleSheet[2956] = {
+extern const char wmlUserAgentStyleSheet[3039] = {
     110, 97, 109, 101, 115, 112, 97, 99, 101, 32, 34, 104, 116, 116, 112, 58,
     47, 47, 119, 119, 119, 46, 119, 97, 112, 102, 111, 114, 117, 109, 46, 111,
     114, 103, 47, 68, 84, 68, 47, 119, 109, 108, 95, 49, 46, 49, 46, 120,
@@ -878,30 +883,35 @@ extern const char wmlUserAgentStyleSheet[2956] = {
     103, 32, 123, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 108,
     97, 114, 103, 101, 114, 32, 125, 32, 115, 109, 97, 108, 108, 32, 123, 32,
     102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 115, 109, 97, 108, 108,
-    101, 114, 32, 125, 32, 58, 102, 111, 99, 117, 115, 32, 123, 32, 111, 117,
-    116, 108, 105, 110, 101, 58, 32, 97, 117, 116, 111, 32, 53, 112, 120, 32,
-    45, 119, 101, 98, 107, 105, 116, 45, 102, 111, 99, 117, 115, 45, 114, 105,
-    110, 103, 45, 99, 111, 108, 111, 114, 32, 125, 32, 119, 109, 108, 58, 102,
-    111, 99, 117, 115, 44, 32, 99, 97, 114, 100, 58, 102, 111, 99, 117, 115,
-    32, 123, 32, 111, 117, 116, 108, 105, 110, 101, 58, 32, 110, 111, 110, 101,
-    32, 125, 32, 105, 110, 112, 117, 116, 58, 102, 111, 99, 117, 115, 44, 32,
-    115, 101, 108, 101, 99, 116, 58, 102, 111, 99, 117, 115, 32, 123, 32, 111,
-    117, 116, 108, 105, 110, 101, 45, 111, 102, 102, 115, 101, 116, 58, 32, 45,
-    50, 112, 120, 32, 125, 32, 97, 58, 45, 119, 101, 98, 107, 105, 116, 45,
-    97, 110, 121, 45, 108, 105, 110, 107, 44, 32, 97, 110, 99, 104, 111, 114,
-    58, 45, 119, 101, 98, 107, 105, 116, 45, 97, 110, 121, 45, 108, 105, 110,
-    107, 32, 123, 32, 99, 111, 108, 111, 114, 58, 32, 45, 119, 101, 98, 107,
-    105, 116, 45, 108, 105, 110, 107, 59, 32, 116, 101, 120, 116, 45, 100, 101,
-    99, 111, 114, 97, 116, 105, 111, 110, 58, 32, 117, 110, 100, 101, 114, 108,
-    105, 110, 101, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32, 97, 117, 116,
-    111, 59, 32, 125, 32, 97, 58, 45, 119, 101, 98, 107, 105, 116, 45, 97,
-    110, 121, 45, 108, 105, 110, 107, 58, 97, 99, 116, 105, 118, 101, 44, 32,
-    97, 110, 99, 104, 111, 114, 58, 45, 119, 101, 98, 107, 105, 116, 45, 97,
-    110, 121, 45, 108, 105, 110, 107, 58, 97, 99, 116, 105, 118, 101, 32, 123,
-    32, 99, 111, 108, 111, 114, 58, 32, 45, 119, 101, 98, 107, 105, 116, 45,
-    97, 99, 116, 105, 118, 101, 108, 105, 110, 107, 32, 125
+    101, 114, 32, 125, 32, 112, 114, 101, 32, 123, 32, 100, 105, 115, 112, 108,
+    97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 102, 111, 110, 116, 45,
+    102, 97, 109, 105, 108, 121, 58, 32, 109, 111, 110, 111, 115, 112, 97, 99,
+    101, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32,
+    112, 114, 101, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 49, 95, 95,
+    113, 101, 109, 32, 48, 32, 125, 32, 58, 102, 111, 99, 117, 115, 32, 123,
+    32, 111, 117, 116, 108, 105, 110, 101, 58, 32, 97, 117, 116, 111, 32, 53,
+    112, 120, 32, 45, 119, 101, 98, 107, 105, 116, 45, 102, 111, 99, 117, 115,
+    45, 114, 105, 110, 103, 45, 99, 111, 108, 111, 114, 32, 125, 32, 119, 109,
+    108, 58, 102, 111, 99, 117, 115, 44, 32, 99, 97, 114, 100, 58, 102, 111,
+    99, 117, 115, 32, 123, 32, 111, 117, 116, 108, 105, 110, 101, 58, 32, 110,
+    111, 110, 101, 32, 125, 32, 105, 110, 112, 117, 116, 58, 102, 111, 99, 117,
+    115, 44, 32, 115, 101, 108, 101, 99, 116, 58, 102, 111, 99, 117, 115, 32,
+    123, 32, 111, 117, 116, 108, 105, 110, 101, 45, 111, 102, 102, 115, 101, 116,
+    58, 32, 45, 50, 112, 120, 32, 125, 32, 97, 58, 45, 119, 101, 98, 107,
+    105, 116, 45, 97, 110, 121, 45, 108, 105, 110, 107, 44, 32, 97, 110, 99,
+    104, 111, 114, 58, 45, 119, 101, 98, 107, 105, 116, 45, 97, 110, 121, 45,
+    108, 105, 110, 107, 32, 123, 32, 99, 111, 108, 111, 114, 58, 32, 45, 119,
+    101, 98, 107, 105, 116, 45, 108, 105, 110, 107, 59, 32, 116, 101, 120, 116,
+    45, 100, 101, 99, 111, 114, 97, 116, 105, 111, 110, 58, 32, 117, 110, 100,
+    101, 114, 108, 105, 110, 101, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32,
+    97, 117, 116, 111, 59, 32, 125, 32, 97, 58, 45, 119, 101, 98, 107, 105,
+    116, 45, 97, 110, 121, 45, 108, 105, 110, 107, 58, 97, 99, 116, 105, 118,
+    101, 44, 32, 97, 110, 99, 104, 111, 114, 58, 45, 119, 101, 98, 107, 105,
+    116, 45, 97, 110, 121, 45, 108, 105, 110, 107, 58, 97, 99, 116, 105, 118,
+    101, 32, 123, 32, 99, 111, 108, 111, 114, 58, 32, 45, 119, 101, 98, 107,
+    105, 116, 45, 97, 99, 116, 105, 118, 101, 108, 105, 110, 107, 32, 125
 };
-extern const char mediaControlsUserAgentStyleSheet[2346] = {
+extern const char mediaControlsUserAgentStyleSheet[2582] = {
     97, 117, 100, 105, 111, 32, 123, 32, 119, 105, 100, 116, 104, 58, 32, 50,
     48, 48, 112, 120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 54,
     112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101,
@@ -998,56 +1008,71 @@ extern const char mediaControlsUserAgentStyleSheet[2346] = {
     103, 104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 112, 97, 100, 100, 105,
     110, 103, 58, 32, 48, 112, 120, 32, 50, 112, 120, 59, 32, 125, 32, 97,
     117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101,
-    100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 115, 101, 101,
-    107, 45, 98, 97, 99, 107, 45, 98, 117, 116, 116, 111, 110, 44, 32, 118,
-    105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101,
-    100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 115, 101, 101,
-    107, 45, 98, 97, 99, 107, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32,
-    45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110,
-    99, 101, 58, 32, 109, 101, 100, 105, 97, 45, 115, 101, 101, 107, 45, 98,
-    97, 99, 107, 45, 98, 117, 116, 116, 111, 110, 59, 32, 100, 105, 115, 112,
-    108, 97, 121, 58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120,
-    59, 32, 119, 105, 100, 116, 104, 58, 32, 49, 54, 112, 120, 59, 32, 104,
-    101, 105, 103, 104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 125, 32, 97,
+    100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 118, 111, 108,
+    117, 109, 101, 45, 115, 108, 105, 100, 101, 114, 45, 99, 111, 110, 116, 97,
+    105, 110, 101, 114, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101,
+    98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114,
+    111, 108, 115, 45, 118, 111, 108, 117, 109, 101, 45, 115, 108, 105, 100, 101,
+    114, 45, 99, 111, 110, 116, 97, 105, 110, 101, 114, 32, 123, 32, 100, 105,
+    115, 112, 108, 97, 121, 58, 32, 110, 111, 110, 101, 59, 32, 125, 32, 97,
     117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101,
-    100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 115, 101, 101,
-    107, 45, 102, 111, 114, 119, 97, 114, 100, 45, 98, 117, 116, 116, 111, 110,
-    44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116,
-    45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45,
-    115, 101, 101, 107, 45, 102, 111, 114, 119, 97, 114, 100, 45, 98, 117, 116,
-    116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112,
-    112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 100, 105, 97, 45,
-    115, 101, 101, 107, 45, 102, 111, 114, 119, 97, 114, 100, 45, 98, 117, 116,
-    116, 111, 110, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 45, 119,
-    101, 98, 107, 105, 116, 45, 98, 111, 120, 59, 32, 119, 105, 100, 116, 104,
-    58, 32, 49, 54, 112, 120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32,
-    49, 54, 112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45,
-    119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110,
-    116, 114, 111, 108, 115, 45, 102, 117, 108, 108, 115, 99, 114, 101, 101, 110,
-    45, 98, 117, 116, 116, 111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58,
-    45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111,
-    110, 116, 114, 111, 108, 115, 45, 102, 117, 108, 108, 115, 99, 114, 101, 101,
-    110, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107,
-    105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109,
-    101, 100, 105, 97, 45, 102, 117, 108, 108, 115, 99, 114, 101, 101, 110, 45,
+    100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 118, 111, 108,
+    117, 109, 101, 45, 115, 108, 105, 100, 101, 114, 44, 32, 118, 105, 100, 101,
+    111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97,
+    45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 118, 111, 108, 117, 109, 101,
+    45, 115, 108, 105, 100, 101, 114, 32, 123, 32, 100, 105, 115, 112, 108, 97,
+    121, 58, 32, 110, 111, 110, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111,
+    58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45,
+    99, 111, 110, 116, 114, 111, 108, 115, 45, 115, 101, 101, 107, 45, 98, 97,
+    99, 107, 45, 98, 117, 116, 116, 111, 110, 44, 32, 118, 105, 100, 101, 111,
+    58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45,
+    99, 111, 110, 116, 114, 111, 108, 115, 45, 115, 101, 101, 107, 45, 98, 97,
+    99, 107, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98,
+    107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32,
+    109, 101, 100, 105, 97, 45, 115, 101, 101, 107, 45, 98, 97, 99, 107, 45,
     98, 117, 116, 116, 111, 110, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58,
     32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 59, 32, 119, 105,
     100, 116, 104, 58, 32, 49, 54, 112, 120, 59, 32, 104, 101, 105, 103, 104,
     116, 58, 32, 49, 54, 112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111,
     58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45,
-    99, 111, 110, 116, 114, 111, 108, 115, 45, 114, 101, 119, 105, 110, 100, 45,
-    98, 117, 116, 116, 111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45,
-    119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110,
-    116, 114, 111, 108, 115, 45, 114, 101, 119, 105, 110, 100, 45, 98, 117, 116,
-    116, 111, 110, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110,
-    111, 110, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119,
+    99, 111, 110, 116, 114, 111, 108, 115, 45, 115, 101, 101, 107, 45, 102, 111,
+    114, 119, 97, 114, 100, 45, 98, 117, 116, 116, 111, 110, 44, 32, 118, 105,
+    100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100,
+    105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 115, 101, 101, 107,
+    45, 102, 111, 114, 119, 97, 114, 100, 45, 98, 117, 116, 116, 111, 110, 32,
+    123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114,
+    97, 110, 99, 101, 58, 32, 109, 101, 100, 105, 97, 45, 115, 101, 101, 107,
+    45, 102, 111, 114, 119, 97, 114, 100, 45, 98, 117, 116, 116, 111, 110, 59,
+    32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 45, 119, 101, 98, 107, 105,
+    116, 45, 98, 111, 120, 59, 32, 119, 105, 100, 116, 104, 58, 32, 49, 54,
+    112, 120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 54, 112, 120,
+    59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107,
+    105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108,
+    115, 45, 102, 117, 108, 108, 115, 99, 114, 101, 101, 110, 45, 98, 117, 116,
+    116, 111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98,
+    107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111,
+    108, 115, 45, 102, 117, 108, 108, 115, 99, 114, 101, 101, 110, 45, 98, 117,
+    116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97,
+    112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 100, 105, 97,
+    45, 102, 117, 108, 108, 115, 99, 114, 101, 101, 110, 45, 98, 117, 116, 116,
+    111, 110, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 45, 119, 101,
+    98, 107, 105, 116, 45, 98, 111, 120, 59, 32, 119, 105, 100, 116, 104, 58,
+    32, 49, 54, 112, 120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49,
+    54, 112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119,
     101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116,
-    114, 111, 108, 115, 45, 114, 101, 116, 117, 114, 110, 45, 116, 111, 45, 114,
-    101, 97, 108, 116, 105, 109, 101, 45, 98, 117, 116, 116, 111, 110, 44, 32,
-    118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109,
-    101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 114, 101,
-    116, 117, 114, 110, 45, 116, 111, 45, 114, 101, 97, 108, 116, 105, 109, 101,
-    45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 100, 105, 115, 112, 108, 97,
-    121, 58, 32, 110, 111, 110, 101, 59, 32, 125
+    114, 111, 108, 115, 45, 114, 101, 119, 105, 110, 100, 45, 98, 117, 116, 116,
+    111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107,
+    105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108,
+    115, 45, 114, 101, 119, 105, 110, 100, 45, 98, 117, 116, 116, 111, 110, 32,
+    123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111, 110, 101, 59,
+    32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105,
+    116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115,
+    45, 114, 101, 116, 117, 114, 110, 45, 116, 111, 45, 114, 101, 97, 108, 116,
+    105, 109, 101, 45, 98, 117, 116, 116, 111, 110, 44, 32, 118, 105, 100, 101,
+    111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97,
+    45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 114, 101, 116, 117, 114, 110,
+    45, 116, 111, 45, 114, 101, 97, 108, 116, 105, 109, 101, 45, 98, 117, 116,
+    116, 111, 110, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110,
+    111, 110, 101, 59, 32, 125
 };
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/WebKitVersion.h b/src/3rdparty/webkit/WebCore/generated/WebKitVersion.h
new file mode 100644
index 0000000..e7d6127
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/WebKitVersion.h
@@ -0,0 +1,36 @@
+/*
+ * THIS FILE IS AUTOMATICALLY GENERATED, DO NOT EDIT.
+ *
+ *
+ * Copyright (C) 2009 Apple Computer, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+
+#ifndef WebKitVersion_h
+#define WebKitVersion_h
+
+#define WEBKIT_MAJOR_VERSION 532
+#define WEBKIT_MINOR_VERSION 0
+
+#endif //WebKitVersion_h
diff --git a/src/3rdparty/webkit/WebCore/generated/XLinkNames.cpp b/src/3rdparty/webkit/WebCore/generated/XLinkNames.cpp
index 761929e..732c553 100644
--- a/src/3rdparty/webkit/WebCore/generated/XLinkNames.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/XLinkNames.cpp
@@ -1,8 +1,9 @@
 /*
- * THIS FILE IS AUTOMATICALLY GENERATED, DO NOT EDIT.
+ * THIS FILE WAS AUTOMATICALLY GENERATED, DO NOT EDIT.
  *
+ * This file was generated by the dom/make_names.pl script.
  *
- * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,10 +24,9 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-
 #include "config.h"
 #ifdef SKIP_STATIC_CONSTRUCTORS_ON_GCC
 #define DOM_XLinkNAMES_HIDE_GLOBALS 1
diff --git a/src/3rdparty/webkit/WebCore/generated/XLinkNames.h b/src/3rdparty/webkit/WebCore/generated/XLinkNames.h
index 9a9cb29..a07e163 100644
--- a/src/3rdparty/webkit/WebCore/generated/XLinkNames.h
+++ b/src/3rdparty/webkit/WebCore/generated/XLinkNames.h
@@ -1,8 +1,9 @@
 /*
- * THIS FILE IS AUTOMATICALLY GENERATED, DO NOT EDIT.
+ * THIS FILE WAS AUTOMATICALLY GENERATED, DO NOT EDIT.
  *
+ * This file was generated by the dom/make_names.pl script.
  *
- * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,10 +24,9 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-
 #ifndef DOM_XLinkNAMES_H
 #define DOM_XLinkNAMES_H
 
diff --git a/src/3rdparty/webkit/WebCore/generated/XMLNames.cpp b/src/3rdparty/webkit/WebCore/generated/XMLNames.cpp
index ae6e090..cd8e123 100644
--- a/src/3rdparty/webkit/WebCore/generated/XMLNames.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/XMLNames.cpp
@@ -1,8 +1,9 @@
 /*
- * THIS FILE IS AUTOMATICALLY GENERATED, DO NOT EDIT.
+ * THIS FILE WAS AUTOMATICALLY GENERATED, DO NOT EDIT.
  *
+ * This file was generated by the dom/make_names.pl script.
  *
- * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,10 +24,9 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-
 #include "config.h"
 #ifdef SKIP_STATIC_CONSTRUCTORS_ON_GCC
 #define DOM_XMLNAMES_HIDE_GLOBALS 1
diff --git a/src/3rdparty/webkit/WebCore/generated/XMLNames.h b/src/3rdparty/webkit/WebCore/generated/XMLNames.h
index f135e96..bdda2c2 100644
--- a/src/3rdparty/webkit/WebCore/generated/XMLNames.h
+++ b/src/3rdparty/webkit/WebCore/generated/XMLNames.h
@@ -1,8 +1,9 @@
 /*
- * THIS FILE IS AUTOMATICALLY GENERATED, DO NOT EDIT.
+ * THIS FILE WAS AUTOMATICALLY GENERATED, DO NOT EDIT.
  *
+ * This file was generated by the dom/make_names.pl script.
  *
- * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,10 +24,9 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-
 #ifndef DOM_XMLNAMES_H
 #define DOM_XMLNAMES_H
 
diff --git a/src/3rdparty/webkit/WebCore/generated/XPathGrammar.cpp b/src/3rdparty/webkit/WebCore/generated/XPathGrammar.cpp
index 5f34852..1120387 100644
--- a/src/3rdparty/webkit/WebCore/generated/XPathGrammar.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/XPathGrammar.cpp
@@ -1,23 +1,24 @@
-
-/* A Bison parser, made by GNU Bison 2.4.1.  */
+/* A Bison parser, made by GNU Bison 2.3.  */
 
 /* Skeleton implementation for Bison's Yacc-like parsers in C
-   
-      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
+
+   Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
    Free Software Foundation, Inc.
-   
-   This program is free software: you can redistribute it and/or modify
+
+   This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation, either version 3 of the License, or
-   (at your option) any later version.
-   
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
-   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin Street, Fifth Floor,
+   Boston, MA 02110-1301, USA.  */
 
 /* As a special exception, you may create a larger work that contains
    part or all of the Bison parser skeleton and distribute that work
@@ -28,7 +29,7 @@
    special exception, which will cause the skeleton and the resulting
    Bison output files to be licensed under the GNU General Public
    License without this special exception.
-   
+
    This special exception was added by the Free Software Foundation in
    version 2.2 of Bison.  */
 
@@ -46,7 +47,7 @@
 #define YYBISON 1
 
 /* Bison version.  */
-#define YYBISON_VERSION "2.4.1"
+#define YYBISON_VERSION "2.3"
 
 /* Skeleton name.  */
 #define YYSKELETON_NAME "yacc.c"
@@ -54,28 +55,69 @@
 /* Pure parsers.  */
 #define YYPURE 1
 
-/* Push parsers.  */
-#define YYPUSH 0
-
-/* Pull parsers.  */
-#define YYPULL 1
-
 /* Using locations.  */
 #define YYLSP_NEEDED 0
 
 /* Substitute the variable and function names.  */
-#define yyparse         xpathyyparse
-#define yylex           xpathyylex
-#define yyerror         xpathyyerror
-#define yylval          xpathyylval
-#define yychar          xpathyychar
-#define yydebug         xpathyydebug
-#define yynerrs         xpathyynerrs
+#define yyparse xpathyyparse
+#define yylex   xpathyylex
+#define yyerror xpathyyerror
+#define yylval  xpathyylval
+#define yychar  xpathyychar
+#define yydebug xpathyydebug
+#define yynerrs xpathyynerrs
+
+
+/* Tokens.  */
+#ifndef YYTOKENTYPE
+# define YYTOKENTYPE
+   /* Put the tokens into the symbol table, so that GDB and other debuggers
+      know about them.  */
+   enum yytokentype {
+     MULOP = 258,
+     RELOP = 259,
+     EQOP = 260,
+     MINUS = 261,
+     PLUS = 262,
+     AND = 263,
+     OR = 264,
+     AXISNAME = 265,
+     NODETYPE = 266,
+     PI = 267,
+     FUNCTIONNAME = 268,
+     LITERAL = 269,
+     VARIABLEREFERENCE = 270,
+     NUMBER = 271,
+     DOTDOT = 272,
+     SLASHSLASH = 273,
+     NAMETEST = 274,
+     XPATH_ERROR = 275
+   };
+#endif
+/* Tokens.  */
+#define MULOP 258
+#define RELOP 259
+#define EQOP 260
+#define MINUS 261
+#define PLUS 262
+#define AND 263
+#define OR 264
+#define AXISNAME 265
+#define NODETYPE 266
+#define PI 267
+#define FUNCTIONNAME 268
+#define LITERAL 269
+#define VARIABLEREFERENCE 270
+#define NUMBER 271
+#define DOTDOT 272
+#define SLASHSLASH 273
+#define NAMETEST 274
+#define XPATH_ERROR 275
+
 
 
-/* Copy the first part of user declarations.  */
 
-/* Line 189 of yacc.c  */
+/* Copy the first part of user declarations.  */
 #line 28 "../xml/XPathGrammar.y"
 
 
@@ -106,9 +148,6 @@ using namespace XPath;
 
 
 
-/* Line 189 of yacc.c  */
-#line 111 "WebCore/tmp/../generated/XPathGrammar.tab.c"
-
 /* Enabling traces.  */
 #ifndef YYDEBUG
 # define YYDEBUG 0
@@ -127,43 +166,10 @@ using namespace XPath;
 # define YYTOKEN_TABLE 0
 #endif
 
-
-/* Tokens.  */
-#ifndef YYTOKENTYPE
-# define YYTOKENTYPE
-   /* Put the tokens into the symbol table, so that GDB and other debuggers
-      know about them.  */
-   enum yytokentype {
-     MULOP = 258,
-     RELOP = 259,
-     EQOP = 260,
-     MINUS = 261,
-     PLUS = 262,
-     AND = 263,
-     OR = 264,
-     AXISNAME = 265,
-     NODETYPE = 266,
-     PI = 267,
-     FUNCTIONNAME = 268,
-     LITERAL = 269,
-     VARIABLEREFERENCE = 270,
-     NUMBER = 271,
-     DOTDOT = 272,
-     SLASHSLASH = 273,
-     NAMETEST = 274,
-     XPATH_ERROR = 275
-   };
-#endif
-
-
-
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
-{
-
-/* Line 214 of yacc.c  */
 #line 60 "../xml/XPathGrammar.y"
-
+{
     Step::Axis axis;
     Step::NodeTest* nodeTest;
     NumericOp::Opcode numop;
@@ -174,21 +180,18 @@ typedef union YYSTYPE
     Vector<Expression*>* argList;
     Step* step;
     LocationPath* locationPath;
-
-
-
-/* Line 214 of yacc.c  */
-#line 182 "WebCore/tmp/../generated/XPathGrammar.tab.c"
-} YYSTYPE;
-# define YYSTYPE_IS_TRIVIAL 1
+}
+/* Line 187 of yacc.c.  */
+#line 186 "WebCore/tmp/../generated/XPathGrammar.tab.c"
+	YYSTYPE;
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
+# define YYSTYPE_IS_TRIVIAL 1
 #endif
 
 
-/* Copy the second part of user declarations.  */
 
-/* Line 264 of yacc.c  */
+/* Copy the second part of user declarations.  */
 #line 73 "../xml/XPathGrammar.y"
 
 
@@ -197,8 +200,8 @@ static void xpathyyerror(const char*) { }
     
 
 
-/* Line 264 of yacc.c  */
-#line 202 "WebCore/tmp/../generated/XPathGrammar.tab.c"
+/* Line 216 of yacc.c.  */
+#line 205 "WebCore/tmp/../generated/XPathGrammar.tab.c"
 
 #ifdef short
 # undef short
@@ -273,14 +276,14 @@ typedef short int yytype_int16;
 #if (defined __STDC__ || defined __C99__FUNC__ \
      || defined __cplusplus || defined _MSC_VER)
 static int
-YYID (int yyi)
+YYID (int i)
 #else
 static int
-YYID (yyi)
-    int yyi;
+YYID (i)
+    int i;
 #endif
 {
-  return yyi;
+  return i;
 }
 #endif
 
@@ -361,9 +364,9 @@ void free (void *); /* INFRINGES ON USER NAME SPACE */
 /* A type that is properly aligned for any stack member.  */
 union yyalloc
 {
-  yytype_int16 yyss_alloc;
-  YYSTYPE yyvs_alloc;
-};
+  yytype_int16 yyss;
+  YYSTYPE yyvs;
+  };
 
 /* The size of the maximum gap between one aligned stack and the next.  */
 # define YYSTACK_GAP_MAXIMUM (sizeof (union yyalloc) - 1)
@@ -397,12 +400,12 @@ union yyalloc
    elements in the stack, and YYPTR gives the new location of the
    stack.  Advance YYPTR to a properly aligned location for the next
    stack.  */
-# define YYSTACK_RELOCATE(Stack_alloc, Stack)				\
+# define YYSTACK_RELOCATE(Stack)					\
     do									\
       {									\
 	YYSIZE_T yynewbytes;						\
-	YYCOPY (&yyptr->Stack_alloc, Stack, yysize);			\
-	Stack = &yyptr->Stack_alloc;					\
+	YYCOPY (&yyptr->Stack, Stack, yysize);				\
+	Stack = &yyptr->Stack;						\
 	yynewbytes = yystacksize * sizeof (*Stack) + YYSTACK_GAP_MAXIMUM; \
 	yyptr += yynewbytes / sizeof (*yyptr);				\
       }									\
@@ -855,20 +858,17 @@ yy_symbol_print (yyoutput, yytype, yyvaluep)
 #if (defined __STDC__ || defined __C99__FUNC__ \
      || defined __cplusplus || defined _MSC_VER)
 static void
-yy_stack_print (yytype_int16 *yybottom, yytype_int16 *yytop)
+yy_stack_print (yytype_int16 *bottom, yytype_int16 *top)
 #else
 static void
-yy_stack_print (yybottom, yytop)
-    yytype_int16 *yybottom;
-    yytype_int16 *yytop;
+yy_stack_print (bottom, top)
+    yytype_int16 *bottom;
+    yytype_int16 *top;
 #endif
 {
   YYFPRINTF (stderr, "Stack now");
-  for (; yybottom <= yytop; yybottom++)
-    {
-      int yybot = *yybottom;
-      YYFPRINTF (stderr, " %d", yybot);
-    }
+  for (; bottom <= top; ++bottom)
+    YYFPRINTF (stderr, " %d", *bottom);
   YYFPRINTF (stderr, "\n");
 }
 
@@ -902,11 +902,11 @@ yy_reduce_print (yyvsp, yyrule)
   /* The symbols being reduced.  */
   for (yyi = 0; yyi < yynrhs; yyi++)
     {
-      YYFPRINTF (stderr, "   $%d = ", yyi + 1);
+      fprintf (stderr, "   $%d = ", yyi + 1);
       yy_symbol_print (stderr, yyrhs[yyprhs[yyrule] + yyi],
 		       &(yyvsp[(yyi + 1) - (yynrhs)])
 		       		       );
-      YYFPRINTF (stderr, "\n");
+      fprintf (stderr, "\n");
     }
 }
 
@@ -1186,8 +1186,10 @@ yydestruct (yymsg, yytype, yyvaluep)
 	break;
     }
 }
+
 
 /* Prevent warnings from -Wmissing-prototypes.  */
+
 #ifdef YYPARSE_PARAM
 #if defined __STDC__ || defined __cplusplus
 int yyparse (void *YYPARSE_PARAM);
@@ -1206,9 +1208,10 @@ int yyparse ();
 
 
 
-/*-------------------------.
-| yyparse or yypush_parse.  |
-`-------------------------*/
+
+/*----------.
+| yyparse.  |
+`----------*/
 
 #ifdef YYPARSE_PARAM
 #if (defined __STDC__ || defined __C99__FUNC__ \
@@ -1232,46 +1235,22 @@ yyparse ()
 #endif
 #endif
 {
-/* The lookahead symbol.  */
+  /* The look-ahead symbol.  */
 int yychar;
 
-/* The semantic value of the lookahead symbol.  */
+/* The semantic value of the look-ahead symbol.  */
 YYSTYPE yylval;
 
-    /* Number of syntax errors so far.  */
-    int yynerrs;
-
-    int yystate;
-    /* Number of tokens to shift before error messages enabled.  */
-    int yyerrstatus;
-
-    /* The stacks and their tools:
-       `yyss': related to states.
-       `yyvs': related to semantic values.
-
-       Refer to the stacks thru separate pointers, to allow yyoverflow
-       to reallocate them elsewhere.  */
-
-    /* The state stack.  */
-    yytype_int16 yyssa[YYINITDEPTH];
-    yytype_int16 *yyss;
-    yytype_int16 *yyssp;
-
-    /* The semantic value stack.  */
-    YYSTYPE yyvsa[YYINITDEPTH];
-    YYSTYPE *yyvs;
-    YYSTYPE *yyvsp;
-
-    YYSIZE_T yystacksize;
+/* Number of syntax errors so far.  */
+int yynerrs;
 
+  int yystate;
   int yyn;
   int yyresult;
-  /* Lookahead token as an internal (translated) token number.  */
-  int yytoken;
-  /* The variables used to return semantic value and location from the
-     action routines.  */
-  YYSTYPE yyval;
-
+  /* Number of tokens to shift before error messages enabled.  */
+  int yyerrstatus;
+  /* Look-ahead token as an internal (translated) token number.  */
+  int yytoken = 0;
 #if YYERROR_VERBOSE
   /* Buffer for error messages, and its allocated size.  */
   char yymsgbuf[128];
@@ -1279,28 +1258,51 @@ YYSTYPE yylval;
   YYSIZE_T yymsg_alloc = sizeof yymsgbuf;
 #endif
 
+  /* Three stacks and their tools:
+     `yyss': related to states,
+     `yyvs': related to semantic values,
+     `yyls': related to locations.
+
+     Refer to the stacks thru separate pointers, to allow yyoverflow
+     to reallocate them elsewhere.  */
+
+  /* The state stack.  */
+  yytype_int16 yyssa[YYINITDEPTH];
+  yytype_int16 *yyss = yyssa;
+  yytype_int16 *yyssp;
+
+  /* The semantic value stack.  */
+  YYSTYPE yyvsa[YYINITDEPTH];
+  YYSTYPE *yyvs = yyvsa;
+  YYSTYPE *yyvsp;
+
+
+
 #define YYPOPSTACK(N)   (yyvsp -= (N), yyssp -= (N))
 
+  YYSIZE_T yystacksize = YYINITDEPTH;
+
+  /* The variables used to return semantic value and location from the
+     action routines.  */
+  YYSTYPE yyval;
+
+
   /* The number of symbols on the RHS of the reduced rule.
      Keep to zero when no symbol should be popped.  */
   int yylen = 0;
 
-  yytoken = 0;
-  yyss = yyssa;
-  yyvs = yyvsa;
-  yystacksize = YYINITDEPTH;
-
   YYDPRINTF ((stderr, "Starting parse\n"));
 
   yystate = 0;
   yyerrstatus = 0;
   yynerrs = 0;
-  yychar = YYEMPTY; /* Cause a token to be read.  */
+  yychar = YYEMPTY;		/* Cause a token to be read.  */
 
   /* Initialize stack pointers.
      Waste one element of value and location stack
      so that they stay on the same level as the state stack.
      The wasted elements are never initialized.  */
+
   yyssp = yyss;
   yyvsp = yyvs;
 
@@ -1330,6 +1332,7 @@ YYSTYPE yylval;
 	YYSTYPE *yyvs1 = yyvs;
 	yytype_int16 *yyss1 = yyss;
 
+
 	/* Each stack pointer address is followed by the size of the
 	   data in use in that stack, in bytes.  This used to be a
 	   conditional around just the two extra args, but that might
@@ -1337,6 +1340,7 @@ YYSTYPE yylval;
 	yyoverflow (YY_("memory exhausted"),
 		    &yyss1, yysize * sizeof (*yyssp),
 		    &yyvs1, yysize * sizeof (*yyvsp),
+
 		    &yystacksize);
 
 	yyss = yyss1;
@@ -1359,8 +1363,9 @@ YYSTYPE yylval;
 	  (union yyalloc *) YYSTACK_ALLOC (YYSTACK_BYTES (yystacksize));
 	if (! yyptr)
 	  goto yyexhaustedlab;
-	YYSTACK_RELOCATE (yyss_alloc, yyss);
-	YYSTACK_RELOCATE (yyvs_alloc, yyvs);
+	YYSTACK_RELOCATE (yyss);
+	YYSTACK_RELOCATE (yyvs);
+
 #  undef YYSTACK_RELOCATE
 	if (yyss1 != yyssa)
 	  YYSTACK_FREE (yyss1);
@@ -1371,6 +1376,7 @@ YYSTYPE yylval;
       yyssp = yyss + yysize - 1;
       yyvsp = yyvs + yysize - 1;
 
+
       YYDPRINTF ((stderr, "Stack size increased to %lu\n",
 		  (unsigned long int) yystacksize));
 
@@ -1380,9 +1386,6 @@ YYSTYPE yylval;
 
   YYDPRINTF ((stderr, "Entering state %d\n", yystate));
 
-  if (yystate == YYFINAL)
-    YYACCEPT;
-
   goto yybackup;
 
 /*-----------.
@@ -1391,16 +1394,16 @@ YYSTYPE yylval;
 yybackup:
 
   /* Do appropriate processing given the current state.  Read a
-     lookahead token if we need one and don't already have one.  */
+     look-ahead token if we need one and don't already have one.  */
 
-  /* First try to decide what to do without reference to lookahead token.  */
+  /* First try to decide what to do without reference to look-ahead token.  */
   yyn = yypact[yystate];
   if (yyn == YYPACT_NINF)
     goto yydefault;
 
-  /* Not known => get a lookahead token if don't already have one.  */
+  /* Not known => get a look-ahead token if don't already have one.  */
 
-  /* YYCHAR is either YYEMPTY or YYEOF or a valid lookahead symbol.  */
+  /* YYCHAR is either YYEMPTY or YYEOF or a valid look-ahead symbol.  */
   if (yychar == YYEMPTY)
     {
       YYDPRINTF ((stderr, "Reading a token: "));
@@ -1432,16 +1435,20 @@ yybackup:
       goto yyreduce;
     }
 
+  if (yyn == YYFINAL)
+    YYACCEPT;
+
   /* Count tokens shifted since error; after three, turn off error
      status.  */
   if (yyerrstatus)
     yyerrstatus--;
 
-  /* Shift the lookahead token.  */
+  /* Shift the look-ahead token.  */
   YY_SYMBOL_PRINT ("Shifting", yytoken, &yylval, &yylloc);
 
-  /* Discard the shifted token.  */
-  yychar = YYEMPTY;
+  /* Discard the shifted token unless it is eof.  */
+  if (yychar != YYEOF)
+    yychar = YYEMPTY;
 
   yystate = yyn;
   *++yyvsp = yylval;
@@ -1481,8 +1488,6 @@ yyreduce:
   switch (yyn)
     {
         case 2:
-
-/* Line 1455 of yacc.c  */
 #line 122 "../xml/XPathGrammar.y"
     {
         PARSER->m_topExpr = (yyvsp[(1) - (1)].expr);
@@ -1490,8 +1495,6 @@ yyreduce:
     break;
 
   case 3:
-
-/* Line 1455 of yacc.c  */
 #line 129 "../xml/XPathGrammar.y"
     {
         (yyval.locationPath)->setAbsolute(false);
@@ -1499,8 +1502,6 @@ yyreduce:
     break;
 
   case 4:
-
-/* Line 1455 of yacc.c  */
 #line 134 "../xml/XPathGrammar.y"
     {
         (yyval.locationPath)->setAbsolute(true);
@@ -1508,8 +1509,6 @@ yyreduce:
     break;
 
   case 5:
-
-/* Line 1455 of yacc.c  */
 #line 141 "../xml/XPathGrammar.y"
     {
         (yyval.locationPath) = new LocationPath;
@@ -1518,8 +1517,6 @@ yyreduce:
     break;
 
   case 6:
-
-/* Line 1455 of yacc.c  */
 #line 147 "../xml/XPathGrammar.y"
     {
         (yyval.locationPath) = (yyvsp[(2) - (2)].locationPath);
@@ -1527,8 +1524,6 @@ yyreduce:
     break;
 
   case 7:
-
-/* Line 1455 of yacc.c  */
 #line 152 "../xml/XPathGrammar.y"
     {
         (yyval.locationPath) = (yyvsp[(2) - (2)].locationPath);
@@ -1538,8 +1533,6 @@ yyreduce:
     break;
 
   case 8:
-
-/* Line 1455 of yacc.c  */
 #line 161 "../xml/XPathGrammar.y"
     {
         (yyval.locationPath) = new LocationPath;
@@ -1550,8 +1543,6 @@ yyreduce:
     break;
 
   case 9:
-
-/* Line 1455 of yacc.c  */
 #line 169 "../xml/XPathGrammar.y"
     {
         (yyval.locationPath)->appendStep((yyvsp[(3) - (3)].step));
@@ -1560,8 +1551,6 @@ yyreduce:
     break;
 
   case 10:
-
-/* Line 1455 of yacc.c  */
 #line 175 "../xml/XPathGrammar.y"
     {
         (yyval.locationPath)->appendStep((yyvsp[(2) - (3)].step));
@@ -1572,8 +1561,6 @@ yyreduce:
     break;
 
   case 11:
-
-/* Line 1455 of yacc.c  */
 #line 185 "../xml/XPathGrammar.y"
     {
         if ((yyvsp[(2) - (2)].predList)) {
@@ -1587,8 +1574,6 @@ yyreduce:
     break;
 
   case 12:
-
-/* Line 1455 of yacc.c  */
 #line 196 "../xml/XPathGrammar.y"
     {
         String localName;
@@ -1609,8 +1594,6 @@ yyreduce:
     break;
 
   case 13:
-
-/* Line 1455 of yacc.c  */
 #line 214 "../xml/XPathGrammar.y"
     {
         if ((yyvsp[(3) - (3)].predList)) {
@@ -1624,8 +1607,6 @@ yyreduce:
     break;
 
   case 14:
-
-/* Line 1455 of yacc.c  */
 #line 225 "../xml/XPathGrammar.y"
     {
         String localName;
@@ -1646,8 +1627,6 @@ yyreduce:
     break;
 
   case 17:
-
-/* Line 1455 of yacc.c  */
 #line 249 "../xml/XPathGrammar.y"
     {
         (yyval.axis) = Step::AttributeAxis;
@@ -1655,8 +1634,6 @@ yyreduce:
     break;
 
   case 18:
-
-/* Line 1455 of yacc.c  */
 #line 256 "../xml/XPathGrammar.y"
     {
         if (*(yyvsp[(1) - (3)].str) == "node")
@@ -1672,8 +1649,6 @@ yyreduce:
     break;
 
   case 19:
-
-/* Line 1455 of yacc.c  */
 #line 269 "../xml/XPathGrammar.y"
     {
         (yyval.nodeTest) = new Step::NodeTest(Step::NodeTest::ProcessingInstructionNodeTest);
@@ -1683,8 +1658,6 @@ yyreduce:
     break;
 
   case 20:
-
-/* Line 1455 of yacc.c  */
 #line 276 "../xml/XPathGrammar.y"
     {
         (yyval.nodeTest) = new Step::NodeTest(Step::NodeTest::ProcessingInstructionNodeTest, (yyvsp[(3) - (4)].str)->stripWhiteSpace());
@@ -1695,8 +1668,6 @@ yyreduce:
     break;
 
   case 21:
-
-/* Line 1455 of yacc.c  */
 #line 286 "../xml/XPathGrammar.y"
     {
         (yyval.predList) = 0;
@@ -1704,8 +1675,6 @@ yyreduce:
     break;
 
   case 23:
-
-/* Line 1455 of yacc.c  */
 #line 295 "../xml/XPathGrammar.y"
     {
         (yyval.predList) = new Vector<Predicate*>;
@@ -1716,8 +1685,6 @@ yyreduce:
     break;
 
   case 24:
-
-/* Line 1455 of yacc.c  */
 #line 303 "../xml/XPathGrammar.y"
     {
         (yyval.predList)->append(new Predicate((yyvsp[(2) - (2)].expr)));
@@ -1726,8 +1693,6 @@ yyreduce:
     break;
 
   case 25:
-
-/* Line 1455 of yacc.c  */
 #line 311 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = (yyvsp[(2) - (3)].expr);
@@ -1735,8 +1700,6 @@ yyreduce:
     break;
 
   case 26:
-
-/* Line 1455 of yacc.c  */
 #line 318 "../xml/XPathGrammar.y"
     {
         (yyval.step) = new Step(Step::DescendantOrSelfAxis, Step::NodeTest(Step::NodeTest::AnyNodeTest));
@@ -1745,8 +1708,6 @@ yyreduce:
     break;
 
   case 27:
-
-/* Line 1455 of yacc.c  */
 #line 326 "../xml/XPathGrammar.y"
     {
         (yyval.step) = new Step(Step::SelfAxis, Step::NodeTest(Step::NodeTest::AnyNodeTest));
@@ -1755,8 +1716,6 @@ yyreduce:
     break;
 
   case 28:
-
-/* Line 1455 of yacc.c  */
 #line 332 "../xml/XPathGrammar.y"
     {
         (yyval.step) = new Step(Step::ParentAxis, Step::NodeTest(Step::NodeTest::AnyNodeTest));
@@ -1765,8 +1724,6 @@ yyreduce:
     break;
 
   case 29:
-
-/* Line 1455 of yacc.c  */
 #line 340 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = new VariableReference(*(yyvsp[(1) - (1)].str));
@@ -1776,8 +1733,6 @@ yyreduce:
     break;
 
   case 30:
-
-/* Line 1455 of yacc.c  */
 #line 347 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = (yyvsp[(2) - (3)].expr);
@@ -1785,8 +1740,6 @@ yyreduce:
     break;
 
   case 31:
-
-/* Line 1455 of yacc.c  */
 #line 352 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = new StringExpression(*(yyvsp[(1) - (1)].str));
@@ -1796,8 +1749,6 @@ yyreduce:
     break;
 
   case 32:
-
-/* Line 1455 of yacc.c  */
 #line 359 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = new Number((yyvsp[(1) - (1)].str)->toDouble());
@@ -1807,8 +1758,6 @@ yyreduce:
     break;
 
   case 34:
-
-/* Line 1455 of yacc.c  */
 #line 370 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = createFunction(*(yyvsp[(1) - (3)].str));
@@ -1820,8 +1769,6 @@ yyreduce:
     break;
 
   case 35:
-
-/* Line 1455 of yacc.c  */
 #line 379 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = createFunction(*(yyvsp[(1) - (4)].str), *(yyvsp[(3) - (4)].argList));
@@ -1834,8 +1781,6 @@ yyreduce:
     break;
 
   case 36:
-
-/* Line 1455 of yacc.c  */
 #line 391 "../xml/XPathGrammar.y"
     {
         (yyval.argList) = new Vector<Expression*>;
@@ -1846,8 +1791,6 @@ yyreduce:
     break;
 
   case 37:
-
-/* Line 1455 of yacc.c  */
 #line 399 "../xml/XPathGrammar.y"
     {
         (yyval.argList)->append((yyvsp[(3) - (3)].expr));
@@ -1856,8 +1799,6 @@ yyreduce:
     break;
 
   case 40:
-
-/* Line 1455 of yacc.c  */
 #line 413 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = new Union;
@@ -1870,8 +1811,6 @@ yyreduce:
     break;
 
   case 41:
-
-/* Line 1455 of yacc.c  */
 #line 425 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = (yyvsp[(1) - (1)].locationPath);
@@ -1879,8 +1818,6 @@ yyreduce:
     break;
 
   case 43:
-
-/* Line 1455 of yacc.c  */
 #line 432 "../xml/XPathGrammar.y"
     {
         (yyvsp[(3) - (3)].locationPath)->setAbsolute(true);
@@ -1892,8 +1829,6 @@ yyreduce:
     break;
 
   case 44:
-
-/* Line 1455 of yacc.c  */
 #line 441 "../xml/XPathGrammar.y"
     {
         (yyvsp[(3) - (3)].locationPath)->insertFirstStep((yyvsp[(2) - (3)].step));
@@ -1907,8 +1842,6 @@ yyreduce:
     break;
 
   case 46:
-
-/* Line 1455 of yacc.c  */
 #line 456 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = new Filter((yyvsp[(1) - (2)].expr), *(yyvsp[(2) - (2)].predList));
@@ -1919,8 +1852,6 @@ yyreduce:
     break;
 
   case 48:
-
-/* Line 1455 of yacc.c  */
 #line 468 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = new LogicalOp(LogicalOp::OP_Or, (yyvsp[(1) - (3)].expr), (yyvsp[(3) - (3)].expr));
@@ -1931,8 +1862,6 @@ yyreduce:
     break;
 
   case 50:
-
-/* Line 1455 of yacc.c  */
 #line 480 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = new LogicalOp(LogicalOp::OP_And, (yyvsp[(1) - (3)].expr), (yyvsp[(3) - (3)].expr));
@@ -1943,8 +1872,6 @@ yyreduce:
     break;
 
   case 52:
-
-/* Line 1455 of yacc.c  */
 #line 492 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = new EqTestOp((yyvsp[(2) - (3)].eqop), (yyvsp[(1) - (3)].expr), (yyvsp[(3) - (3)].expr));
@@ -1955,8 +1882,6 @@ yyreduce:
     break;
 
   case 54:
-
-/* Line 1455 of yacc.c  */
 #line 504 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = new EqTestOp((yyvsp[(2) - (3)].eqop), (yyvsp[(1) - (3)].expr), (yyvsp[(3) - (3)].expr));
@@ -1967,8 +1892,6 @@ yyreduce:
     break;
 
   case 56:
-
-/* Line 1455 of yacc.c  */
 #line 516 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = new NumericOp(NumericOp::OP_Add, (yyvsp[(1) - (3)].expr), (yyvsp[(3) - (3)].expr));
@@ -1979,8 +1902,6 @@ yyreduce:
     break;
 
   case 57:
-
-/* Line 1455 of yacc.c  */
 #line 524 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = new NumericOp(NumericOp::OP_Sub, (yyvsp[(1) - (3)].expr), (yyvsp[(3) - (3)].expr));
@@ -1991,8 +1912,6 @@ yyreduce:
     break;
 
   case 59:
-
-/* Line 1455 of yacc.c  */
 #line 536 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = new NumericOp((yyvsp[(2) - (3)].numop), (yyvsp[(1) - (3)].expr), (yyvsp[(3) - (3)].expr));
@@ -2003,8 +1922,6 @@ yyreduce:
     break;
 
   case 61:
-
-/* Line 1455 of yacc.c  */
 #line 548 "../xml/XPathGrammar.y"
     {
         (yyval.expr) = new Negative;
@@ -2015,9 +1932,8 @@ yyreduce:
     break;
 
 
-
-/* Line 1455 of yacc.c  */
-#line 2021 "WebCore/tmp/../generated/XPathGrammar.tab.c"
+/* Line 1267 of yacc.c.  */
+#line 1937 "WebCore/tmp/../generated/XPathGrammar.tab.c"
       default: break;
     }
   YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
@@ -2028,6 +1944,7 @@ yyreduce:
 
   *++yyvsp = yyval;
 
+
   /* Now `shift' the result of the reduction.  Determine what state
      that goes to, based on the state we popped back to and the rule
      number reduced by.  */
@@ -2092,7 +2009,7 @@ yyerrlab:
 
   if (yyerrstatus == 3)
     {
-      /* If just tried and failed to reuse lookahead token after an
+      /* If just tried and failed to reuse look-ahead token after an
 	 error, discard it.  */
 
       if (yychar <= YYEOF)
@@ -2109,7 +2026,7 @@ yyerrlab:
 	}
     }
 
-  /* Else will try to reuse lookahead token after shifting the error
+  /* Else will try to reuse look-ahead token after shifting the error
      token.  */
   goto yyerrlab1;
 
@@ -2166,6 +2083,9 @@ yyerrlab1:
       YY_STACK_PRINT (yyss, yyssp);
     }
 
+  if (yyn == YYFINAL)
+    YYACCEPT;
+
   *++yyvsp = yylval;
 
 
@@ -2190,7 +2110,7 @@ yyabortlab:
   yyresult = 1;
   goto yyreturn;
 
-#if !defined(yyoverflow) || YYERROR_VERBOSE
+#ifndef yyoverflow
 /*-------------------------------------------------.
 | yyexhaustedlab -- memory exhaustion comes here.  |
 `-------------------------------------------------*/
@@ -2201,7 +2121,7 @@ yyexhaustedlab:
 #endif
 
 yyreturn:
-  if (yychar != YYEMPTY)
+  if (yychar != YYEOF && yychar != YYEMPTY)
      yydestruct ("Cleanup: discarding lookahead",
 		 yytoken, &yylval);
   /* Do not reclaim the symbols of the rule which action triggered
@@ -2227,8 +2147,6 @@ yyreturn:
 }
 
 
-
-/* Line 1675 of yacc.c  */
 #line 556 "../xml/XPathGrammar.y"
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/XPathGrammar.h b/src/3rdparty/webkit/WebCore/generated/XPathGrammar.h
index cdf2b32..0276481 100644
--- a/src/3rdparty/webkit/WebCore/generated/XPathGrammar.h
+++ b/src/3rdparty/webkit/WebCore/generated/XPathGrammar.h
@@ -1,23 +1,24 @@
-
-/* A Bison parser, made by GNU Bison 2.4.1.  */
+/* A Bison parser, made by GNU Bison 2.3.  */
 
 /* Skeleton interface for Bison's Yacc-like parsers in C
-   
-      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
+
+   Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
    Free Software Foundation, Inc.
-   
-   This program is free software: you can redistribute it and/or modify
+
+   This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation, either version 3 of the License, or
-   (at your option) any later version.
-   
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
-   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin Street, Fifth Floor,
+   Boston, MA 02110-1301, USA.  */
 
 /* As a special exception, you may create a larger work that contains
    part or all of the Bison parser skeleton and distribute that work
@@ -28,11 +29,10 @@
    special exception, which will cause the skeleton and the resulting
    Bison output files to be licensed under the GNU General Public
    License without this special exception.
-   
+
    This special exception was added by the Free Software Foundation in
    version 2.2 of Bison.  */
 
-
 /* Tokens.  */
 #ifndef YYTOKENTYPE
 # define YYTOKENTYPE
@@ -59,16 +59,33 @@
      XPATH_ERROR = 275
    };
 #endif
+/* Tokens.  */
+#define MULOP 258
+#define RELOP 259
+#define EQOP 260
+#define MINUS 261
+#define PLUS 262
+#define AND 263
+#define OR 264
+#define AXISNAME 265
+#define NODETYPE 266
+#define PI 267
+#define FUNCTIONNAME 268
+#define LITERAL 269
+#define VARIABLEREFERENCE 270
+#define NUMBER 271
+#define DOTDOT 272
+#define SLASHSLASH 273
+#define NAMETEST 274
+#define XPATH_ERROR 275
+
 
 
 
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
-{
-
-/* Line 1676 of yacc.c  */
 #line 60 "../xml/XPathGrammar.y"
-
+{
     Step::Axis axis;
     Step::NodeTest* nodeTest;
     NumericOp::Opcode numop;
@@ -79,17 +96,14 @@ typedef union YYSTYPE
     Vector<Expression*>* argList;
     Step* step;
     LocationPath* locationPath;
-
-
-
-/* Line 1676 of yacc.c  */
-#line 87 "WebCore/tmp/../generated/XPathGrammar.tab.h"
-} YYSTYPE;
-# define YYSTYPE_IS_TRIVIAL 1
+}
+/* Line 1489 of yacc.c.  */
+#line 102 "WebCore/tmp/../generated/XPathGrammar.tab.h"
+	YYSTYPE;
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
+# define YYSTYPE_IS_TRIVIAL 1
 #endif
 
 
 
-
diff --git a/src/3rdparty/webkit/WebCore/history/BackForwardList.cpp b/src/3rdparty/webkit/WebCore/history/BackForwardList.cpp
index a0636b5..d10e61c 100644
--- a/src/3rdparty/webkit/WebCore/history/BackForwardList.cpp
+++ b/src/3rdparty/webkit/WebCore/history/BackForwardList.cpp
@@ -268,6 +268,8 @@ bool BackForwardList::containsItem(HistoryItem* entry)
 #if ENABLE(WML)
 void BackForwardList::clearWMLPageHistory()
 {
+    RefPtr<HistoryItem> currentItem = this->currentItem();
+
     int size = m_entries.size();
     for (int i = 0; i < size; ++i)
         pageCache()->remove(m_entries[i].get());
@@ -275,6 +277,9 @@ void BackForwardList::clearWMLPageHistory()
     m_entries.clear();
     m_entryHash.clear();
     m_current = NoCurrentItemIndex;
+
+    // Spec: The history stack may be reset to a state where it only contains the current card.
+    addItem(currentItem);
 }
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/history/CachedFrame.cpp b/src/3rdparty/webkit/WebCore/history/CachedFrame.cpp
index 5f4e746..d542554 100644
--- a/src/3rdparty/webkit/WebCore/history/CachedFrame.cpp
+++ b/src/3rdparty/webkit/WebCore/history/CachedFrame.cpp
@@ -29,6 +29,7 @@
 #include "CachedFramePlatformData.h"
 #include "CString.h"
 #include "DocumentLoader.h"
+#include "EventNames.h"
 #include "Frame.h"
 #include "FrameLoaderClient.h"
 #include "FrameView.h"
@@ -49,12 +50,58 @@ static WTF::RefCountedLeakCounter& cachedFrameCounter()
 }
 #endif
 
-CachedFrame::CachedFrame(Frame* frame)
+CachedFrameBase::CachedFrameBase(Frame* frame)
     : m_document(frame->document())
     , m_documentLoader(frame->loader()->documentLoader())
     , m_view(frame->view())
     , m_mousePressNode(frame->eventHandler()->mousePressNode())
     , m_url(frame->loader()->url())
+    , m_isMainFrame(!frame->tree()->parent())
+{
+}
+
+CachedFrameBase::~CachedFrameBase()
+{
+#ifndef NDEBUG
+    cachedFrameCounter().decrement();
+#endif
+    // CachedFrames should always have had destroy() called by their parent CachedPage
+    ASSERT(!m_document);
+}
+
+void CachedFrameBase::restore()
+{
+    ASSERT(m_document->view() == m_view);
+    
+    Frame* frame = m_view->frame();
+    m_cachedFrameScriptData->restore(frame);
+
+#if ENABLE(SVG)
+    if (m_document->svgExtensions())
+        m_document->accessSVGExtensions()->unpauseAnimations();
+#endif
+
+    frame->animation()->resumeAnimations(m_document.get());
+    frame->eventHandler()->setMousePressNode(m_mousePressNode.get());
+    m_document->resumeActiveDOMObjects();
+
+    // It is necessary to update any platform script objects after restoring the
+    // cached page.
+    frame->script()->updatePlatformScriptObjects();
+
+    // Reconstruct the FrameTree
+    for (unsigned i = 0; i < m_childFrames.size(); ++i)
+        frame->tree()->appendChild(m_childFrames[i]->view()->frame());
+
+    // Open the child CachedFrames in their respective FrameLoaders.
+    for (unsigned i = 0; i < m_childFrames.size(); ++i)
+        m_childFrames[i]->open();
+
+    m_document->dispatchPageTransitionEvent(EventNames().pageshowEvent, true);
+}
+
+CachedFrame::CachedFrame(Frame* frame)
+    : CachedFrameBase(frame)
 {
 #ifndef NDEBUG
     cachedFrameCounter().increment();
@@ -67,46 +114,38 @@ CachedFrame::CachedFrame(Frame* frame)
     m_document->suspendActiveDOMObjects();
     m_cachedFrameScriptData.set(new ScriptCachedFrameData(frame));
     
+    // Custom scrollbar renderers will get reattached when the document comes out of the page cache
+    m_view->detachCustomScrollbars();
+
     m_document->documentWillBecomeInactive(); 
     frame->clearTimers();
     m_document->setInPageCache(true);
     
     frame->loader()->client()->savePlatformDataToCachedFrame(this);
 
+    // Create the CachedFrames for all Frames in the FrameTree.
     for (Frame* child = frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
         m_childFrames.append(CachedFrame::create(child));
 
-    LOG(PageCache, "Finished creating CachedFrame with url %s and documentloader %p\n", m_url.string().utf8().data(), m_documentLoader.get());
-}
+    // Deconstruct the FrameTree, to restore it later.
+    // We do this for two reasons:
+    // 1 - We reuse the main frame, so when it navigates to a new page load it needs to start with a blank FrameTree.
+    // 2 - It's much easier to destroy a CachedFrame while it resides in the PageCache if it is disconnected from its parent.
+    for (unsigned i = 0; i < m_childFrames.size(); ++i)
+        frame->tree()->removeChild(m_childFrames[i]->view()->frame());
 
-CachedFrame::~CachedFrame()
-{
 #ifndef NDEBUG
-    cachedFrameCounter().decrement();
+    if (m_isMainFrame)
+        LOG(PageCache, "Finished creating CachedFrame for main frame url '%s' and DocumentLoader %p\n", m_url.string().utf8().data(), m_documentLoader.get());
+    else
+        LOG(PageCache, "Finished creating CachedFrame for child frame with url '%s' and DocumentLoader %p\n", m_url.string().utf8().data(), m_documentLoader.get());
 #endif
-
-    clear();
 }
 
-void CachedFrame::restore()
+void CachedFrame::open()
 {
-    ASSERT(m_document->view() == m_view);
-    
-    Frame* frame = m_view->frame();
-    m_cachedFrameScriptData->restore(frame);
-
-#if ENABLE(SVG)
-    if (m_document->svgExtensions())
-        m_document->accessSVGExtensions()->unpauseAnimations();
-#endif
-
-    frame->animation()->resumeAnimations(m_document.get());
-    frame->eventHandler()->setMousePressNode(mousePressNode());
-    m_document->resumeActiveDOMObjects();
-
-    // It is necessary to update any platform script objects after restoring the
-    // cached page.
-    frame->script()->updatePlatformScriptObjects();
+    ASSERT(m_view);
+    m_view->frame()->loader()->open(*this);
 }
 
 void CachedFrame::clear()
@@ -114,26 +153,16 @@ void CachedFrame::clear()
     if (!m_document)
         return;
 
-    if (m_cachedFramePlatformData)
-        m_cachedFramePlatformData->clear();
-        
+    // clear() should only be called for Frames representing documents that are no longer in the page cache.
+    // This means the CachedFrame has been:
+    // 1 - Successfully restore()'d by going back/forward.
+    // 2 - destroy()'ed because the PageCache is pruning or the WebView was closed.
+    ASSERT(!m_document->inPageCache());
     ASSERT(m_view);
     ASSERT(m_document->frame() == m_view->frame());
 
-    if (m_document->inPageCache()) {
-        Frame::clearTimers(m_view.get(), m_document.get());
-
-        // FIXME: Why do we need to call removeAllEventListeners here? When the document is in page cache, this method won't work
-        // fully anyway, because the document won't be able to access its DOMWindow object (due to being frameless).
-        m_document->removeAllEventListeners();
-
-        m_document->setInPageCache(false);
-        // FIXME: We don't call willRemove here. Why is that OK?
-        m_document->detach();
-        m_view->clearFrame();
-    }
-
-    ASSERT(!m_document->inPageCache());
+    for (int i = m_childFrames.size() - 1; i >= 0; --i)
+        m_childFrames[i]->clear();
 
     m_document = 0;
     m_view = 0;
@@ -141,10 +170,44 @@ void CachedFrame::clear()
     m_url = KURL();
 
     m_cachedFramePlatformData.clear();
-
     m_cachedFrameScriptData.clear();
 }
 
+void CachedFrame::destroy()
+{
+    if (!m_document)
+        return;
+    
+    // Only CachedFrames that are still in the PageCache should be destroyed in this manner
+    ASSERT(m_document->inPageCache());
+    ASSERT(m_view);
+    ASSERT(m_document->frame() == m_view->frame());
+
+    if (!m_isMainFrame) {
+        m_view->frame()->detachFromPage();
+        m_view->frame()->loader()->detachViewsAndDocumentLoader();
+    }
+    
+    for (int i = m_childFrames.size() - 1; i >= 0; --i)
+        m_childFrames[i]->destroy();
+
+    if (m_cachedFramePlatformData)
+        m_cachedFramePlatformData->clear();
+
+    Frame::clearTimers(m_view.get(), m_document.get());
+
+    // FIXME: Why do we need to call removeAllEventListeners here? When the document is in page cache, this method won't work
+    // fully anyway, because the document won't be able to access its DOMWindow object (due to being frameless).
+    m_document->removeAllEventListeners();
+
+    m_document->setInPageCache(false);
+    // FIXME: We don't call willRemove here. Why is that OK?
+    m_document->detach();
+    m_view->clearFrame();
+
+    clear();
+}
+
 void CachedFrame::setCachedFramePlatformData(CachedFramePlatformData* data)
 {
     m_cachedFramePlatformData.set(data);
diff --git a/src/3rdparty/webkit/WebCore/history/CachedFrame.h b/src/3rdparty/webkit/WebCore/history/CachedFrame.h
index 0302444..883c12a 100644
--- a/src/3rdparty/webkit/WebCore/history/CachedFrame.h
+++ b/src/3rdparty/webkit/WebCore/history/CachedFrame.h
@@ -43,29 +43,20 @@ namespace WebCore {
 
 typedef Vector<RefPtr<CachedFrame> > CachedFrameVector;
 
-class CachedFrame : public RefCounted<CachedFrame> {
+class CachedFrameBase {
 public:
-    static PassRefPtr<CachedFrame> create(Frame* frame) { return adoptRef(new CachedFrame(frame)); }
-    ~CachedFrame();
-
     void restore();
-    void clear();
 
     Document* document() const { return m_document.get(); }
-    DocumentLoader* documentLoader() const { return m_documentLoader.get(); }
     FrameView* view() const { return m_view.get(); }
-    Node* mousePressNode() const { return m_mousePressNode.get(); }
     const KURL& url() const { return m_url; }
     DOMWindow* domWindow() const { return m_cachedFrameScriptData->domWindow(); }
+    bool isMainFrame() { return m_isMainFrame; }
 
-    void setCachedFramePlatformData(CachedFramePlatformData*);
-    CachedFramePlatformData* cachedFramePlatformData();
+protected:
+    CachedFrameBase(Frame*);
+    ~CachedFrameBase();
     
-    int descendantFrameCount() const;
-
-private:
-    CachedFrame(Frame*);
-
     RefPtr<Document> m_document;
     RefPtr<DocumentLoader> m_documentLoader;
     RefPtr<FrameView> m_view;
@@ -73,10 +64,33 @@ private:
     KURL m_url;
     OwnPtr<ScriptCachedFrameData> m_cachedFrameScriptData;
     OwnPtr<CachedFramePlatformData> m_cachedFramePlatformData;
+    bool m_isMainFrame;
     
     CachedFrameVector m_childFrames;
 };
 
+class CachedFrame : public RefCounted<CachedFrame>, private CachedFrameBase {
+public:
+    static PassRefPtr<CachedFrame> create(Frame* frame) { return adoptRef(new CachedFrame(frame)); }
+
+    void open();
+    void clear();
+    void destroy();
+
+    void setCachedFramePlatformData(CachedFramePlatformData* data);
+    CachedFramePlatformData* cachedFramePlatformData();
+
+    using CachedFrameBase::document;
+    using CachedFrameBase::view;
+    DocumentLoader* documentLoader() const { return m_documentLoader.get(); }
+    Node* mousePressNode() const { return m_mousePressNode.get(); }
+
+    int descendantFrameCount() const;
+
+private:
+    CachedFrame(Frame*);
+};
+
 } // namespace WebCore
 
 #endif // CachedFrame_h
diff --git a/src/3rdparty/webkit/WebCore/history/CachedPage.cpp b/src/3rdparty/webkit/WebCore/history/CachedPage.cpp
index 8898ce2..20c5fd7 100644
--- a/src/3rdparty/webkit/WebCore/history/CachedPage.cpp
+++ b/src/3rdparty/webkit/WebCore/history/CachedPage.cpp
@@ -61,14 +61,17 @@ CachedPage::~CachedPage()
     cachedPageCounter.decrement();
 #endif
 
-    clear();
+    destroy();
+    ASSERT(!m_cachedMainFrame);
 }
 
 void CachedPage::restore(Page* page)
 {
+    ASSERT(m_cachedMainFrame);
     ASSERT(page && page->mainFrame() && page->mainFrame() == m_cachedMainFrame->view()->frame());
-    m_cachedMainFrame->restore();
 
+    m_cachedMainFrame->open();
+    
     // Restore the focus appearance for the focused element.
     // FIXME: Right now we don't support pages w/ frames in the b/f cache.  This may need to be tweaked when we add support for that.
     Document* focusedDocument = page->focusController()->focusedOrMainFrame()->document();
@@ -76,11 +79,23 @@ void CachedPage::restore(Page* page)
         if (node->isElementNode())
             static_cast<Element*>(node)->updateFocusAppearance(true);
     }
+    
+    clear();
 }
 
 void CachedPage::clear()
 {
-    m_cachedMainFrame.clear();
+    ASSERT(m_cachedMainFrame);
+    m_cachedMainFrame->clear();
+    m_cachedMainFrame = 0;
+}
+
+void CachedPage::destroy()
+{
+    if (m_cachedMainFrame)
+        m_cachedMainFrame->destroy();
+
+    m_cachedMainFrame = 0;
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/history/CachedPage.h b/src/3rdparty/webkit/WebCore/history/CachedPage.h
index 430cf3a..c68c753 100644
--- a/src/3rdparty/webkit/WebCore/history/CachedPage.h
+++ b/src/3rdparty/webkit/WebCore/history/CachedPage.h
@@ -46,12 +46,10 @@ public:
 
     void restore(Page*);
     void clear();
+    void destroy();
 
     Document* document() const { return m_cachedMainFrame->document(); }
     DocumentLoader* documentLoader() const { return m_cachedMainFrame->documentLoader(); }
-    FrameView* mainFrameView() const { return m_cachedMainFrame->view(); }
-    const KURL& url() const { return m_cachedMainFrame->url(); }
-    DOMWindow* domWindow() const { return m_cachedMainFrame->domWindow(); }
 
     double timeStamp() const { return m_timeStamp; }
     
diff --git a/src/3rdparty/webkit/WebCore/history/HistoryItem.cpp b/src/3rdparty/webkit/WebCore/history/HistoryItem.cpp
index d2b83cf..4352936 100644
--- a/src/3rdparty/webkit/WebCore/history/HistoryItem.cpp
+++ b/src/3rdparty/webkit/WebCore/history/HistoryItem.cpp
@@ -172,12 +172,12 @@ double HistoryItem::lastVisitedTime() const
 
 KURL HistoryItem::url() const
 {
-    return KURL(m_urlString);
+    return KURL(ParsedURLString, m_urlString);
 }
 
 KURL HistoryItem::originalURL() const
 {
-    return KURL(m_originalURLString);
+    return KURL(ParsedURLString, m_originalURLString);
 }
 
 const String& HistoryItem::referrer() const
@@ -480,7 +480,7 @@ FormData* HistoryItem::formData()
 bool HistoryItem::isCurrentDocument(Document* doc) const
 {
     // FIXME: We should find a better way to check if this is the current document.
-    return equalIgnoringRef(url(), doc->url());
+    return equalIgnoringFragmentIdentifier(url(), doc->url());
 }
 
 void HistoryItem::mergeAutoCompleteHints(HistoryItem* otherItem)
diff --git a/src/3rdparty/webkit/WebCore/history/PageCache.cpp b/src/3rdparty/webkit/WebCore/history/PageCache.cpp
index 8d04f6f..9a3ecd7 100644
--- a/src/3rdparty/webkit/WebCore/history/PageCache.cpp
+++ b/src/3rdparty/webkit/WebCore/history/PageCache.cpp
@@ -182,7 +182,7 @@ void PageCache::releaseAutoreleasedPagesNow()
 
     CachedPageSet::iterator end = tmp.end();
     for (CachedPageSet::iterator it = tmp.begin(); it != end; ++it)
-        (*it)->clear();
+        (*it)->destroy();
 
     // Now do the prune.
     cache()->setPruneEnabled(true);
diff --git a/src/3rdparty/webkit/WebCore/history/qt/HistoryItemQt.cpp b/src/3rdparty/webkit/WebCore/history/qt/HistoryItemQt.cpp
index 68fee87..098a786 100644
--- a/src/3rdparty/webkit/WebCore/history/qt/HistoryItemQt.cpp
+++ b/src/3rdparty/webkit/WebCore/history/qt/HistoryItemQt.cpp
@@ -45,7 +45,7 @@ bool WebCore::HistoryItem::restoreState(QDataStream& in, int /*version*/)
     WebCore::IntPoint scrollPoint;
     WTF::Vector<int> weeklyVisitCounts;
     WTF::Vector<int> dailyVisitCounts;
-    bool loadFormdata;
+    // bool loadFormdata;
     // WebCore::String formContentType;
     // WTF::Vector<char> formData;
 
diff --git a/src/3rdparty/webkit/WebCore/html/CollectionType.h b/src/3rdparty/webkit/WebCore/html/CollectionType.h
index e5973a3..9d7bb54 100644
--- a/src/3rdparty/webkit/WebCore/html/CollectionType.h
+++ b/src/3rdparty/webkit/WebCore/html/CollectionType.h
@@ -51,6 +51,7 @@ enum CollectionType {
     TSectionRows, // all row elements in this table section
     TRCells,      // all cells in this row
     SelectOptions,
+    DataListOptions,
     MapAreas,
 
     OtherCollection
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.cpp
index 1757a75..daa7919 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.cpp
@@ -40,51 +40,46 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLAnchorElement::HTMLAnchorElement(Document* document)
-    : HTMLElement(aTag, document)
-    , m_rootEditableElementForSelectionOnMouseDown(0)
+HTMLAnchorElement::HTMLAnchorElement(const QualifiedName& tagName, Document* document)
+    : HTMLElement(tagName, document, CreateElement)
     , m_wasShiftKeyDownOnMouseDown(false)
 {
 }
 
-HTMLAnchorElement::HTMLAnchorElement(const QualifiedName& tagName, Document* document)
-    : HTMLElement(tagName, document)
-    , m_rootEditableElementForSelectionOnMouseDown(0)
-    , m_wasShiftKeyDownOnMouseDown(false)
+PassRefPtr<HTMLAnchorElement> HTMLAnchorElement::create(Document* document)
 {
+    return adoptRef(new HTMLAnchorElement(aTag, document));
 }
 
-bool HTMLAnchorElement::supportsFocus() const
+PassRefPtr<HTMLAnchorElement> HTMLAnchorElement::create(const QualifiedName& tagName, Document* document)
 {
-    if (isContentEditable())
-        return HTMLElement::supportsFocus();
-    return isFocusable() || (isLink() && document() && !document()->haveStylesheetsLoaded());
+    return adoptRef(new HTMLAnchorElement(tagName, document));
 }
 
-bool HTMLAnchorElement::isFocusable() const
+bool HTMLAnchorElement::supportsFocus() const
 {
     if (isContentEditable())
-        return HTMLElement::isFocusable();
-
-    // FIXME: Even if we are not visible, we might have a child that is visible.
-    // Dave wants to fix that some day with a "has visible content" flag or the like.
-    if (!(isLink() && renderer() && renderer()->style()->visibility() == VISIBLE))
-        return false;
-
-    return true;
+        return HTMLElement::supportsFocus();
+    // If not a link we should still be able to focus the element if it has tabIndex.
+    return isLink() || HTMLElement::supportsFocus();
 }
 
 bool HTMLAnchorElement::isMouseFocusable() const
 {
-#if PLATFORM(GTK)
-    return HTMLElement::isMouseFocusable();
-#else
-    return false;
+    // Anchor elements should be mouse focusable, https://bugs.webkit.org/show_bug.cgi?id=26856
+#if !PLATFORM(GTK)
+    if (isLink())
+        return false;
 #endif
+    // Allow tab index etc to control focus.
+    return HTMLElement::isMouseFocusable();
 }
 
 bool HTMLAnchorElement::isKeyboardFocusable(KeyboardEvent* event) const
 {
+    if (!isLink())
+        return HTMLElement::isKeyboardFocusable(event);
+
     if (!isFocusable())
         return false;
     
@@ -344,21 +339,23 @@ String HTMLAnchorElement::target() const
 
 String HTMLAnchorElement::hash() const
 {
-    String ref = href().ref();
-    return ref.isEmpty() ? "" : "#" + ref;
+    String fragmentIdentifier = href().fragmentIdentifier();
+    return fragmentIdentifier.isEmpty() ? "" : "#" + fragmentIdentifier;
 }
 
 String HTMLAnchorElement::host() const
 {
-    return href().host();
+    const KURL& url = href();
+    if (url.hostEnd() == url.pathStart())
+        return url.host();
+    if (SecurityOrigin::isDefaultPortForProtocol(url.port(), url.protocol()))
+        return url.host();
+    return url.host() + ":" + String::number(url.port());
 }
 
 String HTMLAnchorElement::hostname() const
 {
-    const KURL& url = href();
-    if (url.port() == 0)
-        return url.host();
-    return url.host() + ":" + String::number(url.port());
+    return href().host();
 }
 
 String HTMLAnchorElement::pathname() const
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.h b/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.h
index 3c73118..f538be2 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.h
@@ -30,8 +30,8 @@ namespace WebCore {
 
 class HTMLAnchorElement : public HTMLElement {
 public:
-    HTMLAnchorElement(Document*);
-    HTMLAnchorElement(const QualifiedName&, Document*);
+    static PassRefPtr<HTMLAnchorElement> create(Document*);
+    static PassRefPtr<HTMLAnchorElement> create(const QualifiedName&, Document*);
 
     KURL href() const;
     void setHref(const AtomicString&);
@@ -52,6 +52,8 @@ public:
     bool isLiveLink() const;
 
 protected:
+    HTMLAnchorElement(const QualifiedName&, Document*);
+
     virtual void parseMappedAttribute(MappedAttribute*);
 
 private:
@@ -60,7 +62,6 @@ private:
     virtual bool supportsFocus() const;
     virtual bool isMouseFocusable() const;
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
-    virtual bool isFocusable() const;
     virtual void defaultEventHandler(Event*);
     virtual void setActive(bool active = true, bool pause = false);
     virtual void accessKeyAction(bool fullAction);
@@ -70,7 +71,7 @@ private:
     virtual short tabIndex() const;
     virtual bool draggable() const;
 
-    Element* m_rootEditableElementForSelectionOnMouseDown;
+    RefPtr<Element> m_rootEditableElementForSelectionOnMouseDown;
     bool m_wasShiftKeyDownOnMouseDown;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.cpp
index 32dfb71..46045d6 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.cpp
@@ -34,12 +34,17 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLAppletElement::HTMLAppletElement(const QualifiedName& tagName, Document* doc)
-    : HTMLPlugInElement(tagName, doc)
+inline HTMLAppletElement::HTMLAppletElement(const QualifiedName& tagName, Document* document)
+    : HTMLPlugInElement(tagName, document)
 {
     ASSERT(hasTagName(appletTag));
 }
 
+PassRefPtr<HTMLAppletElement> HTMLAppletElement::create(const QualifiedName& tagName, Document* document)
+{
+    return adoptRef(new HTMLAppletElement(tagName, document));
+}
+
 void HTMLAppletElement::parseMappedAttribute(MappedAttribute* attr)
 {
     if (attr->name() == altAttr ||
@@ -141,7 +146,7 @@ RenderWidget* HTMLAppletElement::renderWidgetForJSBindings() const
     if (!settings || !settings->isJavaEnabled())
         return 0;
 
-    RenderApplet* applet = static_cast<RenderApplet*>(renderer());
+    RenderApplet* applet = toRenderApplet(renderer());
     if (applet)
         applet->createWidgetIfNecessary();
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.h b/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.h
index c616bb4..baaab38 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.h
@@ -27,12 +27,9 @@
 
 namespace WebCore {
 
-class HTMLFormElement;
-class HTMLImageLoader;
-
 class HTMLAppletElement : public HTMLPlugInElement {
 public:
-    HTMLAppletElement(const QualifiedName&, Document*);
+    static PassRefPtr<HTMLAppletElement> create(const QualifiedName&, Document*);
 
     String hspace() const;
     void setHspace(const String&);
@@ -41,6 +38,8 @@ public:
     void setVspace(const String&);
 
 private:
+    HTMLAppletElement(const QualifiedName&, Document*);
+
     virtual int tagPriority() const { return 1; }
 
     virtual void parseMappedAttribute(MappedAttribute*);
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.cpp
index b878a1a..b202cae 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.cpp
@@ -34,9 +34,8 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLAreaElement::HTMLAreaElement(const QualifiedName& tagName, Document* document)
+inline HTMLAreaElement::HTMLAreaElement(const QualifiedName& tagName, Document* document)
     : HTMLAnchorElement(tagName, document)
-    , m_coords(0)
     , m_coordsLen(0)
     , m_lastSize(-1, -1)
     , m_shape(Unknown)
@@ -44,9 +43,9 @@ HTMLAreaElement::HTMLAreaElement(const QualifiedName& tagName, Document* documen
     ASSERT(hasTagName(areaTag));
 }
 
-HTMLAreaElement::~HTMLAreaElement()
+PassRefPtr<HTMLAreaElement> HTMLAreaElement::create(const QualifiedName& tagName, Document* document)
 {
-    delete [] m_coords;
+    return adoptRef(new HTMLAreaElement(tagName, document));
 }
 
 void HTMLAreaElement::parseMappedAttribute(MappedAttribute* attr)
@@ -61,8 +60,7 @@ void HTMLAreaElement::parseMappedAttribute(MappedAttribute* attr)
         else if (equalIgnoringCase(attr->value(), "rect"))
             m_shape = Rect;
     } else if (attr->name() == coordsAttr) {
-        delete [] m_coords;
-        m_coords = newCoordsArray(attr->value().string(), m_coordsLen);
+        m_coords.set(newCoordsArray(attr->value().string(), m_coordsLen));
     } else if (attr->name() == altAttr || attr->name() == accesskeyAttr) {
         // Do nothing.
     } else
@@ -164,9 +162,10 @@ void HTMLAreaElement::setNoHref(bool noHref)
     setAttribute(nohrefAttr, noHref ? "" : 0);
 }
 
-bool HTMLAreaElement::isFocusable() const
+bool HTMLAreaElement::supportsFocus() const
 {
-    return HTMLElement::isFocusable();
+    // Skip HTMLAnchorElements isLink() check.
+    return HTMLElement::supportsFocus();
 }
 
 String HTMLAreaElement::target() const
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.h b/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.h
index fffd45e..7b2497c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.h
@@ -25,6 +25,7 @@
 
 #include "HTMLAnchorElement.h"
 #include "IntSize.h"
+#include <wtf/OwnArrayPtr.h>
 
 namespace WebCore {
 
@@ -33,8 +34,7 @@ class Path;
 
 class HTMLAreaElement : public HTMLAnchorElement {
 public:
-    HTMLAreaElement(const QualifiedName&, Document*);
-    virtual ~HTMLAreaElement();
+    static PassRefPtr<HTMLAreaElement> create(const QualifiedName&, Document*);
 
     bool isDefault() const { return m_shape == Default; }
 
@@ -48,17 +48,19 @@ public:
     void setNoHref(bool);
 
 private:
+    HTMLAreaElement(const QualifiedName&, Document*);
+
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusForbidden; }
     virtual int tagPriority() const { return 0; }
     virtual void parseMappedAttribute(MappedAttribute*);
-    virtual bool isFocusable() const;
+    virtual bool supportsFocus() const;
     virtual String target() const;
 
     enum Shape { Default, Poly, Rect, Circle, Unknown };
     Path getRegion(const IntSize&) const;
 
     OwnPtr<Path> m_region;
-    Length* m_coords;
+    OwnArrayPtr<Length> m_coords;
     int m_coordsLen;
     IntSize m_lastSize;
     Shape m_shape;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in b/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in
index 15db3e9..f258bd7 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in
@@ -23,9 +23,11 @@ aria-labelledby
 aria-level
 aria-pressed
 aria-readonly
+aria-required
 aria-valuemax
 aria-valuemin
 aria-valuenow
+aria-valuetext
 autobuffer
 autocomplete
 autofocus
@@ -76,6 +78,7 @@ expanded
 face
 focused
 for
+formnovalidate
 frame
 frameborder
 headers
@@ -95,6 +98,7 @@ lang
 language
 leftmargin
 link
+list
 longdesc
 loop
 playcount
@@ -115,6 +119,7 @@ name
 nohref
 noresize
 noshade
+novalidate
 nowrap
 object
 onabort
@@ -143,13 +148,16 @@ onemptied
 onended
 onerror
 onfocus
+onhashchange
 oninput
+oninvalid
 onkeydown
 onkeypress
 onkeyup
 onload
 onloadeddata
 onloadedmetadata
+onloadend
 onloadstart
 onmousedown
 onmousemove
@@ -159,6 +167,8 @@ onmouseup
 onmousewheel
 ononline
 onoffline
+onpagehide
+onpageshow
 onpaste
 onpause
 onplay
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.cpp
index 269e005..3813177 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.cpp
@@ -135,10 +135,16 @@ void HTMLBodyElement::parseMappedAttribute(MappedAttribute *attr)
         document()->setWindowAttributeEventListener(eventNames().beforeunloadEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onunloadAttr)
         document()->setWindowAttributeEventListener(eventNames().unloadEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onpagehideAttr)
+        document()->setWindowAttributeEventListener(eventNames().pagehideEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onpageshowAttr)
+        document()->setWindowAttributeEventListener(eventNames().pageshowEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onblurAttr)
         document()->setWindowAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onfocusAttr)
         document()->setWindowAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onhashchangeAttr)
+        document()->setWindowAttributeEventListener(eventNames().hashchangeEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onresizeAttr)
         document()->setWindowAttributeEventListener(eventNames().resizeEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onscrollAttr)
@@ -323,7 +329,7 @@ EventListener* HTMLBodyElement::onblur() const
 
 void HTMLBodyElement::setOnblur(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().blurEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().blurEvent, eventListener);
 }
 
 EventListener* HTMLBodyElement::onerror() const
@@ -333,7 +339,7 @@ EventListener* HTMLBodyElement::onerror() const
 
 void HTMLBodyElement::setOnerror(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().errorEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().errorEvent, eventListener);
 }
 
 EventListener* HTMLBodyElement::onfocus() const
@@ -343,7 +349,7 @@ EventListener* HTMLBodyElement::onfocus() const
 
 void HTMLBodyElement::setOnfocus(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().focusEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().focusEvent, eventListener);
 }
 
 EventListener* HTMLBodyElement::onload() const
@@ -353,7 +359,7 @@ EventListener* HTMLBodyElement::onload() const
 
 void HTMLBodyElement::setOnload(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().loadEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().loadEvent, eventListener);
 }
 
 EventListener* HTMLBodyElement::onbeforeunload() const
@@ -363,9 +369,19 @@ EventListener* HTMLBodyElement::onbeforeunload() const
 
 void HTMLBodyElement::setOnbeforeunload(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().beforeunloadEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().beforeunloadEvent, eventListener);
 }
 
+EventListener* HTMLBodyElement::onhashchange() const
+{
+    return document()->getWindowAttributeEventListener(eventNames().hashchangeEvent);
+}
+
+void HTMLBodyElement::setOnhashchange(PassRefPtr<EventListener> eventListener)
+{
+    document()->setWindowAttributeEventListener(eventNames().hashchangeEvent, eventListener);
+}    
+                                                                                
 EventListener* HTMLBodyElement::onmessage() const
 {
     return document()->getWindowAttributeEventListener(eventNames().messageEvent);
@@ -373,7 +389,7 @@ EventListener* HTMLBodyElement::onmessage() const
 
 void HTMLBodyElement::setOnmessage(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().messageEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().messageEvent, eventListener);
 }
 
 EventListener* HTMLBodyElement::onoffline() const
@@ -383,7 +399,7 @@ EventListener* HTMLBodyElement::onoffline() const
 
 void HTMLBodyElement::setOnoffline(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().offlineEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().offlineEvent, eventListener);
 }
 
 EventListener* HTMLBodyElement::ononline() const
@@ -393,7 +409,7 @@ EventListener* HTMLBodyElement::ononline() const
 
 void HTMLBodyElement::setOnonline(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().onlineEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().onlineEvent, eventListener);
 }
 
 EventListener* HTMLBodyElement::onresize() const
@@ -403,7 +419,7 @@ EventListener* HTMLBodyElement::onresize() const
 
 void HTMLBodyElement::setOnresize(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().resizeEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().resizeEvent, eventListener);
 }
 
 EventListener* HTMLBodyElement::onstorage() const
@@ -413,7 +429,7 @@ EventListener* HTMLBodyElement::onstorage() const
 
 void HTMLBodyElement::setOnstorage(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().storageEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().storageEvent, eventListener);
 }
 
 EventListener* HTMLBodyElement::onunload() const
@@ -423,7 +439,7 @@ EventListener* HTMLBodyElement::onunload() const
 
 void HTMLBodyElement::setOnunload(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().unloadEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().unloadEvent, eventListener);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.h b/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.h
index 575d562..d5efab3 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.h
@@ -57,6 +57,8 @@ public:
     void setOnbeforeunload(PassRefPtr<EventListener>);
     EventListener* onmessage() const;
     void setOnmessage(PassRefPtr<EventListener>);
+    EventListener* onhashchange() const;
+    void setOnhashchange(PassRefPtr<EventListener>);
     EventListener* onoffline() const;
     void setOnoffline(PassRefPtr<EventListener>);
     EventListener* ononline() const;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.idl
index 097b4ac..7be6803 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.idl
@@ -36,6 +36,7 @@ module html {
 #if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // Event handler attributes
         attribute [DontEnum] EventListener onbeforeunload;
+        attribute [DontEnum] EventListener onhashchange;
         attribute [DontEnum] EventListener onmessage;
         attribute [DontEnum] EventListener onoffline;
         attribute [DontEnum] EventListener ononline;
@@ -43,10 +44,15 @@ module html {
         attribute [DontEnum] EventListener onstorage;
         attribute [DontEnum] EventListener onunload;
 
+        // Overrides of Element attributes (left in for completeness).
+        // attribute [DontEnum] EventListener onblur;
+        // attribute [DontEnum] EventListener onerror;
+        // attribute [DontEnum] EventListener onfocus;
+        // attribute [DontEnum] EventListener onload;
+
         // Not implemented yet.
         // attribute [DontEnum] EventListener onafterprint;
         // attribute [DontEnum] EventListener onbeforeprint;
-        // attribute [DontEnum] EventListener onhashchange;
         // attribute [DontEnum] EventListener onpopstate;
         // attribute [DontEnum] EventListener onredo;
         // attribute [DontEnum] EventListener onundo;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.idl
index 30ad6f2..55803df 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.idl
@@ -26,6 +26,7 @@ module html {
         ImplementationUUID=1be13b5f-40df-4550-b70e-8c805e546cad
     ] HTMLButtonElement : HTMLElement {
         readonly attribute  HTMLFormElement      form;
+                 attribute  boolean              formNoValidate;
 #if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         readonly attribute  ValidityState        validity;
 #endif
@@ -36,6 +37,8 @@ module html {
         readonly attribute  DOMString            type;
                  attribute  [ConvertNullToNullString] DOMString            value;
         readonly attribute boolean               willValidate;
+        boolean  checkValidity();
+        void setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
         void click();
     };
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.cpp
index 9e635e7..c8202fd 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.cpp
@@ -30,6 +30,9 @@
 #include "CanvasGradient.h"
 #include "CanvasPattern.h"
 #include "CanvasRenderingContext2D.h"
+#if ENABLE(3D_CANVAS)    
+#include "CanvasRenderingContext3D.h"
+#endif
 #include "CanvasStyle.h"
 #include "Chrome.h"
 #include "Document.h"
@@ -146,17 +149,42 @@ String HTMLCanvasElement::toDataURL(const String& mimeType, ExceptionCode& ec)
 
 CanvasRenderingContext* HTMLCanvasElement::getContext(const String& type)
 {
+    // A Canvas can either be "2D" or "3D" never both. If you request a 2D canvas and the existing
+    // context is already 2D, just return that. If the existing context is 3D, then destroy it
+    // before creating a new 2D context. Vice versa when requesting a 3D canvas. Requesting a
+    // context with any other type string will destroy any existing context.
+    
+    // FIXME - The code depends on the context not going away once created, to prevent JS from
+    // seeing a dangling pointer. So for now we will disallow the context from being changed
+    // once it is created.
     if (type == "2d") {
-        if (!m_2DContext)
-            m_2DContext.set(new CanvasRenderingContext2D(this));
-        return m_2DContext.get();
+        if (m_context && !m_context->is2d())
+            return 0;
+        if (!m_context)
+            m_context = new CanvasRenderingContext2D(this);
+        return m_context.get();
     }
+#if ENABLE(3D_CANVAS)    
+    if ((type == "webkit-3d") ||
+        (type == "GL")) {
+        if (m_context && !m_context->is3d())
+            return 0;
+        if (!m_context) {
+            m_context = new CanvasRenderingContext3D(this);
+            
+            // Need to make sure a RenderLayer and compositing layer get created for the Canvas
+            setNeedsStyleRecalc(SyntheticStyleChange);
+        }
+        return m_context.get();
+    }
+#endif
     return 0;
 }
 
 void HTMLCanvasElement::willDraw(const FloatRect& rect)
 {
-    m_imageBuffer->clearImage();
+    if (m_imageBuffer)
+        m_imageBuffer->clearImage();
     
     if (RenderBox* ro = renderBox()) {
         FloatRect destRect = ro->contentBoxRect();
@@ -192,17 +220,18 @@ void HTMLCanvasElement::reset()
     bool hadImageBuffer = m_createdImageBuffer;
     m_createdImageBuffer = false;
     m_imageBuffer.clear();
-    if (m_2DContext)
-        m_2DContext->reset();
+    if (m_context && m_context->is2d())
+        static_cast<CanvasRenderingContext2D*>(m_context.get())->reset();
 
-    if (RenderObject* ro = renderer())
+    if (RenderObject* renderer = this->renderer()) {
         if (m_rendererIsCanvas) {
             if (oldSize != m_size)
-                static_cast<RenderHTMLCanvas*>(ro)->canvasSizeChanged();
+                toRenderHTMLCanvas(renderer)->canvasSizeChanged();
             if (hadImageBuffer)
-                ro->repaint();
+                renderer->repaint();
         }
-        
+    }
+
     if (m_observer)
         m_observer->canvasResized(this);
 }
@@ -215,11 +244,26 @@ void HTMLCanvasElement::paint(GraphicsContext* context, const IntRect& r)
     if (context->paintingDisabled())
         return;
     
+#if ENABLE(3D_CANVAS)
+    CanvasRenderingContext3D* context3D = NULL;
+    if (m_context && m_context->is3d()) {
+        context3D = static_cast<CanvasRenderingContext3D*>(m_context.get());
+        context3D->beginPaint();
+    }
+#endif
+
     if (m_imageBuffer) {
         Image* image = m_imageBuffer->image();
         if (image)
             context->drawImage(image, r);
     }
+
+#if ENABLE(3D_CANVAS)
+    if (context3D != NULL) {
+        context3D->reshape(r.width(), r.height());
+        context3D->endPaint();
+    }
+#endif
 }
 
 IntRect HTMLCanvasElement::convertLogicalToDevice(const FloatRect& logicalRect) const
@@ -259,7 +303,7 @@ void HTMLCanvasElement::createImageBuffer() const
     if (!size.width() || !size.height())
         return;
 
-    m_imageBuffer = ImageBuffer::create(size, false);
+    m_imageBuffer = ImageBuffer::create(size);
     // The convertLogicalToDevice MaxCanvasArea check should prevent common cases
     // where ImageBuffer::create() returns NULL, however we could still be low on memory.
     if (!m_imageBuffer)
@@ -292,4 +336,11 @@ TransformationMatrix HTMLCanvasElement::baseTransform() const
     return transform;
 }
 
+#if ENABLE(3D_CANVAS)    
+bool HTMLCanvasElement::is3D() const
+{
+    return m_context && m_context->is3d();
+}
+#endif
+
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.h b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.h
index bba1f2d..edae9e5 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2004, 2006, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alp Toker <alp@atoker.com>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -30,12 +30,14 @@
 #include "TransformationMatrix.h"
 #include "FloatRect.h"
 #include "HTMLElement.h"
+#if ENABLE(3D_CANVAS)    
+#include "GraphicsContext3D.h"
+#endif
 #include "IntSize.h"
 
 namespace WebCore {
 
-class CanvasRenderingContext2D;
-typedef CanvasRenderingContext2D CanvasRenderingContext;
+class CanvasRenderingContext;
 class FloatPoint;
 class FloatRect;
 class FloatSize;
@@ -47,7 +49,7 @@ class IntSize;
 
 class CanvasObserver {
 public:
-    virtual ~CanvasObserver() {};
+    virtual ~CanvasObserver() { }
 
     virtual void canvasChanged(HTMLCanvasElement*, const FloatRect& changedRect) = 0;
     virtual void canvasResized(HTMLCanvasElement*) = 0;
@@ -59,11 +61,6 @@ public:
     HTMLCanvasElement(const QualifiedName&, Document*);
     virtual ~HTMLCanvasElement();
 
-#if ENABLE(DASHBOARD_SUPPORT)
-    virtual HTMLTagStatus endTagRequirement() const;
-    virtual int tagPriority() const;
-#endif
-
     int width() const { return m_size.width(); }
     int height() const { return m_size.height(); }
     void setWidth(int);
@@ -73,10 +70,7 @@ public:
 
     CanvasRenderingContext* getContext(const String&);
 
-    virtual void parseMappedAttribute(MappedAttribute*);
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-
-    IntSize size() const { return m_size; }
+    const IntSize& size() const { return m_size; }
     void setSize(const IntSize& size)
     { 
         if (size == m_size)
@@ -103,18 +97,33 @@ public:
     void setOriginTainted() { m_originClean = false; } 
     bool originClean() const { return m_originClean; }
 
-    static const float MaxCanvasArea;
-
-    void setObserver(CanvasObserver* o) { m_observer = o; }
+    void setObserver(CanvasObserver* observer) { m_observer = observer; }
 
     TransformationMatrix baseTransform() const;
+
+    CanvasRenderingContext* renderingContext() const { return m_context.get(); }
+
+#if ENABLE(3D_CANVAS)    
+    bool is3D() const;
+#endif
+
 private:
+#if ENABLE(DASHBOARD_SUPPORT)
+    virtual HTMLTagStatus endTagRequirement() const;
+    virtual int tagPriority() const;
+#endif
+
+    virtual void parseMappedAttribute(MappedAttribute*);
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+
     void createImageBuffer() const;
     void reset();
 
+    static const float MaxCanvasArea;
+
     bool m_rendererIsCanvas;
 
-    OwnPtr<CanvasRenderingContext2D> m_2DContext;
+    OwnPtr<CanvasRenderingContext> m_context;
     IntSize m_size;    
     CanvasObserver* m_observer;
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.idl
index 13fc623..4b1b057 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,6 +26,7 @@
 module html {
 
     interface [
+        CustomMarkFunction,
         GenerateConstructor,
         InterfaceUUID=a14d88c8-c6af-4e34-ad17-659700c77a10,
         ImplementationUUID=7ae731bc-c264-4ee3-a4b4-5d4540af26c3
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLCollection.cpp b/src/3rdparty/webkit/WebCore/html/HTMLCollection.cpp
index 9dca48f..44e1104 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLCollection.cpp
@@ -27,6 +27,7 @@
 #include "HTMLElement.h"
 #include "HTMLNames.h"
 #include "HTMLObjectElement.h"
+#include "HTMLOptionElement.h"
 #include "NodeList.h"
 
 #include <utility>
@@ -104,6 +105,7 @@ Element* HTMLCollection::itemAfter(Element* previous) const
         case MapAreas:
         case OtherCollection:
         case SelectOptions:
+        case DataListOptions:
         case WindowNamedItems:
             break;
         case NodeChildren:
@@ -153,6 +155,13 @@ Element* HTMLCollection::itemAfter(Element* previous) const
                 if (e->hasLocalName(optionTag))
                     return e;
                 break;
+            case DataListOptions:
+                if (e->hasLocalName(optionTag)) {
+                    HTMLOptionElement* option = static_cast<HTMLOptionElement*>(e);
+                    if (!option->disabled() && !option->value().isEmpty())
+                        return e;
+                }
+                break;
             case MapAreas:
                 if (e->hasLocalName(areaTag))
                     return e;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataListElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLDataListElement.cpp
new file mode 100644
index 0000000..a6ca525
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataListElement.cpp
@@ -0,0 +1,60 @@
+/*
+ * Copyright (c) 2009, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#if ENABLE(DATALIST)
+#include "HTMLDataListElement.h"
+
+#include "HTMLNames.h"
+
+namespace WebCore {
+
+HTMLDataListElement::HTMLDataListElement(const QualifiedName& tagName, Document *doc)
+    : HTMLElement(tagName, doc)
+{
+}
+
+HTMLDataListElement::~HTMLDataListElement()
+{
+}
+
+bool HTMLDataListElement::checkDTD(const Node* newChild)
+{
+    return newChild->hasTagName(HTMLNames::optionTag) || HTMLElement::inInlineTagList(newChild);
+}
+
+PassRefPtr<HTMLCollection> HTMLDataListElement::options()
+{
+    return HTMLCollection::create(this, DataListOptions);
+}
+
+}  // namespace WebCore
+
+#endif  // ENABLE(DATALIST)
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataListElement.h b/src/3rdparty/webkit/WebCore/html/HTMLDataListElement.h
new file mode 100644
index 0000000..8c4cfbc
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataListElement.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (c) 2009, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef HTMLDataListElement_h
+#define HTMLDataListElement_h
+
+#if ENABLE(DATALIST)
+
+#include "HTMLCollection.h"
+#include "HTMLElement.h"
+
+namespace WebCore {
+
+    class HTMLDataListElement : public HTMLElement {
+    public:
+        HTMLDataListElement(const QualifiedName&, Document*);
+        virtual ~HTMLDataListElement();
+        PassRefPtr<HTMLCollection> options();
+
+    private:
+        virtual bool checkDTD(const Node*);
+    };
+
+}  // namespace WebCore
+
+#endif  // ENABLE(DATALIST)
+
+#endif  // HTMLDataListElement_h
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataListElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLDataListElement.idl
new file mode 100644
index 0000000..916c0a1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataListElement.idl
@@ -0,0 +1,38 @@
+/*
+ * Copyright (c) 2009, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module html {
+    interface [
+        GenerateConstructor,
+        Conditional=DATALIST
+    ] HTMLDataListElement : HTMLElement {
+        readonly attribute HTMLCollection options;
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDocument.cpp b/src/3rdparty/webkit/WebCore/html/HTMLDocument.cpp
index 96ae9e4..fd939c8 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDocument.cpp
@@ -109,14 +109,14 @@ String HTMLDocument::dir()
     HTMLElement* b = body();
     if (!b)
         return String();
-    return b->dir();
+    return b->getAttribute(dirAttr);
 }
 
 void HTMLDocument::setDir(const String& value)
 {
     HTMLElement* b = body();
     if (b)
-        b->setDir(value);
+        b->setAttribute(dirAttr, value);
 }
 
 String HTMLDocument::designMode() const
@@ -284,8 +284,10 @@ void HTMLDocument::releaseEvents()
 Tokenizer *HTMLDocument::createTokenizer()
 {
     bool reportErrors = false;
+#if ENABLE(INSPECTOR)
     if (Page* page = this->page())
         reportErrors = page->inspectorController()->windowVisible();
+#endif
 
     return new HTMLTokenizer(this, reportErrors);
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDocument.h b/src/3rdparty/webkit/WebCore/html/HTMLDocument.h
index eda7593..4b14d0c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDocument.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDocument.h
@@ -37,7 +37,7 @@ class HTMLDocument : public Document, public CachedResourceClient {
 public:
     static PassRefPtr<HTMLDocument> create(Frame* frame)
     {
-        return new HTMLDocument(frame);
+        return adoptRef(new HTMLDocument(frame));
     }
     virtual ~HTMLDocument();
 
@@ -71,10 +71,6 @@ public:
     void captureEvents();
     void releaseEvents();
 
-    virtual bool childAllowed(Node*);
-
-    virtual PassRefPtr<Element> createElement(const AtomicString& tagName, ExceptionCode&);
-
     void addNamedItem(const AtomicString& name);
     void removeNamedItem(const AtomicString& name);
     bool hasNamedItem(AtomicStringImpl* name);
@@ -87,6 +83,10 @@ protected:
     HTMLDocument(Frame*);
 
 private:
+    virtual bool childAllowed(Node*);
+
+    virtual PassRefPtr<Element> createElement(const AtomicString& tagName, ExceptionCode&);
+
     virtual bool isHTMLDocument() const { return true; }
     virtual bool isFrameSet() const;
     virtual Tokenizer* createTokenizer();
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLElement.cpp
index d201482..967a8e0 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLElement.cpp
@@ -56,13 +56,9 @@ using namespace HTMLNames;
 using std::min;
 using std::max;
 
-HTMLElement::HTMLElement(const QualifiedName& tagName, Document *doc)
-    : StyledElement(tagName, doc)
-{
-}
-
-HTMLElement::~HTMLElement()
+PassRefPtr<HTMLElement> HTMLElement::create(const QualifiedName& tagName, Document* document)
 {
+    return adoptRef(new HTMLElement(tagName, document, CreateElement));
 }
 
 String HTMLElement::nodeName() const
@@ -92,7 +88,7 @@ int HTMLElement::tagPriority() const
         return 0;
     if (hasLocalName(addressTag) || hasLocalName(ddTag) || hasLocalName(dtTag) || hasLocalName(noscriptTag) || hasLocalName(rpTag) || hasLocalName(rtTag))
         return 3;
-    if (hasLocalName(centerTag) || hasLocalName(nobrTag) || hasLocalName(rubyTag))
+    if (hasLocalName(centerTag) || hasLocalName(nobrTag) || hasLocalName(rubyTag) || hasLocalName(navTag))
         return 5;
     if (hasLocalName(noembedTag) || hasLocalName(noframesTag))
         return 10;
@@ -224,6 +220,8 @@ void HTMLElement::parseMappedAttribute(MappedAttribute *attr)
         setAttributeEventListener(eventNames().webkitTransitionEndEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == oninputAttr) {
         setAttributeEventListener(eventNames().inputEvent, createAttributeEventListener(this, attr));
+    } else if (attr->name() == oninvalidAttr) {
+        setAttributeEventListener(eventNames().invalidEvent, createAttributeEventListener(this, attr));
     }
 }
 
@@ -247,7 +245,7 @@ PassRefPtr<DocumentFragment> HTMLElement::createContextualFragment(const String
         hasLocalName(headTag) || hasLocalName(styleTag) || hasLocalName(titleTag))
         return 0;
 
-    RefPtr<DocumentFragment> fragment = new DocumentFragment(document());
+    RefPtr<DocumentFragment> fragment = DocumentFragment::create(document());
     
     if (document()->isHTMLDocument())
          parseHTMLDocumentFragment(html, fragment.get());
@@ -309,7 +307,7 @@ static void replaceChildrenWithFragment(HTMLElement* element, PassRefPtr<Documen
     }
 
     if (hasOneTextChild(element) && hasOneTextChild(fragment.get())) {
-        static_cast<Text*>(element->firstChild())->setData(static_cast<Text*>(fragment->firstChild())->string(), ec);
+        static_cast<Text*>(element->firstChild())->setData(static_cast<Text*>(fragment->firstChild())->data(), ec);
         return;
     }
 
@@ -329,7 +327,7 @@ static void replaceChildrenWithText(HTMLElement* element, const String& text, Ex
         return;
     }
 
-    RefPtr<Text> textNode = new Text(element->document(), text);
+    RefPtr<Text> textNode = Text::create(element->document(), text);
 
     if (hasOneChild(element)) {
         element->replaceChild(textNode.release(), element->firstChild(), ec);
@@ -415,7 +413,7 @@ void HTMLElement::setInnerText(const String& text, ExceptionCode& ec)
 
     // Add text nodes and <br> elements.
     ec = 0;
-    RefPtr<DocumentFragment> fragment = new DocumentFragment(document());
+    RefPtr<DocumentFragment> fragment = DocumentFragment::create(document());
     int lineStart = 0;
     UChar prev = 0;
     int length = text.length();
@@ -423,7 +421,7 @@ void HTMLElement::setInnerText(const String& text, ExceptionCode& ec)
         UChar c = text[i];
         if (c == '\n' || c == '\r') {
             if (i > lineStart) {
-                fragment->appendChild(new Text(document(), text.substring(lineStart, i - lineStart)), ec);
+                fragment->appendChild(Text::create(document(), text.substring(lineStart, i - lineStart)), ec);
                 if (ec)
                     return;
             }
@@ -437,7 +435,7 @@ void HTMLElement::setInnerText(const String& text, ExceptionCode& ec)
         prev = c;
     }
     if (length > lineStart)
-        fragment->appendChild(new Text(document(), text.substring(lineStart, length - lineStart)), ec);
+        fragment->appendChild(Text::create(document(), text.substring(lineStart, length - lineStart)), ec);
     replaceChildrenWithFragment(this, fragment.release(), ec);
 }
 
@@ -465,7 +463,7 @@ void HTMLElement::setOuterText(const String &text, ExceptionCode& ec)
     // FIXME: This creates a new text node even when the text is empty.
     // FIXME: This creates a single text node even when the text has CR and LF
     // characters in it. Instead it should create <br> elements.
-    RefPtr<Text> t = new Text(document(), text);
+    RefPtr<Text> t = Text::create(document(), text);
     ec = 0;
     parent->replaceChild(t, this, ec);
     if (ec)
@@ -603,9 +601,9 @@ void HTMLElement::addHTMLAlignmentToStyledElement(StyledElement* element, Mapped
         element->addCSSProperty(attr, CSSPropertyVerticalAlign, verticalAlignValue);
 }
 
-bool HTMLElement::isFocusable() const
+bool HTMLElement::supportsFocus() const
 {
-    return Element::isFocusable() || (isContentEditable() && parent() && !parent()->isContentEditable());
+    return Element::supportsFocus() || (isContentEditable() && parent() && !parent()->isContentEditable());
 }
 
 bool HTMLElement::isContentEditable() const 
@@ -727,56 +725,11 @@ void HTMLElement::accessKeyAction(bool sendToAnyElement)
         dispatchSimulatedClick(0, true);
 }
 
-String HTMLElement::id() const
-{
-    return getAttribute(idAttr);
-}
-
-void HTMLElement::setId(const String& value)
-{
-    setAttribute(idAttr, value);
-}
-
 String HTMLElement::title() const
 {
     return getAttribute(titleAttr);
 }
 
-void HTMLElement::setTitle(const String& value)
-{
-    setAttribute(titleAttr, value);
-}
-
-String HTMLElement::lang() const
-{
-    return getAttribute(langAttr);
-}
-
-void HTMLElement::setLang(const String& value)
-{
-    setAttribute(langAttr, value);
-}
-
-String HTMLElement::dir() const
-{
-    return getAttribute(dirAttr);
-}
-
-void HTMLElement::setDir(const String &value)
-{
-    setAttribute(dirAttr, value);
-}
-
-String HTMLElement::className() const
-{
-    return getAttribute(classAttr);
-}
-
-void HTMLElement::setClassName(const String &value)
-{
-    setAttribute(classAttr, value);
-}
-
 short HTMLElement::tabIndex() const
 {
     if (supportsFocus())
@@ -884,6 +837,7 @@ static HashSet<AtomicStringImpl*>* inlineTagList()
         tagList.add(textareaTag.localName().impl());
         tagList.add(labelTag.localName().impl());
         tagList.add(buttonTag.localName().impl());
+        tagList.add(datalistTag.localName().impl());
         tagList.add(insTag.localName().impl());
         tagList.add(delTag.localName().impl());
         tagList.add(nobrTag.localName().impl());
@@ -926,6 +880,7 @@ static HashSet<AtomicStringImpl*>* blockTagList()
         tagList.add(listingTag.localName().impl());
         tagList.add(marqueeTag.localName().impl());
         tagList.add(menuTag.localName().impl());
+        tagList.add(navTag.localName().impl());
         tagList.add(noembedTag.localName().impl());
         tagList.add(noframesTag.localName().impl());
         tagList.add(nolayerTag.localName().impl());
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLElement.h b/src/3rdparty/webkit/WebCore/html/HTMLElement.h
index 21b3bb5..c6a384b 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLElement.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -35,28 +35,12 @@ enum HTMLTagStatus { TagStatusOptional, TagStatusRequired, TagStatusForbidden };
                        
 class HTMLElement : public StyledElement {
 public:
-    HTMLElement(const QualifiedName& tagName, Document*);
-    virtual ~HTMLElement();
-
-    virtual bool isHTMLElement() const { return true; }
-
-    virtual String nodeName() const;
-
-    virtual bool mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const;
-    virtual void parseMappedAttribute(MappedAttribute*);
+    static PassRefPtr<HTMLElement> create(const QualifiedName& tagName, Document*);
 
     PassRefPtr<HTMLCollection> children();
     
-    String id() const;
-    void setId(const String&);
     virtual String title() const;
-    void setTitle(const String&);
-    String lang() const;
-    void setLang(const String&);
-    String dir() const;
-    void setDir(const String&);
-    String className() const;
-    void setClassName(const String&);
+
     virtual short tabIndex() const;
     void setTabIndex(int);
 
@@ -72,12 +56,13 @@ public:
     void insertAdjacentHTML(const String& where, const String& html, ExceptionCode&);
     void insertAdjacentText(const String& where, const String& text, ExceptionCode&);
 
-    virtual bool isFocusable() const;
+    virtual bool supportsFocus() const;
+    
     virtual bool isContentEditable() const;
     virtual bool isContentRichlyEditable() const;
-    virtual String contentEditable() const;
-    virtual void setContentEditable(MappedAttribute*);
-    virtual void setContentEditable(const String&);
+
+    String contentEditable() const;
+    void setContentEditable(const String&);
 
     virtual bool draggable() const;
     void setDraggable(bool);
@@ -88,31 +73,51 @@ public:
 
     virtual HTMLTagStatus endTagRequirement() const;
     virtual int tagPriority() const;
+
+    virtual bool rendererIsNeeded(RenderStyle*);
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+
+    HTMLFormElement* form() const { return virtualForm(); }
+
+    static void addHTMLAlignmentToStyledElement(StyledElement*, MappedAttribute*);
+
+protected:
+    HTMLElement(const QualifiedName& tagName, Document*, ConstructionType = CreateElementZeroRefCount);
+
+    void addHTMLAlignment(MappedAttribute*);
+
+    virtual bool mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const;
+    virtual void parseMappedAttribute(MappedAttribute*);
+
     virtual bool childAllowed(Node* newChild); // Error-checking during parsing that checks the DTD
 
     // Helper function to check the DTD for a given child node.
     virtual bool checkDTD(const Node*);
+
     static bool inEitherTagList(const Node*);
     static bool inInlineTagList(const Node*);
     static bool inBlockTagList(const Node*);
     static bool isRecognizedTagName(const QualifiedName&);
 
-    virtual bool rendererIsNeeded(RenderStyle*);
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-
-    HTMLFormElement* form() const { return virtualForm(); }
     HTMLFormElement* findFormAncestor() const;
 
-    static void addHTMLAlignmentToStyledElement(StyledElement*, MappedAttribute*);
+private:
+    virtual bool isHTMLElement() const { return true; }
 
-protected:
-    void addHTMLAlignment(MappedAttribute*);
+    virtual String nodeName() const;
+
+    void setContentEditable(MappedAttribute*);
 
-private:
     virtual HTMLFormElement* virtualForm() const;
+
     Node* insertAdjacent(const String& where, Node* newChild, ExceptionCode&);
 };
 
+inline HTMLElement::HTMLElement(const QualifiedName& tagName, Document* document, ConstructionType type)
+    : StyledElement(tagName, document, type)
+{
+}
+
 } // namespace WebCore
 
 #endif // HTMLElement_h
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.cpp
index 1bcbe56..81b88a4 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
- * Copyright (C) 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
@@ -42,15 +42,16 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLEmbedElement::HTMLEmbedElement(const QualifiedName& tagName, Document* doc)
-    : HTMLPlugInImageElement(tagName, doc)
+inline HTMLEmbedElement::HTMLEmbedElement(const QualifiedName& tagName, Document* document)
+    : HTMLPlugInImageElement(tagName, document)
     , m_needWidgetUpdate(false)
 {
     ASSERT(hasTagName(embedTag));
 }
 
-HTMLEmbedElement::~HTMLEmbedElement()
+PassRefPtr<HTMLEmbedElement> HTMLEmbedElement::create(const QualifiedName& tagName, Document* document)
 {
+    return adoptRef(new HTMLEmbedElement(tagName, document));
 }
 
 static inline RenderWidget* findWidgetRenderer(const Node* n) 
@@ -61,7 +62,7 @@ static inline RenderWidget* findWidgetRenderer(const Node* n)
         while (n && !n->hasTagName(objectTag));
 
     if (n && n->renderer() && n->renderer()->isWidget())
-        return static_cast<RenderWidget*>(n->renderer());
+        return toRenderWidget(n->renderer());
 
     return 0;
 }
@@ -182,7 +183,7 @@ void HTMLEmbedElement::updateWidget()
 {
     document()->updateStyleIfNeeded();
     if (m_needWidgetUpdate && renderer() && !isImageType())
-        static_cast<RenderPartObject*>(renderer())->updateWidget(true);
+        toRenderPartObject(renderer())->updateWidget(true);
 }
 
 void HTMLEmbedElement::insertedIntoDocument()
@@ -238,31 +239,11 @@ const QualifiedName& HTMLEmbedElement::imageSourceAttributeName() const
     return srcAttr;
 }
 
-String HTMLEmbedElement::src() const
-{
-    return getAttribute(srcAttr);
-}
-
-void HTMLEmbedElement::setSrc(const String& value)
-{
-    setAttribute(srcAttr, value);
-}
-
-String HTMLEmbedElement::type() const
-{
-    return getAttribute(typeAttr);
-}
-
-void HTMLEmbedElement::setType(const String& value)
-{
-    setAttribute(typeAttr, value);
-}
-
 void HTMLEmbedElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) const
 {
     HTMLPlugInImageElement::addSubresourceAttributeURLs(urls);
 
-    addSubresourceURL(urls, document()->completeURL(src()));
+    addSubresourceURL(urls, document()->completeURL(getAttribute(srcAttr)));
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.h b/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.h
index 2ce182a..16f0893 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -29,8 +29,12 @@ namespace WebCore {
 
 class HTMLEmbedElement : public HTMLPlugInImageElement {
 public:
+    static PassRefPtr<HTMLEmbedElement> create(const QualifiedName&, Document*);
+
+    void setNeedWidgetUpdate(bool needWidgetUpdate) { m_needWidgetUpdate = needWidgetUpdate; }
+
+private:
     HTMLEmbedElement(const QualifiedName&, Document*);
-    ~HTMLEmbedElement();
 
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusForbidden; }
     virtual int tagPriority() const { return 0; }
@@ -50,19 +54,11 @@ public:
     virtual const QualifiedName& imageSourceAttributeName() const;
 
     virtual void updateWidget();
-    void setNeedWidgetUpdate(bool needWidgetUpdate) { m_needWidgetUpdate = needWidgetUpdate; }
 
     virtual RenderWidget* renderWidgetForJSBindings() const;
 
-    String src() const;
-    void setSrc(const String&);
-
-    String type() const;
-    void setType(const String&);
-
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
-private:
     bool m_needWidgetUpdate;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.idl
index a38402c..05c10db 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.idl
@@ -29,17 +29,17 @@ module html {
         InterfaceUUID=18f9bd58-6bb3-4b5c-aa30-6da13adfc91e,
         ImplementationUUID=93e0407a-8380-4ff0-978d-f773f2dee6a3
     ] HTMLEmbedElement : HTMLElement {
-                 attribute [ConvertNullToNullString] DOMString align;
+                 attribute [ConvertNullToNullString, Reflect] DOMString align;
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-                 attribute [ConvertNullToNullString] DOMString height;
+                 attribute [ConvertNullToNullString, Reflect] DOMString height;
 #else
                  attribute [ConvertFromString] long height;
 #endif
-                 attribute [ConvertNullToNullString] DOMString name;
-                 attribute [ConvertNullToNullString] DOMString src;
-                 attribute [ConvertNullToNullString] DOMString type;
+                 attribute [ConvertNullToNullString, Reflect] DOMString name;
+                 attribute [ConvertNullToNullString, Reflect] DOMString src;
+                 attribute [ConvertNullToNullString, Reflect] DOMString type;
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-                 attribute [ConvertNullToNullString] DOMString width;
+                 attribute [ConvertNullToNullString, Reflect] DOMString width;
 #else
                  attribute [ConvertFromString] long width;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.cpp
index eb83173..b792075 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.cpp
@@ -48,9 +48,9 @@ bool HTMLFieldSetElement::checkDTD(const Node* newChild)
     return newChild->hasTagName(legendTag) || HTMLElement::checkDTD(newChild);
 }
 
-bool HTMLFieldSetElement::isFocusable() const
+bool HTMLFieldSetElement::supportsFocus() const
 {
-    return HTMLElement::isFocusable();
+    return HTMLElement::supportsFocus();
 }
 
 const AtomicString& HTMLFieldSetElement::formControlType() const
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.h b/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.h
index e79f2c5..0900317 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.h
@@ -44,7 +44,7 @@ public:
     virtual int tagPriority() const { return 3; }
     virtual bool checkDTD(const Node* newChild);
 
-    virtual bool isFocusable() const;
+    virtual bool supportsFocus() const;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual const AtomicString& formControlType() const;
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.idl
index 371f3fd..ca8563b 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.idl
@@ -29,6 +29,8 @@ module html {
         readonly attribute ValidityState   validity;
 #endif
         readonly attribute boolean         willValidate;
+        boolean  checkValidity();
+        void     setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.cpp
index e90a6e0..61e112c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.cpp
@@ -64,6 +64,16 @@ HTMLFormControlElement::~HTMLFormControlElement()
         m_form->removeFormElement(this);
 }
 
+bool HTMLFormControlElement::formNoValidate() const
+{
+    return !getAttribute(formnovalidateAttr).isNull();
+}
+
+void HTMLFormControlElement::setFormNoValidate(bool formnovalidate)
+{
+    setAttribute(formnovalidateAttr, formnovalidate ? "" : 0);
+}
+
 ValidityState* HTMLFormControlElement::validity()
 {
     if (!m_validityState)
@@ -222,13 +232,19 @@ void HTMLFormControlElement::recalcStyle(StyleChange change)
         renderer()->updateFromElement();
 }
 
+bool HTMLFormControlElement::supportsFocus() const
+{
+    return !disabled();
+}
+
 bool HTMLFormControlElement::isFocusable() const
 {
-    if (disabled() || !renderer() || 
-        (renderer()->style() && renderer()->style()->visibility() != VISIBLE) || 
+    if (!renderer() || 
         !renderer()->isBox() || toRenderBox(renderer())->size().isEmpty())
         return false;
-    return true;
+    // HTMLElement::isFocusable handles visibility and calls suportsFocus which
+    // will cover the disabled case.
+    return HTMLElement::isFocusable();
 }
 
 bool HTMLFormControlElement::isKeyboardFocusable(KeyboardEvent* event) const
@@ -260,7 +276,22 @@ bool HTMLFormControlElement::willValidate() const
     //      The control does not have a repetition template as an ancestor.
     //      The control does not have a datalist element as an ancestor.
     //      The control is not an output element.
-    return form() && name().length() && !disabled() && !isReadOnlyFormControl();
+    return form() && !name().isEmpty() && !disabled() && !isReadOnlyFormControl();
+}
+
+bool HTMLFormControlElement::checkValidity()
+{
+    if (willValidate() && !isValidFormControlElement()) {
+        dispatchEvent(EventNames().invalidEvent, false, true);
+        return false;
+    }
+
+    return true;
+}
+
+void HTMLFormControlElement::setCustomValidity(const String& error)
+{
+    validity()->setCustomErrorMessage(error);
 }
     
 void HTMLFormControlElement::dispatchFocusEvent()
@@ -279,14 +310,19 @@ void HTMLFormControlElement::dispatchBlurEvent()
     HTMLElement::dispatchBlurEvent();
 }
 
-bool HTMLFormControlElement::supportsFocus() const
+HTMLFormElement* HTMLFormControlElement::virtualForm() const
 {
-    return isFocusable() || (!disabled() && !document()->haveStylesheetsLoaded());
+    return m_form;
 }
 
-HTMLFormElement* HTMLFormControlElement::virtualForm() const
+bool HTMLFormControlElement::isDefaultButtonForForm() const
 {
-    return m_form;
+    return isSuccessfulSubmitButton() && m_form && m_form->defaultButton() == this;
+}
+
+bool HTMLFormControlElement::isValidFormControlElement()
+{
+    return validity()->valid();
 }
 
 void HTMLFormControlElement::removeFromForm()
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.h b/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.h
index d3dd60f..ee7d772 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.h
@@ -43,6 +43,9 @@ public:
     HTMLFormElement* form() const { return m_form; }
     virtual ValidityState* validity();
 
+    bool formNoValidate() const;
+    void setFormNoValidate(bool);
+
     virtual bool isTextFormControl() const { return false; }
     virtual bool isEnabledFormControl() const { return !disabled(); }
 
@@ -77,8 +80,6 @@ public:
     bool required() const;
     void setRequired(bool);
 
-    virtual bool valueMissing() const { return false; }
-
     virtual void recalcStyle(StyleChange);
 
     virtual const AtomicString& formControlName() const;
@@ -104,7 +105,10 @@ public:
     virtual short tabIndex() const;
 
     virtual bool willValidate() const;
+    bool checkValidity();
+    void setCustomValidity(const String&);
 
+    virtual bool valueMissing() const { return false; }
     virtual bool patternMismatch() const { return false; }
 
     void formDestroyed() { m_form = 0; }
@@ -117,6 +121,8 @@ protected:
 
 private:
     virtual HTMLFormElement* virtualForm() const;
+    virtual bool isDefaultButtonForForm() const;
+    virtual bool isValidFormControlElement();
 
     HTMLFormElement* m_form;
     RefPtr<ValidityState> m_validityState;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp
index 54986b0..9f2d7c2 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp
@@ -47,6 +47,7 @@
 #include "MappedAttribute.h"
 #include "Page.h"
 #include "RenderTextControl.h"
+#include "ValidityState.h"
 #include <limits>
 #include <wtf/CurrentTime.h>
 #include <wtf/RandomNumber.h>
@@ -537,6 +538,16 @@ void HTMLFormElement::setName(const String &value)
     setAttribute(nameAttr, value);
 }
 
+bool HTMLFormElement::noValidate() const
+{
+    return !getAttribute(novalidateAttr).isNull();
+}
+
+void HTMLFormElement::setNoValidate(bool novalidate)
+{
+    setAttribute(novalidateAttr, novalidate ? "" : 0);
+}
+
 void HTMLFormElement::setAcceptCharset(const String &value)
 {
     setAttribute(accept_charsetAttr, value);
@@ -577,6 +588,31 @@ void HTMLFormElement::setTarget(const String &value)
     setAttribute(targetAttr, value);
 }
 
+HTMLFormControlElement* HTMLFormElement::defaultButton() const
+{
+    for (unsigned i = 0; i < formElements.size(); ++i) {
+        HTMLFormControlElement* control = formElements[i];
+        if (control->isSuccessfulSubmitButton())
+            return control;
+    }
+
+    return 0;
+}
+
+bool HTMLFormElement::checkValidity()
+{
+    // TODO: Check for unhandled invalid controls, see #27452 for tips.
+
+    bool hasOnlyValidControls = true;
+    for (unsigned i = 0; i < formElements.size(); ++i) {
+        HTMLFormControlElement* control = formElements[i];
+        if (!control->checkValidity())
+            hasOnlyValidControls = false;
+    }
+
+    return hasOnlyValidControls;
+}
+
 PassRefPtr<HTMLFormControlElement> HTMLFormElement::elementForAlias(const AtomicString& alias)
 {
     if (alias.isEmpty() || !m_elementAliases)
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormElement.h b/src/3rdparty/webkit/WebCore/html/HTMLFormElement.h
index 6b7812a..af81fcc 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormElement.h
@@ -96,6 +96,9 @@ public:
     String name() const;
     void setName(const String&);
 
+    bool noValidate() const;
+    void setNoValidate(bool);
+
     String acceptCharset() const { return m_formDataBuilder.acceptCharset(); }
     void setAcceptCharset(const String&);
 
@@ -107,7 +110,11 @@ public:
 
     virtual String target() const;
     void setTarget(const String&);
-    
+
+    HTMLFormControlElement* defaultButton() const;
+
+    bool checkValidity();
+
     PassRefPtr<HTMLFormControlElement> elementForAlias(const AtomicString&);
     void addElementAlias(HTMLFormControlElement*, const AtomicString& alias);
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLFormElement.idl
index f3aca87..3e846d6 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormElement.idl
@@ -30,6 +30,7 @@ module html {
         readonly attribute HTMLCollection  elements;
         readonly attribute long            length;
                  attribute [ConvertNullToNullString] DOMString       name;
+                 attribute boolean         noValidate;
                  attribute [ConvertNullToNullString] DOMString       acceptCharset;
                  attribute [ConvertNullToNullString] DOMString       action;
                  attribute [ConvertNullToNullString] DOMString       encoding;  /* Netscape/Firefox legacy attribute. Same as enctype. */
@@ -39,5 +40,6 @@ module html {
         
         [Custom] void submit();
         void reset();
+        boolean  checkValidity();
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.cpp
index adc3ff1..b456ac3 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.cpp
@@ -1,9 +1,9 @@
-/**
+/*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann (hausmann@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2006 Apple Computer, Inc.
+ * Copyright (C) 2004, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -34,18 +34,24 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLFrameElement::HTMLFrameElement(const QualifiedName& tagName, Document* document)
+inline HTMLFrameElement::HTMLFrameElement(const QualifiedName& tagName, Document* document)
     : HTMLFrameElementBase(tagName, document)
     , m_frameBorder(true)
     , m_frameBorderSet(false)
+    , m_noResize(false)
 {
     ASSERT(hasTagName(frameTag));
 }
 
+PassRefPtr<HTMLFrameElement> HTMLFrameElement::create(const QualifiedName& tagName, Document* document)
+{
+    return adoptRef(new HTMLFrameElement(tagName, document));
+}
+
 bool HTMLFrameElement::rendererIsNeeded(RenderStyle*)
 {
     // For compatibility, frames render even when display: none is set.
-    return isURLAllowed(m_URL);
+    return isURLAllowed();
 }
 
 RenderObject* HTMLFrameElement::createRenderer(RenderArena* arena, RenderStyle*)
@@ -55,9 +61,10 @@ RenderObject* HTMLFrameElement::createRenderer(RenderArena* arena, RenderStyle*)
 
 static inline HTMLFrameSetElement* containingFrameSetElement(Node* node)
 {
-    while ((node = node->parentNode()))
+    while ((node = node->parentNode())) {
         if (node->hasTagName(framesetTag))
             return static_cast<HTMLFrameSetElement*>(node);
+    }
     return 0;
 }
 
@@ -73,14 +80,26 @@ void HTMLFrameElement::attach()
     }
 }
 
-void HTMLFrameElement::parseMappedAttribute(MappedAttribute *attr)
+void HTMLFrameElement::parseMappedAttribute(MappedAttribute* attr)
 {
     if (attr->name() == frameborderAttr) {
         m_frameBorder = attr->value().toInt();
         m_frameBorderSet = !attr->isNull();
         // FIXME: If we are already attached, this has no effect.
+    } else if (attr->name() == noresizeAttr) {
+        m_noResize = true;
+        // FIXME: If we are already attached, this has no effect.
+        // FIXME: Since this does not check attr->isNull(), it can
+        // never reset m_noResize to false if the attribute is removed.
+        // FIXME: There seems to be no code that looks at this
+        // value and prevents resizing.
     } else
         HTMLFrameElementBase::parseMappedAttribute(attr);
 }
 
+void HTMLFrameElement::setNoResize(bool noResize)
+{
+    setAttribute(noresizeAttr, noResize ? "" : 0);
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.h b/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.h
index ab602ee..4a8e16c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.h
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
- * Copyright (C) 2004, 2006 Apple Computer, Inc.
+ * Copyright (C) 2004, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -28,13 +28,16 @@
 
 namespace WebCore {
 
-class Document;
-class RenderObject;
-class RenderArena;
-class RenderStyle;
-
 class HTMLFrameElement : public HTMLFrameElementBase {
 public:
+    static PassRefPtr<HTMLFrameElement> create(const QualifiedName&, Document*);
+
+    bool hasFrameBorder() const { return m_frameBorder; }
+
+    bool noResize() const { return m_noResize; }
+    void setNoResize(bool);
+
+private:
     HTMLFrameElement(const QualifiedName&, Document*);
 
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusForbidden; }
@@ -47,11 +50,10 @@ public:
     
     virtual void parseMappedAttribute(MappedAttribute*);
 
-    bool hasFrameBorder() const { return m_frameBorder; }
-
-private:
     bool m_frameBorder;
     bool m_frameBorderSet;
+
+    bool m_noResize;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.idl
index 106e57e..d0076eb 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.idl
@@ -26,14 +26,14 @@ module html {
         ImplementationUUID=38c9e3c8-3384-40b6-a484-cb845c48b67d
     ] HTMLFrameElement : HTMLElement {
 
-                 attribute [ConvertNullToNullString] DOMString       frameBorder;
-                 attribute [ConvertNullToNullString] DOMString       longDesc;
-                 attribute [ConvertNullToNullString] DOMString       marginHeight;
-                 attribute [ConvertNullToNullString] DOMString       marginWidth;
-                 attribute [ConvertNullToNullString] DOMString       name;
+                 attribute [ConvertNullToNullString, Reflect=frameborder] DOMString       frameBorder;
+                 attribute [ConvertNullToNullString, Reflect=longdesc] DOMString       longDesc;
+                 attribute [ConvertNullToNullString, Reflect=marginheight] DOMString       marginHeight;
+                 attribute [ConvertNullToNullString, Reflect=marginwidth] DOMString       marginWidth;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       name;
                  attribute boolean         noResize;
-                 attribute [ConvertNullToNullString] DOMString       scrolling;
-                 attribute [ConvertNullToNullString, CustomSetter] DOMString       src;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       scrolling;
+                 attribute [ConvertNullToNullString, CustomSetter, ReflectURL] DOMString       src;
 
         // Introduced in DOM Level 2:
         readonly attribute [CheckFrameSecurity] Document        contentDocument;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.cpp
index 7ae8f59..1bc4995 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.cpp
@@ -50,18 +50,17 @@ HTMLFrameElementBase::HTMLFrameElementBase(const QualifiedName& tagName, Documen
     , m_scrolling(ScrollbarAuto)
     , m_marginWidth(-1)
     , m_marginHeight(-1)
-    , m_noResize(false)
     , m_viewSource(false)
     , m_shouldOpenURLAfterAttach(false)
 {
 }
 
-bool HTMLFrameElementBase::isURLAllowed(const AtomicString& URLString) const
+bool HTMLFrameElementBase::isURLAllowed() const
 {
-    if (URLString.isEmpty())
+    if (m_URL.isEmpty())
         return true;
 
-    const KURL& completeURL = document()->completeURL(URLString);
+    const KURL& completeURL = document()->completeURL(m_URL);
 
     // Don't allow more than 200 total frames in a set. This seems
     // like a reasonable upper bound, and otherwise mutually recursive
@@ -79,7 +78,7 @@ bool HTMLFrameElementBase::isURLAllowed(const AtomicString& URLString) const
     // But we don't allow more than one.
     bool foundSelfReference = false;
     for (Frame* frame = document()->frame(); frame; frame = frame->tree()->parent()) {
-        if (equalIgnoringRef(frame->loader()->url(), completeURL)) {
+        if (equalIgnoringFragmentIdentifier(frame->loader()->url(), completeURL)) {
             if (foundSelfReference)
                 return false;
             foundSelfReference = true;
@@ -93,7 +92,7 @@ void HTMLFrameElementBase::openURL()
 {
     ASSERT(!m_frameName.isEmpty());
 
-    if (!isURLAllowed(m_URL))
+    if (!isURLAllowed())
         return;
 
     if (m_URL.isEmpty())
@@ -127,9 +126,6 @@ void HTMLFrameElementBase::parseMappedAttribute(MappedAttribute *attr)
     } else if (attr->name() == marginheightAttr) {
         m_marginHeight = attr->value().toInt();
         // FIXME: If we are already attached, this has no effect.
-    } else if (attr->name() == noresizeAttr) {
-        m_noResize = true;
-        // FIXME: If we are already attached, this has no effect.
     } else if (attr->name() == scrollingAttr) {
         // Auto and yes both simply mean "allow scrolling." No means "don't allow scrolling."
         if (equalIgnoringCase(attr->value(), "auto") || equalIgnoringCase(attr->value(), "yes"))
@@ -193,14 +189,15 @@ void HTMLFrameElementBase::attach()
 
     HTMLFrameOwnerElement::attach();
     
-    if (RenderPart* renderPart = static_cast<RenderPart*>(renderer()))
+    if (RenderPart* renderPart = toRenderPart(renderer())) {
         if (Frame* frame = contentFrame())
             renderPart->setWidget(frame->view());
+    }
 }
 
 KURL HTMLFrameElementBase::location() const
 {
-    return src();
+    return document()->completeURL(getAttribute(srcAttr));
 }
 
 void HTMLFrameElementBase::setLocation(const String& str)
@@ -215,9 +212,9 @@ void HTMLFrameElementBase::setLocation(const String& str)
         openURL();
 }
 
-bool HTMLFrameElementBase::isFocusable() const
+bool HTMLFrameElementBase::supportsFocus() const
 {
-    return renderer();
+    return true;
 }
 
 void HTMLFrameElementBase::setFocus(bool received)
@@ -232,81 +229,6 @@ bool HTMLFrameElementBase::isURLAttribute(Attribute *attr) const
     return attr->name() == srcAttr;
 }
 
-String HTMLFrameElementBase::frameBorder() const
-{
-    return getAttribute(frameborderAttr);
-}
-
-void HTMLFrameElementBase::setFrameBorder(const String &value)
-{
-    setAttribute(frameborderAttr, value);
-}
-
-String HTMLFrameElementBase::longDesc() const
-{
-    return getAttribute(longdescAttr);
-}
-
-void HTMLFrameElementBase::setLongDesc(const String &value)
-{
-    setAttribute(longdescAttr, value);
-}
-
-String HTMLFrameElementBase::marginHeight() const
-{
-    return getAttribute(marginheightAttr);
-}
-
-void HTMLFrameElementBase::setMarginHeight(const String &value)
-{
-    setAttribute(marginheightAttr, value);
-}
-
-String HTMLFrameElementBase::marginWidth() const
-{
-    return getAttribute(marginwidthAttr);
-}
-
-void HTMLFrameElementBase::setMarginWidth(const String &value)
-{
-    setAttribute(marginwidthAttr, value);
-}
-
-String HTMLFrameElementBase::name() const
-{
-    return getAttribute(nameAttr);
-}
-
-void HTMLFrameElementBase::setName(const String &value)
-{
-    setAttribute(nameAttr, value);
-}
-
-void HTMLFrameElementBase::setNoResize(bool noResize)
-{
-    setAttribute(noresizeAttr, noResize ? "" : 0);
-}
-
-String HTMLFrameElementBase::scrolling() const
-{
-    return getAttribute(scrollingAttr);
-}
-
-void HTMLFrameElementBase::setScrolling(const String &value)
-{
-    setAttribute(scrollingAttr, value);
-}
-
-KURL HTMLFrameElementBase::src() const
-{
-    return document()->completeURL(getAttribute(srcAttr));
-}
-
-void HTMLFrameElementBase::setSrc(const String &value)
-{
-    setAttribute(srcAttr, value);
-}
-
 int HTMLFrameElementBase::width() const
 {
     if (!renderer())
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.h b/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.h
index 4a24451..c211ba7 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.h
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
- * Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -31,60 +31,39 @@ namespace WebCore {
 
 class HTMLFrameElementBase : public HTMLFrameOwnerElement {
 public:
-    virtual void parseMappedAttribute(MappedAttribute*);
-
-    virtual void insertedIntoDocument();
-    virtual void removedFromDocument();
-
-    virtual void attach();
-    virtual bool canLazyAttach() { return false; }
-
     KURL location() const;
     void setLocation(const String&);
 
-    virtual bool isFocusable() const;
-    virtual void setFocus(bool);
-    
-    virtual bool isURLAttribute(Attribute*) const;
-
     virtual ScrollbarMode scrollingMode() const { return m_scrolling; }
     
     int getMarginWidth() const { return m_marginWidth; }
     int getMarginHeight() const { return m_marginHeight; }
 
-    String frameBorder() const;
-    void setFrameBorder(const String&);
-
-    String longDesc() const;
-    void setLongDesc(const String&);
+    int width() const;
+    int height() const;
 
-    String marginHeight() const;
-    void setMarginHeight(const String&);
+protected:
+    HTMLFrameElementBase(const QualifiedName&, Document*);
 
-    String marginWidth() const;
-    void setMarginWidth(const String&);
+    bool isURLAllowed() const;
 
-    String name() const;
-    void setName(const String&);
+    virtual void parseMappedAttribute(MappedAttribute*);
 
-    bool noResize() const { return m_noResize; }
-    void setNoResize(bool);
+    virtual void insertedIntoDocument();
+    virtual void removedFromDocument();
 
-    String scrolling() const;
-    void setScrolling(const String&);
+    virtual void attach();
 
-    KURL src() const;
-    void setSrc(const String&);
+private:
+    virtual bool canLazyAttach() { return false; }
 
-    int width() const;
-    int height() const;
+    virtual bool supportsFocus() const;
+    virtual void setFocus(bool);
+    
+    virtual bool isURLAttribute(Attribute*) const;
 
     bool viewSourceMode() const { return m_viewSource; }
 
-protected:
-    HTMLFrameElementBase(const QualifiedName&, Document*);
-
-    bool isURLAllowed(const AtomicString&) const;
     void setNameAndOpenURL();
     void openURL();
 
@@ -98,7 +77,6 @@ protected:
     int m_marginWidth;
     int m_marginHeight;
 
-    bool m_noResize;
     bool m_viewSource;
 
     bool m_shouldOpenURLAfterAttach;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.cpp
index a98a3df..84958c2 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -33,7 +33,7 @@
 namespace WebCore {
 
 HTMLFrameOwnerElement::HTMLFrameOwnerElement(const QualifiedName& tagName, Document* document)
-    : HTMLElement(tagName, document)
+    : HTMLElement(tagName, document, CreateElement)
     , m_contentFrame(0)
 {
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.h b/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.h
index 3f50a02..1437e2c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -27,36 +27,36 @@ namespace WebCore {
 
 class DOMWindow;
 class Frame;
-class KeyboardEvent;
 
 #if ENABLE(SVG)
 class SVGDocument;
 #endif
 
 class HTMLFrameOwnerElement : public HTMLElement {
-protected:
-    HTMLFrameOwnerElement(const QualifiedName& tagName, Document*);
-
 public:
     virtual ~HTMLFrameOwnerElement();
 
-    virtual void willRemove();
-
     Frame* contentFrame() const { return m_contentFrame; }
     DOMWindow* contentWindow() const;
     Document* contentDocument() const;
 
-    virtual bool isFrameOwnerElement() const { return true; }
-    virtual bool isKeyboardFocusable(KeyboardEvent*) const { return m_contentFrame; }
-    
-    virtual ScrollbarMode scrollingMode() const { return ScrollbarAuto; }
-
 #if ENABLE(SVG)
     SVGDocument* getSVGDocument(ExceptionCode&) const;
 #endif
 
+    virtual ScrollbarMode scrollingMode() const { return ScrollbarAuto; }
+
+protected:
+    HTMLFrameOwnerElement(const QualifiedName& tagName, Document*);
+
 private:
     friend class Frame;
+
+    virtual bool isFrameOwnerElement() const { return true; }
+    virtual bool isKeyboardFocusable(KeyboardEvent*) const { return m_contentFrame; }
+    
+    virtual void willRemove();
+
     Frame* m_contentFrame;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.cpp
index 42c1d7f..8dc3964 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.cpp
@@ -135,6 +135,8 @@ void HTMLFrameSetElement::parseMappedAttribute(MappedAttribute *attr)
         document()->setWindowAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onfocusAttr)
         document()->setWindowAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onhashchangeAttr)
+        document()->setWindowAttributeEventListener(eventNames().hashchangeEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onresizeAttr)
         document()->setWindowAttributeEventListener(eventNames().resizeEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onscrollAttr)
@@ -191,7 +193,7 @@ void HTMLFrameSetElement::attach()
 void HTMLFrameSetElement::defaultEventHandler(Event* evt)
 {
     if (evt->isMouseEvent() && !noresize && renderer()) {
-        if (static_cast<RenderFrameSet*>(renderer())->userResize(static_cast<MouseEvent*>(evt))) {
+        if (toRenderFrameSet(renderer())->userResize(static_cast<MouseEvent*>(evt))) {
             evt->setDefaultHandled();
             return;
         }
@@ -235,7 +237,7 @@ EventListener* HTMLFrameSetElement::onblur() const
 
 void HTMLFrameSetElement::setOnblur(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().blurEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().blurEvent, eventListener);
 }
 
 EventListener* HTMLFrameSetElement::onerror() const
@@ -245,7 +247,7 @@ EventListener* HTMLFrameSetElement::onerror() const
 
 void HTMLFrameSetElement::setOnerror(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().errorEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().errorEvent, eventListener);
 }
 
 EventListener* HTMLFrameSetElement::onfocus() const
@@ -255,9 +257,19 @@ EventListener* HTMLFrameSetElement::onfocus() const
 
 void HTMLFrameSetElement::setOnfocus(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().focusEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().focusEvent, eventListener);
 }
 
+EventListener* HTMLFrameSetElement::onhashchange() const
+{
+    return document()->getWindowAttributeEventListener(eventNames().hashchangeEvent);
+}
+
+void HTMLFrameSetElement::setOnhashchange(PassRefPtr<EventListener> eventListener)
+{
+    document()->setWindowAttributeEventListener(eventNames().hashchangeEvent, eventListener);
+}   
+
 EventListener* HTMLFrameSetElement::onload() const
 {
     return document()->getWindowAttributeEventListener(eventNames().loadEvent);
@@ -265,7 +277,7 @@ EventListener* HTMLFrameSetElement::onload() const
 
 void HTMLFrameSetElement::setOnload(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().loadEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().loadEvent, eventListener);
 }
 
 EventListener* HTMLFrameSetElement::onbeforeunload() const
@@ -275,7 +287,7 @@ EventListener* HTMLFrameSetElement::onbeforeunload() const
 
 void HTMLFrameSetElement::setOnbeforeunload(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().beforeunloadEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().beforeunloadEvent, eventListener);
 }
 
 EventListener* HTMLFrameSetElement::onmessage() const
@@ -285,7 +297,7 @@ EventListener* HTMLFrameSetElement::onmessage() const
 
 void HTMLFrameSetElement::setOnmessage(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().messageEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().messageEvent, eventListener);
 }
 
 EventListener* HTMLFrameSetElement::onoffline() const
@@ -295,7 +307,7 @@ EventListener* HTMLFrameSetElement::onoffline() const
 
 void HTMLFrameSetElement::setOnoffline(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().offlineEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().offlineEvent, eventListener);
 }
 
 EventListener* HTMLFrameSetElement::ononline() const
@@ -305,7 +317,7 @@ EventListener* HTMLFrameSetElement::ononline() const
 
 void HTMLFrameSetElement::setOnonline(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().onlineEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().onlineEvent, eventListener);
 }
 
 EventListener* HTMLFrameSetElement::onresize() const
@@ -315,7 +327,7 @@ EventListener* HTMLFrameSetElement::onresize() const
 
 void HTMLFrameSetElement::setOnresize(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().resizeEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().resizeEvent, eventListener);
 }
 
 EventListener* HTMLFrameSetElement::onstorage() const
@@ -325,7 +337,7 @@ EventListener* HTMLFrameSetElement::onstorage() const
 
 void HTMLFrameSetElement::setOnstorage(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().storageEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().storageEvent, eventListener);
 }
 
 EventListener* HTMLFrameSetElement::onunload() const
@@ -335,7 +347,7 @@ EventListener* HTMLFrameSetElement::onunload() const
 
 void HTMLFrameSetElement::setOnunload(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().unloadEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().unloadEvent, eventListener);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.h b/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.h
index 4319c7a..b51e702 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.h
@@ -79,6 +79,8 @@ public:
 
     EventListener* onbeforeunload() const;
     void setOnbeforeunload(PassRefPtr<EventListener>);
+    EventListener* onhashchange() const;
+    void setOnhashchange(PassRefPtr<EventListener>);
     EventListener* onmessage() const;
     void setOnmessage(PassRefPtr<EventListener>);
     EventListener* onoffline() const;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.idl
index 4050f2c..0375c0a 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.idl
@@ -33,6 +33,7 @@ module html {
 #if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // Event handler attributes
         attribute [DontEnum] EventListener onbeforeunload;
+        attribute [DontEnum] EventListener onhashchange;
         attribute [DontEnum] EventListener onmessage;
         attribute [DontEnum] EventListener onoffline;
         attribute [DontEnum] EventListener ononline;
@@ -40,7 +41,7 @@ module html {
         attribute [DontEnum] EventListener onstorage;
         attribute [DontEnum] EventListener onunload;
 
-        // Overrides of Element attributes.
+        // Overrides of Element attributes (left in for completeness).
         // attribute [DontEnum] EventListener onblur;
         // attribute [DontEnum] EventListener onerror;
         // attribute [DontEnum] EventListener onfocus;
@@ -49,7 +50,6 @@ module html {
         // Not implemented yet.
         // attribute [DontEnum] EventListener onafterprint;
         // attribute [DontEnum] EventListener onbeforeprint;
-        // attribute [DontEnum] EventListener onhashchange;
         // attribute [DontEnum] EventListener onpopstate;
         // attribute [DontEnum] EventListener onredo;
         // attribute [DontEnum] EventListener onundo;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLHtmlElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLHtmlElement.cpp
index d4867a4..8382e60 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLHtmlElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLHtmlElement.cpp
@@ -23,8 +23,10 @@
 #include "config.h"
 #include "HTMLHtmlElement.h"
 
-#include "ApplicationCacheGroup.h"
+#include "ApplicationCacheHost.h"
 #include "Document.h"
+#include "DocumentLoader.h"
+#include "Frame.h"
 #include "HTMLNames.h"
 
 namespace WebCore {
@@ -68,12 +70,19 @@ void HTMLHtmlElement::insertedIntoDocument()
     if (!document()->frame())
         return;
 
+    DocumentLoader* documentLoader = document()->frame()->loader()->documentLoader();
+    if (!documentLoader)
+        return;
+
     // Check the manifest attribute
+    // FIXME: Revisit this when we get a clarification from whatwg on how to handle empty
+    // manifest attributes. As spec'd, and coded here, the system will initiate an update
+    // passing in the document url as the manifest url. That's not a good thing.
     AtomicString manifest = getAttribute(manifestAttr);
     if (manifest.isNull())
-        ApplicationCacheGroup::selectCacheWithoutManifestURL(document()->frame());
+        documentLoader->applicationCacheHost()->selectCacheWithoutManifest();
     else
-        ApplicationCacheGroup::selectCache(document()->frame(), document()->completeURL(manifest));
+        documentLoader->applicationCacheHost()->selectCacheWithManifest(document()->completeURL(manifest));
 }
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.cpp
index a190bca..cae9b8d 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.cpp
@@ -3,7 +3,7 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann (hausmann@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -35,12 +35,17 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLIFrameElement::HTMLIFrameElement(const QualifiedName& tagName, Document* document)
+inline HTMLIFrameElement::HTMLIFrameElement(const QualifiedName& tagName, Document* document)
     : HTMLFrameElementBase(tagName, document)
 {
     ASSERT(hasTagName(iframeTag));
 }
 
+PassRefPtr<HTMLIFrameElement> HTMLIFrameElement::create(const QualifiedName& tagName, Document* document)
+{
+    return adoptRef(new HTMLIFrameElement(tagName, document));
+}
+
 bool HTMLIFrameElement::mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const
 {
     if (attrName == widthAttr || attrName == heightAttr) {
@@ -89,7 +94,7 @@ void HTMLIFrameElement::parseMappedAttribute(MappedAttribute* attr)
 
 bool HTMLIFrameElement::rendererIsNeeded(RenderStyle* style)
 {
-    return isURLAllowed(m_URL) && style->display() != NONE;
+    return isURLAllowed() && style->display() != NONE;
 }
 
 RenderObject* HTMLIFrameElement::createRenderer(RenderArena* arena, RenderStyle*)
@@ -117,7 +122,7 @@ void HTMLIFrameElement::attach()
 {
     HTMLFrameElementBase::attach();
 
-    if (RenderPartObject* renderPartObject = static_cast<RenderPartObject*>(renderer()))
+    if (RenderPartObject* renderPartObject = toRenderPartObject(renderer()))
         renderPartObject->updateWidget(false);
 }
 
@@ -126,34 +131,4 @@ bool HTMLIFrameElement::isURLAttribute(Attribute* attr) const
     return attr->name() == srcAttr;
 }
 
-String HTMLIFrameElement::align() const
-{
-    return getAttribute(alignAttr);
-}
-
-void HTMLIFrameElement::setAlign(const String &value)
-{
-    setAttribute(alignAttr, value);
-}
-
-String HTMLIFrameElement::height() const
-{
-    return getAttribute(heightAttr);
-}
-
-void HTMLIFrameElement::setHeight(const String &value)
-{
-    setAttribute(heightAttr, value);
-}
-
-String HTMLIFrameElement::width() const
-{
-    return getAttribute(widthAttr);
-}
-
-void HTMLIFrameElement::setWidth(const String &value)
-{
-    setAttribute(widthAttr, value);
-}
-
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.h b/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.h
index 362b991..f1c6a35 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.h
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
- * Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -30,6 +30,9 @@ namespace WebCore {
 
 class HTMLIFrameElement : public HTMLFrameElementBase {
 public:
+    static PassRefPtr<HTMLIFrameElement> create(const QualifiedName&, Document*);
+
+private:
     HTMLIFrameElement(const QualifiedName&, Document*);
 
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusRequired; }
@@ -48,16 +51,6 @@ public:
     
     virtual bool isURLAttribute(Attribute*) const;
 
-    String align() const;
-    void setAlign(const String&);
-
-    String height() const;
-    void setHeight(const String&);
-
-    String width() const;
-    void setWidth(const String&);
-
-private:
     AtomicString m_name;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.idl
index b5684ca..e288b54 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -26,16 +26,16 @@ module html {
         ImplementationUUID=370c6318-f804-49f9-bc8a-46b99cd87399
     ] HTMLIFrameElement : HTMLElement {
 
-                 attribute [ConvertNullToNullString] DOMString       align;
-                 attribute [ConvertNullToNullString] DOMString       frameBorder;
-                 attribute [ConvertNullToNullString] DOMString       height;
-                 attribute [ConvertNullToNullString] DOMString       longDesc;
-                 attribute [ConvertNullToNullString] DOMString       marginHeight;
-                 attribute [ConvertNullToNullString] DOMString       marginWidth;
-                 attribute [ConvertNullToNullString] DOMString       name;
-                 attribute [ConvertNullToNullString] DOMString       scrolling;
-                 attribute [ConvertNullToNullString, CustomSetter] DOMString       src;
-                 attribute [ConvertNullToNullString] DOMString       width;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       align;
+                 attribute [ConvertNullToNullString, Reflect=frameborder] DOMString       frameBorder;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       height;
+                 attribute [ConvertNullToNullString, Reflect=longdesc] DOMString       longDesc;
+                 attribute [ConvertNullToNullString, Reflect=marginheight] DOMString       marginHeight;
+                 attribute [ConvertNullToNullString, Reflect=marginwidth] DOMString       marginWidth;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       name;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       scrolling;
+                 attribute [ConvertNullToNullString, CustomSetter, Reflect] DOMString       src;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       width;
 
         // Introduced in DOM Level 2:
         readonly attribute [CheckFrameSecurity] Document        contentDocument;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp
index 5173964..932e718 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp
@@ -279,46 +279,11 @@ bool HTMLImageElement::isURLAttribute(Attribute* attr) const
         || (attr->name() == usemapAttr && attr->value().string()[0] != '#');
 }
 
-String HTMLImageElement::name() const
-{
-    return getAttribute(nameAttr);
-}
-
-void HTMLImageElement::setName(const String& value)
-{
-    setAttribute(nameAttr, value);
-}
-
-String HTMLImageElement::align() const
-{
-    return getAttribute(alignAttr);
-}
-
-void HTMLImageElement::setAlign(const String& value)
-{
-    setAttribute(alignAttr, value);
-}
-
-String HTMLImageElement::alt() const
+const AtomicString& HTMLImageElement::alt() const
 {
     return getAttribute(altAttr);
 }
 
-void HTMLImageElement::setAlt(const String& value)
-{
-    setAttribute(altAttr, value);
-}
-
-String HTMLImageElement::border() const
-{
-    return getAttribute(borderAttr);
-}
-
-void HTMLImageElement::setBorder(const String& value)
-{
-    setAttribute(borderAttr, value);
-}
-
 bool HTMLImageElement::draggable() const
 {
     // Image elements are draggable by default.
@@ -381,16 +346,6 @@ void HTMLImageElement::setSrc(const String& value)
     setAttribute(srcAttr, value);
 }
 
-String HTMLImageElement::useMap() const
-{
-    return getAttribute(usemapAttr);
-}
-
-void HTMLImageElement::setUseMap(const String& value)
-{
-    setAttribute(usemapAttr, value);
-}
-
 int HTMLImageElement::vspace() const
 {
     // ### return actual vspace
@@ -439,7 +394,8 @@ void HTMLImageElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) cons
     HTMLElement::addSubresourceAttributeURLs(urls);
 
     addSubresourceURL(urls, src());
-    addSubresourceURL(urls, document()->completeURL(useMap()));
+    // FIXME: What about when the usemap attribute begins with "#"?
+    addSubresourceURL(urls, document()->completeURL(getAttribute(usemapAttr)));
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.h b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.h
index 5e82186..f58574d 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.h
@@ -69,17 +69,7 @@ public:
 
     void setLoadManually(bool loadManually) { m_imageLoader.setLoadManually(loadManually); }
 
-    String name() const;
-    void setName(const String&);
-
-    String align() const;
-    void setAlign(const String&);
-
-    String alt() const;
-    void setAlt(const String&);
-
-    String border() const;
-    void setBorder(const String&);
+    const AtomicString& alt() const;
 
     virtual bool draggable() const;
 
@@ -100,9 +90,6 @@ public:
     KURL src() const;
     void setSrc(const String&);
 
-    String useMap() const;
-    void setUseMap(const String&);
-
     int vspace() const;
     void setVspace(int);
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
index f35292f..8b884cf 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "HTMLInputElement.h"
 
+#include "AXObjectCache.h"
 #include "CSSPropertyNames.h"
 #include "ChromeClient.h"
 #include "Document.h"
@@ -38,9 +39,11 @@
 #include "FocusController.h"
 #include "FormDataList.h"
 #include "Frame.h"
+#include "HTMLDataListElement.h"
 #include "HTMLFormElement.h"
 #include "HTMLImageLoader.h"
 #include "HTMLNames.h"
+#include "HTMLOptionElement.h"
 #include "ScriptEventListener.h"
 #include "KeyboardEvent.h"
 #include "LocalizedStrings.h"
@@ -56,6 +59,7 @@
 #include "RenderTextControlSingleLine.h"
 #include "RenderTheme.h"
 #include "TextEvent.h"
+#include <wtf/MathExtras.h>
 #include <wtf/StdLibExtras.h>
 
 using namespace std;
@@ -134,6 +138,8 @@ bool HTMLInputElement::valueMissing() const
             return !checked();
         case RADIO:
             return !document()->checkedRadioButtons().checkedButtonForGroup(name());
+        case COLOR:
+            return false;
         case HIDDEN:
         case RANGE:
         case SUBMIT:
@@ -162,6 +168,7 @@ bool HTMLInputElement::patternMismatch() const
         case BUTTON:
         case RANGE:
         case NUMBER:
+        case COLOR:
             return false;
         case TEXT:
         case SEARCH:
@@ -252,7 +259,7 @@ bool HTMLInputElement::shouldUseInputMethod() const
 
 void HTMLInputElement::dispatchFocusEvent()
 {
-    InputElement::dispatchFocusEvent(m_data, this, this);
+    InputElement::dispatchFocusEvent(this, this);
 
     if (isTextField())
         m_autofilled = false;
@@ -262,7 +269,7 @@ void HTMLInputElement::dispatchFocusEvent()
 
 void HTMLInputElement::dispatchBlurEvent()
 {
-    InputElement::dispatchBlurEvent(m_data, this, this);
+    InputElement::dispatchBlurEvent(this, this);
     HTMLFormControlElementWithState::dispatchBlurEvent();
 }
 
@@ -311,6 +318,8 @@ void HTMLInputElement::setInputType(const String& t)
         newType = TELEPHONE;
     else if (equalIgnoringCase(t, "url"))
         newType = URL;
+    else if (equalIgnoringCase(t, "color"))
+        newType = COLOR;
     else
         newType = TEXT;
 
@@ -345,7 +354,7 @@ void HTMLInputElement::setInputType(const String& t)
                 m_data.setValue(String());
             }
             if (!didStoreValue && willStoreValue)
-                m_data.setValue(constrainValue(getAttribute(valueAttr)));
+                m_data.setValue(sanitizeValue(getAttribute(valueAttr)));
             else
                 InputElement::updateValueIfNeeded(m_data, this);
 
@@ -394,6 +403,10 @@ const AtomicString& HTMLInputElement::formControlType() const
             DEFINE_STATIC_LOCAL(const AtomicString, checkbox, ("checkbox"));
             return checkbox;
         }
+        case COLOR: {
+            DEFINE_STATIC_LOCAL(const AtomicString, color, ("color"));
+            return color;
+        }
         case EMAIL: {
             DEFINE_STATIC_LOCAL(const AtomicString, email, ("email"));
             return email;
@@ -463,6 +476,7 @@ bool HTMLInputElement::saveFormControlState(String& result) const
 
     switch (inputType()) {
         case BUTTON:
+        case COLOR:
         case EMAIL:
         case FILE:
         case HIDDEN:
@@ -494,6 +508,7 @@ void HTMLInputElement::restoreFormControlState(const String& state)
     ASSERT(inputType() != PASSWORD); // should never save/restore password fields
     switch (inputType()) {
         case BUTTON:
+        case COLOR:
         case EMAIL:
         case FILE:
         case HIDDEN:
@@ -605,6 +620,7 @@ void HTMLInputElement::accessKeyAction(bool sendToAnyElement)
         case HIDDEN:
             // a no-op for this type
             break;
+        case COLOR:
         case EMAIL:
         case ISINDEX:
         case NUMBER:
@@ -734,6 +750,11 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
              attr->name() == multipleAttr ||
              attr->name() == precisionAttr)
         setNeedsStyleRecalc();
+#if ENABLE(DATALIST)
+    else if (attr->name() == listAttr)
+        m_hasNonEmptyList = !attr->isEmpty();
+        // FIXME: we need to tell this change to a renderer if the attribute affects the appearance.
+#endif
     else
         HTMLFormControlElementWithState::parseMappedAttribute(attr);
 }
@@ -743,6 +764,7 @@ bool HTMLInputElement::rendererIsNeeded(RenderStyle *style)
     switch (inputType()) {
         case BUTTON:
         case CHECKBOX:
+        case COLOR:
         case EMAIL:
         case FILE:
         case IMAGE:
@@ -783,6 +805,7 @@ RenderObject *HTMLInputElement::createRenderer(RenderArena *arena, RenderStyle *
             return new (arena) RenderImage(this);
         case RANGE:
             return new (arena) RenderSlider(this);
+        case COLOR:
         case EMAIL:
         case ISINDEX:
         case NUMBER:
@@ -869,6 +892,7 @@ bool HTMLInputElement::appendFormData(FormDataList& encoding, bool multipart)
         return false;
 
     switch (inputType()) {
+        case COLOR:
         case EMAIL:
         case HIDDEN:
         case ISINDEX:
@@ -972,6 +996,12 @@ void HTMLInputElement::setChecked(bool nowChecked, bool sendChangeEvent)
     if (renderer() && renderer()->style()->hasAppearance())
         renderer()->theme()->stateChanged(renderer(), CheckedState);
 
+    // Ideally we'd do this from the render tree (matching
+    // RenderTextView), but it's not possible to do it at the moment
+    // because of the way the code is structured.
+    if (renderer() && AXObjectCache::accessibilityEnabled())
+        renderer()->document()->axObjectCache()->postNotification(renderer(), AXObjectCache::AXCheckedStateChanged, true);
+
     // Only send a change event for items in the document (avoid firing during
     // parsing) and don't send a change event for a radio button that's getting
     // unchecked to match other browsers. DOM is not a useful standard for this
@@ -1023,7 +1053,7 @@ String HTMLInputElement::value() const
 
     String value = m_data.value();
     if (value.isNull()) {
-        value = constrainValue(getAttribute(valueAttr));
+        value = sanitizeValue(getAttribute(valueAttr));
 
         // If no attribute exists, then just use "on" or "" based off the checked() state of the control.
         if (value.isNull() && (inputType() == CHECKBOX || inputType() == RADIO))
@@ -1040,6 +1070,7 @@ String HTMLInputElement::valueWithDefault() const
         switch (inputType()) {
             case BUTTON:
             case CHECKBOX:
+            case COLOR:
             case EMAIL:
             case FILE:
             case HIDDEN:
@@ -1078,9 +1109,9 @@ void HTMLInputElement::setValue(const String& value)
         if (inputType() == FILE)
             m_fileList->clear();
         else {
-            m_data.setValue(constrainValue(value));
+            m_data.setValue(sanitizeValue(value));
             if (isTextField()) {
-                InputElement::updatePlaceholderVisibility(m_data, this, this);
+                InputElement::updatePlaceholderVisibility(this, this);
                 if (inDocument())
                     document()->updateStyleIfNeeded();
             }
@@ -1089,7 +1120,7 @@ void HTMLInputElement::setValue(const String& value)
             renderer()->updateFromElement();
         setNeedsStyleRecalc();
     } else
-        setAttribute(valueAttr, constrainValue(value));
+        setAttribute(valueAttr, sanitizeValue(value));
     
     if (isTextField()) {
         unsigned max = m_data.value().length();
@@ -1145,6 +1176,7 @@ bool HTMLInputElement::storesValueSeparateFromAttribute() const
         case RESET:
         case SUBMIT:
             return false;
+        case COLOR:
         case EMAIL:
         case FILE:
         case ISINDEX:
@@ -1307,7 +1339,7 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
                 m_activeSubmit = false;
             }
         } else if (inputType() == FILE && renderer())
-            static_cast<RenderFileUploadControl*>(renderer())->click();
+            toRenderFileUploadControl(renderer())->click();
     }
 
     // Use key press event here since sending simulated mouse events
@@ -1320,6 +1352,7 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
         if (charCode == '\r') {
             switch (inputType()) {
                 case CHECKBOX:
+                case COLOR:
                 case EMAIL:
                 case HIDDEN:
                 case ISINDEX:
@@ -1447,6 +1480,7 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
                     if (!checked())
                         clickElement = true;
                     break;
+                case COLOR:
                 case EMAIL:
                 case HIDDEN:
                 case ISINDEX:
@@ -1491,13 +1525,13 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
     }
 
     if (evt->isBeforeTextInsertedEvent())
-        InputElement::handleBeforeTextInsertedEvent(m_data, this, document(), evt);
+        InputElement::handleBeforeTextInsertedEvent(m_data, this, this, evt);
 
     if (isTextField() && renderer() && (evt->isMouseEvent() || evt->isDragEvent() || evt->isWheelEvent() || evt->type() == eventNames().blurEvent || evt->type() == eventNames().focusEvent))
-        static_cast<RenderTextControlSingleLine*>(renderer())->forwardEvent(evt);
+        toRenderTextControlSingleLine(renderer())->forwardEvent(evt);
 
     if (inputType() == RANGE && renderer() && (evt->isMouseEvent() || evt->isDragEvent() || evt->isWheelEvent()))
-        static_cast<RenderSlider*>(renderer())->forwardEvent(evt);
+        toRenderSlider(renderer())->forwardEvent(evt);
 
     if (!callBaseClassEarly && !evt->defaultHandled())
         HTMLFormControlElementWithState::defaultEventHandler(evt);
@@ -1634,9 +1668,11 @@ FileList* HTMLInputElement::files()
     return m_fileList.get();
 }
 
-String HTMLInputElement::constrainValue(const String& proposedValue) const
+String HTMLInputElement::sanitizeValue(const String& proposedValue) const
 {
-    return InputElement::constrainValue(this, proposedValue, m_data.maxLength());
+    if (isTextField())
+        return InputElement::sanitizeValue(this, proposedValue);
+    return proposedValue;
 }
 
 bool HTMLInputElement::needsActivationCallback()
@@ -1679,6 +1715,7 @@ bool HTMLInputElement::isRequiredFormControl() const
         case IMAGE:
         case RESET:
         case BUTTON:
+        case COLOR:
         case ISINDEX:
             return false;
     }
@@ -1697,14 +1734,14 @@ void HTMLInputElement::addSearchResult()
 {
     ASSERT(isSearchField());
     if (renderer())
-        static_cast<RenderTextControlSingleLine*>(renderer())->addSearchResult();
+        toRenderTextControlSingleLine(renderer())->addSearchResult();
 }
 
 void HTMLInputElement::onSearch()
 {
     ASSERT(isSearchField());
     if (renderer())
-        static_cast<RenderTextControlSingleLine*>(renderer())->stopSearchEventTimer();
+        toRenderTextControlSingleLine(renderer())->stopSearchEventTimer();
     dispatchEvent(eventNames().searchEvent, true, false);
 }
 
@@ -1755,7 +1792,91 @@ bool HTMLInputElement::willValidate() const
 
 bool HTMLInputElement::placeholderShouldBeVisible() const
 {
-    return m_data.placeholderShouldBeVisible();
+    return InputElement::placeholderShouldBeVisible(this, this);
+}
+
+bool HTMLInputElement::formStringToDouble(const String& src, double* out)
+{
+    // See HTML5 2.4.4.3 `Real numbers.'
+
+    if (src.isEmpty())
+        return false;
+    // String::toDouble() accepts leading + \t \n \v \f \r and SPACE, which are invalid in HTML5.
+    // So, check the first character.
+    if (src[0] != '-' && (src[0] < '0' || src[0] > '9'))
+        return false;
+
+    bool valid = false;
+    double value = src.toDouble(&valid);
+    if (!valid)
+        return false;
+    // NaN and Infinity are not valid numbers according to the standard.
+    if (isnan(value) || isinf(value))
+        return false;
+    if (out)
+        *out = value;
+    return true;
+}
+
+#if ENABLE(DATALIST)
+HTMLElement* HTMLInputElement::list() const
+{
+    return dataList();
+}
+
+HTMLDataListElement* HTMLInputElement::dataList() const
+{
+    if (!m_hasNonEmptyList)
+        return 0;
+
+    switch (inputType()) {
+    case TEXT:
+    case SEARCH:
+    case URL:
+    case TELEPHONE:
+    case EMAIL:
+    case NUMBER:
+    case RANGE:
+    case COLOR: {
+        Element* element = document()->getElementById(getAttribute(listAttr));
+        if (element && element->hasTagName(datalistTag))
+            return static_cast<HTMLDataListElement*>(element);
+        break;
+    }
+    case HIDDEN:
+    case PASSWORD:
+    case CHECKBOX:
+    case RADIO:
+    case FILE:
+    case SUBMIT:
+    case IMAGE:
+    case RESET:
+    case BUTTON:
+    case ISINDEX:
+        break;
+    }
+    return 0;
+}
+
+HTMLOptionElement* HTMLInputElement::selectedOption() const
+{
+    String currentValue = value();
+    // The empty value never matches to a datalist option because it
+    // doesn't represent a suggestion according to the standard.
+    if (currentValue.isEmpty())
+        return 0;
+
+    HTMLDataListElement* sourceElement = dataList();
+    if (!sourceElement)
+        return 0;
+    RefPtr<HTMLCollection> options = sourceElement->options();
+    for (unsigned i = 0; options && i < options->length(); ++i) {
+        HTMLOptionElement* option = static_cast<HTMLOptionElement*>(options->item(i));
+        if (!option->disabled() && currentValue == option->value())
+            return option;
+    }
+    return 0;
 }
+#endif  // ENABLE(DATALIST)
 
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h
index 4d887f3..8f273cb 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h
@@ -31,7 +31,9 @@
 namespace WebCore {
 
 class FileList;
+class HTMLDataListElement;
 class HTMLImageLoader;
+class HTMLOptionElement;
 class KURL;
 class VisibleSelection;
 
@@ -54,7 +56,8 @@ public:
         EMAIL,
         NUMBER,
         TELEPHONE,
-        URL
+        URL,
+        COLOR
     };
     
     enum AutoCompleteSetting {
@@ -95,7 +98,7 @@ public:
 
     bool isTextButton() const { return m_type == SUBMIT || m_type == RESET || m_type == BUTTON; }
     virtual bool isRadioButton() const { return m_type == RADIO; }
-    virtual bool isTextField() const { return m_type == TEXT || m_type == PASSWORD || m_type == SEARCH || m_type == ISINDEX || m_type == EMAIL || m_type == NUMBER || m_type == TELEPHONE || m_type == URL; }
+    virtual bool isTextField() const { return m_type == TEXT || m_type == PASSWORD || m_type == SEARCH || m_type == ISINDEX || m_type == EMAIL || m_type == NUMBER || m_type == TELEPHONE || m_type == URL || m_type == COLOR; }
     virtual bool isSearchField() const { return m_type == SEARCH; }
     virtual bool isInputTypeHidden() const { return m_type == HIDDEN; }
     virtual bool isPasswordField() const { return m_type == PASSWORD; }
@@ -194,6 +197,11 @@ public:
     KURL src() const;
     void setSrc(const String&);
 
+#if ENABLE(DATALIST)
+    HTMLElement* list() const;
+    HTMLOptionElement* selectedOption() const;
+#endif
+
     int maxLength() const;
     void setMaxLength(int);
 
@@ -214,7 +222,7 @@ public:
 
     VisibleSelection selection() const;
 
-    virtual String constrainValue(const String& proposedValue) const;
+    virtual String sanitizeValue(const String&) const;
 
     virtual void documentDidBecomeActive();
 
@@ -223,6 +231,11 @@ public:
     virtual bool willValidate() const;
 
     virtual bool placeholderShouldBeVisible() const;
+
+    // Converts the specified string to a floating number.
+    // If the conversion fails, the return value is false. Take care that leading or trailing unnecessary characters make failures.  This returns false for an empty string input.
+    // The double* parameter may be 0.
+    static bool formStringToDouble(const String&, double*);
     
 protected:
     virtual void willMoveToNewOwnerDocument();
@@ -230,7 +243,7 @@ protected:
 
     void updatePlaceholderVisibility()
     {
-        InputElement::updatePlaceholderVisibility(m_data, this, this, true);
+        InputElement::updatePlaceholderVisibility(this, this, true);
     }
 
 private:
@@ -243,6 +256,10 @@ private:
     virtual bool isOptionalFormControl() const { return !isRequiredFormControl(); }
     virtual bool isRequiredFormControl() const;
 
+#if ENABLE(DATALIST)
+    HTMLDataListElement* dataList() const;
+#endif
+
     InputElementData m_data;
     int m_xPos;
     int m_yPos;
@@ -259,6 +276,9 @@ private:
     unsigned m_autocomplete : 2; // AutoCompleteSetting
     bool m_autofilled : 1;
     bool m_inited : 1;
+#if ENABLE(DATALIST)
+    bool m_hasNonEmptyList : 1;
+#endif
 };
 
 } //namespace
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.idl
index e19b30e..07bab90 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.idl
@@ -28,6 +28,7 @@ module html {
                  attribute [ConvertNullToNullString] DOMString defaultValue;
                  attribute boolean         defaultChecked;
         readonly attribute HTMLFormElement form;
+                 attribute boolean         formNoValidate;
 #if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         readonly attribute ValidityState   validity;
 #endif
@@ -38,6 +39,9 @@ module html {
                  attribute boolean         checked;
                  attribute boolean         disabled;
                  attribute boolean         autofocus;
+#if defined(ENABLE_DATALIST) && ENABLE_DATALIST
+        readonly attribute HTMLElement     list;
+#endif
                  attribute long            maxLength;
                  attribute boolean         multiple;
                  attribute [ConvertNullToNullString] DOMString name;
@@ -55,7 +59,12 @@ module html {
                  attribute [ConvertNullToNullString, JSCCustomGetter] DOMString type; // readonly dropped as part of DOM level 2
                  attribute [ConvertNullToNullString] DOMString useMap;
                  attribute [ConvertNullToNullString] DOMString value;
+#if defined(ENABLE_DATALIST) && ENABLE_DATALIST
+        readonly attribute HTMLOptionElement selectedOption;
+#endif
         readonly attribute boolean         willValidate;
+        boolean            checkValidity();
+        void               setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
         void               select();
         void               click();
         
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLKeygenElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLKeygenElement.cpp
index b1b6238..6af088f 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLKeygenElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLKeygenElement.cpp
@@ -51,7 +51,7 @@ HTMLKeygenElement::HTMLKeygenElement(const QualifiedName& tagName, Document* doc
     for (Vector<String>::const_iterator it = keys.begin(); it != end; ++it) {
         HTMLOptionElement* o = new HTMLOptionElement(optionTag, doc, form());
         addChild(o);
-        o->addChild(new Text(doc, *it));
+        o->addChild(Text::create(doc, *it));
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLLIElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLLIElement.cpp
index 044b93c..a8a327a 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLLIElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLLIElement.cpp
@@ -56,9 +56,9 @@ void HTMLLIElement::parseMappedAttribute(MappedAttribute* attr)
         m_requestedValue = attr->value().toInt();
         if (renderer() && renderer()->isListItem()) {
             if (m_requestedValue > 0)
-                static_cast<RenderListItem*>(renderer())->setExplicitValue(m_requestedValue);
+                toRenderListItem(renderer())->setExplicitValue(m_requestedValue);
             else
-                static_cast<RenderListItem*>(renderer())->clearExplicitValue();
+                toRenderListItem(renderer())->clearExplicitValue();
         }
     } else if (attr->name() == typeAttr) {
         if (attr->value() == "a")
@@ -84,7 +84,7 @@ void HTMLLIElement::attach()
     HTMLElement::attach();
 
     if (renderer() && renderer()->isListItem()) {
-        RenderListItem* render = static_cast<RenderListItem*>(renderer());
+        RenderListItem* render = toRenderListItem(renderer());
 
         // Find the enclosing list node.
         Node* listNode = 0;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLLegendElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLLegendElement.cpp
index d6e08c7..516ca54 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLLegendElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLLegendElement.cpp
@@ -42,9 +42,9 @@ HTMLLegendElement::~HTMLLegendElement()
 {
 }
 
-bool HTMLLegendElement::isFocusable() const
+bool HTMLLegendElement::supportsFocus() const
 {
-    return HTMLElement::isFocusable();
+    return HTMLElement::supportsFocus();
 }
 
 const AtomicString& HTMLLegendElement::formControlType() const
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLLegendElement.h b/src/3rdparty/webkit/WebCore/html/HTMLLegendElement.h
index 713d73c..1b394e4 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLLegendElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLLegendElement.h
@@ -33,7 +33,7 @@ public:
     HTMLLegendElement(const QualifiedName&, Document*, HTMLFormElement* = 0);
     virtual ~HTMLLegendElement();
 
-    virtual bool isFocusable() const;
+    virtual bool supportsFocus() const;
     virtual const AtomicString& formControlType() const;
     virtual void accessKeyAction(bool sendToAnyElement);
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp
index 7cda3fb..039d6f6 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp
@@ -38,6 +38,7 @@
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "FrameLoader.h"
+#include "FrameLoaderClient.h"
 #include "HTMLDocument.h"
 #include "HTMLNames.h"
 #include "HTMLSourceElement.h"
@@ -178,6 +179,8 @@ void HTMLMediaElement::parseMappedAttribute(MappedAttribute* attr)
         setAttributeEventListener(eventNames().loadeddataEvent, createAttributeEventListener(this, attr));
     else if (attrName == onloadedmetadataAttr)
         setAttributeEventListener(eventNames().loadedmetadataEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onloadendAttr)
+        setAttributeEventListener(eventNames().loadendEvent, createAttributeEventListener(this, attr));
     else if (attrName == onloadstartAttr)
         setAttributeEventListener(eventNames().loadstartEvent, createAttributeEventListener(this, attr));
     else if (attrName == onpauseAttr)
@@ -234,7 +237,7 @@ RenderObject* HTMLMediaElement::createRenderer(RenderArena* arena, RenderStyle*)
 void HTMLMediaElement::insertedIntoDocument()
 {
     HTMLElement::insertedIntoDocument();
-    if (!src().isEmpty())
+    if (!src().isEmpty() && m_networkState == NETWORK_EMPTY)
         scheduleLoad();
 }
 
@@ -269,6 +272,15 @@ void HTMLMediaElement::recalcStyle(StyleChange change)
 
 void HTMLMediaElement::scheduleLoad()
 {
+    if (m_loadTimer.isActive())
+        return;
+    prepareForLoad();
+    m_loadTimer.startOneShot(0);
+}
+
+void HTMLMediaElement::scheduleNextSourceChild()
+{
+    // Schedule the timer to try the next <source> element WITHOUT resetting state ala prepareForLoad.
     m_loadTimer.startOneShot(0);
 }
 
@@ -408,17 +420,15 @@ void HTMLMediaElement::load(ExceptionCode& ec)
 {
     if (m_restrictions & RequireUserGestureForLoadRestriction && !processingUserGesture())
         ec = INVALID_STATE_ERR;
-    else
+    else {
+        prepareForLoad();
         loadInternal();
+    }
 }
 
-void HTMLMediaElement::loadInternal()
+void HTMLMediaElement::prepareForLoad()
 {
-    // 1 - If the load() method for this element is already being invoked, then abort these steps.
-    if (m_processingLoad)
-        return;
-    m_processingLoad = true;
-    
+    // Perform the cleanup required for the resource load algorithm to run.
     stopPeriodicTimers();
     m_loadTimer.stop();
     m_sentStalledEvent = false;
@@ -430,21 +440,34 @@ void HTMLMediaElement::loadInternal()
     // 3 - If there are any tasks from the media element's media element event task source in 
     // one of the task queues, then remove those tasks.
     cancelPendingEventsAndCallbacks();
+}
+
+void HTMLMediaElement::loadInternal()
+{
+    // 1 - If the load() method for this element is already being invoked, then abort these steps.
+    if (m_processingLoad)
+        return;
+    m_processingLoad = true;
     
-    // 4 - If the media element's networkState is set to NETWORK_LOADING or NETWORK_IDLE, set the 
-    // error attribute to a new MediaError object whose code attribute is set to MEDIA_ERR_ABORTED, 
-    // and fire a progress event called abort at the media element.
+    // Steps 2 and 3 were done in prepareForLoad()
+    
+    // 4 - If the media element's networkState is set to NETWORK_LOADING or NETWORK_IDLE, set
+    // the error attribute to a new MediaError object whose code attribute is set to
+    // MEDIA_ERR_ABORTED, fire a progress event called abort at the media element, in the
+    // context of the fetching process that is in progress for the element, and fire a progress
+    // event called loadend at the media element, in the context of the same fetching process.
     if (m_networkState == NETWORK_LOADING || m_networkState == NETWORK_IDLE) {
         m_error = MediaError::create(MediaError::MEDIA_ERR_ABORTED);
-        
-        // fire synchronous 'abort'
+
+        // fire synchronous 'abort' and 'loadend'
         bool totalKnown = m_player && m_player->totalBytesKnown();
         unsigned loaded = m_player ? m_player->bytesLoaded() : 0;
         unsigned total = m_player ? m_player->totalBytes() : 0;
         dispatchProgressEvent(eventNames().abortEvent, totalKnown, loaded, total);
+        dispatchProgressEvent(eventNames().loadendEvent, totalKnown, loaded, total);
     }
-    
-    // 5 
+
+    // 5
     m_error = 0;
     m_autoplaying = true;
     m_playedTimeRanges = TimeRanges::create();
@@ -452,7 +475,7 @@ void HTMLMediaElement::loadInternal()
 
     // 6
     setPlaybackRate(defaultPlaybackRate());
-    
+
     // 7
     if (m_networkState != NETWORK_EMPTY) {
         m_networkState = NETWORK_EMPTY;
@@ -466,7 +489,7 @@ void HTMLMediaElement::loadInternal()
         }
         dispatchEvent(eventNames().emptiedEvent, false, true);
     }
-    
+
     selectMediaResource();
     m_processingLoad = false;
 }
@@ -564,8 +587,8 @@ bool HTMLMediaElement::isSafeToLoadURL(const KURL& url, InvalidSourceAction acti
     Frame* frame = document()->frame();
     FrameLoader* loader = frame ? frame->loader() : 0;
 
-    // don't allow remote to local urls
-    if (!loader || !loader->canLoad(url, String(), document())) {
+    // don't allow remote to local urls, and check with the frame loader client.
+    if (!loader || !loader->canLoad(url, String(), document()) || !loader->client()->shouldLoadMediaElementURL(url)) {
         if (actionIfInvalid == Complain)
             FrameLoader::reportLocalLoadFailed(frame, url.string());
         return false;
@@ -591,22 +614,29 @@ void HTMLMediaElement::noneSupported()
     m_loadState = WaitingForSource;
     m_currentSourceNode = 0;
 
-    // 3 - Reaching this step indicates that either the URL failed to resolve, or the media 
-    // resource failed to load. Set the error attribute to a new MediaError object whose 
+    // 4 - Reaching this step indicates that either the URL failed to resolve, or the media
+    // resource failed to load. Set the error attribute to a new MediaError object whose
     // code attribute is set to MEDIA_ERR_SRC_NOT_SUPPORTED.
     m_error = MediaError::create(MediaError::MEDIA_ERR_SRC_NOT_SUPPORTED);
 
-    // 4- Set the element's networkState attribute to the NETWORK_NO_SOURCE value.
+    // 5 - Set the element's networkState attribute to the NETWORK_NO_SOURCE value.
     m_networkState = NETWORK_NO_SOURCE;
 
-    // 5 - Queue a task to fire a progress event called error at the media element.
-    scheduleProgressEvent(eventNames().errorEvent); 
+    // 6 - Queue a task to fire a progress event called error at the media element, in
+    // the context of the fetching process that was used to try to obtain the media
+    // resource in the resource fetch algorithm.
+    scheduleProgressEvent(eventNames().errorEvent);
 
-    // 6 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
+    // 7 - Queue a task to fire a progress event called loadend at the media element, in
+    // the context of the fetching process that was used to try to obtain the media
+    // resource in the resource fetch algorithm.
+    scheduleProgressEvent(eventNames().loadendEvent);
+
+    // 8 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
     m_delayingTheLoadEvent = false;
 
-    // Abort these steps. Until the load() method is invoked, the element won't attempt to load another resource.
-    
+    // 9 -Abort these steps. Until the load() method is invoked, the element won't attempt to load another resource.
+
     if (isVideo())
         static_cast<HTMLVideoElement*>(this)->updatePosterImage();
     if (renderer())
@@ -623,20 +653,24 @@ void HTMLMediaElement::mediaEngineError(PassRefPtr<MediaError> err)
     // set to MEDIA_ERR_NETWORK/MEDIA_ERR_DECODE.
     m_error = err;
 
-    // 3 - Queue a task to fire a progress event called error at the media element.
-    scheduleProgressEvent(eventNames().errorEvent); 
+    // 3 - Queue a task to fire a progress event called error at the media element, in
+    // the context of the fetching process started by this instance of this algorithm.
+    scheduleProgressEvent(eventNames().errorEvent);
+
+    // 4 - Queue a task to fire a progress event called loadend at the media element, in
+    // the context of the fetching process started by this instance of this algorithm.
+    scheduleProgressEvent(eventNames().loadendEvent);
 
-    // 3 - Set the element's networkState attribute to the NETWORK_EMPTY value and queue a 
+    // 5 - Set the element's networkState attribute to the NETWORK_EMPTY value and queue a
     // task to fire a simple event called emptied at the element.
     m_networkState = NETWORK_EMPTY;
     scheduleEvent(eventNames().emptiedEvent);
 
-    // 4 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
+    // 6 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
     m_delayingTheLoadEvent = false;
 
-    // 5 - Abort the overall resource selection algorithm.
+    // 7 - Abort the overall resource selection algorithm.
     m_currentSourceNode = 0;
-
 }
 
 void HTMLMediaElement::cancelPendingEventsAndCallbacks()
@@ -672,7 +706,7 @@ void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
         if (m_readyState < HAVE_METADATA && m_loadState == LoadingFromSourceElement) {
             m_currentSourceNode->scheduleErrorEvent();
             if (havePotentialSourceChild())
-                scheduleLoad();
+                scheduleNextSourceChild();
             return;
         }
 
@@ -710,6 +744,10 @@ void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
         if (oldState < NETWORK_LOADED || oldState == NETWORK_NO_SOURCE) {
             m_progressEventTimer.stop();
 
+            // Schedule one last progress event so we guarantee that at least one is fired
+            // for files that load very quickly.
+            scheduleProgressEvent(eventNames().progressEvent);
+
             // Check to see if readyState changes need to be dealt with before sending the 
             // 'load' event so we report 'canplaythrough' first. This is necessary because a
             //  media engine reports readyState and networkState changes separately
@@ -717,7 +755,8 @@ void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
             if (static_cast<ReadyState>(currentState) != m_readyState)
                 setReadyState(currentState);
 
-             scheduleProgressEvent(eventNames().loadEvent); 
+            scheduleProgressEvent(eventNames().loadEvent);
+            scheduleProgressEvent(eventNames().loadendEvent);
         }
     }
 }
@@ -742,21 +781,29 @@ void HTMLMediaElement::setReadyState(MediaPlayer::ReadyState state)
     if (m_readyState == oldState)
         return;
     
-    if (m_readyState >= HAVE_CURRENT_DATA)
-        m_seeking = false;
-    
     if (m_networkState == NETWORK_EMPTY)
         return;
 
-    if (m_seeking && m_readyState < HAVE_CURRENT_DATA) {
+    if (m_seeking) {
+        // 4.8.10.10, step 8
+        if (wasPotentiallyPlaying && m_readyState < HAVE_FUTURE_DATA)
+            scheduleEvent(eventNames().waitingEvent);
+
         // 4.8.10.10, step 9
-        scheduleEvent(eventNames().seekingEvent);
-    }
+        if (m_readyState < HAVE_CURRENT_DATA) {
+            if (oldState >= HAVE_CURRENT_DATA)
+                scheduleEvent(eventNames().seekingEvent);
+        } else {
+            // 4.8.10.10 step 12 & 13.
+            finishSeek();
+        }
 
-    if (wasPotentiallyPlaying && m_readyState < HAVE_FUTURE_DATA) {
-        // 4.8.10.9
-        scheduleTimeupdateEvent(false);
-        scheduleEvent(eventNames().waitingEvent);
+    } else {
+        if (wasPotentiallyPlaying && m_readyState < HAVE_FUTURE_DATA) {
+            // 4.8.10.9
+            scheduleTimeupdateEvent(false);
+            scheduleEvent(eventNames().waitingEvent);
+        }
     }
 
     if (m_readyState >= HAVE_METADATA && oldState < HAVE_METADATA) {
@@ -765,7 +812,7 @@ void HTMLMediaElement::setReadyState(MediaPlayer::ReadyState state)
 
 #if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
         if (renderer() && renderer()->isVideo()) {
-            static_cast<RenderVideo*>(renderer())->videoSizeChanged();
+            toRenderVideo(renderer())->videoSizeChanged();
         }
 #endif        
         m_delayingTheLoadEvent = false;
@@ -901,6 +948,15 @@ void HTMLMediaElement::seek(float time, ExceptionCode& ec)
     m_sentEndEvent = false;
 }
 
+void HTMLMediaElement::finishSeek()
+{
+    // 4.8.10.10 Seeking step 12
+    m_seeking = false;
+
+    // 4.8.10.10 Seeking step 13
+    scheduleEvent(eventNames().seekedEvent);
+}
+
 HTMLMediaElement::ReadyState HTMLMediaElement::readyState() const
 {
     return m_readyState;
@@ -911,6 +967,11 @@ MediaPlayer::MovieLoadType HTMLMediaElement::movieLoadType() const
     return m_player ? m_player->movieLoadType() : MediaPlayer::Unknown;
 }
 
+bool HTMLMediaElement::hasAudio() const
+{
+    return m_player ? m_player->hasAudio() : false;
+}
+
 bool HTMLMediaElement::seeking() const
 {
     return m_seeking;
@@ -1226,7 +1287,19 @@ float HTMLMediaElement::percentLoaded() const
     if (!m_player)
         return 0;
     float duration = m_player->duration();
-    return duration ? m_player->maxTimeBuffered() / duration : 0;
+
+    if (!duration || isinf(duration))
+        return 0;
+
+    float buffered = 0;
+    RefPtr<TimeRanges> timeRanges = m_player->buffered();
+    for (unsigned i = 0; i < timeRanges->length(); ++i) {
+        ExceptionCode ignoredException;
+        float start = timeRanges->start(i, ignoredException);
+        float end = timeRanges->end(i, ignoredException);
+        buffered += end - start;
+    }
+    return buffered / duration;
 }
 
 bool HTMLMediaElement::havePotentialSourceChild()
@@ -1298,9 +1371,9 @@ void HTMLMediaElement::mediaPlayerTimeChanged(MediaPlayer*)
 {
     beginProcessingMediaPlayerCallback();
 
+    // 4.8.10.10 step 12 & 13.  Needed if no ReadyState change is associated with the seek.
     if (m_readyState >= HAVE_CURRENT_DATA && m_seeking) {
-        scheduleEvent(eventNames().seekedEvent);
-        m_seeking = false;
+        finishSeek();
     }
     
     float now = currentTime();
@@ -1340,7 +1413,7 @@ void HTMLMediaElement::mediaPlayerDurationChanged(MediaPlayer*)
     if (renderer()) {
         renderer()->updateFromElement();
         if (renderer()->isVideo())
-            static_cast<RenderVideo*>(renderer())->videoSizeChanged();
+            toRenderVideo(renderer())->videoSizeChanged();
     }
 #endif        
     endProcessingMediaPlayerCallback();
@@ -1380,7 +1453,7 @@ void HTMLMediaElement::mediaPlayerSizeChanged(MediaPlayer*)
     beginProcessingMediaPlayerCallback();
 #if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     if (renderer() && renderer()->isVideo())
-        static_cast<RenderVideo*>(renderer())->videoSizeChanged();
+        toRenderVideo(renderer())->videoSizeChanged();
 #endif        
     endProcessingMediaPlayerCallback();
 }
@@ -1390,7 +1463,7 @@ bool HTMLMediaElement::mediaPlayerRenderingCanBeAccelerated(MediaPlayer*)
 {
     if (renderer() && renderer()->isVideo()) {
         ASSERT(renderer()->view());
-        return renderer()->view()->compositor()->canAccelerateVideoRendering(static_cast<RenderVideo*>(renderer()));
+        return renderer()->view()->compositor()->canAccelerateVideoRendering(toRenderVideo(renderer()));
     }
     return false;
 }
@@ -1398,17 +1471,16 @@ bool HTMLMediaElement::mediaPlayerRenderingCanBeAccelerated(MediaPlayer*)
 GraphicsLayer* HTMLMediaElement::mediaPlayerGraphicsLayer(MediaPlayer*)
 {
     if (renderer() && renderer()->isVideo())
-        return static_cast<RenderVideo*>(renderer())->videoGraphicsLayer();
+        return toRenderVideo(renderer())->videoGraphicsLayer();
     return 0;
 }
 #endif
 
 PassRefPtr<TimeRanges> HTMLMediaElement::buffered() const
 {
-    // FIXME real ranges support
-    if (!m_player || !m_player->maxTimeBuffered())
+    if (!m_player)
         return TimeRanges::create();
-    return TimeRanges::create(0, m_player->maxTimeBuffered());
+    return m_player->buffered();
 }
 
 PassRefPtr<TimeRanges> HTMLMediaElement::played() const
@@ -1552,12 +1624,17 @@ void HTMLMediaElement::userCancelledLoad()
         // 2 - Set the error attribute to a new MediaError object whose code attribute is set to MEDIA_ERR_ABORT.
         m_error = MediaError::create(MediaError::MEDIA_ERR_ABORTED);
 
-        // 3 - Queue a task to fire a progress event called abort at the media element.
+        // 3 - Queue a task to fire a progress event called abort at the media element, in the context
+        // of the fetching process started by this instance of this algorithm.
         scheduleProgressEvent(eventNames().abortEvent);
 
-        // 4 - If the media element's readyState attribute has a value equal to HAVE_NOTHING, set the 
-        // element's networkState attribute to the NETWORK_EMPTY value and queue a task to fire a 
-        // simple event called emptied at the element. Otherwise, set set the element's networkState 
+        // 4 - Queue a task to fire a progress event called loadend at the media element, in the context
+        // of the fetching process started by this instance of this algorithm.
+        scheduleProgressEvent(eventNames().loadendEvent);
+
+        // 5 - If the media element's readyState attribute has a value equal to HAVE_NOTHING, set the
+        // element's networkState attribute to the NETWORK_EMPTY value and queue a task to fire a
+        // simple event called emptied at the element. Otherwise, set set the element's networkState
         // attribute to the NETWORK_IDLE value.
         if (m_networkState >= NETWORK_LOADING) {
             m_networkState = NETWORK_EMPTY;
@@ -1565,8 +1642,11 @@ void HTMLMediaElement::userCancelledLoad()
             scheduleEvent(eventNames().emptiedEvent);
         }
 
-        // 5 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
+        // 6 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
         m_delayingTheLoadEvent = false;
+
+        // 7 - Abort the overall resource selection algorithm.
+        m_currentSourceNode = 0;
     }
 }
 
@@ -1598,7 +1678,7 @@ void HTMLMediaElement::documentDidBecomeActive()
         ExceptionCode ec;
         load(ec);
     }
-        
+
     if (renderer())
         renderer()->updateFromElement();
 }
@@ -1615,12 +1695,12 @@ void HTMLMediaElement::defaultEventHandler(Event* event)
     if (!r || !r->isWidget())
         return;
 
-    Widget* widget = static_cast<RenderWidget*>(r)->widget();
+    Widget* widget = toRenderWidget(r)->widget();
     if (widget)
         widget->handleEvent(event);
 #else
     if (renderer() && renderer()->isMedia())
-        static_cast<RenderMedia*>(renderer())->forwardEvent(event);
+        toRenderMedia(renderer())->forwardEvent(event);
     if (event->defaultHandled())
         return;
     HTMLElement::defaultEventHandler(event);
@@ -1637,6 +1717,7 @@ bool HTMLMediaElement::processingUserGesture() const
 }
 
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+
 void HTMLMediaElement::deliverNotification(MediaPlayerProxyNotificationType notification)
 {
     if (notification == MediaPlayerNotificationPlayPauseButtonPressed) {
@@ -1674,8 +1755,9 @@ void HTMLMediaElement::finishParsingChildren()
     
     document()->updateStyleIfNeeded();
     if (m_needWidgetUpdate && renderer())
-        static_cast<RenderPartObject*>(renderer())->updateWidget(true);
+        toRenderPartObject(renderer())->updateWidget(true);
 }
+
 #endif
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h
index 27b48ea..3aeb653 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h
@@ -65,6 +65,7 @@ public:
     
     virtual bool isVideo() const { return false; }
     virtual bool hasVideo() const { return false; }
+    virtual bool hasAudio() const;
 
     void rewind(float timeDelta);
     void returnToRealtime();
@@ -190,6 +191,7 @@ private:
     void stopPeriodicTimers();
 
     void seek(float time, ExceptionCode&);
+    void finishSeek();
     void checkIfSeekNeeded();
     
     void scheduleTimeupdateEvent(bool periodicEvent);
@@ -200,6 +202,7 @@ private:
     // loading
     void selectMediaResource();
     void loadResource(const KURL&, ContentType&);
+    void scheduleNextSourceChild();
     void loadNextSourceChild();
     void userCancelledLoad();
     bool havePotentialSourceChild();
@@ -215,6 +218,8 @@ private:
     void loadInternal();
     void playInternal();
     void pauseInternal();
+
+    void prepareForLoad();
     
     bool processingUserGesture() const;
     bool processingMediaPlayerCallback() const { return m_processingMediaPlayerCallback > 0; }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLOListElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLOListElement.cpp
index 63fd437..344a069 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLOListElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLOListElement.cpp
@@ -1,4 +1,4 @@
-/**
+/*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *
@@ -63,12 +63,16 @@ void HTMLOListElement::parseMappedAttribute(MappedAttribute* attr)
         else if (attr->value() == "1")
             addCSSProperty(attr, CSSPropertyListStyleType, CSSValueDecimal);
     } else if (attr->name() == startAttr) {
-        int s = !attr->isNull() ? attr->value().toInt() : 1;
-        if (s != m_start) {
-            m_start = s;
-            for (RenderObject* r = renderer(); r; r = r->nextInPreOrder(renderer()))
-                if (r->isListItem())
-                    static_cast<RenderListItem*>(r)->updateValue();
+        bool canParse;
+        int start = attr->value().toInt(&canParse);
+        if (!canParse)
+            start = 1;
+        if (start == m_start)
+            return;
+        m_start = start;
+        for (RenderObject* child = renderer(); child; child = child->nextInPreOrder(renderer())) {
+            if (child->isListItem())
+                toRenderListItem(child)->updateValue();
         }
     } else
         HTMLElement::parseMappedAttribute(attr);
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.cpp
index 16e9a84..9765c43 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
@@ -45,8 +45,8 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLObjectElement::HTMLObjectElement(const QualifiedName& tagName, Document* doc, bool createdByParser) 
-    : HTMLPlugInImageElement(tagName, doc)
+inline HTMLObjectElement::HTMLObjectElement(const QualifiedName& tagName, Document* document, bool createdByParser) 
+    : HTMLPlugInImageElement(tagName, document)
     , m_docNamedItem(true)
     , m_needWidgetUpdate(!createdByParser)
     , m_useFallbackContent(false)
@@ -54,16 +54,17 @@ HTMLObjectElement::HTMLObjectElement(const QualifiedName& tagName, Document* doc
     ASSERT(hasTagName(objectTag));
 }
 
-HTMLObjectElement::~HTMLObjectElement()
+PassRefPtr<HTMLObjectElement> HTMLObjectElement::create(const QualifiedName& tagName, Document* document, bool createdByParser)
 {
+    return adoptRef(new HTMLObjectElement(tagName, document, createdByParser));
 }
 
 RenderWidget* HTMLObjectElement::renderWidgetForJSBindings() const
 {
-    RenderWidget* renderWidget = (renderer() && renderer()->isWidget()) ? static_cast<RenderWidget*>(renderer()) : 0;
+    RenderWidget* renderWidget = (renderer() && renderer()->isWidget()) ? toRenderWidget(renderer()) : 0;
     if (renderWidget && !renderWidget->widget()) {
         document()->updateLayoutIgnorePendingStylesheets();
-        renderWidget = (renderer() && renderer()->isWidget()) ? static_cast<RenderWidget*>(renderer()) : 0;
+        renderWidget = (renderer() && renderer()->isWidget()) ? toRenderWidget(renderer()) : 0;
     }
     return renderWidget;
 }
@@ -166,7 +167,7 @@ void HTMLObjectElement::updateWidget()
 {
     document()->updateStyleIfNeeded();
     if (m_needWidgetUpdate && renderer() && !m_useFallbackContent && !isImageType())
-        static_cast<RenderPartObject*>(renderer())->updateWidget(true);
+        toRenderPartObject(renderer())->updateWidget(true);
 }
 
 void HTMLObjectElement::finishParsingChildren()
@@ -297,66 +298,6 @@ void HTMLObjectElement::updateDocNamedItem()
     m_docNamedItem = isNamedItem;
 }
 
-String HTMLObjectElement::code() const
-{
-    return getAttribute(codeAttr);
-}
-
-void HTMLObjectElement::setCode(const String& value)
-{
-    setAttribute(codeAttr, value);
-}
-
-String HTMLObjectElement::archive() const
-{
-    return getAttribute(archiveAttr);
-}
-
-void HTMLObjectElement::setArchive(const String& value)
-{
-    setAttribute(archiveAttr, value);
-}
-
-String HTMLObjectElement::border() const
-{
-    return getAttribute(borderAttr);
-}
-
-void HTMLObjectElement::setBorder(const String& value)
-{
-    setAttribute(borderAttr, value);
-}
-
-String HTMLObjectElement::codeBase() const
-{
-    return getAttribute(codebaseAttr);
-}
-
-void HTMLObjectElement::setCodeBase(const String& value)
-{
-    setAttribute(codebaseAttr, value);
-}
-
-String HTMLObjectElement::codeType() const
-{
-    return getAttribute(codetypeAttr);
-}
-
-void HTMLObjectElement::setCodeType(const String& value)
-{
-    setAttribute(codetypeAttr, value);
-}
-
-KURL HTMLObjectElement::data() const
-{
-    return document()->completeURL(getAttribute(dataAttr));
-}
-
-void HTMLObjectElement::setData(const String& value)
-{
-    setAttribute(dataAttr, value);
-}
-
 bool HTMLObjectElement::declare() const
 {
     return !getAttribute(declareAttr).isNull();
@@ -377,36 +318,6 @@ void HTMLObjectElement::setHspace(int value)
     setAttribute(hspaceAttr, String::number(value));
 }
 
-String HTMLObjectElement::standby() const
-{
-    return getAttribute(standbyAttr);
-}
-
-void HTMLObjectElement::setStandby(const String& value)
-{
-    setAttribute(standbyAttr, value);
-}
-
-String HTMLObjectElement::type() const
-{
-    return getAttribute(typeAttr);
-}
-
-void HTMLObjectElement::setType(const String& value)
-{
-    setAttribute(typeAttr, value);
-}
-
-String HTMLObjectElement::useMap() const
-{
-    return getAttribute(usemapAttr);
-}
-
-void HTMLObjectElement::setUseMap(const String& value)
-{
-    setAttribute(usemapAttr, value);
-}
-
 int HTMLObjectElement::vspace() const
 {
     return getAttribute(vspaceAttr).toInt();
@@ -419,21 +330,19 @@ void HTMLObjectElement::setVspace(int value)
 
 bool HTMLObjectElement::containsJavaApplet() const
 {
-    if (MIMETypeRegistry::isJavaAppletMIMEType(type()))
+    if (MIMETypeRegistry::isJavaAppletMIMEType(getAttribute(typeAttr)))
         return true;
         
-    Node* child = firstChild();
-    while (child) {
-        if (child->isElementNode()) {
-            Element* e = static_cast<Element*>(child);
-            if (e->hasTagName(paramTag) && equalIgnoringCase(e->getAttribute(nameAttr), "type") && MIMETypeRegistry::isJavaAppletMIMEType(e->getAttribute(valueAttr).string()))
-                return true;
-            else if (e->hasTagName(objectTag) && static_cast<HTMLObjectElement*>(e)->containsJavaApplet())
-                return true;
-            else if (e->hasTagName(appletTag))
-                return true;
-        }
-        child = child->nextSibling();
+    for (Element* child = firstElementChild(); child; child = child->nextElementSibling()) {
+        if (child->hasTagName(paramTag)
+                && equalIgnoringCase(child->getAttribute(nameAttr), "type")
+                && MIMETypeRegistry::isJavaAppletMIMEType(child->getAttribute(valueAttr).string()))
+            return true;
+        if (child->hasTagName(objectTag)
+                && static_cast<HTMLObjectElement*>(child)->containsJavaApplet())
+            return true;
+        if (child->hasTagName(appletTag))
+            return true;
     }
     
     return false;
@@ -443,9 +352,13 @@ void HTMLObjectElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) con
 {
     HTMLPlugInImageElement::addSubresourceAttributeURLs(urls);
 
-    addSubresourceURL(urls, data());
-    if (useMap().startsWith("#"))
-        addSubresourceURL(urls, document()->completeURL(useMap()));
+    addSubresourceURL(urls, document()->completeURL(getAttribute(dataAttr)));
+
+    // FIXME: Passing a string that starts with "#" to the completeURL function does
+    // not seem like it would work. The image element has similar but not identical code.
+    const AtomicString& useMap = getAttribute(usemapAttr);
+    if (useMap.startsWith("#"))
+        addSubresourceURL(urls, document()->completeURL(useMap));
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.h b/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.h
index 8f31bda..ec1132f 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2004, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -27,12 +27,31 @@
 
 namespace WebCore {
 
-class KURL;
-
 class HTMLObjectElement : public HTMLPlugInImageElement {
 public:
+    static PassRefPtr<HTMLObjectElement> create(const QualifiedName&, Document*, bool createdByParser);
+
+    void setNeedWidgetUpdate(bool needWidgetUpdate) { m_needWidgetUpdate = needWidgetUpdate; }
+
+    void renderFallbackContent();
+
+    bool declare() const;
+    void setDeclare(bool);
+
+    int hspace() const;
+    void setHspace(int);
+
+    int vspace() const;
+    void setVspace(int);
+
+    bool isDocNamedItem() const { return m_docNamedItem; }
+
+    const String& classId() const { return m_classId; }
+
+    bool containsJavaApplet() const;
+
+private:
     HTMLObjectElement(const QualifiedName&, Document*, bool createdByParser);
-    ~HTMLObjectElement();
 
     virtual int tagPriority() const { return 5; }
 
@@ -54,57 +73,11 @@ public:
     virtual const QualifiedName& imageSourceAttributeName() const;
 
     virtual void updateWidget();
-    void setNeedWidgetUpdate(bool needWidgetUpdate) { m_needWidgetUpdate = needWidgetUpdate; }
-
-    void renderFallbackContent();
 
     virtual RenderWidget* renderWidgetForJSBindings() const;
 
-    String archive() const;
-    void setArchive(const String&);
-
-    String border() const;
-    void setBorder(const String&);
-
-    String code() const;
-    void setCode(const String&);
-    
-    String codeBase() const;
-    void setCodeBase(const String&);
-
-    String codeType() const;
-    void setCodeType(const String&);
-    
-    KURL data() const;
-    void setData(const String&);
-
-    bool declare() const;
-    void setDeclare(bool);
-
-    int hspace() const;
-    void setHspace(int);
-
-    String standby() const;
-    void setStandby(const String&);
-
-    String type() const;
-    void setType(const String&);
-
-    String useMap() const;
-    void setUseMap(const String&);
-
-    int vspace() const;
-    void setVspace(int);
-
-    bool isDocNamedItem() const { return m_docNamedItem; }
-
-    const String& classId() const { return m_classId; }
-
-    bool containsJavaApplet() const;
-
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
-private:
     void updateDocNamedItem();
 
     AtomicString m_id;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.idl
index 1880836..b51c568 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -30,22 +30,23 @@ module html {
         ImplementationUUID=2dd24554-6784-4ef9-9713-179f3d37b2f9
     ] HTMLObjectElement : HTMLElement {
         readonly attribute HTMLFormElement form;
-                 attribute [ConvertNullToNullString] DOMString       code;
-                 attribute [ConvertNullToNullString] DOMString       align;
-                 attribute [ConvertNullToNullString] DOMString       archive;
-                 attribute [ConvertNullToNullString] DOMString       border;
-                 attribute [ConvertNullToNullString] DOMString       codeBase;
-                 attribute [ConvertNullToNullString] DOMString       codeType;
-                 attribute [ConvertNullToNullString] DOMString       data;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       code;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       align;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       archive;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       border;
+                 attribute [ConvertNullToNullString, Reflect=codebase] DOMString       codeBase;
+                 attribute [ConvertNullToNullString, Reflect=codetype] DOMString       codeType;
+                 attribute [ConvertNullToNullString, ReflectURL] DOMString       data;
                  attribute boolean         declare;
-                 attribute [ConvertNullToNullString] DOMString       height;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       height;
                  attribute long            hspace;
-                 attribute [ConvertNullToNullString] DOMString       name;
-                 attribute [ConvertNullToNullString] DOMString       standby;
-                 attribute [ConvertNullToNullString] DOMString       type;
-                 attribute [ConvertNullToNullString] DOMString       useMap;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       name;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       standby;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       type;
+                 attribute [ConvertNullToNullString, Reflect=usemap] DOMString       useMap;
                  attribute long            vspace;
-                 attribute [ConvertNullToNullString] DOMString       width;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       width;
+        readonly attribute boolean         willValidate;
 
         // Introduced in DOM Level 2:
         readonly attribute [CheckFrameSecurity] Document        contentDocument;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLOptGroupElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLOptGroupElement.cpp
index af81b07..90156da 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLOptGroupElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLOptGroupElement.cpp
@@ -44,9 +44,15 @@ HTMLOptGroupElement::HTMLOptGroupElement(const QualifiedName& tagName, Document*
     ASSERT(hasTagName(optgroupTag));
 }
 
+bool HTMLOptGroupElement::supportsFocus() const
+{
+    return HTMLElement::supportsFocus();
+}
+
 bool HTMLOptGroupElement::isFocusable() const
 {
-    return HTMLElement::isFocusable();
+    // Optgroup elements do not have a renderer so we check the renderStyle instead.
+    return supportsFocus() && renderStyle() && renderStyle()->display() != NONE;
 }
 
 const AtomicString& HTMLOptGroupElement::formControlType() const
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLOptGroupElement.h b/src/3rdparty/webkit/WebCore/html/HTMLOptGroupElement.h
index 13e92ca..6e5b043 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLOptGroupElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLOptGroupElement.h
@@ -37,6 +37,7 @@ public:
 
     virtual bool checkDTD(const Node*);
     virtual const AtomicString& formControlType() const;
+    virtual bool supportsFocus() const;
     virtual bool isFocusable() const;
     virtual void parseMappedAttribute(MappedAttribute*);
     virtual bool rendererIsNeeded(RenderStyle*) { return false; }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.cpp
index 8cb95d0..316b192 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.cpp
@@ -66,9 +66,15 @@ void HTMLOptionElement::detach()
     HTMLFormControlElement::detach();
 }
 
+bool HTMLOptionElement::supportsFocus() const
+{
+    return HTMLElement::supportsFocus();
+}
+
 bool HTMLOptionElement::isFocusable() const
 {
-    return HTMLElement::isFocusable();
+    // Option elements do not have a renderer so we check the renderStyle instead.
+    return supportsFocus() && renderStyle() && renderStyle()->display() != NONE;
 }
 
 const AtomicString& HTMLOptionElement::formControlType() const
@@ -79,7 +85,7 @@ const AtomicString& HTMLOptionElement::formControlType() const
 
 String HTMLOptionElement::text() const
 {
-    return OptionElement::collectOptionText(m_data, this);
+    return OptionElement::collectOptionLabelOrText(m_data, this);
 }
 
 void HTMLOptionElement::setText(const String &text, ExceptionCode& ec)
@@ -92,7 +98,7 @@ void HTMLOptionElement::setText(const String &text, ExceptionCode& ec)
     }
 
     removeChildren();
-    appendChild(new Text(document(), text), ec);
+    appendChild(Text::create(document(), text), ec);
 }
 
 void HTMLOptionElement::accessKeyAction(bool)
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.h b/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.h
index f13a802..843608f 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.h
@@ -42,6 +42,7 @@ public:
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusOptional; }
     virtual int tagPriority() const { return 2; }
     virtual bool checkDTD(const Node* newChild);
+    virtual bool supportsFocus() const;
     virtual bool isFocusable() const;
     virtual bool rendererIsNeeded(RenderStyle*) { return false; }
     virtual void attach();
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLParser.cpp b/src/3rdparty/webkit/WebCore/html/HTMLParser.cpp
index 928a1bf..1cb47ae 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLParser.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLParser.cpp
@@ -137,7 +137,7 @@ HTMLParser::HTMLParser(HTMLDocument* doc, bool reportErrors)
     , m_reportErrors(reportErrors)
     , m_handlingResidualStyleAcrossBlocks(false)
     , m_inStrayTableContent(0)
-    , m_parserQuirks(m_document->page() ? m_document->page()->chrome()->client()->createHTMLParserQuirks() : PassOwnPtr<HTMLParserQuirks>(0))
+    , m_parserQuirks(m_document->page() ? m_document->page()->chrome()->client()->createHTMLParserQuirks() : 0)
 {
 }
 
@@ -155,7 +155,7 @@ HTMLParser::HTMLParser(DocumentFragment* frag)
     , m_reportErrors(false)
     , m_handlingResidualStyleAcrossBlocks(false)
     , m_inStrayTableContent(0)
-    , m_parserQuirks(m_document->page() ? m_document->page()->chrome()->client()->createHTMLParserQuirks() : PassOwnPtr<HTMLParserQuirks>(0))
+    , m_parserQuirks(m_document->page() ? m_document->page()->chrome()->client()->createHTMLParserQuirks() : 0)
 {
     if (frag)
         frag->ref();
@@ -692,13 +692,13 @@ typedef HashMap<AtomicStringImpl*, CreateErrorCheckFunc> FunctionMap;
 
 bool HTMLParser::textCreateErrorCheck(Token* t, RefPtr<Node>& result)
 {
-    result = new Text(m_document, t->text.get());
+    result = Text::create(m_document, t->text.get());
     return false;
 }
 
 bool HTMLParser::commentCreateErrorCheck(Token* t, RefPtr<Node>& result)
 {
-    result = new Comment(m_document, t->text.get());
+    result = Comment::create(m_document, t->text.get());
     return false;
 }
 
@@ -921,6 +921,7 @@ PassRefPtr<Node> HTMLParser::getNode(Token* t)
         gFunctionMap.set(listingTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
         gFunctionMap.set(mapTag.localName().impl(), &HTMLParser::mapCreateErrorCheck);
         gFunctionMap.set(menuTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
+        gFunctionMap.set(navTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
         gFunctionMap.set(nobrTag.localName().impl(), &HTMLParser::nestedCreateErrorCheck);
         gFunctionMap.set(noembedTag.localName().impl(), &HTMLParser::noembedCreateErrorCheck);
         gFunctionMap.set(noframesTag.localName().impl(), &HTMLParser::noframesCreateErrorCheck);
@@ -1093,6 +1094,7 @@ bool HTMLParser::isAffectedByResidualStyle(const AtomicString& tagName)
         unaffectedTags.add(selectTag.localName().impl());
         unaffectedTags.add(objectTag.localName().impl());
         unaffectedTags.add(datagridTag.localName().impl());
+        unaffectedTags.add(datalistTag.localName().impl());
     }
     
     return !unaffectedTags.contains(tagName.impl());
@@ -1598,7 +1600,7 @@ PassRefPtr<Node> HTMLParser::handleIsindex(Token* t)
     }
 
     n->addChild(new HTMLHRElement(hrTag, m_document));
-    n->addChild(new Text(m_document, text));
+    n->addChild(Text::create(m_document, text));
     n->addChild(isIndex.release());
     n->addChild(new HTMLHRElement(hrTag, m_document));
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLPlugInElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLPlugInElement.cpp
index d950d9d..2f429b4 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLPlugInElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLPlugInElement.cpp
@@ -91,16 +91,6 @@ PassScriptInstance HTMLPlugInElement::getInstance() const
     return m_instance;
 }
 
-String HTMLPlugInElement::align() const
-{
-    return getAttribute(alignAttr);
-}
-
-void HTMLPlugInElement::setAlign(const String& value)
-{
-    setAttribute(alignAttr, value);
-}
-
 String HTMLPlugInElement::height() const
 {
     return getAttribute(heightAttr);
@@ -111,16 +101,6 @@ void HTMLPlugInElement::setHeight(const String& value)
     setAttribute(heightAttr, value);
 }
 
-String HTMLPlugInElement::name() const
-{
-    return getAttribute(nameAttr);
-}
-
-void HTMLPlugInElement::setName(const String& value)
-{
-    setAttribute(nameAttr, value);
-}
-
 String HTMLPlugInElement::width() const
 {
     return getAttribute(widthAttr);
@@ -177,9 +157,10 @@ void HTMLPlugInElement::defaultEventHandler(Event* event)
     RenderObject* r = renderer();
     if (!r || !r->isWidget())
         return;
-
-    if (Widget* widget = static_cast<RenderWidget*>(r)->widget())
-        widget->handleEvent(event);
+    Widget* widget = toRenderWidget(r)->widget();
+    if (!widget)
+        return;
+    widget->handleEvent(event);
 }
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLPlugInElement.h b/src/3rdparty/webkit/WebCore/html/HTMLPlugInElement.h
index a9cbcc9..9d3dc6d 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLPlugInElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLPlugInElement.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2004, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -36,43 +36,44 @@ class RenderWidget;
 
 class HTMLPlugInElement : public HTMLFrameOwnerElement {
 public:
-    HTMLPlugInElement(const QualifiedName& tagName, Document*);
     virtual ~HTMLPlugInElement();
 
-    virtual bool mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const;
-    virtual void parseMappedAttribute(MappedAttribute*);
-
-    virtual HTMLTagStatus endTagRequirement() const { return TagStatusRequired; }
-    virtual bool checkDTD(const Node* newChild);
-
-    virtual void updateWidget() { }
-
-    String align() const;
-    void setAlign(const String&);
-    
     String height() const;
     void setHeight(const String&);
     
-    String name() const;
-    void setName(const String&);
-    
     String width() const;
     void setWidth(const String&);
 
-    virtual void defaultEventHandler(Event*);
-
-    virtual RenderWidget* renderWidgetForJSBindings() const = 0;
-    virtual void detach();
     PassScriptInstance getInstance() const;
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
-    virtual NPObject* getNPObject();
+    NPObject* getNPObject();
 #endif
 
 protected:
+    HTMLPlugInElement(const QualifiedName& tagName, Document*);
+
+    virtual void detach();
+
     static void updateWidgetCallback(Node*);
 
+    virtual bool mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const;
+    virtual void parseMappedAttribute(MappedAttribute*);
+
+private:
+    virtual void defaultEventHandler(Event*);
+
+    virtual RenderWidget* renderWidgetForJSBindings() const = 0;
+
+    virtual HTMLTagStatus endTagRequirement() const { return TagStatusRequired; }
+    virtual bool checkDTD(const Node* newChild);
+
+    virtual void updateWidget() { }
+
+protected:
     AtomicString m_name;
+
+private:
     mutable ScriptInstance m_instance;
 #if ENABLE(NETSCAPE_PLUGIN_API)
     NPObject* m_NPObject;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLPlugInImageElement.h b/src/3rdparty/webkit/WebCore/html/HTMLPlugInImageElement.h
index ec3b258..7725a5a 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLPlugInImageElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLPlugInImageElement.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -30,15 +30,16 @@ class HTMLImageLoader;
 
 class HTMLPlugInImageElement : public HTMLPlugInElement {
 public:
-    HTMLPlugInImageElement(const QualifiedName& tagName, Document*);
     virtual ~HTMLPlugInImageElement();
 
-    bool isImageType();
-
     const String& serviceType() const { return m_serviceType; }
     const String& url() const { return m_url; }
 
 protected:
+    HTMLPlugInImageElement(const QualifiedName& tagName, Document*);
+
+    bool isImageType();
+
     OwnPtr<HTMLImageLoader> m_imageLoader;
     String m_serviceType;
     String m_url;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.idl
index 26f2653..53fe848 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.idl
@@ -45,6 +45,8 @@ module html {
         readonly attribute ValidityState   validity;
 #endif
         readonly attribute boolean         willValidate;
+        boolean            checkValidity();
+        void               setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
 
         // Modified in DOM Level 2:
         readonly attribute HTMLOptionsCollection options;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTableCellElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTableCellElement.cpp
index 878549d..3c58703 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTableCellElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTableCellElement.cpp
@@ -92,12 +92,12 @@ void HTMLTableCellElement::parseMappedAttribute(MappedAttribute *attr)
         rSpan = !attr->isNull() ? attr->value().toInt() : 1;
         rSpan = max(1, min(rSpan, maxRowspan));
         if (renderer() && renderer()->isTableCell())
-            static_cast<RenderTableCell*>(renderer())->updateFromElement();
+            toRenderTableCell(renderer())->updateFromElement();
     } else if (attr->name() == colspanAttr) {
         cSpan = !attr->isNull() ? attr->value().toInt() : 1;
         cSpan = max(1, cSpan);
         if (renderer() && renderer()->isTableCell())
-            static_cast<RenderTableCell*>(renderer())->updateFromElement();
+            toRenderTableCell(renderer())->updateFromElement();
     } else if (attr->name() == nowrapAttr) {
         if (!attr->isNull())
             addCSSProperty(attr, CSSPropertyWhiteSpace, CSSValueWebkitNowrap);
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTableColElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTableColElement.cpp
index 4e4f89e..e1008d1 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTableColElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTableColElement.cpp
@@ -79,12 +79,12 @@ void HTMLTableColElement::parseMappedAttribute(MappedAttribute *attr)
     if (attr->name() == spanAttr) {
         _span = !attr->isNull() ? attr->value().toInt() : 1;
         if (renderer() && renderer()->isTableCol())
-            static_cast<RenderTableCol*>(renderer())->updateFromElement();
+            renderer()->updateFromElement();
     } else if (attr->name() == widthAttr) {
         if (!attr->value().isEmpty()) {
             addCSSLength(attr, CSSPropertyWidth, attr->value());
             if (renderer() && renderer()->isTableCol()) {
-                RenderTableCol* col = static_cast<RenderTableCol*>(renderer());
+                RenderTableCol* col = toRenderTableCol(renderer());
                 int newWidth = width().toInt();
                 if (newWidth != col->width())
                     col->setNeedsLayoutAndPrefWidthsRecalc();
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTagNames.in b/src/3rdparty/webkit/WebCore/html/HTMLTagNames.in
index c066e3c..8842b23 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTagNames.in
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTagNames.in
@@ -8,115 +8,118 @@ acronym interfaceName=HTMLElement
 address interfaceName=HTMLElement
 applet
 area
-audio wrapperOnlyIfMediaIsAvailable,conditional=VIDEO
+audio wrapperOnlyIfMediaIsAvailable, conditional=VIDEO, createWithNew
 b interfaceName=HTMLElement
-base
-basefont interfaceName=HTMLBaseFontElement
+base createWithNew
+basefont interfaceName=HTMLBaseFontElement, createWithNew
 bdo interfaceName=HTMLElement
 big interfaceName=HTMLElement
-blockquote
-body
-br interfaceName=HTMLBRElement
-button constructorNeedsFormElement
-canvas
-caption interfaceName=HTMLTableCaptionElement
+blockquote createWithNew
+body createWithNew
+br interfaceName=HTMLBRElement, createWithNew
+button constructorNeedsFormElement, createWithNew
+canvas createWithNew
+caption interfaceName=HTMLTableCaptionElement, createWithNew
 center interfaceName=HTMLElement
 cite interfaceName=HTMLElement
 code interfaceName=HTMLElement
-col interfaceName=HTMLTableColElement
-colgroup interfaceName=HTMLTableColElement
-datagrid interfaceName=HTMLDataGridElement,conditional=DATAGRID
-dcell interfaceName=HTMLDataGridCellElement,conditional=DATAGRID
-dcol interfaceName=HTMLDataGridColElement,conditional=DATAGRID
-drow interfaceName=HTMLDataGridRowElement,conditional=DATAGRID
+col interfaceName=HTMLTableColElement, createWithNew
+colgroup interfaceName=HTMLTableColElement, createWithNew
+datagrid interfaceName=HTMLDataGridElement, conditional=DATAGRID, createWithNew
+datalist interfaceName=HTMLDataListElement, conditional=DATALIST, createWithNew
+dcell interfaceName=HTMLDataGridCellElement, conditional=DATAGRID, createWithNew
+dcol interfaceName=HTMLDataGridColElement, conditional=DATAGRID, createWithNew
+drow interfaceName=HTMLDataGridRowElement, conditional=DATAGRID, createWithNew
 dd interfaceName=HTMLElement
-del interfaceName=HTMLModElement
+del interfaceName=HTMLModElement, createWithNew
 dfn interfaceName=HTMLElement
-dir interfaceName=HTMLDirectoryElement
-div
-dl interfaceName=HTMLDListElement
+dir interfaceName=HTMLDirectoryElement, createWithNew
+div createWithNew
+dl interfaceName=HTMLDListElement, createWithNew, createWithNew
 dt interfaceName=HTMLElement
 em interfaceName=HTMLElement
 embed
-fieldset interfaceName=HTMLFieldSetElement, constructorNeedsFormElement
-font
-form
+fieldset interfaceName=HTMLFieldSetElement, constructorNeedsFormElement, createWithNew
+font createWithNew
+form createWithNew
 frame
-frameset interfaceName=HTMLFrameSetElement
-head
-h1 interfaceName=HTMLHeadingElement
-h2 interfaceName=HTMLHeadingElement
-h3 interfaceName=HTMLHeadingElement
-h4 interfaceName=HTMLHeadingElement
-h5 interfaceName=HTMLHeadingElement
-h6 interfaceName=HTMLHeadingElement
-hr interfaceName=HTMLHRElement
-html
+frameset interfaceName=HTMLFrameSetElement, createWithNew
+h1 interfaceName=HTMLHeadingElement, createWithNew
+h2 interfaceName=HTMLHeadingElement, createWithNew
+h3 interfaceName=HTMLHeadingElement, createWithNew
+h4 interfaceName=HTMLHeadingElement, createWithNew
+h5 interfaceName=HTMLHeadingElement, createWithNew
+h6 interfaceName=HTMLHeadingElement, createWithNew
+head createWithNew
+hr interfaceName=HTMLHRElement, createWithNew
+html createWithNew
 i interfaceName=HTMLElement
 iframe interfaceName=HTMLIFrameElement
-image mapToTagName=img
-img interfaceName=HTMLImageElement, constructorNeedsFormElement
-input constructorNeedsFormElement
-ins interfaceName=HTMLModElement
-isindex interfaceName=HTMLIsIndexElement, constructorNeedsFormElement
+image mapToTagName=img, createWithNew
+img interfaceName=HTMLImageElement, constructorNeedsFormElement, createWithNew
+input constructorNeedsFormElement, createWithNew
+ins interfaceName=HTMLModElement, createWithNew
+isindex interfaceName=HTMLIsIndexElement, constructorNeedsFormElement, createWithNew
 kbd interfaceName=HTMLElement
-keygen JSInterfaceName=HTMLSelectElement, constructorNeedsFormElement
-label
+keygen JSInterfaceName=HTMLSelectElement, constructorNeedsFormElement, createWithNew
+label createWithNew
 layer interfaceName=HTMLElement
-legend constructorNeedsFormElement
-li interfaceName=HTMLLIElement
-link constructorNeedsCreatedByParser
-listing interfaceName=HTMLPreElement
-map
-marquee
-menu
-meta
+legend constructorNeedsFormElement, createWithNew
+li interfaceName=HTMLLIElement, createWithNew
+link constructorNeedsCreatedByParser, createWithNew
+listing interfaceName=HTMLPreElement, createWithNew
+map createWithNew
+marquee createWithNew
+menu createWithNew
+meta createWithNew
+nav interfaceName=HTMLElement
 nobr interfaceName=HTMLElement
 noembed interfaceName=HTMLElement
 noframes interfaceName=HTMLElement
 nolayer interfaceName=HTMLElement
-#if ENABLE_XHTMLMP
-noscript interfaceName=HTMLNoScriptElement
-#else
-noscript interfaceName=HTMLElement
-#endif
 object constructorNeedsCreatedByParser
-ol interfaceName=HTMLOListElement
-optgroup interfaceName=HTMLOptGroupElement, constructorNeedsFormElement
-option constructorNeedsFormElement
-p interfaceName=HTMLParagraphElement
-param
+ol interfaceName=HTMLOListElement, createWithNew
+optgroup interfaceName=HTMLOptGroupElement, constructorNeedsFormElement, createWithNew
+option constructorNeedsFormElement, createWithNew
+p interfaceName=HTMLParagraphElement, createWithNew
+param createWithNew
 plaintext interfaceName=HTMLElement
-pre
-q interfaceName=HTMLQuoteElement
+pre createWithNew
+q interfaceName=HTMLQuoteElement, createWithNew
 rp interfaceName=HTMLElement
 rt interfaceName=HTMLElement
 ruby interfaceName=HTMLElement
 s interfaceName=HTMLElement
 samp interfaceName=HTMLElement
-script constructorNeedsCreatedByParser
-select constructorNeedsFormElement
+script constructorNeedsCreatedByParser, createWithNew
+select constructorNeedsFormElement, createWithNew
 small interfaceName=HTMLElement
-source wrapperOnlyIfMediaIsAvailable,conditional=VIDEO
+source wrapperOnlyIfMediaIsAvailable, conditional=VIDEO, createWithNew
 span interfaceName=HTMLElement
 strike interfaceName=HTMLElement
 strong interfaceName=HTMLElement
-style constructorNeedsCreatedByParser
+style constructorNeedsCreatedByParser, createWithNew
 sub interfaceName=HTMLElement
 sup interfaceName=HTMLElement
-table
-tbody interfaceName=HTMLTableSectionElement
-td interfaceName=HTMLTableCellElement
-textarea interfaceName=HTMLTextAreaElement, constructorNeedsFormElement
-tfoot interfaceName=HTMLTableSectionElement
-th interfaceName=HTMLTableCellElement
-thead interfaceName=HTMLTableSectionElement
-title
-tr interfaceName=HTMLTableRowElement
+table createWithNew
+tbody interfaceName=HTMLTableSectionElement, createWithNew
+td interfaceName=HTMLTableCellElement, createWithNew
+textarea interfaceName=HTMLTextAreaElement, constructorNeedsFormElement, createWithNew
+tfoot interfaceName=HTMLTableSectionElement, createWithNew
+th interfaceName=HTMLTableCellElement, createWithNew
+thead interfaceName=HTMLTableSectionElement, createWithNew
+title createWithNew
+tr interfaceName=HTMLTableRowElement, createWithNew
 tt interfaceName=HTMLElement
 u interfaceName=HTMLElement
-ul interfaceName=HTMLUListElement
+ul interfaceName=HTMLUListElement, createWithNew
 var interfaceName=HTMLElement
-video wrapperOnlyIfMediaIsAvailable,conditional=VIDEO
+video wrapperOnlyIfMediaIsAvailable, conditional=VIDEO, createWithNew
 wbr interfaceName=HTMLElement
-xmp interfaceName=HTMLPreElement
+xmp interfaceName=HTMLPreElement, createWithNew
+
+#if ENABLE_XHTMLMP
+noscript interfaceName=HTMLNoScriptElement, createWithNew
+#else
+noscript interfaceName=HTMLElement
+#endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.cpp
index 6a1dcf8..d3fc897 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.cpp
@@ -192,6 +192,8 @@ void HTMLTextAreaElement::parseMappedAttribute(MappedAttribute* attr)
     } else if (attr->name() == alignAttr) {
         // Don't map 'align' attribute.  This matches what Firefox, Opera and IE do.
         // See http://bugs.webkit.org/show_bug.cgi?id=7075
+    } else if (attr->name() == placeholderAttr) {
+        updatePlaceholderVisibility(true);
     } else if (attr->name() == onfocusAttr)
         setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onblurAttr)
@@ -267,7 +269,7 @@ void HTMLTextAreaElement::updateFocusAppearance(bool restorePreviousSelection)
 void HTMLTextAreaElement::defaultEventHandler(Event* event)
 {
     if (renderer() && (event->isMouseEvent() || event->isDragEvent() || event->isWheelEvent() || event->type() == eventNames().blurEvent))
-        static_cast<RenderTextControlMultiLine*>(renderer())->forwardEvent(event);
+        toRenderTextControlMultiLine(renderer())->forwardEvent(event);
 
     HTMLFormControlElementWithState::defaultEventHandler(event);
 }
@@ -309,6 +311,7 @@ void HTMLTextAreaElement::setValue(const String& value)
 
     m_value = normalizedValue;
     setFormControlValueMatchesRenderer(true);
+    updatePlaceholderVisibility(false);
     if (inDocument())
         document()->updateStyleIfNeeded();
     if (renderer())
@@ -408,4 +411,29 @@ bool HTMLTextAreaElement::shouldUseInputMethod() const
     return true;
 }
 
+bool HTMLTextAreaElement::placeholderShouldBeVisible() const
+{
+    return value().isEmpty()
+        && document()->focusedNode() != this
+        && !getAttribute(placeholderAttr).isEmpty();
+}
+
+void HTMLTextAreaElement::updatePlaceholderVisibility(bool placeholderValueChanged)
+{
+    if (renderer())
+        toRenderTextControl(renderer())->updatePlaceholderVisibility(placeholderShouldBeVisible(), placeholderValueChanged);
+}
+
+void HTMLTextAreaElement::dispatchFocusEvent()
+{
+    updatePlaceholderVisibility(false);
+    HTMLFormControlElementWithState::dispatchFocusEvent();
+}
+
+void HTMLTextAreaElement::dispatchBlurEvent()
+{
+    updatePlaceholderVisibility(false);
+    HTMLFormControlElementWithState::dispatchBlurEvent();
+}
+
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.h b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.h
index 5ef8e55..1f5cb91 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.h
@@ -77,6 +77,7 @@ public:
     void setValue(const String&);
     String defaultValue() const;
     void setDefaultValue(const String&);
+    int textLength() const { return value().length(); }
     
     void rendererWillBeDestroyed();
     
@@ -93,10 +94,15 @@ public:
 
     virtual bool shouldUseInputMethod() const;
 
+    bool placeholderShouldBeVisible() const;
+
 private:
     enum WrapMethod { NoWrap, SoftWrap, HardWrap };
 
     void updateValue() const;
+    void updatePlaceholderVisibility(bool placeholderValueChanged);
+    virtual void dispatchFocusEvent();
+    virtual void dispatchBlurEvent();
 
     virtual bool isOptionalFormControl() const { return !isRequiredFormControl(); }
     virtual bool isRequiredFormControl() const { return required(); }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.idl
index ba8a062..6d27f54 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.idl
@@ -35,15 +35,19 @@ module html {
                  attribute  boolean              disabled;
                  attribute  boolean              autofocus;
                  attribute  [ConvertNullToNullString] DOMString            name;
+                 attribute  [ConvertNullToNullString, Reflect] DOMString   placeholder;
                  attribute  boolean              readOnly;
                  attribute  boolean              required;
                  attribute  long                 rows;
         readonly attribute  DOMString            type;
                  attribute  [ConvertNullToNullString] DOMString            value;
+        readonly attribute  unsigned long        textLength;
         
         void     select();
 
         readonly attribute boolean         willValidate;
+        boolean  checkValidity();
+        void     setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
 
        // WinIE & FireFox extension:
                  attribute long selectionStart;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
index e4e46c5..71faac0 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
@@ -42,6 +42,7 @@
 #include "HTMLParser.h"
 #include "HTMLScriptElement.h"
 #include "HTMLViewSourceDocument.h"
+#include "InspectorTimelineAgent.h"
 #include "MappedAttribute.h"
 #include "Page.h"
 #include "PreloadScanner.h"
@@ -1657,10 +1658,16 @@ void HTMLTokenizer::write(const SegmentedString& str, bool appendData)
     if (!m_doc->ownerElement())
         printf("Beginning write at time %d\n", m_doc->elapsedTime());
 #endif
-    
+
     int processedCount = 0;
     double startTime = currentTime();
 
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* timelineAgent = m_doc->inspectorTimelineAgent();
+    if (timelineAgent)
+        timelineAgent->willWriteHTML();
+#endif
+  
     Frame* frame = m_doc->frame();
 
     State state = m_state;
@@ -1781,7 +1788,12 @@ void HTMLTokenizer::write(const SegmentedString& str, bool appendData)
     if (!m_doc->ownerElement())
         printf("Ending write at time %d\n", m_doc->elapsedTime());
 #endif
-    
+
+#if ENABLE(INSPECTOR)
+    if (timelineAgent)
+        timelineAgent->didWriteHTML();
+#endif
+
     m_inWrite = wasInWrite;
 
     m_state = state;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.cpp b/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.cpp
index 13404cc..ba718d1 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -47,9 +47,6 @@ using namespace HTMLNames;
 HTMLViewSourceDocument::HTMLViewSourceDocument(Frame* frame, const String& mimeType)
     : HTMLDocument(frame)
     , m_type(mimeType)
-    , m_current(0)
-    , m_tbody(0)
-    , m_td(0)
 {
     setUsesBeforeAfterRules(true);
 }
@@ -70,23 +67,23 @@ Tokenizer* HTMLViewSourceDocument::createTokenizer()
 
 void HTMLViewSourceDocument::createContainingTable()
 {
-    RefPtr<Element> html = new HTMLHtmlElement(htmlTag, this);
+    RefPtr<HTMLHtmlElement> html = new HTMLHtmlElement(htmlTag, this);
     addChild(html);
     html->attach();
-    RefPtr<Element> body = new HTMLBodyElement(bodyTag, this);
+    RefPtr<HTMLBodyElement> body = new HTMLBodyElement(bodyTag, this);
     html->addChild(body);
     body->attach();
     
     // Create a line gutter div that can be used to make sure the gutter extends down the height of the whole
     // document.
-    RefPtr<Element> div = new HTMLDivElement(divTag, this);
+    RefPtr<HTMLDivElement> div = new HTMLDivElement(divTag, this);
     RefPtr<NamedMappedAttrMap> attrs = NamedMappedAttrMap::create();
     attrs->addAttribute(MappedAttribute::create(classAttr, "webkit-line-gutter-backdrop"));
     div->setAttributeMap(attrs.release());
     body->addChild(div);
     div->attach();
 
-    RefPtr<Element> table = new HTMLTableElement(tableTag, this);
+    RefPtr<HTMLTableElement> table = new HTMLTableElement(tableTag, this);
     body->addChild(table);
     table->attach();
     m_tbody = new HTMLTableSectionElement(tbodyTag, this);
@@ -205,31 +202,31 @@ void HTMLViewSourceDocument::addViewSourceDoctypeToken(DoctypeToken* doctypeToke
     addText(text, "webkit-html-doctype");
 }
 
-Element* HTMLViewSourceDocument::addSpanWithClassName(const String& className)
+PassRefPtr<Element> HTMLViewSourceDocument::addSpanWithClassName(const String& className)
 {
     if (m_current == m_tbody) {
         addLine(className);
         return m_current;
     }
 
-    Element* span = new HTMLElement(spanTag, this);
+    RefPtr<HTMLElement> span = HTMLElement::create(spanTag, this);
     RefPtr<NamedMappedAttrMap> attrs = NamedMappedAttrMap::create();
     attrs->addAttribute(MappedAttribute::create(classAttr, className));
     span->setAttributeMap(attrs.release());
     m_current->addChild(span);
     span->attach();
-    return span;
+    return span.release();
 }
 
 void HTMLViewSourceDocument::addLine(const String& className)
 {
     // Create a table row.
-    RefPtr<Element> trow = new HTMLTableRowElement(trTag, this);
+    RefPtr<HTMLTableRowElement> trow = new HTMLTableRowElement(trTag, this);
     m_tbody->addChild(trow);
     trow->attach();
     
     // Create a cell that will hold the line number (it is generated in the stylesheet using counters).
-    Element* td = new HTMLTableCellElement(tdTag, this);
+    RefPtr<HTMLTableCellElement> td = new HTMLTableCellElement(tdTag, this);
     RefPtr<NamedMappedAttrMap> attrs = NamedMappedAttrMap::create();
     attrs->addAttribute(MappedAttribute::create(classAttr, "webkit-line-number"));
     td->setAttributeMap(attrs.release());
@@ -246,7 +243,7 @@ void HTMLViewSourceDocument::addLine(const String& className)
     m_current = m_td = td;
 
 #ifdef DEBUG_LINE_NUMBERS
-    RefPtr<Text> lineNumberText = new Text(this, String::number(tokenizer()->lineNumber() + 1) + " ");
+    RefPtr<Text> lineNumberText = Text::create(this, String::number(tokenizer()->lineNumber() + 1) + " ");
     td->addChild(lineNumberText);
     lineNumberText->attach();
 #endif
@@ -277,7 +274,7 @@ void HTMLViewSourceDocument::addText(const String& text, const String& className
         }
         if (m_current == m_tbody)
             addLine(className);
-        RefPtr<Text> t = new Text(this, substring);
+        RefPtr<Text> t = Text::create(this, substring);
         m_current->addChild(t);
         t->attach();
         if (i < size - 1)
@@ -289,13 +286,13 @@ void HTMLViewSourceDocument::addText(const String& text, const String& className
         m_current = m_tbody;
 }
 
-Element* HTMLViewSourceDocument::addLink(const String& url, bool isAnchor)
+PassRefPtr<Element> HTMLViewSourceDocument::addLink(const String& url, bool isAnchor)
 {
     if (m_current == m_tbody)
         addLine("webkit-html-tag");
     
     // Now create a link for the attribute value instead of a span.
-    Element* anchor = new HTMLAnchorElement(aTag, this);
+    RefPtr<HTMLAnchorElement> anchor = HTMLAnchorElement::create(this);
     RefPtr<NamedMappedAttrMap> attrs = NamedMappedAttrMap::create();
     const char* classValue;
     if (isAnchor)
@@ -308,7 +305,7 @@ Element* HTMLViewSourceDocument::addLink(const String& url, bool isAnchor)
     anchor->setAttributeMap(attrs.release());
     m_current->addChild(anchor);
     anchor->attach();
-    return anchor;
+    return anchor.release();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.h b/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.h
index 57a8f21..e4eadb0 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,18 +30,18 @@
 namespace WebCore {
 
 class DoctypeToken;
+class HTMLTableCellElement;
+class HTMLTableSectionElement;
+
 struct Token;
 
 class HTMLViewSourceDocument : public HTMLDocument {
 public:
     static PassRefPtr<HTMLViewSourceDocument> create(Frame* frame, const String& mimeType)
     {
-        return new HTMLViewSourceDocument(frame, mimeType);
+        return adoptRef(new HTMLViewSourceDocument(frame, mimeType));
     }
 
-    // Returns HTMLTokenizer or TextTokenizer based on m_type.
-    virtual Tokenizer* createTokenizer();
-
     void addViewSourceToken(Token*); // Used by the HTML tokenizer.
     void addViewSourceText(const String&); // Used by the plaintext tokenizer.
     void addViewSourceDoctypeToken(DoctypeToken*);
@@ -49,16 +49,19 @@ public:
 private:
     HTMLViewSourceDocument(Frame*, const String& mimeType);
 
+    // Returns HTMLTokenizer or TextTokenizer based on m_type.
+    virtual Tokenizer* createTokenizer();
+
     void createContainingTable();
-    Element* addSpanWithClassName(const String&);
+    PassRefPtr<Element> addSpanWithClassName(const String&);
     void addLine(const String& className);
     void addText(const String& text, const String& className);
-    Element* addLink(const String& url, bool isAnchor);
+    PassRefPtr<Element> addLink(const String& url, bool isAnchor);
 
     String m_type;
-    Element* m_current;
-    Element* m_tbody;
-    Element* m_td;
+    RefPtr<Element> m_current;
+    RefPtr<HTMLTableSectionElement> m_tbody;
+    RefPtr<HTMLTableCellElement> m_td;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/TimeRanges.idl b/src/3rdparty/webkit/WebCore/html/TimeRanges.idl
index c6776a9..d8686be 100644
--- a/src/3rdparty/webkit/WebCore/html/TimeRanges.idl
+++ b/src/3rdparty/webkit/WebCore/html/TimeRanges.idl
@@ -25,7 +25,7 @@
 
 module html {
 
-interface TimeRanges {
+interface [Conditional=VIDEO] TimeRanges {
     readonly attribute unsigned long length;
     float start(in unsigned long index)
         raises (DOMException);
diff --git a/src/3rdparty/webkit/WebCore/html/ValidityState.cpp b/src/3rdparty/webkit/WebCore/html/ValidityState.cpp
index 86227d4..df8933d 100644
--- a/src/3rdparty/webkit/WebCore/html/ValidityState.cpp
+++ b/src/3rdparty/webkit/WebCore/html/ValidityState.cpp
@@ -23,14 +23,43 @@
 #include "config.h"
 #include "ValidityState.h"
 
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
+#include "KURL.h"
+
 namespace WebCore {
 
+using namespace HTMLNames;
+
 ValidityState::ValidityState(HTMLFormControlElement* parent)
     : m_control(parent)
 {
     ASSERT(parent);
 }
 
+bool ValidityState::typeMismatch()
+{
+    if (!control()->hasTagName(inputTag))
+        return false;
+
+    HTMLInputElement* input = static_cast<HTMLInputElement*>(control());
+    String value = input->value();
+
+    if (value.isEmpty())
+        return false;
+
+    switch (input->inputType()) {
+    case HTMLInputElement::COLOR:
+        return !isValidColorString(value);
+    case HTMLInputElement::NUMBER:
+        return !HTMLInputElement::formStringToDouble(value, 0);
+    case HTMLInputElement::URL:
+        return !KURL(KURL(), value).isValid();
+    default:
+        return false;
+    }
+}
+
 bool ValidityState::valid()
 {
     bool someError = typeMismatch() || stepMismatch() || rangeUnderflow() || rangeOverflow() ||
@@ -39,4 +68,17 @@ bool ValidityState::valid()
     return !someError;
 }
 
+bool ValidityState::isValidColorString(const String& value)
+{
+    if (value.isEmpty())
+        return false;
+    if (value[0] == '#') {
+        // We don't accept #rgb and #aarrggbb formats.
+        if (value.length() != 7)
+            return false;
+    }
+    Color color(value);  // This accepts named colors such as "white".
+    return color.isValid() && !color.hasAlpha();
+}
+
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/html/ValidityState.h b/src/3rdparty/webkit/WebCore/html/ValidityState.h
index 4b2f022..1b87f99 100644
--- a/src/3rdparty/webkit/WebCore/html/ValidityState.h
+++ b/src/3rdparty/webkit/WebCore/html/ValidityState.h
@@ -38,19 +38,24 @@ namespace WebCore {
 
         HTMLFormControlElement* control() const { return m_control; }
 
+        void setCustomErrorMessage(const String& message) { m_customErrorMessage = message; }
+
         bool valueMissing() { return control()->valueMissing(); }
-        bool typeMismatch() { return false; }
+        bool typeMismatch();
         bool patternMismatch() { return control()->patternMismatch(); }
         bool tooLong() { return false; }
         bool rangeUnderflow() { return false; }
         bool rangeOverflow() { return false; }
         bool stepMismatch() { return false; }
-        bool customError() { return false; }
+        bool customError() { return !m_customErrorMessage.isEmpty(); }
         bool valid();
 
     private:
         ValidityState(HTMLFormControlElement*);
         HTMLFormControlElement* m_control;
+        String m_customErrorMessage;
+
+        static bool isValidColorString(const String&);
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.cpp
new file mode 100644
index 0000000..37cc840
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArray.h"
+#include "CanvasArrayBuffer.h"
+
+namespace WebCore {
+    CanvasArray::CanvasArray(PassRefPtr<CanvasArrayBuffer> buffer,
+                             unsigned offset)
+        : m_offset(offset)
+        , m_buffer(buffer)
+    {
+        m_baseAddress = static_cast<char*>(m_buffer->data()) + m_offset;
+    }
+
+    CanvasArray::~CanvasArray()
+    {
+    }
+
+    unsigned CanvasArray::alignedSizeInBytes() const {
+        // Assume we only need to round up to 4-byte boundaries for alignment.
+        return ((sizeInBytes() + 3) / 4) * 4;
+    }
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.h
new file mode 100644
index 0000000..e34ad8c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasArray_h
+#define CanvasArray_h
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+#include "CanvasArrayBuffer.h"
+
+namespace WebCore {
+    class CanvasArray : public RefCounted<CanvasArray> {
+    public:
+        PassRefPtr<CanvasArrayBuffer> buffer() {
+            return m_buffer;
+        }
+
+        void* baseAddress() {
+            return m_baseAddress;
+        }
+
+        unsigned offset() const {
+            return m_offset;
+        }
+
+        virtual unsigned length() const = 0;
+        virtual unsigned sizeInBytes() const = 0;
+        virtual unsigned alignedSizeInBytes() const;
+        virtual ~CanvasArray();
+
+    protected:
+        CanvasArray(PassRefPtr<CanvasArrayBuffer> buffer, unsigned offset);
+
+        // This is the address of the CanvasArrayBuffer's storage, plus the offset.
+        void* m_baseAddress;
+        unsigned m_offset;
+        
+    private:
+        RefPtr<CanvasArrayBuffer> m_buffer;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasArray_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.idl
new file mode 100644
index 0000000..01bb37e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasArray.idl
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [Conditional=3D_CANVAS] CanvasArray {
+        readonly attribute long length;
+        int sizeInBytes();
+        int alignedSizeInBytes();
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasArrayBuffer.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasArrayBuffer.cpp
new file mode 100644
index 0000000..c8a1397
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasArrayBuffer.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+
+namespace WebCore {
+    
+    PassRefPtr<CanvasArrayBuffer> CanvasArrayBuffer::create(unsigned sizeInBytes)
+    {
+        return adoptRef(new CanvasArrayBuffer(sizeInBytes));
+    }
+    
+    CanvasArrayBuffer::CanvasArrayBuffer(unsigned sizeInBytes) {
+        m_sizeInBytes = sizeInBytes;
+        m_data = WTF::fastZeroedMalloc(sizeInBytes);
+    }
+    
+    void* CanvasArrayBuffer::data() {
+        return m_data;
+    }
+
+    unsigned CanvasArrayBuffer::byteLength() const {
+        return m_sizeInBytes;
+    }
+
+    CanvasArrayBuffer::~CanvasArrayBuffer() {
+        WTF::fastFree(m_data);
+    }
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasArrayBuffer.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasArrayBuffer.h
new file mode 100644
index 0000000..e3ff2b0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasArrayBuffer.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasArrayBuffer_h
+#define CanvasArrayBuffer_h
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasArrayBuffer : public RefCounted<CanvasArrayBuffer> {
+    public:
+        static PassRefPtr<CanvasArrayBuffer> create(unsigned sizeInBytes);
+
+        void* data();
+        unsigned byteLength() const;
+
+        ~CanvasArrayBuffer();
+
+    private:
+        CanvasArrayBuffer(unsigned sizeInBytes);
+        unsigned m_sizeInBytes;
+        void* m_data;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasArrayBuffer_h
diff --git a/src/3rdparty/webkit/WebCore/page/PositionCallback.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasArrayBuffer.idl
index e862538..5dc0f7f 100644
--- a/src/3rdparty/webkit/WebCore/page/PositionCallback.idl
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasArrayBuffer.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,10 +10,10 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
@@ -23,12 +23,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-module core {
-
-    interface [
-        GenerateConstructor
-    ] PositionCallback {
-        void handleEvent(in Geoposition position);
+module html {
+    interface [Conditional=3D_CANVAS] CanvasArrayBuffer {
+        readonly attribute int byteLength;
     };
-
 }
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasBuffer.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasBuffer.cpp
new file mode 100644
index 0000000..009f8ad
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasBuffer.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasBuffer.h"
+#include "CanvasRenderingContext3D.h"
+
+namespace WebCore {
+    
+PassRefPtr<CanvasBuffer> CanvasBuffer::create(CanvasRenderingContext3D* ctx)
+{
+    return adoptRef(new CanvasBuffer(ctx));
+}
+
+CanvasBuffer::CanvasBuffer(CanvasRenderingContext3D* ctx)
+    : CanvasObject(ctx)
+{
+    setObject(context()->graphicsContext3D()->createBuffer());
+}
+
+void CanvasBuffer::_deleteObject(Platform3DObject object)
+{
+    context()->graphicsContext3D()->deleteBuffer(object);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasBuffer.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasBuffer.h
new file mode 100644
index 0000000..8fdab82
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasBuffer.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasBuffer_h
+#define CanvasBuffer_h
+
+#include "CanvasObject.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasBuffer : public CanvasObject {
+    public:
+        virtual ~CanvasBuffer() { deleteObject(); }
+        
+        static PassRefPtr<CanvasBuffer> create(CanvasRenderingContext3D*);
+        
+    protected:
+        CanvasBuffer(CanvasRenderingContext3D*);
+        
+        virtual void _deleteObject(Platform3DObject o);
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasBuffer_h
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGDefinitionSrcElement.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasBuffer.idl
index f221895..9bca42b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGDefinitionSrcElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasBuffer.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,9 +23,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-module svg {
-
-    interface [Conditional=SVG&SVG_FONTS] SVGDefinitionSrcElement : SVGElement {
+module html {
+    interface [Conditional=3D_CANVAS] CanvasBuffer {
     };
-
 }
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.cpp
new file mode 100644
index 0000000..8375334
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.cpp
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasByteArray.h"
+
+namespace WebCore {
+    
+PassRefPtr<CanvasByteArray> CanvasByteArray::create(unsigned length)
+{
+    RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(signed char));
+    return create(buffer, 0, length);
+}
+
+PassRefPtr<CanvasByteArray> CanvasByteArray::create(signed char* array, unsigned length)
+{
+    RefPtr<CanvasByteArray> a = CanvasByteArray::create(length);
+    for (unsigned i = 0; i < length; ++i)
+        a->set(i, array[i]);
+    return a;
+}
+
+PassRefPtr<CanvasByteArray> CanvasByteArray::create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
+{
+    // Check to make sure we are talking about a valid region of
+    // the given CanvasArrayBuffer's storage.
+    if ((offset + (length * sizeof(signed char))) > buffer->byteLength()) {
+        return NULL;
+    }
+
+    return adoptRef(new CanvasByteArray(buffer, offset, length));
+}
+
+CanvasByteArray::CanvasByteArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
+    : CanvasArray(buffer, offset)
+    , m_size(length)
+{
+}
+
+unsigned CanvasByteArray::length() const {
+    return m_size;
+}
+    
+unsigned CanvasByteArray::sizeInBytes() const {
+    return length() * sizeof(signed char);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.h
new file mode 100644
index 0000000..34ae292
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.h
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasByteArray_h
+#define CanvasByteArray_h
+
+#include "CanvasArray.h"
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasArrayBuffer;
+
+    class CanvasByteArray : public CanvasArray {
+    public:
+        static PassRefPtr<CanvasByteArray> create(unsigned length);
+        static PassRefPtr<CanvasByteArray> create(signed char* array, unsigned length);
+        static PassRefPtr<CanvasByteArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+
+        char* data() { return static_cast<char*>(baseAddress()); }
+
+        virtual unsigned length() const;
+        virtual unsigned sizeInBytes() const;
+
+        void set(unsigned index, double value)
+        {
+            if (index >= m_size)
+                return;
+            if (isnan(value)) // Clamp NaN to 0
+                value = 0;
+            if (value < std::numeric_limits<signed char>::min())
+                value = std::numeric_limits<signed char>::min();
+            else if (value > std::numeric_limits<signed char>::max())
+                value = std::numeric_limits<signed char>::max();
+            signed char* storage = static_cast<signed char*>(m_baseAddress);
+            storage[index] = static_cast<signed char>(value);
+        }
+        
+        bool get(unsigned index, signed char& result) const
+        {
+            if (index >= m_size)
+                return false;
+            signed char* storage = static_cast<signed char*>(m_baseAddress);
+            result = storage[index];
+            return true;
+        }
+
+        signed char item(unsigned index) const
+        {
+            ASSERT(index < m_size);
+            signed char* storage = static_cast<signed char*>(m_baseAddress);
+            return storage[index];
+        }
+    private:
+        CanvasByteArray(PassRefPtr<CanvasArrayBuffer> buffer,
+                        int offset,
+                        unsigned length);
+        unsigned m_size;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasByteArray_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.idl
new file mode 100644
index 0000000..ccf49ad
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasByteArray.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        HasNumericIndexGetter,
+        HasCustomIndexSetter,
+        GenerateNativeConverter,
+        GenerateCustomConstructor,
+        CustomToJS
+    ] CanvasByteArray : CanvasArray {
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.cpp
new file mode 100644
index 0000000..c78be1a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.cpp
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasFloatArray.h"
+
+namespace WebCore {
+    
+    PassRefPtr<CanvasFloatArray> CanvasFloatArray::create(unsigned length)
+    {
+        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(float));
+        return create(buffer, 0, length);
+    }
+
+    PassRefPtr<CanvasFloatArray> CanvasFloatArray::create(float* array, unsigned length)
+    {
+        RefPtr<CanvasFloatArray> a = CanvasFloatArray::create(length);
+        for (unsigned i = 0; i < length; ++i)
+            a->set(i, array[i]);
+        return a;
+    }
+
+    PassRefPtr<CanvasFloatArray> CanvasFloatArray::create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
+    {
+        // Make sure the offset results in valid alignment.
+        if ((offset % sizeof(float)) != 0) {
+            return NULL;
+        }
+
+        // Check to make sure we are talking about a valid region of
+        // the given CanvasArrayBuffer's storage.
+        if ((offset + (length * sizeof(float))) > buffer->byteLength()) {
+            return NULL;
+        }
+
+        return adoptRef(new CanvasFloatArray(buffer, offset, length));
+    }
+    
+    CanvasFloatArray::CanvasFloatArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
+        : CanvasArray(buffer, offset)
+        , m_size(length)
+    {
+    }
+    
+    unsigned CanvasFloatArray::length() const {
+        return m_size;
+    }
+        
+    unsigned CanvasFloatArray::sizeInBytes() const {
+        return length() * sizeof(float);
+    }
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.h
new file mode 100644
index 0000000..49bd897
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasFloatArray_h
+#define CanvasFloatArray_h
+
+#include "CanvasArray.h"
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasFloatArray : public CanvasArray {
+    public:
+        static PassRefPtr<CanvasFloatArray> create(unsigned length);
+        static PassRefPtr<CanvasFloatArray> create(float* array, unsigned length);
+        static PassRefPtr<CanvasFloatArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+
+        float* data() { return static_cast<float*>(baseAddress()); }
+
+        virtual unsigned length() const;
+        
+        virtual unsigned sizeInBytes() const;
+
+        void set(unsigned index, double value)
+        {
+            if (index >= m_size)
+                return;
+            if (isnan(value)) // Clamp NaN to 0
+                value = 0;
+            float* storage = static_cast<float*>(m_baseAddress);
+            storage[index] = static_cast<float>(value);
+        }
+        
+        bool get(unsigned index, float& result) const
+        {
+            if (index >= m_size)
+                return false;
+            result = item(index);
+            return true;
+        }
+        
+        float item(unsigned index) const
+        {
+            ASSERT(index < m_size);
+            float* storage = static_cast<float*>(m_baseAddress);
+            float result = storage[index];
+            if (isnan(result)) {
+                // Clamp NaN to 0
+                result = 0;
+            }
+            return result;
+        }
+    private:
+        CanvasFloatArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+        unsigned m_size;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasFloatArray_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.idl
new file mode 100644
index 0000000..bb236b9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasFloatArray.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        HasNumericIndexGetter,
+        HasCustomIndexSetter,
+        GenerateNativeConverter,
+        GenerateCustomConstructor,
+        CustomToJS
+    ] CanvasFloatArray : CanvasArray {
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasFramebuffer.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasFramebuffer.cpp
new file mode 100644
index 0000000..9700354
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasFramebuffer.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasFramebuffer.h"
+#include "CanvasRenderingContext3D.h"
+
+namespace WebCore {
+    
+PassRefPtr<CanvasFramebuffer> CanvasFramebuffer::create(CanvasRenderingContext3D* ctx)
+{
+    return adoptRef(new CanvasFramebuffer(ctx));
+}
+
+CanvasFramebuffer::CanvasFramebuffer(CanvasRenderingContext3D* ctx)
+    : CanvasObject(ctx)
+{
+    setObject(context()->graphicsContext3D()->createFramebuffer());
+}
+
+void CanvasFramebuffer::_deleteObject(Platform3DObject object)
+{
+    context()->graphicsContext3D()->deleteFramebuffer(object);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasFramebuffer.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasFramebuffer.h
new file mode 100644
index 0000000..ec3cb97
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasFramebuffer.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasFramebuffer_h
+#define CanvasFramebuffer_h
+
+#include "CanvasObject.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasFramebuffer : public CanvasObject {
+    public:
+        virtual ~CanvasFramebuffer() { deleteObject(); }
+        
+        static PassRefPtr<CanvasFramebuffer> create(CanvasRenderingContext3D*);
+        
+    protected:
+        CanvasFramebuffer(CanvasRenderingContext3D*);
+        
+        virtual void _deleteObject(Platform3DObject);
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasFramebuffer_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasFramebuffer.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasFramebuffer.idl
new file mode 100644
index 0000000..0a9b668
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasFramebuffer.idl
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [Conditional=3D_CANVAS] CanvasFramebuffer {
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasGradient.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasGradient.cpp
index fd48194..fd48194 100644
--- a/src/3rdparty/webkit/WebCore/html/CanvasGradient.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasGradient.cpp
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasGradient.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasGradient.h
index 0a77652..0a77652 100644
--- a/src/3rdparty/webkit/WebCore/html/CanvasGradient.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasGradient.h
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasGradient.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasGradient.idl
index a925a26..a925a26 100644
--- a/src/3rdparty/webkit/WebCore/html/CanvasGradient.idl
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasGradient.idl
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.cpp
new file mode 100644
index 0000000..9a07b6e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.cpp
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasIntArray.h"
+
+namespace WebCore {
+    
+    PassRefPtr<CanvasIntArray> CanvasIntArray::create(unsigned length)
+    {
+        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(int));
+        return create(buffer, 0, length);
+    }
+
+    PassRefPtr<CanvasIntArray> CanvasIntArray::create(int* array, unsigned length)
+    {
+        RefPtr<CanvasIntArray> a = CanvasIntArray::create(length);
+        for (unsigned i = 0; i < length; ++i)
+            a->set(i, array[i]);
+        return a;
+    }
+
+    PassRefPtr<CanvasIntArray> CanvasIntArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
+                                                      int offset,
+                                                      unsigned length)
+    {
+        // Make sure the offset results in valid alignment.
+        if ((offset % sizeof(int)) != 0) {
+            return NULL;
+        }
+
+        // Check to make sure we are talking about a valid region of
+        // the given CanvasArrayBuffer's storage.
+        if ((offset + (length * sizeof(int))) > buffer->byteLength()) {
+            return NULL;
+        }
+
+        return adoptRef(new CanvasIntArray(buffer, offset, length));
+    }
+    
+    CanvasIntArray::CanvasIntArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
+        : CanvasArray(buffer, offset)
+        , m_size(length)
+    {
+    }
+    
+    unsigned CanvasIntArray::length() const {
+        return m_size;
+    }
+        
+    unsigned CanvasIntArray::sizeInBytes() const {
+        return length() * sizeof(int);
+    }
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.h
new file mode 100644
index 0000000..ace6410
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasIntArray_h
+#define CanvasIntArray_h
+
+#include "CanvasArray.h"
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasIntArray : public CanvasArray {
+    public:
+        static PassRefPtr<CanvasIntArray> create(unsigned length);
+        static PassRefPtr<CanvasIntArray> create(int* array, unsigned length);
+        static PassRefPtr<CanvasIntArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+
+        int* data() { return static_cast<int*>(baseAddress()); }
+
+        virtual unsigned length() const;
+        virtual unsigned sizeInBytes() const;
+
+        void set(unsigned index, double value)
+        {
+            if (index >= m_size)
+                return;
+            if (isnan(value)) // Clamp NaN to 0
+                value = 0;
+            if (value < std::numeric_limits<int>::min())
+                value = std::numeric_limits<int>::min();
+            else if (value > std::numeric_limits<int>::max())
+                value = std::numeric_limits<int>::max();
+            int* storage = static_cast<int*>(m_baseAddress);
+            storage[index] = static_cast<int>(value);
+        }
+        
+        bool get(unsigned index, int& result) const
+        {
+            if (index >= m_size)
+                return false;
+            result = item(index);
+            return true;
+        }
+        
+        int item(unsigned index) const
+        {
+            ASSERT(index < m_size);
+            int* storage = static_cast<int*>(m_baseAddress);
+            return storage[index];
+        }
+
+    private:
+        CanvasIntArray(PassRefPtr<CanvasArrayBuffer> buffer,
+                       int offset,
+                       unsigned length);
+        unsigned m_size;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasIntArray_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.idl
new file mode 100644
index 0000000..2c81b87
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasIntArray.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        HasNumericIndexGetter,
+        HasCustomIndexSetter,
+        GenerateNativeConverter,
+        GenerateCustomConstructor,
+        CustomToJS
+    ] CanvasIntArray : CanvasArray {
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasNumberArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasNumberArray.cpp
new file mode 100644
index 0000000..6cbdfff
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasNumberArray.cpp
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasNumberArray.h"
+#include "PlatformString.h"
+
+namespace WebCore {
+    
+PassRefPtr<CanvasNumberArray> CanvasNumberArray::create(unsigned length)
+{
+    return adoptRef(new CanvasNumberArray(length));
+}
+
+CanvasNumberArray::CanvasNumberArray(unsigned length)
+    : m_data(length)
+{
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasNumberArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasNumberArray.h
new file mode 100644
index 0000000..eb79866
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasNumberArray.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasNumberArray_h
+#define CanvasNumberArray_h
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+#include <limits>
+
+namespace WebCore {
+
+    class String;
+    
+    class CanvasNumberArray : public RefCounted<CanvasNumberArray> {
+    public:
+        static PassRefPtr<CanvasNumberArray> create(unsigned length);
+        
+        Vector<float>& data() { return m_data; }
+        const Vector<float>& data() const { return m_data; }
+
+        unsigned length() const { return m_data.size(); }
+        float item(unsigned index) const { return (index >= m_data.size()) ? 0 : m_data[index]; }
+
+    private:
+        CanvasNumberArray(unsigned length);
+        Vector<float> m_data;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasNumberArray_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasNumberArray.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasNumberArray.idl
new file mode 100644
index 0000000..56e807e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasNumberArray.idl
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        GenerateConstructor,
+        HasCustomIndexGetter
+    ] CanvasNumberArray {
+        readonly attribute unsigned long length;
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasObject.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasObject.cpp
new file mode 100644
index 0000000..8a71a45
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasObject.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasObject.h"
+#include "CanvasRenderingContext3D.h"
+
+namespace WebCore {
+    
+CanvasObject::CanvasObject(CanvasRenderingContext3D* context)
+    : m_object(0)
+    , m_context(context)
+{
+}
+
+CanvasObject::~CanvasObject()
+{
+    if (m_context)
+        m_context->removeObject(this);
+}
+
+void CanvasObject::setObject(Platform3DObject object)
+{
+    if (object == m_object)
+        return;
+        
+    deleteObject();
+    m_object = object;
+}
+
+void CanvasObject::deleteObject()
+{
+    if (m_object) {
+        if (m_context) {
+            m_context->graphicsContext3D()->makeContextCurrent();
+            _deleteObject(m_object);
+        }
+        m_object = 0;
+    }
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasObject.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasObject.h
new file mode 100644
index 0000000..413da71
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasObject.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasObject_h
+#define CanvasObject_h
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+#include "GraphicsContext3D.h"
+
+namespace WebCore {
+
+    class CanvasRenderingContext3D;
+    
+    class CanvasObject : public RefCounted<CanvasObject> {
+    public:
+        virtual ~CanvasObject();
+        
+        Platform3DObject object() const { return m_object; }
+        void setObject(Platform3DObject);
+        void deleteObject();
+        
+        void detachContext()
+        {
+            deleteObject();
+            m_context = 0;
+        }
+        
+    protected:
+        CanvasObject(CanvasRenderingContext3D*);
+        virtual void _deleteObject(Platform3DObject) = 0;
+        
+        CanvasRenderingContext3D* context() const { return m_context; }
+    
+    private:
+        Platform3DObject m_object;
+        CanvasRenderingContext3D* m_context;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasObject_h
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasPattern.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasPattern.cpp
index 62a4620..62a4620 100644
--- a/src/3rdparty/webkit/WebCore/html/CanvasPattern.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasPattern.cpp
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasPattern.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasPattern.h
index 6c012d1..6c012d1 100644
--- a/src/3rdparty/webkit/WebCore/html/CanvasPattern.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasPattern.h
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasPattern.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasPattern.idl
index 1cac8f8..1cac8f8 100644
--- a/src/3rdparty/webkit/WebCore/html/CanvasPattern.idl
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasPattern.idl
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasPixelArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasPixelArray.cpp
index a377c83..a377c83 100644
--- a/src/3rdparty/webkit/WebCore/html/CanvasPixelArray.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasPixelArray.cpp
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasPixelArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasPixelArray.h
index b91a642..8ac5163 100644
--- a/src/3rdparty/webkit/WebCore/html/CanvasPixelArray.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasPixelArray.h
@@ -48,12 +48,22 @@ namespace WebCore {
         {
             m_data->set(index, value);
         }
+
+        void set(unsigned index, unsigned char value)
+        {
+            m_data->set(index, value);
+        }
         
         bool get(unsigned index, unsigned char& result) const
         {
             return m_data->get(index, result);
         }
 
+        unsigned char get(unsigned index) const
+        {
+            return m_data->get(index);
+        }
+
     private:
         CanvasPixelArray(unsigned length);
         RefPtr<WTF::ByteArray> m_data;
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasPixelArray.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasPixelArray.idl
index c815788..2295af6 100644
--- a/src/3rdparty/webkit/WebCore/html/CanvasPixelArray.idl
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasPixelArray.idl
@@ -30,7 +30,7 @@ module html {
 #if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT || defined(V8_BINDING) && V8_BINDING
     interface [
         CustomHeader,
-        HasCustomIndexGetter,
+        HasNumericIndexGetter,
         HasCustomIndexSetter
     ] CanvasPixelArray {
         readonly attribute long length;
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasProgram.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasProgram.cpp
new file mode 100644
index 0000000..83da270
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasProgram.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasProgram.h"
+#include "CanvasRenderingContext3D.h"
+
+namespace WebCore {
+    
+PassRefPtr<CanvasProgram> CanvasProgram::create(CanvasRenderingContext3D* ctx)
+{
+    return adoptRef(new CanvasProgram(ctx));
+}
+
+CanvasProgram::CanvasProgram(CanvasRenderingContext3D* ctx)
+    : CanvasObject(ctx)
+{
+    setObject(context()->graphicsContext3D()->createProgram());
+}
+
+void CanvasProgram::_deleteObject(Platform3DObject object)
+{
+    context()->graphicsContext3D()->deleteProgram(object);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasProgram.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasProgram.h
new file mode 100644
index 0000000..af817c8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasProgram.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasProgram_h
+#define CanvasProgram_h
+
+#include "CanvasObject.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasProgram : public CanvasObject {
+    public:
+        virtual ~CanvasProgram() { deleteObject(); }
+        
+        static PassRefPtr<CanvasProgram> create(CanvasRenderingContext3D*);
+        
+    protected:
+        CanvasProgram(CanvasRenderingContext3D*);
+        
+        virtual void _deleteObject(Platform3DObject);
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasProgram_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasProgram.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasProgram.idl
new file mode 100644
index 0000000..46daaf2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasProgram.idl
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [Conditional=3D_CANVAS] CanvasProgram {
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderbuffer.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderbuffer.cpp
new file mode 100644
index 0000000..51054cd
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderbuffer.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasRenderbuffer.h"
+#include "CanvasRenderingContext3D.h"
+
+namespace WebCore {
+    
+PassRefPtr<CanvasRenderbuffer> CanvasRenderbuffer::create(CanvasRenderingContext3D* ctx)
+{
+    return adoptRef(new CanvasRenderbuffer(ctx));
+}
+
+CanvasRenderbuffer::CanvasRenderbuffer(CanvasRenderingContext3D* ctx)
+    : CanvasObject(ctx)
+{
+    setObject(context()->graphicsContext3D()->createRenderbuffer());
+}
+
+void CanvasRenderbuffer::_deleteObject(Platform3DObject object)
+{
+    context()->graphicsContext3D()->deleteRenderbuffer(object);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderbuffer.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderbuffer.h
new file mode 100644
index 0000000..3fb99e9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderbuffer.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasRenderbuffer_h
+#define CanvasRenderbuffer_h
+
+#include "CanvasObject.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasRenderbuffer : public CanvasObject {
+    public:
+        virtual ~CanvasRenderbuffer() { deleteObject(); }
+        
+        static PassRefPtr<CanvasRenderbuffer> create(CanvasRenderingContext3D*);
+        
+    protected:
+        CanvasRenderbuffer(CanvasRenderingContext3D*);
+        
+        virtual void _deleteObject(Platform3DObject);
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasRenderbuffer_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderbuffer.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderbuffer.idl
new file mode 100644
index 0000000..5e47cc3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderbuffer.idl
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [Conditional=3D_CANVAS] CanvasRenderbuffer {
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext.cpp
new file mode 100644
index 0000000..fed8cb2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CanvasRenderingContext.h"
+
+#include "HTMLCanvasElement.h"
+
+namespace WebCore {
+
+CanvasRenderingContext::CanvasRenderingContext(HTMLCanvasElement* canvas)
+    : m_canvas(canvas)
+{
+}
+
+void CanvasRenderingContext::ref()
+{
+    m_canvas->ref();
+}
+
+void CanvasRenderingContext::deref()
+{
+    m_canvas->deref(); 
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext.h
new file mode 100644
index 0000000..9ac9e57
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasRenderingContext_h
+#define CanvasRenderingContext_h
+
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+    class CanvasObject;
+    class HTMLCanvasElement;
+
+    class CanvasRenderingContext : public Noncopyable {
+    public:
+        CanvasRenderingContext(HTMLCanvasElement*);
+        virtual ~CanvasRenderingContext() { }
+        
+        void ref();
+        void deref();
+        
+        HTMLCanvasElement* canvas() const { return m_canvas; }
+        
+        virtual bool is2d() const { return false; }
+        virtual bool is3d() const { return false; }
+
+    protected:
+        HTMLCanvasElement* m_canvas;
+    };
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext.idl
new file mode 100644
index 0000000..8701c80
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext.idl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+
+    interface [
+        GenerateConstructor,
+        CustomToJS,
+        InterfaceUUID=98fb48ae-7216-489c-862b-8e1217fc4443,
+        ImplementationUUID=ab4f0781-152f-450e-9546-5b3987491a54
+    ] CanvasRenderingContext {
+
+        readonly attribute HTMLCanvasElement canvas;
+    };
+
+}
+
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.cpp
index 6878129..1e3faa3 100644
--- a/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.cpp
@@ -94,7 +94,7 @@ private:
 
 
 CanvasRenderingContext2D::CanvasRenderingContext2D(HTMLCanvasElement* canvas)
-    : m_canvas(canvas)
+    : CanvasRenderingContext(canvas)
     , m_stateStack(1)
 {
     // Make sure that even if the drawingContext() has a different default
@@ -102,14 +102,8 @@ CanvasRenderingContext2D::CanvasRenderingContext2D(HTMLCanvasElement* canvas)
     setLineWidth(lineWidth());
 }
 
-void CanvasRenderingContext2D::ref()
+CanvasRenderingContext2D::~CanvasRenderingContext2D()
 {
-    m_canvas->ref();
-}
-
-void CanvasRenderingContext2D::deref()
-{
-    m_canvas->deref(); 
 }
 
 void CanvasRenderingContext2D::reset()
@@ -1278,8 +1272,13 @@ static PassRefPtr<ImageData> createEmptyImageData(const IntSize& size)
     return data.get();
 }
 
-PassRefPtr<ImageData> CanvasRenderingContext2D::createImageData(float sw, float sh) const
+PassRefPtr<ImageData> CanvasRenderingContext2D::createImageData(float sw, float sh, ExceptionCode& ec) const
 {
+    ec = 0;
+    if (!isfinite(sw) || !isfinite(sh)) {
+        ec = NOT_SUPPORTED_ERR;
+        return 0;
+    }
     FloatSize unscaledSize(sw, sh);
     IntSize scaledSize = m_canvas->convertLogicalToDevice(unscaledSize);
     if (scaledSize.width() < 1)
@@ -1306,7 +1305,7 @@ PassRefPtr<ImageData> CanvasRenderingContext2D::getImageData(float sx, float sy,
     ImageBuffer* buffer = m_canvas ? m_canvas->buffer() : 0;
     if (!buffer)
         return createEmptyImageData(scaledRect.size());
-    return buffer->getImageData(scaledRect);
+    return buffer->getUnmultipliedImageData(scaledRect);
 }
 
 void CanvasRenderingContext2D::putImageData(ImageData* data, float dx, float dy, ExceptionCode& ec)
@@ -1357,7 +1356,7 @@ void CanvasRenderingContext2D::putImageData(ImageData* data, float dx, float dy,
     sourceRect.move(-destOffset);
     IntPoint destPoint(destOffset.width(), destOffset.height());
     
-    buffer->putImageData(data, sourceRect, destPoint);
+    buffer->putUnmultipliedImageData(data, sourceRect, destPoint);
 }
 
 String CanvasRenderingContext2D::font() const
@@ -1526,7 +1525,7 @@ void CanvasRenderingContext2D::drawTextInternal(const String& text, float x, flo
         // FIXME: The rect is not big enough for miters on stroked text.
         IntRect maskRect = enclosingIntRect(textRect);
 
-        OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(maskRect.size(), false);
+        OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(maskRect.size());
 
         GraphicsContext* maskImageContext = maskImage->context();
 
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.h
index 9648ffc..283f92c 100644
--- a/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.h
@@ -26,6 +26,7 @@
 #ifndef CanvasRenderingContext2D_h
 #define CanvasRenderingContext2D_h
 
+#include "CanvasRenderingContext.h"
 #include "TransformationMatrix.h"
 #include "FloatSize.h"
 #include "Font.h"
@@ -54,14 +55,13 @@ namespace WebCore {
 
     typedef int ExceptionCode;
 
-    class CanvasRenderingContext2D : public Noncopyable {
+    class CanvasRenderingContext2D : public CanvasRenderingContext {
     public:
         CanvasRenderingContext2D(HTMLCanvasElement*);
+
+        virtual ~CanvasRenderingContext2D();
         
-        void ref();
-        void deref();
-        
-        HTMLCanvasElement* canvas() const { return m_canvas; }
+        virtual bool is2d() const { return true; }
 
         CanvasStyle* strokeStyle() const;
         void setStrokeStyle(PassRefPtr<CanvasStyle>);
@@ -178,7 +178,7 @@ namespace WebCore {
         PassRefPtr<CanvasPattern> createPattern(HTMLImageElement*, const String& repetitionType, ExceptionCode&);
         PassRefPtr<CanvasPattern> createPattern(HTMLCanvasElement*, const String& repetitionType, ExceptionCode&);
         
-        PassRefPtr<ImageData> createImageData(float width, float height) const;
+        PassRefPtr<ImageData> createImageData(float width, float height, ExceptionCode&) const;
         PassRefPtr<ImageData> getImageData(float sx, float sy, float sw, float sh, ExceptionCode&) const;
         void putImageData(ImageData*, float dx, float dy, ExceptionCode&);
         void putImageData(ImageData*, float dx, float dy, float dirtyX, float dirtyY, float dirtyWidth, float dirtyHeight, ExceptionCode&);
@@ -262,7 +262,6 @@ namespace WebCore {
         void checkOrigin(const KURL&);
         void checkOrigin(const String&);
 
-        HTMLCanvasElement* m_canvas;
         Vector<State, 1> m_stateStack;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.idl
index a86b47d..ef66d1a 100644
--- a/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.idl
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.idl
@@ -29,12 +29,10 @@ module html {
         GenerateConstructor,
         InterfaceUUID=98fb48ae-7216-489c-862b-8e1217fc4443,
         ImplementationUUID=ab4f0781-152f-450e-9546-5b3987491a54
-    ] CanvasRenderingContext2D {
+    ] CanvasRenderingContext2D : CanvasRenderingContext {
 
         // Web Applications 1.0 draft
 
-        readonly attribute HTMLCanvasElement canvas;
-
         void save();
         void restore();
 
@@ -113,7 +111,8 @@ module html {
         attribute [Custom] custom fillStyle;
         
         // pixel manipulation
-        ImageData createImageData(in float sw, in float sh);
+        ImageData createImageData(in float sw, in float sh)
+            raises (DOMException);
         ImageData getImageData(in float sx, in float sy, in float sw, in float sh)
             raises(DOMException);
         [Custom] void putImageData(/* in ImageData imagedata, in float dx, in float dy [, in float dirtyX, in float dirtyY, in float dirtyWidth, in float dirtyHeight] */);
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.cpp
new file mode 100644
index 0000000..b810500
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.cpp
@@ -0,0 +1,1401 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasRenderingContext3D.h"
+#include "CanvasBuffer.h"
+#include "CanvasFramebuffer.h"
+#include "CanvasProgram.h"
+#include "CanvasRenderbuffer.h"
+#include "CanvasTexture.h"
+#include "CanvasShader.h"
+#include "HTMLCanvasElement.h"
+#include "RenderBox.h"
+#include "RenderLayer.h"
+
+namespace WebCore {
+
+CanvasRenderingContext3D::CanvasRenderingContext3D(HTMLCanvasElement* canvas)
+    : CanvasRenderingContext(canvas)
+    , m_needsUpdate(true)
+    , m_markedCanvasDirty(false)
+{
+    m_context.reshape(m_canvas->width(), m_canvas->height());
+}
+
+CanvasRenderingContext3D::~CanvasRenderingContext3D()
+{
+    detachAndRemoveAllObjects();
+}
+
+void CanvasRenderingContext3D::markContextChanged()
+{
+#if USE(ACCELERATED_COMPOSITING)
+    if (m_canvas->renderBox() && m_canvas->renderBox()->hasLayer()) {
+        m_canvas->renderBox()->layer()->rendererContentChanged();
+    } else {
+#endif
+        if (!m_markedCanvasDirty) {
+            // Make sure the canvas's image buffer is allocated.
+            m_canvas->buffer();
+            m_canvas->willDraw(FloatRect(0, 0, m_canvas->width(), m_canvas->height()));
+            m_markedCanvasDirty = true;
+        }
+#if USE(ACCELERATED_COMPOSITING)
+    }
+#endif
+}
+
+void CanvasRenderingContext3D::beginPaint()
+{
+    if (m_markedCanvasDirty) {
+        m_context.beginPaint(this);
+    }
+}
+
+void CanvasRenderingContext3D::endPaint()
+{
+    if (m_markedCanvasDirty) {
+        m_markedCanvasDirty = false;
+        m_context.endPaint();
+    }
+}
+
+void CanvasRenderingContext3D::reshape(int width, int height)
+{
+    if (m_needsUpdate) {
+#if USE(ACCELERATED_COMPOSITING)
+        if (m_canvas->renderBox() && m_canvas->renderBox()->hasLayer())
+            m_canvas->renderBox()->layer()->rendererContentChanged();
+#endif
+        m_needsUpdate = false;
+    }
+    
+    m_context.reshape(width, height);
+}
+
+int CanvasRenderingContext3D::sizeInBytes(int type, ExceptionCode& ec)
+{
+    int result = m_context.sizeInBytes(type);
+    if (result <= 0) {
+        ec = SYNTAX_ERR;
+    }
+    return result;
+}
+
+void CanvasRenderingContext3D::activeTexture(unsigned long texture)
+{
+    m_context.activeTexture(texture);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::attachShader(CanvasProgram* program, CanvasShader* shader)
+{
+    if (!program || !shader)
+        return;
+    m_context.attachShader(program, shader);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::bindAttribLocation(CanvasProgram* program, unsigned long index, const String& name)
+{
+    if (!program)
+        return;
+    m_context.bindAttribLocation(program, index, name);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::bindBuffer(unsigned long target, CanvasBuffer* buffer)
+{
+    m_context.bindBuffer(target, buffer);
+    cleanupAfterGraphicsCall(false);
+}
+
+
+void CanvasRenderingContext3D::bindFramebuffer(unsigned long target, CanvasFramebuffer* buffer)
+{
+    m_context.bindFramebuffer(target, buffer);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::bindRenderbuffer(unsigned long target, CanvasRenderbuffer* renderbuffer)
+{
+    m_context.bindRenderbuffer(target, renderbuffer);
+    cleanupAfterGraphicsCall(false);
+}
+
+
+void CanvasRenderingContext3D::bindTexture(unsigned long target, CanvasTexture* texture)
+{
+    m_context.bindTexture(target, texture);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::blendColor(double red, double green, double blue, double alpha)
+{
+    m_context.blendColor(red, green, blue, alpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::blendEquation( unsigned long mode )
+{
+    m_context.blendEquation(mode);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha)
+{
+    m_context.blendEquationSeparate(modeRGB, modeAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+
+void CanvasRenderingContext3D::blendFunc(unsigned long sfactor, unsigned long dfactor)
+{
+    m_context.blendFunc(sfactor, dfactor);
+    cleanupAfterGraphicsCall(false);
+}       
+
+void CanvasRenderingContext3D::blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha)
+{
+    m_context.blendFuncSeparate(srcRGB, dstRGB, srcAlpha, dstAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::bufferData(unsigned long target, int size, unsigned long usage)
+{
+    m_context.bufferData(target, size, usage);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::bufferData(unsigned long target, CanvasArray* data, unsigned long usage)
+{
+    m_context.bufferData(target, data, usage);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::bufferSubData(unsigned long target, long offset, CanvasArray* data)
+{
+    m_context.bufferSubData(target, offset, data);
+    cleanupAfterGraphicsCall(false);
+}
+
+unsigned long CanvasRenderingContext3D::checkFramebufferStatus(unsigned long target)
+{
+    return m_context.checkFramebufferStatus(target);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::clear(unsigned long mask)
+{
+    m_context.clear(mask);
+    cleanupAfterGraphicsCall(true);
+}
+
+void CanvasRenderingContext3D::clearColor(double r, double g, double b, double a)
+{
+    if (isnan(r))
+        r = 0;
+    if (isnan(g))
+        g = 0;
+    if (isnan(b))
+        b = 0;
+    if (isnan(a))
+        a = 1;
+    m_context.clearColor(r, g, b, a);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::clearDepth(double depth)
+{
+    m_context.clearDepth(depth);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::clearStencil(long s)
+{
+    m_context.clearStencil(s);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::colorMask(bool red, bool green, bool blue, bool alpha)
+{
+    m_context.colorMask(red, green, blue, alpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::compileShader(CanvasShader* shader)
+{
+    m_context.compileShader(shader);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::copyTexImage2D(unsigned long target, long level, unsigned long internalformat, long x, long y, unsigned long width, unsigned long height, long border)
+{
+    m_context.copyTexImage2D(target, level, internalformat, x, y, width, height, border);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::copyTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, long x, long y, unsigned long width, unsigned long height)
+{
+    m_context.copyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
+    cleanupAfterGraphicsCall(false);
+}
+
+PassRefPtr<CanvasBuffer> CanvasRenderingContext3D::createBuffer()
+{
+    RefPtr<CanvasBuffer> o = CanvasBuffer::create(this);
+    addObject(o.get());
+    return o;
+}
+        
+PassRefPtr<CanvasFramebuffer> CanvasRenderingContext3D::createFramebuffer()
+{
+    RefPtr<CanvasFramebuffer> o = CanvasFramebuffer::create(this);
+    addObject(o.get());
+    return o;
+}
+
+PassRefPtr<CanvasTexture> CanvasRenderingContext3D::createTexture()
+{
+    RefPtr<CanvasTexture> o = CanvasTexture::create(this);
+    addObject(o.get());
+    return o;
+}
+
+PassRefPtr<CanvasProgram> CanvasRenderingContext3D::createProgram()
+{
+    RefPtr<CanvasProgram> o = CanvasProgram::create(this);
+    addObject(o.get());
+    return o;
+}
+
+PassRefPtr<CanvasRenderbuffer> CanvasRenderingContext3D::createRenderbuffer()
+{
+    RefPtr<CanvasRenderbuffer> o = CanvasRenderbuffer::create(this);
+    addObject(o.get());
+    return o;
+}
+
+PassRefPtr<CanvasShader> CanvasRenderingContext3D::createShader(unsigned long type)
+{
+    // FIXME: Need to include GL_ constants for internal use
+    // FIXME: Need to do param checking and throw exception if an illegal value is passed in
+    GraphicsContext3D::ShaderType shaderType = GraphicsContext3D::VERTEX_SHADER;
+    if (type == 0x8B30) // GL_FRAGMENT_SHADER
+        shaderType = GraphicsContext3D::FRAGMENT_SHADER;
+        
+    RefPtr<CanvasShader> o = CanvasShader::create(this, shaderType);
+    addObject(o.get());
+    return o;
+}
+
+void CanvasRenderingContext3D::cullFace(unsigned long mode)
+{
+    m_context.cullFace(mode);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::deleteBuffer(CanvasBuffer* buffer)
+{
+    if (!buffer)
+        return;
+    
+    buffer->deleteObject();
+}
+
+void CanvasRenderingContext3D::deleteFramebuffer(CanvasFramebuffer* framebuffer)
+{
+    if (!framebuffer)
+        return;
+    
+    framebuffer->deleteObject();
+}
+
+void CanvasRenderingContext3D::deleteProgram(CanvasProgram* program)
+{
+    if (!program)
+        return;
+    
+    program->deleteObject();
+}
+
+void CanvasRenderingContext3D::deleteRenderbuffer(CanvasRenderbuffer* renderbuffer)
+{
+    if (!renderbuffer)
+        return;
+    
+    renderbuffer->deleteObject();
+}
+
+void CanvasRenderingContext3D::deleteShader(CanvasShader* shader)
+{
+    if (!shader)
+        return;
+    
+    shader->deleteObject();
+}
+
+void CanvasRenderingContext3D::deleteTexture(CanvasTexture* texture)
+{
+    if (!texture)
+        return;
+    
+    texture->deleteObject();
+}
+
+void CanvasRenderingContext3D::depthFunc(unsigned long func)
+{
+    m_context.depthFunc(func);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::depthMask(bool flag)
+{
+    m_context.depthMask(flag);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::depthRange(double zNear, double zFar)
+{
+    m_context.depthRange(zNear, zFar);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::detachShader(CanvasProgram* program, CanvasShader* shader)
+{
+    if (!program || !shader)
+        return;
+
+    m_context.detachShader(program, shader);
+    cleanupAfterGraphicsCall(false);
+}
+
+
+void CanvasRenderingContext3D::disable(unsigned long cap)
+{
+    m_context.disable(cap);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::disableVertexAttribArray(unsigned long index)
+{
+    m_context.disableVertexAttribArray(index);
+    cleanupAfterGraphicsCall(false);
+}
+
+
+void CanvasRenderingContext3D::drawArrays(unsigned long mode, long first, long count)
+{
+    m_context.drawArrays(mode, first, count);
+    cleanupAfterGraphicsCall(true);
+}
+
+void CanvasRenderingContext3D::drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset)
+{
+    m_context.drawElements(mode, count, type, offset);
+    cleanupAfterGraphicsCall(true);
+}
+
+void CanvasRenderingContext3D::enable(unsigned long cap)
+{
+    m_context.enable(cap);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::enableVertexAttribArray(unsigned long index)
+{
+    m_context.enableVertexAttribArray(index);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::finish()
+{
+    m_context.finish();
+    cleanupAfterGraphicsCall(true);
+}
+
+
+void CanvasRenderingContext3D::flush()
+{
+    m_context.flush();
+    cleanupAfterGraphicsCall(true);
+}
+
+void CanvasRenderingContext3D::framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, CanvasRenderbuffer* buffer)
+{
+    if (!buffer)
+        return;
+        
+    m_context.framebufferRenderbuffer(target, attachment, renderbuffertarget, buffer);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, CanvasTexture* texture, long level)
+{
+    if (!texture)
+        return;
+        
+    m_context.framebufferTexture2D(target, attachment, textarget, texture, level);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::frontFace(unsigned long mode)
+{
+    m_context.frontFace(mode);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::generateMipmap(unsigned long target)
+{
+    m_context.generateMipmap(target);
+    cleanupAfterGraphicsCall(false);
+}
+
+int CanvasRenderingContext3D::getAttribLocation(CanvasProgram* program, const String& name)
+{
+    return m_context.getAttribLocation(program, name);
+}
+
+bool CanvasRenderingContext3D::getBoolean(unsigned long pname)
+{
+    bool result = m_context.getBoolean(pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasUnsignedByteArray> CanvasRenderingContext3D::getBooleanv(unsigned long pname)
+{
+    RefPtr<CanvasUnsignedByteArray> array = m_context.getBooleanv(pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+int CanvasRenderingContext3D::getBufferParameteri(unsigned long target, unsigned long pname)
+{
+    int result = m_context.getBufferParameteri(target, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getBufferParameteriv(unsigned long target, unsigned long pname)
+{
+    RefPtr<CanvasIntArray> array = m_context.getBufferParameteriv(target, pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+unsigned long CanvasRenderingContext3D::getError()
+{
+    return m_context.getError();
+}
+
+float CanvasRenderingContext3D::getFloat(unsigned long pname)
+{
+    float result = m_context.getFloat(pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getFloatv(unsigned long pname)
+{
+    RefPtr<CanvasFloatArray> array = m_context.getFloatv(pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+int CanvasRenderingContext3D::getFramebufferAttachmentParameteri(unsigned long target, unsigned long attachment, unsigned long pname)
+{
+    int result = m_context.getFramebufferAttachmentParameteri(target, attachment, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long pname)
+{
+    RefPtr<CanvasIntArray> array = m_context.getFramebufferAttachmentParameteriv(target, attachment, pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+int CanvasRenderingContext3D::getInteger(unsigned long pname)
+{
+    float result = m_context.getInteger(pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getIntegerv(unsigned long pname)
+{
+    RefPtr<CanvasIntArray> array = m_context.getIntegerv(pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+int CanvasRenderingContext3D::getProgrami(CanvasProgram* program, unsigned long pname)
+{
+    int result = m_context.getProgrami(program, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getProgramiv(CanvasProgram* program, unsigned long pname)
+{
+    RefPtr<CanvasIntArray> array = m_context.getProgramiv(program, pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+String CanvasRenderingContext3D::getProgramInfoLog(CanvasProgram* program)
+{
+    String s = m_context.getProgramInfoLog(program);
+    cleanupAfterGraphicsCall(false);
+    return s;
+}
+
+int CanvasRenderingContext3D::getRenderbufferParameteri(unsigned long target, unsigned long pname)
+{
+    int result = m_context.getRenderbufferParameteri(target, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getRenderbufferParameteriv(unsigned long target, unsigned long pname)
+{
+    RefPtr<CanvasIntArray> array = m_context.getRenderbufferParameteriv(target, pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+int CanvasRenderingContext3D::getShaderi(CanvasShader* shader, unsigned long pname)
+{
+    int result = m_context.getShaderi(shader, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getShaderiv(CanvasShader* shader, unsigned long pname)
+{
+    RefPtr<CanvasIntArray> array = m_context.getShaderiv(shader, pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+String CanvasRenderingContext3D::getShaderInfoLog(CanvasShader* shader)
+{
+    String s = m_context.getShaderInfoLog(shader);
+    cleanupAfterGraphicsCall(false);
+    return s;
+}
+
+String CanvasRenderingContext3D::getShaderSource(CanvasShader* shader)
+{
+    String s = m_context.getShaderSource(shader);
+    cleanupAfterGraphicsCall(false);
+    return s;
+}
+
+String CanvasRenderingContext3D::getString(unsigned long name)
+{
+    return m_context.getString(name);
+}
+
+float CanvasRenderingContext3D::getTexParameterf(unsigned long target, unsigned long pname)
+{
+    float result = m_context.getTexParameterf(target, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getTexParameterfv(unsigned long target, unsigned long pname)
+{
+    RefPtr<CanvasFloatArray> array = m_context.getTexParameterfv(target, pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+int CanvasRenderingContext3D::getTexParameteri(unsigned long target, unsigned long pname)
+{
+    int result = m_context.getTexParameteri(target, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getTexParameteriv(unsigned long target, unsigned long pname)
+{
+    RefPtr<CanvasIntArray> array = m_context.getTexParameteriv(target, pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+float CanvasRenderingContext3D::getUniformf(CanvasProgram* program, long location)
+{
+    float result = m_context.getUniformf(program, location);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getUniformfv(CanvasProgram* program, long location)
+{
+    RefPtr<CanvasFloatArray> array = m_context.getUniformfv(program, location);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+long CanvasRenderingContext3D::getUniformi(CanvasProgram* program, long location)
+{
+    long result = m_context.getUniformi(program, location);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getUniformiv(CanvasProgram* program, long location)
+{
+    RefPtr<CanvasIntArray> array = m_context.getUniformiv(program, location);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+long CanvasRenderingContext3D::getUniformLocation(CanvasProgram* program, const String& name)
+{
+    return m_context.getUniformLocation(program, name);
+}
+
+float CanvasRenderingContext3D::getVertexAttribf(unsigned long index, unsigned long pname)
+{
+    float result = m_context.getVertexAttribf(index, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getVertexAttribfv(unsigned long index, unsigned long pname)
+{
+    RefPtr<CanvasFloatArray> array = m_context.getVertexAttribfv(index, pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+long CanvasRenderingContext3D::getVertexAttribi(unsigned long index, unsigned long pname)
+{
+    long result = m_context.getVertexAttribi(index, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getVertexAttribiv(unsigned long index, unsigned long pname)
+{
+    RefPtr<CanvasIntArray> array = m_context.getVertexAttribiv(index, pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+long CanvasRenderingContext3D::getVertexAttribOffset(unsigned long index, unsigned long pname)
+{
+    long result = m_context.getVertexAttribOffset(index, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+void CanvasRenderingContext3D::hint(unsigned long target, unsigned long mode)
+{
+    m_context.hint(target, mode);
+    cleanupAfterGraphicsCall(false);
+}
+
+bool CanvasRenderingContext3D::isBuffer(CanvasBuffer* buffer)
+{
+    if (!buffer)
+        return false;
+        
+    return m_context.isBuffer(buffer);
+}
+
+bool CanvasRenderingContext3D::isEnabled(unsigned long cap)
+{
+    return m_context.isEnabled(cap);
+}
+
+bool CanvasRenderingContext3D::isFramebuffer(CanvasFramebuffer* framebuffer)
+{
+    return m_context.isFramebuffer(framebuffer);
+}
+
+bool CanvasRenderingContext3D::isProgram(CanvasProgram* program)
+{
+    return m_context.isProgram(program);
+}
+
+bool CanvasRenderingContext3D::isRenderbuffer(CanvasRenderbuffer* renderbuffer)
+{
+    return m_context.isRenderbuffer(renderbuffer);
+}
+
+bool CanvasRenderingContext3D::isShader(CanvasShader* shader)
+{
+    return m_context.isShader(shader);
+}
+
+bool CanvasRenderingContext3D::isTexture(CanvasTexture* texture)
+{
+    return m_context.isTexture(texture);
+}
+
+void CanvasRenderingContext3D::lineWidth(double width)
+{
+    m_context.lineWidth((float) width);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::linkProgram(CanvasProgram* program)
+{
+    if (!program)
+        return;
+        
+    m_context.linkProgram(program);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::pixelStorei(unsigned long pname, long param)
+{
+    m_context.pixelStorei(pname, param);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::polygonOffset(double factor, double units)
+{
+    m_context.polygonOffset((float) factor, (float) units);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::releaseShaderCompiler()
+{
+    m_context.releaseShaderCompiler();
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height)
+{
+    m_context.renderbufferStorage(target, internalformat, width, height);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::sampleCoverage(double value, bool invert)
+{
+    m_context.sampleCoverage((float) value, invert);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::scissor(long x, long y, unsigned long width, unsigned long height)
+{
+    m_context.scissor(x, y, width, height);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::shaderSource(CanvasShader* shader, const String& string)
+{
+    m_context.shaderSource(shader, string);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::stencilFunc(unsigned long func, long ref, unsigned long mask)
+{
+    m_context.stencilFunc(func, ref, mask);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask)
+{
+    m_context.stencilFuncSeparate(face, func, ref, mask);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::stencilMask(unsigned long mask)
+{
+    m_context.stencilMask(mask);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::stencilMaskSeparate(unsigned long face, unsigned long mask)
+{
+    m_context.stencilMaskSeparate(face, mask);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::stencilOp(unsigned long fail, unsigned long zfail, unsigned long zpass)
+{
+    m_context.stencilOp(fail, zfail, zpass);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::stencilOpSeparate(unsigned long face, unsigned long fail, unsigned long zfail, unsigned long zpass)
+{
+    m_context.stencilOpSeparate(face, fail, zfail, zpass);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, unsigned internalformat,
+                                          unsigned width, unsigned height, unsigned border,
+                                          unsigned format, unsigned type, CanvasArray* pixels, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texImage2D(target, level, internalformat, width, height,
+                         border, format, type, pixels);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, unsigned internalformat,
+                                          unsigned width, unsigned height, unsigned border,
+                                          unsigned format, unsigned type, ImageData* pixels, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texImage2D(target, level, internalformat, width, height,
+                         border, format, type, pixels);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, HTMLImageElement* image,
+                                          bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texImage2D(target, level, image, flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, HTMLCanvasElement* canvas,
+                                          bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texImage2D(target, level, canvas, flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, HTMLVideoElement* video,
+                                          bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texImage2D(target, level, video, flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texParameterf(unsigned target, unsigned pname, float param)
+{
+    m_context.texParameterf(target, pname, param);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texParameteri(unsigned target, unsigned pname, int param)
+{
+    m_context.texParameteri(target, pname, param);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                             unsigned width, unsigned height,
+                                             unsigned format, unsigned type, CanvasArray* pixels, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texSubImage2D(target, level, xoffset, yoffset, width, height, format, type, pixels);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                             unsigned width, unsigned height,
+                                             unsigned format, unsigned type, ImageData* pixels, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texSubImage2D(target, level, xoffset, yoffset, width, height, format, type, pixels);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                             unsigned width, unsigned height, HTMLImageElement* image,
+                                             bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texSubImage2D(target, level, xoffset, yoffset, width, height, image, flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                             unsigned width, unsigned height, HTMLCanvasElement* canvas,
+                                             bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texSubImage2D(target, level, xoffset, yoffset, width, height, canvas, flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                             unsigned width, unsigned height, HTMLVideoElement* video,
+                                             bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texSubImage2D(target, level, xoffset, yoffset, width, height, video, flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform1f(long location, float x)
+{
+    m_context.uniform1f(location, x);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform1fv(long location, CanvasFloatArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    m_context.uniform1fv(location, v->data(), v->length());
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform1fv(long location, float* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    m_context.uniform1fv(location, v, size);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform1i(long location, int x)
+{
+    m_context.uniform1i(location, x);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform1iv(long location, CanvasIntArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    m_context.uniform1iv(location, v->data(), v->length());
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform1iv(long location, int* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    m_context.uniform1iv(location, v, size);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform2f(long location, float x, float y)
+{
+    m_context.uniform2f(location, x, y);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform2fv(long location, CanvasFloatArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 2
+    m_context.uniform2fv(location, v->data(), v->length() / 2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform2fv(long location, float* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 2
+    m_context.uniform2fv(location, v, size / 2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform2i(long location, int x, int y)
+{
+    m_context.uniform2i(location, x, y);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform2iv(long location, CanvasIntArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 2
+    m_context.uniform2iv(location, v->data(), v->length() / 2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform2iv(long location, int* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 2
+    m_context.uniform2iv(location, v, size / 2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform3f(long location, float x, float y, float z)
+{
+    m_context.uniform3f(location, x, y, z);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform3fv(long location, CanvasFloatArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 3
+    m_context.uniform3fv(location, v->data(), v->length() / 3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform3fv(long location, float* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 3
+    m_context.uniform3fv(location, v, size / 3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform3i(long location, int x, int y, int z)
+{
+    m_context.uniform3i(location, x, y, z);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform3iv(long location, CanvasIntArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 3
+    m_context.uniform3iv(location, v->data(), v->length() / 3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform3iv(long location, int* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 3
+    m_context.uniform3iv(location, v, size / 3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform4f(long location, float x, float y, float z, float w)
+{
+    m_context.uniform4f(location, x, y, z, w);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform4fv(long location, CanvasFloatArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 4
+    m_context.uniform4fv(location, v->data(), v->length() / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform4fv(long location, float* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 4
+    m_context.uniform4fv(location, v, size / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform4i(long location, int x, int y, int z, int w)
+{
+    m_context.uniform4i(location, x, y, z, w);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform4iv(long location, CanvasIntArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 4
+    m_context.uniform4iv(location, v->data(), v->length() / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform4iv(long location, int* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 4
+    m_context.uniform4iv(location, v, size / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniformMatrix2fv(long location, bool transpose, CanvasFloatArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 4
+    m_context.uniformMatrix2fv(location, transpose, v->data(), v->length() / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniformMatrix2fv(long location, bool transpose, float* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 4
+    m_context.uniformMatrix2fv(location, transpose, v, size / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniformMatrix3fv(long location, bool transpose, CanvasFloatArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 9
+    m_context.uniformMatrix3fv(location, transpose, v->data(), v->length() / 9);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniformMatrix3fv(long location, bool transpose, float* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 9
+    m_context.uniformMatrix3fv(location, transpose, v, size / 9);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniformMatrix4fv(long location, bool transpose, CanvasFloatArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 16
+    m_context.uniformMatrix4fv(location, transpose, v->data(), v->length() / 16);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniformMatrix4fv(long location, bool transpose, float* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 16
+    m_context.uniformMatrix4fv(location, transpose, v, size / 16);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::useProgram(CanvasProgram* program)
+{
+    m_context.useProgram(program);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::validateProgram(CanvasProgram* program)
+{
+    m_context.validateProgram(program);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib1f(unsigned long indx, float v0)
+{
+    m_context.vertexAttrib1f(indx, v0);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib1fv(unsigned long indx, CanvasFloatArray* v)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    m_context.vertexAttrib1fv(indx, v->data());
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib1fv(unsigned long indx, float* v, int size)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    UNUSED_PARAM(size);
+    
+    m_context.vertexAttrib1fv(indx, v);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib2f(unsigned long indx, float v0, float v1)
+{
+    m_context.vertexAttrib2f(indx, v0, v1);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib2fv(unsigned long indx, CanvasFloatArray* v)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    m_context.vertexAttrib2fv(indx, v->data());
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib2fv(unsigned long indx, float* v, int size)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    UNUSED_PARAM(size);
+    
+    m_context.vertexAttrib2fv(indx, v);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib3f(unsigned long indx, float v0, float v1, float v2)
+{
+    m_context.vertexAttrib3f(indx, v0, v1, v2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib3fv(unsigned long indx, CanvasFloatArray* v)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    m_context.vertexAttrib3fv(indx, v->data());
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib3fv(unsigned long indx, float* v, int size)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    UNUSED_PARAM(size);
+    
+    m_context.vertexAttrib3fv(indx, v);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib4f(unsigned long indx, float v0, float v1, float v2, float v3)
+{
+    m_context.vertexAttrib4f(indx, v0, v1, v2, v3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib4fv(unsigned long indx, CanvasFloatArray* v)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    m_context.vertexAttrib4fv(indx, v->data());
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib4fv(unsigned long indx, float* v, int size)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    UNUSED_PARAM(size);
+    
+    m_context.vertexAttrib4fv(indx, v);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttribPointer(unsigned long indx, long size, unsigned long type, bool normalized, unsigned long stride, unsigned long offset)
+{
+    m_context.vertexAttribPointer(indx, size, type, normalized, stride, offset);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::viewport(long x, long y, unsigned long width, unsigned long height)
+{
+    if (isnan(x))
+        x = 0;
+    if (isnan(y))
+        y = 0;
+    if (isnan(width))
+        width = 100;
+    if (isnan(height))
+        height = 100;
+    m_context.viewport(x, y, width, height);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::removeObject(CanvasObject* object)
+{
+    m_canvasObjects.remove(object);
+}
+
+void CanvasRenderingContext3D::addObject(CanvasObject* object)
+{
+    removeObject(object);
+    m_canvasObjects.add(object);
+}
+
+void CanvasRenderingContext3D::detachAndRemoveAllObjects()
+{
+    HashSet<CanvasObject*>::iterator pend = m_canvasObjects.end();
+    for (HashSet<CanvasObject*>::iterator it = m_canvasObjects.begin(); it != pend; ++it)
+        (*it)->detachContext();
+        
+    m_canvasObjects.clear();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
+
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.h
new file mode 100644
index 0000000..a4a68fc
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.h
@@ -0,0 +1,321 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasRenderingContext3D_h
+#define CanvasRenderingContext3D_h
+
+#include "CanvasRenderingContext.h"
+#include "ExceptionCode.h"
+#include "CanvasFloatArray.h"
+#include "CanvasIntArray.h"
+#include "CanvasUnsignedByteArray.h"
+#include "GraphicsContext3D.h"
+#include "PlatformString.h"
+
+namespace WebCore {
+
+class CanvasBuffer;
+class CanvasFramebuffer;
+class CanvasObject;
+class CanvasProgram;
+class CanvasRenderbuffer;
+class CanvasShader;
+class CanvasTexture;
+class HTMLImageElement;
+class HTMLVideoElement;
+class ImageData;
+class WebKitCSSMatrix;
+
+    class CanvasRenderingContext3D : public CanvasRenderingContext {
+    public:
+        CanvasRenderingContext3D(HTMLCanvasElement*);
+        ~CanvasRenderingContext3D();
+
+        virtual bool is3d() const { return true; }
+
+        // Helper to return the size in bytes of OpenGL data types
+        // like GL_FLOAT, GL_INT, etc.
+        int sizeInBytes(int type, ExceptionCode& ec);
+
+        void activeTexture(unsigned long texture);
+        void attachShader(CanvasProgram*, CanvasShader*);
+        void bindAttribLocation(CanvasProgram*, unsigned long index, const String& name);
+        void bindBuffer(unsigned long target, CanvasBuffer*);
+        void bindFramebuffer(unsigned long target, CanvasFramebuffer*);
+        void bindRenderbuffer(unsigned long target, CanvasRenderbuffer*);
+        void bindTexture(unsigned long target, CanvasTexture*);
+        void blendColor(double red, double green, double blue, double alpha);
+        void blendEquation(unsigned long mode);
+        void blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha);
+        void blendFunc(unsigned long sfactor, unsigned long dfactor);
+        void blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha);
+
+        void bufferData(unsigned long target, int size, unsigned long usage);
+        void bufferData(unsigned long target, CanvasArray* data, unsigned long usage);
+        void bufferSubData(unsigned long target, long offset, CanvasArray* data);
+
+        unsigned long checkFramebufferStatus(unsigned long target);
+        void clear(unsigned long mask);
+        void clearColor(double red, double green, double blue, double alpha);
+        void clearDepth(double);
+        void clearStencil(long);
+        void colorMask(bool red, bool green, bool blue, bool alpha);
+        void compileShader(CanvasShader*);
+        
+        //void compressedTexImage2D(unsigned long target, long level, unsigned long internalformat, unsigned long width, unsigned long height, long border, unsigned long imageSize, const void* data);
+        //void compressedTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, unsigned long width, unsigned long height, unsigned long format, unsigned long imageSize, const void* data);
+        
+        void copyTexImage2D(unsigned long target, long level, unsigned long internalformat, long x, long y, unsigned long width, unsigned long height, long border);
+        void copyTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, long x, long y, unsigned long width, unsigned long height);
+
+        PassRefPtr<CanvasBuffer> createBuffer();
+        PassRefPtr<CanvasFramebuffer> createFramebuffer();
+        PassRefPtr<CanvasProgram> createProgram();
+        PassRefPtr<CanvasRenderbuffer> createRenderbuffer();
+        PassRefPtr<CanvasShader> createShader(unsigned long type);
+        PassRefPtr<CanvasTexture> createTexture();
+
+        void cullFace(unsigned long mode);
+
+        void deleteBuffer(CanvasBuffer*);
+        void deleteFramebuffer(CanvasFramebuffer*);
+        void deleteProgram(CanvasProgram*);
+        void deleteRenderbuffer(CanvasRenderbuffer*);
+        void deleteShader(CanvasShader*);
+        void deleteTexture(CanvasTexture*);
+        
+        void depthFunc(unsigned long);
+        void depthMask(bool);
+        void depthRange(double zNear, double zFar);
+        void detachShader(CanvasProgram*, CanvasShader*);
+        void disable(unsigned long cap);
+        void disableVertexAttribArray(unsigned long index);
+        void drawArrays(unsigned long mode, long first, long count);
+        void drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset);
+
+        void enable(unsigned long cap);
+        void enableVertexAttribArray(unsigned long index);
+        void finish();
+        void flush();
+        void framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, CanvasRenderbuffer*);
+        void framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, CanvasTexture*, long level);
+        void frontFace(unsigned long mode);
+        void generateMipmap(unsigned long target);
+        
+        int  getAttribLocation(CanvasProgram*, const String& name);
+
+        bool getBoolean(unsigned long pname);
+        PassRefPtr<CanvasUnsignedByteArray> getBooleanv(unsigned long pname);
+        int getBufferParameteri(unsigned long target, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getBufferParameteriv(unsigned long target, unsigned long pname);
+
+        unsigned long getError();
+
+        float getFloat(unsigned long pname);
+        PassRefPtr<CanvasFloatArray> getFloatv(unsigned long pname);
+        int getFramebufferAttachmentParameteri(unsigned long target, unsigned long attachment, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long pname);
+        int getInteger(unsigned long pname);
+        PassRefPtr<CanvasIntArray> getIntegerv(unsigned long pname);
+        int getProgrami(CanvasProgram*, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getProgramiv(CanvasProgram*, unsigned long pname);
+        String getProgramInfoLog(CanvasProgram*);
+        int getRenderbufferParameteri(unsigned long target, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getRenderbufferParameteriv(unsigned long target, unsigned long pname);
+        int getShaderi(CanvasShader*, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getShaderiv(CanvasShader*, unsigned long pname);
+
+        String getShaderInfoLog(CanvasShader*);
+
+        // TBD
+        // void glGetShaderPrecisionFormat (GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision);
+
+        String getShaderSource(CanvasShader*);
+        String getString(unsigned long name);
+
+        float getTexParameterf(unsigned long target, unsigned long pname);
+        PassRefPtr<CanvasFloatArray> getTexParameterfv(unsigned long target, unsigned long pname);
+        int getTexParameteri(unsigned long target, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getTexParameteriv(unsigned long target, unsigned long pname);
+
+        float getUniformf(CanvasProgram* program, long location);
+        PassRefPtr<CanvasFloatArray> getUniformfv(CanvasProgram* program, long location);
+        long getUniformi(CanvasProgram* program, long location);
+        PassRefPtr<CanvasIntArray> getUniformiv(CanvasProgram* program, long location);
+
+        long getUniformLocation(CanvasProgram*, const String& name);
+
+        float getVertexAttribf(unsigned long index, unsigned long pname);
+        PassRefPtr<CanvasFloatArray> getVertexAttribfv(unsigned long index, unsigned long pname);
+        long getVertexAttribi(unsigned long index, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getVertexAttribiv(unsigned long index, unsigned long pname);
+
+        long getVertexAttribOffset(unsigned long index, unsigned long pname);
+
+        void hint(unsigned long target, unsigned long mode);
+        bool isBuffer(CanvasBuffer*);
+        bool isEnabled(unsigned long cap);
+        bool isFramebuffer(CanvasFramebuffer*);
+        bool isProgram(CanvasProgram*);
+        bool isRenderbuffer(CanvasRenderbuffer*);
+        bool isShader(CanvasShader*);
+        bool isTexture(CanvasTexture*);
+        void lineWidth(double);
+        void linkProgram(CanvasProgram*);
+        void pixelStorei(unsigned long pname, long param);
+        void polygonOffset(double factor, double units);
+        
+        // TBD
+        //void readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type, void* pixels);
+        
+        void releaseShaderCompiler();
+        void renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height);
+        void sampleCoverage(double value, bool invert);
+        void scissor(long x, long y, unsigned long width, unsigned long height);
+        void shaderSource(CanvasShader*, const String&);
+        void stencilFunc(unsigned long func, long ref, unsigned long mask);
+        void stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask);
+        void stencilMask(unsigned long);
+        void stencilMaskSeparate(unsigned long face, unsigned long mask);
+        void stencilOp(unsigned long fail, unsigned long zfail, unsigned long zpass);
+        void stencilOpSeparate(unsigned long face, unsigned long fail, unsigned long zfail, unsigned long zpass);
+
+        void texImage2D(unsigned target, unsigned level, unsigned internalformat,
+                        unsigned width, unsigned height, unsigned border,
+                        unsigned format, unsigned type, CanvasArray* pixels, ExceptionCode&);
+        void texImage2D(unsigned target, unsigned level, unsigned internalformat,
+                        unsigned width, unsigned height, unsigned border,
+                        unsigned format, unsigned type, ImageData* pixels, ExceptionCode&);
+        void texImage2D(unsigned target, unsigned level, HTMLImageElement* image,
+                        bool flipY, bool premultiplyAlpha, ExceptionCode&);
+        void texImage2D(unsigned target, unsigned level, HTMLCanvasElement* canvas,
+                        bool flipY, bool premultiplyAlpha, ExceptionCode&);
+        void texImage2D(unsigned target, unsigned level, HTMLVideoElement* video,
+                        bool flipY, bool premultiplyAlpha, ExceptionCode&);
+
+        void texParameterf(unsigned target, unsigned pname, float param);
+        void texParameteri(unsigned target, unsigned pname, int param);
+
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           unsigned width, unsigned height,
+                           unsigned format, unsigned type, CanvasArray* pixels, ExceptionCode&);
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           unsigned width, unsigned height,
+                           unsigned format, unsigned type, ImageData* pixels, ExceptionCode&);
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           unsigned width, unsigned height, HTMLImageElement* image,
+                           bool flipY, bool premultiplyAlpha, ExceptionCode&);
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           unsigned width, unsigned height, HTMLCanvasElement* canvas,
+                           bool flipY, bool premultiplyAlpha, ExceptionCode&);
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           unsigned width, unsigned height, HTMLVideoElement* video,
+                           bool flipY, bool premultiplyAlpha, ExceptionCode&);
+
+        void uniform1f(long location, float x);
+        void uniform1fv(long location, CanvasFloatArray* v);
+        void uniform1fv(long location, float* v, int size);
+        void uniform1i(long location, int x);
+        void uniform1iv(long location, CanvasIntArray* v);
+        void uniform1iv(long location, int* v, int size);
+        void uniform2f(long location, float x, float y);
+        void uniform2fv(long location, CanvasFloatArray* v);
+        void uniform2fv(long location, float* v, int size);
+        void uniform2i(long location, int x, int y);
+        void uniform2iv(long location, CanvasIntArray* v);
+        void uniform2iv(long location, int* v, int size);
+        void uniform3f(long location, float x, float y, float z);
+        void uniform3fv(long location, CanvasFloatArray* v);
+        void uniform3fv(long location, float* v, int size);
+        void uniform3i(long location, int x, int y, int z);
+        void uniform3iv(long location, CanvasIntArray* v);
+        void uniform3iv(long location, int* v, int size);
+        void uniform4f(long location, float x, float y, float z, float w);
+        void uniform4fv(long location, CanvasFloatArray* v);
+        void uniform4fv(long location, float* v, int size);
+        void uniform4i(long location, int x, int y, int z, int w);
+        void uniform4iv(long location, CanvasIntArray* v);
+        void uniform4iv(long location, int* v, int size);
+        void uniformMatrix2fv(long location, bool transpose, CanvasFloatArray* value);
+        void uniformMatrix2fv(long location, bool transpose, float* value, int size);
+        void uniformMatrix3fv(long location, bool transpose, CanvasFloatArray* value);
+        void uniformMatrix3fv(long location, bool transpose, float* value, int size);
+        void uniformMatrix4fv(long location, bool transpose, CanvasFloatArray* value);
+        void uniformMatrix4fv(long location, bool transpose, float* value, int size);
+
+        void useProgram(CanvasProgram*);
+        void validateProgram(CanvasProgram*);
+
+        void vertexAttrib1f(unsigned long indx, float x);
+        void vertexAttrib1fv(unsigned long indx, CanvasFloatArray* values);
+        void vertexAttrib1fv(unsigned long indx, float* values, int size);
+        void vertexAttrib2f(unsigned long indx, float x, float y);
+        void vertexAttrib2fv(unsigned long indx, CanvasFloatArray* values);
+        void vertexAttrib2fv(unsigned long indx, float* values, int size);
+        void vertexAttrib3f(unsigned long indx, float x, float y, float z);
+        void vertexAttrib3fv(unsigned long indx, CanvasFloatArray* values);
+        void vertexAttrib3fv(unsigned long indx, float* values, int size);
+        void vertexAttrib4f(unsigned long indx, float x, float y, float z, float w);
+        void vertexAttrib4fv(unsigned long indx, CanvasFloatArray* values);
+        void vertexAttrib4fv(unsigned long indx, float* values, int size);
+        void vertexAttribPointer(unsigned long indx, long size, unsigned long type, bool normalized,
+                                 unsigned long stride, unsigned long offset);
+
+        void viewport(long x, long y, unsigned long width, unsigned long height);
+
+        GraphicsContext3D* graphicsContext3D() { return &m_context; }
+    
+        void reshape(int width, int height);
+
+        // Helpers for notification about paint events.
+        void beginPaint();
+        void endPaint();
+        
+        void removeObject(CanvasObject*);
+        
+    private:
+        friend class CanvasObject;
+        void addObject(CanvasObject*);
+        void detachAndRemoveAllObjects();
+
+        void markContextChanged();
+        void cleanupAfterGraphicsCall(bool changed)
+        {
+            m_context.checkError();
+            if (changed)
+                markContextChanged();
+        }
+        
+        GraphicsContext3D m_context;
+        bool m_needsUpdate;
+        bool m_markedCanvasDirty;
+        // FIXME: I think this is broken -- it does not increment any
+        // reference counts, so may refer to destroyed objects.
+        HashSet<CanvasObject*> m_canvasObjects;
+    };
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.idl
new file mode 100644
index 0000000..4b9a889
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext3D.idl
@@ -0,0 +1,687 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+
+    interface [
+        Conditional=3D_CANVAS,
+        GenerateConstructor,
+        InterfaceUUID=98fb48ae-7216-489c-862b-8e1217fc4443,
+        ImplementationUUID=ab4f0781-152f-450e-9546-5b3987491a54
+    ] CanvasRenderingContext3D : CanvasRenderingContext {
+
+        /* ClearBufferMask */
+        const unsigned int DEPTH_BUFFER_BIT               = 0x00000100;
+        const unsigned int STENCIL_BUFFER_BIT             = 0x00000400;
+        const unsigned int COLOR_BUFFER_BIT               = 0x00004000;
+
+        /* Boolean */
+        const unsigned int FALSE                          = 0;
+        const unsigned int TRUE                           = 1;
+
+        /* BeginMode */
+        const unsigned int POINTS                         = 0x0000;
+        const unsigned int LINES                          = 0x0001;
+        const unsigned int LINE_LOOP                      = 0x0002;
+        const unsigned int LINE_STRIP                     = 0x0003;
+        const unsigned int TRIANGLES                      = 0x0004;
+        const unsigned int TRIANGLE_STRIP                 = 0x0005;
+        const unsigned int TRIANGLE_FAN                   = 0x0006;
+
+        /* AlphaFunction (not supported in ES20) */
+        /*      NEVER */
+        /*      LESS */
+        /*      EQUAL */
+        /*      LEQUAL */
+        /*      GREATER */
+        /*      NOTEQUAL */
+        /*      GEQUAL */
+        /*      ALWAYS */
+
+        /* BlendingFactorDest */
+        const unsigned int ZERO                           = 0;
+        const unsigned int ONE                            = 1;
+        const unsigned int SRC_COLOR                      = 0x0300;
+        const unsigned int ONE_MINUS_SRC_COLOR            = 0x0301;
+        const unsigned int SRC_ALPHA                      = 0x0302;
+        const unsigned int ONE_MINUS_SRC_ALPHA            = 0x0303;
+        const unsigned int DST_ALPHA                      = 0x0304;
+        const unsigned int ONE_MINUS_DST_ALPHA            = 0x0305;
+
+        /* BlendingFactorSrc */
+        /*      ZERO */
+        /*      ONE */
+        const unsigned int DST_COLOR                      = 0x0306;
+        const unsigned int ONE_MINUS_DST_COLOR            = 0x0307;
+        const unsigned int SRC_ALPHA_SATURATE             = 0x0308;
+        /*      SRC_ALPHA */
+        /*      ONE_MINUS_SRC_ALPHA */
+        /*      DST_ALPHA */
+        /*      ONE_MINUS_DST_ALPHA */
+
+        /* BlendEquationSeparate */
+        const unsigned int FUNC_ADD                       = 0x8006;
+        const unsigned int BLEND_EQUATION                 = 0x8009;
+        const unsigned int BLEND_EQUATION_RGB             = 0x8009;   /* same as BLEND_EQUATION */
+        const unsigned int BLEND_EQUATION_ALPHA           = 0x883D;
+
+        /* BlendSubtract */
+        const unsigned int FUNC_SUBTRACT                  = 0x800A;
+        const unsigned int FUNC_REVERSE_SUBTRACT          = 0x800B;
+
+        /* Separate Blend Functions */
+        const unsigned int BLEND_DST_RGB                  = 0x80C8;
+        const unsigned int BLEND_SRC_RGB                  = 0x80C9;
+        const unsigned int BLEND_DST_ALPHA                = 0x80CA;
+        const unsigned int BLEND_SRC_ALPHA                = 0x80CB;
+        const unsigned int CONSTANT_COLOR                 = 0x8001;
+        const unsigned int ONE_MINUS_CONSTANT_COLOR       = 0x8002;
+        const unsigned int CONSTANT_ALPHA                 = 0x8003;
+        const unsigned int ONE_MINUS_CONSTANT_ALPHA       = 0x8004;
+        const unsigned int BLEND_COLOR                    = 0x8005;
+
+        /* Buffer Objects */
+        const unsigned int ARRAY_BUFFER                   = 0x8892;
+        const unsigned int ELEMENT_ARRAY_BUFFER           = 0x8893;
+        const unsigned int ARRAY_BUFFER_BINDING           = 0x8894;
+        const unsigned int ELEMENT_ARRAY_BUFFER_BINDING   = 0x8895;
+
+        const unsigned int STREAM_DRAW                    = 0x88E0;
+        const unsigned int STATIC_DRAW                    = 0x88E4;
+        const unsigned int DYNAMIC_DRAW                   = 0x88E8;
+
+        const unsigned int BUFFER_SIZE                    = 0x8764;
+        const unsigned int BUFFER_USAGE                   = 0x8765;
+
+        const unsigned int CURRENT_VERTEX_ATTRIB          = 0x8626;
+
+        /* CullFaceMode */
+        const unsigned int FRONT                          = 0x0404;
+        const unsigned int BACK                           = 0x0405;
+        const unsigned int FRONT_AND_BACK                 = 0x0408;
+
+        /* DepthFunction */
+        /*      NEVER */
+        /*      LESS */
+        /*      EQUAL */
+        /*      LEQUAL */
+        /*      GREATER */
+        /*      NOTEQUAL */
+        /*      GEQUAL */
+        /*      ALWAYS */
+
+        /* EnableCap */
+        const unsigned int TEXTURE_2D                     = 0x0DE1;
+        const unsigned int CULL_FACE                      = 0x0B44;
+        const unsigned int BLEND                          = 0x0BE2;
+        const unsigned int DITHER                         = 0x0BD0;
+        const unsigned int STENCIL_TEST                   = 0x0B90;
+        const unsigned int DEPTH_TEST                     = 0x0B71;
+        const unsigned int SCISSOR_TEST                   = 0x0C11;
+        const unsigned int POLYGON_OFFSET_FILL            = 0x8037;
+        const unsigned int SAMPLE_ALPHA_TO_COVERAGE       = 0x809E;
+        const unsigned int SAMPLE_COVERAGE                = 0x80A0;
+
+        /* ErrorCode */
+        const unsigned int NO_ERROR                       = 0;
+        const unsigned int INVALID_ENUM                   = 0x0500;
+        const unsigned int INVALID_VALUE                  = 0x0501;
+        const unsigned int INVALID_OPERATION              = 0x0502;
+        const unsigned int OUT_OF_MEMORY                  = 0x0505;
+
+        /* FrontFaceDirection */
+        const unsigned int CW                             = 0x0900;
+        const unsigned int CCW                            = 0x0901;
+
+        /* GetPName */
+        const unsigned int LINE_WIDTH                     = 0x0B21;
+        const unsigned int ALIASED_POINT_SIZE_RANGE       = 0x846D;
+        const unsigned int ALIASED_LINE_WIDTH_RANGE       = 0x846E;
+        const unsigned int CULL_FACE_MODE                 = 0x0B45;
+        const unsigned int FRONT_FACE                     = 0x0B46;
+        const unsigned int DEPTH_RANGE                    = 0x0B70;
+        const unsigned int DEPTH_WRITEMASK                = 0x0B72;
+        const unsigned int DEPTH_CLEAR_VALUE              = 0x0B73;
+        const unsigned int DEPTH_FUNC                     = 0x0B74;
+        const unsigned int STENCIL_CLEAR_VALUE            = 0x0B91;
+        const unsigned int STENCIL_FUNC                   = 0x0B92;
+        const unsigned int STENCIL_FAIL                   = 0x0B94;
+        const unsigned int STENCIL_PASS_DEPTH_FAIL        = 0x0B95;
+        const unsigned int STENCIL_PASS_DEPTH_PASS        = 0x0B96;
+        const unsigned int STENCIL_REF                    = 0x0B97;
+        const unsigned int STENCIL_VALUE_MASK             = 0x0B93;
+        const unsigned int STENCIL_WRITEMASK              = 0x0B98;
+        const unsigned int STENCIL_BACK_FUNC              = 0x8800;
+        const unsigned int STENCIL_BACK_FAIL              = 0x8801;
+        const unsigned int STENCIL_BACK_PASS_DEPTH_FAIL   = 0x8802;
+        const unsigned int STENCIL_BACK_PASS_DEPTH_PASS   = 0x8803;
+        const unsigned int STENCIL_BACK_REF               = 0x8CA3;
+        const unsigned int STENCIL_BACK_VALUE_MASK        = 0x8CA4;
+        const unsigned int STENCIL_BACK_WRITEMASK         = 0x8CA5;
+        const unsigned int VIEWPORT                       = 0x0BA2;
+        const unsigned int SCISSOR_BOX                    = 0x0C10;
+        /*      SCISSOR_TEST */
+        const unsigned int COLOR_CLEAR_VALUE              = 0x0C22;
+        const unsigned int COLOR_WRITEMASK                = 0x0C23;
+        const unsigned int UNPACK_ALIGNMENT               = 0x0CF5;
+        const unsigned int PACK_ALIGNMENT                 = 0x0D05;
+        const unsigned int MAX_TEXTURE_SIZE               = 0x0D33;
+        const unsigned int MAX_VIEWPORT_DIMS              = 0x0D3A;
+        const unsigned int SUBPIXEL_BITS                  = 0x0D50;
+        const unsigned int RED_BITS                       = 0x0D52;
+        const unsigned int GREEN_BITS                     = 0x0D53;
+        const unsigned int BLUE_BITS                      = 0x0D54;
+        const unsigned int ALPHA_BITS                     = 0x0D55;
+        const unsigned int DEPTH_BITS                     = 0x0D56;
+        const unsigned int STENCIL_BITS                   = 0x0D57;
+        const unsigned int POLYGON_OFFSET_UNITS           = 0x2A00;
+        /*      POLYGON_OFFSET_FILL */
+        const unsigned int POLYGON_OFFSET_FACTOR          = 0x8038;
+        const unsigned int TEXTURE_BINDING_2D             = 0x8069;
+        const unsigned int SAMPLE_BUFFERS                 = 0x80A8;
+        const unsigned int SAMPLES                        = 0x80A9;
+        const unsigned int SAMPLE_COVERAGE_VALUE          = 0x80AA;
+        const unsigned int SAMPLE_COVERAGE_INVERT         = 0x80AB;
+
+        /* GetTextureParameter */
+        /*      TEXTURE_MAG_FILTER */
+        /*      TEXTURE_MIN_FILTER */
+        /*      TEXTURE_WRAP_S */
+        /*      TEXTURE_WRAP_T */
+
+        const unsigned int NUM_COMPRESSED_TEXTURE_FORMATS = 0x86A2;
+        const unsigned int COMPRESSED_TEXTURE_FORMATS     = 0x86A3;
+
+        /* HintMode */
+        const unsigned int DONT_CARE                      = 0x1100;
+        const unsigned int FASTEST                        = 0x1101;
+        const unsigned int NICEST                         = 0x1102;
+
+        /* HintTarget */
+        const unsigned int GENERATE_MIPMAP_HINT            = 0x8192;
+
+        /* DataType */
+        const unsigned int BYTE                           = 0x1400;
+        const unsigned int UNSIGNED_BYTE                  = 0x1401;
+        const unsigned int SHORT                          = 0x1402;
+        const unsigned int UNSIGNED_SHORT                 = 0x1403;
+        const unsigned int INT                            = 0x1404;
+        const unsigned int UNSIGNED_INT                   = 0x1405;
+        const unsigned int FLOAT                          = 0x1406;
+        const unsigned int FIXED                          = 0x140C;
+
+        /* PixelFormat */
+        const unsigned int DEPTH_COMPONENT                = 0x1902;
+        const unsigned int ALPHA                          = 0x1906;
+        const unsigned int RGB                            = 0x1907;
+        const unsigned int RGBA                           = 0x1908;
+        const unsigned int LUMINANCE                      = 0x1909;
+        const unsigned int LUMINANCE_ALPHA                = 0x190A;
+
+        /* PixelType */
+        /*      UNSIGNED_BYTE */
+        const unsigned int UNSIGNED_SHORT_4_4_4_4         = 0x8033;
+        const unsigned int UNSIGNED_SHORT_5_5_5_1         = 0x8034;
+        const unsigned int UNSIGNED_SHORT_5_6_5           = 0x8363;
+
+        /* Shaders */
+        const unsigned int FRAGMENT_SHADER                  = 0x8B30;
+        const unsigned int VERTEX_SHADER                    = 0x8B31;
+        const unsigned int MAX_VERTEX_ATTRIBS               = 0x8869;
+        const unsigned int MAX_VERTEX_UNIFORM_VECTORS       = 0x8DFB;
+        const unsigned int MAX_VARYING_VECTORS              = 0x8DFC;
+        const unsigned int MAX_COMBINED_TEXTURE_IMAGE_UNITS = 0x8B4D;
+        const unsigned int MAX_VERTEX_TEXTURE_IMAGE_UNITS   = 0x8B4C;
+        const unsigned int MAX_TEXTURE_IMAGE_UNITS          = 0x8872;
+        const unsigned int MAX_FRAGMENT_UNIFORM_VECTORS     = 0x8DFD;
+        const unsigned int SHADER_TYPE                      = 0x8B4F;
+        const unsigned int DELETE_STATUS                    = 0x8B80;
+        const unsigned int LINK_STATUS                      = 0x8B82;
+        const unsigned int VALIDATE_STATUS                  = 0x8B83;
+        const unsigned int ATTACHED_SHADERS                 = 0x8B85;
+        const unsigned int ACTIVE_UNIFORMS                  = 0x8B86;
+        const unsigned int ACTIVE_UNIFORM_MAX_LENGTH        = 0x8B87;
+        const unsigned int ACTIVE_ATTRIBUTES                = 0x8B89;
+        const unsigned int ACTIVE_ATTRIBUTE_MAX_LENGTH      = 0x8B8A;
+        const unsigned int SHADING_LANGUAGE_VERSION         = 0x8B8C;
+        const unsigned int CURRENT_PROGRAM                  = 0x8B8D;
+
+        /* StencilFunction */
+        const unsigned int NEVER                          = 0x0200;
+        const unsigned int LESS                           = 0x0201;
+        const unsigned int EQUAL                          = 0x0202;
+        const unsigned int LEQUAL                         = 0x0203;
+        const unsigned int GREATER                        = 0x0204;
+        const unsigned int NOTEQUAL                       = 0x0205;
+        const unsigned int GEQUAL                         = 0x0206;
+        const unsigned int ALWAYS                         = 0x0207;
+
+        /* StencilOp */
+        /*      ZERO */
+        const unsigned int KEEP                           = 0x1E00;
+        const unsigned int REPLACE                        = 0x1E01;
+        const unsigned int INCR                           = 0x1E02;
+        const unsigned int DECR                           = 0x1E03;
+        const unsigned int INVERT                         = 0x150A;
+        const unsigned int INCR_WRAP                      = 0x8507;
+        const unsigned int DECR_WRAP                      = 0x8508;
+
+        /* StringName */
+        const unsigned int VENDOR                         = 0x1F00;
+        const unsigned int RENDERER                       = 0x1F01;
+        const unsigned int VERSION                        = 0x1F02;
+        const unsigned int EXTENSIONS                     = 0x1F03;
+
+        /* TextureMagFilter */
+        const unsigned int NEAREST                        = 0x2600;
+        const unsigned int LINEAR                         = 0x2601;
+
+        /* TextureMinFilter */
+        /*      NEAREST */
+        /*      LINEAR */
+        const unsigned int NEAREST_MIPMAP_NEAREST         = 0x2700;
+        const unsigned int LINEAR_MIPMAP_NEAREST          = 0x2701;
+        const unsigned int NEAREST_MIPMAP_LINEAR          = 0x2702;
+        const unsigned int LINEAR_MIPMAP_LINEAR           = 0x2703;
+
+        /* TextureParameterName */
+        const unsigned int TEXTURE_MAG_FILTER             = 0x2800;
+        const unsigned int TEXTURE_MIN_FILTER             = 0x2801;
+        const unsigned int TEXTURE_WRAP_S                 = 0x2802;
+        const unsigned int TEXTURE_WRAP_T                 = 0x2803;
+
+        /* TextureTarget */
+        /*      TEXTURE_2D */
+        const unsigned int TEXTURE                        = 0x1702;
+
+        const unsigned int TEXTURE_CUBE_MAP               = 0x8513;
+        const unsigned int TEXTURE_BINDING_CUBE_MAP       = 0x8514;
+        const unsigned int TEXTURE_CUBE_MAP_POSITIVE_X    = 0x8515;
+        const unsigned int TEXTURE_CUBE_MAP_NEGATIVE_X    = 0x8516;
+        const unsigned int TEXTURE_CUBE_MAP_POSITIVE_Y    = 0x8517;
+        const unsigned int TEXTURE_CUBE_MAP_NEGATIVE_Y    = 0x8518;
+        const unsigned int TEXTURE_CUBE_MAP_POSITIVE_Z    = 0x8519;
+        const unsigned int TEXTURE_CUBE_MAP_NEGATIVE_Z    = 0x851A;
+        const unsigned int MAX_CUBE_MAP_TEXTURE_SIZE      = 0x851C;
+
+        /* TextureUnit */
+        const unsigned int TEXTURE0                       = 0x84C0;
+        const unsigned int TEXTURE1                       = 0x84C1;
+        const unsigned int TEXTURE2                       = 0x84C2;
+        const unsigned int TEXTURE3                       = 0x84C3;
+        const unsigned int TEXTURE4                       = 0x84C4;
+        const unsigned int TEXTURE5                       = 0x84C5;
+        const unsigned int TEXTURE6                       = 0x84C6;
+        const unsigned int TEXTURE7                       = 0x84C7;
+        const unsigned int TEXTURE8                       = 0x84C8;
+        const unsigned int TEXTURE9                       = 0x84C9;
+        const unsigned int TEXTURE10                      = 0x84CA;
+        const unsigned int TEXTURE11                      = 0x84CB;
+        const unsigned int TEXTURE12                      = 0x84CC;
+        const unsigned int TEXTURE13                      = 0x84CD;
+        const unsigned int TEXTURE14                      = 0x84CE;
+        const unsigned int TEXTURE15                      = 0x84CF;
+        const unsigned int TEXTURE16                      = 0x84D0;
+        const unsigned int TEXTURE17                      = 0x84D1;
+        const unsigned int TEXTURE18                      = 0x84D2;
+        const unsigned int TEXTURE19                      = 0x84D3;
+        const unsigned int TEXTURE20                      = 0x84D4;
+        const unsigned int TEXTURE21                      = 0x84D5;
+        const unsigned int TEXTURE22                      = 0x84D6;
+        const unsigned int TEXTURE23                      = 0x84D7;
+        const unsigned int TEXTURE24                      = 0x84D8;
+        const unsigned int TEXTURE25                      = 0x84D9;
+        const unsigned int TEXTURE26                      = 0x84DA;
+        const unsigned int TEXTURE27                      = 0x84DB;
+        const unsigned int TEXTURE28                      = 0x84DC;
+        const unsigned int TEXTURE29                      = 0x84DD;
+        const unsigned int TEXTURE30                      = 0x84DE;
+        const unsigned int TEXTURE31                      = 0x84DF;
+        const unsigned int ACTIVE_TEXTURE                 = 0x84E0;
+
+        /* TextureWrapMode */
+        const unsigned int REPEAT                         = 0x2901;
+        const unsigned int CLAMP_TO_EDGE                  = 0x812F;
+        const unsigned int MIRRORED_REPEAT                = 0x8370;
+
+        /* Uniform Types */
+        const unsigned int FLOAT_VEC2                     = 0x8B50;
+        const unsigned int FLOAT_VEC3                     = 0x8B51;
+        const unsigned int FLOAT_VEC4                     = 0x8B52;
+        const unsigned int INT_VEC2                       = 0x8B53;
+        const unsigned int INT_VEC3                       = 0x8B54;
+        const unsigned int INT_VEC4                       = 0x8B55;
+        const unsigned int BOOL                           = 0x8B56;
+        const unsigned int BOOL_VEC2                      = 0x8B57;
+        const unsigned int BOOL_VEC3                      = 0x8B58;
+        const unsigned int BOOL_VEC4                      = 0x8B59;
+        const unsigned int FLOAT_MAT2                     = 0x8B5A;
+        const unsigned int FLOAT_MAT3                     = 0x8B5B;
+        const unsigned int FLOAT_MAT4                     = 0x8B5C;
+        const unsigned int SAMPLER_2D                     = 0x8B5E;
+        const unsigned int SAMPLER_CUBE                   = 0x8B60;
+
+        /* Vertex Arrays */
+        const unsigned int VERTEX_ATTRIB_ARRAY_ENABLED        = 0x8622;
+        const unsigned int VERTEX_ATTRIB_ARRAY_SIZE           = 0x8623;
+        const unsigned int VERTEX_ATTRIB_ARRAY_STRIDE         = 0x8624;
+        const unsigned int VERTEX_ATTRIB_ARRAY_TYPE           = 0x8625;
+        const unsigned int VERTEX_ATTRIB_ARRAY_NORMALIZED     = 0x886A;
+        const unsigned int VERTEX_ATTRIB_ARRAY_POINTER        = 0x8645;
+        const unsigned int VERTEX_ATTRIB_ARRAY_BUFFER_BINDING = 0x889F;
+
+        /* Read Format */
+        const unsigned int IMPLEMENTATION_COLOR_READ_TYPE   = 0x8B9A;
+        const unsigned int IMPLEMENTATION_COLOR_READ_FORMAT = 0x8B9B;
+
+        /* Shader Source */
+        const unsigned int COMPILE_STATUS                 = 0x8B81;
+        const unsigned int INFO_LOG_LENGTH                = 0x8B84;
+        const unsigned int SHADER_SOURCE_LENGTH           = 0x8B88;
+        const unsigned int SHADER_COMPILER                = 0x8DFA;
+
+        /* Shader Binary */
+        const unsigned int SHADER_BINARY_FORMATS          = 0x8DF8;
+        const unsigned int NUM_SHADER_BINARY_FORMATS      = 0x8DF9;
+
+        /* Shader Precision-Specified Types */
+        const unsigned int LOW_FLOAT                      = 0x8DF0;
+        const unsigned int MEDIUM_FLOAT                   = 0x8DF1;
+        const unsigned int HIGH_FLOAT                     = 0x8DF2;
+        const unsigned int LOW_INT                        = 0x8DF3;
+        const unsigned int MEDIUM_INT                     = 0x8DF4;
+        const unsigned int HIGH_INT                       = 0x8DF5;
+
+        /* Framebuffer Object. */
+        const unsigned int FRAMEBUFFER                    = 0x8D40;
+        const unsigned int RENDERBUFFER                   = 0x8D41;
+
+        const unsigned int RGBA4                          = 0x8056;
+        const unsigned int RGB5_A1                        = 0x8057;
+        const unsigned int RGB565                         = 0x8D62;
+        const unsigned int DEPTH_COMPONENT16              = 0x81A5;
+        const unsigned int STENCIL_INDEX                  = 0x1901;
+        const unsigned int STENCIL_INDEX8                 = 0x8D48;
+
+        const unsigned int RENDERBUFFER_WIDTH             = 0x8D42;
+        const unsigned int RENDERBUFFER_HEIGHT            = 0x8D43;
+        const unsigned int RENDERBUFFER_INTERNAL_FORMAT   = 0x8D44;
+        const unsigned int RENDERBUFFER_RED_SIZE          = 0x8D50;
+        const unsigned int RENDERBUFFER_GREEN_SIZE        = 0x8D51;
+        const unsigned int RENDERBUFFER_BLUE_SIZE         = 0x8D52;
+        const unsigned int RENDERBUFFER_ALPHA_SIZE        = 0x8D53;
+        const unsigned int RENDERBUFFER_DEPTH_SIZE        = 0x8D54;
+        const unsigned int RENDERBUFFER_STENCIL_SIZE      = 0x8D55;
+
+        const unsigned int FRAMEBUFFER_ATTACHMENT_OBJECT_TYPE           = 0x8CD0;
+        const unsigned int FRAMEBUFFER_ATTACHMENT_OBJECT_NAME           = 0x8CD1;
+        const unsigned int FRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL         = 0x8CD2;
+        const unsigned int FRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE = 0x8CD3;
+
+        const unsigned int COLOR_ATTACHMENT0              = 0x8CE0;
+        const unsigned int DEPTH_ATTACHMENT               = 0x8D00;
+        const unsigned int STENCIL_ATTACHMENT             = 0x8D20;
+
+        const unsigned int NONE                           = 0;
+
+        const unsigned int FRAMEBUFFER_COMPLETE                      = 0x8CD5;
+        const unsigned int FRAMEBUFFER_INCOMPLETE_ATTACHMENT         = 0x8CD6;
+        const unsigned int FRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT = 0x8CD7;
+        const unsigned int FRAMEBUFFER_INCOMPLETE_DIMENSIONS         = 0x8CD9;
+        const unsigned int FRAMEBUFFER_UNSUPPORTED                   = 0x8CDD;
+
+        const unsigned int FRAMEBUFFER_BINDING            = 0x8CA6;
+        const unsigned int RENDERBUFFER_BINDING           = 0x8CA7;
+        const unsigned int MAX_RENDERBUFFER_SIZE          = 0x84E8;
+
+        const unsigned int INVALID_FRAMEBUFFER_OPERATION  = 0x0506;
+
+        long sizeInBytes(in unsigned long type) raises(DOMException);
+
+        void         activeTexture(in unsigned long texture);
+        void         attachShader(in CanvasProgram program, in CanvasShader shader);
+        void         bindAttribLocation(in CanvasProgram program, in unsigned long index, in DOMString name);
+        void         bindBuffer(in unsigned long target, in CanvasBuffer buffer);
+        void         bindFramebuffer(in unsigned long target, in CanvasFramebuffer framebuffer);
+        void         bindRenderbuffer(in unsigned long target, in CanvasRenderbuffer renderbuffer);
+        void         bindTexture(in unsigned long target, in CanvasTexture texture);
+        void         blendColor(in double red, in double green, in double blue, in double alpha);
+        void         blendEquation( in unsigned long mode );
+        void         blendEquationSeparate(in unsigned long modeRGB, in unsigned long modeAlpha);
+        void         blendFunc(in unsigned long sfactor, in unsigned long dfactor);
+        void         blendFuncSeparate(in unsigned long srcRGB, in unsigned long dstRGB, in unsigned long srcAlpha, in unsigned long dstAlpha);
+        // Supported forms:
+        //   void bufferData (in GLenum target, in GLsizei size, in GLenum usage);
+        //   void bufferData (in GLenum target, in CanvasArray data, in GLenum usage);
+        [Custom] void bufferData();
+        // Supported forms:
+        //   void bufferSubData (in GLenum target, in GLsizeiptr offset, in CanvasArray data);
+        [Custom] void bufferSubData();
+
+        unsigned long checkFramebufferStatus(in unsigned long target);
+        void         clear(in unsigned long mask);
+        void         clearColor(in double red, in double green, in double blue, in double alpha);
+        void         clearDepth(in double depth);
+        void         clearStencil(in long s);
+        void         colorMask(in boolean red, in boolean green, in boolean blue, in boolean alpha);
+        void         compileShader(in CanvasShader shader);
+        
+        //void         compressedTexImage2D(in unsigned long target, in long level, in unsigned long internalformat, in unsigned long width, in unsigned long height, in long border, in unsigned long imageSize, const void* data);
+        //void         compressedTexSubImage2D(in unsigned long target, in long level, in long xoffset, in long yoffset, in unsigned long width, in unsigned long height, in unsigned long format, in unsigned long imageSize, const void* data);
+        
+        void         copyTexImage2D(in unsigned long target, in long level, in unsigned long internalformat, in long x, in long y, in unsigned long width, in unsigned long height, in long border);
+        void         copyTexSubImage2D(in unsigned long target, in long level, in long xoffset, in long yoffset, in long x, in long y, in unsigned long width, in unsigned long height);
+
+        CanvasBuffer createBuffer();
+        CanvasFramebuffer createFramebuffer();
+        CanvasProgram createProgram();
+        CanvasRenderbuffer createRenderbuffer();
+        CanvasShader createShader(in unsigned long type);
+        CanvasTexture createTexture();
+
+        void         cullFace(in unsigned long mode);
+
+        void         deleteBuffer(in CanvasBuffer buffer);
+        void         deleteFramebuffer(in CanvasFramebuffer framebuffer);
+        void         deleteProgram(in CanvasProgram program);
+        void         deleteRenderbuffer(in CanvasRenderbuffer renderbuffer);
+        void         deleteShader(in CanvasShader shader);
+        void         deleteTexture(in CanvasTexture texture);
+
+        void         depthFunc(in unsigned long func);
+        void         depthMask(in boolean flag);
+        // FIXME: this differs from the current WebGL spec (depthRangef)
+        void         depthRange(in double zNear, in double zFar);
+        void         detachShader(in CanvasProgram program, in CanvasShader shader);
+        void         disable(in unsigned long cap);
+        void         disableVertexAttribArray(in unsigned long index);
+        void         drawArrays(in unsigned long mode, in long first, in unsigned long count);
+        void         drawElements (in unsigned long mode, in long count, in unsigned long type, in unsigned long offset);
+
+        void         enable(in unsigned long cap);
+        void         enableVertexAttribArray(in unsigned long index);
+        void         finish();
+        void         flush();
+        void         framebufferRenderbuffer(in unsigned long target, in unsigned long attachment, in unsigned long renderbuffertarget, in CanvasRenderbuffer renderbuffer);
+        void         framebufferTexture2D(in unsigned long target, in unsigned long attachment, in unsigned long textarget, in CanvasTexture texture, in long level);
+        void         frontFace(in unsigned long mode);
+        void         generateMipmap(in unsigned long target);
+        
+        // FIXME: these need to be added per the WebGL spec
+        // CanvasActiveInfo getActiveAttrib(GLuint program, GLuint index);
+        // CanvasActiveInfo getActiveUniform(GLuint program, GLuint index);
+        // CanvasShaderArray glGetAttachedShaders(GLuint program);
+
+        int          getAttribLocation(in CanvasProgram program, in DOMString name);
+
+        boolean getBoolean(in unsigned long pname);
+        CanvasUnsignedByteArray getBooleanv(in unsigned long pname);
+        long getBufferParameteri(in unsigned long target, in unsigned long pname);
+        CanvasIntArray getBufferParameteriv(in unsigned long target, in unsigned long pname);
+
+        unsigned long getError();
+
+        float getFloat(in unsigned long pname);
+        CanvasFloatArray getFloatv(in unsigned long pname);
+        long getFramebufferAttachmentParameteri(in unsigned long target, in unsigned long attachment, in unsigned long pname);
+        CanvasIntArray getFramebufferAttachmentParameteriv(in unsigned long target, in unsigned long attachment, in unsigned long pname);
+        long getInteger(in unsigned long pname);
+        CanvasIntArray getIntegerv(in unsigned long pname);
+        long getProgrami(in CanvasProgram program, in unsigned long pname);
+        CanvasIntArray getProgramiv(in CanvasProgram program, in unsigned long pname);
+        DOMString getProgramInfoLog(in CanvasProgram program);
+        long getRenderbufferParameteri(in unsigned long target, in unsigned long pname);
+        CanvasIntArray getRenderbufferParameteriv(in unsigned long target, in unsigned long pname);
+        long getShaderi(in CanvasShader shader, in unsigned long pname);
+        CanvasIntArray getShaderiv(in CanvasShader shader, in unsigned long pname);
+
+        DOMString    getShaderInfoLog(in CanvasShader shader);
+
+        // TBD
+        // void glGetShaderPrecisionFormat (GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision);
+
+        DOMString    getShaderSource(in CanvasShader shader);
+        DOMString    getString(in unsigned long name);
+
+        float getTexParameterf(in unsigned long target, in unsigned long pname);
+        CanvasFloatArray getTexParameterfv(in unsigned long target, in unsigned long pname);
+        long getTexParameteri(in unsigned long target, in unsigned long pname);
+        CanvasIntArray getTexParameteriv(in unsigned long target, in unsigned long pname);
+
+        float getUniformf(in CanvasProgram program, in long location);
+        CanvasFloatArray getUniformfv(in CanvasProgram program, in long location);
+        long getUniformi(in CanvasProgram program, in long location);
+        CanvasIntArray getUniformiv(in CanvasProgram program, in long location);
+        
+        long getUniformLocation(in CanvasProgram program, in DOMString name);
+
+        float getVertexAttribf(in unsigned long index, in unsigned long pname);
+        CanvasFloatArray getVertexAttribfv(in unsigned long index, in unsigned long pname);
+        long getVertexAttribi(in unsigned long index, in unsigned long pname);
+        CanvasIntArray getVertexAttribiv(in unsigned long index, in unsigned long pname);
+
+        long getVertexAttribOffset(in unsigned long index, in unsigned long pname);
+
+        void         hint(in unsigned long target, in unsigned long mode);
+        boolean      isBuffer(in CanvasBuffer buffer);
+        boolean      isEnabled(in unsigned long cap);
+        boolean      isFramebuffer(in CanvasFramebuffer framebuffer);
+        boolean      isProgram(in CanvasProgram program);
+        boolean      isRenderbuffer(in CanvasRenderbuffer renderbuffer);
+        boolean      isShader(in CanvasShader shader);
+        boolean      isTexture(in CanvasTexture texture);
+        void         lineWidth(in double width);
+        void         linkProgram(in CanvasProgram program);
+        void         pixelStorei(in unsigned long pname, in long param);
+        void         polygonOffset(in double factor, in double units);
+        
+        // FIXME
+        //void         readPixels(in long x, in long y, in unsigned long width, in unsigned long height, in unsigned long format, in unsigned long type, void* pixels);
+        
+        void         releaseShaderCompiler();
+        void         renderbufferStorage(in unsigned long target, in unsigned long internalformat, in unsigned long width, in unsigned long height);
+        void         sampleCoverage(in double value, in boolean invert);
+        void         scissor(in long x, in long y, in unsigned long width, in unsigned long height);
+        void         shaderSource(in CanvasShader shader, in DOMString string);
+        void         stencilFunc(in unsigned long func, in long ref, in unsigned long mask);
+        void         stencilFuncSeparate(in unsigned long face, in unsigned long func, in long ref, in unsigned long mask);
+        void         stencilMask(in unsigned long mask);
+        void         stencilMaskSeparate(in unsigned long face, in unsigned long mask);
+        void         stencilOp(in unsigned long fail, in unsigned long zfail, in unsigned long zpass);
+        void         stencilOpSeparate(in unsigned long face, in unsigned long fail, in unsigned long zfail, in unsigned long zpass);
+
+        void         texParameterf(in unsigned long target, in unsigned long pname, in float param);
+        void         texParameteri(in unsigned long target, in unsigned long pname, in long param);
+
+        // Supported forms:
+        //   void texImage2D(in GLenum target, in GLint level, in GLenum internalformat, in GLsizei width, in GLsizei height, 
+        //                   in GLint border, in GLenum format, in GLenum type, in CanvasArray pixels);
+        //   void texImage2D(in GLenum target, in GLint level, in GLenum internalformat, in GLsizei width, in GLsizei height, 
+        //                   in GLint border, in GLenum format, in GLenum type, in ImageData pixels);
+        //   void texImage2D(in GLenum target, in GLint level, in HTMLImageElement image,
+        //                   [Optional] in GLboolean flipY, [Optional] in premultiplyAlpha);
+        //   void texImage2D(in GLenum target, in GLint level, in HTMLCanvasElement canvas,
+        //                   [Optional] in GLboolean flipY, [Optional] in premultiplyAlpha);
+        //   void texImage2D(in GLenum target, in GLint level, in HTMLVideoElement video,
+        //                   [Optional] in GLboolean flipY, [Optional] in premultiplyAlpha);
+        [Custom] void texImage2D();
+
+        // Supported forms:
+        //   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, 
+        //                      in GLsizei width, in GLsizei height, 
+        //                      in GLenum format, in GLenum type, in CanvasArray pixels);
+        //   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, 
+        //                      in GLsizei width, in GLsizei height, 
+        //                      in GLenum format, in GLenum type, in ImageData pixels);
+        //   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, 
+        //                      in GLsizei width, in GLsizei height, in HTMLImageElement image,
+        //                      [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
+        //   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, 
+        //                      in GLsizei width, in GLsizei height, in HTMLCanvasElement canvas,
+        //                      [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
+        //   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, 
+        //                      in GLsizei width, in GLsizei height, in HTMLVideoElement video,
+        //                      [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
+        [Custom] void texSubImage2D();
+
+        void uniform1f(in long location, in float x);
+        [Custom] void uniform1fv(in long location, in CanvasFloatArray v);
+        void uniform1i(in long location, in long x);
+        [Custom] void uniform1iv(in long location, in CanvasIntArray v);
+        void uniform2f(in long location, in float x, in float y);
+        [Custom] void uniform2fv(in long location, in CanvasFloatArray v);
+        void uniform2i(in long location, in long x, in long y);
+        [Custom] void uniform2iv(in long location, in CanvasIntArray v);
+        void uniform3f(in long location, in float x, in float y, in float z);
+        [Custom] void uniform3fv(in long location, in CanvasFloatArray v);
+        void uniform3i(in long location, in long x, in long y, in long z);
+        [Custom] void uniform3iv(in long location, in CanvasIntArray v);
+        void uniform4f(in long location, in float x, in float y, in float z, in float w);
+        [Custom] void uniform4fv(in long location, in CanvasFloatArray v);
+        void uniform4i(in long location, in long x, in long y, in long z, in long w);
+        [Custom] void uniform4iv(in long location, in CanvasIntArray v);
+
+        [Custom] void uniformMatrix2fv(in long location, in boolean transpose, in CanvasFloatArray array);
+        [Custom] void uniformMatrix3fv(in long location, in boolean transpose, in CanvasFloatArray array);
+        [Custom] void uniformMatrix4fv(in long location, in boolean transpose, in CanvasFloatArray array);
+
+        void         useProgram(in CanvasProgram program);
+        void         validateProgram(in CanvasProgram program);
+
+        void         vertexAttrib1f(in unsigned long indx, in float x);
+        [Custom] void         vertexAttrib1fv(in unsigned long indx, in CanvasFloatArray values);
+        void         vertexAttrib2f(in unsigned long indx, in float x, in float y);
+        [Custom] void         vertexAttrib2fv(in unsigned long indx, in CanvasFloatArray values);
+        void         vertexAttrib3f(in unsigned long indx, in float x, in float y, in float z);
+        [Custom] void         vertexAttrib3fv(in unsigned long indx, in CanvasFloatArray values);
+        void         vertexAttrib4f(in unsigned long indx, in float x, in float y, in float z, in float w);
+        [Custom] void         vertexAttrib4fv(in unsigned long indx, in CanvasFloatArray values);
+        void         vertexAttribPointer(in unsigned long indx, in long size, in unsigned long type, in boolean normalized, 
+                                         in long stride, in unsigned long offset);
+
+        void         viewport(in long x, in long y, in unsigned long width, in unsigned long height);
+    };
+}
+
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasShader.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasShader.cpp
new file mode 100644
index 0000000..7f134fa
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasShader.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasShader.h"
+#include "CanvasRenderingContext3D.h"
+
+namespace WebCore {
+    
+PassRefPtr<CanvasShader> CanvasShader::create(CanvasRenderingContext3D* ctx, GraphicsContext3D::ShaderType type)
+{
+    return adoptRef(new CanvasShader(ctx, type));
+}
+
+CanvasShader::CanvasShader(CanvasRenderingContext3D* ctx, GraphicsContext3D::ShaderType type)
+    : CanvasObject(ctx)
+{
+    setObject(context()->graphicsContext3D()->createShader(type));
+}
+
+void CanvasShader::_deleteObject(Platform3DObject object)
+{
+    context()->graphicsContext3D()->deleteShader(object);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasShader.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasShader.h
new file mode 100644
index 0000000..bb7980e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasShader.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasShader_h
+#define CanvasShader_h
+
+#include "CanvasObject.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasShader : public CanvasObject {
+    public:
+        virtual ~CanvasShader() { deleteObject(); }
+        
+        static PassRefPtr<CanvasShader> create(CanvasRenderingContext3D*, GraphicsContext3D::ShaderType);
+        
+    private:
+        CanvasShader(CanvasRenderingContext3D*, GraphicsContext3D::ShaderType);
+
+        virtual void _deleteObject(Platform3DObject);
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasShader_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasShader.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasShader.idl
new file mode 100644
index 0000000..7474c3a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasShader.idl
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [Conditional=3D_CANVAS] CanvasShader {
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.cpp
new file mode 100644
index 0000000..44fc18e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.cpp
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasShortArray.h"
+
+namespace WebCore {
+    
+    PassRefPtr<CanvasShortArray> CanvasShortArray::create(unsigned length)
+    {
+        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(short));
+        return create(buffer, 0, length);
+    }
+
+    PassRefPtr<CanvasShortArray> CanvasShortArray::create(short* array, unsigned length)
+    {
+        RefPtr<CanvasShortArray> a = CanvasShortArray::create(length);
+        for (unsigned i = 0; i < length; ++i)
+            a->set(i, array[i]);
+        return a;
+    }
+
+    PassRefPtr<CanvasShortArray> CanvasShortArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
+                                                          int offset,
+                                                          unsigned length)
+    {
+        // Make sure the offset results in valid alignment.
+        if ((offset % sizeof(short)) != 0) {
+            return NULL;
+        }
+
+        // Check to make sure we are talking about a valid region of
+        // the given CanvasArrayBuffer's storage.
+        if ((offset + (length * sizeof(short))) > buffer->byteLength()) {
+            return NULL;
+        }
+
+        return adoptRef(new CanvasShortArray(buffer, offset, length));
+    }
+    
+    CanvasShortArray::CanvasShortArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
+        : CanvasArray(buffer, offset)
+        , m_size(length)
+    {
+    }
+    
+    unsigned CanvasShortArray::length() const {
+        return m_size;
+    }
+        
+    unsigned CanvasShortArray::sizeInBytes() const {
+        return length() * sizeof(short);
+    }
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.h
new file mode 100644
index 0000000..2ac86b5
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasShortArray_h
+#define CanvasShortArray_h
+
+#include "CanvasArray.h"
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasShortArray : public CanvasArray {
+    public:
+        static PassRefPtr<CanvasShortArray> create(unsigned length);
+        static PassRefPtr<CanvasShortArray> create(short* array, unsigned length);
+        static PassRefPtr<CanvasShortArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+
+        short* data() { return static_cast<short*>(baseAddress()); }
+
+        virtual unsigned length() const;
+        virtual unsigned sizeInBytes() const;
+
+        void set(unsigned index, double value)
+        {
+            if (index >= m_size)
+                return;
+            if (isnan(value)) // Clamp NaN to 0
+                value = 0;
+            if (value < std::numeric_limits<short>::min())
+                value = std::numeric_limits<short>::min();
+            else if (value > std::numeric_limits<short>::max())
+                value = std::numeric_limits<short>::max();
+            short* storage = static_cast<short*>(m_baseAddress);
+            storage[index] = static_cast<short>(value);
+        }
+        
+        bool get(unsigned index, short& result) const
+        {
+            if (index >= m_size)
+                return false;
+            result = item(index);
+            return true;
+        }
+        
+        short item(unsigned index) const
+        {
+            ASSERT(index < m_size);
+            short* storage = static_cast<short*>(m_baseAddress);
+            return storage[index];
+        }
+
+    private:
+        CanvasShortArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+        unsigned m_size;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasShortArray_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.idl
new file mode 100644
index 0000000..6d64e1c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasShortArray.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        HasNumericIndexGetter,
+        HasCustomIndexSetter,
+        GenerateNativeConverter,
+        GenerateCustomConstructor,
+        CustomToJS
+    ] CanvasShortArray : CanvasArray {
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasStyle.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasStyle.cpp
index 946cac7..946cac7 100644
--- a/src/3rdparty/webkit/WebCore/html/CanvasStyle.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasStyle.cpp
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasStyle.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasStyle.h
index fe01bd1..fe01bd1 100644
--- a/src/3rdparty/webkit/WebCore/html/CanvasStyle.h
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasStyle.h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasTexture.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasTexture.cpp
new file mode 100644
index 0000000..624c275
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasTexture.cpp
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasTexture.h"
+#include "CanvasRenderingContext3D.h"
+
+namespace WebCore {
+    
+PassRefPtr<CanvasTexture> CanvasTexture::create(CanvasRenderingContext3D* ctx)
+{
+    return adoptRef(new CanvasTexture(ctx));
+}
+
+CanvasTexture::CanvasTexture(CanvasRenderingContext3D* ctx)
+    : CanvasObject(ctx)
+    , cubeMapRWrapModeInitialized(false)
+{
+    setObject(context()->graphicsContext3D()->createTexture());
+}
+
+void CanvasTexture::_deleteObject(Platform3DObject object)
+{
+    context()->graphicsContext3D()->deleteTexture(object);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasTexture.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasTexture.h
new file mode 100644
index 0000000..32a669a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasTexture.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasTexture_h
+#define CanvasTexture_h
+
+#include "CanvasObject.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasTexture : public CanvasObject {
+    public:
+        virtual ~CanvasTexture() { deleteObject(); }
+        
+        static PassRefPtr<CanvasTexture> create(CanvasRenderingContext3D*);
+    
+        bool isCubeMapRWrapModeInitialized() {
+            return cubeMapRWrapModeInitialized;
+        }
+
+        void setCubeMapRWrapModeInitialized(bool initialized) {
+            cubeMapRWrapModeInitialized = initialized;
+        }
+
+    protected:
+        CanvasTexture(CanvasRenderingContext3D*);
+
+        virtual void _deleteObject(Platform3DObject);
+
+    private:
+        bool cubeMapRWrapModeInitialized;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasTexture_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasTexture.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasTexture.idl
new file mode 100644
index 0000000..77eedd7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasTexture.idl
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [Conditional=3D_CANVAS] CanvasTexture {
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.cpp
new file mode 100644
index 0000000..0ad7b2b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasUnsignedByteArray.h"
+
+namespace WebCore {
+    
+    PassRefPtr<CanvasUnsignedByteArray> CanvasUnsignedByteArray::create(unsigned length)
+    {
+        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(unsigned char));
+        return create(buffer, 0, length);
+    }
+
+    PassRefPtr<CanvasUnsignedByteArray> CanvasUnsignedByteArray::create(unsigned char* array, unsigned length)
+    {
+        RefPtr<CanvasUnsignedByteArray> a = CanvasUnsignedByteArray::create(length);
+        for (unsigned i = 0; i < length; ++i)
+            a->set(i, array[i]);
+        return a;
+    }
+
+    PassRefPtr<CanvasUnsignedByteArray> CanvasUnsignedByteArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
+                                                                        int offset,
+                                                                        unsigned length)
+    {
+        // Check to make sure we are talking about a valid region of
+        // the given CanvasArrayBuffer's storage.
+        if ((offset + (length * sizeof(unsigned char))) > buffer->byteLength()) {
+            return NULL;
+        }
+
+        return adoptRef(new CanvasUnsignedByteArray(buffer, offset, length));
+    }
+    
+    CanvasUnsignedByteArray::CanvasUnsignedByteArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
+        : CanvasArray(buffer, offset)
+        , m_size(length)
+    {
+    }
+    
+    unsigned CanvasUnsignedByteArray::length() const {
+        return m_size;
+    }
+        
+    unsigned CanvasUnsignedByteArray::sizeInBytes() const {
+        return length() * sizeof(unsigned char);
+    }
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.h
new file mode 100644
index 0000000..f1b7348
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasUnsignedByteArray_h
+#define CanvasUnsignedByteArray_h
+
+#include "CanvasArray.h"
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasUnsignedByteArray : public CanvasArray {
+    public:
+        static PassRefPtr<CanvasUnsignedByteArray> create(unsigned length);
+        static PassRefPtr<CanvasUnsignedByteArray> create(unsigned char* array, unsigned length);
+        static PassRefPtr<CanvasUnsignedByteArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+
+        unsigned char* data() { return static_cast<unsigned char*>(baseAddress()); }
+        
+        virtual unsigned length() const;
+        virtual unsigned sizeInBytes() const;
+
+        void set(unsigned index, double value)
+        {
+            if (index >= m_size)
+                return;
+            if (isnan(value)) // Clamp NaN to 0
+                value = 0;
+            if (value < std::numeric_limits<unsigned char>::min())
+                value = std::numeric_limits<unsigned char>::min();
+            else if (value > std::numeric_limits<unsigned char>::max())
+                value = std::numeric_limits<unsigned char>::max();
+            unsigned char* storage = static_cast<unsigned char*>(m_baseAddress);
+            storage[index] = static_cast<unsigned char>(value);
+        }
+        
+        bool get(unsigned index, unsigned char& result) const
+        {
+            if (index >= m_size)
+                return false;
+            result = item(index);
+            return true;
+        }
+        
+        unsigned char item(unsigned index) const
+        {
+            ASSERT(index < m_size);
+            unsigned char* storage = static_cast<unsigned char*>(m_baseAddress);
+            return storage[index];
+        }
+
+    private:
+        CanvasUnsignedByteArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+        unsigned m_size;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasUnsignedByteArray_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.idl
new file mode 100644
index 0000000..d46f708
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedByteArray.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        HasNumericIndexGetter,
+        HasCustomIndexSetter,
+        GenerateNativeConverter,
+        GenerateCustomConstructor,
+        CustomToJS
+    ] CanvasUnsignedByteArray : CanvasArray {
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.cpp
new file mode 100644
index 0000000..e00e783
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.cpp
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasUnsignedIntArray.h"
+
+namespace WebCore {
+    
+    PassRefPtr<CanvasUnsignedIntArray> CanvasUnsignedIntArray::create(unsigned length)
+    {
+        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(unsigned int));
+        return create(buffer, 0, length);
+    }
+
+    PassRefPtr<CanvasUnsignedIntArray> CanvasUnsignedIntArray::create(unsigned int* array, unsigned length)
+    {
+        RefPtr<CanvasUnsignedIntArray> a = CanvasUnsignedIntArray::create(length);
+        for (unsigned i = 0; i < length; ++i)
+            a->set(i, array[i]);
+        return a;
+    }
+
+    PassRefPtr<CanvasUnsignedIntArray> CanvasUnsignedIntArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
+                                                                      int offset,
+                                                                      unsigned length)
+    {
+        // Make sure the offset results in valid alignment.
+        if ((offset % sizeof(unsigned int)) != 0) {
+            return NULL;
+        }
+
+        // Check to make sure we are talking about a valid region of
+        // the given CanvasArrayBuffer's storage.
+        if ((offset + (length * sizeof(unsigned int))) > buffer->byteLength()) {
+            return NULL;
+        }
+
+        return adoptRef(new CanvasUnsignedIntArray(buffer, offset, length));
+    }
+    
+    CanvasUnsignedIntArray::CanvasUnsignedIntArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
+        : CanvasArray(buffer, offset)
+        , m_size(length)
+    {
+    }
+    
+    unsigned CanvasUnsignedIntArray::length() const {
+        return m_size;
+    }
+        
+    unsigned CanvasUnsignedIntArray::sizeInBytes() const {
+        return length() * sizeof(unsigned int);
+    }
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.h
new file mode 100644
index 0000000..21f0d10
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasUnsignedIntArray_h
+#define CanvasUnsignedIntArray_h
+
+#include "CanvasArray.h"
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasUnsignedIntArray : public CanvasArray {
+    public:
+        static PassRefPtr<CanvasUnsignedIntArray> create(unsigned length);
+        static PassRefPtr<CanvasUnsignedIntArray> create(unsigned int* array, unsigned length);
+        static PassRefPtr<CanvasUnsignedIntArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+
+        unsigned int* data() { return static_cast<unsigned int*>(baseAddress()); }
+        
+        virtual unsigned length() const;
+        virtual unsigned sizeInBytes() const;
+
+        void set(unsigned index, double value)
+        {
+            if (index >= m_size)
+                return;
+            if (isnan(value)) // Clamp NaN to 0
+                value = 0;
+            if (value < std::numeric_limits<unsigned int>::min())
+                value = std::numeric_limits<unsigned int>::min();
+            else if (value > std::numeric_limits<unsigned int>::max())
+                value = std::numeric_limits<unsigned int>::max();
+            unsigned int* storage = static_cast<unsigned int*>(m_baseAddress);
+            storage[index] = static_cast<unsigned int>(value);
+        }
+        
+        bool get(unsigned index, unsigned int& result) const
+        {
+            if (index >= m_size)
+                return false;
+            result = item(index);
+            return true;
+        }
+        
+        unsigned int item(unsigned index) const
+        {
+            ASSERT(index < m_size);
+            unsigned int* storage = static_cast<unsigned int*>(m_baseAddress);
+            return storage[index];
+        }
+
+    private:
+        CanvasUnsignedIntArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+        unsigned m_size;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasUnsignedIntArray_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.idl
new file mode 100644
index 0000000..3ab60d60
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedIntArray.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        HasNumericIndexGetter,
+        HasCustomIndexSetter,
+        GenerateNativeConverter,
+        GenerateCustomConstructor,
+        CustomToJS
+    ] CanvasUnsignedIntArray : CanvasArray {
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.cpp
new file mode 100644
index 0000000..03a4ce1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.cpp
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasUnsignedShortArray.h"
+
+namespace WebCore {
+    
+    PassRefPtr<CanvasUnsignedShortArray> CanvasUnsignedShortArray::create(unsigned length)
+    {
+        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(unsigned short));
+        return create(buffer, 0, length);
+    }
+
+    PassRefPtr<CanvasUnsignedShortArray> CanvasUnsignedShortArray::create(unsigned short* array, unsigned length)
+    {
+        RefPtr<CanvasUnsignedShortArray> a = CanvasUnsignedShortArray::create(length);
+        for (unsigned i = 0; i < length; ++i)
+            a->set(i, array[i]);
+        return a;
+    }
+
+    PassRefPtr<CanvasUnsignedShortArray> CanvasUnsignedShortArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
+                                                                          int offset,
+                                                                          unsigned length)
+    {
+        // Make sure the offset results in valid alignment.
+        if ((offset % sizeof(unsigned short)) != 0) {
+            return NULL;
+        }
+
+        // Check to make sure we are talking about a valid region of
+        // the given CanvasArrayBuffer's storage.
+        if ((offset + (length * sizeof(unsigned short))) > buffer->byteLength()) {
+            return NULL;
+        }
+
+        return adoptRef(new CanvasUnsignedShortArray(buffer, offset, length));
+    }
+    
+    CanvasUnsignedShortArray::CanvasUnsignedShortArray(PassRefPtr<CanvasArrayBuffer> buffer,
+                                         int offset,
+                                         unsigned length)
+        : CanvasArray(buffer, offset)
+        , m_size(length)
+    {
+    }
+    
+    unsigned CanvasUnsignedShortArray::length() const {
+        return m_size;
+    }
+        
+    unsigned CanvasUnsignedShortArray::sizeInBytes() const {
+        return length() * sizeof(unsigned short);
+    }
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.h b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.h
new file mode 100644
index 0000000..324e868
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasUnsignedShortArray_h
+#define CanvasUnsignedShortArray_h
+
+#include "CanvasArray.h"
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasUnsignedShortArray : public CanvasArray {
+    public:
+        static PassRefPtr<CanvasUnsignedShortArray> create(unsigned length);
+        static PassRefPtr<CanvasUnsignedShortArray> create(unsigned short* array, unsigned length);
+        static PassRefPtr<CanvasUnsignedShortArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+
+        unsigned short* data() { return static_cast<unsigned short*>(baseAddress()); }
+        
+        virtual unsigned length() const;
+        virtual unsigned sizeInBytes() const;
+
+        void set(unsigned index, double value)
+        {
+            if (index >= m_size)
+                return;
+            if (isnan(value)) // Clamp NaN to 0
+                value = 0;
+            if (value < std::numeric_limits<unsigned short>::min())
+                value = std::numeric_limits<unsigned short>::min();
+            else if (value > std::numeric_limits<unsigned short>::max())
+                value = std::numeric_limits<unsigned short>::max();
+            unsigned short* storage = static_cast<unsigned short*>(m_baseAddress);
+            storage[index] = static_cast<unsigned short>(value);
+        }
+        
+        bool get(unsigned index, unsigned short& result) const
+        {
+            if (index >= m_size)
+                return false;
+            unsigned short* storage = static_cast<unsigned short*>(m_baseAddress);
+            result = storage[index];
+            return true;
+        }
+        
+        unsigned short item(unsigned index) const
+        {
+            ASSERT(index < m_size);
+            unsigned short* storage = static_cast<unsigned short*>(m_baseAddress);
+            return storage[index];
+        }
+
+    private:
+        CanvasUnsignedShortArray(PassRefPtr<CanvasArrayBuffer> buffer,int offset,unsigned length);
+        unsigned m_size;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasUnsignedShortArray_h
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.idl b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.idl
new file mode 100644
index 0000000..99fc6a2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasUnsignedShortArray.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        HasNumericIndexGetter,
+        HasCustomIndexSetter,
+        GenerateNativeConverter,
+        GenerateCustomConstructor,
+        CustomToJS
+    ] CanvasUnsignedShortArray : CanvasArray {
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.cpp b/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.cpp
index 609197e..6cfb75e 100644
--- a/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.cpp
@@ -32,8 +32,8 @@
 #include "ConsoleMessage.h"
 
 #include "InspectorFrontend.h"
-#include "InspectorJSONObject.h"
 #include "ScriptCallStack.h"
+#include "ScriptObject.h"
 #include "ScriptObjectQuarantine.h"
 
 namespace WebCore {
@@ -54,7 +54,9 @@ ConsoleMessage::ConsoleMessage(MessageSource s, MessageType t, MessageLevel l, S
     : m_source(s)
     , m_type(t)
     , m_level(l)
+#if ENABLE(INSPECTOR)
     , m_wrappedArguments(callStack->at(0).argumentCount())
+#endif
     , m_frames(storeTrace ? callStack->size() : 0)
     , m_groupLevel(g)
     , m_repeatCount(1)
@@ -71,13 +73,16 @@ ConsoleMessage::ConsoleMessage(MessageSource s, MessageType t, MessageLevel l, S
             m_frames[i] = callStack->at(i).functionName();
     }
 
+#if ENABLE(INSPECTOR)
     for (unsigned i = 0; i < lastCaller.argumentCount(); ++i)
         m_wrappedArguments[i] = quarantineValue(callStack->state(), lastCaller.argumentAt(i));
+#endif
 }
 
+#if ENABLE(INSPECTOR)
 void ConsoleMessage::addToConsole(InspectorFrontend* frontend)
 {
-    InspectorJSONObject jsonObj = frontend->newInspectorJSONObject();
+    ScriptObject jsonObj = frontend->newScriptObject();
     jsonObj.set("source", static_cast<int>(m_source));
     jsonObj.set("type", static_cast<int>(m_type));
     jsonObj.set("level", static_cast<int>(m_level));
@@ -87,9 +92,11 @@ void ConsoleMessage::addToConsole(InspectorFrontend* frontend)
     jsonObj.set("repeatCount", static_cast<int>(m_repeatCount));
     frontend->addMessageToConsole(jsonObj, m_frames, m_wrappedArguments,  m_message);
 }
+#endif // ENABLE(INSPECTOR)
 
 bool ConsoleMessage::isEqual(ScriptState* state, ConsoleMessage* msg) const
 {
+#if ENABLE(INSPECTOR)
     if (msg->m_wrappedArguments.size() != m_wrappedArguments.size())
         return false;
     if (!state && msg->m_wrappedArguments.size())
@@ -101,6 +108,9 @@ bool ConsoleMessage::isEqual(ScriptState* state, ConsoleMessage* msg) const
         if (!m_wrappedArguments[i].isEqual(state, msg->m_wrappedArguments[i]))
             return false;
     }
+#else
+    UNUSED_PARAM(state);
+#endif // ENABLE(INSPECTOR)
 
     size_t frameCount = msg->m_frames.size();
     if (frameCount != m_frames.size())
diff --git a/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.h b/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.h
index 5b2f7d5..d03f2b7 100644
--- a/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.h
+++ b/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.h
@@ -47,16 +47,23 @@ namespace WebCore {
         ConsoleMessage(MessageSource, MessageType, MessageLevel, const String& m, unsigned li, const String& u, unsigned g);        
         ConsoleMessage(MessageSource, MessageType, MessageLevel, ScriptCallStack*, unsigned g, bool storeTrace = false);
 
+#if ENABLE(INSPECTOR)
         void addToConsole(InspectorFrontend* frontend);
+#endif
         void incrementCount() { ++m_repeatCount; };
         bool isEqual(ScriptState*, ConsoleMessage* msg) const;
 
+        MessageSource source() const { return m_source; }
+        const String& message() const { return m_message; }
+
     private:
         MessageSource m_source;
         MessageType m_type;
         MessageLevel m_level;
         String m_message;
+#if ENABLE(INSPECTOR)
         Vector<ScriptValue> m_wrappedArguments;
+#endif
         Vector<ScriptString> m_frames;
         unsigned m_line;
         String m_url;
diff --git a/src/3rdparty/webkit/WebCore/inspector/DOMDispatchTimelineItem.cpp b/src/3rdparty/webkit/WebCore/inspector/DOMDispatchTimelineItem.cpp
new file mode 100644
index 0000000..acff513
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/DOMDispatchTimelineItem.cpp
@@ -0,0 +1,58 @@
+/*
+* Copyright (C) 2009 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are
+* met:
+*
+*     * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*     * Redistributions in binary form must reproduce the above
+* copyright notice, this list of conditions and the following disclaimer
+* in the documentation and/or other materials provided with the
+* distribution.
+*     * Neither the name of Google Inc. nor the names of its
+* contributors may be used to endorse or promote products derived from
+* this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#include "config.h"
+#include "DOMDispatchTimelineItem.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "Event.h"
+#include "InspectorFrontend.h"
+
+namespace WebCore {
+
+DOMDispatchTimelineItem::DOMDispatchTimelineItem(PassOwnPtr<TimelineItem> previous, double startTime, const Event& event)
+    : TimelineItem(previous, startTime, DOMDispatchTimelineItemType)
+    , m_eventType(event.type().string())
+{
+}
+
+ScriptObject DOMDispatchTimelineItem::convertToScriptObject(InspectorFrontend* frontend)
+{
+    ScriptObject selfObj = TimelineItem::convertToScriptObject(frontend);
+    ScriptObject dataObj = frontend->newScriptObject();
+    dataObj.set("type", m_eventType);
+    selfObj.set("data", dataObj);
+    return selfObj;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/inspector/DOMDispatchTimelineItem.h b/src/3rdparty/webkit/WebCore/inspector/DOMDispatchTimelineItem.h
new file mode 100644
index 0000000..384ce25f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/DOMDispatchTimelineItem.h
@@ -0,0 +1,58 @@
+/*
+* Copyright (C) 2009 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are
+* met:
+*
+*     * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*     * Redistributions in binary form must reproduce the above
+* copyright notice, this list of conditions and the following disclaimer
+* in the documentation and/or other materials provided with the
+* distribution.
+*     * Neither the name of Google Inc. nor the names of its
+* contributors may be used to endorse or promote products derived from
+* this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#ifndef DOMDispatchTimelineItem_h
+#define DOMDispatchTimelineItem_h
+
+#include "TimelineItem.h"
+#include "PlatformString.h"
+
+namespace WebCore {
+
+    class Event;
+    class InspectorFrontend;
+
+    class DOMDispatchTimelineItem : public TimelineItem {
+    public:
+        DOMDispatchTimelineItem(PassOwnPtr<TimelineItem> previous, double startTime, const Event&);
+
+        virtual ~DOMDispatchTimelineItem() { }
+
+    protected:
+        virtual ScriptObject convertToScriptObject(InspectorFrontend*);
+
+    private:
+        String m_eventType;
+    };
+
+} // namespace WebCore
+
+#endif // !defined(DOMDispatchTimelineItem_h)
+
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.cpp
index d50efd3..25034fa 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.cpp
@@ -30,13 +30,26 @@
 #include "config.h"
 #include "InspectorBackend.h"
 
+#if ENABLE(INSPECTOR)
+
+#if ENABLE(DATABASE)
+#include "Database.h"
+#endif
+
 #include "Element.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "HTMLFrameOwnerElement.h"
 #include "InspectorClient.h"
 #include "InspectorController.h"
+#include "InspectorDOMAgent.h"
+#include "InspectorFrontend.h"
 #include "InspectorResource.h"
+#include "ScriptFunctionCall.h"
+
+#if ENABLE(DOM_STORAGE)
+#include "Storage.h"
+#endif
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 #include "JavaScriptCallFrame.h"
@@ -138,10 +151,10 @@ bool InspectorBackend::addSourceToFrame(const String& mimeType, const String& so
     return true;
 }
 
-void InspectorBackend::clearMessages()
+void InspectorBackend::clearMessages(bool clearUI)
 {
     if (m_inspectorController)
-        m_inspectorController->clearConsoleMessages();
+        m_inspectorController->clearConsoleMessages(clearUI);
 }
 
 void InspectorBackend::toggleNodeSearch()
@@ -241,9 +254,41 @@ const String& InspectorBackend::platform() const
     return platform;
 }
 
+void InspectorBackend::enableTimeline(bool always)
+{
+    if (m_inspectorController)
+        m_inspectorController->enableTimeline(always);
+}
+
+void InspectorBackend::disableTimeline(bool always)
+{
+    if (m_inspectorController)
+        m_inspectorController->disableTimeline(always);
+}
+
+bool InspectorBackend::timelineEnabled() const
+{
+    if (m_inspectorController)
+        return m_inspectorController->timelineEnabled();
+    return false;
+}
+
+void InspectorBackend::getCookies(long callId)
+{
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        domAgent->getCookies(callId);
+}
+
+void InspectorBackend::deleteCookie(const String& cookieName)
+{
+    if (!m_inspectorController)
+        return;
+    m_inspectorController->deleteCookie(cookieName);
+}
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 const ProfilesArray& InspectorBackend::profiles() const
-{    
+{
     if (m_inspectorController)
         return m_inspectorController->profiles();
     return m_emptyProfiles;
@@ -304,10 +349,16 @@ JavaScriptCallFrame* InspectorBackend::currentCallFrame() const
     return JavaScriptDebugServer::shared().currentCallFrame();
 }
 
-void InspectorBackend::addBreakpoint(const String& sourceID, unsigned lineNumber)
+void InspectorBackend::addBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition)
 {
     intptr_t sourceIDValue = sourceID.toIntPtr();
-    JavaScriptDebugServer::shared().addBreakpoint(sourceIDValue, lineNumber);
+    JavaScriptDebugServer::shared().addBreakpoint(sourceIDValue, lineNumber, condition);
+}
+
+void InspectorBackend::updateBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition)
+{
+    intptr_t sourceIDValue = sourceID.toIntPtr();
+    JavaScriptDebugServer::shared().updateBreakpoint(sourceIDValue, lineNumber, condition);
 }
 
 void InspectorBackend::removeBreakpoint(const String& sourceID, unsigned lineNumber)
@@ -354,10 +405,122 @@ void InspectorBackend::stepOutOfFunctionInDebugger()
 
 #endif
 
-void InspectorBackend::highlight(Node* node)
+void InspectorBackend::dispatchOnInjectedScript(long callId, const String& methodName, const String& arguments)
 {
-    if (m_inspectorController)
+    InspectorFrontend* frontend = inspectorFrontend();
+    if (!frontend)
+        return;
+
+    ScriptFunctionCall function(m_inspectorController->m_scriptState, m_inspectorController->m_injectedScriptObj, "dispatch");
+    function.appendArgument(methodName);
+    function.appendArgument(arguments);
+    bool hadException = false;
+    ScriptValue result = function.call(hadException);
+    if (hadException)
+        frontend->didDispatchOnInjectedScript(callId, "", true);
+    else
+        frontend->didDispatchOnInjectedScript(callId, result.toString(m_inspectorController->m_scriptState), false);
+}
+
+void InspectorBackend::getChildNodes(long callId, long nodeId)
+{
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        domAgent->getChildNodes(callId, nodeId);
+}
+
+void InspectorBackend::setAttribute(long callId, long elementId, const String& name, const String& value)
+{
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        domAgent->setAttribute(callId, elementId, name, value);
+}
+
+void InspectorBackend::removeAttribute(long callId, long elementId, const String& name)
+{
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        domAgent->removeAttribute(callId, elementId, name);
+}
+
+void InspectorBackend::setTextNodeValue(long callId, long nodeId, const String& value)
+{
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        domAgent->setTextNodeValue(callId, nodeId, value);
+}
+
+void InspectorBackend::highlight(long nodeId)
+{
+    if (Node* node = nodeForId(nodeId))
         m_inspectorController->highlight(node);
 }
 
+Node* InspectorBackend::nodeForId(long nodeId)
+{
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        return domAgent->nodeForId(nodeId);
+    return 0;
+}
+
+ScriptValue InspectorBackend::wrapObject(const ScriptValue& object)
+{
+    if (m_inspectorController)
+        return m_inspectorController->wrapObject(object);
+    return ScriptValue();
+}
+
+ScriptValue InspectorBackend::unwrapObject(const String& objectId)
+{
+    if (m_inspectorController)
+        return m_inspectorController->unwrapObject(objectId);
+    return ScriptValue();
+}
+
+long InspectorBackend::pushNodePathToFrontend(Node* node, bool selectInUI)
+{
+    InspectorFrontend* frontend = inspectorFrontend();
+    InspectorDOMAgent* domAgent = inspectorDOMAgent();
+    if (!domAgent || !frontend)
+        return 0;
+    long id = domAgent->pushNodePathToFrontend(node);
+    if (selectInUI)
+        frontend->updateFocusedNode(id);
+    return id;
+}
+
+void InspectorBackend::addNodesToSearchResult(const String& nodeIds)
+{
+    if (InspectorFrontend* frontend = inspectorFrontend())
+        frontend->addNodesToSearchResult(nodeIds);
+}
+
+#if ENABLE(DATABASE)
+void InspectorBackend::selectDatabase(Database* database)
+{
+    if (InspectorFrontend* frontend = inspectorFrontend())
+        frontend->selectDatabase(database);
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+void InspectorBackend::selectDOMStorage(Storage* storage)
+{
+    if (InspectorFrontend* frontend = inspectorFrontend())
+        frontend->selectDOMStorage(storage);
+}
+#endif
+
+InspectorDOMAgent* InspectorBackend::inspectorDOMAgent()
+{
+    if (!m_inspectorController)
+        return 0;
+    return m_inspectorController->domAgent();
+}
+
+InspectorFrontend* InspectorBackend::inspectorFrontend()
+{
+    if (!m_inspectorController)
+        return 0;
+    return m_inspectorController->m_frontend.get();
+}
+
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.h b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.h
index bb891c2..22b46bf 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.h
@@ -38,9 +38,12 @@
 namespace WebCore {
 
 class CachedResource;
+class Database;
 class InspectorClient;
+class InspectorDOMAgent;
 class JavaScriptCallFrame;
 class Node;
+class Storage;
 
 class InspectorBackend : public RefCounted<InspectorBackend>
 {
@@ -68,7 +71,7 @@ public:
     void addResourceSourceToFrame(long identifier, Node* frame);
     bool addSourceToFrame(const String& mimeType, const String& source, Node* frame);
 
-    void clearMessages();
+    void clearMessages(bool clearUI);
 
     void toggleNodeSearch();
 
@@ -92,6 +95,13 @@ public:
 
     const String& platform() const;
 
+    void enableTimeline(bool always);
+    void disableTimeline(bool always);
+    bool timelineEnabled() const;
+
+    void getCookies(long callId);
+    void deleteCookie(const String& cookieName);
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     const ProfilesArray& profiles() const;
 
@@ -108,7 +118,8 @@ public:
 
     JavaScriptCallFrame* currentCallFrame() const;
 
-    void addBreakpoint(const String& sourceID, unsigned lineNumber);
+    void addBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition);
+    void updateBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition);
     void removeBreakpoint(const String& sourceID, unsigned lineNumber);
 
     bool pauseOnExceptions();
@@ -122,11 +133,30 @@ public:
     void stepOutOfFunctionInDebugger();
 #endif
 
+    void dispatchOnInjectedScript(long callId, const String& methodName, const String& arguments);
+    void getChildNodes(long callId, long nodeId);
+    void setAttribute(long callId, long elementId, const String& name, const String& value);
+    void removeAttribute(long callId, long elementId, const String& name);
+    void setTextNodeValue(long callId, long nodeId, const String& value);
+
     // Generic code called from custom implementations.
-    void highlight(Node* node);
+    void highlight(long nodeId);
+    Node* nodeForId(long nodeId);
+    ScriptValue wrapObject(const ScriptValue& object);
+    ScriptValue unwrapObject(const String& objectId);
+    long pushNodePathToFrontend(Node* node, bool selectInUI);
+    void addNodesToSearchResult(const String& nodeIds);
+#if ENABLE(DATABASE)
+    void selectDatabase(Database* database);
+#endif
+#if ENABLE(DOM_STORAGE)
+    void selectDOMStorage(Storage* storage);
+#endif
 
 private:
     InspectorBackend(InspectorController* inspectorController, InspectorClient* client);
+    InspectorDOMAgent* inspectorDOMAgent();
+    InspectorFrontend* inspectorFrontend();
 
     InspectorController* m_inspectorController;
     InspectorClient* m_client;
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.idl b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.idl
index 21e6d99..4540001 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.idl
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.idl
@@ -35,14 +35,14 @@ module core {
         GenerateConstructor
     ] InspectorBackend {
         void hideDOMNodeHighlight();
-        [Custom] void highlightDOMNode(in Node node);
+        [Custom] void highlightDOMNode(in long nodeId);
         void loaded();
         void windowUnloading();
         void attach();
         void detach();
 
         void closeWindow();
-        void clearMessages();
+        void clearMessages(in boolean clearUI);
         void toggleNodeSearch();
 
         boolean isWindowVisible();
@@ -60,6 +60,9 @@ module core {
         DOMString localizedStringsURL();
         DOMString hiddenPanels();
         DOMString platform();
+        void enableTimeline(in boolean always);
+        void disableTimeline(in boolean always);
+        boolean timelineEnabled();
         [ImplementationFunction=moveWindowBy] void moveByUnrestricted(in float x, in float y);
         void setAttachedWindowHeight(in unsigned long height);
         [Custom] DOMObject wrapCallback(in DOMObject callback);
@@ -68,12 +71,16 @@ module core {
         void disableResourceTracking(in boolean always);
         void storeLastActivePanel(in DOMString panelName);
 
+        void getCookies(in long callId);
+        void deleteCookie(in DOMString cookieName);
+
 #if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
         boolean debuggerEnabled();
         void enableDebugger(in boolean always);
         void disableDebugger(in boolean always);
 
-        void addBreakpoint(in DOMString sourceID, in unsigned long lineNumber);
+        void addBreakpoint(in DOMString sourceID, in unsigned long lineNumber, in DOMString condition);
+        void updateBreakpoint(in DOMString sourceID, in unsigned long lineNumber, in DOMString condition);
         void removeBreakpoint(in DOMString sourceID, in unsigned long lineNumber);
 
         void pauseInDebugger();
@@ -97,5 +104,23 @@ module core {
 
         [Custom] Array profiles();
 #endif
-     };
- }
+        void dispatchOnInjectedScript(in long callId, in DOMString methodName, in DOMString arguments);
+        void getChildNodes(in long callId, in long nodeId);
+        void setAttribute(in long callId, in long elementId, in DOMString name, in DOMString value);
+        void removeAttribute(in long callId, in long elementId, in DOMString name);
+        void setTextNodeValue(in long callId, in long nodeId, in DOMString value);
+
+        // Called from InjectedScript.
+        [Custom] DOMObject nodeForId(in long nodeId);
+        [Custom] long wrapObject(in DOMObject object);
+        [Custom] DOMObject unwrapObject(in long objectId);
+        [Custom] int pushNodePathToFrontend(in DOMObject node, in boolean selectInUI);
+        void addNodesToSearchResult(in DOMString nodeIds);
+#if defined(ENABLE_DATABASE) && ENABLE_DATABASE
+        [Custom] void selectDatabase(in DOMObject database);
+#endif
+#if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
+        [Custom] void selectDOMStorage(in DOMObject storage);
+#endif
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorClient.h b/src/3rdparty/webkit/WebCore/inspector/InspectorClient.h
index 2508536..f96662a 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorClient.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorClient.h
@@ -62,6 +62,8 @@ public:
     virtual void populateSetting(const String& key, InspectorController::Setting&) = 0;
     virtual void storeSetting(const String& key, const InspectorController::Setting&) = 0;
     virtual void removeSetting(const String& key) = 0;
+
+    virtual void inspectorWindowObjectCleared() = 0;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
index 2c7e588..6498d84 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
@@ -30,10 +30,13 @@
 #include "config.h"
 #include "InspectorController.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "CString.h"
 #include "CachedResource.h"
 #include "Console.h"
 #include "ConsoleMessage.h"
+#include "CookieJar.h"
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Element.h"
@@ -51,7 +54,9 @@
 #include "InspectorClient.h"
 #include "InspectorFrontend.h"
 #include "InspectorDatabaseResource.h"
+#include "InspectorDOMAgent.h"
 #include "InspectorDOMStorageResource.h"
+#include "InspectorTimelineAgent.h"
 #include "InspectorResource.h"
 #include "JavaScriptProfile.h"
 #include "Page.h"
@@ -60,7 +65,9 @@
 #include "ResourceRequest.h"
 #include "ResourceResponse.h"
 #include "ScriptCallStack.h"
+#include "ScriptFunctionCall.h"
 #include "ScriptObject.h"
+#include "ScriptObjectQuarantine.h"
 #include "ScriptString.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
@@ -102,6 +109,7 @@ static const char* const debuggerEnabledSettingName = "debuggerEnabled";
 static const char* const profilerEnabledSettingName = "profilerEnabled";
 static const char* const inspectorAttachedHeightName = "inspectorAttachedHeight";
 static const char* const lastActivePanelSettingName = "lastActivePanel";
+static const char* const timelineEnabledSettingName = "timelineEnabled";
 
 static const unsigned defaultAttachedHeight = 300;
 static const float minimumAttachedHeight = 250.0f;
@@ -124,6 +132,7 @@ InspectorController::InspectorController(Page* page, InspectorClient* client)
     , m_resourceTrackingEnabled(false)
     , m_resourceTrackingSettingsLoaded(false)
     , m_inspectorBackend(InspectorBackend::create(this, client))
+    , m_lastBoundObjectId(1)
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     , m_debuggerEnabled(false)
     , m_attachDebuggerWhenShown(false)
@@ -257,8 +266,7 @@ void InspectorController::inspect(Node* node)
         return;
     }
 
-    if (windowVisible())
-        focusNode();
+    focusNode();
 }
 
 void InspectorController::focusNode()
@@ -269,7 +277,8 @@ void InspectorController::focusNode()
     ASSERT(m_frontend);
     ASSERT(m_nodeToFocus);
 
-    m_frontend->updateFocusedNode(m_nodeToFocus.get());
+    long id = m_domAgent->pushNodePathToFrontend(m_nodeToFocus.get());
+    m_frontend->updateFocusedNode(id);
     m_nodeToFocus = 0;
 }
 
@@ -297,14 +306,11 @@ bool InspectorController::windowVisible()
 
 void InspectorController::setWindowVisible(bool visible, bool attached)
 {
-    if (visible == m_windowVisible)
+    if (visible == m_windowVisible || !m_frontend)
         return;
 
     m_windowVisible = visible;
 
-    if (!m_frontend)
-        return;
-
     if (m_windowVisible) {
         setAttachedWindow(attached);
         populateScriptObjects();
@@ -373,16 +379,21 @@ void InspectorController::addConsoleMessage(ScriptState* scriptState, ConsoleMes
         m_consoleMessages.append(consoleMessage);
     }
 
-    if (windowVisible())
+    if (m_frontend)
         m_previousMessage->addToConsole(m_frontend.get());
 }
 
-void InspectorController::clearConsoleMessages()
+void InspectorController::clearConsoleMessages(bool clearUI)
 {
     deleteAllValues(m_consoleMessages);
     m_consoleMessages.clear();
     m_previousMessage = 0;
     m_groupLevel = 0;
+    m_idToConsoleObject.clear();
+    if (m_domAgent)
+        m_domAgent->releaseDanglingNodes();
+    if (clearUI && m_frontend)
+        m_frontend->clearConsoleMessages();
 }
 
 void InspectorController::startGroup(MessageSource source, ScriptCallStack* callStack)
@@ -491,14 +502,6 @@ void InspectorController::handleMousePressOnNode(Node* node)
     inspect(node);
 }
 
-void InspectorController::inspectedWindowScriptObjectCleared(Frame* frame)
-{
-    if (!enabled() || !m_frontend)
-        return;
-
-    m_frontend->inspectedWindowScriptObjectCleared(frame);
-}
-
 void InspectorController::windowScriptObjectAvailable()
 {
     if (!m_page || !enabled())
@@ -506,7 +509,6 @@ void InspectorController::windowScriptObjectAvailable()
 
     // Grant the inspector the ability to script the inspected page.
     m_page->mainFrame()->document()->securityOrigin()->grantUniversalAccess();
-
     m_scriptState = scriptStateFromPage(m_page);
     ScriptGlobalObject::set(m_scriptState, "InspectorController", m_inspectorBackend.get());
 }
@@ -520,7 +522,10 @@ void InspectorController::scriptObjectReady()
     ScriptObject webInspectorObj;
     if (!ScriptGlobalObject::get(m_scriptState, "WebInspector", webInspectorObj))
         return;
-    setFrontendProxyObject(m_scriptState, webInspectorObj);
+    ScriptObject injectedScriptObj;
+    if (!ScriptGlobalObject::get(m_scriptState, "InjectedScript", injectedScriptObj))
+        return;
+    setFrontendProxyObject(m_scriptState, webInspectorObj, injectedScriptObj);
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     Setting debuggerEnabled = setting(debuggerEnabledSettingName);
@@ -533,11 +538,20 @@ void InspectorController::scriptObjectReady()
 
     // Make sure our window is visible now that the page loaded
     showWindow();
+
+    m_client->inspectorWindowObjectCleared();
 }
 
-void InspectorController::setFrontendProxyObject(ScriptState* scriptState, ScriptObject webInspectorObj)
+void InspectorController::setFrontendProxyObject(ScriptState* scriptState, ScriptObject webInspectorObj, ScriptObject injectedScriptObj)
 {
-    m_frontend.set(new InspectorFrontend(scriptState, webInspectorObj));
+    m_scriptState = scriptState;
+    m_injectedScriptObj = injectedScriptObj;
+    m_frontend.set(new InspectorFrontend(this, scriptState, webInspectorObj));
+    m_domAgent = new InspectorDOMAgent(m_frontend.get());
+
+    Setting timelineEnabled = setting(timelineEnabledSettingName);
+    if (timelineEnabled.type() == Setting::BooleanType && timelineEnabled.booleanValue())
+        m_timelineAgent = new InspectorTimelineAgent(m_frontend.get());
 }
 
 void InspectorController::show()
@@ -591,6 +605,13 @@ void InspectorController::close()
     closeWindow();
 
     m_frontend.set(0);
+    m_injectedScriptObj = ScriptObject();
+    // m_domAgent is RefPtr. Remove DOM listeners first to ensure that there are
+    // no references to the DOM agent from the DOM tree.
+    if (m_domAgent)
+        m_domAgent->setDocument(0);
+    m_domAgent = 0;
+    m_timelineAgent = 0;
     m_scriptState = 0;
 }
 
@@ -641,6 +662,8 @@ void InspectorController::populateScriptObjects()
         (*it)->bind(m_frontend.get());
 #endif
 
+    if (m_domAgent->setDocument(m_inspectedPage->mainFrame()->document()))
+        resetInjectedScript();
     m_frontend->populateInterface();
 }
 
@@ -664,6 +687,9 @@ void InspectorController::resetScriptObjects()
         (*it)->unbind();
 #endif
 
+    if (m_timelineAgent)
+        m_timelineAgent->reset();
+
     m_frontend->reset();
 }
 
@@ -680,7 +706,7 @@ void InspectorController::pruneResources(ResourcesMap* resourceMap, DocumentLoad
 
         if (!loaderToKeep || !resource->isSameLoader(loaderToKeep)) {
             removeResource(resource);
-            if (windowVisible())
+            if (m_frontend)
                 resource->releaseScriptObject(m_frontend.get(), true);
         }
     }
@@ -696,7 +722,7 @@ void InspectorController::didCommitLoad(DocumentLoader* loader)
     if (loader->frame() == m_inspectedPage->mainFrame()) {
         m_client->inspectedURLChanged(loader->url().string());
 
-        clearConsoleMessages();
+        clearConsoleMessages(false);
 
         m_times.clear();
         m_counts.clear();
@@ -712,10 +738,10 @@ void InspectorController::didCommitLoad(DocumentLoader* loader)
         m_domStorageResources.clear();
 #endif
 
-        if (windowVisible()) {
+        if (m_frontend) {
             resetScriptObjects();
 
-            if (!loader->isLoadingFromCachedPage()) {
+            if (!loader->frameLoader()->isLoadingFromCachedPage()) {
                 ASSERT(m_mainResource && m_mainResource->isSameLoader(loader));
                 // We don't add the main resource until its load is committed. This is
                 // needed to keep the load for a user-entered URL from showing up in the
@@ -729,6 +755,9 @@ void InspectorController::didCommitLoad(DocumentLoader* loader)
                 m_mainResource = 0;
             }
         }
+
+        if (m_domAgent && m_domAgent->setDocument(m_inspectedPage->mainFrame()->document()))
+            resetInjectedScript();
     }
 
     for (Frame* frame = loader->frame(); frame; frame = frame->tree()->traverseNext(loader->frame()))
@@ -806,7 +835,7 @@ void InspectorController::didLoadResourceFromMemoryCache(DocumentLoader* loader,
         return;
 
     ASSERT(m_inspectedPage);
-    bool isMainResource = isMainResourceLoader(loader, KURL(cachedResource->url()));
+    bool isMainResource = isMainResourceLoader(loader, KURL(ParsedURLString, cachedResource->url()));
     ensureResourceTrackingSettingsLoaded();
     if (!isMainResource && !m_resourceTrackingEnabled)
         return;
@@ -820,7 +849,7 @@ void InspectorController::didLoadResourceFromMemoryCache(DocumentLoader* loader,
 
     addResource(resource.get());
 
-    if (windowVisible())
+    if (m_frontend)
         resource->createScriptObject(m_frontend.get());
 }
 
@@ -846,7 +875,7 @@ void InspectorController::identifierForInitialRequest(unsigned long identifier,
 
     addResource(resource.get());
 
-    if (windowVisible() && loader->isLoadingFromCachedPage() && resource == m_mainResource)
+    if (m_frontend && loader->frameLoader()->isLoadingFromCachedPage() && resource == m_mainResource)
         resource->createScriptObject(m_frontend.get());
 }
 
@@ -868,7 +897,7 @@ void InspectorController::willSendRequest(DocumentLoader*, unsigned long identif
         resource->updateResponse(redirectResponse);
     }
 
-    if (resource != m_mainResource && windowVisible())
+    if (resource != m_mainResource && m_frontend)
         resource->createScriptObject(m_frontend.get());
 }
 
@@ -881,7 +910,7 @@ void InspectorController::didReceiveResponse(DocumentLoader*, unsigned long iden
     resource->updateResponse(response);
     resource->markResponseReceivedTime();
 
-    if (windowVisible())
+    if (m_frontend)
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -893,7 +922,7 @@ void InspectorController::didReceiveContentLength(DocumentLoader*, unsigned long
 
     resource->addLength(lengthReceived);
 
-    if (windowVisible())
+    if (m_frontend)
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -909,7 +938,7 @@ void InspectorController::didFinishLoading(DocumentLoader*, unsigned long identi
 
     addResource(resource.get());
 
-    if (windowVisible())
+    if (m_frontend)
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -926,7 +955,7 @@ void InspectorController::didFailLoading(DocumentLoader*, unsigned long identifi
 
     addResource(resource.get());
 
-    if (windowVisible())
+    if (m_frontend)
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -941,7 +970,7 @@ void InspectorController::resourceRetrievedByXMLHttpRequest(unsigned long identi
 
     resource->setXMLHttpResponseText(sourceString);
 
-    if (windowVisible())
+    if (m_frontend)
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -958,7 +987,7 @@ void InspectorController::scriptImported(unsigned long identifier, const String&
     // thing by the Inspector. They should be made into distinct types.
     resource->setXMLHttpResponseText(ScriptString(sourceString));
     
-    if (windowVisible())
+    if (m_frontend)
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -1006,6 +1035,46 @@ void InspectorController::ensureResourceTrackingSettingsLoaded()
         m_resourceTrackingEnabled = true;
 }
 
+void InspectorController::enableTimeline(bool always)
+{
+    if (!enabled())
+        return;
+
+    if (always)
+        setSetting(timelineEnabledSettingName, Setting(true));
+
+    if (m_timelineAgent.get())
+        return;
+
+    m_timelineAgent = new InspectorTimelineAgent(m_frontend.get());
+    if (m_frontend)
+        m_frontend->timelineWasEnabled();
+}
+
+void InspectorController::disableTimeline(bool always)
+{
+    if (!enabled())
+        return;
+
+    if (always)
+        setSetting(timelineEnabledSettingName, Setting(false));
+
+    if (!m_timelineAgent.get())
+        return;
+
+    m_timelineAgent.set(0);
+    if (m_frontend)
+        m_frontend->timelineWasDisabled();
+}
+
+bool InspectorController::timelineEnabled() const
+{
+    if (!enabled())
+        return false;
+
+    return m_timelineAgent.get();
+}
+
 #if ENABLE(DATABASE)
 void InspectorController::didOpenDatabase(Database* database, const String& domain, const String& name, const String& version)
 {
@@ -1016,7 +1085,7 @@ void InspectorController::didOpenDatabase(Database* database, const String& doma
 
     m_databaseResources.add(resource);
 
-    if (windowVisible())
+    if (m_frontend)
         resource->bind(m_frontend.get());
 }
 #endif
@@ -1036,7 +1105,7 @@ void InspectorController::didUseDOMStorage(StorageArea* storageArea, bool isLoca
     RefPtr<InspectorDOMStorageResource> resource = InspectorDOMStorageResource::create(domStorage.get(), isLocalStorage, frame);
 
     m_domStorageResources.add(resource);
-    if (windowVisible())
+    if (m_frontend)
         resource->bind(m_frontend.get());
 }
 #endif
@@ -1060,8 +1129,10 @@ void InspectorController::addProfile(PassRefPtr<Profile> prpProfile, unsigned li
     RefPtr<Profile> profile = prpProfile;
     m_profiles.append(profile);
 
-    if (windowVisible())
-        addScriptProfile(profile.get());
+    if (m_frontend) {
+        JSLock lock(SilenceAssertionsOnly);
+        m_frontend->addProfile(toJS(m_scriptState, profile.get()));
+    }
 
     addProfileFinishedMessageToConsole(profile, lineNumber, sourceURL);
 }
@@ -1086,15 +1157,6 @@ void InspectorController::addStartProfilingMessageToConsole(const UString& title
     addMessageToConsole(JSMessageSource, LogMessageType, LogMessageLevel, message, lineNumber, sourceURL);
 }
 
-void InspectorController::addScriptProfile(Profile* profile)
-{
-    if (!m_frontend)
-        return;
-
-    JSLock lock(SilenceAssertionsOnly);
-    m_frontend->addProfile(toJS(m_scriptState, profile));
-}
-
 UString InspectorController::getCurrentUserInitiatedProfileName(bool incrementProfileNumber = false)
 {
     if (incrementProfileNumber)
@@ -1261,7 +1323,9 @@ void InspectorController::failedToParseSource(ExecState*, const SourceCode& sour
 
 void InspectorController::didPause()
 {
-    m_frontend->pausedScript();
+    ScriptFunctionCall function(m_scriptState, m_injectedScriptObj, "getCallFrames");
+    ScriptValue callFrames = function.call();
+    m_frontend->pausedScript(callFrames);
 }
 
 void InspectorController::didContinue()
@@ -1459,10 +1523,48 @@ InspectorController::SpecialPanels InspectorController::specialPanelForJSName(co
         return ScriptsPanel;
     else if (panelName == "profiles")
         return ProfilesPanel;
-    else if (panelName == "databases")
-        return DatabasesPanel;
+    else if (panelName == "storage" || panelName == "databases")
+        return StoragePanel;
     else
         return ElementsPanel;
 }
 
+ScriptValue InspectorController::wrapObject(const ScriptValue& quarantinedObject)
+{
+    if (quarantinedObject.isObject()) {
+        long id = m_lastBoundObjectId++;
+        String objectId = String::format("object#%ld", id);
+        m_idToConsoleObject.set(objectId, quarantinedObject);
+
+        ScriptFunctionCall function(m_scriptState, m_injectedScriptObj, "createProxyObject");
+        function.appendArgument(quarantinedObject);
+        function.appendArgument(objectId);
+        ScriptValue wrapper = function.call();
+        return wrapper;
+    }
+    return quarantinedObject;
+}
+
+ScriptValue InspectorController::unwrapObject(const String& objectId)
+{
+    HashMap<String, ScriptValue>::iterator it = m_idToConsoleObject.find(objectId);
+    if (it != m_idToConsoleObject.end())
+        return it->second;
+    return ScriptValue();
+}
+
+void InspectorController::resetInjectedScript()
+{
+    ScriptFunctionCall function(m_scriptState, m_injectedScriptObj, "reset");
+    function.call();
+}
+
+void InspectorController::deleteCookie(const String& cookieName)
+{
+    Document* document = m_inspectedPage->mainFrame()->document();
+    WebCore::deleteCookie(document, document->cookieURL(), cookieName);
+}
+
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorController.h b/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
index 771f741..f3e230e 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
@@ -31,7 +31,9 @@
 
 #include "Console.h"
 #include "PlatformString.h"
+#include "ScriptObject.h"
 #include "ScriptState.h"
+#include "ScriptValue.h"
 #include "StringHash.h"
 #include "Timer.h"
 
@@ -53,14 +55,16 @@ namespace WebCore {
 
 class CachedResource;
 class Database;
+class Document;
 class DocumentLoader;
 class GraphicsContext;
 class HitTestResult;
 class InspectorBackend;
 class InspectorClient;
+class InspectorDOMAgent;
 class InspectorFrontend;
+class InspectorTimelineAgent;
 class JavaScriptCallFrame;
-class StorageArea;
 class KURL;
 class Node;
 class Page;
@@ -68,9 +72,9 @@ struct ResourceRequest;
 class ResourceResponse;
 class ResourceError;
 class ScriptCallStack;
-class ScriptObject;
 class ScriptString;
 class SharedBuffer;
+class StorageArea;
 
 class ConsoleMessage;
 class InspectorDatabaseResource;
@@ -91,11 +95,11 @@ public:
     typedef enum {
         CurrentPanel,
         ConsolePanel,
-        DatabasesPanel,
         ElementsPanel,
         ProfilesPanel,
         ResourcesPanel,
-        ScriptsPanel
+        ScriptsPanel,
+        StoragePanel
     } SpecialPanels;
 
     struct Setting {
@@ -180,7 +184,8 @@ public:
 
     void addMessageToConsole(MessageSource, MessageType, MessageLevel, ScriptCallStack*);
     void addMessageToConsole(MessageSource, MessageType, MessageLevel, const String& message, unsigned lineNumber, const String& sourceID);
-    void clearConsoleMessages();
+    void clearConsoleMessages(bool clearUI);
+    const Vector<ConsoleMessage*>& consoleMessages() const { return m_consoleMessages; }
 
     void attachWindow();
     void detachWindow();
@@ -190,10 +195,10 @@ public:
     void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags);
     void handleMousePressOnNode(Node*);
 
-    void inspectedWindowScriptObjectCleared(Frame*);
     void windowScriptObjectAvailable();
 
-    void setFrontendProxyObject(ScriptState* state, ScriptObject object);
+    void setFrontendProxyObject(ScriptState* state, ScriptObject webInspectorObj, ScriptObject injectedScriptObj = ScriptObject());
+    ScriptState* frontendScriptState() const { return m_scriptState; }
 
     void populateScriptObjects();
     void resetScriptObjects();
@@ -217,6 +222,11 @@ public:
     bool resourceTrackingEnabled() const { return m_resourceTrackingEnabled; }
     void ensureResourceTrackingSettingsLoaded();
 
+    void enableTimeline(bool always = false);
+    void disableTimeline(bool always = false);
+    bool timelineEnabled() const;
+    InspectorTimelineAgent* timelineAgent() { return m_timelineAgent.get(); }
+
 #if ENABLE(DATABASE)
     void didOpenDatabase(Database*, const String& domain, const String& name, const String& version);
 #endif
@@ -240,7 +250,6 @@ public:
     void addProfile(PassRefPtr<JSC::Profile>, unsigned lineNumber, const JSC::UString& sourceURL);
     void addProfileFinishedMessageToConsole(PassRefPtr<JSC::Profile>, unsigned lineNumber, const JSC::UString& sourceURL);
     void addStartProfilingMessageToConsole(const JSC::UString& title, unsigned lineNumber, const JSC::UString& sourceURL);
-    void addScriptProfile(JSC::Profile*);
     const ProfilesArray& profiles() const { return m_profiles; }
 
     bool isRecordingUserInitiatedProfile() const { return m_recordingUserInitiatedProfile; }
@@ -267,7 +276,6 @@ public:
 
 private:
     friend class InspectorBackend;
- 
     // Following are used from InspectorBackend and internally.
     void scriptObjectReady();
     void moveWindowBy(float x, float y) const;
@@ -275,6 +283,19 @@ private:
     void setAttachedWindowHeight(unsigned height);
     void storeLastActivePanel(const String& panelName);
     void closeWindow();
+    InspectorDOMAgent* domAgent() { return m_domAgent.get(); }
+
+    friend class InspectorFrontend;
+    // Following are used from InspectorFrontend only. We don't want to expose them to the
+    // rest of the InspectorController clients.
+    // TODO: extract these into a separate interface.
+    ScriptValue wrapObject(const ScriptValue& object);
+    ScriptValue unwrapObject(const String& objectId);
+    
+    void resetInjectedScript();
+
+    void deleteCookie(const String& cookieName);
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     void startUserInitiatedProfilingSoon();
     void toggleRecordButton(bool);
@@ -301,6 +322,9 @@ private:
     Page* m_inspectedPage;
     InspectorClient* m_client;
     OwnPtr<InspectorFrontend> m_frontend;
+    RefPtr<InspectorDOMAgent> m_domAgent;
+    OwnPtr<InspectorTimelineAgent> m_timelineAgent;
+    ScriptObject m_injectedScriptObj;
     Page* m_page;
     RefPtr<Node> m_nodeToFocus;
     RefPtr<InspectorResource> m_mainResource;
@@ -327,6 +351,8 @@ private:
     bool m_resourceTrackingEnabled;
     bool m_resourceTrackingSettingsLoaded;
     RefPtr<InspectorBackend> m_inspectorBackend;
+    HashMap<String, ScriptValue> m_idToConsoleObject;
+    long m_lastBoundObjectId;
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     bool m_debuggerEnabled;
     bool m_attachDebuggerWhenShown;
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.cpp
new file mode 100644
index 0000000..c7299d6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.cpp
@@ -0,0 +1,561 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009 Joseph Pecoraro
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorDOMAgent.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "AtomicString.h"
+#include "ContainerNode.h"
+#include "Cookie.h"
+#include "CookieJar.h"
+#include "DOMWindow.h"
+#include "Document.h"
+#include "Event.h"
+#include "EventListener.h"
+#include "EventNames.h"
+#include "EventTarget.h"
+#include "HTMLFrameOwnerElement.h"
+#include "InspectorFrontend.h"
+#include "markup.h"
+#include "MutationEvent.h"
+#include "Node.h"
+#include "NodeList.h"
+#include "PlatformString.h"
+#include "ScriptObject.h"
+#include "Text.h"
+
+#include <wtf/OwnPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+InspectorDOMAgent::InspectorDOMAgent(InspectorFrontend* frontend)
+    : EventListener(InspectorDOMAgentType)
+    , m_frontend(frontend)
+    , m_lastNodeId(1)
+{
+}
+
+InspectorDOMAgent::~InspectorDOMAgent()
+{
+    setDocument(0);
+}
+
+bool InspectorDOMAgent::setDocument(Document* doc)
+{
+    if (doc == mainFrameDocument())
+        return false;
+    discardBindings();
+
+    ListHashSet<RefPtr<Document> > copy = m_documents;
+    for (ListHashSet<RefPtr<Document> >::iterator it = copy.begin(); it != copy.end(); ++it)
+        stopListening((*it).get());
+
+    ASSERT(!m_documents.size());
+
+    if (doc) {
+        startListening(doc);
+        if (doc->documentElement()) {
+            pushDocumentToFrontend();
+        }
+    }
+    return true;
+}
+
+void InspectorDOMAgent::releaseDanglingNodes()
+{
+    deleteAllValues(m_danglingNodeToIdMaps);
+    m_danglingNodeToIdMaps.clear();
+}
+
+void InspectorDOMAgent::startListening(Document* doc)
+{
+    if (m_documents.contains(doc))
+        return;
+
+    doc->addEventListener(eventNames().DOMContentLoadedEvent, this, false);
+    doc->addEventListener(eventNames().DOMNodeInsertedEvent, this, false);
+    doc->addEventListener(eventNames().DOMNodeRemovedEvent, this, false);
+    doc->addEventListener(eventNames().DOMAttrModifiedEvent, this, false);
+    doc->addEventListener(eventNames().loadEvent, this, true);
+    m_documents.add(doc);
+}
+
+void InspectorDOMAgent::stopListening(Document* doc)
+{
+    if (!m_documents.contains(doc))
+        return;
+
+    doc->removeEventListener(eventNames().DOMContentLoadedEvent, this, false);
+    doc->removeEventListener(eventNames().DOMNodeInsertedEvent, this, false);
+    doc->removeEventListener(eventNames().DOMNodeRemovedEvent, this, false);
+    doc->removeEventListener(eventNames().DOMAttrModifiedEvent, this, false);
+    doc->removeEventListener(eventNames().loadEvent, this, true);
+    m_documents.remove(doc);
+}
+
+void InspectorDOMAgent::handleEvent(Event* event, bool)
+{
+    AtomicString type = event->type();
+    Node* node = event->target()->toNode();
+
+    if (type == eventNames().DOMAttrModifiedEvent) {
+        long id = m_documentNodeToIdMap.get(node);
+        // If node is not mapped yet -> ignore the event.
+        if (!id)
+            return;
+
+        Element* element = static_cast<Element*>(node);
+        m_frontend->attributesUpdated(id, buildArrayForElementAttributes(element));
+    } else if (type == eventNames().DOMNodeInsertedEvent) {
+        if (isWhitespace(node))
+            return;
+
+        // We could be attaching existing subtree. Forget the bindings.
+        unbind(node, &m_documentNodeToIdMap);
+
+        Node* parent = static_cast<MutationEvent*>(event)->relatedNode();
+        long parentId = m_documentNodeToIdMap.get(parent);
+        // Return if parent is not mapped yet.
+        if (!parentId)
+            return;
+
+        if (!m_childrenRequested.contains(parentId)) {
+            // No children are mapped yet -> only notify on changes of hasChildren.
+            m_frontend->childNodeCountUpdated(parentId, innerChildNodeCount(parent));
+        } else {
+            // Children have been requested -> return value of a new child.
+            Node* prevSibling = innerPreviousSibling(node);
+            long prevId = prevSibling ? m_documentNodeToIdMap.get(prevSibling) : 0;
+            ScriptObject value = buildObjectForNode(node, 0, &m_documentNodeToIdMap);
+            m_frontend->childNodeInserted(parentId, prevId, value);
+        }
+    } else if (type == eventNames().DOMNodeRemovedEvent) {
+        if (isWhitespace(node))
+            return;
+
+        Node* parent = static_cast<MutationEvent*>(event)->relatedNode();
+        long parentId = m_documentNodeToIdMap.get(parent);
+        // If parent is not mapped yet -> ignore the event.
+        if (!parentId)
+            return;
+
+        if (!m_childrenRequested.contains(parentId)) {
+            // No children are mapped yet -> only notify on changes of hasChildren.
+            if (innerChildNodeCount(parent) == 1)
+                m_frontend->childNodeCountUpdated(parentId, 0);
+        } else {
+            m_frontend->childNodeRemoved(parentId, m_documentNodeToIdMap.get(node));
+        }
+        unbind(node, &m_documentNodeToIdMap);
+    } else if (type == eventNames().DOMContentLoadedEvent) {
+        // Re-push document once it is loaded.
+        discardBindings();
+        pushDocumentToFrontend();
+    } else if (type == eventNames().loadEvent) {
+        long frameOwnerId = m_documentNodeToIdMap.get(node);
+        if (!frameOwnerId)
+            return;
+
+        if (!m_childrenRequested.contains(frameOwnerId)) {
+            // No children are mapped yet -> only notify on changes of hasChildren.
+            m_frontend->childNodeCountUpdated(frameOwnerId, innerChildNodeCount(node));
+        } else {
+            // Re-add frame owner element together with its new children.
+            long parentId = m_documentNodeToIdMap.get(innerParentNode(node));
+            m_frontend->childNodeRemoved(parentId, frameOwnerId);
+            long prevId = m_documentNodeToIdMap.get(innerPreviousSibling(node));
+            ScriptObject value = buildObjectForNode(node, 0, &m_documentNodeToIdMap);
+            m_frontend->childNodeInserted(parentId, prevId, value);
+            // Invalidate children requested flag for the element.
+            m_childrenRequested.remove(m_childrenRequested.find(frameOwnerId));
+        }
+    }
+}
+
+long InspectorDOMAgent::bind(Node* node, NodeToIdMap* nodesMap)
+{
+    long id = nodesMap->get(node);
+    if (id)
+        return id;
+    id = m_lastNodeId++;
+    nodesMap->set(node, id);
+    m_idToNode.set(id, node);
+    m_idToNodesMap.set(id, nodesMap);
+    return id;
+}
+
+void InspectorDOMAgent::unbind(Node* node, NodeToIdMap* nodesMap)
+{
+    if (node->isFrameOwnerElement()) {
+        const HTMLFrameOwnerElement* frameOwner = static_cast<const HTMLFrameOwnerElement*>(node);
+        stopListening(frameOwner->contentDocument());
+    }
+
+    int id = nodesMap->get(node);
+    if (!id)
+        return;
+    m_idToNode.remove(id);
+    nodesMap->remove(node);
+    bool childrenRequested = m_childrenRequested.contains(id);
+    if (childrenRequested) {
+        // Unbind subtree known to client recursively.
+        m_childrenRequested.remove(id);
+        Node* child = innerFirstChild(node);
+        while (child) {
+            unbind(child, nodesMap);
+            child = innerNextSibling(child);
+        }
+    }
+}
+
+void InspectorDOMAgent::pushDocumentToFrontend()
+{
+    Document* document = mainFrameDocument();
+    if (!m_documentNodeToIdMap.contains(document))
+        m_frontend->setDocument(buildObjectForNode(document, 2, &m_documentNodeToIdMap));
+}
+
+void InspectorDOMAgent::pushChildNodesToFrontend(long nodeId)
+{
+    Node* node = nodeForId(nodeId);
+    if (!node || (node->nodeType() != Node::ELEMENT_NODE && node->nodeType() != Node::DOCUMENT_NODE))
+        return;
+    if (m_childrenRequested.contains(nodeId))
+        return;
+
+    NodeToIdMap* nodeMap = m_idToNodesMap.get(nodeId);
+    ScriptArray children = buildArrayForContainerChildren(node, 1, nodeMap);
+    m_childrenRequested.add(nodeId);
+    m_frontend->setChildNodes(nodeId, children);
+}
+
+void InspectorDOMAgent::discardBindings()
+{
+    m_documentNodeToIdMap.clear();
+    m_idToNode.clear();
+    releaseDanglingNodes();
+    m_childrenRequested.clear();
+}
+
+Node* InspectorDOMAgent::nodeForId(long id)
+{
+    if (!id)
+        return 0;
+
+    HashMap<long, Node*>::iterator it = m_idToNode.find(id);
+    if (it != m_idToNode.end())
+        return it->second;
+    return 0;
+}
+
+void InspectorDOMAgent::getChildNodes(long callId, long nodeId)
+{
+    pushChildNodesToFrontend(nodeId);
+    m_frontend->didGetChildNodes(callId);
+}
+
+long InspectorDOMAgent::pushNodePathToFrontend(Node* nodeToPush)
+{
+    ASSERT(nodeToPush);  // Invalid input
+
+    // If we are sending information to the client that is currently being created. Send root node first.
+    pushDocumentToFrontend();
+
+    // Return id in case the node is known.
+    long result = m_documentNodeToIdMap.get(nodeToPush);
+    if (result)
+        return result;
+
+    Node* node = nodeToPush;
+    Vector<Node*> path;
+    NodeToIdMap* danglingMap = 0;
+    while (true) {
+        Node* parent = innerParentNode(node);
+        if (!parent) {
+            // Node being pushed is detached -> push subtree root.
+            danglingMap = new NodeToIdMap();
+            m_danglingNodeToIdMaps.append(danglingMap);
+            m_frontend->setDetachedRoot(buildObjectForNode(node, 0, danglingMap));
+            break;
+        } else {
+            path.append(parent);
+            if (m_documentNodeToIdMap.get(parent))
+                break;
+            else
+                node = parent;
+        }
+    }
+
+    NodeToIdMap* map = danglingMap ? danglingMap : &m_documentNodeToIdMap;
+    for (int i = path.size() - 1; i >= 0; --i) {
+        long nodeId = map->get(path.at(i));
+        ASSERT(nodeId);
+        pushChildNodesToFrontend(nodeId);
+    }
+    return map->get(nodeToPush);
+}
+
+void InspectorDOMAgent::setAttribute(long callId, long elementId, const String& name, const String& value)
+{
+    Node* node = nodeForId(elementId);
+    if (node && (node->nodeType() == Node::ELEMENT_NODE)) {
+        Element* element = static_cast<Element*>(node);
+        ExceptionCode ec = 0;
+        element->setAttribute(name, value, ec);
+        m_frontend->didApplyDomChange(callId, ec == 0);
+    } else {
+        m_frontend->didApplyDomChange(callId, false);
+    }
+}
+
+void InspectorDOMAgent::removeAttribute(long callId, long elementId, const String& name)
+{
+    Node* node = nodeForId(elementId);
+    if (node && (node->nodeType() == Node::ELEMENT_NODE)) {
+        Element* element = static_cast<Element*>(node);
+        ExceptionCode ec = 0;
+        element->removeAttribute(name, ec);
+        m_frontend->didApplyDomChange(callId, ec == 0);
+    } else {
+        m_frontend->didApplyDomChange(callId, false);
+    }
+}
+
+void InspectorDOMAgent::setTextNodeValue(long callId, long nodeId, const String& value)
+{
+    Node* node = nodeForId(nodeId);
+    if (node && (node->nodeType() == Node::TEXT_NODE)) {
+        Text* text_node = static_cast<Text*>(node);
+        ExceptionCode ec = 0;
+        text_node->replaceWholeText(value, ec);
+        m_frontend->didApplyDomChange(callId, ec == 0);
+    } else {
+        m_frontend->didApplyDomChange(callId, false);
+    }
+}
+
+void InspectorDOMAgent::getCookies(long callId)
+{
+    Document* doc = mainFrameDocument();
+    Vector<Cookie> cookiesList;
+    bool isImplemented = getRawCookies(doc, doc->cookieURL(), cookiesList);
+
+    if (!isImplemented)
+        m_frontend->didGetCookies(callId, m_frontend->newScriptArray(), doc->cookie());
+    else
+        m_frontend->didGetCookies(callId, buildArrayForCookies(cookiesList), String());
+}
+
+ScriptObject InspectorDOMAgent::buildObjectForNode(Node* node, int depth, NodeToIdMap* nodesMap)
+{
+    ScriptObject value = m_frontend->newScriptObject();
+
+    long id = bind(node, nodesMap);
+    String nodeName;
+    String nodeValue;
+
+    switch (node->nodeType()) {
+        case Node::TEXT_NODE:
+        case Node::COMMENT_NODE:
+            nodeValue = node->nodeValue();
+            break;
+        case Node::ATTRIBUTE_NODE:
+        case Node::DOCUMENT_FRAGMENT_NODE:
+            break;
+        case Node::DOCUMENT_NODE:
+        case Node::ELEMENT_NODE:
+        default:
+            nodeName = node->nodeName();
+            break;
+    }
+
+    value.set("id", static_cast<int>(id));
+    value.set("nodeType", node->nodeType());
+    value.set("nodeName", nodeName);
+    value.set("nodeValue", nodeValue);
+
+    if (node->nodeType() == Node::ELEMENT_NODE) {
+        Element* element = static_cast<Element*>(node);
+        value.set("attributes", buildArrayForElementAttributes(element));
+    }
+    if (node->nodeType() == Node::ELEMENT_NODE || node->nodeType() == Node::DOCUMENT_NODE) {
+        int nodeCount = innerChildNodeCount(node);
+        value.set("childNodeCount", nodeCount);
+        ScriptArray children = buildArrayForContainerChildren(node, depth, nodesMap);
+        if (children.length() > 0)
+            value.set("children", children);
+    }
+    return value;
+}
+
+ScriptArray InspectorDOMAgent::buildArrayForElementAttributes(Element* element)
+{
+    ScriptArray attributesValue = m_frontend->newScriptArray();
+    // Go through all attributes and serialize them.
+    const NamedNodeMap* attrMap = element->attributes(true);
+    if (!attrMap)
+        return attributesValue;
+    unsigned numAttrs = attrMap->length();
+    int index = 0;
+    for (unsigned i = 0; i < numAttrs; ++i) {
+        // Add attribute pair
+        const Attribute *attribute = attrMap->attributeItem(i);
+        attributesValue.set(index++, attribute->name().toString());
+        attributesValue.set(index++, attribute->value());
+    }
+    return attributesValue;
+}
+
+ScriptArray InspectorDOMAgent::buildArrayForContainerChildren(Node* container, int depth, NodeToIdMap* nodesMap)
+{
+    ScriptArray children = m_frontend->newScriptArray();
+    if (depth == 0) {
+        int index = 0;
+        // Special case the_only text child.
+        if (innerChildNodeCount(container) == 1) {
+            Node *child = innerFirstChild(container);
+            if (child->nodeType() == Node::TEXT_NODE)
+                children.set(index++, buildObjectForNode(child, 0, nodesMap));
+        }
+        return children;
+    } else if (depth > 0) {
+        depth--;
+    }
+
+    int index = 0;
+    for (Node *child = innerFirstChild(container); child; child = innerNextSibling(child))
+        children.set(index++, buildObjectForNode(child, depth, nodesMap));
+    return children;
+}
+
+ScriptObject InspectorDOMAgent::buildObjectForCookie(const Cookie& cookie)
+{
+    ScriptObject value = m_frontend->newScriptObject();
+    value.set("name", cookie.name);
+    value.set("value", cookie.value);
+    value.set("domain", cookie.domain);
+    value.set("path", cookie.path);
+    value.set("expires", cookie.expires);
+    value.set("size", static_cast<int>(cookie.name.length() + cookie.value.length()));
+    value.set("httpOnly", cookie.httpOnly);
+    value.set("secure", cookie.secure);
+    value.set("session", cookie.session);
+    return value;
+}
+
+ScriptArray InspectorDOMAgent::buildArrayForCookies(const Vector<Cookie>& cookiesList)
+{
+    ScriptArray cookies = m_frontend->newScriptArray();
+    unsigned length = cookiesList.size();
+    for (unsigned i = 0; i < length; ++i) {
+        const Cookie& cookie = cookiesList[i];
+        cookies.set(i, buildObjectForCookie(cookie));
+    }
+    return cookies;
+}
+
+Node* InspectorDOMAgent::innerFirstChild(Node* node)
+{
+    if (node->isFrameOwnerElement()) {
+        HTMLFrameOwnerElement* frameOwner = static_cast<HTMLFrameOwnerElement*>(node);
+        Document* doc = frameOwner->contentDocument();
+        if (doc) {
+            startListening(doc);
+            return doc->firstChild();
+        }
+    }
+    node = node->firstChild();
+    while (isWhitespace(node))
+        node = node->nextSibling();
+    return node;
+}
+
+Node* InspectorDOMAgent::innerNextSibling(Node* node)
+{
+    do {
+        node = node->nextSibling();
+    } while (isWhitespace(node));
+    return node;
+}
+
+Node* InspectorDOMAgent::innerPreviousSibling(Node* node)
+{
+    do {
+        node = node->previousSibling();
+    } while (isWhitespace(node));
+    return node;
+}
+
+int InspectorDOMAgent::innerChildNodeCount(Node* node)
+{
+    int count = 0;
+    Node* child = innerFirstChild(node);
+    while (child) {
+        count++;
+        child = innerNextSibling(child);
+    }
+    return count;
+}
+
+Node* InspectorDOMAgent::innerParentNode(Node* node)
+{
+    Node* parent = node->parentNode();
+    if (parent && parent->nodeType() == Node::DOCUMENT_NODE)
+        return static_cast<Document*>(parent)->ownerElement();
+    return parent;
+}
+
+bool InspectorDOMAgent::isWhitespace(Node* node)
+{
+    //TODO: pull ignoreWhitespace setting from the frontend and use here.
+    return node && node->nodeType() == Node::TEXT_NODE && node->nodeValue().stripWhiteSpace().length() == 0;
+}
+
+Document* InspectorDOMAgent::mainFrameDocument() const
+{
+    ListHashSet<RefPtr<Document> >::const_iterator it = m_documents.begin();
+    if (it != m_documents.end())
+        return it->get();
+    return 0;
+}
+
+bool InspectorDOMAgent::operator==(const EventListener& listener)
+{
+    if (const InspectorDOMAgent* inspectorDOMAgentListener = InspectorDOMAgent::cast(&listener))
+        return mainFrameDocument() == inspectorDOMAgentListener->mainFrameDocument();
+    return false;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.h b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.h
new file mode 100644
index 0000000..3f4eaf5
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.h
@@ -0,0 +1,130 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InspectorDOMAgent_h
+#define InspectorDOMAgent_h
+
+#include "EventListener.h"
+#include "ScriptArray.h"
+#include "ScriptObject.h"
+#include "ScriptState.h"
+
+#include <wtf/ListHashSet.h>
+#include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+    class ContainerNode;
+    class Element;
+    class Event;
+    class Document;
+    class InspectorFrontend;
+    class NameNodeMap;
+    class Node;
+    class Page;
+
+    struct Cookie;
+
+    class InspectorDOMAgent : public EventListener {
+    public:
+        static const InspectorDOMAgent* cast(const EventListener* listener)
+        {
+            return listener->type() == InspectorDOMAgentType
+                ? static_cast<const InspectorDOMAgent*>(listener)
+                : 0;
+        }
+
+        InspectorDOMAgent(InspectorFrontend* frontend);
+        ~InspectorDOMAgent();
+
+        virtual bool operator==(const EventListener& other);
+
+        // Methods called from the frontend.
+        void getChildNodes(long callId, long nodeId);
+        void setAttribute(long callId, long elementId, const String& name, const String& value);
+        void removeAttribute(long callId, long elementId, const String& name);
+        void setTextNodeValue(long callId, long nodeId, const String& value);
+        void getCookies(long callId);
+
+        // Methods called from the InspectorController.
+        bool setDocument(Document* document);
+        void releaseDanglingNodes();
+
+        Node* nodeForId(long nodeId);
+        long pushNodePathToFrontend(Node* node);
+
+   private:
+        void startListening(Document* document);
+        void stopListening(Document* document);
+
+        virtual void handleEvent(Event* event, bool isWindowEvent);
+
+        typedef HashMap<RefPtr<Node>, long> NodeToIdMap;
+        long bind(Node* node, NodeToIdMap* nodesMap);
+        void unbind(Node* node, NodeToIdMap* nodesMap);
+
+        void pushDocumentToFrontend();
+        void pushChildNodesToFrontend(long nodeId);
+
+        ScriptObject buildObjectForNode(Node* node, int depth, NodeToIdMap* nodesMap);
+        ScriptArray buildArrayForElementAttributes(Element* element);
+        ScriptArray buildArrayForContainerChildren(Node* container, int depth, NodeToIdMap* nodesMap);
+
+        ScriptObject buildObjectForCookie(const Cookie& cookie);
+        ScriptArray buildArrayForCookies(const Vector<Cookie>& cookiesList);
+
+        // We represent embedded doms as a part of the same hierarchy. Hence we treat children of frame owners differently.
+        // We also skip whitespace text nodes conditionally. Following methods encapsulate these specifics.
+        Node* innerFirstChild(Node* node);
+        Node* innerNextSibling(Node* node);
+        Node* innerPreviousSibling(Node* node);
+        int innerChildNodeCount(Node* node);
+        Node* innerParentNode(Node* node);
+        bool isWhitespace(Node* node);
+
+        Document* mainFrameDocument() const;
+        void discardBindings();
+
+        InspectorFrontend* m_frontend;
+        NodeToIdMap m_documentNodeToIdMap;
+        // Owns node mappings for dangling nodes.
+        Vector<NodeToIdMap*> m_danglingNodeToIdMaps;
+        HashMap<long, Node*> m_idToNode;
+        HashMap<long, NodeToIdMap*> m_idToNodesMap;
+        HashSet<long> m_childrenRequested;
+        long m_lastNodeId;
+        ListHashSet<RefPtr<Document> > m_documents;
+    };
+
+
+} // namespace WebCore
+
+#endif // !defined(InspectorDOMAgent_h)
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.cpp
index b808a84..2f4aa53 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.cpp
@@ -29,14 +29,15 @@
  */
 
 #include "config.h"
-#if ENABLE(DOM_STORAGE)
+
+#if ENABLE(DOM_STORAGE) && ENABLE(INSPECTOR)
 
 #include "InspectorDOMStorageResource.h"
 
 #include "Document.h"
 #include "Frame.h"
 #include "InspectorFrontend.h"
-#include "InspectorJSONObject.h"
+#include "ScriptObject.h"
 #include "ScriptObjectQuarantine.h"
 #include "Storage.h"
 
@@ -62,9 +63,9 @@ void InspectorDOMStorageResource::bind(InspectorFrontend* frontend)
     if (m_scriptObjectCreated)
         return;
 
-    InspectorJSONObject jsonObject = frontend->newInspectorJSONObject();
+    ScriptObject jsonObject = frontend->newScriptObject();
     ScriptObject domStorage;
-    if (!getQuarantinedScriptObject(m_frame.get(), m_domStorage.get(), domStorage))
+    if (!getQuarantinedScriptObject(m_domStorage.get(), domStorage))
         return;
     jsonObject.set("domStorage", domStorage);
     jsonObject.set("host", m_frame->document()->securityOrigin()->host());
@@ -80,4 +81,5 @@ void InspectorDOMStorageResource::unbind()
 
 } // namespace WebCore
 
-#endif
+#endif // ENABLE(DOM_STORAGE) && ENABLE(INSPECTOR)
+
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.cpp
index c75ca87..a58968f 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.cpp
@@ -29,17 +29,16 @@
  */
 
 #include "config.h"
-#if ENABLE(DATABASE)
 #include "InspectorDatabaseResource.h"
 
+#if ENABLE(DATABASE) && ENABLE(INSPECTOR)
 #include "Database.h"
 #include "Document.h"
 #include "Frame.h"
 #include "InspectorFrontend.h"
-#include "InspectorJSONObject.h"
+#include "ScriptObject.h"
 #include "ScriptObjectQuarantine.h"
 
-
 namespace WebCore {
 
 InspectorDatabaseResource::InspectorDatabaseResource(Database* database, const String& domain, const String& name, const String& version)
@@ -56,7 +55,7 @@ void InspectorDatabaseResource::bind(InspectorFrontend* frontend)
     if (m_scriptObjectCreated)
         return;
 
-    InspectorJSONObject jsonObject = frontend->newInspectorJSONObject();
+    ScriptObject jsonObject = frontend->newScriptObject();
     ScriptObject database;
     if (!getQuarantinedScriptObject(m_database.get(), database))
         return;
@@ -75,4 +74,4 @@ void InspectorDatabaseResource::unbind()
 
 } // namespace WebCore
 
-#endif // ENABLE(DATABASE)
+#endif // ENABLE(DATABASE) && ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp
index c1abd31..c8a2f5c 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp
@@ -30,10 +30,11 @@
 #include "config.h"
 #include "InspectorFrontend.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "ConsoleMessage.h"
 #include "Frame.h"
-#include "InspectorController.h"  // TODO(pfeldman): Extract SpecialPanels to remove include.
-#include "InspectorJSONObject.h"
+#include "InspectorController.h"
 #include "Node.h"
 #include "ScriptFunctionCall.h"
 #include "ScriptObject.h"
@@ -50,8 +51,9 @@
 
 namespace WebCore {
 
-InspectorFrontend::InspectorFrontend(ScriptState* scriptState, ScriptObject webInspector)
-    : m_scriptState(scriptState)
+InspectorFrontend::InspectorFrontend(InspectorController* inspectorController, ScriptState* scriptState, ScriptObject webInspector)
+    : m_inspectorController(inspectorController)
+    , m_scriptState(scriptState)
     , m_webInspector(webInspector)
 {
 }
@@ -61,41 +63,51 @@ InspectorFrontend::~InspectorFrontend()
     m_webInspector = ScriptObject();
 }
 
-InspectorJSONObject InspectorFrontend::newInspectorJSONObject()
+ScriptArray InspectorFrontend::newScriptArray()
+{
+    return ScriptArray::createNew(m_scriptState);
+}
+
+ScriptObject InspectorFrontend::newScriptObject()
 {
-    return InspectorJSONObject::createNew(m_scriptState);
+    return ScriptObject::createNew(m_scriptState);
 }
 
-void InspectorFrontend::addMessageToConsole(const InspectorJSONObject& messageObj, const Vector<ScriptString>& frames, const Vector<ScriptValue> wrappedArguments, const String& message)
+void InspectorFrontend::addMessageToConsole(const ScriptObject& messageObj, const Vector<ScriptString>& frames, const Vector<ScriptValue> wrappedArguments, const String& message)
 {
     OwnPtr<ScriptFunctionCall> function(newFunctionCall("addMessageToConsole"));
-    function->appendArgument(messageObj.scriptObject());
+    function->appendArgument(messageObj);
     if (!frames.isEmpty()) {
         for (unsigned i = 0; i < frames.size(); ++i)
             function->appendArgument(frames[i]);
     } else if (!wrappedArguments.isEmpty()) {
         for (unsigned i = 0; i < wrappedArguments.size(); ++i)
-            function->appendArgument(wrappedArguments[i]);
+            function->appendArgument(m_inspectorController->wrapObject(wrappedArguments[i]));
     } else
         function->appendArgument(message);
     function->call();
 }
 
-bool InspectorFrontend::addResource(long long identifier, const InspectorJSONObject& resourceObj)
+void InspectorFrontend::clearConsoleMessages()
+{
+    callSimpleFunction("clearConsoleMessages");
+}
+
+bool InspectorFrontend::addResource(long long identifier, const ScriptObject& resourceObj)
 {
     OwnPtr<ScriptFunctionCall> function(newFunctionCall("addResource"));
     function->appendArgument(identifier);
-    function->appendArgument(resourceObj.scriptObject());
+    function->appendArgument(resourceObj);
     bool hadException = false;
     function->call(hadException);
     return !hadException;
 }
 
-bool InspectorFrontend::updateResource(long long identifier, const InspectorJSONObject& resourceObj)
+bool InspectorFrontend::updateResource(long long identifier, const ScriptObject& resourceObj)
 {
     OwnPtr<ScriptFunctionCall> function(newFunctionCall("updateResource"));
     function->appendArgument(identifier);
-    function->appendArgument(resourceObj.scriptObject());
+    function->appendArgument(resourceObj);
     bool hadException = false;
     function->call(hadException);
     return !hadException;
@@ -108,14 +120,10 @@ void InspectorFrontend::removeResource(long long identifier)
     function->call();
 }
 
-void InspectorFrontend::updateFocusedNode(Node* node)
+void InspectorFrontend::updateFocusedNode(long long nodeId)
 {
-    ScriptObject quarantinedNode;
-    if (!getQuarantinedScriptObject(node, quarantinedNode))
-        return;
-
     OwnPtr<ScriptFunctionCall> function(newFunctionCall("updateFocusedNode"));
-    function->appendArgument(quarantinedNode);
+    function->appendArgument(nodeId);
     function->call();
 }
 
@@ -126,17 +134,6 @@ void InspectorFrontend::setAttachedWindow(bool attached)
     function->call();
 }
 
-void InspectorFrontend::inspectedWindowScriptObjectCleared(Frame* frame)
-{
-    ScriptObject domWindow;
-    if (!getQuarantinedScriptObject(frame->domWindow(), domWindow))
-        return;
-
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("inspectedWindowCleared"));
-    function->appendArgument(domWindow);
-    function->call();
-}
-
 void InspectorFrontend::showPanel(int panel)
 {
     const char* showFunctionName;
@@ -144,9 +141,6 @@ void InspectorFrontend::showPanel(int panel)
         case InspectorController::ConsolePanel:
             showFunctionName = "showConsole";
             break;
-        case InspectorController::DatabasesPanel:
-            showFunctionName = "showDatabasesPanel";
-            break;
         case InspectorController::ElementsPanel:
             showFunctionName = "showElementsPanel";
             break;
@@ -159,6 +153,9 @@ void InspectorFrontend::showPanel(int panel)
         case InspectorController::ScriptsPanel:
             showFunctionName = "showScriptsPanel";
             break;
+        case InspectorController::StoragePanel:
+            showFunctionName = "showStoragePanel";
+            break;
         default:
             ASSERT_NOT_REACHED();
             showFunctionName = 0;
@@ -188,6 +185,23 @@ void InspectorFrontend::resourceTrackingWasDisabled()
     callSimpleFunction("resourceTrackingWasDisabled");
 }
 
+void InspectorFrontend::timelineWasEnabled()
+{
+    callSimpleFunction("timelineWasEnabled");
+}
+
+void InspectorFrontend::timelineWasDisabled()
+{
+    callSimpleFunction("timelineWasDisabled");
+}
+
+void InspectorFrontend::addItemToTimeline(const ScriptObject& itemObj)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addItemToTimeline"));
+    function->appendArgument(itemObj);
+    function->call();
+}
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 void InspectorFrontend::attachDebuggerWhenShown()
 {
@@ -249,9 +263,11 @@ void InspectorFrontend::setRecordingProfile(bool isProfiling)
     function->call();
 }
 
-void InspectorFrontend::pausedScript()
+void InspectorFrontend::pausedScript(const ScriptValue& callFrames)
 {
-    callSimpleFunction("pausedScript");
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("pausedScript"));
+    function->appendArgument(callFrames);
+    function->call();
 }
 
 void InspectorFrontend::resumedScript()
@@ -261,10 +277,10 @@ void InspectorFrontend::resumedScript()
 #endif
 
 #if ENABLE(DATABASE)
-bool InspectorFrontend::addDatabase(const InspectorJSONObject& dbObject)
+bool InspectorFrontend::addDatabase(const ScriptObject& dbObject)
 {
     OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDatabase"));
-    function->appendArgument(dbObject.scriptObject());
+    function->appendArgument(dbObject);
     bool hadException = false;
     function->call(hadException);
     return !hadException;
@@ -272,16 +288,135 @@ bool InspectorFrontend::addDatabase(const InspectorJSONObject& dbObject)
 #endif
 
 #if ENABLE(DOM_STORAGE)
-bool InspectorFrontend::addDOMStorage(const InspectorJSONObject& domStorageObj)
+bool InspectorFrontend::addDOMStorage(const ScriptObject& domStorageObj)
 {
     OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDOMStorage"));
-    function->appendArgument(domStorageObj.scriptObject());
+    function->appendArgument(domStorageObj);
     bool hadException = false;
     function->call(hadException);
     return !hadException;
 }
 #endif
 
+void InspectorFrontend::setDocument(const ScriptObject& root)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setDocument"));
+    function->appendArgument(root);
+    function->call();
+}
+
+void InspectorFrontend::setDetachedRoot(const ScriptObject& root)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setDetachedRoot"));
+    function->appendArgument(root);
+    function->call();
+}
+
+void InspectorFrontend::setChildNodes(int parentId, const ScriptArray& nodes)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setChildNodes"));
+    function->appendArgument(parentId);
+    function->appendArgument(nodes);
+    function->call();
+}
+
+void InspectorFrontend::childNodeCountUpdated(int id, int newValue)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("childNodeCountUpdated"));
+    function->appendArgument(id);
+    function->appendArgument(newValue);
+    function->call();
+}
+
+void InspectorFrontend::childNodeInserted(int parentId, int prevId, const ScriptObject& node)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("childNodeInserted"));
+    function->appendArgument(parentId);
+    function->appendArgument(prevId);
+    function->appendArgument(node);
+    function->call();
+}
+
+void InspectorFrontend::childNodeRemoved(int parentId, int id)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("childNodeRemoved"));
+    function->appendArgument(parentId);
+    function->appendArgument(id);
+    function->call();
+}
+
+void InspectorFrontend::attributesUpdated(int id, const ScriptArray& attributes)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("attributesUpdated"));
+    function->appendArgument(id);
+    function->appendArgument(attributes);
+    function->call();
+}
+
+void InspectorFrontend::didGetChildNodes(int callId)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetChildNodes"));
+    function->appendArgument(callId);
+    function->call();
+}
+
+void InspectorFrontend::didApplyDomChange(int callId, bool success)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didApplyDomChange"));
+    function->appendArgument(callId);
+    function->appendArgument(success);
+    function->call();
+}
+
+void InspectorFrontend::didGetCookies(int callId, const ScriptArray& cookies, const String& cookiesString)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetCookies"));
+    function->appendArgument(callId);
+    function->appendArgument(cookies);
+    function->appendArgument(cookiesString);
+    function->call();
+}
+
+void InspectorFrontend::didDispatchOnInjectedScript(int callId, const String& result, bool isException)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didDispatchOnInjectedScript"));
+    function->appendArgument(callId);
+    function->appendArgument(result);
+    function->appendArgument(isException);
+    function->call();
+}
+
+#if ENABLE(DATABASE)
+void InspectorFrontend::selectDatabase(Database* database)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("selectDatabase"));
+    ScriptObject quarantinedObject;
+    if (!getQuarantinedScriptObject(database, quarantinedObject))
+        return;
+    function->appendArgument(quarantinedObject);
+    function->call();
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+void InspectorFrontend::selectDOMStorage(Storage* storage)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("selectDOMStorage"));
+    ScriptObject quarantinedObject;
+    if (!getQuarantinedScriptObject(storage, quarantinedObject))
+        return;
+    function->appendArgument(quarantinedObject);
+    function->call();
+}
+#endif
+
+void InspectorFrontend::addNodesToSearchResult(const String& nodeIds)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addNodesToSearchResult"));
+    function->appendArgument(nodeIds);
+    function->call();
+}
+
 PassOwnPtr<ScriptFunctionCall> InspectorFrontend::newFunctionCall(const String& functionName)
 {
     ScriptFunctionCall* function = new ScriptFunctionCall(m_scriptState, m_webInspector, "dispatch");
@@ -297,3 +432,5 @@ void InspectorFrontend::callSimpleFunction(const String& functionName)
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.h b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.h
index 1bf3fea..42768e6 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.h
@@ -30,7 +30,8 @@
 #ifndef InspectorFrontend_h
 #define InspectorFrontend_h
 
-#include "InspectorJSONObject.h"
+#include "ScriptArray.h"
+#include "ScriptObject.h"
 #include "ScriptState.h"
 #include <wtf/PassOwnPtr.h>
 
@@ -44,26 +45,32 @@ namespace JSC {
 
 namespace WebCore {
     class ConsoleMessage;
+    class Database;
+    class Frame;
+    class InspectorController;
     class InspectorResource;
     class Node;
     class ScriptFunctionCall;
     class ScriptString;
+    class Storage;
 
     class InspectorFrontend {
     public:
-        InspectorFrontend(ScriptState*, ScriptObject webInspector);
+        InspectorFrontend(InspectorController* inspectorController, ScriptState*, ScriptObject webInspector);
         ~InspectorFrontend();
-        InspectorJSONObject newInspectorJSONObject();
 
-        void addMessageToConsole(const InspectorJSONObject& messageObj, const Vector<ScriptString>& frames, const Vector<ScriptValue> wrappedArguments, const String& message);
-        
-        bool addResource(long long identifier, const InspectorJSONObject& resourceObj);
-        bool updateResource(long long identifier, const InspectorJSONObject& resourceObj);
+        ScriptArray newScriptArray();
+        ScriptObject newScriptObject();
+
+        void addMessageToConsole(const ScriptObject& messageObj, const Vector<ScriptString>& frames, const Vector<ScriptValue> wrappedArguments, const String& message);
+        void clearConsoleMessages();
+
+        bool addResource(long long identifier, const ScriptObject& resourceObj);
+        bool updateResource(long long identifier, const ScriptObject& resourceObj);
         void removeResource(long long identifier);
 
-        void updateFocusedNode(Node* node);
+        void updateFocusedNode(long long nodeId);
         void setAttachedWindow(bool attached);
-        void inspectedWindowScriptObjectCleared(Frame* frame);
         void showPanel(int panel);
         void populateInterface();
         void reset();
@@ -81,21 +88,43 @@ namespace WebCore {
         void failedToParseScriptSource(const JSC::SourceCode&, int errorLine, const JSC::UString& errorMessage);
         void addProfile(const JSC::JSValue& profile);
         void setRecordingProfile(bool isProfiling);
-        void pausedScript();
+        void pausedScript(const ScriptValue& callFrames);
         void resumedScript();
 #endif
 
 #if ENABLE(DATABASE)
-        bool addDatabase(const InspectorJSONObject& dbObj);
+        bool addDatabase(const ScriptObject& dbObj);
+        void selectDatabase(Database* database);
 #endif
         
 #if ENABLE(DOM_STORAGE)
-        bool addDOMStorage(const InspectorJSONObject& domStorageObj);
+        bool addDOMStorage(const ScriptObject& domStorageObj);
+        void selectDOMStorage(Storage* storage);
 #endif
 
+        void setDocument(const ScriptObject& root);
+        void setDetachedRoot(const ScriptObject& root);
+        void setChildNodes(int parentId, const ScriptArray& nodes);
+        void childNodeCountUpdated(int id, int newValue);
+        void childNodeInserted(int parentId, int prevId, const ScriptObject& node);
+        void childNodeRemoved(int parentId, int id);
+        void attributesUpdated(int id, const ScriptArray& attributes);
+        void didGetChildNodes(int callId);
+        void didApplyDomChange(int callId, bool success);
+
+        void timelineWasEnabled();
+        void timelineWasDisabled();
+        void addItemToTimeline(const ScriptObject& itemObj);
+
+        void didGetCookies(int callId, const ScriptArray& cookies, const String& cookiesString);
+        void didDispatchOnInjectedScript(int callId, const String& result, bool isException);
+
+        void addNodesToSearchResult(const String& nodeIds);
+
     private:
         PassOwnPtr<ScriptFunctionCall> newFunctionCall(const String& functionName);
         void callSimpleFunction(const String& functionName);
+        InspectorController* m_inspectorController;
         ScriptState* m_scriptState;
         ScriptObject m_webInspector;
     };
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorJSONObject.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorJSONObject.cpp
deleted file mode 100644
index e7b5178..0000000
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorJSONObject.cpp
+++ /dev/null
@@ -1,95 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "InspectorJSONObject.h"
-
-#include "PlatformString.h"
-#include "ScriptObject.h"
-#include "ScriptState.h"
-
-namespace WebCore {
-
-InspectorJSONObject::InspectorJSONObject(ScriptState* scriptState)
-    : m_scriptState(scriptState)
-{
-    m_scriptObject = ScriptObject::createNew(scriptState);
-}
-
-bool InspectorJSONObject::set(const String& name, const String& value)
-{
-    return m_scriptObject.set(m_scriptState, name, value);
-}
-
-bool InspectorJSONObject::set(const char* name, const ScriptObject& value)
-{
-    return m_scriptObject.set(m_scriptState, name, value);
-}
-
-bool InspectorJSONObject::set(const char* name, const InspectorJSONObject& value)
-{
-    return set(name, value.scriptObject());
-}
-
-bool InspectorJSONObject::set(const char* name, const String& value)
-{
-    return m_scriptObject.set(m_scriptState, name, value);
-}
-
-bool InspectorJSONObject::set(const char* name, double value)
-{
-    return m_scriptObject.set(m_scriptState, name, value);
-}
-
-bool InspectorJSONObject::set(const char* name, long long value)
-{
-    return m_scriptObject.set(m_scriptState, name, value);
-}
-
-bool InspectorJSONObject::set(const char* name, int value)
-{
-    return m_scriptObject.set(m_scriptState, name, value);
-}
-
-bool InspectorJSONObject::set(const char* name, bool value)
-{
-    return m_scriptObject.set(m_scriptState, name, value);
-}
-
-ScriptObject InspectorJSONObject::scriptObject() const
-{
-    return m_scriptObject;
-}
-
-InspectorJSONObject InspectorJSONObject::createNew(ScriptState* scriptState)
-{
-    return InspectorJSONObject(scriptState);
-}
-
-} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorJSONObject.h b/src/3rdparty/webkit/WebCore/inspector/InspectorJSONObject.h
deleted file mode 100644
index 5858ff2..0000000
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorJSONObject.h
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-
-#ifndef InspectorJSONObject_h
-#define InspectorJSONObject_h
-
-#include "ScriptObject.h"
-#include "ScriptState.h"
-
-namespace WebCore {
-    class String;
-
-    class InspectorJSONObject {
-    public:
-        bool set(const String& name, const String&);
-        bool set(const char* name, const InspectorJSONObject&);
-        bool set(const char* name, const ScriptObject&);
-        bool set(const char* name, const String&);
-        bool set(const char* name, double);
-        bool set(const char* name, long long);
-        bool set(const char* name, int);
-        bool set(const char* name, bool);
-        ScriptObject scriptObject() const;
-
-        static InspectorJSONObject createNew(ScriptState* scriptState);
-    private:
-        InspectorJSONObject(ScriptState* scriptState);
-        ScriptState* m_scriptState;
-        ScriptObject m_scriptObject;
-    };
-}
-
-#endif // InspectorJSONObject.h
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorResource.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorResource.cpp
index 15ecce0..54d9f92 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorResource.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorResource.cpp
@@ -31,15 +31,17 @@
 #include "config.h"
 #include "InspectorResource.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "CachedResource.h"
 #include "DocLoader.h"
 #include "DocumentLoader.h"
 #include "Frame.h"
 #include "InspectorFrontend.h"
-#include "InspectorJSONObject.h"
 #include "ResourceRequest.h"
 #include "ResourceResponse.h"
 #include "TextEncoding.h"
+#include "ScriptObject.h"
 
 namespace WebCore {
 
@@ -71,7 +73,7 @@ PassRefPtr<InspectorResource> InspectorResource::createCached(long long identifi
 
     resource->m_finished = true;
 
-    resource->m_requestURL = KURL(cachedResource->url());
+    resource->m_requestURL = KURL(ParsedURLString, cachedResource->url());
     resource->updateResponse(cachedResource->response());
 
     resource->m_length = cachedResource->encodedSize();
@@ -89,6 +91,9 @@ void InspectorResource::updateRequest(const ResourceRequest& request)
 {
     m_requestHeaderFields = request.httpHeaderFields();
     m_requestURL = request.url();
+    m_requestMethod = request.httpMethod();
+    if (request.httpBody() && !request.httpBody()->isEmpty())
+        m_requestFormData = request.httpBody()->flattenToString();
 
     m_changes.set(RequestChange);
 }
@@ -105,7 +110,7 @@ void InspectorResource::updateResponse(const ResourceResponse& response)
     m_changes.set(TypeChange);
 }
 
-static void populateHeadersObject(InspectorJSONObject* object, const HTTPHeaderMap& headers)
+static void populateHeadersObject(ScriptObject* object, const HTTPHeaderMap& headers)
 {
     HTTPHeaderMap::const_iterator end = headers.end();
     for (HTTPHeaderMap::const_iterator it = headers.begin(); it != end; ++it) {
@@ -116,8 +121,8 @@ static void populateHeadersObject(InspectorJSONObject* object, const HTTPHeaderM
 void InspectorResource::createScriptObject(InspectorFrontend* frontend)
 {
     if (!m_scriptObjectCreated) {
-        InspectorJSONObject jsonObject = frontend->newInspectorJSONObject();
-        InspectorJSONObject requestHeaders = frontend->newInspectorJSONObject();
+        ScriptObject jsonObject = frontend->newScriptObject();
+        ScriptObject requestHeaders = frontend->newScriptObject();
         populateHeadersObject(&requestHeaders, m_requestHeaderFields);
         jsonObject.set("requestHeaders", requestHeaders);
         jsonObject.set("requestURL", requestURL());
@@ -126,6 +131,8 @@ void InspectorResource::createScriptObject(InspectorFrontend* frontend)
         jsonObject.set("lastPathComponent", m_requestURL.lastPathComponent());
         jsonObject.set("isMainResource", m_isMainResource);
         jsonObject.set("cached", m_cached);
+        jsonObject.set("requestMethod", m_requestMethod);
+        jsonObject.set("requestFormData", m_requestFormData);
         if (!frontend->addResource(m_identifier, jsonObject))
             return;
 
@@ -143,16 +150,18 @@ void InspectorResource::updateScriptObject(InspectorFrontend* frontend)
     if (m_changes.hasChange(NoChange))
         return;
 
-    InspectorJSONObject jsonObject = frontend->newInspectorJSONObject();
+    ScriptObject jsonObject = frontend->newScriptObject();
     if (m_changes.hasChange(RequestChange)) {
         jsonObject.set("url", requestURL());
         jsonObject.set("domain", m_requestURL.host());
         jsonObject.set("path", m_requestURL.path());
         jsonObject.set("lastPathComponent", m_requestURL.lastPathComponent());
-        InspectorJSONObject requestHeaders = frontend->newInspectorJSONObject();
+        ScriptObject requestHeaders = frontend->newScriptObject();
         populateHeadersObject(&requestHeaders, m_requestHeaderFields);
         jsonObject.set("requestHeaders", requestHeaders);
         jsonObject.set("mainResource", m_isMainResource);
+        jsonObject.set("requestMethod", m_requestMethod);
+        jsonObject.set("requestFormData", m_requestFormData);
         jsonObject.set("didRequestChange", true);
     }
 
@@ -162,7 +171,7 @@ void InspectorResource::updateScriptObject(InspectorFrontend* frontend)
         jsonObject.set("expectedContentLength", m_expectedContentLength);
         jsonObject.set("statusCode", m_responseStatusCode);
         jsonObject.set("suggestedFilename", m_suggestedFilename);
-        InspectorJSONObject responseHeaders = frontend->newInspectorJSONObject();
+        ScriptObject responseHeaders = frontend->newScriptObject();
         populateHeadersObject(&responseHeaders, m_responseHeaderFields);
         jsonObject.set("responseHeaders", responseHeaders);
         jsonObject.set("didResponseChange", true);
@@ -323,3 +332,5 @@ void InspectorResource::addLength(int lengthReceived)
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorResource.h b/src/3rdparty/webkit/WebCore/inspector/InspectorResource.h
index 8380a8f..4c85315 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorResource.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorResource.h
@@ -156,6 +156,8 @@ namespace WebCore {
         ScriptString m_xmlHttpResponseText;
         Changes m_changes;
         bool m_isMainResource;
+        String m_requestMethod;
+        String m_requestFormData;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorTimelineAgent.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorTimelineAgent.cpp
new file mode 100644
index 0000000..c3ad075
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorTimelineAgent.cpp
@@ -0,0 +1,142 @@
+/*
+* Copyright (C) 2009 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are
+* met:
+*
+*     * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*     * Redistributions in binary form must reproduce the above
+* copyright notice, this list of conditions and the following disclaimer
+* in the documentation and/or other materials provided with the
+* distribution.
+*     * Neither the name of Google Inc. nor the names of its
+* contributors may be used to endorse or promote products derived from
+* this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#include "config.h"
+#include "InspectorTimelineAgent.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "DOMDispatchTimelineItem.h"
+#include "Event.h"
+#include "InspectorFrontend.h"
+#include "TimelineItem.h"
+
+#include <wtf/CurrentTime.h>
+
+namespace WebCore {
+
+InspectorTimelineAgent::InspectorTimelineAgent(InspectorFrontend* frontend)
+    : m_sessionStartTime(currentTimeInMilliseconds())
+    , m_frontend(frontend)
+    , m_currentTimelineItem(0)
+{
+    ASSERT(m_frontend);
+}
+
+InspectorTimelineAgent::~InspectorTimelineAgent()
+{
+}
+
+void InspectorTimelineAgent::willDispatchDOMEvent(const Event& event)
+{
+    m_currentTimelineItem = new DOMDispatchTimelineItem(m_currentTimelineItem.release(), sessionTimeInMilliseconds(), event);
+}
+
+void InspectorTimelineAgent::didDispatchDOMEvent()
+{
+    ASSERT(m_currentTimelineItem->type() == DOMDispatchTimelineItemType);
+    didCompleteCurrentRecord();
+}
+
+void InspectorTimelineAgent::willLayout()
+{
+    m_currentTimelineItem = new TimelineItem(m_currentTimelineItem.release(), sessionTimeInMilliseconds(), LayoutTimelineItemType);
+}
+
+void InspectorTimelineAgent::didLayout()
+{
+    ASSERT(m_currentTimelineItem->type() == LayoutTimelineItemType);
+    didCompleteCurrentRecord();
+}
+
+void InspectorTimelineAgent::willRecalculateStyle()
+{
+    m_currentTimelineItem = new TimelineItem(m_currentTimelineItem.release(), sessionTimeInMilliseconds(), RecalculateStylesTimelineItemType);
+}
+
+void InspectorTimelineAgent::didRecalculateStyle()
+{
+    ASSERT(m_currentTimelineItem->type() == RecalculateStylesTimelineItemType);
+    didCompleteCurrentRecord();
+}
+
+void InspectorTimelineAgent::willPaint()
+{
+    m_currentTimelineItem = new TimelineItem(m_currentTimelineItem.release(), sessionTimeInMilliseconds(), PaintTimelineItemType);
+}
+
+void InspectorTimelineAgent::didPaint()
+{
+    ASSERT(m_currentTimelineItem->type() == PaintTimelineItemType);
+    didCompleteCurrentRecord();
+}
+
+void InspectorTimelineAgent::willWriteHTML()
+{
+    m_currentTimelineItem = new TimelineItem(m_currentTimelineItem.release(), sessionTimeInMilliseconds(), ParseHTMLTimelineItemType);
+}
+
+void InspectorTimelineAgent::didWriteHTML()
+{
+    ASSERT(m_currentTimelineItem->type() == ParseHTMLTimelineItemType);
+    didCompleteCurrentRecord();
+}
+
+void InspectorTimelineAgent::reset()
+{
+    m_sessionStartTime = currentTimeInMilliseconds();
+    m_currentTimelineItem.set(0);
+}
+
+void InspectorTimelineAgent::didCompleteCurrentRecord()
+{
+    OwnPtr<TimelineItem> item(m_currentTimelineItem.release());
+    m_currentTimelineItem = item->releasePrevious();
+
+    item->setEndTime(sessionTimeInMilliseconds());
+    if (m_currentTimelineItem.get())
+        m_currentTimelineItem->addChildItem(item.release());
+    else
+        item->addToTimeline(m_frontend);
+}
+
+double InspectorTimelineAgent::currentTimeInMilliseconds()
+{
+    return currentTime() * 1000.0;
+}
+
+double InspectorTimelineAgent::sessionTimeInMilliseconds()
+{
+    return currentTimeInMilliseconds() - m_sessionStartTime;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorTimelineAgent.h b/src/3rdparty/webkit/WebCore/inspector/InspectorTimelineAgent.h
new file mode 100644
index 0000000..4095fed
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorTimelineAgent.h
@@ -0,0 +1,77 @@
+/*
+* Copyright (C) 2009 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are
+* met:
+*
+*     * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*     * Redistributions in binary form must reproduce the above
+* copyright notice, this list of conditions and the following disclaimer
+* in the documentation and/or other materials provided with the
+* distribution.
+*     * Neither the name of Google Inc. nor the names of its
+* contributors may be used to endorse or promote products derived from
+* this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#ifndef InspectorTimelineAgent_h
+#define InspectorTimelineAgent_h
+
+#include "ScriptObject.h"
+#include "ScriptArray.h"
+
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+    class Event;
+    class InspectorFrontend;
+    class TimelineItem;
+
+    class InspectorTimelineAgent {
+    public:
+        InspectorTimelineAgent(InspectorFrontend* frontend);
+        ~InspectorTimelineAgent();
+
+        void reset();
+
+        // Methods called from WebCore.
+        void willDispatchDOMEvent(const Event&);
+        void didDispatchDOMEvent();
+        void willLayout();
+        void didLayout();
+        void willRecalculateStyle();
+        void didRecalculateStyle();
+        void willPaint();
+        void didPaint();
+        void didWriteHTML();
+        void willWriteHTML();
+    private:
+        double sessionTimeInMilliseconds();
+
+        static double currentTimeInMilliseconds();
+
+        void didCompleteCurrentRecord();
+
+        double m_sessionStartTime;
+        InspectorFrontend* m_frontend;
+        OwnPtr<TimelineItem> m_currentTimelineItem;
+    };
+
+} // namespace WebCore
+
+#endif // !defined(InspectorTimelineAgent_h)
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.cpp b/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.cpp
index 0aafd65..6657120 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -45,10 +45,8 @@
 #include "ScrollView.h"
 #include "Widget.h"
 #include "ScriptController.h"
-#include <runtime/CollectorHeapIterator.h>
 #include <debugger/DebuggerCallFrame.h>
 #include <runtime/JSLock.h>
-#include <parser/Parser.h>
 #include <wtf/MainThread.h>
 #include <wtf/StdLibExtras.h>
 #include <wtf/UnusedParam.h>
@@ -59,6 +57,16 @@ namespace WebCore {
 
 typedef JavaScriptDebugServer::ListenerSet ListenerSet;
 
+inline const UString& JavaScriptDebugServer::BreakpointInfo::condition() const
+{
+    return m_condition;
+}
+
+void JavaScriptDebugServer::BreakpointInfo::setCondition(const UString& condition)
+{
+    m_condition = condition;
+}
+
 JavaScriptDebugServer& JavaScriptDebugServer::shared()
 {
     DEFINE_STATIC_LOCAL(JavaScriptDebugServer, server, ());
@@ -157,42 +165,86 @@ bool JavaScriptDebugServer::hasListenersInterestedInPage(Page* page)
     return m_pageListenersMap.contains(page);
 }
 
-void JavaScriptDebugServer::addBreakpoint(intptr_t sourceID, unsigned lineNumber)
+void JavaScriptDebugServer::addBreakpoint(intptr_t sourceID, unsigned lineNumber, const UString& condition)
 {
-    HashSet<unsigned>* lines = m_breakpoints.get(sourceID);
-    if (!lines) {
-        lines = new HashSet<unsigned>;
-        m_breakpoints.set(sourceID, lines);
+    LineToBreakpointInfoMap* sourceBreakpoints = m_breakpoints.get(sourceID);
+    if (!sourceBreakpoints) {
+        sourceBreakpoints = new LineToBreakpointInfoMap;
+        m_breakpoints.set(sourceID, sourceBreakpoints);
     }
+    BreakpointInfo* info = sourceBreakpoints->get(lineNumber);
+    if (!info)
+        sourceBreakpoints->set(lineNumber, new BreakpointInfo(condition));
+    else
+        updateBreakpointInfo(info, condition);
+}
 
-    lines->add(lineNumber);
+JavaScriptDebugServer::BreakpointInfo* JavaScriptDebugServer::breakpointInfo(intptr_t sourceID, unsigned lineNumber) const
+{
+    LineToBreakpointInfoMap* sourceBreakpoints = m_breakpoints.get(sourceID);
+    if (!sourceBreakpoints)
+        return 0;
+    return sourceBreakpoints->get(lineNumber);
 }
 
-void JavaScriptDebugServer::removeBreakpoint(intptr_t sourceID, unsigned lineNumber)
+void JavaScriptDebugServer::updateBreakpoint(intptr_t sourceID, unsigned lineNumber, const UString& condition)
 {
-    HashSet<unsigned>* lines = m_breakpoints.get(sourceID);
-    if (!lines)
+    BreakpointInfo* info = breakpointInfo(sourceID, lineNumber);
+    if (!info)
         return;
+    updateBreakpointInfo(info, condition);
+}
 
-    lines->remove(lineNumber);
+void JavaScriptDebugServer::updateBreakpointInfo(BreakpointInfo* info, const UString& condition)
+{
+    info->setCondition(condition);
+}
 
-    if (!lines->isEmpty())
+void JavaScriptDebugServer::removeBreakpoint(intptr_t sourceID, unsigned lineNumber)
+{
+    LineToBreakpointInfoMap* sourceBreakpoints = m_breakpoints.get(sourceID);
+    if (!sourceBreakpoints)
         return;
 
-    m_breakpoints.remove(sourceID);
-    delete lines;
+    BreakpointInfo* info = sourceBreakpoints->get(lineNumber);
+    if (!info)
+        return;
+
+    sourceBreakpoints->remove(lineNumber);
+    delete info;
+
+    if (sourceBreakpoints->isEmpty()) {
+        m_breakpoints.remove(sourceID);
+        delete sourceBreakpoints;
+    }
 }
 
 bool JavaScriptDebugServer::hasBreakpoint(intptr_t sourceID, unsigned lineNumber) const
 {
-    HashSet<unsigned>* lines = m_breakpoints.get(sourceID);
-    if (!lines)
+    BreakpointInfo* info = breakpointInfo(sourceID, lineNumber);
+    if (!info)
         return false;
-    return lines->contains(lineNumber);
+
+    // An empty condition counts as no condition which is equivalent to "true".
+    if (info->condition().isEmpty())
+        return true;
+
+    JSValue exception;
+    JSValue result = m_currentCallFrame->evaluate(info->condition(), exception);
+    if (exception) {
+        // An erroneous condition counts as "false".
+        return false;
+    }
+    return result.toBoolean(m_currentCallFrame->scopeChain()->globalObject()->globalExec());
 }
 
 void JavaScriptDebugServer::clearBreakpoints()
 {
+    BreakpointsMap::iterator end = m_breakpoints.end();
+    for (BreakpointsMap::iterator it = m_breakpoints.begin(); it != end; ++it) {
+        deleteAllValues(*(it->second));
+        it->second->clear();
+    }
     deleteAllValues(m_breakpoints);
     m_breakpoints.clear();
 }
@@ -299,8 +351,6 @@ void JavaScriptDebugServer::sourceParsed(ExecState* exec, const SourceCode& sour
 
     m_callingListeners = true;
 
-    ASSERT(hasListeners());
-
     bool isError = errorLine != -1;
 
     if (hasGlobalListeners()) {
@@ -459,7 +509,7 @@ void JavaScriptDebugServer::callEvent(const DebuggerCallFrame& debuggerCallFrame
     pauseIfNeeded(toPage(debuggerCallFrame.dynamicGlobalObject()));
 }
 
-void JavaScriptDebugServer::atStatement(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber, int column)
+void JavaScriptDebugServer::atStatement(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
 {
     if (m_paused)
         return;
@@ -533,7 +583,7 @@ void JavaScriptDebugServer::didExecuteProgram(const DebuggerCallFrame& debuggerC
     m_currentCallFrame = m_currentCallFrame->caller();
 }
 
-void JavaScriptDebugServer::didReachBreakpoint(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber, int /*column*/)
+void JavaScriptDebugServer::didReachBreakpoint(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
 {
     if (m_paused)
         return;
@@ -555,60 +605,7 @@ void JavaScriptDebugServer::recompileAllJSFunctionsSoon()
 void JavaScriptDebugServer::recompileAllJSFunctions(Timer<JavaScriptDebugServer>*)
 {
     JSLock lock(SilenceAssertionsOnly);
-    JSGlobalData* globalData = JSDOMWindow::commonJSGlobalData();
-
-    // If JavaScript is running, it's not safe to recompile, since we'll end
-    // up throwing away code that is live on the stack.
-    ASSERT(!globalData->dynamicGlobalObject);
-    if (globalData->dynamicGlobalObject)
-        return;
-
-    Vector<ProtectedPtr<JSFunction> > functions;
-    Heap::iterator heapEnd = globalData->heap.primaryHeapEnd();
-    for (Heap::iterator it = globalData->heap.primaryHeapBegin(); it != heapEnd; ++it) {
-        if ((*it)->isObject(&JSFunction::info)) {
-            JSFunction* function = static_cast<JSFunction*>(*it);
-            if (!function->isHostFunction())
-                functions.append(function);
-        }
-    }
-
-    typedef HashMap<RefPtr<FunctionBodyNode>, RefPtr<FunctionBodyNode> > FunctionBodyMap;
-    typedef HashMap<SourceProvider*, ExecState*> SourceProviderMap;
-
-    FunctionBodyMap functionBodies;
-    SourceProviderMap sourceProviders;
-
-    size_t size = functions.size();
-    for (size_t i = 0; i < size; ++i) {
-        JSFunction* function = functions[i];
-
-        FunctionBodyNode* oldBody = function->body();
-        pair<FunctionBodyMap::iterator, bool> result = functionBodies.add(oldBody, 0);
-        if (!result.second) {
-            function->setBody(result.first->second.get());
-            continue;
-        }
-
-        ExecState* exec = function->scope().globalObject()->JSGlobalObject::globalExec();
-        const SourceCode& sourceCode = oldBody->source();
-
-        RefPtr<FunctionBodyNode> newBody = globalData->parser->parse<FunctionBodyNode>(exec, 0, sourceCode);
-        ASSERT(newBody);
-        newBody->finishParsing(oldBody->copyParameters(), oldBody->parameterCount());
-
-        result.first->second = newBody;
-        function->setBody(newBody.release());
-
-        if (hasListeners() && function->scope().globalObject()->debugger() == this)
-            sourceProviders.add(sourceCode.provider(), exec);
-    }
-
-    // Call sourceParsed() after reparsing all functions because it will execute
-    // JavaScript in the inspector.
-    SourceProviderMap::const_iterator end = sourceProviders.end();
-    for (SourceProviderMap::const_iterator iter = sourceProviders.begin(); iter != end; ++iter)
-        sourceParsed((*iter).second, SourceCode((*iter).first), -1, 0);
+    Debugger::recompileAllJSFunctions(JSDOMWindow::commonJSGlobalData());
 }
 
 void JavaScriptDebugServer::didAddListener(Page* page)
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.h b/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.h
index 505a616..33c6e3d 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.h
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.h
@@ -33,6 +33,7 @@
 
 #include "Timer.h"
 #include <debugger/Debugger.h>
+#include <runtime/UString.h>
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/RefPtr.h>
@@ -61,7 +62,8 @@ namespace WebCore {
         void addListener(JavaScriptDebugListener*, Page*);
         void removeListener(JavaScriptDebugListener*, Page*);
 
-        void addBreakpoint(intptr_t sourceID, unsigned lineNumber);
+        void addBreakpoint(intptr_t sourceID, unsigned lineNumber, const JSC::UString& condition);
+        void updateBreakpoint(intptr_t sourceID, unsigned lineNumber, const JSC::UString& condition);
         void removeBreakpoint(intptr_t sourceID, unsigned lineNumber);
         bool hasBreakpoint(intptr_t sourceID, unsigned lineNumber) const;
         void clearBreakpoints();
@@ -86,6 +88,15 @@ namespace WebCore {
         typedef void (JavaScriptDebugListener::*JavaScriptExecutionCallback)();
 
     private:
+        class BreakpointInfo {
+        public:
+            BreakpointInfo(const JSC::UString& condition) : m_condition(condition) {}
+            const JSC::UString& condition() const;
+            void setCondition(const JSC::UString& condition);
+        private:
+            JSC::UString m_condition;
+        };
+
         JavaScriptDebugServer();
         ~JavaScriptDebugServer();
 
@@ -100,23 +111,28 @@ namespace WebCore {
 
         void dispatchFunctionToListeners(JavaScriptExecutionCallback, Page*);
         void pauseIfNeeded(Page*);
-        
+        BreakpointInfo* breakpointInfo(intptr_t sourceID, unsigned lineNumber) const;
+        void updateBreakpointInfo(BreakpointInfo* info, const JSC::UString& condition);
+
         virtual void detach(JSC::JSGlobalObject*);
 
         virtual void sourceParsed(JSC::ExecState*, const JSC::SourceCode&, int errorLine, const JSC::UString& errorMsg);
         virtual void callEvent(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber);
-        virtual void atStatement(const JSC::DebuggerCallFrame&, intptr_t sourceID, int firstLine, int column);
+        virtual void atStatement(const JSC::DebuggerCallFrame&, intptr_t sourceID, int firstLine);
         virtual void returnEvent(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber);
         virtual void exception(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber);
         virtual void willExecuteProgram(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
         virtual void didExecuteProgram(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
-        virtual void didReachBreakpoint(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno, int column);
-        
+        virtual void didReachBreakpoint(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
+
         void didAddListener(Page*);
         void didRemoveListener(Page*);
         void didRemoveLastListener();
 
         typedef HashMap<Page*, ListenerSet*> PageListenersMap;
+        typedef HashMap<unsigned, BreakpointInfo*> LineToBreakpointInfoMap;
+        typedef HashMap<intptr_t, LineToBreakpointInfoMap*> BreakpointsMap;
+
         PageListenersMap m_pageListenersMap;
         ListenerSet m_listeners;
         bool m_callingListeners;
@@ -126,7 +142,7 @@ namespace WebCore {
         bool m_doneProcessingDebuggerEvents;
         JavaScriptCallFrame* m_pauseOnCallFrame;
         RefPtr<JavaScriptCallFrame> m_currentCallFrame;
-        HashMap<intptr_t, HashSet<unsigned>*> m_breakpoints;
+        BreakpointsMap m_breakpoints;
         Timer<JavaScriptDebugServer> m_recompileTimer;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/TimelineItem.cpp b/src/3rdparty/webkit/WebCore/inspector/TimelineItem.cpp
new file mode 100644
index 0000000..b368c49
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/TimelineItem.cpp
@@ -0,0 +1,81 @@
+/*
+* Copyright (C) 2009 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are
+* met:
+*
+*     * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*     * Redistributions in binary form must reproduce the above
+* copyright notice, this list of conditions and the following disclaimer
+* in the documentation and/or other materials provided with the
+* distribution.
+*     * Neither the name of Google Inc. nor the names of its
+* contributors may be used to endorse or promote products derived from
+* this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#include "config.h"
+#include "TimelineItem.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "InspectorFrontend.h"
+#include "ScriptArray.h"
+#include "ScriptObject.h"
+
+namespace WebCore {
+
+TimelineItem::TimelineItem(PassOwnPtr<TimelineItem> previous, double startTime, TimelineItemType itemType)
+    : m_startTime(startTime)
+    , m_endTime(0.0)
+    , m_itemType(itemType)
+    , m_previous(previous)
+{
+}
+
+void TimelineItem::addToTimeline(InspectorFrontend* frontend)
+{
+    frontend->addItemToTimeline(convertToScriptObject(frontend));
+}
+
+ScriptObject TimelineItem::convertToScriptObject(InspectorFrontend* frontend)
+{
+    ScriptObject selfObj = frontend->newScriptObject();
+    selfObj.set("time", m_startTime);
+    selfObj.set("type", static_cast<int>(m_itemType));
+    selfObj.set("duration", m_endTime - m_startTime);
+    ScriptArray children = convertChildrenToScriptArray(frontend);
+    selfObj.set("children", children);
+    return selfObj;
+}
+
+ScriptArray TimelineItem::convertChildrenToScriptArray(InspectorFrontend* frontend)
+{
+    ScriptArray children = frontend->newScriptArray();
+    for (unsigned i = 0; i < m_children.size(); ++i)
+        children.set(i, m_children[i]->convertToScriptObject(frontend));
+    return children;
+}
+
+void TimelineItem::addChildItem(PassOwnPtr<TimelineItem> timelineItem)
+{
+    m_children.append(timelineItem);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/inspector/TimelineItem.h b/src/3rdparty/webkit/WebCore/inspector/TimelineItem.h
new file mode 100644
index 0000000..1909230
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/TimelineItem.h
@@ -0,0 +1,88 @@
+/*
+* Copyright (C) 2009 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are
+* met:
+*
+*     * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*     * Redistributions in binary form must reproduce the above
+* copyright notice, this list of conditions and the following disclaimer
+* in the documentation and/or other materials provided with the
+* distribution.
+*     * Neither the name of Google Inc. nor the names of its
+* contributors may be used to endorse or promote products derived from
+* this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#ifndef TimelineItem_h
+#define TimelineItem_h
+
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+    class InspectorFrontend;
+    class TimelineItem;
+    class ScriptArray;
+    class ScriptObject;
+
+    typedef Vector<OwnPtr<TimelineItem> > TimelineItems;
+
+    // Must be kept in sync with TimelineAgent.js
+    enum TimelineItemType {
+        DOMDispatchTimelineItemType = 0,
+        LayoutTimelineItemType = 1,
+        RecalculateStylesTimelineItemType = 2,
+        PaintTimelineItemType = 3,
+        ParseHTMLTimelineItemType = 4,
+    };
+
+    class TimelineItem {
+    public:
+        TimelineItem(PassOwnPtr<TimelineItem>, double startTime, TimelineItemType);
+
+        virtual ~TimelineItem() { }
+
+        TimelineItem* previous() const { return m_previous.get(); }
+
+        PassOwnPtr<TimelineItem*> releasePrevious() { return m_previous.release(); }
+
+        void addToTimeline(InspectorFrontend*);
+
+        void addChildItem(PassOwnPtr<TimelineItem>);
+
+        void setEndTime(double endTime) { m_endTime = endTime; }
+
+        TimelineItemType type() { return m_itemType; }
+    protected:
+        virtual ScriptObject convertToScriptObject(InspectorFrontend*);
+
+        ScriptArray convertChildrenToScriptArray(InspectorFrontend*);
+      
+    private:
+        double m_startTime;
+        double m_endTime;
+        TimelineItemType m_itemType;
+        OwnPtr<TimelineItem> m_previous;
+        TimelineItems m_children;
+    };
+
+} // namespace WebCore
+
+#endif // !defined(TimelineItem_h)
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Breakpoint.js b/src/3rdparty/webkit/WebCore/inspector/front-end/Breakpoint.js
index 347df60..292975a 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Breakpoint.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Breakpoint.js
@@ -23,13 +23,14 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.Breakpoint = function(url, line, sourceID)
+WebInspector.Breakpoint = function(url, line, sourceID, condition)
 {
     this.url = url;
     this.line = line;
     this.sourceID = sourceID;
     this._enabled = true;
     this._sourceText = "";
+    this._condition = condition || "";
 }
 
 WebInspector.Breakpoint.prototype = {
@@ -71,6 +72,24 @@ WebInspector.Breakpoint.prototype = {
     get id()
     {
         return this.sourceID + ":" + this.line;
+    },
+
+    get condition()
+    {
+        return this._condition;
+    },
+
+    set condition(c)
+    {
+        c = c || "";
+        if (this._condition === c)
+            return;
+
+        this._condition = c;
+        this.dispatchEventToListeners("condition-changed");
+
+        if (this.enabled)
+            InspectorController.updateBreakpoint(this.sourceID, this.line, c);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/BreakpointsSidebarPane.js b/src/3rdparty/webkit/WebCore/inspector/front-end/BreakpointsSidebarPane.js
index 14f8c06..e6edece 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/BreakpointsSidebarPane.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/BreakpointsSidebarPane.js
@@ -62,7 +62,7 @@ WebInspector.BreakpointsSidebarPane.prototype = {
             return;
 
         if (breakpoint.enabled)
-            InspectorController.addBreakpoint(breakpoint.sourceID, breakpoint.line);
+            InspectorController.addBreakpoint(breakpoint.sourceID, breakpoint.line, breakpoint.condition);
     },
 
     _appendBreakpointElement: function(breakpoint)
@@ -150,7 +150,7 @@ WebInspector.BreakpointsSidebarPane.prototype = {
             return;
 
         if (breakpoint.enabled)
-            InspectorController.addBreakpoint(breakpoint.sourceID, breakpoint.line);
+            InspectorController.addBreakpoint(breakpoint.sourceID, breakpoint.line, breakpoint.condition);
         else
             InspectorController.removeBreakpoint(breakpoint.sourceID, breakpoint.line);
     },
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/CallStackSidebarPane.js b/src/3rdparty/webkit/WebCore/inspector/front-end/CallStackSidebarPane.js
index c08cc7a..2fe4315 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/CallStackSidebarPane.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/CallStackSidebarPane.js
@@ -39,14 +39,14 @@ WebInspector.CallStackSidebarPane = function()
 }
 
 WebInspector.CallStackSidebarPane.prototype = {
-    update: function(callFrame, sourceIDMap)
+    update: function(callFrames, sourceIDMap)
     {
         this.bodyElement.removeChildren();
 
         this.placards = [];
         delete this._selectedCallFrame;
 
-        if (!callFrame) {
+        if (!callFrames) {
             var infoElement = document.createElement("div");
             infoElement.className = "info";
             infoElement.textContent = WebInspector.UIString("Not Paused");
@@ -58,7 +58,8 @@ WebInspector.CallStackSidebarPane.prototype = {
         var subtitle;
         var scriptOrResource;
 
-        do {
+        for (var i = 0; i < callFrames.length; ++i) {
+            var callFrame = callFrames[i];
             switch (callFrame.type) {
             case "function":
                 title = callFrame.functionName || WebInspector.UIString("(anonymous function)");
@@ -85,9 +86,7 @@ WebInspector.CallStackSidebarPane.prototype = {
 
             this.placards.push(placard);
             this.bodyElement.appendChild(placard.element);
-
-            callFrame = callFrame.caller;
-        } while (callFrame);
+        }
     },
 
     get selectedCallFrame()
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Callback.js b/src/3rdparty/webkit/WebCore/inspector/front-end/Callback.js
new file mode 100644
index 0000000..8ae7f954
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Callback.js
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.Callback = function()
+{
+    this._lastCallbackId = 1;
+    this._callbacks = {};
+}
+
+WebInspector.Callback.prototype = {
+    wrap: function(callback)
+    {
+        var callbackId = this._lastCallbackId++;
+        this._callbacks[callbackId] = callback || function() {};
+        return callbackId;
+    },
+
+    processCallback: function(callbackId, opt_vararg)
+    {
+        var args = Array.prototype.slice.call(arguments, 1);
+        var callback = this._callbacks[callbackId];
+        callback.apply(null, args);
+        delete this._callbacks[callbackId];
+    }
+}
+
+WebInspector.Callback._INSTANCE = new WebInspector.Callback();
+WebInspector.Callback.wrap = WebInspector.Callback._INSTANCE.wrap.bind(WebInspector.Callback._INSTANCE);
+WebInspector.Callback.processCallback = WebInspector.Callback._INSTANCE.processCallback.bind(WebInspector.Callback._INSTANCE);
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ChangesView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ChangesView.js
new file mode 100644
index 0000000..802fdba
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ChangesView.js
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Joseph Pecoraro
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.ChangesView = function(drawer)
+{
+    WebInspector.View.call(this);
+    this.element.innerHTML = "<div style=\"bottom:25%;color:rgb(192,192,192);font-size:12px;height:65px;left:0px;margin:auto;position:absolute;right:0px;text-align:center;top:0px;\"><h1>Not Implemented Yet</h1></div>";
+
+    this.drawer = drawer;
+
+    this.clearButton = document.createElement("button");
+    this.clearButton.id = "clear-changes-status-bar-item";
+    this.clearButton.title = WebInspector.UIString("Clear changes log.");
+    this.clearButton.className = "status-bar-item";
+    this.clearButton.addEventListener("click", this._clearButtonClicked.bind(this), false);
+
+    this.toggleChangesButton = document.getElementById("changes-status-bar-item");
+    this.toggleChangesButton.title = WebInspector.UIString("Show changes view.");
+    this.toggleChangesButton.addEventListener("click", this._toggleChangesButtonClicked.bind(this), false);
+    var anchoredStatusBar = document.getElementById("anchored-status-bar-items");
+    anchoredStatusBar.appendChild(this.toggleChangesButton);
+}
+
+WebInspector.ChangesView.prototype = {
+    _clearButtonClicked: function()
+    {
+        // Not Implemented Yet
+    },
+
+    _toggleChangesButtonClicked: function()
+    {
+        this.drawer.visibleView = this;
+    },
+
+    attach: function(mainElement, statusBarElement)
+    {
+        mainElement.appendChild(this.element);
+        statusBarElement.appendChild(this.clearButton);
+    },
+
+    show: function()
+    {
+        this.toggleChangesButton.addStyleClass("toggled-on");
+        this.toggleChangesButton.title = WebInspector.UIString("Hide changes view.");
+    },
+
+    hide: function()
+    {
+        this.toggleChangesButton.removeStyleClass("toggled-on");
+        this.toggleChangesButton.title = WebInspector.UIString("Show changes view.");
+    }
+}
+
+WebInspector.ChangesView.prototype.__proto__ = WebInspector.View.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Color.js b/src/3rdparty/webkit/WebCore/inspector/front-end/Color.js
new file mode 100644
index 0000000..9d9cd76
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Color.js
@@ -0,0 +1,661 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Joseph Pecoraro
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.Color = function(str)
+{
+    this.value = str;
+    this._parse();
+}
+
+WebInspector.Color.prototype = {
+    get shorthex()
+    {
+        if ("_short" in this)
+            return this._short;
+
+        if (!this.simple)
+            return null;
+
+        var hex = this.hex;
+        if (hex.charAt(0) === hex.charAt(1) && hex.charAt(2) === hex.charAt(3) && hex.charAt(4) === hex.charAt(5))
+            this._short = hex.charAt(0) + hex.charAt(2) + hex.charAt(4);
+        else
+            this._short = hex;
+
+        return this._short;
+    },
+
+    get hex()
+    {
+        if (!this.simple)
+            return null;
+
+        return this._hex;
+    },
+
+    set hex(x)
+    {
+        this._hex = x;
+    },
+
+    get rgb()
+    {
+        if ("_rgb" in this)
+            return this._rgb;
+
+        if (this.simple)
+            this._rgb = this._hexToRGB(this.hex);
+        else {
+            var rgba = this.rgba;
+            this._rgb = [rgba[0], rgba[1], rgba[2]];
+        }
+
+        return this._rgb;
+    },
+
+    set rgb(x)
+    {
+        this._rgb = x;
+    },
+
+    get hsl()
+    {
+        if ("_hsl" in this)
+            return this._hsl;
+
+        this._hsl = this._rgbToHSL(this.rgb);
+        return this._hsl;
+    },
+
+    set hsl(x)
+    {
+        this._hsl = x;
+    },
+
+    get nickname()
+    {
+        if (typeof this._nickname !== "undefined") // would be set on parse if there was a nickname
+            return this._nickname;
+        else
+            return null;
+    },
+
+    set nickname(x)
+    {
+        this._nickname = x;
+    },
+
+    get rgba()
+    {
+        return this._rgba;
+    },
+
+    set rgba(x)
+    {
+        this._rgba = x;
+    },
+
+    get hsla()
+    {
+        return this._hsla;
+    },
+
+    set hsla(x)
+    {
+        this._hsla = x;
+    },
+
+    hasShortHex: function()
+    {
+        var shorthex = this.shorthex;
+        return (shorthex && shorthex.length === 3);
+    },
+
+    toString: function(format)
+    {
+        if (!format)
+            format = this.format;
+
+        switch (format) {
+            case "rgb":
+                return "rgb(" + this.rgb.join(", ") + ")";
+            case "rgba":
+                return "rgba(" + this.rgba.join(", ") + ")";
+            case "hsl":
+                var hsl = this.hsl;
+                return "hsl(" + hsl[0] + ", " + hsl[1] + "%, " + hsl[2] + "%)";
+            case "hsla":
+                var hsla = this.hsla;
+                return "hsla(" + hsla[0] + ", " + hsla[1] + "%, " + hsla[2] + "%, " + hsla[3] + ")";
+            case "hex":
+                return "#" + this.hex;
+            case "shorthex":
+                return "#" + this.shorthex;
+            case "nickname":
+                return this.nickname;
+        }
+
+        throw "invalid color format";
+    },
+
+    _rgbToHex: function(rgb)
+    {
+        var r = parseInt(rgb[0]).toString(16);
+        var g = parseInt(rgb[1]).toString(16);
+        var b = parseInt(rgb[2]).toString(16);
+        if (r.length === 1)
+            r = "0" + r;
+        if (g.length === 1)
+            g = "0" + g;
+        if (b.length === 1)
+            b = "0" + b;
+
+        return (r + g + b).toUpperCase();
+    },
+
+    _hexToRGB: function(hex)
+    {
+        var r = parseInt(hex.substring(0,2), 16);
+        var g = parseInt(hex.substring(2,4), 16);
+        var b = parseInt(hex.substring(4,6), 16);
+
+        return [r, g, b];
+    },
+
+    _rgbToHSL: function(rgb)
+    {
+        var r = parseInt(rgb[0]) / 255;
+        var g = parseInt(rgb[1]) / 255;
+        var b = parseInt(rgb[2]) / 255;
+        var max = Math.max(r, g, b);
+        var min = Math.min(r, g, b);
+        var diff = max - min;
+        var add = max + min;
+
+        if (min === max)
+            var h = 0;
+        else if (r === max)
+            var h = ((60 * (g - b) / diff) + 360) % 360;
+        else if (g === max)
+            var h = (60 * (b - r) / diff) + 120;
+        else
+            var h = (60 * (r - g) / diff) + 240;
+
+        var l = 0.5 * add;
+
+        if (l === 0)
+            var s = 0;
+        else if (l === 1)
+            var s = 1;
+        else if (l <= 0.5)
+            var s = diff / add;
+        else
+            var s = diff / (2 - add);
+
+        h = Math.round(h);
+        s = Math.round(s*100);
+        l = Math.round(l*100);
+
+        return [h, s, l];
+    },
+
+    _hslToRGB: function(hsl)
+    {
+        var h = parseFloat(hsl[0]) / 360;
+        var s = parseFloat(hsl[1]) / 100;
+        var l = parseFloat(hsl[2]) / 100;
+
+        if (l <= 0.5)
+            var q = l * (1 + s);
+        else
+            var q = l + s - (l * s);
+
+        var p = 2 * l - q;
+
+        var tr = h + (1 / 3);
+        var tg = h;
+        var tb = h - (1 / 3);
+
+        var r = Math.round(hueToRGB(p, q, tr) * 255);
+        var g = Math.round(hueToRGB(p, q, tg) * 255);
+        var b = Math.round(hueToRGB(p, q, tb) * 255);
+        return [r, g, b];
+
+        function hueToRGB(p, q, h) {
+            if (h < 0)
+                h += 1;
+            else if (h > 1)
+                h -= 1;
+
+            if ((h * 6) < 1)
+                return p + (q - p) * h * 6;
+            else if ((h * 2) < 1)
+                return q;
+            else if ((h * 3) < 2)
+                return p + (q - p) * ((2 / 3) - h) * 6;
+            else
+                return p;
+        }
+    },
+
+    _rgbaToHSLA: function(rgba)
+    {
+        var alpha = rgba[3];
+        var hsl = this._rgbToHSL(rgba)
+        hsl.push(alpha);
+        return hsl;
+    },
+
+    _hslaToRGBA: function(hsla)
+    {
+        var alpha = hsla[3];
+        var rgb = this._hslToRGB(hsla);
+        rgb.push(alpha);
+        return rgb;
+    },
+
+    _parse: function()
+    {
+        // Special Values - Advanced but Must Be Parsed First - transparent
+        var value = this.value.toLowerCase().replace(/%|\s+/g, "");
+        if (value in WebInspector.Color.AdvancedNickNames) {
+            this.format = "nickname";
+            var set = WebInspector.Color.AdvancedNickNames[value];
+            this.simple = false;
+            this.rgba = set[0];
+            this.hsla = set[1];
+            this.nickname = set[2];
+            this.alpha = set[0][3];
+            return;
+        }
+
+        // Simple - #hex, rgb(), nickname, hsl()
+        var simple = /^(?:#([0-9a-f]{3,6})|rgb\(([^)]+)\)|(\w+)|hsl\(([^)]+)\))$/i;
+        var match = this.value.match(simple);
+        if (match) {
+            this.simple = true;
+
+            if (match[1]) { // hex
+                var hex = match[1].toUpperCase();
+                if (hex.length === 3) {
+                    this.format = "shorthex";
+                    this.hex = hex.charAt(0) + hex.charAt(0) + hex.charAt(1) + hex.charAt(1) + hex.charAt(2) + hex.charAt(2);
+                } else {
+                    this.format = "hex";
+                    this.hex = hex;
+                }
+            } else if (match[2]) { // rgb
+                this.format = "rgb";
+                var rgb = match[2].split(/\s*,\s*/);
+                this.rgb = rgb;
+                this.hex = this._rgbToHex(rgb);
+            } else if (match[3]) { // nickname
+                var nickname = match[3].toLowerCase();
+                if (nickname in WebInspector.Color.Nicknames) {
+                    this.format = "nickname";
+                    this.hex = WebInspector.Color.Nicknames[nickname];
+                } else // unknown name
+                    throw "unknown color name";
+            } else if (match[4]) { // hsl
+                this.format = "hsl";
+                var hsl = match[4].replace(/%g/, "").split(/\s*,\s*/);
+                this.hsl = hsl;
+                this.rgb = this._hslToRGB(hsl);
+                this.hex = this._rgbToHex(this.rgb);
+            }
+
+            // Fill in the values if this is a known hex color
+            var hex = this.hex;
+            if (hex && hex in WebInspector.Color.HexTable) {
+                var set = WebInspector.Color.HexTable[hex];
+                this.rgb = set[0];
+                this.hsl = set[1];
+                this.nickname = set[2];
+            }
+
+            return;
+        }
+
+        // Advanced - rgba(), hsla()
+        var advanced = /^(?:rgba\(([^)]+)\)|hsla\(([^)]+)\))$/;
+        match = this.value.match(advanced);
+        if (match) {
+            this.simple = false;
+            if (match[1]) { // rgba
+                this.format = "rgba";
+                this.rgba = match[1].split(/\s*,\s*/);
+                this.hsla = this._rgbaToHSLA(this.rgba);
+                this.alpha = this.rgba[3];
+            } else if (match[2]) { // hsla
+                this.format = "hsla";
+                this.hsla = match[2].replace(/%/g, "").split(/\s*,\s*/);
+                this.rgba = this._hslaToRGBA(this.hsla);
+                this.alpha = this.hsla[3];
+            }
+
+            return;
+        }
+
+        // Could not parse as a valid color
+        throw "could not parse color";
+    }
+}
+
+// Simple Values: [rgb, hsl, nickname]
+WebInspector.Color.HexTable = {
+    "000000": [[0, 0, 0], [0, 0, 0], "black"],
+    "000080": [[0, 0, 128], [240, 100, 25], "navy"],
+    "00008B": [[0, 0, 139], [240, 100, 27], "darkBlue"],
+    "0000CD": [[0, 0, 205], [240, 100, 40], "mediumBlue"],
+    "0000FF": [[0, 0, 255], [240, 100, 50], "blue"],
+    "006400": [[0, 100, 0], [120, 100, 20], "darkGreen"],
+    "008000": [[0, 128, 0], [120, 100, 25], "green"],
+    "008080": [[0, 128, 128], [180, 100, 25], "teal"],
+    "008B8B": [[0, 139, 139], [180, 100, 27], "darkCyan"],
+    "00BFFF": [[0, 191, 255], [195, 100, 50], "deepSkyBlue"],
+    "00CED1": [[0, 206, 209], [181, 100, 41], "darkTurquoise"],
+    "00FA9A": [[0, 250, 154], [157, 100, 49], "mediumSpringGreen"],
+    "00FF00": [[0, 255, 0], [120, 100, 50], "lime"],
+    "00FF7F": [[0, 255, 127], [150, 100, 50], "springGreen"],
+    "00FFFF": [[0, 255, 255], [180, 100, 50], "cyan"],
+    "191970": [[25, 25, 112], [240, 64, 27], "midnightBlue"],
+    "1E90FF": [[30, 144, 255], [210, 100, 56], "dodgerBlue"],
+    "20B2AA": [[32, 178, 170], [177, 70, 41], "lightSeaGreen"],
+    "228B22": [[34, 139, 34], [120, 61, 34], "forestGreen"],
+    "2E8B57": [[46, 139, 87], [146, 50, 36], "seaGreen"],
+    "2F4F4F": [[47, 79, 79], [180, 25, 25], "darkSlateGray"],
+    "32CD32": [[50, 205, 50], [120, 61, 50], "limeGreen"],
+    "3CB371": [[60, 179, 113], [147, 50, 47], "mediumSeaGreen"],
+    "40E0D0": [[64, 224, 208], [174, 72, 56], "turquoise"],
+    "4169E1": [[65, 105, 225], [225, 73, 57], "royalBlue"],
+    "4682B4": [[70, 130, 180], [207, 44, 49], "steelBlue"],
+    "483D8B": [[72, 61, 139], [248, 39, 39], "darkSlateBlue"],
+    "48D1CC": [[72, 209, 204], [178, 60, 55], "mediumTurquoise"],
+    "4B0082": [[75, 0, 130], [275, 100, 25], "indigo"],
+    "556B2F": [[85, 107, 47], [82, 39, 30], "darkOliveGreen"],
+    "5F9EA0": [[95, 158, 160], [182, 25, 50], "cadetBlue"],
+    "6495ED": [[100, 149, 237], [219, 79, 66], "cornflowerBlue"],
+    "66CDAA": [[102, 205, 170], [160, 51, 60], "mediumAquaMarine"],
+    "696969": [[105, 105, 105], [0, 0, 41], "dimGray"],
+    "6A5ACD": [[106, 90, 205], [248, 53, 58], "slateBlue"],
+    "6B8E23": [[107, 142, 35], [80, 60, 35], "oliveDrab"],
+    "708090": [[112, 128, 144], [210, 13, 50], "slateGray"],
+    "778899": [[119, 136, 153], [210, 14, 53], "lightSlateGray"],
+    "7B68EE": [[123, 104, 238], [249, 80, 67], "mediumSlateBlue"],
+    "7CFC00": [[124, 252, 0], [90, 100, 49], "lawnGreen"],
+    "7FFF00": [[127, 255, 0], [90, 100, 50], "chartreuse"],
+    "7FFFD4": [[127, 255, 212], [160, 100, 75], "aquamarine"],
+    "800000": [[128, 0, 0], [0, 100, 25], "maroon"],
+    "800080": [[128, 0, 128], [300, 100, 25], "purple"],
+    "808000": [[128, 128, 0], [60, 100, 25], "olive"],
+    "808080": [[128, 128, 128], [0, 0, 50], "gray"],
+    "87CEEB": [[135, 206, 235], [197, 71, 73], "skyBlue"],
+    "87CEFA": [[135, 206, 250], [203, 92, 75], "lightSkyBlue"],
+    "8A2BE2": [[138, 43, 226], [271, 76, 53], "blueViolet"],
+    "8B0000": [[139, 0, 0], [0, 100, 27], "darkRed"],
+    "8B008B": [[139, 0, 139], [300, 100, 27], "darkMagenta"],
+    "8B4513": [[139, 69, 19], [25, 76, 31], "saddleBrown"],
+    "8FBC8F": [[143, 188, 143], [120, 25, 65], "darkSeaGreen"],
+    "90EE90": [[144, 238, 144], [120, 73, 75], "lightGreen"],
+    "9370D8": [[147, 112, 219], [260, 60, 65], "mediumPurple"],
+    "9400D3": [[148, 0, 211], [282, 100, 41], "darkViolet"],
+    "98FB98": [[152, 251, 152], [120, 93, 79], "paleGreen"],
+    "9932CC": [[153, 50, 204], [280, 61, 50], "darkOrchid"],
+    "9ACD32": [[154, 205, 50], [80, 61, 50], "yellowGreen"],
+    "A0522D": [[160, 82, 45], [19, 56, 40], "sienna"],
+    "A52A2A": [[165, 42, 42], [0, 59, 41], "brown"],
+    "A9A9A9": [[169, 169, 169], [0, 0, 66], "darkGray"],
+    "ADD8E6": [[173, 216, 230], [195, 53, 79], "lightBlue"],
+    "ADFF2F": [[173, 255, 47], [84, 100, 59], "greenYellow"],
+    "AFEEEE": [[175, 238, 238], [180, 65, 81], "paleTurquoise"],
+    "B0C4DE": [[176, 196, 222], [214, 41, 78], "lightSteelBlue"],
+    "B0E0E6": [[176, 224, 230], [187, 52, 80], "powderBlue"],
+    "B22222": [[178, 34, 34], [0, 68, 42], "fireBrick"],
+    "B8860B": [[184, 134, 11], [43, 89, 38], "darkGoldenRod"],
+    "BA55D3": [[186, 85, 211], [288, 59, 58], "mediumOrchid"],
+    "BC8F8F": [[188, 143, 143], [0, 25, 65], "rosyBrown"],
+    "BDB76B": [[189, 183, 107], [56, 38, 58], "darkKhaki"],
+    "C0C0C0": [[192, 192, 192], [0, 0, 75], "silver"],
+    "C71585": [[199, 21, 133], [322, 81, 43], "mediumVioletRed"],
+    "CD5C5C": [[205, 92, 92], [0, 53, 58], "indianRed"],
+    "CD853F": [[205, 133, 63], [30, 59, 53], "peru"],
+    "D2691E": [[210, 105, 30], [25, 75, 47], "chocolate"],
+    "D2B48C": [[210, 180, 140], [34, 44, 69], "tan"],
+    "D3D3D3": [[211, 211, 211], [0, 0, 83], "lightGrey"],
+    "D87093": [[219, 112, 147], [340, 60, 65], "paleVioletRed"],
+    "D8BFD8": [[216, 191, 216], [300, 24, 80], "thistle"],
+    "DA70D6": [[218, 112, 214], [302, 59, 65], "orchid"],
+    "DAA520": [[218, 165, 32], [43, 74, 49], "goldenRod"],
+    "DC143C": [[237, 164, 61], [35, 83, 58], "crimson"],
+    "DCDCDC": [[220, 220, 220], [0, 0, 86], "gainsboro"],
+    "DDA0DD": [[221, 160, 221], [300, 47, 75], "plum"],
+    "DEB887": [[222, 184, 135], [34, 57, 70], "burlyWood"],
+    "E0FFFF": [[224, 255, 255], [180, 100, 94], "lightCyan"],
+    "E6E6FA": [[230, 230, 250], [240, 67, 94], "lavender"],
+    "E9967A": [[233, 150, 122], [15, 72, 70], "darkSalmon"],
+    "EE82EE": [[238, 130, 238], [300, 76, 72], "violet"],
+    "EEE8AA": [[238, 232, 170], [55, 67, 80], "paleGoldenRod"],
+    "F08080": [[240, 128, 128], [0, 79, 72], "lightCoral"],
+    "F0E68C": [[240, 230, 140], [54, 77, 75], "khaki"],
+    "F0F8FF": [[240, 248, 255], [208, 100, 97], "aliceBlue"],
+    "F0FFF0": [[240, 255, 240], [120, 100, 97], "honeyDew"],
+    "F0FFFF": [[240, 255, 255], [180, 100, 97], "azure"],
+    "F4A460": [[244, 164, 96], [28, 87, 67], "sandyBrown"],
+    "F5DEB3": [[245, 222, 179], [39, 77, 83], "wheat"],
+    "F5F5DC": [[245, 245, 220], [60, 56, 91], "beige"],
+    "F5F5F5": [[245, 245, 245], [0, 0, 96], "whiteSmoke"],
+    "F5FFFA": [[245, 255, 250], [150, 100, 98], "mintCream"],
+    "F8F8FF": [[248, 248, 255], [240, 100, 99], "ghostWhite"],
+    "FA8072": [[250, 128, 114], [6, 93, 71], "salmon"],
+    "FAEBD7": [[250, 235, 215], [34, 78, 91], "antiqueWhite"],
+    "FAF0E6": [[250, 240, 230], [30, 67, 94], "linen"],
+    "FAFAD2": [[250, 250, 210], [60, 80, 90], "lightGoldenRodYellow"],
+    "FDF5E6": [[253, 245, 230], [39, 85, 95], "oldLace"],
+    "FF0000": [[255, 0, 0], [0, 100, 50], "red"],
+    "FF00FF": [[255, 0, 255], [300, 100, 50], "magenta"],
+    "FF1493": [[255, 20, 147], [328, 100, 54], "deepPink"],
+    "FF4500": [[255, 69, 0], [16, 100, 50], "orangeRed"],
+    "FF6347": [[255, 99, 71], [9, 100, 64], "tomato"],
+    "FF69B4": [[255, 105, 180], [330, 100, 71], "hotPink"],
+    "FF7F50": [[255, 127, 80], [16, 100, 66], "coral"],
+    "FF8C00": [[255, 140, 0], [33, 100, 50], "darkOrange"],
+    "FFA07A": [[255, 160, 122], [17, 100, 74], "lightSalmon"],
+    "FFA500": [[255, 165, 0], [39, 100, 50], "orange"],
+    "FFB6C1": [[255, 182, 193], [351, 100, 86], "lightPink"],
+    "FFC0CB": [[255, 192, 203], [350, 100, 88], "pink"],
+    "FFD700": [[255, 215, 0], [51, 100, 50], "gold"],
+    "FFDAB9": [[255, 218, 185], [28, 100, 86], "peachPuff"],
+    "FFDEAD": [[255, 222, 173], [36, 100, 84], "navajoWhite"],
+    "FFE4B5": [[255, 228, 181], [38, 100, 85], "moccasin"],
+    "FFE4C4": [[255, 228, 196], [33, 100, 88], "bisque"],
+    "FFE4E1": [[255, 228, 225], [6, 100, 94], "mistyRose"],
+    "FFEBCD": [[255, 235, 205], [36, 100, 90], "blanchedAlmond"],
+    "FFEFD5": [[255, 239, 213], [37, 100, 92], "papayaWhip"],
+    "FFF0F5": [[255, 240, 245], [340, 100, 97], "lavenderBlush"],
+    "FFF5EE": [[255, 245, 238], [25, 100, 97], "seaShell"],
+    "FFF8DC": [[255, 248, 220], [48, 100, 93], "cornsilk"],
+    "FFFACD": [[255, 250, 205], [54, 100, 90], "lemonChiffon"],
+    "FFFAF0": [[255, 250, 240], [40, 100, 97], "floralWhite"],
+    "FFFAFA": [[255, 250, 250], [0, 100, 99], "snow"],
+    "FFFF00": [[255, 255, 0], [60, 100, 50], "yellow"],
+    "FFFFE0": [[255, 255, 224], [60, 100, 94], "lightYellow"],
+    "FFFFF0": [[255, 255, 240], [60, 100, 97], "ivory"],
+    "FFFFFF": [[255, 255, 255], [0, 100, 100], "white"]
+};
+
+// Simple Values
+WebInspector.Color.Nicknames = {
+    "aliceblue": "F0F8FF",
+    "antiquewhite": "FAEBD7",
+    "aqua": "00FFFF",
+    "aquamarine": "7FFFD4",
+    "azure": "F0FFFF",
+    "beige": "F5F5DC",
+    "bisque": "FFE4C4",
+    "black": "000000",
+    "blanchedalmond": "FFEBCD",
+    "blue": "0000FF",
+    "blueviolet": "8A2BE2",
+    "brown": "A52A2A",
+    "burlywood": "DEB887",
+    "cadetblue": "5F9EA0",
+    "chartreuse": "7FFF00",
+    "chocolate": "D2691E",
+    "coral": "FF7F50",
+    "cornflowerblue": "6495ED",
+    "cornsilk": "FFF8DC",
+    "crimson": "DC143C",
+    "cyan": "00FFFF",
+    "darkblue": "00008B",
+    "darkcyan": "008B8B",
+    "darkgoldenrod": "B8860B",
+    "darkgray": "A9A9A9",
+    "darkgreen": "006400",
+    "darkkhaki": "BDB76B",
+    "darkmagenta": "8B008B",
+    "darkolivegreen": "556B2F",
+    "darkorange": "FF8C00",
+    "darkorchid": "9932CC",
+    "darkred": "8B0000",
+    "darksalmon": "E9967A",
+    "darkseagreen": "8FBC8F",
+    "darkslateblue": "483D8B",
+    "darkslategray": "2F4F4F",
+    "darkturquoise": "00CED1",
+    "darkviolet": "9400D3",
+    "deeppink": "FF1493",
+    "deepskyblue": "00BFFF",
+    "dimgray": "696969",
+    "dodgerblue": "1E90FF",
+    "firebrick": "B22222",
+    "floralwhite": "FFFAF0",
+    "forestgreen": "228B22",
+    "fuchsia": "FF00FF",
+    "gainsboro": "DCDCDC",
+    "ghostwhite": "F8F8FF",
+    "gold": "FFD700",
+    "goldenrod": "DAA520",
+    "gray": "808080",
+    "green": "008000",
+    "greenyellow": "ADFF2F",
+    "honeydew": "F0FFF0",
+    "hotpink": "FF69B4",
+    "indianred": "CD5C5C",
+    "indigo": "4B0082",
+    "ivory": "FFFFF0",
+    "khaki": "F0E68C",
+    "lavender": "E6E6FA",
+    "lavenderblush": "FFF0F5",
+    "lawngreen": "7CFC00",
+    "lemonchiffon": "FFFACD",
+    "lightblue": "ADD8E6",
+    "lightcoral": "F08080",
+    "lightcyan": "E0FFFF",
+    "lightgoldenrodyellow": "FAFAD2",
+    "lightgreen": "90EE90",
+    "lightgrey": "D3D3D3",
+    "lightpink": "FFB6C1",
+    "lightsalmon": "FFA07A",
+    "lightseagreen": "20B2AA",
+    "lightskyblue": "87CEFA",
+    "lightslategray": "778899",
+    "lightsteelblue": "B0C4DE",
+    "lightyellow": "FFFFE0",
+    "lime": "00FF00",
+    "limegreen": "32CD32",
+    "linen": "FAF0E6",
+    "magenta": "FF00FF",
+    "maroon": "800000",
+    "mediumaquamarine": "66CDAA",
+    "mediumblue": "0000CD",
+    "mediumorchid": "BA55D3",
+    "mediumpurple": "9370D8",
+    "mediumseagreen": "3CB371",
+    "mediumslateblue": "7B68EE",
+    "mediumspringgreen": "00FA9A",
+    "mediumturquoise": "48D1CC",
+    "mediumvioletred": "C71585",
+    "midnightblue": "191970",
+    "mintcream": "F5FFFA",
+    "mistyrose": "FFE4E1",
+    "moccasin": "FFE4B5",
+    "navajowhite": "FFDEAD",
+    "navy": "000080",
+    "oldlace": "FDF5E6",
+    "olive": "808000",
+    "olivedrab": "6B8E23",
+    "orange": "FFA500",
+    "orangered": "FF4500",
+    "orchid": "DA70D6",
+    "palegoldenrod": "EEE8AA",
+    "palegreen": "98FB98",
+    "paleturquoise": "AFEEEE",
+    "palevioletred": "D87093",
+    "papayawhip": "FFEFD5",
+    "peachpuff": "FFDAB9",
+    "peru": "CD853F",
+    "pink": "FFC0CB",
+    "plum": "DDA0DD",
+    "powderblue": "B0E0E6",
+    "purple": "800080",
+    "red": "FF0000",
+    "rosybrown": "BC8F8F",
+    "royalblue": "4169E1",
+    "saddlebrown": "8B4513",
+    "salmon": "FA8072",
+    "sandybrown": "F4A460",
+    "seagreen": "2E8B57",
+    "seashell": "FFF5EE",
+    "sienna": "A0522D",
+    "silver": "C0C0C0",
+    "skyblue": "87CEEB",
+    "slateblue": "6A5ACD",
+    "slategray": "708090",
+    "snow": "FFFAFA",
+    "springgreen": "00FF7F",
+    "steelblue": "4682B4",
+    "tan": "D2B48C",
+    "teal": "008080",
+    "thistle": "D8BFD8",
+    "tomato": "FF6347",
+    "turquoise": "40E0D0",
+    "violet": "EE82EE",
+    "wheat": "F5DEB3",
+    "white": "FFFFFF",
+    "whitesmoke": "F5F5F5",
+    "yellow": "FFFF00",
+    "yellowgreen": "9ACD32"
+};
+
+// Advanced Values [rgba, hsla, nickname]
+WebInspector.Color.AdvancedNickNames = {
+    "transparent": [[0, 0, 0, 0], [0, 0, 0, 0], "transparent"],
+    "rgba(0,0,0,0)": [[0, 0, 0, 0], [0, 0, 0, 0], "transparent"],
+    "hsla(0,0,0,0)": [[0, 0, 0, 0], [0, 0, 0, 0], "transparent"],
+};
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Console.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ConsoleView.js
index 520e213..41b14ef 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Console.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ConsoleView.js
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2007, 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Joseph Pecoraro
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,11 +27,16 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.Console = function()
+WebInspector.ConsoleView = function(drawer)
 {
+    WebInspector.View.call(this, document.getElementById("console-view"));
+
     this.messages = [];
+    this.drawer = drawer;
 
-    WebInspector.View.call(this, document.getElementById("console"));
+    this.clearButton = document.getElementById("clear-console-status-bar-item");
+    this.clearButton.title = WebInspector.UIString("Clear console log.");
+    this.clearButton.addEventListener("click", this._clearButtonClicked.bind(this), false);
 
     this.messagesElement = document.getElementById("console-messages");
     this.messagesElement.addEventListener("selectstart", this._messagesSelectStart.bind(this), false);
@@ -40,103 +46,116 @@ WebInspector.Console = function()
     this.promptElement.handleKeyEvent = this._promptKeyDown.bind(this);
     this.prompt = new WebInspector.TextPrompt(this.promptElement, this.completions.bind(this), " .=:[({;");
 
-    this.toggleButton = document.getElementById("console-status-bar-item");
-    this.toggleButton.title = WebInspector.UIString("Show console.");
-    this.toggleButton.addEventListener("click", this._toggleButtonClicked.bind(this), false);
-
-    this.clearButton = document.getElementById("clear-console-status-bar-item");
-    this.clearButton.title = WebInspector.UIString("Clear console log.");
-    this.clearButton.addEventListener("click", this._clearButtonClicked.bind(this), false);
-
     this.topGroup = new WebInspector.ConsoleGroup(null, 0);
     this.messagesElement.insertBefore(this.topGroup.element, this.promptElement);
     this.groupLevel = 0;
     this.currentGroup = this.topGroup;
 
-    document.getElementById("main-status-bar").addEventListener("mousedown", this._startStatusBarDragging.bind(this), true);
-}
-
-WebInspector.Console.prototype = {
-    show: function()
-    {
-        if (this._animating || this.visible)
-            return;
-
-        WebInspector.View.prototype.show.call(this);
-
-        this._animating = true;
-
-        this.toggleButton.addStyleClass("toggled-on");
-        this.toggleButton.title = WebInspector.UIString("Hide console.");
+    this.toggleConsoleButton = document.getElementById("console-status-bar-item");
+    this.toggleConsoleButton.title = WebInspector.UIString("Show console.");
+    this.toggleConsoleButton.addEventListener("click", this._toggleConsoleButtonClicked.bind(this), false);
 
-        document.body.addStyleClass("console-visible");
-
-        var anchoredItems = document.getElementById("anchored-status-bar-items");
-
-        var animations = [
-            {element: document.getElementById("main"), end: {bottom: this.element.offsetHeight}},
-            {element: document.getElementById("main-status-bar"), start: {"padding-left": anchoredItems.offsetWidth - 1}, end: {"padding-left": 0}},
-            {element: document.getElementById("other-console-status-bar-items"), start: {opacity: 0}, end: {opacity: 1}}
-        ];
+    var anchoredStatusBar = document.getElementById("anchored-status-bar-items");
+    anchoredStatusBar.appendChild(this.toggleConsoleButton);
+    
+    // Will hold the list of filter elements
+    this.filterBarElement = document.getElementById("console-filter");
+    
+    function createFilterElement(category) {
+        var categoryElement = document.createElement("li");
+        categoryElement.category = category;
+     
+        categoryElement.addStyleClass(categoryElement.category);
+            
+        var label = category.toString();
+        categoryElement.appendChild(document.createTextNode(label));
+     
+        categoryElement.addEventListener("click", this._updateFilter.bind(this), false);
+     
+        this.filterBarElement.appendChild(categoryElement);
+        return categoryElement;
+    }
+    
+    this.allElement = createFilterElement.call(this, "All");
+    this.errorElement = createFilterElement.call(this, "Errors");
+    this.warningElement = createFilterElement.call(this, "Warnings");
+    this.logElement = createFilterElement.call(this, "Logs");
 
-        var consoleStatusBar = document.getElementById("console-status-bar");
-        consoleStatusBar.insertBefore(anchoredItems, consoleStatusBar.firstChild);
+    this.filter(this.allElement);
+}
 
-        function animationFinished()
-        {
-            if ("updateStatusBarItems" in WebInspector.currentPanel)
-                WebInspector.currentPanel.updateStatusBarItems();
-            WebInspector.currentFocusElement = this.promptElement;
-            delete this._animating;
+WebInspector.ConsoleView.prototype = {
+    
+    _updateFilter: function(e)
+    {
+        this.filter(e.target);
+    },
+    
+    filter: function(target)
+    {
+        if (target.category == "All") {
+            if (target.hasStyleClass("selected")) {
+                // We can't unselect all, so we break early here
+                return;
+            }
+            
+            this.errorElement.removeStyleClass("selected");
+            this.warningElement.removeStyleClass("selected");
+            this.logElement.removeStyleClass("selected");
+            
+            document.getElementById("console-messages").removeStyleClass("filter-errors");
+            document.getElementById("console-messages").removeStyleClass("filter-warnings");
+            document.getElementById("console-messages").removeStyleClass("filter-logs");
+        } else {
+            // Something other than all is being selected, so we want to unselect all
+            if (this.allElement.hasStyleClass("selected")) {
+                this.allElement.removeStyleClass("selected");
+                document.getElementById("console-messages").removeStyleClass("filter-all");
+            }
+        }
+        
+        if (target.hasStyleClass("selected")) {
+            target.removeStyleClass("selected");
+            var newClass = "filter-" + target.category.toLowerCase();
+            var filterElement = document.getElementById("console-messages");
+            filterElement.removeStyleClass(newClass);
+        } else {
+            target.addStyleClass("selected");
+            var newClass = "filter-" + target.category.toLowerCase();
+            var filterElement = document.getElementById("console-messages");
+            filterElement.addStyleClass(newClass);
         }
+    },
+    
+    _toggleConsoleButtonClicked: function()
+    {
+        this.drawer.visibleView = this;
+    },
 
-        WebInspector.animateStyle(animations, window.event && window.event.shiftKey ? 2000 : 250, animationFinished.bind(this));
+    attach: function(mainElement, statusBarElement)
+    {
+        mainElement.appendChild(this.element);
+        statusBarElement.appendChild(this.clearButton);
+        statusBarElement.appendChild(this.filterBarElement);
+    },
 
+    show: function()
+    {
+        this.toggleConsoleButton.addStyleClass("toggled-on");
+        this.toggleConsoleButton.title = WebInspector.UIString("Hide console.");
         if (!this.prompt.isCaretInsidePrompt())
             this.prompt.moveCaretToEndOfPrompt();
     },
 
-    hide: function()
+    afterShow: function()
     {
-        if (this._animating || !this.visible)
-            return;
-
-        WebInspector.View.prototype.hide.call(this);
-
-        this._animating = true;
-
-        this.toggleButton.removeStyleClass("toggled-on");
-        this.toggleButton.title = WebInspector.UIString("Show console.");
-
-        if (this.element === WebInspector.currentFocusElement || this.element.isAncestor(WebInspector.currentFocusElement))
-            WebInspector.currentFocusElement = WebInspector.previousFocusElement;
-
-        var anchoredItems = document.getElementById("anchored-status-bar-items");
-
-        // Temporally set properties and classes to mimic the post-animation values so panels
-        // like Elements in their updateStatusBarItems call will size things to fit the final location.
-        document.getElementById("main-status-bar").style.setProperty("padding-left", (anchoredItems.offsetWidth - 1) + "px");
-        document.body.removeStyleClass("console-visible");
-        if ("updateStatusBarItems" in WebInspector.currentPanel)
-            WebInspector.currentPanel.updateStatusBarItems();
-        document.body.addStyleClass("console-visible");
-
-        var animations = [
-            {element: document.getElementById("main"), end: {bottom: 0}},
-            {element: document.getElementById("main-status-bar"), start: {"padding-left": 0}, end: {"padding-left": anchoredItems.offsetWidth - 1}},
-            {element: document.getElementById("other-console-status-bar-items"), start: {opacity: 1}, end: {opacity: 0}}
-        ];
-
-        function animationFinished()
-        {
-            var mainStatusBar = document.getElementById("main-status-bar");
-            mainStatusBar.insertBefore(anchoredItems, mainStatusBar.firstChild);
-            mainStatusBar.style.removeProperty("padding-left");
-            document.body.removeStyleClass("console-visible");
-            delete this._animating;
-        }
+        WebInspector.currentFocusElement = this.promptElement;  
+    },
 
-        WebInspector.animateStyle(animations, window.event && window.event.shiftKey ? 2000 : 250, animationFinished.bind(this));
+    hide: function()
+    {
+        this.toggleConsoleButton.removeStyleClass("toggled-on");
+        this.toggleConsoleButton.title = WebInspector.UIString("Show console.");
     },
 
     addMessage: function(msg)
@@ -223,7 +242,7 @@ WebInspector.Console.prototype = {
     clearMessages: function(clearInspectorController)
     {
         if (clearInspectorController)
-            InspectorController.clearMessages();
+            InspectorController.clearMessages(false);
         if (WebInspector.panels.resources)
             WebInspector.panels.resources.clearMessages();
 
@@ -260,10 +279,42 @@ WebInspector.Console.prototype = {
             return;
 
         var reportCompletions = this._reportCompletions.bind(this, bestMatchOnly, completionsReadyCallback, dotNotation, bracketNotation, prefix);
-        this._evalInInspectedWindow(expressionString, reportCompletions);
-    },
-    
-    _reportCompletions: function(bestMatchOnly, completionsReadyCallback, dotNotation, bracketNotation, prefix, result) {
+        // Collect comma separated object properties for the completion.
+
+        if (!expressionString) {
+            if (WebInspector.panels.scripts && WebInspector.panels.scripts.paused) {
+                // Evaluate into properties in scope of the selected call frame.
+                reportCompletions(WebInspector.panels.scripts.variablesInSelectedCallFrame());
+                return;
+            } else {
+                expressionString = "this";
+            }
+        }
+
+        function parsingCallback(result, isException)
+        {
+            if (!isException)
+                result = JSON.parse(result);
+            reportCompletions(result, isException);
+        }
+
+        this.evalInInspectedWindow(
+            "(function() {" +
+                "var props = {};" +
+                "for (var prop in (" + expressionString + ")) props[prop] = true;" +
+                ((!dotNotation && !bracketNotation) ?
+                "for (var prop in window._inspectorCommandLineAPI)" +
+                    "if (prop.charAt(0) !== '_') props[prop] = true;"
+                : "") +
+                "return JSON.stringify(props);" +
+            "})()",
+            parsingCallback);
+    },
+
+    _reportCompletions: function(bestMatchOnly, completionsReadyCallback, dotNotation, bracketNotation, prefix, result, isException) {
+        if (isException)
+            return;
+
         if (bracketNotation) {
             if (prefix.length && prefix[0] === "'")
                 var quoteUsed = "'";
@@ -273,6 +324,7 @@ WebInspector.Console.prototype = {
 
         var results = [];
         var properties = Object.sortedProperties(result);
+
         for (var i = 0; i < properties.length; ++i) {
             var property = properties[i];
 
@@ -297,11 +349,6 @@ WebInspector.Console.prototype = {
         setTimeout(completionsReadyCallback, 0, results);
     },
 
-    _toggleButtonClicked: function()
-    {
-        this.visible = !this.visible;
-    },
-
     _clearButtonClicked: function()
     {
         this.clearMessages(true);
@@ -331,7 +378,7 @@ WebInspector.Console.prototype = {
         if (!link || !link.representedNode)
             return;
 
-        WebInspector.updateFocusedNode(link.representedNode);
+        WebInspector.updateFocusedNode(link.representedNode.id);
         event.stopPropagation();
         event.preventDefault();
     },
@@ -347,42 +394,7 @@ WebInspector.Console.prototype = {
         this.prompt.handleKeyEvent(event);
     },
 
-    _startStatusBarDragging: function(event)
-    {
-        if (!this.visible || event.target !== document.getElementById("main-status-bar"))
-            return;
-
-        WebInspector.elementDragStart(document.getElementById("main-status-bar"), this._statusBarDragging.bind(this), this._endStatusBarDragging.bind(this), event, "row-resize");
-
-        this._statusBarDragOffset = event.pageY - this.element.totalOffsetTop;
-
-        event.stopPropagation();
-    },
-
-    _statusBarDragging: function(event)
-    {
-        var mainElement = document.getElementById("main");
-
-        var height = window.innerHeight - event.pageY + this._statusBarDragOffset;
-        height = Number.constrain(height, Preferences.minConsoleHeight, window.innerHeight - mainElement.totalOffsetTop - Preferences.minConsoleHeight);
-
-        mainElement.style.bottom = height + "px";
-        this.element.style.height = height + "px";
-
-        event.preventDefault();
-        event.stopPropagation();
-    },
-
-    _endStatusBarDragging: function(event)
-    {
-        WebInspector.elementDragEnd(event);
-
-        delete this._statusBarDragOffset;
-
-        event.stopPropagation();
-    },
-
-    _evalInInspectedWindow: function(expression, callback)
+    evalInInspectedWindow: function(expression, callback)
     {
         if (WebInspector.panels.scripts && WebInspector.panels.scripts.paused) {
             WebInspector.panels.scripts.evaluateInSelectedCallFrame(expression, false, callback);
@@ -390,53 +402,6 @@ WebInspector.Console.prototype = {
         }
         this.doEvalInWindow(expression, callback);
     },
-    
-    _ensureCommandLineAPIInstalled: function(inspectedWindow)
-    {
-        if (!inspectedWindow._inspectorCommandLineAPI) {
-            inspectedWindow.eval("window._inspectorCommandLineAPI = { \
-                $: function() { return document.getElementById.apply(document, arguments) }, \
-                $$: function() { return document.querySelectorAll.apply(document, arguments) }, \
-                $x: function(xpath, context) { \
-                    var nodes = []; \
-                    try { \
-                        var doc = context || document; \
-                        var results = doc.evaluate(xpath, doc, null, XPathResult.ANY_TYPE, null); \
-                        var node; \
-                        while (node = results.iterateNext()) nodes.push(node); \
-                    } catch (e) {} \
-                    return nodes; \
-                }, \
-                dir: function() { return console.dir.apply(console, arguments) }, \
-                dirxml: function() { return console.dirxml.apply(console, arguments) }, \
-                keys: function(o) { var a = []; for (var k in o) a.push(k); return a; }, \
-                values: function(o) { var a = []; for (var k in o) a.push(o[k]); return a; }, \
-                profile: function() { return console.profile.apply(console, arguments) }, \
-                profileEnd: function() { return console.profileEnd.apply(console, arguments) }, \
-                _inspectedNodes: [], \
-                _addInspectedNode: function(node) { \
-                    var inspectedNodes = _inspectorCommandLineAPI._inspectedNodes; \
-                    inspectedNodes.unshift(node); \
-                    if (inspectedNodes.length >= 5) \
-                        inspectedNodes.pop(); \
-                }, \
-                get $0() { return _inspectorCommandLineAPI._inspectedNodes[0] }, \
-                get $1() { return _inspectorCommandLineAPI._inspectedNodes[1] }, \
-                get $2() { return _inspectorCommandLineAPI._inspectedNodes[2] }, \
-                get $3() { return _inspectorCommandLineAPI._inspectedNodes[3] }, \
-                get $4() { return _inspectorCommandLineAPI._inspectedNodes[4] } \
-            };");
-
-            inspectedWindow._inspectorCommandLineAPI.clear = InspectorController.wrapCallback(this.clearMessages.bind(this));
-        }
-    },
-
-    addInspectedNode: function(node)
-    {
-        var inspectedWindow = InspectorController.inspectedWindow();
-        this._ensureCommandLineAPIInstalled(inspectedWindow);
-        inspectedWindow._inspectorCommandLineAPI._addInspectedNode(node);
-    },
 
     doEvalInWindow: function(expression, callback)
     {
@@ -445,22 +410,11 @@ WebInspector.Console.prototype = {
             expression = "this";
         }
 
-        // Surround the expression in with statements to inject our command line API so that
-        // the window object properties still take more precedent than our API functions.
-        expression = "with (window._inspectorCommandLineAPI) { with (window) { " + expression + " } }";
-
-        var self = this;
-        function delayedEvaluation()
+        function evalCallback(result)
         {
-            var inspectedWindow = InspectorController.inspectedWindow();
-            self._ensureCommandLineAPIInstalled(inspectedWindow);
-            try {
-                callback(inspectedWindow.eval(expression));
-            } catch (e) {
-                callback(e, true);
-            }
-        }
-        setTimeout(delayedEvaluation, 0);
+            callback(result.value, result.isException);
+        };
+        InjectedScriptAccess.evaluate(expression, evalCallback);
     },
 
     _enterKeyPressed: function(event)
@@ -488,12 +442,23 @@ WebInspector.Console.prototype = {
             self.prompt.text = "";
             self.addMessage(new WebInspector.ConsoleCommandResult(result, exception, commandMessage));
         }
-        this._evalInInspectedWindow(str, printResult);
+        this.evalInInspectedWindow(str, printResult);
     },
 
     _format: function(output, forceObjectFormat)
     {
-        var type = (forceObjectFormat ? "object" : Object.type(output, InspectorController.inspectedWindow()));
+        var isProxy = (output != null && typeof output === "object");
+
+        if (forceObjectFormat)
+            var type = "object";
+        else
+            var type = Object.proxyType(output);
+
+        if (isProxy && type !== "object" && type !== "function" && type !== "array" && type !== "node") {
+            // Unwrap primitive value, skip decoration.
+            output = output.description;
+            type = "undecorated"
+        }
 
         // We don't perform any special formatting on these types, so we just
         // pass them through the simple _formatvalue function.
@@ -502,8 +467,7 @@ WebInspector.Console.prototype = {
             "null": 1,
             "boolean": 1,
             "number": 1,
-            "date": 1,
-            "function": 1,
+            "undecorated": 1
         };
 
         var formatter;
@@ -530,6 +494,16 @@ WebInspector.Console.prototype = {
         elem.appendChild(document.createTextNode(val));
     },
 
+    _formatfunction: function(func, elem)
+    {
+        elem.appendChild(document.createTextNode(func.description));
+    },
+
+    _formatdate: function(date, elem)
+    {
+        elem.appendChild(document.createTextNode(date));
+    },
+
     _formatstring: function(str, elem)
     {
         elem.appendChild(document.createTextNode("\"" + str + "\""));
@@ -537,34 +511,48 @@ WebInspector.Console.prototype = {
 
     _formatregexp: function(re, elem)
     {
-        var formatted = String(re).replace(/([\\\/])/g, "\\$1").replace(/\\(\/[gim]*)$/, "$1").substring(1);
+        var formatted = String(re.description).replace(/([\\\/])/g, "\\$1").replace(/\\(\/[gim]*)$/, "$1").substring(1);
         elem.appendChild(document.createTextNode(formatted));
     },
 
     _formatarray: function(arr, elem)
     {
-        elem.appendChild(document.createTextNode("["));
-        for (var i = 0; i < arr.length; ++i) {
-            elem.appendChild(this._format(arr[i]));
-            if (i < arr.length - 1)
-                elem.appendChild(document.createTextNode(", "));
+        var self = this;
+        function printResult(properties)
+        {
+            if (!properties)
+                return;
+            elem.appendChild(document.createTextNode("["));
+            for (var i = 0; i < properties.length; ++i) {
+                var property = properties[i].value;
+                elem.appendChild(self._format(property));
+                if (i < properties.length - 1)
+                    elem.appendChild(document.createTextNode(", "));
+            }
+            elem.appendChild(document.createTextNode("]"));
         }
-        elem.appendChild(document.createTextNode("]"));
+        InjectedScriptAccess.getProperties(arr, false, printResult);
     },
 
-    _formatnode: function(node, elem)
+    _formatnode: function(object, elem)
     {
-        var treeOutline = new WebInspector.ElementsTreeOutline();
-        treeOutline.rootDOMNode = node;
-        treeOutline.element.addStyleClass("outline-disclosure");
-        if (!treeOutline.children[0].hasChildren)
-            treeOutline.element.addStyleClass("single-node");
-        elem.appendChild(treeOutline.element);
+        function printNode(nodeId)
+        {
+            if (!nodeId)
+                return;
+            var treeOutline = new WebInspector.ElementsTreeOutline();
+            treeOutline.rootDOMNode = WebInspector.domAgent.nodeForId(nodeId);
+            treeOutline.element.addStyleClass("outline-disclosure");
+            if (!treeOutline.children[0].hasChildren)
+                treeOutline.element.addStyleClass("single-node");
+            elem.appendChild(treeOutline.element);
+        }
+        InjectedScriptAccess.pushNodeToFrontend(object, printNode);
     },
 
     _formatobject: function(obj, elem)
     {
-        elem.appendChild(new WebInspector.ObjectPropertiesSection(obj, null, null, null, true).element);
+        elem.appendChild(new WebInspector.ObjectPropertiesSection(obj, obj.description, null, true).element);
     },
 
     _formaterror: function(obj, elem)
@@ -590,10 +578,10 @@ WebInspector.Console.prototype = {
             elem.appendChild(urlElement);
             elem.appendChild(document.createTextNode(")"));
         }
-    },
+    }
 }
 
-WebInspector.Console.prototype.__proto__ = WebInspector.View.prototype;
+WebInspector.ConsoleView.prototype.__proto__ = WebInspector.View.prototype;
 
 WebInspector.ConsoleMessage = function(source, type, level, line, url, groupLevel, repeatCount)
 {
@@ -656,7 +644,7 @@ WebInspector.ConsoleMessage.prototype = {
             return WebInspector.console._format(obj, true);
         }
 
-        if (Object.type(parameters[0], InspectorController.inspectedWindow()) === "string") {
+        if (typeof parameters[0] === "string") {
             var formatters = {}
             for (var i in String.standardFormatters)
                 formatters[i] = String.standardFormatters[i];
@@ -734,6 +722,9 @@ WebInspector.ConsoleMessage.prototype = {
             case WebInspector.ConsoleMessage.MessageLevel.Log:
                 element.addStyleClass("console-log-level");
                 break;
+            case WebInspector.ConsoleMessage.MessageLevel.Debug:
+                element.addStyleClass("console-debug-level");
+                break;
             case WebInspector.ConsoleMessage.MessageLevel.Warning:
                 element.addStyleClass("console-warning-level");
                 break;
@@ -840,6 +831,9 @@ WebInspector.ConsoleMessage.prototype = {
             case WebInspector.ConsoleMessage.MessageLevel.Warning:
                 levelString = "Warning";
                 break;
+            case WebInspector.ConsoleMessage.MessageLevel.Debug:
+                levelString = "Debug";
+                break;
             case WebInspector.ConsoleMessage.MessageLevel.Error:
                 levelString = "Error";
                 break;
@@ -886,7 +880,8 @@ WebInspector.ConsoleMessage.MessageLevel = {
     Tip: 0,
     Log: 1,
     Warning: 2,
-    Error: 3
+    Error: 3,
+    Debug: 4
 }
 
 WebInspector.ConsoleCommand = function(command)
@@ -910,6 +905,14 @@ WebInspector.ConsoleCommand.prototype = {
     }
 }
 
+WebInspector.ConsoleTextMessage = function(text, level)
+{
+    level = level || WebInspector.ConsoleMessage.MessageLevel.Log;
+    WebInspector.ConsoleMessage.call(this, WebInspector.ConsoleMessage.MessageSource.JS, WebInspector.ConsoleMessage.MessageType.Log, level, 0, null, null, 1, text);
+}
+
+WebInspector.ConsoleTextMessage.prototype.__proto__ = WebInspector.ConsoleMessage.prototype;
+
 WebInspector.ConsoleCommandResult = function(result, exception, originatingCommand)
 {
     var level = (exception ? WebInspector.ConsoleMessage.MessageLevel.Error : WebInspector.ConsoleMessage.MessageLevel.Log);
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/CookieItemsView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/CookieItemsView.js
new file mode 100644
index 0000000..f9604a4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/CookieItemsView.js
@@ -0,0 +1,266 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Joseph Pecoraro
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.CookieItemsView = function()
+{
+    WebInspector.View.call(this);
+
+    this.element.addStyleClass("storage-view");
+    this.element.addStyleClass("table");
+
+    this.deleteButton = new WebInspector.StatusBarButton(WebInspector.UIString("Delete"), "delete-storage-status-bar-item");
+    this.deleteButton.visible = false;
+    this.deleteButton.addEventListener("click", this._deleteButtonClicked.bind(this), false);
+
+    this.refreshButton = new WebInspector.StatusBarButton(WebInspector.UIString("Refresh"), "refresh-storage-status-bar-item");
+    this.refreshButton.addEventListener("click", this._refreshButtonClicked.bind(this), false);
+}
+
+WebInspector.CookieItemsView.prototype = {
+    get statusBarItems()
+    {
+        return [this.refreshButton.element, this.deleteButton.element];
+    },
+
+    show: function(parentElement)
+    {
+        WebInspector.View.prototype.show.call(this, parentElement);
+        this.update();
+    },
+
+    hide: function()
+    {
+        WebInspector.View.prototype.hide.call(this);
+        this.deleteButton.visible = false;
+    },
+
+    update: function()
+    {
+        this.element.removeChildren();
+
+        var self = this;
+        function callback(cookies, isAdvanced) {
+            var dataGrid = (isAdvanced ? self.dataGridForCookies(cookies) : self.simpleDataGridForCookies(cookies));
+            if (dataGrid) {
+                self._dataGrid = dataGrid;
+                self.element.appendChild(dataGrid.element);
+                if (isAdvanced)
+                    self.deleteButton.visible = true;
+            } else {
+                var emptyMsgElement = document.createElement("div");
+                emptyMsgElement.className = "storage-table-empty";
+                emptyMsgElement.textContent = WebInspector.UIString("This site has no cookies.");
+                self.element.appendChild(emptyMsgElement);
+                self._dataGrid = null;
+                self.deleteButton.visible = false;
+            }
+        }
+
+        WebInspector.Cookies.getCookiesAsync(callback);
+    },
+
+    dataGridForCookies: function(cookies)
+    {
+        if (!cookies.length)
+            return null;
+
+        for (var i = 0; i < cookies.length; ++i)
+            cookies[i].expires = new Date(cookies[i].expires);
+
+        var columns = { 0: {}, 1: {}, 2: {}, 3: {}, 4: {}, 5: {}, 6: {}, 7: {} };
+        columns[0].title = WebInspector.UIString("Name");
+        columns[0].width = columns[0].title.length;
+        columns[1].title = WebInspector.UIString("Value");
+        columns[1].width = columns[1].title.length;
+        columns[2].title = WebInspector.UIString("Domain");
+        columns[2].width = columns[2].title.length;
+        columns[3].title = WebInspector.UIString("Path");
+        columns[3].width = columns[3].title.length;
+        columns[4].title = WebInspector.UIString("Expires");
+        columns[4].width = columns[4].title.length;
+        columns[5].title = WebInspector.UIString("Size");
+        columns[5].width = columns[5].title.length;
+        columns[5].aligned = "right";
+        columns[6].title = WebInspector.UIString("HTTP");
+        columns[6].width = columns[6].title.length;
+        columns[6].aligned = "centered";
+        columns[7].title = WebInspector.UIString("Secure");
+        columns[7].width = columns[7].title.length;
+        columns[7].aligned = "centered";
+
+        function updateDataAndColumn(index, value) {
+            data[index] = value;
+            if (value.length > columns[index].width)
+                columns[index].width = value.length;
+        }
+
+        var data;
+        var nodes = [];
+        for (var i = 0; i < cookies.length; ++i) {
+            var cookie = cookies[i];
+            data = {};
+
+            updateDataAndColumn(0, cookie.name);
+            updateDataAndColumn(1, cookie.value);
+            updateDataAndColumn(2, cookie.domain);
+            updateDataAndColumn(3, cookie.path);
+            updateDataAndColumn(4, (cookie.session ? WebInspector.UIString("Session") : cookie.expires.toGMTString()));
+            updateDataAndColumn(5, Number.bytesToString(cookie.size, WebInspector.UIString));
+            updateDataAndColumn(6, (cookie.httpOnly ? "\u2713" : "")); // Checkmark
+            updateDataAndColumn(7, (cookie.secure ? "\u2713" : "")); // Checkmark
+
+            var node = new WebInspector.DataGridNode(data, false);
+            node.cookie = cookie;
+            node.selectable = true;
+            nodes.push(node);
+        }
+
+        var totalColumnWidths = 0;
+        for (var columnIdentifier in columns)
+            totalColumnWidths += columns[columnIdentifier].width;
+
+        // Enforce the Value column (the 2nd column) to be a max of 33%
+        // tweaking the raw total width because may massively outshadow the others
+        var valueColumnWidth = columns[1].width;
+        if (valueColumnWidth / totalColumnWidths > 0.33) {
+            totalColumnWidths -= valueColumnWidth;
+            totalColumnWidths *= 1.33;
+            columns[1].width = totalColumnWidths * 0.33;
+        }
+
+        // Calculate the percentage width for the columns.
+        const minimumPrecent = 6;
+        var recoupPercent = 0;
+        for (var columnIdentifier in columns) {
+            var width = columns[columnIdentifier].width;
+            width = Math.round((width / totalColumnWidths) * 100);
+            if (width < minimumPrecent) {
+                recoupPercent += (minimumPrecent - width);
+                width = minimumPrecent;
+            }
+            columns[columnIdentifier].width = width;
+        }
+
+        // Enforce the minimum percentage width. (need to narrow total percentage due to earlier additions)
+        while (recoupPercent > 0) {
+            for (var columnIdentifier in columns) {
+                if (columns[columnIdentifier].width > minimumPrecent) {
+                    --columns[columnIdentifier].width;
+                    --recoupPercent;
+                    if (!recoupPercent)
+                        break;
+                }
+            }
+        }
+
+        for (var columnIdentifier in columns)
+            columns[columnIdentifier].width += "%";
+
+        var dataGrid = new WebInspector.DataGrid(columns);
+        var length = nodes.length;
+        for (var i = 0; i < length; ++i)
+            dataGrid.appendChild(nodes[i]);
+        if (length > 0)
+            nodes[0].selected = true;
+
+        return dataGrid;
+    },
+
+    simpleDataGridForCookies: function(cookies)
+    {
+        if (!cookies.length)
+            return null;
+
+        var columns = {};
+        columns[0] = {};
+        columns[1] = {};
+        columns[0].title = WebInspector.UIString("Name");
+        columns[0].width = columns[0].title.length;
+        columns[1].title = WebInspector.UIString("Value");
+        columns[1].width = columns[1].title.length;
+
+        var nodes = [];
+        for (var i = 0; i < cookies.length; ++i) {
+            var cookie = cookies[i];
+            var data = {};
+
+            var name = cookie.name;
+            data[0] = name;
+            if (name.length > columns[0].width)
+                columns[0].width = name.length;
+
+            var value = cookie.value;
+            data[1] = value;
+            if (value.length > columns[1].width)
+                columns[1].width = value.length;
+
+            var node = new WebInspector.DataGridNode(data, false);
+            node.selectable = true;
+            nodes.push(node);
+        }
+
+        var totalColumnWidths = columns[0].width + columns[1].width;
+        var width = Math.round((columns[0].width * 100) / totalColumnWidths);
+        const minimumPrecent = 20;
+        if (width < minimumPrecent)
+            width = minimumPrecent;
+        if (width > 100 - minimumPrecent)
+            width = 100 - minimumPrecent;
+        columns[0].width = width;
+        columns[1].width = 100 - width;
+        columns[0].width += "%";
+        columns[1].width += "%";
+
+        var dataGrid = new WebInspector.DataGrid(columns);
+        var length = nodes.length;
+        for (var i = 0; i < length; ++i)
+            dataGrid.appendChild(nodes[i]);
+        if (length > 0)
+            nodes[0].selected = true;
+
+        return dataGrid;
+    },
+
+    _deleteButtonClicked: function(event)
+    {
+        if (!this._dataGrid)
+            return;
+
+        var cookie = this._dataGrid.selectedNode.cookie;
+        InspectorController.deleteCookie(cookie.name);
+        this.update();
+    },
+
+    _refreshButtonClicked: function(event)
+    {
+        this.update();
+    }
+}
+
+WebInspector.CookieItemsView.prototype.__proto__ = WebInspector.View.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DOMAgent.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMAgent.js
new file mode 100644
index 0000000..47c8041
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMAgent.js
@@ -0,0 +1,650 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009 Joseph Pecoraro
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.DOMNode = function(doc, payload) {
+    this.ownerDocument = doc;
+
+    this.id = payload.id;
+    this.nodeType = payload.nodeType;
+    this.nodeName = payload.nodeName;
+    this._nodeValue = payload.nodeValue;
+    this.textContent = this.nodeValue;
+
+    this.attributes = [];
+    this._attributesMap = {};
+    if (payload.attributes)
+        this._setAttributesPayload(payload.attributes);
+
+    this._childNodeCount = payload.childNodeCount;
+    this.children = null;
+
+    this.nextSibling = null;
+    this.prevSibling = null;
+    this.firstChild = null;
+    this.lastChild = null;
+    this.parentNode = null;
+
+    if (payload.children)
+        this._setChildrenPayload(payload.children);
+
+    this._computedStyle = null;
+    this.style = null;
+    this._matchedCSSRules = [];
+
+    if (this.nodeType == Node.ELEMENT_NODE) {
+        if (this.nodeName == "HTML")
+            this.ownerDocument.documentElement = this;
+        if (this.nodeName == "BODY")
+            this.ownerDocument.body = this;
+    }
+}
+
+WebInspector.DOMNode.prototype = {
+    hasAttributes: function()
+    {
+        return this.attributes.length > 0;
+    },
+
+    hasChildNodes: function()  {
+        return this._childNodeCount > 0;
+    },
+
+    get nodeValue() {
+        return this._nodeValue;
+    },
+
+    set nodeValue(value) {
+        if (this.nodeType != Node.TEXT_NODE)
+            return;
+        var self = this;
+        var callback = function()
+        {
+            self._nodeValue = value;
+            self.textContent = value;
+        };
+        this.ownerDocument._domAgent.setTextNodeValueAsync(this, value, callback);
+    },
+
+    getAttribute: function(name)
+    {
+        var attr = this._attributesMap[name];
+        return attr ? attr.value : undefined;
+    },
+
+    setAttribute: function(name, value)
+    {
+        var self = this;
+        var callback = function()
+        {
+            var attr = self._attributesMap[name];
+            if (attr)
+                attr.value = value;
+            else
+                attr = self._addAttribute(name, value);
+        };
+        this.ownerDocument._domAgent.setAttributeAsync(this, name, value, callback);
+    },
+
+    removeAttribute: function(name)
+    {
+        var self = this;
+        var callback = function()
+        {
+            delete self._attributesMap[name];
+            for (var i = 0;  i < self.attributes.length; ++i) {
+                if (self.attributes[i].name == name) {
+                    self.attributes.splice(i, 1);
+                    break;
+                }
+            }
+        };
+        this.ownerDocument._domAgent.removeAttributeAsync(this, name, callback);
+    },
+
+    _setAttributesPayload: function(attrs)
+    {
+        for (var i = 0; i < attrs.length; i += 2)
+            this._addAttribute(attrs[i], attrs[i + 1]);
+    },
+
+    _insertChild: function(prev, payload)
+    {
+        var node = new WebInspector.DOMNode(this.ownerDocument, payload);
+        if (!prev)
+            // First node
+            this.children = [ node ];
+        else
+            this.children.splice(this.children.indexOf(prev) + 1, 0, node);
+        this._renumber();
+        return node;
+    },
+
+    removeChild_: function(node)
+    {
+        this.children.splice(this.children.indexOf(node), 1);
+        node.parentNode = null;
+        this._renumber();
+    },
+
+    _setChildrenPayload: function(payloads)
+    {
+        this.children = [];
+        for (var i = 0; i < payloads.length; ++i) {
+            var payload = payloads[i];
+            var node = new WebInspector.DOMNode(this.ownerDocument, payload);
+            this.children.push(node);
+        }
+        this._renumber();
+    },
+
+    _renumber: function()
+    {
+        this._childNodeCount = this.children.length;
+        if (this._childNodeCount == 0) {
+            this.firstChild = null;
+            this.lastChild = null;
+            return;
+        }
+        this.firstChild = this.children[0];
+        this.lastChild = this.children[this._childNodeCount - 1];
+        for (var i = 0; i < this._childNodeCount; ++i) {
+            var child = this.children[i];
+            child.nextSibling = i + 1 < this._childNodeCount ? this.children[i + 1] : null;
+            child.prevSibling = i - 1 >= 0 ? this.children[i - 1] : null;
+            child.parentNode = this;
+        }
+    },
+
+    _addAttribute: function(name, value)
+    {
+        var attr = {
+            "name": name,
+            "value": value,
+            "_node": this
+        };
+        this._attributesMap[name] = attr;
+        this.attributes.push(attr);
+    },
+
+    _setStyles: function(computedStyle, inlineStyle, styleAttributes, matchedCSSRules)
+    {
+        this._computedStyle = new WebInspector.CSSStyleDeclaration(computedStyle);
+        this.style = new WebInspector.CSSStyleDeclaration(inlineStyle);
+
+        for (var name in styleAttributes) {
+            if (this._attributesMap[name])
+                this._attributesMap[name].style = new WebInspector.CSSStyleDeclaration(styleAttributes[name]);
+        }
+
+        this._matchedCSSRules = [];
+        for (var i = 0; i < matchedCSSRules.length; i++)
+            this._matchedCSSRules.push(WebInspector.CSSStyleDeclaration.parseRule(matchedCSSRules[i]));
+    },
+
+    _clearStyles: function()
+    {
+        this.computedStyle = null;
+        this.style = null;
+        for (var name in this._attributesMap)
+            this._attributesMap[name].style = null;
+        this._matchedCSSRules = null;
+    }
+}
+
+WebInspector.DOMDocument = function(domAgent, defaultView, payload)
+{
+    WebInspector.DOMNode.call(this, this, payload);
+    this._listeners = {};
+    this._domAgent = domAgent;
+    this.defaultView = defaultView;
+}
+
+WebInspector.DOMDocument.prototype = {
+
+    addEventListener: function(name, callback)
+    {
+        var listeners = this._listeners[name];
+        if (!listeners) {
+            listeners = [];
+            this._listeners[name] = listeners;
+        }
+        listeners.push(callback);
+    },
+
+    removeEventListener: function(name, callback)
+    {
+        var listeners = this._listeners[name];
+        if (!listeners)
+            return;
+
+        var index = listeners.indexOf(callback);
+        if (index != -1)
+            listeners.splice(index, 1);
+    },
+
+    _fireDomEvent: function(name, event)
+    {
+        var listeners = this._listeners[name];
+        if (!listeners)
+            return;
+
+        for (var i = 0; i < listeners.length; ++i) {
+            var listener = listeners[i];
+            listener.call(this, event);
+        }
+    }
+}
+
+WebInspector.DOMDocument.prototype.__proto__ = WebInspector.DOMNode.prototype;
+
+
+WebInspector.DOMWindow = function(domAgent)
+{
+    this._domAgent = domAgent;
+}
+
+WebInspector.DOMWindow.prototype = {
+    get document()
+    {
+        return this._domAgent.document;
+    },
+
+    get Node()
+    {
+        return WebInspector.DOMNode;
+    },
+
+    get Element()
+    {
+        return WebInspector.DOMNode;
+    },
+
+    Object: function()
+    {
+    },
+
+    getComputedStyle: function(node)
+    {
+        return node._computedStyle;
+    },
+
+    getMatchedCSSRules: function(node, pseudoElement, authorOnly)
+    {
+        return node._matchedCSSRules;
+    }
+}
+
+WebInspector.DOMAgent = function() {
+    this._window = new WebInspector.DOMWindow(this);
+    this._idToDOMNode = null;
+    this.document = null;
+
+    // TODO: update ElementsPanel to not track embedded iframes - it is already being handled
+    // in the agent backend.
+
+    // Whitespace is ignored in InspectorDOMAgent already -> no need to filter.
+    // TODO: Either remove all of its usages or push value into the agent backend.
+    Preferences.ignoreWhitespace = false;
+}
+
+WebInspector.DOMAgent.prototype = {
+    get domWindow()
+    {
+        return this._window;
+    },
+
+    getChildNodesAsync: function(parent, callback)
+    {
+        var children = parent.children;
+        if (children) {
+            callback(children);
+            return;
+        }
+        function mycallback() {
+            callback(parent.children);
+        }
+        var callId = WebInspector.Callback.wrap(mycallback);
+        InspectorController.getChildNodes(callId, parent.id);
+    },
+
+    setAttributeAsync: function(node, name, value, callback)
+    {
+        var mycallback = this._didApplyDomChange.bind(this, node, callback);
+        InspectorController.setAttribute(WebInspector.Callback.wrap(mycallback), node.id, name, value);
+    },
+
+    removeAttributeAsync: function(node, name, callback)
+    {
+        var mycallback = this._didApplyDomChange.bind(this, node, callback);
+        InspectorController.removeAttribute(WebInspector.Callback.wrap(mycallback), node.id, name);
+    },
+
+    setTextNodeValueAsync: function(node, text, callback)
+    {
+        var mycallback = this._didApplyDomChange.bind(this, node, callback);
+        InspectorController.setTextNodeValue(WebInspector.Callback.wrap(mycallback), node.id, text);
+    },
+
+    _didApplyDomChange: function(node, callback, success)
+    {
+        if (!success)
+            return;
+        callback();
+        // TODO(pfeldman): Fix this hack.
+        var elem = WebInspector.panels.elements.treeOutline.findTreeElement(node);
+        if (elem) {
+            elem._updateTitle();
+        }
+    },
+
+    _attributesUpdated: function(nodeId, attrsArray)
+    {
+        var node = this._idToDOMNode[nodeId];
+        node._setAttributesPayload(attrsArray);
+    },
+
+    nodeForId: function(nodeId) {
+        return this._idToDOMNode[nodeId];
+    },
+
+    _setDocument: function(payload)
+    {
+        this.document = new WebInspector.DOMDocument(this, this._window, payload);
+        this._idToDOMNode = {};
+        this._idToDOMNode[payload.id] = this.document;
+        this._bindNodes(this.document.children);
+        WebInspector.panels.elements.reset();
+    },
+    
+    _setDetachedRoot: function(payload)
+    {
+        var root = new WebInspector.DOMNode(this.document, payload);
+        this._idToDOMNode[payload.id] = root;
+    },
+
+    _setChildNodes: function(parentId, payloads)
+    {
+        var parent = this._idToDOMNode[parentId];
+        parent._setChildrenPayload(payloads);
+        this._bindNodes(parent.children);
+    },
+
+    _bindNodes: function(children)
+    {
+        for (var i = 0; i < children.length; ++i) {
+            var child = children[i];
+            this._idToDOMNode[child.id] = child;
+            if (child.children)
+                this._bindNodes(child.children);
+        }
+    },
+
+    _childNodeCountUpdated: function(nodeId, newValue)
+    {
+        var node = this._idToDOMNode[nodeId];
+        node._childNodeCount = newValue;
+        var outline = WebInspector.panels.elements.treeOutline;
+        var treeElement = outline.findTreeElement(node);
+        if (treeElement) {
+            treeElement.hasChildren = newValue;
+            treeElement.whitespaceIgnored = Preferences.ignoreWhitespace;
+        }
+    },
+
+    _childNodeInserted: function(parentId, prevId, payload)
+    {
+        var parent = this._idToDOMNode[parentId];
+        var prev = this._idToDOMNode[prevId];
+        var node = parent._insertChild(prev, payload);
+        this._idToDOMNode[node.id] = node;
+        var event = { target : node, relatedNode : parent };
+        this.document._fireDomEvent("DOMNodeInserted", event);
+    },
+
+    _childNodeRemoved: function(parentId, nodeId)
+    {
+        var parent = this._idToDOMNode[parentId];
+        var node = this._idToDOMNode[nodeId];
+        parent.removeChild_(node);
+        var event = { target : node, relatedNode : parent };
+        this.document._fireDomEvent("DOMNodeRemoved", event);
+        delete this._idToDOMNode[nodeId];
+    }
+}
+
+WebInspector.Cookies = {}
+
+WebInspector.Cookies.getCookiesAsync = function(callback)
+{
+    function mycallback(cookies, cookiesString) {
+        if (cookiesString)
+            callback(WebInspector.Cookies.buildCookiesFromString(cookiesString), false);
+        else
+            callback(cookies, true);
+    }
+    var callId = WebInspector.Callback.wrap(mycallback);
+    InspectorController.getCookies(callId);
+}
+
+WebInspector.Cookies.buildCookiesFromString = function(rawCookieString)
+{
+    var rawCookies = rawCookieString.split(/;\s*/);
+    var cookies = [];
+
+    if (!(/^\s*$/.test(rawCookieString))) {
+        for (var i = 0; i < rawCookies.length; ++i) {
+            var cookie = rawCookies[i];
+            var delimIndex = cookie.indexOf("=");
+            var name = cookie.substring(0, delimIndex);
+            var value = cookie.substring(delimIndex + 1);
+            var size = name.length + value.length;
+            cookies.push({ name: name, value: value, size: size });
+        }
+    }
+
+    return cookies;
+}
+
+WebInspector.CSSStyleDeclaration = function(payload)
+{
+    this.id = payload.id;
+    this.width = payload.width;
+    this.height = payload.height;
+    this.__disabledProperties = payload.__disabledProperties;
+    this.__disabledPropertyValues = payload.__disabledPropertyValues;
+    this.__disabledPropertyPriorities = payload.__disabledPropertyPriorities;
+    this.uniqueStyleProperties = payload.uniqueStyleProperties;
+    this._shorthandValues = payload.shorthandValues;
+    this._propertyMap = {};
+    this._longhandProperties = {};
+    this.length = payload.properties.length;
+
+    for (var i = 0; i < this.length; ++i) {
+        var property = payload.properties[i];
+        var name = property.name;
+        this[i] = name;
+        this._propertyMap[name] = property;
+    }
+
+    // Index longhand properties.
+    for (var i = 0; i < this.uniqueStyleProperties.length; ++i) {
+        var name = this.uniqueStyleProperties[i];
+        var property = this._propertyMap[name];
+        if (property.shorthand) {
+            var longhands = this._longhandProperties[property.shorthand];
+            if (!longhands) {
+                longhands = [];
+                this._longhandProperties[property.shorthand] = longhands;
+            }
+            longhands.push(name);
+        }
+    }
+}
+
+WebInspector.CSSStyleDeclaration.parseStyle = function(payload)
+{
+    return new WebInspector.CSSStyleDeclaration(payload);
+}
+
+WebInspector.CSSStyleDeclaration.parseRule = function(payload)
+{
+    var rule = {};
+    rule.id = payload.id;
+    rule.selectorText = payload.selectorText;
+    rule.style = new WebInspector.CSSStyleDeclaration(payload.style);
+    rule.style.parentRule = rule;
+    rule.isUserAgent = payload.isUserAgent;
+    rule.isUser = payload.isUser;
+    rule.isViaInspector = payload.isViaInspector;
+    if (payload.parentStyleSheet)
+        rule.parentStyleSheet = { href: payload.parentStyleSheet.href };
+
+    return rule;
+}
+
+WebInspector.CSSStyleDeclaration.prototype = {
+    getPropertyValue: function(name)
+    {
+        var property = this._propertyMap[name];
+        return property ? property.value : "";
+    },
+
+    getPropertyPriority: function(name)
+    {
+        var property = this._propertyMap[name];
+        return property ? property.priority : "";
+    },
+
+    getPropertyShorthand: function(name)
+    {
+        var property = this._propertyMap[name];
+        return property ? property.shorthand : "";
+    },
+
+    isPropertyImplicit: function(name)
+    {
+        var property = this._propertyMap[name];
+        return property ? property.implicit : "";
+    },
+
+    styleTextWithShorthands: function()
+    {
+        var cssText = "";
+        var foundProperties = {};
+        for (var i = 0; i < this.length; ++i) {
+            var individualProperty = this[i];
+            var shorthandProperty = this.getPropertyShorthand(individualProperty);
+            var propertyName = (shorthandProperty || individualProperty);
+
+            if (propertyName in foundProperties)
+                continue;
+
+            if (shorthandProperty) {
+                var value = this.getPropertyValue(shorthandProperty);
+                var priority = this.getShorthandPriority(shorthandProperty);
+            } else {
+                var value = this.getPropertyValue(individualProperty);
+                var priority = this.getPropertyPriority(individualProperty);
+            }
+
+            foundProperties[propertyName] = true;
+
+            cssText += propertyName + ": " + value;
+            if (priority)
+                cssText += " !" + priority;
+            cssText += "; ";
+        }
+
+        return cssText;
+    },
+
+    getLonghandProperties: function(name)
+    {
+        return this._longhandProperties[name] || [];
+    },
+
+    getShorthandValue: function(shorthandProperty)
+    {
+        return this._shorthandValues[shorthandProperty];
+    },
+
+    getShorthandPriority: function(shorthandProperty)
+    {
+        var priority = this.getPropertyPriority(shorthandProperty);
+        if (priority)
+            return priority;
+
+        var longhands = this._longhandProperties[shorthandProperty];
+        return longhands ? this.getPropertyPriority(longhands[0]) : null;
+    }
+}
+
+WebInspector.attributesUpdated = function()
+{
+    this.domAgent._attributesUpdated.apply(this.domAgent, arguments);
+}
+
+WebInspector.setDocument = function()
+{
+    this.domAgent._setDocument.apply(this.domAgent, arguments);
+}
+
+WebInspector.setDetachedRoot = function()
+{
+    this.domAgent._setDetachedRoot.apply(this.domAgent, arguments);
+}
+
+WebInspector.setChildNodes = function()
+{
+    this.domAgent._setChildNodes.apply(this.domAgent, arguments);
+}
+
+WebInspector.childNodeCountUpdated = function()
+{
+    this.domAgent._childNodeCountUpdated.apply(this.domAgent, arguments);
+}
+
+WebInspector.childNodeInserted = function()
+{
+    this.domAgent._childNodeInserted.apply(this.domAgent, arguments);
+}
+
+WebInspector.childNodeRemoved = function()
+{
+    this.domAgent._childNodeRemoved.apply(this.domAgent, arguments);
+}
+
+WebInspector.didGetCookies = WebInspector.Callback.processCallback;
+WebInspector.didGetChildNodes = WebInspector.Callback.processCallback;
+WebInspector.didPerformSearch = WebInspector.Callback.processCallback;
+WebInspector.didApplyDomChange = WebInspector.Callback.processCallback;
+WebInspector.didRemoveAttribute = WebInspector.Callback.processCallback;
+WebInspector.didSetTextNodeValue = WebInspector.Callback.processCallback;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorageDataGrid.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorageDataGrid.js
index 9946415..efdd090 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorageDataGrid.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorageDataGrid.js
@@ -38,39 +38,93 @@ WebInspector.DOMStorageDataGrid.prototype = {
             return;
         this._startEditing(event);
     },
-    
+
+    _startEditingColumnOfDataGridNode: function(node, column)
+    {
+        this._editing = true;
+        this._editingNode = node;
+        this._editingNode.select();
+        WebInspector.panels.storage._unregisterStorageEventListener();
+
+        var element = this._editingNode._element.children[column];
+        WebInspector.startEditing(element, this._editingCommitted.bind(this), this._editingCancelled.bind(this), element.textContent);
+        window.getSelection().setBaseAndExtent(element, 0, element, 1);
+    },
+
     _startEditing: function(event)
     {
         var element = event.target.enclosingNodeOrSelfWithNodeName("td");
         if (!element)
             return;
+
         this._editingNode = this.dataGridNodeFromEvent(event);
-        if (!this._editingNode)
-            return;
+        if (!this._editingNode) {
+            if (!this.creationNode)
+                return;
+            this._editingNode = this.creationNode;
+        }
+
+        // Force editing the "Key" column when editing the creation node
+        if (this._editingNode.isCreationNode)
+            return this._startEditingColumnOfDataGridNode(this._editingNode, 0);
+
         this._editing = true;
-            
+        WebInspector.panels.storage._unregisterStorageEventListener();
         WebInspector.startEditing(element, this._editingCommitted.bind(this), this._editingCancelled.bind(this), element.textContent);
         window.getSelection().setBaseAndExtent(element, 0, element, 1);
     },
-    
-    _editingCommitted: function(element, newText)
+
+    _editingCommitted: function(element, newText, oldText, context, moveDirection)
     {
-        if (element.hasStyleClass("0-column"))
-            columnIdentifier = 0;
-        else
-            columnIdentifier = 1;
-        textBeforeEditing = this._editingNode.data[columnIdentifier];
+        var columnIdentifier = (element.hasStyleClass("0-column") ? 0 : 1);
+        var textBeforeEditing = this._editingNode.data[columnIdentifier];
+        var currentEditingNode = this._editingNode;
+
+        function moveToNextIfNeeded(wasChange) {
+            if (!moveDirection)
+                return;
+
+            if (moveDirection === "forward") {
+                if (currentEditingNode.isCreationNode && columnIdentifier === 0 && !wasChange)
+                    return;
+
+                if (columnIdentifier === 0)
+                    return this._startEditingColumnOfDataGridNode(currentEditingNode, 1);
+
+                var nextDataGridNode = currentEditingNode.traverseNextNode(true, null, true);
+                if (nextDataGridNode)
+                    return this._startEditingColumnOfDataGridNode(nextDataGridNode, 0);
+                if (currentEditingNode.isCreationNode && wasChange) {
+                    addCreationNode(false);
+                    return this._startEditingColumnOfDataGridNode(this.creationNode, 0);
+                }
+                return;
+            }
+
+            if (moveDirection === "backward") {
+                if (columnIdentifier === 1)
+                    return this._startEditingColumnOfDataGridNode(currentEditingNode, 0);
+                    var nextDataGridNode = currentEditingNode.traversePreviousNode(true, null, true);
+
+                if (nextDataGridNode)
+                    return this._startEditingColumnOfDataGridNode(nextDataGridNode, 1);
+                return;
+            }
+        }
+
         if (textBeforeEditing == newText) {
             this._editingCancelled(element);
+            moveToNextIfNeeded.call(this, false);
             return;
         }
-        
-        var domStorage = WebInspector.panels.databases.visibleView.domStorage.domStorage;
+
+        var domStorage = WebInspector.panels.storage.visibleView.domStorage.domStorage;
         if (domStorage) {
             if (columnIdentifier == 0) {
                 if (domStorage.getItem(newText) != null) {
                     element.textContent = this._editingNode.data[0];
                     this._editingCancelled(element);
+                    moveToNextIfNeeded.call(this, false);
                     return;
                 }
                 domStorage.removeItem(this._editingNode.data[0]);
@@ -81,20 +135,28 @@ WebInspector.DOMStorageDataGrid.prototype = {
                 this._editingNode.data[1] = newText;
             }
         }
-        
+
+        if (this._editingNode.isCreationNode)
+            this.addCreationNode(false);
+
         this._editingCancelled(element);
+        moveToNextIfNeeded.call(this, true);
     },
-    
+
     _editingCancelled: function(element, context)
     {
         delete this._editing;
         this._editingNode = null;
+        WebInspector.panels.storage._registerStorageEventListener();
     },
-    
+
     deleteSelectedRow: function()
     {
         var node = this.selectedNode;
-        var domStorage = WebInspector.panels.databases.visibleView.domStorage.domStorage;
+        if (this.selectedNode.isCreationNode)
+            return;
+
+        var domStorage = WebInspector.panels.storage.visibleView.domStorage.domStorage;
         if (node && domStorage)
             domStorage.removeItem(node.data[0]);
     }
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorageItemsView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorageItemsView.js
index 912573e..8617d60 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorageItemsView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorageItemsView.js
@@ -32,21 +32,18 @@ WebInspector.DOMStorageItemsView = function(domStorage)
     this.element.addStyleClass("storage-view");
     this.element.addStyleClass("table");
 
-    this.deleteButton = document.createElement("button");
-    this.deleteButton.title = WebInspector.UIString("Delete");
-    this.deleteButton.className = "delete-storage-status-bar-item status-bar-item hidden";
+    this.deleteButton = new WebInspector.StatusBarButton(WebInspector.UIString("Delete"), "delete-storage-status-bar-item");
+    this.deleteButton.visible = false;
     this.deleteButton.addEventListener("click", this._deleteButtonClicked.bind(this), false);
 
-    this.refreshButton = document.createElement("button");
-    this.refreshButton.title = WebInspector.UIString("Refresh");
-    this.refreshButton.className = "refresh-storage-status-bar-item status-bar-item";
+    this.refreshButton = new WebInspector.StatusBarButton(WebInspector.UIString("Refresh"), "refresh-storage-status-bar-item");
     this.refreshButton.addEventListener("click", this._refreshButtonClicked.bind(this), false);
 }
 
 WebInspector.DOMStorageItemsView.prototype = {
     get statusBarItems()
     {
-        return [this.refreshButton, this.deleteButton];
+        return [this.refreshButton.element, this.deleteButton.element];
     },
 
     show: function(parentElement)
@@ -58,7 +55,7 @@ WebInspector.DOMStorageItemsView.prototype = {
     hide: function()
     {
         WebInspector.View.prototype.hide.call(this);
-        this.deleteButton.addStyleClass("hidden");
+        this.deleteButton.visible = false;
     },
 
     update: function()
@@ -69,13 +66,14 @@ WebInspector.DOMStorageItemsView.prototype = {
             hasDOMStorage = this.domStorage.domStorage;
 
         if (hasDOMStorage) {
-            var dataGrid = WebInspector.panels.databases.dataGridForDOMStorage(this.domStorage.domStorage);
+            var dataGrid = WebInspector.panels.storage.dataGridForDOMStorage(this.domStorage.domStorage);
             if (!dataGrid)
                 hasDOMStorage = 0;
             else {
                 this._dataGrid = dataGrid;
                 this.element.appendChild(dataGrid.element);
-                this.deleteButton.removeStyleClass("hidden");
+                this._dataGrid.updateWidths();
+                this.deleteButton.visible = true;
             }
         }
 
@@ -86,9 +84,15 @@ WebInspector.DOMStorageItemsView.prototype = {
             emptyMsgElement.textContent = WebInspector.UIString("This storage is empty.");
             this.element.appendChild(emptyMsgElement);
             this._dataGrid = null;
-            this.deleteButton.addStyleClass("hidden");
+            this.deleteButton.visible = false;
         }
     },
+    
+    resize: function()
+    {
+        if (this._dataGrid)
+            this._dataGrid.updateWidths();
+    },
 
     _deleteButtonClicked: function(event)
     {
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DataGrid.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DataGrid.js
index 2fcb08c..ce61548 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/DataGrid.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DataGrid.js
@@ -39,6 +39,8 @@ WebInspector.DataGrid = function(columns)
     this._dataTable.addEventListener("mousedown", this._mouseDownInDataTable.bind(this), true);
     this._dataTable.addEventListener("click", this._clickInDataTable.bind(this), true);
 
+    this.aligned = {};
+
     var scrollContainer = document.createElement("div");
     scrollContainer.className = "data-container";
     scrollContainer.appendChild(this._dataTable);
@@ -78,6 +80,11 @@ WebInspector.DataGrid = function(columns)
             cell.addStyleClass("sortable");
         }
 
+        if (column.aligned) {
+            cell.addStyleClass(column.aligned);
+            this.aligned[columnIdentifier] = column.aligned;
+        }
+
         headerRow.appendChild(cell);
 
         ++columnCount;
@@ -89,7 +96,8 @@ WebInspector.DataGrid = function(columns)
     cell.className = "corner";
     headerRow.appendChild(cell);
 
-    this._headerTable.appendChild(columnGroup);
+    this._headerTableColumnGroup = columnGroup;
+    this._headerTable.appendChild(this._headerTableColumnGroup);
     this.headerTableBody.appendChild(headerRow);
 
     var fillerRow = document.createElement("tr");
@@ -99,8 +107,9 @@ WebInspector.DataGrid = function(columns)
         var cell = document.createElement("td");
         fillerRow.appendChild(cell);
     }
-
-    this._dataTable.appendChild(columnGroup.cloneNode(true));
+    
+    this._dataTableColumnGroup = columnGroup.cloneNode(true);
+    this._dataTable.appendChild(this._dataTableColumnGroup);
     this.dataTableBody.appendChild(fillerRow);
 
     this.columns = columns || {};
@@ -114,6 +123,8 @@ WebInspector.DataGrid = function(columns)
     this.selected = false;
     this.dataGrid = this;
     this.indentWidth = 15;
+    this.resizers = [];
+    this.columnWidthsInitialized = false;
 }
 
 WebInspector.DataGrid.prototype = {
@@ -160,6 +171,75 @@ WebInspector.DataGrid.prototype = {
 
         return this._dataTableBody;
     },
+ 
+    // Updates the widths of the table, including the positions of the column
+    // resizers.
+    //
+    // IMPORTANT: This function MUST be called once after the element of the
+    // DataGrid is attached to its parent element and every subsequent time the
+    // width of the parent element is changed in order to make it possible to
+    // resize the columns.
+    //
+    // If this function is not called after the DataGrid is attached to its
+    // parent element, then the DataGrid's columns will not be resizable.
+    updateWidths: function()
+    {
+        var headerTableColumns = this._headerTableColumnGroup.children;
+        
+        var left = 0;
+        var tableWidth = this._dataTable.offsetWidth;
+        var numColumns = headerTableColumns.length;
+        
+        if (!this.columnWidthsInitialized) {
+            // Give all the columns initial widths now so that during a resize,
+            // when the two columns that get resized get a percent value for
+            // their widths, all the other columns already have percent values
+            // for their widths.
+            for (var i = 0; i < numColumns; i++) {
+                var columnWidth = this.headerTableBody.rows[0].cells[i].offsetWidth;
+                var percentWidth = ((columnWidth / tableWidth) * 100) + "%";
+                this._headerTableColumnGroup.children[i].style.width = percentWidth;
+                this._dataTableColumnGroup.children[i].style.width = percentWidth;
+            }
+            this.columnWidthsInitialized = true;
+        }
+        
+        // Make n - 1 resizers for n columns. 
+        for (var i = 0; i < numColumns - 1; i++) {
+            var resizer = this.resizers[i];
+
+            if (!resizer) {
+                // This is the first call to updateWidth, so the resizers need
+                // to be created.
+                resizer = document.createElement("div");
+                resizer.addStyleClass("data-grid-resizer");
+                // This resizer is associated with the column to its right.
+                resizer.rightNeighboringColumnID = i + 1;
+                resizer.addEventListener("mousedown", this._startResizerDragging.bind(this), false);
+                this.element.appendChild(resizer);
+                this.resizers[i] = resizer;
+            }
+
+            // Get the width of the cell in the first (and only) row of the
+            // header table in order to determine the width of the column, since
+            // it is not possible to query a column for its width.
+            left += this.headerTableBody.rows[0].cells[i].offsetWidth;
+            
+            resizer.style.left = left + "px";
+        }
+    },
+
+    addCreationNode: function(hasChildren)
+    {
+        if (this.creationNode)
+            this.creationNode.makeNormal();
+
+        var emptyData = {};
+        for (var column in this.columns)
+            emptyData[column] = '';
+        this.creationNode = new WebInspector.CreationDataGridNode(emptyData, hasChildren);
+        this.appendChild(this.creationNode);
+    },
 
     appendChild: function(child)
     {
@@ -429,7 +509,63 @@ WebInspector.DataGrid.prototype = {
             else
                 gridNode.expand();
         }
-    }
+    },
+    
+    _startResizerDragging: function(event)
+    {
+        this.currentResizer = event.target;
+        if (!this.currentResizer.rightNeighboringColumnID)
+            return;
+        WebInspector.elementDragStart(this.lastResizer, this._resizerDragging.bind(this),
+            this._endResizerDragging.bind(this), event, "col-resize");
+    },
+    
+    _resizerDragging: function(event)
+    {
+        var resizer = this.currentResizer;
+        if (!resizer)
+            return;
+        
+        // Constrain the dragpoint to be within the containing div of the
+        // datagrid.
+        var dragPoint = event.clientX - this.element.totalOffsetLeft;
+        // Constrain the dragpoint to be within the space made up by the
+        // column directly to the left and the column directly to the right.
+        var leftEdgeOfPreviousColumn = 0;
+        var firstRowCells = this.headerTableBody.rows[0].cells;
+        for (var i = 0; i < resizer.rightNeighboringColumnID - 1; i++)
+            leftEdgeOfPreviousColumn += firstRowCells[i].offsetWidth;
+            
+        var rightEdgeOfNextColumn = leftEdgeOfPreviousColumn + firstRowCells[resizer.rightNeighboringColumnID - 1].offsetWidth + firstRowCells[resizer.rightNeighboringColumnID].offsetWidth;
+        
+        // Give each column some padding so that they don't disappear.               
+        var leftMinimum = leftEdgeOfPreviousColumn + this.ColumnResizePadding;
+        var rightMaximum = rightEdgeOfNextColumn - this.ColumnResizePadding;
+        
+        dragPoint = Number.constrain(dragPoint, leftMinimum, rightMaximum);
+        
+        resizer.style.left = (dragPoint - this.CenterResizerOverBorderAdjustment) + "px";
+        
+        var percentLeftColumn = (((dragPoint - leftEdgeOfPreviousColumn) / this._dataTable.offsetWidth) * 100) + "%";
+        this._headerTableColumnGroup.children[resizer.rightNeighboringColumnID - 1].style.width = percentLeftColumn;
+        this._dataTableColumnGroup.children[resizer.rightNeighboringColumnID - 1].style.width = percentLeftColumn;
+        
+        var percentRightColumn = (((rightEdgeOfNextColumn - dragPoint) / this._dataTable.offsetWidth) * 100) + "%";
+        this._headerTableColumnGroup.children[resizer.rightNeighboringColumnID].style.width =  percentRightColumn;
+        this._dataTableColumnGroup.children[resizer.rightNeighboringColumnID].style.width = percentRightColumn;
+        
+        event.preventDefault();
+    },
+    
+    _endResizerDragging: function(event)
+    {
+        WebInspector.elementDragEnd(event);
+        this.currentResizer = null;
+    },
+    
+    ColumnResizePadding: 10,
+    
+    CenterResizerOverBorderAdjustment: 3,
 }
 
 WebInspector.DataGrid.prototype.__proto__ = WebInspector.Object.prototype;
@@ -623,6 +759,10 @@ WebInspector.DataGridNode.prototype = {
         var cell = document.createElement("td");
         cell.className = columnIdentifier + "-column";
 
+        var alignment = this.dataGrid.aligned[columnIdentifier];
+        if (alignment)
+            cell.addStyleClass(alignment);
+
         var div = document.createElement("div");
         div.textContent = this.data[columnIdentifier];
         cell.appendChild(div);
@@ -883,3 +1023,19 @@ WebInspector.DataGridNode.prototype = {
 }
 
 WebInspector.DataGridNode.prototype.__proto__ = WebInspector.Object.prototype;
+
+WebInspector.CreationDataGridNode = function(data, hasChildren)
+{
+    WebInspector.DataGridNode.call(this, data, hasChildren);
+    this.isCreationNode = true;
+}
+
+WebInspector.CreationDataGridNode.prototype = {
+    makeNormal: function()
+    {
+        delete this.isCreationNode;
+        delete this.makeNormal;
+    }
+}
+
+WebInspector.CreationDataGridNode.prototype.__proto__ = WebInspector.DataGridNode.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Database.js b/src/3rdparty/webkit/WebCore/inspector/front-end/Database.js
index ef42e15..dcab2ab 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Database.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Database.js
@@ -28,23 +28,16 @@
 
 WebInspector.Database = function(database, domain, name, version)
 {
-    this.database = database;
+    this._database = database;
     this.domain = domain;
     this.name = name;
     this.version = version;
 }
 
 WebInspector.Database.prototype = {
-    get database()
+    isDatabase: function(db)
     {
-        return this._database;
-    },
-
-    set database(x)
-    {
-        if (this._database === x)
-            return;
-        this._database = x;
+        return this._database === db;
     },
 
     get name()
@@ -88,8 +81,33 @@ WebInspector.Database.prototype = {
         return WebInspector.Resource.prototype.__lookupGetter__("displayDomain").call(this);
     },
 
-    get tableNames()
+    getTableNames: function(callback)
     {
-        return InspectorController.databaseTableNames(this.database).sort();
+        var names = InspectorController.databaseTableNames(this._database);
+        function sortingCallback()
+        {
+            callback(names.sort());
+        }
+        setTimeout(sortingCallback, 0);
+    },
+    
+    executeSql: function(query, onSuccess, onError)
+    {
+        function successCallback(tx, result)
+        {
+            onSuccess(result);
+        }
+
+        function errorCallback(tx, error)
+        {
+            onError(error);
+        }
+
+        var self = this;
+        function queryTransaction(tx)
+        {
+            tx.executeSql(query, null, InspectorController.wrapCallback(successCallback.bind(self)), InspectorController.wrapCallback(errorCallback.bind(self)));
+        }
+        this._database.transaction(InspectorController.wrapCallback(queryTransaction.bind(this)), InspectorController.wrapCallback(errorCallback.bind(this)));
     }
 }
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseQueryView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseQueryView.js
index 429c2c3..6c5fa02 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseQueryView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseQueryView.js
@@ -81,11 +81,15 @@ WebInspector.DatabaseQueryView.prototype = {
                     return;
             }
         }
+        
+        function tableNamesCallback(tableNames)
+        {
+            accumulateMatches(tableNames.map(function(name) { return name + " " }));
+            accumulateMatches(["SELECT ", "FROM ", "WHERE ", "LIMIT ", "DELETE FROM ", "CREATE ", "DROP ", "TABLE ", "INDEX ", "UPDATE ", "INSERT INTO ", "VALUES ("]);
 
-        accumulateMatches(this.database.tableNames.map(function(name) { return name + " " }));
-        accumulateMatches(["SELECT ", "FROM ", "WHERE ", "LIMIT ", "DELETE FROM ", "CREATE ", "DROP ", "TABLE ", "INDEX ", "UPDATE ", "INSERT INTO ", "VALUES ("]);
-
-        completionsReadyCallback(results);
+            completionsReadyCallback(results);
+        }
+        this.database.getTableNames(tableNamesCallback);
     },
 
     _promptKeyDown: function(event)
@@ -132,22 +136,19 @@ WebInspector.DatabaseQueryView.prototype = {
         this.prompt.historyOffset = 0;
         this.prompt.text = "";
 
-        function queryTransaction(tx)
-        {
-            tx.executeSql(query, null, InspectorController.wrapCallback(this._queryFinished.bind(this, query)), InspectorController.wrapCallback(this._executeSqlError.bind(this, query)));
-        }
-
-        this.database.database.transaction(InspectorController.wrapCallback(queryTransaction.bind(this)), InspectorController.wrapCallback(this._queryError.bind(this, query)));
+        this.database.executeSql(query, this._queryFinished.bind(this, query), this._queryError.bind(this, query));
     },
 
-    _queryFinished: function(query, tx, result)
+    _queryFinished: function(query, result)
     {
-        var dataGrid = WebInspector.panels.databases.dataGridForResult(result);
+        var dataGrid = WebInspector.panels.storage.dataGridForResult(result);
+        if (!dataGrid)
+            return;
         dataGrid.element.addStyleClass("inline");
         this._appendQueryResult(query, dataGrid.element);
 
         if (query.match(/^create /i) || query.match(/^drop table /i))
-            WebInspector.panels.databases.updateDatabaseTables(this.database);
+            WebInspector.panels.storage.updateDatabaseTables(this.database);
     },
 
     _queryError: function(query, error)
@@ -162,11 +163,6 @@ WebInspector.DatabaseQueryView.prototype = {
         this._appendQueryResult(query, message, "error");
     },
 
-    _executeSqlError: function(query, tx, error)
-    {
-        this._queryError(query, error);
-    },
-
     _appendQueryResult: function(query, result, resultClassName)
     {
         var element = document.createElement("div");
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseTableView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseTableView.js
index bbca9d0..aa76794 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseTableView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseTableView.js
@@ -33,9 +33,7 @@ WebInspector.DatabaseTableView = function(database, tableName)
     this.element.addStyleClass("storage-view");
     this.element.addStyleClass("table");
 
-    this.refreshButton = document.createElement("button");
-    this.refreshButton.title = WebInspector.UIString("Refresh");
-    this.refreshButton.className = "refresh-storage-status-bar-item status-bar-item";
+    this.refreshButton = new WebInspector.StatusBarButton(WebInspector.UIString("Refresh"), "refresh-storage-status-bar-item");
     this.refreshButton.addEventListener("click", this._refreshButtonClicked.bind(this), false);
 }
 
@@ -53,19 +51,14 @@ WebInspector.DatabaseTableView.prototype = {
 
     update: function()
     {
-        function queryTransaction(tx)
-        {
-            tx.executeSql("SELECT * FROM " + this.tableName, null, InspectorController.wrapCallback(this._queryFinished.bind(this)), InspectorController.wrapCallback(this._queryError.bind(this)));
-        }
-
-        this.database.database.transaction(InspectorController.wrapCallback(queryTransaction.bind(this)), InspectorController.wrapCallback(this._queryError.bind(this)));
+        this.database.executeSql("SELECT * FROM " + this.tableName, this._queryFinished.bind(this), this._queryError.bind(this));
     },
 
-    _queryFinished: function(tx, result)
+    _queryFinished: function(result)
     {
         this.element.removeChildren();
 
-        var dataGrid = WebInspector.panels.databases.dataGridForResult(result);
+        var dataGrid = WebInspector.panels.storage.dataGridForResult(result);
         if (!dataGrid) {
             var emptyMsgElement = document.createElement("div");
             emptyMsgElement.className = "storage-table-empty";
@@ -77,7 +70,7 @@ WebInspector.DatabaseTableView.prototype = {
         this.element.appendChild(dataGrid.element);
     },
 
-    _queryError: function(tx, error)
+    _queryError: function(error)
     {
         this.element.removeChildren();
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Drawer.js b/src/3rdparty/webkit/WebCore/inspector/front-end/Drawer.js
new file mode 100644
index 0000000..1b50f91
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Drawer.js
@@ -0,0 +1,202 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Joseph Pecoraro
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.Drawer = function()
+{
+    WebInspector.View.call(this, document.getElementById("drawer"));
+
+    this.mainStatusBar = document.getElementById("main-status-bar");
+    this.mainStatusBar.addEventListener("mousedown", this._startStatusBarDragging.bind(this), true);
+    this.viewStatusBar = document.getElementById("other-drawer-status-bar-items");
+}
+
+WebInspector.Drawer.prototype = {
+    get visibleView()
+    {
+        return this._visibleView;
+    },
+
+    set visibleView(x)
+    {
+        if (this._visibleView === x) {
+            this.visible = !this.visible;
+            return;
+        }
+
+        var firstTime = !this._visibleView;
+        if (this._visibleView)
+            this._visibleView.hide();
+
+        this._visibleView = x;
+
+        if (x && !firstTime) {
+            this._safelyRemoveChildren();
+            this.viewStatusBar.removeChildren(); // optimize this? call old.detach()
+            x.attach(this.element, this.viewStatusBar);
+            x.show();
+            this.visible = true;
+        }
+    },
+
+    showView: function(view)
+    {
+        if (!this.visible || this.visibleView !== view)
+            this.visibleView = view;
+    },
+
+    show: function()
+    {
+        if (this._animating || this.visible)
+            return;
+
+        if (this.visibleView)
+            this.visibleView.show();
+
+        WebInspector.View.prototype.show.call(this);
+
+        this._animating = true;
+
+        document.body.addStyleClass("drawer-visible");
+
+        var anchoredItems = document.getElementById("anchored-status-bar-items");
+
+        var animations = [
+            {element: document.getElementById("main"), end: {bottom: this.element.offsetHeight}},
+            {element: document.getElementById("main-status-bar"), start: {"padding-left": anchoredItems.offsetWidth - 1}, end: {"padding-left": 0}},
+            {element: document.getElementById("other-drawer-status-bar-items"), start: {opacity: 0}, end: {opacity: 1}}
+        ];
+
+        var consoleStatusBar = document.getElementById("drawer-status-bar");
+        consoleStatusBar.insertBefore(anchoredItems, consoleStatusBar.firstChild);
+
+        function animationFinished()
+        {
+            if ("updateStatusBarItems" in WebInspector.currentPanel)
+                WebInspector.currentPanel.updateStatusBarItems();
+            if (this.visibleView.afterShow)
+                this.visibleView.afterShow();
+            delete this._animating;
+        }
+
+        WebInspector.animateStyle(animations, window.event && window.event.shiftKey ? 2000 : 250, animationFinished.bind(this));
+    },
+
+    hide: function()
+    {
+        if (this._animating || !this.visible)
+            return;
+
+        WebInspector.View.prototype.hide.call(this);
+        
+        if (this.visibleView)
+            this.visibleView.hide();
+
+        this._animating = true;
+
+        if (this.element === WebInspector.currentFocusElement || this.element.isAncestor(WebInspector.currentFocusElement))
+            WebInspector.currentFocusElement = WebInspector.previousFocusElement;
+
+        var anchoredItems = document.getElementById("anchored-status-bar-items");
+
+        // Temporally set properties and classes to mimic the post-animation values so panels
+        // like Elements in their updateStatusBarItems call will size things to fit the final location.
+        document.getElementById("main-status-bar").style.setProperty("padding-left", (anchoredItems.offsetWidth - 1) + "px");
+        document.body.removeStyleClass("drawer-visible");
+        if ("updateStatusBarItems" in WebInspector.currentPanel)
+            WebInspector.currentPanel.updateStatusBarItems();
+        document.body.addStyleClass("drawer-visible");
+
+        var animations = [
+            {element: document.getElementById("main"), end: {bottom: 0}},
+            {element: document.getElementById("main-status-bar"), start: {"padding-left": 0}, end: {"padding-left": anchoredItems.offsetWidth - 1}},
+            {element: document.getElementById("other-drawer-status-bar-items"), start: {opacity: 1}, end: {opacity: 0}}
+        ];
+
+        function animationFinished()
+        {
+            var mainStatusBar = document.getElementById("main-status-bar");
+            mainStatusBar.insertBefore(anchoredItems, mainStatusBar.firstChild);
+            mainStatusBar.style.removeProperty("padding-left");
+            document.body.removeStyleClass("drawer-visible");
+            delete this._animating;
+        }
+
+        WebInspector.animateStyle(animations, window.event && window.event.shiftKey ? 2000 : 250, animationFinished.bind(this));
+    },
+
+    _safelyRemoveChildren: function()
+    {
+        var child = this.element.firstChild;
+        while (child) {
+            if (child.id !== "drawer-status-bar") {
+                var moveTo = child.nextSibling;
+                this.element.removeChild(child);
+                child = moveTo;
+            } else
+                child = child.nextSibling;
+        }
+    },
+
+    _startStatusBarDragging: function(event)
+    {
+        if (!this.visible || event.target !== document.getElementById("main-status-bar"))
+            return;
+
+        WebInspector.elementDragStart(document.getElementById("main-status-bar"), this._statusBarDragging.bind(this), this._endStatusBarDragging.bind(this), event, "row-resize");
+
+        this._statusBarDragOffset = event.pageY - this.element.totalOffsetTop;
+
+        event.stopPropagation();
+    },
+
+    _statusBarDragging: function(event)
+    {
+        var mainElement = document.getElementById("main");
+
+        var height = window.innerHeight - event.pageY + this._statusBarDragOffset;
+        height = Number.constrain(height, Preferences.minConsoleHeight, window.innerHeight - mainElement.totalOffsetTop - Preferences.minConsoleHeight);
+
+        mainElement.style.bottom = height + "px";
+        this.element.style.height = height + "px";
+
+        event.preventDefault();
+        event.stopPropagation();
+    },
+
+    _endStatusBarDragging: function(event)
+    {
+        WebInspector.elementDragEnd(event);
+
+        delete this._statusBarDragOffset;
+
+        event.stopPropagation();
+    }
+}
+
+WebInspector.Drawer.prototype.__proto__ = WebInspector.View.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsPanel.js
index 76d9746..49a1188 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsPanel.js
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2007, 2008 Apple Inc.  All rights reserved.
  * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Joseph Pecoraro
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -60,8 +61,8 @@ WebInspector.ElementsPanel = function()
             InspectorController.toggleNodeSearch();
             this.panel.nodeSearchButton.removeStyleClass("toggled-on");
         }
-
-        WebInspector.console.addInspectedNode(this._focusedDOMNode);
+        if (this._focusedDOMNode)
+            InjectedScriptAccess.addInspectedNode(this._focusedDOMNode.id, function() {});
     };
 
     this.contentElement.appendChild(this.treeOutline.element);
@@ -97,10 +98,7 @@ WebInspector.ElementsPanel = function()
     this.sidebarResizeElement.className = "sidebar-resizer-vertical";
     this.sidebarResizeElement.addEventListener("mousedown", this.rightSidebarResizerDragStart.bind(this), false);
 
-    this.nodeSearchButton = document.createElement("button");
-    this.nodeSearchButton.title = WebInspector.UIString("Select an element in the page to inspect it.");
-    this.nodeSearchButton.id = "node-search-status-bar-item";
-    this.nodeSearchButton.className = "status-bar-item";
+    this.nodeSearchButton = new WebInspector.StatusBarButton(WebInspector.UIString("Select an element in the page to inspect it."), "node-search-status-bar-item");
     this.nodeSearchButton.addEventListener("click", this._nodeSearchButtonClicked.bind(this), false);
 
     this.searchingForNode = false;
@@ -109,10 +107,7 @@ WebInspector.ElementsPanel = function()
     this.element.appendChild(this.sidebarElement);
     this.element.appendChild(this.sidebarResizeElement);
 
-    this._mutationMonitoredWindows = [];
-    this._nodeInsertedEventListener = InspectorController.wrapCallback(this._nodeInserted.bind(this));
-    this._nodeRemovedEventListener = InspectorController.wrapCallback(this._nodeRemoved.bind(this));
-    this._contentLoadedEventListener = InspectorController.wrapCallback(this._contentLoaded.bind(this));
+    this._changedStyles = {};
 
     this.reset();
 }
@@ -127,7 +122,7 @@ WebInspector.ElementsPanel.prototype = {
 
     get statusBarItems()
     {
-        return [this.nodeSearchButton, this.crumbsElement];
+        return [this.nodeSearchButton.element, this.crumbsElement];
     },
 
     updateStatusBarItems: function()
@@ -153,7 +148,7 @@ WebInspector.ElementsPanel.prototype = {
 
         if (InspectorController.searchingForNode()) {
             InspectorController.toggleNodeSearch();
-            this.nodeSearchButton.removeStyleClass("toggled-on");
+            this.nodeSearchButton.toggled = false;
         }
     },
 
@@ -172,40 +167,27 @@ WebInspector.ElementsPanel.prototype = {
 
         if (InspectorController.searchingForNode()) {
             InspectorController.toggleNodeSearch();
-            this.nodeSearchButton.removeStyleClass("toggled-on");
+            this.nodeSearchButton.toggled = false;
         }
 
         this.recentlyModifiedNodes = [];
-        this.unregisterAllMutationEventListeners();
 
         delete this.currentQuery;
         this.searchCanceled();
 
-        var inspectedWindow = InspectorController.inspectedWindow();
-        if (!inspectedWindow || !inspectedWindow.document)
+        var domWindow = WebInspector.domAgent.domWindow;
+        if (!domWindow || !domWindow.document || !domWindow.document.firstChild)
             return;
 
-        if (!inspectedWindow.document.firstChild) {
-            function contentLoaded()
-            {
-                inspectedWindow.document.removeEventListener("DOMContentLoaded", contentLoadedCallback, false);
-
-                this.reset();
-            }
-
-            var contentLoadedCallback = InspectorController.wrapCallback(contentLoaded.bind(this));
-            inspectedWindow.document.addEventListener("DOMContentLoaded", contentLoadedCallback, false);
-            return;
-        }
-
         // If the window isn't visible, return early so the DOM tree isn't built
         // and mutation event listeners are not added.
         if (!InspectorController.isWindowVisible())
             return;
 
-        this.registerMutationEventListeners(inspectedWindow);
+        var inspectedRootDocument = domWindow.document;
+        inspectedRootDocument.addEventListener("DOMNodeInserted", this._nodeInserted.bind(this));
+        inspectedRootDocument.addEventListener("DOMNodeRemoved", this._nodeRemoved.bind(this));
 
-        var inspectedRootDocument = inspectedWindow.document;
         this.rootDOMNode = inspectedRootDocument;
 
         var canidateFocusNode = inspectedRootDocument.body || inspectedRootDocument.documentElement;
@@ -219,19 +201,11 @@ WebInspector.ElementsPanel.prototype = {
         }
     },
 
-    includedInSearchResultsPropertyName: "__includedInInspectorSearchResults",
-
     searchCanceled: function()
     {
         if (this._searchResults) {
-            const searchResultsProperty = this.includedInSearchResultsPropertyName;
             for (var i = 0; i < this._searchResults.length; ++i) {
-                var node = this._searchResults[i];
-
-                // Remove the searchResultsProperty since there might be an unfinished search.
-                delete node[searchResultsProperty];
-
-                var treeElement = this.treeOutline.findTreeElement(node);
+                var treeElement = this.treeOutline.findTreeElement(this._searchResults[i]);
                 if (treeElement)
                     treeElement.highlighted = false;
             }
@@ -239,13 +213,9 @@ WebInspector.ElementsPanel.prototype = {
 
         WebInspector.updateSearchMatchesCount(0, this);
 
-        if (this._currentSearchChunkIntervalIdentifier) {
-            clearInterval(this._currentSearchChunkIntervalIdentifier);
-            delete this._currentSearchChunkIntervalIdentifier;
-        }
-
         this._currentSearchResultIndex = 0;
         this._searchResults = [];
+        InjectedScriptAccess.searchCanceled(function() {});
     },
 
     performSearch: function(query)
@@ -257,241 +227,56 @@ WebInspector.ElementsPanel.prototype = {
         if (!whitespaceTrimmedQuery.length)
             return;
 
-        var tagNameQuery = whitespaceTrimmedQuery;
-        var attributeNameQuery = whitespaceTrimmedQuery;
-        var startTagFound = (tagNameQuery.indexOf("<") === 0);
-        var endTagFound = (tagNameQuery.lastIndexOf(">") === (tagNameQuery.length - 1));
-
-        if (startTagFound || endTagFound) {
-            var tagNameQueryLength = tagNameQuery.length;
-            tagNameQuery = tagNameQuery.substring((startTagFound ? 1 : 0), (endTagFound ? (tagNameQueryLength - 1) : tagNameQueryLength));
-        }
-
-        // Check the tagNameQuery is it is a possibly valid tag name.
-        if (!/^[a-zA-Z0-9\-_:]+$/.test(tagNameQuery))
-            tagNameQuery = null;
-
-        // Check the attributeNameQuery is it is a possibly valid tag name.
-        if (!/^[a-zA-Z0-9\-_:]+$/.test(attributeNameQuery))
-            attributeNameQuery = null;
-
-        const escapedQuery = query.escapeCharacters("'");
-        const escapedTagNameQuery = (tagNameQuery ? tagNameQuery.escapeCharacters("'") : null);
-        const escapedWhitespaceTrimmedQuery = whitespaceTrimmedQuery.escapeCharacters("'");
-        const searchResultsProperty = this.includedInSearchResultsPropertyName;
-
-        var updatedMatchCountOnce = false;
-        var matchesCountUpdateTimeout = null;
-
-        function updateMatchesCount()
-        {
-            WebInspector.updateSearchMatchesCount(this._searchResults.length, this);
-            matchesCountUpdateTimeout = null;
-            updatedMatchCountOnce = true;
-        }
-
-        function updateMatchesCountSoon()
-        {
-            if (!updatedMatchCountOnce)
-                return updateMatchesCount.call(this);
-            if (matchesCountUpdateTimeout)
-                return;
-            // Update the matches count every half-second so it doesn't feel twitchy.
-            matchesCountUpdateTimeout = setTimeout(updateMatchesCount.bind(this), 500);
-        }
-
-        function addNodesToResults(nodes, length, getItem)
-        {
-            if (!length)
-                return;
-
-            for (var i = 0; i < length; ++i) {
-                var node = getItem.call(nodes, i);
-                // Skip this node if it already has the property.
-                if (searchResultsProperty in node)
-                    continue;
-
-                if (!this._searchResults.length) {
-                    this._currentSearchResultIndex = 0;
-                    this.focusedDOMNode = node;
-                }
-
-                node[searchResultsProperty] = true;
-                this._searchResults.push(node);
-
-                // Highlight the tree element to show it matched the search.
-                // FIXME: highlight the substrings in text nodes and attributes.
-                var treeElement = this.treeOutline.findTreeElement(node);
-                if (treeElement)
-                    treeElement.highlighted = true;
-            }
-
-            updateMatchesCountSoon.call(this);
-        }
-
-        function matchExactItems(doc)
-        {
-            matchExactId.call(this, doc);
-            matchExactClassNames.call(this, doc);
-            matchExactTagNames.call(this, doc);
-            matchExactAttributeNames.call(this, doc);
-        }
-
-        function matchExactId(doc)
-        {
-            const result = doc.__proto__.getElementById.call(doc, whitespaceTrimmedQuery);
-            addNodesToResults.call(this, result, (result ? 1 : 0), function() { return this });
-        }
-
-        function matchExactClassNames(doc)
-        {
-            const result = doc.__proto__.getElementsByClassName.call(doc, whitespaceTrimmedQuery);
-            addNodesToResults.call(this, result, result.length, result.item);
-        }
-
-        function matchExactTagNames(doc)
-        {
-            if (!tagNameQuery)
-                return;
-            const result = doc.__proto__.getElementsByTagName.call(doc, tagNameQuery);
-            addNodesToResults.call(this, result, result.length, result.item);
-        }
-
-        function matchExactAttributeNames(doc)
-        {
-            if (!attributeNameQuery)
-                return;
-            const result = doc.__proto__.querySelectorAll.call(doc, "[" + attributeNameQuery + "]");
-            addNodesToResults.call(this, result, result.length, result.item);
-        }
-
-        function matchPartialTagNames(doc)
-        {
-            if (!tagNameQuery)
-                return;
-            const result = doc.__proto__.evaluate.call(doc, "//*[contains(name(), '" + escapedTagNameQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
-            addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
-        }
-
-        function matchStartOfTagNames(doc)
-        {
-            if (!tagNameQuery)
-                return;
-            const result = doc.__proto__.evaluate.call(doc, "//*[starts-with(name(), '" + escapedTagNameQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
-            addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
-        }
-
-        function matchPartialTagNamesAndAttributeValues(doc)
-        {
-            if (!tagNameQuery) {
-                matchPartialAttributeValues.call(this, doc);
-                return;
-            }
+        this._updatedMatchCountOnce = false;
+        this._matchesCountUpdateTimeout = null;
 
-            const result = doc.__proto__.evaluate.call(doc, "//*[contains(name(), '" + escapedTagNameQuery + "') or contains(@*, '" + escapedQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
-            addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
-        }
-
-        function matchPartialAttributeValues(doc)
-        {
-            const result = doc.__proto__.evaluate.call(doc, "//*[contains(@*, '" + escapedQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
-            addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
-        }
-
-        function matchStyleSelector(doc)
-        {
-            const result = doc.__proto__.querySelectorAll.call(doc, whitespaceTrimmedQuery);
-            addNodesToResults.call(this, result, result.length, result.item);
-        }
-
-        function matchPlainText(doc)
-        {
-            const result = doc.__proto__.evaluate.call(doc, "//text()[contains(., '" + escapedQuery + "')] | //comment()[contains(., '" + escapedQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
-            addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
-        }
-
-        function matchXPathQuery(doc)
-        {
-            const result = doc.__proto__.evaluate.call(doc, whitespaceTrimmedQuery, doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
-            addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
-        }
-
-        function finishedSearching()
-        {
-            // Remove the searchResultsProperty now that the search is finished.
-            for (var i = 0; i < this._searchResults.length; ++i)
-                delete this._searchResults[i][searchResultsProperty];
-        }
+        InjectedScriptAccess.performSearch(whitespaceTrimmedQuery, function() {});
+    },
 
-        const mainFrameDocument = InspectorController.inspectedWindow().document;
-        const searchDocuments = [mainFrameDocument];
-
-        if (tagNameQuery && startTagFound && endTagFound)
-            const searchFunctions = [matchExactTagNames, matchPlainText];
-        else if (tagNameQuery && startTagFound)
-            const searchFunctions = [matchStartOfTagNames, matchPlainText];
-        else if (tagNameQuery && endTagFound) {
-            // FIXME: we should have a matchEndOfTagNames search function if endTagFound is true but not startTagFound.
-            // This requires ends-with() support in XPath, WebKit only supports starts-with() and contains().
-            const searchFunctions = [matchPartialTagNames, matchPlainText];
-        } else if (whitespaceTrimmedQuery === "//*" || whitespaceTrimmedQuery === "*") {
-            // These queries will match every node. Matching everything isn't useful and can be slow for large pages,
-            // so limit the search functions list to plain text and attribute matching.
-            const searchFunctions = [matchPartialAttributeValues, matchPlainText];
-        } else
-            const searchFunctions = [matchExactItems, matchStyleSelector, matchPartialTagNamesAndAttributeValues, matchPlainText, matchXPathQuery];
-
-        // Find all frames, iframes and object elements to search their documents.
-        const querySelectorAllFunction = InspectorController.inspectedWindow().Document.prototype.querySelectorAll;
-        const subdocumentResult = querySelectorAllFunction.call(mainFrameDocument, "iframe, frame, object");
-
-        for (var i = 0; i < subdocumentResult.length; ++i) {
-            var element = subdocumentResult.item(i);
-            if (element.contentDocument)
-                searchDocuments.push(element.contentDocument);
-        }
+    _updateMatchesCount: function()
+    {
+        WebInspector.updateSearchMatchesCount(this._searchResults.length, this);
+        this._matchesCountUpdateTimeout = null;
+        this._updatedMatchCountOnce = true;
+    },
 
-        const panel = this;
-        var documentIndex = 0;
-        var searchFunctionIndex = 0;
-        var chunkIntervalIdentifier = null;
+    _updateMatchesCountSoon: function()
+    {
+        if (!this._updatedMatchCountOnce)
+            return this._updateMatchesCount();
+        if (this._matchesCountUpdateTimeout)
+            return;
+        // Update the matches count every half-second so it doesn't feel twitchy.
+        this._matchesCountUpdateTimeout = setTimeout(this._updateMatchesCount.bind(this), 500);
+    },
 
-        // Split up the work into chunks so we don't block the UI thread while processing.
+    addNodesToSearchResult: function(nodeIds)
+    {
+        if (!nodeIds)
+            return;
 
-        function processChunk()
-        {
-            var searchDocument = searchDocuments[documentIndex];
-            var searchFunction = searchFunctions[searchFunctionIndex];
-
-            if (++searchFunctionIndex > searchFunctions.length) {
-                searchFunction = searchFunctions[0];
-                searchFunctionIndex = 0;
-
-                if (++documentIndex > searchDocuments.length) {
-                    if (panel._currentSearchChunkIntervalIdentifier === chunkIntervalIdentifier)
-                        delete panel._currentSearchChunkIntervalIdentifier;
-                    clearInterval(chunkIntervalIdentifier);
-                    finishedSearching.call(panel);
-                    return;
-                }
+        var nodeIdsArray = nodeIds.split(",");
+        for (var i = 0; i < nodeIdsArray.length; ++i) {
+            var nodeId = nodeIdsArray[i];
+            var node = WebInspector.domAgent.nodeForId(nodeId);
+            if (!node)
+                continue;
 
-                searchDocument = searchDocuments[documentIndex];
+            if (!this._searchResults.length) {
+                this._currentSearchResultIndex = 0;
+                this.focusedDOMNode = node;
             }
 
-            if (!searchDocument || !searchFunction)
-                return;
+            this._searchResults.push(node);
 
-            try {
-                searchFunction.call(panel, searchDocument);
-            } catch(err) {
-                // ignore any exceptions. the query might be malformed, but we allow that.
-            }
+            // Highlight the tree element to show it matched the search.
+            // FIXME: highlight the substrings in text nodes and attributes.
+            var treeElement = this.treeOutline.findTreeElement(node);
+            if (treeElement)
+                treeElement.highlighted = true;
         }
 
-        processChunk();
-
-        chunkIntervalIdentifier = setInterval(processChunk, 25);
-        this._currentSearchChunkIntervalIdentifier = chunkIntervalIdentifier;
+        this._updateMatchesCountSoon();
     },
 
     jumpToNextSearchResult: function()
@@ -512,57 +297,118 @@ WebInspector.ElementsPanel.prototype = {
         this.focusedDOMNode = this._searchResults[this._currentSearchResultIndex];
     },
 
-    inspectedWindowCleared: function(window)
-    {
-        if (InspectorController.isWindowVisible())
-            this.updateMutationEventListeners(window);
-    },
-
-    _addMutationEventListeners: function(monitoredWindow)
+    renameSelector: function(oldIdentifier, newIdentifier, oldSelector, newSelector)
     {
-        monitoredWindow.document.addEventListener("DOMNodeInserted", this._nodeInsertedEventListener, true);
-        monitoredWindow.document.addEventListener("DOMNodeRemoved", this._nodeRemovedEventListener, true);
-        if (monitoredWindow.frameElement)
-            monitoredWindow.addEventListener("DOMContentLoaded", this._contentLoadedEventListener, true);
+        // TODO: Implement Shifting the oldSelector, and its contents to a newSelector
     },
 
-    _removeMutationEventListeners: function(monitoredWindow)
+    addStyleChange: function(identifier, style, property)
     {
-        if (monitoredWindow.frameElement)
-            monitoredWindow.removeEventListener("DOMContentLoaded", this._contentLoadedEventListener, true);
-        if (!monitoredWindow.document)
+        if (!style.parentRule)
             return;
-        monitoredWindow.document.removeEventListener("DOMNodeInserted", this._nodeInsertedEventListener, true);
-        monitoredWindow.document.removeEventListener("DOMNodeRemoved", this._nodeRemovedEventListener, true);
-    },
 
-    updateMutationEventListeners: function(monitoredWindow)
-    {
-        this._addMutationEventListeners(monitoredWindow);
+        var selector = style.parentRule.selectorText;
+        if (!this._changedStyles[identifier])
+            this._changedStyles[identifier] = {};
+
+        if (!this._changedStyles[identifier][selector])
+            this._changedStyles[identifier][selector] = {};
+
+        if (!this._changedStyles[identifier][selector][property])
+            WebInspector.styleChanges += 1;
+
+        this._changedStyles[identifier][selector][property] = style.getPropertyValue(property);
     },
 
-    registerMutationEventListeners: function(monitoredWindow)
+    removeStyleChange: function(identifier, style, property)
     {
-        if (!monitoredWindow || this._mutationMonitoredWindows.indexOf(monitoredWindow) !== -1)
+        if (!style.parentRule)
             return;
-        this._mutationMonitoredWindows.push(monitoredWindow);
-        if (InspectorController.isWindowVisible())
-            this._addMutationEventListeners(monitoredWindow);
-    },
 
-    unregisterMutationEventListeners: function(monitoredWindow)
-    {
-        if (!monitoredWindow || this._mutationMonitoredWindows.indexOf(monitoredWindow) === -1)
+        var selector = style.parentRule.selectorText;
+        if (!this._changedStyles[identifier] || !this._changedStyles[identifier][selector])
             return;
-        this._mutationMonitoredWindows.remove(monitoredWindow);
-        this._removeMutationEventListeners(monitoredWindow);
+
+        if (this._changedStyles[identifier][selector][property]) {
+            delete this._changedStyles[identifier][selector][property];
+            WebInspector.styleChanges -= 1;
+        }
     },
 
-    unregisterAllMutationEventListeners: function()
+    generateStylesheet: function()
     {
-        for (var i = 0; i < this._mutationMonitoredWindows.length; ++i)
-            this._removeMutationEventListeners(this._mutationMonitoredWindows[i]);
-        this._mutationMonitoredWindows = [];
+        if (!WebInspector.styleChanges)
+            return;
+
+        // Merge Down to Just Selectors
+        var mergedSelectors = {};
+        for (var identifier in this._changedStyles) {
+            for (var selector in this._changedStyles[identifier]) {
+                if (!mergedSelectors[selector])
+                    mergedSelectors[selector] = this._changedStyles[identifier][selector];
+                else { // merge on selector
+                    var merge = {};
+                    for (var property in mergedSelectors[selector])
+                        merge[property] = mergedSelectors[selector][property];
+                    for (var property in this._changedStyles[identifier][selector]) {
+                        if (!merge[property])
+                            merge[property] = this._changedStyles[identifier][selector][property];
+                        else { // merge on property within a selector, include comment to notify user
+                            var value1 = merge[property];
+                            var value2 = this._changedStyles[identifier][selector][property];
+
+                            if (value1 === value2)
+                                merge[property] = [value1];
+                            else if (value1 instanceof Array)
+                                merge[property].push(value2);
+                            else
+                                merge[property] = [value1, value2];
+                        }
+                    }
+                    mergedSelectors[selector] = merge;
+                }
+            }
+        }
+
+        var builder = [];
+        builder.push("/**");
+        builder.push(" * Inspector Generated Stylesheet"); // UIString?
+        builder.push(" */\n");
+
+        var indent = "  ";
+        function displayProperty(property, value, comment) {
+            if (comment)
+                return indent + "/* " + property + ": " + value + "; */";
+            else
+                return indent + property + ": " + value + ";";
+        }
+
+        for (var selector in mergedSelectors) {
+            var psuedoStyle = mergedSelectors[selector];
+            var properties = Object.properties(psuedoStyle);
+            if (properties.length) {
+                builder.push(selector + " {");
+                for (var i = 0; i < properties.length; ++i) {
+                    var property = properties[i];
+                    var value = psuedoStyle[property];
+                    if (!(value instanceof Array))
+                        builder.push(displayProperty(property, value));
+                    else {
+                        if (value.length === 1)
+                            builder.push(displayProperty(property, value) + " /* merged from equivalent edits */"); // UIString?
+                        else {                        
+                            builder.push(indent + "/* There was a Conflict... There were Multiple Edits for '" + property + "' */"); // UIString?
+                            for (var j = 0; j < value.length; ++j)
+                                builder.push(displayProperty(property, value, true));
+                        }
+                    }
+                }
+                builder.push("}\n");
+            }
+        }
+
+        WebInspector.showConsole();
+        WebInspector.console.addMessage(new WebInspector.ConsoleTextMessage(builder.join("\n")));
     },
 
     get rootDOMNode()
@@ -585,13 +431,6 @@ WebInspector.ElementsPanel.prototype = {
         this.treeOutline.focusedDOMNode = x;
     },
 
-    _contentLoaded: function(event)
-    {
-        this.recentlyModifiedNodes.push({node: event.target, parent: event.target.defaultView.frameElement, replaced: true});
-        if (this.visible)
-            this._updateModifiedNodesSoon();
-    },
-
     _nodeInserted: function(event)
     {
         this.recentlyModifiedNodes.push({node: event.target, parent: event.relatedNode, inserted: true});
@@ -629,14 +468,14 @@ WebInspector.ElementsPanel.prototype = {
             if (!parent)
                 continue;
 
-            var parentNodeItem = this.treeOutline.findTreeElement(parent, null, null, objectsAreSame);
+            var parentNodeItem = this.treeOutline.findTreeElement(parent);
             if (parentNodeItem && !parentNodeItem.alreadyUpdatedChildren) {
                 parentNodeItem.updateChildren(replaced);
                 parentNodeItem.alreadyUpdatedChildren = true;
                 updatedParentTreeElements.push(parentNodeItem);
             }
 
-            if (!updateBreadcrumbs && (objectsAreSame(this.focusedDOMNode, parent) || isAncestorIncludingParentFrames(this.focusedDOMNode, parent)))
+            if (!updateBreadcrumbs && (this.focusedDOMNode === parent || isAncestor(this.focusedDOMNode, parent)))
                 updateBreadcrumbs = true;
         }
 
@@ -696,7 +535,7 @@ WebInspector.ElementsPanel.prototype = {
         var foundRoot = false;
         var crumb = crumbs.firstChild;
         while (crumb) {
-            if (objectsAreSame(crumb.representedObject, this.rootDOMNode))
+            if (crumb.representedObject === this.rootDOMNode)
                 foundRoot = true;
 
             if (foundRoot)
@@ -704,7 +543,7 @@ WebInspector.ElementsPanel.prototype = {
             else
                 crumb.removeStyleClass("dimmed");
 
-            if (objectsAreSame(crumb.representedObject, this.focusedDOMNode)) {
+            if (crumb.representedObject === this.focusedDOMNode) {
                 crumb.addStyleClass("selected");
                 handled = true;
             } else {
@@ -757,11 +596,11 @@ WebInspector.ElementsPanel.prototype = {
         }
 
         foundRoot = false;
-        for (var current = this.focusedDOMNode; current; current = parentNodeOrFrameElement(current)) {
+        for (var current = this.focusedDOMNode; current; current = current.parentNode) {
             if (current.nodeType === Node.DOCUMENT_NODE)
                 continue;
 
-            if (objectsAreSame(current, this.rootDOMNode))
+            if (current === this.rootDOMNode)
                 foundRoot = true;
 
             var crumb = document.createElement("span");
@@ -844,7 +683,7 @@ WebInspector.ElementsPanel.prototype = {
 
             if (foundRoot)
                 crumb.addStyleClass("dimmed");
-            if (objectsAreSame(current, this.focusedDOMNode))
+            if (current === this.focusedDOMNode)
                 crumb.addStyleClass("selected");
             if (!crumbs.childNodes.length)
                 crumb.addStyleClass("end");
@@ -915,7 +754,7 @@ WebInspector.ElementsPanel.prototype = {
         {
             var rightPadding = 20;
             var errorWarningElement = document.getElementById("error-warning-count");
-            if (!WebInspector.console.visible && errorWarningElement)
+            if (!WebInspector.drawer.visible && errorWarningElement)
                 rightPadding += errorWarningElement.offsetWidth;
             return ((crumbs.totalOffsetLeft + crumbs.offsetWidth + rightPadding) < window.innerWidth);
         }
@@ -1151,7 +990,8 @@ WebInspector.ElementsPanel.prototype = {
 
         switch (this.focusedDOMNode.nodeType) {
             case Node.ELEMENT_NODE:
-                var data = this.focusedDOMNode.outerHTML;
+                // TODO: Introduce InspectorController.copyEvent that pushes appropriate markup into the clipboard.
+                var data = null;
                 break;
 
             case Node.COMMENT_NODE:
@@ -1198,10 +1038,7 @@ WebInspector.ElementsPanel.prototype = {
     {
         InspectorController.toggleNodeSearch();
 
-        if (InspectorController.searchingForNode())
-            this.nodeSearchButton.addStyleClass("toggled-on");
-        else
-            this.nodeSearchButton.removeStyleClass("toggled-on");
+        this.nodeSearchButton.toggled = InspectorController.searchingForNode();
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsTreeOutline.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsTreeOutline.js
index ef53209..08ba1c2 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsTreeOutline.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsTreeOutline.js
@@ -51,7 +51,7 @@ WebInspector.ElementsTreeOutline.prototype = {
 
     set rootDOMNode(x)
     {
-        if (objectsAreSame(this._rootDOMNode, x))
+        if (this._rootDOMNode === x)
             return;
 
         this._rootDOMNode = x;
@@ -66,7 +66,7 @@ WebInspector.ElementsTreeOutline.prototype = {
 
     set focusedDOMNode(x)
     {
-        if (objectsAreSame(this._focusedDOMNode, x)) {
+        if (this._focusedDOMNode === x) {
             this.revealAndSelectNode(x);
             return;
         }
@@ -79,11 +79,11 @@ WebInspector.ElementsTreeOutline.prototype = {
         // and the select() call would change the focusedDOMNode and reenter this setter. So to
         // avoid calling focusedNodeChanged() twice, first check if _focusedDOMNode is the same
         // node as the one passed in.
-        if (objectsAreSame(this._focusedDOMNode, x)) {
+        if (this._focusedDOMNode === x) {
             this.focusedNodeChanged();
 
             if (x && !this.suppressSelectHighlight) {
-                InspectorController.highlightDOMNode(x);
+                InspectorController.highlightDOMNode(x.id);
 
                 if ("_restorePreviousHighlightNodeTimeout" in this)
                     clearTimeout(this._restorePreviousHighlightNodeTimeout);
@@ -92,7 +92,7 @@ WebInspector.ElementsTreeOutline.prototype = {
                 {
                     var hoveredNode = WebInspector.hoveredDOMNode;
                     if (hoveredNode)
-                        InspectorController.highlightDOMNode(hoveredNode);
+                        InspectorController.highlightDOMNode(hoveredNode.id);
                     else
                         InspectorController.hideDOMNodeHighlight();
                 }
@@ -138,19 +138,12 @@ WebInspector.ElementsTreeOutline.prototype = {
 
     focusedNodeChanged: function(forceUpdate) {},
 
-    findTreeElement: function(node, isAncestor, getParent, equal)
+    findTreeElement: function(node)
     {
-        if (typeof isAncestor === "undefined")
-            isAncestor = isAncestorIncludingParentFrames;
-        if (typeof getParent === "undefined")
-            getParent = parentNodeOrFrameElement;
-        if (typeof equal === "undefined")
-            equal = objectsAreSame;
-
-        var treeElement = TreeOutline.prototype.findTreeElement.call(this, node, isAncestor, getParent, equal);
+        var treeElement = TreeOutline.prototype.findTreeElement.call(this, node, isAncestorNode, parentNode);
         if (!treeElement && node.nodeType === Node.TEXT_NODE) {
             // The text node might have been inlined if it was short, so try to find the parent element.
-            treeElement = TreeOutline.prototype.findTreeElement.call(this, node.parentNode, isAncestor, getParent, equal);
+            treeElement = TreeOutline.prototype.findTreeElement.call(this, node.parentNode, isAncestorNode, parentNode);
         }
 
         return treeElement;
@@ -232,7 +225,7 @@ WebInspector.ElementsTreeOutline.prototype = {
     _onmouseout: function(event)
     {
         var nodeUnderMouse = document.elementFromPoint(event.pageX, event.pageY);
-        if (nodeUnderMouse.isDescendant(this.element))
+        if (nodeUnderMouse && nodeUnderMouse.isDescendant(this.element))
             return;
 
         if (this._previousHoveredElement) {
@@ -248,7 +241,7 @@ WebInspector.ElementsTreeOutline.prototype.__proto__ = TreeOutline.prototype;
 
 WebInspector.ElementsTreeElement = function(node)
 {
-    var hasChildren = node.contentDocument || (Preferences.ignoreWhitespace ? (firstChildSkippingWhitespace.call(node) ? true : false) : node.hasChildNodes());
+    var hasChildren = Preferences.ignoreWhitespace ? (firstChildSkippingWhitespace.call(node) ? true : false) : node.hasChildNodes();
     var titleInfo = nodeTitleInfo.call(node, hasChildren, WebInspector.linkifyURL);
 
     if (titleInfo.hasChildren) 
@@ -387,9 +380,14 @@ WebInspector.ElementsTreeElement.prototype = {
 
         this.updateChildren();
     },
-
+    
     updateChildren: function(fullRefresh)
     {
+        WebInspector.domAgent.getChildNodesAsync(this.representedObject, this._updateChildren.bind(this, fullRefresh));
+    },
+
+    _updateChildren: function(fullRefresh)
+    {
         if (fullRefresh) {
             var selectedTreeElement = this.treeOutline.selectedTreeElement;
             if (selectedTreeElement && selectedTreeElement.hasAncestor(this))
@@ -406,11 +404,11 @@ WebInspector.ElementsTreeElement.prototype = {
             var child = (Preferences.ignoreWhitespace ? firstChildSkippingWhitespace.call(node) : node.firstChild);
             while (child) {
                 var currentTreeElement = treeElement.children[treeChildIndex];
-                if (!currentTreeElement || !objectsAreSame(currentTreeElement.representedObject, child)) {
+                if (!currentTreeElement || currentTreeElement.representedObject !== child) {
                     // Find any existing element that is later in the children list.
                     var existingTreeElement = null;
                     for (var i = (treeChildIndex + 1); i < treeElement.children.length; ++i) {
-                        if (objectsAreSame(treeElement.children[i].representedObject, child)) {
+                        if (treeElement.children[i].representedObject === child) {
                             existingTreeElement = treeElement.children[i];
                             break;
                         }
@@ -445,9 +443,7 @@ WebInspector.ElementsTreeElement.prototype = {
             var currentNode = currentChild.representedObject;
             var currentParentNode = currentNode.parentNode;
 
-            if (objectsAreSame(currentParentNode, this.representedObject))
-                continue;
-            if (this.representedObject.contentDocument && objectsAreSame(currentParentNode, this.representedObject.contentDocument))
+            if (currentParentNode === this.representedObject)
                 continue;
 
             var selectedTreeElement = this.treeOutline.selectedTreeElement;
@@ -455,13 +451,8 @@ WebInspector.ElementsTreeElement.prototype = {
                 this.select();
 
             this.removeChildAtIndex(i);
-
-            if (this.treeOutline.panel && currentNode.contentDocument)
-                this.treeOutline.panel.unregisterMutationEventListeners(currentNode.contentDocument.defaultView);
         }
 
-        if (this.representedObject.contentDocument)
-            updateChildrenOfNode(this.representedObject.contentDocument);
         updateChildrenOfNode(this.representedObject);
 
         var lastChild = this.children[this.children.length - 1];
@@ -477,9 +468,6 @@ WebInspector.ElementsTreeElement.prototype = {
     onexpand: function()
     {
         this.treeOutline.updateSelection();
-
-        if (this.treeOutline.panel && this.representedObject.contentDocument)
-            this.treeOutline.panel.registerMutationEventListeners(this.representedObject.contentDocument.defaultView);
     },
 
     oncollapse: function()
@@ -693,7 +681,7 @@ WebInspector.ElementsTreeElement.prototype = {
         }
 
         if (!parseElement.hasAttributes()) {
-            InspectorController.inspectedWindow().Element.prototype.removeAttribute.call(this.representedObject, attributeName);
+            this.representedObject.removeAttribute(attributeName);
             this._updateTitle();
             moveToNextAttributeIfNeeded.call(this);
             return;
@@ -704,12 +692,12 @@ WebInspector.ElementsTreeElement.prototype = {
             var attr = parseElement.attributes[i];
             foundOriginalAttribute = foundOriginalAttribute || attr.name === attributeName;
             try {
-                InspectorController.inspectedWindow().Element.prototype.setAttribute.call(this.representedObject, attr.name, attr.value);
+                this.representedObject.setAttribute(attr.name, attr.value);
             } catch(e) {} // ignore invalid attribute (innerHTML doesn't throw errors, but this can)
         }
 
         if (!foundOriginalAttribute)
-            InspectorController.inspectedWindow().Element.prototype.removeAttribute.call(this.representedObject, attributeName);
+            this.representedObject.removeAttribute(attributeName);
 
         this._updateTitle();
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/clearConsoleButtonGlyph.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/clearConsoleButtonGlyph.png
new file mode 100644
index 0000000..b1f9465
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/clearConsoleButtonGlyph.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/clearConsoleButtons.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/clearConsoleButtons.png
deleted file mode 100644
index 140a4fb..0000000
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/clearConsoleButtons.png
+++ /dev/null
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/consoleButtonGlyph.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/consoleButtonGlyph.png
new file mode 100644
index 0000000..d10d43c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/consoleButtonGlyph.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/consoleButtons.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/consoleButtons.png
deleted file mode 100644
index fb5f089..0000000
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/consoleButtons.png
+++ /dev/null
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/cookie.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/cookie.png
new file mode 100644
index 0000000..90c3c15
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/cookie.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/dockButtonGlyph.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/dockButtonGlyph.png
new file mode 100644
index 0000000..7052f4b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/dockButtonGlyph.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/dockButtons.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/dockButtons.png
deleted file mode 100644
index 4b01d66..0000000
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/dockButtons.png
+++ /dev/null
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/domStorage.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/domStorage.png
deleted file mode 100644
index 028550c..0000000
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/domStorage.png
+++ /dev/null
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/enableButtons.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/enableButtons.png
deleted file mode 100644
index facee60..0000000
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/enableButtons.png
+++ /dev/null
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/enableOutlineButtonGlyph.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/enableOutlineButtonGlyph.png
new file mode 100644
index 0000000..85e0bd6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/enableOutlineButtonGlyph.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/enableSolidButtonGlyph.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/enableSolidButtonGlyph.png
new file mode 100644
index 0000000..25b2e96
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/enableSolidButtonGlyph.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/excludeButtonGlyph.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/excludeButtonGlyph.png
new file mode 100644
index 0000000..5128576
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/excludeButtonGlyph.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/excludeButtons.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/excludeButtons.png
deleted file mode 100644
index f1c53a9..0000000
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/excludeButtons.png
+++ /dev/null
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/focusButtonGlyph.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/focusButtonGlyph.png
new file mode 100644
index 0000000..b71807c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/focusButtonGlyph.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/focusButtons.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/focusButtons.png
deleted file mode 100644
index 47eaa04..0000000
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/focusButtons.png
+++ /dev/null
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/largerResourcesButtonGlyph.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/largerResourcesButtonGlyph.png
new file mode 100644
index 0000000..71256d6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/largerResourcesButtonGlyph.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/largerResourcesButtons.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/largerResourcesButtons.png
deleted file mode 100644
index caf3f14..0000000
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/largerResourcesButtons.png
+++ /dev/null
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/localStorage.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/localStorage.png
new file mode 100644
index 0000000..44a3019
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/localStorage.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/nodeSearchButtonGlyph.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/nodeSearchButtonGlyph.png
new file mode 100644
index 0000000..faf5df2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/nodeSearchButtonGlyph.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/nodeSearchButtons.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/nodeSearchButtons.png
deleted file mode 100644
index 0599bd4..0000000
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/nodeSearchButtons.png
+++ /dev/null
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/paneSettingsButtons.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/paneSettingsButtons.png
new file mode 100644
index 0000000..36a6244
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/paneSettingsButtons.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/pauseOnExceptionButtonGlyph.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/pauseOnExceptionButtonGlyph.png
new file mode 100644
index 0000000..c3cec5f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/pauseOnExceptionButtonGlyph.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/pauseOnExceptionButtons.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/pauseOnExceptionButtons.png
deleted file mode 100644
index a4dd33a..0000000
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/pauseOnExceptionButtons.png
+++ /dev/null
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/percentButtonGlyph.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/percentButtonGlyph.png
new file mode 100644
index 0000000..0ace3b7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/percentButtonGlyph.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/percentButtons.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/percentButtons.png
deleted file mode 100644
index 2635b24..0000000
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/percentButtons.png
+++ /dev/null
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/recordButtonGlyph.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/recordButtonGlyph.png
new file mode 100644
index 0000000..bfdad1a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/recordButtonGlyph.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/recordButtons.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/recordButtons.png
deleted file mode 100644
index 3676154..0000000
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/recordButtons.png
+++ /dev/null
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/recordToggledButtonGlyph.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/recordToggledButtonGlyph.png
new file mode 100644
index 0000000..2c22f87c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/recordToggledButtonGlyph.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/reloadButtonGlyph.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/reloadButtonGlyph.png
new file mode 100644
index 0000000..28e047a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/reloadButtonGlyph.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/reloadButtons.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/reloadButtons.png
deleted file mode 100644
index 1e45671..0000000
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/reloadButtons.png
+++ /dev/null
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/sessionStorage.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/sessionStorage.png
new file mode 100644
index 0000000..4d50e35
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/sessionStorage.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/databasesIcon.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/storageIcon.png
index 79c7bb3..79c7bb3 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/databasesIcon.png
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/storageIcon.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/undockButtonGlyph.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/undockButtonGlyph.png
new file mode 100644
index 0000000..eed2b65
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/undockButtonGlyph.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScript.js b/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScript.js
new file mode 100644
index 0000000..003e694
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScript.js
@@ -0,0 +1,1116 @@
+/*
+ * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+var InjectedScript = {};
+
+// Called from within InspectorController on the 'inspected page' side.
+InjectedScript.reset = function()
+{
+    InjectedScript._styles = {};
+    InjectedScript._styleRules = {};
+    InjectedScript._lastStyleId = 0;
+    InjectedScript._lastStyleRuleId = 0;
+    InjectedScript._searchResults = [];
+    InjectedScript._includedInSearchResultsPropertyName = "__includedInInspectorSearchResults";
+}
+
+InjectedScript.reset();
+
+InjectedScript.dispatch = function(methodName, args)
+{
+    var result = InjectedScript[methodName].apply(InjectedScript, JSON.parse(args));
+    return JSON.stringify(result);
+}
+
+InjectedScript.getStyles = function(nodeId, authorOnly)
+{
+    var node = InjectedScript._nodeForId(nodeId);
+    if (!node)
+        return false;
+    var matchedRules = InjectedScript._window().getMatchedCSSRules(node, "", authorOnly);
+    var matchedCSSRules = [];
+    for (var i = 0; matchedRules && i < matchedRules.length; ++i)
+        matchedCSSRules.push(InjectedScript._serializeRule(matchedRules[i]));
+
+    var styleAttributes = {};
+    var attributes = node.attributes;
+    for (var i = 0; attributes && i < attributes.length; ++i) {
+        if (attributes[i].style)
+            styleAttributes[attributes[i].name] = InjectedScript._serializeStyle(attributes[i].style, true);
+    }
+    var result = {};
+    result.inlineStyle = InjectedScript._serializeStyle(node.style, true);
+    result.computedStyle = InjectedScript._serializeStyle(InjectedScript._window().getComputedStyle(node));
+    result.matchedCSSRules = matchedCSSRules;
+    result.styleAttributes = styleAttributes;
+    return result;
+}
+
+InjectedScript.getComputedStyle = function(nodeId)
+{
+    var node = InjectedScript._nodeForId(nodeId);
+    if (!node)
+        return false;
+    return InjectedScript._serializeStyle(InjectedScript._window().getComputedStyle(node));
+}
+
+InjectedScript.getInlineStyle = function(nodeId)
+{
+    var node = InjectedScript._nodeForId(nodeId);
+    if (!node)
+        return false;
+    return InjectedScript._serializeStyle(node.style, true);
+}
+
+InjectedScript.applyStyleText = function(styleId, styleText, propertyName)
+{
+    var style = InjectedScript._styles[styleId];
+    if (!style)
+        return false;
+
+    var styleTextLength = styleText.length;
+
+    // Create a new element to parse the user input CSS.
+    var parseElement = document.createElement("span");
+    parseElement.setAttribute("style", styleText);
+
+    var tempStyle = parseElement.style;
+    if (tempStyle.length || !styleTextLength) {
+        // The input was parsable or the user deleted everything, so remove the
+        // original property from the real style declaration. If this represents
+        // a shorthand remove all the longhand properties.
+        if (style.getPropertyShorthand(propertyName)) {
+            var longhandProperties = InjectedScript._getLonghandProperties(style, propertyName);
+            for (var i = 0; i < longhandProperties.length; ++i)
+                style.removeProperty(longhandProperties[i]);
+        } else
+            style.removeProperty(propertyName);
+    }
+
+    // Notify caller that the property was successfully deleted.
+    if (!styleTextLength)
+        return [null, [propertyName]];
+
+    if (!tempStyle.length)
+        return false;
+
+    // Iterate of the properties on the test element's style declaration and
+    // add them to the real style declaration. We take care to move shorthands.
+    var foundShorthands = {};
+    var changedProperties = [];
+    var uniqueProperties = InjectedScript._getUniqueStyleProperties(tempStyle);
+    for (var i = 0; i < uniqueProperties.length; ++i) {
+        var name = uniqueProperties[i];
+        var shorthand = tempStyle.getPropertyShorthand(name);
+
+        if (shorthand && shorthand in foundShorthands)
+            continue;
+
+        if (shorthand) {
+            var value = InjectedScript._getShorthandValue(tempStyle, shorthand);
+            var priority = InjectedScript._getShorthandPriority(tempStyle, shorthand);
+            foundShorthands[shorthand] = true;
+        } else {
+            var value = tempStyle.getPropertyValue(name);
+            var priority = tempStyle.getPropertyPriority(name);
+        }
+
+        // Set the property on the real style declaration.
+        style.setProperty((shorthand || name), value, priority);
+        changedProperties.push(shorthand || name);
+    }
+    return [InjectedScript._serializeStyle(style, true), changedProperties];
+}
+
+InjectedScript.setStyleText = function(style, cssText)
+{
+    style.cssText = cssText;
+}
+
+InjectedScript.toggleStyleEnabled = function(styleId, propertyName, disabled)
+{
+    var style = InjectedScript._styles[styleId];
+    if (!style)
+        return false;
+
+    if (disabled) {
+        if (!style.__disabledPropertyValues || !style.__disabledPropertyPriorities) {
+            var inspectedWindow = InjectedScript._window();
+            style.__disabledProperties = new inspectedWindow.Object;
+            style.__disabledPropertyValues = new inspectedWindow.Object;
+            style.__disabledPropertyPriorities = new inspectedWindow.Object;
+        }
+
+        style.__disabledPropertyValues[propertyName] = style.getPropertyValue(propertyName);
+        style.__disabledPropertyPriorities[propertyName] = style.getPropertyPriority(propertyName);
+
+        if (style.getPropertyShorthand(propertyName)) {
+            var longhandProperties = InjectedScript._getLonghandProperties(style, propertyName);
+            for (var i = 0; i < longhandProperties.length; ++i) {
+                style.__disabledProperties[longhandProperties[i]] = true;
+                style.removeProperty(longhandProperties[i]);
+            }
+        } else {
+            style.__disabledProperties[propertyName] = true;
+            style.removeProperty(propertyName);
+        }
+    } else if (style.__disabledProperties && style.__disabledProperties[propertyName]) {
+        var value = style.__disabledPropertyValues[propertyName];
+        var priority = style.__disabledPropertyPriorities[propertyName];
+
+        style.setProperty(propertyName, value, priority);
+        delete style.__disabledProperties[propertyName];
+        delete style.__disabledPropertyValues[propertyName];
+        delete style.__disabledPropertyPriorities[propertyName];
+    }
+    return InjectedScript._serializeStyle(style, true);
+}
+
+InjectedScript.applyStyleRuleText = function(ruleId, newContent, selectedNodeId)
+{
+    var rule = InjectedScript._styleRules[ruleId];
+    if (!rule)
+        return false;
+
+    var selectedNode = InjectedScript._nodeForId(selectedNodeId);
+
+    try {
+        var stylesheet = rule.parentStyleSheet;
+        stylesheet.addRule(newContent);
+        var newRule = stylesheet.cssRules[stylesheet.cssRules.length - 1];
+        newRule.style.cssText = rule.style.cssText;
+
+        var parentRules = stylesheet.cssRules;
+        for (var i = 0; i < parentRules.length; ++i) {
+            if (parentRules[i] === rule) {
+                rule.parentStyleSheet.removeRule(i);
+                break;
+            }
+        }
+
+        return [InjectedScript._serializeRule(newRule), InjectedScript._doesSelectorAffectNode(newContent, selectedNode)];
+    } catch(e) {
+        // Report invalid syntax.
+        return false;
+    }
+}
+
+InjectedScript.addStyleSelector = function(newContent, selectedNodeId)
+{
+    var stylesheet = InjectedScript.stylesheet;
+    if (!stylesheet) {
+        var inspectedDocument = InjectedScript._window().document;
+        var head = inspectedDocument.getElementsByTagName("head")[0];
+        var styleElement = inspectedDocument.createElement("style");
+        styleElement.type = "text/css";
+        head.appendChild(styleElement);
+        stylesheet = inspectedDocument.styleSheets[inspectedDocument.styleSheets.length - 1];
+        InjectedScript.stylesheet = stylesheet;
+    }
+
+    try {
+        stylesheet.addRule(newContent);
+    } catch (e) {
+        // Invalid Syntax for a Selector
+        return false;
+    }
+
+    var selectedNode = InjectedScript._nodeForId(selectedNodeId);
+    var rule = stylesheet.cssRules[stylesheet.cssRules.length - 1];
+    rule.__isViaInspector = true;
+
+    return [ InjectedScript._serializeRule(rule), InjectedScript._doesSelectorAffectNode(newContent, selectedNode) ];
+}
+
+InjectedScript._doesSelectorAffectNode = function(selectorText, node)
+{
+    if (!node)
+        return false;
+    var nodes = node.ownerDocument.querySelectorAll(selectorText);
+    for (var i = 0; i < nodes.length; ++i) {
+        if (nodes[i] === node) {
+            return true;
+        }
+    }
+    return false;
+}
+
+InjectedScript.setStyleProperty = function(styleId, name, value)
+{
+    var style = InjectedScript._styles[styleId];
+    if (!style)
+        return false;
+
+    style.setProperty(name, value, "");
+    return true;
+}
+
+InjectedScript._serializeRule = function(rule)
+{
+    var parentStyleSheet = rule.parentStyleSheet;
+
+    var ruleValue = {};
+    ruleValue.selectorText = rule.selectorText;
+    if (parentStyleSheet) {
+        ruleValue.parentStyleSheet = {};
+        ruleValue.parentStyleSheet.href = parentStyleSheet.href;
+    }
+    ruleValue.isUserAgent = parentStyleSheet && !parentStyleSheet.ownerNode && !parentStyleSheet.href;
+    ruleValue.isUser = parentStyleSheet && parentStyleSheet.ownerNode && parentStyleSheet.ownerNode.nodeName == "#document";
+    ruleValue.isViaInspector = !!rule.__isViaInspector;
+
+    // Bind editable scripts only.
+    var doBind = !ruleValue.isUserAgent && !ruleValue.isUser;
+    ruleValue.style = InjectedScript._serializeStyle(rule.style, doBind);
+
+    if (doBind) {
+        if (!rule.id) {
+            rule.id = InjectedScript._lastStyleRuleId++;
+            InjectedScript._styleRules[rule.id] = rule;
+        }
+        ruleValue.id = rule.id;
+    }
+    return ruleValue;
+}
+
+InjectedScript._serializeStyle = function(style, doBind)
+{
+    var result = {};
+    result.width = style.width;
+    result.height = style.height;
+    result.__disabledProperties = style.__disabledProperties;
+    result.__disabledPropertyValues = style.__disabledPropertyValues;
+    result.__disabledPropertyPriorities = style.__disabledPropertyPriorities;
+    result.properties = [];
+    result.shorthandValues = {};
+    var foundShorthands = {};
+    for (var i = 0; i < style.length; ++i) {
+        var property = {};
+        var name = style[i];
+        property.name = name;
+        property.priority = style.getPropertyPriority(name);
+        property.implicit = style.isPropertyImplicit(name);
+        var shorthand =  style.getPropertyShorthand(name);
+        property.shorthand = shorthand;
+        if (shorthand && !(shorthand in foundShorthands)) {
+            foundShorthands[shorthand] = true;
+            result.shorthandValues[shorthand] = InjectedScript._getShorthandValue(style, shorthand);
+        }
+        property.value = style.getPropertyValue(name);
+        result.properties.push(property);
+    }
+    result.uniqueStyleProperties = InjectedScript._getUniqueStyleProperties(style);
+
+    if (doBind) {
+        if (!style.id) {
+            style.id = InjectedScript._lastStyleId++;
+            InjectedScript._styles[style.id] = style;
+        }
+        result.id = style.id;
+    }
+    return result;
+}
+
+InjectedScript._getUniqueStyleProperties = function(style)
+{
+    var properties = [];
+    var foundProperties = {};
+
+    for (var i = 0; i < style.length; ++i) {
+        var property = style[i];
+        if (property in foundProperties)
+            continue;
+        foundProperties[property] = true;
+        properties.push(property);
+    }
+
+    return properties;
+}
+
+
+InjectedScript._getLonghandProperties = function(style, shorthandProperty)
+{
+    var properties = [];
+    var foundProperties = {};
+
+    for (var i = 0; i < style.length; ++i) {
+        var individualProperty = style[i];
+        if (individualProperty in foundProperties || style.getPropertyShorthand(individualProperty) !== shorthandProperty)
+            continue;
+        foundProperties[individualProperty] = true;
+        properties.push(individualProperty);
+    }
+
+    return properties;
+}
+
+InjectedScript._getShorthandValue = function(style, shorthandProperty)
+{
+    var value = style.getPropertyValue(shorthandProperty);
+    if (!value) {
+        // Some shorthands (like border) return a null value, so compute a shorthand value.
+        // FIXME: remove this when http://bugs.webkit.org/show_bug.cgi?id=15823 is fixed.
+
+        var foundProperties = {};
+        for (var i = 0; i < style.length; ++i) {
+            var individualProperty = style[i];
+            if (individualProperty in foundProperties || style.getPropertyShorthand(individualProperty) !== shorthandProperty)
+                continue;
+
+            var individualValue = style.getPropertyValue(individualProperty);
+            if (style.isPropertyImplicit(individualProperty) || individualValue === "initial")
+                continue;
+
+            foundProperties[individualProperty] = true;
+
+            if (!value)
+                value = "";
+            else if (value.length)
+                value += " ";
+            value += individualValue;
+        }
+    }
+    return value;
+}
+
+InjectedScript._getShorthandPriority = function(style, shorthandProperty)
+{
+    var priority = style.getPropertyPriority(shorthandProperty);
+    if (!priority) {
+        for (var i = 0; i < style.length; ++i) {
+            var individualProperty = style[i];
+            if (style.getPropertyShorthand(individualProperty) !== shorthandProperty)
+                continue;
+            priority = style.getPropertyPriority(individualProperty);
+            break;
+        }
+    }
+    return priority;
+}
+
+InjectedScript.getPrototypes = function(nodeId)
+{
+    var node = InjectedScript._nodeForId(nodeId);
+    if (!node)
+        return false;
+
+    var result = [];
+    for (var prototype = node; prototype; prototype = prototype.__proto__) {
+        var title = Object.describe(prototype);
+        if (title.match(/Prototype$/)) {
+            title = title.replace(/Prototype$/, "");
+        }
+        result.push(title);
+    }
+    return result;
+}
+
+InjectedScript.getProperties = function(objectProxy, ignoreHasOwnProperty)
+{
+    var object = InjectedScript._resolveObject(objectProxy);
+    if (!object)
+        return false;
+
+    var properties = [];
+
+    // Go over properties, prepare results.
+    for (var propertyName in object) {
+        if (!ignoreHasOwnProperty && "hasOwnProperty" in object && !object.hasOwnProperty(propertyName))
+            continue;
+
+        var property = {};
+        property.name = propertyName;
+        property.parentObjectProxy = objectProxy;
+        var isGetter = object["__lookupGetter__"] && object.__lookupGetter__(propertyName);
+        if (!property.isGetter) {
+            var childObject = object[propertyName];
+            var childObjectProxy = new InjectedScript.createProxyObject(childObject, objectProxy.objectId, true);
+            childObjectProxy.path = objectProxy.path ? objectProxy.path.slice() : [];
+            childObjectProxy.path.push(propertyName);
+            childObjectProxy.protoDepth = objectProxy.protoDepth || 0;
+            property.value = childObjectProxy;
+        } else {
+            // FIXME: this should show something like "getter" (bug 16734).
+            property.value = { description: "\u2014" }; // em dash
+            property.isGetter = true;
+        }
+        properties.push(property);
+    }
+    return properties;
+}
+
+InjectedScript.setPropertyValue = function(objectProxy, propertyName, expression)
+{
+    var object = InjectedScript._resolveObject(objectProxy);
+    if (!object)
+        return false;
+
+    var expressionLength = expression.length;
+    if (!expressionLength) {
+        delete object[propertyName];
+        return !(propertyName in object);
+    }
+
+    try {
+        // Surround the expression in parenthesis so the result of the eval is the result
+        // of the whole expression not the last potential sub-expression.
+
+        // There is a regression introduced here: eval is now happening against global object,
+        // not call frame while on a breakpoint.
+        // TODO: bring evaluation against call frame back.
+        var result = InjectedScript._window().eval("(" + expression + ")");
+        // Store the result in the property.
+        object[propertyName] = result;
+        return true;
+    } catch(e) {
+        try {
+            var result = InjectedScript._window().eval("\"" + expression.escapeCharacters("\"") + "\"");
+            object[propertyName] = result;
+            return true;
+        } catch(e) {
+            return false;
+        }
+    }
+}
+
+InjectedScript.evaluate = function(expression)
+{
+    return InjectedScript._evaluateOn(InjectedScript._window().eval, InjectedScript._window(), expression);
+}
+
+InjectedScript._evaluateOn = function(evalFunction, object, expression)
+{
+    InjectedScript._ensureCommandLineAPIInstalled();
+    // Surround the expression in with statements to inject our command line API so that
+    // the window object properties still take more precedent than our API functions.
+    expression = "with (window._inspectorCommandLineAPI) { with (window) { " + expression + " } }";
+
+    var result = {};
+    try {
+        var value = evalFunction.call(object, expression);
+        if (value === null)
+            return { value: null };
+        if (Object.type(value) === "error") {
+            result.value = Object.describe(value);
+            result.isException = true;
+            return result;
+        }
+
+        var wrapper = InspectorController.wrapObject(value);
+        if (typeof wrapper === "object" && wrapper.exception) {
+            result.value = wrapper.exception;
+            result.isException = true;
+        } else {
+            result.value = wrapper;
+        }
+    } catch (e) {
+        result.value = e.toString();
+        result.isException = true;
+    }
+    return result;
+}
+
+InjectedScript.addInspectedNode = function(nodeId)
+{
+    var node = InjectedScript._nodeForId(nodeId);
+    if (!node)
+        return false;
+
+    InjectedScript._ensureCommandLineAPIInstalled();
+    var inspectedNodes = InjectedScript._window()._inspectorCommandLineAPI._inspectedNodes;
+    inspectedNodes.unshift(node);
+    if (inspectedNodes.length >= 5)
+        inspectedNodes.pop();
+    return true;
+}
+
+InjectedScript.performSearch = function(whitespaceTrimmedQuery)
+{
+    var tagNameQuery = whitespaceTrimmedQuery;
+    var attributeNameQuery = whitespaceTrimmedQuery;
+    var startTagFound = (tagNameQuery.indexOf("<") === 0);
+    var endTagFound = (tagNameQuery.lastIndexOf(">") === (tagNameQuery.length - 1));
+
+    if (startTagFound || endTagFound) {
+        var tagNameQueryLength = tagNameQuery.length;
+        tagNameQuery = tagNameQuery.substring((startTagFound ? 1 : 0), (endTagFound ? (tagNameQueryLength - 1) : tagNameQueryLength));
+    }
+
+    // Check the tagNameQuery is it is a possibly valid tag name.
+    if (!/^[a-zA-Z0-9\-_:]+$/.test(tagNameQuery))
+        tagNameQuery = null;
+
+    // Check the attributeNameQuery is it is a possibly valid tag name.
+    if (!/^[a-zA-Z0-9\-_:]+$/.test(attributeNameQuery))
+        attributeNameQuery = null;
+
+    const escapedQuery = whitespaceTrimmedQuery.escapeCharacters("'");
+    const escapedTagNameQuery = (tagNameQuery ? tagNameQuery.escapeCharacters("'") : null);
+    const escapedWhitespaceTrimmedQuery = whitespaceTrimmedQuery.escapeCharacters("'");
+    const searchResultsProperty = InjectedScript._includedInSearchResultsPropertyName;
+
+    function addNodesToResults(nodes, length, getItem)
+    {
+        if (!length)
+            return;
+
+        var nodeIds = [];
+        for (var i = 0; i < length; ++i) {
+            var node = getItem.call(nodes, i);
+            // Skip this node if it already has the property.
+            if (searchResultsProperty in node)
+                continue;
+
+            if (!InjectedScript._searchResults.length) {
+                InjectedScript._currentSearchResultIndex = 0;
+            }
+
+            node[searchResultsProperty] = true;
+            InjectedScript._searchResults.push(node);
+            var nodeId = InspectorController.pushNodePathToFrontend(node, false);
+            nodeIds.push(nodeId);
+        }
+        InspectorController.addNodesToSearchResult(nodeIds.join(","));
+    }
+
+    function matchExactItems(doc)
+    {
+        matchExactId.call(this, doc);
+        matchExactClassNames.call(this, doc);
+        matchExactTagNames.call(this, doc);
+        matchExactAttributeNames.call(this, doc);
+    }
+
+    function matchExactId(doc)
+    {
+        const result = doc.__proto__.getElementById.call(doc, whitespaceTrimmedQuery);
+        addNodesToResults.call(this, result, (result ? 1 : 0), function() { return this });
+    }
+
+    function matchExactClassNames(doc)
+    {
+        const result = doc.__proto__.getElementsByClassName.call(doc, whitespaceTrimmedQuery);
+        addNodesToResults.call(this, result, result.length, result.item);
+    }
+
+    function matchExactTagNames(doc)
+    {
+        if (!tagNameQuery)
+            return;
+        const result = doc.__proto__.getElementsByTagName.call(doc, tagNameQuery);
+        addNodesToResults.call(this, result, result.length, result.item);
+    }
+
+    function matchExactAttributeNames(doc)
+    {
+        if (!attributeNameQuery)
+            return;
+        const result = doc.__proto__.querySelectorAll.call(doc, "[" + attributeNameQuery + "]");
+        addNodesToResults.call(this, result, result.length, result.item);
+    }
+
+    function matchPartialTagNames(doc)
+    {
+        if (!tagNameQuery)
+            return;
+        const result = doc.__proto__.evaluate.call(doc, "//*[contains(name(), '" + escapedTagNameQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
+        addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
+    }
+
+    function matchStartOfTagNames(doc)
+    {
+        if (!tagNameQuery)
+            return;
+        const result = doc.__proto__.evaluate.call(doc, "//*[starts-with(name(), '" + escapedTagNameQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
+        addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
+    }
+
+    function matchPartialTagNamesAndAttributeValues(doc)
+    {
+        if (!tagNameQuery) {
+            matchPartialAttributeValues.call(this, doc);
+            return;
+        }
+
+        const result = doc.__proto__.evaluate.call(doc, "//*[contains(name(), '" + escapedTagNameQuery + "') or contains(@*, '" + escapedQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
+        addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
+    }
+
+    function matchPartialAttributeValues(doc)
+    {
+        const result = doc.__proto__.evaluate.call(doc, "//*[contains(@*, '" + escapedQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
+        addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
+    }
+
+    function matchStyleSelector(doc)
+    {
+        const result = doc.__proto__.querySelectorAll.call(doc, whitespaceTrimmedQuery);
+        addNodesToResults.call(this, result, result.length, result.item);
+    }
+
+    function matchPlainText(doc)
+    {
+        const result = doc.__proto__.evaluate.call(doc, "//text()[contains(., '" + escapedQuery + "')] | //comment()[contains(., '" + escapedQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
+        addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
+    }
+
+    function matchXPathQuery(doc)
+    {
+        const result = doc.__proto__.evaluate.call(doc, whitespaceTrimmedQuery, doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
+        addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
+    }
+
+    function finishedSearching()
+    {
+        // Remove the searchResultsProperty now that the search is finished.
+        for (var i = 0; i < InjectedScript._searchResults.length; ++i)
+            delete InjectedScript._searchResults[i][searchResultsProperty];
+    }
+
+    const mainFrameDocument = InjectedScript._window().document;
+    const searchDocuments = [mainFrameDocument];
+    var searchFunctions;
+    if (tagNameQuery && startTagFound && endTagFound)
+        searchFunctions = [matchExactTagNames, matchPlainText];
+    else if (tagNameQuery && startTagFound)
+        searchFunctions = [matchStartOfTagNames, matchPlainText];
+    else if (tagNameQuery && endTagFound) {
+        // FIXME: we should have a matchEndOfTagNames search function if endTagFound is true but not startTagFound.
+        // This requires ends-with() support in XPath, WebKit only supports starts-with() and contains().
+        searchFunctions = [matchPartialTagNames, matchPlainText];
+    } else if (whitespaceTrimmedQuery === "//*" || whitespaceTrimmedQuery === "*") {
+        // These queries will match every node. Matching everything isn't useful and can be slow for large pages,
+        // so limit the search functions list to plain text and attribute matching.
+        searchFunctions = [matchPartialAttributeValues, matchPlainText];
+    } else
+        searchFunctions = [matchExactItems, matchStyleSelector, matchPartialTagNamesAndAttributeValues, matchPlainText, matchXPathQuery];
+
+    // Find all frames, iframes and object elements to search their documents.
+    const querySelectorAllFunction = InjectedScript._window().Document.prototype.querySelectorAll;
+    const subdocumentResult = querySelectorAllFunction.call(mainFrameDocument, "iframe, frame, object");
+
+    for (var i = 0; i < subdocumentResult.length; ++i) {
+        var element = subdocumentResult.item(i);
+        if (element.contentDocument)
+            searchDocuments.push(element.contentDocument);
+    }
+
+    const panel = InjectedScript;
+    var documentIndex = 0;
+    var searchFunctionIndex = 0;
+    var chunkIntervalIdentifier = null;
+
+    // Split up the work into chunks so we don't block the UI thread while processing.
+
+    function processChunk()
+    {
+        var searchDocument = searchDocuments[documentIndex];
+        var searchFunction = searchFunctions[searchFunctionIndex];
+
+        if (++searchFunctionIndex > searchFunctions.length) {
+            searchFunction = searchFunctions[0];
+            searchFunctionIndex = 0;
+
+            if (++documentIndex > searchDocuments.length) {
+                if (panel._currentSearchChunkIntervalIdentifier === chunkIntervalIdentifier)
+                    delete panel._currentSearchChunkIntervalIdentifier;
+                clearInterval(chunkIntervalIdentifier);
+                finishedSearching.call(panel);
+                return;
+            }
+
+            searchDocument = searchDocuments[documentIndex];
+        }
+
+        if (!searchDocument || !searchFunction)
+            return;
+
+        try {
+            searchFunction.call(panel, searchDocument);
+        } catch(err) {
+            // ignore any exceptions. the query might be malformed, but we allow that.
+        }
+    }
+
+    processChunk();
+
+    chunkIntervalIdentifier = setInterval(processChunk, 25);
+    InjectedScript._currentSearchChunkIntervalIdentifier = chunkIntervalIdentifier;
+    return true;
+}
+
+InjectedScript.searchCanceled = function()
+{
+    if (InjectedScript._searchResults) {
+        const searchResultsProperty = InjectedScript._includedInSearchResultsPropertyName;
+        for (var i = 0; i < this._searchResults.length; ++i) {
+            var node = this._searchResults[i];
+
+            // Remove the searchResultsProperty since there might be an unfinished search.
+            delete node[searchResultsProperty];
+        }
+    }
+
+    if (InjectedScript._currentSearchChunkIntervalIdentifier) {
+        clearInterval(InjectedScript._currentSearchChunkIntervalIdentifier);
+        delete InjectedScript._currentSearchChunkIntervalIdentifier;
+    }
+    InjectedScript._searchResults = [];
+    return true;
+}
+
+InjectedScript.openInInspectedWindow = function(url)
+{
+    InjectedScript._window().open(url);
+}
+
+InjectedScript.getCallFrames = function()
+{
+    var callFrame = InspectorController.currentCallFrame();
+    if (!callFrame)
+        return false;
+
+    var result = [];
+    var depth = 0;
+    do {
+        result.push(new InjectedScript.CallFrameProxy(depth++, callFrame));
+        callFrame = callFrame.caller;
+    } while (callFrame);
+    return result;
+}
+
+InjectedScript.evaluateInCallFrame = function(callFrameId, code)
+{
+    var callFrame = InjectedScript._callFrameForId(callFrameId);
+    if (!callFrame)
+        return false;
+    return InjectedScript._evaluateOn(callFrame.evaluate, callFrame, code);
+}
+
+InjectedScript._callFrameForId = function(id)
+{
+    var callFrame = InspectorController.currentCallFrame();
+    while (--id >= 0 && callFrame)
+        callFrame = callFrame.caller;
+    return callFrame;
+}
+
+InjectedScript._clearConsoleMessages = function()
+{
+    InspectorController.clearMessages(true);
+}
+
+InjectedScript._inspectObject = function(o)
+{
+    if (arguments.length === 0)
+        return;
+
+    var inspectedWindow = InjectedScript._window();
+    inspectedWindow.console.log(o);
+    if (Object.type(o) === "node") {
+        InspectorController.pushNodePathToFrontend(o, true);
+    } else {
+        switch (Object.describe(o)) {
+            case "Database":
+                InspectorController.selectDatabase(o);
+                break;
+            case "Storage":
+                InspectorController.selectDOMStorage(o);
+                break;
+        }
+    }
+}
+
+InjectedScript._ensureCommandLineAPIInstalled = function(inspectedWindow)
+{
+    var inspectedWindow = InjectedScript._window();
+    if (inspectedWindow._inspectorCommandLineAPI)
+        return;
+    
+    inspectedWindow.eval("window._inspectorCommandLineAPI = { \
+        $: function() { return document.getElementById.apply(document, arguments) }, \
+        $$: function() { return document.querySelectorAll.apply(document, arguments) }, \
+        $x: function(xpath, context) { \
+            var nodes = []; \
+            try { \
+                var doc = context || document; \
+                var results = doc.evaluate(xpath, doc, null, XPathResult.ANY_TYPE, null); \
+                var node; \
+                while (node = results.iterateNext()) nodes.push(node); \
+            } catch (e) {} \
+            return nodes; \
+        }, \
+        dir: function() { return console.dir.apply(console, arguments) }, \
+        dirxml: function() { return console.dirxml.apply(console, arguments) }, \
+        keys: function(o) { var a = []; for (var k in o) a.push(k); return a; }, \
+        values: function(o) { var a = []; for (var k in o) a.push(o[k]); return a; }, \
+        profile: function() { return console.profile.apply(console, arguments) }, \
+        profileEnd: function() { return console.profileEnd.apply(console, arguments) }, \
+        _inspectedNodes: [], \
+        get $0() { return _inspectorCommandLineAPI._inspectedNodes[0] }, \
+        get $1() { return _inspectorCommandLineAPI._inspectedNodes[1] }, \
+        get $2() { return _inspectorCommandLineAPI._inspectedNodes[2] }, \
+        get $3() { return _inspectorCommandLineAPI._inspectedNodes[3] }, \
+        get $4() { return _inspectorCommandLineAPI._inspectedNodes[4] } \
+    };");
+
+    inspectedWindow._inspectorCommandLineAPI.clear = InspectorController.wrapCallback(InjectedScript._clearConsoleMessages);
+    inspectedWindow._inspectorCommandLineAPI.inspect = InspectorController.wrapCallback(InjectedScript._inspectObject);
+}
+
+InjectedScript._resolveObject = function(objectProxy)
+{
+    var object = InjectedScript._objectForId(objectProxy.objectId);
+    var path = objectProxy.path;
+    var protoDepth = objectProxy.protoDepth;
+
+    // Follow the property path.
+    for (var i = 0; object && path && i < path.length; ++i)
+        object = object[path[i]];
+
+    // Get to the necessary proto layer.
+    for (var i = 0; object && protoDepth && i < protoDepth; ++i)
+        object = object.__proto__;
+
+    return object;
+}
+
+InjectedScript._window = function()
+{
+    // TODO: replace with 'return window;' once this script is injected into
+    // the page's context.
+    return InspectorController.inspectedWindow();
+}
+
+InjectedScript._nodeForId = function(nodeId)
+{
+    if (!nodeId)
+        return null;
+    return InspectorController.nodeForId(nodeId);
+}
+
+InjectedScript._objectForId = function(objectId)
+{
+    // There are three types of object ids used:
+    // - numbers point to DOM Node via the InspectorDOMAgent mapping
+    // - strings point to console objects cached in InspectorController for lazy evaluation upon them
+    // - objects contain complex ids and are currently used for scoped objects
+    if (typeof objectId === "number") {
+        return InjectedScript._nodeForId(objectId);
+    } else if (typeof objectId === "string") {
+        return InspectorController.unwrapObject(objectId);
+    } else if (typeof objectId === "object") {
+        var callFrame = InjectedScript._callFrameForId(objectId.callFrame);
+        if (objectId.thisObject)
+            return callFrame.thisObject;
+        else
+            return callFrame.scopeChain[objectId.chainIndex];
+    }
+    return objectId;
+}
+
+InjectedScript.pushNodeToFrontend = function(objectProxy)
+{
+    var object = InjectedScript._resolveObject(objectProxy);
+    if (!object || Object.type(object) !== "node")
+        return false;
+    return InspectorController.pushNodePathToFrontend(object, false);
+}
+
+// Called from within InspectorController on the 'inspected page' side.
+InjectedScript.createProxyObject = function(object, objectId, abbreviate)
+{
+    var result = {};
+    result.objectId = objectId;
+    result.type = Object.type(object);
+
+    var type = typeof object;
+    if (type === "object" || type === "function") {
+        for (var subPropertyName in object) {
+            result.hasChildren = true;
+            break;
+        }
+    }
+    try {
+        result.description = Object.describe(object, abbreviate);
+    } catch (e) {
+        result.exception = e.toString();
+    }
+    return result;
+}
+
+InjectedScript.CallFrameProxy = function(id, callFrame)
+{
+    this.id = id;
+    this.type = callFrame.type;
+    this.functionName = (this.type === "function" ? callFrame.functionName : "");
+    this.sourceID = callFrame.sourceID;
+    this.line = callFrame.line;
+    this.scopeChain = this._wrapScopeChain(callFrame);
+}
+
+InjectedScript.CallFrameProxy.prototype = {
+    _wrapScopeChain: function(callFrame)
+    {
+        var foundLocalScope = false;
+        var scopeChain = callFrame.scopeChain;
+        var scopeChainProxy = [];
+        for (var i = 0; i < scopeChain.length; ++i) {
+            var scopeObject = scopeChain[i];
+            var scopeObjectProxy = InjectedScript.createProxyObject(scopeObject, { callFrame: this.id, chainIndex: i });
+
+            if (Object.prototype.toString.call(scopeObject) === "[object JSActivation]") {
+                if (!foundLocalScope)
+                    scopeObjectProxy.thisObject = InjectedScript.createProxyObject(callFrame.thisObject, { callFrame: this.id, thisObject: true });
+                else
+                    scopeObjectProxy.isClosure = true;
+                foundLocalScope = true;
+                scopeObjectProxy.isLocal = true;
+            } else if (foundLocalScope && scopeObject instanceof InjectedScript._window().Element)
+                scopeObjectProxy.isElement = true;
+            else if (foundLocalScope && scopeObject instanceof InjectedScript._window().Document)
+                scopeObjectProxy.isDocument = true;
+            else if (!foundLocalScope)
+                scopeObjectProxy.isWithBlock = true;
+            scopeObjectProxy.properties = [];
+            try {
+                for (var propertyName in scopeObject)
+                    scopeObjectProxy.properties.push(propertyName);
+            } catch (e) {
+            }
+            scopeChainProxy.push(scopeObjectProxy);
+        }
+        return scopeChainProxy;
+    }
+}
+
+Object.type = function(obj)
+{
+    if (obj === null)
+        return "null";
+
+    var type = typeof obj;
+    if (type !== "object" && type !== "function")
+        return type;
+
+    var win = InjectedScript._window();
+
+    if (obj instanceof win.Node)
+        return (obj.nodeType === undefined ? type : "node");
+    if (obj instanceof win.String)
+        return "string";
+    if (obj instanceof win.Array)
+        return "array";
+    if (obj instanceof win.Boolean)
+        return "boolean";
+    if (obj instanceof win.Number)
+        return "number";
+    if (obj instanceof win.Date)
+        return "date";
+    if (obj instanceof win.RegExp)
+        return "regexp";
+    if (obj instanceof win.Error)
+        return "error";
+    return type;
+}
+
+Object.hasProperties = function(obj)
+{
+    if (typeof obj === "undefined" || typeof obj === "null")
+        return false;
+    for (var name in obj)
+        return true;
+    return false;
+}
+
+Object.describe = function(obj, abbreviated)
+{
+    var type1 = Object.type(obj);
+    var type2 = Object.className(obj);
+
+    switch (type1) {
+    case "object":
+    case "node":
+        return type2;
+    case "array":
+        return "[" + obj.toString() + "]";
+    case "string":
+        if (obj.length > 100)
+            return "\"" + obj.substring(0, 100) + "\u2026\"";
+        return "\"" + obj + "\"";
+    case "function":
+        var objectText = String(obj);
+        if (!/^function /.test(objectText))
+            objectText = (type2 == "object") ? type1 : type2;
+        else if (abbreviated)
+            objectText = /.*/.exec(obj)[0].replace(/ +$/g, "");
+        return objectText;
+    case "regexp":
+        return String(obj).replace(/([\\\/])/g, "\\$1").replace(/\\(\/[gim]*)$/, "$1").substring(1);
+    default:
+        return String(obj);
+    }
+}
+
+Object.className = function(obj)
+{
+    return Object.prototype.toString.call(obj).replace(/^\[object (.*)\]$/i, "$1")
+}
+
+// Although Function.prototype.bind and String.prototype.escapeCharacters are defined in utilities.js they will soon become
+// unavailable in the InjectedScript context. So we define them here for the local use.
+// TODO: remove this comment once InjectedScript runs in a separate context.
+Function.prototype.bind = function(thisObject)
+{
+    var func = this;
+    var args = Array.prototype.slice.call(arguments, 1);
+    return function() { return func.apply(thisObject, args.concat(Array.prototype.slice.call(arguments, 0))) };
+}
+
+String.prototype.escapeCharacters = function(chars)
+{
+    var foundChar = false;
+    for (var i = 0; i < chars.length; ++i) {
+        if (this.indexOf(chars.charAt(i)) !== -1) {
+            foundChar = true;
+            break;
+        }
+    }
+
+    if (!foundChar)
+        return this;
+
+    var result = "";
+    for (var i = 0; i < this.length; ++i) {
+        if (chars.indexOf(this.charAt(i)) !== -1)
+            result += "\\";
+        result += this.charAt(i);
+    }
+
+    return result;
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScriptAccess.js b/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScriptAccess.js
new file mode 100644
index 0000000..a5be2d8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScriptAccess.js
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009 Joseph Pecoraro
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+var InjectedScriptAccess = {};
+
+InjectedScriptAccess._installHandler = function(methodName)
+{
+    InjectedScriptAccess[methodName] = function()
+    {
+        var allArgs = Array.prototype.slice.call(arguments);
+        var callback = allArgs[allArgs.length - 1];
+        var argsString = JSON.stringify(Array.prototype.slice.call(allArgs, 0, allArgs.length - 1));
+        
+        function myCallback(result, isException)
+        {
+            if (!isException)
+                callback(JSON.parse(result));
+            else
+                WebInspector.console.addMessage(new WebInspector.ConsoleTextMessage("Error dispatching: " + methodName));
+        }
+        var callId = WebInspector.Callback.wrap(myCallback);
+        InspectorController.dispatchOnInjectedScript(callId, methodName, argsString);
+    };
+}
+
+InjectedScriptAccess._installHandler("getStyles");
+InjectedScriptAccess._installHandler("getComputedStyle");
+InjectedScriptAccess._installHandler("getInlineStyle");
+InjectedScriptAccess._installHandler("applyStyleText");
+InjectedScriptAccess._installHandler("setStyleText");
+InjectedScriptAccess._installHandler("toggleStyleEnabled");
+InjectedScriptAccess._installHandler("applyStyleRuleText");
+InjectedScriptAccess._installHandler("addStyleSelector");
+InjectedScriptAccess._installHandler("setStyleProperty");
+InjectedScriptAccess._installHandler("getPrototypes");
+InjectedScriptAccess._installHandler("getProperties");
+InjectedScriptAccess._installHandler("setPropertyValue");
+InjectedScriptAccess._installHandler("evaluate");
+InjectedScriptAccess._installHandler("addInspectedNode");
+InjectedScriptAccess._installHandler("pushNodeToFrontend");
+InjectedScriptAccess._installHandler("evaluate");
+InjectedScriptAccess._installHandler("addInspectedNode");
+InjectedScriptAccess._installHandler("pushNodeToFrontend");
+InjectedScriptAccess._installHandler("performSearch");
+InjectedScriptAccess._installHandler("searchCanceled");
+InjectedScriptAccess._installHandler("openInInspectedWindow");
+InjectedScriptAccess._installHandler("evaluateInCallFrame");
+
+WebInspector.didDispatchOnInjectedScript = WebInspector.Callback.processCallback;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/MetricsSidebarPane.js b/src/3rdparty/webkit/WebCore/inspector/front-end/MetricsSidebarPane.js
index a22a000..a33653b 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/MetricsSidebarPane.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/MetricsSidebarPane.js
@@ -29,6 +29,7 @@
 WebInspector.MetricsSidebarPane = function()
 {
     WebInspector.SidebarPane.call(this, WebInspector.UIString("Metrics"));
+    this._inlineStyleId = null;
 }
 
 WebInspector.MetricsSidebarPane.prototype = {
@@ -46,12 +47,28 @@ WebInspector.MetricsSidebarPane.prototype = {
         if (!node || !node.ownerDocument.defaultView)
             return;
 
-        var style;
-        if (node.nodeType === Node.ELEMENT_NODE)
-            style = node.ownerDocument.defaultView.getComputedStyle(node);
-        if (!style)
+        if (node.nodeType !== Node.ELEMENT_NODE)
             return;
 
+        var self = this;
+        var callback = function(stylePayload) {
+            if (!stylePayload)
+                return;
+            var style = WebInspector.CSSStyleDeclaration.parseStyle(stylePayload);
+            self._update(node, body, style);
+        };
+        InjectedScriptAccess.getComputedStyle(node.id, callback);
+
+        var inlineStyleCallback = function(stylePayload) {
+            if (!stylePayload)
+                return;
+            self._inlineStyleId = stylePayload.id;
+        };
+        InjectedScriptAccess.getInlineStyle(node.id, inlineStyleCallback);
+    },
+
+    _update: function(node, body, style)
+    {
         var metricsElement = document.createElement("div");
         metricsElement.className = "metrics";
 
@@ -184,11 +201,14 @@ WebInspector.MetricsSidebarPane.prototype = {
         if (/^\d+$/.test(userInput))
             userInput += "px";
 
-        this.node.style.setProperty(context.styleProperty, userInput, "");
-
-        this.dispatchEventToListeners("metrics edited");
-
-        this.update();
+        var self = this;
+        var callback = function(success) {
+            if (!success)
+                return;
+            self.dispatchEventToListeners("metrics edited");
+            self.update();
+        };
+        InjectedScriptAccess.setStyleProperty(this._inlineStyleId, context.styleProperty, userInput, callback);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ObjectPropertiesSection.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ObjectPropertiesSection.js
index d8c34d7..8bb4e35 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ObjectPropertiesSection.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ObjectPropertiesSection.js
@@ -26,15 +26,6 @@
 
 WebInspector.ObjectPropertiesSection = function(object, title, subtitle, emptyPlaceholder, ignoreHasOwnProperty, extraProperties, treeElementConstructor)
 {
-    if (!title) {
-        title = Object.describe(object);
-        if (title.match(/Prototype$/)) {
-            title = title.replace(/Prototype$/, "");
-            if (!subtitle)
-                subtitle = WebInspector.UIString("Prototype");
-        }
-    }
-
     this.emptyPlaceholder = (emptyPlaceholder || WebInspector.UIString("No Properties"));
     this.object = object;
     this.ignoreHasOwnProperty = ignoreHasOwnProperty;
@@ -53,108 +44,110 @@ WebInspector.ObjectPropertiesSection.prototype = {
 
     update: function()
     {
-        var properties = [];
-        for (var prop in this.object)
-            properties.push(prop);
+        var self = this;
+        var callback = function(properties) {
+            if (!properties)
+                return;
+            self.updateProperties(properties);
+        };
+        InjectedScriptAccess.getProperties(this.object, this.ignoreHasOwnProperty, callback);
+    },
+
+    updateProperties: function(properties, rootTreeElementConstructor, rootPropertyComparer)
+    {
+        if (!rootTreeElementConstructor)
+            rootTreeElementConstructor = this.treeElementConstructor;
+            
+        if (!rootPropertyComparer)
+            rootPropertyComparer = WebInspector.ObjectPropertiesSection.CompareProperties;
+            
         if (this.extraProperties)
-            for (var prop in this.extraProperties)
-                properties.push(prop);
-        properties.sort(this._displaySort);
+            for (var i = 0; i < this.extraProperties.length; ++i)
+                properties.push(this.extraProperties[i]);
+                
+        properties.sort(rootPropertyComparer);
 
         this.propertiesTreeOutline.removeChildren();
 
-        for (var i = 0; i < properties.length; ++i) {
-            var object = this.object;
-            var propertyName = properties[i];
-            if (this.extraProperties && propertyName in this.extraProperties)
-                object = this.extraProperties;
-            if (propertyName === "__treeElementIdentifier")
-                continue;
-            if (!this.ignoreHasOwnProperty && "hasOwnProperty" in object && !object.hasOwnProperty(propertyName))
-                continue;
-            this.propertiesTreeOutline.appendChild(new this.treeElementConstructor(object, propertyName));
-        }
+        for (var i = 0; i < properties.length; ++i)
+            this.propertiesTreeOutline.appendChild(new rootTreeElementConstructor(properties[i]));
 
         if (!this.propertiesTreeOutline.children.length) {
             var title = "<div class=\"info\">" + this.emptyPlaceholder + "</div>";
             var infoElement = new TreeElement(title, null, false);
             this.propertiesTreeOutline.appendChild(infoElement);
         }
-    },
-
-    _displaySort: function(a,b) {
-
-        // if used elsewhere make sure to
-        //  - convert a and b to strings (not needed here, properties are all strings)
-        //  - check if a == b (not needed here, no two properties can be the same)
-
-        var diff = 0;
-        var chunk = /^\d+|^\D+/;
-        var chunka, chunkb, anum, bnum;
-        while (diff === 0) {
-            if (!a && b)
-                return -1;
-            if (!b && a)
-                return 1;
-            chunka = a.match(chunk)[0];
-            chunkb = b.match(chunk)[0];
-            anum = !isNaN(chunka);
-            bnum = !isNaN(chunkb);
-            if (anum && !bnum)
-                return -1;
-            if (bnum && !anum)
-                return 1;
-            if (anum && bnum) {
-                diff = chunka - chunkb;
-                if (diff === 0 && chunka.length !== chunkb.length) {
-                    if (!+chunka && !+chunkb) // chunks are strings of all 0s (special case)
-                        return chunka.length - chunkb.length;
-                    else
-                        return chunkb.length - chunka.length;
-                }
-            } else if (chunka !== chunkb)
-                return (chunka < chunkb) ? -1 : 1;
-            a = a.substring(chunka.length);
-            b = b.substring(chunkb.length);
-        }
-        return diff;
     }
 }
 
 WebInspector.ObjectPropertiesSection.prototype.__proto__ = WebInspector.PropertiesSection.prototype;
 
-WebInspector.ObjectPropertyTreeElement = function(parentObject, propertyName)
+WebInspector.ObjectPropertiesSection.CompareProperties = function(propertyA, propertyB) 
 {
-    this.parentObject = parentObject;
-    this.propertyName = propertyName;
+    var a = propertyA.name;
+    var b = propertyB.name;
+
+    // if used elsewhere make sure to
+    //  - convert a and b to strings (not needed here, properties are all strings)
+    //  - check if a == b (not needed here, no two properties can be the same)
+
+    var diff = 0;
+    var chunk = /^\d+|^\D+/;
+    var chunka, chunkb, anum, bnum;
+    while (diff === 0) {
+        if (!a && b)
+            return -1;
+        if (!b && a)
+            return 1;
+        chunka = a.match(chunk)[0];
+        chunkb = b.match(chunk)[0];
+        anum = !isNaN(chunka);
+        bnum = !isNaN(chunkb);
+        if (anum && !bnum)
+            return -1;
+        if (bnum && !anum)
+            return 1;
+        if (anum && bnum) {
+            diff = chunka - chunkb;
+            if (diff === 0 && chunka.length !== chunkb.length) {
+                if (!+chunka && !+chunkb) // chunks are strings of all 0s (special case)
+                    return chunka.length - chunkb.length;
+                else
+                    return chunkb.length - chunka.length;
+            }
+        } else if (chunka !== chunkb)
+            return (chunka < chunkb) ? -1 : 1;
+        a = a.substring(chunka.length);
+        b = b.substring(chunkb.length);
+    }
+    return diff;
+}
+
+WebInspector.ObjectPropertyTreeElement = function(property)
+{
+    this.property = property;
 
     // Pass an empty title, the title gets made later in onattach.
     TreeElement.call(this, "", null, false);
 }
 
 WebInspector.ObjectPropertyTreeElement.prototype = {
-    safePropertyValue: function(object, propertyName)
-    {
-        if (object["__lookupGetter__"] && object.__lookupGetter__(propertyName))
-            return;
-        return object[propertyName];
-    },
-
     onpopulate: function()
     {
         if (this.children.length && !this.shouldRefreshChildren)
             return;
 
-        this.removeChildren();
+        var callback = function(properties) {
+            this.removeChildren();
+            if (!properties)
+                return;
 
-        var childObject = this.safePropertyValue(this.parentObject, this.propertyName);
-        var properties = Object.sortedProperties(childObject, WebInspector.ObjectPropertiesSection.prototype._displaySort);
-        for (var i = 0; i < properties.length; ++i) {
-            var propertyName = properties[i];
-            if (propertyName === "__treeElementIdentifier")
-                continue;
-            this.appendChild(new this.treeOutline.section.treeElementConstructor(childObject, propertyName));
-        }
+            properties.sort(WebInspector.ObjectPropertiesSection.CompareProperties);
+            for (var i = 0; i < properties.length; ++i) {
+                this.appendChild(new this.treeOutline.section.treeElementConstructor(properties[i]));
+            }
+        };
+        InjectedScriptAccess.getProperties(this.property.value, false, callback.bind(this));
     },
 
     ondblclick: function(element, event)
@@ -169,41 +162,26 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
 
     update: function()
     {
-        var childObject = this.safePropertyValue(this.parentObject, this.propertyName);
-        var isGetter = ("__lookupGetter__" in this.parentObject && this.parentObject.__lookupGetter__(this.propertyName));
-
-        var nameElement = document.createElement("span");
-        nameElement.className = "name";
-        nameElement.textContent = this.propertyName;
-
+        this.nameElement = document.createElement("span");
+        this.nameElement.className = "name";
+        this.nameElement.textContent = this.property.name;
+
+        var separatorElement = document.createElement("span");
+        separatorElement.className = "separator";
+        separatorElement.textContent = ": ";
+        
         this.valueElement = document.createElement("span");
         this.valueElement.className = "value";
-        if (!isGetter) {
-            this.valueElement.textContent = Object.describe(childObject, true);
-        } else {
-            // FIXME: this should show something like "getter" (bug 16734).
-            this.valueElement.textContent = "\u2014"; // em dash
-            this.valueElement.addStyleClass("dimmed");
-        }
+        this.valueElement.textContent = this.property.value.description;
+        if (this.property.isGetter)
+           this.valueElement.addStyleClass("dimmed");
 
         this.listItemElement.removeChildren();
 
-        this.listItemElement.appendChild(nameElement);
-        this.listItemElement.appendChild(document.createTextNode(": "));
+        this.listItemElement.appendChild(this.nameElement);
+        this.listItemElement.appendChild(separatorElement);
         this.listItemElement.appendChild(this.valueElement);
-
-        var hasSubProperties = false;
-        var type = typeof childObject;
-        if (childObject && (type === "object" || type === "function")) {
-            for (var subPropertyName in childObject) {
-                if (subPropertyName === "__treeElementIdentifier")
-                    continue;
-                hasSubProperties = true;
-                break;
-            }
-        }
-
-        this.hasChildren = hasSubProperties;
+        this.hasChildren = this.property.value.hasChildren;
     },
 
     updateSiblings: function()
@@ -253,67 +231,27 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
         this.editingEnded(context);
     },
 
-    evaluateExpression: function(expression, callback)
-    {
-        // Evaluate in the currently selected call frame if the debugger is paused.
-        // Otherwise evaluate in against the inspected window.
-        if (WebInspector.panels.scripts && WebInspector.panels.scripts.paused && this.treeOutline.section.editInSelectedCallFrameWhenPaused)
-            return WebInspector.panels.scripts.evaluateInSelectedCallFrame(expression, false, callback);
-        try {
-            var result = InspectorController.inspectedWindow().eval(expression);
-            callback(result);
-        } catch (e) {
-            callback(e, true);
-        }
-    },
-
     applyExpression: function(expression, updateInterface)
     {
-        var expressionLength = expression.trimWhitespace().length;
-
-        if (!expressionLength) {
-            // The user deleted everything, so try to delete the property.
-            delete this.parentObject[this.propertyName];
-
-            if (updateInterface) {
-                if (this.propertyName in this.parentObject) {
-                    // The property was not deleted, so update.
-                    this.update();
-                } else {
-                    // The property was deleted, so remove this tree element.
-                    this.parent.removeChild(this);
-                }
-            }
+        expression = expression.trimWhitespace();
+        var expressionLength = expression.length;
+        var self = this;
+        var callback = function(success) {
+            if (!updateInterface)
+                return;
 
-            return;
-        }
+            if (!success)
+                self.update();
 
-        try {
-            // Surround the expression in parenthesis so the result of the eval is the result
-            // of the whole expression not the last potential sub-expression.
-            var result = this.evaluateExpression("(" + expression + ")");
-
-            // Store the result in the property.
-            this.parentObject[this.propertyName] = result;
-        } catch(e) {
-            try {
-                // Try to update as a string
-                var result = this.evaluateExpression("\"" + expression.escapeCharacters("\"") + "\"");
-
-                // Store the result in the property.
-                this.parentObject[this.propertyName] = result;
-            } catch(e) {
-                // The expression failed so don't change the value. So just update and return.
-                if (updateInterface)
-                    this.update();
-                return;
+            if (!expressionLength) {
+                // The property was deleted, so remove this tree element.
+                self.parent.removeChild(this);
+            } else {
+                // Call updateSiblings since their value might be based on the value that just changed.
+                self.updateSiblings();
             }
-        }
-
-        if (updateInterface) {
-            // Call updateSiblings since their value might be based on the value that just changed.
-            this.updateSiblings();
-        }
+        };
+        InjectedScriptAccess.setPropertyValue(this.property.parentObjectProxy, this.property.name, expression.trimWhitespace(), callback);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ObjectProxy.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ObjectProxy.js
new file mode 100644
index 0000000..03d16ab
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ObjectProxy.js
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.ObjectProxy = function(objectId, path, protoDepth, description, hasChildren)
+{
+    this.objectId = objectId;
+    this.path = path || [];
+    this.protoDepth = protoDepth || 0;
+    this.description = description;
+    this.hasChildren = hasChildren;
+}
+
+WebInspector.ObjectPropertyProxy = function(name, value)
+{
+    this.name = name;
+    this.value = value;
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Popup.js b/src/3rdparty/webkit/WebCore/inspector/front-end/Popup.js
new file mode 100644
index 0000000..9c8ef24
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Popup.js
@@ -0,0 +1,168 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * This class provides a popup that can be shown relative to an anchor element
+ * or at an arbitrary absolute position.
+ * Points are Objects: {x: xValue, y: yValue}.
+ * Rectangles are Objects: {x: xValue, y: yValue, width: widthValue, height: heightValue}.
+ *
+ * element is an optional unparented visible element (style.display != "none" AND style.visibility != "hidden").
+ * If the element is absent/undefined, it must have been set with the element(x) setter before the show() method invocation.
+ */
+WebInspector.Popup = function(element)
+{
+    if (element)
+        this.element = element;
+    this._keyHandler = this._keyEventHandler.bind(this);
+    this._mouseDownHandler = this._mouseDownEventHandler.bind(this);
+    this._visible = false;
+    this._autoHide = true;
+}
+
+WebInspector.Popup.prototype = {
+    show: function()
+    {
+        if (this.visible)
+            return;
+        var ownerDocument = this._contentElement.ownerDocument;
+        if (!ownerDocument)
+            return;
+
+        this._glasspaneElement = ownerDocument.createElement("div");
+        this._glasspaneElement.className = "popup-glasspane";
+        ownerDocument.body.appendChild(this._glasspaneElement);
+
+        this._contentElement.positionAt(0, 0);
+        this._contentElement.removeStyleClass("hidden");
+        ownerDocument.body.appendChild(this._contentElement);
+
+        this.positionElement();
+        this._visible = true;
+        ownerDocument.addEventListener("keydown", this._keyHandler, false);
+        ownerDocument.addEventListener("mousedown", this._mouseDownHandler, false);
+    },
+
+    hide: function()
+    {
+        if (this.visible) {
+            this._visible = false;
+            this._contentElement.ownerDocument.removeEventListener("keydown", this._keyHandler, false);
+            this._contentElement.ownerDocument.removeEventListener("mousedown", this._mouseDownHandler, false);
+            this._glasspaneElement.parentElement.removeChild(this._glasspaneElement);
+            this._contentElement.parentElement.removeChild(this._contentElement);
+        }
+    },
+
+    get visible()
+    {
+        return this._visible;
+    },
+
+    set element(x)
+    {
+        this._checkNotVisible();
+        this._contentElement = x;
+        this._contentElement.addStyleClass("hidden");
+    },
+
+    get element()
+    {
+        return this._contentElement;
+    },
+
+    positionElement: function()
+    {
+        var element = this._contentElement;
+        var anchorElement = this._anchorElement;
+
+        var targetDocument = element.ownerDocument;
+        var targetDocumentBody = targetDocument.body;
+        var targetDocumentElement = targetDocument.documentElement;
+        var clippingBox = {x: 0, y: 0, width: targetDocumentElement.clientWidth, height: targetDocumentElement.clientHeight};
+        var parentElement = element.offsetParent || element.parentElement;
+
+        var anchorPosition = {x: anchorElement.totalOffsetLeft, y: anchorElement.totalOffsetTop};
+
+        // FIXME(apavlov@chromium.org): Translate anchorPosition to the element.ownerDocument frame when https://bugs.webkit.org/show_bug.cgi?id=28913 is fixed.
+        var anchorBox = {x: anchorPosition.x, y: anchorPosition.y, width: anchorElement.offsetWidth, height: anchorElement.offsetHeight};
+        var elementBox = {x: element.totalOffsetLeft, y: element.totalOffsetTop, width: element.offsetWidth, height: element.offsetHeight};
+        var newElementPosition = {x: 0, y: 0};
+
+        if (anchorBox.y - elementBox.height >= clippingBox.y)
+            newElementPosition.y = anchorBox.y - elementBox.height;
+        else
+            newElementPosition.y = Math.min(anchorBox.y + anchorBox.height, Math.max(clippingBox.y, clippingBox.y + clippingBox.height - elementBox.height));
+
+        if (anchorBox.x + elementBox.height <= clippingBox.x + clippingBox.height)
+            newElementPosition.x = anchorBox.x;
+        else
+            newElementPosition.x = Math.max(clippingBox.x, clippingBox.x + clippingBox.height - elementBox.height);
+        element.positionAt(newElementPosition.x, newElementPosition.y);
+    },
+
+    set anchor(x)
+    {
+        this._checkNotVisible();
+        this._anchorElement = x;
+    },
+
+    get anchor()
+    {
+        return this._anchorElement;
+    },
+
+    set autoHide(x)
+    {
+        this._autoHide = x;
+    },
+
+    _checkNotVisible: function()
+    {
+        if (this.visible)
+            throw new Error("The popup must not be visible.");
+    },
+
+    _keyEventHandler: function(event)
+    {
+        // Escape hides the popup.
+        if (event.keyIdentifier == "U+001B") {
+            this.hide();
+            event.preventDefault();
+            event.handled = true;
+        }
+    },
+
+    _mouseDownEventHandler: function(event)
+    {
+        if (this._autoHide && event.originalTarget === this._glasspaneElement)
+            this.hide();
+    }
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileDataGridTree.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileDataGridTree.js
index 84d9923..356f57d 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileDataGridTree.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileDataGridTree.js
@@ -50,7 +50,7 @@ WebInspector.ProfileDataGridNode.prototype = {
     {
         function formatMilliseconds(time)
         {
-            return Number.secondsToString(time / 1000, WebInspector.UIString.bind(WebInspector), true);
+            return Number.secondsToString(time / 1000, WebInspector.UIString.bind(WebInspector), !Preferences.samplingCPUProfiler);
         }
 
         var data = {};
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js
index bc78fc8..2b8c6ce 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js
@@ -39,6 +39,11 @@ WebInspector.ProfileView = function(profile)
                     "calls": { title: WebInspector.UIString("Calls"), width: "54px", sortable: true },
                     "function": { title: WebInspector.UIString("Function"), disclosure: true, sortable: true } };
 
+    if (Preferences.samplingCPUProfiler) {
+        delete columns.average;
+        delete columns.calls;
+    }
+
     this.dataGrid = new WebInspector.DataGrid(columns);
     this.dataGrid.addEventListener("sorting changed", this._sortData, this);
     this.dataGrid.element.addEventListener("mousedown", this._mouseDownInDataGrid.bind(this), true);
@@ -56,25 +61,19 @@ WebInspector.ProfileView = function(profile)
     this.viewSelectElement.appendChild(heavyViewOption);
     this.viewSelectElement.appendChild(treeViewOption);
 
-    this.percentButton = document.createElement("button");
-    this.percentButton.className = "percent-time-status-bar-item status-bar-item";
+    this.percentButton = new WebInspector.StatusBarButton("", "percent-time-status-bar-item");
     this.percentButton.addEventListener("click", this._percentClicked.bind(this), false);
 
-    this.focusButton = document.createElement("button");
-    this.focusButton.title = WebInspector.UIString("Focus selected function.");
-    this.focusButton.className = "focus-profile-node-status-bar-item status-bar-item";
+    this.focusButton = new WebInspector.StatusBarButton(WebInspector.UIString("Focus selected function."), "focus-profile-node-status-bar-item");
     this.focusButton.disabled = true;
     this.focusButton.addEventListener("click", this._focusClicked.bind(this), false);
 
-    this.excludeButton = document.createElement("button");
-    this.excludeButton.title = WebInspector.UIString("Exclude selected function.");
-    this.excludeButton.className = "exclude-profile-node-status-bar-item status-bar-item";
+    this.excludeButton = new WebInspector.StatusBarButton(WebInspector.UIString("Exclude selected function."), "exclude-profile-node-status-bar-item");
     this.excludeButton.disabled = true;
     this.excludeButton.addEventListener("click", this._excludeClicked.bind(this), false);
 
-    this.resetButton = document.createElement("button");
-    this.resetButton.title = WebInspector.UIString("Restore all functions.");
-    this.resetButton.className = "reset-profile-status-bar-item status-bar-item hidden";
+    this.resetButton = new WebInspector.StatusBarButton(WebInspector.UIString("Restore all functions."), "reset-profile-status-bar-item");
+    this.resetButton.visible = false;
     this.resetButton.addEventListener("click", this._resetClicked.bind(this), false);
 
     this.profile = profile;
@@ -90,7 +89,7 @@ WebInspector.ProfileView = function(profile)
 WebInspector.ProfileView.prototype = {
     get statusBarItems()
     {
-        return [this.viewSelectElement, this.percentButton, this.focusButton, this.excludeButton, this.resetButton];
+        return [this.viewSelectElement, this.percentButton.element, this.focusButton.element, this.excludeButton.element, this.resetButton.element];
     },
 
     get profile()
@@ -148,11 +147,23 @@ WebInspector.ProfileView.prototype = {
         return this._bottomUpTree;
     },
 
+    show: function(parentElement)
+    {
+        WebInspector.View.prototype.show.call(this, parentElement);
+        this.dataGrid.updateWidths();
+    },
+
     hide: function()
     {
         WebInspector.View.prototype.hide.call(this);
         this._currentSearchResultIndex = -1;
     },
+    
+    resize: function()
+    {
+        if (this.dataGrid)
+            this.dataGrid.updateWidths();
+    },
 
     refresh: function()
     {
@@ -427,10 +438,10 @@ WebInspector.ProfileView.prototype = {
     {
         if (this.showSelfTimeAsPercent && this.showTotalTimeAsPercent && this.showAverageTimeAsPercent) {
             this.percentButton.title = WebInspector.UIString("Show absolute total and self times.");
-            this.percentButton.addStyleClass("toggled-on");
+            this.percentButton.toggled = true;
         } else {
             this.percentButton.title = WebInspector.UIString("Show total and self times as percentages.");
-            this.percentButton.removeStyleClass("toggled-on");
+            this.percentButton.toggled = false;
         }
     },
 
@@ -439,7 +450,7 @@ WebInspector.ProfileView.prototype = {
         if (!this.dataGrid.selectedNode)
             return;
 
-        this.resetButton.removeStyleClass("hidden");
+        this.resetButton.visible = true;
         this.profileDataGridTree.focus(this.dataGrid.selectedNode);
         this.refresh();
         this.refreshVisibleData();
@@ -454,7 +465,7 @@ WebInspector.ProfileView.prototype = {
 
         selectedNode.deselect();
 
-        this.resetButton.removeStyleClass("hidden");
+        this.resetButton.visible = true;
         this.profileDataGridTree.exclude(selectedNode);
         this.refresh();
         this.refreshVisibleData();
@@ -462,7 +473,7 @@ WebInspector.ProfileView.prototype = {
 
     _resetClicked: function(event)
     {
-        this.resetButton.addStyleClass("hidden");
+        this.resetButton.visible = false;
         this.profileDataGridTree.restore();
         this.refresh();
         this.refreshVisibleData();
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfilesPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfilesPanel.js
index 3808025..c010033 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfilesPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfilesPanel.js
@@ -55,22 +55,32 @@ WebInspector.ProfilesPanel = function()
 
     this.sidebarTree = new TreeOutline(this.sidebarTreeElement);
 
+    this.profilesListTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("CPU PROFILES"), null, true);
+    this.sidebarTree.appendChild(this.profilesListTreeElement);
+    this.profilesListTreeElement.expand();
+
+    this.snapshotsListTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("HEAP SNAPSHOTS"), null, true);
+    if (Preferences.heapProfilerPresent) {
+        this.sidebarTree.appendChild(this.snapshotsListTreeElement);
+        this.snapshotsListTreeElement.expand();
+    }
+
     this.profileViews = document.createElement("div");
     this.profileViews.id = "profile-views";
     this.element.appendChild(this.profileViews);
 
-    this.enableToggleButton = document.createElement("button");
-    this.enableToggleButton.className = "enable-toggle-status-bar-item status-bar-item";
+    this.enableToggleButton = new WebInspector.StatusBarButton("", "enable-toggle-status-bar-item");
     this.enableToggleButton.addEventListener("click", this._toggleProfiling.bind(this), false);
 
-    this.recordButton = document.createElement("button");
-    this.recordButton.title = WebInspector.UIString("Start profiling.");
-    this.recordButton.id = "record-profile-status-bar-item";
-    this.recordButton.className = "status-bar-item";
+    this.recordButton = new WebInspector.StatusBarButton(WebInspector.UIString("Start profiling."), "record-profile-status-bar-item");
     this.recordButton.addEventListener("click", this._recordClicked.bind(this), false);
 
     this.recording = false;
 
+    this.snapshotButton = new WebInspector.StatusBarButton(WebInspector.UIString("Take heap snapshot."), "heap-snapshot-status-bar-item");
+    this.snapshotButton.visible = Preferences.heapProfilerPresent;
+    this.snapshotButton.addEventListener("click", this._snapshotClicked.bind(this), false);
+
     this.profileViewStatusBarItemsContainer = document.createElement("div");
     this.profileViewStatusBarItemsContainer.id = "profile-view-status-bar-items";
 
@@ -87,7 +97,7 @@ WebInspector.ProfilesPanel.prototype = {
 
     get statusBarItems()
     {
-        return [this.enableToggleButton, this.recordButton, this.profileViewStatusBarItemsContainer];
+        return [this.enableToggleButton.element, this.recordButton.element, this.snapshotButton.element, this.profileViewStatusBarItemsContainer];
     },
 
     show: function()
@@ -137,7 +147,8 @@ WebInspector.ProfilesPanel.prototype = {
 
         this.sidebarTreeElement.removeStyleClass("some-expandable");
 
-        this.sidebarTree.removeChildren();
+        this.profilesListTreeElement.removeChildren();
+        this.snapshotsListTreeElement.removeChildren();
         this.profileViews.removeChildren();
 
         this.profileViewStatusBarItemsContainer.removeChildren();
@@ -155,7 +166,7 @@ WebInspector.ProfilesPanel.prototype = {
         this._profiles.push(profile);
         this._profilesIdMap[profile.uid] = profile;
 
-        var sidebarParent = this.sidebarTree;
+        var sidebarParent = this.profilesListTreeElement;
         var small = false;
         var alternateTitle;
 
@@ -317,26 +328,36 @@ WebInspector.ProfilesPanel.prototype = {
         this.recording = isProfiling;
 
         if (isProfiling) {
-            this.recordButton.addStyleClass("toggled-on");
+            this.recordButton.toggled = true;
             this.recordButton.title = WebInspector.UIString("Stop profiling.");
         } else {
-            this.recordButton.removeStyleClass("toggled-on");
+            this.recordButton.toggled = false;
             this.recordButton.title = WebInspector.UIString("Start profiling.");
         }
     },
+    
+    resize: function()
+    {
+        var visibleView = this.visibleView;
+        if (visibleView && "resize" in visibleView)
+            visibleView.resize();
+    },
 
     _updateInterface: function()
     {
         if (InspectorController.profilerEnabled()) {
             this.enableToggleButton.title = WebInspector.UIString("Profiling enabled. Click to disable.");
-            this.enableToggleButton.addStyleClass("toggled-on");
-            this.recordButton.removeStyleClass("hidden");
+            this.enableToggleButton.toggled = true;
+            this.recordButton.visible = true;
+            if (Preferences.heapProfilerPresent)
+                this.snapshotButton.visible = true;
             this.profileViewStatusBarItemsContainer.removeStyleClass("hidden");
             this.panelEnablerView.visible = false;
         } else {
             this.enableToggleButton.title = WebInspector.UIString("Profiling disabled. Click to enable.");
-            this.enableToggleButton.removeStyleClass("toggled-on");
-            this.recordButton.addStyleClass("hidden");
+            this.enableToggleButton.toggled = false;
+            this.recordButton.visible = false;
+            this.snapshotButton.visible = false;
             this.profileViewStatusBarItemsContainer.addStyleClass("hidden");
             this.panelEnablerView.visible = true;
         }
@@ -352,6 +373,11 @@ WebInspector.ProfilesPanel.prototype = {
             InspectorController.stopProfiling();
     },
 
+    _snapshotClicked: function()
+    {
+        InspectorController.takeHeapSnapshot();
+    },
+
     _enableProfiling: function()
     {
         if (InspectorController.profilerEnabled())
@@ -424,6 +450,10 @@ WebInspector.ProfilesPanel.prototype = {
         this.profileViews.style.left = width + "px";
         this.profileViewStatusBarItemsContainer.style.left = width + "px";
         this.sidebarResizeElement.style.left = (width - 3) + "px";
+        
+        var visibleView = this.visibleView;
+        if (visibleView && "resize" in visibleView)
+            visibleView.resize();
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/PropertiesSidebarPane.js b/src/3rdparty/webkit/WebCore/inspector/front-end/PropertiesSidebarPane.js
index 70db805..ec08210 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/PropertiesSidebarPane.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/PropertiesSidebarPane.js
@@ -32,7 +32,7 @@ WebInspector.PropertiesSidebarPane = function()
 }
 
 WebInspector.PropertiesSidebarPane.prototype = {
-    update: function(object)
+    update: function(node)
     {
         var body = this.bodyElement;
 
@@ -40,14 +40,24 @@ WebInspector.PropertiesSidebarPane.prototype = {
 
         this.sections = [];
 
-        if (!object)
+        if (!node)
             return;
 
-        for (var prototype = object; prototype; prototype = prototype.__proto__) {
-            var section = new WebInspector.ObjectPropertiesSection(prototype);
-            this.sections.push(section);
-            body.appendChild(section.element);
-        }
+        var self = this;
+        var callback = function(prototypes) {
+            var body = self.bodyElement;
+            body.removeChildren();
+            self.sections = [];
+
+            // Get array of prototype user-friendly names.
+            for (var i = 0; i < prototypes.length; ++i) {
+                var prototype = new WebInspector.ObjectProxy(node.id, [], i);
+                var section = new WebInspector.ObjectPropertiesSection(prototype, prototypes[i], WebInspector.UIString("Prototype"));
+                self.sections.push(section);
+                body.appendChild(section.element);
+            }
+        };
+        InjectedScriptAccess.getPrototypes(node.id, callback);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Resource.js b/src/3rdparty/webkit/WebCore/inspector/front-end/Resource.js
index bcb7b2a..4dac093 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Resource.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Resource.js
@@ -26,7 +26,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.Resource = function(requestHeaders, url, domain, path, lastPathComponent, identifier, mainResource, cached)
+WebInspector.Resource = function(requestHeaders, url, domain, path, lastPathComponent, identifier, mainResource, cached, requestMethod, requestFormData)
 {
     this.identifier = identifier;
 
@@ -39,6 +39,8 @@ WebInspector.Resource = function(requestHeaders, url, domain, path, lastPathComp
     this.path = path;
     this.lastPathComponent = lastPathComponent;
     this.cached = cached;
+    this.requestMethod = requestMethod || "";
+    this.requestFormData = requestFormData || "";
 
     this.category = WebInspector.resourceCategories.other;
 }
@@ -538,7 +540,6 @@ WebInspector.Resource.prototype = {
 
     _checkWarning: function(warning)
     {
-        var addWarning = false;
         var msg;
         switch (warning.id) {
             case WebInspector.Warnings.IncorrectMIMEType.id:
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourceView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourceView.js
index b480362..d745920 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourceView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourceView.js
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2007, 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) IBM Corp. 2009  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -58,6 +59,27 @@ WebInspector.ResourceView = function(resource)
     this.requestHeadersTreeElement.selectable = false;
     this.headersTreeOutline.appendChild(this.requestHeadersTreeElement);
 
+    this._decodeHover = WebInspector.UIString("Double-Click to toggle between URL encoded and decoded formats");
+    this._decodeRequestParameters = true;
+
+    this.queryStringTreeElement = new TreeElement("", null, true);
+    this.queryStringTreeElement.expanded = false;
+    this.queryStringTreeElement.selectable = false;
+    this.queryStringTreeElement.hidden = true;
+    this.headersTreeOutline.appendChild(this.queryStringTreeElement);
+
+    this.formDataTreeElement = new TreeElement("", null, true);
+    this.formDataTreeElement.expanded = false;
+    this.formDataTreeElement.selectable = false;
+    this.formDataTreeElement.hidden = true;
+    this.headersTreeOutline.appendChild(this.formDataTreeElement);
+
+    this.requestPayloadTreeElement = new TreeElement(WebInspector.UIString("Request Payload"), null, true);
+    this.requestPayloadTreeElement.expanded = false;
+    this.requestPayloadTreeElement.selectable = false;
+    this.requestPayloadTreeElement.hidden = true;
+    this.headersTreeOutline.appendChild(this.requestPayloadTreeElement);
+
     this.responseHeadersTreeElement = new TreeElement("", null, true);
     this.responseHeadersTreeElement.expanded = false;
     this.responseHeadersTreeElement.selectable = false;
@@ -104,12 +126,113 @@ WebInspector.ResourceView.prototype = {
 
     _refreshURL: function()
     {
-        this.urlTreeElement.title = this.resource.url.escapeHTML();
+        var url = this.resource.url;
+        this.urlTreeElement.title = this.resource.requestMethod + " " + url.escapeHTML();
+        this._refreshQueryString();
+    },
+
+    _refreshQueryString: function()
+    {
+        var url = this.resource.url;
+        var hasQueryString = url.indexOf("?") >= 0;
+
+        if (!hasQueryString) {
+            this.queryStringTreeElement.hidden = true;
+            return;
+        }
+
+        this.queryStringTreeElement.hidden = false;
+        var parmString = url.split("?", 2)[1];
+        this._refreshParms(WebInspector.UIString("Query String Parameters"), parmString, this.queryStringTreeElement);
+    },
+
+    _refreshFormData: function()
+    {
+        this.formDataTreeElement.hidden = true;
+        this.requestPayloadTreeElement.hidden = true;
+
+        var isFormData = this.resource.requestFormData;
+        if (!isFormData)
+            return;
+
+        var isFormEncoded = false;
+        var requestContentType = this._getHeaderValue(this.resource.requestHeaders, "Content-Type");
+        if (requestContentType == "application/x-www-form-urlencoded")
+            isFormEncoded = true;
+
+        if (isFormEncoded) {
+            this.formDataTreeElement.hidden = false;
+            this._refreshParms(WebInspector.UIString("Form Data"), this.resource.requestFormData, this.formDataTreeElement);
+        } else {
+            this.requestPayloadTreeElement.hidden = false;
+            this._refreshRequestPayload(this.resource.requestFormData);
+        }
+    },
+
+    _refreshRequestPayload: function(formData)
+    {
+        this.requestPayloadTreeElement.removeChildren();
+
+        var title = "<div class=\"header-name\">&nbsp;</div>";
+        title += "<div class=\"raw-form-data header-value\">" + formData.escapeHTML() + "</div>";
+        var parmTreeElement = new TreeElement(title, null, false);
+        this.requestPayloadTreeElement.appendChild(parmTreeElement);
+    },
+
+    _refreshParms: function(title, parmString, parmsTreeElement)
+    {
+        var parms = parmString.split("&");
+        for (var i = 0; i < parms.length; ++i) {
+            var parm = parms[i];
+            parm = parm.split("=", 2);
+            if (parm.length == 1)
+                parm.push("");
+            parms[i] = parm;
+        }
+
+        parmsTreeElement.removeChildren();
+
+        parmsTreeElement.title = title + "<span class=\"header-count\">" + WebInspector.UIString(" (%d)", parms.length) + "</span>";
+
+        for (var i = 0; i < parms.length; ++i) {
+            var key = parms[i][0];
+            var val = parms[i][1];
+
+            if (val.indexOf("%") >= 0)
+                if (this._decodeRequestParameters)
+                    val = decodeURIComponent(val).replace(/\+/g, " ");
+
+            var title = "<div class=\"header-name\">" + key.escapeHTML() + ":</div>";
+            title += "<div class=\"header-value\">" + val.escapeHTML() + "</div>";
+
+            var parmTreeElement = new TreeElement(title, null, false);
+            parmTreeElement.selectable = false;
+            parmTreeElement.tooltip = this._decodeHover;
+            parmTreeElement.ondblclick = this._toggleURLdecoding.bind(this);
+            parmsTreeElement.appendChild(parmTreeElement);
+        }
+    },
+
+    _toggleURLdecoding: function(treeElement, event)
+    {
+        this._decodeRequestParameters = !this._decodeRequestParameters;
+        this._refreshQueryString();
+        this._refreshFormData();
+    },
+
+    _getHeaderValue: function(headers, key)
+    {
+        var lowerKey = key.toLowerCase();
+        for (var testKey in headers) {
+            if (testKey.toLowerCase() === lowerKey)
+                return headers[testKey];
+        }
     },
 
     _refreshRequestHeaders: function()
     {
         this._refreshHeaders(WebInspector.UIString("Request Headers"), this.resource.sortedRequestHeaders, this.requestHeadersTreeElement);
+        this._refreshFormData();
     },
 
     _refreshResponseHeaders: function()
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js
index 3804b5b..680f66c 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2007, 2008 Apple Inc.  All rights reserved.
- * Copyright (C) 2008 Anthony Ricaud (rik24d@gmail.com)
+ * Copyright (C) 2008, 2009 Anthony Ricaud <rik@webkit.org>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -33,6 +33,10 @@ WebInspector.ResourcesPanel = function()
 
     this.element.addStyleClass("resources");
 
+    this.filterBarElement = document.createElement("div");
+    this.filterBarElement.id = "resources-filter";
+    this.element.appendChild(this.filterBarElement);
+
     this.viewsContainerElement = document.createElement("div");
     this.viewsContainerElement.id = "resource-views";
     this.element.appendChild(this.viewsContainerElement);
@@ -56,9 +60,9 @@ WebInspector.ResourcesPanel = function()
     this.containerContentElement.id = "resources-container-content";
     this.containerElement.appendChild(this.containerContentElement);
 
-    this.summaryElement = document.createElement("div");
-    this.summaryElement.id = "resources-summary";
-    this.containerContentElement.appendChild(this.summaryElement);
+    this.summaryBar = new WebInspector.SummaryBar(this.categories);
+    this.summaryBar.element.id = "resources-summary";
+    this.containerContentElement.appendChild(this.summaryBar.element);
 
     this.resourcesGraphsElement = document.createElement("div");
     this.resourcesGraphsElement.id = "resources-graphs";
@@ -72,16 +76,6 @@ WebInspector.ResourcesPanel = function()
     this.dividersLabelBarElement.id = "resources-dividers-label-bar";
     this.containerContentElement.appendChild(this.dividersLabelBarElement);
 
-    this.summaryGraphElement = document.createElement("canvas");
-    this.summaryGraphElement.setAttribute("width", "450");
-    this.summaryGraphElement.setAttribute("height", "38");
-    this.summaryGraphElement.id = "resources-summary-graph";
-    this.summaryElement.appendChild(this.summaryGraphElement);
-
-    this.legendElement = document.createElement("div");
-    this.legendElement.id = "resources-graph-legend";
-    this.summaryElement.appendChild(this.legendElement);
-
     this.sidebarTreeElement = document.createElement("ol");
     this.sidebarTreeElement.className = "sidebar-tree";
     this.sidebarElement.appendChild(this.sidebarTreeElement);
@@ -135,20 +129,35 @@ WebInspector.ResourcesPanel = function()
 
     this.element.appendChild(this.panelEnablerView.element);
 
-    this.enableToggleButton = document.createElement("button");
-    this.enableToggleButton.className = "enable-toggle-status-bar-item status-bar-item";
+    this.enableToggleButton = new WebInspector.StatusBarButton("", "enable-toggle-status-bar-item");
     this.enableToggleButton.addEventListener("click", this._toggleResourceTracking.bind(this), false);
 
-    this.largerResourcesButton = document.createElement("button");
-    this.largerResourcesButton.id = "resources-larger-resources-status-bar-item";
-    this.largerResourcesButton.className = "status-bar-item toggled-on";
-    this.largerResourcesButton.title = WebInspector.UIString("Use small resource rows.");
+    this.largerResourcesButton = new WebInspector.StatusBarButton(WebInspector.UIString("Use small resource rows."), "resources-larger-resources-status-bar-item");
+    this.largerResourcesButton.toggled = true;
     this.largerResourcesButton.addEventListener("click", this._toggleLargerResources.bind(this), false);
 
     this.sortingSelectElement = document.createElement("select");
     this.sortingSelectElement.className = "status-bar-item";
     this.sortingSelectElement.addEventListener("change", this._changeSortingFunction.bind(this), false);
 
+    var createFilterElement = function (category) {
+        var categoryElement = document.createElement("li");
+        categoryElement.category = category;
+        categoryElement.addStyleClass(category);
+        var label = WebInspector.UIString("All");
+        if (WebInspector.resourceCategories[category])
+            label = WebInspector.resourceCategories[category].title;
+        categoryElement.appendChild(document.createTextNode(label));
+        categoryElement.addEventListener("click", this._updateFilter.bind(this), false);
+        this.filterBarElement.appendChild(categoryElement);
+        return categoryElement;
+    };
+
+    var allElement = createFilterElement.call(this, "all");
+    this.filter(allElement.category);
+    for (var category in this.categories)
+        createFilterElement.call(this, category);
+
     this.reset();
 
     timeGraphItem.select();
@@ -157,6 +166,40 @@ WebInspector.ResourcesPanel = function()
 WebInspector.ResourcesPanel.prototype = {
     toolbarItemClass: "resources",
 
+    get categories()
+    {
+        if (!this._categories) {
+            this._categories = {documents: {color: {r: 47, g: 102, b: 236}}, stylesheets: {color: {r: 157, g: 231, b: 119}}, images: {color: {r: 164, g: 60, b: 255}}, scripts: {color: {r: 255, g: 121, b: 0}}, xhr: {color: {r: 231, g: 231, b: 10}}, fonts: {color: {r: 255, g: 82, b: 62}}, other: {color: {r: 186, g: 186, b: 186}}};
+            for (var category in this._categories) {
+                this._categories[category].title = WebInspector.resourceCategories[category].title;
+            }
+        }
+        return this._categories; 
+    },
+
+    filter: function (category) {
+        if (this._filterCategory && this._filterCategory === category)
+            return;
+
+        if (this._filterCategory) {
+            var filterElement = this.filterBarElement.getElementsByClassName(this._filterCategory)[0];
+            filterElement.removeStyleClass("selected");
+            var oldClass = "filter-" + this._filterCategory;
+            this.resourcesTreeElement.childrenListElement.removeStyleClass(oldClass);
+            this.resourcesGraphsElement.removeStyleClass(oldClass);
+        }
+        this._filterCategory = category;
+        var filterElement = this.filterBarElement.getElementsByClassName(this._filterCategory)[0];
+        filterElement.addStyleClass("selected");
+        var newClass = "filter-" + this._filterCategory;
+        this.resourcesTreeElement.childrenListElement.addStyleClass(newClass);
+        this.resourcesGraphsElement.addStyleClass(newClass);
+    },
+
+    _updateFilter: function (e) {
+        this.filter(e.target.category);
+    },
+
     get toolbarItemLabel()
     {
         return WebInspector.UIString("Resources");
@@ -164,7 +207,7 @@ WebInspector.ResourcesPanel.prototype = {
 
     get statusBarItems()
     {
-        return [this.enableToggleButton, this.largerResourcesButton, this.sortingSelectElement];
+        return [this.enableToggleButton.element, this.largerResourcesButton.element, this.sortingSelectElement];
     },
 
     show: function()
@@ -412,22 +455,20 @@ WebInspector.ResourcesPanel.prototype = {
         this.resourcesTreeElement.removeChildren();
         this.viewsContainerElement.removeChildren();
         this.resourcesGraphsElement.removeChildren();
-        this.legendElement.removeChildren();
+        this.summaryBar.reset();
 
         this._updateGraphDividersIfNeeded(true);
 
-        this._drawSummaryGraph(); // draws an empty graph
-
         if (InspectorController.resourceTrackingEnabled()) {
             this.enableToggleButton.title = WebInspector.UIString("Resource tracking enabled. Click to disable.");
-            this.enableToggleButton.addStyleClass("toggled-on");
-            this.largerResourcesButton.removeStyleClass("hidden");
+            this.enableToggleButton.toggled = true;
+            this.largerResourcesButton.visible = true;
             this.sortingSelectElement.removeStyleClass("hidden");
             this.panelEnablerView.visible = false;
         } else {
             this.enableToggleButton.title = WebInspector.UIString("Resource tracking disabled. Click to enable.");
-            this.enableToggleButton.removeStyleClass("toggled-on");
-            this.largerResourcesButton.addStyleClass("hidden");
+            this.enableToggleButton.toggled = false;
+            this.largerResourcesButton.visible = false;
             this.sortingSelectElement.addStyleClass("hidden");
             this.panelEnablerView.visible = true;
         }
@@ -618,40 +659,6 @@ WebInspector.ResourcesPanel.prototype = {
         this.sidebarTree.handleKeyEvent(event);
     },
 
-    _makeLegendElement: function(label, value, color)
-    {
-        var legendElement = document.createElement("label");
-        legendElement.className = "resources-graph-legend-item";
-
-        if (color) {
-            var swatch = document.createElement("canvas");
-            swatch.className = "resources-graph-legend-swatch";
-            swatch.setAttribute("width", "13");
-            swatch.setAttribute("height", "24");
-
-            legendElement.appendChild(swatch);
-
-            this._drawSwatch(swatch, color);
-        }
-
-        var labelElement = document.createElement("div");
-        labelElement.className = "resources-graph-legend-label";
-        legendElement.appendChild(labelElement);
-
-        var headerElement = document.createElement("div");
-        var headerElement = document.createElement("div");
-        headerElement.className = "resources-graph-legend-header";
-        headerElement.textContent = label;
-        labelElement.appendChild(headerElement);
-
-        var valueElement = document.createElement("div");
-        valueElement.className = "resources-graph-legend-value";
-        valueElement.textContent = value;
-        labelElement.appendChild(valueElement);
-
-        return legendElement;
-    },
-
     _sortResourcesIfNeeded: function()
     {
         var sortedElements = [].concat(this.resourcesTreeElement.children);
@@ -716,282 +723,15 @@ WebInspector.ResourcesPanel.prototype = {
         }
     },
 
-    _fadeOutRect: function(ctx, x, y, w, h, a1, a2)
-    {
-        ctx.save();
-
-        var gradient = ctx.createLinearGradient(x, y, x, y + h);
-        gradient.addColorStop(0.0, "rgba(0, 0, 0, " + (1.0 - a1) + ")");
-        gradient.addColorStop(0.8, "rgba(0, 0, 0, " + (1.0 - a2) + ")");
-        gradient.addColorStop(1.0, "rgba(0, 0, 0, 1.0)");
-
-        ctx.globalCompositeOperation = "destination-out";
-
-        ctx.fillStyle = gradient;
-        ctx.fillRect(x, y, w, h);
-
-        ctx.restore();
-    },
-
-    _drawSwatch: function(canvas, color)
-    {
-        var ctx = canvas.getContext("2d");
-
-        function drawSwatchSquare() {
-            ctx.fillStyle = color;
-            ctx.fillRect(0, 0, 13, 13);
-
-            var gradient = ctx.createLinearGradient(0, 0, 13, 13);
-            gradient.addColorStop(0.0, "rgba(255, 255, 255, 0.2)");
-            gradient.addColorStop(1.0, "rgba(255, 255, 255, 0.0)");
-
-            ctx.fillStyle = gradient;
-            ctx.fillRect(0, 0, 13, 13);
-
-            gradient = ctx.createLinearGradient(13, 13, 0, 0);
-            gradient.addColorStop(0.0, "rgba(0, 0, 0, 0.2)");
-            gradient.addColorStop(1.0, "rgba(0, 0, 0, 0.0)");
-
-            ctx.fillStyle = gradient;
-            ctx.fillRect(0, 0, 13, 13);
-
-            ctx.strokeStyle = "rgba(0, 0, 0, 0.6)";
-            ctx.strokeRect(0.5, 0.5, 12, 12);
-        }
-
-        ctx.clearRect(0, 0, 13, 24);
-
-        drawSwatchSquare();
-
-        ctx.save();
-
-        ctx.translate(0, 25);
-        ctx.scale(1, -1);
-
-        drawSwatchSquare();
-
-        ctx.restore();
-
-        this._fadeOutRect(ctx, 0, 13, 13, 13, 0.5, 0.0);
-    },
-
-    _drawSummaryGraph: function(segments)
-    {
-        if (!this.summaryGraphElement)
-            return;
-
-        if (!segments || !segments.length) {
-            segments = [{color: "white", value: 1}];
-            this._showingEmptySummaryGraph = true;
-        } else
-            delete this._showingEmptySummaryGraph;
-
-        // Calculate the total of all segments.
-        var total = 0;
-        for (var i = 0; i < segments.length; ++i)
-            total += segments[i].value;
-
-        // Calculate the percentage of each segment, rounded to the nearest percent.
-        var percents = segments.map(function(s) { return Math.max(Math.round(100 * s.value / total), 1) });
-
-        // Calculate the total percentage.
-        var percentTotal = 0;
-        for (var i = 0; i < percents.length; ++i)
-            percentTotal += percents[i];
-
-        // Make sure our percentage total is not greater-than 100, it can be greater
-        // if we rounded up for a few segments.
-        while (percentTotal > 100) {
-            for (var i = 0; i < percents.length && percentTotal > 100; ++i) {
-                if (percents[i] > 1) {
-                    --percents[i];
-                    --percentTotal;
-                }
-            }
-        }
-
-        // Make sure our percentage total is not less-than 100, it can be less
-        // if we rounded down for a few segments.
-        while (percentTotal < 100) {
-            for (var i = 0; i < percents.length && percentTotal < 100; ++i) {
-                ++percents[i];
-                ++percentTotal;
-            }
-        }
-
-        var ctx = this.summaryGraphElement.getContext("2d");
-
-        var x = 0;
-        var y = 0;
-        var w = 450;
-        var h = 19;
-        var r = (h / 2);
-
-        function drawPillShadow()
-        {
-            // This draws a line with a shadow that is offset away from the line. The line is stroked
-            // twice with different X shadow offsets to give more feathered edges. Later we erase the
-            // line with destination-out 100% transparent black, leaving only the shadow. This only
-            // works if nothing has been drawn into the canvas yet.
-
-            ctx.beginPath();
-            ctx.moveTo(x + 4, y + h - 3 - 0.5);
-            ctx.lineTo(x + w - 4, y + h - 3 - 0.5);
-            ctx.closePath();
-
-            ctx.save();
-
-            ctx.shadowBlur = 2;
-            ctx.shadowColor = "rgba(0, 0, 0, 0.5)";
-            ctx.shadowOffsetX = 3;
-            ctx.shadowOffsetY = 5;
-
-            ctx.strokeStyle = "white";
-            ctx.lineWidth = 1;
-
-            ctx.stroke();
-
-            ctx.shadowOffsetX = -3;
-
-            ctx.stroke();
-
-            ctx.restore();
-
-            ctx.save();
-
-            ctx.globalCompositeOperation = "destination-out";
-            ctx.strokeStyle = "rgba(0, 0, 0, 1)";
-            ctx.lineWidth = 1;
-
-            ctx.stroke();
-
-            ctx.restore();
-        }
-
-        function drawPill()
-        {
-            // Make a rounded rect path.
-            ctx.beginPath();
-            ctx.moveTo(x, y + r);
-            ctx.lineTo(x, y + h - r);
-            ctx.quadraticCurveTo(x, y + h, x + r, y + h);
-            ctx.lineTo(x + w - r, y + h);
-            ctx.quadraticCurveTo(x + w, y + h, x + w, y + h - r);
-            ctx.lineTo(x + w, y + r);
-            ctx.quadraticCurveTo(x + w, y, x + w - r, y);
-            ctx.lineTo(x + r, y);
-            ctx.quadraticCurveTo(x, y, x, y + r);
-            ctx.closePath();
-
-            // Clip to the rounded rect path.
-            ctx.save();
-            ctx.clip();
-
-            // Fill the segments with the associated color.
-            var previousSegmentsWidth = 0;
-            for (var i = 0; i < segments.length; ++i) {
-                var segmentWidth = Math.round(w * percents[i] / 100);
-                ctx.fillStyle = segments[i].color;
-                ctx.fillRect(x + previousSegmentsWidth, y, segmentWidth, h);
-                previousSegmentsWidth += segmentWidth;
-            }
-
-            // Draw the segment divider lines.
-            ctx.lineWidth = 1;
-            for (var i = 1; i < 20; ++i) {
-                ctx.beginPath();
-                ctx.moveTo(x + (i * Math.round(w / 20)) + 0.5, y);
-                ctx.lineTo(x + (i * Math.round(w / 20)) + 0.5, y + h);
-                ctx.closePath();
-
-                ctx.strokeStyle = "rgba(0, 0, 0, 0.2)";
-                ctx.stroke();
-
-                ctx.beginPath();
-                ctx.moveTo(x + (i * Math.round(w / 20)) + 1.5, y);
-                ctx.lineTo(x + (i * Math.round(w / 20)) + 1.5, y + h);
-                ctx.closePath();
-
-                ctx.strokeStyle = "rgba(255, 255, 255, 0.2)";
-                ctx.stroke();
-            }
-
-            // Draw the pill shading.
-            var lightGradient = ctx.createLinearGradient(x, y, x, y + (h / 1.5));
-            lightGradient.addColorStop(0.0, "rgba(220, 220, 220, 0.6)");
-            lightGradient.addColorStop(0.4, "rgba(220, 220, 220, 0.2)");
-            lightGradient.addColorStop(1.0, "rgba(255, 255, 255, 0.0)");
-
-            var darkGradient = ctx.createLinearGradient(x, y + (h / 3), x, y + h);
-            darkGradient.addColorStop(0.0, "rgba(0, 0, 0, 0.0)");
-            darkGradient.addColorStop(0.8, "rgba(0, 0, 0, 0.2)");
-            darkGradient.addColorStop(1.0, "rgba(0, 0, 0, 0.5)");
-
-            ctx.fillStyle = darkGradient;
-            ctx.fillRect(x, y, w, h);
-
-            ctx.fillStyle = lightGradient;
-            ctx.fillRect(x, y, w, h);
-
-            ctx.restore();
-        }
-
-        ctx.clearRect(x, y, w, (h * 2));
-
-        drawPillShadow();
-        drawPill();
-
-        ctx.save();
-
-        ctx.translate(0, (h * 2) + 1);
-        ctx.scale(1, -1);
-
-        drawPill();
-
-        ctx.restore();
-
-        this._fadeOutRect(ctx, x, y + h + 1, w, h, 0.5, 0.0);
-    },
-
     _updateSummaryGraph: function()
     {
-        var graphInfo = this.calculator.computeSummaryValues(this._resources);
-
-        var categoryOrder = ["documents", "stylesheets", "images", "scripts", "xhr", "fonts", "other"];
-        var categoryColors = {documents: {r: 47, g: 102, b: 236}, stylesheets: {r: 157, g: 231, b: 119}, images: {r: 164, g: 60, b: 255}, scripts: {r: 255, g: 121, b: 0}, xhr: {r: 231, g: 231, b: 10}, fonts: {r: 255, g: 82, b: 62}, other: {r: 186, g: 186, b: 186}};
-        var fillSegments = [];
-
-        this.legendElement.removeChildren();
-
-        for (var i = 0; i < categoryOrder.length; ++i) {
-            var category = categoryOrder[i];
-            var size = graphInfo.categoryValues[category];
-            if (!size)
-                continue;
-
-            var color = categoryColors[category];
-            var colorString = "rgb(" + color.r + ", " + color.g + ", " + color.b + ")";
-
-            var fillSegment = {color: colorString, value: size};
-            fillSegments.push(fillSegment);
-
-            var legendLabel = this._makeLegendElement(WebInspector.resourceCategories[category].title, this.calculator.formatValue(size), colorString);
-            this.legendElement.appendChild(legendLabel);
-        }
-
-        if (graphInfo.total) {
-            var totalLegendLabel = this._makeLegendElement(WebInspector.UIString("Total"), this.calculator.formatValue(graphInfo.total));
-            totalLegendLabel.addStyleClass("total");
-            this.legendElement.appendChild(totalLegendLabel);
-        }
-
-        this._drawSummaryGraph(fillSegments);
+        this.summaryBar.update(this._resources);
     },
 
     _updateDividersLabelBarPosition: function()
     {
         var scrollTop = this.containerElement.scrollTop;
-        var dividersTop = (scrollTop < this.summaryElement.offsetHeight ? this.summaryElement.offsetHeight : scrollTop);
+        var dividersTop = (scrollTop < this.summaryBar.element.offsetHeight ? this.summaryBar.element.offsetHeight : scrollTop);
         this.dividersElement.style.top = scrollTop + "px";
         this.dividersLabelBarElement.style.top = dividersTop + "px";
     },
@@ -1030,12 +770,12 @@ WebInspector.ResourcesPanel.prototype = {
         if (this.resourcesTreeElement.smallChildren) {
             this.resourcesGraphsElement.addStyleClass("small");
             this.largerResourcesButton.title = WebInspector.UIString("Use large resource rows.");
-            this.largerResourcesButton.removeStyleClass("toggled-on");
+            this.largerResourcesButton.toggled = false;
             this._adjustScrollPosition();
         } else {
             this.resourcesGraphsElement.removeStyleClass("small");
             this.largerResourcesButton.title = WebInspector.UIString("Use small resource rows.");
-            this.largerResourcesButton.addStyleClass("toggled-on");
+            this.largerResourcesButton.toggled = true;
         }
     },
 
@@ -1050,7 +790,7 @@ WebInspector.ResourcesPanel.prototype = {
     {
         var selectedOption = this.sortingSelectElement[this.sortingSelectElement.selectedIndex];
         this.sortingFunction = selectedOption.sortingFunction;
-        this.calculator = selectedOption.calculator;
+        this.calculator = this.summaryBar.calculator = selectedOption.calculator;
     },
 
     _createResourceView: function(resource)
@@ -1469,7 +1209,7 @@ WebInspector.ResourceSidebarTreeElement.prototype = {
     
     ondblclick: function(treeElement, event)
     {
-        InspectorController.inspectedWindow().open(this.resource.url);
+        InjectedScriptAccess.openInInspectedWindow(this.resource.url);
     },
 
     get mainTitle()
@@ -1500,6 +1240,11 @@ WebInspector.ResourceSidebarTreeElement.prototype = {
         // Do nothing.
     },
 
+    get selectable()
+    {
+        return WebInspector.panels.resources._filterCategory == "all" || WebInspector.panels.resources._filterCategory == this.resource.category.name;
+    },
+
     createIconElement: function()
     {
         var previousIconElement = this.iconElement;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ScopeChainSidebarPane.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ScopeChainSidebarPane.js
index 157cee9..3875324 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ScopeChainSidebarPane.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ScopeChainSidebarPane.js
@@ -26,6 +26,7 @@
 WebInspector.ScopeChainSidebarPane = function()
 {
     WebInspector.SidebarPane.call(this, WebInspector.UIString("Scope Variables"));
+    this._expandedProperties = [];
 }
 
 WebInspector.ScopeChainSidebarPane.prototype = {
@@ -44,52 +45,41 @@ WebInspector.ScopeChainSidebarPane.prototype = {
             return;
         }
 
-        if (!callFrame._expandedProperties) {
-            // FIXME: fix this when https://bugs.webkit.org/show_bug.cgi?id=19410 is fixed.
-            // The callFrame is a JSInspectedObjectWrapper, so we are not allowed to assign
-            // an object created in the Inspector's context to that object. So create an
-            // Object from the inspectedWindow.
-            var inspectedWindow = InspectorController.inspectedWindow();
-            callFrame._expandedProperties = new inspectedWindow.Object;
-        }
-
         var foundLocalScope = false;
         var scopeChain = callFrame.scopeChain;
         for (var i = 0; i < scopeChain.length; ++i) {
-            var scopeObject = scopeChain[i];
+            var scopeObjectProxy = scopeChain[i];
             var title = null;
-            var subtitle = Object.describe(scopeObject, true);
+            var subtitle = scopeObjectProxy.description;
             var emptyPlaceholder = null;
-            var localScope = false;
             var extraProperties = null;
 
-            if (Object.prototype.toString.call(scopeObject) === "[object JSActivation]") {
-                if (!foundLocalScope) {
-                    extraProperties = { "this": callFrame.thisObject };
+            if (scopeObjectProxy.isLocal) {
+                if (scopeObjectProxy.thisObject) {
+                    extraProperties = [ new WebInspector.ObjectPropertyProxy("this", scopeObjectProxy.thisObject) ];
                     title = WebInspector.UIString("Local");
                 } else
                     title = WebInspector.UIString("Closure");
                 emptyPlaceholder = WebInspector.UIString("No Variables");
                 subtitle = null;
                 foundLocalScope = true;
-                localScope = true;
             } else if (i === (scopeChain.length - 1))
                 title = WebInspector.UIString("Global");
-            else if (foundLocalScope && scopeObject instanceof InspectorController.inspectedWindow().Element)
+            else if (scopeObjectProxy.isElement)
                 title = WebInspector.UIString("Event Target");
-            else if (foundLocalScope && scopeObject instanceof InspectorController.inspectedWindow().Document)
+            else if (scopeObjectProxy.isDocument)
                 title = WebInspector.UIString("Event Document");
-            else if (!foundLocalScope && !localScope)
+            else if (scopeObjectProxy.isWithBlock)
                 title = WebInspector.UIString("With Block");
 
             if (!title || title === subtitle)
                 subtitle = null;
 
-            var section = new WebInspector.ObjectPropertiesSection(scopeObject, title, subtitle, emptyPlaceholder, true, extraProperties, WebInspector.ScopeVariableTreeElement);
+            var section = new WebInspector.ObjectPropertiesSection(scopeObjectProxy, title, subtitle, emptyPlaceholder, true, extraProperties, WebInspector.ScopeVariableTreeElement);
             section.editInSelectedCallFrameWhenPaused = true;
             section.pane = this;
 
-            if (!foundLocalScope || localScope)
+            if (!foundLocalScope || scopeObjectProxy.isLocal)
                 section.expanded = true;
 
             this.sections.push(section);
@@ -100,27 +90,27 @@ WebInspector.ScopeChainSidebarPane.prototype = {
 
 WebInspector.ScopeChainSidebarPane.prototype.__proto__ = WebInspector.SidebarPane.prototype;
 
-WebInspector.ScopeVariableTreeElement = function(parentObject, propertyName)
+WebInspector.ScopeVariableTreeElement = function(property)
 {
-    WebInspector.ObjectPropertyTreeElement.call(this, parentObject, propertyName);
+    WebInspector.ObjectPropertyTreeElement.call(this, property);
 }
 
 WebInspector.ScopeVariableTreeElement.prototype = {
     onattach: function()
     {
         WebInspector.ObjectPropertyTreeElement.prototype.onattach.call(this);
-        if (this.hasChildren && this.propertyIdentifier in this.treeOutline.section.pane.callFrame._expandedProperties)
+        if (this.hasChildren && this.propertyIdentifier in this.treeOutline.section.pane._expandedProperties)
             this.expand();
     },
 
     onexpand: function()
     {
-        this.treeOutline.section.pane.callFrame._expandedProperties[this.propertyIdentifier] = true;
+        this.treeOutline.section.pane._expandedProperties[this.propertyIdentifier] = true;
     },
 
     oncollapse: function()
     {
-        delete this.treeOutline.section.pane.callFrame._expandedProperties[this.propertyIdentifier];
+        delete this.treeOutline.section.pane._expandedProperties[this.propertyIdentifier];
     },
 
     get propertyIdentifier()
@@ -142,9 +132,9 @@ WebInspector.ScopeVariableTreeElement.prototype = {
 
         do {
             if (result)
-                result = current.propertyName + "." + result;
+                result = current.property.name + "." + result;
             else
-                result = current.propertyName;
+                result = current.property.name;
             current = current.parent;
         } while (current && !current.root);
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ScriptsPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ScriptsPanel.js
index 6fcf42f..04f27bb 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ScriptsPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ScriptsPanel.js
@@ -126,6 +126,7 @@ WebInspector.ScriptsPanel = function()
     this.topStatusBar.appendChild(this.sidebarResizeWidgetElement);
 
     this.sidebarPanes = {};
+    this.sidebarPanes.watchExpressions = new WebInspector.WatchExpressionsSidebarPane();
     this.sidebarPanes.callstack = new WebInspector.CallStackSidebarPane();
     this.sidebarPanes.scopechain = new WebInspector.ScopeChainSidebarPane();
     this.sidebarPanes.breakpoints = new WebInspector.BreakpointsSidebarPane();
@@ -151,13 +152,10 @@ WebInspector.ScriptsPanel = function()
     this.element.appendChild(this.sidebarElement);
     this.element.appendChild(this.sidebarResizeElement);
 
-    this.enableToggleButton = document.createElement("button");
-    this.enableToggleButton.className = "enable-toggle-status-bar-item status-bar-item";
+    this.enableToggleButton = new WebInspector.StatusBarButton("", "enable-toggle-status-bar-item");
     this.enableToggleButton.addEventListener("click", this._toggleDebugging.bind(this), false);
 
-    this.pauseOnExceptionButton = document.createElement("button");
-    this.pauseOnExceptionButton.id = "scripts-pause-on-exceptions-status-bar-item";
-    this.pauseOnExceptionButton.className = "status-bar-item";
+    this.pauseOnExceptionButton = new WebInspector.StatusBarButton("", "scripts-pause-on-exceptions-status-bar-item");
     this.pauseOnExceptionButton.addEventListener("click", this._togglePauseOnExceptions.bind(this), false);
 
     this._breakpointsURLMap = {};
@@ -208,7 +206,7 @@ WebInspector.ScriptsPanel.prototype = {
 
     get statusBarItems()
     {
-        return [this.enableToggleButton, this.pauseOnExceptionButton];
+        return [this.enableToggleButton.element, this.pauseOnExceptionButton.element];
     },
 
     get paused()
@@ -286,7 +284,7 @@ WebInspector.ScriptsPanel.prototype = {
                 if (startingLine <= breakpoint.line) {
                     breakpoint.sourceID = sourceID;
                     if (breakpoint.enabled)
-                        InspectorController.addBreakpoint(breakpoint.sourceID, breakpoint.line);
+                        InspectorController.addBreakpoint(breakpoint.sourceID, breakpoint.line, breakpoint.condition);
                 }
             }
         }
@@ -374,36 +372,31 @@ WebInspector.ScriptsPanel.prototype = {
 
     doEvalInCallFrame: function(callFrame, code, callback)
     {
-        var panel = this;
-        function delayedEvaluation()
+        function evalCallback(result)
         {
-            if (!code) {
-                // Evaluate into properties in scope of the selected call frame.
-                callback(panel._variablesInScope(callFrame));
-                return;
-            }
-            try {
-                callback(callFrame.evaluate(code));
-            } catch (e) {
-                callback(e, true);
-            }
+            if (result)
+                callback(result.value, result.isException);
         }
-        setTimeout(delayedEvaluation, 0);
+        InjectedScriptAccess.evaluateInCallFrame(callFrame.id, code, evalCallback);
     },
 
-    _variablesInScope: function(callFrame)
+    variablesInSelectedCallFrame: function()
     {
+        var selectedCallFrame = this.sidebarPanes.callstack.selectedCallFrame;
+        if (!this._paused || !selectedCallFrame)
+            return {};
+
         var result = {};
-        var scopeChain = callFrame.scopeChain;
+        var scopeChain = selectedCallFrame.scopeChain;
         for (var i = 0; i < scopeChain.length; ++i) {
-            var scopeObject = scopeChain[i];
-            for (var property in scopeObject)
-                result[property] = true;
+            var scopeObjectProperties = scopeChain[i].properties;
+            for (var j = 0; j < scopeObjectProperties.length; ++j)
+                result[scopeObjectProperties[j]] = true;
         }
         return result;
     },
 
-    debuggerPaused: function()
+    debuggerPaused: function(callFrames)
     {
         this._paused = true;
         this._waitingToPause = false;
@@ -411,10 +404,8 @@ WebInspector.ScriptsPanel.prototype = {
 
         this._updateDebuggerButtons();
 
-        var callStackPane = this.sidebarPanes.callstack;
-        var currentFrame = InspectorController.currentCallFrame();
-        callStackPane.update(currentFrame, this._sourceIDMap);
-        callStackPane.selectedCallFrame = currentFrame;
+        this.sidebarPanes.callstack.update(callFrames, this._sourceIDMap);
+        this.sidebarPanes.callstack.selectedCallFrame = callFrames[0];
 
         WebInspector.currentPanel = this;
         window.focus();
@@ -481,6 +472,8 @@ WebInspector.ScriptsPanel.prototype = {
         }
 
         this._sourceIDMap = {};
+        
+        this.sidebarPanes.watchExpressions.refreshExpressions();
     },
 
     get visibleView()
@@ -714,6 +707,7 @@ WebInspector.ScriptsPanel.prototype = {
             return;
 
         this.sidebarPanes.scopechain.update(currentFrame);
+        this.sidebarPanes.watchExpressions.refreshExpressions();
 
         var scriptOrResource = this._sourceIDMap[currentFrame.sourceID];
         this._showScriptOrResource(scriptOrResource, currentFrame.line);
@@ -764,10 +758,10 @@ WebInspector.ScriptsPanel.prototype = {
     {
         if (InspectorController.pauseOnExceptions()) {
             this.pauseOnExceptionButton.title = WebInspector.UIString("Don't pause on exceptions.");
-            this.pauseOnExceptionButton.addStyleClass("toggled-on");
+            this.pauseOnExceptionButton.toggled = true;
         } else {
             this.pauseOnExceptionButton.title = WebInspector.UIString("Pause on exceptions.");
-            this.pauseOnExceptionButton.removeStyleClass("toggled-on");
+            this.pauseOnExceptionButton.toggled = false;
         }
     },
 
@@ -775,13 +769,13 @@ WebInspector.ScriptsPanel.prototype = {
     {
         if (InspectorController.debuggerEnabled()) {
             this.enableToggleButton.title = WebInspector.UIString("Debugging enabled. Click to disable.");
-            this.enableToggleButton.addStyleClass("toggled-on");
-            this.pauseOnExceptionButton.removeStyleClass("hidden");
+            this.enableToggleButton.toggled = true;
+            this.pauseOnExceptionButton.visible = true;
             this.panelEnablerView.visible = false;
         } else {
             this.enableToggleButton.title = WebInspector.UIString("Debugging disabled. Click to enable.");
-            this.enableToggleButton.removeStyleClass("toggled-on");
-            this.pauseOnExceptionButton.addStyleClass("hidden");
+            this.enableToggleButton.toggled = false;
+            this.pauseOnExceptionButton.visible = false;
             this.panelEnablerView.visible = true;
         }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceFrame.js b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceFrame.js
index 930eb16..e364cb2 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceFrame.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceFrame.js
@@ -115,7 +115,7 @@ WebInspector.SourceFrame.prototype = {
             this._lineNumberToReveal = lineNumber;
             return;
         }
-    
+
         var row = this.sourceRow(lineNumber);
         if (row)
             row.scrollIntoViewIfNeeded(true);
@@ -199,6 +199,7 @@ WebInspector.SourceFrame.prototype = {
     _loaded: function()
     {
         WebInspector.addMainEventListeners(this.element.contentDocument);
+        this.element.contentDocument.addEventListener("contextmenu", this._documentContextMenu.bind(this), true);
         this.element.contentDocument.addEventListener("mousedown", this._documentMouseDown.bind(this), true);
         this.element.contentDocument.addEventListener("keydown", this._documentKeyDown.bind(this), true);
         this.element.contentDocument.addEventListener("keyup", WebInspector.documentKeyUp.bind(WebInspector), true);
@@ -222,11 +223,18 @@ WebInspector.SourceFrame.prototype = {
         // Add these style rules here since they are specific to the Inspector. They also behave oddly and not
         // all properties apply if added to view-source.css (becuase it is a user agent sheet.)
         var styleText = ".webkit-line-number { background-repeat: no-repeat; background-position: right 1px; }\n";
+        styleText += ".webkit-execution-line .webkit-line-number { color: transparent; background-image: -webkit-canvas(program-counter); }\n";
+
         styleText += ".webkit-breakpoint .webkit-line-number { color: white; background-image: -webkit-canvas(breakpoint); }\n";
         styleText += ".webkit-breakpoint-disabled .webkit-line-number { color: white; background-image: -webkit-canvas(breakpoint-disabled); }\n";
-        styleText += ".webkit-execution-line .webkit-line-number { color: transparent; background-image: -webkit-canvas(program-counter); }\n";
         styleText += ".webkit-breakpoint.webkit-execution-line .webkit-line-number { color: transparent; background-image: -webkit-canvas(breakpoint-program-counter); }\n";
         styleText += ".webkit-breakpoint-disabled.webkit-execution-line .webkit-line-number { color: transparent; background-image: -webkit-canvas(breakpoint-disabled-program-counter); }\n";
+
+        styleText += ".webkit-breakpoint.webkit-breakpoint-conditional .webkit-line-number { color: white; background-image: -webkit-canvas(breakpoint-conditional); }\n";
+        styleText += ".webkit-breakpoint-disabled.webkit-breakpoint-conditional .webkit-line-number { color: white; background-image: -webkit-canvas(breakpoint-disabled-conditional); }\n";
+        styleText += ".webkit-breakpoint.webkit-breakpoint-conditional.webkit-execution-line .webkit-line-number { color: transparent; background-image: -webkit-canvas(breakpoint-conditional-program-counter); }\n";
+        styleText += ".webkit-breakpoint-disabled.webkit-breakpoint-conditional.webkit-execution-line .webkit-line-number { color: transparent; background-image: -webkit-canvas(breakpoint-disabled-conditional-program-counter); }\n";
+
         styleText += ".webkit-execution-line .webkit-line-content { background-color: rgb(171, 191, 254); outline: 1px solid rgb(64, 115, 244); }\n";
         styleText += ".webkit-height-sized-to-fit { overflow-y: hidden }\n";
         styleText += ".webkit-line-content { background-color: white; }\n";
@@ -237,6 +245,15 @@ WebInspector.SourceFrame.prototype = {
         styleText += ".webkit-javascript-number { color: rgb(28, 0, 207); }\n";
         styleText += ".webkit-javascript-string, .webkit-javascript-regexp { color: rgb(196, 26, 22); }\n";
 
+        // TODO: Move these styles into inspector.css once https://bugs.webkit.org/show_bug.cgi?id=28913 is fixed and popup moved into the top frame.
+        styleText += ".popup-content { position: absolute; z-index: 10000; padding: 4px; background-color: rgb(203, 226, 255); -webkit-border-radius: 7px; border: 2px solid rgb(169, 172, 203); }";
+        styleText += ".popup-glasspane { position: absolute; top: 0; left: 0; height: 100%; width: 100%; opacity: 0; z-index: 9900; }";
+        styleText += ".popup-message { background-color: transparent; font-family: Lucida Grande, sans-serif; font-weight: normal; font-size: 11px; text-align: left; text-shadow: none; color: rgb(85, 85, 85); cursor: default; margin: 0 0 2px 0; }";
+        styleText += ".popup-content.breakpoint-condition { width: 90%; }";
+        styleText += ".popup-content input#bp-condition { font-family: monospace; margin: 0; border: 1px inset rgb(190, 190, 190) !important; width: 100%; box-shadow: none !important; outline: none !important; -webkit-user-modify: read-write; }";
+        // This class is already in inspector.css
+        styleText += ".hidden { display: none !important; }";
+        
         styleElement.textContent = styleText;
 
         this._needsProgramCounterImage = true;
@@ -244,8 +261,12 @@ WebInspector.SourceFrame.prototype = {
 
         this.element.contentWindow.Element.prototype.addStyleClass = Element.prototype.addStyleClass;
         this.element.contentWindow.Element.prototype.removeStyleClass = Element.prototype.removeStyleClass;
+        this.element.contentWindow.Element.prototype.positionAt = Element.prototype.positionAt;
         this.element.contentWindow.Element.prototype.removeMatchingStyleClasses = Element.prototype.removeMatchingStyleClasses;
         this.element.contentWindow.Element.prototype.hasStyleClass = Element.prototype.hasStyleClass;
+        this.element.contentWindow.Element.prototype.pageOffsetRelativeToWindow = Element.prototype.pageOffsetRelativeToWindow;
+        this.element.contentWindow.Element.prototype.__defineGetter__("totalOffsetLeft", Element.prototype.__lookupGetter__("totalOffsetLeft"));
+        this.element.contentWindow.Element.prototype.__defineGetter__("totalOffsetTop", Element.prototype.__lookupGetter__("totalOffsetTop"));
         this.element.contentWindow.Node.prototype.enclosingNodeOrSelfWithNodeName = Node.prototype.enclosingNodeOrSelfWithNodeName;
         this.element.contentWindow.Node.prototype.enclosingNodeOrSelfWithNodeNameInArray = Node.prototype.enclosingNodeOrSelfWithNodeNameInArray;
 
@@ -257,20 +278,20 @@ WebInspector.SourceFrame.prototype = {
 
         if (this.autoSizesToFitContentHeight)
             this.sizeToFitContentHeight();
-            
+
         if (this._lineNumberToReveal) {
             this.revealLine(this._lineNumberToReveal);
             delete this._lineNumberToReveal;
         }
-    
+
         if (this._lineNumberToHighlight) {
             this.highlightLine(this._lineNumberToHighlight);
             delete this._lineNumberToHighlight;
         }
-        
+
         this.dispatchEventToListeners("content loaded");
     },
-    
+
     _isContentLoaded: function() {
         var doc = this.element.contentDocument;
         return doc && doc.getElementsByTagName("table")[0];
@@ -283,18 +304,102 @@ WebInspector.SourceFrame.prototype = {
         this.sizeToFitContentHeight();
     },
 
-    _documentMouseDown: function(event)
+    _documentContextMenu: function(event)
     {
         if (!event.target.hasStyleClass("webkit-line-number"))
             return;
+        var sourceRow = event.target.enclosingNodeOrSelfWithNodeName("tr");
+        if (!sourceRow._breakpointObject && this.addBreakpointDelegate)
+            this.addBreakpointDelegate(this.lineNumberForSourceRow(sourceRow));
+        
+        var breakpoint = sourceRow._breakpointObject;
+        if (!breakpoint)
+            return;
+        
+        this._editBreakpointCondition(event.target, sourceRow, breakpoint);
+        event.preventDefault();
+    },
 
+    _documentMouseDown: function(event)
+    {
+        if (!event.target.hasStyleClass("webkit-line-number"))
+            return;
+        if (event.button != 0 || event.altKey || event.ctrlKey || event.metaKey || event.shiftKey)
+            return;
         var sourceRow = event.target.enclosingNodeOrSelfWithNodeName("tr");
-        if (sourceRow._breakpointObject)
-            sourceRow._breakpointObject.enabled = !sourceRow._breakpointObject.enabled;
+        if (sourceRow._breakpointObject && sourceRow._breakpointObject.enabled)
+            sourceRow._breakpointObject.enabled = false;
+        else if (sourceRow._breakpointObject)
+            WebInspector.panels.scripts.removeBreakpoint(sourceRow._breakpointObject);
         else if (this.addBreakpointDelegate)
             this.addBreakpointDelegate(this.lineNumberForSourceRow(sourceRow));
     },
 
+    _editBreakpointCondition: function(eventTarget, sourceRow, breakpoint)
+    {
+        // TODO: Migrate the popup to the top-level document and remove the blur listener from conditionElement once https://bugs.webkit.org/show_bug.cgi?id=28913 is fixed.
+        var popupDocument = this.element.contentDocument;
+        this._showBreakpointConditionPopup(eventTarget, breakpoint.line, popupDocument);
+        
+        function committed(element, newText)
+        {
+            breakpoint.condition = newText;
+            if (breakpoint.condition)
+                sourceRow.addStyleClass("webkit-breakpoint-conditional");
+            else
+                sourceRow.removeStyleClass("webkit-breakpoint-conditional");
+            dismissed.call(this);
+        }
+
+        function dismissed()
+        {
+            this._popup.hide();
+            delete this._conditionEditorElement;
+        }
+
+        var dismissedHandler = dismissed.bind(this);
+        this._conditionEditorElement.addEventListener("blur", dismissedHandler, false);
+        
+        WebInspector.startEditing(this._conditionEditorElement, committed.bind(this), dismissedHandler);
+        this._conditionEditorElement.value = breakpoint.condition;
+        this._conditionEditorElement.select();
+    },
+
+    _showBreakpointConditionPopup: function(clickedElement, lineNumber, popupDocument)
+    {
+        var popupContentElement = this._createPopupElement(lineNumber, popupDocument);
+        var lineElement = clickedElement.enclosingNodeOrSelfWithNodeName("td").nextSibling;
+        if (this._popup) {
+            this._popup.hide();
+            this._popup.element = popupContentElement;
+        } else {
+            this._popup = new WebInspector.Popup(popupContentElement);
+            this._popup.autoHide = true;
+        }
+        this._popup.anchor = lineElement;
+        this._popup.show();
+    },
+
+    _createPopupElement: function(lineNumber, popupDocument)
+    {
+        var popupContentElement = popupDocument.createElement("div");
+        popupContentElement.className = "popup-content breakpoint-condition";
+
+        var labelElement = document.createElement("label");
+        labelElement.className = "popup-message";
+        labelElement.htmlFor = "bp-condition";
+        labelElement.appendChild(document.createTextNode(WebInspector.UIString("The breakpoint on line %d will stop only if this expression is true:", lineNumber)));
+        popupContentElement.appendChild(labelElement);
+
+        var editorElement = document.createElement("input");
+        editorElement.id = "bp-condition";
+        editorElement.type = "text"
+        popupContentElement.appendChild(editorElement);
+        this._conditionEditorElement = editorElement;
+
+        return popupContentElement;
+    },
+
     _documentKeyDown: function(event)
     {
         var shortcut = WebInspector.KeyboardShortcut.makeKeyFromEvent(event);
@@ -380,6 +485,8 @@ WebInspector.SourceFrame.prototype = {
         sourceRow.addStyleClass("webkit-breakpoint");
         if (!breakpoint.enabled)
             sourceRow.addStyleClass("webkit-breakpoint-disabled");
+        if (breakpoint.condition)
+            sourceRow.addStyleClass("webkit-breakpoint-conditional");
     },
 
     _removeBreakpointFromSource: function(breakpoint)
@@ -392,8 +499,9 @@ WebInspector.SourceFrame.prototype = {
 
         sourceRow.removeStyleClass("webkit-breakpoint");
         sourceRow.removeStyleClass("webkit-breakpoint-disabled");
+        sourceRow.removeStyleClass("webkit-breakpoint-conditional");
     },
-    
+
     _incrementMessageRepeatCount: function(msg, repeatDelta)
     {
         if (!msg._resourceMessageLineElement)
@@ -518,12 +626,12 @@ WebInspector.SourceFrame.prototype = {
         delete this._needsProgramCounterImage;
     },
 
-    _drawBreakpointImagesIfNeeded: function()
+    _drawBreakpointImagesIfNeeded: function(conditional)
     {
         if (!this._needsBreakpointImages || !this.element.contentDocument)
             return;
 
-        function drawBreakpoint(ctx, disabled)
+        function drawBreakpoint(ctx, disabled, conditional)
         {
             ctx.beginPath();
             ctx.moveTo(0, 2);
@@ -534,8 +642,8 @@ WebInspector.SourceFrame.prototype = {
             ctx.lineTo(2, 11);
             ctx.lineTo(0, 9);
             ctx.closePath();
-            ctx.fillStyle = "rgb(1, 142, 217)";
-            ctx.strokeStyle = "rgb(0, 103, 205)";
+            ctx.fillStyle = conditional ? "rgb(217, 142, 1)" : "rgb(1, 142, 217)";
+            ctx.strokeStyle = conditional ? "rgb(205, 103, 0)" : "rgb(0, 103, 205)";
             ctx.lineWidth = 3;
             ctx.fill();
             ctx.save();
@@ -553,6 +661,9 @@ WebInspector.SourceFrame.prototype = {
             ctx.restore();
         }
 
+
+        // Unconditional breakpoints.
+
         var ctx = this.element.contentDocument.getCSSCanvasContext("2d", "breakpoint", 26, 11);
         ctx.clearRect(0, 0, 26, 11);
         drawBreakpoint(ctx);
@@ -573,6 +684,29 @@ WebInspector.SourceFrame.prototype = {
         ctx.clearRect(20, 0, 6, 11);
         this._drawProgramCounterInContext(ctx, true);
 
+
+        // Conditional breakpoints.
+
+        var ctx = this.element.contentDocument.getCSSCanvasContext("2d", "breakpoint-conditional", 26, 11);
+        ctx.clearRect(0, 0, 26, 11);
+        drawBreakpoint(ctx, false, true);
+
+        var ctx = this.element.contentDocument.getCSSCanvasContext("2d", "breakpoint-conditional-program-counter", 26, 11);
+        ctx.clearRect(0, 0, 26, 11);
+        drawBreakpoint(ctx, false, true);
+        ctx.clearRect(20, 0, 6, 11);
+        this._drawProgramCounterInContext(ctx, true);
+
+        var ctx = this.element.contentDocument.getCSSCanvasContext("2d", "breakpoint-disabled-conditional", 26, 11);
+        ctx.clearRect(0, 0, 26, 11);
+        drawBreakpoint(ctx, true, true);
+
+        var ctx = this.element.contentDocument.getCSSCanvasContext("2d", "breakpoint-disabled-conditional-program-counter", 26, 11);
+        ctx.clearRect(0, 0, 26, 11);
+        drawBreakpoint(ctx, true, true);
+        ctx.clearRect(20, 0, 6, 11);
+        this._drawProgramCounterInContext(ctx, true);
+
         delete this._needsBreakpointImages;
     },
 
@@ -769,3 +903,4 @@ WebInspector.SourceFrame.prototype = {
 }
 
 WebInspector.SourceFrame.prototype.__proto__ = WebInspector.Object.prototype;
+
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/StatusBarButton.js b/src/3rdparty/webkit/WebCore/inspector/front-end/StatusBarButton.js
new file mode 100644
index 0000000..5c69ed5
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/StatusBarButton.js
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.StatusBarButton = function(title, className)
+{
+    this.element = document.createElement("button");
+    this.element.className = className + " status-bar-item";
+    this.element.addEventListener("click", this._clicked.bind(this), false);
+
+    this.glyph = document.createElement("div");
+    this.glyph.className = "glyph";
+    this.element.appendChild(this.glyph);
+
+    this.glyphShadow = document.createElement("div");
+    this.glyphShadow.className = "glyph shadow";
+    this.element.appendChild(this.glyphShadow);
+
+    this.title = title;
+    this.disabled = false;
+    this._toggled = false;
+    this._visible = true;
+}
+
+WebInspector.StatusBarButton.prototype = {
+    _clicked: function()
+    {
+        this.dispatchEventToListeners("click");
+    },
+
+    get disabled()
+    {
+        return this._disabled;
+    },
+
+    set disabled(x)
+    {
+        if (this._disabled === x)
+            return;
+        this._disabled = x;
+        this.element.disabled = x;
+    },
+
+    get title()
+    {
+        return this._title;
+    },
+
+    set title(x)
+    {
+        if (this._title === x)
+            return;
+        this._title = x;
+        this.element.title = x;
+    },
+
+    get toggled()
+    {
+        return this._toggled;
+    },
+
+    set toggled(x)
+    {
+        if (this._toggled === x)
+            return;
+
+        if (x)
+            this.element.addStyleClass("toggled-on");
+        else
+            this.element.removeStyleClass("toggled-on");
+        this._toggled = x;
+    },
+
+    get visible()
+    {
+        return this._visible;
+    },
+
+    set visible(x)
+    {
+        if (this._visible === x)
+            return;
+
+        if (x)
+            this.element.removeStyleClass("hidden");
+        else
+            this.element.addStyleClass("hidden");
+        this._visible = x;
+    }
+}
+
+WebInspector.StatusBarButton.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DatabasesPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/StoragePanel.js
index b1d815f..aed0d06 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/DatabasesPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/StoragePanel.js
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2007, 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Joseph Pecoraro
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,12 +27,12 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.DatabasesPanel = function(database)
+WebInspector.StoragePanel = function(database)
 {
     WebInspector.Panel.call(this);
 
     this.sidebarElement = document.createElement("div");
-    this.sidebarElement.id = "databases-sidebar";
+    this.sidebarElement.id = "storage-sidebar";
     this.sidebarElement.className = "sidebar";
     this.element.appendChild(this.sidebarElement);
 
@@ -58,6 +59,13 @@ WebInspector.DatabasesPanel = function(database)
     this.sidebarTree.appendChild(this.sessionStorageListTreeElement);
     this.sessionStorageListTreeElement.expand();
 
+    this.cookieListTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("COOKIES"), {}, true);
+    this.sidebarTree.appendChild(this.cookieListTreeElement);
+    this.cookieListTreeElement.expand();
+
+    this.cookieTreeElement = new WebInspector.CookieSidebarTreeElement();
+    this.cookieListTreeElement.appendChild(this.cookieTreeElement);
+
     this.storageViews = document.createElement("div");
     this.storageViews.id = "storage-views";
     this.element.appendChild(this.storageViews);
@@ -68,12 +76,12 @@ WebInspector.DatabasesPanel = function(database)
     this.reset();
 }
 
-WebInspector.DatabasesPanel.prototype = {
-    toolbarItemClass: "databases",
+WebInspector.StoragePanel.prototype = {
+    toolbarItemClass: "storage",
 
     get toolbarItemLabel()
     {
-        return WebInspector.UIString("Databases");
+        return WebInspector.UIString("Storage");
     },
 
     get statusBarItems()
@@ -85,6 +93,7 @@ WebInspector.DatabasesPanel.prototype = {
     {
         WebInspector.Panel.prototype.show.call(this);
         this._updateSidebarWidth();
+        this._registerStorageEventListener();
     },
 
     reset: function()
@@ -101,6 +110,8 @@ WebInspector.DatabasesPanel.prototype = {
 
         this._databases = [];
 
+        this._unregisterStorageEventListener();
+
         if (this._domStorage) {
             var domStorageLength = this._domStorage.length;
             for (var i = 0; i < domStorageLength; ++i) {
@@ -112,12 +123,17 @@ WebInspector.DatabasesPanel.prototype = {
 
         this._domStorage = [];
 
+        delete this._cookieView;
+
         this.databasesListTreeElement.removeChildren();
         this.localStorageListTreeElement.removeChildren();
         this.sessionStorageListTreeElement.removeChildren();
-        this.storageViews.removeChildren();
-        
+        this.storageViews.removeChildren();        
+
         this.storageViewStatusBarItemsContainer.removeChildren();
+        
+        if (this.sidebarTree.selectedTreeElement)
+            this.sidebarTree.selectedTreeElement.deselect();
     },
 
     handleKeyEvent: function(event)
@@ -137,7 +153,7 @@ WebInspector.DatabasesPanel.prototype = {
     addDOMStorage: function(domStorage)
     {
         this._domStorage.push(domStorage);
-        var domStorageTreeElement = new WebInspector.DOMStorageSidebarTreeElement(domStorage);
+        var domStorageTreeElement = new WebInspector.DOMStorageSidebarTreeElement(domStorage, (domStorage.isLocalStorage ? "local-storage" : "session-storage"));
         domStorage._domStorageTreeElement = domStorageTreeElement;
         if (domStorage.isLocalStorage)
             this.localStorageListTreeElement.appendChild(domStorageTreeElement);
@@ -145,6 +161,32 @@ WebInspector.DatabasesPanel.prototype = {
             this.sessionStorageListTreeElement.appendChild(domStorageTreeElement);
     },
 
+    selectDatabase: function(db)
+    {
+        var database;
+        for (var i = 0, len = this._databases.length; i < len; ++i) {
+            database = this._databases[i];
+            if (database.isDatabase(db)) {
+                this.showDatabase(database);
+                database._databasesTreeElement.select();
+                return;
+            }
+        }
+    },
+
+    selectDOMStorage: function(s)
+    {
+        var isLocalStorage = (s === InspectorController.inspectedWindow().localStorage);
+        for (var i = 0, len = this._domStorage.length; i < len; ++i) {
+            var storage = this._domStorage[i];
+            if ( isLocalStorage === storage.isLocalStorage ) {
+                this.showDOMStorage(storage);
+                storage._domStorageTreeElement.select();
+                return;
+            }
+        }
+    },
+
     showDatabase: function(database, tableName)
     {
         if (!database)
@@ -175,9 +217,9 @@ WebInspector.DatabasesPanel.prototype = {
         this.visibleView = view;
 
         this.storageViewStatusBarItemsContainer.removeChildren();
-        var statusBarItems = view.statusBarItems;
+        var statusBarItems = view.statusBarItems || [];
         for (var i = 0; i < statusBarItems.length; ++i)
-            this.storageViewStatusBarItemsContainer.appendChild(statusBarItems[i]);
+            this.storageViewStatusBarItemsContainer.appendChild(statusBarItems[i].element);
     },
 
     showDOMStorage: function(domStorage)
@@ -205,6 +247,27 @@ WebInspector.DatabasesPanel.prototype = {
             this.storageViewStatusBarItemsContainer.appendChild(statusBarItems[i]);
     },
 
+    showCookies: function()
+    {
+        if (this.visibleView)
+            this.visibleView.hide();
+
+        var view = this._cookieView;
+        if (!view) {
+            view = new WebInspector.CookieItemsView();
+            this._cookieView = view;
+        }
+
+        view.show(this.storageViews);
+
+        this.visibleView = view;
+
+        this.storageViewStatusBarItemsContainer.removeChildren();
+        var statusBarItems = view.statusBarItems;
+        for (var i = 0; i < statusBarItems.length; ++i)
+            this.storageViewStatusBarItemsContainer.appendChild(statusBarItems[i]);
+    },
+
     closeVisibleView: function()
     {
         if (this.visibleView)
@@ -223,18 +286,22 @@ WebInspector.DatabasesPanel.prototype = {
             return;
 
         var tableNamesHash = {};
-        var tableNames = database.tableNames;
-        var tableNamesLength = tableNames.length;
-        for (var i = 0; i < tableNamesLength; ++i)
-            tableNamesHash[tableNames[i]] = true;
-
-        for (var tableName in database._tableViews) {
-            if (!(tableName in tableNamesHash)) {
-                if (this.visibleView === database._tableViews[tableName])
-                    this.closeVisibleView();
-                delete database._tableViews[tableName];
+        var self = this;
+        function tableNamesCallback(tableNames)
+        {
+            var tableNamesLength = tableNames.length;
+            for (var i = 0; i < tableNamesLength; ++i)
+                tableNamesHash[tableNames[i]] = true;
+
+            for (var tableName in database._tableViews) {
+                if (!(tableName in tableNamesHash)) {
+                    if (self.visibleView === database._tableViews[tableName])
+                        self.closeVisibleView();
+                    delete database._tableViews[tableName];
+                }
             }
         }
+        database.getTableNames(tableNamesCallback);
     },
 
     dataGridForResult: function(result)
@@ -327,7 +394,7 @@ WebInspector.DatabasesPanel.prototype = {
         columns[0].title = WebInspector.UIString("Key");
         columns[0].width = columns[0].title.length;
         columns[1].title = WebInspector.UIString("Value");
-        columns[1].width = columns[0].title.length;
+        columns[1].width = columns[1].title.length;
 
         var nodes = [];
         
@@ -350,7 +417,7 @@ WebInspector.DatabasesPanel.prototype = {
         }
 
         var totalColumnWidths = columns[0].width + columns[1].width;
-        width = Math.round((columns[0].width * 100) / totalColumnWidths);
+        var width = Math.round((columns[0].width * 100) / totalColumnWidths);
         const minimumPrecent = 10;
         if (width < minimumPrecent)
             width = minimumPrecent;
@@ -365,11 +432,59 @@ WebInspector.DatabasesPanel.prototype = {
         var length = nodes.length;
         for (var i = 0; i < length; ++i)
             dataGrid.appendChild(nodes[i]);
+        dataGrid.addCreationNode(false);
         if (length > 0)
             nodes[0].selected = true;
         return dataGrid;
     },
 
+    resize: function()
+    {
+        var visibleView = this.visibleView;
+        if (visibleView && "resize" in visibleView)
+            visibleView.resize();
+    },
+
+    _registerStorageEventListener: function()
+    {
+        var inspectedWindow = InspectorController.inspectedWindow();
+        if (!inspectedWindow || !inspectedWindow.document)
+            return;
+
+        this._storageEventListener = InspectorController.wrapCallback(this._storageEvent.bind(this));
+        inspectedWindow.addEventListener("storage", this._storageEventListener, true);
+    },
+
+    _unregisterStorageEventListener: function()
+    {
+        if (!this._storageEventListener)
+            return;
+
+        var inspectedWindow = InspectorController.inspectedWindow();
+        if (!inspectedWindow || !inspectedWindow.document)
+            return;
+
+        inspectedWindow.removeEventListener("storage", this._storageEventListener, true);
+        delete this._storageEventListener;
+    },
+
+    _storageEvent: function(event)
+    {
+        if (!this._domStorage)
+            return;
+
+        var isLocalStorage = (event.storageArea === InspectorController.inspectedWindow().localStorage);
+        var domStorageLength = this._domStorage.length;
+        for (var i = 0; i < domStorageLength; ++i) {
+            var domStorage = this._domStorage[i];
+            if (isLocalStorage === domStorage.isLocalStorage) {
+                var view = domStorage._domStorageView;
+                if (this.visibleView && view === this.visibleView)
+                    domStorage._domStorageView.update();
+            }
+        }
+    },
+
     _startSidebarDragging: function(event)
     {
         WebInspector.elementDragStart(this.sidebarResizeElement, this._sidebarDragging.bind(this), this._endSidebarDragging.bind(this), event, "col-resize");
@@ -409,10 +524,14 @@ WebInspector.DatabasesPanel.prototype = {
         this.storageViews.style.left = width + "px";
         this.storageViewStatusBarItemsContainer.style.left = width + "px";
         this.sidebarResizeElement.style.left = (width - 3) + "px";
+        
+        var visibleView = this.visibleView;
+        if (visibleView && "resize" in visibleView)
+            visibleView.resize();
     }
 }
 
-WebInspector.DatabasesPanel.prototype.__proto__ = WebInspector.Panel.prototype;
+WebInspector.StoragePanel.prototype.__proto__ = WebInspector.Panel.prototype;
 
 WebInspector.DatabaseSidebarTreeElement = function(database)
 {
@@ -426,7 +545,7 @@ WebInspector.DatabaseSidebarTreeElement = function(database)
 WebInspector.DatabaseSidebarTreeElement.prototype = {
     onselect: function()
     {
-        WebInspector.panels.databases.showDatabase(this.database);
+        WebInspector.panels.storage.showDatabase(this.database);
     },
 
     oncollapse: function()
@@ -440,10 +559,14 @@ WebInspector.DatabaseSidebarTreeElement.prototype = {
     {
         this.removeChildren();
 
-        var tableNames = this.database.tableNames;
-        var tableNamesLength = tableNames.length;
-        for (var i = 0; i < tableNamesLength; ++i)
-            this.appendChild(new WebInspector.SidebarDatabaseTableTreeElement(this.database, tableNames[i]));
+        var self = this;
+        function tableNamesCallback(tableNames)
+        {
+            var tableNamesLength = tableNames.length;
+            for (var i = 0; i < tableNamesLength; ++i)
+                self.appendChild(new WebInspector.SidebarDatabaseTableTreeElement(self.database, tableNames[i]));
+        }
+        this.database.getTableNames(tableNamesCallback);
     },
 
     get mainTitle()
@@ -480,18 +603,18 @@ WebInspector.SidebarDatabaseTableTreeElement = function(database, tableName)
 WebInspector.SidebarDatabaseTableTreeElement.prototype = {
     onselect: function()
     {
-        WebInspector.panels.databases.showDatabase(this.database, this.tableName);
+        WebInspector.panels.storage.showDatabase(this.database, this.tableName);
     }
 }
 
 WebInspector.SidebarDatabaseTableTreeElement.prototype.__proto__ = WebInspector.SidebarTreeElement.prototype;
 
-WebInspector.DOMStorageSidebarTreeElement = function(domStorage)
+WebInspector.DOMStorageSidebarTreeElement = function(domStorage, className)
 {
 
     this.domStorage = domStorage;
 
-    WebInspector.SidebarTreeElement.call(this, "domstorage-sidebar-tree-item", domStorage, "", null, false);
+    WebInspector.SidebarTreeElement.call(this, "domstorage-sidebar-tree-item " + className, domStorage, "", null, false);
 
     this.refreshTitles();
 }
@@ -499,7 +622,7 @@ WebInspector.DOMStorageSidebarTreeElement = function(domStorage)
 WebInspector.DOMStorageSidebarTreeElement.prototype = {
     onselect: function()
     {
-        WebInspector.panels.databases.showDOMStorage(this.domStorage);
+        WebInspector.panels.storage.showDOMStorage(this.domStorage);
     },
 
     get mainTitle()
@@ -524,3 +647,39 @@ WebInspector.DOMStorageSidebarTreeElement.prototype = {
 }
 
 WebInspector.DOMStorageSidebarTreeElement.prototype.__proto__ = WebInspector.SidebarTreeElement.prototype;
+
+WebInspector.CookieSidebarTreeElement = function()
+{
+    WebInspector.SidebarTreeElement.call(this, "cookie-sidebar-tree-item", null, "", null, false);
+
+    this.refreshTitles();
+}
+
+WebInspector.CookieSidebarTreeElement.prototype = {
+    onselect: function()
+    {
+        WebInspector.panels.storage.showCookies();
+    },
+
+    get mainTitle()
+    {
+        return WebInspector.UIString("Cookies");
+    },
+
+    set mainTitle(x)
+    {
+        // Do nothing.
+    },
+
+    get subtitle()
+    {
+        return "";
+    },
+
+    set subtitle(x)
+    {
+        // Do nothing.
+    }
+}
+
+WebInspector.CookieSidebarTreeElement.prototype.__proto__ = WebInspector.SidebarTreeElement.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/StylesSidebarPane.js b/src/3rdparty/webkit/WebCore/inspector/front-end/StylesSidebarPane.js
index 1785d77..6185aff 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/StylesSidebarPane.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/StylesSidebarPane.js
@@ -30,6 +30,44 @@
 WebInspector.StylesSidebarPane = function()
 {
     WebInspector.SidebarPane.call(this, WebInspector.UIString("Styles"));
+
+    this.settingsSelectElement = document.createElement("select");
+
+    var option = document.createElement("option");
+    option.value = "hex";
+    option.action = this._changeColorFormat.bind(this);
+    if (Preferences.colorFormat === "hex")
+        option.selected = true;
+    option.label = WebInspector.UIString("Hex Colors");
+    this.settingsSelectElement.appendChild(option);
+
+    option = document.createElement("option");
+    option.value = "rgb";
+    option.action = this._changeColorFormat.bind(this);
+    if (Preferences.colorFormat === "rgb")
+        option.selected = true;
+    option.label = WebInspector.UIString("RGB Colors");
+    this.settingsSelectElement.appendChild(option);
+
+    option = document.createElement("option");
+    option.value = "hsl";
+    option.action = this._changeColorFormat.bind(this);
+    if (Preferences.colorFormat === "hsl")
+        option.selected = true;
+    option.label = WebInspector.UIString("HSL Colors");
+    this.settingsSelectElement.appendChild(option);
+
+    this.settingsSelectElement.appendChild(document.createElement("hr"));
+
+    option = document.createElement("option");
+    option.action = this._createNewRule.bind(this);
+    option.label = WebInspector.UIString("New Style Rule");
+    this.settingsSelectElement.appendChild(option);
+
+    this.settingsSelectElement.addEventListener("click", function(event) { event.stopPropagation() }, false);
+    this.settingsSelectElement.addEventListener("change", this._changeSetting.bind(this), false);
+
+    this.titleElement.appendChild(this.settingsSelectElement);
 }
 
 WebInspector.StylesSidebarPane.prototype = {
@@ -63,14 +101,35 @@ WebInspector.StylesSidebarPane.prototype = {
         if (!node)
             return;
 
+        var self = this;
+        function callback(styles)
+        {
+            if (!styles)
+                return;
+            node._setStyles(styles.computedStyle, styles.inlineStyle, styles.styleAttributes, styles.matchedCSSRules);
+            self._update(refresh, body, node, editedSection, forceUpdate);
+        }
+
+        InjectedScriptAccess.getStyles(node.id, !Preferences.showUserAgentStyles, callback);
+    },
+
+    _update: function(refresh, body, node, editedSection, forceUpdate)
+    {
+        if (!refresh) {
+            body.removeChildren();
+            this.sections = [];
+        }
+
         var styleRules = [];
 
         if (refresh) {
             for (var i = 0; i < this.sections.length; ++i) {
                 var section = this.sections[i];
+                if (section instanceof WebInspector.BlankStylePropertiesSection)
+                    continue;
                 if (section.computedStyle)
                     section.styleRule.style = node.ownerDocument.defaultView.getComputedStyle(node);
-                var styleRule = { section: section, style: section.styleRule.style, computedStyle: section.computedStyle };
+                var styleRule = { section: section, style: section.styleRule.style, computedStyle: section.computedStyle, rule: section.rule };
                 styleRules.push(styleRule);
             }
         } else {
@@ -91,8 +150,9 @@ WebInspector.StylesSidebarPane.prototype = {
                 }
             }
 
-            if (node.style && (node.style.length || Object.hasProperties(node.style.__disabledProperties))) {
-                var inlineStyle = { selectorText: WebInspector.UIString("Inline Style Attribute"), style: node.style };
+            // Always Show element's Style Attributes
+            if (node.nodeType === Node.ELEMENT_NODE) {
+                var inlineStyle = { selectorText: WebInspector.UIString("Style Attribute"), style: node.style, isAttribute: true };
                 inlineStyle.subtitle = WebInspector.UIString("element’s “%s” attribute", "style");
                 styleRules.push(inlineStyle);
             }
@@ -102,7 +162,7 @@ WebInspector.StylesSidebarPane.prototype = {
                 // Add rules in reverse order to match the cascade order.
                 for (var i = (matchedStyleRules.length - 1); i >= 0; --i) {
                     var rule = matchedStyleRules[i];
-                    styleRules.push({ style: rule.style, selectorText: rule.selectorText, parentStyleSheet: rule.parentStyleSheet });
+                    styleRules.push({ style: rule.style, selectorText: rule.selectorText, parentStyleSheet: rule.parentStyleSheet, rule: rule });
                 }
             }
         }
@@ -128,6 +188,8 @@ WebInspector.StylesSidebarPane.prototype = {
             var styleRule = styleRules[i];
             if (styleRule.computedStyle)
                 continue;
+            if (styleRule.section && styleRule.section.noAffect)
+                continue;
 
             styleRule.usedProperties = {};
 
@@ -182,7 +244,7 @@ WebInspector.StylesSidebarPane.prototype = {
                     continue;
 
                 var style = styleRules[i].style;
-                var uniqueProperties = getUniqueStyleProperties(style);
+                var uniqueProperties = style.uniqueStyleProperties;
                 for (var j = 0; j < uniqueProperties.length; ++j) {
                     var name = uniqueProperties[j];
                     if (style.getPropertyPriority(name).length) {
@@ -223,6 +285,9 @@ WebInspector.StylesSidebarPane.prototype = {
                 var editable = styleRule.editable;
                 delete styleRule.editable;
 
+                var isAttribute = styleRule.isAttribute;
+                delete styleRule.isAttribute;
+
                 // Default editable to true if it was omitted.
                 if (typeof editable === "undefined")
                     editable = true;
@@ -236,6 +301,8 @@ WebInspector.StylesSidebarPane.prototype = {
                     section.expanded = Preferences.styleRulesExpandedState[section.identifier];
                 else if (computedStyle)
                     section.collapse(true);
+                else if (isAttribute && styleRule.style.length === 0)
+                    section.collapse(true);
                 else
                     section.expand(true);
 
@@ -243,6 +310,84 @@ WebInspector.StylesSidebarPane.prototype = {
                 this.sections.push(section);
             }
         }
+    },
+
+    _changeSetting: function(event)
+    {
+        var options = this.settingsSelectElement.options;
+        var selectedOption = options[this.settingsSelectElement.selectedIndex];
+        selectedOption.action(event);
+
+        // Select the correct color format setting again, since it needs to be selected.
+        var selectedIndex = 0;
+        for (var i = 0; i < options.length; ++i) {
+            if (options[i].value === Preferences.colorFormat) {
+                selectedIndex = i;
+                break;
+            }
+        }
+
+        this.settingsSelectElement.selectedIndex = selectedIndex;
+    },
+
+    _changeColorFormat: function(event)
+    {
+        var selectedOption = this.settingsSelectElement[this.settingsSelectElement.selectedIndex];
+        Preferences.colorFormat = selectedOption.value;
+
+        InspectorController.setSetting("color-format", Preferences.colorFormat);
+
+        for (var i = 0; i < this.sections.length; ++i)
+            this.sections[i].update(true);
+    },
+
+    _createNewRule: function(event)
+    {
+        this.addBlankSection().startEditingSelector();
+    },
+
+    addBlankSection: function()
+    {
+        var blankSection = new WebInspector.BlankStylePropertiesSection(this.appropriateSelectorForNode());
+        blankSection.pane = this;
+
+        var elementStyleSection = this.sections[1];        
+        this.bodyElement.insertBefore(blankSection.element, elementStyleSection.element.nextSibling);
+
+        this.sections.splice(2, 0, blankSection);
+
+        return blankSection;
+    },
+
+    removeSection: function(section)
+    {
+        var index = this.sections.indexOf(section);
+        if (index === -1)
+            return;
+        this.sections.splice(index, 1);
+        if (section.element.parentNode)
+            section.element.parentNode.removeChild(section.element);
+    },
+
+    appropriateSelectorForNode: function()
+    {
+        var node = this.node;
+        if (!node)
+            return "";
+
+        var id = node.getAttribute("id");
+        if (id)
+            return "#" + id;
+
+        var className = node.getAttribute("class");
+        if (className)
+            return "." + className.replace(/\s+/, ".");
+
+        var nodeName = node.nodeName.toLowerCase();
+        if (nodeName === "input" && node.getAttribute("type"))
+            return nodeName + "[type=\"" + node.getAttribute("type") + "\"]";
+
+        return nodeName;
     }
 }
 
@@ -252,13 +397,20 @@ WebInspector.StylePropertiesSection = function(styleRule, subtitle, computedStyl
 {
     WebInspector.PropertiesSection.call(this, styleRule.selectorText);
 
+    this.titleElement.addEventListener("click", function(e) { e.stopPropagation(); }, false);
+    this.titleElement.addEventListener("dblclick", this._dblclickSelector.bind(this), false);
+    this.element.addEventListener("dblclick", this._dblclickEmptySpace.bind(this), false);
+
     this.styleRule = styleRule;
+    this.rule = this.styleRule.rule;
     this.computedStyle = computedStyle;
     this.editable = (editable && !computedStyle);
 
     // Prevent editing the user agent and user rules.
-    var isUserAgent = this.styleRule.parentStyleSheet && !this.styleRule.parentStyleSheet.ownerNode && !this.styleRule.parentStyleSheet.href;
-    var isUser = this.styleRule.parentStyleSheet && this.styleRule.parentStyleSheet.ownerNode && this.styleRule.parentStyleSheet.ownerNode.nodeName == '#document';
+    var isUserAgent = this.rule && this.rule.isUserAgent;
+    var isUser = this.rule && this.rule.isUser;
+    var isViaInspector = this.rule && this.rule.isViaInspector;
+
     if (isUserAgent || isUser)
         this.editable = false;
 
@@ -300,6 +452,8 @@ WebInspector.StylePropertiesSection = function(styleRule, subtitle, computedStyl
                 subtitle = WebInspector.UIString("user agent stylesheet");
             else if (isUser)
                 subtitle = WebInspector.UIString("user stylesheet");
+            else if (isViaInspector)
+                subtitle = WebInspector.UIString("via inspector");
             else
                 subtitle = WebInspector.UIString("inline stylesheet");
         }
@@ -309,7 +463,7 @@ WebInspector.StylePropertiesSection = function(styleRule, subtitle, computedStyl
 
     this.identifier = styleRule.selectorText;
     if (this.subtitle)
-        this.identifier += ":" + this.subtitleElement.textContent;
+        this.identifier += ":" + this.subtitleElement.textContent;    
 }
 
 WebInspector.StylePropertiesSection.prototype = {
@@ -348,7 +502,7 @@ WebInspector.StylePropertiesSection.prototype = {
 
     isPropertyInherited: function(property)
     {
-        if (!this.computedStyle || !this._usedProperties)
+        if (!this.computedStyle || !this._usedProperties || this.noAffect)
             return false;
         // These properties should always show for Computed Style.
         var alwaysShowComputedProperties = { "display": true, "height": true, "width": true };
@@ -357,7 +511,7 @@ WebInspector.StylePropertiesSection.prototype = {
 
     isPropertyOverloaded: function(property, shorthand)
     {
-        if (this.computedStyle || !this._usedProperties)
+        if (this.computedStyle || !this._usedProperties || this.noAffect)
             return false;
 
         var used = (property in this.usedProperties);
@@ -366,7 +520,7 @@ WebInspector.StylePropertiesSection.prototype = {
 
         // Find out if any of the individual longhand properties of the shorthand
         // are used, if none are then the shorthand is overloaded too.
-        var longhandProperties = getLonghandProperties(this.styleRule.style, property);
+        var longhandProperties = this.styleRule.style.getLonghandProperties(property);
         for (var j = 0; j < longhandProperties.length; ++j) {
             var individualProperty = longhandProperties[j];
             if (individualProperty in this.usedProperties)
@@ -376,6 +530,11 @@ WebInspector.StylePropertiesSection.prototype = {
         return true;
     },
 
+    isInspectorStylesheet: function()
+    {
+        return (this.styleRule.parentStyleSheet === WebInspector.panels.elements.stylesheet);
+    },
+
     update: function(full)
     {
         if (full || this.computedStyle) {
@@ -400,7 +559,7 @@ WebInspector.StylePropertiesSection.prototype = {
         var style = this.styleRule.style;
 
         var foundShorthands = {};
-        var uniqueProperties = getUniqueStyleProperties(style);
+        var uniqueProperties = style.uniqueStyleProperties;
         var disabledProperties = style.__disabledPropertyValues || {};
 
         for (var name in disabledProperties)
@@ -428,7 +587,7 @@ WebInspector.StylePropertiesSection.prototype = {
             var inherited = this.isPropertyInherited(name);
             var overloaded = this.isPropertyOverloaded(name, isShorthand);
 
-            var item = new WebInspector.StylePropertyTreeElement(style, name, isShorthand, inherited, overloaded, disabled);
+            var item = new WebInspector.StylePropertyTreeElement(this.styleRule, style, name, isShorthand, inherited, overloaded, disabled);
             this.propertiesTreeOutline.appendChild(item);
         }
     },
@@ -446,18 +605,179 @@ WebInspector.StylePropertiesSection.prototype = {
 
     addNewBlankProperty: function()
     {
-        var item = new WebInspector.StylePropertyTreeElement(this.styleRule.style, "", false, false, false, false);
+        var item = new WebInspector.StylePropertyTreeElement(this.styleRule, this.styleRule.style, "", false, false, false, false);
         this.propertiesTreeOutline.appendChild(item);
         item.listItemElement.textContent = "";
         item._newProperty = true;
         return item;
+    },
+
+    _dblclickEmptySpace: function(event)
+    {
+        this.expand();
+        this.addNewBlankProperty().startEditing();
+    },
+
+    _dblclickSelector: function(event)
+    {
+        if (!this.editable)
+            return;
+
+        if (!this.rule && this.propertiesTreeOutline.children.length === 0) {
+            this.expand();
+            this.addNewBlankProperty().startEditing();
+            return;
+        }
+
+        if (!this.rule)
+            return;
+
+        this.startEditingSelector();
+        event.stopPropagation();
+    },
+
+    startEditingSelector: function()
+    {
+        var element = this.titleElement;
+        if (WebInspector.isBeingEdited(element))
+            return;
+
+        WebInspector.startEditing(this.titleElement, this.editingSelectorCommitted.bind(this), this.editingSelectorCancelled.bind(this), null);
+        window.getSelection().setBaseAndExtent(element, 0, element, 1);
+    },
+
+    editingSelectorCommitted: function(element, newContent, oldContent, context, moveDirection)
+    {
+        function moveToNextIfNeeded() {
+            if (!moveDirection || moveDirection !== "forward")
+                return;
+
+            this.expand();
+            if (this.propertiesTreeOutline.children.length === 0)
+                this.addNewBlankProperty().startEditing();
+            else {
+                var item = this.propertiesTreeOutline.children[0]
+                item.startEditing(item.valueElement);
+            }
+        }
+
+        if (newContent === oldContent)
+            return moveToNextIfNeeded.call(this);
+
+        var self = this;
+        function callback(result)
+        {
+            if (!result) {
+                // Invalid Syntax for a Selector
+                moveToNextIfNeeded.call(self);
+                return;
+            }
+
+            var newRulePayload = result[0];
+            var doesAffectSelectedNode = result[1];
+            if (!doesAffectSelectedNode) {
+                self.noAffect = true;
+                self.element.addStyleClass("no-affect");
+            } else {
+                delete self.noAffect;
+                self.element.removeStyleClass("no-affect");
+            }
+
+            var newRule = WebInspector.CSSStyleDeclaration.parseRule(newRulePayload);
+            self.rule = newRule;
+            self.styleRule = { section: self, style: newRule.style, selectorText: newRule.selectorText, parentStyleSheet: newRule.parentStyleSheet, rule: newRule };
+
+            var oldIdentifier = this.identifier;
+            self.identifier = newRule.selectorText + ":" + self.subtitleElement.textContent;
+
+            self.pane.update();
+
+            WebInspector.panels.elements.renameSelector(oldIdentifier, this.identifier, oldContent, newContent);
+
+            moveToNextIfNeeded.call(self);
+        }
+
+        InjectedScriptAccess.applyStyleRuleText(this.rule.id, newContent, this.pane.node.id, callback);
+    },
+
+    editingSelectorCancelled: function()
+    {
+        // Do nothing, this is overridden by BlankStylePropertiesSection.
     }
 }
 
 WebInspector.StylePropertiesSection.prototype.__proto__ = WebInspector.PropertiesSection.prototype;
 
-WebInspector.StylePropertyTreeElement = function(style, name, shorthand, inherited, overloaded, disabled)
+WebInspector.BlankStylePropertiesSection = function(defaultSelectorText)
+{
+    WebInspector.StylePropertiesSection.call(this, {selectorText: defaultSelectorText, rule: {isViaInspector: true}}, "", false, {}, false);
+
+    this.element.addStyleClass("blank-section");
+}
+
+WebInspector.BlankStylePropertiesSection.prototype = {
+    expand: function()
+    {
+        // Do nothing, blank sections are not expandable.
+    },
+
+    editingSelectorCommitted: function(element, newContent, oldContent, context)
+    {
+        var self = this;
+        function callback(result)
+        {
+            if (!result) {
+                // Invalid Syntax for a Selector
+                self.editingSelectorCancelled();
+                return;
+            }
+
+            var rule = result[0];
+            var doesSelectorAffectSelectedNode = result[1];
+
+            var styleRule = WebInspector.CSSStyleDeclaration.parseRule(rule);
+            styleRule.rule = rule;
+
+            self.makeNormal(styleRule);
+
+            if (!doesSelectorAffectSelectedNode) {
+                self.noAffect = true;
+                self.element.addStyleClass("no-affect");
+            }
+
+            self.subtitleElement.textContent = WebInspector.UIString("via inspector");
+            self.expand();
+
+            self.addNewBlankProperty().startEditing();
+        }
+
+        InjectedScriptAccess.addStyleSelector(newContent, this.pane.node.id, callback);
+    },
+
+    editingSelectorCancelled: function()
+    {
+        this.pane.removeSection(this);
+    },
+
+    makeNormal: function(styleRule)
+    {
+        this.element.removeStyleClass("blank-section");
+
+        this.styleRule = styleRule;
+        this.rule = styleRule.rule;
+        this.computedStyle = false;
+        this.editable = true;
+        this.identifier = styleRule.selectorText + ":via inspector";
+
+        this.__proto__ = WebInspector.StylePropertiesSection.prototype;
+    }
+}
+
+WebInspector.BlankStylePropertiesSection.prototype.__proto__ = WebInspector.StylePropertiesSection.prototype;
+
+WebInspector.StylePropertyTreeElement = function(styleRule, style, name, shorthand, inherited, overloaded, disabled)
 {
+    this._styleRule = styleRule;
     this.style = style;
     this.name = name;
     this.shorthand = shorthand;
@@ -513,14 +833,14 @@ WebInspector.StylePropertyTreeElement.prototype = {
     {
         if (this.disabled && this.style.__disabledPropertyPriorities && this.name in this.style.__disabledPropertyPriorities)
             return this.style.__disabledPropertyPriorities[this.name];
-        return (this.shorthand ? getShorthandPriority(this.style, this.name) : this.style.getPropertyPriority(this.name));
+        return (this.shorthand ? this.style.getShorthandPriority(this.name) : this.style.getPropertyPriority(this.name));
     },
 
     get value()
     {
         if (this.disabled && this.style.__disabledPropertyValues && this.name in this.style.__disabledPropertyValues)
             return this.style.__disabledPropertyValues[this.name];
-        return (this.shorthand ? getShorthandValue(this.style, this.name) : this.style.getPropertyValue(this.name));
+        return (this.shorthand ? this.style.getShorthandValue(this.name) : this.style.getPropertyValue(this.name));
     },
 
     onattach: function()
@@ -530,49 +850,14 @@ WebInspector.StylePropertyTreeElement.prototype = {
 
     updateTitle: function()
     {
-        // "Nicknames" for some common values that are easier to read.
-        var valueNicknames = {
-            "rgb(0, 0, 0)": "black",
-            "#000": "black",
-            "#000000": "black",
-            "rgb(255, 255, 255)": "white",
-            "#fff": "white",
-            "#ffffff": "white",
-            "#FFF": "white",
-            "#FFFFFF": "white",
-            "rgba(0, 0, 0, 0)": "transparent",
-            "rgb(255, 0, 0)": "red",
-            "rgb(0, 255, 0)": "lime",
-            "rgb(0, 0, 255)": "blue",
-            "rgb(255, 255, 0)": "yellow",
-            "rgb(255, 0, 255)": "magenta",
-            "rgb(0, 255, 255)": "cyan"
-        };
-
         var priority = this.priority;
         var value = this.value;
-        var htmlValue = value;
 
         if (priority && !priority.length)
             delete priority;
         if (priority)
             priority = "!" + priority;
 
-        if (value) {
-            var urls = value.match(/url\([^)]+\)/);
-            if (urls) {
-                for (var i = 0; i < urls.length; ++i) {
-                    var url = urls[i].substring(4, urls[i].length - 1);
-                    htmlValue = htmlValue.replace(urls[i], "url(" + WebInspector.linkifyURL(url) + ")");
-                }
-            } else {
-                if (value in valueNicknames)
-                    htmlValue = valueNicknames[value];
-                htmlValue = htmlValue.escapeHTML();
-            }
-        } else
-            htmlValue = value = "";
-
         this.updateState();
 
         var enabledCheckboxElement = document.createElement("input");
@@ -588,9 +873,133 @@ WebInspector.StylePropertyTreeElement.prototype = {
 
         var valueElement = document.createElement("span");
         valueElement.className = "value";
-        valueElement.innerHTML = htmlValue;
         this.valueElement = valueElement;
 
+        if (value) {
+            function processValue(regex, processor, nextProcessor, valueText)
+            {
+                var container = document.createDocumentFragment();
+
+                var items = valueText.replace(regex, "\0$1\0").split("\0");
+                for (var i = 0; i < items.length; ++i) {
+                    if ((i % 2) === 0) {
+                        if (nextProcessor)
+                            container.appendChild(nextProcessor(items[i]));
+                        else
+                            container.appendChild(document.createTextNode(items[i]));
+                    } else {
+                        var processedNode = processor(items[i]);
+                        if (processedNode)
+                            container.appendChild(processedNode);
+                    }
+                }
+
+                return container;
+            }
+
+            function linkifyURL(url)
+            {
+                var container = document.createDocumentFragment();
+                container.appendChild(document.createTextNode("url("));
+                container.appendChild(WebInspector.linkifyURLAsNode(url, url, null, (url in WebInspector.resourceURLMap)));
+                container.appendChild(document.createTextNode(")"));
+                return container;
+            }
+
+            function processColor(text)
+            {
+                try {
+                    var color = new WebInspector.Color(text);
+                } catch (e) {
+                    return document.createTextNode(text);
+                }
+
+                var swatchElement = document.createElement("span");
+                swatchElement.title = WebInspector.UIString("Click to change color format");
+                swatchElement.className = "swatch";
+                swatchElement.style.setProperty("background-color", text);
+
+                swatchElement.addEventListener("click", changeColorDisplay, false);
+                swatchElement.addEventListener("dblclick", function(event) { event.stopPropagation() }, false);
+
+                var format;
+                if (Preferences.showColorNicknames && color.nickname)
+                    format = "nickname";
+                else if (Preferences.colorFormat === "rgb")
+                    format = (color.simple ? "rgb" : "rgba");
+                else if (Preferences.colorFormat === "hsl")
+                    format = (color.simple ? "hsl" : "hsla");
+                else if (color.simple)
+                    format = (color.hasShortHex() ? "shorthex" : "hex");
+                else
+                    format = "rgba";
+
+                var colorValueElement = document.createElement("span");
+                colorValueElement.textContent = color.toString(format);
+
+                function changeColorDisplay(event)
+                {
+                    switch (format) {
+                        case "rgb":
+                            format = "hsl";
+                            break;
+
+                        case "shorthex":
+                            format = "hex";
+                            break;
+
+                        case "hex":
+                            format = "rgb";
+                            break;
+
+                        case "nickname":
+                            if (color.simple) {
+                                if (color.hasShortHex())
+                                    format = "shorthex";
+                                else
+                                    format = "hex";
+                                break;
+                            }
+
+                            format = "rgba";
+                            break;
+
+                        case "hsl":
+                            if (color.nickname)
+                                format = "nickname";
+                            else if (color.hasShortHex())
+                                format = "shorthex";
+                            else
+                                format = "hex";
+                            break;
+
+                        case "rgba":
+                            format = "hsla";
+                            break;
+
+                        case "hsla":
+                            if (color.nickname)
+                                format = "nickname";
+                            else
+                                format = "rgba";
+                            break;
+                    }
+
+                    colorValueElement.textContent = color.toString(format);
+                }
+
+                var container = document.createDocumentFragment();
+                container.appendChild(swatchElement);
+                container.appendChild(colorValueElement);
+                return container;
+            }
+
+            var colorRegex = /((?:rgb|hsl)a?\([^)]+\)|#[0-9a-fA-F]{6}|#[0-9a-fA-F]{3}|\b\w+\b)/g;
+            var colorProcessor = processValue.bind(window, colorRegex, processColor, null);
+
+            valueElement.appendChild(processValue(/url\(([^)]+)\)/g, linkifyURL, colorProcessor, value));
+        }
+
         if (priority) {
             var priorityElement = document.createElement("span");
             priorityElement.className = "priority";
@@ -613,21 +1022,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
 
         this.listItemElement.appendChild(document.createTextNode(";"));
 
-        if (value) {
-            // FIXME: this only covers W3C and CSS 16 valid color names
-            var colors = value.match(/((rgb|hsl)a?\([^)]+\))|(#[0-9a-fA-F]{6})|(#[0-9a-fA-F]{3})|aqua|black|blue|fuchsia|gray|green|lime|maroon|navy|olive|purple|red|silver|teal|white|yellow/g);
-            if (colors) {
-                var colorsLength = colors.length;
-                for (var i = 0; i < colorsLength; ++i) {
-                    var swatchElement = document.createElement("span");
-                    swatchElement.className = "swatch";
-                    swatchElement.style.setProperty("background-color", colors[i]);
-                    this.listItemElement.appendChild(swatchElement);
-                }
-            }
-        }
-
-        this.tooltip = this.name + ": " + (valueNicknames[value] || value) + (priority ? " " + priority : "");
+        this.tooltip = this.name + ": " + valueElement.textContent + (priority ? " " + priority : "");
     },
 
     updateAll: function(updateAllRules)
@@ -644,42 +1039,26 @@ WebInspector.StylePropertyTreeElement.prototype = {
     {
         var disabled = !event.target.checked;
 
-        if (disabled) {
-            if (!this.style.__disabledPropertyValues || !this.style.__disabledPropertyPriorities) {
-                var inspectedWindow = InspectorController.inspectedWindow();
-                this.style.__disabledProperties = new inspectedWindow.Object;
-                this.style.__disabledPropertyValues = new inspectedWindow.Object;
-                this.style.__disabledPropertyPriorities = new inspectedWindow.Object;
-            }
+        var self = this;
+        function callback(newPayload)
+        {
+            if (!newPayload)
+                return;
 
-            this.style.__disabledPropertyValues[this.name] = this.value;
-            this.style.__disabledPropertyPriorities[this.name] = this.priority;
+            self.style = WebInspector.CSSStyleDeclaration.parseStyle(newPayload);
+            self._styleRule.style = self.style;
 
-            if (this.shorthand) {
-                var longhandProperties = getLonghandProperties(this.style, this.name);
-                for (var i = 0; i < longhandProperties.length; ++i) {
-                    this.style.__disabledProperties[longhandProperties[i]] = true;
-                    this.style.removeProperty(longhandProperties[i]);
-                }
-            } else {
-                this.style.__disabledProperties[this.name] = true;
-                this.style.removeProperty(this.name);
-            }
-        } else {
-            this.style.setProperty(this.name, this.value, this.priority);
-            delete this.style.__disabledProperties[this.name];
-            delete this.style.__disabledPropertyValues[this.name];
-            delete this.style.__disabledPropertyPriorities[this.name];
-        }
+            // Set the disabled property here, since the code above replies on it not changing
+            // until after the value and priority are retrieved.
+            self.disabled = disabled;
 
-        // Set the disabled property here, since the code above replies on it not changing
-        // until after the value and priority are retrieved.
-        this.disabled = disabled;
+            if (self.treeOutline.section && self.treeOutline.section.pane)
+                self.treeOutline.section.pane.dispatchEventToListeners("style property toggled");
 
-        if (this.treeOutline.section && this.treeOutline.section.pane)
-            this.treeOutline.section.pane.dispatchEventToListeners("style property toggled");
+            self.updateAll(true);
+        }
 
-        this.updateAll(true);
+        InjectedScriptAccess.toggleStyleEnabled(this.style.id, this.name, disabled, callback);
     },
 
     updateState: function()
@@ -714,7 +1093,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
         if (this.children.length || !this.shorthand)
             return;
 
-        var longhandProperties = getLonghandProperties(this.style, this.name);
+        var longhandProperties = this.style.getLonghandProperties(this.name);
         for (var i = 0; i < longhandProperties.length; ++i) {
             var name = longhandProperties[i];
 
@@ -723,7 +1102,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
                 var overloaded = this.treeOutline.section.isPropertyOverloaded(name);
             }
 
-            var item = new WebInspector.StylePropertyTreeElement(this.style, name, false, inherited, overloaded);
+            var item = new WebInspector.StylePropertyTreeElement(this._styleRule, this.style, name, false, inherited, overloaded);
             this.appendChild(item);
         }
     },
@@ -731,6 +1110,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
     ondblclick: function(element, event)
     {
         this.startEditing(event.target);
+        event.stopPropagation();
     },
 
     startEditing: function(selectElement)
@@ -837,11 +1217,11 @@ WebInspector.StylePropertyTreeElement.prototype = {
         if (!this.originalCSSText) {
             // Remember the rule's original CSS text, so it can be restored
             // if the editing is canceled and before each apply.
-            this.originalCSSText = getStyleTextWithShorthands(this.style);
+            this.originalCSSText = this.style.styleTextWithShorthands();
         } else {
             // Restore the original CSS text before applying user changes. This is needed to prevent
             // new properties from sticking around if the user adds one, then removes it.
-            this.style.cssText = this.originalCSSText;
+            InjectedScriptAccess.setStyleText(this.style.id, this.originalCSSText);
         }
 
         this.applyStyleText(this.listItemElement.textContent);
@@ -858,8 +1238,10 @@ WebInspector.StylePropertyTreeElement.prototype = {
 
     editingCancelled: function(element, context)
     {
-        if (this.originalCSSText) {
-            this.style.cssText = this.originalCSSText;
+        if (this._newProperty)
+            this.treeOutline.removeChild(this);
+        else if (this.originalCSSText) {
+            InjectedScriptAccess.setStyleText(this.style.id, this.originalCSSText);
 
             if (this.treeOutline.section && this.treeOutline.section.pane)
                 this.treeOutline.section.pane.dispatchEventToListeners("style edited");
@@ -876,13 +1258,14 @@ WebInspector.StylePropertyTreeElement.prototype = {
         this.editingEnded(context);
 
         // Determine where to move to before making changes
-        var newProperty = false;
-        var moveToPropertyName;
+        var newProperty, moveToPropertyName, moveToSelector;
         var moveTo = (moveDirection === "forward" ? this.nextSibling : this.previousSibling);
         if (moveTo)
             moveToPropertyName = moveTo.name;
         else if (moveDirection === "forward")
             newProperty = true;
+        else if (moveDirection === "backward" && this.treeOutline.section.rule)
+            moveToSelector = true;
 
         // Make the Changes and trigger the moveToNextCallback after updating
         var blankInput = /^\s*$/.test(userInput);
@@ -893,7 +1276,8 @@ WebInspector.StylePropertyTreeElement.prototype = {
             moveToNextCallback(this._newProperty, false, this.treeOutline.section, false);
 
         // The Callback to start editing the next property
-        function moveToNextCallback(alreadyNew, valueChanged, section) {
+        function moveToNextCallback(alreadyNew, valueChanged, section)
+        {
             if (!moveDirection)
                 return;
 
@@ -919,85 +1303,70 @@ WebInspector.StylePropertyTreeElement.prototype = {
 
                 var item = section.addNewBlankProperty();
                 item.startEditing();
+                return;
             }
+
+            if (moveToSelector)
+                section.startEditingSelector();
         }
     },
 
     applyStyleText: function(styleText, updateInterface)
     {
+        var section = this.treeOutline.section;
+        var elementsPanel = WebInspector.panels.elements;
         var styleTextLength = styleText.trimWhitespace().length;
-
-        // Create a new element to parse the user input CSS.
-        var parseElement = document.createElement("span");
-        parseElement.setAttribute("style", styleText);
-
-        var tempStyle = parseElement.style;
-        if (tempStyle.length || !styleTextLength) {
-            // The input was parsable or the user deleted everything, so remove the
-            // original property from the real style declaration. If this represents
-            // a shorthand remove all the longhand properties.
-            if (this.shorthand) {
-                var longhandProperties = getLonghandProperties(this.style, this.name);
-                for (var i = 0; i < longhandProperties.length; ++i)
-                    this.style.removeProperty(longhandProperties[i]);
-            } else
-                this.style.removeProperty(this.name);
-        }
-
-        if (!styleTextLength) {
-            if (updateInterface) {
+        if (!styleTextLength && updateInterface) {
+            if (this._newProperty) {
                 // The user deleted everything, so remove the tree element and update.
-                if (!this._newProperty)
-                    delete this.treeOutline.section._afterUpdate;
-                if (this.treeOutline.section && this.treeOutline.section.pane)
-                    this.treeOutline.section.pane.update();
                 this.parent.removeChild(this);
+                return;
+            } else {
+                delete section._afterUpdate;
             }
-            return;
         }
 
-        if (!tempStyle.length) {
-            // The user typed something, but it didn't parse. Just abort and restore
-            // the original title for this property.  If this was a new attribute and
-            // we couldn't parse, then just remove it.
-            if (this._newProperty) {
-                this.parent.removeChild(this);
+        var self = this;
+        function callback(result)
+        {
+            if (!result) {
+                // The user typed something, but it didn't parse. Just abort and restore
+                // the original title for this property.  If this was a new attribute and
+                // we couldn't parse, then just remove it.
+                if (self._newProperty) {
+                    self.parent.removeChild(self);
+                    return;
+                }
+                if (updateInterface)
+                    self.updateTitle();
                 return;
             }
-            if (updateInterface)
-                this.updateTitle();
-            return;
-        }
 
-        // Iterate of the properties on the test element's style declaration and
-        // add them to the real style declaration. We take care to move shorthands.
-        var foundShorthands = {};
-        var uniqueProperties = getUniqueStyleProperties(tempStyle);
-        for (var i = 0; i < uniqueProperties.length; ++i) {
-            var name = uniqueProperties[i];
-            var shorthand = tempStyle.getPropertyShorthand(name);
-
-            if (shorthand && shorthand in foundShorthands)
-                continue;
+            var newPayload = result[0];
+            var changedProperties = result[1];
+            elementsPanel.removeStyleChange(section.identifier, self.style, self.name);
 
-            if (shorthand) {
-                var value = getShorthandValue(tempStyle, shorthand);
-                var priority = getShorthandPriority(tempStyle, shorthand);
-                foundShorthands[shorthand] = true;
+            if (!styleTextLength) {
+                // Do remove ourselves from UI when the property removal is confirmed.
+                self.parent.removeChild(self);
             } else {
-                var value = tempStyle.getPropertyValue(name);
-                var priority = tempStyle.getPropertyPriority(name);
+                self.style = WebInspector.CSSStyleDeclaration.parseStyle(newPayload);
+                for (var i = 0; i < changedProperties.length; ++i)
+                    elementsPanel.addStyleChange(section.identifier, self.style, changedProperties[i]);
+                self._styleRule.style = self.style;
             }
 
-            // Set the property on the real style declaration.
-            this.style.setProperty((shorthand || name), value, priority);
-        }
+            if (section && section.pane)
+                section.pane.dispatchEventToListeners("style edited");
 
-        if (this.treeOutline.section && this.treeOutline.section.pane)
-            this.treeOutline.section.pane.dispatchEventToListeners("style edited");
+            if (updateInterface)
+                self.updateAll(true);
+
+            if (!self.rule)
+                WebInspector.panels.elements.treeOutline.update();
+        }
 
-        if (updateInterface)
-            this.updateAll(true);
+        InjectedScriptAccess.applyStyleText(this.style.id, styleText.trimWhitespace(), this.name, callback);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/SummaryBar.js b/src/3rdparty/webkit/WebCore/inspector/front-end/SummaryBar.js
new file mode 100644
index 0000000..bbf2b1a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/SummaryBar.js
@@ -0,0 +1,364 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2008, 2009 Anthony Ricaud <rik@webkit.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.SummaryBar = function(categories)
+{
+    this.categories = categories;
+
+    this.element = document.createElement("div");
+    this.element.className = "summary-bar";
+
+    this.graphElement = document.createElement("canvas");
+    this.graphElement.setAttribute("width", "450");
+    this.graphElement.setAttribute("height", "38");
+    this.graphElement.className = "summary-graph";
+    this.element.appendChild(this.graphElement);
+
+    this.legendElement = document.createElement("div");
+    this.legendElement.className = "summary-graph-legend";
+    this.element.appendChild(this.legendElement);
+}
+
+WebInspector.SummaryBar.prototype = {
+
+    get calculator() {
+        return this._calculator;
+    },
+
+    set calculator(x) {
+        this._calculator = x;
+    },
+
+    reset: function()
+    {
+        this.legendElement.removeChildren();
+        this._drawSummaryGraph();
+    },
+
+    update: function(data)
+    {
+        var graphInfo = this.calculator.computeSummaryValues(data);
+
+        var fillSegments = [];
+
+        this.legendElement.removeChildren();
+
+        for (var category in this.categories) {
+            var size = graphInfo.categoryValues[category];
+            if (!size)
+                continue;
+
+            var color = this.categories[category].color;
+            var colorString = "rgb(" + color.r + ", " + color.g + ", " + color.b + ")";
+
+            var fillSegment = {color: colorString, value: size};
+            fillSegments.push(fillSegment);
+
+            var legendLabel = this._makeLegendElement(this.categories[category].title, this.calculator.formatValue(size), colorString);
+            this.legendElement.appendChild(legendLabel);
+        }
+
+        if (graphInfo.total) {
+            var totalLegendLabel = this._makeLegendElement(WebInspector.UIString("Total"), this.calculator.formatValue(graphInfo.total));
+            totalLegendLabel.addStyleClass("total");
+            this.legendElement.appendChild(totalLegendLabel);
+        }
+
+        this._drawSummaryGraph(fillSegments);
+    },
+
+    _drawSwatch: function(canvas, color)
+    {
+        var ctx = canvas.getContext("2d");
+
+        function drawSwatchSquare() {
+            ctx.fillStyle = color;
+            ctx.fillRect(0, 0, 13, 13);
+
+            var gradient = ctx.createLinearGradient(0, 0, 13, 13);
+            gradient.addColorStop(0.0, "rgba(255, 255, 255, 0.2)");
+            gradient.addColorStop(1.0, "rgba(255, 255, 255, 0.0)");
+
+            ctx.fillStyle = gradient;
+            ctx.fillRect(0, 0, 13, 13);
+
+            gradient = ctx.createLinearGradient(13, 13, 0, 0);
+            gradient.addColorStop(0.0, "rgba(0, 0, 0, 0.2)");
+            gradient.addColorStop(1.0, "rgba(0, 0, 0, 0.0)");
+
+            ctx.fillStyle = gradient;
+            ctx.fillRect(0, 0, 13, 13);
+
+            ctx.strokeStyle = "rgba(0, 0, 0, 0.6)";
+            ctx.strokeRect(0.5, 0.5, 12, 12);
+        }
+
+        ctx.clearRect(0, 0, 13, 24);
+
+        drawSwatchSquare();
+
+        ctx.save();
+
+        ctx.translate(0, 25);
+        ctx.scale(1, -1);
+
+        drawSwatchSquare();
+
+        ctx.restore();
+
+        this._fadeOutRect(ctx, 0, 13, 13, 13, 0.5, 0.0);
+    },
+
+    _drawSummaryGraph: function(segments)
+    {
+        if (!segments || !segments.length) {
+            segments = [{color: "white", value: 1}];
+            this._showingEmptySummaryGraph = true;
+        } else
+            delete this._showingEmptySummaryGraph;
+
+        // Calculate the total of all segments.
+        var total = 0;
+        for (var i = 0; i < segments.length; ++i)
+            total += segments[i].value;
+
+        // Calculate the percentage of each segment, rounded to the nearest percent.
+        var percents = segments.map(function(s) { return Math.max(Math.round(100 * s.value / total), 1) });
+
+        // Calculate the total percentage.
+        var percentTotal = 0;
+        for (var i = 0; i < percents.length; ++i)
+            percentTotal += percents[i];
+
+        // Make sure our percentage total is not greater-than 100, it can be greater
+        // if we rounded up for a few segments.
+        while (percentTotal > 100) {
+            for (var i = 0; i < percents.length && percentTotal > 100; ++i) {
+                if (percents[i] > 1) {
+                    --percents[i];
+                    --percentTotal;
+                }
+            }
+        }
+
+        // Make sure our percentage total is not less-than 100, it can be less
+        // if we rounded down for a few segments.
+        while (percentTotal < 100) {
+            for (var i = 0; i < percents.length && percentTotal < 100; ++i) {
+                ++percents[i];
+                ++percentTotal;
+            }
+        }
+
+        var ctx = this.graphElement.getContext("2d");
+
+        var x = 0;
+        var y = 0;
+        var w = 450;
+        var h = 19;
+        var r = (h / 2);
+
+        function drawPillShadow()
+        {
+            // This draws a line with a shadow that is offset away from the line. The line is stroked
+            // twice with different X shadow offsets to give more feathered edges. Later we erase the
+            // line with destination-out 100% transparent black, leaving only the shadow. This only
+            // works if nothing has been drawn into the canvas yet.
+
+            ctx.beginPath();
+            ctx.moveTo(x + 4, y + h - 3 - 0.5);
+            ctx.lineTo(x + w - 4, y + h - 3 - 0.5);
+            ctx.closePath();
+
+            ctx.save();
+
+            ctx.shadowBlur = 2;
+            ctx.shadowColor = "rgba(0, 0, 0, 0.5)";
+            ctx.shadowOffsetX = 3;
+            ctx.shadowOffsetY = 5;
+
+            ctx.strokeStyle = "white";
+            ctx.lineWidth = 1;
+
+            ctx.stroke();
+
+            ctx.shadowOffsetX = -3;
+
+            ctx.stroke();
+
+            ctx.restore();
+
+            ctx.save();
+
+            ctx.globalCompositeOperation = "destination-out";
+            ctx.strokeStyle = "rgba(0, 0, 0, 1)";
+            ctx.lineWidth = 1;
+
+            ctx.stroke();
+
+            ctx.restore();
+        }
+
+        function drawPill()
+        {
+            // Make a rounded rect path.
+            ctx.beginPath();
+            ctx.moveTo(x, y + r);
+            ctx.lineTo(x, y + h - r);
+            ctx.quadraticCurveTo(x, y + h, x + r, y + h);
+            ctx.lineTo(x + w - r, y + h);
+            ctx.quadraticCurveTo(x + w, y + h, x + w, y + h - r);
+            ctx.lineTo(x + w, y + r);
+            ctx.quadraticCurveTo(x + w, y, x + w - r, y);
+            ctx.lineTo(x + r, y);
+            ctx.quadraticCurveTo(x, y, x, y + r);
+            ctx.closePath();
+
+            // Clip to the rounded rect path.
+            ctx.save();
+            ctx.clip();
+
+            // Fill the segments with the associated color.
+            var previousSegmentsWidth = 0;
+            for (var i = 0; i < segments.length; ++i) {
+                var segmentWidth = Math.round(w * percents[i] / 100);
+                ctx.fillStyle = segments[i].color;
+                ctx.fillRect(x + previousSegmentsWidth, y, segmentWidth, h);
+                previousSegmentsWidth += segmentWidth;
+            }
+
+            // Draw the segment divider lines.
+            ctx.lineWidth = 1;
+            for (var i = 1; i < 20; ++i) {
+                ctx.beginPath();
+                ctx.moveTo(x + (i * Math.round(w / 20)) + 0.5, y);
+                ctx.lineTo(x + (i * Math.round(w / 20)) + 0.5, y + h);
+                ctx.closePath();
+
+                ctx.strokeStyle = "rgba(0, 0, 0, 0.2)";
+                ctx.stroke();
+
+                ctx.beginPath();
+                ctx.moveTo(x + (i * Math.round(w / 20)) + 1.5, y);
+                ctx.lineTo(x + (i * Math.round(w / 20)) + 1.5, y + h);
+                ctx.closePath();
+
+                ctx.strokeStyle = "rgba(255, 255, 255, 0.2)";
+                ctx.stroke();
+            }
+
+            // Draw the pill shading.
+            var lightGradient = ctx.createLinearGradient(x, y, x, y + (h / 1.5));
+            lightGradient.addColorStop(0.0, "rgba(220, 220, 220, 0.6)");
+            lightGradient.addColorStop(0.4, "rgba(220, 220, 220, 0.2)");
+            lightGradient.addColorStop(1.0, "rgba(255, 255, 255, 0.0)");
+
+            var darkGradient = ctx.createLinearGradient(x, y + (h / 3), x, y + h);
+            darkGradient.addColorStop(0.0, "rgba(0, 0, 0, 0.0)");
+            darkGradient.addColorStop(0.8, "rgba(0, 0, 0, 0.2)");
+            darkGradient.addColorStop(1.0, "rgba(0, 0, 0, 0.5)");
+
+            ctx.fillStyle = darkGradient;
+            ctx.fillRect(x, y, w, h);
+
+            ctx.fillStyle = lightGradient;
+            ctx.fillRect(x, y, w, h);
+
+            ctx.restore();
+        }
+
+        ctx.clearRect(x, y, w, (h * 2));
+
+        drawPillShadow();
+        drawPill();
+
+        ctx.save();
+
+        ctx.translate(0, (h * 2) + 1);
+        ctx.scale(1, -1);
+
+        drawPill();
+
+        ctx.restore();
+
+        this._fadeOutRect(ctx, x, y + h + 1, w, h, 0.5, 0.0);
+    },
+
+    _fadeOutRect: function(ctx, x, y, w, h, a1, a2)
+    {
+        ctx.save();
+
+        var gradient = ctx.createLinearGradient(x, y, x, y + h);
+        gradient.addColorStop(0.0, "rgba(0, 0, 0, " + (1.0 - a1) + ")");
+        gradient.addColorStop(0.8, "rgba(0, 0, 0, " + (1.0 - a2) + ")");
+        gradient.addColorStop(1.0, "rgba(0, 0, 0, 1.0)");
+
+        ctx.globalCompositeOperation = "destination-out";
+
+        ctx.fillStyle = gradient;
+        ctx.fillRect(x, y, w, h);
+
+        ctx.restore();
+    },
+
+    _makeLegendElement: function(label, value, color)
+    {
+        var legendElement = document.createElement("label");
+        legendElement.className = "summary-graph-legend-item";
+
+        if (color) {
+            var swatch = document.createElement("canvas");
+            swatch.className = "summary-graph-legend-swatch";
+            swatch.setAttribute("width", "13");
+            swatch.setAttribute("height", "24");
+
+            legendElement.appendChild(swatch);
+
+            this._drawSwatch(swatch, color);
+        }
+
+        var labelElement = document.createElement("div");
+        labelElement.className = "summary-graph-legend-label";
+        legendElement.appendChild(labelElement);
+
+        var headerElement = document.createElement("div");
+        headerElement.className = "summary-graph-legend-header";
+        headerElement.textContent = label;
+        labelElement.appendChild(headerElement);
+
+        var valueElement = document.createElement("div");
+        valueElement.className = "summary-graph-legend-value";
+        valueElement.textContent = value;
+        labelElement.appendChild(valueElement);
+
+        return legendElement;
+    }
+}
+
+WebInspector.SummaryBar.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/TextPrompt.js b/src/3rdparty/webkit/WebCore/inspector/front-end/TextPrompt.js
index 4194ff1..5ff774f 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/TextPrompt.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/TextPrompt.js
@@ -66,6 +66,7 @@ WebInspector.TextPrompt.prototype = {
                 this._tabKeyPressed(event);
                 break;
             case "Right":
+            case "End":
                 if (!this.acceptAutoComplete())
                     this.autoCompleteSoon();
                 break;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/TimelineAgent.js b/src/3rdparty/webkit/WebCore/inspector/front-end/TimelineAgent.js
new file mode 100644
index 0000000..6d18732
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/TimelineAgent.js
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.TimelineAgent = function() {
+    // Not implemented.
+}
+
+// Must be kept in sync with TimelineItem.h
+WebInspector.TimelineAgent.ItemType = {
+    DOMDispatch       : 0,
+    Layout            : 1,
+    RecalculateStyles : 2,
+    Paint             : 3,
+    ParseHTML         : 4
+};
+
+WebInspector.addItemToTimeline = function(record) {
+    // Not implemented.
+}
+
+WebInspector.timelineWasEnabled = function() {
+    // Not implemented.
+}
+
+WebInspector.timelineWasDisabled = function() {
+    // Not implemented.
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js b/src/3rdparty/webkit/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
new file mode 100644
index 0000000..b568939
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
@@ -0,0 +1,274 @@
+/*
+ * Copyright (C) IBM Corp. 2009  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of IBM Corp. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.WatchExpressionsSidebarPane = function()
+{
+    WebInspector.SidebarPane.call(this, WebInspector.UIString("Watch Expressions"));
+
+    this.section = new WebInspector.WatchExpressionsSection();
+
+    this.bodyElement.appendChild(this.section.element);
+
+    var addElement = document.createElement("button");
+    addElement.setAttribute("type", "button");
+    addElement.textContent = WebInspector.UIString("Add");
+    addElement.addEventListener("click", this.section.addExpression.bind(this.section), false);
+
+    var refreshElement = document.createElement("button");
+    refreshElement.setAttribute("type", "button");
+    refreshElement.textContent = WebInspector.UIString("Refresh");
+    refreshElement.addEventListener("click", this.section.update.bind(this.section), false);
+
+    var centerElement = document.createElement("div");
+    centerElement.addStyleClass("watch-expressions-buttons-container");
+    centerElement.appendChild(addElement);
+    centerElement.appendChild(refreshElement);
+    this.bodyElement.appendChild(centerElement);
+
+    this.expanded = this.section.loadSavedExpressions().length > 0;
+    this.onexpand = this.refreshExpressions.bind(this);
+}
+
+WebInspector.WatchExpressionsSidebarPane.prototype = {
+    refreshExpressions: function()
+    {
+        this.section.update();
+    }
+}
+
+WebInspector.WatchExpressionsSidebarPane.prototype.__proto__ = WebInspector.SidebarPane.prototype;
+
+WebInspector.WatchExpressionsSection = function()
+{
+    WebInspector.ObjectPropertiesSection.call(this);
+
+    this.watchExpressions = this.loadSavedExpressions();
+
+    this.headerElement.className = "hidden";
+    this.editable = true;
+    this.expanded = true;
+    this.propertiesElement.addStyleClass("watch-expressions");
+}
+
+WebInspector.WatchExpressionsSection.NewWatchExpression = "\xA0";
+
+WebInspector.WatchExpressionsSection.prototype = {
+    update: function()
+    {
+        function appendResult(expression, watchIndex, result, exception)
+        {
+            // The null check catches some other cases, like null itself, and NaN
+            if ((typeof result !== "object") || (result == null))
+                result = new WebInspector.ObjectProxy(null, [], 0, String(result), false);
+
+            var property = new WebInspector.ObjectPropertyProxy(expression, result);
+            property.watchIndex = watchIndex;
+
+            // For newly added, empty expressions, set description to "",
+            // since otherwise you get DOMWindow
+            if (property.name === WebInspector.WatchExpressionsSection.NewWatchExpression) 
+                property.value.description = "";
+            
+            // To clarify what's going on here: 
+            // In the outer function, we calculate the number of properties
+            // that we're going to be updating, and set that in the
+            // propertyCount variable.  
+            // In this function, we test to see when we are processing the 
+            // last property, and then call the superclass's updateProperties() 
+            // method to get all the properties refreshed at once.
+            properties.push(property);
+            
+            if (properties.length == propertyCount)
+                this.updateProperties(properties, WebInspector.WatchExpressionTreeElement, WebInspector.WatchExpressionsSection.CompareProperties);
+        }
+
+        var properties = [];
+
+        // Count the properties, so we known when to call this.updateProperties()
+        // in appendResult()
+        var propertyCount = 0;
+        for (var i = 0; i < this.watchExpressions.length; ++i) {
+            if (!this.watchExpressions[i]) 
+                continue;
+            ++propertyCount;
+        }
+
+        // Now process all the expressions, since we have the actual count,
+        // which is checked in the appendResult inner function.
+        for (var i = 0; i < this.watchExpressions.length; ++i) {
+            var expression = this.watchExpressions[i];
+            if (!expression) 
+                continue;
+
+            WebInspector.console.evalInInspectedWindow("(" + expression + ")", appendResult.bind(this, expression, i));
+        }
+
+        // note this is setting the expansion of the tree, not the section;
+        // with no expressions, and expanded tree, we get some extra vertical
+        // white space
+        // FIXME: should change to use header buttons instead of the buttons
+        // at the bottom of the section, then we can add a "No Watch Expressions
+        // element when there are no watch expressions, and this issue should
+        // go away.
+        this.expanded = (propertyCount != 0);
+    },
+
+    addExpression: function()
+    {
+        this.watchExpressions.push(WebInspector.WatchExpressionsSection.NewWatchExpression);
+        this.update();
+
+        // After update(), the new empty expression to be edited
+        // will be in the tree, but we have to find it.
+        treeElement = this.findAddedTreeElement();
+        if (treeElement)
+            treeElement.startEditing();
+    },
+
+    updateExpression: function(element, value)
+    {
+        this.watchExpressions[element.property.watchIndex] = value;
+        this.saveExpressions();
+        this.update();
+    },
+
+    findAddedTreeElement: function()
+    {
+        var children = this.propertiesTreeOutline.children;
+        for (var i = 0; i < children.length; ++i)
+            if (children[i].property.name === WebInspector.WatchExpressionsSection.NewWatchExpression)
+                return children[i];
+    },
+
+    loadSavedExpressions: function()
+    {
+        var json = InspectorController.setting("watchExpressions");
+        if (!json)
+            return [];
+
+        try {
+            json = JSON.parse(json);
+        } catch(e) {
+            return [];
+        }
+
+        return json.expressions || [];
+    },
+
+    saveExpressions: function()
+    {
+        var toSave = [];
+        for (var i = 0; i < this.watchExpressions.length; i++)
+            if (this.watchExpressions[i])
+                toSave.push(this.watchExpressions[i]);
+
+        var json = JSON.stringify({expressions: toSave});
+        InspectorController.setSetting("watchExpressions", json);
+
+        return toSave.length;
+    }
+}
+
+WebInspector.WatchExpressionsSection.prototype.__proto__ = WebInspector.ObjectPropertiesSection.prototype;
+
+WebInspector.WatchExpressionsSection.CompareProperties = function(propertyA, propertyB) 
+{
+    if (propertyA.watchIndex == propertyB.watchIndex)
+        return 0;
+    else if (propertyA.watchIndex < propertyB.watchIndex)
+        return -1;
+    else
+        return 1;
+}
+
+WebInspector.WatchExpressionTreeElement = function(property)
+{
+    WebInspector.ObjectPropertyTreeElement.call(this, property);
+}
+
+WebInspector.WatchExpressionTreeElement.prototype = {
+    update: function()
+    {
+        WebInspector.ObjectPropertyTreeElement.prototype.update.call(this);
+
+        var deleteButton = document.createElement("input");
+        deleteButton.type = "button";
+        deleteButton.title = WebInspector.UIString("Delete watch expression.");
+        deleteButton.addStyleClass("enabled-button");
+        deleteButton.addStyleClass("delete-button");
+        deleteButton.addEventListener("click", this._deleteButtonClicked.bind(this), false);
+
+        this.listItemElement.insertBefore(deleteButton, this.listItemElement.firstChild);
+    },
+
+    _deleteButtonClicked: function()
+    {
+        this.treeOutline.section.updateExpression(this, null);
+    },
+
+    startEditing: function()
+    {
+        if (WebInspector.isBeingEdited(this.nameElement) || !this.treeOutline.section.editable)
+            return;
+
+        this.nameElement.textContent = this.property.name.trimWhitespace();
+
+        var context = { expanded: this.expanded };
+
+        // collapse temporarily, if required
+        this.hasChildren = false;
+
+        this.listItemElement.addStyleClass("editing-sub-part");
+
+        WebInspector.startEditing(this.nameElement, this.editingCommitted.bind(this), this.editingCancelled.bind(this), context);
+    },
+
+    editingCancelled: function(element, context)
+    {
+        if (!this.nameElement.textContent)
+            this.treeOutline.section.updateExpression(this, null);
+            
+        this.update();
+        this.editingEnded(context);
+    },
+
+    applyExpression: function(expression, updateInterface)
+    {
+        expression = expression.trimWhitespace();
+
+        if (!expression)
+            expression = null;
+
+        this.property.name = expression;
+        this.treeOutline.section.updateExpression(this, expression);
+    }
+}
+
+WebInspector.WatchExpressionTreeElement.prototype.__proto__ = WebInspector.ObjectPropertyTreeElement.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc b/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc
index 6619499..b4dff4e 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc
@@ -4,28 +4,37 @@
     <file>BottomUpProfileDataGridTree.js</file>
     <file>Breakpoint.js</file>
     <file>BreakpointsSidebarPane.js</file>
+    <file>Callback.js</file>
     <file>CallStackSidebarPane.js</file>
-    <file>Console.js</file>
+    <file>ChangesView.js</file>
+    <file>Color.js</file>
+    <file>ConsoleView.js</file>
+    <file>CookieItemsView.js</file>
     <file>Database.js</file>
     <file>DatabaseQueryView.js</file>
-    <file>DatabasesPanel.js</file>
     <file>DatabaseTableView.js</file>
     <file>DataGrid.js</file>
+    <file>DOMAgent.js</file>
     <file>DOMStorage.js</file>
     <file>DOMStorageDataGrid.js</file>
     <file>DOMStorageItemsView.js</file>
+    <file>Drawer.js</file>
     <file>ElementsPanel.js</file>
     <file>ElementsTreeOutline.js</file>
     <file>FontView.js</file>
     <file>ImageView.js</file>
+    <file>InjectedScript.js</file>
+    <file>InjectedScriptAccess.js</file>
     <file>inspector.js</file>
     <file>KeyboardShortcut.js</file>
     <file>MetricsSidebarPane.js</file>
     <file>Object.js</file>
     <file>ObjectPropertiesSection.js</file>
+    <file>ObjectProxy.js</file>
     <file>Panel.js</file>
     <file>PanelEnablerView.js</file>
     <file>Placard.js</file>
+    <file>Popup.js</file>
     <file>ProfileDataGridTree.js</file>
     <file>ProfilesPanel.js</file>
     <file>ProfileView.js</file>
@@ -43,20 +52,25 @@
     <file>SidebarTreeElement.js</file>
     <file>SourceFrame.js</file>
     <file>SourceView.js</file>
+    <file>StatusBarButton.js</file>
+    <file>StoragePanel.js</file>
     <file>StylesSidebarPane.js</file>
+    <file>SummaryBar.js</file>
     <file>TextPrompt.js</file>
+    <file>TimelineAgent.js</file>
     <file>TopDownProfileDataGridTree.js</file>
     <file>treeoutline.js</file>
     <file>utilities.js</file>
     <file>View.js</file>
+    <file>WatchExpressionsSidebarPane.js</file>
     <file>inspector.css</file>
     <file>Images/back.png</file>
     <file>Images/checker.png</file>
-    <file>Images/clearConsoleButtons.png</file>
+    <file>Images/clearConsoleButtonGlyph.png</file>
     <file>Images/closeButtons.png</file>
-    <file>Images/consoleButtons.png</file>
+    <file>Images/consoleButtonGlyph.png</file>
+    <file>Images/cookie.png</file>
     <file>Images/database.png</file>
-    <file>Images/databasesIcon.png</file>
     <file>Images/databaseTable.png</file>
     <file>Images/debuggerContinue.png</file>
     <file>Images/debuggerPause.png</file>
@@ -72,14 +86,14 @@
     <file>Images/disclosureTriangleSmallRightDownBlack.png</file>
     <file>Images/disclosureTriangleSmallRightDownWhite.png</file>
     <file>Images/disclosureTriangleSmallRightWhite.png</file>
-    <file>Images/dockButtons.png</file>
-    <file>Images/domStorage.png</file>
+    <file>Images/dockButtonGlyph.png</file>
     <file>Images/elementsIcon.png</file>
-    <file>Images/enableButtons.png</file>
+    <file>Images/enableOutlineButtonGlyph.png</file>
+    <file>Images/enableSolidButtonGlyph.png</file>
     <file>Images/errorIcon.png</file>
     <file>Images/errorMediumIcon.png</file>
-    <file>Images/excludeButtons.png</file>
-    <file>Images/focusButtons.png</file>
+    <file>Images/excludeButtonGlyph.png</file>
+    <file>Images/focusButtonGlyph.png</file>
     <file>Images/forward.png</file>
     <file>Images/glossyHeader.png</file>
     <file>Images/glossyHeaderPressed.png</file>
@@ -88,21 +102,24 @@
     <file>Images/goArrow.png</file>
     <file>Images/graphLabelCalloutLeft.png</file>
     <file>Images/graphLabelCalloutRight.png</file>
-    <file>Images/largerResourcesButtons.png</file>
-    <file>Images/nodeSearchButtons.png</file>
+    <file>Images/largerResourcesButtonGlyph.png</file>
+    <file>Images/localStorage.png</file>
+    <file>Images/nodeSearchButtonGlyph.png</file>
     <file>Images/paneBottomGrow.png</file>
     <file>Images/paneBottomGrowActive.png</file>
     <file>Images/paneGrowHandleLine.png</file>
-    <file>Images/pauseOnExceptionButtons.png</file>
-    <file>Images/percentButtons.png</file>
+    <file>Images/paneSettingsButtons.png</file>
+    <file>Images/pauseOnExceptionButtonGlyph.png</file>
+    <file>Images/percentButtonGlyph.png</file>
     <file>Images/profileGroupIcon.png</file>
     <file>Images/profileIcon.png</file>
     <file>Images/profilesIcon.png</file>
     <file>Images/profileSmallIcon.png</file>
     <file>Images/profilesSilhouette.png</file>
     <file>Images/radioDot.png</file>
-    <file>Images/recordButtons.png</file>
-    <file>Images/reloadButtons.png</file>
+    <file>Images/recordButtonGlyph.png</file>
+    <file>Images/recordToggledButtonGlyph.png</file>
+    <file>Images/reloadButtonGlyph.png</file>
     <file>Images/resourceCSSIcon.png</file>
     <file>Images/resourceDocumentIcon.png</file>
     <file>Images/resourceDocumentIconSmall.png</file>
@@ -125,6 +142,7 @@
     <file>Images/segmentHoverEnd.png</file>
     <file>Images/segmentSelected.png</file>
     <file>Images/segmentSelectedEnd.png</file>
+    <file>Images/sessionStorage.png</file>
     <file>Images/splitviewDimple.png</file>
     <file>Images/splitviewDividerBackground.png</file>
     <file>Images/statusbarBackground.png</file>
@@ -134,6 +152,7 @@
     <file>Images/statusbarMenuButtonSelected.png</file>
     <file>Images/statusbarResizerHorizontal.png</file>
     <file>Images/statusbarResizerVertical.png</file>
+    <file>Images/storageIcon.png</file>
     <file>Images/timelineHollowPillBlue.png</file>
     <file>Images/timelineHollowPillGray.png</file>
     <file>Images/timelineHollowPillGreen.png</file>
@@ -159,6 +178,7 @@
     <file>Images/treeRightTriangleWhite.png</file>
     <file>Images/treeUpTriangleBlack.png</file>
     <file>Images/treeUpTriangleWhite.png</file>
+    <file>Images/undockButtonGlyph.png</file>
     <file>Images/userInputIcon.png</file>
     <file>Images/userInputPreviousIcon.png</file>
     <file>Images/userInputResultIcon.png</file>
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css
index dabadc2..ea6f661 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Anthony Ricaud <rik@webkit.org>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -198,8 +199,8 @@ body.attached #search-results-matches {
     background-image: url(Images/scriptsIcon.png);
 }
 
-.toolbar-item.databases .toolbar-icon {
-    background-image: url(Images/databasesIcon.png);
+.toolbar-item.storage .toolbar-icon {
+    background-image: url(Images/storageIcon.png);
 }
 
 .toolbar-item.profiles .toolbar-icon {
@@ -259,7 +260,7 @@ body.attached #main {
     right: 0;
 }
 
-body.console-visible #main-status-bar {
+body.drawer-visible #main-status-bar {
     height: 24px;
     background-image: url(Images/statusbarResizerVertical.png), url(Images/statusbarBackground.png);
     background-repeat: no-repeat, repeat-x;
@@ -267,11 +268,11 @@ body.console-visible #main-status-bar {
     cursor: row-resize;
 }
 
-body.console-visible #main-status-bar * {
+body.drawer-visible #main-status-bar * {
     cursor: default;
 }
 
-body.console-visible #main-panels {
+body.drawer-visible #main-panels {
     bottom: 24px;
 }
 
@@ -306,14 +307,39 @@ body.console-visible #main-panels {
     z-index: 200;
 }
 
+.glyph {
+    position: absolute;
+    top: 0;
+    left: 0;
+    right: 0;
+    bottom: 0;
+    background-color: rgba(0, 0, 0, 0.75);
+    z-index: 1;
+}
+
+.glyph.shadow {
+    top: 1px;
+    background-color: white !important;
+    z-index: 0;
+}
+
 button.status-bar-item {
+    position: relative;
     width: 32px;
     background-image: url(Images/statusbarButtons.png);
     background-position: 0 0;
 }
 
 button.status-bar-item:active {
-    background-position: 32px 0;
+    background-position: 32px 0 !important;
+}
+
+button.status-bar-item .glyph.shadow {
+    background-color: rgba(255, 255, 255, 0.33) !important;
+}
+
+button.status-bar-item.toggled-on .glyph {
+    background-color: rgb(66, 129, 235);
 }
 
 button.status-bar-item:disabled {
@@ -338,47 +364,31 @@ select.status-bar-item:active {
     -webkit-border-image: url(Images/statusbarMenuButtonSelected.png) 0 17 0 2;
 }
 
-#dock-status-bar-item {
-    background-image: url(Images/dockButtons.png);
-}
-
-body.attached #dock-status-bar-item:active {
-    background-position: 32px 0;
-}
-
-body.detached #dock-status-bar-item {
-    background-position: 0 24px;
-}
-
-body.detached #dock-status-bar-item.toggled-on:active {
-    background-position: 32px 24px;
-}
-
-#console-status-bar-item {
-    background-image: url(Images/consoleButtons.png);
+#dock-status-bar-item .glyph {
+    -webkit-mask-image: url(Images/undockButtonGlyph.png);
 }
 
-#console-status-bar-item:active {
-    background-position: 32px 0;
+body.detached #dock-status-bar-item .glyph {
+    -webkit-mask-image: url(Images/dockButtonGlyph.png);
 }
 
-#console-status-bar-item.toggled-on {
-    background-position: 0 24px;
+#console-status-bar-item .glyph {
+    -webkit-mask-image: url(Images/consoleButtonGlyph.png);
 }
 
-#console-status-bar-item.toggled-on:active {
-    background-position: 32px 24px;
+#clear-console-status-bar-item .glyph {
+    -webkit-mask-image: url(Images/clearConsoleButtonGlyph.png);
 }
 
-#clear-console-status-bar-item {
-    background-image: url(Images/clearConsoleButtons.png);
+#changes-status-bar-item .glyph {
+    -webkit-mask-image: url(Images/consoleButtonGlyph.png); /* TODO: Needs Image for Changes Toggle Button */
 }
 
-#clear-console-status-bar-item:active {
-    background-position: 32px 0;
+#clear-changes-status-bar-item .glyph {
+    -webkit-mask-image: url(Images/clearConsoleButtonGlyph.png);
 }
 
-#error-warning-count {
+#count-items {
     position: absolute;
     right: 16px;
     top: 0;
@@ -388,10 +398,22 @@ body.detached #dock-status-bar-item.toggled-on:active {
     height: 19px;
 }
 
-#error-warning-count:hover {
+#changes-count, #error-warning-count {
+    display: inline;
+}
+
+#error-warning-count:hover, #changes-count:hover {
     border-bottom: 1px solid rgb(96, 96, 96);
 }
 
+#style-changes-count::before {
+    content: url(Images/styleIcon.png); /* TODO: Needs Image for Style Changes Icon */
+    width: 10px;
+    height: 10px;
+    vertical-align: -1px;
+    margin-right: 2px;
+}
+
 #error-count::before {
     content: url(Images/errorIcon.png);
     width: 10px;
@@ -399,8 +421,8 @@ body.detached #dock-status-bar-item.toggled-on:active {
     vertical-align: -1px;
     margin-right: 2px;
 }
-
-#error-count + #warning-count {
+    
+#changes-count + #error-warning-count, #error-count + #warning-count {
     margin-left: 6px;
 }
 
@@ -412,7 +434,7 @@ body.detached #dock-status-bar-item.toggled-on:active {
     margin-right: 2px;
 }
 
-#console {
+#drawer {
     display: none;
     position: absolute;
     bottom: 0;
@@ -425,11 +447,11 @@ body.detached #dock-status-bar-item.toggled-on:active {
     background-position: bottom;
 }
 
-body.console-visible #console {
+body.drawer-visible #drawer {
     display: block;
 }
 
-#console-status-bar {
+#drawer-status-bar {
     position: absolute;
     bottom: 0;
     left: 0;
@@ -521,7 +543,7 @@ body.console-visible #console {
     padding-left: 6px;
 }
 
-.repeated-message.console-error-level::before, .repeated-message.console-warning-level:before {
+.repeated-message.console-error-level::before, .repeated-message.console-warning-level:before, .repeated-message.console-debug-level:before {
     visibility: hidden;
 }
 
@@ -552,6 +574,14 @@ body.console-visible #console {
     color: red;
 }
 
+.console-debug-level .console-message-text {
+    color: blue;
+}
+
+.console-debug-level::before {
+    background-image: url(Images/searchSmallBrightBlue.png);
+}
+
 .console-error-level::before {
     background-image: url(Images/errorIcon.png);
 }
@@ -751,6 +781,10 @@ body.console-visible #console {
     margin-right: 100px;
 }
 
+.resource-view-headers .outline-disclosure .raw-form-data {
+    white-space:pre-wrap;
+}
+
 .resource-view .resource-view-content {
     position: absolute;
     top: 0;
@@ -1172,6 +1206,10 @@ body.inactive .placard.selected {
     margin-bottom: 1px;
 }
 
+.watch-expressions-buttons-container {
+    text-align: center;
+}
+
 .section .header {
     padding: 2px 8px 4px 18px;
     border-top: 1px solid rgb(145, 160, 192);
@@ -1182,6 +1220,10 @@ body.inactive .placard.selected {
     -webkit-background-clip: padding;
 }
 
+.section.no-affect .header {
+    background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(167, 167, 167)), to(rgb(123, 123, 123)))
+}
+
 .section .header::before {
     position: absolute;
     top: 4px;
@@ -1191,6 +1233,10 @@ body.inactive .placard.selected {
     content: url(Images/treeRightTriangleWhite.png);
 }
 
+.section.blank-section .header::before {
+    display: none;
+}
+
 .section.expanded .header::before {
     content: url(Images/treeDownTriangleWhite.png);
 }
@@ -1202,6 +1248,10 @@ body.inactive .placard.selected {
     white-space: normal;
 }
 
+.section .header .title.blank-title {
+    font-style: italic;
+}
+
 .section .header label {
     display: none;
 }
@@ -1239,6 +1289,15 @@ body.inactive .placard.selected {
     padding: 2px 6px 3px;
     list-style: none;
     background-color: white;
+    min-height: 18px;
+}
+
+.section.no-affect .properties li {
+    opacity: 0.5;
+}
+
+.section.no-affect .properties li.editing {
+    opacity: 1.0;
 }
 
 .section.expanded .properties {
@@ -1317,10 +1376,19 @@ body.inactive .placard.selected {
     text-overflow: clip;
 }
 
-li.editing .swatch, li.editing .enabled-button {
+li.editing .swatch, li.editing .enabled-button,  li.editing-sub-part .delete-button {
     display: none !important;
 }
 
+.watch-expressions > li.editing-sub-part .name {
+    display: block; 
+    width: 100%;
+}
+
+.watch-expressions > li.editing-sub-part .value, .watch-expressions > li.editing-sub-part .separator  {
+    display: none;
+}
+
 .section .properties li.editing-sub-part {
     padding: 3px 6px 8px 18px;
     margin: -3px -6px -8px -6px;
@@ -1354,6 +1422,17 @@ li.editing .swatch, li.editing .enabled-button {
     z-index: 1;
 }
 
+/* FIXME: need a better icon (comment in bug 27514) */
+.section .properties .delete-button {
+    width: 10px;
+    height: 10px;
+    background-image: url(Images/errorIcon.png);
+    background-position: 0 0;
+    background-color: transparent;
+    background-repeat: no-repeat;
+    border: 0 none transparent;
+}
+
 .section:hover .properties .enabled-button {
     display: block;
 }
@@ -1385,11 +1464,16 @@ li.editing .swatch, li.editing .enabled-button {
 .swatch {
     display: inline-block;
     vertical-align: baseline;
-    margin-left: 4px;
+    margin-left: 1px;
+    margin-right: 2px;
     margin-bottom: -1px;
     width: 1em;
     height: 1em;
-    border: 1px solid rgb(180, 180, 180);
+    border: 1px solid rgba(128, 128, 128, 0.6);
+}
+
+.swatch:hover {
+    border: 1px solid rgba(64, 64, 64, 0.8);
 }
 
 .pane:not(.expanded) + .pane, .pane:first-of-type {
@@ -1430,6 +1514,34 @@ li.editing .swatch, li.editing .enabled-button {
     content: url(Images/disclosureTriangleSmallDownBlack.png);
 }
 
+.pane > .title > select {
+    display: none;
+    float: right;
+    width: 23px;
+    height: 17px;
+    color: transparent;
+    background-color: transparent;
+    border: none;
+    background-image: url(Images/paneSettingsButtons.png);
+    background-repeat: no-repeat;
+    margin: 1px 0 0 0;
+    padding: 0;
+    -webkit-border-radius: 0;
+    -webkit-appearance: none;
+}
+
+.pane.expanded:hover > .title > select {
+    display: inline-block;
+}
+
+.pane > .title > select:hover {
+    background-position: -23px 0px;
+}
+
+.pane > .title > select:active {
+    background-position: -46px 0px;
+}
+
 .pane > .body {
     position: relative;
     display: none;
@@ -1579,8 +1691,16 @@ body.inactive .sidebar {
     content: url(Images/databaseTable.png);
 }
 
-.domstorage-sidebar-tree-item .icon {
-    content: url(Images/domStorage.png);
+.domstorage-sidebar-tree-item.local-storage .icon {
+    content: url(Images/localStorage.png);
+}
+
+.domstorage-sidebar-tree-item.session-storage .icon {
+    content: url(Images/sessionStorage.png);
+}
+
+.cookie-sidebar-tree-item .icon {
+    content: url(Images/cookie.png);
 }
 
 #storage-views {
@@ -1742,6 +1862,14 @@ body.inactive .sidebar {
     overflow: hidden;
 }
 
+.data-grid .centered div {
+    text-align: center;
+}
+
+.data-grid .right div {
+    text-align: right;
+}
+
 .data-grid th.sortable div {
     position: relative;
 }
@@ -1824,6 +1952,15 @@ body.inactive .data-grid th.sort-ascending, body.inactive .data-grid th.sort-des
     text-indent: 10px;
 }
 
+.data-grid-resizer {
+    position: absolute;
+    top: 0;
+    bottom: 0;
+    width: 5px;
+    z-index: 500;
+    cursor: col-resize;
+}
+
 .storage-view.query {
     font-size: initial;
     font-family: monospace;
@@ -2031,36 +2168,16 @@ body.inactive .panel-enabler-view button, .panel-enabler-view button:disabled {
     content: url(Images/profilesSilhouette.png);
 }
 
-button.enable-toggle-status-bar-item {
-    background-image: url(Images/enableButtons.png);
+button.enable-toggle-status-bar-item .glyph {
+    -webkit-mask-image: url(Images/enableOutlineButtonGlyph.png);
 }
 
-button.enable-toggle-status-bar-item:active {
-    background-position: 32px 0;
+button.enable-toggle-status-bar-item.toggled-on .glyph {
+    -webkit-mask-image: url(Images/enableSolidButtonGlyph.png);
 }
 
-button.enable-toggle-status-bar-item.toggled-on {
-    background-position: 0 24px;
-}
-
-button.enable-toggle-status-bar-item.toggled-on:active {
-    background-position: 32px 24px;
-}
-
-#scripts-pause-on-exceptions-status-bar-item {
-    background-image: url(Images/pauseOnExceptionButtons.png);
-}
-
-#scripts-pause-on-exceptions-status-bar-item:active {
-    background-position: 32px 0;
-}
-
-#scripts-pause-on-exceptions-status-bar-item.toggled-on {
-    background-position: 0 24px;
-}
-
-#scripts-pause-on-exceptions-status-bar-item.toggled-on:active {
-    background-position: 32px 24px;
+.scripts-pause-on-exceptions-status-bar-item .glyph {
+    -webkit-mask-image: url(Images/pauseOnExceptionButtonGlyph.png);
 }
 
 #scripts-status-bar {
@@ -2177,25 +2294,63 @@ button.enable-toggle-status-bar-item.toggled-on:active {
     overflow: auto;
 }
 
-#resources-larger-resources-status-bar-item {
-    background-image: url(Images/largerResourcesButtons.png);
+.resources-larger-resources-status-bar-item .glyph {
+    -webkit-mask-image: url(Images/largerResourcesButtonGlyph.png);
 }
 
-#resources-larger-resources-status-bar-item:active {
-    background-position: 32px 0;
+#resources-filter {
+    height: 24px;
+    padding: 2px 10px 0;
+    background: -webkit-gradient(linear, left top, left bottom, from(rgb(233, 233, 233)), to(rgb(207, 207, 207)));
+    border-bottom: 1px solid rgb(177, 177, 177);
+    overflow: hidden;
 }
 
-#resources-larger-resources-status-bar-item.toggled-on {
-    background-position: 0 24px;
+#console-filter {
+    height: 24px;
+    padding: 2px 10px 0;
+    overflow: hidden;
+}
+
+#resources-filter li, #console-filter li {
+    display: inline-block;
+    margin: 1px 1px 0 0;
+    padding: 0 6px 3px;
+    font-size: 12px;
+    line-height: 12px;
+    font-weight: bold;
+    color: rgb(40, 40, 40);
+    border: 1px solid transparent;
+    border-bottom: 0;
+    background: transparent;
+    -webkit-border-radius: 8px;
+    text-shadow: rgba(255, 255, 255, 0.5) 1px 1px 0;
 }
 
-#resources-larger-resources-status-bar-item.toggled-on:active {
-    background-position: 32px 24px;
+#resources-filter li.selected, #resources-filter li:hover, #resources-filter li:active,
+#console-filter li.selected, #console-filter li:hover, #console-filter li:active {
+    color: white;
+    text-shadow: rgb(80, 80, 80) 1px 1px 1px;
+    background: rgba(20, 20, 20, 0.4);
+    border-color: rgba(20, 20, 20, 0.2);
+    -webkit-box-shadow: 0 1px 0px rgba(255, 255, 255, 0.5);
+}
+
+#resources-filter li:hover,
+#console-filter li:hover {
+    background: rgba(20, 20, 20, 0.4);
+    border-color: transparent;
+    -webkit-box-shadow: none;
+}
+
+#resources-filter li:active,
+#console-filter li:active {
+    background: rgba(20, 20, 20, 0.6);
 }
 
 #resources-container {
     position: absolute;
-    top: 0;
+    top: 24px;
     left: 0;
     bottom: 0;
     right: 0;
@@ -2255,36 +2410,36 @@ button.enable-toggle-status-bar-item.toggled-on:active {
     -webkit-background-clip: padding;
 }
 
-#resources-graph-legend {
+.summary-graph-legend {
     margin-top: -10px;
     padding-left: 15px;
 }
 
-.resources-graph-legend-item {
+.summary-graph-legend-item {
     display: inline-block;
     font-weight: bold;
     margin-right: 15px;
     vertical-align: top;
 }
 
-.resources-graph-legend-item.total {
+.summary-graph-legend-item.total {
     margin-left: 10px;
 }
 
-.resources-graph-legend-label {
+.summary-graph-legend-label {
     display: inline-block;
     text-align: left;
 }
 
-.resources-graph-legend-header {
+.summary-graph-legend-header {
     font-size: 12px;
 }
 
-.resources-graph-legend-value {
+.summary-graph-legend-value {
     font-size: 10px;
 }
 
-.resources-graph-legend-swatch {
+.summary-graph-legend-swatch {
     vertical-align: top;
     margin-top: 1px;
     margin-right: 3px;
@@ -2400,6 +2555,32 @@ button.enable-toggle-status-bar-item.toggled-on:active {
     -webkit-border-image: url(Images/timelinePillGray.png) 6 7 6 7;
 }
 
+.resources-category-documents, .resources-category-stylesheets, .resources-category-images,
+.resources-category-scripts, .resources-category-xhr, .resources-category-fonts, .resources-category-other {
+    display: none;
+}
+
+.filter-all .resources-category-documents, .filter-documents .resources-category-documents,
+.filter-all .resources-category-stylesheets, .filter-stylesheets .resources-category-stylesheets,
+.filter-all .resources-category-images, .filter-images .resources-category-images,
+.filter-all .resources-category-scripts, .filter-scripts .resources-category-scripts,
+.filter-all .resources-category-xhr, .filter-xhr .resources-category-xhr,
+.filter-all .resources-category-fonts, .filter-fonts .resources-category-fonts,
+.filter-all .resources-category-other, .filter-other .resources-category-other,
+.resource-sidebar-tree-item.selected {
+    display: list-item;
+}
+
+.console-warning-level, .console-error-level, .console-log-level {
+    display: none;
+}
+
+.filter-all .console-warning-level, .filter-warnings .console-warning-level,
+.filter-all .console-error-level, .filter-errors .console-error-level,
+.filter-all .console-log-level, .filter-logs .console-log-level {
+    display: block;
+}
+
 .resources-graph-bar.waiting {
     opacity: 0.35;
 }
@@ -2503,7 +2684,7 @@ button.enable-toggle-status-bar-item.toggled-on:active {
 
 #resource-views {
     position: absolute;
-    top: 0;
+    top: 24px;
     right: 0;
     left: 200px;
     bottom: 0;
@@ -2523,6 +2704,10 @@ button.enable-toggle-status-bar-item.toggled-on:active {
     cursor: col-resize;
 }
 
+.resources .sidebar-resizer-vertical {
+    top: 24px;
+}
+
 .sidebar-tree, .sidebar-tree .children {
     position: relative;
     padding: 0;
@@ -2889,6 +3074,10 @@ body.inactive .sidebar-tree-item.selected {
     content: url(Images/resourceDocumentIconSmall.png);
 }
 
+.bubble.debug, .console-debug-level .bubble {
+    background-color: rgb(0, 0, 255) !important;
+}
+
 .bubble.warning, .console-warning-level .bubble {
     background-color: rgb(232, 164, 0) !important;
 }
@@ -3009,84 +3198,45 @@ body.inactive .sidebar-tree-item.selected .bubble.search-matches {
     color: white;
 }
 
-#record-profile-status-bar-item {
-    background-image: url(Images/recordButtons.png);
+button.enable-toggle-status-bar-item .glyph {
 }
 
-#record-profile-status-bar-item:active {
-    background-position: 32px 0;
+.record-profile-status-bar-item .glyph {
+    -webkit-mask-image: url(Images/recordButtonGlyph.png);
 }
 
-#record-profile-status-bar-item.toggled-on {
-    background-position: 0 24px;
+.record-profile-status-bar-item.toggled-on .glyph {
+    -webkit-mask-image: url(Images/recordToggledButtonGlyph.png);
+    background-color: rgb(216, 0, 0) !important;
 }
 
-#record-profile-status-bar-item.toggled-on:active {
-    background-position: 32px 24px;
+/* FIXME: should have its own glyph. */
+.heap-snapshot-status-bar-item .glyph {
+    -webkit-mask-image: url(Images/focusButtonGlyph.png);
 }
 
-#node-search-status-bar-item {
-    background-image: url(Images/nodeSearchButtons.png);
+.node-search-status-bar-item .glyph {
+    -webkit-mask-image: url(Images/nodeSearchButtonGlyph.png);
 }
 
-#node-search-status-bar-item:active {
-    background-position: 32px 0;
+.percent-time-status-bar-item .glyph {
+    -webkit-mask-image: url(Images/percentButtonGlyph.png);
 }
 
-#node-search-status-bar-item.toggled-on {
-    background-position: 0 24px;
+.focus-profile-node-status-bar-item .glyph {
+    -webkit-mask-image: url(Images/focusButtonGlyph.png);
 }
 
-#node-search-status-bar-item.toggled-on:active {
-    background-position: 32px 24px;
+.exclude-profile-node-status-bar-item .glyph {
+    -webkit-mask-image: url(Images/excludeButtonGlyph.png);
 }
 
-.percent-time-status-bar-item {
-    background-image: url(Images/percentButtons.png) !important;
+.reset-profile-status-bar-item .glyph {
+    -webkit-mask-image: url(Images/reloadButtonGlyph.png);
 }
 
-.percent-time-status-bar-item:active {
-    background-position: 32px 0;
-}
-
-.percent-time-status-bar-item.toggled-on {
-    background-position: 0 24px;
-}
-
-.percent-time-status-bar-item.toggled-on:active {
-    background-position: 32px 24px;
-}
-
-.focus-profile-node-status-bar-item {
-    background-image: url(Images/focusButtons.png) !important;
-}
-
-.focus-profile-node-status-bar-item:active {
-    background-position: 32px 0;
-}
-
-.exclude-profile-node-status-bar-item {
-    background-image: url(Images/excludeButtons.png) !important;
-}
-
-.exclude-profile-node-status-bar-item:active {
-    background-position: 32px 0;
-}
-
-.reset-profile-status-bar-item {
-    background-image: url(Images/reloadButtons.png) !important;
-}
-
-.reset-profile-status-bar-item:active {
-    background-position: 32px 0;
-}
-
-.delete-storage-status-bar-item {
-    background-image: url(Images/excludeButtons.png) !important;
-}
-
-.delete-storage-status-bar-item:active {
-    background-position: 32px 0;
+.delete-storage-status-bar-item .glyph {
+    -webkit-mask-image: url(Images/excludeButtonGlyph.png);
 }
 
 #storage-view-status-bar-items {
@@ -3099,12 +3249,8 @@ body.inactive .sidebar-tree-item.selected .bubble.search-matches {
     margin-left: -1px;
 }
 
-.refresh-storage-status-bar-item {
-    background-image: url(Images/reloadButtons.png) !important;
-}
-
-.refresh-storage-status-bar-item:active {
-    background-position: 32px 0;
+.refresh-storage-status-bar-item .glyph {
+    -webkit-mask-image: url(Images/reloadButtonGlyph.png);
 }
 
 #storage-view-status-bar-items {
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.html b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.html
index 762074e..7f544fe 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.html
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.html
@@ -6,13 +6,13 @@ modification, are permitted provided that the following conditions
 are met:
 
 1.  Redistributions of source code must retain the above copyright
-    notice, this list of conditions and the following disclaimer. 
+    notice, this list of conditions and the following disclaimer.
 2.  Redistributions in binary form must reproduce the above copyright
     notice, this list of conditions and the following disclaimer in the
-    documentation and/or other materials provided with the distribution. 
+    documentation and/or other materials provided with the distribution.
 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
     its contributors may be used to endorse or promote products derived
-    from this software without specific prior written permission. 
+    from this software without specific prior written permission.
 
 THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
 EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
@@ -36,9 +36,13 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="Object.js"></script>
     <script type="text/javascript" src="KeyboardShortcut.js"></script>
     <script type="text/javascript" src="TextPrompt.js"></script>
+    <script type="text/javascript" src="Popup.js"></script>
     <script type="text/javascript" src="Placard.js"></script>
     <script type="text/javascript" src="View.js"></script>
-    <script type="text/javascript" src="Console.js"></script>
+    <script type="text/javascript" src="Callback.js"></script>
+    <script type="text/javascript" src="Drawer.js"></script>
+    <script type="text/javascript" src="ChangesView.js"></script>
+    <script type="text/javascript" src="ConsoleView.js"></script>
     <script type="text/javascript" src="Resource.js"></script>
     <script type="text/javascript" src="ResourceCategory.js"></script>
     <script type="text/javascript" src="Database.js"></script>
@@ -46,25 +50,31 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="DOMStorageItemsView.js"></script>
     <script type="text/javascript" src="DataGrid.js"></script>
     <script type="text/javascript" src="DOMStorageDataGrid.js"></script>
+    <script type="text/javascript" src="CookieItemsView.js"></script>
     <script type="text/javascript" src="Script.js"></script>
     <script type="text/javascript" src="Breakpoint.js"></script>
     <script type="text/javascript" src="SidebarPane.js"></script>
     <script type="text/javascript" src="ElementsTreeOutline.js"></script>
     <script type="text/javascript" src="SidebarTreeElement.js"></script>
     <script type="text/javascript" src="PropertiesSection.js"></script>
+    <script type="text/javascript" src="ObjectProxy.js"></script>
     <script type="text/javascript" src="ObjectPropertiesSection.js"></script>
     <script type="text/javascript" src="BreakpointsSidebarPane.js"></script>
     <script type="text/javascript" src="CallStackSidebarPane.js"></script>
     <script type="text/javascript" src="ScopeChainSidebarPane.js"></script>
+    <script type="text/javascript" src="WatchExpressionsSidebarPane.js"></script>
     <script type="text/javascript" src="MetricsSidebarPane.js"></script>
     <script type="text/javascript" src="PropertiesSidebarPane.js"></script>
+    <script type="text/javascript" src="Color.js"></script>
     <script type="text/javascript" src="StylesSidebarPane.js"></script>
     <script type="text/javascript" src="Panel.js"></script>
     <script type="text/javascript" src="PanelEnablerView.js"></script>
+    <script type="text/javascript" src="StatusBarButton.js"></script>
+    <script type="text/javascript" src="SummaryBar.js"></script>
     <script type="text/javascript" src="ElementsPanel.js"></script>
     <script type="text/javascript" src="ResourcesPanel.js"></script>
     <script type="text/javascript" src="ScriptsPanel.js"></script>
-    <script type="text/javascript" src="DatabasesPanel.js"></script>
+    <script type="text/javascript" src="StoragePanel.js"></script>
     <script type="text/javascript" src="ProfilesPanel.js"></script>
     <script type="text/javascript" src="ResourceView.js"></script>
     <script type="text/javascript" src="SourceFrame.js"></script>
@@ -78,6 +88,10 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="BottomUpProfileDataGridTree.js"></script>
     <script type="text/javascript" src="TopDownProfileDataGridTree.js"></script>
     <script type="text/javascript" src="ProfileView.js"></script>
+    <script type="text/javascript" src="DOMAgent.js"></script>
+    <script type="text/javascript" src="InjectedScript.js"></script>
+    <script type="text/javascript" src="InjectedScriptAccess.js"></script>
+    <script type="text/javascript" src="TimelineAgent.js"></script>
 </head>
 <body class="detached">
     <div id="toolbar">
@@ -88,11 +102,11 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     </div>
     <div id="main">
         <div id="main-panels" tabindex="0" spellcheck="false"></div>
-        <div id="main-status-bar" class="status-bar"><div id="anchored-status-bar-items"><button id="dock-status-bar-item" class="status-bar-item toggled"></button><button id="console-status-bar-item" class="status-bar-item"></button><div id="error-warning-count" class="hidden"></div></div></div>
+        <div id="main-status-bar" class="status-bar"><div id="anchored-status-bar-items"><button id="dock-status-bar-item" class="status-bar-item toggled"><div class="glyph"></div><div class="glyph shadow"></div></button><button id="console-status-bar-item" class="status-bar-item"><div class="glyph"></div><div class="glyph shadow"></div></button><button id="changes-status-bar-item" class="status-bar-item hidden"></button><div id="count-items"><div id="changes-count" class="hidden"></div><div id="error-warning-count" class="hidden"></div></div></div></div>
     </div>
-    <div id="console">
-        <div id="console-messages"><div id="console-prompt" spellcheck="false"><br></div></div>
-        <div id="console-status-bar" class="status-bar"><div id="other-console-status-bar-items"><button id="clear-console-status-bar-item" class="status-bar-item"></button></div></div>
+    <div id="drawer">
+        <div id="console-view"><div id="console-messages"><div id="console-prompt" spellcheck="false"><br></div></div></div>
+        <div id="drawer-status-bar" class="status-bar"><div id="other-drawer-status-bar-items"><button id="clear-console-status-bar-item" class="status-bar-item"><div class="glyph"></div><div class="glyph shadow"></div></button><div id="console-filter" class="status-bar-item"></div></div></div>
     </div>
 </body>
 </html>
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.js b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.js
index 7e23692..902dd94 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.js
@@ -1,19 +1,20 @@
 /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc.  All rights reserved.
  * Copyright (C) 2007 Matt Lilek (pewtermoose@gmail.com).
+ * Copyright (C) 2009 Joseph Pecoraro
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer. 
+ *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution. 
+ *     documentation and/or other materials provided with the distribution.
  * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
  *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission. 
+ *     from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
@@ -37,7 +38,11 @@ var Preferences = {
     minScriptsSidebarWidth: 200,
     showInheritedComputedStyleProperties: false,
     styleRulesExpandedState: {},
-    showMissingLocalizedStrings: false
+    showMissingLocalizedStrings: false,
+    heapProfilerPresent: false,
+    samplingCPUProfiler: false,
+    showColorNicknames: true,
+    colorFormat: "hex"
 }
 
 var WebInspector = {
@@ -68,7 +73,7 @@ var WebInspector = {
             // there isn't already a caret selection inside.
             var selection = window.getSelection();
             if (selection.isCollapsed && !this._currentFocusElement.isInsertionCaretInside()) {
-                var selectionRange = document.createRange();
+                var selectionRange = this._currentFocusElement.ownerDocument.createRange();
                 selectionRange.setStart(this._currentFocusElement, 0);
                 selectionRange.setEnd(this._currentFocusElement, 0);
 
@@ -117,13 +122,13 @@ var WebInspector = {
                 }
             }
         }
-        
+
         for (var panelName in WebInspector.panels) {
             if (WebInspector.panels[panelName] == x)
                 InspectorController.storeLastActivePanel(panelName);
         }
     },
-  
+
     _createPanels: function()
     {
         var hiddenPanels = (InspectorController.hiddenPanels() || "").split(',');
@@ -135,8 +140,8 @@ var WebInspector = {
             this.panels.scripts = new WebInspector.ScriptsPanel();
         if (hiddenPanels.indexOf("profiles") === -1)
             this.panels.profiles = new WebInspector.ProfilesPanel();
-        if (hiddenPanels.indexOf("databases") === -1)
-            this.panels.databases = new WebInspector.DatabasesPanel();      
+        if (hiddenPanels.indexOf("storage") === -1 && hiddenPanels.indexOf("databases") === -1)
+            this.panels.storage = new WebInspector.StoragePanel();      
     },
 
     get attached()
@@ -251,6 +256,53 @@ var WebInspector = {
             errorWarningElement.title = null;
     },
 
+    get styleChanges()
+    {
+        return this._styleChanges;
+    },
+
+    set styleChanges(x)
+    {
+        x = Math.max(x, 0);
+
+        if (this._styleChanges === x)
+            return;
+        this._styleChanges = x;
+        this._updateChangesCount();
+    },
+
+    _updateChangesCount: function()
+    {
+        // TODO: Remove immediate return when enabling the Changes Panel
+        return;
+
+        var changesElement = document.getElementById("changes-count");
+        if (!changesElement)
+            return;
+
+        if (!this.styleChanges) {
+            changesElement.addStyleClass("hidden");
+            return;
+        }
+
+        changesElement.removeStyleClass("hidden");
+        changesElement.removeChildren();
+
+        if (this.styleChanges) {
+            var styleChangesElement = document.createElement("span");
+            styleChangesElement.id = "style-changes-count";
+            styleChangesElement.textContent = this.styleChanges;
+            changesElement.appendChild(styleChangesElement);
+        }
+
+        if (this.styleChanges) {
+            if (this.styleChanges === 1)
+                changesElement.title = WebInspector.UIString("%d style change", this.styleChanges);
+            else
+                changesElement.title = WebInspector.UIString("%d style changes", this.styleChanges);
+        }
+    },
+
     get hoveredDOMNode()
     {
         return this._hoveredDOMNode;
@@ -258,7 +310,7 @@ var WebInspector = {
 
     set hoveredDOMNode(x)
     {
-        if (objectsAreSame(this._hoveredDOMNode, x))
+        if (this._hoveredDOMNode === x)
             return;
 
         this._hoveredDOMNode = x;
@@ -284,7 +336,7 @@ var WebInspector = {
         }
 
         if (this._hoveredDOMNode) {
-            InspectorController.highlightDOMNode(this._hoveredDOMNode);
+            InspectorController.highlightDOMNode(this._hoveredDOMNode.id);
             this.showingDOMNodeHighlight = true;
         } else {
             InspectorController.hideDOMNodeHighlight();
@@ -298,7 +350,27 @@ WebInspector.loaded = function()
     var platform = InspectorController.platform();
     document.body.addStyleClass("platform-" + platform);
 
-    this.console = new WebInspector.Console();
+    var colorFormat = InspectorController.setting("color-format");
+    if (colorFormat)
+        Preferences.colorFormat = colorFormat;
+
+    this.drawer = new WebInspector.Drawer();
+    this.console = new WebInspector.ConsoleView(this.drawer);
+    // TODO: Uncomment when enabling the Changes Panel
+    // this.changes = new WebInspector.ChangesView(this.drawer);
+    // TODO: Remove class="hidden" from inspector.html on button#changes-status-bar-item
+    this.drawer.visibleView = this.console;
+    this.domAgent = new WebInspector.DOMAgent();
+
+    this.resourceCategories = {
+        documents: new WebInspector.ResourceCategory(WebInspector.UIString("Documents"), "documents"),
+        stylesheets: new WebInspector.ResourceCategory(WebInspector.UIString("Stylesheets"), "stylesheets"),
+        images: new WebInspector.ResourceCategory(WebInspector.UIString("Images"), "images"),
+        scripts: new WebInspector.ResourceCategory(WebInspector.UIString("Scripts"), "scripts"),
+        xhr: new WebInspector.ResourceCategory(WebInspector.UIString("XHR"), "xhr"),
+        fonts: new WebInspector.ResourceCategory(WebInspector.UIString("Fonts"), "fonts"),
+        other: new WebInspector.ResourceCategory(WebInspector.UIString("Other"), "other")
+    };
 
     this.panels = {};
     this._createPanels();
@@ -319,16 +391,6 @@ WebInspector.loaded = function()
         previousToolbarItem = panelToolbarItem;
     }
 
-    this.resourceCategories = {
-        documents: new WebInspector.ResourceCategory(WebInspector.UIString("Documents"), "documents"),
-        stylesheets: new WebInspector.ResourceCategory(WebInspector.UIString("Stylesheets"), "stylesheets"),
-        images: new WebInspector.ResourceCategory(WebInspector.UIString("Images"), "images"),
-        scripts: new WebInspector.ResourceCategory(WebInspector.UIString("Scripts"), "scripts"),
-        xhr: new WebInspector.ResourceCategory(WebInspector.UIString("XHR"), "xhr"),
-        fonts: new WebInspector.ResourceCategory(WebInspector.UIString("Fonts"), "fonts"),
-        other: new WebInspector.ResourceCategory(WebInspector.UIString("Other"), "other")
-    };
-
     this.Tips = {
         ResourceNotCompressed: {id: 0, message: WebInspector.UIString("You could save bandwidth by having your web server compress this transfer with gzip or zlib.")}
     };
@@ -347,6 +409,7 @@ WebInspector.loaded = function()
     document.addEventListener("keyup", this.documentKeyUp.bind(this), true);
     document.addEventListener("beforecopy", this.documentCanCopy.bind(this), true);
     document.addEventListener("copy", this.documentCopy.bind(this), true);
+    document.addEventListener("contextmenu", this.contextMenu.bind(this), true);
 
     var mainPanelsElement = document.getElementById("main-panels");
     mainPanelsElement.handleKeyEvent = this.mainKeyDown.bind(this);
@@ -367,9 +430,15 @@ WebInspector.loaded = function()
         dockToggleButton.title = WebInspector.UIString("Dock to main window.");
 
     var errorWarningCount = document.getElementById("error-warning-count");
-    errorWarningCount.addEventListener("click", this.console.show.bind(this.console), false);
+    errorWarningCount.addEventListener("click", this.showConsole.bind(this), false);
     this._updateErrorAndWarningCounts();
 
+    this.styleChanges = 0;
+    // TODO: Uncomment when enabling the Changes Panel
+    // var changesElement = document.getElementById("changes-count");
+    // changesElement.addEventListener("click", this.showChanges.bind(this), false);
+    // this._updateErrorAndWarningCounts();
+
     var searchField = document.getElementById("search");
     searchField.addEventListener("keydown", this.searchKeyDown.bind(this), false);
     searchField.addEventListener("keyup", this.searchKeyUp.bind(this), false);
@@ -498,7 +567,7 @@ WebInspector.documentKeyDown = function(event)
 
         switch (event.keyIdentifier) {
             case "U+001B": // Escape key
-                this.console.visible = !this.console.visible;
+                this.drawer.visible = !this.drawer.visible;
                 event.preventDefault();
                 break;
 
@@ -595,6 +664,12 @@ WebInspector.documentCopy = function(event)
         WebInspector[this.currentFocusElement.id + "Copy"](event);
 }
 
+WebInspector.contextMenu = function(event)
+{
+    if (event.handled || event.target.hasStyleClass("popup-glasspane"))
+        event.preventDefault();
+}
+
 WebInspector.mainKeyDown = function(event)
 {
     if (this.currentPanel && this.currentPanel.handleKeyEvent)
@@ -759,7 +834,7 @@ WebInspector.toolbarDrag = function(event)
     event.preventDefault();
 }
 
-WebInspector.elementDragStart = function(element, dividerDrag, elementDragEnd, event, cursor) 
+WebInspector.elementDragStart = function(element, dividerDrag, elementDragEnd, event, cursor)
 {
     if (this._elementDraggingEventListener || this._elementEndDraggingEventListener)
         this.elementDragEnd(event);
@@ -790,7 +865,12 @@ WebInspector.elementDragEnd = function(event)
 
 WebInspector.showConsole = function()
 {
-    this.console.show();
+    this.drawer.showView(this.console);
+}
+
+WebInspector.showChanges = function()
+{
+    this.drawer.showView(this.changes);
 }
 
 WebInspector.showElementsPanel = function()
@@ -813,9 +893,9 @@ WebInspector.showProfilesPanel = function()
     this.currentPanel = this.panels.profiles;
 }
 
-WebInspector.showDatabasesPanel = function()
+WebInspector.showStoragePanel = function()
 {
-    this.currentPanel = this.panels.databases;
+    this.currentPanel = this.panels.storage;
 }
 
 WebInspector.addResource = function(identifier, payload)
@@ -828,7 +908,9 @@ WebInspector.addResource = function(identifier, payload)
         payload.lastPathComponent,
         identifier,
         payload.isMainResource,
-        payload.cached);
+        payload.cached,
+        payload.requestMethod,
+        payload.requestFormData);
     this.resources[identifier] = resource;
     this.resourceURLMap[resource.url] = resource;
 
@@ -841,6 +923,23 @@ WebInspector.addResource = function(identifier, payload)
         this.panels.resources.addResource(resource);
 }
 
+WebInspector.clearConsoleMessages = function()
+{
+    WebInspector.console.clearMessages(false);
+}
+
+WebInspector.selectDatabase = function(o)
+{
+    WebInspector.showStoragePanel();
+    WebInspector.panels.storage.selectDatabase(o);
+}
+
+WebInspector.selectDOMStorage = function(o)
+{
+    WebInspector.showStoragePanel();
+    WebInspector.panels.storage.selectDOMStorage(o);
+}
+
 WebInspector.updateResource = function(identifier, payload)
 {
     var resource = this.resources[identifier];
@@ -854,6 +953,8 @@ WebInspector.updateResource = function(identifier, payload)
         resource.lastPathComponent = payload.lastPathComponent;
         resource.requestHeaders = payload.requestHeaders;
         resource.mainResource = payload.mainResource;
+        resource.requestMethod = payload.requestMethod;
+        resource.requestFormData = payload.requestFormData;
     }
 
     if (payload.didResponseChange) {
@@ -868,7 +969,7 @@ WebInspector.updateResource = function(identifier, payload)
     if (payload.didTypeChange) {
         resource.type = payload.type;
     }
-    
+
     if (payload.didLengthChange) {
         resource.contentLength = payload.contentLength;
     }
@@ -909,7 +1010,7 @@ WebInspector.addDatabase = function(payload)
         payload.domain,
         payload.name,
         payload.version);
-    this.panels.databases.addDatabase(database);
+    this.panels.storage.addDatabase(database);
 }
 
 WebInspector.addDOMStorage = function(payload)
@@ -918,7 +1019,7 @@ WebInspector.addDOMStorage = function(payload)
         payload.domStorage,
         payload.host,
         payload.isLocalStorage);
-    this.panels.databases.addDOMStorage(domStorage);
+    this.panels.storage.addDOMStorage(domStorage);
 }
 
 WebInspector.resourceTrackingWasEnabled = function()
@@ -966,9 +1067,9 @@ WebInspector.failedToParseScriptSource = function(sourceURL, source, startingLin
     this.panels.scripts.addScript(null, sourceURL, source, startingLine, errorLine, errorMessage);
 }
 
-WebInspector.pausedScript = function()
+WebInspector.pausedScript = function(callFrames)
 {
-    this.panels.scripts.debuggerPaused();
+    this.panels.scripts.debuggerPaused(callFrames);
 }
 
 WebInspector.resumedScript = function()
@@ -1005,11 +1106,6 @@ WebInspector.reset = function()
     this.console.clearMessages();
 }
 
-WebInspector.inspectedWindowCleared = function(inspectedWindow)
-{
-    this.panels.elements.inspectedWindowCleared(inspectedWindow);
-}
-
 WebInspector.resourceURLChanged = function(resource, oldURL)
 {
     delete this.resourceURLMap[oldURL];
@@ -1030,6 +1126,20 @@ WebInspector.addMessageToConsole = function(payload)
     this.console.addMessage(consoleMessage);
 }
 
+WebInspector.log = function(message)
+{
+    var msg = new WebInspector.ConsoleMessage(
+        WebInspector.ConsoleMessage.MessageSource.Other,
+        WebInspector.ConsoleMessage.MessageType.Log,
+        WebInspector.ConsoleMessage.MessageLevel.Debug,
+        -1,
+        null,
+        null,
+        1,
+        message);
+    this.console.addMessage(msg);
+}
+
 WebInspector.addProfile = function(profile)
 {
     this.panels.profiles.addProfile(profile);
@@ -1049,7 +1159,7 @@ WebInspector.drawLoadingPieChart = function(canvas, percent) {
     var r = 7;
 
     g.beginPath();
-    g.arc(cx, cy, r, 0, Math.PI * 2, false); 
+    g.arc(cx, cy, r, 0, Math.PI * 2, false);
     g.closePath();
 
     g.lineWidth = 1;
@@ -1063,15 +1173,16 @@ WebInspector.drawLoadingPieChart = function(canvas, percent) {
 
     g.beginPath();
     g.moveTo(cx, cy);
-    g.arc(cx, cy, r, startangle, endangle, false); 
+    g.arc(cx, cy, r, startangle, endangle, false);
     g.closePath();
 
     g.fillStyle = darkColor;
     g.fill();
 }
 
-WebInspector.updateFocusedNode = function(node)
+WebInspector.updateFocusedNode = function(nodeId)
 {
+    var node = WebInspector.domAgent.nodeForId(nodeId);
     if (!node)
         // FIXME: Should we deselect if null is passed in?
         return;
@@ -1179,7 +1290,7 @@ WebInspector.linkifyURLAsNode = function(url, linkText, classes, isExternal)
     a.title = url;
     a.target = "_blank";
     a.textContent = linkText;
-    
+
     return a;
 }
 
@@ -1261,6 +1372,11 @@ WebInspector.performSearch = function(event)
     this.currentPanel.performSearch(query);
 }
 
+WebInspector.addNodesToSearchResult = function(nodeIds)
+{
+    WebInspector.panels.elements.addNodesToSearchResult(nodeIds);
+}
+
 WebInspector.updateSearchMatchesCount = function(matches, panel)
 {
     if (!panel)
@@ -1317,7 +1433,7 @@ WebInspector.startEditing = function(element, committedCallback, cancelledCallba
         return;
     element.__editing = true;
 
-    var oldText = element.textContent;
+    var oldText = getContent(element);
     var oldHandleKeyEvent = element.handleKeyEvent;
     var moveDirection = "";
 
@@ -1331,6 +1447,13 @@ WebInspector.startEditing = function(element, committedCallback, cancelledCallba
         editingCommitted.call(element);
     }
 
+    function getContent(element) {
+        if (element.tagName === "INPUT" && element.type === "text")
+            return element.value;
+        else
+            return element.textContent;
+    }
+
     function cleanUpAfterEditing() {
         delete this.__editing;
 
@@ -1347,17 +1470,22 @@ WebInspector.startEditing = function(element, committedCallback, cancelledCallba
     }
 
     function editingCancelled() {
-        this.innerText = oldText;
+        if (this.tagName === "INPUT" && this.type === "text")
+            this.value = oldText;
+        else
+            this.textContent = oldText;
 
         cleanUpAfterEditing.call(this);
 
-        cancelledCallback(this, context);
+        if (cancelledCallback)
+            cancelledCallback(this, context);
     }
 
     function editingCommitted() {
         cleanUpAfterEditing.call(this);
 
-        committedCallback(this, this.textContent, oldText, context, moveDirection);
+        if (committedCallback)
+            committedCallback(this, getContent(this), oldText, context, moveDirection);
     }
 
     element.handleKeyEvent = function(event) {
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/treeoutline.js b/src/3rdparty/webkit/WebCore/inspector/front-end/treeoutline.js
index 579e7fb..ecc322b 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/treeoutline.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/treeoutline.js
@@ -249,35 +249,40 @@ TreeOutline.prototype._forgetChildrenRecursive = function(parentElement)
     }
 }
 
-TreeOutline.prototype.findTreeElement = function(representedObject, isAncestor, getParent, equal)
+TreeOutline.prototype.getCachedTreeElement = function(representedObject)
 {
     if (!representedObject)
         return null;
 
-    if (!equal)
-        equal = function(a, b) { return a === b };
-
     if ("__treeElementIdentifier" in representedObject) {
         // If this representedObject has a tree element identifier, and it is a known TreeElement
         // in our tree we can just return that tree element.
         var elements = this._knownTreeElements[representedObject.__treeElementIdentifier];
         if (elements) {
             for (var i = 0; i < elements.length; ++i)
-                if (equal(elements[i].representedObject, representedObject))
+                if (elements[i].representedObject === representedObject)
                     return elements[i];
         }
     }
+    return null;
+}
 
-    if (!isAncestor || !(isAncestor instanceof Function) || !getParent || !(getParent instanceof Function))
+TreeOutline.prototype.findTreeElement = function(representedObject, isAncestor, getParent)
+{
+    if (!representedObject)
         return null;
 
+    var cachedElement = this.getCachedTreeElement(representedObject);
+    if (cachedElement)
+        return cachedElement;
+
     // The representedObject isn't know, so we start at the top of the tree and work down to find the first
     // tree element that represents representedObject or one of its ancestors.
     var item;
     var found = false;
     for (var i = 0; i < this.children.length; ++i) {
         item = this.children[i];
-        if (equal(item.representedObject, representedObject) || isAncestor(item.representedObject, representedObject)) {
+        if (item.representedObject === representedObject || isAncestor(item.representedObject, representedObject)) {
             found = true;
             break;
         }
@@ -292,7 +297,7 @@ TreeOutline.prototype.findTreeElement = function(representedObject, isAncestor,
     var currentObject = representedObject;
     while (currentObject) {
         ancestors.unshift(currentObject);
-        if (equal(currentObject, item.representedObject))
+        if (currentObject === item.representedObject)
             break;
         currentObject = getParent(currentObject);
     }
@@ -301,18 +306,16 @@ TreeOutline.prototype.findTreeElement = function(representedObject, isAncestor,
     for (var i = 0; i < ancestors.length; ++i) {
         // Make sure we don't call findTreeElement with the same representedObject
         // again, to prevent infinite recursion.
-        if (equal(ancestors[i], representedObject))
+        if (ancestors[i] === representedObject)
             continue;
         // FIXME: we could do something faster than findTreeElement since we will know the next
         // ancestor exists in the tree.
-        item = this.findTreeElement(ancestors[i], isAncestor, getParent, equal);
+        item = this.findTreeElement(ancestors[i], isAncestor, getParent);
         if (item && item.onpopulate)
             item.onpopulate(item);
     }
 
-    // Now that all the ancestors are populated, try to find the representedObject again. This time
-    // without the isAncestor and getParent functions to prevent an infinite recursion if it isn't found.
-    return this.findTreeElement(representedObject, null, null, equal);
+    return this.getCachedTreeElement(representedObject);
 }
 
 TreeOutline.prototype.treeElementFromPoint = function(x, y)
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/utilities.js b/src/3rdparty/webkit/WebCore/inspector/front-end/utilities.js
index 4285785..e831abd 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/utilities.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/utilities.js
@@ -26,83 +26,31 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-Object.type = function(obj, win)
+Object.proxyType = function(objectProxy)
 {
-    if (obj === null)
+    if (objectProxy === null)
         return "null";
 
-    var type = typeof obj;
+    var type = typeof objectProxy;
     if (type !== "object" && type !== "function")
         return type;
 
-    win = win || window;
-
-    if (obj instanceof win.Node)
-        return (obj.nodeType === undefined ? type : "node");
-    if (obj instanceof win.String)
-        return "string";
-    if (obj instanceof win.Array)
-        return "array";
-    if (obj instanceof win.Boolean)
-        return "boolean";
-    if (obj instanceof win.Number)
-        return "number";
-    if (obj instanceof win.Date)
-        return "date";
-    if (obj instanceof win.RegExp)
-        return "regexp";
-    if (obj instanceof win.Error)
-        return "error";
-    return type;
+    return objectProxy.type;
 }
 
-Object.hasProperties = function(obj)
-{
-    if (typeof obj === "undefined" || typeof obj === "null")
-        return false;
-    for (var name in obj)
-        return true;
-    return false;
-}
-
-Object.describe = function(obj, abbreviated)
-{
-    var type1 = Object.type(obj);
-    var type2 = Object.prototype.toString.call(obj).replace(/^\[object (.*)\]$/i, "$1");
-
-    switch (type1) {
-    case "object":
-    case "node":
-        return type2;
-    case "array":
-        return "[" + obj.toString() + "]";
-    case "string":
-        if (obj.length > 100)
-            return "\"" + obj.substring(0, 100) + "\u2026\"";
-        return "\"" + obj + "\"";
-    case "function":
-        var objectText = String(obj);
-        if (!/^function /.test(objectText))
-            objectText = (type2 == "object") ? type1 : type2;
-        else if (abbreviated)
-            objectText = /.*/.exec(obj)[0].replace(/ +$/g, "");
-        return objectText;
-    case "regexp":
-        return String(obj).replace(/([\\\/])/g, "\\$1").replace(/\\(\/[gim]*)$/, "$1").substring(1);
-    default:
-        return String(obj);
-    }
-}
-
-Object.sortedProperties = function(obj, sortFunc)
+Object.properties = function(obj)
 {
     var properties = [];
     for (var prop in obj)
         properties.push(prop);
-    properties.sort(sortFunc);
     return properties;
 }
 
+Object.sortedProperties = function(obj, sortFunc)
+{
+    return Object.properties(obj).sort(sortFunc);
+}
+
 Function.prototype.bind = function(thisObject)
 {
     var func = this;
@@ -232,9 +180,15 @@ Element.prototype.hasStyleClass = function(className)
     return regex.test(this.className);
 }
 
+Element.prototype.positionAt = function(x, y)
+{
+    this.style.left = x + "px";
+    this.style.top = y + "px";
+}
+
 Node.prototype.enclosingNodeOrSelfWithNodeNameInArray = function(nameArray)
 {
-    for (var node = this; node && !objectsAreSame(node, this.ownerDocument); node = node.parentNode)
+    for (var node = this; node && node !== this.ownerDocument; node = node.parentNode)
         for (var i = 0; i < nameArray.length; ++i)
             if (node.nodeName.toLowerCase() === nameArray[i].toLowerCase())
                 return node;
@@ -248,7 +202,7 @@ Node.prototype.enclosingNodeOrSelfWithNodeName = function(nodeName)
 
 Node.prototype.enclosingNodeOrSelfWithClass = function(className)
 {
-    for (var node = this; node && !objectsAreSame(node, this.ownerDocument); node = node.parentNode)
+    for (var node = this; node && node !== this.ownerDocument; node = node.parentNode)
         if (node.nodeType === Node.ELEMENT_NODE && node.hasStyleClass(className))
             return node;
     return null;
@@ -297,16 +251,34 @@ Element.prototype.__defineGetter__("totalOffsetTop", function()
     return total;
 });
 
+Element.prototype.offsetRelativeToWindow = function(targetWindow)
+{
+    var elementOffset = {x: 0, y: 0};
+    var curElement = this;
+    var curWindow = this.ownerDocument.defaultView;
+    while (curWindow && curElement) {
+        elementOffset.x += curElement.totalOffsetLeft;
+        elementOffset.y += curElement.totalOffsetTop;
+        if (curWindow === targetWindow)
+            break;
+
+        curElement = curWindow.frameElement;
+        curWindow = curWindow.parent;
+    }
+
+    return elementOffset;
+}
+
 Element.prototype.firstChildSkippingWhitespace = firstChildSkippingWhitespace;
 Element.prototype.lastChildSkippingWhitespace = lastChildSkippingWhitespace;
 
 Node.prototype.isWhitespace = isNodeWhitespace;
-Node.prototype.nodeTypeName = nodeTypeName;
 Node.prototype.displayName = nodeDisplayName;
-Node.prototype.contentPreview = nodeContentPreview;
-Node.prototype.isAncestor = isAncestorNode;
+Node.prototype.isAncestor = function(node)
+{
+    return isAncestorNode(this, node);
+};
 Node.prototype.isDescendant = isDescendantNode;
-Node.prototype.firstCommonAncestor = firstCommonNodeAncestor;
 Node.prototype.nextSiblingSkippingWhitespace = nextSiblingSkippingWhitespace;
 Node.prototype.previousSiblingSkippingWhitespace = previousSiblingSkippingWhitespace;
 Node.prototype.traverseNextNode = traverseNextNode;
@@ -381,113 +353,6 @@ String.prototype.trimURL = function(baseURLDomain)
     return result;
 }
 
-function getStyleTextWithShorthands(style)
-{
-    var cssText = "";
-    var foundProperties = {};
-    for (var i = 0; i < style.length; ++i) {
-        var individualProperty = style[i];
-        var shorthandProperty = style.getPropertyShorthand(individualProperty);
-        var propertyName = (shorthandProperty || individualProperty);
-
-        if (propertyName in foundProperties)
-            continue;
-
-        if (shorthandProperty) {
-            var value = getShorthandValue(style, shorthandProperty);
-            var priority = getShorthandPriority(style, shorthandProperty);
-        } else {
-            var value = style.getPropertyValue(individualProperty);
-            var priority = style.getPropertyPriority(individualProperty);
-        }
-
-        foundProperties[propertyName] = true;
-
-        cssText += propertyName + ": " + value;
-        if (priority)
-            cssText += " !" + priority;
-        cssText += "; ";
-    }
-
-    return cssText;
-}
-
-function getShorthandValue(style, shorthandProperty)
-{
-    var value = style.getPropertyValue(shorthandProperty);
-    if (!value) {
-        // Some shorthands (like border) return a null value, so compute a shorthand value.
-        // FIXME: remove this when http://bugs.webkit.org/show_bug.cgi?id=15823 is fixed.
-
-        var foundProperties = {};
-        for (var i = 0; i < style.length; ++i) {
-            var individualProperty = style[i];
-            if (individualProperty in foundProperties || style.getPropertyShorthand(individualProperty) !== shorthandProperty)
-                continue;
-
-            var individualValue = style.getPropertyValue(individualProperty);
-            if (style.isPropertyImplicit(individualProperty) || individualValue === "initial")
-                continue;
-
-            foundProperties[individualProperty] = true;
-
-            if (!value)
-                value = "";
-            else if (value.length)
-                value += " ";
-            value += individualValue;
-        }
-    }
-    return value;
-}
-
-function getShorthandPriority(style, shorthandProperty)
-{
-    var priority = style.getPropertyPriority(shorthandProperty);
-    if (!priority) {
-        for (var i = 0; i < style.length; ++i) {
-            var individualProperty = style[i];
-            if (style.getPropertyShorthand(individualProperty) !== shorthandProperty)
-                continue;
-            priority = style.getPropertyPriority(individualProperty);
-            break;
-        }
-    }
-    return priority;
-}
-
-function getLonghandProperties(style, shorthandProperty)
-{
-    var properties = [];
-    var foundProperties = {};
-
-    for (var i = 0; i < style.length; ++i) {
-        var individualProperty = style[i];
-        if (individualProperty in foundProperties || style.getPropertyShorthand(individualProperty) !== shorthandProperty)
-            continue;
-        foundProperties[individualProperty] = true;
-        properties.push(individualProperty);
-    }
-
-    return properties;
-}
-
-function getUniqueStyleProperties(style)
-{
-    var properties = [];
-    var foundProperties = {};
-
-    for (var i = 0; i < style.length; ++i) {
-        var property = style[i];
-        if (property in foundProperties)
-            continue;
-        foundProperties[property] = true;
-        properties.push(property);
-    }
-
-    return properties;
-}
-
 function isNodeWhitespace()
 {
     if (!this || this.nodeType !== Node.TEXT_NODE)
@@ -497,29 +362,6 @@ function isNodeWhitespace()
     return this.nodeValue.match(/^[\s\xA0]+$/);
 }
 
-function nodeTypeName()
-{
-    if (!this)
-        return "(unknown)";
-
-    switch (this.nodeType) {
-        case Node.ELEMENT_NODE: return "Element";
-        case Node.ATTRIBUTE_NODE: return "Attribute";
-        case Node.TEXT_NODE: return "Text";
-        case Node.CDATA_SECTION_NODE: return "Character Data";
-        case Node.ENTITY_REFERENCE_NODE: return "Entity Reference";
-        case Node.ENTITY_NODE: return "Entity";
-        case Node.PROCESSING_INSTRUCTION_NODE: return "Processing Instruction";
-        case Node.COMMENT_NODE: return "Comment";
-        case Node.DOCUMENT_NODE: return "Document";
-        case Node.DOCUMENT_TYPE_NODE: return "Document Type";
-        case Node.DOCUMENT_FRAGMENT_NODE: return "Document Fragment";
-        case Node.NOTATION_NODE: return "Notation";
-    }
-
-    return "(unknown)";
-}
-
 function nodeDisplayName()
 {
     if (!this)
@@ -594,90 +436,23 @@ function nodeDisplayName()
     return this.nodeName.toLowerCase().collapseWhitespace();
 }
 
-function nodeContentPreview()
-{
-    if (!this || !this.hasChildNodes || !this.hasChildNodes())
-        return "";
-
-    var limit = 0;
-    var preview = "";
-
-    // always skip whitespace here
-    var currentNode = traverseNextNode.call(this, true, this);
-    while (currentNode) {
-        if (currentNode.nodeType === Node.TEXT_NODE)
-            preview += currentNode.nodeValue.escapeHTML();
-        else
-            preview += nodeDisplayName.call(currentNode).escapeHTML();
-
-        currentNode = traverseNextNode.call(currentNode, true, this);
-
-        if (++limit > 4) {
-            preview += "&#x2026;"; // ellipsis
-            break;
-        }
-    }
-
-    return preview.collapseWhitespace();
-}
-
-function objectsAreSame(a, b)
-{
-    // FIXME: Make this more generic so is works with any wrapped object, not just nodes.
-    // This function is used to compare nodes that might be JSInspectedObjectWrappers, since
-    // JavaScript equality is not true for JSInspectedObjectWrappers of the same node wrapped
-    // with different global ExecStates, we use isSameNode to compare them.
-    if (a === b)
-        return true;
-    if (!a || !b)
-        return false;
-    if (a.isSameNode && b.isSameNode)
-        return a.isSameNode(b);
-    return false;
-}
-
-function isAncestorNode(ancestor)
+function isAncestorNode(ancestor, node)
 {
-    if (!this || !ancestor)
+    if (!node || !ancestor)
         return false;
 
-    var currentNode = ancestor.parentNode;
+    var currentNode = node.parentNode;
     while (currentNode) {
-        if (objectsAreSame(this, currentNode))
+        if (ancestor === currentNode)
             return true;
         currentNode = currentNode.parentNode;
     }
-
     return false;
 }
 
 function isDescendantNode(descendant)
 {
-    return isAncestorNode.call(descendant, this);
-}
-
-function firstCommonNodeAncestor(node)
-{
-    if (!this || !node)
-        return;
-
-    var node1 = this.parentNode;
-    var node2 = node.parentNode;
-
-    if ((!node1 || !node2) || !objectsAreSame(node1, node2))
-        return null;
-
-    while (node1 && node2) {
-        if (!node1.parentNode || !node2.parentNode)
-            break;
-        if (!objectsAreSame(node1, node2))
-            break;
-
-        node1 = node1.parentNode;
-        node2 = node2.parentNode;
-    }
-
-    return node1;
+    return isAncestorNode(descendant, this);
 }
 
 function nextSiblingSkippingWhitespace()
@@ -729,7 +504,7 @@ function traverseNextNode(skipWhitespace, stayWithin)
     if (node)
         return node;
 
-    if (stayWithin && objectsAreSame(this, stayWithin))
+    if (stayWithin && this === stayWithin)
         return null;
 
     node = skipWhitespace ? nextSiblingSkippingWhitespace.call(this) : this.nextSibling;
@@ -737,7 +512,7 @@ function traverseNextNode(skipWhitespace, stayWithin)
         return node;
 
     node = this;
-    while (node && !(skipWhitespace ? nextSiblingSkippingWhitespace.call(node) : node.nextSibling) && (!stayWithin || !node.parentNode || !objectsAreSame(node.parentNode, stayWithin)))
+    while (node && !(skipWhitespace ? nextSiblingSkippingWhitespace.call(node) : node.nextSibling) && (!stayWithin || !node.parentNode || node.parentNode !== stayWithin))
         node = node.parentNode;
     if (!node)
         return null;
@@ -749,7 +524,7 @@ function traversePreviousNode(skipWhitespace, stayWithin)
 {
     if (!this)
         return;
-    if (stayWithin && objectsAreSame(this, stayWithin))
+    if (stayWithin && this === stayWithin)
         return null;
     var node = skipWhitespace ? previousSiblingSkippingWhitespace.call(this) : this.previousSibling;
     while (node && (skipWhitespace ? lastChildSkippingWhitespace.call(node) : node.lastChild) )
@@ -850,21 +625,8 @@ function getDocumentForNode(node) {
     return node.nodeType == Node.DOCUMENT_NODE ? node : node.ownerDocument;
 }
 
-function parentNodeOrFrameElement(node) {
-    var parent = node.parentNode;
-    if (parent)
-        return parent;
-
-    return getDocumentForNode(node).defaultView.frameElement;
-}
-
-function isAncestorIncludingParentFrames(a, b) {
-    if (objectsAreSame(a, b))
-        return false;
-    for (var node = b; node; node = getDocumentForNode(node).defaultView.frameElement)
-        if (objectsAreSame(a, node) || isAncestorNode.call(a, node))
-            return true;
-    return false;
+function parentNode(node) {
+    return node.parentNode;
 }
 
 Number.secondsToString = function(seconds, formatterFunction, higherResolution)
@@ -893,20 +655,27 @@ Number.secondsToString = function(seconds, formatterFunction, higherResolution)
     return formatterFunction("%.1f days", days);
 }
 
-Number.bytesToString = function(bytes, formatterFunction)
+Number.bytesToString = function(bytes, formatterFunction, higherResolution)
 {
     if (!formatterFunction)
         formatterFunction = String.sprintf;
+    if (typeof higherResolution === "undefined")
+        higherResolution = true;
 
     if (bytes < 1024)
         return formatterFunction("%.0fB", bytes);
 
     var kilobytes = bytes / 1024;
-    if (kilobytes < 1024)
+    if (higherResolution && kilobytes < 1024)
         return formatterFunction("%.2fKB", kilobytes);
+    else if (kilobytes < 1024)
+        return formatterFunction("%.0fKB", kilobytes);
 
     var megabytes = kilobytes / 1024;
-    return formatterFunction("%.3fMB", megabytes);
+    if (higherResolution)
+        return formatterFunction("%.3fMB", megabytes);
+    else
+        return formatterFunction("%.0fMB", megabytes);
 }
 
 Number.constrain = function(num, min, max)
diff --git a/src/3rdparty/webkit/WebCore/loader/Cache.cpp b/src/3rdparty/webkit/WebCore/loader/Cache.cpp
index 250ea0d..14edae9 100644
--- a/src/3rdparty/webkit/WebCore/loader/Cache.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/Cache.cpp
@@ -182,6 +182,7 @@ void Cache::revalidateResource(CachedResource* resource, DocLoader* docLoader)
 {
     ASSERT(resource);
     ASSERT(resource->inCache());
+    ASSERT(resource == m_resources.get(resource->url()));
     ASSERT(!disabled());
     if (resource->resourceToRevalidate())
         return;
@@ -190,7 +191,7 @@ void Cache::revalidateResource(CachedResource* resource, DocLoader* docLoader)
         return;
     }
     const String& url = resource->url();
-    CachedResource* newResource = createResource(resource->type(), KURL(url), resource->encoding());
+    CachedResource* newResource = createResource(resource->type(), KURL(ParsedURLString, url), resource->encoding());
     newResource->setResourceToRevalidate(resource);
     evict(resource);
     m_resources.set(url, newResource);
@@ -205,6 +206,7 @@ void Cache::revalidationSucceeded(CachedResource* revalidatingResource, const Re
     ASSERT(resource);
     ASSERT(!resource->inCache());
     ASSERT(resource->isLoaded());
+    ASSERT(revalidatingResource->inCache());
     
     evict(revalidatingResource);
 
@@ -351,7 +353,7 @@ void Cache::pruneDeadResources()
         current = m_allResources[i].m_tail;
         while (current) {
             CachedResource* prev = current->m_prevInAllResourcesList;
-            if (!current->hasClients() && !current->isPreloaded()) {
+            if (!current->hasClients() && !current->isPreloaded() && !current->isCacheValidator()) {
                 evict(current);
                 // If evict() caused pruneDeadResources() to be re-entered, bail out. This can happen when removing an
                 // SVG CachedImage that has subresources.
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedFont.cpp b/src/3rdparty/webkit/WebCore/loader/CachedFont.cpp
index af18cc9..9cf152d 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedFont.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/CachedFont.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,12 +27,16 @@
 #include "config.h"
 #include "CachedFont.h"
 
+#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && (PLATFORM(WIN_OS) || PLATFORM(LINUX))) || PLATFORM(HAIKU) || PLATFORM(WINCE)
+#define STORE_FONT_CUSTOM_PLATFORM_DATA
+#endif
+
 #include "Cache.h"
 #include "CachedResourceClient.h"
 #include "CachedResourceClientWalker.h"
 #include "DOMImplementation.h"
 #include "FontPlatformData.h"
-#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && PLATFORM(WIN_OS))
+#ifdef STORE_FONT_CUSTOM_PLATFORM_DATA
 #include "FontCustomPlatformData.h"
 #endif
 #include "TextResourceDecoder.h"
@@ -60,7 +65,7 @@ CachedFont::CachedFont(const String &url)
 
 CachedFont::~CachedFont()
 {
-#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && PLATFORM(WIN_OS))
+#ifdef STORE_FONT_CUSTOM_PLATFORM_DATA
     delete m_fontData;
 #endif
 }
@@ -98,7 +103,7 @@ void CachedFont::beginLoadIfNeeded(DocLoader* dl)
 
 bool CachedFont::ensureCustomFontData()
 {
-#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && PLATFORM(WIN_OS))
+#ifdef STORE_FONT_CUSTOM_PLATFORM_DATA
 #if ENABLE(SVG_FONTS)
     ASSERT(!m_isSVGFont);
 #endif
@@ -117,7 +122,7 @@ FontPlatformData CachedFont::platformDataFromCustomData(float size, bool bold, b
     if (m_externalSVGDocument)
         return FontPlatformData(size, bold, italic);
 #endif
-#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && PLATFORM(WIN_OS))
+#ifdef STORE_FONT_CUSTOM_PLATFORM_DATA
     ASSERT(m_fontData);
     return m_fontData->fontPlatformData(static_cast<int>(size), bold, italic, renderingMode);
 #else
@@ -173,7 +178,7 @@ SVGFontElement* CachedFont::getSVGFontById(const String& fontName) const
 
 void CachedFont::allClientsRemoved()
 {
-#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && PLATFORM(WIN_OS))
+#ifdef STORE_FONT_CUSTOM_PLATFORM_DATA
     if (m_fontData) {
         delete m_fontData;
         m_fontData = 0;
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedResource.cpp b/src/3rdparty/webkit/WebCore/loader/CachedResource.cpp
index 478873f..43de633 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedResource.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/CachedResource.cpp
@@ -59,7 +59,7 @@ CachedResource::CachedResource(const String& url, Type type)
     , m_docLoader(0)
     , m_handleCount(0)
     , m_resourceToRevalidate(0)
-    , m_isBeingRevalidated(false)
+    , m_proxyResource(0)
 {
 #ifndef NDEBUG
     cachedResourceLeakCounter.increment();
@@ -89,6 +89,8 @@ CachedResource::CachedResource(const String& url, Type type)
 
 CachedResource::~CachedResource()
 {
+    ASSERT(!m_resourceToRevalidate); // Should be true because canDelete() checks this.
+    ASSERT(canDelete());
     ASSERT(!inCache());
     ASSERT(!m_deleted);
     ASSERT(url().isNull() || cache()->resourceForURL(url()) != this);
@@ -97,9 +99,6 @@ CachedResource::~CachedResource()
     cachedResourceLeakCounter.decrement();
 #endif
 
-    if (m_resourceToRevalidate)
-        m_resourceToRevalidate->m_isBeingRevalidated = false;
-
     if (m_docLoader)
         m_docLoader->removeCachedResource(this);
 }
@@ -298,18 +297,26 @@ void CachedResource::setResourceToRevalidate(CachedResource* resource)
     ASSERT(resource);
     ASSERT(!m_resourceToRevalidate);
     ASSERT(resource != this);
-    ASSERT(!resource->m_isBeingRevalidated);
     ASSERT(m_handlesToRevalidate.isEmpty());
     ASSERT(resource->type() == type());
-    resource->m_isBeingRevalidated = true;
+
+    // The following assert should be investigated whenever it occurs. Although it should never fire, it currently does in rare circumstances.
+    // https://bugs.webkit.org/show_bug.cgi?id=28604.
+    // So the code needs to be robust to this assert failing thus the "if (m_resourceToRevalidate->m_proxyResource == this)" in CachedResource::clearResourceToRevalidate.
+    ASSERT(!resource->m_proxyResource);
+
+    resource->m_proxyResource = this;
     m_resourceToRevalidate = resource;
 }
 
 void CachedResource::clearResourceToRevalidate() 
 { 
     ASSERT(m_resourceToRevalidate);
-    m_resourceToRevalidate->m_isBeingRevalidated = false;
-    m_resourceToRevalidate->deleteIfPossible();
+    // A resource may start revalidation before this method has been called, so check that this resource is still the proxy resource before clearing it out.
+    if (m_resourceToRevalidate->m_proxyResource == this) {
+        m_resourceToRevalidate->m_proxyResource = 0;
+        m_resourceToRevalidate->deleteIfPossible();
+    }
     m_handlesToRevalidate.clear();
     m_resourceToRevalidate = 0;
     deleteIfPossible();
@@ -403,7 +410,7 @@ bool CachedResource::mustRevalidate(CachePolicy cachePolicy) const
 
 bool CachedResource::isSafeToMakePurgeable() const
 { 
-    return !hasClients() && !m_isBeingRevalidated && !m_resourceToRevalidate; 
+    return !hasClients() && !m_proxyResource && !m_resourceToRevalidate;
 }
 
 bool CachedResource::makePurgeable(bool purgeable) 
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedResource.h b/src/3rdparty/webkit/WebCore/loader/CachedResource.h
index babdf89..05d24fc 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedResource.h
+++ b/src/3rdparty/webkit/WebCore/loader/CachedResource.h
@@ -129,7 +129,7 @@ public:
     // while still being referenced. This means the object should delete itself
     // if the number of clients observing it ever drops to 0.
     // The resource can be brought back to cache after successful revalidation.
-    void setInCache(bool b) { m_inCache = b; if (b) m_isBeingRevalidated = false; }
+    void setInCache(bool inCache) { m_inCache = inCache; }
     bool inCache() const { return m_inCache; }
     
     void setInLiveDecodedResourcesList(bool b) { m_inLiveDecodedResourcesList = b; }
@@ -142,7 +142,7 @@ public:
     void setResponse(const ResourceResponse&);
     const ResourceResponse& response() const { return m_response; }
 
-    bool canDelete() const { return !hasClients() && !m_request && !m_preloadCount && !m_handleCount && !m_resourceToRevalidate && !m_isBeingRevalidated; }
+    bool canDelete() const { return !hasClients() && !m_request && !m_preloadCount && !m_handleCount && !m_resourceToRevalidate && !m_proxyResource; }
 
     bool isExpired() const;
 
@@ -251,7 +251,10 @@ private:
     // to to be clients of m_resourceToRevalidate and the resource is deleted. If not, the field is zeroed and this
     // resources becomes normal resource load.
     CachedResource* m_resourceToRevalidate;
-    bool m_isBeingRevalidated;
+
+    // If this field is non-null, the resource has a proxy for checking whether it is still up to date (see m_resourceToRevalidate).
+    CachedResource* m_proxyResource;
+
     // These handles will need to be updated to point to the m_resourceToRevalidate in case we get 304 response.
     HashSet<CachedResourceHandleBase*> m_handlesToRevalidate;
 };
diff --git a/src/3rdparty/webkit/WebCore/loader/CrossOriginPreflightResultCache.cpp b/src/3rdparty/webkit/WebCore/loader/CrossOriginPreflightResultCache.cpp
index 4bd05b2..cea66b1 100644
--- a/src/3rdparty/webkit/WebCore/loader/CrossOriginPreflightResultCache.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/CrossOriginPreflightResultCache.cpp
@@ -30,6 +30,8 @@
 #include "CrossOriginAccessControl.h"
 #include "ResourceResponse.h"
 #include <wtf/CurrentTime.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/Threading.h>
 
 namespace WebCore {
 
@@ -64,8 +66,7 @@ static void addToAccessControlAllowList(const String& string, unsigned start, un
     while (end && isSpaceOrNewline((*stringImpl)[end]))
         --end;
 
-    // substringCopy() is called on the strings because the cache is accessed on multiple threads.
-    set.add(string.substringCopy(start, end - start + 1));
+    set.add(string.substring(start, end - start + 1));
 }
 
 template<class HashType>
@@ -137,20 +138,20 @@ bool CrossOriginPreflightResultCacheItem::allowsRequest(bool includeCredentials,
 
 CrossOriginPreflightResultCache& CrossOriginPreflightResultCache::shared()
 {
-    AtomicallyInitializedStatic(CrossOriginPreflightResultCache&, cache = *new CrossOriginPreflightResultCache);
+    DEFINE_STATIC_LOCAL(CrossOriginPreflightResultCache, cache, ());
+    ASSERT(isMainThread());
     return cache;
 }
 
 void CrossOriginPreflightResultCache::appendEntry(const String& origin, const KURL& url, CrossOriginPreflightResultCacheItem* preflightResult)
 {
-    MutexLocker lock(m_mutex);
-    // Note that the entry may already be present in the HashMap if another thread is accessing the same location.
-    m_preflightHashMap.set(std::make_pair(origin.copy(), url.copy()), preflightResult);
+    ASSERT(isMainThread());
+    m_preflightHashMap.set(std::make_pair(origin, url), preflightResult);
 }
 
 bool CrossOriginPreflightResultCache::canSkipPreflight(const String& origin, const KURL& url, bool includeCredentials, const String& method, const HTTPHeaderMap& requestHeaders)
 {
-    MutexLocker lock(m_mutex);
+    ASSERT(isMainThread());
     CrossOriginPreflightResultHashMap::iterator cacheIt = m_preflightHashMap.find(std::make_pair(origin, url));
     if (cacheIt == m_preflightHashMap.end())
         return false;
@@ -165,7 +166,7 @@ bool CrossOriginPreflightResultCache::canSkipPreflight(const String& origin, con
 
 void CrossOriginPreflightResultCache::empty()
 {
-    MutexLocker lock(m_mutex);
+    ASSERT(isMainThread());
     deleteAllValues(m_preflightHashMap);
     m_preflightHashMap.clear();
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/CrossOriginPreflightResultCache.h b/src/3rdparty/webkit/WebCore/loader/CrossOriginPreflightResultCache.h
index f71d1c8..97b526a 100644
--- a/src/3rdparty/webkit/WebCore/loader/CrossOriginPreflightResultCache.h
+++ b/src/3rdparty/webkit/WebCore/loader/CrossOriginPreflightResultCache.h
@@ -72,7 +72,6 @@ namespace WebCore {
         typedef HashMap<std::pair<String, KURL>, CrossOriginPreflightResultCacheItem*> CrossOriginPreflightResultHashMap;
 
         CrossOriginPreflightResultHashMap m_preflightHashMap;
-        Mutex m_mutex;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/DocLoader.cpp b/src/3rdparty/webkit/WebCore/loader/DocLoader.cpp
index 0b72f94..5eb7acf 100644
--- a/src/3rdparty/webkit/WebCore/loader/DocLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/DocLoader.cpp
@@ -192,6 +192,41 @@ bool DocLoader::canRequest(CachedResource::Type type, const KURL& url)
         ASSERT_NOT_REACHED();
         break;
     }
+
+    // Given that the load is allowed by the same-origin policy, we should
+    // check whether the load passes the mixed-content policy.
+    //
+    // Note: Currently, we always allow mixed content, but we generate a
+    //       callback to the FrameLoaderClient in case the embedder wants to
+    //       update any security indicators.
+    // 
+    switch (type) {
+    case CachedResource::Script:
+#if ENABLE(XSLT)
+    case CachedResource::XSLStyleSheet:
+#endif
+#if ENABLE(XBL)
+    case CachedResource::XBL:
+#endif
+        // These resource can inject script into the current document.
+        if (Frame* f = frame())
+            f->loader()->checkIfRunInsecureContent(m_doc->securityOrigin(), url);
+        break;
+    case CachedResource::ImageResource:
+    case CachedResource::CSSStyleSheet:
+    case CachedResource::FontResource: {
+        // These resources can corrupt only the frame's pixels.
+        if (Frame* f = frame()) {
+            Frame* top = f->tree()->top();
+            top->loader()->checkIfDisplayInsecureContent(top->document()->securityOrigin(), url);
+        }
+        break;
+    }
+    default:
+        ASSERT_NOT_REACHED();
+        break;
+    }
+    // FIXME: Consider letting the embedder block mixed content loads.
     return true;
 }
 
@@ -217,7 +252,7 @@ CachedResource* DocLoader::requestResource(CachedResource::Type type, const Stri
     if (resource) {
         // Check final URL of resource to catch redirects.
         // See <https://bugs.webkit.org/show_bug.cgi?id=21963>.
-        if (!canRequest(type, KURL(resource->url())))
+        if (fullURL != resource->url() && !canRequest(type, KURL(ParsedURLString, resource->url())))
             return 0;
 
         m_documentResources.set(resource->url(), resource);
diff --git a/src/3rdparty/webkit/WebCore/loader/DocumentLoader.cpp b/src/3rdparty/webkit/WebCore/loader/DocumentLoader.cpp
index 812d17b..820cb36 100644
--- a/src/3rdparty/webkit/WebCore/loader/DocumentLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/DocumentLoader.cpp
@@ -29,11 +29,7 @@
 #include "config.h"
 #include "DocumentLoader.h"
 
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-#include "ApplicationCache.h"
-#include "ApplicationCacheGroup.h"
-#include "ApplicationCacheResource.h"
-#endif
+#include "ApplicationCacheHost.h"
 #include "ArchiveFactory.h"
 #include "ArchiveResourceCollection.h"
 #include "CachedPage.h"
@@ -148,12 +144,11 @@ DocumentLoader::DocumentLoader(const ResourceRequest& req, const SubstituteData&
     , m_gotFirstByte(false)
     , m_primaryLoadComplete(false)
     , m_isClientRedirect(false)
-    , m_loadingFromCachedPage(false)
     , m_stopRecordingResponses(false)
     , m_substituteResourceDeliveryTimer(this, &DocumentLoader::substituteResourceDeliveryTimerFired)
     , m_didCreateGlobalHistoryEntry(false)
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    , m_candidateApplicationCacheGroup(0)
+    , m_applicationCacheHost(new ApplicationCacheHost(this))
 #endif
 {
 }
@@ -168,13 +163,6 @@ FrameLoader* DocumentLoader::frameLoader() const
 DocumentLoader::~DocumentLoader()
 {
     ASSERT(!m_frame || frameLoader()->activeDocumentLoader() != this || !frameLoader()->isLoading());
-    
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    if (m_applicationCache)
-        m_applicationCache->group()->disassociateDocumentLoader(this);
-    else if (m_candidateApplicationCacheGroup)
-        m_candidateApplicationCacheGroup->disassociateDocumentLoader(this);
-#endif
 }
 
 PassRefPtr<SharedBuffer> DocumentLoader::mainResourceData() const
@@ -258,14 +246,7 @@ void DocumentLoader::mainReceivedError(const ResourceError& error, bool isComple
     ASSERT(!error.isNull());
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    ApplicationCacheGroup* group = m_candidateApplicationCacheGroup;
-    if (!group && m_applicationCache) {
-        ASSERT(!mainResourceApplicationCache()); // If the main resource were loaded from a cache, it wouldn't fail.
-        group = m_applicationCache->group();
-    }
-    
-    if (group)
-        group->failedLoadingMainResource(this);
+    m_applicationCacheHost->failedLoadingMainResource();
 #endif
     
     if (!frameLoader())
@@ -292,7 +273,7 @@ void DocumentLoader::stopLoading(DatabasePolicy databasePolicy)
         Document* doc = m_frame->document();
         
         if (loading || doc->parsing())
-            m_frame->loader()->stopLoading(false, databasePolicy);
+            m_frame->loader()->stopLoading(UnloadEventPolicyNone, databasePolicy);
     }
 
     // Always cancel multipart loaders
@@ -430,6 +411,9 @@ void DocumentLoader::attachToFrame()
 void DocumentLoader::detachFromFrame()
 {
     ASSERT(m_frame);
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    m_applicationCacheHost->setDOMApplicationCache(0);
+#endif
     m_frame = 0;
 }
 
@@ -451,9 +435,6 @@ void DocumentLoader::setPrimaryLoadComplete(bool flag)
     if (flag) {
         if (m_mainResourceLoader) {
             m_mainResourceData = m_mainResourceLoader->resourceData();
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-            m_mainResourceApplicationCache = m_mainResourceLoader->applicationCache();
-#endif
             m_mainResourceLoader = 0;
         }
 
@@ -519,7 +500,7 @@ ArchiveResource* DocumentLoader::archiveResourceForURL(const KURL& url) const
 
 PassRefPtr<Archive> DocumentLoader::popArchiveForSubframe(const String& frameName)
 {
-    return m_archiveResourceCollection ? m_archiveResourceCollection->popSubframeArchive(frameName) : PassRefPtr<Archive>(0);
+    return m_archiveResourceCollection ? m_archiveResourceCollection->popSubframeArchive(frameName) : 0;
 }
 
 void DocumentLoader::clearArchiveResources()
@@ -579,7 +560,7 @@ void DocumentLoader::getSubresources(Vector<PassRefPtr<ArchiveResource> >& subre
     const DocLoader::DocumentResourceMap& allResources = document->docLoader()->allCachedResources();
     DocLoader::DocumentResourceMap::const_iterator end = allResources.end();
     for (DocLoader::DocumentResourceMap::const_iterator it = allResources.begin(); it != end; ++it) {
-        RefPtr<ArchiveResource> subresource = this->subresource(KURL(it->second->url()));
+        RefPtr<ArchiveResource> subresource = this->subresource(KURL(ParsedURLString, it->second->url()));
         if (subresource)
             subresources.append(subresource.release());
     }
@@ -705,16 +686,6 @@ bool DocumentLoader::urlForHistoryReflectsFailure() const
     return m_substituteData.isValid() || m_response.httpStatusCode() >= 400;
 }
 
-void DocumentLoader::loadFromCachedPage(PassRefPtr<CachedPage> cachedPage)
-{
-    LOG(PageCache, "WebCorePageCache: DocumentLoader %p loading from cached page %p", this, cachedPage.get());
-    
-    prepareForLoadStart();
-    setLoadingFromCachedPage(true);
-    setCommitted(true);
-    frameLoader()->commitProvisionalLoad(cachedPage);
-}
-
 const KURL& DocumentLoader::originalURL() const
 {
     return m_originalRequestCopy.url();
@@ -847,113 +818,4 @@ void DocumentLoader::iconLoadDecisionAvailable()
         m_frame->loader()->iconLoadDecisionAvailable();
 }
 
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-void DocumentLoader::setCandidateApplicationCacheGroup(ApplicationCacheGroup* group)
-{
-    ASSERT(!m_applicationCache);
-    m_candidateApplicationCacheGroup = group;
-}
-    
-void DocumentLoader::setApplicationCache(PassRefPtr<ApplicationCache> applicationCache)
-{
-    if (m_candidateApplicationCacheGroup) {
-        ASSERT(!m_applicationCache);
-        m_candidateApplicationCacheGroup = 0;
-    }
-
-    m_applicationCache = applicationCache;
-}
-
-ApplicationCache* DocumentLoader::mainResourceApplicationCache() const
-{
-    if (m_mainResourceApplicationCache)
-        return m_mainResourceApplicationCache.get();
-    if (m_mainResourceLoader)
-        return m_mainResourceLoader->applicationCache();
-    return 0;
-}
-
-bool DocumentLoader::shouldLoadResourceFromApplicationCache(const ResourceRequest& request, ApplicationCacheResource*& resource)
-{
-    ApplicationCache* cache = applicationCache();
-    if (!cache || !cache->isComplete())
-        return false;
-
-    // If the resource is not a HTTP/HTTPS GET, then abort
-    if (!ApplicationCache::requestIsHTTPOrHTTPSGet(request))
-        return false;
-
-    // If the resource's URL is an master entry, the manifest, an explicit entry, or a fallback entry
-    // in the application cache, then get the resource from the cache (instead of fetching it).
-    resource = cache->resourceForURL(request.url());
-
-    // Resources that match fallback namespaces or online whitelist entries are fetched from the network,
-    // unless they are also cached.
-    if (!resource && (cache->urlMatchesFallbackNamespace(request.url()) || cache->isURLInOnlineWhitelist(request.url())))
-        return false;
-
-    // Resources that are not present in the manifest will always fail to load (at least, after the
-    // cache has been primed the first time), making the testing of offline applications simpler.
-    return true;
-}
-
-bool DocumentLoader::getApplicationCacheFallbackResource(const ResourceRequest& request, ApplicationCacheResource*& resource, ApplicationCache* cache)
-{
-    if (!cache) {
-        cache = applicationCache();
-        if (!cache)
-            return false;
-    }
-    if (!cache->isComplete())
-        return false;
-    
-    // If the resource is not a HTTP/HTTPS GET, then abort
-    if (!ApplicationCache::requestIsHTTPOrHTTPSGet(request))
-        return false;
-
-    KURL fallbackURL;
-    if (!cache->urlMatchesFallbackNamespace(request.url(), &fallbackURL))
-        return false;
-
-    resource = cache->resourceForURL(fallbackURL);
-    ASSERT(resource);
-
-    return true;
-}
-
-bool DocumentLoader::scheduleApplicationCacheLoad(ResourceLoader* loader, const ResourceRequest& request, const KURL& originalURL)
-{
-    if (!frameLoader()->frame()->settings() || !frameLoader()->frame()->settings()->offlineWebApplicationCacheEnabled())
-        return false;
-    
-    if (request.url() != originalURL)
-        return false;
-
-    ApplicationCacheResource* resource;
-    if (!shouldLoadResourceFromApplicationCache(request, resource))
-        return false;
-    
-    m_pendingSubstituteResources.set(loader, resource);
-    deliverSubstituteResourcesAfterDelay();
-        
-    return true;
-}
-
-bool DocumentLoader::scheduleLoadFallbackResourceFromApplicationCache(ResourceLoader* loader, const ResourceRequest& request, ApplicationCache* cache)
-{
-    if (!frameLoader()->frame()->settings() || !frameLoader()->frame()->settings()->offlineWebApplicationCacheEnabled())
-        return false;
-
-    ApplicationCacheResource* resource;
-    if (!getApplicationCacheFallbackResource(request, resource, cache))
-        return false;
-
-    m_pendingSubstituteResources.set(loader, resource);
-    deliverSubstituteResourcesAfterDelay();
-        
-    return true;
-}
-
-#endif // ENABLE(OFFLINE_WEB_APPLICATIONS)
-
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/DocumentLoader.h b/src/3rdparty/webkit/WebCore/loader/DocumentLoader.h
index d4ac427..70d5afd 100644
--- a/src/3rdparty/webkit/WebCore/loader/DocumentLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/DocumentLoader.h
@@ -38,13 +38,10 @@
 
 namespace WebCore {
 
-    class ApplicationCache;
-    class ApplicationCacheGroup;
-    class ApplicationCacheResource;
+    class ApplicationCacheHost;
     class Archive;
     class ArchiveResource;
     class ArchiveResourceCollection;
-    class CachedPage;
     class Frame;
     class FrameLoader;
     class MainResourceLoader;
@@ -172,10 +169,6 @@ namespace WebCore {
         bool didCreateGlobalHistoryEntry() const { return m_didCreateGlobalHistoryEntry; }
         void setDidCreateGlobalHistoryEntry(bool didCreateGlobalHistoryEntry) { m_didCreateGlobalHistoryEntry = didCreateGlobalHistoryEntry; }
         
-        void loadFromCachedPage(PassRefPtr<CachedPage>);
-        void setLoadingFromCachedPage(bool loading) { m_loadingFromCachedPage = loading; }
-        bool isLoadingFromCachedPage() const { return m_loadingFromCachedPage; }
-        
         void setDefersLoading(bool);
 
         bool startLoadingMainResource(unsigned long identifier);
@@ -207,18 +200,7 @@ namespace WebCore {
         void takeMemoryCacheLoadsForClientNotification(Vector<String>& loads);
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-        bool scheduleApplicationCacheLoad(ResourceLoader*, const ResourceRequest&, const KURL& originalURL);
-        bool scheduleLoadFallbackResourceFromApplicationCache(ResourceLoader*, const ResourceRequest&, ApplicationCache* = 0);
-        bool shouldLoadResourceFromApplicationCache(const ResourceRequest&, ApplicationCacheResource*&);
-        bool getApplicationCacheFallbackResource(const ResourceRequest&, ApplicationCacheResource*&, ApplicationCache* = 0);
-        
-        void setCandidateApplicationCacheGroup(ApplicationCacheGroup* group);
-        ApplicationCacheGroup* candidateApplicationCacheGroup() const { return m_candidateApplicationCacheGroup; }
-        
-        void setApplicationCache(PassRefPtr<ApplicationCache> applicationCache);
-        ApplicationCache* applicationCache() const { return m_applicationCache.get(); }
-
-        ApplicationCache* mainResourceApplicationCache() const;
+        ApplicationCacheHost* applicationCacheHost() const { return m_applicationCacheHost.get(); }
 #endif
 
     protected:
@@ -273,7 +255,6 @@ namespace WebCore {
         bool m_gotFirstByte;
         bool m_primaryLoadComplete;
         bool m_isClientRedirect;
-        bool m_loadingFromCachedPage;
 
         String m_pageTitle;
 
@@ -306,16 +287,9 @@ namespace WebCore {
         String m_clientRedirectSourceForHistory;
         bool m_didCreateGlobalHistoryEntry;
 
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)  
-        // The application cache that the document loader is associated with (if any).
-        RefPtr<ApplicationCache> m_applicationCache;
-        
-        // Before an application cache has finished loading, this will be the candidate application
-        // group that the document loader is associated with.
-        ApplicationCacheGroup* m_candidateApplicationCacheGroup;
-        
-        // Once the main resource has finished loading, this is the application cache it was loaded from (if any).
-        RefPtr<ApplicationCache> m_mainResourceApplicationCache;
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+        friend class ApplicationCacheHost;  // for substitute resource delivery
+        OwnPtr<ApplicationCacheHost> m_applicationCacheHost;
 #endif
     };
 
diff --git a/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.cpp b/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.cpp
index dd5ca76..8a223fd 100644
--- a/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.cpp
@@ -32,8 +32,9 @@
 #include "DocumentThreadableLoader.h"
 
 #include "AuthenticationChallenge.h"
+#include "CrossOriginAccessControl.h"
+#include "CrossOriginPreflightResultCache.h"
 #include "Document.h"
-#include "DocumentThreadableLoader.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "ResourceRequest.h"
@@ -43,61 +44,106 @@
 
 namespace WebCore {
 
-void DocumentThreadableLoader::loadResourceSynchronously(Document* document, const ResourceRequest& request, ThreadableLoaderClient& client, StoredCredentials storedCredentials)
+void DocumentThreadableLoader::loadResourceSynchronously(Document* document, const ResourceRequest& request, ThreadableLoaderClient& client, const ThreadableLoaderOptions& options)
 {
-    bool sameOriginRequest = document->securityOrigin()->canRequest(request.url());
-
-    Vector<char> data;
-    ResourceError error;
-    ResourceResponse response;
-    unsigned long identifier = std::numeric_limits<unsigned long>::max();
-    if (document->frame())
-        identifier = document->frame()->loader()->loadResourceSynchronously(request, storedCredentials, error, response, data);
-
-    // No exception for file:/// resources, see <rdar://problem/4962298>.
-    // Also, if we have an HTTP response, then it wasn't a network error in fact.
-    if (!error.isNull() && !request.url().isLocalFile() && response.httpStatusCode() <= 0) {
-        client.didFail(error);
-        return;
-    }
-
-    // FIXME: This check along with the one in willSendRequest is specific to xhr and
-    // should be made more generic.
-    if (sameOriginRequest && !document->securityOrigin()->canRequest(response.url())) {
-        client.didFailRedirectCheck();
-        return;
-    }
-
-    client.didReceiveResponse(response);
-
-    const char* bytes = static_cast<const char*>(data.data());
-    int len = static_cast<int>(data.size());
-    client.didReceiveData(bytes, len);
-
-    client.didFinishLoading(identifier);
+    // The loader will be deleted as soon as this function exits.
+    RefPtr<DocumentThreadableLoader> loader = adoptRef(new DocumentThreadableLoader(document, &client, LoadSynchronously, request, options));
+    ASSERT(loader->hasOneRef());
 }
 
-PassRefPtr<DocumentThreadableLoader> DocumentThreadableLoader::create(Document* document, ThreadableLoaderClient* client, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+PassRefPtr<DocumentThreadableLoader> DocumentThreadableLoader::create(Document* document, ThreadableLoaderClient* client, const ResourceRequest& request, const ThreadableLoaderOptions& options)
 {
-    ASSERT(document);
-    RefPtr<DocumentThreadableLoader> loader = adoptRef(new DocumentThreadableLoader(document, client, request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy));
+    RefPtr<DocumentThreadableLoader> loader = adoptRef(new DocumentThreadableLoader(document, client, LoadAsynchronously, request, options));
     if (!loader->m_loader)
         loader = 0;
     return loader.release();
 }
 
-DocumentThreadableLoader::DocumentThreadableLoader(Document* document, ThreadableLoaderClient* client, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+DocumentThreadableLoader::DocumentThreadableLoader(Document* document, ThreadableLoaderClient* client, BlockingBehavior blockingBehavior, const ResourceRequest& request, const ThreadableLoaderOptions& options)
     : m_client(client)
     , m_document(document)
-    , m_allowStoredCredentials(storedCredentials == AllowStoredCredentials)
+    , m_options(options)
     , m_sameOriginRequest(document->securityOrigin()->canRequest(request.url()))
-    , m_denyCrossOriginRedirect(crossOriginRedirectPolicy == DenyCrossOriginRedirect)
+    , m_async(blockingBehavior == LoadAsynchronously)
 {
     ASSERT(document);
     ASSERT(client);
-    ASSERT(storedCredentials == AllowStoredCredentials || storedCredentials == DoNotAllowStoredCredentials);
-    ASSERT(crossOriginRedirectPolicy == DenyCrossOriginRedirect || crossOriginRedirectPolicy == AllowCrossOriginRedirect);
-    m_loader = SubresourceLoader::create(document->frame(), this, request, false, callbacksSetting == SendLoadCallbacks, contentSniff == SniffContent);
+
+    if (m_sameOriginRequest || m_options.crossOriginRequestPolicy == AllowCrossOriginRequests) {
+        bool skipCanLoadCheck = false;
+        loadRequest(request, skipCanLoadCheck);
+        return;
+    }
+
+    if (m_options.crossOriginRequestPolicy == DenyCrossOriginRequests) {
+        m_client->didFail(ResourceError());
+        return;
+    }
+    
+    ASSERT(m_options.crossOriginRequestPolicy == UseAccessControl);
+
+    if (!m_options.forcePreflight && isSimpleCrossOriginAccessRequest(request.httpMethod(), request.httpHeaderFields()))
+        makeSimpleCrossOriginAccessRequest(request);
+    else {
+        m_actualRequest.set(new ResourceRequest(request));
+        m_actualRequest->setAllowCookies(m_options.allowCredentials);
+
+        if (CrossOriginPreflightResultCache::shared().canSkipPreflight(document->securityOrigin()->toString(), request.url(), m_options.allowCredentials, request.httpMethod(), request.httpHeaderFields()))
+            preflightSuccess();
+        else
+            makeCrossOriginAccessRequestWithPreflight(request);
+    }
+}
+
+void DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest(const ResourceRequest& request)
+{
+    ASSERT(isSimpleCrossOriginAccessRequest(request.httpMethod(), request.httpHeaderFields()));
+
+    // Cross-origin requests are only defined for HTTP. We would catch this when checking response headers later, but there is no reason to send a request that's guaranteed to be denied.
+    if (!request.url().protocolInHTTPFamily()) {
+        m_client->didFail(ResourceError());
+        return;
+    }
+
+    // Make a copy of the passed request so that we can modify some details.
+    ResourceRequest crossOriginRequest(request);
+    crossOriginRequest.removeCredentials();
+    crossOriginRequest.setAllowCookies(m_options.allowCredentials);
+    crossOriginRequest.setHTTPOrigin(m_document->securityOrigin()->toString());
+
+    bool skipCanLoadCheck = false;
+    loadRequest(crossOriginRequest, skipCanLoadCheck);
+}
+
+void DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight(const ResourceRequest& request)
+{
+    ResourceRequest preflightRequest(request.url());
+    preflightRequest.removeCredentials();
+    preflightRequest.setHTTPOrigin(m_document->securityOrigin()->toString());
+    preflightRequest.setAllowCookies(m_options.allowCredentials);
+    preflightRequest.setHTTPMethod("OPTIONS");
+    preflightRequest.setHTTPHeaderField("Access-Control-Request-Method", request.httpMethod());
+
+    const HTTPHeaderMap& requestHeaderFields = request.httpHeaderFields();
+
+    if (requestHeaderFields.size() > 0) {
+        Vector<UChar> headerBuffer;
+        HTTPHeaderMap::const_iterator it = requestHeaderFields.begin();
+        append(headerBuffer, it->first);
+        ++it;
+
+        HTTPHeaderMap::const_iterator end = requestHeaderFields.end();
+        for (; it != end; ++it) {
+            headerBuffer.append(',');
+            headerBuffer.append(' ');
+            append(headerBuffer, it->first);
+        }
+
+        preflightRequest.setHTTPHeaderField("Access-Control-Request-Headers", String::adopt(headerBuffer));
+    }
+
+    bool skipCanLoadCheck = false;
+    loadRequest(preflightRequest, skipCanLoadCheck);
 }
 
 DocumentThreadableLoader::~DocumentThreadableLoader()
@@ -122,8 +168,7 @@ void DocumentThreadableLoader::willSendRequest(SubresourceLoader* loader, Resour
     ASSERT(m_client);
     ASSERT_UNUSED(loader, loader == m_loader);
 
-    // FIXME: This needs to be fixed to follow the redirect correctly even for cross-domain requests.
-    if (m_denyCrossOriginRedirect && !m_document->securityOrigin()->canRequest(request.url())) {
+    if (!isAllowedRedirect(request.url())) {
         RefPtr<DocumentThreadableLoader> protect(this);
         m_client->didFailRedirectCheck();
         request = ResourceRequest();
@@ -143,7 +188,31 @@ void DocumentThreadableLoader::didReceiveResponse(SubresourceLoader* loader, con
     ASSERT(m_client);
     ASSERT_UNUSED(loader, loader == m_loader);
 
-    m_client->didReceiveResponse(response);
+    if (m_actualRequest) {
+        if (!passesAccessControlCheck(response, m_options.allowCredentials, m_document->securityOrigin())) {
+            preflightFailure();
+            return;
+        }
+
+        OwnPtr<CrossOriginPreflightResultCacheItem> preflightResult(new CrossOriginPreflightResultCacheItem(m_options.allowCredentials));
+        if (!preflightResult->parse(response)
+            || !preflightResult->allowsCrossOriginMethod(m_actualRequest->httpMethod())
+            || !preflightResult->allowsCrossOriginHeaders(m_actualRequest->httpHeaderFields())) {
+            preflightFailure();
+            return;
+        }
+
+        CrossOriginPreflightResultCache::shared().appendEntry(m_document->securityOrigin()->toString(), m_actualRequest->url(), preflightResult.release());
+    } else {
+        if (!m_sameOriginRequest && m_options.crossOriginRequestPolicy == UseAccessControl) {
+            if (!passesAccessControlCheck(response, m_options.allowCredentials, m_document->securityOrigin())) {
+                m_client->didFail(ResourceError());
+                return;
+            }
+        }
+
+        m_client->didReceiveResponse(response);
+    }
 }
 
 void DocumentThreadableLoader::didReceiveData(SubresourceLoader* loader, const char* data, int lengthReceived)
@@ -158,7 +227,17 @@ void DocumentThreadableLoader::didFinishLoading(SubresourceLoader* loader)
 {
     ASSERT(loader == m_loader);
     ASSERT(m_client);
-    m_client->didFinishLoading(loader->identifier());
+    didFinishLoading(loader->identifier());
+}
+
+void DocumentThreadableLoader::didFinishLoading(unsigned long identifier)
+{
+    if (m_actualRequest) {
+        ASSERT(!m_sameOriginRequest);
+        ASSERT(m_options.crossOriginRequestPolicy == UseAccessControl);
+        preflightSuccess();
+    } else
+        m_client->didFinishLoading(identifier);
 }
 
 void DocumentThreadableLoader::didFail(SubresourceLoader* loader, const ResourceError& error)
@@ -172,9 +251,9 @@ void DocumentThreadableLoader::didFail(SubresourceLoader* loader, const Resource
 
 bool DocumentThreadableLoader::getShouldUseCredentialStorage(SubresourceLoader* loader, bool& shouldUseCredentialStorage)
 {
-    ASSERT_UNUSED(loader, loader == m_loader);
+    ASSERT_UNUSED(loader, loader == m_loader || !m_loader);
 
-    if (!m_allowStoredCredentials) {
+    if (!m_options.allowCredentials) {
         shouldUseCredentialStorage = false;
         return true;
     }
@@ -200,4 +279,76 @@ void DocumentThreadableLoader::receivedCancellation(SubresourceLoader* loader, c
     m_client->didReceiveAuthenticationCancellation(challenge.failureResponse());
 }
 
+void DocumentThreadableLoader::preflightSuccess()
+{
+    OwnPtr<ResourceRequest> actualRequest;
+    actualRequest.swap(m_actualRequest);
+
+    bool skipCanLoadCheck = true;  // ok to skip load check since we already asked about the preflight request
+    loadRequest(*actualRequest, skipCanLoadCheck);
+}
+
+void DocumentThreadableLoader::preflightFailure()
+{
+    m_client->didFail(ResourceError());
+}
+
+void DocumentThreadableLoader::loadRequest(const ResourceRequest& request, bool skipCanLoadCheck)
+{
+    if (m_async) {
+        // Don't sniff content or send load callbacks for the preflight request.
+        bool sendLoadCallbacks = m_options.sendLoadCallbacks && !m_actualRequest;
+        bool sniffContent = m_options.sniffContent && !m_actualRequest;
+
+        // Clear the loader so that any callbacks from SubresourceLoader::create will not have the old loader.
+        m_loader = 0;
+        m_loader = SubresourceLoader::create(m_document->frame(), this, request, skipCanLoadCheck, sendLoadCallbacks, sniffContent);
+        return;
+    }
+    
+    // FIXME: ThreadableLoaderOptions.sniffContent is not supported for synchronous requests.
+    StoredCredentials storedCredentials = m_options.allowCredentials ? AllowStoredCredentials : DoNotAllowStoredCredentials;
+
+    Vector<char> data;
+    ResourceError error;
+    ResourceResponse response;
+    unsigned long identifier = std::numeric_limits<unsigned long>::max();
+    if (m_document->frame())
+        identifier = m_document->frame()->loader()->loadResourceSynchronously(request, storedCredentials, error, response, data);
+
+    // No exception for file:/// resources, see <rdar://problem/4962298>.
+    // Also, if we have an HTTP response, then it wasn't a network error in fact.
+    if (!error.isNull() && !request.url().isLocalFile() && response.httpStatusCode() <= 0) {
+        m_client->didFail(error);
+        return;
+    }
+
+    // FIXME: FrameLoader::loadSynchronously() does not tell us whether a redirect happened or not, so we guess by comparing the
+    // request and response URLs. This isn't a perfect test though, since a server can serve a redirect to the same URL that was
+    // requested.
+    if (request.url() != response.url() && !isAllowedRedirect(response.url())) {
+        m_client->didFailRedirectCheck();
+        return;
+    }
+
+    didReceiveResponse(0, response);
+
+    const char* bytes = static_cast<const char*>(data.data());
+    int len = static_cast<int>(data.size());
+    didReceiveData(0, bytes, len);
+
+    didFinishLoading(identifier);
+}
+
+bool DocumentThreadableLoader::isAllowedRedirect(const KURL& url)
+{
+    if (m_options.crossOriginRequestPolicy == AllowCrossOriginRequests)
+        return true;
+
+    // FIXME: We need to implement access control for each redirect. This will require some refactoring though, because the code
+    // that processes redirects doesn't know about access control and expects a synchronous answer from its client about whether
+    // a redirect should proceed.
+    return m_sameOriginRequest && m_document->securityOrigin()->canRequest(url);
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.h b/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.h
index 465475f..64b1a22 100644
--- a/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.h
@@ -33,19 +33,21 @@
 
 #include "SubresourceLoaderClient.h"
 #include "ThreadableLoader.h"
+#include <wtf/OwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
     class Document;
+    class KURL;
     struct ResourceRequest;
     class ThreadableLoaderClient;
 
     class DocumentThreadableLoader : public RefCounted<DocumentThreadableLoader>, public ThreadableLoader, private SubresourceLoaderClient  {
     public:
-        static void loadResourceSynchronously(Document*, const ResourceRequest&, ThreadableLoaderClient&, StoredCredentials);
-        static PassRefPtr<DocumentThreadableLoader> create(Document*, ThreadableLoaderClient*, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
+        static void loadResourceSynchronously(Document*, const ResourceRequest&, ThreadableLoaderClient&, const ThreadableLoaderOptions&);
+        static PassRefPtr<DocumentThreadableLoader> create(Document*, ThreadableLoaderClient*, const ResourceRequest&, const ThreadableLoaderOptions&);
         virtual ~DocumentThreadableLoader();
 
         virtual void cancel();
@@ -58,7 +60,13 @@ namespace WebCore {
         virtual void derefThreadableLoader() { deref(); }
 
     private:
-        DocumentThreadableLoader(Document*, ThreadableLoaderClient*, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
+        enum BlockingBehavior {
+            LoadSynchronously,
+            LoadAsynchronously
+        };
+
+        DocumentThreadableLoader(Document*, ThreadableLoaderClient*, BlockingBehavior blockingBehavior, const ResourceRequest&, const ThreadableLoaderOptions& options);
+
         virtual void willSendRequest(SubresourceLoader*, ResourceRequest&, const ResourceResponse& redirectResponse);
         virtual void didSendData(SubresourceLoader*, unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
 
@@ -71,12 +79,22 @@ namespace WebCore {
         virtual void didReceiveAuthenticationChallenge(SubresourceLoader*, const AuthenticationChallenge&);
         virtual void receivedCancellation(SubresourceLoader*, const AuthenticationChallenge&);
 
+        void didFinishLoading(unsigned long identifier);
+        void makeSimpleCrossOriginAccessRequest(const ResourceRequest& request);
+        void makeCrossOriginAccessRequestWithPreflight(const ResourceRequest& request);
+        void preflightSuccess();
+        void preflightFailure();
+
+        void loadRequest(const ResourceRequest&, bool skipCanLoadCheck);
+        bool isAllowedRedirect(const KURL&);
+
         RefPtr<SubresourceLoader> m_loader;
         ThreadableLoaderClient* m_client;
         Document* m_document;
-        bool m_allowStoredCredentials;
+        ThreadableLoaderOptions m_options;
         bool m_sameOriginRequest;
-        bool m_denyCrossOriginRedirect;
+        bool m_async;
+        OwnPtr<ResourceRequest> m_actualRequest;  // non-null during Access Control preflight checks
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/EmptyClients.h b/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
index 6d87342..4172c06 100644
--- a/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
+++ b/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
@@ -123,6 +123,7 @@ public:
     virtual PlatformWidget platformWindow() const { return 0; }
     virtual void contentsSizeChanged(Frame*, const IntSize&) const { }
 
+    virtual void scrollbarsModeDidChange() const { }
     virtual void mouseDidMoveOverElement(const HitTestResult&, unsigned) { }
 
     virtual void setToolTip(const String&, TextDirection) { }
@@ -137,6 +138,10 @@ public:
     virtual void reachedMaxAppCacheSize(int64_t) { }
 #endif
 
+#if ENABLE(NOTIFICATIONS)
+    virtual NotificationPresenter* notificationPresenter() const { return 0; }
+#endif
+
     virtual void runOpenPanel(Frame*, PassRefPtr<FileChooser>) { }
 
     virtual void formStateDidChange(const Node*) { }
@@ -155,7 +160,7 @@ public:
 #if USE(ACCELERATED_COMPOSITING)
     virtual void attachRootGraphicsLayer(Frame*, GraphicsLayer*) {};
     virtual void setNeedsOneShotDrawingSynchronization() {};
-    virtual void scheduleViewUpdate() {};
+    virtual void scheduleCompositingLayerSync() {};
 #endif
 };
 
@@ -275,7 +280,8 @@ public:
     virtual bool shouldGoToHistoryItem(HistoryItem*) const { return false; }
     virtual void saveViewStateToItem(HistoryItem*) { }
     virtual bool canCachePage() const { return false; }
-
+    virtual void didDisplayInsecureContent() { }
+    virtual void didRunInsecureContent(SecurityOrigin*) { }
     virtual PassRefPtr<Frame> createFrame(const KURL&, const String&, HTMLFrameOwnerElement*, const String&, bool, int, int) { return 0; }
     virtual PassRefPtr<Widget> createPlugin(const IntSize&, HTMLPlugInElement*, const KURL&, const Vector<String>&, const Vector<String>&, const String&, bool) { return 0; }
     virtual PassRefPtr<Widget> createJavaAppletWidget(const IntSize&, HTMLAppletElement*, const KURL&, const Vector<String>&, const Vector<String>&) { return 0; }
@@ -409,6 +415,7 @@ public:
 
 };
 
+#if ENABLE(CONTEXT_MENUS)
 class EmptyContextMenuClient : public ContextMenuClient {
 public:
     virtual ~EmptyContextMenuClient() {  }
@@ -429,7 +436,9 @@ public:
     virtual void searchWithSpotlight() { }
 #endif
 };
+#endif // ENABLE(CONTEXT_MENUS)
 
+#if ENABLE(DRAG_SUPPORT)
 class EmptyDragClient : public DragClient {
 public:
     virtual ~EmptyDragClient() {}
@@ -441,6 +450,7 @@ public:
     virtual DragImageRef createDragImageForLink(KURL&, const String&, Frame*) { return 0; }
     virtual void dragControllerDestroyed() { }
 };
+#endif // ENABLE(DRAG_SUPPORT)
 
 class EmptyInspectorClient : public InspectorClient {
 public:
@@ -469,6 +479,8 @@ public:
     virtual void populateSetting(const String&, InspectorController::Setting&) { }
     virtual void storeSetting(const String&, const InspectorController::Setting&) { }
     virtual void removeSetting(const String&) { }
+
+    virtual void inspectorWindowObjectCleared() { }
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/FTPDirectoryDocument.cpp b/src/3rdparty/webkit/WebCore/loader/FTPDirectoryDocument.cpp
index ace4cfe..ee0f4ca 100644
--- a/src/3rdparty/webkit/WebCore/loader/FTPDirectoryDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/FTPDirectoryDocument.cpp
@@ -118,7 +118,7 @@ void FTPDirectoryTokenizer::appendEntry(const String& filename, const String& si
     rowElement->setAttribute("class", "ftpDirectoryEntryRow", ec);
    
     RefPtr<Element> element = m_doc->createElement(tdTag, false);
-    element->appendChild(new Text(m_doc, String(&noBreakSpace, 1)), ec);
+    element->appendChild(Text::create(m_doc, String(&noBreakSpace, 1)), ec);
     if (isDirectory)
         element->setAttribute("class", "ftpDirectoryIcon ftpDirectoryTypeDirectory", ec);
     else
@@ -130,12 +130,12 @@ void FTPDirectoryTokenizer::appendEntry(const String& filename, const String& si
     rowElement->appendChild(element, ec);
     
     element = m_doc->createElement(tdTag, false);
-    element->appendChild(new Text(m_doc, date), ec);
+    element->appendChild(Text::create(m_doc, date), ec);
     element->setAttribute("class", "ftpDirectoryFileDate", ec);
     rowElement->appendChild(element, ec);
     
     element = m_doc->createElement(tdTag, false);
-    element->appendChild(new Text(m_doc, size), ec);
+    element->appendChild(Text::create(m_doc, size), ec);
     element->setAttribute("class", "ftpDirectoryFileSize", ec);
     rowElement->appendChild(element, ec);
 }
@@ -152,7 +152,7 @@ PassRefPtr<Element> FTPDirectoryTokenizer::createTDForFilename(const String& fil
 
     RefPtr<Element> anchorElement = m_doc->createElement(aTag, false);
     anchorElement->setAttribute("href", fullURL, ec);
-    anchorElement->appendChild(new Text(m_doc, filename), ec);
+    anchorElement->appendChild(Text::create(m_doc, filename), ec);
     
     RefPtr<Element> tdElement = m_doc->createElement(tdTag, false);
     tdElement->appendChild(anchorElement, ec);
diff --git a/src/3rdparty/webkit/WebCore/loader/FTPDirectoryDocument.h b/src/3rdparty/webkit/WebCore/loader/FTPDirectoryDocument.h
index ecc6f73..b208c4e 100644
--- a/src/3rdparty/webkit/WebCore/loader/FTPDirectoryDocument.h
+++ b/src/3rdparty/webkit/WebCore/loader/FTPDirectoryDocument.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,7 +35,7 @@ class FTPDirectoryDocument : public HTMLDocument {
 public:
     static PassRefPtr<FTPDirectoryDocument> create(Frame* frame)
     {
-        return new FTPDirectoryDocument(frame);
+        return adoptRef(new FTPDirectoryDocument(frame));
     }
 
 private:
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp b/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
index 7fc7936..4321be0 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "FrameLoader.h"
 
+#include "ApplicationCacheHost.h"
 #include "Archive.h"
 #include "ArchiveFactory.h"
 #include "CString.h"
@@ -86,6 +87,11 @@
 #include "SecurityOrigin.h"
 #include "SegmentedString.h"
 #include "Settings.h"
+
+#if ENABLE(SHARED_WORKERS)
+#include "SharedWorkerRepository.h"
+#endif
+
 #include "TextResourceDecoder.h"
 #include "WindowFeatures.h"
 #include "XMLHttpRequest.h"
@@ -94,10 +100,6 @@
 #include <wtf/CurrentTime.h>
 #include <wtf/StdLibExtras.h>
 
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-#include "ApplicationCache.h"
-#include "ApplicationCacheResource.h"
-#endif
 
 #if ENABLE(SVG)
 #include "SVGDocument.h"
@@ -109,6 +111,10 @@
 #include "SVGViewSpec.h"
 #endif
 
+#if PLATFORM(MAC) || PLATFORM(WIN)
+#define PAGE_CACHE_ACCEPTS_UNLOAD_HANDLERS
+#endif
+
 namespace WebCore {
 
 #if ENABLE(SVG)
@@ -213,6 +219,7 @@ bool isBackForwardLoadType(FrameLoadType type)
         case FrameLoadTypeReplace:
             return false;
         case FrameLoadTypeBack:
+        case FrameLoadTypeBackWMLDeckNotAccessible:
         case FrameLoadTypeForward:
         case FrameLoadTypeIndexedBackForward:
             return true;
@@ -268,6 +275,7 @@ FrameLoader::FrameLoader(Frame* frame, FrameLoaderClient* client)
     , m_isDisplayingInitialEmptyDocument(false)
     , m_committedFirstRealDocumentLoad(false)
     , m_didPerformFirstNavigation(false)
+    , m_loadingFromCachedPage(false)
 #ifndef NDEBUG
     , m_didDispatchDidCommitLoad(false)
 #endif
@@ -290,7 +298,7 @@ void FrameLoader::init()
     // this somewhat odd set of steps is needed to give the frame an initial empty document
     m_isDisplayingInitialEmptyDocument = false;
     m_creatingInitialEmptyDocument = true;
-    setPolicyDocumentLoader(m_client->createDocumentLoader(ResourceRequest(KURL("")), SubstituteData()).get());
+    setPolicyDocumentLoader(m_client->createDocumentLoader(ResourceRequest(KURL(ParsedURLString, "")), SubstituteData()).get());
     setProvisionalDocumentLoader(m_policyDocumentLoader.get());
     setState(FrameStateProvisional);
     m_provisionalDocumentLoader->setResponse(ResourceResponse(KURL(), "text/html", 0, String(), String()));
@@ -464,7 +472,7 @@ Frame* FrameLoader::loadSubframe(HTMLFrameOwnerElement* ownerElement, const KURL
     RenderObject* renderer = ownerElement->renderer();
     FrameView* view = frame->view();
     if (renderer && renderer->isWidget() && view)
-        static_cast<RenderWidget*>(renderer)->setWidget(view);
+        toRenderWidget(renderer)->setWidget(view);
     
     checkCallImplicitClose();
     
@@ -559,20 +567,24 @@ void FrameLoader::submitForm(const char* action, const String& url, PassRefPtr<F
     targetFrame->loader()->scheduleFormSubmission(frameRequest, lockHistory, event, formState);
 }
 
-void FrameLoader::stopLoading(bool sendUnload, DatabasePolicy databasePolicy)
+void FrameLoader::stopLoading(UnloadEventPolicy unloadEventPolicy, DatabasePolicy databasePolicy)
 {
     if (m_frame->document() && m_frame->document()->tokenizer())
         m_frame->document()->tokenizer()->stopParsing();
 
-    if (sendUnload) {
+    if (unloadEventPolicy != UnloadEventPolicyNone) {
         if (m_frame->document()) {
             if (m_didCallImplicitClose && !m_wasUnloadEventEmitted) {
                 Node* currentFocusedNode = m_frame->document()->focusedNode();
                 if (currentFocusedNode)
                     currentFocusedNode->aboutToUnload();
                 m_unloadEventBeingDispatched = true;
-                if (m_frame->domWindow())
-                    m_frame->domWindow()->dispatchUnloadEvent();
+                if (m_frame->domWindow()) {
+                    if (unloadEventPolicy == UnloadEventPolicyUnloadAndPageHide)
+                        m_frame->domWindow()->dispatchPageTransitionEvent(EventNames().pagehideEvent, m_frame->document()->inPageCache());
+                    if (!m_frame->document()->inPageCache())
+                        m_frame->domWindow()->dispatchUnloadEvent();
+                }
                 m_unloadEventBeingDispatched = false;
                 if (m_frame->document())
                     m_frame->document()->updateStyleIfNeeded();
@@ -608,7 +620,7 @@ void FrameLoader::stopLoading(bool sendUnload, DatabasePolicy databasePolicy)
 
     // tell all subframes to stop as well
     for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
-        child->loader()->stopLoading(sendUnload);
+        child->loader()->stopLoading(unloadEventPolicy);
 
     cancelRedirection();
 }
@@ -630,7 +642,11 @@ void FrameLoader::stop()
 bool FrameLoader::closeURL()
 {
     saveDocumentState();
-    stopLoading(true);
+    
+    // Should only send the pagehide event here if the current document exists and has not been placed in the page cache.    
+    Document* currentDocument = m_frame->document();
+    stopLoading(currentDocument && !currentDocument->inPageCache() ? UnloadEventPolicyUnloadAndPageHide : UnloadEventPolicyUnloadOnly);
+    
     m_frame->editor()->clearUndoRedoOperations();
     return true;
 }
@@ -652,7 +668,7 @@ KURL FrameLoader::iconURL()
 
     // If we have an iconURL from a Link element, return that
     if (!m_frame->document()->iconURL().isEmpty())
-        return KURL(m_frame->document()->iconURL());
+        return KURL(ParsedURLString, m_frame->document()->iconURL());
 
     // Don't return a favicon iconURL unless we're http or https
     if (!m_URL.protocolInHTTPFamily())
@@ -783,7 +799,7 @@ void FrameLoader::cancelAndClear()
     m_frame->script()->updatePlatformScriptObjects();
 }
 
-void FrameLoader::clear(bool clearWindowProperties, bool clearScriptObjects)
+void FrameLoader::clear(bool clearWindowProperties, bool clearScriptObjects, bool clearFrameView)
 {
     m_frame->editor()->clear();
 
@@ -810,7 +826,7 @@ void FrameLoader::clear(bool clearWindowProperties, bool clearScriptObjects)
 
     m_frame->selection()->clear();
     m_frame->eventHandler()->clear();
-    if (m_frame->view())
+    if (clearFrameView && m_frame->view())
         m_frame->view()->clear();
 
     m_frame->setSelectionGranularity(CharacterGranularity);
@@ -914,15 +930,12 @@ void FrameLoader::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
     KURL ref(url);
     ref.setUser(String());
     ref.setPass(String());
-    ref.setRef(String());
+    ref.removeFragmentIdentifier();
     m_outgoingReferrer = ref.string();
     m_URL = url;
 
     m_frame->setDocument(document);
 
-    if (dispatch)
-        dispatchWindowObjectAvailable();
-
     document->setURL(m_URL);
     if (m_decoder)
         document->setDecoder(m_decoder.get());
@@ -932,6 +945,9 @@ void FrameLoader::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
     m_frame->domWindow()->setURL(document->url());
     m_frame->domWindow()->setSecurityOrigin(document->securityOrigin());
 
+    if (dispatch)
+        dispatchWindowObjectAvailable();
+    
     updateFirstPartyForCookies();
 
     Settings* settings = document->settings();
@@ -943,12 +959,6 @@ void FrameLoader::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
             document->parseDNSPrefetchControlHeader(dnsPrefetchControl);
     }
 
-#if FRAME_LOADS_USER_STYLESHEET
-    KURL userStyleSheet = settings ? settings->userStyleSheetLocation() : KURL();
-    if (!userStyleSheet.isEmpty())
-        m_frame->setUserStyleSheetLocation(userStyleSheet);
-#endif
-
     restoreDocumentState();
 
     document->implicitOpen();
@@ -1115,6 +1125,12 @@ void FrameLoader::startIconLoader()
         }
     }
 
+    // People who want to avoid loading images generally want to avoid loading all images.
+    // Now that we've accounted for URL mapping, avoid starting the network load if images aren't set to display automatically.
+    Settings* settings = m_frame->settings();
+    if (settings && !settings->loadsImagesAutomatically())
+        return;
+
     // This is either a reload or the icon database said "yes, load the icon", so kick off the load!
     if (!m_iconLoader)
         m_iconLoader.set(IconLoader::create(m_frame).release());
@@ -1158,6 +1174,7 @@ void FrameLoader::restoreDocumentState()
         case FrameLoadTypeReplace:
             break;
         case FrameLoadTypeBack:
+        case FrameLoadTypeBackWMLDeckNotAccessible:
         case FrameLoadTypeForward:
         case FrameLoadTypeIndexedBackForward:
         case FrameLoadTypeRedirectWithLockedBackForwardList:
@@ -1178,16 +1195,16 @@ void FrameLoader::gotoAnchor()
     // OTOH If CSS target was set previously, we want to set it to 0, recalc
     // and possibly repaint because :target pseudo class may have been
     // set (see bug 11321).
-    if (!m_URL.hasRef() && !m_frame->document()->cssTarget())
+    if (!m_URL.hasFragmentIdentifier() && !m_frame->document()->cssTarget())
         return;
 
-    String ref = m_URL.ref();
-    if (gotoAnchor(ref))
+    String fragmentIdentifier = m_URL.fragmentIdentifier();
+    if (gotoAnchor(fragmentIdentifier))
         return;
 
     // Try again after decoding the ref, based on the document's encoding.
     if (m_decoder)
-        gotoAnchor(decodeURLEscapeSequences(ref, m_decoder->encoding()));
+        gotoAnchor(decodeURLEscapeSequences(fragmentIdentifier, m_decoder->encoding()));
 }
 
 void FrameLoader::finishedParsing()
@@ -1195,6 +1212,8 @@ void FrameLoader::finishedParsing()
     if (m_creatingInitialEmptyDocument)
         return;
 
+    m_frame->injectUserScripts(InjectAtDocumentEnd);
+
     // This can be called from the Frame's destructor, in which case we shouldn't protect ourselves
     // because doing so will cause us to re-enter the destructor when protector goes out of scope.
     // Null-checking the FrameView indicates whether or not we're in the destructor.
@@ -1349,8 +1368,8 @@ void FrameLoader::scheduleLocationChange(const String& url, const String& referr
 
     // If the URL we're going to navigate to is the same as the current one, except for the
     // fragment part, we don't need to schedule the location change.
-    KURL parsedURL(url);
-    if (parsedURL.hasRef() && equalIgnoringRef(m_URL, parsedURL)) {
+    KURL parsedURL(ParsedURLString, url);
+    if (parsedURL.hasFragmentIdentifier() && equalIgnoringFragmentIdentifier(m_URL, parsedURL)) {
         changeLocation(completeURL(url), referrer, lockHistory, lockBackForwardList, wasUserGesture);
         return;
     }
@@ -1456,7 +1475,7 @@ void FrameLoader::redirectionTimerFired(Timer<FrameLoader>*)
     switch (redirection->type) {
         case ScheduledRedirection::redirection:
         case ScheduledRedirection::locationChange:
-            changeLocation(KURL(redirection->url), redirection->referrer,
+            changeLocation(KURL(ParsedURLString, redirection->url), redirection->referrer,
                 redirection->lockHistory, redirection->lockBackForwardList, redirection->wasUserGesture, redirection->wasRefresh);
             return;
         case ScheduledRedirection::historyNavigation:
@@ -1502,7 +1521,7 @@ void FrameLoader::loadURLIntoChildFrame(const KURL& url, const String& referer,
             // Use the original URL to ensure we get all the side-effects, such as
             // onLoad handlers, of any redirects that happened. An example of where
             // this is needed is Radar 3213556.
-            workingURL = KURL(childItem->originalURLString());
+            workingURL = KURL(ParsedURLString, childItem->originalURLString());
             childLoadType = loadType;
             childFrame->loader()->m_provisionalHistoryItem = childItem;
         }
@@ -1707,6 +1726,33 @@ String FrameLoader::outgoingOrigin() const
     return m_frame->document()->securityOrigin()->toString();
 }
 
+bool FrameLoader::isMixedContent(SecurityOrigin* context, const KURL& url)
+{
+    if (context->protocol() != "https")
+        return false;  // We only care about HTTPS security origins.
+
+    if (url.protocolIs("https") || url.protocolIs("about") || url.protocolIs("data"))
+        return false;  // Loading these protocols is secure.
+
+    return true;
+}
+
+void FrameLoader::checkIfDisplayInsecureContent(SecurityOrigin* context, const KURL& url)
+{
+    if (!isMixedContent(context, url))
+        return;
+
+    m_client->didDisplayInsecureContent();
+}
+
+void FrameLoader::checkIfRunInsecureContent(SecurityOrigin* context, const KURL& url)
+{
+    if (!isMixedContent(context, url))
+        return;
+
+    m_client->didRunInsecureContent(context);
+}
+
 Frame* FrameLoader::opener()
 {
     return m_opener;
@@ -1793,9 +1839,13 @@ static inline bool frameContainsWMLContent(Frame* frame)
 
 bool FrameLoader::canCachePageContainingThisFrame()
 {
+    for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling()) {
+        if (!child->loader()->canCachePageContainingThisFrame())
+            return false;
+    }
+            
     return m_documentLoader
         && m_documentLoader->mainDocumentError().isNull()
-        && !m_frame->tree()->childCount()
         // FIXME: If we ever change this so that frames with plug-ins will be cached,
         // we need to make sure that we don't cache frames that have outstanding NPObjects
         // (objects created by the plug-in). Since there is no way to pause/resume a Netscape plug-in,
@@ -1803,10 +1853,15 @@ bool FrameLoader::canCachePageContainingThisFrame()
         // the right NPObjects. See <rdar://problem/5197041> for more information.
         && !m_containsPlugIns
         && !m_URL.protocolIs("https")
+#ifndef PAGE_CACHE_ACCEPTS_UNLOAD_HANDLERS
         && (!m_frame->domWindow() || !m_frame->domWindow()->hasEventListener(eventNames().unloadEvent))
+#endif
 #if ENABLE(DATABASE)
         && !m_frame->document()->hasOpenDatabases()
 #endif
+#if ENABLE(SHARED_WORKERS)
+        && !SharedWorkerRepository::hasSharedWorkers(m_frame->document())
+#endif
         && !m_frame->document()->usingGeolocation()
         && m_currentHistoryItem
         && !m_quickRedirectComing
@@ -1816,8 +1871,7 @@ bool FrameLoader::canCachePageContainingThisFrame()
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
         // FIXME: We should investigating caching frames that have an associated
         // application cache. <rdar://problem/5917899> tracks that work.
-        && !m_documentLoader->applicationCache()
-        && !m_documentLoader->candidateApplicationCacheGroup()
+        && m_documentLoader->applicationCacheHost()->canCacheInPageCache()
 #endif
 #if ENABLE(WML)
         && !frameContainsWMLContent(m_frame)
@@ -1942,18 +1996,22 @@ bool FrameLoader::logCanCacheFrameDecision(int indentLevel)
         }
         if (!m_documentLoader->mainDocumentError().isNull())
             { PCLOG("   -Main document has an error"); cannotCache = true; }
-        if (m_frame->tree()->childCount())
-            { PCLOG("   -Frame has child frames"); cannotCache = true; }
         if (m_containsPlugIns)
             { PCLOG("   -Frame contains plugins"); cannotCache = true; }
         if (m_URL.protocolIs("https"))
             { PCLOG("   -Frame is HTTPS"); cannotCache = true; }
+#ifndef PAGE_CACHE_ACCEPTS_UNLOAD_HANDLERS
         if (m_frame->domWindow() && m_frame->domWindow()->hasEventListener(eventNames().unloadEvent))
             { PCLOG("   -Frame has an unload event listener"); cannotCache = true; }
+#endif
 #if ENABLE(DATABASE)
         if (m_frame->document()->hasOpenDatabases())
             { PCLOG("   -Frame has open database handles"); cannotCache = true; }
 #endif
+#if ENABLE(SHARED_WORKERS)
+        if (SharedWorkerRepository::hasSharedWorkers(m_frame->document()))
+            { PCLOG("   -Frame has associated SharedWorkers"); cannotCache = true; }
+#endif
         if (m_frame->document()->usingGeolocation())
             { PCLOG("   -Frame uses Geolocation"); cannotCache = true; }
         if (!m_currentHistoryItem)
@@ -1967,10 +2025,8 @@ bool FrameLoader::logCanCacheFrameDecision(int indentLevel)
         if (!m_frame->document()->canSuspendActiveDOMObjects())
             { PCLOG("   -The document cannot suspect its active DOM Objects"); cannotCache = true; }
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-        if (m_documentLoader->applicationCache())
-            { PCLOG("   -The DocumentLoader has an active application cache"); cannotCache = true; }
-        if (m_documentLoader->candidateApplicationCacheGroup())
-            { PCLOG("   -The DocumentLoader has a candidateApplicationCacheGroup"); cannotCache = true; }
+        if (!m_documentLoader->applicationCacheHost()->canCacheInPageCache())
+            { PCLOG("   -The DocumentLoader uses an application cache"); cannotCache = true; }
 #endif
         if (!m_client->canCachePage())
             { PCLOG("   -The client says this frame cannot be cached"); cannotCache = true; }
@@ -2002,10 +2058,39 @@ void FrameLoader::setFirstPartyForCookies(const KURL& url)
         child->loader()->setFirstPartyForCookies(url);
 }
 
+class HashChangeEventTask : public ScriptExecutionContext::Task {
+public:
+    static PassRefPtr<HashChangeEventTask> create(PassRefPtr<Document> document)
+    {
+        return adoptRef(new HashChangeEventTask(document));
+    }
+    
+    virtual void performTask(ScriptExecutionContext* context)
+    {
+        ASSERT_UNUSED(context, context->isDocument());
+        m_document->dispatchWindowEvent(eventNames().hashchangeEvent, false, false);
+    }
+    
+private:
+    HashChangeEventTask(PassRefPtr<Document> document)
+        : m_document(document)
+    {
+        ASSERT(m_document);
+    }
+    
+    RefPtr<Document> m_document;
+};
+    
 // This does the same kind of work that didOpenURL does, except it relies on the fact
 // that a higher level already checked that the URLs match and the scrolling is the right thing to do.
 void FrameLoader::scrollToAnchor(const KURL& url)
 {
+    ASSERT(equalIgnoringFragmentIdentifier(url, m_URL));
+    if (equalIgnoringFragmentIdentifier(url, m_URL) && !equalIgnoringNullity(url.fragmentIdentifier(), m_URL.fragmentIdentifier())) {
+        Document* currentDocument = frame()->document();
+        currentDocument->postTask(HashChangeEventTask::create(currentDocument));
+    }
+    
     m_URL = url;
     updateHistoryForAnchorScroll();
 
@@ -2035,7 +2120,7 @@ void FrameLoader::scheduleRedirection(ScheduledRedirection* redirection)
     if (redirection->wasDuringLoad) {
         if (m_provisionalDocumentLoader)
             m_provisionalDocumentLoader->stopLoading();
-        stopLoading(true);   
+        stopLoading(UnloadEventPolicyUnloadAndPageHide);   
     }
 
     stopRedirectionTimer();
@@ -2057,7 +2142,7 @@ void FrameLoader::startRedirectionTimer()
     switch (m_scheduledRedirection->type) {
         case ScheduledRedirection::locationChange:
         case ScheduledRedirection::redirection:
-            clientRedirected(KURL(m_scheduledRedirection->url),
+            clientRedirected(KURL(ParsedURLString, m_scheduledRedirection->url),
                 m_scheduledRedirection->delay,
                 currentTime() + m_redirectionTimer.nextFireInterval(),
                 m_scheduledRedirection->lockBackForwardList);
@@ -2634,6 +2719,7 @@ void FrameLoader::stopLoadingSubframes()
 
 void FrameLoader::stopAllLoaders(DatabasePolicy databasePolicy)
 {
+    ASSERT(!m_frame->document() || !m_frame->document()->inPageCache());
     if (m_unloadEventBeingDispatched)
         return;
 
@@ -2769,7 +2855,8 @@ void FrameLoader::commitProvisionalLoad(PassRefPtr<CachedPage> prpCachedPage)
     RefPtr<CachedPage> cachedPage = prpCachedPage;
     RefPtr<DocumentLoader> pdl = m_provisionalDocumentLoader;
 
-    LOG(Loading, "WebCoreLoading %s: About to commit provisional load from previous URL %s", m_frame->tree()->name().string().utf8().data(), m_URL.string().utf8().data());
+    LOG(PageCache, "WebCoreLoading %s: About to commit provisional load from previous URL '%s' to new URL '%s'", m_frame->tree()->name().string().utf8().data(), m_URL.string().utf8().data(), 
+        pdl ? pdl->url().string().utf8().data() : "<no provisional DocumentLoader>");
 
     // Check to see if we need to cache the page we are navigating away from into the back/forward cache.
     // We are doing this here because we know for sure that a new page is about to be loaded.
@@ -2790,10 +2877,9 @@ void FrameLoader::commitProvisionalLoad(PassRefPtr<CachedPage> prpCachedPage)
     if (m_sentRedirectNotification)
         clientRedirectCancelledOrFinished(false);
     
-    if (cachedPage && cachedPage->document()) {
+    if (cachedPage && cachedPage->document())
         open(*cachedPage);
-        cachedPage->clear();
-    } else {        
+    else {        
         KURL url = pdl->substituteData().responseURL();
         if (url.isEmpty())
             url = pdl->url();
@@ -2810,7 +2896,7 @@ void FrameLoader::commitProvisionalLoad(PassRefPtr<CachedPage> prpCachedPage)
     if (m_loadType == FrameLoadTypeStandard && m_documentLoader->isClientRedirect())
         updateHistoryForClientRedirect();
 
-    if (m_documentLoader->isLoadingFromCachedPage()) {
+    if (m_loadingFromCachedPage) {
         m_frame->document()->documentDidBecomeActive();
         
         // Force a layout to update view size and thereby update scrollbars.
@@ -2877,6 +2963,7 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
     switch (m_loadType) {
         case FrameLoadTypeForward:
         case FrameLoadTypeBack:
+        case FrameLoadTypeBackWMLDeckNotAccessible:
         case FrameLoadTypeIndexedBackForward:
             if (Page* page = m_frame->page())
                 if (page->backForwardList()) {
@@ -2985,9 +3072,9 @@ bool FrameLoader::shouldReload(const KURL& currentURL, const KURL& destinationUR
     // This function implements the rule: "Don't reload if navigating by fragment within
     // the same URL, but do reload if going to a new URL or to the same URL with no
     // fragment identifier at all."
-    if (!destinationURL.hasRef())
+    if (!destinationURL.hasFragmentIdentifier())
         return true;
-    return !equalIgnoringRef(currentURL, destinationURL);
+    return !equalIgnoringFragmentIdentifier(currentURL, destinationURL);
 }
 
 void FrameLoader::closeOldDataSources()
@@ -3021,13 +3108,12 @@ void FrameLoader::open(CachedPage& cachedPage)
         m_frame->setJSDefaultStatusBarText(String());
     }
 
-    open(*cachedPage.cachedMainFrame());
     cachedPage.restore(m_frame->page());
 
     checkCompleted();
 }
 
-void FrameLoader::open(CachedFrame& cachedFrame)
+void FrameLoader::open(CachedFrameBase& cachedFrame)
 {
     m_isComplete = false;
     
@@ -3043,8 +3129,7 @@ void FrameLoader::open(CachedFrame& cachedFrame)
     m_workingURL = url;
 
     started();
-
-    clear();
+    clear(true, true, cachedFrame.isMainFrame());
 
     Document* document = cachedFrame.document();
     ASSERT(document);
@@ -3059,8 +3144,11 @@ void FrameLoader::open(CachedFrame& cachedFrame)
     
     // When navigating to a CachedFrame its FrameView should never be null.  If it is we'll crash in creative ways downstream.
     ASSERT(view);
-    if (view)
-        view->setWasScrolledByUser(false);
+    view->setWasScrolledByUser(false);
+
+    // Use the current ScrollView's frame rect.
+    if (m_frame->view())
+        view->setFrameRect(m_frame->view()->frameRect());
     m_frame->setView(view);
     
     m_frame->setDocument(document);
@@ -3376,7 +3464,7 @@ void FrameLoader::continueLoadAfterWillSubmitForm(PolicyAction)
     if (activeDocLoader && activeDocLoader->isLoadingMainResource())
         return;
 
-    m_provisionalDocumentLoader->setLoadingFromCachedPage(false);
+    m_loadingFromCachedPage = false;
 
     unsigned long identifier = 0;
 
@@ -3440,7 +3528,7 @@ void FrameLoader::closeAndRemoveChild(Frame* child)
     child->tree()->detachFromParent();
 
     child->setView(0);
-    if (child->ownerElement())
+    if (child->ownerElement() && child->page())
         child->page()->decrementFrameCount();
     child->pageDestroyed();
 
@@ -3514,12 +3602,13 @@ void FrameLoader::detachFromParent()
     saveScrollPositionAndViewStateToItem(currentHistoryItem());
     detachChildren();
 
+#if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
         page->inspectorController()->frameDetachedFromParent(m_frame);
+#endif
+
+    detachViewsAndDocumentLoader();
 
-    m_client->detachedFromParent2();
-    setDocumentLoader(0);
-    m_client->detachedFromParent3();
     if (Frame* parent = m_frame->tree()->parent()) {
         parent->loader()->closeAndRemoveChild(m_frame);
         parent->loader()->scheduleCheckCompleted();
@@ -3528,6 +3617,13 @@ void FrameLoader::detachFromParent()
         m_frame->pageDestroyed();
     }
 }
+
+void FrameLoader::detachViewsAndDocumentLoader()
+{
+    m_client->detachedFromParent2();
+    setDocumentLoader(0);
+    m_client->detachedFromParent3();
+}
     
 void FrameLoader::addExtraFieldsToSubresourceRequest(ResourceRequest& request)
 {
@@ -3681,30 +3777,11 @@ unsigned long FrameLoader::loadResourceSynchronously(const ResourceRequest& requ
         ASSERT(!newRequest.isNull());
         
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-        ApplicationCacheResource* resource;
-        if (documentLoader()->shouldLoadResourceFromApplicationCache(newRequest, resource)) {
-            if (resource) {
-                response = resource->response();
-                data.append(resource->data()->data(), resource->data()->size());
-            } else
-                error = cannotShowURLError(newRequest);
-        } else {
+        if (!documentLoader()->applicationCacheHost()->maybeLoadSynchronously(newRequest, error, response, data)) {
 #endif
             ResourceHandle::loadResourceSynchronously(newRequest, storedCredentials, error, response, data, m_frame);
-
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-            // If normal loading results in a redirect to a resource with another origin (indicative of a captive portal), or a 4xx or 5xx status code or equivalent,
-            // or if there were network errors (but not if the user canceled the download), then instead get, from the cache, the resource of the fallback entry
-            // corresponding to the matched namespace.
-            if ((!error.isNull() && !error.isCancellation())
-                 || response.httpStatusCode() / 100 == 4 || response.httpStatusCode() / 100 == 5
-                 || !protocolHostAndPortAreEqual(newRequest.url(), response.url())) {
-                if (documentLoader()->getApplicationCacheFallbackResource(newRequest, resource)) {
-                    response = resource->response();
-                    data.clear();
-                    data.append(resource->data()->data(), resource->data()->size());
-                }
-            }
+            documentLoader()->applicationCacheHost()->maybeLoadFallbackSynchronously(newRequest, error, response, data);
         }
 #endif
     }
@@ -4009,7 +4086,7 @@ void FrameLoader::continueLoadAfterNavigationPolicy(const ResourceRequest&, Pass
     if (!m_frame->page())
         return;
 
-#if ENABLE(JAVASCRIPT_DEBUGGER)
+#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR)
     if (Page* page = m_frame->page()) {
         if (page->mainFrame() == m_frame)
             page->inspectorController()->resumeDebugger();
@@ -4100,7 +4177,9 @@ void FrameLoader::loadedResourceFromMemoryCache(const CachedResource* resource)
     if (!page)
         return;
 
+#if ENABLE(INSPECTOR)
     page->inspectorController()->didLoadResourceFromMemoryCache(m_documentLoader.get(), resource);
+#endif
 
     if (!resource->sendResourceLoadCallbacks() || m_documentLoader->haveToldClientAboutLoad(resource->url()))
         return;
@@ -4178,7 +4257,17 @@ bool FrameLoader::loadProvisionalItemFromCachedPage()
     RefPtr<CachedPage> cachedPage = pageCache()->get(m_provisionalHistoryItem.get());
     if (!cachedPage || !cachedPage->document())
         return false;
-    provisionalDocumentLoader()->loadFromCachedPage(cachedPage.release());
+
+    DocumentLoader *provisionalLoader = provisionalDocumentLoader();
+    LOG(PageCache, "WebCorePageCache: FrameLoader %p loading provisional DocumentLoader %p with URL '%s' from CachedPage %p", this, provisionalLoader, provisionalLoader->url().string().utf8().data(), cachedPage.get());
+    
+    provisionalLoader->prepareForLoadStart();
+
+    m_loadingFromCachedPage = true;
+
+    provisionalLoader->setCommitted(true);
+    commitProvisionalLoad(cachedPage);
+    
     return true;
 }
 
@@ -4187,12 +4276,26 @@ void FrameLoader::cachePageForHistoryItem(HistoryItem* item)
     if (!canCachePage() || item->isInPageCache())
         return;
 
+    pageHidden();
+    
     if (Page* page = m_frame->page()) {
         RefPtr<CachedPage> cachedPage = CachedPage::create(page);
         pageCache()->add(item, cachedPage.release());
     }
 }
 
+void FrameLoader::pageHidden()
+{
+    m_unloadEventBeingDispatched = true;
+    if (m_frame->domWindow())
+        m_frame->domWindow()->dispatchPageTransitionEvent(EventNames().pagehideEvent, true);
+    m_unloadEventBeingDispatched = false;
+
+    // Send pagehide event for subframes as well
+    for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
+        child->loader()->pageHidden();
+}
+
 bool FrameLoader::shouldTreatURLAsSameAsCurrent(const KURL& url) const
 {
     if (!m_currentHistoryItem)
@@ -4520,7 +4623,7 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
                 // have the item vanish when we try to use it in the ensuing nav.  This should be
                 // extremely rare, but in that case the user will get an error on the navigation.
                 
-                if (ResourceHandle::willLoadFromCache(request))
+                if (ResourceHandle::willLoadFromCache(request, m_frame))
                     action = NavigationAction(itemURL, loadType, false);
                 else {
                     request.setCachePolicy(ReloadIgnoringCacheData);
@@ -4533,6 +4636,7 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
                         request.setCachePolicy(ReloadIgnoringCacheData);
                         break;
                     case FrameLoadTypeBack:
+                    case FrameLoadTypeBackWMLDeckNotAccessible:
                     case FrameLoadTypeForward:
                     case FrameLoadTypeIndexedBackForward:
                         if (itemURL.protocol() != "https")
@@ -4561,7 +4665,7 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
 bool FrameLoader::urlsMatchItem(HistoryItem* item) const
 {
     const KURL& currentURL = documentLoader()->url();
-    if (!equalIgnoringRef(currentURL, item->url()))
+    if (!equalIgnoringFragmentIdentifier(currentURL, item->url()))
         return false;
 
     const HistoryItemVector& childItems = item->children();
@@ -5041,6 +5145,7 @@ String FrameLoader::referrer() const
 
 void FrameLoader::dispatchDocumentElementAvailable()
 {
+    m_frame->injectUserScripts(InjectAtDocumentStart);
     m_client->documentElementAvailable();
 }
 
@@ -5051,12 +5156,12 @@ void FrameLoader::dispatchWindowObjectAvailable()
 
     m_client->windowObjectCleared();
 
+#if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page()) {
-        if (InspectorController* inspector = page->inspectorController())
-            inspector->inspectedWindowScriptObjectCleared(m_frame);
         if (InspectorController* inspector = page->parentInspectorController())
             inspector->windowScriptObjectAvailable();
     }
+#endif
 }
 
 PassRefPtr<Widget> FrameLoader::createJavaAppletWidget(const IntSize& size, HTMLAppletElement* element, const HashMap<String, String>& args)
@@ -5121,16 +5226,20 @@ void FrameLoader::dispatchDidCommitLoad()
 
     m_client->dispatchDidCommitLoad();
 
+#if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
         page->inspectorController()->didCommitLoad(m_documentLoader.get());
+#endif
 }
 
 void FrameLoader::dispatchAssignIdentifierToInitialRequest(unsigned long identifier, DocumentLoader* loader, const ResourceRequest& request)
 {
     m_client->assignIdentifierToInitialRequest(identifier, loader, request);
 
+#if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
         page->inspectorController()->identifierForInitialRequest(identifier, loader, request);
+#endif
 }
 
 void FrameLoader::dispatchWillSendRequest(DocumentLoader* loader, unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
@@ -5144,32 +5253,40 @@ void FrameLoader::dispatchWillSendRequest(DocumentLoader* loader, unsigned long
     if (!request.isNull() && oldRequestURL != request.url().string().impl())
         m_documentLoader->didTellClientAboutLoad(request.url());
 
+#if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
         page->inspectorController()->willSendRequest(loader, identifier, request, redirectResponse);
+#endif
 }
 
 void FrameLoader::dispatchDidReceiveResponse(DocumentLoader* loader, unsigned long identifier, const ResourceResponse& r)
 {
     m_client->dispatchDidReceiveResponse(loader, identifier, r);
 
+#if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
         page->inspectorController()->didReceiveResponse(loader, identifier, r);
+#endif
 }
 
 void FrameLoader::dispatchDidReceiveContentLength(DocumentLoader* loader, unsigned long identifier, int length)
 {
     m_client->dispatchDidReceiveContentLength(loader, identifier, length);
 
+#if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
         page->inspectorController()->didReceiveContentLength(loader, identifier, length);
+#endif
 }
 
 void FrameLoader::dispatchDidFinishLoading(DocumentLoader* loader, unsigned long identifier)
 {
     m_client->dispatchDidFinishLoading(loader, identifier);
 
+#if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
         page->inspectorController()->didFinishLoading(loader, identifier);
+#endif
 }
 
 void FrameLoader::tellClientAboutPastMemoryCacheLoads()
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoader.h b/src/3rdparty/webkit/WebCore/loader/FrameLoader.h
index c41e491..26206e6 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoader.h
@@ -40,7 +40,7 @@ namespace WebCore {
 
     class Archive;
     class AuthenticationChallenge;
-    class CachedFrame;
+    class CachedFrameBase;
     class CachedPage;
     class CachedResource;
     class Document;
@@ -241,6 +241,7 @@ namespace WebCore {
 
         void checkLoadComplete();
         void detachFromParent();
+        void detachViewsAndDocumentLoader();
 
         void addExtraFieldsToSubresourceRequest(ResourceRequest&);
         void addExtraFieldsToMainResourceRequest(ResourceRequest&);
@@ -260,7 +261,7 @@ namespace WebCore {
             bool lockHistory, PassRefPtr<Event>, PassRefPtr<FormState>);
 
         void stop();
-        void stopLoading(bool sendUnload, DatabasePolicy = DatabasePolicyStop);
+        void stopLoading(UnloadEventPolicy, DatabasePolicy = DatabasePolicyStop);
         bool closeURL();
 
         void didExplicitOpen();
@@ -307,6 +308,11 @@ namespace WebCore {
         void dispatchDocumentElementAvailable();
         void restoreDocumentState();
 
+        // Mixed content related functions.
+        static bool isMixedContent(SecurityOrigin* context, const KURL&);
+        void checkIfDisplayInsecureContent(SecurityOrigin* context, const KURL&);
+        void checkIfRunInsecureContent(SecurityOrigin* context, const KURL&);
+
         Frame* opener();
         void setOpener(Frame*);
         bool openedByDOM() const;
@@ -345,6 +351,7 @@ namespace WebCore {
         void setTitle(const String&);
 
         void commitProvisionalLoad(PassRefPtr<CachedPage>);
+        bool isLoadingFromCachedPage() const { return m_loadingFromCachedPage; }
 
         void goToItem(HistoryItem*, FrameLoadType);
         void saveDocumentAndScrollState();
@@ -355,7 +362,7 @@ namespace WebCore {
         enum LocalLoadPolicy {
             AllowLocalLoadsForAll,  // No restriction on local loads.
             AllowLocalLoadsForLocalAndSubstituteData,
-            AllowLocalLoadsForLocalOnly
+            AllowLocalLoadsForLocalOnly,
         };
         static void setLocalLoadPolicy(LocalLoadPolicy);
         static bool restrictAccessToLocal();
@@ -374,6 +381,8 @@ namespace WebCore {
 
         bool shouldInterruptLoadForXFrameOptions(const String&, const KURL&);
 
+        void open(CachedFrameBase&);
+
     private:
         PassRefPtr<HistoryItem> createHistoryItem(bool useOriginal);
         PassRefPtr<HistoryItem> createHistoryItemTree(Frame* targetFrame, bool clipAtTarget);
@@ -418,6 +427,7 @@ namespace WebCore {
         
         bool loadProvisionalItemFromCachedPage();
         void cachePageForHistoryItem(HistoryItem*);
+        void pageHidden();
 
         void receivedFirstData();
 
@@ -467,11 +477,10 @@ namespace WebCore {
 
         void closeOldDataSources();
         void open(CachedPage&);
-        void open(CachedFrame&);
 
         void updateHistoryAfterClientRedirect();
 
-        void clear(bool clearWindowProperties = true, bool clearScriptObjects = true);
+        void clear(bool clearWindowProperties = true, bool clearScriptObjects = true, bool clearFrameView = true);
 
         bool shouldReloadToHandleUnreachableURL(DocumentLoader*);
         void handleUnimplementablePolicy(const ResourceError&);
@@ -617,6 +626,7 @@ namespace WebCore {
         RefPtr<HistoryItem> m_provisionalHistoryItem;
         
         bool m_didPerformFirstNavigation;
+        bool m_loadingFromCachedPage;
         
 #ifndef NDEBUG
         bool m_didDispatchDidCommitLoad;
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h b/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h
index 1e68991..5ba4b10 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h
@@ -59,12 +59,14 @@ namespace WebCore {
     class IntSize;
     class KURL;
     class NavigationAction;
+    class PluginView;
     class ResourceError;
     class ResourceHandle;
     class ResourceLoader;
     struct ResourceRequest;
     class ResourceResponse;
     class ScriptString;
+    class SecurityOrigin;
     class SharedBuffer;
     class SubstituteData;
     class String;
@@ -163,6 +165,15 @@ namespace WebCore {
 
         virtual bool shouldGoToHistoryItem(HistoryItem*) const = 0;
 
+        // This frame has displayed inactive content (such as an image) from an
+        // insecure source.  Inactive content cannot spread to other frames.
+        virtual void didDisplayInsecureContent() = 0;
+
+        // The indicated security origin has run active content (such as a
+        // script) from an insecure source.  Note that the insecure content can
+        // spread to other frames in the same origin.
+        virtual void didRunInsecureContent(SecurityOrigin*) = 0;
+
         virtual ResourceError cancelledError(const ResourceRequest&) = 0;
         virtual ResourceError blockedError(const ResourceRequest&) = 0;
         virtual ResourceError cannotShowURLError(const ResourceRequest&) = 0;
@@ -202,9 +213,11 @@ namespace WebCore {
                                    const String& referrer, bool allowsScrolling, int marginWidth, int marginHeight) = 0;
         virtual PassRefPtr<Widget> createPlugin(const IntSize&, HTMLPlugInElement*, const KURL&, const Vector<String>&, const Vector<String>&, const String&, bool loadManually) = 0;
         virtual void redirectDataToPlugin(Widget* pluginWidget) = 0;
-        
+
         virtual PassRefPtr<Widget> createJavaAppletWidget(const IntSize&, HTMLAppletElement*, const KURL& baseURL, const Vector<String>& paramNames, const Vector<String>& paramValues) = 0;
 
+        virtual void dispatchDidFailToStartPlugin(const PluginView*) const { }
+
         virtual ObjectContentType objectContentType(const KURL& url, const String& mimeType) = 0;
         virtual String overrideMediaType() const = 0;
 
@@ -231,6 +244,7 @@ namespace WebCore {
 #endif
 
         virtual bool shouldUsePluginDocument(const String& /*mimeType*/) const { return false; }
+        virtual bool shouldLoadMediaElementURL(const KURL&) const { return true; }
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoaderTypes.h b/src/3rdparty/webkit/WebCore/loader/FrameLoaderTypes.h
index b3823ba..76299f5 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoaderTypes.h
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoaderTypes.h
@@ -42,19 +42,22 @@ namespace WebCore {
     enum PolicyAction {
         PolicyUse,
         PolicyDownload,
-        PolicyIgnore
+        PolicyIgnore,
     };
 
+    // NOTE: Keep in sync with WebKit/mac/WebView/WebFramePrivate.h and WebKit/win/Interfaces/IWebFramePrivate.idl
     enum FrameLoadType {
         FrameLoadTypeStandard,
         FrameLoadTypeBack,
         FrameLoadTypeForward,
         FrameLoadTypeIndexedBackForward, // a multi-item hop in the backforward list
         FrameLoadTypeReload,
-        FrameLoadTypeSame,               // user loads same URL again (but not reload button)
+        // Skipped value: 'FrameLoadTypeReloadAllowingStaleData', still present in mac/win public API. Ready to be reused
+        FrameLoadTypeSame = FrameLoadTypeReload + 2, // user loads same URL again (but not reload button)
         FrameLoadTypeRedirectWithLockedBackForwardList, // FIXME: Merge "lockBackForwardList", "lockHistory", "quickRedirect" and "clientRedirect" into a single concept of redirect.
         FrameLoadTypeReplace,
-        FrameLoadTypeReloadFromOrigin
+        FrameLoadTypeReloadFromOrigin,
+        FrameLoadTypeBackWMLDeckNotAccessible
     };
 
     enum NavigationType {
@@ -78,6 +81,12 @@ namespace WebCore {
         ObjectContentNetscapePlugin,
         ObjectContentOtherPlugin
     };
+    
+    enum UnloadEventPolicy {
+        UnloadEventPolicyNone,
+        UnloadEventPolicyUnloadOnly,
+        UnloadEventPolicyUnloadAndPageHide
+    };
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/loader/ImageDocument.cpp b/src/3rdparty/webkit/WebCore/loader/ImageDocument.cpp
index 08f2e9a..d2b1dd6 100644
--- a/src/3rdparty/webkit/WebCore/loader/ImageDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/ImageDocument.cpp
@@ -54,10 +54,24 @@ using namespace HTMLNames;
 class ImageEventListener : public EventListener {
 public:
     static PassRefPtr<ImageEventListener> create(ImageDocument* document) { return adoptRef(new ImageEventListener(document)); }
-    virtual void handleEvent(Event*, bool isWindowEvent);
+    static const ImageEventListener* cast(const EventListener* listener)
+    {
+        return listener->type() == ImageEventListenerType
+            ? static_cast<const ImageEventListener*>(listener)
+            : 0;
+    }
+
+    virtual bool operator==(const EventListener& other);
 
 private:
-    ImageEventListener(ImageDocument* document) : m_doc(document) { }
+    ImageEventListener(ImageDocument* document)
+        : EventListener(ImageEventListenerType)
+        , m_doc(document)
+    {
+    }
+
+    virtual void handleEvent(Event*, bool isWindowEvent);
+
     ImageDocument* m_doc;
 };
     
@@ -354,6 +368,13 @@ void ImageEventListener::handleEvent(Event* event, bool)
     }
 }
 
+bool ImageEventListener::operator==(const EventListener& listener)
+{
+    if (const ImageEventListener* imageEventListener = ImageEventListener::cast(&listener))
+        return m_doc == imageEventListener->m_doc;
+    return false;
+}
+
 // --------
 
 ImageDocumentElement::~ImageDocumentElement()
diff --git a/src/3rdparty/webkit/WebCore/loader/ImageDocument.h b/src/3rdparty/webkit/WebCore/loader/ImageDocument.h
index 1bc5245..080b250 100644
--- a/src/3rdparty/webkit/WebCore/loader/ImageDocument.h
+++ b/src/3rdparty/webkit/WebCore/loader/ImageDocument.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,7 +35,7 @@ class ImageDocument : public HTMLDocument {
 public:
     static PassRefPtr<ImageDocument> create(Frame* frame)
     {
-        return new ImageDocument(frame);
+        return adoptRef(new ImageDocument(frame));
     }
 
     CachedImage* cachedImage();
diff --git a/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.cpp b/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.cpp
index 39e5b90..a3e90fd 100644
--- a/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.cpp
@@ -30,6 +30,7 @@
 #include "config.h"
 #include "MainResourceLoader.h"
 
+#include "ApplicationCacheHost.h"
 #include "DocumentLoader.h"
 #include "FormState.h"
 #include "Frame.h"
@@ -41,12 +42,6 @@
 #include "ResourceHandle.h"
 #include "Settings.h"
 
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-#include "ApplicationCache.h"
-#include "ApplicationCacheGroup.h"
-#include "ApplicationCacheResource.h"
-#endif
-
 // FIXME: More that is in common with SubresourceLoader should move up into ResourceLoader.
 
 namespace WebCore {
@@ -177,6 +172,10 @@ void MainResourceLoader::willSendRequest(ResourceRequest& newRequest, const Reso
     // Don't set this on the first request. It is set when the main load was started.
     m_documentLoader->setRequest(newRequest);
 
+    Frame* top = m_frame->tree()->top();
+    if (top != m_frame)
+        frameLoader()->checkIfDisplayInsecureContent(top->document()->securityOrigin(), newRequest.url());
+
     // FIXME: Ideally we'd stop the I/O until we hear back from the navigation policy delegate
     // listener. But there's no way to do that in practice. So instead we cancel later if the
     // listener tells us to. In practice that means the navigation policy needs to be decided
@@ -283,15 +282,8 @@ void MainResourceLoader::continueAfterContentPolicy(PolicyAction policy)
 void MainResourceLoader::didReceiveResponse(const ResourceResponse& r)
 {
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    if (r.httpStatusCode() / 100 == 4 || r.httpStatusCode() / 100 == 5) {
-        ASSERT(!m_applicationCache);
-        if (m_frame->settings() && m_frame->settings()->offlineWebApplicationCacheEnabled()) {
-            m_applicationCache = ApplicationCacheGroup::fallbackCacheForMainRequest(request(), documentLoader());
-
-            if (scheduleLoadFallbackResourceFromApplicationCache(m_applicationCache.get()))
-                return;
-        }
-    }
+    if (documentLoader()->applicationCacheHost()->maybeLoadFallbackForMainResponse(request(), r))
+        return;
 #endif
 
     HTTPHeaderMap::const_iterator it = r.httpHeaderFields().find(AtomicString("x-frame-options"));
@@ -353,6 +345,10 @@ void MainResourceLoader::didReceiveData(const char* data, int length, long long
     ASSERT(!defersLoading());
 #endif
  
+ #if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    documentLoader()->applicationCacheHost()->mainResourceDataReceived(data, length, lengthReceived, allAtOnce);
+#endif
+
     // The additional processing can do anything including possibly removing the last
     // reference to this object; one example of this is 3266216.
     RefPtr<MainResourceLoader> protect(this);
@@ -380,27 +376,15 @@ void MainResourceLoader::didFinishLoading()
     ResourceLoader::didFinishLoading();
     
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    ApplicationCacheGroup* group = dl->candidateApplicationCacheGroup();
-    if (!group && dl->applicationCache() && !dl->mainResourceApplicationCache())
-        group = dl->applicationCache()->group();
-    
-    if (group)
-        group->finishedLoadingMainResource(dl.get());
+    dl->applicationCacheHost()->finishedLoadingMainResource();
 #endif
 }
 
 void MainResourceLoader::didFail(const ResourceError& error)
 {
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    if (!error.isCancellation()) {
-        ASSERT(!m_applicationCache);
-        if (m_frame->settings() && m_frame->settings()->offlineWebApplicationCacheEnabled()) {
-            m_applicationCache = ApplicationCacheGroup::fallbackCacheForMainRequest(request(), documentLoader());
-
-            if (scheduleLoadFallbackResourceFromApplicationCache(m_applicationCache.get()))
-                return;
-        }
-    }
+    if (documentLoader()->applicationCacheHost()->maybeLoadFallbackForMainError(request(), error))
+        return;
 #endif
 
     // There is a bug in CFNetwork where callbacks can be dispatched even when loads are deferred.
@@ -495,27 +479,15 @@ bool MainResourceLoader::load(const ResourceRequest& r, const SubstituteData& su
 
     m_substituteData = substituteData;
 
+    ResourceRequest request(r);
+
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    // Check if this request should be loaded from the application cache
-    if (!m_substituteData.isValid() && frameLoader()->frame()->settings() && frameLoader()->frame()->settings()->offlineWebApplicationCacheEnabled()) {
-        ASSERT(!m_applicationCache);
-
-        m_applicationCache = ApplicationCacheGroup::cacheForMainRequest(r, m_documentLoader.get());
-
-        if (m_applicationCache) {
-            // Get the resource from the application cache. By definition, cacheForMainRequest() returns a cache that contains the resource.
-            ApplicationCacheResource* resource = m_applicationCache->resourceForRequest(r);
-            m_substituteData = SubstituteData(resource->data(), 
-                                              resource->response().mimeType(),
-                                              resource->response().textEncodingName(), KURL());
-        }
-    }
+    documentLoader()->applicationCacheHost()->maybeLoadMainResource(request, m_substituteData);
 #endif
 
-    ResourceRequest request(r);
     bool defer = defersLoading();
     if (defer) {
-        bool shouldLoadEmpty = shouldLoadAsEmptyDocument(r.url());
+        bool shouldLoadEmpty = shouldLoadAsEmptyDocument(request.url());
         if (shouldLoadEmpty)
             defer = false;
     }
diff --git a/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.h b/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.h
index d9ce2f9..d3f411b 100644
--- a/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.h
@@ -39,9 +39,6 @@
 
 namespace WebCore {
 
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    class ApplicationCache;
-#endif
     class FormState;
     struct ResourceRequest;
 
@@ -71,10 +68,6 @@ namespace WebCore {
 
         bool isLoadingMultipartContent() const { return m_loadingMultipartContent; }
 
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-        ApplicationCache* applicationCache() const { return m_applicationCache.get(); }
-#endif
-
     private:
         MainResourceLoader(Frame*);
 
@@ -105,11 +98,6 @@ namespace WebCore {
 
         MainResourceLoaderTimer m_dataLoadTimer;
 
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-        // The application cache that the main resource was loaded from (if any).
-        RefPtr<ApplicationCache> m_applicationCache;
-#endif
-
         bool m_loadingMultipartContent;
         bool m_waitingForContentPolicy;
     };
diff --git a/src/3rdparty/webkit/WebCore/loader/MediaDocument.cpp b/src/3rdparty/webkit/WebCore/loader/MediaDocument.cpp
index 0b1fd59..656d0a0 100644
--- a/src/3rdparty/webkit/WebCore/loader/MediaDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/MediaDocument.cpp
@@ -226,8 +226,8 @@ void MediaDocument::replaceMediaElementTimerFired(Timer<MediaDocument>*)
         embedElement->setAttribute(widthAttr, "100%");
         embedElement->setAttribute(heightAttr, "100%");
         embedElement->setAttribute(nameAttr, "plugin");
-        embedElement->setSrc(url().string());
-        embedElement->setType(frame()->loader()->responseMIMEType());
+        embedElement->setAttribute(srcAttr, url().string());
+        embedElement->setAttribute(typeAttr, frame()->loader()->responseMIMEType());
 
         ExceptionCode ec;
         videoElement->parent()->replaceChild(embedElement, videoElement, ec);
diff --git a/src/3rdparty/webkit/WebCore/loader/MediaDocument.h b/src/3rdparty/webkit/WebCore/loader/MediaDocument.h
index ac286f0..aa751ab 100644
--- a/src/3rdparty/webkit/WebCore/loader/MediaDocument.h
+++ b/src/3rdparty/webkit/WebCore/loader/MediaDocument.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008,2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -36,22 +36,23 @@ class MediaDocument : public HTMLDocument {
 public:
     static PassRefPtr<MediaDocument> create(Frame* frame)
     {
-        return new MediaDocument(frame);
+        return adoptRef(new MediaDocument(frame));
     }
-
-    virtual void defaultEventHandler(Event*);
+    virtual ~MediaDocument();
 
     void mediaElementSawUnsupportedTracks();
 
 private:
     MediaDocument(Frame*);
-    virtual ~MediaDocument();
-    Timer<MediaDocument> m_replaceMediaElementTimer;
 
     virtual bool isMediaDocument() const { return true; }        
     virtual Tokenizer* createTokenizer();
 
+    virtual void defaultEventHandler(Event*);
+
     void replaceMediaElementTimerFired(Timer<MediaDocument>*);
+
+    Timer<MediaDocument> m_replaceMediaElementTimer;
 };
     
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/PlaceholderDocument.cpp b/src/3rdparty/webkit/WebCore/loader/PlaceholderDocument.cpp
index e071aa8..af14c72 100644
--- a/src/3rdparty/webkit/WebCore/loader/PlaceholderDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/PlaceholderDocument.cpp
@@ -37,7 +37,7 @@ void PlaceholderDocument::attach()
 
     if (!styleSelector()) {
         RefPtr<StyleSheetList> styleSheetList = StyleSheetList::create(this);
-        setStyleSelector(new CSSStyleSelector(this, userStyleSheet(), styleSheetList.get(), 0, true, false));
+        setStyleSelector(new CSSStyleSelector(this, styleSheetList.get(), 0, pageUserSheet(), pageGroupUserSheets(), true, false));
     }
 
     // Skipping Document::attach().
diff --git a/src/3rdparty/webkit/WebCore/loader/PlaceholderDocument.h b/src/3rdparty/webkit/WebCore/loader/PlaceholderDocument.h
index c542370..a759266 100644
--- a/src/3rdparty/webkit/WebCore/loader/PlaceholderDocument.h
+++ b/src/3rdparty/webkit/WebCore/loader/PlaceholderDocument.h
@@ -34,7 +34,7 @@ class PlaceholderDocument : public Document {
 public:
     static PassRefPtr<PlaceholderDocument> create(Frame* frame)
     {
-        return new PlaceholderDocument(frame);
+        return adoptRef(new PlaceholderDocument(frame));
     }
 
     virtual void attach();
diff --git a/src/3rdparty/webkit/WebCore/loader/PluginDocument.cpp b/src/3rdparty/webkit/WebCore/loader/PluginDocument.cpp
index 373126f..788691f 100644
--- a/src/3rdparty/webkit/WebCore/loader/PluginDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/PluginDocument.cpp
@@ -88,8 +88,8 @@ void PluginTokenizer::createDocumentStructure()
     m_embedElement->setAttribute(heightAttr, "100%");
     
     m_embedElement->setAttribute(nameAttr, "plugin");
-    m_embedElement->setSrc(m_doc->url().string());
-    m_embedElement->setType(m_doc->frame()->loader()->responseMIMEType());
+    m_embedElement->setAttribute(srcAttr, m_doc->url().string());
+    m_embedElement->setAttribute(typeAttr, m_doc->frame()->loader()->responseMIMEType());
     
     body->appendChild(embedElement, ec);    
 }
@@ -106,12 +106,12 @@ bool PluginTokenizer::writeRawData(const char*, int)
         Settings* settings = frame->settings();
         if (settings && settings->arePluginsEnabled()) {
             m_doc->updateLayout();
-        
-            if (RenderWidget* renderer = static_cast<RenderWidget*>(m_embedElement->renderer())) {
+
+            if (RenderWidget* renderer = toRenderWidget(m_embedElement->renderer())) {
                 frame->loader()->client()->redirectDataToPlugin(renderer->widget());
                 frame->loader()->activeDocumentLoader()->mainResourceLoader()->setShouldBufferData(false);
             }
-        
+
             finish();
         }
     }
diff --git a/src/3rdparty/webkit/WebCore/loader/PluginDocument.h b/src/3rdparty/webkit/WebCore/loader/PluginDocument.h
index 35e4038..1d5c964 100644
--- a/src/3rdparty/webkit/WebCore/loader/PluginDocument.h
+++ b/src/3rdparty/webkit/WebCore/loader/PluginDocument.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2008, 2009Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -33,7 +33,7 @@ class PluginDocument : public HTMLDocument {
 public:
     static PassRefPtr<PluginDocument> create(Frame* frame)
     {
-        return new PluginDocument(frame);
+        return adoptRef(new PluginDocument(frame));
     }
 
 private:
diff --git a/src/3rdparty/webkit/WebCore/loader/ResourceLoader.cpp b/src/3rdparty/webkit/WebCore/loader/ResourceLoader.cpp
index e2fc7ba..ee7dea9 100644
--- a/src/3rdparty/webkit/WebCore/loader/ResourceLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/ResourceLoader.cpp
@@ -30,6 +30,7 @@
 #include "config.h"
 #include "ResourceLoader.h"
 
+#include "ApplicationCacheHost.h"
 #include "DocumentLoader.h"
 #include "Frame.h"
 #include "FrameLoader.h"
@@ -93,8 +94,9 @@ void ResourceLoader::releaseResources()
 
     if (m_handle) {
         // Clear out the ResourceHandle's client so that it doesn't try to call
-        // us back after we release it.
-        m_handle->setClient(0);
+        // us back after we release it, unless it has been replaced by someone else.
+        if (m_handle->client() == this)
+            m_handle->setClient(0);
         m_handle = 0;
     }
 
@@ -119,7 +121,7 @@ bool ResourceLoader::load(const ResourceRequest& r)
         return true;
     
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    if (m_documentLoader->scheduleApplicationCacheLoad(this, clientRequest, r.url()))
+    if (m_documentLoader->applicationCacheHost()->maybeLoadResource(this, clientRequest, r.url()))
         return true;
 #endif
 
@@ -190,17 +192,6 @@ void ResourceLoader::clearResourceData()
         m_resourceData->clear();
 }
 
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-bool ResourceLoader::scheduleLoadFallbackResourceFromApplicationCache(ApplicationCache* cache)
-{
-    if (documentLoader()->scheduleLoadFallbackResourceFromApplicationCache(this, m_request, cache)) {
-        handle()->cancel();
-        return true;
-    }
-    return false;
-}
-#endif
-
 void ResourceLoader::willSendRequest(ResourceRequest& request, const ResourceResponse& redirectResponse)
 {
     // Protect this in this delegate method since the additional processing can do
@@ -382,10 +373,8 @@ ResourceError ResourceLoader::cannotShowURLError()
 void ResourceLoader::willSendRequest(ResourceHandle*, ResourceRequest& request, const ResourceResponse& redirectResponse)
 {
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    if (!redirectResponse.isNull() && !protocolHostAndPortAreEqual(request.url(), redirectResponse.url())) {
-        if (scheduleLoadFallbackResourceFromApplicationCache())
-            return;
-    }
+    if (documentLoader()->applicationCacheHost()->maybeLoadFallbackForRedirect(this, request, redirectResponse))
+        return;
 #endif
     willSendRequest(request, redirectResponse);
 }
@@ -398,10 +387,8 @@ void ResourceLoader::didSendData(ResourceHandle*, unsigned long long bytesSent,
 void ResourceLoader::didReceiveResponse(ResourceHandle*, const ResourceResponse& response)
 {
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    if (response.httpStatusCode() / 100 == 4 || response.httpStatusCode() / 100 == 5) {
-        if (scheduleLoadFallbackResourceFromApplicationCache())
-            return;
-    }
+    if (documentLoader()->applicationCacheHost()->maybeLoadFallbackForResponse(this, response))
+        return;
 #endif
     didReceiveResponse(response);
 }
@@ -419,10 +406,8 @@ void ResourceLoader::didFinishLoading(ResourceHandle*)
 void ResourceLoader::didFail(ResourceHandle*, const ResourceError& error)
 {
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    if (!error.isCancellation()) {
-        if (documentLoader()->scheduleLoadFallbackResourceFromApplicationCache(this, m_request))
-            return;
-    }
+    if (documentLoader()->applicationCacheHost()->maybeLoadFallbackForError(this, error))
+        return;
 #endif
     didFail(error);
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/ResourceLoader.h b/src/3rdparty/webkit/WebCore/loader/ResourceLoader.h
index d3e7b80..5239289 100644
--- a/src/3rdparty/webkit/WebCore/loader/ResourceLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/ResourceLoader.h
@@ -40,7 +40,7 @@
 
 namespace WebCore {
 
-    class ApplicationCache;
+    class ApplicationCacheHost;
     class DocumentLoader;
     class Frame;
     class FrameLoader;
@@ -119,7 +119,7 @@ namespace WebCore {
         ResourceLoader(Frame*, bool sendResourceLoadCallbacks, bool shouldContentSniff);
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-        bool scheduleLoadFallbackResourceFromApplicationCache(ApplicationCache* = 0);
+        friend class ApplicationCacheHost;  // for access to request()
 #endif
 
         virtual void didCancel(const ResourceError&);
@@ -133,13 +133,13 @@ namespace WebCore {
         RefPtr<ResourceHandle> m_handle;
         RefPtr<Frame> m_frame;
         RefPtr<DocumentLoader> m_documentLoader;
-        ResourceResponse m_response;        
+        ResourceResponse m_response;
         
     private:
         ResourceRequest m_request;
         RefPtr<SharedBuffer> m_resourceData;
         
-        unsigned long m_identifier;        
+        unsigned long m_identifier;
 
         bool m_reachedTerminalState;
         bool m_cancelled;
diff --git a/src/3rdparty/webkit/WebCore/loader/TextDocument.h b/src/3rdparty/webkit/WebCore/loader/TextDocument.h
index c67fea5..53e3074 100644
--- a/src/3rdparty/webkit/WebCore/loader/TextDocument.h
+++ b/src/3rdparty/webkit/WebCore/loader/TextDocument.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,7 +35,7 @@ class TextDocument : public HTMLDocument {
 public:
     static PassRefPtr<TextDocument> create(Frame* frame)
     {
-        return new TextDocument(frame);
+        return adoptRef(new TextDocument(frame));
     }
 
 private:
diff --git a/src/3rdparty/webkit/WebCore/loader/TextResourceDecoder.cpp b/src/3rdparty/webkit/WebCore/loader/TextResourceDecoder.cpp
index db68441..6ddd604 100644
--- a/src/3rdparty/webkit/WebCore/loader/TextResourceDecoder.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/TextResourceDecoder.cpp
@@ -798,23 +798,15 @@ String TextResourceDecoder::decode(const char* data, size_t len)
         if (!checkForHeadCharset(data, len, movedDataToBuffer))
             return "";
 
-    // FIXME: It seems wrong to change our encoding downstream after
-    // we have already done some decoding. However, it's not possible
-    // to avoid in a sense in two cases below because triggering conditions
-    // for both cases depend on the information that won't be available
-    // until we do partial read. 
-    // The first case had better be removed altogether (see bug 21990)
-    // or at least be made to be invoked only when the encoding detection
-    // is turned on. 
-    // Do the auto-detect 1) using Japanese detector if our default encoding is
-    // one of the Japanese detector or 2) using detectTextEncoding if encoding
-    // detection is turned on.
-    if (m_source != UserChosenEncoding && m_source != AutoDetectedEncoding && m_encoding.isJapanese())
-        detectJapaneseEncoding(data, len);
-    else if (shouldAutoDetect()) {
-        TextEncoding detectedEncoding;
-        if (detectTextEncoding(data, len, m_hintEncoding, &detectedEncoding))
-            setEncoding(detectedEncoding, AutoDetectedEncoding);
+    // FIXME: It is wrong to change the encoding downstream after we have already done some decoding.
+    if (shouldAutoDetect()) {
+        if (m_encoding.isJapanese())
+            detectJapaneseEncoding(data, len); // FIXME: We should use detectTextEncoding() for all languages.
+        else {
+            TextEncoding detectedEncoding;
+            if (detectTextEncoding(data, len, m_hintEncoding, &detectedEncoding))
+                setEncoding(detectedEncoding, AutoDetectedEncoding);
+        }
     }
 
     ASSERT(m_encoding.isValid());
diff --git a/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.cpp b/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.cpp
index b174af7..720ba4e 100644
--- a/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.cpp
@@ -40,33 +40,33 @@
 
 namespace WebCore {
 
-PassRefPtr<ThreadableLoader> ThreadableLoader::create(ScriptExecutionContext* context, ThreadableLoaderClient* client, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy) 
+PassRefPtr<ThreadableLoader> ThreadableLoader::create(ScriptExecutionContext* context, ThreadableLoaderClient* client, const ResourceRequest& request, const ThreadableLoaderOptions& options) 
 {
     ASSERT(client);
     ASSERT(context);
 
 #if ENABLE(WORKERS)
     if (context->isWorkerContext())
-        return WorkerThreadableLoader::create(static_cast<WorkerContext*>(context), client, WorkerRunLoop::defaultMode(), request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy);
+        return WorkerThreadableLoader::create(static_cast<WorkerContext*>(context), client, WorkerRunLoop::defaultMode(), request, options);
 #endif // ENABLE(WORKERS)
 
     ASSERT(context->isDocument());
-    return DocumentThreadableLoader::create(static_cast<Document*>(context), client, request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy);
+    return DocumentThreadableLoader::create(static_cast<Document*>(context), client, request, options);
 }
 
-void ThreadableLoader::loadResourceSynchronously(ScriptExecutionContext* context, const ResourceRequest& request, ThreadableLoaderClient& client, StoredCredentials storedCredentials)
+void ThreadableLoader::loadResourceSynchronously(ScriptExecutionContext* context, const ResourceRequest& request, ThreadableLoaderClient& client, const ThreadableLoaderOptions& options)
 {
     ASSERT(context);
 
 #if ENABLE(WORKERS)
     if (context->isWorkerContext()) {
-        WorkerThreadableLoader::loadResourceSynchronously(static_cast<WorkerContext*>(context), request, client, storedCredentials, DenyCrossOriginRedirect);
+        WorkerThreadableLoader::loadResourceSynchronously(static_cast<WorkerContext*>(context), request, client, options);
         return;
     }
 #endif // ENABLE(WORKERS)
 
     ASSERT(context->isDocument());
-    DocumentThreadableLoader::loadResourceSynchronously(static_cast<Document*>(context), request, client, storedCredentials);
+    DocumentThreadableLoader::loadResourceSynchronously(static_cast<Document*>(context), request, client, options);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.h b/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.h
index 1ac12cb..a52bfad 100644
--- a/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.h
@@ -43,32 +43,32 @@ namespace WebCore {
     class ScriptExecutionContext;
     class ThreadableLoaderClient;
 
-    enum LoadCallbacks {
-        SendLoadCallbacks,
-        DoNotSendLoadCallbacks
-    };
-
-    enum ContentSniff {
-        SniffContent,
-        DoNotSniffContent
-    };
-
     enum StoredCredentials {
         AllowStoredCredentials,
         DoNotAllowStoredCredentials
     };
-
-    enum CrossOriginRedirectPolicy {
-        DenyCrossOriginRedirect,
-        AllowCrossOriginRedirect
+    
+    enum CrossOriginRequestPolicy {
+        DenyCrossOriginRequests,
+        UseAccessControl,
+        AllowCrossOriginRequests
+    };
+    
+    struct ThreadableLoaderOptions {
+        ThreadableLoaderOptions() : sendLoadCallbacks(false), sniffContent(false), allowCredentials(false), forcePreflight(false), crossOriginRequestPolicy(DenyCrossOriginRequests) { }
+        bool sendLoadCallbacks;
+        bool sniffContent;
+        bool allowCredentials;  // Whether HTTP credentials and cookies are sent with the request.
+        bool forcePreflight;  // If AccessControl is used, whether to force a preflight.
+        CrossOriginRequestPolicy crossOriginRequestPolicy;
     };
 
     // Useful for doing loader operations from any thread (not threadsafe, 
     // just able to run on threads other than the main thread).
     class ThreadableLoader : public Noncopyable {
     public:
-        static void loadResourceSynchronously(ScriptExecutionContext*, const ResourceRequest&, ThreadableLoaderClient&, StoredCredentials);
-        static PassRefPtr<ThreadableLoader> create(ScriptExecutionContext*, ThreadableLoaderClient*, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
+        static void loadResourceSynchronously(ScriptExecutionContext*, const ResourceRequest&, ThreadableLoaderClient&, const ThreadableLoaderOptions&);
+        static PassRefPtr<ThreadableLoader> create(ScriptExecutionContext*, ThreadableLoaderClient*, const ResourceRequest&, const ThreadableLoaderOptions&);
 
         virtual void cancel() = 0;
         void ref() { refThreadableLoader(); }
diff --git a/src/3rdparty/webkit/WebCore/loader/UserStyleSheetLoader.cpp b/src/3rdparty/webkit/WebCore/loader/UserStyleSheetLoader.cpp
deleted file mode 100644
index 3afbc15..0000000
--- a/src/3rdparty/webkit/WebCore/loader/UserStyleSheetLoader.cpp
+++ /dev/null
@@ -1,62 +0,0 @@
-/*
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "UserStyleSheetLoader.h"
-
-#include "CachedCSSStyleSheet.h"
-#include "DocLoader.h"
-#include "Frame.h"
-
-using namespace WebCore;
-
-UserStyleSheetLoader::UserStyleSheetLoader(PassRefPtr<Document> document, const String& url)
-    : m_document(document)
-    , m_cachedSheet(m_document->docLoader()->requestUserCSSStyleSheet(url, ""))
-{
-    if (m_cachedSheet) {
-        m_document->addPendingSheet();
-        m_cachedSheet->addClient(this);
-    }
-}
-
-UserStyleSheetLoader::~UserStyleSheetLoader()
-{
-    if (m_cachedSheet) {
-        if (!m_cachedSheet->isLoaded())
-            m_document->removePendingSheet();
-        m_cachedSheet->removeClient(this);
-    }
-}
-
-void UserStyleSheetLoader::setCSSStyleSheet(const String& /*URL*/, const String& /*charset*/, const CachedCSSStyleSheet* sheet)
-{
-    m_document->removePendingSheet();
-    if (Frame* frame = m_document->frame())
-        frame->setUserStyleSheet(sheet->sheetText());
-}
diff --git a/src/3rdparty/webkit/WebCore/loader/UserStyleSheetLoader.h b/src/3rdparty/webkit/WebCore/loader/UserStyleSheetLoader.h
deleted file mode 100644
index 6e7a1ba..0000000
--- a/src/3rdparty/webkit/WebCore/loader/UserStyleSheetLoader.h
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef UserStyleSheetLoader_h
-#define UserStyleSheetLoader_h
-
-#include "CachedResourceClient.h"
-#include "CachedResourceHandle.h"
-
-#include "Document.h"
-
-namespace WebCore {
-    class CachedCSSStyleSheet;
-    class String;
-
-    // This class is deprecated and should not be used in any new code. User
-    // stylesheet loading should instead happen through Page.
-    class UserStyleSheetLoader : CachedResourceClient {
-    public:
-        UserStyleSheetLoader(PassRefPtr<Document>, const String& url);
-        ~UserStyleSheetLoader();
-
-    private:
-        virtual void setCSSStyleSheet(const String& URL, const String& charset, const CachedCSSStyleSheet* sheet);
-
-        RefPtr<Document> m_document;
-        CachedResourceHandle<CachedCSSStyleSheet> m_cachedSheet;
-    };
-
-} // namespace WebCore
-
-#endif // UserStyleSheetLoader_h
diff --git a/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.cpp b/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.cpp
index 4d12b8d..6819759 100644
--- a/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.cpp
@@ -53,11 +53,10 @@ namespace WebCore {
 
 static const char loadResourceSynchronouslyMode[] = "loadResourceSynchronouslyMode";
 
-WorkerThreadableLoader::WorkerThreadableLoader(WorkerContext* workerContext, ThreadableLoaderClient* client, const String& taskMode, const ResourceRequest& request, LoadCallbacks callbacksSetting,
-                                               ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+WorkerThreadableLoader::WorkerThreadableLoader(WorkerContext* workerContext, ThreadableLoaderClient* client, const String& taskMode, const ResourceRequest& request, const ThreadableLoaderOptions& options)
     : m_workerContext(workerContext)
     , m_workerClientWrapper(ThreadableLoaderClientWrapper::create(client))
-    , m_bridge(*(new MainThreadBridge(m_workerClientWrapper, m_workerContext->thread()->workerLoaderProxy(), taskMode, request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy)))
+    , m_bridge(*(new MainThreadBridge(m_workerClientWrapper, m_workerContext->thread()->workerLoaderProxy(), taskMode, request, options)))
 {
 }
 
@@ -66,7 +65,7 @@ WorkerThreadableLoader::~WorkerThreadableLoader()
     m_bridge.destroy();
 }
 
-void WorkerThreadableLoader::loadResourceSynchronously(WorkerContext* workerContext, const ResourceRequest& request, ThreadableLoaderClient& client, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+void WorkerThreadableLoader::loadResourceSynchronously(WorkerContext* workerContext, const ResourceRequest& request, ThreadableLoaderClient& client, const ThreadableLoaderOptions& options)
 {
     WorkerRunLoop& runLoop = workerContext->thread()->runLoop();
 
@@ -74,9 +73,7 @@ void WorkerThreadableLoader::loadResourceSynchronously(WorkerContext* workerCont
     String mode = loadResourceSynchronouslyMode;
     mode.append(String::number(runLoop.createUniqueId()));
 
-    ContentSniff contentSniff = request.url().isLocalFile() ? SniffContent : DoNotSniffContent;
-    RefPtr<WorkerThreadableLoader> loader = WorkerThreadableLoader::create(workerContext, &client, mode, request, DoNotSendLoadCallbacks, contentSniff, storedCredentials, crossOriginRedirectPolicy);
-
+    RefPtr<WorkerThreadableLoader> loader = WorkerThreadableLoader::create(workerContext, &client, mode, request, options);
     MessageQueueWaitResult result = MessageQueueMessageReceived;
     while (!loader->done() && result != MessageQueueTerminated)
         result = runLoop.runInMode(workerContext, mode);
@@ -91,21 +88,20 @@ void WorkerThreadableLoader::cancel()
 }
 
 WorkerThreadableLoader::MainThreadBridge::MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, WorkerLoaderProxy& loaderProxy, const String& taskMode,
-                                                           const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials,
-                                                           CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+                                                           const ResourceRequest& request, const ThreadableLoaderOptions& options)
     : m_workerClientWrapper(workerClientWrapper)
     , m_loaderProxy(loaderProxy)
     , m_taskMode(taskMode.copy())
 {
     ASSERT(m_workerClientWrapper.get());
-    m_loaderProxy.postTaskToLoader(createCallbackTask(&MainThreadBridge::mainThreadCreateLoader, this, request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy));
+    m_loaderProxy.postTaskToLoader(createCallbackTask(&MainThreadBridge::mainThreadCreateLoader, this, request, options));
 }
 
 WorkerThreadableLoader::MainThreadBridge::~MainThreadBridge()
 {
 }
 
-void WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader(ScriptExecutionContext* context, MainThreadBridge* thisPtr, auto_ptr<CrossThreadResourceRequestData> requestData, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+void WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader(ScriptExecutionContext* context, MainThreadBridge* thisPtr, auto_ptr<CrossThreadResourceRequestData> requestData, ThreadableLoaderOptions options)
 {
     ASSERT(isMainThread());
     ASSERT(context->isDocument());
@@ -117,7 +113,7 @@ void WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader(ScriptExec
     // FIXME: If the a site requests a local resource, then this will return a non-zero value but the sync path
     // will return a 0 value.  Either this should return 0 or the other code path should do a callback with
     // a failure.
-    thisPtr->m_mainThreadLoader = ThreadableLoader::create(context, thisPtr, *request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy);
+    thisPtr->m_mainThreadLoader = ThreadableLoader::create(context, thisPtr, *request, options);
     ASSERT(thisPtr->m_mainThreadLoader);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.h b/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.h
index 8b11b70..230c77d 100644
--- a/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.h
@@ -55,10 +55,10 @@ namespace WebCore {
 
     class WorkerThreadableLoader : public RefCounted<WorkerThreadableLoader>, public ThreadableLoader {
     public:
-        static void loadResourceSynchronously(WorkerContext*, const ResourceRequest&, ThreadableLoaderClient&, StoredCredentials, CrossOriginRedirectPolicy);
-        static PassRefPtr<WorkerThreadableLoader> create(WorkerContext* workerContext, ThreadableLoaderClient* client, const String& taskMode, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+        static void loadResourceSynchronously(WorkerContext*, const ResourceRequest&, ThreadableLoaderClient&, const ThreadableLoaderOptions&);
+        static PassRefPtr<WorkerThreadableLoader> create(WorkerContext* workerContext, ThreadableLoaderClient* client, const String& taskMode, const ResourceRequest& request, const ThreadableLoaderOptions& options)
         {
-            return adoptRef(new WorkerThreadableLoader(workerContext, client, taskMode, request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy));
+            return adoptRef(new WorkerThreadableLoader(workerContext, client, taskMode, request, options));
         }
 
         ~WorkerThreadableLoader();
@@ -97,7 +97,7 @@ namespace WebCore {
         class MainThreadBridge : ThreadableLoaderClient {
         public:
             // All executed on the worker context's thread.
-            MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper>, WorkerLoaderProxy&, const String& taskMode, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
+            MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper>, WorkerLoaderProxy&, const String& taskMode, const ResourceRequest&, const ThreadableLoaderOptions&);
             void cancel();
             void destroy();
 
@@ -109,7 +109,7 @@ namespace WebCore {
             static void mainThreadDestroy(ScriptExecutionContext*, MainThreadBridge*);
             ~MainThreadBridge();
 
-            static void mainThreadCreateLoader(ScriptExecutionContext*, MainThreadBridge*, std::auto_ptr<CrossThreadResourceRequestData>, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
+            static void mainThreadCreateLoader(ScriptExecutionContext*, MainThreadBridge*, std::auto_ptr<CrossThreadResourceRequestData>, ThreadableLoaderOptions);
             static void mainThreadCancel(ScriptExecutionContext*, MainThreadBridge*);
             virtual void didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
             virtual void didReceiveResponse(const ResourceResponse&);
@@ -133,7 +133,7 @@ namespace WebCore {
             String m_taskMode;
         };
 
-        WorkerThreadableLoader(WorkerContext*, ThreadableLoaderClient*, const String& taskMode, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
+        WorkerThreadableLoader(WorkerContext*, ThreadableLoaderClient*, const String& taskMode, const ResourceRequest&, const ThreadableLoaderOptions&);
 
         RefPtr<WorkerContext> m_workerContext;
         RefPtr<ThreadableLoaderClientWrapper> m_workerClientWrapper;
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.cpp
index d221bdb..c0cd3ea 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.cpp
@@ -111,7 +111,7 @@ unsigned ApplicationCache::removeResource(const String& url)
     
 ApplicationCacheResource* ApplicationCache::resourceForURL(const String& url)
 {
-    ASSERT(!KURL(url).hasRef());
+    ASSERT(!KURL(ParsedURLString, url).hasFragmentIdentifier());
     return m_resources.get(url).get();
 }    
 
@@ -133,8 +133,8 @@ ApplicationCacheResource* ApplicationCache::resourceForRequest(const ResourceReq
         return false;
 
     KURL url(request.url());
-    if (url.hasRef())
-        url.removeRef();
+    if (url.hasFragmentIdentifier())
+        url.removeFragmentIdentifier();
 
     return resourceForURL(url);
 }
@@ -147,6 +147,9 @@ void ApplicationCache::setOnlineWhitelist(const Vector<KURL>& onlineWhitelist)
 
 bool ApplicationCache::isURLInOnlineWhitelist(const KURL& url)
 {
+    if (m_allowAllNetworkRequests)
+        return true;
+
     size_t whitelistSize = m_onlineWhitelist.size();
     for (size_t i = 0; i < whitelistSize; ++i) {
         if (protocolHostAndPortAreEqual(url, m_onlineWhitelist[i]) && url.string().startsWith(m_onlineWhitelist[i].string()))
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.h b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.h
index b1753be..d1444c0 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.h
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.h
@@ -65,6 +65,8 @@ public:
     ApplicationCacheResource* resourceForRequest(const ResourceRequest&);
     ApplicationCacheResource* resourceForURL(const String& url);
 
+    void setAllowsAllNetworkRequests(bool value) { m_allowAllNetworkRequests = value; }
+    bool allowsAllNetworkRequests() const { return m_allowAllNetworkRequests; }
     void setOnlineWhitelist(const Vector<KURL>& onlineWhitelist);
     const Vector<KURL>& onlineWhitelist() const { return m_onlineWhitelist; }
     bool isURLInOnlineWhitelist(const KURL&); // There is an entry in online whitelist that has the same origin as the resource's URL and that is a prefix match for the resource's URL.
@@ -96,6 +98,7 @@ private:
     ResourceMap m_resources;
     ApplicationCacheResource* m_manifest;
 
+    bool m_allowAllNetworkRequests;
     Vector<KURL> m_onlineWhitelist;
     FallbackURLVector m_fallbackURLs;
 
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
index fd6a8b4..d18dcf2 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
@@ -29,6 +29,7 @@
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
 
 #include "ApplicationCache.h"
+#include "ApplicationCacheHost.h"
 #include "ApplicationCacheResource.h"
 #include "ApplicationCacheStorage.h"
 #include "ChromeClient.h"
@@ -86,8 +87,8 @@ ApplicationCache* ApplicationCacheGroup::cacheForMainRequest(const ResourceReque
         return 0;
 
     KURL url(request.url());
-    if (url.hasRef())
-        url.removeRef();
+    if (url.hasFragmentIdentifier())
+        url.removeFragmentIdentifier();
 
     if (ApplicationCacheGroup* group = cacheStorage().cacheGroupForURL(url)) {
         ASSERT(group->newestCache());
@@ -105,8 +106,8 @@ ApplicationCache* ApplicationCacheGroup::fallbackCacheForMainRequest(const Resou
         return 0;
 
     KURL url(request.url());
-    if (url.hasRef())
-        url.removeRef();
+    if (url.hasFragmentIdentifier())
+        url.removeFragmentIdentifier();
 
     if (ApplicationCacheGroup* group = cacheStorage().fallbackCacheGroupForURL(url)) {
         ASSERT(group->newestCache());
@@ -126,7 +127,7 @@ void ApplicationCacheGroup::selectCache(Frame* frame, const KURL& passedManifest
         return;
     
     DocumentLoader* documentLoader = frame->loader()->documentLoader();
-    ASSERT(!documentLoader->applicationCache());
+    ASSERT(!documentLoader->applicationCacheHost()->applicationCache());
 
     if (passedManifestURL.isNull()) {
         selectCacheWithoutManifestURL(frame);        
@@ -134,10 +135,10 @@ void ApplicationCacheGroup::selectCache(Frame* frame, const KURL& passedManifest
     }
 
     KURL manifestURL(passedManifestURL);
-    if (manifestURL.hasRef())
-        manifestURL.removeRef();
+    if (manifestURL.hasFragmentIdentifier())
+        manifestURL.removeFragmentIdentifier();
 
-    ApplicationCache* mainResourceCache = documentLoader->mainResourceApplicationCache();
+    ApplicationCache* mainResourceCache = documentLoader->applicationCacheHost()->mainResourceApplicationCache();
     
     if (mainResourceCache) {
         if (manifestURL == mainResourceCache->group()->m_manifestURL) {
@@ -146,8 +147,8 @@ void ApplicationCacheGroup::selectCache(Frame* frame, const KURL& passedManifest
         } else {
             // The main resource was loaded from cache, so the cache must have an entry for it. Mark it as foreign.
             KURL documentURL(documentLoader->url());
-            if (documentURL.hasRef())
-                documentURL.removeRef();
+            if (documentURL.hasFragmentIdentifier())
+                documentURL.removeFragmentIdentifier();
             ApplicationCacheResource* resource = mainResourceCache->resourceForURL(documentURL);
             bool inStorage = resource->storageID();
             resource->addType(ApplicationCacheResource::Foreign);
@@ -175,14 +176,14 @@ void ApplicationCacheGroup::selectCache(Frame* frame, const KURL& passedManifest
 
     // Don't change anything on disk if private browsing is enabled.
     if (!frame->settings() || frame->settings()->privateBrowsingEnabled()) {
-        postListenerTask(&DOMApplicationCache::callCheckingListener, documentLoader);
-        postListenerTask(&DOMApplicationCache::callErrorListener, documentLoader);
+        postListenerTask(ApplicationCacheHost::CHECKING_EVENT, documentLoader);
+        postListenerTask(ApplicationCacheHost::ERROR_EVENT, documentLoader);
         return;
     }
 
     ApplicationCacheGroup* group = cacheStorage().findOrCreateCacheGroup(manifestURL);
 
-    documentLoader->setCandidateApplicationCacheGroup(group);
+    documentLoader->applicationCacheHost()->setCandidateApplicationCacheGroup(group);
     group->m_pendingMasterResourceLoaders.add(documentLoader);
     group->m_downloadingPendingMasterResourceLoadersCount++;
 
@@ -196,9 +197,9 @@ void ApplicationCacheGroup::selectCacheWithoutManifestURL(Frame* frame)
         return;
 
     DocumentLoader* documentLoader = frame->loader()->documentLoader();
-    ASSERT(!documentLoader->applicationCache());
+    ASSERT(!documentLoader->applicationCacheHost()->applicationCache());
 
-    ApplicationCache* mainResourceCache = documentLoader->mainResourceApplicationCache();
+    ApplicationCache* mainResourceCache = documentLoader->applicationCacheHost()->mainResourceApplicationCache();
 
     if (mainResourceCache) {
         mainResourceCache->group()->associateDocumentLoaderWithCache(documentLoader, mainResourceCache);
@@ -211,8 +212,8 @@ void ApplicationCacheGroup::finishedLoadingMainResource(DocumentLoader* loader)
     ASSERT(m_pendingMasterResourceLoaders.contains(loader));
     ASSERT(m_completionType == None || m_pendingEntries.isEmpty());
     KURL url = loader->url();
-    if (url.hasRef())
-        url.removeRef();
+    if (url.hasFragmentIdentifier())
+        url.removeFragmentIdentifier();
 
     switch (m_completionType) {
     case None:
@@ -235,9 +236,9 @@ void ApplicationCacheGroup::finishedLoadingMainResource(DocumentLoader* loader)
         // Cache update has been a failure, so there is no reason to keep the document associated with the incomplete cache
         // (its main resource was not cached yet, so it is likely that the application changed significantly server-side).
         ASSERT(!m_cacheBeingUpdated); // Already cleared out by stopLoading().
-        loader->setApplicationCache(0); // Will unset candidate, too.
+        loader->applicationCacheHost()->setApplicationCache(0); // Will unset candidate, too.
         m_associatedDocumentLoaders.remove(loader);
-        postListenerTask(&DOMApplicationCache::callErrorListener, loader);
+        postListenerTask(ApplicationCacheHost::ERROR_EVENT, loader);
         break;
     case Completed:
         ASSERT(m_associatedDocumentLoaders.contains(loader));
@@ -271,28 +272,28 @@ void ApplicationCacheGroup::failedLoadingMainResource(DocumentLoader* loader)
 
         // The manifest didn't change, and we have a relevant cache - but the main resource download failed mid-way, so it cannot be stored to the cache,
         // and the loader does not get associated to it. If there are other main resources being downloaded for this cache group, they may still succeed.
-        postListenerTask(&DOMApplicationCache::callErrorListener, loader);
+        postListenerTask(ApplicationCacheHost::ERROR_EVENT, loader);
 
         break;
     case Failure:
         // Cache update failed, too.
         ASSERT(!m_cacheBeingUpdated); // Already cleared out by stopLoading().
-        ASSERT(!loader->applicationCache() || loader->applicationCache() == m_cacheBeingUpdated);
+        ASSERT(!loader->applicationCacheHost()->applicationCache() || loader->applicationCacheHost()->applicationCache() == m_cacheBeingUpdated);
 
-        loader->setApplicationCache(0); // Will unset candidate, too.
+        loader->applicationCacheHost()->setApplicationCache(0); // Will unset candidate, too.
         m_associatedDocumentLoaders.remove(loader);
-        postListenerTask(&DOMApplicationCache::callErrorListener, loader);
+        postListenerTask(ApplicationCacheHost::ERROR_EVENT, loader);
         break;
     case Completed:
         // The cache manifest didn't list this main resource, and all cache entries were already updated successfully - but the main resource failed to load,
         // so it cannot be stored to the cache. If there are other main resources being downloaded for this cache group, they may still succeed.
         ASSERT(m_associatedDocumentLoaders.contains(loader));
-        ASSERT(loader->applicationCache() == m_cacheBeingUpdated);
-        ASSERT(!loader->candidateApplicationCacheGroup());
+        ASSERT(loader->applicationCacheHost()->applicationCache() == m_cacheBeingUpdated);
+        ASSERT(!loader->applicationCacheHost()->candidateApplicationCacheGroup());
         m_associatedDocumentLoaders.remove(loader);
-        loader->setApplicationCache(0);
+        loader->applicationCacheHost()->setApplicationCache(0);
 
-        postListenerTask(&DOMApplicationCache::callErrorListener, loader);
+        postListenerTask(ApplicationCacheHost::ERROR_EVENT, loader);
 
         break;
     }
@@ -332,7 +333,7 @@ void ApplicationCacheGroup::disassociateDocumentLoader(DocumentLoader* loader)
 
     m_pendingMasterResourceLoaders.remove(loader);
 
-    loader->setApplicationCache(0); // Will set candidate to 0, too.
+    loader->applicationCacheHost()->setApplicationCache(0); // Will set candidate to 0, too.
 
     if (!m_associatedDocumentLoaders.isEmpty() || !m_pendingMasterResourceLoaders.isEmpty())
         return;
@@ -388,9 +389,9 @@ void ApplicationCacheGroup::update(Frame* frame, ApplicationCacheUpdateOption up
 {
     if (m_updateStatus == Checking || m_updateStatus == Downloading) {
         if (updateOption == ApplicationCacheUpdateWithBrowsingContext) {
-            postListenerTask(&DOMApplicationCache::callCheckingListener, frame->loader()->documentLoader());
+            postListenerTask(ApplicationCacheHost::CHECKING_EVENT, frame->loader()->documentLoader());
             if (m_updateStatus == Downloading)
-                postListenerTask(&DOMApplicationCache::callDownloadingListener, frame->loader()->documentLoader());
+                postListenerTask(ApplicationCacheHost::DOWNLOADING_EVENT, frame->loader()->documentLoader());
         }
         return;
     }
@@ -400,8 +401,8 @@ void ApplicationCacheGroup::update(Frame* frame, ApplicationCacheUpdateOption up
         ASSERT(m_pendingMasterResourceLoaders.isEmpty());
         ASSERT(m_pendingEntries.isEmpty());
         ASSERT(!m_cacheBeingUpdated);
-        postListenerTask(&DOMApplicationCache::callCheckingListener, frame->loader()->documentLoader());
-        postListenerTask(&DOMApplicationCache::callNoUpdateListener, frame->loader()->documentLoader());
+        postListenerTask(ApplicationCacheHost::CHECKING_EVENT, frame->loader()->documentLoader());
+        postListenerTask(ApplicationCacheHost::NOUPDATE_EVENT, frame->loader()->documentLoader());
         return;
     }
 
@@ -410,10 +411,10 @@ void ApplicationCacheGroup::update(Frame* frame, ApplicationCacheUpdateOption up
 
     m_updateStatus = Checking;
 
-    postListenerTask(&DOMApplicationCache::callCheckingListener, m_associatedDocumentLoaders);
+    postListenerTask(ApplicationCacheHost::CHECKING_EVENT, m_associatedDocumentLoaders);
     if (!m_newestCache) {
         ASSERT(updateOption == ApplicationCacheUpdateWithBrowsingContext);
-        postListenerTask(&DOMApplicationCache::callCheckingListener, frame->loader()->documentLoader());
+        postListenerTask(ApplicationCacheHost::CHECKING_EVENT, frame->loader()->documentLoader());
     }
     
     ASSERT(!m_manifestHandle);
@@ -454,8 +455,8 @@ void ApplicationCacheGroup::didReceiveResponse(ResourceHandle* handle, const Res
     ASSERT(handle == m_currentHandle);
 
     KURL url(handle->request().url());
-    if (url.hasRef())
-        url.removeRef();
+    if (url.hasFragmentIdentifier())
+        url.removeFragmentIdentifier();
     
     ASSERT(!m_currentResource);
     ASSERT(m_pendingEntries.contains(url));
@@ -553,8 +554,8 @@ void ApplicationCacheGroup::didFail(ResourceHandle* handle, const ResourceError&
 
     unsigned type = m_currentResource ? m_currentResource->type() : m_pendingEntries.get(handle->request().url());
     KURL url(handle->request().url());
-    if (url.hasRef())
-        url.removeRef();
+    if (url.hasFragmentIdentifier())
+        url.removeFragmentIdentifier();
 
     ASSERT(!m_currentResource || !m_pendingEntries.contains(url));
     m_currentResource = 0;
@@ -648,7 +649,7 @@ void ApplicationCacheGroup::didFinishLoadingManifest()
     // We have the manifest, now download the resources.
     m_updateStatus = Downloading;
     
-    postListenerTask(&DOMApplicationCache::callDownloadingListener, m_associatedDocumentLoaders);
+    postListenerTask(ApplicationCacheHost::DOWNLOADING_EVENT, m_associatedDocumentLoaders);
 
     ASSERT(m_pendingEntries.isEmpty());
 
@@ -671,6 +672,7 @@ void ApplicationCacheGroup::didFinishLoadingManifest()
     
     m_cacheBeingUpdated->setOnlineWhitelist(manifest.onlineWhitelistedURLs);
     m_cacheBeingUpdated->setFallbackURLs(manifest.fallbackURLs);
+    m_cacheBeingUpdated->setAllowsAllNetworkRequests(manifest.allowAllNetworkRequests);
     
     startLoadingEntry();
 }
@@ -698,8 +700,8 @@ void ApplicationCacheGroup::manifestNotFound()
 {
     makeObsolete();
 
-    postListenerTask(&DOMApplicationCache::callObsoleteListener, m_associatedDocumentLoaders);
-    postListenerTask(&DOMApplicationCache::callErrorListener, m_pendingMasterResourceLoaders);
+    postListenerTask(ApplicationCacheHost::OBSOLETE_EVENT, m_associatedDocumentLoaders);
+    postListenerTask(ApplicationCacheHost::ERROR_EVENT, m_pendingMasterResourceLoaders);
 
     stopLoading();
 
@@ -709,9 +711,9 @@ void ApplicationCacheGroup::manifestNotFound()
     while (!m_pendingMasterResourceLoaders.isEmpty()) {
         HashSet<DocumentLoader*>::iterator it = m_pendingMasterResourceLoaders.begin();
         
-        ASSERT((*it)->candidateApplicationCacheGroup() == this);
-        ASSERT(!(*it)->applicationCache());
-        (*it)->setCandidateApplicationCacheGroup(0);
+        ASSERT((*it)->applicationCacheHost()->candidateApplicationCacheGroup() == this);
+        ASSERT(!(*it)->applicationCacheHost()->applicationCache());
+        (*it)->applicationCacheHost()->setCandidateApplicationCacheGroup(0);
         m_pendingMasterResourceLoaders.remove(it);
     }
 
@@ -747,11 +749,11 @@ void ApplicationCacheGroup::checkIfLoadIsComplete()
         if (!m_storageID)
             cacheStorage().storeNewestCache(this);
 
-        postListenerTask(&DOMApplicationCache::callNoUpdateListener, m_associatedDocumentLoaders);
+        postListenerTask(ApplicationCacheHost::NOUPDATE_EVENT, m_associatedDocumentLoaders);
         break;
     case Failure:
         ASSERT(!m_cacheBeingUpdated);
-        postListenerTask(&DOMApplicationCache::callErrorListener, m_associatedDocumentLoaders);
+        postListenerTask(ApplicationCacheHost::ERROR_EVENT, m_associatedDocumentLoaders);
         if (m_caches.isEmpty()) {
             ASSERT(m_associatedDocumentLoaders.isEmpty());
             delete this;
@@ -772,7 +774,7 @@ void ApplicationCacheGroup::checkIfLoadIsComplete()
             ASSERT(cacheStorage().isMaximumSizeReached() && m_calledReachedMaxAppCacheSize);
         }
 
-        RefPtr<ApplicationCache> oldNewestCache = (m_newestCache == m_cacheBeingUpdated) ? RefPtr<ApplicationCache>(0) : m_newestCache;
+        RefPtr<ApplicationCache> oldNewestCache = (m_newestCache == m_cacheBeingUpdated) ? 0 : m_newestCache;
 
         setNewestCache(m_cacheBeingUpdated.release());
         if (cacheStorage().storeNewestCache(this)) {
@@ -780,7 +782,7 @@ void ApplicationCacheGroup::checkIfLoadIsComplete()
             if (oldNewestCache)
                 cacheStorage().remove(oldNewestCache.get());
             // Fire the success events.
-            postListenerTask(isUpgradeAttempt ? &DOMApplicationCache::callUpdateReadyListener : &DOMApplicationCache::callCachedListener, m_associatedDocumentLoaders);
+            postListenerTask(isUpgradeAttempt ? ApplicationCacheHost::UPDATEREADY_EVENT : ApplicationCacheHost::CACHED_EVENT, m_associatedDocumentLoaders);
         } else {
             if (cacheStorage().isMaximumSizeReached() && !m_calledReachedMaxAppCacheSize) {
                 // We ran out of space. All the changes in the cache storage have
@@ -800,7 +802,7 @@ void ApplicationCacheGroup::checkIfLoadIsComplete()
                 // Run the "cache failure steps"
                 // Fire the error events to all pending master entries, as well any other cache hosts
                 // currently associated with a cache in this group.
-                postListenerTask(&DOMApplicationCache::callErrorListener, m_associatedDocumentLoaders);
+                postListenerTask(ApplicationCacheHost::ERROR_EVENT, m_associatedDocumentLoaders);
                 // Disassociate the pending master entries from the failed new cache. Note that
                 // all other loaders in the m_associatedDocumentLoaders are still associated with
                 // some other cache in this group. They are not associated with the failed new cache.
@@ -846,11 +848,11 @@ void ApplicationCacheGroup::startLoadingEntry()
     
     EntryMap::const_iterator it = m_pendingEntries.begin();
 
-    postListenerTask(&DOMApplicationCache::callProgressListener, m_associatedDocumentLoaders);
+    postListenerTask(ApplicationCacheHost::PROGRESS_EVENT, m_associatedDocumentLoaders);
 
     ASSERT(!m_currentHandle);
     
-    m_currentHandle = createResourceHandle(KURL(it->first), m_newestCache ? m_newestCache->resourceForURL(it->first) : 0);
+    m_currentHandle = createResourceHandle(KURL(ParsedURLString, it->first), m_newestCache ? m_newestCache->resourceForURL(it->first) : 0);
 }
 
 void ApplicationCacheGroup::deliverDelayedMainResources()
@@ -877,7 +879,7 @@ void ApplicationCacheGroup::deliverDelayedMainResources()
 void ApplicationCacheGroup::addEntry(const String& url, unsigned type)
 {
     ASSERT(m_cacheBeingUpdated);
-    ASSERT(!KURL(url).hasRef());
+    ASSERT(!KURL(ParsedURLString, url).hasFragmentIdentifier());
     
     // Don't add the URL if we already have an master resource in the cache
     // (i.e., the main resource finished loading before the manifest).
@@ -910,7 +912,7 @@ void ApplicationCacheGroup::associateDocumentLoaderWithCache(DocumentLoader* loa
 
     ASSERT(!m_isObsolete);
 
-    loader->setApplicationCache(cache);
+    loader->applicationCacheHost()->setApplicationCache(cache);
 
     ASSERT(!m_associatedDocumentLoaders.contains(loader));
     m_associatedDocumentLoaders.add(loader);
@@ -944,39 +946,44 @@ void ApplicationCacheGroup::scheduleReachedMaxAppCacheSizeCallback()
 }
 
 class CallCacheListenerTask : public ScriptExecutionContext::Task {
-    typedef void (DOMApplicationCache::*ListenerFunction)();
 public:
-    static PassRefPtr<CallCacheListenerTask> create(ListenerFunction listenerFunction)
+    static PassRefPtr<CallCacheListenerTask> create(PassRefPtr<DocumentLoader> loader, ApplicationCacheHost::EventID eventID)
     {
-        return adoptRef(new CallCacheListenerTask(listenerFunction));
+        return adoptRef(new CallCacheListenerTask(loader, eventID));
     }
 
     virtual void performTask(ScriptExecutionContext* context)
     {
-        ASSERT(context->isDocument());
-        if (DOMWindow* window = static_cast<Document*>(context)->domWindow()) {
-            if (DOMApplicationCache* domCache = window->optionalApplicationCache())
-                (domCache->*m_listenerFunction)();
-        }
+        
+        ASSERT_UNUSED(context, context->isDocument());
+        Frame* frame = m_documentLoader->frame();
+        if (!frame)
+            return;
+    
+        ASSERT(frame->loader()->documentLoader() == m_documentLoader.get());
+
+        m_documentLoader->applicationCacheHost()->notifyEventListener(m_eventID);
     }
 
 private:
-    CallCacheListenerTask(ListenerFunction listenerFunction)
-        : m_listenerFunction(listenerFunction)
+    CallCacheListenerTask(PassRefPtr<DocumentLoader> loader, ApplicationCacheHost::EventID eventID)
+        : m_documentLoader(loader)
+        , m_eventID(eventID)
     {
     }
 
-    ListenerFunction m_listenerFunction;
+    RefPtr<DocumentLoader> m_documentLoader;
+    ApplicationCacheHost::EventID m_eventID;
 };
 
-void ApplicationCacheGroup::postListenerTask(ListenerFunction listenerFunction, const HashSet<DocumentLoader*>& loaderSet)
+void ApplicationCacheGroup::postListenerTask(ApplicationCacheHost::EventID eventID, const HashSet<DocumentLoader*>& loaderSet)
 {
     HashSet<DocumentLoader*>::const_iterator loaderSetEnd = loaderSet.end();
     for (HashSet<DocumentLoader*>::const_iterator iter = loaderSet.begin(); iter != loaderSetEnd; ++iter)
-        postListenerTask(listenerFunction, *iter);
+        postListenerTask(eventID, *iter);
 }
 
-void ApplicationCacheGroup::postListenerTask(ListenerFunction listenerFunction, DocumentLoader* loader)
+void ApplicationCacheGroup::postListenerTask(ApplicationCacheHost::EventID eventID, DocumentLoader* loader)
 {
     Frame* frame = loader->frame();
     if (!frame)
@@ -984,7 +991,7 @@ void ApplicationCacheGroup::postListenerTask(ListenerFunction listenerFunction,
     
     ASSERT(frame->loader()->documentLoader() == loader);
 
-    frame->document()->postTask(CallCacheListenerTask::create(listenerFunction));
+    frame->document()->postTask(CallCacheListenerTask::create(loader, eventID));
 }
 
 void ApplicationCacheGroup::clearStorageID()
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.h b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.h
index 375bd17..8df52cc 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.h
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.h
@@ -32,6 +32,7 @@
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 
+#include "DOMApplicationCache.h"
 #include "KURL.h"
 #include "PlatformString.h"
 #include "ResourceHandle.h"
@@ -42,7 +43,6 @@ namespace WebCore {
 
 class ApplicationCache;
 class ApplicationCacheResource;
-class DOMApplicationCache;
 class Document;
 class DocumentLoader;
 class Frame;
@@ -91,14 +91,16 @@ public:
     bool isCopy() const { return m_isCopy; }
 
 private:
-    typedef void (DOMApplicationCache::*ListenerFunction)();
-    static void postListenerTask(ListenerFunction, const HashSet<DocumentLoader*>&);
-    static void postListenerTask(ListenerFunction, const Vector<RefPtr<DocumentLoader> >& loaders);
-    static void postListenerTask(ListenerFunction, DocumentLoader*);
+    static void postListenerTask(ApplicationCacheHost::EventID, const HashSet<DocumentLoader*>&);
+    static void postListenerTask(ApplicationCacheHost::EventID, DocumentLoader*);
     void scheduleReachedMaxAppCacheSizeCallback();
 
     PassRefPtr<ResourceHandle> createResourceHandle(const KURL&, ApplicationCacheResource* newestCachedResource);
 
+    // For normal resource loading, WebKit client is asked about each resource individually. Since application cache does not belong to any particular document,
+    // the existing client callback cannot be used, so assume that any client that enables application cache also wants it to use credential storage.
+    virtual bool shouldUseCredentialStorage(ResourceHandle*) { return true; }
+
     virtual void didReceiveResponse(ResourceHandle*, const ResourceResponse&);
     virtual void didReceiveData(ResourceHandle*, const char*, int, int lengthReceived);
     virtual void didFinishLoading(ResourceHandle*);
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheHost.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheHost.cpp
new file mode 100644
index 0000000..992f9e9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheHost.cpp
@@ -0,0 +1,382 @@
+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ApplicationCacheHost.h"
+
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+
+#include "ApplicationCache.h"
+#include "ApplicationCacheGroup.h"
+#include "ApplicationCacheResource.h"
+#include "DocumentLoader.h"
+#include "DOMApplicationCache.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "FrameLoaderClient.h"
+#include "MainResourceLoader.h"
+#include "ResourceLoader.h"
+#include "ResourceRequest.h"
+#include "Settings.h"
+
+namespace WebCore {
+
+ApplicationCacheHost::ApplicationCacheHost(DocumentLoader* documentLoader)
+    : m_domApplicationCache(0)
+    , m_documentLoader(documentLoader)
+    , m_candidateApplicationCacheGroup(0)
+{
+    ASSERT(m_documentLoader);
+}
+
+ApplicationCacheHost::~ApplicationCacheHost()
+{
+    if (m_applicationCache)
+        m_applicationCache->group()->disassociateDocumentLoader(m_documentLoader);
+    else if (m_candidateApplicationCacheGroup)
+        m_candidateApplicationCacheGroup->disassociateDocumentLoader(m_documentLoader);
+}
+
+void ApplicationCacheHost::selectCacheWithoutManifest()
+{
+    ApplicationCacheGroup::selectCacheWithoutManifestURL(m_documentLoader->frame());
+}
+
+void ApplicationCacheHost::selectCacheWithManifest(const KURL& manifestURL)
+{
+    ApplicationCacheGroup::selectCache(m_documentLoader->frame(), manifestURL);
+}
+
+void ApplicationCacheHost::maybeLoadMainResource(ResourceRequest& request, SubstituteData& substituteData)
+{
+    // Check if this request should be loaded from the application cache
+    if (!substituteData.isValid() && isApplicationCacheEnabled()) {
+        ASSERT(!m_mainResourceApplicationCache);
+
+        m_mainResourceApplicationCache = ApplicationCacheGroup::cacheForMainRequest(request, m_documentLoader);
+
+        if (m_mainResourceApplicationCache) {
+            // Get the resource from the application cache. By definition, cacheForMainRequest() returns a cache that contains the resource.
+            ApplicationCacheResource* resource = m_mainResourceApplicationCache->resourceForRequest(request);
+            substituteData = SubstituteData(resource->data(), 
+                                            resource->response().mimeType(),
+                                            resource->response().textEncodingName(), KURL());
+        }
+    }
+}
+
+bool ApplicationCacheHost::maybeLoadFallbackForMainResponse(const ResourceRequest& request, const ResourceResponse& r)
+{
+    if (r.httpStatusCode() / 100 == 4 || r.httpStatusCode() / 100 == 5) {
+        ASSERT(!m_mainResourceApplicationCache);
+        if (isApplicationCacheEnabled()) {
+            m_mainResourceApplicationCache = ApplicationCacheGroup::fallbackCacheForMainRequest(request, documentLoader());
+
+            if (scheduleLoadFallbackResourceFromApplicationCache(documentLoader()->mainResourceLoader(), m_mainResourceApplicationCache.get()))
+                return true;
+        }
+    }
+    return false;
+}
+
+bool ApplicationCacheHost::maybeLoadFallbackForMainError(const ResourceRequest& request, const ResourceError& error)
+{
+    if (!error.isCancellation()) {
+        ASSERT(!m_mainResourceApplicationCache);
+        if (isApplicationCacheEnabled()) {
+            m_mainResourceApplicationCache = ApplicationCacheGroup::fallbackCacheForMainRequest(request, m_documentLoader);
+
+            if (scheduleLoadFallbackResourceFromApplicationCache(documentLoader()->mainResourceLoader(), m_mainResourceApplicationCache.get()))
+                return true;
+        }
+    }
+    return false;
+}
+
+void ApplicationCacheHost::mainResourceDataReceived(const char*, int, long long, bool)
+{
+    // This method is here to facilitate alternate implemetations of this interface by the host browser.
+}
+
+void ApplicationCacheHost::failedLoadingMainResource()
+{
+    ApplicationCacheGroup* group = m_candidateApplicationCacheGroup;
+    if (!group && m_applicationCache) {
+        ASSERT(!mainResourceApplicationCache()); // If the main resource were loaded from a cache, it wouldn't fail.
+        group = m_applicationCache->group();
+    }
+    
+    if (group)
+        group->failedLoadingMainResource(m_documentLoader);
+}
+
+void ApplicationCacheHost::finishedLoadingMainResource()
+{
+    ApplicationCacheGroup* group = candidateApplicationCacheGroup();
+    if (!group && applicationCache() && !mainResourceApplicationCache())
+        group = applicationCache()->group();
+    
+    if (group)
+        group->finishedLoadingMainResource(m_documentLoader);
+}
+
+bool ApplicationCacheHost::maybeLoadResource(ResourceLoader* loader, ResourceRequest& request, const KURL& originalURL)
+{
+    if (!isApplicationCacheEnabled())
+        return false;
+    
+    if (request.url() != originalURL)
+        return false;
+
+    ApplicationCacheResource* resource;
+    if (!shouldLoadResourceFromApplicationCache(request, resource))
+        return false;
+    
+    m_documentLoader->m_pendingSubstituteResources.set(loader, resource);
+    m_documentLoader->deliverSubstituteResourcesAfterDelay();
+        
+    return true;
+}
+
+bool ApplicationCacheHost::maybeLoadFallbackForRedirect(ResourceLoader* resourceLoader, ResourceRequest& request, const ResourceResponse& redirectResponse)
+{
+    if (!redirectResponse.isNull() && !protocolHostAndPortAreEqual(request.url(), redirectResponse.url()))
+        if (scheduleLoadFallbackResourceFromApplicationCache(resourceLoader))
+            return true;
+    return false;
+}
+
+bool ApplicationCacheHost::maybeLoadFallbackForResponse(ResourceLoader* resourceLoader, const ResourceResponse& response)
+{
+    if (response.httpStatusCode() / 100 == 4 || response.httpStatusCode() / 100 == 5)
+        if (scheduleLoadFallbackResourceFromApplicationCache(resourceLoader))
+            return true;
+    return false;
+}
+
+bool ApplicationCacheHost::maybeLoadFallbackForError(ResourceLoader* resourceLoader, const ResourceError& error)
+{
+    if (!error.isCancellation())
+        if (scheduleLoadFallbackResourceFromApplicationCache(resourceLoader))
+            return true;
+    return false;
+}
+
+bool ApplicationCacheHost::maybeLoadSynchronously(ResourceRequest& request, ResourceError& error, ResourceResponse& response, Vector<char>& data)
+{
+    ApplicationCacheResource* resource;
+    if (shouldLoadResourceFromApplicationCache(request, resource)) {
+        if (resource) {
+            response = resource->response();
+            data.append(resource->data()->data(), resource->data()->size());
+        } else {
+            error = documentLoader()->frameLoader()->client()->cannotShowURLError(request);
+        }
+        return true;
+    }
+    return false;
+}
+
+void ApplicationCacheHost::maybeLoadFallbackSynchronously(const ResourceRequest& request, ResourceError& error, ResourceResponse& response, Vector<char>& data)
+{
+    // If normal loading results in a redirect to a resource with another origin (indicative of a captive portal), or a 4xx or 5xx status code or equivalent,
+    // or if there were network errors (but not if the user canceled the download), then instead get, from the cache, the resource of the fallback entry
+    // corresponding to the matched namespace.
+    if ((!error.isNull() && !error.isCancellation())
+         || response.httpStatusCode() / 100 == 4 || response.httpStatusCode() / 100 == 5
+         || !protocolHostAndPortAreEqual(request.url(), response.url())) {
+        ApplicationCacheResource* resource;
+        if (getApplicationCacheFallbackResource(request, resource)) {
+            response = resource->response();
+            data.clear();
+            data.append(resource->data()->data(), resource->data()->size());
+        }
+    }
+}
+
+bool ApplicationCacheHost::canCacheInPageCache() const 
+{
+    return !applicationCache() && !candidateApplicationCacheGroup();
+}
+
+void ApplicationCacheHost::setDOMApplicationCache(DOMApplicationCache* domApplicationCache)
+{
+    ASSERT(!m_domApplicationCache || !domApplicationCache);
+    m_domApplicationCache = domApplicationCache;
+}
+
+void ApplicationCacheHost::notifyEventListener(EventID id)
+{
+    if (m_domApplicationCache)
+        m_domApplicationCache->callEventListener(id);
+}
+
+void ApplicationCacheHost::setCandidateApplicationCacheGroup(ApplicationCacheGroup* group)
+{
+    ASSERT(!m_applicationCache);
+    m_candidateApplicationCacheGroup = group;
+}
+    
+void ApplicationCacheHost::setApplicationCache(PassRefPtr<ApplicationCache> applicationCache)
+{
+    if (m_candidateApplicationCacheGroup) {
+        ASSERT(!m_applicationCache);
+        m_candidateApplicationCacheGroup = 0;
+    }
+
+    m_applicationCache = applicationCache;
+}
+
+bool ApplicationCacheHost::shouldLoadResourceFromApplicationCache(const ResourceRequest& request, ApplicationCacheResource*& resource)
+{
+    ApplicationCache* cache = applicationCache();
+    if (!cache || !cache->isComplete())
+        return false;
+
+    // If the resource is not to be fetched using the HTTP GET mechanism or equivalent, or if its URL has a different
+    // <scheme> component than the application cache's manifest, then fetch the resource normally.
+    if (!ApplicationCache::requestIsHTTPOrHTTPSGet(request) || !equalIgnoringCase(request.url().protocol(), cache->manifestResource()->url().protocol()))
+        return false;
+
+    // If the resource's URL is an master entry, the manifest, an explicit entry, or a fallback entry
+    // in the application cache, then get the resource from the cache (instead of fetching it).
+    resource = cache->resourceForURL(request.url());
+
+    // Resources that match fallback namespaces or online whitelist entries are fetched from the network,
+    // unless they are also cached.
+    if (!resource && (cache->urlMatchesFallbackNamespace(request.url()) || cache->isURLInOnlineWhitelist(request.url())))
+        return false;
+
+    // Resources that are not present in the manifest will always fail to load (at least, after the
+    // cache has been primed the first time), making the testing of offline applications simpler.
+    return true;
+}
+
+bool ApplicationCacheHost::getApplicationCacheFallbackResource(const ResourceRequest& request, ApplicationCacheResource*& resource, ApplicationCache* cache)
+{
+    if (!cache) {
+        cache = applicationCache();
+        if (!cache)
+            return false;
+    }
+    if (!cache->isComplete())
+        return false;
+    
+    // If the resource is not a HTTP/HTTPS GET, then abort
+    if (!ApplicationCache::requestIsHTTPOrHTTPSGet(request))
+        return false;
+
+    KURL fallbackURL;
+    if (!cache->urlMatchesFallbackNamespace(request.url(), &fallbackURL))
+        return false;
+
+    resource = cache->resourceForURL(fallbackURL);
+    ASSERT(resource);
+
+    return true;
+}
+
+bool ApplicationCacheHost::scheduleLoadFallbackResourceFromApplicationCache(ResourceLoader* loader, ApplicationCache* cache)
+{
+    if (!isApplicationCacheEnabled())
+        return false;
+
+    ApplicationCacheResource* resource;
+    if (!getApplicationCacheFallbackResource(loader->request(), resource, cache))
+        return false;
+
+    m_documentLoader->m_pendingSubstituteResources.set(loader, resource);
+    m_documentLoader->deliverSubstituteResourcesAfterDelay();
+    
+    loader->handle()->cancel();
+
+    return true;
+}
+
+ApplicationCacheHost::Status ApplicationCacheHost::status() const
+{
+    ApplicationCache* cache = applicationCache();    
+    if (!cache)
+        return UNCACHED;
+
+    switch (cache->group()->updateStatus()) {
+        case ApplicationCacheGroup::Checking:
+            return CHECKING;
+        case ApplicationCacheGroup::Downloading:
+            return DOWNLOADING;
+        case ApplicationCacheGroup::Idle: {
+            if (cache->group()->isObsolete())
+                return OBSOLETE;
+            if (cache != cache->group()->newestCache())
+                return UPDATEREADY;
+            return IDLE;
+        }
+    }
+
+    ASSERT_NOT_REACHED();
+    return UNCACHED;
+}
+
+bool ApplicationCacheHost::update()
+{
+    ApplicationCache* cache = applicationCache();
+    if (!cache)
+        return false;
+    cache->group()->update(m_documentLoader->frame(), ApplicationCacheUpdateWithoutBrowsingContext);
+    return true;
+}
+
+bool ApplicationCacheHost::swapCache()
+{
+    ApplicationCache* cache = applicationCache();
+    if (!cache)
+        return false;
+
+    // If the group of application caches to which cache belongs has the lifecycle status obsolete, unassociate document from cache.
+    if (cache->group()->isObsolete()) {
+        cache->group()->disassociateDocumentLoader(m_documentLoader);
+        return true;
+    }
+
+    // If there is no newer cache, raise an INVALID_STATE_ERR exception.
+    ApplicationCache* newestCache = cache->group()->newestCache();
+    if (cache == newestCache)
+        return false;
+    
+    ASSERT(cache->group() == newestCache->group());
+    setApplicationCache(newestCache);
+    
+    return true;
+}
+
+bool ApplicationCacheHost::isApplicationCacheEnabled()
+{
+    return m_documentLoader->frame()->settings()
+           && m_documentLoader->frame()->settings()->offlineWebApplicationCacheEnabled();
+}
+
+}  // namespace WebCore
+
+#endif  // ENABLE(OFFLINE_WEB_APPLICATIONS)
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheHost.h b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheHost.h
new file mode 100644
index 0000000..cb68862
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheHost.h
@@ -0,0 +1,152 @@
+/*
+ * Copyright (c) 2009, Google Inc.  All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ApplicationCacheHost_h
+#define ApplicationCacheHost_h
+
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+
+#include <wtf/OwnPtr.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+    class DOMApplicationCache;
+    class DocumentLoader;
+    class KURL;
+    class ResourceLoader;
+    class ResourceError;
+    struct ResourceRequest;
+    class ResourceResponse;
+    class SubstituteData;
+#if PLATFORM(CHROMIUM)
+    class ApplicationCacheHostInternal;
+#else
+    class ApplicationCache;
+    class ApplicationCacheGroup;
+    class ApplicationCacheResource;
+    class ApplicationCacheStorage;
+#endif
+
+    class ApplicationCacheHost {
+    public:
+        // The Status numeric values are specified in the HTML5 spec.
+        enum Status {
+            UNCACHED = 0,
+            IDLE = 1,
+            CHECKING = 2,
+            DOWNLOADING = 3,
+            UPDATEREADY = 4,
+            OBSOLETE = 5
+        };
+
+        enum EventID {
+            CHECKING_EVENT = 0,
+            ERROR_EVENT,
+            NOUPDATE_EVENT,
+            DOWNLOADING_EVENT,
+            PROGRESS_EVENT,
+            UPDATEREADY_EVENT,
+            CACHED_EVENT,
+            OBSOLETE_EVENT  // Must remain the last value, this is used to size arrays.
+        };
+
+        ApplicationCacheHost(DocumentLoader*);
+        ~ApplicationCacheHost();
+
+        void selectCacheWithoutManifest();
+        void selectCacheWithManifest(const KURL& manifestURL);
+
+        void maybeLoadMainResource(ResourceRequest&, SubstituteData&);
+        bool maybeLoadFallbackForMainResponse(const ResourceRequest&, const ResourceResponse&);
+        bool maybeLoadFallbackForMainError(const ResourceRequest&, const ResourceError&);
+        void mainResourceDataReceived(const char* data, int length, long long lengthReceived, bool allAtOnce);
+        void finishedLoadingMainResource();
+        void failedLoadingMainResource();
+
+        bool maybeLoadResource(ResourceLoader*, ResourceRequest&, const KURL& originalURL);
+        bool maybeLoadFallbackForRedirect(ResourceLoader*, ResourceRequest&, const ResourceResponse&);
+        bool maybeLoadFallbackForResponse(ResourceLoader*, const ResourceResponse&);
+        bool maybeLoadFallbackForError(ResourceLoader*, const ResourceError&);
+
+        bool maybeLoadSynchronously(ResourceRequest&, ResourceError&, ResourceResponse&, Vector<char>& data);
+        void maybeLoadFallbackSynchronously(const ResourceRequest&, ResourceError&, ResourceResponse&, Vector<char>& data);
+
+        bool canCacheInPageCache() const;
+
+        Status status() const;  
+        bool update();
+        bool swapCache();
+
+        void setDOMApplicationCache(DOMApplicationCache* domApplicationCache);
+        void notifyEventListener(EventID id);
+
+    private:
+        bool isApplicationCacheEnabled();
+        DocumentLoader* documentLoader() { return m_documentLoader; }
+
+        DOMApplicationCache* m_domApplicationCache;
+        DocumentLoader* m_documentLoader;
+
+#if PLATFORM(CHROMIUM)
+        friend class ApplicationCacheHostInternal;
+        OwnPtr<ApplicationCacheHostInternal> m_internal;
+#else
+        friend class ApplicationCacheGroup;
+        friend class ApplicationCacheStorage;
+
+        bool scheduleLoadFallbackResourceFromApplicationCache(ResourceLoader*, ApplicationCache* = 0);
+        bool shouldLoadResourceFromApplicationCache(const ResourceRequest&, ApplicationCacheResource*&);
+        bool getApplicationCacheFallbackResource(const ResourceRequest&, ApplicationCacheResource*&, ApplicationCache* = 0);
+        void setCandidateApplicationCacheGroup(ApplicationCacheGroup* group);
+        ApplicationCacheGroup* candidateApplicationCacheGroup() const { return m_candidateApplicationCacheGroup; }
+        void setApplicationCache(PassRefPtr<ApplicationCache> applicationCache);
+        ApplicationCache* applicationCache() const { return m_applicationCache.get(); }
+        ApplicationCache* mainResourceApplicationCache() const { return m_mainResourceApplicationCache.get(); }
+
+
+        // The application cache that the document loader is associated with (if any).
+        RefPtr<ApplicationCache> m_applicationCache;
+
+        // Before an application cache has finished loading, this will be the candidate application
+        // group that the document loader is associated with.
+        ApplicationCacheGroup* m_candidateApplicationCacheGroup;
+
+        // This is the application cache the main resource was loaded from (if any).
+        RefPtr<ApplicationCache> m_mainResourceApplicationCache;
+#endif
+    };
+
+}  // namespace WebCore
+
+#endif  // ENABLE(OFFLINE_WEB_APPLICATIONS)
+#endif  // ApplicationCacheHost_h
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheResource.h b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheResource.h
index cffc51b..2ca7846 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheResource.h
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheResource.h
@@ -44,7 +44,7 @@ public:
         
     static PassRefPtr<ApplicationCacheResource> create(const KURL& url, const ResourceResponse& response, unsigned type, PassRefPtr<SharedBuffer> buffer = SharedBuffer::create())
     {
-        ASSERT(!url.hasRef());
+        ASSERT(!url.hasFragmentIdentifier());
         return adoptRef(new ApplicationCacheResource(url, response, type, buffer));
     }
 
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.cpp
index 18a0ed4..d6ee723 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.cpp
@@ -29,6 +29,7 @@
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
 
 #include "ApplicationCache.h"
+#include "ApplicationCacheHost.h"
 #include "ApplicationCacheGroup.h"
 #include "ApplicationCacheResource.h"
 #include "CString.h"
@@ -127,7 +128,7 @@ ApplicationCacheGroup* ApplicationCacheStorage::loadCacheGroup(const KURL& manif
 
 ApplicationCacheGroup* ApplicationCacheStorage::findOrCreateCacheGroup(const KURL& manifestURL)
 {
-    ASSERT(!manifestURL.hasRef());
+    ASSERT(!manifestURL.hasFragmentIdentifier());
 
     std::pair<CacheGroupMap::iterator, bool> result = m_cachesInMemory.add(manifestURL, 0);
     
@@ -177,7 +178,7 @@ void ApplicationCacheStorage::loadManifestHostHashes()
 
 ApplicationCacheGroup* ApplicationCacheStorage::cacheGroupForURL(const KURL& url)
 {
-    ASSERT(!url.hasRef());
+    ASSERT(!url.hasFragmentIdentifier());
     
     loadManifestHostHashes();
     
@@ -215,7 +216,7 @@ ApplicationCacheGroup* ApplicationCacheStorage::cacheGroupForURL(const KURL& url
     
     int result;
     while ((result = statement.step()) == SQLResultRow) {
-        KURL manifestURL = KURL(statement.getColumnText(1));
+        KURL manifestURL = KURL(ParsedURLString, statement.getColumnText(1));
 
         if (m_cachesInMemory.contains(manifestURL))
             continue;
@@ -254,7 +255,7 @@ ApplicationCacheGroup* ApplicationCacheStorage::cacheGroupForURL(const KURL& url
 
 ApplicationCacheGroup* ApplicationCacheStorage::fallbackCacheGroupForURL(const KURL& url)
 {
-    ASSERT(!url.hasRef());
+    ASSERT(!url.hasFragmentIdentifier());
 
     // Check if an appropriate cache already exists in memory.
     CacheGroupMap::const_iterator end = m_cachesInMemory.end();
@@ -283,7 +284,7 @@ ApplicationCacheGroup* ApplicationCacheStorage::fallbackCacheGroupForURL(const K
     
     int result;
     while ((result = statement.step()) == SQLResultRow) {
-        KURL manifestURL = KURL(statement.getColumnText(1));
+        KURL manifestURL = KURL(ParsedURLString, statement.getColumnText(1));
 
         if (m_cachesInMemory.contains(manifestURL))
             continue;
@@ -426,7 +427,7 @@ bool ApplicationCacheStorage::executeSQLCommand(const String& sql)
     return result;
 }
 
-static const int schemaVersion = 4;
+static const int schemaVersion = 5;
     
 void ApplicationCacheStorage::verifySchemaVersion()
 {
@@ -478,6 +479,7 @@ void ApplicationCacheStorage::openDatabase(bool createIfDoesNotExist)
                       "manifestHostHash INTEGER NOT NULL ON CONFLICT FAIL, manifestURL TEXT UNIQUE ON CONFLICT FAIL, newestCache INTEGER)");
     executeSQLCommand("CREATE TABLE IF NOT EXISTS Caches (id INTEGER PRIMARY KEY AUTOINCREMENT, cacheGroup INTEGER, size INTEGER)");
     executeSQLCommand("CREATE TABLE IF NOT EXISTS CacheWhitelistURLs (url TEXT NOT NULL ON CONFLICT FAIL, cache INTEGER NOT NULL ON CONFLICT FAIL)");
+    executeSQLCommand("CREATE TABLE IF NOT EXISTS CacheAllowsAllNetworkRequests (wildcard INTEGER NOT NULL ON CONFLICT FAIL, cache INTEGER NOT NULL ON CONFLICT FAIL)");
     executeSQLCommand("CREATE TABLE IF NOT EXISTS FallbackURLs (namespace TEXT NOT NULL ON CONFLICT FAIL, fallbackURL TEXT NOT NULL ON CONFLICT FAIL, "
                       "cache INTEGER NOT NULL ON CONFLICT FAIL)");
     executeSQLCommand("CREATE TABLE IF NOT EXISTS CacheEntries (cache INTEGER NOT NULL ON CONFLICT FAIL, type INTEGER, resource INTEGER NOT NULL)");
@@ -490,6 +492,7 @@ void ApplicationCacheStorage::openDatabase(bool createIfDoesNotExist)
                       " FOR EACH ROW BEGIN"
                       "  DELETE FROM CacheEntries WHERE cache = OLD.id;"
                       "  DELETE FROM CacheWhitelistURLs WHERE cache = OLD.id;"
+                      "  DELETE FROM CacheAllowsAllNetworkRequests WHERE cache = OLD.id;"
                       "  DELETE FROM FallbackURLs WHERE cache = OLD.id;"
                       " END");
 
@@ -583,6 +586,18 @@ bool ApplicationCacheStorage::store(ApplicationCache* cache, ResourceStorageIDJo
                 return false;
         }
     }
+
+    // Store online whitelist wildcard flag.
+    {
+        SQLiteStatement statement(m_database, "INSERT INTO CacheAllowsAllNetworkRequests (wildcard, cache) VALUES (?, ?)");
+        statement.prepare();
+
+        statement.bindInt64(1, cache->allowsAllNetworkRequests());
+        statement.bindInt64(2, cacheStorageID);
+
+        if (!executeStatement(statement))
+            return false;
+    }
     
     // Store fallback URLs.
     const FallbackURLVector& fallbackURLs = cache->fallbackURLs();
@@ -820,7 +835,7 @@ PassRefPtr<ApplicationCache> ApplicationCacheStorage::loadCache(unsigned storage
     
     int result;
     while ((result = cacheStatement.step()) == SQLResultRow) {
-        KURL url(cacheStatement.getColumnText(0));
+        KURL url(ParsedURLString, cacheStatement.getColumnText(0));
         
         unsigned type = static_cast<unsigned>(cacheStatement.getColumnInt64(1));
 
@@ -856,13 +871,28 @@ PassRefPtr<ApplicationCache> ApplicationCacheStorage::loadCache(unsigned storage
     
     Vector<KURL> whitelist;
     while ((result = whitelistStatement.step()) == SQLResultRow) 
-        whitelist.append(whitelistStatement.getColumnText(0));
+        whitelist.append(KURL(ParsedURLString, whitelistStatement.getColumnText(0)));
 
     if (result != SQLResultDone)
         LOG_ERROR("Could not load cache online whitelist, error \"%s\"", m_database.lastErrorMsg());
 
     cache->setOnlineWhitelist(whitelist);
 
+    // Load online whitelist wildcard flag.
+    SQLiteStatement whitelistWildcardStatement(m_database, "SELECT wildcard FROM CacheAllowsAllNetworkRequests WHERE cache=?");
+    if (whitelistWildcardStatement.prepare() != SQLResultOk)
+        return 0;
+    whitelistWildcardStatement.bindInt64(1, storageID);
+    
+    result = whitelistWildcardStatement.step();
+    if (result != SQLResultRow)
+        LOG_ERROR("Could not load cache online whitelist wildcard flag, error \"%s\"", m_database.lastErrorMsg());
+
+    cache->setAllowsAllNetworkRequests(whitelistWildcardStatement.getColumnInt64(0));
+
+    if (whitelistWildcardStatement.step() != SQLResultDone)
+        LOG_ERROR("Too many rows for online whitelist wildcard flag");
+
     // Load fallback URLs.
     SQLiteStatement fallbackStatement(m_database, "SELECT namespace, fallbackURL FROM FallbackURLs WHERE cache=?");
     if (fallbackStatement.prepare() != SQLResultOk)
@@ -871,7 +901,7 @@ PassRefPtr<ApplicationCache> ApplicationCacheStorage::loadCache(unsigned storage
     
     FallbackURLVector fallbackURLs;
     while ((result = fallbackStatement.step()) == SQLResultRow) 
-        fallbackURLs.append(make_pair(fallbackStatement.getColumnText(0), fallbackStatement.getColumnText(1)));
+        fallbackURLs.append(make_pair(KURL(ParsedURLString, fallbackStatement.getColumnText(0)), KURL(ParsedURLString, fallbackStatement.getColumnText(1))));
 
     if (result != SQLResultDone)
         LOG_ERROR("Could not load fallback URLs, error \"%s\"", m_database.lastErrorMsg());
@@ -937,8 +967,12 @@ void ApplicationCacheStorage::empty()
         it->second->clearStorageID();
 }    
 
-bool ApplicationCacheStorage::storeCopyOfCache(const String& cacheDirectory, ApplicationCache* cache)
+bool ApplicationCacheStorage::storeCopyOfCache(const String& cacheDirectory, ApplicationCacheHost* cacheHost)
 {
+    ApplicationCache* cache = cacheHost->applicationCache();
+    if (!cache)
+        return true;
+
     // Create a new cache.
     RefPtr<ApplicationCache> cacheCopy = ApplicationCache::create();
 
@@ -982,7 +1016,7 @@ bool ApplicationCacheStorage::manifestURLs(Vector<KURL>* urls)
         return false;
 
     while (selectURLs.step() == SQLResultRow)
-        urls->append(selectURLs.getColumnText(0));
+        urls->append(KURL(ParsedURLString, selectURLs.getColumnText(0)));
 
     return true;
 }
@@ -1063,6 +1097,10 @@ bool ApplicationCacheStorage::deleteCacheGroup(const String& manifestURL)
 
 void ApplicationCacheStorage::vacuumDatabaseFile()
 {
+    openDatabase(false);
+    if (!m_database.isOpen())
+        return;
+
     m_database.runVacuumCommand();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.h b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.h
index c6d687e..1348aa9 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.h
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.h
@@ -37,6 +37,7 @@
 namespace WebCore {
 
 class ApplicationCache;
+class ApplicationCacheHost;
 class ApplicationCacheGroup;
 class ApplicationCacheResource;
 class KURL;
@@ -69,7 +70,7 @@ public:
     
     void empty();
     
-    static bool storeCopyOfCache(const String& cacheDirectory, ApplicationCache*);
+    static bool storeCopyOfCache(const String& cacheDirectory, ApplicationCacheHost*);
 
     bool manifestURLs(Vector<KURL>* urls);
     bool cacheGroupSize(const String& manifestURL, int64_t* size);
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.cpp
index 5ea5d4f..dd0aed9 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.cpp
@@ -28,9 +28,7 @@
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
 
-#include "ApplicationCache.h"
-#include "ApplicationCacheGroup.h"
-#include "ApplicationCacheResource.h"
+#include "ApplicationCacheHost.h"
 #include "DocumentLoader.h"
 #include "Event.h"
 #include "EventException.h"
@@ -44,90 +42,52 @@ namespace WebCore {
 DOMApplicationCache::DOMApplicationCache(Frame* frame)
     : m_frame(frame)
 {
+    ASSERT(!m_frame || applicationCacheHost());
+    ApplicationCacheHost* cacheHost = applicationCacheHost();
+    if (cacheHost)
+        cacheHost->setDOMApplicationCache(this);
 }
 
 void DOMApplicationCache::disconnectFrame()
 {
+    ApplicationCacheHost* cacheHost = applicationCacheHost();
+    if (cacheHost)
+        cacheHost->setDOMApplicationCache(0);
     m_frame = 0;
 }
 
-ApplicationCache* DOMApplicationCache::associatedCache() const
+ApplicationCacheHost* DOMApplicationCache::applicationCacheHost() const
 {
-    if (!m_frame)
+    if (!m_frame || !m_frame->loader()->documentLoader())
         return 0;
- 
-    return m_frame->loader()->documentLoader()->applicationCache();
+    return m_frame->loader()->documentLoader()->applicationCacheHost();
 }
 
 unsigned short DOMApplicationCache::status() const
 {
-    ApplicationCache* cache = associatedCache();    
-    if (!cache)
-        return UNCACHED;
-
-    switch (cache->group()->updateStatus()) {
-        case ApplicationCacheGroup::Checking:
-            return CHECKING;
-        case ApplicationCacheGroup::Downloading:
-            return DOWNLOADING;
-        case ApplicationCacheGroup::Idle: {
-            if (cache->group()->isObsolete())
-                return OBSOLETE;
-            if (cache != cache->group()->newestCache())
-                return UPDATEREADY;
-            return IDLE;
-        }
-    }
-
-    ASSERT_NOT_REACHED();
-    return 0;
+    ApplicationCacheHost* cacheHost = applicationCacheHost();
+    if (!cacheHost)
+        return ApplicationCacheHost::UNCACHED;
+    return cacheHost->status();
 }
 
 void DOMApplicationCache::update(ExceptionCode& ec)
 {
-    ApplicationCache* cache = associatedCache();
-    if (!cache) {
+    ApplicationCacheHost* cacheHost = applicationCacheHost();
+    if (!cacheHost || !cacheHost->update())
         ec = INVALID_STATE_ERR;
-        return;
-    }
-    
-    cache->group()->update(m_frame, ApplicationCacheUpdateWithoutBrowsingContext);
 }
 
-bool DOMApplicationCache::swapCache()
-{
-    if (!m_frame)
-        return false;
-    
-    ApplicationCache* cache = m_frame->loader()->documentLoader()->applicationCache();
-    if (!cache)
-        return false;
-
-    // If the group of application caches to which cache belongs has the lifecycle status obsolete, unassociate document from cache.
-    if (cache->group()->isObsolete()) {
-        cache->group()->disassociateDocumentLoader(m_frame->loader()->documentLoader());
-        return true;
-    }
-
-    // If there is no newer cache, raise an INVALID_STATE_ERR exception.
-    ApplicationCache* newestCache = cache->group()->newestCache();
-    if (cache == newestCache)
-        return false;
-    
-    ASSERT(cache->group() == newestCache->group());
-    m_frame->loader()->documentLoader()->setApplicationCache(newestCache);
-    
-    return true;
-}
-    
 void DOMApplicationCache::swapCache(ExceptionCode& ec)
 {
-    if (!swapCache())
+    ApplicationCacheHost* cacheHost = applicationCacheHost();
+    if (!cacheHost || !cacheHost->swapCache())
         ec = INVALID_STATE_ERR;
 }
 
 ScriptExecutionContext* DOMApplicationCache::scriptExecutionContext() const
 {
+    ASSERT(m_frame);
     return m_frame->document();
 }
 
@@ -141,7 +101,7 @@ void DOMApplicationCache::addEventListener(const AtomicString& eventType, PassRe
     } else {
         ListenerVector& listeners = iter->second;
         for (ListenerVector::iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-            if (*listenerIter == eventListener)
+            if (**listenerIter == *eventListener)
                 return;
         }
         
@@ -158,7 +118,7 @@ void DOMApplicationCache::removeEventListener(const AtomicString& eventType, Eve
     
     ListenerVector& listeners = iter->second;
     for (ListenerVector::const_iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-        if (*listenerIter == eventListener) {
+        if (**listenerIter == *eventListener) {
             listeners.remove(listenerIter - listeners.begin());
             return;
         }
@@ -171,7 +131,7 @@ bool DOMApplicationCache::dispatchEvent(PassRefPtr<Event> event, ExceptionCode&
         ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
         return true;
     }
-    
+
     ListenerVector listenersCopy = m_eventListeners.get(event->type());
     for (ListenerVector::const_iterator listenerIter = listenersCopy.begin(); listenerIter != listenersCopy.end(); ++listenerIter) {
         event->setTarget(this);
@@ -198,44 +158,51 @@ void DOMApplicationCache::callListener(const AtomicString& eventType, EventListe
     ASSERT(!ec);    
 }
 
-void DOMApplicationCache::callCheckingListener()
-{
-    callListener(eventNames().checkingEvent, m_onCheckingListener.get());
-}
-
-void DOMApplicationCache::callErrorListener()
-{
-    callListener(eventNames().errorEvent, m_onErrorListener.get());
-}
-
-void DOMApplicationCache::callNoUpdateListener()
-{
-    callListener(eventNames().noupdateEvent, m_onNoUpdateListener.get());
-}
-
-void DOMApplicationCache::callDownloadingListener()
-{
-    callListener(eventNames().downloadingEvent, m_onDownloadingListener.get());
-}
-
-void DOMApplicationCache::callProgressListener()
-{
-    callListener(eventNames().progressEvent, m_onProgressListener.get());
-}
-
-void DOMApplicationCache::callUpdateReadyListener()
-{
-    callListener(eventNames().updatereadyEvent, m_onUpdateReadyListener.get());
-}
-
-void DOMApplicationCache::callCachedListener()
-{
-    callListener(eventNames().cachedEvent, m_onCachedListener.get());
-}
-
-void DOMApplicationCache::callObsoleteListener()
-{
-    callListener(eventNames().obsoleteEvent, m_onObsoleteListener.get());
+const AtomicString& DOMApplicationCache::toEventType(ApplicationCacheHost::EventID id)
+{
+    switch (id) {
+    case ApplicationCacheHost::CHECKING_EVENT:
+        return eventNames().checkingEvent;
+    case ApplicationCacheHost::ERROR_EVENT:
+        return eventNames().errorEvent;
+    case ApplicationCacheHost::NOUPDATE_EVENT:
+        return eventNames().noupdateEvent;
+    case ApplicationCacheHost::DOWNLOADING_EVENT:
+        return eventNames().downloadingEvent;
+    case ApplicationCacheHost::PROGRESS_EVENT:
+        return eventNames().progressEvent;
+    case ApplicationCacheHost::UPDATEREADY_EVENT:
+        return eventNames().updatereadyEvent;
+    case ApplicationCacheHost::CACHED_EVENT:
+        return eventNames().cachedEvent;
+    case ApplicationCacheHost::OBSOLETE_EVENT:            
+        return eventNames().obsoleteEvent;
+    }
+    ASSERT_NOT_REACHED();
+    return eventNames().errorEvent;
+}
+
+ApplicationCacheHost::EventID DOMApplicationCache::toEventID(const AtomicString& eventType)
+{
+    if (eventType == eventNames().checkingEvent)
+        return ApplicationCacheHost::CHECKING_EVENT;
+    if (eventType == eventNames().errorEvent)
+        return ApplicationCacheHost::ERROR_EVENT;
+    if (eventType == eventNames().noupdateEvent)
+        return ApplicationCacheHost::NOUPDATE_EVENT;
+    if (eventType == eventNames().downloadingEvent)
+        return ApplicationCacheHost::DOWNLOADING_EVENT;
+    if (eventType == eventNames().progressEvent)
+        return ApplicationCacheHost::PROGRESS_EVENT;
+    if (eventType == eventNames().updatereadyEvent)
+        return ApplicationCacheHost::UPDATEREADY_EVENT;
+    if (eventType == eventNames().cachedEvent)
+        return ApplicationCacheHost::CACHED_EVENT;
+    if (eventType == eventNames().obsoleteEvent)
+        return ApplicationCacheHost::OBSOLETE_EVENT;
+  
+    ASSERT_NOT_REACHED();
+    return ApplicationCacheHost::ERROR_EVENT;
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.h b/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.h
index 4fe1511..09e9a03 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.h
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.h
@@ -28,6 +28,7 @@
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
 
+#include "ApplicationCacheHost.h"
 #include "AtomicStringHash.h"
 #include "EventTarget.h"
 #include "EventListener.h"
@@ -38,35 +39,34 @@
 
 namespace WebCore {
 
-class ApplicationCache;
 class AtomicStringImpl;
 class Frame;
 class KURL;
 class String;
-    
+
 class DOMApplicationCache : public RefCounted<DOMApplicationCache>, public EventTarget {
 public:
     static PassRefPtr<DOMApplicationCache> create(Frame* frame) { return adoptRef(new DOMApplicationCache(frame)); }
-    void disconnectFrame();
+    ~DOMApplicationCache() { ASSERT(!m_frame); }
 
-    enum Status {
-        UNCACHED = 0,
-        IDLE = 1,
-        CHECKING = 2,
-        DOWNLOADING = 3,
-        UPDATEREADY = 4,
-        OBSOLETE = 5
-    };
+    void disconnectFrame();
 
     unsigned short status() const;
-    
     void update(ExceptionCode&);
     void swapCache(ExceptionCode&);
-    
+
+    // Event listener attributes by EventID
+
+    void setAttributeEventListener(ApplicationCacheHost::EventID id, PassRefPtr<EventListener> eventListener) { m_attributeEventListeners[id] = eventListener; }
+    EventListener* getAttributeEventListener(ApplicationCacheHost::EventID id) const { return m_attributeEventListeners[id].get(); }
+    void clearAttributeEventListener(ApplicationCacheHost::EventID id) { m_attributeEventListeners[id] = 0; }
+    void callEventListener(ApplicationCacheHost::EventID id) { callListener(toEventType(id), getAttributeEventListener(id)); }
+
+    // EventTarget impl
+
     virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
     virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
     virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
-    
     typedef Vector<RefPtr<EventListener> > ListenerVector;
     typedef HashMap<AtomicString, ListenerVector> EventListenersMap;
     EventListenersMap& eventListeners() { return m_eventListeners; }
@@ -74,61 +74,50 @@ public:
     using RefCounted<DOMApplicationCache>::ref;
     using RefCounted<DOMApplicationCache>::deref;
 
-    void setOnchecking(PassRefPtr<EventListener> eventListener) { m_onCheckingListener = eventListener; }
-    EventListener* onchecking() const { return m_onCheckingListener.get(); }
+    // Explicitly named attribute event listener helpers
 
-    void setOnerror(PassRefPtr<EventListener> eventListener) { m_onErrorListener = eventListener; }
-    EventListener* onerror() const { return m_onErrorListener.get(); }
+    void setOnchecking(PassRefPtr<EventListener> listener) { setAttributeEventListener(ApplicationCacheHost::CHECKING_EVENT, listener); }
+    EventListener* onchecking() const { return getAttributeEventListener(ApplicationCacheHost::CHECKING_EVENT); }
 
-    void setOnnoupdate(PassRefPtr<EventListener> eventListener) { m_onNoUpdateListener = eventListener; }
-    EventListener* onnoupdate() const { return m_onNoUpdateListener.get(); }
+    void setOnerror(PassRefPtr<EventListener> listener) { setAttributeEventListener(ApplicationCacheHost::ERROR_EVENT, listener);}
+    EventListener* onerror() const { return getAttributeEventListener(ApplicationCacheHost::ERROR_EVENT); }
 
-    void setOndownloading(PassRefPtr<EventListener> eventListener) { m_onDownloadingListener = eventListener; }
-    EventListener* ondownloading() const { return m_onDownloadingListener.get(); }
-    
-    void setOnprogress(PassRefPtr<EventListener> eventListener) { m_onProgressListener = eventListener; }
-    EventListener* onprogress() const { return m_onProgressListener.get(); }
+    void setOnnoupdate(PassRefPtr<EventListener> listener) { setAttributeEventListener(ApplicationCacheHost::NOUPDATE_EVENT, listener); }
+    EventListener* onnoupdate() const { return getAttributeEventListener(ApplicationCacheHost::NOUPDATE_EVENT); }
+
+    void setOndownloading(PassRefPtr<EventListener> listener) { setAttributeEventListener(ApplicationCacheHost::DOWNLOADING_EVENT, listener); }
+    EventListener* ondownloading() const { return getAttributeEventListener(ApplicationCacheHost::DOWNLOADING_EVENT); }
 
-    void setOnupdateready(PassRefPtr<EventListener> eventListener) { m_onUpdateReadyListener = eventListener; }
-    EventListener* onupdateready() const { return m_onUpdateReadyListener.get(); }
+    void setOnprogress(PassRefPtr<EventListener> listener) { setAttributeEventListener(ApplicationCacheHost::PROGRESS_EVENT, listener); }
+    EventListener* onprogress() const { return getAttributeEventListener(ApplicationCacheHost::PROGRESS_EVENT); }
 
-    void setOncached(PassRefPtr<EventListener> eventListener) { m_onCachedListener = eventListener; }
-    EventListener* oncached() const { return m_onCachedListener.get(); }
+    void setOnupdateready(PassRefPtr<EventListener> listener) { setAttributeEventListener(ApplicationCacheHost::UPDATEREADY_EVENT, listener); }
+    EventListener* onupdateready() const { return getAttributeEventListener(ApplicationCacheHost::UPDATEREADY_EVENT); }
 
-    void setOnobsolete(PassRefPtr<EventListener> eventListener) { m_onObsoleteListener = eventListener; }
-    EventListener* onobsolete() const { return m_onObsoleteListener.get(); }
+    void setOncached(PassRefPtr<EventListener> listener) { setAttributeEventListener(ApplicationCacheHost::CACHED_EVENT, listener); }
+    EventListener* oncached() const { return getAttributeEventListener(ApplicationCacheHost::CACHED_EVENT); }
+
+    void setOnobsolete(PassRefPtr<EventListener> listener) { setAttributeEventListener(ApplicationCacheHost::OBSOLETE_EVENT, listener); }
+    EventListener* onobsolete() const { return getAttributeEventListener(ApplicationCacheHost::OBSOLETE_EVENT); }
 
     virtual ScriptExecutionContext* scriptExecutionContext() const;
     DOMApplicationCache* toDOMApplicationCache() { return this; }
 
-    void callCheckingListener();
-    void callErrorListener();    
-    void callNoUpdateListener();    
-    void callDownloadingListener();
-    void callProgressListener();
-    void callUpdateReadyListener();
-    void callCachedListener();
-    void callObsoleteListener();
-    
+    static const AtomicString& toEventType(ApplicationCacheHost::EventID id);
+    static ApplicationCacheHost::EventID toEventID(const AtomicString& eventType);
+
 private:
     DOMApplicationCache(Frame*);
+
     void callListener(const AtomicString& eventType, EventListener*);
     
     virtual void refEventTarget() { ref(); }
     virtual void derefEventTarget() { deref(); }
 
-    ApplicationCache* associatedCache() const;
-    bool swapCache();
-    
-    RefPtr<EventListener> m_onCheckingListener;
-    RefPtr<EventListener> m_onErrorListener;
-    RefPtr<EventListener> m_onNoUpdateListener;
-    RefPtr<EventListener> m_onDownloadingListener;
-    RefPtr<EventListener> m_onProgressListener;
-    RefPtr<EventListener> m_onUpdateReadyListener;
-    RefPtr<EventListener> m_onCachedListener;
-    RefPtr<EventListener> m_onObsoleteListener;
+    ApplicationCacheHost* applicationCacheHost() const;
     
+    RefPtr<EventListener> m_attributeEventListeners[ApplicationCacheHost::OBSOLETE_EVENT + 1];
+
     EventListenersMap m_eventListeners;
 
     Frame* m_frame;
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ManifestParser.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/ManifestParser.cpp
index 4169313..b001bff 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ManifestParser.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ManifestParser.cpp
@@ -43,7 +43,8 @@ bool parseManifest(const KURL& manifestURL, const char* data, int length, Manife
     ASSERT(manifest.explicitURLs.isEmpty());
     ASSERT(manifest.onlineWhitelistedURLs.isEmpty());
     ASSERT(manifest.fallbackURLs.isEmpty());
-    
+    manifest.allowAllNetworkRequests = false;
+
     Mode mode = Explicit;
 
     RefPtr<TextResourceDecoder> decoder = TextResourceDecoder::create("text/cache-manifest", "UTF-8");
@@ -109,13 +110,19 @@ bool parseManifest(const KURL& manifestURL, const char* data, int length, Manife
             while (p < lineEnd && *p != '\t' && *p != ' ') 
                 p++;
 
+            if (mode == OnlineWhitelist && p - line.characters() == 1 && *line.characters() == '*') {
+                // Wildcard was found.
+                manifest.allowAllNetworkRequests = true;
+                continue;
+            }
+
             KURL url(manifestURL, String(line.characters(), p - line.characters()));
             
             if (!url.isValid())
                 continue;
 
-            if (url.hasRef())
-                url.setRef(String());
+            if (url.hasFragmentIdentifier())
+                url.removeFragmentIdentifier();
             
             if (!equalIgnoringCase(url.protocol(), manifestURL.protocol()))
                 continue;
@@ -141,8 +148,8 @@ bool parseManifest(const KURL& manifestURL, const char* data, int length, Manife
             KURL namespaceURL(manifestURL, String(line.characters(), p - line.characters()));
             if (!namespaceURL.isValid())
                 continue;
-            if (namespaceURL.hasRef())
-                namespaceURL.setRef(String());
+            if (namespaceURL.hasFragmentIdentifier())
+                namespaceURL.removeFragmentIdentifier();
 
             if (!protocolHostAndPortAreEqual(manifestURL, namespaceURL))
                 continue;
@@ -159,8 +166,8 @@ bool parseManifest(const KURL& manifestURL, const char* data, int length, Manife
             KURL fallbackURL(manifestURL, String(fallbackStart, p - fallbackStart));
             if (!fallbackURL.isValid())
                 continue;
-            if (fallbackURL.hasRef())
-                fallbackURL.setRef(String());
+            if (fallbackURL.hasFragmentIdentifier())
+                fallbackURL.removeFragmentIdentifier();
 
             if (!protocolHostAndPortAreEqual(manifestURL, fallbackURL))
                 continue;
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ManifestParser.h b/src/3rdparty/webkit/WebCore/loader/appcache/ManifestParser.h
index c03cf27..f0369ee 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ManifestParser.h
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ManifestParser.h
@@ -38,6 +38,7 @@ namespace WebCore {
         Vector<KURL> onlineWhitelistedURLs;
         HashSet<String> explicitURLs;
         FallbackURLVector fallbackURLs;
+        bool allowAllNetworkRequests; // Wildcard found in NETWORK section.
     };
 
     bool parseManifest(const KURL& manifestURL, const char* data, int length, Manifest&);
diff --git a/src/3rdparty/webkit/WebCore/loader/archive/ArchiveFactory.cpp b/src/3rdparty/webkit/WebCore/loader/archive/ArchiveFactory.cpp
index 753c3c3..1322dbb 100644
--- a/src/3rdparty/webkit/WebCore/loader/archive/ArchiveFactory.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/archive/ArchiveFactory.cpp
@@ -75,7 +75,7 @@ bool ArchiveFactory::isArchiveMimeType(const String& mimeType)
 PassRefPtr<Archive> ArchiveFactory::create(SharedBuffer* data, const String& mimeType)
 {
     RawDataCreationFunction* function = archiveMIMETypes().get(mimeType);
-    return function ? function(data) : PassRefPtr<Archive>(0);
+    return function ? function(data) : 0;
 }
 
 void ArchiveFactory::registerKnownArchiveMIMETypes()
diff --git a/src/3rdparty/webkit/WebCore/loader/archive/ArchiveResource.cpp b/src/3rdparty/webkit/WebCore/loader/archive/ArchiveResource.cpp
index b6317da..691f66a 100644
--- a/src/3rdparty/webkit/WebCore/loader/archive/ArchiveResource.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/archive/ArchiveResource.cpp
@@ -35,17 +35,17 @@ namespace WebCore {
 
 PassRefPtr<ArchiveResource> ArchiveResource::create(PassRefPtr<SharedBuffer> data, const KURL& url, const ResourceResponse& response)
 {
-    return data ? adoptRef(new ArchiveResource(data, url, response)) : PassRefPtr<ArchiveResource>(0);
+    return data ? adoptRef(new ArchiveResource(data, url, response)) : 0;
 }
 
 PassRefPtr<ArchiveResource> ArchiveResource::create(PassRefPtr<SharedBuffer> data, const KURL& url, const String& mimeType, const String& textEncoding, const String& frameName)
 {
-    return data ? adoptRef(new ArchiveResource(data, url, mimeType, textEncoding, frameName)) : PassRefPtr<ArchiveResource>(0);
+    return data ? adoptRef(new ArchiveResource(data, url, mimeType, textEncoding, frameName)) : 0;
 }
 
 PassRefPtr<ArchiveResource> ArchiveResource::create(PassRefPtr<SharedBuffer> data, const KURL& url, const String& mimeType, const String& textEncoding, const String& frameName, const ResourceResponse& resourceResponse)
 {
-    return data ? adoptRef(new ArchiveResource(data, url, mimeType, textEncoding, frameName, resourceResponse)) : PassRefPtr<ArchiveResource>(0);
+    return data ? adoptRef(new ArchiveResource(data, url, mimeType, textEncoding, frameName, resourceResponse)) : 0;
 }
 
 ArchiveResource::ArchiveResource(PassRefPtr<SharedBuffer> data, const KURL& url, const ResourceResponse& response)
diff --git a/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchive.cpp b/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchive.cpp
index d1269cc..3141e98 100644
--- a/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchive.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchive.cpp
@@ -233,7 +233,7 @@ PassRefPtr<ArchiveResource> LegacyWebArchive::createResource(CFDictionaryRef dic
         response = createResourceResponseFromPropertyListData(resourceResponseData, resourceResponseVersion);
     }
     
-    return ArchiveResource::create(SharedBuffer::create(CFDataGetBytePtr(resourceData), CFDataGetLength(resourceData)), KURL(url), mimeType, textEncoding, frameName, response);
+    return ArchiveResource::create(SharedBuffer::create(CFDataGetBytePtr(resourceData), CFDataGetLength(resourceData)), KURL(ParsedURLString, url), mimeType, textEncoding, frameName, response);
 }
 
 PassRefPtr<LegacyWebArchive> LegacyWebArchive::create()
@@ -489,7 +489,7 @@ PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(const String& markupString
     // it's possible to have a response without a URL here
     // <rdar://problem/5454935>
     if (responseURL.isNull())
-        responseURL = KURL("");
+        responseURL = KURL(ParsedURLString, "");
         
     PassRefPtr<ArchiveResource> mainResource = ArchiveResource::create(utf8Buffer(markupString), responseURL, response.mimeType(), "UTF-8", frame->tree()->name());
 
@@ -548,7 +548,7 @@ PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(const String& markupString
         const String& iconURL = iconDatabase()->iconURLForPageURL(responseURL);
         if (!iconURL.isEmpty() && iconDatabase()->iconDataKnownForIconURL(iconURL)) {
             if (Image* iconImage = iconDatabase()->iconForPageURL(responseURL, IntSize(16, 16))) {
-                if (RefPtr<ArchiveResource> resource = ArchiveResource::create(iconImage->data(), KURL(iconURL), "image/x-icon", "", ""))
+                if (RefPtr<ArchiveResource> resource = ArchiveResource::create(iconImage->data(), KURL(ParsedURLString, iconURL), "image/x-icon", "", ""))
                     subresources.append(resource.release());
             }
         }
diff --git a/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.cpp b/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.cpp
index 7201661..b78291d 100644
--- a/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.cpp
@@ -511,7 +511,7 @@ void IconDatabase::setIconDataForIconURL(PassRefPtr<SharedBuffer> dataOriginal,
     if (!isOpen() || iconURLOriginal.isEmpty())
         return;
     
-    RefPtr<SharedBuffer> data = dataOriginal ? dataOriginal->copy() : PassRefPtr<SharedBuffer>(0);
+    RefPtr<SharedBuffer> data = dataOriginal ? dataOriginal->copy() : 0;
     String iconURL = iconURLOriginal.copy();
     
     Vector<String> pageURLs;
diff --git a/src/3rdparty/webkit/WebCore/loader/loader.cpp b/src/3rdparty/webkit/WebCore/loader/loader.cpp
index 7ca45a5..0b6dff1 100644
--- a/src/3rdparty/webkit/WebCore/loader/loader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/loader.cpp
@@ -100,7 +100,7 @@ void Loader::load(DocLoader* docLoader, CachedResource* resource, bool increment
     Request* request = new Request(docLoader, resource, incremental, skipCanLoadCheck, sendResourceLoadCallbacks);
 
     RefPtr<Host> host;
-    KURL url(resource->url());
+    KURL url(ParsedURLString, resource->url());
     if (url.protocolInHTTPFamily()) {
         AtomicString hostName = url.host();
         host = m_hosts.get(hostName.impl());
@@ -288,7 +288,11 @@ void Loader::Host::servePendingRequests(RequestQueue& requestsPending, bool& ser
         DocLoader* docLoader = request->docLoader();
         bool resourceIsCacheValidator = request->cachedResource()->isCacheValidator();
 
-        if (m_requestsLoading.size() + m_nonCachedRequestsInFlight >= m_maxRequestsInFlight) {
+        // For named hosts - which are only http(s) hosts - we should always enforce the connection limit.
+        // For non-named hosts - everything but http(s) - we should only enforce the limit if the document isn't done parsing 
+        // and we don't know all stylesheets yet.
+        bool shouldLimitRequests = !m_name.isNull() || docLoader->doc()->parsing() || !docLoader->doc()->haveStylesheetsLoaded();
+        if (shouldLimitRequests && m_requestsLoading.size() + m_nonCachedRequestsInFlight >= m_maxRequestsInFlight) {
             serveLowerPriority = false;
             return;
         }
@@ -349,7 +353,7 @@ void Loader::Host::didFinishLoading(SubresourceLoader* loader)
     DocLoader* docLoader = request->docLoader();
     // Prevent the document from being destroyed before we are done with
     // the docLoader that it will delete when the document gets deleted.
-    DocPtr<Document> protector(docLoader->doc());
+    RefPtr<Document> protector(docLoader->doc());
     if (!request->isMultipart())
         docLoader->decrementRequestCount();
 
@@ -397,7 +401,7 @@ void Loader::Host::didFail(SubresourceLoader* loader, bool cancelled)
     DocLoader* docLoader = request->docLoader();
     // Prevent the document from being destroyed before we are done with
     // the docLoader that it will delete when the document gets deleted.
-    DocPtr<Document> protector(docLoader->doc());
+    RefPtr<Document> protector(docLoader->doc());
     if (!request->isMultipart())
         docLoader->decrementRequestCount();
 
diff --git a/src/3rdparty/webkit/WebCore/make-generated-sources.sh b/src/3rdparty/webkit/WebCore/make-generated-sources.sh
index 88173d5..96b2112 100755
--- a/src/3rdparty/webkit/WebCore/make-generated-sources.sh
+++ b/src/3rdparty/webkit/WebCore/make-generated-sources.sh
@@ -2,7 +2,6 @@
 export SOURCE_ROOT=$PWD
 export SRCROOT=$PWD
 export WebCore=$PWD
-export CREATE_HASH_TABLE="$SRCROOT/../JavaScriptCore/create_hash_table"
 
 mkdir -p DerivedSources/WebCore &&
 make -C DerivedSources/WebCore -f ../../DerivedSources.make $@
diff --git a/src/3rdparty/webkit/WebCore/notifications/Notification.cpp b/src/3rdparty/webkit/WebCore/notifications/Notification.cpp
new file mode 100644
index 0000000..61ad1f3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/notifications/Notification.cpp
@@ -0,0 +1,234 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(NOTIFICATIONS)
+
+#include "Notification.h"
+#include "NotificationContents.h"
+
+#include "Document.h"
+#include "EventNames.h"
+#include "WorkerContext.h" 
+
+namespace WebCore {
+
+Notification::Notification(const String& url, ScriptExecutionContext* context, ExceptionCode& ec, NotificationPresenter* provider)
+    : ActiveDOMObject(context, this)
+    , m_isHTML(true)
+    , m_isShowing(false)
+    , m_presenter(provider)
+{
+    if (m_presenter->checkPermission(context->securityOrigin()) != NotificationPresenter::PermissionAllowed) {
+        ec = SECURITY_ERR;
+        return;
+    }
+
+    m_notificationURL = context->completeURL(url);
+    if (url.isEmpty() || !m_notificationURL.isValid()) {
+        ec = SYNTAX_ERR;
+        return;
+    }
+}
+
+Notification::Notification(const NotificationContents& contents, ScriptExecutionContext* context, ExceptionCode& ec, NotificationPresenter* provider)
+    : ActiveDOMObject(context, this)
+    , m_isHTML(false)
+    , m_contents(contents)
+    , m_isShowing(false)
+    , m_presenter(provider)
+{
+    if (m_presenter->checkPermission(context->securityOrigin()) != NotificationPresenter::PermissionAllowed) {
+        ec = SECURITY_ERR;
+        return;
+    }
+
+    KURL icon = context->completeURL(contents.icon());
+    if (!icon.isEmpty() && !icon.isValid()) {
+        ec = SYNTAX_ERR;
+        return;
+    }
+}
+
+Notification::~Notification() 
+{
+    m_presenter->notificationObjectDestroyed(this);
+}
+
+void Notification::show() 
+{
+    // prevent double-showing
+    if (!m_isShowing)
+        m_isShowing = m_presenter->show(this);
+}
+
+void Notification::cancel() 
+{
+    if (m_isShowing)
+        m_presenter->cancel(this);
+}
+
+EventListener* Notification::ondisplay() const
+{
+    return getAttributeEventListener("display");
+}
+
+void Notification::setOndisplay(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener("display", eventListener);
+}
+
+EventListener* Notification::onerror() const
+{
+    return getAttributeEventListener(eventNames().errorEvent);
+}
+
+void Notification::setOnerror(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().errorEvent, eventListener);
+}
+
+EventListener* Notification::onclose() const
+{
+    return getAttributeEventListener(eventNames().closeEvent);
+}
+
+void Notification::setOnclose(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().closeEvent, eventListener);
+}
+
+EventListener* Notification::getAttributeEventListener(const AtomicString& eventType) const
+{
+    const RegisteredEventListenerVector& listeners = m_eventListeners;
+    size_t size = listeners.size();
+    for (size_t i = 0; i < size; ++i) {
+        const RegisteredEventListener& r = *listeners[i];
+        if (r.eventType() == eventType && r.listener()->isAttribute())
+            return r.listener();
+    }
+    return 0;
+}
+
+void Notification::setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener)
+{
+    clearAttributeEventListener(eventType);
+    if (listener)
+        addEventListener(eventType, listener, false);
+}
+
+void Notification::clearAttributeEventListener(const AtomicString& eventType)
+{
+    RegisteredEventListenerVector* listeners = &m_eventListeners;
+    size_t size = listeners->size();
+    for (size_t i = 0; i < size; ++i) {
+        RegisteredEventListener& r = *listeners->at(i);
+        if (r.eventType() != eventType || !r.listener()->isAttribute())
+            continue;
+
+        r.setRemoved(true);
+        listeners->remove(i);
+        return;
+    }
+}
+
+void Notification::dispatchDisplayEvent() 
+{   
+    RefPtr<Event> event = Event::create("display", false, true);
+    ExceptionCode ec = 0;
+    dispatchEvent(event.release(), ec);
+    ASSERT(!ec);
+}
+
+void Notification::dispatchErrorEvent()
+{  
+    RefPtr<Event> event = Event::create(eventNames().errorEvent, false, true);
+    ExceptionCode ec = 0;
+    dispatchEvent(event.release(), ec);
+    ASSERT(!ec);
+}
+
+void Notification::dispatchCloseEvent() 
+{   
+    RefPtr<Event> event = Event::create(eventNames().closeEvent, false, true);
+    ExceptionCode ec = 0;
+    dispatchEvent(event.release(), ec);
+    ASSERT(!ec);
+}
+
+void Notification::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
+{
+    RefPtr<RegisteredEventListener> registeredListener = RegisteredEventListener::create(eventType, listener, useCapture);
+    m_eventListeners.append(registeredListener);
+}
+
+void Notification::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
+{
+    size_t size = m_eventListeners.size();
+    for (size_t i = 0; i < size; ++i) {
+        RegisteredEventListener& r = *m_eventListeners[i];
+        if (r.eventType() == eventType && r.useCapture() == useCapture && *r.listener() == *listener) {
+            r.setRemoved(true);
+            m_eventListeners.remove(i);
+            return; 
+        }
+    }
+}
+
+void Notification::handleEvent(PassRefPtr<Event> event, bool useCapture)
+{
+    RegisteredEventListenerVector listenersCopy = m_eventListeners;
+    size_t size = listenersCopy.size();
+    for (size_t i = 0; i < size; ++i) {
+        RegisteredEventListener& r = *listenersCopy[i];
+        if (r.eventType() == event->type() && r.useCapture() == useCapture && !r.removed())
+            r.listener()->handleEvent(event.get());
+    }
+}
+
+bool Notification::dispatchEvent(PassRefPtr<Event> inEvent, ExceptionCode&)
+{
+    RefPtr<Event> event(inEvent);
+
+    event->setEventPhase(Event::AT_TARGET);
+    event->setCurrentTarget(this);
+
+    handleEvent(event.get(), true);
+    if (!event->propagationStopped()) {
+        handleEvent(event.get(), false);
+    }
+
+    return !event->defaultPrevented();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(NOTIFICATIONS)
diff --git a/src/3rdparty/webkit/WebCore/notifications/Notification.h b/src/3rdparty/webkit/WebCore/notifications/Notification.h
new file mode 100644
index 0000000..baae4ee
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/notifications/Notification.h
@@ -0,0 +1,120 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef Notification_h  
+#define Notification_h
+
+#include "ActiveDOMObject.h"
+#include "AtomicStringHash.h"
+#include "Event.h"
+#include "EventListener.h"
+#include "EventTarget.h"
+#include "ExceptionCode.h"
+#include "KURL.h"
+#include "NotificationPresenter.h"
+#include "NotificationContents.h"
+#include "RegisteredEventListener.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+#if ENABLE(NOTIFICATIONS)
+namespace WebCore {
+
+    class WorkerContext;
+
+    class Notification : public RefCounted<Notification>, public ActiveDOMObject, public EventTarget { 
+    public:
+        static Notification* create(const String& url, ScriptExecutionContext* context, ExceptionCode& ec, NotificationPresenter* provider) { return new Notification(url, context, ec, provider); }
+        static Notification* create(const NotificationContents& contents, ScriptExecutionContext* context, ExceptionCode& ec, NotificationPresenter* provider) { return new Notification(contents, context, ec, provider); }
+        
+        virtual ~Notification();
+
+        void show();
+        void cancel();
+    
+        bool isHTML() { return m_isHTML; }
+        KURL url() { return m_notificationURL; }
+        NotificationContents& contents() { return m_contents; }
+
+        EventListener* ondisplay() const;
+        void setOndisplay(PassRefPtr<EventListener> eventListener);
+        EventListener* onerror() const;
+        void setOnerror(PassRefPtr<EventListener> eventListener);
+        EventListener* onclose() const;
+        void setOnclose(PassRefPtr<EventListener> eventListener);
+    
+        using RefCounted<Notification>::ref;
+        using RefCounted<Notification>::deref;
+    
+        // Dispatching of events on the notification.  The presenter should call these when events occur.
+        void dispatchDisplayEvent();
+        void dispatchErrorEvent();
+        void dispatchCloseEvent();
+
+        // EventTarget interface
+        virtual ScriptExecutionContext* scriptExecutionContext() const { return ActiveDOMObject::scriptExecutionContext(); }
+        virtual void addEventListener(const AtomicString&, PassRefPtr<EventListener>, bool);
+        virtual void removeEventListener(const AtomicString&, EventListener*, bool);
+        virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
+        virtual Notification* toNotification() { return this; }
+
+        // These methods are for onEvent style listeners.
+        EventListener* getAttributeEventListener(const AtomicString&) const;
+        void setAttributeEventListener(const AtomicString&, PassRefPtr<EventListener>);
+        void clearAttributeEventListener(const AtomicString&);
+
+    private:
+        Notification(const String& url, ScriptExecutionContext* context, ExceptionCode& ec, NotificationPresenter* provider);
+        Notification(const NotificationContents& fields, ScriptExecutionContext* context, ExceptionCode& ec, NotificationPresenter* provider);
+
+        // EventTarget interface
+        virtual void refEventTarget() { ref(); }
+        virtual void derefEventTarget() { deref(); }
+  
+        void handleEvent(PassRefPtr<Event> event, bool useCapture);
+
+        bool m_isHTML;
+        KURL m_notificationURL;
+        NotificationContents m_contents;
+
+        bool m_isShowing;
+
+        RegisteredEventListenerVector m_eventListeners;
+
+        NotificationPresenter* m_presenter;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(NOTIFICATIONS)
+
+#endif // Notifications_h
diff --git a/src/3rdparty/webkit/WebCore/notifications/Notification.idl b/src/3rdparty/webkit/WebCore/notifications/Notification.idl
new file mode 100644
index 0000000..eca2eb4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/notifications/Notification.idl
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module threads {
+
+    interface [
+        Conditional=NOTIFICATIONS
+    ] Notification {
+        void show();
+        void cancel();
+
+        attribute EventListener ondisplay;
+        attribute EventListener onerror;
+        attribute EventListener onclose;
+
+        // EventTarget interface
+        [Custom] void addEventListener(in DOMString type, 
+                                       in EventListener listener, 
+                                       in boolean useCapture);
+        [Custom] void removeEventListener(in DOMString type, 
+                                          in EventListener listener, 
+                                          in boolean useCapture);
+        boolean dispatchEvent(in Event evt)
+            raises(EventException);
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/notifications/NotificationCenter.cpp b/src/3rdparty/webkit/WebCore/notifications/NotificationCenter.cpp
new file mode 100644
index 0000000..94976a2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/notifications/NotificationCenter.cpp
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(NOTIFICATIONS)
+
+#include "NotificationCenter.h"
+
+#include "Document.h"
+#include "VoidCallback.h"
+#include "WorkerContext.h"
+
+namespace WebCore {
+
+NotificationCenter::NotificationCenter(ScriptExecutionContext* context, NotificationPresenter* presenter) 
+    : ActiveDOMObject(context, this)
+    , m_scriptExecutionContext(context)
+    , m_notificationPresenter(presenter) {}
+
+int NotificationCenter::checkPermission() 
+{
+    return m_notificationPresenter->checkPermission(m_scriptExecutionContext->securityOrigin());
+}
+
+void NotificationCenter::requestPermission(PassRefPtr<VoidCallback> callback)
+{
+    m_notificationPresenter->requestPermission(m_scriptExecutionContext->securityOrigin(), callback);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(NOTIFICATIONS)
diff --git a/src/3rdparty/webkit/WebCore/notifications/NotificationCenter.h b/src/3rdparty/webkit/WebCore/notifications/NotificationCenter.h
new file mode 100644
index 0000000..596ab8b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/notifications/NotificationCenter.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef NotificationCenter_h
+#define NotificationCenter_h
+
+#include "Notification.h"
+#include "NotificationContents.h"
+#include "WorkerThread.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+#if ENABLE(NOTIFICATIONS)
+
+namespace WebCore {
+
+    class ScriptExecutionContext;
+
+    class NotificationCenter : public RefCounted<NotificationCenter>, public ActiveDOMObject { 
+    public:
+        static PassRefPtr<NotificationCenter> create(ScriptExecutionContext* context, NotificationPresenter* presenter) { return adoptRef(new NotificationCenter(context, presenter)); }
+        
+        Notification* createHTMLNotification(const String& URI, ExceptionCode& ec)
+        {
+            return Notification::create(KURL(ParsedURLString, URI), context(), ec, presenter());
+        }
+
+        Notification* createNotification(const String& iconURI, const String& title, const String& body, ExceptionCode& ec)
+        {
+            NotificationContents contents(iconURI, title, body);
+            return Notification::create(contents, context(), ec, presenter());
+        }
+
+        ScriptExecutionContext* context() const { return m_scriptExecutionContext; }
+        NotificationPresenter* presenter() const { return m_notificationPresenter; }
+
+        int checkPermission();
+        void requestPermission(PassRefPtr<VoidCallback> callback);
+
+    private:
+        NotificationCenter(ScriptExecutionContext*, NotificationPresenter*);
+
+        ScriptExecutionContext* m_scriptExecutionContext;
+        NotificationPresenter* m_notificationPresenter;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(NOTIFICATIONS)
+
+#endif // NotificationCenter_h
diff --git a/src/3rdparty/webkit/WebCore/notifications/NotificationCenter.idl b/src/3rdparty/webkit/WebCore/notifications/NotificationCenter.idl
new file mode 100644
index 0000000..3f6e369
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/notifications/NotificationCenter.idl
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module threads {
+
+    interface [
+        Conditional=NOTIFICATIONS
+    ] NotificationCenter {
+       [V8Custom] Notification createHTMLNotification(in DOMString url) raises(Exception);
+       [V8Custom] Notification createNotification(in DOMString iconUrl, in DOMString title, in DOMString body) raises(Exception);
+
+       int checkPermission();
+       [Custom] void requestPermission(in VoidCallback callback);
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/notifications/NotificationContents.h b/src/3rdparty/webkit/WebCore/notifications/NotificationContents.h
new file mode 100644
index 0000000..ebdc514
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/notifications/NotificationContents.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef NotificationContents_h
+#define NotificationContents_h
+
+#if ENABLE(NOTIFICATIONS)
+
+namespace WebCore {
+
+    class NotificationContents { 
+    public:
+        NotificationContents() {}
+        NotificationContents(const String& iconUrl, const String& title, const String& body) 
+            : m_icon(iconUrl)
+            , m_title(title)
+            , m_body(body) {}
+
+        String icon() const { return m_icon; }
+        String title() const { return m_title; }
+        String body() const { return m_body; }
+
+    private:
+        String m_icon;
+        String m_title;
+        String m_body;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(NOTIFICATIONS)
+
+#endif // NotificationContents_h
diff --git a/src/3rdparty/webkit/WebCore/notifications/NotificationPresenter.h b/src/3rdparty/webkit/WebCore/notifications/NotificationPresenter.h
new file mode 100644
index 0000000..d70a3e9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/notifications/NotificationPresenter.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef NotificationPresenter_h
+#define NotificationPresenter_h
+
+#include <wtf/PassRefPtr.h>
+#include "VoidCallback.h"
+
+#if ENABLE(NOTIFICATIONS)
+
+namespace WebCore {
+
+    class Notification;
+    class SecurityOrigin;
+    class String;
+    
+    class NotificationPresenter {
+
+    public:
+        enum Permission { 
+            PermissionAllowed,     // User has allowed notifications
+            PermissionNotAllowed,  // User has not yet allowed
+            PermissionDenied       // User has explictly denied permission
+        };
+
+        virtual ~NotificationPresenter() {}
+
+        // Requests that a notification be shown.
+        virtual bool show(Notification* object) = 0;
+
+        // Requests that a notification that has already been shown be canceled.
+        virtual void cancel(Notification* object) = 0;
+
+        // Informs the presenter that a Notification object has been destroyed 
+        // (such as by a page transition).  The presenter may continue showing
+        // the notification, but must not attempt to call the event handlers.
+        virtual void notificationObjectDestroyed(Notification* object) = 0;
+
+        // Requests user permission to show desktop notifications from a particular
+        // origin.  The callback parameter should be run when the user has
+        // made a decision.
+        virtual void requestPermission(SecurityOrigin* origin, PassRefPtr<VoidCallback> callback) = 0;
+
+        // Checks the current level of permission.
+        virtual Permission checkPermission(SecurityOrigin* origin) = 0;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(NOTIFICATIONS)
+
+#endif // NotificationPresenter_h
diff --git a/src/3rdparty/webkit/WebCore/page/AbstractView.idl b/src/3rdparty/webkit/WebCore/page/AbstractView.idl
index 5b7ce89..36865de 100644
--- a/src/3rdparty/webkit/WebCore/page/AbstractView.idl
+++ b/src/3rdparty/webkit/WebCore/page/AbstractView.idl
@@ -31,6 +31,7 @@ module views {
         ObjCCustomImplementation
     ] AbstractView {
         readonly attribute Document document;
+        readonly attribute Media media;
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/page/Chrome.cpp b/src/3rdparty/webkit/WebCore/page/Chrome.cpp
index 5a5670e..a16db68 100644
--- a/src/3rdparty/webkit/WebCore/page/Chrome.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Chrome.cpp
@@ -102,6 +102,11 @@ void Chrome::scrollRectIntoView(const IntRect& rect, const ScrollView* scrollVie
     m_client->scrollRectIntoView(rect, scrollView);
 }
 
+void Chrome::scrollbarsModeDidChange() const
+{
+    m_client->scrollbarsModeDidChange();
+}
+
 void Chrome::setWindowRect(const FloatRect& rect) const
 {
     m_client->setWindowRect(rect);
@@ -311,8 +316,10 @@ void Chrome::mouseDidMoveOverElement(const HitTestResult& result, unsigned modif
     }
     m_client->mouseDidMoveOverElement(result, modifierFlags);
 
+#if ENABLE(INSPECTOR)
     if (InspectorController* inspector = m_page->inspectorController())
         inspector->mouseDidMoveOverElement(result, modifierFlags);
+#endif
 }
 
 void Chrome::setToolTip(const HitTestResult& result)
@@ -403,6 +410,13 @@ bool Chrome::setCursor(PlatformCursorHandle cursor)
     return m_client->setCursor(cursor);
 }
 
+#if ENABLE(NOTIFICATIONS)
+NotificationPresenter* Chrome::notificationPresenter() const
+{
+    return m_client->notificationPresenter();
+}
+#endif
+
 // --------
 
 #if ENABLE(DASHBOARD_SUPPORT)
diff --git a/src/3rdparty/webkit/WebCore/page/Chrome.h b/src/3rdparty/webkit/WebCore/page/Chrome.h
index c26e450..79d3eca 100644
--- a/src/3rdparty/webkit/WebCore/page/Chrome.h
+++ b/src/3rdparty/webkit/WebCore/page/Chrome.h
@@ -44,6 +44,9 @@ namespace WebCore {
     class IntRect;
     class Page;
     class String;
+#if ENABLE(NOTIFICATIONS)
+    class NotificationPresenter;
+#endif
 
     struct FrameLoadRequest;
     struct WindowFeatures;
@@ -62,6 +65,7 @@ namespace WebCore {
         virtual IntRect windowToScreen(const IntRect&) const;
         virtual PlatformWidget platformWindow() const;
         virtual void scrollRectIntoView(const IntRect&, const ScrollView*) const;
+        virtual void scrollbarsModeDidChange() const;
 
         void contentsSizeChanged(Frame*, const IntSize&) const;
 
@@ -128,6 +132,10 @@ namespace WebCore {
         void focusNSView(NSView*);
 #endif
 
+#if ENABLE(NOTIFICATIONS)
+        NotificationPresenter* notificationPresenter() const; 
+#endif
+
     private:
         Page* m_page;
         ChromeClient* m_client;
diff --git a/src/3rdparty/webkit/WebCore/page/ChromeClient.h b/src/3rdparty/webkit/WebCore/page/ChromeClient.h
index 2a90611..2a1e991 100644
--- a/src/3rdparty/webkit/WebCore/page/ChromeClient.h
+++ b/src/3rdparty/webkit/WebCore/page/ChromeClient.h
@@ -62,6 +62,10 @@ namespace WebCore {
     class GraphicsLayer;
 #endif
 
+#if ENABLE(NOTIFICATIONS)
+    class NotificationPresenter;
+#endif
+
     class ChromeClient {
     public:
         virtual void chromeDestroyed() = 0;
@@ -129,6 +133,7 @@ namespace WebCore {
         virtual void scrollRectIntoView(const IntRect&, const ScrollView*) const = 0; // Currently only Mac has a non empty implementation.
         // End methods used by HostWindow.
 
+        virtual void scrollbarsModeDidChange() const = 0;
         virtual void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags) = 0;
 
         virtual void setToolTip(const String&, TextDirection) = 0;
@@ -152,6 +157,10 @@ namespace WebCore {
         virtual void dashboardRegionsChanged();
 #endif
 
+#if ENABLE(NOTIFICATIONS)
+        virtual NotificationPresenter* notificationPresenter() const = 0;
+#endif
+
         virtual void populateVisitedLinks();
 
         virtual FloatRect customHighlightRect(Node*, const AtomicString& type, const FloatRect& lineRect);
@@ -166,7 +175,7 @@ namespace WebCore {
                                           float value, float proportion, ScrollbarControlPartMask);
         virtual bool paintCustomScrollCorner(GraphicsContext*, const FloatRect&);
 
-        // This is an asynchronous call. The ChromeClient can display UI asking the user for permission
+        // This can be either a synchronous or asynchronous call. The ChromeClient can display UI asking the user for permission
         // to use Geolococation. The ChromeClient must call Geolocation::setShouldClearCache() appropriately.
         virtual void requestGeolocationPermissionForFrame(Frame*, Geolocation*) = 0;
             
@@ -191,7 +200,7 @@ namespace WebCore {
         virtual void setNeedsOneShotDrawingSynchronization() = 0;
         // Sets a flag to specify that the view needs to be updated, so we need
         // to do an eager layout before the drawing.
-        virtual void scheduleViewUpdate() = 0;
+        virtual void scheduleCompositingLayerSync() = 0;
 #endif
 
 #if PLATFORM(MAC)
diff --git a/src/3rdparty/webkit/WebCore/page/Console.cpp b/src/3rdparty/webkit/WebCore/page/Console.cpp
index de7bc72..79613d3 100644
--- a/src/3rdparty/webkit/WebCore/page/Console.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Console.cpp
@@ -31,6 +31,7 @@
 
 #include "CString.h"
 #include "ChromeClient.h"
+#include "ConsoleMessage.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameTree.h"
@@ -128,6 +129,9 @@ static void printMessageSourceAndLevelPrefix(MessageSource source, MessageLevel
     case ErrorMessageLevel:
         levelString = "ERROR";
         break;
+    case DebugMessageLevel:
+        levelString = "DEBUG";
+        break;
     default:
         ASSERT_NOT_REACHED();
         levelString = "UNKNOWN";
@@ -143,10 +147,12 @@ void Console::addMessage(MessageSource source, MessageType type, MessageLevel le
     if (!page)
         return;
 
-    if (source == JSMessageSource || source == WMLMessageSource)
+    if (source == JSMessageSource)
         page->chrome()->client()->addMessageToConsole(source, type, level, message, lineNumber, sourceURL);
 
+#if ENABLE(INSPECTOR)
     page->inspectorController()->addMessageToConsole(source, type, level, message, lineNumber, sourceURL);
+#endif
 
     if (!Console::shouldPrintExceptions())
         return;
@@ -172,7 +178,9 @@ void Console::addMessage(MessageType type, MessageLevel level, ScriptCallStack*
     if (getFirstArgumentAsString(callStack->state(), lastCaller, message))
         page->chrome()->client()->addMessageToConsole(JSMessageSource, type, level, message, lastCaller.lineNumber(), lastCaller.sourceURL().prettyURL());
 
+#if ENABLE(INSPECTOR)
     page->inspectorController()->addMessageToConsole(JSMessageSource, type, level, callStack);
+#endif
 
     if (!Console::shouldPrintExceptions())
         return;
@@ -245,6 +253,7 @@ void Console::assertCondition(bool condition, ScriptCallStack* callStack)
 
 void Console::count(ScriptCallStack* callStack)
 {
+#if ENABLE(INSPECTOR)
     Page* page = this->page();
     if (!page)
         return;
@@ -256,8 +265,37 @@ void Console::count(ScriptCallStack* callStack)
     getFirstArgumentAsString(callStack->state(), lastCaller, title);
 
     page->inspectorController()->count(title, lastCaller.lineNumber(), lastCaller.sourceURL().string());
+#else
+    UNUSED_PARAM(callStack);
+#endif
 }
 
+#if ENABLE(WML)
+String Console::lastWMLErrorMessage() const
+{
+    Page* page = this->page();
+    if (!page)
+        return String();
+
+    const Vector<ConsoleMessage*>& consoleMessages = page->inspectorController()->consoleMessages();
+    if (consoleMessages.isEmpty())
+        return String();
+
+    Vector<ConsoleMessage*>::const_iterator it = consoleMessages.begin();
+    const Vector<ConsoleMessage*>::const_iterator end = consoleMessages.end();
+
+    for (; it != end; ++it) {
+        ConsoleMessage* message = *it;
+        if (message->source() != WMLMessageSource)
+            continue;
+
+        return message->message();
+    }
+
+    return String();
+}
+#endif
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 
 void Console::profile(const JSC::UString& title, ScriptCallStack* callStack)
@@ -266,19 +304,27 @@ void Console::profile(const JSC::UString& title, ScriptCallStack* callStack)
     if (!page)
         return;
 
+#if ENABLE(INSPECTOR)
     InspectorController* controller = page->inspectorController();
     // FIXME: log a console message when profiling is disabled.
     if (!controller->profilerEnabled())
         return;
+#endif
 
     JSC::UString resolvedTitle = title;
     if (title.isNull())   // no title so give it the next user initiated profile title.
+#if ENABLE(INSPECTOR)
         resolvedTitle = controller->getCurrentUserInitiatedProfileName(true);
+#else
+        resolvedTitle = "";
+#endif
 
     JSC::Profiler::profiler()->startProfiling(callStack->state(), resolvedTitle);
 
+#if ENABLE(INSPECTOR)
     const ScriptCallFrame& lastCaller = callStack->at(0);
     controller->addStartProfilingMessageToConsole(resolvedTitle, lastCaller.lineNumber(), lastCaller.sourceURL());
+#endif
 }
 
 void Console::profileEnd(const JSC::UString& title, ScriptCallStack* callStack)
@@ -290,9 +336,11 @@ void Console::profileEnd(const JSC::UString& title, ScriptCallStack* callStack)
     if (!this->page())
         return;
 
+#if ENABLE(INSPECTOR)
     InspectorController* controller = page->inspectorController();
     if (!controller->profilerEnabled())
         return;
+#endif
 
     RefPtr<JSC::Profile> profile = JSC::Profiler::profiler()->stopProfiling(callStack->state(), title);
     if (!profile)
@@ -300,14 +348,17 @@ void Console::profileEnd(const JSC::UString& title, ScriptCallStack* callStack)
 
     m_profiles.append(profile);
 
+#if ENABLE(INSPECTOR)
     const ScriptCallFrame& lastCaller = callStack->at(0);
     controller->addProfile(profile, lastCaller.lineNumber(), lastCaller.sourceURL());
+#endif
 }
 
 #endif
 
 void Console::time(const String& title)
 {
+#if ENABLE(INSPECTOR)
     Page* page = this->page();
     if (!page)
         return;
@@ -318,10 +369,14 @@ void Console::time(const String& title)
         return;
 
     page->inspectorController()->startTiming(title);
+#else
+    UNUSED_PARAM(title);
+#endif
 }
 
 void Console::timeEnd(const String& title, ScriptCallStack* callStack)
 {
+#if ENABLE(INSPECTOR)
     Page* page = this->page();
     if (!page)
         return;
@@ -339,24 +394,34 @@ void Console::timeEnd(const String& title, ScriptCallStack* callStack)
 
     const ScriptCallFrame& lastCaller = callStack->at(0);
     page->inspectorController()->addMessageToConsole(JSMessageSource, LogMessageType, LogMessageLevel, message, lastCaller.lineNumber(), lastCaller.sourceURL().string());
+#else
+    UNUSED_PARAM(title);
+    UNUSED_PARAM(callStack);
+#endif
 }
 
 void Console::group(ScriptCallStack* callStack)
 {
+#if ENABLE(INSPECTOR)
     Page* page = this->page();
     if (!page)
         return;
 
     page->inspectorController()->startGroup(JSMessageSource, callStack);
+#else
+    UNUSED_PARAM(callStack);
+#endif
 }
 
 void Console::groupEnd()
 {
+#if ENABLE(INSPECTOR)
     Page* page = this->page();
     if (!page)
         return;
 
     page->inspectorController()->endGroup(JSMessageSource, 0, String());
+#endif
 }
 
 void Console::warn(ScriptCallStack* callStack)
diff --git a/src/3rdparty/webkit/WebCore/page/Console.h b/src/3rdparty/webkit/WebCore/page/Console.h
index 64e596d..08d43e3 100644
--- a/src/3rdparty/webkit/WebCore/page/Console.h
+++ b/src/3rdparty/webkit/WebCore/page/Console.h
@@ -71,7 +71,8 @@ namespace WebCore {
         TipMessageLevel,
         LogMessageLevel,
         WarningMessageLevel,
-        ErrorMessageLevel
+        ErrorMessageLevel,
+        DebugMessageLevel
     };
 
     class Console : public RefCounted<Console> {
@@ -93,6 +94,9 @@ namespace WebCore {
         void trace(ScriptCallStack*);
         void assertCondition(bool condition, ScriptCallStack*);
         void count(ScriptCallStack*);
+#if ENABLE(WML)
+        String lastWMLErrorMessage() const;
+#endif
 #if ENABLE(JAVASCRIPT_DEBUGGER)
         void profile(const JSC::UString&, ScriptCallStack*);
         void profileEnd(const JSC::UString&, ScriptCallStack*);
diff --git a/src/3rdparty/webkit/WebCore/page/Console.idl b/src/3rdparty/webkit/WebCore/page/Console.idl
index 4803508..0e9f3dc 100644
--- a/src/3rdparty/webkit/WebCore/page/Console.idl
+++ b/src/3rdparty/webkit/WebCore/page/Console.idl
@@ -45,6 +45,10 @@ module window {
         [CustomArgumentHandling, ImplementationFunction=assertCondition] void assert(in boolean condition);
         [CustomArgumentHandling] void count();
 
+#if defined(ENABLE_WML) && ENABLE_WML
+        [DontEnum] DOMString lastWMLErrorMessage();
+#endif
+
 #if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
         [CustomArgumentHandling] void profile(in [ConvertUndefinedOrNullToNullString] DOMString title);
         [CustomArgumentHandling] void profileEnd(in [ConvertUndefinedOrNullToNullString] DOMString title);
diff --git a/src/3rdparty/webkit/WebCore/page/ContextMenuController.cpp b/src/3rdparty/webkit/WebCore/page/ContextMenuController.cpp
index 58e6519..a3a86a5 100644
--- a/src/3rdparty/webkit/WebCore/page/ContextMenuController.cpp
+++ b/src/3rdparty/webkit/WebCore/page/ContextMenuController.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "ContextMenuController.h"
 
+#if ENABLE(CONTEXT_MENUS)
+
 #include "Chrome.h"
 #include "ContextMenu.h"
 #include "ContextMenuClient.h"
@@ -39,11 +41,11 @@
 #include "EventNames.h"
 #include "FormState.h"
 #include "Frame.h"
-#include "FrameLoader.h"
 #include "FrameLoadRequest.h"
+#include "FrameLoader.h"
+#include "HTMLFormElement.h"
 #include "HitTestRequest.h"
 #include "HitTestResult.h"
-#include "HTMLFormElement.h"
 #include "InspectorController.h"
 #include "MouseEvent.h"
 #include "Node.h"
@@ -95,8 +97,10 @@ void ContextMenuController::handleContextMenuEvent(Event* event)
 
     m_contextMenu.set(new ContextMenu(result));
     m_contextMenu->populate();
+#if ENABLE(INSPECTOR)
     if (m_page->inspectorController()->enabled())
         m_contextMenu->addInspectElementItem();
+#endif
 
     PlatformMenuDescription customMenu = m_client->getCustomMenuFromDefaultItems(m_contextMenu.get());
     m_contextMenu->setPlatformDescription(customMenu);
@@ -108,8 +112,7 @@ static void openNewWindow(const KURL& urlToLoad, Frame* frame)
 {
     if (Page* oldPage = frame->page()) {
         WindowFeatures features;
-        if (Page* newPage = oldPage->chrome()->createWindow(frame,
-                FrameLoadRequest(ResourceRequest(urlToLoad, frame->loader()->outgoingReferrer())), features))
+        if (Page* newPage = oldPage->chrome()->createWindow(frame, FrameLoadRequest(ResourceRequest(urlToLoad, frame->loader()->outgoingReferrer())), features))
             newPage->chrome()->show();
     }
 }
@@ -127,216 +130,216 @@ void ContextMenuController::contextMenuItemSelected(ContextMenuItem* item)
     Frame* frame = result.innerNonSharedNode()->document()->frame();
     if (!frame)
         return;
-    
+
     switch (item->action()) {
-        case ContextMenuItemTagOpenLinkInNewWindow: 
-            openNewWindow(result.absoluteLinkURL(), frame);
-            break;
-        case ContextMenuItemTagDownloadLinkToDisk:
-            // FIXME: Some day we should be able to do this from within WebCore.
-            m_client->downloadURL(result.absoluteLinkURL());
-            break;
-        case ContextMenuItemTagCopyLinkToClipboard:
-            frame->editor()->copyURL(result.absoluteLinkURL(), result.textContent());
-            break;
-        case ContextMenuItemTagOpenImageInNewWindow:
-            openNewWindow(result.absoluteImageURL(), frame);
-            break;
-        case ContextMenuItemTagDownloadImageToDisk:
-            // FIXME: Some day we should be able to do this from within WebCore.
-            m_client->downloadURL(result.absoluteImageURL());
-            break;
-        case ContextMenuItemTagCopyImageToClipboard:
-            // FIXME: The Pasteboard class is not written yet
-            // For now, call into the client. This is temporary!
-            frame->editor()->copyImage(result);
-            break;
-        case ContextMenuItemTagOpenFrameInNewWindow: {
-            DocumentLoader* loader = frame->loader()->documentLoader();
-            if (!loader->unreachableURL().isEmpty())
-                openNewWindow(loader->unreachableURL(), frame);
-            else
-                openNewWindow(loader->url(), frame);
-            break;
-        }
-        case ContextMenuItemTagCopy:
-            frame->editor()->copy();
-            break;
-        case ContextMenuItemTagGoBack:
-            frame->loader()->goBackOrForward(-1);
-            break;
-        case ContextMenuItemTagGoForward:
-            frame->loader()->goBackOrForward(1);
-            break;
-        case ContextMenuItemTagStop:
-            frame->loader()->stop();
-            break;
-        case ContextMenuItemTagReload:
-            frame->loader()->reload();
-            break;
-        case ContextMenuItemTagCut:
-            frame->editor()->cut();
-            break;
-        case ContextMenuItemTagPaste:
-            frame->editor()->paste();
-            break;
+    case ContextMenuItemTagOpenLinkInNewWindow:
+        openNewWindow(result.absoluteLinkURL(), frame);
+        break;
+    case ContextMenuItemTagDownloadLinkToDisk:
+        // FIXME: Some day we should be able to do this from within WebCore.
+        m_client->downloadURL(result.absoluteLinkURL());
+        break;
+    case ContextMenuItemTagCopyLinkToClipboard:
+        frame->editor()->copyURL(result.absoluteLinkURL(), result.textContent());
+        break;
+    case ContextMenuItemTagOpenImageInNewWindow:
+        openNewWindow(result.absoluteImageURL(), frame);
+        break;
+    case ContextMenuItemTagDownloadImageToDisk:
+        // FIXME: Some day we should be able to do this from within WebCore.
+        m_client->downloadURL(result.absoluteImageURL());
+        break;
+    case ContextMenuItemTagCopyImageToClipboard:
+        // FIXME: The Pasteboard class is not written yet
+        // For now, call into the client. This is temporary!
+        frame->editor()->copyImage(result);
+        break;
+    case ContextMenuItemTagOpenFrameInNewWindow: {
+        DocumentLoader* loader = frame->loader()->documentLoader();
+        if (!loader->unreachableURL().isEmpty())
+            openNewWindow(loader->unreachableURL(), frame);
+        else
+            openNewWindow(loader->url(), frame);
+        break;
+    }
+    case ContextMenuItemTagCopy:
+        frame->editor()->copy();
+        break;
+    case ContextMenuItemTagGoBack:
+        frame->loader()->goBackOrForward(-1);
+        break;
+    case ContextMenuItemTagGoForward:
+        frame->loader()->goBackOrForward(1);
+        break;
+    case ContextMenuItemTagStop:
+        frame->loader()->stop();
+        break;
+    case ContextMenuItemTagReload:
+        frame->loader()->reload();
+        break;
+    case ContextMenuItemTagCut:
+        frame->editor()->cut();
+        break;
+    case ContextMenuItemTagPaste:
+        frame->editor()->paste();
+        break;
 #if PLATFORM(GTK)
-        case ContextMenuItemTagDelete:
-            frame->editor()->performDelete();
-            break;
-        case ContextMenuItemTagSelectAll:
-            frame->editor()->command("SelectAll").execute();
-            break;
+    case ContextMenuItemTagDelete:
+        frame->editor()->performDelete();
+        break;
+    case ContextMenuItemTagSelectAll:
+        frame->editor()->command("SelectAll").execute();
+        break;
 #endif
-        case ContextMenuItemTagSpellingGuess:
-            ASSERT(frame->selectedText().length());
-            if (frame->editor()->shouldInsertText(item->title(), frame->selection()->toNormalizedRange().get(),
-                EditorInsertActionPasted)) {
-                Document* document = frame->document();
-                RefPtr<ReplaceSelectionCommand> command =
-                    ReplaceSelectionCommand::create(document, createFragmentFromMarkup(document, item->title(), ""),
-                                                                                   true, false, true);
-                applyCommand(command);
-                frame->revealSelection(ScrollAlignment::alignToEdgeIfNeeded);
-            }
-            break;
-        case ContextMenuItemTagIgnoreSpelling:
-            frame->editor()->ignoreSpelling();
-            break;
-        case ContextMenuItemTagLearnSpelling:
-            frame->editor()->learnSpelling();
-            break;
-        case ContextMenuItemTagSearchWeb:
-            m_client->searchWithGoogle(frame);
-            break;
-        case ContextMenuItemTagLookUpInDictionary:
-            // FIXME: Some day we may be able to do this from within WebCore.
-            m_client->lookUpInDictionary(frame);
-            break;
-        case ContextMenuItemTagOpenLink:
-            if (Frame* targetFrame = result.targetFrame()) {
-                targetFrame->loader()->loadFrameRequest(FrameLoadRequest(ResourceRequest(result.absoluteLinkURL(), 
-                    frame->loader()->outgoingReferrer())), false, false, 0, 0);
-            } else
-                openNewWindow(result.absoluteLinkURL(), frame);
-            break;
-        case ContextMenuItemTagBold:
-            frame->editor()->command("ToggleBold").execute();
-            break;
-        case ContextMenuItemTagItalic:
-            frame->editor()->command("ToggleItalic").execute();
-            break;
-        case ContextMenuItemTagUnderline:
-            frame->editor()->toggleUnderline();
-            break;
-        case ContextMenuItemTagOutline:
-            // We actually never enable this because CSS does not have a way to specify an outline font,
-            // which may make this difficult to implement. Maybe a special case of text-shadow?
-            break;
-        case ContextMenuItemTagStartSpeaking: {
-            ExceptionCode ec;
-            RefPtr<Range> selectedRange = frame->selection()->toNormalizedRange();
-            if (!selectedRange || selectedRange->collapsed(ec)) {
-                Document* document = result.innerNonSharedNode()->document();
-                selectedRange = document->createRange();
-                selectedRange->selectNode(document->documentElement(), ec);
-            }
-            m_client->speak(plainText(selectedRange.get()));
-            break;
+    case ContextMenuItemTagSpellingGuess:
+        ASSERT(frame->selectedText().length());
+        if (frame->editor()->shouldInsertText(item->title(), frame->selection()->toNormalizedRange().get(), EditorInsertActionPasted)) {
+            Document* document = frame->document();
+            RefPtr<ReplaceSelectionCommand> command = ReplaceSelectionCommand::create(document, createFragmentFromMarkup(document, item->title(), ""), true, false, true);
+            applyCommand(command);
+            frame->revealSelection(ScrollAlignment::alignToEdgeIfNeeded);
+        }
+        break;
+    case ContextMenuItemTagIgnoreSpelling:
+        frame->editor()->ignoreSpelling();
+        break;
+    case ContextMenuItemTagLearnSpelling:
+        frame->editor()->learnSpelling();
+        break;
+    case ContextMenuItemTagSearchWeb:
+        m_client->searchWithGoogle(frame);
+        break;
+    case ContextMenuItemTagLookUpInDictionary:
+        // FIXME: Some day we may be able to do this from within WebCore.
+        m_client->lookUpInDictionary(frame);
+        break;
+    case ContextMenuItemTagOpenLink:
+        if (Frame* targetFrame = result.targetFrame())
+            targetFrame->loader()->loadFrameRequest(FrameLoadRequest(ResourceRequest(result.absoluteLinkURL(), frame->loader()->outgoingReferrer())), false, false, 0, 0);
+        else
+            openNewWindow(result.absoluteLinkURL(), frame);
+        break;
+    case ContextMenuItemTagBold:
+        frame->editor()->command("ToggleBold").execute();
+        break;
+    case ContextMenuItemTagItalic:
+        frame->editor()->command("ToggleItalic").execute();
+        break;
+    case ContextMenuItemTagUnderline:
+        frame->editor()->toggleUnderline();
+        break;
+    case ContextMenuItemTagOutline:
+        // We actually never enable this because CSS does not have a way to specify an outline font,
+        // which may make this difficult to implement. Maybe a special case of text-shadow?
+        break;
+    case ContextMenuItemTagStartSpeaking: {
+        ExceptionCode ec;
+        RefPtr<Range> selectedRange = frame->selection()->toNormalizedRange();
+        if (!selectedRange || selectedRange->collapsed(ec)) {
+            Document* document = result.innerNonSharedNode()->document();
+            selectedRange = document->createRange();
+            selectedRange->selectNode(document->documentElement(), ec);
         }
-        case ContextMenuItemTagStopSpeaking:
-            m_client->stopSpeaking();
-            break;
-        case ContextMenuItemTagDefaultDirection:
-            frame->editor()->setBaseWritingDirection(NaturalWritingDirection);
-            break;
-        case ContextMenuItemTagLeftToRight:
-            frame->editor()->setBaseWritingDirection(LeftToRightWritingDirection);
-            break;
-        case ContextMenuItemTagRightToLeft:
-            frame->editor()->setBaseWritingDirection(RightToLeftWritingDirection);
-            break;
-        case ContextMenuItemTagTextDirectionDefault:
-            frame->editor()->command("MakeTextWritingDirectionNatural").execute();
-            break;
-        case ContextMenuItemTagTextDirectionLeftToRight:
-            frame->editor()->command("MakeTextWritingDirectionLeftToRight").execute();
-            break;
-        case ContextMenuItemTagTextDirectionRightToLeft:
-            frame->editor()->command("MakeTextWritingDirectionRightToLeft").execute();
-            break;
+        m_client->speak(plainText(selectedRange.get()));
+        break;
+    }
+    case ContextMenuItemTagStopSpeaking:
+        m_client->stopSpeaking();
+        break;
+    case ContextMenuItemTagDefaultDirection:
+        frame->editor()->setBaseWritingDirection(NaturalWritingDirection);
+        break;
+    case ContextMenuItemTagLeftToRight:
+        frame->editor()->setBaseWritingDirection(LeftToRightWritingDirection);
+        break;
+    case ContextMenuItemTagRightToLeft:
+        frame->editor()->setBaseWritingDirection(RightToLeftWritingDirection);
+        break;
+    case ContextMenuItemTagTextDirectionDefault:
+        frame->editor()->command("MakeTextWritingDirectionNatural").execute();
+        break;
+    case ContextMenuItemTagTextDirectionLeftToRight:
+        frame->editor()->command("MakeTextWritingDirectionLeftToRight").execute();
+        break;
+    case ContextMenuItemTagTextDirectionRightToLeft:
+        frame->editor()->command("MakeTextWritingDirectionRightToLeft").execute();
+        break;
 #if PLATFORM(MAC)
-        case ContextMenuItemTagSearchInSpotlight:
-            m_client->searchWithSpotlight();
-            break;
+    case ContextMenuItemTagSearchInSpotlight:
+        m_client->searchWithSpotlight();
+        break;
 #endif
-        case ContextMenuItemTagShowSpellingPanel:
-            frame->editor()->showSpellingGuessPanel();
-            break;
-        case ContextMenuItemTagCheckSpelling:
-            frame->editor()->advanceToNextMisspelling();
-            break;
-        case ContextMenuItemTagCheckSpellingWhileTyping:
-            frame->editor()->toggleContinuousSpellChecking();
-            break;
+    case ContextMenuItemTagShowSpellingPanel:
+        frame->editor()->showSpellingGuessPanel();
+        break;
+    case ContextMenuItemTagCheckSpelling:
+        frame->editor()->advanceToNextMisspelling();
+        break;
+    case ContextMenuItemTagCheckSpellingWhileTyping:
+        frame->editor()->toggleContinuousSpellChecking();
+        break;
 #ifndef BUILDING_ON_TIGER
-        case ContextMenuItemTagCheckGrammarWithSpelling:
-            frame->editor()->toggleGrammarChecking();
-            break;
+    case ContextMenuItemTagCheckGrammarWithSpelling:
+        frame->editor()->toggleGrammarChecking();
+        break;
 #endif
 #if PLATFORM(MAC)
-        case ContextMenuItemTagShowFonts:
-            frame->editor()->showFontPanel();
-            break;
-        case ContextMenuItemTagStyles:
-            frame->editor()->showStylesPanel();
-            break;
-        case ContextMenuItemTagShowColors:
-            frame->editor()->showColorPanel();
-            break;
+    case ContextMenuItemTagShowFonts:
+        frame->editor()->showFontPanel();
+        break;
+    case ContextMenuItemTagStyles:
+        frame->editor()->showStylesPanel();
+        break;
+    case ContextMenuItemTagShowColors:
+        frame->editor()->showColorPanel();
+        break;
 #endif
 #if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
-        case ContextMenuItemTagMakeUpperCase:
-            frame->editor()->uppercaseWord();
-            break;
-        case ContextMenuItemTagMakeLowerCase:
-            frame->editor()->lowercaseWord();
-            break;
-        case ContextMenuItemTagCapitalize:
-            frame->editor()->capitalizeWord();
-            break;
-        case ContextMenuItemTagShowSubstitutions:
-            frame->editor()->showSubstitutionsPanel();
-            break;
-        case ContextMenuItemTagSmartCopyPaste:
-            frame->editor()->toggleSmartInsertDelete();
-            break;
-        case ContextMenuItemTagSmartQuotes:
-            frame->editor()->toggleAutomaticQuoteSubstitution();
-            break;
-        case ContextMenuItemTagSmartDashes:
-            frame->editor()->toggleAutomaticDashSubstitution();
-            break;
-        case ContextMenuItemTagSmartLinks:
-            frame->editor()->toggleAutomaticLinkDetection();
-            break;
-        case ContextMenuItemTagTextReplacement:
-            frame->editor()->toggleAutomaticTextReplacement();
-            break;
-        case ContextMenuItemTagCorrectSpellingAutomatically:
-            frame->editor()->toggleAutomaticSpellingCorrection();
-            break;
-        case ContextMenuItemTagChangeBack:
-            frame->editor()->changeBackToReplacedString(result.replacedString());
-            break;
+    case ContextMenuItemTagMakeUpperCase:
+        frame->editor()->uppercaseWord();
+        break;
+    case ContextMenuItemTagMakeLowerCase:
+        frame->editor()->lowercaseWord();
+        break;
+    case ContextMenuItemTagCapitalize:
+        frame->editor()->capitalizeWord();
+        break;
+    case ContextMenuItemTagShowSubstitutions:
+        frame->editor()->showSubstitutionsPanel();
+        break;
+    case ContextMenuItemTagSmartCopyPaste:
+        frame->editor()->toggleSmartInsertDelete();
+        break;
+    case ContextMenuItemTagSmartQuotes:
+        frame->editor()->toggleAutomaticQuoteSubstitution();
+        break;
+    case ContextMenuItemTagSmartDashes:
+        frame->editor()->toggleAutomaticDashSubstitution();
+        break;
+    case ContextMenuItemTagSmartLinks:
+        frame->editor()->toggleAutomaticLinkDetection();
+        break;
+    case ContextMenuItemTagTextReplacement:
+        frame->editor()->toggleAutomaticTextReplacement();
+        break;
+    case ContextMenuItemTagCorrectSpellingAutomatically:
+        frame->editor()->toggleAutomaticSpellingCorrection();
+        break;
+    case ContextMenuItemTagChangeBack:
+        frame->editor()->changeBackToReplacedString(result.replacedString());
+        break;
+#endif
+#if ENABLE(INSPECTOR)
+    case ContextMenuItemTagInspectElement:
+        if (Page* page = frame->page())
+            page->inspectorController()->inspect(result.innerNonSharedNode());
+        break;
 #endif
-        case ContextMenuItemTagInspectElement:
-            if (Page* page = frame->page())
-                page->inspectorController()->inspect(result.innerNonSharedNode());
-            break;
-        default:
-            break;
+    default:
+        break;
     }
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(CONTEXT_MENUS)
diff --git a/src/3rdparty/webkit/WebCore/page/Coordinates.h b/src/3rdparty/webkit/WebCore/page/Coordinates.h
index acb5dd0..50003ce 100644
--- a/src/3rdparty/webkit/WebCore/page/Coordinates.h
+++ b/src/3rdparty/webkit/WebCore/page/Coordinates.h
@@ -51,8 +51,6 @@ public:
     bool canProvideHeading() const { return m_canProvideHeading; }
     bool canProvideSpeed() const { return m_canProvideSpeed; }
     
-    String toString() const;
-
 private:
     Coordinates(double latitude, double longitude, bool providesAltitude, double altitude, double accuracy, bool providesAltitudeAccuracy, double altitudeAccuracy, bool providesHeading, double heading, bool providesSpeed, double speed)
         : m_latitude(latitude)
diff --git a/src/3rdparty/webkit/WebCore/page/Coordinates.idl b/src/3rdparty/webkit/WebCore/page/Coordinates.idl
index f6c82b5..f847325 100644
--- a/src/3rdparty/webkit/WebCore/page/Coordinates.idl
+++ b/src/3rdparty/webkit/WebCore/page/Coordinates.idl
@@ -33,9 +33,5 @@ module core {
         readonly attribute [Custom] double altitudeAccuracy;
         readonly attribute [Custom] double heading;
         readonly attribute [Custom] double speed;
-
-#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-        [DontEnum] DOMString toString();
-#endif
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/page/DOMSelection.cpp b/src/3rdparty/webkit/WebCore/page/DOMSelection.cpp
index 23c695e..0d21c56 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMSelection.cpp
+++ b/src/3rdparty/webkit/WebCore/page/DOMSelection.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -41,6 +41,17 @@
 
 namespace WebCore {
 
+static Node* selectionShadowAncestor(Frame* frame)
+{
+    Node* node = frame->selection()->selection().base().anchorNode();
+    if (!node)
+        return 0;
+    Node* shadowAncestor = node->shadowAncestorNode();
+    if (shadowAncestor == node)
+        return 0;
+    return shadowAncestor;
+}
+
 DOMSelection::DOMSelection(Frame* frame)
     : m_frame(frame)
 {
@@ -88,6 +99,8 @@ Node* DOMSelection::anchorNode() const
 {
     if (!m_frame)
         return 0;
+    if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
+        return shadowAncestor->parentNode();
     return anchorPosition(visibleSelection()).node();
 }
 
@@ -95,6 +108,8 @@ int DOMSelection::anchorOffset() const
 {
     if (!m_frame)
         return 0;
+    if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
+        return shadowAncestor->nodeIndex();
     return anchorPosition(visibleSelection()).deprecatedEditingOffset();
 }
 
@@ -102,6 +117,8 @@ Node* DOMSelection::focusNode() const
 {
     if (!m_frame)
         return 0;
+    if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
+        return shadowAncestor->parentNode();
     return focusPosition(visibleSelection()).node();
 }
 
@@ -109,6 +126,8 @@ int DOMSelection::focusOffset() const
 {
     if (!m_frame)
         return 0;
+    if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
+        return shadowAncestor->nodeIndex();
     return focusPosition(visibleSelection()).deprecatedEditingOffset();
 }
 
@@ -116,6 +135,8 @@ Node* DOMSelection::baseNode() const
 {
     if (!m_frame)
         return 0;
+    if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
+        return shadowAncestor->parentNode();
     return basePosition(visibleSelection()).node();
 }
 
@@ -123,14 +144,17 @@ int DOMSelection::baseOffset() const
 {
     if (!m_frame)
         return 0;
+    if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
+        return shadowAncestor->nodeIndex();
     return basePosition(visibleSelection()).deprecatedEditingOffset();
 }
 
-
 Node* DOMSelection::extentNode() const
 {
     if (!m_frame)
         return 0;
+    if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
+        return shadowAncestor->parentNode();
     return extentPosition(visibleSelection()).node();
 }
 
@@ -138,13 +162,15 @@ int DOMSelection::extentOffset() const
 {
     if (!m_frame)
         return 0;
+    if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
+        return shadowAncestor->nodeIndex();
     return extentPosition(visibleSelection()).deprecatedEditingOffset();
 }
 
 bool DOMSelection::isCollapsed() const
 {
-    if (!m_frame)
-        return false;
+    if (!m_frame || selectionShadowAncestor(m_frame))
+        return true;
     return !m_frame->selection()->isRange();
 }
 
@@ -206,7 +232,7 @@ void DOMSelection::empty()
 {
     if (!m_frame)
         return;
-    m_frame->selection()->moveTo(VisiblePosition());
+    m_frame->selection()->clear();
 }
 
 void DOMSelection::setBaseAndExtent(Node* baseNode, int baseOffset, Node* extentNode, int extentOffset, ExceptionCode& ec)
@@ -317,6 +343,12 @@ PassRefPtr<Range> DOMSelection::getRangeAt(int index, ExceptionCode& ec)
     // If you're hitting this, you've added broken multi-range selection support
     ASSERT(rangeCount() == 1);
 
+    if (Node* shadowAncestor = selectionShadowAncestor(m_frame)) {
+        Node* container = shadowAncestor->parentNode();
+        int offset = shadowAncestor->nodeIndex();
+        return Range::create(shadowAncestor->document(), container, offset, container, offset);
+    }
+
     const VisibleSelection& selection = m_frame->selection()->selection();
     return selection.firstRange();
 }
diff --git a/src/3rdparty/webkit/WebCore/page/DOMTimer.cpp b/src/3rdparty/webkit/WebCore/page/DOMTimer.cpp
index c42a0dc..dd1e842 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMTimer.cpp
+++ b/src/3rdparty/webkit/WebCore/page/DOMTimer.cpp
@@ -47,6 +47,9 @@ DOMTimer::DOMTimer(ScriptExecutionContext* context, ScheduledAction* action, int
     , m_action(action)
     , m_nextFireInterval(0)
     , m_repeatInterval(0)
+#if !ASSERT_DISABLED
+    , m_suspended(false)
+#endif
 {
     static int lastUsedTimeoutId = 0;
     ++lastUsedTimeoutId;
@@ -148,7 +151,10 @@ void DOMTimer::stop()
 
 void DOMTimer::suspend()
 {
-    ASSERT(!m_nextFireInterval && !m_repeatInterval);
+#if !ASSERT_DISABLED
+    ASSERT(!m_suspended);
+    m_suspended = true;
+#endif
     m_nextFireInterval = nextFireInterval();
     m_repeatInterval = repeatInterval();
     TimerBase::stop();
@@ -156,9 +162,11 @@ void DOMTimer::suspend()
 
 void DOMTimer::resume()
 {
+#if !ASSERT_DISABLED
+    ASSERT(m_suspended);
+    m_suspended = false;
+#endif
     start(m_nextFireInterval, m_repeatInterval);
-    m_nextFireInterval = 0;
-    m_repeatInterval = 0;
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/page/DOMTimer.h b/src/3rdparty/webkit/WebCore/page/DOMTimer.h
index 6d6271f..3c65258 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMTimer.h
+++ b/src/3rdparty/webkit/WebCore/page/DOMTimer.h
@@ -66,6 +66,9 @@ namespace WebCore {
         OwnPtr<ScheduledAction> m_action;
         double m_nextFireInterval;
         double m_repeatInterval;
+#if !ASSERT_DISABLED
+        bool m_suspended;
+#endif
         static double s_minTimerInterval;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp b/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
index c54aab2..783f93d 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
+++ b/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
@@ -36,6 +36,7 @@
 #include "Console.h"
 #include "DOMSelection.h"
 #include "DOMTimer.h"
+#include "PageTransitionEvent.h"
 #include "Document.h"
 #include "Element.h"
 #include "EventException.h"
@@ -51,6 +52,7 @@
 #include "History.h"
 #include "InspectorController.h"
 #include "Location.h"
+#include "Media.h"
 #include "MessageEvent.h"
 #include "Navigator.h"
 #include "Page.h"
@@ -79,6 +81,10 @@
 #include "DOMApplicationCache.h"
 #endif
 
+#if ENABLE(NOTIFICATIONS)
+#include "NotificationCenter.h"
+#endif
+
 using std::min;
 using std::max;
 
@@ -86,24 +92,20 @@ namespace WebCore {
 
 class PostMessageTimer : public TimerBase {
 public:
-    PostMessageTimer(DOMWindow* window, const String& message, const String& sourceOrigin, PassRefPtr<DOMWindow> source, PassOwnPtr<MessagePortChannel> channel, SecurityOrigin* targetOrigin)
+    PostMessageTimer(DOMWindow* window, const String& message, const String& sourceOrigin, PassRefPtr<DOMWindow> source, PassOwnPtr<MessagePortChannelArray> channels, SecurityOrigin* targetOrigin)
         : m_window(window)
         , m_message(message)
         , m_origin(sourceOrigin)
         , m_source(source)
-        , m_channel(channel)
+        , m_channels(channels)
         , m_targetOrigin(targetOrigin)
     {
     }
 
     PassRefPtr<MessageEvent> event(ScriptExecutionContext* context)
     {
-        RefPtr<MessagePort> messagePort;
-        if (m_channel) {
-            messagePort = MessagePort::create(*context);
-            messagePort->entangle(m_channel.release());
-        }
-        return MessageEvent::create(m_message, m_origin, "", m_source, messagePort.release());
+        OwnPtr<MessagePortArray> messagePorts = MessagePort::entanglePorts(*context, m_channels.release());
+        return MessageEvent::create(m_message, m_origin, "", m_source, messagePorts.release());
     }
     SecurityOrigin* targetOrigin() const { return m_targetOrigin.get(); }
 
@@ -117,7 +119,7 @@ private:
     String m_message;
     String m_origin;
     RefPtr<DOMWindow> m_source;
-    OwnPtr<MessagePortChannel> m_channel;
+    OwnPtr<MessagePortChannelArray> m_channels;
     RefPtr<SecurityOrigin> m_targetOrigin;
 };
 
@@ -259,6 +261,7 @@ void DOMWindow::dispatchAllPendingUnloadEvents()
         if (!listeners)
             continue;
         RegisteredEventListenerVector listenersCopy = *listeners;
+        window->dispatchPageTransitionEvent(EventNames().pagehideEvent, false);
         window->dispatchUnloadEvent(&listenersCopy);
     }
 
@@ -453,6 +456,10 @@ void DOMWindow::clear()
         m_applicationCache->disconnectFrame();
     m_applicationCache = 0;
 #endif
+
+#if ENABLE(NOTIFICATIONS)
+    m_notifications = 0;
+#endif
 }
 
 Screen* DOMWindow::screen() const
@@ -559,7 +566,9 @@ Storage* DOMWindow::sessionStorage() const
         return 0;
 
     RefPtr<StorageArea> storageArea = page->sessionStorage()->storageArea(document->securityOrigin());
+#if ENABLE(INSPECTOR)
     page->inspectorController()->didUseDOMStorage(storageArea.get(), false, m_frame);
+#endif
 
     m_sessionStorage = Storage::create(m_frame, storageArea.release());
     return m_sessionStorage.get();
@@ -582,9 +591,11 @@ Storage* DOMWindow::localStorage() const
         return 0;
 
     StorageNamespace* localStorage = page->group().localStorage();
-    RefPtr<StorageArea> storageArea = localStorage ? localStorage->storageArea(document->securityOrigin()) : PassRefPtr<StorageArea>(0);
+    RefPtr<StorageArea> storageArea = localStorage ? localStorage->storageArea(document->securityOrigin()) : 0; 
     if (storageArea) {
+#if ENABLE(INSPECTOR)
         page->inspectorController()->didUseDOMStorage(storageArea.get(), true, m_frame);
+#endif
         m_localStorage = Storage::create(m_frame, storageArea.release());
     }
 
@@ -592,7 +603,37 @@ Storage* DOMWindow::localStorage() const
 }
 #endif
 
-void DOMWindow::postMessage(const String& message, MessagePort* messagePort, const String& targetOrigin, DOMWindow* source, ExceptionCode& ec)
+#if ENABLE(NOTIFICATIONS)
+NotificationCenter* DOMWindow::webkitNotifications() const
+{
+    if (m_notifications)
+        return m_notifications.get();
+
+    Document* document = this->document();
+    if (!document)
+        return 0;
+    
+    Page* page = document->page();
+    if (!page)
+        return 0;
+
+    NotificationPresenter* provider = page->chrome()->notificationPresenter();
+    if (provider) 
+        m_notifications = NotificationCenter::create(document, provider);    
+      
+    return m_notifications.get();
+}
+#endif
+
+void DOMWindow::postMessage(const String& message, MessagePort* port, const String& targetOrigin, DOMWindow* source, ExceptionCode& ec)
+{
+    MessagePortArray ports;
+    if (port)
+        ports.append(port);
+    postMessage(message, &ports, targetOrigin, source, ec);
+}
+
+void DOMWindow::postMessage(const String& message, const MessagePortArray* ports, const String& targetOrigin, DOMWindow* source, ExceptionCode& ec)
 {
     if (!m_frame)
         return;
@@ -608,9 +649,7 @@ void DOMWindow::postMessage(const String& message, MessagePort* messagePort, con
         }
     }
 
-    OwnPtr<MessagePortChannel> channel;
-    if (messagePort)
-        channel = messagePort->disentangle(ec);
+    OwnPtr<MessagePortChannelArray> channels = MessagePort::disentanglePorts(ports, ec);
     if (ec)
         return;
 
@@ -622,7 +661,7 @@ void DOMWindow::postMessage(const String& message, MessagePort* messagePort, con
     String sourceOrigin = sourceDocument->securityOrigin()->toString();
 
     // Schedule the message.
-    PostMessageTimer* timer = new PostMessageTimer(this, message, sourceOrigin, source, channel.release(), target.get());
+    PostMessageTimer* timer = new PostMessageTimer(this, message, sourceOrigin, source, channels.release(), target.get());
     timer->startOneShot(0);
 }
 
@@ -1002,6 +1041,11 @@ Document* DOMWindow::document() const
     return m_frame->document();
 }
 
+PassRefPtr<Media> DOMWindow::media() const
+{
+    return Media::create(const_cast<DOMWindow*>(this));
+}
+
 PassRefPtr<CSSStyleDeclaration> DOMWindow::getComputedStyle(Element* elt, const String&) const
 {
     if (!elt)
@@ -1239,7 +1283,7 @@ void DOMWindow::removeEventListener(const AtomicString& eventType, EventListener
     size_t size = m_eventListeners.size();
     for (size_t i = 0; i < size; ++i) {
         RegisteredEventListener& r = *m_eventListeners[i];
-        if (r.eventType() == eventType && r.listener() == listener && r.useCapture() == useCapture) {
+        if (r.eventType() == eventType && r.useCapture() == useCapture && *r.listener() == *listener) {
             if (eventType == eventNames().unloadEvent)
                 removePendingEventListener(pendingUnloadEventListenerMap(), this, &r);
             else if (eventType == eventNames().beforeunloadEvent && allowsPendingBeforeUnloadListeners(this))
@@ -1323,6 +1367,11 @@ PassRefPtr<BeforeUnloadEvent> DOMWindow::dispatchBeforeUnloadEvent(RegisteredEve
     return beforeUnloadEvent.release();
 }
 
+void DOMWindow::dispatchPageTransitionEvent(const AtomicString& eventType, bool persisted)
+{
+    dispatchEventWithDocumentAsTarget(PageTransitionEvent::create(eventType, persisted));
+}
+
 void DOMWindow::removeAllEventListeners()
 {
     size_t size = m_eventListeners.size();
@@ -1519,6 +1568,16 @@ void DOMWindow::setOnfocus(PassRefPtr<EventListener> eventListener)
     setAttributeEventListener(eventNames().focusEvent, eventListener);
 }
 
+EventListener* DOMWindow::onhashchange() const
+{
+    return getAttributeEventListener(eventNames().hashchangeEvent);
+}
+
+void DOMWindow::setOnhashchange(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().hashchangeEvent, eventListener);
+}
+
 EventListener* DOMWindow::onkeydown() const
 {
     return getAttributeEventListener(eventNames().keydownEvent);
@@ -1639,6 +1698,26 @@ void DOMWindow::setOnonline(PassRefPtr<EventListener> eventListener)
     setAttributeEventListener(eventNames().onlineEvent, eventListener);
 }
 
+EventListener* DOMWindow::onpagehide() const
+{
+    return getAttributeEventListener(eventNames().pagehideEvent);
+}
+
+void DOMWindow::setOnpagehide(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().pagehideEvent, eventListener);
+}
+
+EventListener* DOMWindow::onpageshow() const
+{
+    return getAttributeEventListener(eventNames().pageshowEvent);
+}
+
+void DOMWindow::setOnpageshow(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().pageshowEvent, eventListener);
+}
+
 EventListener* DOMWindow::onreset() const
 {
     return getAttributeEventListener(eventNames().resetEvent);
@@ -1999,6 +2078,16 @@ void DOMWindow::setOncontextmenu(PassRefPtr<EventListener> eventListener)
     setAttributeEventListener(eventNames().contextmenuEvent, eventListener);
 }
 
+EventListener* DOMWindow::oninvalid() const
+{
+    return getAttributeEventListener(eventNames().invalidEvent);
+}
+
+void DOMWindow::setOninvalid(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().invalidEvent, eventListener);
+}
+
 void DOMWindow::captureEvents()
 {
     // Not implemented.
diff --git a/src/3rdparty/webkit/WebCore/page/DOMWindow.h b/src/3rdparty/webkit/WebCore/page/DOMWindow.h
index eac936f..db4edda 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMWindow.h
+++ b/src/3rdparty/webkit/WebCore/page/DOMWindow.h
@@ -28,6 +28,7 @@
 
 #include "EventTarget.h"
 #include "KURL.h"
+#include "MessagePort.h"
 #include "PlatformString.h"
 #include "RegisteredEventListener.h"
 #include "SecurityOrigin.h"
@@ -52,9 +53,10 @@ namespace WebCore {
     class Frame;
     class History;
     class Location;
-    class MessagePort;
+    class Media;
     class Navigator;
     class Node;
+    class NotificationCenter;
     class PostMessageTimer;
     class ScheduledAction;
     class Screen;
@@ -171,6 +173,8 @@ namespace WebCore {
 
         // DOM Level 2 AbstractView Interface
         Document* document() const;
+        // CSSOM View Module
+        PassRefPtr<Media> media() const;
 
         // DOM Level 2 Style Interface
         PassRefPtr<CSSStyleDeclaration> getComputedStyle(Element*, const String& pseudoElt) const;
@@ -199,6 +203,12 @@ namespace WebCore {
         DOMApplicationCache* applicationCache() const;
 #endif
 
+#if ENABLE(NOTIFICATIONS)
+        NotificationCenter* webkitNotifications() const;
+#endif
+
+        void postMessage(const String& message, const MessagePortArray*, const String& targetOrigin, DOMWindow* source, ExceptionCode&);
+        // FIXME: remove this when we update the ObjC bindings (bug #28774).
         void postMessage(const String& message, MessagePort*, const String& targetOrigin, DOMWindow* source, ExceptionCode&);
         void postMessageTimerFired(PostMessageTimer*);
 
@@ -230,6 +240,7 @@ namespace WebCore {
         void dispatchLoadEvent();
         void dispatchUnloadEvent(RegisteredEventListenerVector* = 0);
         PassRefPtr<BeforeUnloadEvent> dispatchBeforeUnloadEvent(RegisteredEventListenerVector* = 0);
+        void dispatchPageTransitionEvent(const AtomicString& eventType, bool persisted);
 
         // Used for legacy "onEvent" property APIs.
         void setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener>);
@@ -268,6 +279,8 @@ namespace WebCore {
         void setOnerror(PassRefPtr<EventListener>);
         EventListener* onfocus() const;
         void setOnfocus(PassRefPtr<EventListener>);
+        EventListener* onhashchange() const;
+        void setOnhashchange(PassRefPtr<EventListener>);
         EventListener* onkeydown() const;
         void setOnkeydown(PassRefPtr<EventListener>);
         EventListener* onkeypress() const;
@@ -292,6 +305,10 @@ namespace WebCore {
         void setOnoffline(PassRefPtr<EventListener>);
         EventListener* ononline() const;
         void setOnonline(PassRefPtr<EventListener>);
+        EventListener* onpagehide() const;
+        void setOnpagehide(PassRefPtr<EventListener>);
+        EventListener* onpageshow() const;
+        void setOnpageshow(PassRefPtr<EventListener>);
         EventListener* onreset() const;
         void setOnreset(PassRefPtr<EventListener>);
         EventListener* onresize() const;
@@ -364,11 +381,13 @@ namespace WebCore {
         void setOnmessage(PassRefPtr<EventListener>);
         EventListener* oncontextmenu() const;
         void setOncontextmenu(PassRefPtr<EventListener>);
+        EventListener* oninvalid() const;
+        void setOninvalid(PassRefPtr<EventListener>);
 
         void captureEvents();
         void releaseEvents();
 
-        // These methods are used for GC marking. See JSDOMWindow::mark() in
+        // These methods are used for GC marking. See JSDOMWindow::markChildren(MarkStack&) in
         // JSDOMWindowCustom.cpp.
         Screen* optionalScreen() const { return m_screen.get(); }
         DOMSelection* optionalSelection() const { return m_selection.get(); }
@@ -424,6 +443,9 @@ namespace WebCore {
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
         mutable RefPtr<DOMApplicationCache> m_applicationCache;
 #endif
+#if ENABLE(NOTIFICATIONS)
+        mutable RefPtr<NotificationCenter> m_notifications;
+#endif
 
         RegisteredEventListenerVector m_eventListeners;
     };
diff --git a/src/3rdparty/webkit/WebCore/page/DOMWindow.idl b/src/3rdparty/webkit/WebCore/page/DOMWindow.idl
index e1c9ff0..dcd83d9 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMWindow.idl
+++ b/src/3rdparty/webkit/WebCore/page/DOMWindow.idl
@@ -55,7 +55,7 @@ module window {
         attribute [Replaceable] Navigator clientInformation;
         attribute [DoNotCheckDomainSecurity, JSCCustom, V8CustomSetter, V8DisallowShadowing] Location location;
 
-        attribute [Replaceable, CustomGetter] Event event;
+        attribute [Replaceable, CustomGetter, V8CustomSetter] Event event;
 
         readonly attribute [Custom] Crypto crypto;
 
@@ -74,7 +74,7 @@ module window {
                                 in DOMString name,
                                 in [Optional] DOMString options);
 
-        [Custom] DOMObject showModalDialog(in DOMString url, 
+        [Custom] DOMObject showModalDialog(in DOMString url,
                                            in [Optional] DOMObject dialogArgs,
                                            in [Optional] DOMString featureArgs);
 
@@ -139,6 +139,9 @@ module window {
         // DOM Level 2 AbstractView Interface
         readonly attribute Document document;
 
+        // CSSOM View Module
+        readonly attribute Media media;
+
         // DOM Level 2 Style Interface
         CSSStyleDeclaration getComputedStyle(in Element element,
                                              in DOMString pseudoElement);
@@ -163,12 +166,21 @@ module window {
         readonly attribute Storage sessionStorage;
         readonly attribute Storage localStorage;
 #endif
+#if defined(ENABLE_NOTIFICATIONS) && ENABLE_NOTIFICATIONS
+        readonly attribute NotificationCenter webkitNotifications;
+#endif
 
                  attribute [Replaceable] Console console;
 
         // cross-document messaging
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
+        [DoNotCheckDomainSecurity, Custom] void postMessage(in DOMString message, in [Optional] Array messagePorts, in DOMString targetOrigin)
+            raises(DOMException);
+#else
+        // There's no good way to expose an array via the ObjC bindings, so for now just allow passing in a single port.
         [DoNotCheckDomainSecurity, Custom] void postMessage(in DOMString message, in [Optional] MessagePort messagePort, in DOMString targetOrigin)
             raises(DOMException);
+#endif
 
         // Timers
         [Custom] long setTimeout(in TimeoutHandler handler, in long timeout);
@@ -208,7 +220,9 @@ module window {
         attribute EventListener onended;
         attribute EventListener onerror;
         attribute EventListener onfocus;
+        attribute EventListener onhashchange;
         attribute EventListener oninput;
+        attribute EventListener oninvalid;
         attribute EventListener onkeydown;
         attribute EventListener onkeypress;
         attribute EventListener onkeyup;
@@ -225,6 +239,8 @@ module window {
         attribute EventListener onmousewheel;
         attribute EventListener onoffline;
         attribute EventListener ononline;
+        attribute EventListener onpagehide;
+        attribute EventListener onpageshow;
         attribute EventListener onpause;
         attribute EventListener onplay;
         attribute EventListener onplaying;
@@ -250,7 +266,6 @@ module window {
         // attribute EventListener onformchange;
         // attribute EventListener onforminput;
         // attribute EventListener onhashchange;
-        // attribute EventListener oninvalid;
         // attribute EventListener onpopstate;
         // attribute EventListener onreadystatechange;
         // attribute EventListener onredo;
@@ -406,13 +421,24 @@ module window {
         attribute [CustomGetter] HTMLOptionElementConstructor Option; // Usable with new operator
 
         attribute CanvasRenderingContext2DConstructor CanvasRenderingContext2D;
+        attribute [Conditional=3D_CANVAS] CanvasRenderingContext3DConstructor CanvasRenderingContext3D;
         attribute TextMetricsConstructor TextMetrics;
 
+        attribute [CustomGetter,Conditional=3D_CANVAS] CanvasArrayBufferConstructor CanvasArrayBuffer; // Usable with new operator
+        attribute [CustomGetter,Conditional=3D_CANVAS] CanvasByteArrayConstructor CanvasByteArray; // Usable with new operator
+        attribute [CustomGetter,Conditional=3D_CANVAS] CanvasUnsignedByteArrayConstructor CanvasUnsignedByteArray; // Usable with new operator
+        attribute [CustomGetter,Conditional=3D_CANVAS] CanvasShortArrayConstructor CanvasShortArray; // Usable with new operator
+        attribute [CustomGetter,Conditional=3D_CANVAS] CanvasUnsignedShortArrayConstructor CanvasUnsignedShortArray; // Usable with new operator
+        attribute [CustomGetter,Conditional=3D_CANVAS] CanvasIntArrayConstructor CanvasIntArray; // Usable with new operator
+        attribute [CustomGetter,Conditional=3D_CANVAS] CanvasUnsignedIntArrayConstructor CanvasUnsignedIntArray; // Usable with new operator
+        attribute [CustomGetter,Conditional=3D_CANVAS] CanvasFloatArrayConstructor CanvasFloatArray; // Usable with new operator
+
         attribute EventConstructor Event;
         attribute KeyboardEventConstructor KeyboardEvent;
         attribute MouseEventConstructor MouseEvent;
         attribute MutationEventConstructor MutationEvent;
         attribute OverflowEventConstructor OverflowEvent;
+        attribute PageTransitionEventConstructor PageTransitionEvent;
         attribute ProgressEventConstructor ProgressEvent;
         attribute TextEventConstructor TextEvent;
         attribute UIEventConstructor UIEvent;
@@ -438,6 +464,10 @@ module window {
         attribute RangeConstructor Range;
         attribute RangeExceptionConstructor RangeException;
 
+#if ENABLE_EVENTSOURCE
+        attribute [JSCCustomGetter] EventSourceConstructor EventSource; // Usable with new the operator
+#endif
+
         // Mozilla has a separate XMLDocument object for XML documents. 
         // We just use Document for this.
         attribute DocumentConstructor XMLDocument;
@@ -466,6 +496,10 @@ module window {
         attribute [JSCCustomGetter] SharedWorkerConstructor SharedWorker; // Usable with the new operator
 #endif
 
+#if defined(ENABLE_WEB_SOCKETS) && ENABLE_WEB_SOCKETS
+        attribute [JSCCustomGetter] WebSocketConstructor WebSocket; // Usable with the new operator
+#endif
+
         attribute PluginConstructor Plugin;
         attribute PluginArrayConstructor PluginArray;
 
diff --git a/src/3rdparty/webkit/WebCore/page/DragController.cpp b/src/3rdparty/webkit/WebCore/page/DragController.cpp
index 64cb212..676c6d9 100644
--- a/src/3rdparty/webkit/WebCore/page/DragController.cpp
+++ b/src/3rdparty/webkit/WebCore/page/DragController.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "DragController.h"
 
+#if ENABLE(DRAG_SUPPORT)
 #include "CSSStyleDeclaration.h"
 #include "Clipboard.h"
 #include "ClipboardAccessPolicy.h"
@@ -107,7 +108,7 @@ static PassRefPtr<DocumentFragment> documentFragmentFromDragData(DragData* dragD
             String title;
             String url = dragData->asURL(&title);
             if (!url.isEmpty()) {
-                RefPtr<HTMLAnchorElement> anchor = new HTMLAnchorElement(document);
+                RefPtr<HTMLAnchorElement> anchor = HTMLAnchorElement::create(document);
                 anchor->setHref(url);
                 ExceptionCode ec;
                 RefPtr<Node> anchorText = document->createTextNode(title);
@@ -281,9 +282,7 @@ bool DragController::tryDocumentDrag(DragData* dragData, DragDestinationAction a
     if (m_isHandlingDrag) {
         m_page->dragCaretController()->clear();
         return true;
-    }
-
-    if ((actionMask & DragDestinationActionEdit) && !m_isHandlingDrag && canProcessDrag(dragData)) {
+    } else if ((actionMask & DragDestinationActionEdit) && canProcessDrag(dragData)) {
         if (dragData->containsColor()) {
             operation = DragOperationGeneric;
             return true;
@@ -302,6 +301,8 @@ bool DragController::tryDocumentDrag(DragData* dragData, DragDestinationAction a
         operation = dragIsMove(innerFrame->selection()) ? DragOperationMove : DragOperationCopy;
         return true;
     }
+    // If we're not over an editable region, make sure we're clearing any prior drag cursor.
+    m_page->dragCaretController()->clear();
     return false;
 }
 
@@ -379,11 +380,10 @@ bool DragController::concludeEditDrag(DragData* dragData)
         if (filenames.isEmpty())
             return false;
 
-        // Ugly.  For security none of the API's available to us to set the input value
-        // on file inputs.  Even forcing a change in HTMLInputElement doesn't work as
-        // RenderFileUploadControl clears the file when doing updateFromElement()
-        RenderFileUploadControl* renderer = static_cast<RenderFileUploadControl*>(fileInput->renderer());
-
+        // Ugly. For security none of the APIs available to us can set the input value
+        // on file inputs. Even forcing a change in HTMLInputElement doesn't work as
+        // RenderFileUploadControl clears the file when doing updateFromElement().
+        RenderFileUploadControl* renderer = toRenderFileUploadControl(fileInput->renderer());
         if (!renderer)
             return false;
 
@@ -786,3 +786,5 @@ void DragController::placeDragCaret(const IntPoint& windowPoint)
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(DRAG_SUPPORT)
diff --git a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
index 547485c..abe40c7 100644
--- a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
+++ b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
@@ -78,6 +78,7 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+#if ENABLE(DRAG_SUPPORT)
 // The link drag hysteresis is much larger than the others because there
 // needs to be enough space to cancel the link press without starting a link drag,
 // and because dragging links is rare.
@@ -85,6 +86,7 @@ const int LinkDragHysteresis = 40;
 const int ImageDragHysteresis = 5;
 const int TextDragHysteresis = 3;
 const int GeneralDragHysteresis = 3;
+#endif // ENABLE(DRAG_SUPPORT)
 
 // Match key code of composition keydown event on windows.
 // IE sends VK_PROCESSKEY which has value 229;
@@ -97,7 +99,6 @@ using namespace SVGNames;
 // When the autoscroll or the panScroll is triggered when do the scroll every 0.05s to make it smooth
 const double autoscrollInterval = 0.05;
 
-static Frame* subframeForTargetNode(Node*);
 static Frame* subframeForHitTestResult(const MouseEventWithHitTestResults&);
 
 static inline void scrollAndAcceptEvent(float delta, ScrollDirection positiveDirection, ScrollDirection negativeDirection, PlatformWheelEvent& e, Node* node)
@@ -137,7 +138,9 @@ EventHandler::EventHandler(Frame* frame)
     , m_mousePressed(false)
     , m_capturesDragging(false)
     , m_mouseDownMayStartSelect(false)
+#if ENABLE(DRAG_SUPPORT)
     , m_mouseDownMayStartDrag(false)
+#endif
     , m_mouseDownWasSingleClickInSelection(false)
     , m_beganSelectingText(false)
     , m_panScrollInProgress(false)
@@ -170,11 +173,13 @@ EventHandler::~EventHandler()
 {
 }
     
+#if ENABLE(DRAG_SUPPORT)
 EventHandler::EventHandlerDragState& EventHandler::dragState()
 {
     DEFINE_STATIC_LOCAL(EventHandlerDragState, state, ());
     return state;
 }
+#endif // ENABLE(DRAG_SUPPORT)
     
 void EventHandler::clear()
 {
@@ -191,7 +196,9 @@ void EventHandler::clear()
     m_clickCount = 0;
     m_clickNode = 0;
     m_frameSetBeingResized = 0;
+#if ENABLE(DRAG_SUPPORT)
     m_dragTarget = 0;
+#endif
     m_currentMousePosition = IntPoint();
     m_mousePressNode = 0;
     m_mousePressed = false;
@@ -345,8 +352,10 @@ bool EventHandler::handleMousePressEventSingleClick(const MouseEventWithHitTestR
 
 bool EventHandler::handleMousePressEvent(const MouseEventWithHitTestResults& event)
 {
+#if ENABLE(DRAG_SUPPORT)
     // Reset drag state.
     dragState().m_dragSrc = 0;
+#endif
 
     if (ScrollView* scrollView = m_frame->view()) {
         if (scrollView->isPointInScrollbarCorner(event.event().pos()))
@@ -359,8 +368,10 @@ bool EventHandler::handleMousePressEvent(const MouseEventWithHitTestResults& eve
     // so it's allowed to start a drag or selection.
     m_mouseDownMayStartSelect = canMouseDownStartSelect(event.targetNode());
     
+#if ENABLE(DRAG_SUPPORT)
     // Careful that the drag starting logic stays in sync with eventMayStartDrag()
     m_mouseDownMayStartDrag = singleClick;
+#endif
 
     m_mouseDownWasSingleClickInSelection = false;
 
@@ -388,7 +399,9 @@ bool EventHandler::handleMousePressEvent(const MouseEventWithHitTestResults& eve
     Node* innerNode = event.targetNode();
 
     m_mousePressNode = innerNode;
+#if ENABLE(DRAG_SUPPORT)
     m_dragStartPos = event.event().pos();
+#endif
 
     bool swallowEvent = false;
     m_frame->selection()->setCaretBlinkingSuspended(true);
@@ -408,6 +421,7 @@ bool EventHandler::handleMousePressEvent(const MouseEventWithHitTestResults& eve
     return swallowEvent;
 }
 
+#if ENABLE(DRAG_SUPPORT)
 bool EventHandler::handleMouseDraggedEvent(const MouseEventWithHitTestResults& event)
 {
     if (handleDrag(event))
@@ -430,7 +444,7 @@ bool EventHandler::handleMouseDraggedEvent(const MouseEventWithHitTestResults& e
         // If the selection is contained in a layer that can scroll, that layer should handle the autoscroll
         // Otherwise, let the bridge handle it so the view can scroll itself.
         RenderObject* renderer = targetNode->renderer();
-        while (renderer && (!renderer->isBox() || !toRenderBox(renderer)->canBeProgramaticallyScrolled(false))) {
+        while (renderer && (!renderer->isBox() || !toRenderBox(renderer)->canBeScrolledAndHasScrollableArea())) {
             if (!renderer->parent() && renderer->node() == renderer->document() && renderer->document()->ownerElement())
                 renderer = renderer->document()->ownerElement()->renderer();
             else
@@ -547,6 +561,7 @@ void EventHandler::updateSelectionForMouseDrag(Node* targetNode, const IntPoint&
         m_frame->selection()->setSelection(newSelection);
     }
 }
+#endif // ENABLE(DRAG_SUPPORT)
     
 bool EventHandler::handleMouseUp(const MouseEventWithHitTestResults& event)
 {
@@ -574,7 +589,9 @@ bool EventHandler::handleMouseReleaseEvent(const MouseEventWithHitTestResults& e
     m_frame->selection()->setCaretBlinkingSuspended(false);
     m_mousePressed = false;
     m_capturesDragging = false;
+#if ENABLE(DRAG_SUPPORT)
     m_mouseDownMayStartDrag = false;
+#endif
     m_mouseDownMayStartSelect = false;
     m_mouseDownMayStartAutoscroll = false;
     m_mouseDownWasInSubframe = false;
@@ -586,7 +603,9 @@ bool EventHandler::handleMouseReleaseEvent(const MouseEventWithHitTestResults& e
     // on the selection, the selection goes away.  However, if we are
     // editing, place the caret.
     if (m_mouseDownWasSingleClickInSelection && !m_beganSelectingText
+#if ENABLE(DRAG_SUPPORT)
             && m_dragStartPos == event.event().pos()
+#endif
             && m_frame->selection()->isRange()
             && event.event().button() != RightButton) {
         VisibleSelection newSelection;
@@ -720,7 +739,7 @@ void EventHandler::updateAutoscrollRenderer()
     if (Node* nodeAtPoint = hitTest.innerNode())
         m_autoscrollRenderer = nodeAtPoint->renderer();
 
-    while (m_autoscrollRenderer && (!m_autoscrollRenderer->isBox() || !toRenderBox(m_autoscrollRenderer)->canBeProgramaticallyScrolled(false)))
+    while (m_autoscrollRenderer && (!m_autoscrollRenderer->isBox() || !toRenderBox(m_autoscrollRenderer)->canBeScrolledAndHasScrollableArea()))
         m_autoscrollRenderer = m_autoscrollRenderer->parent();
 }
 
@@ -729,6 +748,7 @@ void EventHandler::setAutoscrollRenderer(RenderObject* renderer)
     m_autoscrollRenderer = renderer;
 }
 
+#if ENABLE(DRAG_SUPPORT)
 void EventHandler::allowDHTMLDrag(bool& flagDHTML, bool& flagUA) const
 {
     flagDHTML = false;
@@ -749,6 +769,7 @@ void EventHandler::allowDHTMLDrag(bool& flagDHTML, bool& flagUA) const
     flagDHTML = (mask & DragSourceActionDHTML) != DragSourceActionNone;
     flagUA = ((mask & DragSourceActionImage) || (mask & DragSourceActionLink) || (mask & DragSourceActionSelection));
 }
+#endif // ENABLE(DRAG_SUPPORT)
     
 HitTestResult EventHandler::hitTestResultAtPoint(const IntPoint& point, bool allowShadowContent, bool ignoreClipping, HitTestScrollbars testScrollbars)
 {
@@ -764,7 +785,7 @@ HitTestResult EventHandler::hitTestResultAtPoint(const IntPoint& point, bool all
         Node* n = result.innerNode();
         if (!result.isOverWidget() || !n || !n->renderer() || !n->renderer()->isWidget())
             break;
-        RenderWidget* renderWidget = static_cast<RenderWidget*>(n->renderer());
+        RenderWidget* renderWidget = toRenderWidget(n->renderer());
         Widget* widget = renderWidget->widget();
         if (!widget || !widget->isFrameView())
             break;
@@ -902,10 +923,10 @@ Frame* subframeForHitTestResult(const MouseEventWithHitTestResults& hitTestResul
 {
     if (!hitTestResult.isOverWidget())
         return 0;
-    return subframeForTargetNode(hitTestResult.targetNode());
+    return EventHandler::subframeForTargetNode(hitTestResult.targetNode());
 }
 
-Frame* subframeForTargetNode(Node* node)
+Frame* EventHandler::subframeForTargetNode(Node* node)
 {
     if (!node)
         return 0;
@@ -914,7 +935,7 @@ Frame* subframeForTargetNode(Node* node)
     if (!renderer || !renderer->isWidget())
         return 0;
 
-    Widget* widget = static_cast<RenderWidget*>(renderer)->widget();
+    Widget* widget = toRenderWidget(renderer)->widget();
     if (!widget || !widget->isFrameView())
         return 0;
 
@@ -945,10 +966,10 @@ Cursor EventHandler::selectCursor(const MouseEventWithHitTestResults& event, Scr
     RenderStyle* style = renderer ? renderer->style() : 0;
 
     if (renderer && renderer->isFrameSet()) {
-        RenderFrameSet* fs = static_cast<RenderFrameSet*>(renderer);
-        if (fs->canResizeRow(event.localPoint()))
+        RenderFrameSet* frameSetRenderer = toRenderFrameSet(renderer);
+        if (frameSetRenderer->canResizeRow(event.localPoint()))
             return rowResizeCursor();
-        if (fs->canResizeColumn(event.localPoint()))
+        if (frameSetRenderer->canResizeColumn(event.localPoint()))
             return columnResizeCursor();
     }
 
@@ -1105,7 +1126,9 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
     m_capturesDragging = true;
     m_currentMousePosition = mouseEvent.pos();
     m_mouseDownTimestamp = mouseEvent.timestamp();
+#if ENABLE(DRAG_SUPPORT)
     m_mouseDownMayStartDrag = false;
+#endif
     m_mouseDownMayStartSelect = false;
     m_mouseDownMayStartAutoscroll = false;
     if (FrameView* view = m_frame->view())
@@ -1129,6 +1152,7 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
 
     m_mousePressNode = mev.targetNode();
 
+#if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page()) {
         InspectorController* inspector = page->inspectorController();
         if (inspector && inspector->enabled() && inspector->searchingForNodeInPage()) {
@@ -1137,6 +1161,7 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
             return true;
         }
     }
+#endif
 
     Frame* subframe = subframeForHitTestResult(mev);
     if (subframe && passMousePressEventToSubframe(mev, subframe)) {
@@ -1160,7 +1185,7 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
     if (mouseEvent.button() == MiddleButton && !mev.isOverLink()) {
         RenderObject* renderer = mev.targetNode()->renderer();
 
-        while (renderer && (!renderer->isBox() || !toRenderBox(renderer)->canBeProgramaticallyScrolled(false))) {
+        while (renderer && (!renderer->isBox() || !toRenderBox(renderer)->canBeScrolledAndHasScrollableArea())) {
             if (!renderer->parent() && renderer->node() == renderer->document() && renderer->document()->ownerElement())
                 renderer = renderer->document()->ownerElement()->renderer();
             else
@@ -1381,8 +1406,10 @@ bool EventHandler::handleMouseMoveEvent(const PlatformMouseEvent& mouseEvent, Hi
         return true;
     
     swallowEvent = dispatchMouseEvent(eventNames().mousemoveEvent, mev.targetNode(), false, 0, mouseEvent, true);
+#if ENABLE(DRAG_SUPPORT)
     if (!swallowEvent)
         swallowEvent = handleMouseDraggedEvent(mev);
+#endif // ENABLE(DRAG_SUPPORT)
 
     return swallowEvent;
 }
@@ -1452,6 +1479,7 @@ bool EventHandler::handleMouseReleaseEvent(const PlatformMouseEvent& mouseEvent)
     return swallowMouseUpEvent || swallowClickEvent || swallowMouseReleaseEvent;
 }
 
+#if ENABLE(DRAG_SUPPORT)
 bool EventHandler::dispatchDragEvent(const AtomicString& eventType, Node* dragTarget, const PlatformMouseEvent& event, Clipboard* clipboard)
 {
     FrameView* view = m_frame->view();
@@ -1559,6 +1587,7 @@ void EventHandler::clearDragState()
     m_sendingEventToSubview = false;
 #endif
 }
+#endif // ENABLE(DRAG_SUPPORT)
 
 void EventHandler::setCapturingMouseEventsNode(PassRefPtr<Node> n)
 {
@@ -1680,12 +1709,15 @@ bool EventHandler::dispatchMouseEvent(const AtomicString& eventType, Node* targe
         swallowEvent = m_nodeUnderMouse->dispatchMouseEvent(mouseEvent, eventType, clickCount);
     
     if (!swallowEvent && eventType == eventNames().mousedownEvent) {
+        // The layout needs to be up to date to determine if an element is focusable.
+        m_frame->document()->updateLayoutIgnorePendingStylesheets();
+
         // Blur current focus node when a link/button is clicked; this
         // is expected by some sites that rely on onChange handlers running
         // from form fields before the button click is processed.
         Node* node = m_nodeUnderMouse.get();
         RenderObject* renderer = node ? node->renderer() : 0;
-                
+
         // Walk up the render tree to search for a node to focus.
         // Walking up the DOM tree wouldn't work for shadow trees, like those behind the engine-based text fields.
         while (renderer) {
@@ -1771,8 +1803,7 @@ bool EventHandler::handleWheelEvent(PlatformWheelEvent& e)
         RenderObject* target = node->renderer();
         
         if (isOverWidget && target && target->isWidget()) {
-            Widget* widget = static_cast<RenderWidget*>(target)->widget();
-
+            Widget* widget = toRenderWidget(target)->widget();
             if (widget && passWheelEventToWidget(e, widget)) {
                 e.accept();
                 return true;
@@ -1808,6 +1839,7 @@ bool EventHandler::handleWheelEvent(PlatformWheelEvent& e)
     return e.isAccepted();
 }
 
+#if ENABLE(CONTEXT_MENUS)
 bool EventHandler::sendContextMenuEvent(const PlatformMouseEvent& event)
 {
     Document* doc = m_frame->document();
@@ -1838,6 +1870,7 @@ bool EventHandler::sendContextMenuEvent(const PlatformMouseEvent& event)
     
     return swallowEvent;
 }
+#endif // ENABLE(CONTEXT_MENUS)
 
 void EventHandler::scheduleHoverStateUpdate()
 {
@@ -1863,6 +1896,7 @@ bool EventHandler::canMouseDownStartSelect(Node* node)
     return true;
 }
 
+#if ENABLE(DRAG_SUPPORT)
 bool EventHandler::canMouseDragExtendSelect(Node* node)
 {
     if (!node || !node->renderer())
@@ -1875,6 +1909,7 @@ bool EventHandler::canMouseDragExtendSelect(Node* node)
 
     return true;
 }
+#endif // ENABLE(DRAG_SUPPORT)
 
 void EventHandler::setResizingFrameSet(HTMLFrameSetElement* frameSet)
 {
@@ -1945,10 +1980,8 @@ bool EventHandler::keyEvent(const PlatformKeyboardEvent& initialKeyEvent)
 #if ENABLE(PAN_SCROLLING)
     if (Page* page = m_frame->page()) {
         if (page->mainFrame()->eventHandler()->panScrollInProgress() || m_autoscrollInProgress) {
-            static const char* const escapeKeyIdentifier = "U+001B";
-
             // If a key is pressed while the autoscroll/panScroll is in progress then we want to stop
-            if (initialKeyEvent.keyIdentifier() == escapeKeyIdentifier && initialKeyEvent.type() == PlatformKeyboardEvent::KeyUp) 
+            if (initialKeyEvent.type() == PlatformKeyboardEvent::KeyDown || initialKeyEvent.type() == PlatformKeyboardEvent::RawKeyDown) 
                 stopAutoscrollTimer();
 
             // If we were in autoscroll/panscroll mode, we swallow the key event
@@ -2093,6 +2126,7 @@ void EventHandler::defaultKeyboardEventHandler(KeyboardEvent* event)
     }
 }
 
+#if ENABLE(DRAG_SUPPORT)
 bool EventHandler::dragHysteresisExceeded(const FloatPoint& floatDragViewportLocation) const
 {
     IntPoint dragViewportLocation((int)floatDragViewportLocation.x(), (int)floatDragViewportLocation.y());
@@ -2292,6 +2326,7 @@ cleanupDrag:
     // No more default handling (like selection), whether we're past the hysteresis bounds or not
     return true;
 }
+#endif // ENABLE(DRAG_SUPPORT)
   
 bool EventHandler::handleTextInputEvent(const String& text, Event* underlyingEvent, bool isLineBreak, bool isBackTab)
 {
@@ -2323,7 +2358,7 @@ bool EventHandler::handleTextInputEvent(const String& text, Event* underlyingEve
 }
     
     
-#if !PLATFORM(MAC) && !PLATFORM(QT)
+#if !PLATFORM(MAC) && !PLATFORM(QT) && !PLATFORM(HAIKU)
 bool EventHandler::invertSenseOfTabsToLinks(KeyboardEvent*) const
 {
     return false;
@@ -2417,7 +2452,7 @@ void EventHandler::capsLockStateMayHaveChanged()
     if (Node* node = d->focusedNode()) {
         if (RenderObject* r = node->renderer()) {
             if (r->isTextField())
-                static_cast<RenderTextControlSingleLine*>(r)->capsLockStateMayHaveChanged();
+                toRenderTextControlSingleLine(r)->capsLockStateMayHaveChanged();
         }
     }
 }
diff --git a/src/3rdparty/webkit/WebCore/page/EventHandler.h b/src/3rdparty/webkit/WebCore/page/EventHandler.h
index 409913a..b390457 100644
--- a/src/3rdparty/webkit/WebCore/page/EventHandler.h
+++ b/src/3rdparty/webkit/WebCore/page/EventHandler.h
@@ -62,10 +62,12 @@ class SVGElementInstance;
 class TextEvent;
 class Widget;
     
+#if ENABLE(DRAG_SUPPORT)
 extern const int LinkDragHysteresis;
 extern const int ImageDragHysteresis;
 extern const int TextDragHysteresis;
 extern const int GeneralDragHysteresis;
+#endif // ENABLE(DRAG_SUPPORT)
 
 enum HitTestScrollbars { ShouldHitTestScrollbars, DontHitTestScrollbars };
 
@@ -76,7 +78,9 @@ public:
 
     void clear();
 
+#if ENABLE(DRAG_SUPPORT)
     void updateSelectionForMouseDrag();
+#endif
 
     Node* mousePressNode() const;
     void setMousePressNode(PassRefPtr<Node>);
@@ -95,9 +99,11 @@ public:
 
     void setCapturingMouseEventsNode(PassRefPtr<Node>);
 
+#if ENABLE(DRAG_SUPPORT)
     bool updateDragAndDrop(const PlatformMouseEvent&, Clipboard*);
     void cancelDragAndDrop(const PlatformMouseEvent&, Clipboard*);
     bool performDragAndDrop(const PlatformMouseEvent&, Clipboard*);
+#endif
 
     void scheduleHoverStateUpdate();
 
@@ -109,11 +115,15 @@ public:
 
     void setIgnoreWheelEvents(bool);
 
+    static Frame* subframeForTargetNode(Node*);
+
     bool scrollOverflow(ScrollDirection, ScrollGranularity);
 
     bool scrollRecursively(ScrollDirection, ScrollGranularity);
 
+#if ENABLE(DRAG_SUPPORT)
     bool shouldDragAutoNode(Node*, const IntPoint&) const; // -webkit-user-drag == auto
+#endif
 
     bool tabsToLinks(KeyboardEvent*) const;
     bool tabsToAllControls(KeyboardEvent*) const;
@@ -127,7 +137,9 @@ public:
     bool handleMouseReleaseEvent(const PlatformMouseEvent&);
     bool handleWheelEvent(PlatformWheelEvent&);
 
+#if ENABLE(CONTEXT_MENUS)
     bool sendContextMenuEvent(const PlatformMouseEvent&);
+#endif
 
     void setMouseDownMayStartAutoscroll() { m_mouseDownMayStartAutoscroll = true; }
 
@@ -142,10 +154,12 @@ public:
         bool isLineBreak = false, bool isBackTab = false);
     void defaultTextInputEventHandler(TextEvent*);
 
+#if ENABLE(DRAG_SUPPORT)
     bool eventMayStartDrag(const PlatformMouseEvent&) const;
     
     void dragSourceMovedTo(const PlatformMouseEvent&);
     void dragSourceEndedAt(const PlatformMouseEvent&, DragOperation);
+#endif
 
     void focusDocumentView();
 
@@ -164,7 +178,9 @@ public:
     bool keyEvent(NSEvent *);
     bool wheelEvent(NSEvent *);
 
+#if ENABLE(CONTEXT_MENUS)
     bool sendContextMenuEvent(NSEvent *);
+#endif
     bool eventMayStartDrag(NSEvent *);
 
     void sendFakeEventsAfterWidgetTracking(NSEvent *initiatingEvent);
@@ -175,6 +191,7 @@ public:
 #endif
 
 private:
+#if ENABLE(DRAG_SUPPORT)
     struct EventHandlerDragState {
         RefPtr<Node> m_dragSrc; // element that may be a drag source, for the current mouse gesture
         bool m_dragSrcIsLink;
@@ -189,6 +206,7 @@ private:
     static const double TextDragDelay;
     
     PassRefPtr<Clipboard> createDraggingClipboard() const;
+#endif // ENABLE(DRAG_SUPPORT)
     
     bool eventActivatedView(const PlatformMouseEvent&) const;
     void selectClosestWordFromMouseEvent(const MouseEventWithHitTestResults&);
@@ -200,7 +218,9 @@ private:
     bool handleMousePressEventSingleClick(const MouseEventWithHitTestResults&);
     bool handleMousePressEventDoubleClick(const MouseEventWithHitTestResults&);
     bool handleMousePressEventTripleClick(const MouseEventWithHitTestResults&);
+#if ENABLE(DRAG_SUPPORT)
     bool handleMouseDraggedEvent(const MouseEventWithHitTestResults&);
+#endif
     bool handleMouseReleaseEvent(const MouseEventWithHitTestResults&);
 
     void handleKeyboardSelectionMovement(KeyboardEvent*);
@@ -213,7 +233,9 @@ private:
     void hoverTimerFired(Timer<EventHandler>*);
 
     static bool canMouseDownStartSelect(Node*);
+#if ENABLE(DRAG_SUPPORT)
     static bool canMouseDragExtendSelect(Node*);
+#endif
 
     void handleAutoscroll(RenderObject*);
     void startAutoscrollTimer();
@@ -230,18 +252,22 @@ private:
     MouseEventWithHitTestResults prepareMouseEvent(const HitTestRequest&, const PlatformMouseEvent&);
 
     bool dispatchMouseEvent(const AtomicString& eventType, Node* target, bool cancelable, int clickCount, const PlatformMouseEvent&, bool setUnder);
+#if ENABLE(DRAG_SUPPORT)
     bool dispatchDragEvent(const AtomicString& eventType, Node* target, const PlatformMouseEvent&, Clipboard*);
 
     void freeClipboard();
 
     bool handleDrag(const MouseEventWithHitTestResults&);
+#endif
     bool handleMouseUp(const MouseEventWithHitTestResults&);
+#if ENABLE(DRAG_SUPPORT)
     void clearDragState();
 
     bool dispatchDragSrcEvent(const AtomicString& eventType, const PlatformMouseEvent&);
 
     bool dragHysteresisExceeded(const FloatPoint&) const;
     bool dragHysteresisExceeded(const IntPoint&) const;
+#endif // ENABLE(DRAG_SUPPORT)
 
     bool passMousePressEventToSubframe(MouseEventWithHitTestResults&, Frame* subframe);
     bool passMouseMoveEventToSubframe(MouseEventWithHitTestResults&, Frame* subframe, HitTestResult* hoveredNode = 0);
@@ -260,16 +286,22 @@ private:
     void defaultSpaceEventHandler(KeyboardEvent*);
     void defaultTabEventHandler(KeyboardEvent*);
 
+#if ENABLE(DRAG_SUPPORT)
     void allowDHTMLDrag(bool& flagDHTML, bool& flagUA) const;
+#endif
 
     // The following are called at the beginning of handleMouseUp and handleDrag.  
     // If they return true it indicates that they have consumed the event.
     bool eventLoopHandleMouseUp(const MouseEventWithHitTestResults&);
+#if ENABLE(DRAG_SUPPORT)
     bool eventLoopHandleMouseDragged(const MouseEventWithHitTestResults&);
+#endif
 
     bool invertSenseOfTabsToLinks(KeyboardEvent*) const;
 
+#if ENABLE(DRAG_SUPPORT)
     void updateSelectionForMouseDrag(Node* targetNode, const IntPoint& localPoint);
+#endif
 
     void updateLastScrollbarUnderMouse(Scrollbar*, bool);
 
@@ -288,11 +320,15 @@ private:
     RefPtr<Node> m_mousePressNode;
 
     bool m_mouseDownMayStartSelect;
+#if ENABLE(DRAG_SUPPORT)
     bool m_mouseDownMayStartDrag;
+#endif
     bool m_mouseDownWasSingleClickInSelection;
     bool m_beganSelectingText;
 
+#if ENABLE(DRAG_SUPPORT)
     IntPoint m_dragStartPos;
+#endif
 
     IntPoint m_panScrollStartPos;
     bool m_panScrollInProgress;
@@ -326,7 +362,9 @@ private:
     int m_clickCount;
     RefPtr<Node> m_clickNode;
 
+#if ENABLE(DRAG_SUPPORT)
     RefPtr<Node> m_dragTarget;
+#endif
     
     RefPtr<HTMLFrameSetElement> m_frameSetBeingResized;
 
diff --git a/src/3rdparty/webkit/WebCore/page/EventSource.cpp b/src/3rdparty/webkit/WebCore/page/EventSource.cpp
new file mode 100644
index 0000000..afec20f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/EventSource.cpp
@@ -0,0 +1,372 @@
+/*
+ * Copyright (C) 2009 Ericsson AB
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Ericsson nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(EVENTSOURCE)
+
+#include "EventSource.h"
+
+#include "Cache.h"
+#include "DOMWindow.h"
+#include "Event.h"
+#include "EventException.h"
+#include "PlatformString.h"
+#include "MessageEvent.h"
+#include "ResourceError.h"
+#include "ResourceRequest.h"
+#include "ResourceResponse.h"
+#include "ScriptExecutionContext.h"
+#include "TextResourceDecoder.h"
+#include "ThreadableLoader.h"
+
+namespace WebCore {
+
+const unsigned long long EventSource::defaultReconnectDelay = 3000;
+
+EventSource::EventSource(const String& url, ScriptExecutionContext* context, ExceptionCode& ec)
+    : ActiveDOMObject(context, this)
+    , m_state(CONNECTING)
+    , m_reconnectTimer(this, &EventSource::reconnectTimerFired)
+    , m_failSilently(false)
+    , m_requestInFlight(false)
+    , m_reconnectDelay(defaultReconnectDelay)
+{
+    if (url.isEmpty() || !(m_url = context->completeURL(url)).isValid()) {
+        ec = SYNTAX_ERR;
+        return;
+    }
+    // FIXME: should support cross-origin requests
+    if (!scriptExecutionContext()->securityOrigin()->canRequest(m_url)) {
+        ec = SECURITY_ERR;
+        return;
+    }
+
+    m_origin = scriptExecutionContext()->securityOrigin()->toString();
+    m_decoder = TextResourceDecoder::create("text/plain", "UTF-8");
+
+    setPendingActivity(this);
+    connect();
+}
+
+EventSource::~EventSource()
+{
+}
+
+void EventSource::connect()
+{
+    ResourceRequest request(m_url);
+    request.setHTTPMethod("GET");
+    request.setHTTPHeaderField("Accept", "text/event-stream");
+    request.setHTTPHeaderField("Cache-Control", "no-cache");
+    if (!m_lastEventId.isEmpty())
+        request.setHTTPHeaderField("Last-Event-ID", m_lastEventId);
+
+    ThreadableLoaderOptions options;
+    options.sendLoadCallbacks = true;
+    options.sniffContent = false;
+    options.allowCredentials = true;
+
+    m_loader = ThreadableLoader::create(scriptExecutionContext(), this, request, options);
+
+    m_requestInFlight = true;
+
+    if (!scriptExecutionContext()->isWorkerContext())
+        cache()->loader()->nonCacheRequestInFlight(m_url);
+}
+
+void EventSource::endRequest()
+{
+    m_requestInFlight = false;
+
+    if (!m_failSilently)
+        dispatchGenericEvent(eventNames().errorEvent);
+
+    if (!scriptExecutionContext()->isWorkerContext())
+        cache()->loader()->nonCacheRequestComplete(m_url);
+
+    if (m_state != CLOSED)
+        scheduleReconnect();
+    else
+        unsetPendingActivity(this);
+}
+
+void EventSource::scheduleReconnect()
+{
+    m_state = CONNECTING;
+    m_reconnectTimer.startOneShot(m_reconnectDelay / 1000);
+}
+
+void EventSource::reconnectTimerFired(Timer<EventSource>*)
+{
+    connect();
+}
+
+String EventSource::url() const
+{
+    return m_url.string();
+}
+
+EventSource::State EventSource::readyState() const
+{
+    return m_state;
+}
+
+void EventSource::close()
+{
+    if (m_state == CLOSED)
+        return;
+
+    if (m_reconnectTimer.isActive()) {
+        m_reconnectTimer.stop();
+        unsetPendingActivity(this);
+    }
+
+    m_state = CLOSED;
+    m_failSilently = true;
+
+    if (m_requestInFlight)
+        m_loader->cancel();
+}
+
+ScriptExecutionContext* EventSource::scriptExecutionContext() const
+{
+    return ActiveDOMObject::scriptExecutionContext();
+}
+
+void EventSource::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> eventListener, bool)
+{
+    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
+    if (iter == m_eventListeners.end()) {
+        ListenerVector listeners;
+        listeners.append(eventListener);
+        m_eventListeners.add(eventType, listeners);
+    } else {
+        ListenerVector& listeners = iter->second;
+        for (ListenerVector::iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
+            if (**listenerIter == *eventListener)
+                return;
+        }
+
+        listeners.append(eventListener);
+        m_eventListeners.add(eventType, listeners);
+    }
+}
+
+void EventSource::removeEventListener(const AtomicString& eventType, EventListener* eventListener, bool)
+{
+    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
+    if (iter == m_eventListeners.end())
+        return;
+
+    ListenerVector& listeners = iter->second;
+    for (ListenerVector::const_iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
+        if (**listenerIter == *eventListener) {
+            listeners.remove(listenerIter - listeners.begin());
+            return;
+        }
+    }
+}
+
+bool EventSource::dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec)
+{
+    if (!event || event->type().isEmpty()) {
+        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
+        return true;
+    }
+
+    EventListener* attributeListener = m_attributeListeners.get(event->type()).get();
+    if (attributeListener) {
+        event->setTarget(this);
+        event->setCurrentTarget(this);
+        attributeListener->handleEvent(event.get(), false);
+    }
+
+    ListenerVector listenersCopy = m_eventListeners.get(event->type());
+    for (ListenerVector::const_iterator listenerIter = listenersCopy.begin(); listenerIter != listenersCopy.end(); ++listenerIter) {
+        event->setTarget(this);
+        event->setCurrentTarget(this);
+        listenerIter->get()->handleEvent(event.get(), false);
+    }
+
+    return !event->defaultPrevented();
+}
+
+void EventSource::didReceiveResponse(const ResourceResponse& response)
+{
+    int statusCode = response.httpStatusCode();
+    if (statusCode == 200 && response.httpHeaderField("Content-Type") == "text/event-stream") {
+        m_state = OPEN;
+        dispatchGenericEvent(eventNames().openEvent);
+    } else {
+        if (statusCode <= 200 || statusCode > 299)
+            m_state = CLOSED;
+        m_loader->cancel();
+    }
+}
+
+void EventSource::didReceiveData(const char* data, int length)
+{
+    append(m_receiveBuf, m_decoder->decode(data, length));
+    parseEventStream();
+}
+
+void EventSource::didFinishLoading(unsigned long)
+{
+    if (m_receiveBuf.size() > 0 || m_data.size() > 0) {
+        append(m_receiveBuf, "\n\n");
+        parseEventStream();
+    }
+    m_state = CONNECTING;
+    endRequest();
+}
+
+void EventSource::didFail(const ResourceError& error)
+{
+    int canceled = error.isCancellation();
+    if (((m_state == CONNECTING) && !canceled) || ((m_state == OPEN) && canceled))
+        m_state = CLOSED;
+    endRequest();
+}
+
+void EventSource::didFailRedirectCheck()
+{
+    m_state = CLOSED;
+    m_loader->cancel();
+}
+
+void EventSource::parseEventStream()
+{
+    unsigned int bufPos = 0;
+    unsigned int bufSize = m_receiveBuf.size();
+    for (;;) {
+        int lineLength = -1;
+        int fieldLength = -1;
+        int carriageReturn = 0;
+        for (unsigned int i = bufPos; lineLength < 0 && i < bufSize; i++) {
+            switch (m_receiveBuf[i]) {
+            case ':':
+                if (fieldLength < 0)
+                    fieldLength = i - bufPos;
+                break;
+            case '\n':
+                if (i > bufPos && m_receiveBuf[i - 1] == '\r') {
+                    carriageReturn++;
+                    i--;
+                }
+                lineLength = i - bufPos;
+                break;
+            }
+        }
+
+        if (lineLength < 0)
+            break;
+
+        parseEventStreamLine(bufPos, fieldLength, lineLength);
+        bufPos += lineLength + carriageReturn + 1;
+    }
+
+    if (bufPos == bufSize)
+        m_receiveBuf.clear();
+    else if (bufPos)
+        m_receiveBuf.remove(0, bufPos);
+}
+
+void EventSource::parseEventStreamLine(unsigned int bufPos, int fieldLength, int lineLength)
+{
+    if (!lineLength) {
+        if (!m_data.isEmpty())
+            dispatchMessageEvent();
+        if (!m_eventName.isEmpty())
+            m_eventName = "";
+    } else if (fieldLength) {
+        bool noValue = fieldLength < 0;
+
+        String field(&m_receiveBuf[bufPos], noValue ? lineLength : fieldLength);
+        int step;
+        if (noValue)
+            step = lineLength;
+        else if (m_receiveBuf[bufPos + fieldLength + 1] != ' ')
+            step = fieldLength + 1;
+        else
+            step = fieldLength + 2;
+        bufPos += step;
+        int valueLength = lineLength - step;
+
+        if (field == "data") {
+            if (m_data.size() > 0)
+                m_data.append('\n');
+            if (valueLength)
+                m_data.append(&m_receiveBuf[bufPos], valueLength);
+        } else if (field == "event")
+            m_eventName = valueLength ? String(&m_receiveBuf[bufPos], valueLength) : "";
+        else if (field == "id")
+            m_lastEventId = valueLength ? String(&m_receiveBuf[bufPos], valueLength) : "";
+        else if (field == "retry") {
+            if (!valueLength)
+                m_reconnectDelay = defaultReconnectDelay;
+            else {
+                String value(&m_receiveBuf[bufPos], valueLength);
+                bool ok;
+                unsigned long long retry = value.toUInt64(&ok);
+                if (ok)
+                    m_reconnectDelay = retry;
+            }
+        }
+    }
+}
+
+void EventSource::dispatchGenericEvent(const AtomicString& type)
+{
+    RefPtr<Event> evt = Event::create(type, false, false);
+    ExceptionCode ec = 0;
+    dispatchEvent(evt.release(), ec);
+    ASSERT(!ec);
+}
+
+void EventSource::dispatchMessageEvent()
+{
+    RefPtr<MessageEvent> evt = MessageEvent::create();
+    String eventName = m_eventName.isEmpty() ? eventNames().messageEvent.string() : m_eventName;
+    evt->initMessageEvent(eventName, false, false, String::adopt(m_data), m_origin, m_lastEventId, 0, 0);
+    ExceptionCode ec = 0;
+    dispatchEvent(evt.release(), ec);
+    ASSERT(!ec);
+}
+
+void EventSource::stop()
+{
+    close();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(EVENTSOURCE)
diff --git a/src/3rdparty/webkit/WebCore/page/EventSource.h b/src/3rdparty/webkit/WebCore/page/EventSource.h
new file mode 100644
index 0000000..df55694
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/EventSource.h
@@ -0,0 +1,146 @@
+/*
+ * Copyright (C) 2009 Ericsson AB
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Ericsson nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef EventSource_h
+#define EventSource_h
+
+#if ENABLE(EVENTSOURCE)
+
+#include "ActiveDOMObject.h"
+#include "AtomicStringHash.h"
+#include "EventListener.h"
+#include "EventNames.h"
+#include "EventTarget.h"
+#include "KURL.h"
+#include "ThreadableLoaderClient.h"
+#include "Timer.h"
+
+#include <wtf/HashMap.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+    class ResourceResponse;
+    class TextResourceDecoder;
+    class ThreadableLoader;
+
+    class EventSource : public RefCounted<EventSource>, public EventTarget, private ThreadableLoaderClient, public ActiveDOMObject {
+    public:
+        static PassRefPtr<EventSource> create(const String& url, ScriptExecutionContext* context, ExceptionCode& ec) { return adoptRef(new EventSource(url, context, ec)); }
+        virtual ~EventSource();
+
+        static const unsigned long long defaultReconnectDelay;
+
+        String url() const;
+
+        enum State {
+            CONNECTING = 0,
+            OPEN = 1,
+            CLOSED = 2,
+        };
+
+        State readyState() const;
+
+        void setOnopen(PassRefPtr<EventListener> eventListener) { m_attributeListeners.set(eventNames().openEvent, eventListener); }
+        EventListener* onopen() const { return m_attributeListeners.get(eventNames().openEvent).get(); }
+
+        void setOnmessage(PassRefPtr<EventListener> eventListener) { m_attributeListeners.set(eventNames().messageEvent, eventListener); }
+        EventListener* onmessage() const { return m_attributeListeners.get(eventNames().messageEvent).get(); }
+
+        void setOnerror(PassRefPtr<EventListener> eventListener) { m_attributeListeners.set(eventNames().errorEvent, eventListener); }
+        EventListener* onerror() const { return m_attributeListeners.get(eventNames().errorEvent).get(); }
+
+        void close();
+
+        using RefCounted<EventSource>::ref;
+        using RefCounted<EventSource>::deref;
+
+        virtual EventSource* toEventSource() { return this; }
+        virtual ScriptExecutionContext* scriptExecutionContext() const;
+
+        typedef Vector<RefPtr<EventListener> > ListenerVector;
+        typedef HashMap<AtomicString, ListenerVector> EventListenersMap;
+
+        virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
+        virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
+        virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
+        EventListenersMap& eventListeners() { return m_eventListeners; }
+
+        virtual void stop();
+
+    private:
+        EventSource(const String& url, ScriptExecutionContext* context, ExceptionCode& ec);
+
+        virtual void refEventTarget() { ref(); }
+        virtual void derefEventTarget() { deref(); }
+
+        virtual void didReceiveResponse(const ResourceResponse& response);
+        virtual void didReceiveData(const char* data, int length);
+        virtual void didFinishLoading(unsigned long);
+        virtual void didFail(const ResourceError& error);
+        virtual void didFailRedirectCheck();
+
+        void connect();
+        void endRequest();
+        void scheduleReconnect();
+        void reconnectTimerFired(Timer<EventSource>*);
+        void parseEventStream();
+        void parseEventStreamLine(unsigned int pos, int fieldLength, int lineLength);
+        void dispatchGenericEvent(const AtomicString& type);
+        void dispatchMessageEvent();
+
+        KURL m_url;
+        State m_state;
+
+        HashMap<AtomicString, RefPtr<EventListener> > m_attributeListeners;
+        EventListenersMap m_eventListeners;
+
+        RefPtr<TextResourceDecoder> m_decoder;
+        RefPtr<ThreadableLoader> m_loader;
+        Timer<EventSource> m_reconnectTimer;
+        Vector<UChar> m_receiveBuf;
+        bool m_failSilently;
+        bool m_requestInFlight;
+
+        String m_eventName;
+        Vector<UChar> m_data;
+        String m_lastEventId;
+        unsigned long long m_reconnectDelay;
+        String m_origin;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(EVENTSOURCE)
+
+#endif // EventSource_h
diff --git a/src/3rdparty/webkit/WebCore/page/EventSource.idl b/src/3rdparty/webkit/WebCore/page/EventSource.idl
new file mode 100644
index 0000000..c438e682
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/EventSource.idl
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2009 Ericsson AB
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Ericsson nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module window {
+
+    interface [
+        Conditional=EVENTSOURCE,
+        CustomMarkFunction,
+        NoStaticTables
+    ] EventSource {
+
+        readonly attribute DOMString URL;
+
+        // ready state
+        const unsigned short CONNECTING = 0;
+        const unsigned short OPEN = 1;
+        const unsigned short CLOSED = 2;
+        readonly attribute unsigned short readyState;
+
+        // networking
+        attribute EventListener onopen;
+        attribute EventListener onmessage;
+        attribute EventListener onerror;
+        void close();
+
+        // EventTarget interface
+        [Custom] void addEventListener(in DOMString type,
+                                      in EventListener listener,
+                                      in boolean useCapture);
+        [Custom] void removeEventListener(in DOMString type,
+                                          in EventListener listener,
+                                          in boolean useCapture);
+        boolean dispatchEvent(in Event evt)
+            raises(EventException);
+
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/page/FocusController.cpp b/src/3rdparty/webkit/WebCore/page/FocusController.cpp
index 817801c..bc9e477 100644
--- a/src/3rdparty/webkit/WebCore/page/FocusController.cpp
+++ b/src/3rdparty/webkit/WebCore/page/FocusController.cpp
@@ -55,6 +55,18 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+static inline void dispatchEventsOnWindowAndFocusedNode(Document* document, bool focused)
+{
+    // If we have a focused node we should dispatch blur on it before we blur the window.
+    // If we have a focused node we should dispatch focus on it after we focus the window.
+    // https://bugs.webkit.org/show_bug.cgi?id=27105
+    if (!focused && document->focusedNode())
+        document->focusedNode()->dispatchBlurEvent();
+    document->dispatchWindowEvent(focused ? eventNames().focusEvent : eventNames().blurEvent, false, false);
+    if (focused && document->focusedNode())
+        document->focusedNode()->dispatchFocusEvent();
+}
+
 FocusController::FocusController(Page* page)
     : m_page(page)
     , m_isActive(false)
@@ -100,7 +112,7 @@ void FocusController::setFocused(bool focused)
     
     if (m_focusedFrame && m_focusedFrame->view()) {
         m_focusedFrame->selection()->setFocused(focused);
-        m_focusedFrame->document()->dispatchWindowEvent(focused ? eventNames().focusEvent : eventNames().blurEvent, false, false);
+        dispatchEventsOnWindowAndFocusedNode(m_focusedFrame->document(), focused);
     }
 }
 
@@ -146,6 +158,8 @@ bool FocusController::advanceFocus(FocusDirection direction, KeyboardEvent* even
     if (caretBrowsing && !currentNode)
         currentNode = frame->selection()->start().node();
 
+    document->updateLayoutIgnorePendingStylesheets();
+
     Node* node = (direction == FocusDirectionForward)
         ? document->nextFocusableNode(currentNode, event)
         : document->previousFocusableNode(currentNode, event);
@@ -341,7 +355,7 @@ void FocusController::setActive(bool active)
     focusedOrMainFrame()->selection()->pageActivationChanged();
     
     if (m_focusedFrame && isFocused())
-        m_focusedFrame->document()->dispatchWindowEvent(active ? eventNames().focusEvent : eventNames().blurEvent, false, false);
+        dispatchEventsOnWindowAndFocusedNode(m_focusedFrame->document(), active);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/Frame.cpp b/src/3rdparty/webkit/WebCore/page/Frame.cpp
index 2d6a795..7a3ed27 100644
--- a/src/3rdparty/webkit/WebCore/page/Frame.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Frame.cpp
@@ -60,6 +60,7 @@
 #include "Navigator.h"
 #include "NodeList.h"
 #include "Page.h"
+#include "PageGroup.h"
 #include "RegularExpression.h"
 #include "RenderPart.h"
 #include "RenderTableCell.h"
@@ -67,6 +68,8 @@
 #include "RenderTheme.h"
 #include "RenderView.h"
 #include "ScriptController.h"
+#include "ScriptSourceCode.h"
+#include "ScriptValue.h"
 #include "Settings.h"
 #include "TextIterator.h"
 #include "TextResourceDecoder.h"
@@ -83,10 +86,6 @@
 #include "runtime_root.h"
 #endif
 
-#if FRAME_LOADS_USER_STYLESHEET
-#include "UserStyleSheetLoader.h"
-#endif
-
 #if ENABLE(SVG)
 #include "SVGDocument.h"
 #include "SVGDocumentExtensions.h"
@@ -135,9 +134,6 @@ Frame::Frame(Page* page, HTMLFrameOwnerElement* ownerElement, FrameLoaderClient*
     , m_needsReapplyStyles(false)
     , m_isDisconnected(false)
     , m_excludeFromTextSearch(false)
-#if FRAME_LOADS_USER_STYLESHEET
-    , m_userStyleSheetLoader(0)
-#endif
 {
     Frame* parent = parentFromOwnerElement(ownerElement);
     m_zoomFactor = parent ? parent->m_zoomFactor : 1.0f;
@@ -200,10 +196,6 @@ Frame::~Frame()
     }
 
     ASSERT(!m_lifeSupportTimer.isActive());
-
-#if FRAME_LOADS_USER_STYLESHEET
-    delete m_userStyleSheetLoader;
-#endif
 }
 
 void Frame::init()
@@ -223,6 +215,12 @@ FrameView* Frame::view() const
 
 void Frame::setView(PassRefPtr<FrameView> view)
 {
+    // We the custom scroll bars as early as possible to prevent m_doc->detach()
+    // from messing with the view such that its scroll bars won't be torn down.
+    // FIXME: We should revisit this.
+    if (m_view)
+        m_view->detachCustomScrollbars();
+
     // Detach the document now, so any onUnload handlers get run - if
     // we wait until the view is destroyed, then things won't be
     // hooked up enough for some JavaScript calls to work.
@@ -387,10 +385,11 @@ static RegularExpression* createRegExpForLabels(const Vector<String>& labels)
 
 String Frame::searchForLabelsAboveCell(RegularExpression* regExp, HTMLTableCellElement* cell)
 {
-    RenderTableCell* cellRenderer = static_cast<RenderTableCell*>(cell->renderer());
+    RenderObject* cellRenderer = cell->renderer();
 
     if (cellRenderer && cellRenderer->isTableCell()) {
-        RenderTableCell* cellAboveRenderer = cellRenderer->table()->cellAbove(cellRenderer);
+        RenderTableCell* tableCellRenderer = toRenderTableCell(cellRenderer);
+        RenderTableCell* cellAboveRenderer = tableCellRenderer->table()->cellAbove(tableCellRenderer);
 
         if (cellAboveRenderer) {
             HTMLTableCellElement* aboveCell =
@@ -559,7 +558,7 @@ static bool isFrameElement(const Node *n)
     RenderObject *renderer = n->renderer();
     if (!renderer || !renderer->isWidget())
         return false;
-    Widget* widget = static_cast<RenderWidget*>(renderer)->widget();
+    Widget* widget = toRenderWidget(renderer)->widget();
     return widget && widget->isFrameView();
 }
 
@@ -825,14 +824,6 @@ void Frame::reapplyStyles()
     // We should probably eventually move it into its own function.
     m_doc->docLoader()->setAutoLoadImages(m_page && m_page->settings()->loadsImagesAutomatically());
 
-#if FRAME_LOADS_USER_STYLESHEET
-    const KURL userStyleSheetLocation = m_page ? m_page->settings()->userStyleSheetLocation() : KURL();
-    if (!userStyleSheetLocation.isEmpty())
-        setUserStyleSheetLocation(userStyleSheetLocation);
-    else
-        setUserStyleSheet(String());
-#endif
-
     // FIXME: It's not entirely clear why the following is needed.
     // The document automatically does this as required when you set the style sheet.
     // But we had problems when this code was removed. Details are in
@@ -840,6 +831,36 @@ void Frame::reapplyStyles()
     m_doc->updateStyleSelector();
 }
 
+void Frame::injectUserScripts(UserScriptInjectionTime injectionTime)
+{
+    if (!m_page)
+        return;
+    
+    // Walk the hashtable. Inject by world.
+    const UserScriptMap* userScripts = m_page->group().userScripts();
+    if (!userScripts)
+        return;
+    UserScriptMap::const_iterator end = userScripts->end();
+    for (UserScriptMap::const_iterator it = userScripts->begin(); it != end; ++it)
+        injectUserScriptsForWorld(it->first, *it->second, injectionTime);
+}
+
+void Frame::injectUserScriptsForWorld(unsigned worldID, const UserScriptVector& userScripts, UserScriptInjectionTime injectionTime)
+{
+    if (userScripts.isEmpty())
+        return;
+
+    // FIXME: Need to implement pattern checking.
+    Vector<ScriptSourceCode> sourceCode;
+    unsigned count = userScripts.size();
+    for (unsigned i = 0; i < count; ++i) {
+        UserScript* script = userScripts[i].get();
+        if (script->injectionTime() == injectionTime)
+            sourceCode.append(ScriptSourceCode(script->source(), script->url()));
+    }
+    script()->evaluateInIsolatedWorld(worldID, sourceCode);
+}
+
 bool Frame::shouldChangeSelection(const VisibleSelection& newSelection) const
 {
     return shouldChangeSelection(selection()->selection(), newSelection, newSelection.affinity(), false);
@@ -1153,7 +1174,7 @@ RenderPart* Frame::ownerRenderer() const
     // https://bugs.webkit.org/show_bug.cgi?id=18585
     if (!object->isRenderPart())
         return 0;
-    return static_cast<RenderPart*>(object);
+    return toRenderPart(object);
 }
 
 bool Frame::isDisconnected() const
@@ -1555,6 +1576,11 @@ Page* Frame::page() const
     return m_page;
 }
 
+void Frame::detachFromPage()
+{
+    m_page = 0;
+}
+
 EventHandler* Frame::eventHandler() const
 {
     return &m_eventHandler;
@@ -1574,7 +1600,7 @@ void Frame::pageDestroyed()
     script()->clearScriptObjects();
     script()->updatePlatformScriptObjects();
 
-    m_page = 0;
+    detachFromPage();
 }
 
 void Frame::disconnectOwnerElement()
@@ -1753,7 +1779,6 @@ void Frame::createView(const IntSize& viewportSize,
         frameView = FrameView::create(this);
 
     frameView->setScrollbarModes(horizontalScrollbarMode, verticalScrollbarMode);
-    frameView->updateDefaultScrollbarState();
 
     setView(frameView);
 
diff --git a/src/3rdparty/webkit/WebCore/page/Frame.h b/src/3rdparty/webkit/WebCore/page/Frame.h
index 652269a..ef803f1 100644
--- a/src/3rdparty/webkit/WebCore/page/Frame.h
+++ b/src/3rdparty/webkit/WebCore/page/Frame.h
@@ -41,6 +41,7 @@
 #include "ScrollBehavior.h"
 #include "SelectionController.h"
 #include "TextGranularity.h"
+#include "UserScriptTypes.h"
 
 #if PLATFORM(WIN)
 #include "FrameWin.h"
@@ -79,10 +80,6 @@ namespace WebCore {
     class VisibleSelection;
     class Widget;
 
-#if FRAME_LOADS_USER_STYLESHEET
-    class UserStyleSheetLoader;
-#endif
-
     template <typename T> class Timer;
 
     class Frame : public RefCounted<Frame> {
@@ -97,6 +94,7 @@ namespace WebCore {
         void init();
 
         Page* page() const;
+        void detachFromPage();
         HTMLFrameOwnerElement* ownerElement() const;
 
         void pageDestroyed();
@@ -128,6 +126,10 @@ namespace WebCore {
         void createView(const IntSize&, const Color&, bool, const IntSize &, bool,
                         ScrollbarMode = ScrollbarAuto, ScrollbarMode = ScrollbarAuto);
 
+        void injectUserScripts(UserScriptInjectionTime);
+
+    private:
+        void injectUserScriptsForWorld(unsigned worldID, const UserScriptVector&, UserScriptInjectionTime);
 
     private:
         Frame(Page*, HTMLFrameOwnerElement*, FrameLoaderClient*);
@@ -139,11 +141,6 @@ namespace WebCore {
 
         Settings* settings() const; // can be NULL
 
-    #if FRAME_LOADS_USER_STYLESHEET
-        void setUserStyleSheetLocation(const KURL&);
-        void setUserStyleSheet(const String& styleSheetData);
-    #endif
-
         void setPrinting(bool printing, float minPageWidth, float maxPageWidth, bool adjustViewSize);
 
         bool inViewSourceMode() const;
@@ -365,11 +362,6 @@ namespace WebCore {
         bool m_needsReapplyStyles;
         bool m_isDisconnected;
         bool m_excludeFromTextSearch;
-
-    #if FRAME_LOADS_USER_STYLESHEET
-        UserStyleSheetLoader* m_userStyleSheetLoader;
-    #endif
-
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/FrameTree.cpp b/src/3rdparty/webkit/WebCore/page/FrameTree.cpp
index 24f125d..41caa9c 100644
--- a/src/3rdparty/webkit/WebCore/page/FrameTree.cpp
+++ b/src/3rdparty/webkit/WebCore/page/FrameTree.cpp
@@ -91,7 +91,7 @@ void FrameTree::removeChild(Frame* child)
     RefPtr<Frame>& newLocationForNext = m_firstChild == child ? m_firstChild : child->tree()->m_previousSibling->tree()->m_nextSibling;
     Frame*& newLocationForPrevious = m_lastChild == child ? m_lastChild : child->tree()->m_nextSibling->tree()->m_previousSibling;
     swap(newLocationForNext, child->tree()->m_nextSibling);
-    // For some inexplicable reason, the following line does not compile without the explicit std:: namepsace
+    // For some inexplicable reason, the following line does not compile without the explicit std:: namespace
     std::swap(newLocationForPrevious, child->tree()->m_previousSibling);
 
     child->tree()->m_previousSibling = 0;
diff --git a/src/3rdparty/webkit/WebCore/page/FrameView.cpp b/src/3rdparty/webkit/WebCore/page/FrameView.cpp
index 9160c89..b358018 100644
--- a/src/3rdparty/webkit/WebCore/page/FrameView.cpp
+++ b/src/3rdparty/webkit/WebCore/page/FrameView.cpp
@@ -43,11 +43,12 @@
 #include "HTMLFrameElement.h"
 #include "HTMLFrameSetElement.h"
 #include "HTMLNames.h"
+#include "InspectorTimelineAgent.h"
 #include "OverflowEvent.h"
-#include "Page.h"
 #include "RenderPart.h"
 #include "RenderPartObject.h"
 #include "RenderScrollbar.h"
+#include "RenderScrollbarPart.h"
 #include "RenderTheme.h"
 #include "RenderView.h"
 #include "Settings.h"
@@ -92,13 +93,10 @@ struct ScheduledEvent {
 
 FrameView::FrameView(Frame* frame)
     : m_frame(frame)
-    , m_vmode(ScrollbarAuto)
-    , m_hmode(ScrollbarAuto)
     , m_slowRepaintObjectCount(0)
     , m_layoutTimer(this, &FrameView::layoutTimerFired)
     , m_layoutRoot(0)
     , m_postLayoutTasksTimer(this, &FrameView::postLayoutTimerFired)
-    , m_needToInitScrollbars(true)
     , m_isTransparent(false)
     , m_baseBackgroundColor(Color::white)
     , m_mediaType("screen")
@@ -111,6 +109,7 @@ FrameView::FrameView(Frame* frame)
     , m_shouldUpdateWhileOffscreen(true)
     , m_deferSetNeedsLayouts(0)
     , m_setNeedsLayoutWasDeferred(false)
+    , m_scrollCorner(0)
 {
     init();
 }
@@ -139,9 +138,15 @@ FrameView::~FrameView()
     }
 
     resetScrollbars();
+
+    // Custom scrollbars should already be destroyed at this point
+    ASSERT(!horizontalScrollbar() || !horizontalScrollbar()->isCustomScrollbar());
+    ASSERT(!verticalScrollbar() || !verticalScrollbar()->isCustomScrollbar());
+
     setHasHorizontalScrollbar(false); // Remove native scrollbars now before we lose the connection to the HostWindow.
     setHasVerticalScrollbar(false);
     
+    ASSERT(!m_scrollCorner);
     ASSERT(m_scheduledEvents.isEmpty());
     ASSERT(!m_enqueueEvents);
 
@@ -202,7 +207,7 @@ void FrameView::resetScrollbars()
     // Reset the document's scrollbars back to our defaults before we yield the floor.
     m_firstLayout = true;
     setScrollbarsSuppressed(true);
-    setScrollbarModes(m_hmode, m_vmode);
+    setScrollbarModes(ScrollbarAuto, ScrollbarAuto);
     setScrollbarsSuppressed(false);
 }
 
@@ -233,23 +238,18 @@ void FrameView::detachCustomScrollbars()
     if (!m_frame)
         return;
 
-    Document* document = m_frame->document();
-    if (!document)
-        return;
-
-    Element* body = document->body();
-    if (!body)
-        return;
-
-    RenderBox* renderBox = body->renderBox();
-
     Scrollbar* horizontalBar = horizontalScrollbar();
-    if (horizontalBar && horizontalBar->isCustomScrollbar() && reinterpret_cast<RenderScrollbar*>(horizontalBar)->owningRenderer() == renderBox)
+    if (horizontalBar && horizontalBar->isCustomScrollbar() && !toRenderScrollbar(horizontalBar)->owningRenderer()->isRenderPart())
         setHasHorizontalScrollbar(false);
 
     Scrollbar* verticalBar = verticalScrollbar();
-    if (verticalBar && verticalBar->isCustomScrollbar() && reinterpret_cast<RenderScrollbar*>(verticalBar)->owningRenderer() == renderBox)
+    if (verticalBar && verticalBar->isCustomScrollbar() && !toRenderScrollbar(verticalBar)->owningRenderer()->isRenderPart())
         setHasVerticalScrollbar(false);
+
+    if (m_scrollCorner) {
+        m_scrollCorner->destroy();
+        m_scrollCorner = 0;
+    }
 }
 
 void FrameView::clear()
@@ -271,21 +271,6 @@ bool FrameView::didFirstLayout() const
     return !m_firstLayout;
 }
 
-void FrameView::initScrollbars()
-{
-    if (!m_needToInitScrollbars)
-        return;
-    m_needToInitScrollbars = false;
-    updateDefaultScrollbarState();
-}
-
-void FrameView::updateDefaultScrollbarState()
-{
-    m_hmode = horizontalScrollbarMode();
-    m_vmode = verticalScrollbarMode();
-    setScrollbarModes(m_hmode, m_vmode);
-}
-
 void FrameView::invalidateRect(const IntRect& rect)
 {
     if (!parent()) {
@@ -319,12 +304,6 @@ void FrameView::setMarginHeight(int h)
     m_margins.setHeight(h);
 }
 
-void FrameView::setCanHaveScrollbars(bool canScroll)
-{
-    ScrollView::setCanHaveScrollbars(canScroll);
-    scrollbarModes(m_hmode, m_vmode);
-}
-
 PassRefPtr<Scrollbar> FrameView::createScrollbar(ScrollbarOrientation orientation)
 {
     // FIXME: We need to update the scrollbar dynamically as documents change (or as doc elements and bodies get discovered that have custom styles).
@@ -373,7 +352,7 @@ void FrameView::adjustViewSize()
     RenderView* root = m_frame->contentRenderer();
     if (!root)
         return;
-    setContentsSize(IntSize(root->overflowWidth(), root->overflowHeight()));
+    setContentsSize(IntSize(root->rightLayoutOverflow(), root->bottomLayoutOverflow()));
 }
 
 void FrameView::applyOverflowToViewport(RenderObject* o, ScrollbarMode& hMode, ScrollbarMode& vMode)
@@ -439,6 +418,37 @@ void FrameView::setNeedsOneShotDrawingSynchronization()
 }
 #endif // USE(ACCELERATED_COMPOSITING)
 
+bool FrameView::syncCompositingStateRecursive()
+{
+#if USE(ACCELERATED_COMPOSITING)
+    ASSERT(m_frame->view() == this);
+    RenderView* contentRenderer = m_frame->contentRenderer();
+    if (!contentRenderer)
+        return true;    // We don't want to keep trying to update layers if we have no renderer.
+
+    if (m_layoutTimer.isActive()) {
+        // Don't sync layers if there's a layout pending.
+        return false;
+    }
+    
+    if (GraphicsLayer* rootLayer = contentRenderer->compositor()->rootPlatformLayer())
+        rootLayer->syncCompositingState();
+
+    bool allSubframesSynced = true;
+    const HashSet<RefPtr<Widget> >* viewChildren = children();
+    HashSet<RefPtr<Widget> >::const_iterator end = viewChildren->end();
+    for (HashSet<RefPtr<Widget> >::const_iterator current = viewChildren->begin(); current != end; ++current) {
+        Widget* widget = (*current).get();
+        if (widget->isFrameView()) {
+            bool synced = static_cast<FrameView*>(widget)->syncCompositingStateRecursive();
+            allSubframesSynced &= synced;
+        }
+    }
+    return allSubframesSynced;
+#endif // USE(ACCELERATED_COMPOSITING)
+    return true;
+}
+
 void FrameView::didMoveOnscreen()
 {
     RenderView* view = m_frame->contentRenderer();
@@ -482,6 +492,12 @@ void FrameView::layout(bool allowSubtree)
     if (isPainting())
         return;
 
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent();
+    if (timelineAgent)
+        timelineAgent->willLayout();
+#endif
+
     if (!allowSubtree && m_layoutRoot) {
         m_layoutRoot->markContainingBlocksForLayout(false);
         m_layoutRoot = 0;
@@ -533,8 +549,9 @@ void FrameView::layout(bool allowSubtree)
 
     m_nestedLayoutCount++;
 
-    ScrollbarMode hMode = m_hmode;
-    ScrollbarMode vMode = m_vmode;
+    ScrollbarMode hMode;
+    ScrollbarMode vMode;
+    scrollbarModes(hMode, vMode);
 
     if (!subtree) {
         RenderObject* rootRenderer = document->documentElement() ? document->documentElement()->renderer() : 0;
@@ -634,7 +651,7 @@ void FrameView::layout(bool allowSubtree)
 
 #if PLATFORM(MAC)
     if (AXObjectCache::accessibilityEnabled())
-        root->document()->axObjectCache()->postNotification(root, "AXLayoutComplete", true);
+        root->document()->axObjectCache()->postNotification(root, AXObjectCache::AXLayoutComplete, true);
 #endif
 #if ENABLE(DASHBOARD_SUPPORT)
     updateDashboardRegions();
@@ -665,6 +682,11 @@ void FrameView::layout(bool allowSubtree)
         ASSERT(m_enqueueEvents);
     }
 
+#if ENABLE(INSPECTOR)
+    if (timelineAgent)
+        timelineAgent->didLayout();
+#endif
+
     m_nestedLayoutCount--;
 }
 
@@ -809,9 +831,9 @@ void FrameView::repaintContentRectangle(const IntRect& r, bool immediate)
             m_repaintRects.append(unionedRect);
         }
         if (m_repaintCount < cRepaintRectUnionThreshold)
-            m_repaintRects.append(r);
+            m_repaintRects.append(visibleContent);
         else
-            m_repaintRects[0].unite(r);
+            m_repaintRects[0].unite(visibleContent);
         m_repaintCount++;
     
         if (!m_deferringRepaints && !m_deferredRepaintTimer.isActive())
@@ -1160,6 +1182,9 @@ void FrameView::scrollToAnchor()
     // Align to the top and to the closest side (this matches other browsers).
     anchorNode->renderer()->enclosingLayer()->scrollRectToVisible(rect, true, ScrollAlignment::alignToEdgeIfNeeded, ScrollAlignment::alignTopAlways);
 
+    if (AXObjectCache::accessibilityEnabled())
+        m_frame->document()->axObjectCache()->handleScrolledToAnchor(anchorNode.get());
+
     // scrollRectToVisible can call into scrollRectIntoViewRecursively(), which resets m_maintainScrollPositionAnchor.
     m_maintainScrollPositionAnchor = anchorNode;
 }
@@ -1366,6 +1391,86 @@ void FrameView::updateDashboardRegions()
 }
 #endif
 
+void FrameView::invalidateScrollCorner()
+{
+    invalidateRect(scrollCornerRect());
+}
+
+void FrameView::updateScrollCorner()
+{
+    RenderObject* renderer = 0;
+    RefPtr<RenderStyle> cornerStyle;
+    
+    if (!scrollCornerRect().isEmpty()) {
+        // Try the <body> element first as a scroll corner source.
+        Document* doc = m_frame->document();
+        Element* body = doc ? doc->body() : 0;
+        if (body && body->renderer()) {
+            renderer = body->renderer();
+            cornerStyle = renderer->getUncachedPseudoStyle(SCROLLBAR_CORNER, renderer->style());
+        }
+        
+        if (!cornerStyle) {
+            // If the <body> didn't have a custom style, then the root element might.
+            Element* docElement = doc ? doc->documentElement() : 0;
+            if (docElement && docElement->renderer()) {
+                renderer = docElement->renderer();
+                cornerStyle = renderer->getUncachedPseudoStyle(SCROLLBAR_CORNER, renderer->style());
+            }
+        }
+        
+        if (!cornerStyle) {
+            // If we have an owning iframe/frame element, then it can set the custom scrollbar also.
+            if (RenderPart* renderer = m_frame->ownerRenderer())
+                cornerStyle = renderer->getUncachedPseudoStyle(SCROLLBAR_CORNER, renderer->style());
+        }
+    }
+
+    if (cornerStyle) {
+        if (!m_scrollCorner)
+            m_scrollCorner = new (renderer->renderArena()) RenderScrollbarPart(renderer->document());
+        m_scrollCorner->setStyle(cornerStyle.release());
+        invalidateRect(scrollCornerRect());
+    } else if (m_scrollCorner) {
+        m_scrollCorner->destroy();
+        m_scrollCorner = 0;
+    }
+}
+
+void FrameView::paintScrollCorner(GraphicsContext* context, const IntRect& cornerRect)
+{
+    if (context->updatingControlTints()) {
+        updateScrollCorner();
+        return;
+    }
+
+    if (m_scrollCorner) {
+        m_scrollCorner->paintIntoRect(context, cornerRect.x(), cornerRect.y(), cornerRect);
+        return;
+    }
+
+    ScrollView::paintScrollCorner(context, cornerRect);
+}
+
+bool FrameView::hasCustomScrollbars() const
+{
+    const HashSet<RefPtr<Widget> >* viewChildren = children();
+    HashSet<RefPtr<Widget> >::const_iterator end = viewChildren->end();
+    for (HashSet<RefPtr<Widget> >::const_iterator current = viewChildren->begin(); current != end; ++current) {
+        Widget* widget = current->get();
+        if (widget->isFrameView()) {
+            if (static_cast<FrameView*>(widget)->hasCustomScrollbars())
+                return true;
+        } else if (widget->isScrollbar()) {
+            Scrollbar* scrollbar = static_cast<Scrollbar*>(widget);
+            if (scrollbar->isCustomScrollbar())
+                return true;
+        }
+    }
+
+    return false;
+}
+
 void FrameView::updateControlTints()
 {
     // This is called when control tints are changed from aqua/graphite to clear and vice versa.
@@ -1377,7 +1482,7 @@ void FrameView::updateControlTints()
     if (!m_frame || m_frame->loader()->url().isEmpty())
         return;
 
-    if (m_frame->contentRenderer() && m_frame->contentRenderer()->theme()->supportsControlTints()) {
+    if ((m_frame->contentRenderer() && m_frame->contentRenderer()->theme()->supportsControlTints()) || hasCustomScrollbars())  {
         if (needsLayout())
             layout();
         PlatformGraphicsContext* const noContext = 0;
@@ -1407,7 +1512,13 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
 {
     if (!frame())
         return;
-    
+
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent();
+    if (timelineAgent)
+        timelineAgent->willPaint();
+#endif
+
     Document* document = frame()->document();
 
 #ifndef NDEBUG
@@ -1443,6 +1554,13 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
     if (needsLayout())
         return;
 
+#if USE(ACCELERATED_COMPOSITING)
+    if (!p->paintingDisabled()) {
+        if (GraphicsLayer* rootLayer = contentRenderer->compositor()->rootPlatformLayer())
+            rootLayer->syncCompositingState();
+    }
+#endif
+
     ASSERT(!m_isPainting);
         
     m_isPainting = true;
@@ -1464,6 +1582,11 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
 
     if (isTopLevelPainter)
         sCurrentPaintTimeStamp = 0;
+
+#if ENABLE(INSPECTOR)
+    if (timelineAgent)
+        timelineAgent->didPaint();
+#endif
 }
 
 void FrameView::setPaintRestriction(PaintRestriction pr)
@@ -1505,10 +1628,15 @@ void FrameView::layoutIfNeededRecursive()
 
     // layoutIfNeededRecursive is called when we need to make sure layout is up-to-date before
     // painting, so we need to flush out any deferred repaints too.
-    if (m_deferredRepaintTimer.isActive()) {
-        m_deferredRepaintTimer.stop();
-        doDeferredRepaints();
-    }
+    flushDeferredRepaints();
+}
+    
+void FrameView::flushDeferredRepaints()
+{
+    if (!m_deferredRepaintTimer.isActive())
+        return;
+    m_deferredRepaintTimer.stop();
+    doDeferredRepaints();
 }
 
 void FrameView::forceLayout(bool allowSubtree)
@@ -1558,7 +1686,7 @@ void FrameView::adjustPageHeight(float *newBottom, float oldTop, float oldBottom
         // Use a context with painting disabled.
         GraphicsContext context((PlatformGraphicsContext*)0);
         root->setTruncatedAt((int)floorf(oldBottom));
-        IntRect dirtyRect(0, (int)floorf(oldTop), root->overflowWidth(), (int)ceilf(oldBottom - oldTop));
+        IntRect dirtyRect(0, (int)floorf(oldTop), root->rightLayoutOverflow(), (int)ceilf(oldBottom - oldTop));
         root->layer()->paint(&context, dirtyRect);
         *newBottom = root->bestTruncatedAt();
         if (*newBottom == 0)
diff --git a/src/3rdparty/webkit/WebCore/page/FrameView.h b/src/3rdparty/webkit/WebCore/page/FrameView.h
index 83e2c1e..617a8e9 100644
--- a/src/3rdparty/webkit/WebCore/page/FrameView.h
+++ b/src/3rdparty/webkit/WebCore/page/FrameView.h
@@ -25,7 +25,9 @@
 #ifndef FrameView_h
 #define FrameView_h
 
+#include "Frame.h"
 #include "IntSize.h"
+#include "Page.h"
 #include "RenderLayer.h"
 #include "ScrollView.h"
 #include <wtf/Forward.h>
@@ -37,6 +39,7 @@ class Color;
 class Event;
 class Frame;
 class FrameViewPrivate;
+class InspectorTimelineAgent;
 class IntRect;
 class Node;
 class PlatformMouseEvent;
@@ -69,8 +72,6 @@ public:
     void setMarginWidth(int);
     void setMarginHeight(int);
 
-    virtual void setCanHaveScrollbars(bool);
-
     virtual PassRefPtr<Scrollbar> createScrollbar(ScrollbarOrientation);
 
     virtual void setContentsSize(const IntSize&);
@@ -99,6 +100,9 @@ public:
     // content rendered via the normal painting path.
     void setNeedsOneShotDrawingSynchronization();
 #endif
+    // Only used with accelerated compositing, but outside the #ifdef to make linkage easier.
+    // Returns true if the sync was completed.
+    bool syncCompositingStateRecursive();
 
     void didMoveOnscreen();
     void willMoveOffscreen();
@@ -119,8 +123,6 @@ public:
     void setShouldUpdateWhileOffscreen(bool);
 
     void adjustViewSize();
-    void initScrollbars();
-    void updateDefaultScrollbarState();
     
     virtual IntRect windowClipRect(bool clipToContents = true) const;
     IntRect windowClipRectForLayer(const RenderLayer*, bool clipToLayerContents) const;
@@ -171,6 +173,7 @@ public:
     static double currentPaintTimeStamp() { return sCurrentPaintTimeStamp; } // returns 0 if not painting
     
     void layoutIfNeededRecursive();
+    void flushDeferredRepaints();
 
     void setIsVisuallyNonEmpty() { m_isVisuallyNonEmpty = true; }
 
@@ -187,6 +190,9 @@ public:
     virtual IntPoint convertFromRenderer(const RenderObject*, const IntPoint&) const;
     virtual IntPoint convertToRenderer(const RenderObject*, const IntPoint&) const;
 
+    bool isFrameViewScrollCorner(RenderScrollbarPart* scrollCorner) const { return m_scrollCorner == scrollCorner; }
+    void invalidateScrollCorner();
+
 private:
     FrameView(Frame*);
 
@@ -229,7 +235,16 @@ private:
 
     bool updateWidgets();
     void scrollToAnchor();
+
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* inspectorTimelineAgent() const;
+#endif
     
+    bool hasCustomScrollbars() const;
+
+    virtual void updateScrollCorner();
+    virtual void paintScrollCorner(GraphicsContext*, const IntRect& cornerRect);
+
     static double sCurrentPaintTimeStamp; // used for detecting decoded resource thrash in the cache
 
     IntSize m_size;
@@ -239,8 +254,6 @@ private:
 
     bool m_doFullRepaint;
     
-    ScrollbarMode m_vmode;
-    ScrollbarMode m_hmode;
     bool m_useSlowRepaints;
     bool m_isOverlapped;
     bool m_contentIsOpaque;
@@ -260,7 +273,6 @@ private:
     bool m_firstLayoutCallbackPending;
 
     bool m_firstLayout;
-    bool m_needToInitScrollbars;
     bool m_isTransparent;
     Color m_baseBackgroundColor;
     IntSize m_lastLayoutSize;
@@ -299,8 +311,18 @@ private:
     bool m_firstVisuallyNonEmptyLayoutCallbackPending;
 
     RefPtr<Node> m_maintainScrollPositionAnchor;
+
+    // Renderer to hold our custom scroll corner.
+    RenderScrollbarPart* m_scrollCorner;
 };
 
+#if ENABLE(INSPECTOR)
+inline InspectorTimelineAgent* FrameView::inspectorTimelineAgent() const
+{
+    return m_frame->page() ? m_frame->page()->inspectorTimelineAgent() : 0;
+}
+#endif
+
 } // namespace WebCore
 
 #endif // FrameView_h
diff --git a/src/3rdparty/webkit/WebCore/page/Geolocation.cpp b/src/3rdparty/webkit/WebCore/page/Geolocation.cpp
index 8abe8a6..86127d7 100644
--- a/src/3rdparty/webkit/WebCore/page/Geolocation.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Geolocation.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,28 +35,39 @@
 
 namespace WebCore {
 
-Geolocation::GeoNotifier::GeoNotifier(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
-    : m_successCallback(successCallback)
+Geolocation::GeoNotifier::GeoNotifier(Geolocation* geolocation, PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
+    : m_geolocation(geolocation)
+    , m_successCallback(successCallback)
     , m_errorCallback(errorCallback)
     , m_options(options)
     , m_timer(this, &Geolocation::GeoNotifier::timerFired)
 {
+    ASSERT(m_successCallback);
+    // If no options were supplied from JS, we should have created a default set
+    // of options in JSGeolocationCustom.cpp.
+    ASSERT(m_options);
 }
 
-void Geolocation::GeoNotifier::startTimer()
+bool Geolocation::GeoNotifier::hasZeroTimeout() const
 {
-    if (m_errorCallback && m_options)
+    return m_options->hasTimeout() && m_options->timeout() == 0;
+}
+
+void Geolocation::GeoNotifier::startTimerIfNeeded()
+{
+    if (m_options->hasTimeout())
         m_timer.startOneShot(m_options->timeout() / 1000.0);
 }
 
 void Geolocation::GeoNotifier::timerFired(Timer<GeoNotifier>*)
 {
-    ASSERT(m_errorCallback);
-    
     m_timer.stop();
 
-    RefPtr<PositionError> error = PositionError::create(PositionError::TIMEOUT, "Timed out");
-    m_errorCallback->handleEvent(error.get());
+    if (m_errorCallback) {
+        RefPtr<PositionError> error = PositionError::create(PositionError::TIMEOUT, "Timeout expired");
+        m_errorCallback->handleEvent(error.get());
+    }
+    m_geolocation->requestTimedOut(this);
 }
 
 Geolocation::Geolocation(Frame* frame)
@@ -73,14 +85,18 @@ Geolocation::Geolocation(Frame* frame)
 void Geolocation::disconnectFrame()
 {
     m_service->stopUpdating();
+    if (m_frame && m_frame->document())
+        m_frame->document()->setUsingGeolocation(false);
     m_frame = 0;
 }
 
 void Geolocation::getCurrentPosition(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
 {
-    RefPtr<GeoNotifier> notifier = GeoNotifier::create(successCallback, errorCallback, options);
+    RefPtr<GeoNotifier> notifier = GeoNotifier::create(this, successCallback, errorCallback, options);
 
-    if (!m_service->startUpdating(notifier->m_options.get())) {
+    if (notifier->hasZeroTimeout() || m_service->startUpdating(notifier->m_options.get()))
+        notifier->startTimerIfNeeded();
+    else {
         if (notifier->m_errorCallback) {
             RefPtr<PositionError> error = PositionError::create(PositionError::PERMISSION_DENIED, "Unable to Start");
             notifier->m_errorCallback->handleEvent(error.get());
@@ -93,9 +109,11 @@ void Geolocation::getCurrentPosition(PassRefPtr<PositionCallback> successCallbac
 
 int Geolocation::watchPosition(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
 {
-    RefPtr<GeoNotifier> notifier = GeoNotifier::create(successCallback, errorCallback, options);
+    RefPtr<GeoNotifier> notifier = GeoNotifier::create(this, successCallback, errorCallback, options);
 
-    if (!m_service->startUpdating(notifier->m_options.get())) {
+    if (notifier->hasZeroTimeout() || m_service->startUpdating(notifier->m_options.get()))
+        notifier->startTimerIfNeeded();
+    else {
         if (notifier->m_errorCallback) {
             RefPtr<PositionError> error = PositionError::create(PositionError::PERMISSION_DENIED, "Unable to Start");
             notifier->m_errorCallback->handleEvent(error.get());
@@ -110,6 +128,15 @@ int Geolocation::watchPosition(PassRefPtr<PositionCallback> successCallback, Pas
     return sIdentifier;
 }
 
+void Geolocation::requestTimedOut(GeoNotifier* notifier)
+{
+    // If this is a one-shot request, stop it.
+    m_oneShots.remove(notifier);
+
+    if (!hasListeners())
+        m_service->stopUpdating();
+}
+
 void Geolocation::clearWatch(int watchId)
 {
     m_watchers.remove(watchId);
@@ -134,122 +161,90 @@ void Geolocation::setIsAllowed(bool allowed)
 {
     m_allowGeolocation = allowed ? Yes : No;
     
-    if (isAllowed()) {
-        startTimers();
-        geolocationServicePositionChanged(m_service.get());
-    } else {
-        WTF::RefPtr<WebCore::PositionError> error = WebCore::PositionError::create(PositionError::PERMISSION_DENIED, "User disallowed GeoLocation");
+    if (isAllowed())
+        makeSuccessCallbacks();
+    else {
+        RefPtr<PositionError> error = PositionError::create(PositionError::PERMISSION_DENIED, "User disallowed Geolocation");
+        error->setIsFatal(true);
         handleError(error.get());
     }
 }
 
-void Geolocation::sendErrorToOneShots(PositionError* error)
+void Geolocation::sendError(Vector<RefPtr<GeoNotifier> >& notifiers, PositionError* error)
 {
-    Vector<RefPtr<GeoNotifier> > copy;
-    copyToVector(m_oneShots, copy);
-
-    Vector<RefPtr<GeoNotifier> >::const_iterator end = copy.end();
-    for (Vector<RefPtr<GeoNotifier> >::const_iterator it = copy.begin(); it != end; ++it) {
-        RefPtr<GeoNotifier> notifier = *it;
-        
-        if (notifier->m_errorCallback)
-            notifier->m_errorCallback->handleEvent(error);
-    }
+     Vector<RefPtr<GeoNotifier> >::const_iterator end = notifiers.end();
+     for (Vector<RefPtr<GeoNotifier> >::const_iterator it = notifiers.begin(); it != end; ++it) {
+         RefPtr<GeoNotifier> notifier = *it;
+         
+         if (notifier->m_errorCallback)
+             notifier->m_errorCallback->handleEvent(error);
+     }
 }
 
-void Geolocation::sendErrorToWatchers(PositionError* error)
+void Geolocation::sendPosition(Vector<RefPtr<GeoNotifier> >& notifiers, Geoposition* position)
 {
-    Vector<RefPtr<GeoNotifier> > copy;
-    copyValuesToVector(m_watchers, copy);
-
-    Vector<RefPtr<GeoNotifier> >::const_iterator end = copy.end();
-    for (Vector<RefPtr<GeoNotifier> >::const_iterator it = copy.begin(); it != end; ++it) {
-        RefPtr<GeoNotifier> notifier = *it;
-        
-        if (notifier->m_errorCallback)
-            notifier->m_errorCallback->handleEvent(error);
-    }
-}
-
-void Geolocation::sendPositionToOneShots(Geoposition* position)
-{
-    Vector<RefPtr<GeoNotifier> > copy;
-    copyToVector(m_oneShots, copy);
-    
-    Vector<RefPtr<GeoNotifier> >::const_iterator end = copy.end();
-    for (Vector<RefPtr<GeoNotifier> >::const_iterator it = copy.begin(); it != end; ++it) {
-        RefPtr<GeoNotifier> notifier = *it;
-        ASSERT(notifier->m_successCallback);
-        
-        notifier->m_timer.stop();
-        bool shouldCallErrorCallback = false;
-        notifier->m_successCallback->handleEvent(position, shouldCallErrorCallback);
-        if (shouldCallErrorCallback) {
-            RefPtr<PositionError> error = PositionError::create(PositionError::UNKNOWN_ERROR, "An exception was thrown");
-            handleError(error.get());
-        }
-    }
-}
-
-void Geolocation::sendPositionToWatchers(Geoposition* position)
-{
-    Vector<RefPtr<GeoNotifier> > copy;
-    copyValuesToVector(m_watchers, copy);
-    
-    Vector<RefPtr<GeoNotifier> >::const_iterator end = copy.end();
-    for (Vector<RefPtr<GeoNotifier> >::const_iterator it = copy.begin(); it != end; ++it) {
+    Vector<RefPtr<GeoNotifier> >::const_iterator end = notifiers.end();
+    for (Vector<RefPtr<GeoNotifier> >::const_iterator it = notifiers.begin(); it != end; ++it) {
         RefPtr<GeoNotifier> notifier = *it;
         ASSERT(notifier->m_successCallback);
         
-        notifier->m_timer.stop();
-        bool shouldCallErrorCallback = false;
-        notifier->m_successCallback->handleEvent(position, shouldCallErrorCallback);
-        if (shouldCallErrorCallback) {
-            RefPtr<PositionError> error = PositionError::create(PositionError::UNKNOWN_ERROR, "An exception was thrown");
-            handleError(error.get());
-        }
+        notifier->m_successCallback->handleEvent(position);
     }
 }
 
-void Geolocation::startTimer(Vector<RefPtr<GeoNotifier> >& notifiers)
+void Geolocation::stopTimer(Vector<RefPtr<GeoNotifier> >& notifiers)
 {
     Vector<RefPtr<GeoNotifier> >::const_iterator end = notifiers.end();
     for (Vector<RefPtr<GeoNotifier> >::const_iterator it = notifiers.begin(); it != end; ++it) {
         RefPtr<GeoNotifier> notifier = *it;
-        notifier->startTimer();
+        notifier->m_timer.stop();
     }
 }
 
-void Geolocation::startTimersForOneShots()
+void Geolocation::stopTimersForOneShots()
 {
     Vector<RefPtr<GeoNotifier> > copy;
     copyToVector(m_oneShots, copy);
     
-    startTimer(copy);
+    stopTimer(copy);
 }
 
-void Geolocation::startTimersForWatchers()
+void Geolocation::stopTimersForWatchers()
 {
     Vector<RefPtr<GeoNotifier> > copy;
     copyValuesToVector(m_watchers, copy);
     
-    startTimer(copy);
+    stopTimer(copy);
 }
 
-void Geolocation::startTimers()
+void Geolocation::stopTimers()
 {
-    startTimersForOneShots();
-    startTimersForWatchers();
+    stopTimersForOneShots();
+    stopTimersForWatchers();
 }
 
 void Geolocation::handleError(PositionError* error)
 {
     ASSERT(error);
     
-    sendErrorToOneShots(error);    
-    sendErrorToWatchers(error);
+    Vector<RefPtr<GeoNotifier> > oneShotsCopy;
+    copyToVector(m_oneShots, oneShotsCopy);
+
+    Vector<RefPtr<GeoNotifier> > watchersCopy;
+    copyValuesToVector(m_watchers, watchersCopy);
 
+    // Clear the lists before we make the callbacks, to avoid clearing notifiers
+    // added by calls to Geolocation methods from the callbacks, and to prevent
+    // further callbacks to these notifiers.
     m_oneShots.clear();
+    if (error->isFatal())
+        m_watchers.clear();
+
+    sendError(oneShotsCopy, error);
+    sendError(watchersCopy, error);
+
+    if (!hasListeners())
+        m_service->stopUpdating();
 }
 
 void Geolocation::requestPermission()
@@ -264,25 +259,51 @@ void Geolocation::requestPermission()
     if (!page)
         return;
     
+    m_allowGeolocation = InProgress;
+
     // Ask the chrome: it maintains the geolocation challenge policy itself.
     page->chrome()->requestGeolocationPermissionForFrame(m_frame, this);
-    
-    m_allowGeolocation = InProgress;
 }
 
 void Geolocation::geolocationServicePositionChanged(GeolocationService* service)
 {
-    ASSERT(service->lastPosition());
+    ASSERT_UNUSED(service, service == m_service);
+    ASSERT(m_service->lastPosition());
+
+    // Stop all currently running timers.
+    stopTimers();
     
-    requestPermission();
-    if (!isAllowed())
+    if (!isAllowed()) {
+        // requestPermission() will ask the chrome for permission. This may be
+        // implemented synchronously or asynchronously. In both cases,
+        // makeSuccessCallbacks() will be called if permission is granted, so
+        // there's nothing more to do here.
+        requestPermission();
         return;
+    }
+
+    makeSuccessCallbacks();
+}
+
+void Geolocation::makeSuccessCallbacks()
+{
+    ASSERT(m_service->lastPosition());
+    ASSERT(isAllowed());
     
-    sendPositionToOneShots(service->lastPosition());
-    sendPositionToWatchers(service->lastPosition());
-        
+    Vector<RefPtr<GeoNotifier> > oneShotsCopy;
+    copyToVector(m_oneShots, oneShotsCopy);
+    
+    Vector<RefPtr<GeoNotifier> > watchersCopy;
+    copyValuesToVector(m_watchers, watchersCopy);
+    
+    // Clear the lists before we make the callbacks, to avoid clearing notifiers
+    // added by calls to Geolocation methods from the callbacks, and to prevent
+    // further callbacks to these notifiers.
     m_oneShots.clear();
 
+    sendPosition(oneShotsCopy, m_service->lastPosition());
+    sendPosition(watchersCopy, m_service->lastPosition());
+
     if (!hasListeners())
         m_service->stopUpdating();
 }
diff --git a/src/3rdparty/webkit/WebCore/page/Geolocation.h b/src/3rdparty/webkit/WebCore/page/Geolocation.h
index ae24bdd..07a587f 100644
--- a/src/3rdparty/webkit/WebCore/page/Geolocation.h
+++ b/src/3rdparty/webkit/WebCore/page/Geolocation.h
@@ -73,32 +73,33 @@ private:
 
     class GeoNotifier : public RefCounted<GeoNotifier> {
     public:
-        static PassRefPtr<GeoNotifier> create(PassRefPtr<PositionCallback> positionCallback, PassRefPtr<PositionErrorCallback> positionErrorCallback, PassRefPtr<PositionOptions> options) { return adoptRef(new GeoNotifier(positionCallback, positionErrorCallback, options)); }
+        static PassRefPtr<GeoNotifier> create(Geolocation* geolocation, PassRefPtr<PositionCallback> positionCallback, PassRefPtr<PositionErrorCallback> positionErrorCallback, PassRefPtr<PositionOptions> options) { return adoptRef(new GeoNotifier(geolocation, positionCallback, positionErrorCallback, options)); }
         
-        void startTimer();
+        bool hasZeroTimeout() const;
+        void startTimerIfNeeded();
         void timerFired(Timer<GeoNotifier>*);
         
+        Geolocation* m_geolocation;
         RefPtr<PositionCallback> m_successCallback;
         RefPtr<PositionErrorCallback> m_errorCallback;
         RefPtr<PositionOptions> m_options;
         Timer<GeoNotifier> m_timer;
 
     private:
-        GeoNotifier(PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PassRefPtr<PositionOptions>);
+        GeoNotifier(Geolocation*, PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PassRefPtr<PositionOptions>);
     };
 
     bool hasListeners() const { return !m_oneShots.isEmpty() || !m_watchers.isEmpty(); }
 
-    void sendErrorToOneShots(PositionError*);
-    void sendErrorToWatchers(PositionError*);
-    void sendPositionToOneShots(Geoposition*);
-    void sendPositionToWatchers(Geoposition*);
+    void sendError(Vector<RefPtr<GeoNotifier> >&, PositionError*);
+    void sendPosition(Vector<RefPtr<GeoNotifier> >&, Geoposition*);
     
-    static void startTimer(Vector<RefPtr<GeoNotifier> >&);
-    void startTimersForOneShots();
-    void startTimersForWatchers();
-    void startTimers();
+    static void stopTimer(Vector<RefPtr<GeoNotifier> >&);
+    void stopTimersForOneShots();
+    void stopTimersForWatchers();
+    void stopTimers();
     
+    void makeSuccessCallbacks();
     void handleError(PositionError*);
 
     void requestPermission();
@@ -107,6 +108,8 @@ private:
     virtual void geolocationServicePositionChanged(GeolocationService*);
     virtual void geolocationServiceErrorOccurred(GeolocationService*);
 
+    void requestTimedOut(GeoNotifier*);
+
     typedef HashSet<RefPtr<GeoNotifier> > GeoNotifierSet;
     typedef HashMap<int, RefPtr<GeoNotifier> > GeoNotifierMap;
     
diff --git a/src/3rdparty/webkit/WebCore/page/Geoposition.h b/src/3rdparty/webkit/WebCore/page/Geoposition.h
index 505e8b3..f3c703b 100644
--- a/src/3rdparty/webkit/WebCore/page/Geoposition.h
+++ b/src/3rdparty/webkit/WebCore/page/Geoposition.h
@@ -42,8 +42,6 @@ public:
     DOMTimeStamp timestamp() const { return m_timestamp; }
     Coordinates* coords() const { return m_coordinates.get(); }
     
-    String toString() const;
-
 private:
     Geoposition(PassRefPtr<Coordinates> coordinates, DOMTimeStamp timestamp)
         : m_coordinates(coordinates)
diff --git a/src/3rdparty/webkit/WebCore/page/Geoposition.idl b/src/3rdparty/webkit/WebCore/page/Geoposition.idl
index de508fe..3ec8b0b 100644
--- a/src/3rdparty/webkit/WebCore/page/Geoposition.idl
+++ b/src/3rdparty/webkit/WebCore/page/Geoposition.idl
@@ -28,9 +28,5 @@ module core {
     interface Geoposition {
         readonly attribute Coordinates coords;
         readonly attribute DOMTimeStamp timestamp;
-
-#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-        [DontEnum] DOMString toString();
-#endif
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/page/Location.cpp b/src/3rdparty/webkit/WebCore/page/Location.cpp
index c8780eb..5adc48d 100644
--- a/src/3rdparty/webkit/WebCore/page/Location.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Location.cpp
@@ -125,8 +125,8 @@ String Location::hash() const
     if (!m_frame)
         return String();
 
-    const KURL& url = this->url();
-    return url.ref().isEmpty() ? "" : "#" + url.ref();
+    const String& fragmentIdentifier = this->url().fragmentIdentifier();
+    return fragmentIdentifier.isEmpty() ? "" : "#" + fragmentIdentifier;
 }
 
 String Location::toString() const
diff --git a/src/3rdparty/webkit/WebCore/page/Navigator.cpp b/src/3rdparty/webkit/WebCore/page/Navigator.cpp
index 3603b86..4922860 100644
--- a/src/3rdparty/webkit/WebCore/page/Navigator.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Navigator.cpp
@@ -31,11 +31,13 @@
 #include "Language.h"
 #include "MimeTypeArray.h"
 #include "Page.h"
+#include "PageGroup.h"
 #include "PlatformString.h"
 #include "PluginArray.h"
 #include "PluginData.h"
 #include "ScriptController.h"
 #include "Settings.h"
+#include "StorageNamespace.h"
 
 namespace WebCore {
 
@@ -150,5 +152,21 @@ Geolocation* Navigator::geolocation() const
         m_geolocation = Geolocation::create(m_frame);
     return m_geolocation.get();
 }
-    
+
+#if ENABLE(DOM_STORAGE)
+void Navigator::getStorageUpdates()
+{
+    if (!m_frame)
+        return;
+
+    Page* page = m_frame->page();
+    if (!page)
+        return;
+
+    StorageNamespace* localStorage = page->group().localStorage();
+    if (localStorage)
+        localStorage->unlock();
+}
+#endif
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/Navigator.h b/src/3rdparty/webkit/WebCore/page/Navigator.h
index d50721e..4adebe1 100644
--- a/src/3rdparty/webkit/WebCore/page/Navigator.h
+++ b/src/3rdparty/webkit/WebCore/page/Navigator.h
@@ -55,6 +55,11 @@ namespace WebCore {
         // This is used for GC marking.
         Geolocation* optionalGeolocation() const { return m_geolocation.get(); }
 
+#if ENABLE(DOM_STORAGE)
+        // Relinquishes the storage lock, if one exists.
+        void getStorageUpdates();
+#endif
+
     private:
         Navigator(Frame*);
         Frame* m_frame;
diff --git a/src/3rdparty/webkit/WebCore/page/Navigator.idl b/src/3rdparty/webkit/WebCore/page/Navigator.idl
index 8048ff3..80ef4fb 100644
--- a/src/3rdparty/webkit/WebCore/page/Navigator.idl
+++ b/src/3rdparty/webkit/WebCore/page/Navigator.idl
@@ -42,6 +42,10 @@ module window {
 #if defined(ENABLE_GEOLOCATION) && ENABLE_GEOLOCATION
         readonly attribute Geolocation geolocation;
 #endif
+
+#if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
+        void getStorageUpdates();
+#endif
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/page/OriginAccessEntry.cpp b/src/3rdparty/webkit/WebCore/page/OriginAccessEntry.cpp
new file mode 100644
index 0000000..98c280c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/OriginAccessEntry.cpp
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "OriginAccessEntry.h"
+
+#include "SecurityOrigin.h"
+
+namespace WebCore {
+    
+OriginAccessEntry::OriginAccessEntry(const String& protocol, const String& host, SubdomainSetting subdomainSetting)
+    : m_protocol(protocol.lower())
+    , m_host(host.lower())
+    , m_subdomainSettings(subdomainSetting)
+{
+    ASSERT(m_protocol == "http" || m_protocol == "https");
+    ASSERT(subdomainSetting == AllowSubdomains || subdomainSetting == DisallowSubdomains);
+
+    // Assume that any host that ends with a digit is trying to be an IP address.
+    m_hostIsIPAddress = !m_host.isEmpty() && isASCIIDigit(m_host[m_host.length() - 1]);
+}
+
+bool OriginAccessEntry::matchesOrigin(const SecurityOrigin& origin) const
+{
+    ASSERT(origin.host() == origin.host().lower());
+    ASSERT(origin.protocol() == origin.protocol().lower());
+
+    if (m_protocol != origin.protocol())
+        return false;
+    
+    // Special case: Include subdomains and empty host means "all hosts, including ip addresses".
+    if (m_subdomainSettings == AllowSubdomains && m_host.isEmpty())
+        return true;
+    
+    // Exact match.
+    if (m_host == origin.host())
+        return true;
+    
+    // Otherwise we can only match if we're matching subdomains.
+    if (m_subdomainSettings == DisallowSubdomains)
+        return false;
+    
+    // Don't try to do subdomain matching on IP addresses.
+    if (m_hostIsIPAddress)
+        return false;
+    
+    // Match subdomains.
+    if (origin.host().length() > m_host.length() && origin.host()[origin.host().length() - m_host.length() - 1] == '.' && origin.host().endsWith(m_host))
+        return true;
+    
+    return false;
+}
+    
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/OriginAccessEntry.h b/src/3rdparty/webkit/WebCore/page/OriginAccessEntry.h
new file mode 100644
index 0000000..767d75f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/OriginAccessEntry.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CrossOriginAccess_h
+#define CrossOriginAccess_h
+
+#include "PlatformString.h"
+
+namespace WebCore {
+
+class SecurityOrigin;
+
+class OriginAccessEntry {
+public:
+    enum SubdomainSetting {
+        AllowSubdomains,
+        DisallowSubdomains
+    };
+
+    // If host is empty string and SubdomainSetting is AllowSubdomains, the entry will match all domains in the specified protocol.
+    OriginAccessEntry(const String& protocol, const String& host, SubdomainSetting);
+    bool matchesOrigin(const SecurityOrigin&) const;
+    
+private:
+    String m_protocol;
+    String m_host;
+    SubdomainSetting m_subdomainSettings;
+    bool m_hostIsIPAddress;
+    
+};
+
+} // namespace WebCore
+
+#endif // CrossOriginAccess_h
diff --git a/src/3rdparty/webkit/WebCore/page/Page.cpp b/src/3rdparty/webkit/WebCore/page/Page.cpp
index 32c60c6..f6f6a81 100644
--- a/src/3rdparty/webkit/WebCore/page/Page.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Page.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "Page.h"
 
+#include "Base64.h"
 #include "CSSStyleSelector.h"
 #include "Chrome.h"
 #include "ChromeClient.h"
@@ -34,11 +35,13 @@
 #include "FocusController.h"
 #include "Frame.h"
 #include "FrameLoader.h"
+#include "FrameLoaderClient.h"
 #include "FrameTree.h"
 #include "FrameView.h"
 #include "HTMLElement.h"
 #include "HistoryItem.h"
 #include "InspectorController.h"
+#include "InspectorTimelineAgent.h"
 #include "Logging.h"
 #include "Navigator.h"
 #include "NetworkStateNotifier.h"
@@ -97,10 +100,16 @@ static void networkStateChanged()
 Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, EditorClient* editorClient, DragClient* dragClient, InspectorClient* inspectorClient)
     : m_chrome(new Chrome(this, chromeClient))
     , m_dragCaretController(new SelectionController(0, true))
+#if ENABLE(DRAG_SUPPORT)
     , m_dragController(new DragController(this, dragClient))
+#endif
     , m_focusController(new FocusController(this))
+#if ENABLE(CONTEXT_MENUS)
     , m_contextMenuController(new ContextMenuController(this, contextMenuClient))
+#endif
+#if ENABLE(INSPECTOR)
     , m_inspectorController(new InspectorController(this, inspectorClient))
+#endif
     , m_settings(new Settings(this))
     , m_progress(new ProgressTracker)
     , m_backForwardList(BackForwardList::create(this))
@@ -114,14 +123,26 @@ Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, Edi
     , m_areMemoryCacheClientCallsEnabled(true)
     , m_mediaVolume(1)
     , m_javaScriptURLsAreAllowed(true)
+#if ENABLE(INSPECTOR)
     , m_parentInspectorController(0)
+#endif
     , m_didLoadUserStyleSheet(false)
     , m_userStyleSheetModificationTime(0)
     , m_group(0)
     , m_debugger(0)
     , m_customHTMLTokenizerTimeDelay(-1)
     , m_customHTMLTokenizerChunkSize(-1)
+    , m_canStartPlugins(true)
 {
+#if !ENABLE(CONTEXT_MENUS)
+    UNUSED_PARAM(contextMenuClient);
+#endif
+#if !ENABLE(DRAG_SUPPORT)
+    UNUSED_PARAM(dragClient);
+#endif
+#if !ENABLE(INSPECTOR)
+    UNUSED_PARAM(inspectorClient);
+#endif
     if (!allPages) {
         allPages = new HashSet<Page*>;
         
@@ -150,9 +171,11 @@ Page::~Page()
         frame->pageDestroyed();
 
     m_editorClient->pageDestroyed();
+#if ENABLE(INSPECTOR)
     if (m_parentInspectorController)
         m_parentInspectorController->pageDestroyed();
     m_inspectorController->inspectedPageDestroyed();
+#endif
 
     m_backForwardList->close();
 
@@ -211,7 +234,7 @@ void Page::goToItem(HistoryItem* item, FrameLoadType type)
     const KURL& currentURL = m_mainFrame->loader()->url();
     const KURL& newURL = item->url();
 
-    if (newURL.hasRef() && equalIgnoringRef(currentURL, newURL))
+    if (newURL.hasFragmentIdentifier() && equalIgnoringFragmentIdentifier(currentURL, newURL))
         databasePolicy = DatabasePolicyContinue;
 #endif
     m_mainFrame->loader()->stopAllLoaders(databasePolicy);
@@ -298,6 +321,19 @@ PluginData* Page::pluginData() const
     return m_pluginData.get();
 }
 
+void Page::addUnstartedPlugin(PluginView* view)
+{
+    ASSERT(!m_canStartPlugins);
+    m_unstartedPlugins.add(view);
+}
+
+void Page::removeUnstartedPlugin(PluginView* view)
+{
+    ASSERT(!m_canStartPlugins);
+    ASSERT(m_unstartedPlugins.contains(view));
+    m_unstartedPlugins.remove(view);
+}
+
 static Frame* incrementFrame(Frame* curr, bool forward, bool wrapFlag)
 {
     return forward
@@ -424,26 +460,43 @@ void Page::willMoveOffscreen()
 
 void Page::userStyleSheetLocationChanged()
 {
-#if !FRAME_LOADS_USER_STYLESHEET
-    // FIXME: We should provide a way to load other types of URLs than just
-    // file: (e.g., http:, data:).
-    if (m_settings->userStyleSheetLocation().isLocalFile())
-        m_userStyleSheetPath = m_settings->userStyleSheetLocation().fileSystemPath();
+    // FIXME: Eventually we will move to a model of just being handed the sheet
+    // text instead of loading the URL ourselves.
+    KURL url = m_settings->userStyleSheetLocation();
+    if (url.isLocalFile())
+        m_userStyleSheetPath = url.fileSystemPath();
     else
         m_userStyleSheetPath = String();
 
     m_didLoadUserStyleSheet = false;
     m_userStyleSheet = String();
     m_userStyleSheetModificationTime = 0;
-#endif
+    
+    // Data URLs with base64-encoded UTF-8 style sheets are common. We can process them
+    // synchronously and avoid using a loader. 
+    if (url.protocolIs("data") && url.string().startsWith("data:text/css;charset=utf-8;base64,")) {
+        m_didLoadUserStyleSheet = true;
+        
+        const unsigned prefixLength = 35;
+        Vector<char> encodedData(url.string().length() - prefixLength);
+        for (unsigned i = prefixLength; i < url.string().length(); ++i)
+            encodedData[i - prefixLength] = static_cast<char>(url.string()[i]);
+
+        Vector<char> styleSheetAsUTF8;
+        if (base64Decode(encodedData, styleSheetAsUTF8))
+            m_userStyleSheet = String::fromUTF8(styleSheetAsUTF8.data());
+    }
+    
+    for (Frame* frame = mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+        if (frame->document())
+            frame->document()->clearPageUserSheet();
+    }
 }
 
 const String& Page::userStyleSheet() const
 {
-    if (m_userStyleSheetPath.isEmpty()) {
-        ASSERT(m_userStyleSheet.isEmpty());
+    if (m_userStyleSheetPath.isEmpty())
         return m_userStyleSheet;
-    }
 
     time_t modTime;
     if (!getFileModificationTime(m_userStyleSheetPath, modTime)) {
@@ -499,7 +552,9 @@ void Page::removeAllVisitedLinks()
 void Page::allVisitedStateChanged(PageGroup* group)
 {
     ASSERT(group);
-    ASSERT(allPages);
+    if (!allPages)
+        return;
+
     HashSet<Page*>::iterator pagesEnd = allPages->end();
     for (HashSet<Page*>::iterator it = allPages->begin(); it != pagesEnd; ++it) {
         Page* page = *it;
@@ -515,7 +570,9 @@ void Page::allVisitedStateChanged(PageGroup* group)
 void Page::visitedStateChanged(PageGroup* group, LinkHash visitedLinkHash)
 {
     ASSERT(group);
-    ASSERT(allPages);
+    if (!allPages)
+        return;
+
     HashSet<Page*>::iterator pagesEnd = allPages->end();
     for (HashSet<Page*>::iterator it = allPages->begin(); it != pagesEnd; ++it) {
         Page* page = *it;
@@ -613,4 +670,11 @@ bool Page::javaScriptURLsAreAllowed() const
     return m_javaScriptURLsAreAllowed;
 }
 
+#if ENABLE(INSPECTOR)
+InspectorTimelineAgent* Page::inspectorTimelineAgent() const
+{
+    return m_inspectorController->timelineAgent();
+}
+#endif
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/Page.h b/src/3rdparty/webkit/WebCore/page/Page.h
index cc3d25d..d3f7ddb 100644
--- a/src/3rdparty/webkit/WebCore/page/Page.h
+++ b/src/3rdparty/webkit/WebCore/page/Page.h
@@ -56,9 +56,11 @@ namespace WebCore {
     class Frame;
     class InspectorClient;
     class InspectorController;
+    class InspectorTimelineAgent;
     class Node;
     class PageGroup;
     class PluginData;
+    class PluginView;
     class ProgressTracker;
     class RenderTheme;
     class VisibleSelection;
@@ -70,6 +72,9 @@ namespace WebCore {
 #if ENABLE(WML)
     class WMLPageState;
 #endif
+#if ENABLE(NOTIFICATIONS)
+    class NotificationPresenter;
+#endif
 
     enum FindDirection { FindDirectionForward, FindDirectionBackward };
 
@@ -85,6 +90,11 @@ namespace WebCore {
         static void refreshPlugins(bool reload);
         PluginData* pluginData() const;
 
+        void setCanStartPlugins(bool);
+        bool canStartPlugins() const { return m_canStartPlugins; }
+        void addUnstartedPlugin(PluginView*);
+        void removeUnstartedPlugin(PluginView*);
+
         EditorClient* editorClient() const { return m_editorClient; }
 
         void setMainFrame(PassRefPtr<Frame>);
@@ -115,15 +125,23 @@ namespace WebCore {
 
         Chrome* chrome() const { return m_chrome.get(); }
         SelectionController* dragCaretController() const { return m_dragCaretController.get(); }
+#if ENABLE(DRAG_SUPPORT)
         DragController* dragController() const { return m_dragController.get(); }
+#endif
         FocusController* focusController() const { return m_focusController.get(); }
+#if ENABLE(CONTEXT_MENUS)
         ContextMenuController* contextMenuController() const { return m_contextMenuController.get(); }
+#endif
+#if ENABLE(INSPECTOR)
         InspectorController* inspectorController() const { return m_inspectorController.get(); }
+#endif
         Settings* settings() const { return m_settings.get(); }
         ProgressTracker* progress() const { return m_progress.get(); }
 
+#if ENABLE(INSPECTOR)
         void setParentInspectorController(InspectorController* controller) { m_parentInspectorController = controller; }
         InspectorController* parentInspectorController() const { return m_parentInspectorController; }
+#endif
         
         void setTabKeyCyclesThroughElements(bool b) { m_tabKeyCyclesThroughElements = b; }
         bool tabKeyCyclesThroughElements() const { return m_tabKeyCyclesThroughElements; }
@@ -201,15 +219,24 @@ namespace WebCore {
         void setJavaScriptURLsAreAllowed(bool);
         bool javaScriptURLsAreAllowed() const;
 
+#if ENABLE(INSPECTOR)
+        InspectorTimelineAgent* inspectorTimelineAgent() const;
+#endif
     private:
         void initGroup();
 
         OwnPtr<Chrome> m_chrome;
         OwnPtr<SelectionController> m_dragCaretController;
+#if ENABLE(DRAG_SUPPORT)
         OwnPtr<DragController> m_dragController;
+#endif
         OwnPtr<FocusController> m_focusController;
+#if ENABLE(CONTEXT_MENUS)
         OwnPtr<ContextMenuController> m_contextMenuController;
+#endif
+#if ENABLE(INSPECTOR)
         OwnPtr<InspectorController> m_inspectorController;
+#endif
         OwnPtr<Settings> m_settings;
         OwnPtr<ProgressTracker> m_progress;
         
@@ -237,7 +264,9 @@ namespace WebCore {
 
         bool m_javaScriptURLsAreAllowed;
 
+#if ENABLE(INSPECTOR)
         InspectorController* m_parentInspectorController;
+#endif
 
         String m_userStyleSheetPath;
         mutable String m_userStyleSheet;
@@ -252,6 +281,9 @@ namespace WebCore {
         double m_customHTMLTokenizerTimeDelay;
         int m_customHTMLTokenizerChunkSize;
 
+        bool m_canStartPlugins;
+        HashSet<PluginView*> m_unstartedPlugins;
+
 #if ENABLE(DOM_STORAGE)
         RefPtr<StorageNamespace> m_sessionStorage;
 #endif
@@ -263,6 +295,10 @@ namespace WebCore {
 #if ENABLE(WML)
         OwnPtr<WMLPageState> m_wmlPageState;
 #endif
+
+#if ENABLE(NOTIFICATIONS)
+        NotificationPresenter* m_notificationPresenter;
+#endif
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/PageGroup.cpp b/src/3rdparty/webkit/WebCore/page/PageGroup.cpp
index 5155be1..f9855a7 100644
--- a/src/3rdparty/webkit/WebCore/page/PageGroup.cpp
+++ b/src/3rdparty/webkit/WebCore/page/PageGroup.cpp
@@ -28,6 +28,7 @@
 
 #include "ChromeClient.h"
 #include "Document.h"
+#include "Frame.h"
 #include "Page.h"
 #include "Settings.h"
 
@@ -66,6 +67,11 @@ PageGroup::PageGroup(Page* page)
     addPage(page);
 }
 
+PageGroup::~PageGroup()
+{
+    removeAllUserContent();
+}
+
 typedef HashMap<String, PageGroup*> PageGroupMap;
 static PageGroupMap* pageGroups = 0;
 
@@ -193,4 +199,71 @@ StorageNamespace* PageGroup::localStorage()
 }
 #endif
 
+void PageGroup::addUserScript(const String& source, const KURL& url, const Vector<String>& patterns, 
+                              unsigned worldID, UserScriptInjectionTime injectionTime)
+{
+    if (worldID == UINT_MAX)
+        return;
+    OwnPtr<UserScript> userScript(new UserScript(source, url, patterns, worldID, injectionTime));
+    if (!m_userScripts)
+        m_userScripts.set(new UserScriptMap);
+    UserScriptVector*& scriptsInWorld = m_userScripts->add(worldID, 0).first->second;
+    if (!scriptsInWorld)
+        scriptsInWorld = new UserScriptVector;
+    scriptsInWorld->append(userScript.release());
+}
+
+void PageGroup::addUserStyleSheet(const String& source, const KURL& url, const Vector<String>& patterns, unsigned worldID)
+{
+    if (worldID == UINT_MAX)
+        return;
+    OwnPtr<UserStyleSheet> userStyleSheet(new UserStyleSheet(source, url, patterns, worldID));
+    if (!m_userStyleSheets)
+        m_userStyleSheets.set(new UserStyleSheetMap);
+    UserStyleSheetVector*& styleSheetsInWorld = m_userStyleSheets->add(worldID, 0).first->second;
+    if (!styleSheetsInWorld)
+        styleSheetsInWorld = new UserStyleSheetVector;
+    styleSheetsInWorld->append(userStyleSheet.release());
+    
+    // Clear our cached sheets and have them just reparse.
+    HashSet<Page*>::const_iterator end = m_pages.end();
+    for (HashSet<Page*>::const_iterator it = m_pages.begin(); it != end; ++it) {
+        for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext())
+            frame->document()->clearPageGroupUserSheets();
+    }
+}
+
+void PageGroup::removeUserContentForWorld(unsigned worldID)
+{
+    if (m_userScripts) {
+        UserScriptMap::iterator it = m_userScripts->find(worldID);
+        if (it != m_userScripts->end()) {
+            m_userScripts->remove(it);
+            delete it->second;
+        }
+    }
+    
+    if (m_userStyleSheets) {
+        UserStyleSheetMap::iterator it = m_userStyleSheets->find(worldID);
+        if (it != m_userStyleSheets->end()) {
+            m_userStyleSheets->remove(it);
+            delete it->second;
+        }
+    }
+}
+
+void PageGroup::removeAllUserContent()
+{
+    if (m_userScripts) {
+        deleteAllValues(*m_userScripts);
+        m_userScripts.clear();
+    }
+    
+    
+    if (m_userStyleSheets) {
+        deleteAllValues(*m_userStyleSheets);
+        m_userStyleSheets.clear();
+    }
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/PageGroup.h b/src/3rdparty/webkit/WebCore/page/PageGroup.h
index f92c2e6..0bf3fbc 100644
--- a/src/3rdparty/webkit/WebCore/page/PageGroup.h
+++ b/src/3rdparty/webkit/WebCore/page/PageGroup.h
@@ -30,6 +30,8 @@
 #include <wtf/Noncopyable.h>
 #include "LinkHash.h"
 #include "StringHash.h"
+#include "UserScript.h"
+#include "UserStyleSheet.h"
 
 namespace WebCore {
 
@@ -41,6 +43,7 @@ namespace WebCore {
     public:
         PageGroup(const String& name);
         PageGroup(Page*);
+        ~PageGroup();
 
         static PageGroup* pageGroup(const String& groupName);
         static void closeLocalStorage();
@@ -64,13 +67,22 @@ namespace WebCore {
 
 #if ENABLE(DOM_STORAGE)
         StorageNamespace* localStorage();
+        bool hasLocalStorage() { return m_localStorage; }
 #endif
 
+        void addUserScript(const String& source, const KURL&, const Vector<String>& patterns,
+                           unsigned worldID, UserScriptInjectionTime);
+        const UserScriptMap* userScripts() const { return m_userScripts.get(); }
+        
+        void addUserStyleSheet(const String& source, const KURL&, const Vector<String>& patterns, unsigned worldID);
+        const UserStyleSheetMap* userStyleSheets() const { return m_userStyleSheets.get(); }
+        
+        void removeUserContentForWorld(unsigned);
+        void removeAllUserContent();
+        
     private:
         void addVisitedLink(LinkHash stringHash);
-#if ENABLE(DOM_STORAGE)
-        bool hasLocalStorage() { return m_localStorage; }
-#endif
+
         String m_name;
 
         HashSet<Page*> m_pages;
@@ -82,6 +94,9 @@ namespace WebCore {
 #if ENABLE(DOM_STORAGE)
         RefPtr<StorageNamespace> m_localStorage;
 #endif
+
+        OwnPtr<UserScriptMap> m_userScripts;
+        OwnPtr<UserStyleSheetMap> m_userStyleSheets;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/PositionCallback.h b/src/3rdparty/webkit/WebCore/page/PositionCallback.h
index 5f32c75..9f36d7a 100644
--- a/src/3rdparty/webkit/WebCore/page/PositionCallback.h
+++ b/src/3rdparty/webkit/WebCore/page/PositionCallback.h
@@ -36,7 +36,7 @@ namespace WebCore {
     class PositionCallback : public RefCounted<PositionCallback> {
     public:
         virtual ~PositionCallback() { }
-        virtual void handleEvent(Geoposition* position, bool& raisedException) = 0;
+        virtual void handleEvent(Geoposition*) = 0;
     };
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/PositionError.h b/src/3rdparty/webkit/WebCore/page/PositionError.h
index 1d31f3b..f6f56f0 100644
--- a/src/3rdparty/webkit/WebCore/page/PositionError.h
+++ b/src/3rdparty/webkit/WebCore/page/PositionError.h
@@ -45,16 +45,22 @@ public:
 
     ErrorCode code() const { return m_code; }
     const String& message() const { return m_message; }
+    void setIsFatal(bool isFatal) { m_isFatal = isFatal; }
+    bool isFatal() const { return m_isFatal; }
     
 private:
     PositionError(ErrorCode code, const String& message) 
         : m_code(code)
         , m_message(message)
+        , m_isFatal(false)
     {
     }
     
     ErrorCode m_code;
     String m_message;
+    // Whether the error is fatal, such that no request can ever obtain a good
+    // position fix in the future.
+    bool m_isFatal;
 };
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/PositionOptions.h b/src/3rdparty/webkit/WebCore/page/PositionOptions.h
index 10845d3..ed7074b 100644
--- a/src/3rdparty/webkit/WebCore/page/PositionOptions.h
+++ b/src/3rdparty/webkit/WebCore/page/PositionOptions.h
@@ -33,26 +33,41 @@ namespace WebCore {
     
 class PositionOptions : public RefCounted<PositionOptions> {
 public:
-    static PassRefPtr<PositionOptions> create(bool highAccuracy, unsigned timeout, unsigned maximumAge) { return adoptRef(new PositionOptions(highAccuracy, timeout, maximumAge)); }
+    static PassRefPtr<PositionOptions> create() { return adoptRef(new PositionOptions()); }
 
     bool enableHighAccuracy() const { return m_highAccuracy; }
     void setEnableHighAccuracy(bool enable) { m_highAccuracy = enable; }
-    unsigned timeout() const { return m_timeout; }
-    void setTimeout(unsigned t) { m_timeout = t; }
-    unsigned maximumAge() const { return m_maximumAge; }
-    void setMaximumAge(unsigned a) { m_maximumAge = a; }
+    bool hasTimeout() const { return m_hasTimeout; }
+    int timeout() const
+    {
+        ASSERT(hasTimeout());
+        return m_timeout;
+    }
+    void setTimeout(int timeout)
+    {
+        ASSERT(timeout >= 0);
+        m_hasTimeout = true;
+        m_timeout = timeout;
+    }
+    int maximumAge() const { return m_maximumAge; }
+    void setMaximumAge(int age)
+    {
+        ASSERT(age >= 0);
+        m_maximumAge = age;
+    }
     
 private:
-    PositionOptions(bool highAccuracy, unsigned timeout, unsigned maximumAge)
-        : m_highAccuracy(highAccuracy)
-        , m_timeout(timeout)
-        , m_maximumAge(maximumAge)
+    PositionOptions()
+        : m_highAccuracy(false)
+        , m_hasTimeout(false)
+        , m_maximumAge(0)
     {
     }
     
     bool m_highAccuracy;
-    unsigned m_timeout;
-    unsigned m_maximumAge;
+    bool m_hasTimeout;
+    int m_timeout;
+    int m_maximumAge;
 };
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/PrintContext.cpp b/src/3rdparty/webkit/WebCore/page/PrintContext.cpp
index 2202559..4d3a839 100644
--- a/src/3rdparty/webkit/WebCore/page/PrintContext.cpp
+++ b/src/3rdparty/webkit/WebCore/page/PrintContext.cpp
@@ -53,7 +53,7 @@ void PrintContext::computePageRects(const FloatRect& printRect, float headerHeig
     if (!m_frame->document() || !m_frame->view() || !m_frame->document()->renderer())
         return;
 
-    RenderView* root = static_cast<RenderView*>(m_frame->document()->renderer());
+    RenderView* root = toRenderView(m_frame->document()->renderer());
 
     if (!root) {
         LOG_ERROR("document to be printed has no renderer");
@@ -67,7 +67,7 @@ void PrintContext::computePageRects(const FloatRect& printRect, float headerHeig
 
     float ratio = printRect.height() / printRect.width();
 
-    float pageWidth  = (float)root->overflowWidth();
+    float pageWidth  = (float)root->rightLayoutOverflow();
     float pageHeight = pageWidth * ratio;
     outPageHeight = pageHeight;   // this is the height of the page adjusted by margins
     pageHeight -= headerHeight + footerHeight;
diff --git a/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp b/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp
index baafd4e..5076adf 100644
--- a/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp
+++ b/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp
@@ -32,14 +32,19 @@
 #include "CString.h"
 #include "FrameLoader.h"
 #include "KURL.h"
-#include "PlatformString.h"
-#include "StringHash.h"
-#include <wtf/HashSet.h>
+#include "OriginAccessEntry.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
-typedef HashSet<String, CaseFoldingHash> URLSchemesMap;
+typedef Vector<OriginAccessEntry> OriginAccessWhiteList;
+typedef HashMap<String, OriginAccessWhiteList*> OriginAccessMap;
+
+static OriginAccessMap& originAccessMap()
+{
+    DEFINE_STATIC_LOCAL(OriginAccessMap, originAccessMap, ());
+    return originAccessMap;
+}
 
 static URLSchemesMap& localSchemes()
 {
@@ -68,7 +73,7 @@ static URLSchemesMap& noAccessSchemes()
     return noAccessSchemes;
 }
 
-static bool isDefaultPortForProtocol(unsigned short port, const String& protocol)
+bool SecurityOrigin::isDefaultPortForProtocol(unsigned short port, const String& protocol)
 {
     if (protocol.isEmpty())
         return false;
@@ -203,7 +208,17 @@ bool SecurityOrigin::canRequest(const KURL& url) const
 
     // We call isSameSchemeHostPort here instead of canAccess because we want
     // to ignore document.domain effects.
-    return isSameSchemeHostPort(targetOrigin.get());
+    if (isSameSchemeHostPort(targetOrigin.get()))
+        return true;
+
+    if (OriginAccessWhiteList* list = originAccessMap().get(toString())) {
+        for (size_t i = 0; i < list->size(); ++i) {
+            if (list->at(i).matchesOrigin(*targetOrigin))
+                return true;
+        }
+    }
+
+    return false;
 }
 
 void SecurityOrigin::grantLoadLocalResources()
@@ -281,15 +296,16 @@ PassRefPtr<SecurityOrigin> SecurityOrigin::createFromDatabaseIdentifier(const St
     if (separator2 == -1)
         return create(KURL());
         
-    // Ensure there were at least 2 seperator characters. Some hostnames on intranets have
+    // Ensure there were at least 2 separator characters. Some hostnames on intranets have
     // underscores in them, so we'll assume that any additional underscores are part of the host.
-    if (separator1 != separator2)
+    if (separator1 == separator2)
         return create(KURL());
         
     // Make sure the port section is a valid port number or doesn't exist
     bool portOkay;
     int port = databaseIdentifier.right(databaseIdentifier.length() - separator2 - 1).toInt(&portOkay);
-    if (!portOkay && separator2 + 1 == static_cast<int>(databaseIdentifier.length()))
+    bool portAbsent = (separator2 == static_cast<int>(databaseIdentifier.length()) - 1);
+    if (!(portOkay || portAbsent))
         return create(KURL());
     
     if (port < 0 || port > 65535)
@@ -345,6 +361,28 @@ void SecurityOrigin::registerURLSchemeAsLocal(const String& scheme)
 }
 
 // static
+void SecurityOrigin::removeURLSchemeRegisteredAsLocal(const String& scheme)
+{
+    if (scheme == "file")
+        return;
+#if PLATFORM(MAC)
+    if (scheme == "applewebdata")
+        return;
+#endif
+#if PLATFORM(QT)
+    if (scheme == "qrc")
+        return;
+#endif
+    localSchemes().remove(scheme);
+}
+
+// static
+const URLSchemesMap&  SecurityOrigin::localURLSchemes()
+{
+    return localSchemes();
+}
+
+// static
 bool SecurityOrigin::shouldTreatURLAsLocal(const String& url)
 {
     // This avoids an allocation of another String and the HashSet contains()
@@ -396,4 +434,28 @@ bool SecurityOrigin::shouldTreatURLSchemeAsNoAccess(const String& scheme)
     return noAccessSchemes().contains(scheme);
 }
 
+void SecurityOrigin::whiteListAccessFromOrigin(const SecurityOrigin& sourceOrigin, const String& destinationProtocol, const String& destinationDomains, bool allowDestinationSubdomains)
+{
+    ASSERT(isMainThread());
+    ASSERT(!sourceOrigin.isEmpty());
+    if (sourceOrigin.isEmpty())
+        return;
+
+    String sourceString = sourceOrigin.toString();
+    OriginAccessWhiteList* list = originAccessMap().get(sourceString);
+    if (!list) {
+        list = new OriginAccessWhiteList;
+        originAccessMap().set(sourceString, list);
+    }
+    list->append(OriginAccessEntry(destinationProtocol, destinationDomains, allowDestinationSubdomains ? OriginAccessEntry::AllowSubdomains : OriginAccessEntry::DisallowSubdomains));
+}
+
+void SecurityOrigin::resetOriginAccessWhiteLists()
+{
+    ASSERT(isMainThread());
+    OriginAccessMap& map = originAccessMap();
+    deleteAllValues(map);
+    map.clear();
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/SecurityOrigin.h b/src/3rdparty/webkit/WebCore/page/SecurityOrigin.h
index ab92683..c8086ac 100644
--- a/src/3rdparty/webkit/WebCore/page/SecurityOrigin.h
+++ b/src/3rdparty/webkit/WebCore/page/SecurityOrigin.h
@@ -29,14 +29,18 @@
 #ifndef SecurityOrigin_h
 #define SecurityOrigin_h
 
+#include <wtf/HashSet.h>
 #include <wtf/RefCounted.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/Threading.h>
 
 #include "PlatformString.h"
+#include "StringHash.h"
 
 namespace WebCore {
 
+    typedef HashSet<String, CaseFoldingHash> URLSchemesMap;
+    
     class KURL;
     
     class SecurityOrigin : public ThreadSafeShared<SecurityOrigin> {
@@ -129,12 +133,19 @@ namespace WebCore {
         bool isSameSchemeHostPort(const SecurityOrigin*) const;
 
         static void registerURLSchemeAsLocal(const String&);
+        static void removeURLSchemeRegisteredAsLocal(const String&);
+        static const URLSchemesMap& localURLSchemes();
         static bool shouldTreatURLAsLocal(const String&);
         static bool shouldTreatURLSchemeAsLocal(const String&);
 
         static void registerURLSchemeAsNoAccess(const String&);
         static bool shouldTreatURLSchemeAsNoAccess(const String&);
 
+        static void whiteListAccessFromOrigin(const SecurityOrigin& sourceOrigin, const String& destinationProtocol, const String& destinationDomains, bool allowDestinationSubdomains);
+        static void resetOriginAccessWhiteLists();
+
+        static bool isDefaultPortForProtocol(unsigned short port, const String& protocol);
+
     private:
         explicit SecurityOrigin(const KURL&);
         explicit SecurityOrigin(const SecurityOrigin*);
diff --git a/src/3rdparty/webkit/WebCore/page/Settings.cpp b/src/3rdparty/webkit/WebCore/page/Settings.cpp
index 133dd9a..da36fee 100644
--- a/src/3rdparty/webkit/WebCore/page/Settings.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Settings.cpp
@@ -48,6 +48,10 @@ static void setNeedsReapplyStylesInAllFrames(Page* page)
 bool Settings::gShouldPaintNativeControls = true;
 #endif
 
+#if PLATFORM(WIN) || (PLATFORM(WIN_OS) && PLATFORM(WX))
+bool Settings::gShouldUseHighResolutionTimers = true;
+#endif
+
 Settings::Settings(Page* page)
     : m_page(page)
     , m_editableLinkBehavior(EditableLinkDefaultBehavior)
@@ -98,7 +102,8 @@ Settings::Settings(Page* page)
     , m_usesEncodingDetector(false)
     , m_allowScriptsToCloseWindows(false)
     , m_editingBehavior(
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
+        // (PLATFORM(MAC) is always false in Chromium, hence the extra condition.)
         EditingMacBehavior
 #else
         EditingWindowsBehavior
@@ -273,7 +278,6 @@ void Settings::setUserStyleSheetLocation(const KURL& userStyleSheetLocation)
     m_userStyleSheetLocation = userStyleSheetLocation;
 
     m_page->userStyleSheetLocationChanged();
-    setNeedsReapplyStylesInAllFrames(m_page);
 }
 
 void Settings::setShouldPrintBackgrounds(bool shouldPrintBackgrounds)
@@ -493,4 +497,11 @@ void Settings::setAcceleratedCompositingEnabled(bool enabled)
     setNeedsReapplyStylesInAllFrames(m_page);
 }
 
+#if PLATFORM(WIN) || (PLATFORM(WIN_OS) && PLATFORM(WX))
+void Settings::setShouldUseHighResolutionTimers(bool shouldUseHighResolutionTimers)
+{
+    gShouldUseHighResolutionTimers = shouldUseHighResolutionTimers;
+}
+#endif
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/Settings.h b/src/3rdparty/webkit/WebCore/page/Settings.h
index 544d0d5..7900c91 100644
--- a/src/3rdparty/webkit/WebCore/page/Settings.h
+++ b/src/3rdparty/webkit/WebCore/page/Settings.h
@@ -253,6 +253,11 @@ namespace WebCore {
         void setAcceleratedCompositingEnabled(bool);
         bool acceleratedCompositingEnabled() const { return m_acceleratedCompositingEnabled; }
 
+#if PLATFORM(WIN) || (PLATFORM(WIN_OS) && PLATFORM(WX))
+        static void setShouldUseHighResolutionTimers(bool);
+        static bool shouldUseHighResolutionTimers() { return gShouldUseHighResolutionTimers; }
+#endif
+
     private:
         Page* m_page;
         
@@ -321,6 +326,9 @@ namespace WebCore {
 #if USE(SAFARI_THEME)
         static bool gShouldPaintNativeControls;
 #endif
+#if PLATFORM(WIN) || (PLATFORM(WIN_OS) && PLATFORM(WX))
+        static bool gShouldUseHighResolutionTimers;
+#endif
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/UserScript.h b/src/3rdparty/webkit/WebCore/page/UserScript.h
new file mode 100644
index 0000000..51031ab
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/UserScript.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+ 
+#ifndef UserScript_h
+#define UserScript_h
+
+#include "KURL.h"
+#include "UserScriptTypes.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class UserScript {
+public:
+    UserScript(const String& source, const KURL& url,
+               const Vector<String>& patterns, unsigned worldID,
+               UserScriptInjectionTime injectionTime)
+        : m_source(source)
+        , m_url(url)
+        , m_patterns(patterns)
+        , m_worldID(worldID)
+        , m_injectionTime(injectionTime)
+    {
+    }
+
+    const String& source() const { return m_source; }
+    const KURL& url() const { return m_url; }
+    const Vector<String>& patterns() const { return m_patterns; }
+    unsigned worldID() const { return m_worldID; }
+    UserScriptInjectionTime injectionTime() const { return m_injectionTime; }
+    
+private:
+    String m_source;
+    KURL m_url;
+    Vector<String> m_patterns;
+    unsigned m_worldID;
+    UserScriptInjectionTime m_injectionTime;
+};
+
+} // namespace WebCore
+ 
+#endif // UserScript_h
diff --git a/src/3rdparty/webkit/WebCore/page/UserScriptTypes.h b/src/3rdparty/webkit/WebCore/page/UserScriptTypes.h
new file mode 100644
index 0000000..ac37662
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/UserScriptTypes.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+ 
+#ifndef UserScriptTypes_h
+#define UserScriptTypes_h
+
+#include <wtf/HashMap.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+enum UserScriptInjectionTime { InjectAtDocumentStart, InjectAtDocumentEnd };
+
+class UserScript;
+
+typedef Vector<OwnPtr<UserScript> > UserScriptVector;
+typedef HashMap<unsigned, UserScriptVector*> UserScriptMap;
+
+} // namespace WebCore
+ 
+#endif // UserScriptTypes_h
diff --git a/src/3rdparty/webkit/WebCore/page/UserStyleSheet.h b/src/3rdparty/webkit/WebCore/page/UserStyleSheet.h
new file mode 100644
index 0000000..5ae95c3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/UserStyleSheet.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+ 
+#ifndef UserStyleSheet_h
+#define UserStyleSheet_h
+
+#include "KURL.h"
+#include "UserStyleSheetTypes.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class UserStyleSheet {
+public:
+    UserStyleSheet(const String& source, const KURL& url,
+               const Vector<String>& patterns, unsigned worldID)
+        : m_source(source)
+        , m_url(url)
+        , m_patterns(patterns)
+        , m_worldID(worldID)
+    {
+    }
+
+    const String& source() const { return m_source; }
+    const KURL& url() const { return m_url; }
+    const Vector<String>& patterns() const { return m_patterns; }
+    unsigned worldID() const { return m_worldID; }
+
+private:
+    String m_source;
+    KURL m_url;
+    Vector<String> m_patterns;
+    unsigned m_worldID;
+};
+
+} // namespace WebCore
+ 
+#endif // UserStyleSheet_h
diff --git a/src/3rdparty/webkit/WebCore/page/UserStyleSheetTypes.h b/src/3rdparty/webkit/WebCore/page/UserStyleSheetTypes.h
new file mode 100644
index 0000000..094b2cf
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/UserStyleSheetTypes.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+ 
+#ifndef UserStyleSheetTypes_h
+#define UserStyleSheetTypes_h
+
+#include <wtf/HashMap.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class UserStyleSheet;
+
+typedef Vector<OwnPtr<UserStyleSheet> > UserStyleSheetVector;
+typedef HashMap<unsigned, UserStyleSheetVector*> UserStyleSheetMap;
+
+} // namespace WebCore
+ 
+#endif // UserStyleSheetTypes_h
diff --git a/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp b/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp
index 70b691b..df627d3 100644
--- a/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp
+++ b/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp
@@ -56,6 +56,18 @@ static bool isNonCanonicalCharacter(UChar c)
     return (c == '\\' || c == '0' || c < ' ' || c == 127);
 }
 
+String XSSAuditor::CachingURLCanonicalizer::canonicalizeURL(const String& url, const TextEncoding& encoding, bool decodeEntities)
+{
+    if (decodeEntities == m_decodeEntities && encoding == m_encoding && url == m_inputURL)
+        return m_cachedCanonicalizedURL;
+
+    m_cachedCanonicalizedURL = canonicalize(decodeURL(url, encoding, decodeEntities));
+    m_inputURL = url;
+    m_encoding = encoding;
+    m_decodeEntities = decodeEntities;
+    return m_cachedCanonicalizedURL;
+}
+
 XSSAuditor::XSSAuditor(Frame* frame)
     : m_frame(frame)
 {
@@ -156,22 +168,23 @@ String XSSAuditor::canonicalize(const String& string)
     return result.removeCharacters(&isNonCanonicalCharacter);
 }
 
-String XSSAuditor::decodeURL(const String& string, const TextEncoding& encoding, bool decodeHTMLentities)
+String XSSAuditor::decodeURL(const String& string, const TextEncoding& encoding, bool decodeEntities)
 {
     String result;
     String url = string;
 
     url.replace('+', ' ');
     result = decodeURLEscapeSequences(url);
-    String decodedResult = encoding.decode(result.utf8().data(), result.length());
+    CString utf8Url = result.utf8();
+    String decodedResult = encoding.decode(utf8Url.data(), utf8Url.length());
     if (!decodedResult.isEmpty())
         result = decodedResult;
-    if (decodeHTMLentities)
+    if (decodeEntities)
         result = decodeHTMLEntities(result);
     return result;
 }
 
-String XSSAuditor::decodeHTMLEntities(const String& string, bool leaveUndecodableHTMLEntitiesUntouched)
+String XSSAuditor::decodeHTMLEntities(const String& string, bool leaveUndecodableEntitiesUntouched)
 {
     SegmentedString source(string);
     SegmentedString sourceShadow;
@@ -186,7 +199,7 @@ String XSSAuditor::decodeHTMLEntities(const String& string, bool leaveUndecodabl
             continue;
         }
         
-        if (leaveUndecodableHTMLEntitiesUntouched)
+        if (leaveUndecodableEntitiesUntouched)
             sourceShadow = source;
         bool notEnoughCharacters = false;
         unsigned entity = PreloadScanner::consumeEntity(source, notEnoughCharacters);
@@ -196,11 +209,11 @@ String XSSAuditor::decodeHTMLEntities(const String& string, bool leaveUndecodabl
         if (entity > 0xFFFF) {
             result.append(U16_LEAD(entity));
             result.append(U16_TRAIL(entity));
-        } else if (entity && (!leaveUndecodableHTMLEntitiesUntouched || entity != 0xFFFD)){
+        } else if (entity && (!leaveUndecodableEntitiesUntouched || entity != 0xFFFD)){
             result.append(entity);
         } else {
             result.append('&');
-            if (leaveUndecodableHTMLEntitiesUntouched)
+            if (leaveUndecodableEntitiesUntouched)
                 source = sourceShadow;
         }
     }
@@ -208,31 +221,48 @@ String XSSAuditor::decodeHTMLEntities(const String& string, bool leaveUndecodabl
     return String::adopt(result);
 }
 
-bool XSSAuditor::findInRequest(const String& string, bool decodeHTMLentities) const
+bool XSSAuditor::findInRequest(const String& string, bool decodeEntities) const
 {
     bool result = false;
     Frame* parentFrame = m_frame->tree()->parent();
     if (parentFrame && m_frame->document()->url() == blankURL())
-        result = findInRequest(parentFrame, string, decodeHTMLentities);
+        result = findInRequest(parentFrame, string, decodeEntities);
     if (!result)
-        result = findInRequest(m_frame, string, decodeHTMLentities);
+        result = findInRequest(m_frame, string, decodeEntities);
     return result;
 }
 
-bool XSSAuditor::findInRequest(Frame* frame, const String& string, bool decodeHTMLentities) const
+bool XSSAuditor::findInRequest(Frame* frame, const String& string, bool decodeEntities) const
 {
     ASSERT(frame->document());
-    String pageURL = frame->document()->url().string();
 
     if (!frame->document()->decoder()) {
         // Note, JavaScript URLs do not have a charset.
         return false;
     }
 
-    if (protocolIs(pageURL, "data"))
+    if (string.isEmpty())
         return false;
 
-    if (string.isEmpty())
+    FormData* formDataObj = frame->loader()->documentLoader()->originalRequest().httpBody();
+    String pageURL = frame->document()->url().string();
+
+    if (!formDataObj && string.length() >= 2 * pageURL.length()) {
+        // Q: Why do we bother to do this check at all?
+        // A: Canonicalizing large inline scripts can be expensive.  We want to
+        //    bail out before the call to canonicalize below, which could
+        //    result in an unneeded allocation and memcpy.
+        //
+        // Q: Why do we multiply by two here?
+        // A: We attempt to detect reflected XSS even when the server
+        //    transforms the attacker's input with addSlashes.  The best the
+        //    attacker can do get the server to inflate his/her input by a
+        //    factor of two by sending " characters, which the server
+        //    transforms to \".
+        return false;
+    }
+
+    if (frame->document()->url().protocolIs("data"))
         return false;
 
     String canonicalizedString = canonicalize(string);
@@ -241,12 +271,11 @@ bool XSSAuditor::findInRequest(Frame* frame, const String& string, bool decodeHT
 
     if (string.length() < pageURL.length()) {
         // The string can actually fit inside the pageURL.
-        String decodedPageURL = canonicalize(decodeURL(pageURL, frame->document()->decoder()->encoding(), decodeHTMLentities));
+        String decodedPageURL = m_cache.canonicalizeURL(pageURL, frame->document()->decoder()->encoding(), decodeEntities);
         if (decodedPageURL.find(canonicalizedString, 0, false) != -1)
            return true;  // We've found the smoking gun.
     }
 
-    FormData* formDataObj = frame->loader()->documentLoader()->originalRequest().httpBody();
     if (formDataObj && !formDataObj->isEmpty()) {
         String formData = formDataObj->flattenToString();
         if (string.length() < formData.length()) {
@@ -254,7 +283,7 @@ bool XSSAuditor::findInRequest(Frame* frame, const String& string, bool decodeHT
             // the url-encoded POST data because the length of the url-decoded
             // code is less than or equal to the length of the url-encoded
             // string.
-            String decodedFormData = canonicalize(decodeURL(formData, frame->document()->decoder()->encoding(), decodeHTMLentities));
+            String decodedFormData = m_cache.canonicalizeURL(formData, frame->document()->decoder()->encoding(), decodeEntities);
             if (decodedFormData.find(canonicalizedString, 0, false) != -1)
                 return true;  // We found the string in the POST data.
         }
diff --git a/src/3rdparty/webkit/WebCore/page/XSSAuditor.h b/src/3rdparty/webkit/WebCore/page/XSSAuditor.h
index 26f10ab..58b2cc2 100644
--- a/src/3rdparty/webkit/WebCore/page/XSSAuditor.h
+++ b/src/3rdparty/webkit/WebCore/page/XSSAuditor.h
@@ -99,18 +99,34 @@ namespace WebCore {
         bool canSetBaseElementURL(const String& url) const;
 
     private:
-        static String canonicalize(const String&);
-        
-        static String decodeURL(const String& url, const TextEncoding& encoding = UTF8Encoding(), bool decodeHTMLentities = true);
-        
-        static String decodeHTMLEntities(const String&, bool leaveUndecodableHTMLEntitiesUntouched = true);
+        class CachingURLCanonicalizer
+        {
+        public:
+            CachingURLCanonicalizer() : m_decodeEntities(false) { }
+            String canonicalizeURL(const String& url, const TextEncoding& encoding, bool decodeEntities);
+
+        private:
+            // The parameters we were called with last.
+            String m_inputURL;
+            TextEncoding m_encoding;
+            bool m_decodeEntities;
+
+            // The cached result.
+            String m_cachedCanonicalizedURL;
+        };
 
-        bool findInRequest(const String&, bool decodeHTMLentities = true) const;
+        static String canonicalize(const String&);
+        static String decodeURL(const String& url, const TextEncoding& encoding, bool decodeEntities);
+        static String decodeHTMLEntities(const String&, bool leaveUndecodableEntitiesUntouched = true);
 
-        bool findInRequest(Frame*, const String&, bool decodeHTMLentities = true) const;
+        bool findInRequest(const String&, bool decodeEntities = true) const;
+        bool findInRequest(Frame*, const String&, bool decodeEntities = true) const;
 
         // The frame to audit.
         Frame* m_frame;
+
+        // A state store to help us avoid canonicalizing the same URL repeated.
+        mutable CachingURLCanonicalizer m_cache;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/android/EventHandlerAndroid.cpp b/src/3rdparty/webkit/WebCore/page/android/EventHandlerAndroid.cpp
index c6bce4f..dcd25f2 100644
--- a/src/3rdparty/webkit/WebCore/page/android/EventHandlerAndroid.cpp
+++ b/src/3rdparty/webkit/WebCore/page/android/EventHandlerAndroid.cpp
@@ -58,8 +58,7 @@ bool EventHandler::passWidgetMouseDownEventToWidget(const MouseEventWithHitTestR
     RenderObject* target = event.targetNode() ? event.targetNode()->renderer() : 0;
     if (!target || !target->isWidget())
         return false;
-    
-    return passMouseDownEventToWidget(static_cast<RenderWidget*>(target)->widget());
+    return passMouseDownEventToWidget(toRenderWidget(target)->widget());
 }
 
 bool EventHandler::passWidgetMouseDownEventToWidget(RenderWidget* renderWidget)
diff --git a/src/3rdparty/webkit/WebCore/page/android/InspectorControllerAndroid.cpp b/src/3rdparty/webkit/WebCore/page/android/InspectorControllerAndroid.cpp
index 978bc25..3ba64e9 100644
--- a/src/3rdparty/webkit/WebCore/page/android/InspectorControllerAndroid.cpp
+++ b/src/3rdparty/webkit/WebCore/page/android/InspectorControllerAndroid.cpp
@@ -90,7 +90,6 @@ void InspectorController::addProfile(PassRefPtr<JSC::Profile>, unsigned int, con
 void InspectorController::inspectedPageDestroyed() {}
 void InspectorController::resourceRetrievedByXMLHttpRequest(unsigned long identifier, JSC::UString& sourceString) {}
 
-void InspectorController::inspectedWindowScriptObjectCleared(Frame* frame) {}
 void InspectorController::startGroup(MessageSource source, JSC::ExecState* exec, const JSC::ArgList& arguments, unsigned lineNumber, const String& sourceURL) {}
 void InspectorController::endGroup(MessageSource source, unsigned lineNumber, const String& sourceURL) {}
 void InspectorController::startTiming(const JSC::UString& title) {}
diff --git a/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.cpp b/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.cpp
index 8769a59..e54be8b 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.cpp
+++ b/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.cpp
@@ -45,6 +45,8 @@
 #include "MatrixTransformOperation.h"
 #include "Matrix3DTransformOperation.h"
 #include "RenderBox.h"
+#include "RenderLayer.h"
+#include "RenderLayerBacking.h"
 #include "RenderStyle.h"
 #include "UnitBezier.h"
 
@@ -144,7 +146,7 @@ static inline TransformOperations blendFunc(const AnimationBase* anim, const Tra
         for (unsigned i = 0; i < size; i++) {
             RefPtr<TransformOperation> fromOp = (i < fromSize) ? from.operations()[i].get() : 0;
             RefPtr<TransformOperation> toOp = (i < toSize) ? to.operations()[i].get() : 0;
-            RefPtr<TransformOperation> blendedOp = toOp ? toOp->blend(fromOp.get(), progress) : (fromOp ? fromOp->blend(0, progress, true) : PassRefPtr<TransformOperation>(0));
+            RefPtr<TransformOperation> blendedOp = toOp ? toOp->blend(fromOp.get(), progress) : (fromOp ? fromOp->blend(0, progress, true) : 0);
             if (blendedOp)
                 result.operations().append(blendedOp);
             else {
@@ -300,11 +302,21 @@ public:
     {
         ShadowData* shadowA = (a->*m_getter)();
         ShadowData* shadowB = (b->*m_getter)();
+        
+        while (true) {
+            if (!shadowA && !shadowB)   // end of both lists
+                return true;
+
+            if (!shadowA || !shadowB)   // end of just one of the lists
+                return false;
+
+            if (*shadowA != *shadowB)
+                return false;
+        
+            shadowA = shadowA->next;
+            shadowB = shadowB->next;
+        }
 
-        if ((!shadowA && shadowB) || (shadowA && !shadowB))
-            return false;
-        if (shadowA && shadowB && (*shadowA != *shadowB))
-            return false;
         return true;
     }
 
@@ -314,12 +326,22 @@ public:
         ShadowData* shadowB = (b->*m_getter)();
         ShadowData defaultShadowData(0, 0, 0, 0, Normal, Color::transparent);
 
-        if (!shadowA)
-            shadowA = &defaultShadowData;
-        if (!shadowB)
-            shadowB = &defaultShadowData;
+        ShadowData* newShadowData = 0;
+        
+        while (shadowA || shadowB) {
+            ShadowData* srcShadow = shadowA ? shadowA : &defaultShadowData;
+            ShadowData* dstShadow = shadowB ? shadowB : &defaultShadowData;
+            
+            if (!newShadowData)
+                newShadowData = blendFunc(anim, srcShadow, dstShadow, progress);
+            else
+                newShadowData->next = blendFunc(anim, srcShadow, dstShadow, progress);
 
-        (dst->*m_setter)(blendFunc(anim, shadowA, shadowB, progress), false);
+            shadowA = shadowA ? shadowA->next : 0;
+            shadowB = shadowB ? shadowB->next : 0;
+        }
+        
+        (dst->*m_setter)(newShadowData, false);
     }
 
 private:
@@ -363,6 +385,124 @@ private:
     void (RenderStyle::*m_setter)(const Color&);
 };
 
+// Wrapper base class for an animatable property in a FillLayer
+class FillLayerPropertyWrapperBase {
+public:
+    FillLayerPropertyWrapperBase()
+    {
+    }
+
+    virtual ~FillLayerPropertyWrapperBase() { }
+    
+    virtual bool equals(const FillLayer* a, const FillLayer* b) const = 0;
+    virtual void blend(const AnimationBase* anim, FillLayer* dst, const FillLayer* a, const FillLayer* b, double progress) const = 0;
+};
+
+template <typename T>
+class FillLayerPropertyWrapperGetter : public FillLayerPropertyWrapperBase {
+public:
+    FillLayerPropertyWrapperGetter(T (FillLayer::*getter)() const)
+        : m_getter(getter)
+    {
+    }
+
+    virtual bool equals(const FillLayer* a, const FillLayer* b) const
+    {
+       // If the style pointers are the same, don't bother doing the test.
+       // If either is null, return false. If both are null, return true.
+       if ((!a && !b) || a == b)
+           return true;
+       if (!a || !b)
+            return false;
+        return (a->*m_getter)() == (b->*m_getter)();
+    }
+
+protected:
+    T (FillLayer::*m_getter)() const;
+};
+
+template <typename T>
+class FillLayerPropertyWrapper : public FillLayerPropertyWrapperGetter<T> {
+public:
+    FillLayerPropertyWrapper(T (FillLayer::*getter)() const, void (FillLayer::*setter)(T))
+        : FillLayerPropertyWrapperGetter<T>(getter)
+        , m_setter(setter)
+    {
+    }
+    
+    virtual void blend(const AnimationBase* anim, FillLayer* dst, const FillLayer* a, const FillLayer* b, double progress) const
+    {
+        (dst->*m_setter)(blendFunc(anim, (a->*FillLayerPropertyWrapperGetter<T>::m_getter)(), (b->*FillLayerPropertyWrapperGetter<T>::m_getter)(), progress));
+    }
+
+protected:
+    void (FillLayer::*m_setter)(T);
+};
+
+
+class FillLayersPropertyWrapper : public PropertyWrapperBase {
+public:
+    typedef const FillLayer* (RenderStyle::*LayersGetter)() const;
+    typedef FillLayer* (RenderStyle::*LayersAccessor)();
+    
+    FillLayersPropertyWrapper(int prop, LayersGetter getter, LayersAccessor accessor)
+        : PropertyWrapperBase(prop)
+        , m_layersGetter(getter)
+        , m_layersAccessor(accessor)
+    {
+        switch (prop) {
+            case CSSPropertyBackgroundPositionX:
+            case CSSPropertyWebkitMaskPositionX:
+                m_fillLayerPropertyWrapper = new FillLayerPropertyWrapper<Length>(&FillLayer::xPosition, &FillLayer::setXPosition);
+                break;
+            case CSSPropertyBackgroundPositionY:
+            case CSSPropertyWebkitMaskPositionY:
+                m_fillLayerPropertyWrapper = new FillLayerPropertyWrapper<Length>(&FillLayer::yPosition, &FillLayer::setYPosition);
+                break;
+            case CSSPropertyBackgroundSize:
+            case CSSPropertyWebkitMaskSize:
+                m_fillLayerPropertyWrapper = new FillLayerPropertyWrapper<LengthSize>(&FillLayer::sizeLength, &FillLayer::setSizeLength);
+                break;
+        }
+    }
+
+    virtual bool equals(const RenderStyle* a, const RenderStyle* b) const
+    {
+        const FillLayer* fromLayer = (a->*m_layersGetter)();
+        const FillLayer* toLayer = (b->*m_layersGetter)();
+
+        while (fromLayer && toLayer) {
+            if (!m_fillLayerPropertyWrapper->equals(fromLayer, toLayer))
+                return false;
+            
+            fromLayer = fromLayer->next();
+            toLayer = toLayer->next();
+        }
+
+        return true;
+    }
+
+    virtual void blend(const AnimationBase* anim, RenderStyle* dst, const RenderStyle* a, const RenderStyle* b, double progress) const
+    {
+        const FillLayer* aLayer = (a->*m_layersGetter)();
+        const FillLayer* bLayer = (b->*m_layersGetter)();
+        FillLayer* dstLayer = (dst->*m_layersAccessor)();
+
+        while (aLayer && bLayer && dstLayer) {
+            m_fillLayerPropertyWrapper->blend(anim, dstLayer, aLayer, bLayer, progress);
+            aLayer = aLayer->next();
+            bLayer = bLayer->next();
+            dstLayer = dstLayer->next();
+        }
+    }
+
+private:
+    FillLayerPropertyWrapperBase* m_fillLayerPropertyWrapper;
+    
+    LayersGetter m_layersGetter;
+    LayersAccessor m_layersAccessor;
+};
+
 class ShorthandPropertyWrapper : public PropertyWrapperBase {
 public:
     ShorthandPropertyWrapper(int property, const CSSPropertyLonghand& longhand)
@@ -416,8 +556,15 @@ static void ensurePropertyMap()
         gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyRight, &RenderStyle::right, &RenderStyle::setRight));
         gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyTop, &RenderStyle::top, &RenderStyle::setTop));
         gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyBottom, &RenderStyle::bottom, &RenderStyle::setBottom));
+
         gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyWidth, &RenderStyle::width, &RenderStyle::setWidth));
+        gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyMinWidth, &RenderStyle::minWidth, &RenderStyle::setMinWidth));
+        gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyMaxWidth, &RenderStyle::maxWidth, &RenderStyle::setMaxWidth));
+
         gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyHeight, &RenderStyle::height, &RenderStyle::setHeight));
+        gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyMinHeight, &RenderStyle::minHeight, &RenderStyle::setMinHeight));
+        gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyMaxHeight, &RenderStyle::maxHeight, &RenderStyle::setMaxHeight));
+
         gPropertyWrappers->append(new PropertyWrapper<unsigned short>(CSSPropertyBorderLeftWidth, &RenderStyle::borderLeftWidth, &RenderStyle::setBorderLeftWidth));
         gPropertyWrappers->append(new PropertyWrapper<unsigned short>(CSSPropertyBorderRightWidth, &RenderStyle::borderRightWidth, &RenderStyle::setBorderRightWidth));
         gPropertyWrappers->append(new PropertyWrapper<unsigned short>(CSSPropertyBorderTopWidth, &RenderStyle::borderTopWidth, &RenderStyle::setBorderTopWidth));
@@ -433,13 +580,14 @@ static void ensurePropertyMap()
         gPropertyWrappers->append(new PropertyWrapper<const Color&>(CSSPropertyColor, &RenderStyle::color, &RenderStyle::setColor));
 
         gPropertyWrappers->append(new PropertyWrapper<const Color&>(CSSPropertyBackgroundColor, &RenderStyle::backgroundColor, &RenderStyle::setBackgroundColor));
-        gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyBackgroundPositionX, &RenderStyle::backgroundXPosition, &RenderStyle::setBackgroundXPosition));
-        gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyBackgroundPositionY, &RenderStyle::backgroundYPosition, &RenderStyle::setBackgroundYPosition));
-        gPropertyWrappers->append(new PropertyWrapper<LengthSize>(CSSPropertyWebkitBackgroundSize, &RenderStyle::backgroundSize, &RenderStyle::setBackgroundSize));
 
-        gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyWebkitMaskPositionX, &RenderStyle::maskXPosition, &RenderStyle::setMaskXPosition));
-        gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyWebkitMaskPositionY, &RenderStyle::maskYPosition, &RenderStyle::setMaskYPosition));
-        gPropertyWrappers->append(new PropertyWrapper<LengthSize>(CSSPropertyWebkitMaskSize, &RenderStyle::maskSize, &RenderStyle::setMaskSize));
+        gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyBackgroundPositionX, &RenderStyle::backgroundLayers, &RenderStyle::accessBackgroundLayers));
+        gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyBackgroundPositionY, &RenderStyle::backgroundLayers, &RenderStyle::accessBackgroundLayers));
+        gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyBackgroundSize, &RenderStyle::backgroundLayers, &RenderStyle::accessBackgroundLayers));
+
+        gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyWebkitMaskPositionX, &RenderStyle::maskLayers, &RenderStyle::accessMaskLayers));
+        gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyWebkitMaskPositionY, &RenderStyle::maskLayers, &RenderStyle::accessMaskLayers));
+        gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyWebkitMaskSize, &RenderStyle::maskLayers, &RenderStyle::accessMaskLayers));
 
         gPropertyWrappers->append(new PropertyWrapper<int>(CSSPropertyFontSize, &RenderStyle::fontSize, &RenderStyle::setBlendedFontSize));
         gPropertyWrappers->append(new PropertyWrapper<unsigned short>(CSSPropertyWebkitColumnRuleWidth, &RenderStyle::columnRuleWidth, &RenderStyle::setColumnRuleWidth));
@@ -454,16 +602,18 @@ static void ensurePropertyMap()
         gPropertyWrappers->append(new PropertyWrapper<unsigned short>(CSSPropertyOutlineWidth, &RenderStyle::outlineWidth, &RenderStyle::setOutlineWidth));
         gPropertyWrappers->append(new PropertyWrapper<int>(CSSPropertyLetterSpacing, &RenderStyle::letterSpacing, &RenderStyle::setLetterSpacing));
         gPropertyWrappers->append(new PropertyWrapper<int>(CSSPropertyWordSpacing, &RenderStyle::wordSpacing, &RenderStyle::setWordSpacing));
+        gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyTextIndent, &RenderStyle::textIndent, &RenderStyle::setTextIndent));
+
         gPropertyWrappers->append(new PropertyWrapper<float>(CSSPropertyWebkitPerspective, &RenderStyle::perspective, &RenderStyle::setPerspective));
         gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyWebkitPerspectiveOriginX, &RenderStyle::perspectiveOriginX, &RenderStyle::setPerspectiveOriginX));
         gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyWebkitPerspectiveOriginY, &RenderStyle::perspectiveOriginY, &RenderStyle::setPerspectiveOriginY));
         gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyWebkitTransformOriginX, &RenderStyle::transformOriginX, &RenderStyle::setTransformOriginX));
         gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyWebkitTransformOriginY, &RenderStyle::transformOriginY, &RenderStyle::setTransformOriginY));
         gPropertyWrappers->append(new PropertyWrapper<float>(CSSPropertyWebkitTransformOriginZ, &RenderStyle::transformOriginZ, &RenderStyle::setTransformOriginZ));
-        gPropertyWrappers->append(new PropertyWrapper<const IntSize&>(CSSPropertyWebkitBorderTopLeftRadius, &RenderStyle::borderTopLeftRadius, &RenderStyle::setBorderTopLeftRadius));
-        gPropertyWrappers->append(new PropertyWrapper<const IntSize&>(CSSPropertyWebkitBorderTopRightRadius, &RenderStyle::borderTopRightRadius, &RenderStyle::setBorderTopRightRadius));
-        gPropertyWrappers->append(new PropertyWrapper<const IntSize&>(CSSPropertyWebkitBorderBottomLeftRadius, &RenderStyle::borderBottomLeftRadius, &RenderStyle::setBorderBottomLeftRadius));
-        gPropertyWrappers->append(new PropertyWrapper<const IntSize&>(CSSPropertyWebkitBorderBottomRightRadius, &RenderStyle::borderBottomRightRadius, &RenderStyle::setBorderBottomRightRadius));
+        gPropertyWrappers->append(new PropertyWrapper<const IntSize&>(CSSPropertyBorderTopLeftRadius, &RenderStyle::borderTopLeftRadius, &RenderStyle::setBorderTopLeftRadius));
+        gPropertyWrappers->append(new PropertyWrapper<const IntSize&>(CSSPropertyBorderTopRightRadius, &RenderStyle::borderTopRightRadius, &RenderStyle::setBorderTopRightRadius));
+        gPropertyWrappers->append(new PropertyWrapper<const IntSize&>(CSSPropertyBorderBottomLeftRadius, &RenderStyle::borderBottomLeftRadius, &RenderStyle::setBorderBottomLeftRadius));
+        gPropertyWrappers->append(new PropertyWrapper<const IntSize&>(CSSPropertyBorderBottomRightRadius, &RenderStyle::borderBottomRightRadius, &RenderStyle::setBorderBottomRightRadius));
         gPropertyWrappers->append(new PropertyWrapper<EVisibility>(CSSPropertyVisibility, &RenderStyle::visibility, &RenderStyle::setVisibility));
         gPropertyWrappers->append(new PropertyWrapper<float>(CSSPropertyZoom, &RenderStyle::zoom, &RenderStyle::setZoom));
         
@@ -496,8 +646,6 @@ static void ensurePropertyMap()
 
         // TODO:
         // 
-        //  CSSPropertyMinWidth, CSSPropertyMaxWidth, CSSPropertyMinHeight, CSSPropertyMaxHeight
-        //  CSSPropertyTextIndent
         //  CSSPropertyVerticalAlign
         // 
         // Compound properties that have components that should be animatable:
@@ -676,7 +824,7 @@ void AnimationBase::setNeedsStyleRecalc(Node* node)
 {
     ASSERT(!node || (node->document() && !node->document()->inPageCache()));
     if (node)
-        node->setNeedsStyleRecalc(AnimationStyleChange);
+        node->setNeedsStyleRecalc(SyntheticStyleChange);
 }
 
 double AnimationBase::duration() const
@@ -1077,10 +1225,18 @@ void AnimationBase::goIntoEndingOrLoopingState()
     m_animState = isLooping ? AnimationStateLooping : AnimationStateEnding;
 }
   
-void AnimationBase::pauseAtTime(double t)
+void AnimationBase::freezeAtTime(double t)
 {
-    updatePlayState(false);
+    ASSERT(m_startTime);        // if m_startTime is zero, we haven't started yet, so we'll get a bad pause time.
     m_pauseTime = m_startTime + t - m_animation->delay();
+
+#if USE(ACCELERATED_COMPOSITING)
+    if (m_object && m_object->hasLayer()) {
+        RenderLayer* layer = toRenderBoxModelObject(m_object)->layer();
+        if (layer->isComposited())
+            layer->backing()->suspendAnimations(m_pauseTime);
+    }
+#endif
 }
 
 double AnimationBase::beginAnimationUpdateTime() const
diff --git a/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.h b/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.h
index 8f55a8e..3482f65 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.h
+++ b/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.h
@@ -156,7 +156,8 @@ public:
 
     bool isTransformFunctionListValid() const { return m_transformFunctionListValid; }
     
-    void pauseAtTime(double t);
+    // Freeze the animation; used by DumpRenderTree.
+    void freezeAtTime(double t);
     
     double beginAnimationUpdateTime() const;
     
diff --git a/src/3rdparty/webkit/WebCore/page/animation/AnimationController.cpp b/src/3rdparty/webkit/WebCore/page/animation/AnimationController.cpp
index ed241e1..1d2ebe2 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/AnimationController.cpp
+++ b/src/3rdparty/webkit/WebCore/page/animation/AnimationController.cpp
@@ -98,7 +98,7 @@ void AnimationControllerPrivate::updateAnimationTimer(bool callSetChanged/* = fa
                 if (callSetChanged) {
                     Node* node = it->first->node();
                     ASSERT(!node || (node->document() && !node->document()->inPageCache()));
-                    node->setNeedsStyleRecalc(AnimationStyleChange);
+                    node->setNeedsStyleRecalc(SyntheticStyleChange);
                     calledSetChanged = true;
                 }
                 else
@@ -146,7 +146,7 @@ void AnimationControllerPrivate::updateStyleIfNeededDispatcherFired(Timer<Animat
     // call setChanged on all the elements
     Vector<RefPtr<Node> >::const_iterator nodeChangesToDispatchEnd = m_nodeChangesToDispatch.end();
     for (Vector<RefPtr<Node> >::const_iterator it = m_nodeChangesToDispatch.begin(); it != nodeChangesToDispatchEnd; ++it)
-        (*it)->setNeedsStyleRecalc(AnimationStyleChange);
+        (*it)->setNeedsStyleRecalc(SyntheticStyleChange);
     
     m_nodeChangesToDispatch.clear();
     
@@ -244,7 +244,7 @@ bool AnimationControllerPrivate::pauseAnimationAtTime(RenderObject* renderer, co
         return false;
 
     if (compAnim->pauseAnimationAtTime(name, t)) {
-        renderer->node()->setNeedsStyleRecalc(AnimationStyleChange);
+        renderer->node()->setNeedsStyleRecalc(SyntheticStyleChange);
         startUpdateStyleIfNeededDispatcher();
         return true;
     }
@@ -262,7 +262,7 @@ bool AnimationControllerPrivate::pauseTransitionAtTime(RenderObject* renderer, c
         return false;
 
     if (compAnim->pauseTransitionAtTime(cssPropertyID(property), t)) {
-        renderer->node()->setNeedsStyleRecalc(AnimationStyleChange);
+        renderer->node()->setNeedsStyleRecalc(SyntheticStyleChange);
         startUpdateStyleIfNeededDispatcher();
         return true;
     }
@@ -438,7 +438,7 @@ void AnimationController::cancelAnimations(RenderObject* renderer)
     if (m_data->clear(renderer)) {
         Node* node = renderer->node();
         ASSERT(!node || (node->document() && !node->document()->inPageCache()));
-        node->setNeedsStyleRecalc(AnimationStyleChange);
+        node->setNeedsStyleRecalc(SyntheticStyleChange);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/page/animation/CompositeAnimation.cpp b/src/3rdparty/webkit/WebCore/page/animation/CompositeAnimation.cpp
index 9481b8d..8946d80 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/CompositeAnimation.cpp
+++ b/src/3rdparty/webkit/WebCore/page/animation/CompositeAnimation.cpp
@@ -480,7 +480,7 @@ bool CompositeAnimation::pauseAnimationAtTime(const AtomicString& name, double t
 
     int count = keyframeAnim->m_animation->iterationCount();
     if ((t >= 0.0) && (!count || (t <= count * keyframeAnim->duration()))) {
-        keyframeAnim->pauseAtTime(t);
+        keyframeAnim->freezeAtTime(t);
         return true;
     }
 
@@ -497,7 +497,7 @@ bool CompositeAnimation::pauseTransitionAtTime(int property, double t)
         return false;
 
     if ((t >= 0.0) && (t <= implAnim->duration())) {
-        implAnim->pauseAtTime(t);
+        implAnim->freezeAtTime(t);
         return true;
     }
 
diff --git a/src/3rdparty/webkit/WebCore/page/animation/KeyframeAnimation.cpp b/src/3rdparty/webkit/WebCore/page/animation/KeyframeAnimation.cpp
index 3f84de1..39ae1e7 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/KeyframeAnimation.cpp
+++ b/src/3rdparty/webkit/WebCore/page/animation/KeyframeAnimation.cpp
@@ -93,8 +93,10 @@ void KeyframeAnimation::getKeyframeAnimationInterval(const RenderStyle*& fromSty
         return;
 
     const TimingFunction* timingFunction = 0;
-    if (fromStyle->animations() && fromStyle->animations()->size() > 0)
+    if (fromStyle->animations() && fromStyle->animations()->size() > 0) {
+        // We get the timing function from the first animation, because we've synthesized a RenderStyle for each keyframe.
         timingFunction = &(fromStyle->animations()->animation(0)->timingFunction());
+    }
 
     prog = progress(scale, offset, timingFunction);
 }
@@ -209,8 +211,12 @@ void KeyframeAnimation::endAnimation(bool reset)
 #if USE(ACCELERATED_COMPOSITING)
         if (m_object->hasLayer()) {
             RenderLayer* layer = toRenderBoxModelObject(m_object)->layer();
-            if (layer->isComposited())
-                layer->backing()->animationFinished(m_keyframes.animationName(), 0, reset);
+            if (layer->isComposited()) {
+                if (reset)
+                    layer->backing()->animationFinished(m_keyframes.animationName());
+                else
+                    layer->backing()->animationPaused(m_keyframes.animationName());
+            }
         }
 #else
         UNUSED_PARAM(reset);
diff --git a/src/3rdparty/webkit/WebCore/page/qt/FrameQt.cpp b/src/3rdparty/webkit/WebCore/page/qt/FrameQt.cpp
index 388bf66..493e60d 100644
--- a/src/3rdparty/webkit/WebCore/page/qt/FrameQt.cpp
+++ b/src/3rdparty/webkit/WebCore/page/qt/FrameQt.cpp
@@ -24,8 +24,6 @@
 #include "config.h"
 #include "Frame.h"
 
-#include "UserStyleSheetLoader.h"
-
 namespace WebCore {
 
 DragImageRef Frame::dragImageForSelection() 
@@ -33,21 +31,5 @@ DragImageRef Frame::dragImageForSelection()
     return 0;
 }
 
-void Frame::setUserStyleSheetLocation(const KURL& url)
-{
-    delete m_userStyleSheetLoader;
-    m_userStyleSheetLoader = 0;
-    if (m_doc && m_doc->docLoader())
-        m_userStyleSheetLoader = new UserStyleSheetLoader(m_doc, url.string());
-}
-
-void Frame::setUserStyleSheet(const String& styleSheet)
-{
-    delete m_userStyleSheetLoader;
-    m_userStyleSheetLoader = 0;
-    if (m_doc)
-        m_doc->setUserStyleSheet(styleSheet);
-}
-
 }
 // vim: ts=4 sw=4 et
diff --git a/src/3rdparty/webkit/WebCore/page/win/EventHandlerWin.cpp b/src/3rdparty/webkit/WebCore/page/win/EventHandlerWin.cpp
index 88bc373..50e50fb 100644
--- a/src/3rdparty/webkit/WebCore/page/win/EventHandlerWin.cpp
+++ b/src/3rdparty/webkit/WebCore/page/win/EventHandlerWin.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007-2009 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -87,9 +88,13 @@ bool EventHandler::eventActivatedView(const PlatformMouseEvent& event) const
 
 PassRefPtr<Clipboard> EventHandler::createDraggingClipboard() const
 {
+#if PLATFORM(WINCE)
+    return 0;
+#else
     COMPtr<WCDataObject> dataObject;
     WCDataObject::createInstance(&dataObject);
     return ClipboardWin::create(true, dataObject.get(), ClipboardWritable);
+#endif
 }
 
 void EventHandler::focusDocumentView()
diff --git a/src/3rdparty/webkit/WebCore/page/win/FrameWin.cpp b/src/3rdparty/webkit/WebCore/page/win/FrameWin.cpp
index 0c1c5b1..b15d195 100644
--- a/src/3rdparty/webkit/WebCore/page/win/FrameWin.cpp
+++ b/src/3rdparty/webkit/WebCore/page/win/FrameWin.cpp
@@ -47,7 +47,7 @@ void computePageRectsForFrame(Frame* frame, const IntRect& printRect, float head
     if (!frame->document() || !frame->view() || !frame->document()->renderer())
         return;
  
-    RenderView* root = static_cast<RenderView*>(frame->document()->renderer());
+    RenderView* root = toRenderView(frame->document()->renderer());
 
     if (!root) {
         LOG_ERROR("document to be printed has no renderer");
@@ -61,7 +61,7 @@ void computePageRectsForFrame(Frame* frame, const IntRect& printRect, float head
     
     float ratio = static_cast<float>(printRect.height()) / static_cast<float>(printRect.width());
  
-    float pageWidth  = static_cast<float>(root->overflowWidth());
+    float pageWidth  = static_cast<float>(root->rightLayoutOverflow());
     float pageHeight = pageWidth * ratio;
     outPageHeight = static_cast<int>(pageHeight);   // this is the height of the page adjusted by margins
     pageHeight -= (headerHeight + footerHeight);
diff --git a/src/3rdparty/webkit/WebCore/page/win/PageWin.cpp b/src/3rdparty/webkit/WebCore/page/win/PageWin.cpp
index f4c744a..5d7450c 100644
--- a/src/3rdparty/webkit/WebCore/page/win/PageWin.cpp
+++ b/src/3rdparty/webkit/WebCore/page/win/PageWin.cpp
@@ -27,12 +27,36 @@
 #include "Page.h"
 
 #include "Frame.h"
+#include "FrameLoaderClient.h"
 #include "FrameView.h"
 #include "FloatRect.h"
+#include "PluginView.h"
 #include <windows.h>
 
 namespace WebCore {
 
 HINSTANCE Page::s_instanceHandle = 0;
 
+void Page::setCanStartPlugins(bool canStartPlugins)
+{
+    if (m_canStartPlugins == canStartPlugins)
+        return;
+
+    m_canStartPlugins = canStartPlugins;
+
+    if (!m_canStartPlugins || m_unstartedPlugins.isEmpty())
+        return;
+
+    Vector<PluginView*> unstartedPlugins;
+    copyToVector(m_unstartedPlugins, unstartedPlugins);
+    m_unstartedPlugins.clear();
+
+    for (size_t i = 0; i < unstartedPlugins.size(); ++i) {
+        if (unstartedPlugins[i]->start())
+            continue;
+        unstartedPlugins[i]->parentFrame()->loader()->client()->dispatchDidFailToStartPlugin(unstartedPlugins[i]);
+    }
+}
+
 } // namespace WebCore
+
diff --git a/src/3rdparty/webkit/WebCore/platform/ContextMenu.cpp b/src/3rdparty/webkit/WebCore/platform/ContextMenu.cpp
index 1c8ec20..21fa7df 100644
--- a/src/3rdparty/webkit/WebCore/platform/ContextMenu.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/ContextMenu.cpp
@@ -27,6 +27,8 @@
 #include "config.h"
 #include "ContextMenu.h"
 
+#if ENABLE(CONTEXT_MENUS)
+
 #include "ContextMenuController.h"
 #include "ContextMenuClient.h"
 #include "CSSComputedStyleDeclaration.h"
@@ -514,6 +516,7 @@ void ContextMenu::populate()
     }
 }
 
+#if ENABLE(INSPECTOR)
 void ContextMenu::addInspectElementItem()
 {
     Node* node = m_hitTestResult.innerNonSharedNode();
@@ -535,6 +538,7 @@ void ContextMenu::addInspectElementItem()
     appendItem(*separatorItem());
     appendItem(InspectElementItem);
 }
+#endif // ENABLE(INSPECTOR)
 
 void ContextMenu::checkOrEnableIfNeeded(ContextMenuItem& item) const
 {
@@ -711,7 +715,10 @@ void ContextMenu::checkOrEnableIfNeeded(ContextMenuItem& item) const
         case ContextMenuItemTagStopSpeaking:
             shouldEnable = controller() && controller()->client() && controller()->client()->isSpeaking();
             break;
-#endif // PLATFORM(MAC)
+#else // PLATFORM(MAC) ends here
+        case ContextMenuItemTagStopSpeaking:
+            break;
+#endif
 #if PLATFORM(GTK)
         case ContextMenuItemTagGoBack:
             shouldEnable = frame->loader()->canGoBackOrForward(-1);
@@ -769,7 +776,9 @@ void ContextMenu::checkOrEnableIfNeeded(ContextMenuItem& item) const
         case ContextMenuItemTagTextDirectionMenu:
         case ContextMenuItemTagPDFSinglePageScrolling:
         case ContextMenuItemTagPDFFacingPagesScrolling:
+#if ENABLE(INSPECTOR)
         case ContextMenuItemTagInspectElement:
+#endif
         case ContextMenuItemBaseApplicationTag:
             break;
     }
@@ -778,4 +787,6 @@ void ContextMenu::checkOrEnableIfNeeded(ContextMenuItem& item) const
     item.setEnabled(shouldEnable);
 }
 
-}
+} // namespace WebCore
+
+#endif // ENABLE(CONTEXT_MENUS)
diff --git a/src/3rdparty/webkit/WebCore/platform/ContextMenuItem.h b/src/3rdparty/webkit/WebCore/platform/ContextMenuItem.h
index 291258d..0c6b81a 100644
--- a/src/3rdparty/webkit/WebCore/platform/ContextMenuItem.h
+++ b/src/3rdparty/webkit/WebCore/platform/ContextMenuItem.h
@@ -46,6 +46,8 @@ typedef struct _GtkMenuItem GtkMenuItem;
 #include <QAction>
 #elif PLATFORM(WX)
 class wxMenuItem;
+#elif PLATFORM(HAIKU)
+class BMenuItem;
 #endif
 
 namespace WebCore {
@@ -119,7 +121,9 @@ namespace WebCore {
         ContextMenuItemTagRightToLeft,
         ContextMenuItemTagPDFSinglePageScrolling,
         ContextMenuItemTagPDFFacingPagesScrolling,
+#if ENABLE(INSPECTOR)
         ContextMenuItemTagInspectElement,
+#endif
         ContextMenuItemTagTextDirectionMenu, // Text Direction sub-menu
         ContextMenuItemTagTextDirectionDefault,
         ContextMenuItemTagTextDirectionLeftToRight,
@@ -202,6 +206,8 @@ namespace WebCore {
         bool checked;
         bool enabled;
     };
+#elif PLATFORM(HAIKU)
+    typedef BMenuItem* PlatformMenuItemDescription;
 #else
     typedef void* PlatformMenuItemDescription;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/Cookie.h b/src/3rdparty/webkit/WebCore/platform/Cookie.h
new file mode 100644
index 0000000..3e74ddc
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/Cookie.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2009 Joseph Pecoraro. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef Cookie_h
+#define Cookie_h
+
+#include "PlatformString.h"
+
+namespace WebCore {
+
+    // This struct is currently only used to provide more cookies information
+    // to the Web Inspector.
+
+    struct Cookie {
+        Cookie(const String& name, const String& value, const String& domain,
+                const String& path, double expires, bool httpOnly, bool secure,
+                bool session)
+            : name(name)
+            , value(value)
+            , domain(domain)
+            , path(path)
+            , expires(expires)
+            , httpOnly(httpOnly)
+            , secure(secure)
+            , session(session)
+        {
+        }
+
+        String name;
+        String value;
+        String domain;
+        String path;
+        double expires;
+        bool httpOnly;
+        bool secure;
+        bool session;
+    };
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/platform/CookieJar.h b/src/3rdparty/webkit/WebCore/platform/CookieJar.h
index 6159386..987543e 100644
--- a/src/3rdparty/webkit/WebCore/platform/CookieJar.h
+++ b/src/3rdparty/webkit/WebCore/platform/CookieJar.h
@@ -26,15 +26,21 @@
 #ifndef CookieJar_h
 #define CookieJar_h
 
+#include <wtf/Vector.h>
+
 namespace WebCore {
 
+    class Document;
     class KURL;
     class String;
-    class Document;
+
+    struct Cookie;
 
     String cookies(const Document*, const KURL&);
     void setCookies(Document*, const KURL&, const String&);
     bool cookiesEnabled(const Document*);
+    bool getRawCookies(const Document*, const KURL&, Vector<Cookie>&);
+    void deleteCookie(const Document*, const KURL&, const String&);
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/CrossThreadCopier.h b/src/3rdparty/webkit/WebCore/platform/CrossThreadCopier.h
index d12d72d..178e056 100644
--- a/src/3rdparty/webkit/WebCore/platform/CrossThreadCopier.h
+++ b/src/3rdparty/webkit/WebCore/platform/CrossThreadCopier.h
@@ -46,6 +46,7 @@ namespace WebCore {
     class String;
     struct CrossThreadResourceResponseData;
     struct CrossThreadResourceRequestData;
+    struct ThreadableLoaderOptions;
 
     template<typename T> struct CrossThreadCopierPassThrough {
         typedef T Type;
@@ -65,6 +66,9 @@ namespace WebCore {
     template<typename T> struct CrossThreadCopierBase<false, T*> : public CrossThreadCopierPassThrough<T*> {
     };
 
+    template<> struct CrossThreadCopierBase<false, ThreadableLoaderOptions> : public CrossThreadCopierPassThrough<ThreadableLoaderOptions> {
+    };
+
     // Custom copy methods.
     template<typename T> struct CrossThreadCopierBase<false, RefPtr<ThreadSafeShared<T> > > {
         typedef PassRefPtr<T> Type;
diff --git a/src/3rdparty/webkit/WebCore/platform/Cursor.h b/src/3rdparty/webkit/WebCore/platform/Cursor.h
index ea75191..2d041d2 100644
--- a/src/3rdparty/webkit/WebCore/platform/Cursor.h
+++ b/src/3rdparty/webkit/WebCore/platform/Cursor.h
@@ -40,6 +40,8 @@ typedef struct _GdkCursor GdkCursor;
 #include <QCursor>
 #elif PLATFORM(CHROMIUM)
 #include "PlatformCursor.h"
+#elif PLATFORM(HAIKU)
+#include <app/Cursor.h>
 #endif
 
 #if PLATFORM(MAC)
@@ -86,6 +88,9 @@ namespace WebCore {
 #elif PLATFORM(CHROMIUM)
     // See PlatformCursor.h
     typedef void* PlatformCursorHandle;
+#elif PLATFORM(HAIKU)
+    typedef BCursor* PlatformCursor;
+    typedef BCursor* PlatformCursorHandle;
 #else
     typedef void* PlatformCursor;
     typedef void* PlatformCursorHandle;
diff --git a/src/3rdparty/webkit/WebCore/platform/DragData.cpp b/src/3rdparty/webkit/WebCore/platform/DragData.cpp
index bf2275a..4518909 100644
--- a/src/3rdparty/webkit/WebCore/platform/DragData.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/DragData.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "DragData.h"
 
+#if ENABLE(DRAG_SUPPORT)
 namespace WebCore {
 
 #if !PLATFORM(MAC)
@@ -39,4 +40,6 @@ DragData::DragData(DragDataRef data, const IntPoint& clientPosition, const IntPo
 }
 #endif
 
-}
+} // namespace WebCore
+
+#endif // ENABLE(DRAG_SUPPORT)
diff --git a/src/3rdparty/webkit/WebCore/platform/DragData.h b/src/3rdparty/webkit/WebCore/platform/DragData.h
index a2c5628..462424b 100644
--- a/src/3rdparty/webkit/WebCore/platform/DragData.h
+++ b/src/3rdparty/webkit/WebCore/platform/DragData.h
@@ -56,6 +56,9 @@ typedef class wxDataObject* DragDataRef;
 typedef void* DragDataRef;
 #elif PLATFORM(CHROMIUM)
 #include "DragDataRef.h"
+#elif PLATFORM(HAIKU)
+class BMessage;
+typedef class BMessage* DragDataRef;
 #endif
 
 
diff --git a/src/3rdparty/webkit/WebCore/platform/DragImage.cpp b/src/3rdparty/webkit/WebCore/platform/DragImage.cpp
index adf9a57..aff4aba 100644
--- a/src/3rdparty/webkit/WebCore/platform/DragImage.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/DragImage.cpp
@@ -25,6 +25,8 @@
 
 #include "config.h"
 #include "DragImage.h"
+
+#if ENABLE(DRAG_SUPPORT)
 #include "DragController.h"
 
 #include "Frame.h"
@@ -71,4 +73,6 @@ DragImageRef createDragImageForSelection(Frame* frame)
     return image;
 }
 
-}
+} // namespace WebCore
+
+#endif // ENABLE(DRAG_SUPPORT)
diff --git a/src/3rdparty/webkit/WebCore/platform/DragImage.h b/src/3rdparty/webkit/WebCore/platform/DragImage.h
index a9039db..91e8aa0 100644
--- a/src/3rdparty/webkit/WebCore/platform/DragImage.h
+++ b/src/3rdparty/webkit/WebCore/platform/DragImage.h
@@ -48,6 +48,8 @@ class wxDragImage;
 #include "DragImageRef.h"
 #elif PLATFORM(GTK)
 typedef struct _GdkPixbuf GdkPixbuf;
+#elif PLATFORM(HAIKU)
+class BBitmap;
 #endif
 
 //We need to #define YOffset as it needs to be shared with WebKit
@@ -72,6 +74,8 @@ namespace WebCore {
     typedef wxDragImage* DragImageRef;
 #elif PLATFORM(GTK)
     typedef GdkPixbuf* DragImageRef;
+#elif PLATFORM(HAIKU)
+    typedef BBitmap* DragImageRef;
 #endif
     
     IntSize dragImageSize(DragImageRef);
diff --git a/src/3rdparty/webkit/WebCore/platform/FileSystem.h b/src/3rdparty/webkit/WebCore/platform/FileSystem.h
index e23b6da..958eb73 100644
--- a/src/3rdparty/webkit/WebCore/platform/FileSystem.h
+++ b/src/3rdparty/webkit/WebCore/platform/FileSystem.h
@@ -170,6 +170,10 @@ char* filenameFromString(const String&);
 String filenameForDisplay(const String&);
 #endif
 
+#if PLATFORM(CHROMIUM)
+String pathGetDisplayFileName(const String&);
+#endif
+
 } // namespace WebCore
 
 #endif // FileSystem_h
diff --git a/src/3rdparty/webkit/WebCore/platform/GeolocationService.cpp b/src/3rdparty/webkit/WebCore/platform/GeolocationService.cpp
index 9b362c8..e60ef00 100644
--- a/src/3rdparty/webkit/WebCore/platform/GeolocationService.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/GeolocationService.cpp
@@ -20,23 +20,39 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
 #include "GeolocationService.h"
+#include "Geoposition.h"
+#include "GeolocationServiceMock.h"
+#include "PositionError.h"
 
+#include <wtf/CurrentTime.h>
 #include <wtf/Assertions.h>
 
 namespace WebCore {
 
 #if !ENABLE(GEOLOCATION)
-GeolocationService* GeolocationService::create(GeolocationServiceClient*)
+static GeolocationService* createGeolocationServiceNull(GeolocationServiceClient*)
 {
     return 0;
 }
+
+GeolocationService::FactoryFunction* GeolocationService::s_factoryFunction = &createGeolocationServiceNull;
 #endif
 
+GeolocationService* GeolocationService::create(GeolocationServiceClient* client)
+{
+    return (*s_factoryFunction)(client);
+}
+
+void GeolocationService::useMock()
+{
+    s_factoryFunction = &GeolocationServiceMock::create;
+}
+
 GeolocationService::GeolocationService(GeolocationServiceClient* client)
     : m_geolocationServiceClient(client)
 {
diff --git a/src/3rdparty/webkit/WebCore/platform/GeolocationService.h b/src/3rdparty/webkit/WebCore/platform/GeolocationService.h
index 74a6ead..cebf313 100644
--- a/src/3rdparty/webkit/WebCore/platform/GeolocationService.h
+++ b/src/3rdparty/webkit/WebCore/platform/GeolocationService.h
@@ -59,11 +59,16 @@ public:
     void positionChanged();
     void errorOccurred();
 
+    static void useMock();
+
 protected:
     GeolocationService(GeolocationServiceClient*);
 
 private:
     GeolocationServiceClient* m_geolocationServiceClient;
+
+    typedef GeolocationService* (FactoryFunction)(GeolocationServiceClient*);
+    static FactoryFunction* s_factoryFunction;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/HostWindow.h b/src/3rdparty/webkit/WebCore/platform/HostWindow.h
index 3a024de..8c74d4f 100644
--- a/src/3rdparty/webkit/WebCore/platform/HostWindow.h
+++ b/src/3rdparty/webkit/WebCore/platform/HostWindow.h
@@ -54,6 +54,9 @@ public:
     // For scrolling a rect into view recursively.  Useful in the cases where a WebView is embedded inside some containing
     // platform-specific ScrollView.
     virtual void scrollRectIntoView(const IntRect&, const ScrollView*) const = 0;
+
+    // To notify WebKit of scrollbar mode changes.
+    virtual void scrollbarsModeDidChange() const = 0;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/KURL.cpp b/src/3rdparty/webkit/WebCore/platform/KURL.cpp
index 4b75046..aa9c624 100644
--- a/src/3rdparty/webkit/WebCore/platform/KURL.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/KURL.cpp
@@ -302,13 +302,13 @@ void KURL::invalidate()
     m_fragmentEnd = 0;
 }
 
-KURL::KURL(const char* url)
+KURL::KURL(ParsedURLStringTag, const char* url)
 {
     parse(url, 0);
     ASSERT(url == m_string);
 }
 
-KURL::KURL(const String& url)
+KURL::KURL(ParsedURLStringTag, const String& url)
 {
     parse(url);
     ASSERT(url == m_string);
@@ -590,7 +590,7 @@ String KURL::user() const
     return decodeURLEscapeSequences(m_string.substring(m_userStart, m_userEnd - m_userStart));
 }
 
-String KURL::ref() const
+String KURL::fragmentIdentifier() const
 {
     if (m_fragmentEnd == m_queryEnd)
         return String();
@@ -598,7 +598,7 @@ String KURL::ref() const
     return m_string.substring(m_queryEnd + 1, m_fragmentEnd - (m_queryEnd + 1));
 }
 
-bool KURL::hasRef() const
+bool KURL::hasFragmentIdentifier() const
 {
     return m_fragmentEnd != m_queryEnd;
 }
@@ -760,16 +760,16 @@ void KURL::setPass(const String& password)
     parse(m_string.left(m_userEnd) + p + m_string.substring(end));
 }
 
-void KURL::setRef(const String& s)
+void KURL::setFragmentIdentifier(const String& s)
 {
     if (!m_isValid)
         return;
 
     // FIXME: Non-ASCII characters must be encoded and escaped to match parse() expectations.
-    parse(m_string.left(m_queryEnd) + (s.isNull() ? "" : "#" + s));
+    parse(m_string.left(m_queryEnd) + "#" + s);
 }
 
-void KURL::removeRef()
+void KURL::removeFragmentIdentifier()
 {
     if (!m_isValid)
         return;
@@ -843,7 +843,7 @@ String KURL::prettyURL() const
 
     if (m_fragmentEnd != m_queryEnd) {
         result.append('#');
-        append(result, ref());
+        append(result, fragmentIdentifier());
     }
 
     return String::adopt(result);
@@ -1316,7 +1316,7 @@ void KURL::parse(const char* url, const String* originalString)
     m_isValid = true;
 }
 
-bool equalIgnoringRef(const KURL& a, const KURL& b)
+bool equalIgnoringFragmentIdentifier(const KURL& a, const KURL& b)
 {
     if (a.m_queryEnd != b.m_queryEnd)
         return false;
@@ -1641,7 +1641,7 @@ String mimeTypeFromDataURL(const String& url)
 
 const KURL& blankURL()
 {
-    DEFINE_STATIC_LOCAL(KURL, staticBlankURL, ("about:blank"));
+    DEFINE_STATIC_LOCAL(KURL, staticBlankURL, (ParsedURLString, "about:blank"));
     return staticBlankURL;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/KURL.h b/src/3rdparty/webkit/WebCore/platform/KURL.h
index e419d16..73fadd1 100644
--- a/src/3rdparty/webkit/WebCore/platform/KURL.h
+++ b/src/3rdparty/webkit/WebCore/platform/KURL.h
@@ -55,20 +55,18 @@ namespace WebCore {
 class TextEncoding;
 struct KURLHash;
 
-// FIXME: Our terminology here is a bit inconsistent. We refer to the part
-// after the "#" as the "fragment" in some places and the "ref" in others.
-// We should fix the terminology to match the URL and URI RFCs as closely
-// as possible to resolve this.
+enum ParsedURLStringTag { ParsedURLString };
 
 class KURL {
 public:
     // Generates a URL which contains a null string.
     KURL() { invalidate(); }
 
-    // The argument is an absolute URL string. The string is assumed to be
-    // an already encoded (ASCII-only) valid absolute URL.
-    explicit KURL(const char*);
-    explicit KURL(const String&);
+    // The argument is an absolute URL string. The string is assumed to be output of KURL::string() called on a valid
+    // KURL object, or indiscernible from such.
+    // It is usually best to avoid repeatedly parsing a string, unless memory saving outweigh the possible slow-downs.
+    KURL(ParsedURLStringTag, const char*);
+    KURL(ParsedURLStringTag, const String&);
 
     // Resolves the relative URL with the given base URL. If provided, the
     // TextEncoding is used to encode non-ASCII characers. The base URL can be
@@ -120,8 +118,8 @@ public:
     String path() const;
     String lastPathComponent() const;
     String query() const;
-    String ref() const;
-    bool hasRef() const;
+    String fragmentIdentifier() const;
+    bool hasFragmentIdentifier() const;
 
     String baseAsString() const;
 
@@ -155,10 +153,10 @@ public:
     // URL (with nothing after it). To clear the query, pass a null string.
     void setQuery(const String&);
 
-    void setRef(const String&);
-    void removeRef();
+    void setFragmentIdentifier(const String&);
+    void removeFragmentIdentifier();
 
-    friend bool equalIgnoringRef(const KURL&, const KURL&);
+    friend bool equalIgnoringFragmentIdentifier(const KURL&, const KURL&);
 
     friend bool protocolHostAndPortAreEqual(const KURL&, const KURL&);
 
@@ -244,7 +242,7 @@ bool operator!=(const KURL&, const KURL&);
 bool operator!=(const KURL&, const String&);
 bool operator!=(const String&, const KURL&);
 
-bool equalIgnoringRef(const KURL&, const KURL&);
+bool equalIgnoringFragmentIdentifier(const KURL&, const KURL&);
 bool protocolHostAndPortAreEqual(const KURL&, const KURL&);
     
 const KURL& blankURL();
diff --git a/src/3rdparty/webkit/WebCore/platform/KURLGoogle.cpp b/src/3rdparty/webkit/WebCore/platform/KURLGoogle.cpp
index d8b87e5..b323332 100644
--- a/src/3rdparty/webkit/WebCore/platform/KURLGoogle.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/KURLGoogle.cpp
@@ -331,7 +331,7 @@ const String& KURLGooglePrivate::string() const
 // Creates with NULL-terminated string input representing an absolute URL.
 // WebCore generally calls this only with hardcoded strings, so the input is
 // ASCII. We treat is as UTF-8 just in case.
-KURL::KURL(const char *url)
+KURL::KURL(ParsedURLStringTag, const char *url)
 {
     // FIXME The Mac code checks for beginning with a slash and converting to a
     // file: URL. We will want to add this as well once we can compile on a
@@ -349,7 +349,7 @@ KURL::KURL(const char *url)
 // to a string and then converted back. In this case, the URL is already
 // canonical and in proper escaped form so needs no encoding. We treat it was
 // UTF-8 just in case.
-KURL::KURL(const String& url)
+KURL::KURL(ParsedURLStringTag, const String& url)
 {
     if (!url.isNull())
         m_url.init(KURL(), url, 0);
@@ -504,7 +504,7 @@ String KURL::user() const
     return m_url.componentString(m_url.m_parsed.username);
 }
 
-String KURL::ref() const
+String KURL::fragmentIdentifier() const
 {
     // Empty but present refs ("foo.com/bar#") should result in the empty
     // string, which m_url.componentString will produce. Nonexistant refs should be
@@ -516,7 +516,7 @@ String KURL::ref() const
     return m_url.componentString(m_url.m_parsed.ref);
 }
 
-bool KURL::hasRef() const
+bool KURL::hasFragmentIdentifier() const
 {
     // Note: KURL.cpp unescapes here.
     // FIXME determine if KURL.cpp agrees about an empty ref
@@ -627,22 +627,22 @@ void KURL::setPass(const String& pass)
     m_url.replaceComponents(replacements);
 }
 
-void KURL::setRef(const String& ref)
+void KURL::setFragmentIdentifier(const String& s)
 {
     // This function is commonly called to clear the ref, which we
     // normally don't have, so we optimize this case.
-    if (ref.isNull() && !m_url.m_parsed.ref.is_valid())
+    if (s.isNull() && !m_url.m_parsed.ref.is_valid())
         return;
 
     KURLGooglePrivate::Replacements replacements;
-    if (ref.isNull())
+    if (s.isNull())
         replacements.ClearRef();
     else
-        replacements.SetRef(CharactersOrEmpty(ref), url_parse::Component(0, ref.length()));
+        replacements.SetRef(CharactersOrEmpty(s), url_parse::Component(0, s.length()));
     m_url.replaceComponents(replacements);
 }
 
-void KURL::removeRef()
+void KURL::removeFragmentIdentifier()
 {
     KURLGooglePrivate::Replacements replacements;
     replacements.ClearRef();
@@ -728,13 +728,8 @@ String decodeURLEscapeSequences(const String& str)
 // cause security holes. We never call this function for components, and
 // just return the ASCII versions instead.
 //
-// However, this static function is called directly in some cases. It appears
-// that this only happens for javascript: URLs, so this is essentially the
-// JavaScript URL decoder. It assumes UTF-8 encoding.
-//
-// IE doesn't unescape %00, forcing you to use \x00 in JS strings, so we do
-// the same. This also eliminates NULL-related problems should a consumer
-// incorrectly call this function for non-JavaScript.
+// This function is also used to decode javascript: URLs and as a general
+// purpose unescaping function.
 //
 // FIXME These should be merged to the KURL.cpp implementation.
 String decodeURLEscapeSequences(const String& str, const TextEncoding& encoding)
@@ -757,15 +752,9 @@ String decodeURLEscapeSequences(const String& str, const TextEncoding& encoding)
     for (int i = 0; i < inputLength; i++) {
         if (input[i] == '%') {
             unsigned char ch;
-            if (url_canon::DecodeEscaped(input, &i, inputLength, &ch)) {
-                if (!ch) {
-                    // Never unescape NULLs.
-                    unescaped.push_back('%');
-                    unescaped.push_back('0');
-                    unescaped.push_back('0');
-                } else
-                    unescaped.push_back(ch);
-            } else {
+            if (url_canon::DecodeEscaped(input, &i, inputLength, &ch))
+                unescaped.push_back(ch);
+            else {
                 // Invalid escape sequence, copy the percent literal.
                 unescaped.push_back('%');
             }
@@ -885,7 +874,7 @@ void KURL::invalidate()
 }
 
 // Equal up to reference fragments, if any.
-bool equalIgnoringRef(const KURL& a, const KURL& b)
+bool equalIgnoringFragmentIdentifier(const KURL& a, const KURL& b)
 {
     // Compute the length of each URL without its ref. Note that the reference
     // begin (if it exists) points to the character *after* the '#', so we need
@@ -936,7 +925,7 @@ unsigned KURL::pathAfterLastSlash() const
 
 const KURL& blankURL()
 {
-    static KURL staticBlankURL("about:blank");
+    static KURL staticBlankURL(ParsedURLString, "about:blank");
     return staticBlankURL;
 }
 
@@ -957,6 +946,32 @@ inline bool KURL::protocolIs(const String& string, const char* protocol)
     return WebCore::protocolIs(string, protocol);
 }
 
+bool protocolHostAndPortAreEqual(const KURL& a, const KURL& b)
+{
+    if (a.parsed().scheme.end() != b.parsed().scheme.end())
+        return false;
+
+    int hostStartA = a.hostStart();
+    int hostStartB = b.hostStart();
+    if (a.hostEnd() - hostStartA != b.hostEnd() - hostStartB)
+        return false;
+
+    // Check the scheme
+    for (int i = 0; i < a.parsed().scheme.end(); ++i)
+        if (a.string()[i] != b.string()[i])
+            return false;
+    
+    // And the host
+    for (int i = hostStartA; i < static_cast<int>(a.hostEnd()); ++i)
+        if (a.string()[i] != b.string()[i])
+            return false;
+    
+    if (a.port() != b.port())
+        return false;
+
+    return true;
+}
+
 } // namespace WebCore
 
 #endif // USE(GOOGLEURL)
diff --git a/src/3rdparty/webkit/WebCore/platform/KURLHash.h b/src/3rdparty/webkit/WebCore/platform/KURLHash.h
index 4deb078..7448a49 100644
--- a/src/3rdparty/webkit/WebCore/platform/KURLHash.h
+++ b/src/3rdparty/webkit/WebCore/platform/KURLHash.h
@@ -52,7 +52,7 @@ namespace WTF {
 
     template<> struct HashTraits<WebCore::KURL> : GenericHashTraits<WebCore::KURL> {
         static const bool emptyValueIsZero = true;
-        static void constructDeletedValue(WebCore::KURL& slot) { new (&slot) WebCore::KURL(WebCore::String(HashTableDeletedValue)); }
+        static void constructDeletedValue(WebCore::KURL& slot) { new (&slot) WebCore::KURL(WebCore::ParsedURLString, WebCore::String(HashTableDeletedValue)); }
         static bool isDeletedValue(const WebCore::KURL& slot) { return slot.string().isHashTableDeletedValue(); }
     };
 
diff --git a/src/3rdparty/webkit/WebCore/platform/LocalizedStrings.h b/src/3rdparty/webkit/WebCore/platform/LocalizedStrings.h
index 7c586d3..0fa9f71 100644
--- a/src/3rdparty/webkit/WebCore/platform/LocalizedStrings.h
+++ b/src/3rdparty/webkit/WebCore/platform/LocalizedStrings.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2003, 2006, 2009 Apple Computer, Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -38,6 +38,7 @@ namespace WebCore {
     String fileButtonChooseFileLabel();
     String fileButtonNoFileSelectedLabel();
     String copyImageUnknownFileLabel();
+#if ENABLE(CONTEXT_MENUS)
     String contextMenuItemTagOpenLinkInNewWindow();
     String contextMenuItemTagDownloadLinkToDisk();
     String contextMenuItemTagCopyLinkToClipboard();
@@ -103,6 +104,7 @@ namespace WebCore {
     String contextMenuItemTagChangeBack(const String& replacedString);
 #endif
     String contextMenuItemTagInspectElement();
+#endif // ENABLE(CONTEXT_MENUS)
 
     String searchMenuNoRecentSearchesText();
     String searchMenuRecentSearchesText();
@@ -115,6 +117,7 @@ namespace WebCore {
     String AXHeadingText();
     String AXDefinitionListTermText();
     String AXDefinitionListDefinitionText();
+    String AXARIAContentGroupText(const String& ariaType);
     
     String AXButtonActionVerb();
     String AXRadioButtonActionVerb();
@@ -135,6 +138,9 @@ namespace WebCore {
 
     String mediaElementLoadingStateText();
     String mediaElementLiveBroadcastStateText();
+    String localizedMediaControlElementString(const String&);
+    String localizedMediaControlElementHelpText(const String&);
+    String localizedMediaTimeDescription(float);
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/MIMETypeRegistry.cpp b/src/3rdparty/webkit/WebCore/platform/MIMETypeRegistry.cpp
index 923dd8c..609a1b0 100644
--- a/src/3rdparty/webkit/WebCore/platform/MIMETypeRegistry.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/MIMETypeRegistry.cpp
@@ -92,7 +92,7 @@ static void initializeSupportedImageMIMETypes()
 
 #elif PLATFORM(QT)
     QList<QByteArray> formats = QImageReader::supportedImageFormats();
-    for (size_t i = 0; i < formats.size(); ++i) {
+    for (size_t i = 0; i < static_cast<size_t>(formats.size()); ++i) {
 #if ENABLE(SVG)
         /*
          * Qt has support for SVG, but we want to use KSVG2
@@ -149,7 +149,7 @@ static void initializeSupportedImageMIMETypesForEncoding()
 #endif
 #elif PLATFORM(QT)
     QList<QByteArray> formats = QImageWriter::supportedImageFormats();
-    for (size_t i = 0; i < formats.size(); ++i) {
+    for (int i = 0; i < formats.size(); ++i) {
         String mimeType = MIMETypeRegistry::getMIMETypeForExtension(formats.at(i).constData());
         supportedImageMIMETypesForEncoding->add(mimeType);
     }
diff --git a/src/3rdparty/webkit/WebCore/platform/Pasteboard.h b/src/3rdparty/webkit/WebCore/platform/Pasteboard.h
index 883364a..cd6a3b5 100644
--- a/src/3rdparty/webkit/WebCore/platform/Pasteboard.h
+++ b/src/3rdparty/webkit/WebCore/platform/Pasteboard.h
@@ -95,13 +95,14 @@ public:
     bool canSmartReplace();
     PassRefPtr<DocumentFragment> documentFragment(Frame*, PassRefPtr<Range>, bool allowPlainText, bool& chosePlainText);
     String plainText(Frame* = 0);
-#if PLATFORM(QT)
+#if PLATFORM(QT) || PLATFORM(CHROMIUM)
     bool isSelectionMode() const;
     void setSelectionMode(bool selectionMode);
 #endif
 
 #if PLATFORM(GTK)
     void setHelper(PasteboardHelper*);
+    PasteboardHelper* m_helper;
 #endif
 
 private:
@@ -117,11 +118,7 @@ private:
     HWND m_owner;
 #endif
 
-#if PLATFORM(GTK)
-    PasteboardHelper* m_helper;
-#endif
-
-#if PLATFORM(QT)
+#if PLATFORM(QT) || PLATFORM(CHROMIUM)
     bool m_selectionMode;
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/platform/PlatformKeyboardEvent.h b/src/3rdparty/webkit/WebCore/platform/PlatformKeyboardEvent.h
index d9701b7..4a06731 100644
--- a/src/3rdparty/webkit/WebCore/platform/PlatformKeyboardEvent.h
+++ b/src/3rdparty/webkit/WebCore/platform/PlatformKeyboardEvent.h
@@ -59,6 +59,10 @@ QT_END_NAMESPACE
 class wxKeyEvent;
 #endif
 
+#if PLATFORM(HAIKU)
+class BMessage;
+#endif
+
 namespace WebCore {
 
     class PlatformKeyboardEvent {
@@ -81,7 +85,7 @@ namespace WebCore {
             AltKey = 1 << 0,
             CtrlKey = 1 << 1,
             MetaKey = 1 << 2,
-            ShiftKey = 1 << 3
+            ShiftKey = 1 << 3,
         };
 
         Type type() const { return m_type; }
@@ -148,6 +152,10 @@ namespace WebCore {
         PlatformKeyboardEvent(wxKeyEvent&);
 #endif
 
+#if PLATFORM(HAIKU)
+        PlatformKeyboardEvent(BMessage*);
+#endif
+
 #if PLATFORM(WIN) || PLATFORM(CHROMIUM)
         bool isSystemKey() const { return m_isSystemKey; }
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/PlatformMenuDescription.h b/src/3rdparty/webkit/WebCore/platform/PlatformMenuDescription.h
index 65537eb..380ded4 100644
--- a/src/3rdparty/webkit/WebCore/platform/PlatformMenuDescription.h
+++ b/src/3rdparty/webkit/WebCore/platform/PlatformMenuDescription.h
@@ -40,6 +40,8 @@ typedef struct HMENU__* HMENU;
 typedef struct _GtkMenu GtkMenu;
 #elif PLATFORM(WX)
 class wxMenu;
+#elif PLATFORM(HAIKU)
+class BMenu;
 #endif
 
 namespace WebCore {
@@ -55,6 +57,8 @@ namespace WebCore {
     typedef GtkMenu* PlatformMenuDescription;
 #elif PLATFORM(WX)
     typedef wxMenu* PlatformMenuDescription;
+#elif PLATFORM(HAIKU)
+    typedef BMenu* PlatformMenuDescription;
 #else
     typedef void* PlatformMenuDescription;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/PlatformMouseEvent.h b/src/3rdparty/webkit/WebCore/platform/PlatformMouseEvent.h
index 2543d40..99acc63 100644
--- a/src/3rdparty/webkit/WebCore/platform/PlatformMouseEvent.h
+++ b/src/3rdparty/webkit/WebCore/platform/PlatformMouseEvent.h
@@ -36,6 +36,7 @@ typedef struct _GdkEventMotion GdkEventMotion;
 #if PLATFORM(QT)
 QT_BEGIN_NAMESPACE
 class QInputEvent;
+class QGraphicsSceneMouseEvent;
 QT_END_NAMESPACE
 #endif
 
@@ -50,6 +51,10 @@ typedef long LPARAM;
 class wxMouseEvent;
 #endif
 
+#if PLATFORM(HAIKU)
+class BMessage;
+#endif
+
 namespace WebCore {
     
     // These button numbers match the ones used in the DOM API, 0 through 2, except for NoButton which isn't specified.
@@ -116,6 +121,7 @@ namespace WebCore {
 
 #if PLATFORM(QT)
         PlatformMouseEvent(QInputEvent*, int clickCount);
+        PlatformMouseEvent(QGraphicsSceneMouseEvent*, int clickCount);
 #endif
 
 #if PLATFORM(WIN)
@@ -128,6 +134,10 @@ namespace WebCore {
         PlatformMouseEvent(const wxMouseEvent&, const wxPoint& globalPoint, int clickCount);
 #endif
 
+#if PLATFORM(HAIKU)
+        PlatformMouseEvent(const BMessage*);
+#endif
+
     protected:
         IntPoint m_position;
         IntPoint m_globalPosition;
diff --git a/src/3rdparty/webkit/WebCore/platform/PlatformWheelEvent.h b/src/3rdparty/webkit/WebCore/platform/PlatformWheelEvent.h
index ae8df4e..537deac 100644
--- a/src/3rdparty/webkit/WebCore/platform/PlatformWheelEvent.h
+++ b/src/3rdparty/webkit/WebCore/platform/PlatformWheelEvent.h
@@ -35,6 +35,7 @@ typedef struct _GdkEventScroll GdkEventScroll;
 #if PLATFORM(QT)
 QT_BEGIN_NAMESPACE
 class QWheelEvent;
+class QGraphicsSceneWheelEvent;
 QT_END_NAMESPACE
 #endif
 
@@ -49,6 +50,10 @@ class wxMouseEvent;
 class wxPoint;
 #endif
 
+#if PLATFORM(HAIKU)
+class BMessage;
+#endif
+
 namespace WebCore {
 
     class FloatPoint;
@@ -98,6 +103,8 @@ namespace WebCore {
 
 #if PLATFORM(QT)
         PlatformWheelEvent(QWheelEvent*);
+        PlatformWheelEvent(QGraphicsSceneWheelEvent*);
+        void applyDelta(int delta, Qt::Orientation);
 #endif
 
 #if PLATFORM(WIN)
@@ -109,6 +116,10 @@ namespace WebCore {
         PlatformWheelEvent(const wxMouseEvent&, const wxPoint&);
 #endif
 
+#if PLATFORM(HAIKU)
+        PlatformWheelEvent(BMessage*);
+#endif
+
     protected:
         IntPoint m_position;
         IntPoint m_globalPosition;
diff --git a/src/3rdparty/webkit/WebCore/platform/PopupMenu.h b/src/3rdparty/webkit/WebCore/platform/PopupMenu.h
index fc85d60..2315f02 100644
--- a/src/3rdparty/webkit/WebCore/platform/PopupMenu.h
+++ b/src/3rdparty/webkit/WebCore/platform/PopupMenu.h
@@ -59,6 +59,8 @@ class wxMenu;
 #include <wx/event.h>
 #elif PLATFORM(CHROMIUM)
 #include "PopupMenuPrivate.h"
+#elif PLATFORM(HAIKU)
+class BMenu;
 #endif
 
 namespace WebCore {
@@ -92,6 +94,8 @@ public:
 #if PLATFORM(WIN)
     Scrollbar* scrollbar() const { return m_scrollbar.get(); }
 
+    static LPCTSTR popupClassName();
+
     bool up(unsigned lines = 1);
     bool down(unsigned lines = 1);
 
@@ -153,6 +157,10 @@ private:
     void calculatePositionAndSize(const IntRect&, FrameView*);
     void invalidateItem(int index);
 
+    static LRESULT CALLBACK PopupMenuWndProc(HWND, UINT, WPARAM, LPARAM);
+    LRESULT wndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam);
+    static void registerClass();
+
     RefPtr<Scrollbar> m_scrollbar;
     HWND m_popup;
     HDC m_DC;
@@ -164,6 +172,7 @@ private:
     int m_wheelDelta;
     int m_focusedIndex;
     bool m_scrollbarCapturingMouse;
+    bool m_showPopup;
 #elif PLATFORM(GTK)
     IntPoint m_menuPosition;
     GtkMenu* m_popup;
@@ -177,6 +186,8 @@ private:
     void OnMenuItemSelected(wxCommandEvent&);
 #elif PLATFORM(CHROMIUM)
     PopupMenuPrivate p;
+#elif PLATFORM(HAIKU)
+    BMenu* m_menu;
 #endif
 
 };
diff --git a/src/3rdparty/webkit/WebCore/platform/PopupMenuClient.h b/src/3rdparty/webkit/WebCore/platform/PopupMenuClient.h
index 0718b8c..2614fe2 100644
--- a/src/3rdparty/webkit/WebCore/platform/PopupMenuClient.h
+++ b/src/3rdparty/webkit/WebCore/platform/PopupMenuClient.h
@@ -39,6 +39,7 @@ public:
     virtual void valueChanged(unsigned listIndex, bool fireEvents = true) = 0;
 
     virtual String itemText(unsigned listIndex) const = 0;
+    virtual String itemToolTip(unsigned listIndex) const = 0;
     virtual bool itemIsEnabled(unsigned listIndex) const = 0;
     virtual PopupMenuStyle itemStyle(unsigned listIndex) const = 0;
     virtual PopupMenuStyle menuStyle() const = 0;
@@ -48,7 +49,7 @@ public:
     virtual int clientPaddingRight() const = 0;
     virtual int listSize() const = 0;
     virtual int selectedIndex() const = 0;
-    virtual void hidePopup() = 0;
+    virtual void popupDidHide() = 0;
     virtual bool itemIsSeparator(unsigned listIndex) const = 0;
     virtual bool itemIsLabel(unsigned listIndex) const = 0;
     virtual bool itemIsSelected(unsigned listIndex) const = 0;
diff --git a/src/3rdparty/webkit/WebCore/platform/ScrollTypes.h b/src/3rdparty/webkit/WebCore/platform/ScrollTypes.h
index b0df470..eba9055 100644
--- a/src/3rdparty/webkit/WebCore/platform/ScrollTypes.h
+++ b/src/3rdparty/webkit/WebCore/platform/ScrollTypes.h
@@ -53,7 +53,7 @@ namespace WebCore {
     enum ScrollbarControlStateMask {
         ActiveScrollbarState = 1,
         EnabledScrollbarState = 1 << 1,
-        PressedScrollbarState = 1 << 2
+        PressedScrollbarState = 1 << 2,
     };
 
     enum ScrollbarPart {
@@ -67,7 +67,7 @@ namespace WebCore {
         ForwardButtonEndPart = 1 << 6,
         ScrollbarBGPart = 1 << 7,
         TrackBGPart = 1 << 8,
-        AllParts = 0xffffffff
+        AllParts = 0xffffffff,
     };
 
     enum ScrollbarButtonsPlacement {
diff --git a/src/3rdparty/webkit/WebCore/platform/ScrollView.cpp b/src/3rdparty/webkit/WebCore/platform/ScrollView.cpp
index b1cff4f..d8c3318 100644
--- a/src/3rdparty/webkit/WebCore/platform/ScrollView.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/ScrollView.cpp
@@ -82,6 +82,7 @@ void ScrollView::setHasHorizontalScrollbar(bool hasBar)
     if (hasBar && !m_horizontalScrollbar) {
         m_horizontalScrollbar = createScrollbar(HorizontalScrollbar);
         addChild(m_horizontalScrollbar.get());
+        m_horizontalScrollbar->styleChanged();
     } else if (!hasBar && m_horizontalScrollbar) {
         removeChild(m_horizontalScrollbar.get());
         m_horizontalScrollbar = 0;
@@ -93,6 +94,7 @@ void ScrollView::setHasVerticalScrollbar(bool hasBar)
     if (hasBar && !m_verticalScrollbar) {
         m_verticalScrollbar = createScrollbar(VerticalScrollbar);
         addChild(m_verticalScrollbar.get());
+        m_verticalScrollbar->styleChanged();
     } else if (!hasBar && m_verticalScrollbar) {
         removeChild(m_verticalScrollbar.get());
         m_verticalScrollbar = 0;
@@ -104,7 +106,6 @@ PassRefPtr<Scrollbar> ScrollView::createScrollbar(ScrollbarOrientation orientati
 {
     return Scrollbar::createNativeScrollbar(this, orientation, RegularScrollbar);
 }
-#endif
 
 void ScrollView::setScrollbarModes(ScrollbarMode horizontalMode, ScrollbarMode verticalMode)
 {
@@ -117,6 +118,7 @@ void ScrollView::setScrollbarModes(ScrollbarMode horizontalMode, ScrollbarMode v
     else
         updateScrollbars(scrollOffset());
 }
+#endif
 
 void ScrollView::scrollbarModes(ScrollbarMode& horizontalMode, ScrollbarMode& verticalMode) const
 {
@@ -327,6 +329,15 @@ void ScrollView::updateScrollbars(const IntSize& desiredOffset)
     if (m_inUpdateScrollbars || prohibitsScrolling() || platformWidget())
         return;
 
+    // If we came in here with the view already needing a layout, then go ahead and do that
+    // first.  (This will be the common case, e.g., when the page changes due to window resizing for example).
+    // This layout will not re-enter updateScrollbars and does not count towards our max layout pass total.
+    if (!m_scrollbarsSuppressed) {
+        m_inUpdateScrollbars = true;
+        visibleContentsResized();
+        m_inUpdateScrollbars = false;
+    }
+
     bool hasHorizontalScrollbar = m_horizontalScrollbar;
     bool hasVerticalScrollbar = m_verticalScrollbar;
     
@@ -347,13 +358,6 @@ void ScrollView::updateScrollbars(const IntSize& desiredOffset)
         if (hasVerticalScrollbar != newHasVerticalScrollbar)
             setHasVerticalScrollbar(newHasVerticalScrollbar);
     } else {
-        // If we came in here with the view already needing a layout, then go ahead and do that
-        // first.  (This will be the common case, e.g., when the page changes due to window resizing for example).
-        // This layout will not re-enter updateScrollers and does not count towards our max layout pass total.
-        m_inUpdateScrollbars = true;
-        visibleContentsResized();
-        m_inUpdateScrollbars = false;
-
         bool sendContentResizedNotification = false;
         
         IntSize docSize = contentsSize();
@@ -460,8 +464,10 @@ void ScrollView::updateScrollbars(const IntSize& desiredOffset)
             m_verticalScrollbar->setSuppressInvalidation(false);
     }
 
-    if (hasHorizontalScrollbar != (m_horizontalScrollbar != 0) || hasVerticalScrollbar != (m_verticalScrollbar != 0))
+    if (hasHorizontalScrollbar != (m_horizontalScrollbar != 0) || hasVerticalScrollbar != (m_verticalScrollbar != 0)) {
         frameRectsChanged();
+        updateScrollCorner();
+    }
 
     // See if our offset has changed in a situation where we might not have scrollbars.
     // This can happen when editing a body with overflow:hidden and scrolling to reveal selection.
@@ -476,7 +482,7 @@ void ScrollView::updateScrollbars(const IntSize& desiredOffset)
     m_inUpdateScrollbars = false;
 }
 
-const int panIconSizeLength = 20;
+const int panIconSizeLength = 16;
 
 void ScrollView::scrollContents(const IntSize& scrollDelta)
 {
@@ -621,23 +627,7 @@ void ScrollView::setScrollbarsSuppressed(bool suppressed, bool repaintOnUnsuppre
             m_verticalScrollbar->invalidate();
 
         // Invalidate the scroll corner too on unsuppress.
-        IntRect hCorner;
-        if (m_horizontalScrollbar && width() - m_horizontalScrollbar->width() > 0) {
-            hCorner = IntRect(m_horizontalScrollbar->width(),
-                              height() - m_horizontalScrollbar->height(),
-                              width() - m_horizontalScrollbar->width(),
-                              m_horizontalScrollbar->height());
-            invalidateRect(hCorner);
-        }
-
-        if (m_verticalScrollbar && height() - m_verticalScrollbar->height() > 0) {
-            IntRect vCorner(width() - m_verticalScrollbar->width(),
-                            m_verticalScrollbar->height(),
-                            m_verticalScrollbar->width(),
-                            height() - m_verticalScrollbar->height());
-            if (vCorner != hCorner)
-                invalidateRect(vCorner);
-        }
+        invalidateRect(scrollCornerRect());
     }
 }
 
@@ -717,16 +707,48 @@ void ScrollView::frameRectsChanged()
 
 void ScrollView::repaintContentRectangle(const IntRect& rect, bool now)
 {
-    if (rect.isEmpty())
+    IntRect visibleContent = visibleContentRect();
+    visibleContent.intersect(rect);
+    if (visibleContent.isEmpty())
         return;
 
     if (platformWidget()) {
-        platformRepaintContentRectangle(rect, now);
+        platformRepaintContentRectangle(visibleContent, now);
         return;
     }
 
     if (hostWindow())
-        hostWindow()->repaint(contentsToWindow(rect), true, now);
+        hostWindow()->repaint(contentsToWindow(visibleContent), true, now);
+}
+
+IntRect ScrollView::scrollCornerRect() const
+{
+    IntRect cornerRect;
+    
+    if (m_horizontalScrollbar && width() - m_horizontalScrollbar->width() > 0) {
+        cornerRect.unite(IntRect(m_horizontalScrollbar->width(),
+                                 height() - m_horizontalScrollbar->height(),
+                                 width() - m_horizontalScrollbar->width(),
+                                 m_horizontalScrollbar->height()));
+    }
+
+    if (m_verticalScrollbar && height() - m_verticalScrollbar->height() > 0) {
+        cornerRect.unite(IntRect(width() - m_verticalScrollbar->width(),
+                                 m_verticalScrollbar->height(),
+                                 m_verticalScrollbar->width(),
+                                 height() - m_verticalScrollbar->height()));
+    }
+    
+    return cornerRect;
+}
+
+void ScrollView::updateScrollCorner()
+{
+}
+
+void ScrollView::paintScrollCorner(GraphicsContext* context, const IntRect& cornerRect)
+{
+    ScrollbarTheme::nativeTheme()->paintScrollCorner(this, context, cornerRect);
 }
 
 void ScrollView::paint(GraphicsContext* context, const IntRect& rect)
@@ -768,25 +790,7 @@ void ScrollView::paint(GraphicsContext* context, const IntRect& rect)
         if (m_verticalScrollbar)
             m_verticalScrollbar->paint(context, scrollViewDirtyRect);
 
-        IntRect hCorner;
-        if (m_horizontalScrollbar && width() - m_horizontalScrollbar->width() > 0) {
-            hCorner = IntRect(m_horizontalScrollbar->width(),
-                              height() - m_horizontalScrollbar->height(),
-                              width() - m_horizontalScrollbar->width(),
-                              m_horizontalScrollbar->height());
-            if (hCorner.intersects(scrollViewDirtyRect))
-                ScrollbarTheme::nativeTheme()->paintScrollCorner(this, context, hCorner);
-        }
-
-        if (m_verticalScrollbar && height() - m_verticalScrollbar->height() > 0) {
-            IntRect vCorner(width() - m_verticalScrollbar->width(),
-                            m_verticalScrollbar->height(),
-                            m_verticalScrollbar->width(),
-                            height() - m_verticalScrollbar->height());
-            if (vCorner != hCorner && vCorner.intersects(scrollViewDirtyRect))
-                ScrollbarTheme::nativeTheme()->paintScrollCorner(this, context, vCorner);
-        }
-
+        paintScrollCorner(context, scrollCornerRect());
         context->restore();
     }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/ScrollView.h b/src/3rdparty/webkit/WebCore/platform/ScrollView.h
index 4678ad0..8fcdf60 100644
--- a/src/3rdparty/webkit/WebCore/platform/ScrollView.h
+++ b/src/3rdparty/webkit/WebCore/platform/ScrollView.h
@@ -89,7 +89,7 @@ public:
     void scrollbarModes(ScrollbarMode& horizontalMode, ScrollbarMode& verticalMode) const;
     ScrollbarMode horizontalScrollbarMode() const { ScrollbarMode horizontal, vertical; scrollbarModes(horizontal, vertical); return horizontal; }
     ScrollbarMode verticalScrollbarMode() const { ScrollbarMode horizontal, vertical; scrollbarModes(horizontal, vertical); return vertical; }
-    virtual void setCanHaveScrollbars(bool flag);
+    void setCanHaveScrollbars(bool flag);
     bool canHaveScrollbars() const { return horizontalScrollbarMode() != ScrollbarAlwaysOff || verticalScrollbarMode() != ScrollbarAlwaysOff; }
 
     // Overridden by FrameView to create custom CSS scrollbars if applicable.
@@ -239,6 +239,10 @@ protected:
     void setHasHorizontalScrollbar(bool);
     void setHasVerticalScrollbar(bool);
 
+    IntRect scrollCornerRect() const;
+    virtual void updateScrollCorner();
+    virtual void paintScrollCorner(GraphicsContext*, const IntRect& cornerRect);
+    
 private:
     RefPtr<Scrollbar> m_horizontalScrollbar;
     RefPtr<Scrollbar> m_verticalScrollbar;
diff --git a/src/3rdparty/webkit/WebCore/platform/Scrollbar.cpp b/src/3rdparty/webkit/WebCore/platform/Scrollbar.cpp
index 4574f63..4eb2c4a 100644
--- a/src/3rdparty/webkit/WebCore/platform/Scrollbar.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/Scrollbar.cpp
@@ -392,9 +392,9 @@ void Scrollbar::setFrameRect(const IntRect& rect)
     // Get our window resizer rect and see if we overlap.  Adjust to avoid the overlap
     // if necessary.
     IntRect adjustedRect(rect);
-    if (parent()) {
-        bool overlapsResizer = false;
-        ScrollView* view = parent();
+    bool overlapsResizer = false;
+    ScrollView* view = parent();
+    if (view && !rect.isEmpty() && !view->windowResizerRect().isEmpty()) {
         IntRect resizerRect = view->convertFromContainingWindow(view->windowResizerRect());
         if (rect.intersects(resizerRect)) {
             if (orientation() == HorizontalScrollbar) {
@@ -411,11 +411,11 @@ void Scrollbar::setFrameRect(const IntRect& rect)
                 }
             }
         }
-
-        if (overlapsResizer != m_overlapsResizer) {
-            m_overlapsResizer = overlapsResizer;
+    }
+    if (overlapsResizer != m_overlapsResizer) {
+        m_overlapsResizer = overlapsResizer;
+        if (view)
             view->adjustScrollbarsAvoidingResizerCount(m_overlapsResizer ? 1 : -1);
-        }
     }
 
     Widget::setFrameRect(adjustedRect);
diff --git a/src/3rdparty/webkit/WebCore/platform/StaticConstructors.h b/src/3rdparty/webkit/WebCore/platform/StaticConstructors.h
index 26b44de..5bc792c 100644
--- a/src/3rdparty/webkit/WebCore/platform/StaticConstructors.h
+++ b/src/3rdparty/webkit/WebCore/platform/StaticConstructors.h
@@ -56,6 +56,9 @@
 #if COMPILER(MSVC7)
 #define DEFINE_GLOBAL(type, name) \
     const type name;
+#elif COMPILER(WINSCW)
+#define DEFINE_GLOBAL(type, name, arg...) \
+    const type name;
 #else
 #define DEFINE_GLOBAL(type, name, ...) \
     const type name;
@@ -67,6 +70,9 @@
 #if COMPILER(MSVC7)
 #define DEFINE_GLOBAL(type, name) \
     void * name[(sizeof(type) + sizeof(void *) - 1) / sizeof(void *)];
+#elif COMPILER(WINSCW)
+#define DEFINE_GLOBAL(type, name, arg...) \
+    void * name[(sizeof(type) + sizeof(void *) - 1) / sizeof(void *)];
 #else
 #define DEFINE_GLOBAL(type, name, ...) \
     void * name[(sizeof(type) + sizeof(void *) - 1) / sizeof(void *)];
diff --git a/src/3rdparty/webkit/WebCore/platform/ThemeTypes.h b/src/3rdparty/webkit/WebCore/platform/ThemeTypes.h
index b763675..3ab41dd 100644
--- a/src/3rdparty/webkit/WebCore/platform/ThemeTypes.h
+++ b/src/3rdparty/webkit/WebCore/platform/ThemeTypes.h
@@ -49,9 +49,8 @@ enum ControlPart {
     ButtonBevelPart, DefaultButtonPart, ListboxPart, ListItemPart, 
     MediaFullscreenButtonPart, MediaMuteButtonPart, MediaPlayButtonPart, MediaSeekBackButtonPart, 
     MediaSeekForwardButtonPart, MediaRewindButtonPart, MediaReturnToRealtimeButtonPart,
-    MediaSliderPart,
-    MediaSliderThumbPart, MediaControlsBackgroundPart,
-    MediaCurrentTimePart, MediaTimeRemainingPart,
+    MediaSliderPart, MediaSliderThumbPart, MediaVolumeSliderContainerPart, MediaVolumeSliderPart, MediaVolumeSliderThumbPart,
+    MediaControlsBackgroundPart, MediaCurrentTimePart, MediaTimeRemainingPart,
     MenulistPart, MenulistButtonPart, MenulistTextPart, MenulistTextFieldPart,
     SliderHorizontalPart, SliderVerticalPart, SliderThumbHorizontalPart,
     SliderThumbVerticalPart, CaretPart, SearchFieldPart, SearchFieldDecorationPart,
diff --git a/src/3rdparty/webkit/WebCore/platform/ThreadTimers.cpp b/src/3rdparty/webkit/WebCore/platform/ThreadTimers.cpp
index 71a06b0..3ae8207 100644
--- a/src/3rdparty/webkit/WebCore/platform/ThreadTimers.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/ThreadTimers.cpp
@@ -34,6 +34,11 @@
 
 namespace WebCore {
 
+// Fire timers for this length of time, and then quit to let the run loop process user input events.
+// 100ms is about a perceptable delay in UI, so use a half of that as a threshold.
+// This is to prevent UI freeze when there are too many timers or machine performance is low.
+static const double maxDurationOfFiringTimers = 0.050;
+
 // Timers are created, started and fired on the same thread, and each thread has its own ThreadTimers
 // copy to keep the heap and a set of currently firing timers.
 
@@ -79,43 +84,6 @@ void ThreadTimers::updateSharedTimer()
         m_sharedTimer->setFireTime(m_timerHeap.first()->m_nextFireTime);
 }
 
-
-void ThreadTimers::collectFiringTimers(double fireTime, Vector<TimerBase*>& firingTimers)
-{
-    while (!m_timerHeap.isEmpty() && m_timerHeap.first()->m_nextFireTime <= fireTime) {
-        TimerBase* timer = m_timerHeap.first();
-        firingTimers.append(timer);
-        m_timersReadyToFire.add(timer);
-        timer->m_nextFireTime = 0;
-        timer->heapDeleteMin();
-    }
-}
-
-void ThreadTimers::fireTimers(double fireTime, const Vector<TimerBase*>& firingTimers)
-{
-    size_t size = firingTimers.size();
-    for (size_t i = 0; i != size; ++i) {
-        TimerBase* timer = firingTimers[i];
-
-        // If not in the set, this timer has been deleted or re-scheduled in another timer's fired function.
-        // So either we don't want to fire it at all or we will fire it next time the shared timer goes off.
-        // It might even have been deleted; that's OK because we won't do anything else with the pointer.
-        if (!m_timersReadyToFire.contains(timer))
-            continue;
-
-        // Setting the next fire time has a side effect of removing the timer from the firing timers set.
-        double interval = timer->repeatInterval();
-        timer->setNextFireTime(interval ? fireTime + interval : 0);
-
-        // Once the timer has been fired, it may be deleted, so do nothing else with it after this point.
-        timer->fired();
-
-        // Catch the case where the timer asked timers to fire in a nested event loop.
-        if (!m_firingTimers)
-            break;
-    }
-}
-
 void ThreadTimers::sharedTimerFired()
 {
     // Redirect to non-static method.
@@ -130,17 +98,24 @@ void ThreadTimers::sharedTimerFiredInternal()
     m_firingTimers = true;
 
     double fireTime = currentTime();
-    Vector<TimerBase*> firingTimers;
+    double timeToQuit = fireTime + maxDurationOfFiringTimers;
 
-    // m_timersReadyToFire will initially contain the same set as firingTimers, but
-    // as timers fire some mat become re-scheduled or deleted. They get removed from
-    // m_timersReadyToFire so we can avoid firing them.
-    ASSERT(m_timersReadyToFire.isEmpty());
+    while (!m_timerHeap.isEmpty() && m_timerHeap.first()->m_nextFireTime <= fireTime) {
+        TimerBase* timer = m_timerHeap.first();
+        timer->m_nextFireTime = 0;
+        timer->heapDeleteMin();
 
-    collectFiringTimers(fireTime, firingTimers);
-    fireTimers(fireTime, firingTimers);
+        double interval = timer->repeatInterval();
+        timer->setNextFireTime(interval ? fireTime + interval : 0);
+
+        // Once the timer has been fired, it may be deleted, so do nothing else with it after this point.
+        timer->fired();
+
+        // Catch the case where the timer asked timers to fire in a nested event loop, or we are over time limit.
+        if (!m_firingTimers || timeToQuit < currentTime())
+            break;
+    }
 
-    m_timersReadyToFire.clear();
     m_firingTimers = false;
 
     updateSharedTimer();
@@ -150,7 +125,6 @@ void ThreadTimers::fireTimersInNestedEventLoop()
 {
     // Reset the reentrancy guard so the timers can fire again.
     m_firingTimers = false;
-    m_timersReadyToFire.clear();
     updateSharedTimer();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/ThreadTimers.h b/src/3rdparty/webkit/WebCore/platform/ThreadTimers.h
index ea0a366..01b4c71 100644
--- a/src/3rdparty/webkit/WebCore/platform/ThreadTimers.h
+++ b/src/3rdparty/webkit/WebCore/platform/ThreadTimers.h
@@ -45,7 +45,6 @@ namespace WebCore {
         void setSharedTimer(SharedTimer*);
 
         Vector<TimerBase*>& timerHeap() { return m_timerHeap; }
-        HashSet<const TimerBase*>& timersReadyToFire() { return m_timersReadyToFire; }
 
         void updateSharedTimer();
         void fireTimersInNestedEventLoop();
@@ -53,13 +52,10 @@ namespace WebCore {
     private:
         static void sharedTimerFired();
 
-        void fireTimers(double fireTime, const Vector<TimerBase*>&);
-        void collectFiringTimers(double fireTime, Vector<TimerBase*>&);
         void sharedTimerFiredInternal();
         void fireTimersInNestedEventLoopInternal();
 
         Vector<TimerBase*> m_timerHeap;
-        HashSet<const TimerBase*> m_timersReadyToFire; // Temporarily holds a pointer to a stack object. No ownership.
         SharedTimer* m_sharedTimer; // External object, can be a run loop on a worker thread. Normally set/reset by worker thread.
         bool m_firingTimers; // Reentrancy guard.
     };
diff --git a/src/3rdparty/webkit/WebCore/platform/Timer.cpp b/src/3rdparty/webkit/WebCore/platform/Timer.cpp
index bd29fd8..539846c 100644
--- a/src/3rdparty/webkit/WebCore/platform/Timer.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/Timer.cpp
@@ -53,11 +53,6 @@ static Vector<TimerBase*>& timerHeap()
     return threadGlobalData().threadTimers().timerHeap();
 }
 
-static HashSet<const TimerBase*>& timersReadyToFire()
-{
-    return threadGlobalData().threadTimers().timersReadyToFire();
-}
-
 // Class to represent elements in the heap when calling the standard library heap algorithms.
 // Maintains the m_heapIndex value in the timers themselves, which allows us to do efficient
 // modification of the heap.
@@ -205,7 +200,7 @@ bool TimerBase::isActive() const
 {
     ASSERT(m_thread == currentThread());
 
-    return m_nextFireTime || timersReadyToFire().contains(this);
+    return m_nextFireTime;
 }
 
 double TimerBase::nextFireInterval() const
@@ -296,9 +291,6 @@ void TimerBase::setNextFireTime(double newTime)
     ASSERT(m_thread == currentThread());
 
     // Keep heap valid while changing the next-fire time.
-
-    timersReadyToFire().remove(this);
-
     double oldTime = m_nextFireTime;
     if (oldTime != newTime) {
         m_nextFireTime = newTime;
diff --git a/src/3rdparty/webkit/WebCore/platform/TreeShared.h b/src/3rdparty/webkit/WebCore/platform/TreeShared.h
index 1ac1b33..02728ff 100644
--- a/src/3rdparty/webkit/WebCore/platform/TreeShared.h
+++ b/src/3rdparty/webkit/WebCore/platform/TreeShared.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -28,17 +28,8 @@ namespace WebCore {
 
 template<class T> class TreeShared : public Noncopyable {
 public:
-    TreeShared()
-        : m_refCount(0)
-        , m_parent(0)
-    {
-#ifndef NDEBUG
-        m_deletionHasBegun = false;
-        m_inRemovedLastRefFunction = false;
-#endif
-    }
-    TreeShared(T* parent)
-        : m_refCount(0)
+    TreeShared(int initialRefCount = 1)
+        : m_refCount(initialRefCount)
         , m_parent(0)
     {
 #ifndef NDEBUG
diff --git a/src/3rdparty/webkit/WebCore/platform/Widget.h b/src/3rdparty/webkit/WebCore/platform/Widget.h
index 5fd18fa..a102b96 100644
--- a/src/3rdparty/webkit/WebCore/platform/Widget.h
+++ b/src/3rdparty/webkit/WebCore/platform/Widget.h
@@ -65,6 +65,11 @@ class wxWindow;
 typedef wxWindow* PlatformWidget;
 #endif
 
+#if PLATFORM(HAIKU)
+class BView;
+typedef BView* PlatformWidget;
+#endif
+
 #if PLATFORM(CHROMIUM)
 #include "PlatformWidget.h"
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/animation/Animation.h b/src/3rdparty/webkit/WebCore/platform/animation/Animation.h
index 9e1e8e1..306a1b9 100644
--- a/src/3rdparty/webkit/WebCore/platform/animation/Animation.h
+++ b/src/3rdparty/webkit/WebCore/platform/animation/Animation.h
@@ -35,12 +35,6 @@ namespace WebCore {
 const int cAnimateNone = 0;
 const int cAnimateAll = -2;
 
-// These were in RenderStyle, but have been moved here as
-// animation-play-state is in the process of being removed.
-
-const unsigned AnimPlayStatePlaying = 0;
-const unsigned AnimPlayStatePaused = 1;
-
 class Animation : public RefCounted<Animation> {
 public:
     ~Animation();
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.h b/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.h
index a3a0493..cc3d775 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2008-2009 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -44,6 +45,10 @@ class NSImage;
 typedef struct HBITMAP__ *HBITMAP;
 #endif
 
+#if PLATFORM(HAIKU)
+class BBitmap;
+#endif
+
 namespace WebCore {
     struct FrameData;
 }
@@ -150,7 +155,7 @@ protected:
     enum RepetitionCountStatus {
       Unknown,    // We haven't checked the source's repetition count.
       Uncertain,  // We have a repetition count, but it might be wrong (some GIFs have a count after the image data, and will report "loop once" until all data has been decoded).
-      Certain     // The repetition count is known to be correct.
+      Certain,    // The repetition count is known to be correct.
     };
 
     BitmapImage(NativeImagePtr, ImageObserver* = 0);
@@ -160,10 +165,16 @@ protected:
     virtual void drawFrameMatchingSourceSize(GraphicsContext*, const FloatRect& dstRect, const IntSize& srcSize, CompositeOperator);
 #endif
     virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator);
-#if PLATFORM(WX)
+
+#if PLATFORM(WX) || PLATFORM(WINCE)
     virtual void drawPattern(GraphicsContext*, const FloatRect& srcRect, const TransformationMatrix& patternTransform,
                              const FloatPoint& phase, CompositeOperator, const FloatRect& destRect);
-#endif    
+#endif
+
+#if PLATFORM(HAIKU)
+    virtual BBitmap* getBBitmap() const;
+#endif
+
     size_t currentFrame() const { return m_currentFrame; }
     size_t frameCount();
     NativeImagePtr frameAtIndex(size_t);
@@ -220,7 +231,11 @@ protected:
     {
         if (!m_checkedForSolidColor && frameCount() > 0) {
             checkForSolidColor();
+            // WINCE PORT: checkForSolidColor() doesn't set m_checkedForSolidColor until
+            // it gets enough information to make final decision.
+#if !PLATFORM(WINCE)
             ASSERT(m_checkedForSolidColor);
+#endif
         }
         return m_isSolidColor && m_currentFrame == 0;
     }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/Color.h b/src/3rdparty/webkit/WebCore/platform/graphics/Color.h
index 7ac432f..4fa1513 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/Color.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/Color.h
@@ -47,6 +47,10 @@ typedef struct _GdkColor GdkColor;
 class wxColour;
 #endif
 
+#if PLATFORM(HAIKU)
+struct rgb_color;
+#endif
+
 namespace WebCore {
 
 class String;
@@ -121,6 +125,11 @@ public:
     Color(CGColorRef);
 #endif
 
+#if PLATFORM(HAIKU)
+    Color(const rgb_color&);
+    operator rgb_color() const;
+#endif
+
     static bool parseHexColor(const String& name, RGBA32& rgb);
 
     static const RGBA32 black = 0xFF000000;
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FloatPoint.h b/src/3rdparty/webkit/WebCore/platform/graphics/FloatPoint.h
index 157c1e7..d953b3b 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FloatPoint.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FloatPoint.h
@@ -51,6 +51,10 @@ class QPointF;
 QT_END_NAMESPACE
 #endif
 
+#if PLATFORM(HAIKU)
+class BPoint;
+#endif
+
 #if PLATFORM(SKIA)
 struct SkPoint;
 #endif
@@ -90,6 +94,11 @@ public:
     operator QPointF() const;
 #endif
 
+#if PLATFORM(HAIKU)
+    FloatPoint(const BPoint&);
+    operator BPoint() const;
+#endif
+
 #if PLATFORM(SKIA)
     operator SkPoint() const;
     FloatPoint(const SkPoint&);
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FloatPoint3D.h b/src/3rdparty/webkit/WebCore/platform/graphics/FloatPoint3D.h
index 2e71ddd..73c3a37 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FloatPoint3D.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FloatPoint3D.h
@@ -49,6 +49,16 @@ private:
     float m_z;
 };
 
+inline bool operator==(const FloatPoint3D& a, const FloatPoint3D& b)
+{
+    return a.x() == b.x() && a.y() == b.y() && a.z() == b.z();
+}
+
+inline bool operator!=(const FloatPoint3D& a, const FloatPoint3D& b)
+{
+    return a.x() != b.x() || a.y() != b.y() || a.z() != b.z();
+}
+
 } // namespace WebCore
 
 #endif // FloatPoint3D_h
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FloatRect.h b/src/3rdparty/webkit/WebCore/platform/graphics/FloatRect.h
index 0723eb7..c6a86bc 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FloatRect.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FloatRect.h
@@ -51,6 +51,10 @@ QT_END_NAMESPACE
 class wxRect2DDouble;
 #endif
 
+#if PLATFORM(HAIKU)
+class BRect;
+#endif
+
 #if PLATFORM(SKIA)
 struct SkRect;
 #endif
@@ -138,6 +142,11 @@ public:
     operator wxRect2DDouble() const;
 #endif
 
+#if PLATFORM(HAIKU)
+    FloatRect(const BRect&);
+    operator BRect() const;
+#endif
+
 #if PLATFORM(SKIA)
     FloatRect(const SkRect&);
     operator SkRect() const;
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FontCache.h b/src/3rdparty/webkit/WebCore/platform/graphics/FontCache.h
index 3c0f2d9..a591474 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FontCache.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FontCache.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2008 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2007-2008 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -63,7 +64,15 @@ public:
     // Also implemented by the platform.
     void platformInit();
 
-#if PLATFORM(WIN)
+#if PLATFORM(WINCE)
+#if defined(IMLANG_FONT_LINK) && (IMLANG_FONT_LINK == 2)
+    IMLangFontLink2* getFontLinkInterface();
+#else
+    IMLangFontLink* getFontLinkInterface();
+#endif
+    static void comInitialize();
+    static void comUninitialize();
+#elif PLATFORM(WIN)
     IMLangFontLink2* getFontLinkInterface();
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FontDescription.h b/src/3rdparty/webkit/WebCore/platform/graphics/FontDescription.h
index c893b8a..27b3a05 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FontDescription.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FontDescription.h
@@ -28,6 +28,7 @@
 #include "FontFamily.h"
 #include "FontRenderingMode.h"
 #include "FontTraitsMask.h"
+#include "RenderStyleConstants.h"
 
 namespace WebCore {
 
@@ -61,6 +62,7 @@ public:
         , m_usePrinterFont(false)
         , m_renderingMode(NormalRenderingMode)
         , m_keywordSize(0)
+        , m_fontSmoothing(AutoSmoothing)
     {
     }
 
@@ -80,8 +82,11 @@ public:
     FontWeight bolderWeight() const;
     GenericFamilyType genericFamily() const { return static_cast<GenericFamilyType>(m_genericFamily); }
     bool usePrinterFont() const { return m_usePrinterFont; }
+    // only use fixed default size when there is only one font family, and that family is "monospace"
+    bool useFixedDefaultSize() const { return genericFamily() == MonospaceFamily && !family().next() && family().family() == "-webkit-monospace"; }
     FontRenderingMode renderingMode() const { return static_cast<FontRenderingMode>(m_renderingMode); }
     unsigned keywordSize() const { return m_keywordSize; }
+    FontSmoothing fontSmoothing() const { return static_cast<FontSmoothing>(m_fontSmoothing); }
 
     FontTraitsMask traitsMask() const;
 
@@ -96,6 +101,7 @@ public:
     void setUsePrinterFont(bool p) { m_usePrinterFont = p; }
     void setRenderingMode(FontRenderingMode mode) { m_renderingMode = mode; }
     void setKeywordSize(unsigned s) { m_keywordSize = s; }
+    void setFontSmoothing(FontSmoothing smoothing) { m_fontSmoothing = smoothing; }
 
 private:
     FontFamily m_familyList; // The list of font families to be used.
@@ -117,6 +123,8 @@ private:
     unsigned m_keywordSize : 4; // We cache whether or not a font is currently represented by a CSS keyword (e.g., medium).  If so,
                            // then we can accurately translate across different generic families to adjust for different preference settings
                            // (e.g., 13px monospace vs. 16px everything else).  Sizes are 1-8 (like the HTML size values for <font>).
+
+    unsigned m_fontSmoothing : 2; // FontSmoothing
 };
 
 inline bool FontDescription::operator==(const FontDescription& other) const
@@ -131,7 +139,8 @@ inline bool FontDescription::operator==(const FontDescription& other) const
         && m_genericFamily == other.m_genericFamily
         && m_usePrinterFont == other.m_usePrinterFont
         && m_renderingMode == other.m_renderingMode
-        && m_keywordSize == other.m_keywordSize;
+        && m_keywordSize == other.m_keywordSize
+        && m_fontSmoothing == other.m_fontSmoothing;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/FontFastPath.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/FontFastPath.cpp
index 74b7ec1..b0e39db 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/FontFastPath.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/FontFastPath.cpp
@@ -1,6 +1,7 @@
 /**
  * Copyright (C) 2003, 2006 Apple Computer, Inc.
  * Copyright (C) 2008 Holger Hans Peter Freyther
+ * Copyright (C) 2009 Torch Mobile, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -155,16 +156,33 @@ GlyphData Font::glyphDataForCharacter(UChar32 c, bool mirror, bool forceSmallCap
         GlyphPage* fallbackPage = GlyphPageTreeNode::getRootChild(characterFontData, pageNumber)->page();
         GlyphData data = fallbackPage && fallbackPage->fontDataForCharacter(c) ? fallbackPage->glyphDataForCharacter(c) : characterFontData->missingGlyphData();
         // Cache it so we don't have to do system fallback again next time.
-        if (!useSmallCapsFont)
+        if (!useSmallCapsFont) {
+#if PLATFORM(WINCE)
+            // missingGlyphData returns a null character, which is not suitable for GDI to display.
+            // Also, sometimes we cannot map a font for the character on WINCE, but GDI can still
+            // display the character, probably because the font package is not installed correctly.
+            // So we just always set the glyph to be same as the character, and let GDI solve it.
+            page->setGlyphDataForCharacter(c, c, characterFontData);
+            return page->glyphDataForCharacter(c);
+#else
             page->setGlyphDataForCharacter(c, data.glyph, data.fontData);
+#endif
+        }
         return data;
     }
 
     // Even system fallback can fail; use the missing glyph in that case.
     // FIXME: It would be nicer to use the missing glyph from the last resort font instead.
     GlyphData data = primaryFont()->missingGlyphData();
-    if (!useSmallCapsFont)
+    if (!useSmallCapsFont) {
+#if PLATFORM(WINCE)
+        // See comment about WINCE GDI handling near setGlyphDataForCharacter above.
+        page->setGlyphDataForCharacter(c, c, data.fontData);
+        return page->glyphDataForCharacter(c);
+#else
         page->setGlyphDataForCharacter(c, data.glyph, data.fontData);
+#endif
+    }
     return data;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GeneratedImage.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/GeneratedImage.cpp
index c40a40a..bac9da0 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GeneratedImage.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GeneratedImage.cpp
@@ -51,7 +51,7 @@ void GeneratedImage::drawPattern(GraphicsContext* context, const FloatRect& srcR
                                  const FloatPoint& phase, CompositeOperator compositeOp, const FloatRect& destRect)
 {
     // Create a BitmapImage and call drawPattern on it.
-    OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(m_size, false);
+    OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(m_size);
     ASSERT(imageBuffer.get());
     
     // Fill with the gradient.
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GlyphBuffer.h b/src/3rdparty/webkit/WebCore/platform/graphics/GlyphBuffer.h
index dcda419..04491a7 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GlyphBuffer.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GlyphBuffer.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2007-2008 Torch Mobile Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -49,6 +50,8 @@ class SimpleFontData;
 #if PLATFORM(CAIRO)
 // FIXME: Why does Cairo use such a huge struct instead of just an offset into an array?
 typedef cairo_glyph_t GlyphBufferGlyph;
+#elif PLATFORM(WINCE)
+typedef wchar_t GlyphBufferGlyph;
 #else
 typedef Glyph GlyphBufferGlyph;
 #endif
@@ -57,6 +60,10 @@ typedef Glyph GlyphBufferGlyph;
 // can be passed directly to CGContextShowGlyphsWithAdvances in FontMac.mm
 #if PLATFORM(CG)
 typedef CGSize GlyphBufferAdvance;
+#elif PLATFORM(WINCE)
+// There is no cross-platform code that uses the height of GlyphBufferAdvance,
+// so we can save memory space on embedded devices by storing only the width
+typedef float GlyphBufferAdvance;
 #else
 typedef FloatSize GlyphBufferAdvance;
 #endif
@@ -117,6 +124,8 @@ public:
     {
 #if PLATFORM(CG)
         return m_advances[index].width;
+#elif PLATFORM(WINCE)
+        return m_advances[index];
 #else
         return m_advances[index].width();
 #endif
@@ -147,6 +156,8 @@ public:
 #if PLATFORM(CG)
         CGSize advance = { width, 0 };
         m_advances.append(advance);
+#elif PLATFORM(WINCE)
+        m_advances.append(width);
 #else
         m_advances.append(FloatSize(width, 0));
 #endif
@@ -161,6 +172,7 @@ public:
 #endif
     }
     
+#if !PLATFORM(WINCE)
     void add(Glyph glyph, const SimpleFontData* font, GlyphBufferAdvance advance)
     {
         m_fontData.append(font);
@@ -174,6 +186,7 @@ public:
 
         m_advances.append(advance);
     }
+#endif
     
 private:
     Vector<const SimpleFontData*, 2048> m_fontData;
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GlyphPageTreeNode.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/GlyphPageTreeNode.cpp
index 6419e0c..9f53f0b 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GlyphPageTreeNode.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GlyphPageTreeNode.cpp
@@ -202,8 +202,10 @@ void GlyphPageTreeNode::initializePage(const FontData* fontData, unsigned pageNu
                 GlyphPage* pageToFill = m_page.get();
                 for (unsigned i = 0; i < numRanges; i++) {
                     const FontDataRange& range = segmentedFontData->rangeAt(i);
-                    int from = max(0, range.from() - static_cast<int>(start));
-                    int to = 1 + min(range.to() - static_cast<int>(start), static_cast<int>(GlyphPage::size) - 1);
+                    // all this casting is to ensure all the parameters to min and max have the same type,
+                    // to avoid ambiguous template parameter errors on Windows
+                    int from = max(0, static_cast<int>(range.from()) - static_cast<int>(start));
+                    int to = 1 + min(static_cast<int>(range.to()) - static_cast<int>(start), static_cast<int>(GlyphPage::size) - 1);
                     if (from < static_cast<int>(GlyphPage::size) && to > 0) {
                         if (haveGlyphs && !scratchPage) {
                             scratchPage = GlyphPage::create(this);
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/Gradient.h b/src/3rdparty/webkit/WebCore/platform/graphics/Gradient.h
index a74b1ef..0e39e73 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/Gradient.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/Gradient.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alp Toker <alp@atoker.com>
+ * Copyright (C) 2008 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -73,8 +74,17 @@ namespace WebCore {
 
         void getColor(float value, float* r, float* g, float* b, float* a) const;
 
+#if PLATFORM(WINCE) && !PLATFORM(QT)
+        const FloatPoint& p0() const { return m_p0; }
+        const FloatPoint& p1() const { return m_p1; }
+        float r0() const { return m_r0; }
+        float r1() const { return m_r1; }
+        bool isRadial() const { return m_radial; }
+        struct ColorStop;
+        const Vector<ColorStop>& getStops() const;
+#else
         PlatformGradient platformGradient();
-
+#endif
         struct ColorStop {
             float stop;
             float red;
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.cpp
index 3e36f73..ccdce08 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.cpp
@@ -27,9 +27,9 @@
 #include "GraphicsContext.h"
 
 #include "BidiResolver.h"
+#include "Font.h"
 #include "Generator.h"
 #include "GraphicsContextPrivate.h"
-#include "Font.h"
 
 using namespace std;
 
@@ -89,7 +89,7 @@ void GraphicsContext::save()
         return;
 
     m_common->stack.append(m_common->state);
-    
+
     savePlatformState();
 }
 
@@ -104,7 +104,7 @@ void GraphicsContext::restore()
     }
     m_common->state = m_common->stack.last();
     m_common->stack.removeLast();
-    
+
     restorePlatformState();
 }
 
@@ -305,7 +305,7 @@ bool GraphicsContext::paintingDisabled() const
 }
 
 void GraphicsContext::drawImage(Image* image, const IntPoint& p, CompositeOperator op)
-{        
+{
     drawImage(image, p, IntRect(0, 0, -1, -1), op);
 }
 
@@ -324,13 +324,15 @@ void GraphicsContext::drawImage(Image* image, const IntRect& dest, const IntRect
     drawImage(image, FloatRect(dest), srcRect, op, useLowQualityScale);
 }
 
+#if !PLATFORM(WINCE) || PLATFORM(QT)
 void GraphicsContext::drawText(const Font& font, const TextRun& run, const IntPoint& point, int from, int to)
 {
     if (paintingDisabled())
         return;
-    
+
     font.drawText(this, run, point, from, to);
 }
+#endif
 
 void GraphicsContext::drawBidiText(const Font& font, const TextRun& run, const FloatPoint& point)
 {
@@ -381,7 +383,7 @@ void GraphicsContext::initFocusRing(int width, int offset)
     if (paintingDisabled())
         return;
     clearFocusRing();
-    
+
     m_common->m_focusRingWidth = width;
     m_common->m_focusRingOffset = offset;
 }
@@ -394,12 +396,12 @@ void GraphicsContext::clearFocusRing()
 IntRect GraphicsContext::focusRingBoundingRect()
 {
     IntRect result = IntRect(0, 0, 0, 0);
-    
+
     const Vector<IntRect>& rects = focusRingRects();
     unsigned rectCount = rects.size();
     for (unsigned i = 0; i < rectCount; i++)
         result.unite(rects[i]);
-        
+
     return result;
 }
 
@@ -434,7 +436,7 @@ void GraphicsContext::drawImage(Image* image, const FloatRect& dest, const Float
     float tsh = src.height();
     float tw = dest.width();
     float th = dest.height();
-        
+
     if (tsw == -1)
         tsw = image->width();
     if (tsh == -1)
@@ -538,10 +540,39 @@ void GraphicsContext::setPlatformTextDrawingMode(int mode)
 }
 #endif
 
-#if !PLATFORM(QT) && !PLATFORM(CAIRO) && !PLATFORM(SKIA)
+#if !PLATFORM(QT) && !PLATFORM(CAIRO) && !PLATFORM(SKIA) && !PLATFORM(HAIKU)
 void GraphicsContext::setPlatformStrokeStyle(const StrokeStyle&)
 {
 }
 #endif
 
+void GraphicsContext::adjustLineToPixelBoundaries(FloatPoint& p1, FloatPoint& p2, float strokeWidth, const StrokeStyle& penStyle)
+{
+    // For odd widths, we add in 0.5 to the appropriate x/y so that the float arithmetic
+    // works out.  For example, with a border width of 3, WebKit will pass us (y1+y2)/2, e.g.,
+    // (50+53)/2 = 103/2 = 51 when we want 51.5.  It is always true that an even width gave
+    // us a perfect position, but an odd width gave us a position that is off by exactly 0.5.
+    if (penStyle == DottedStroke || penStyle == DashedStroke) {
+        if (p1.x() == p2.x()) {
+            p1.setY(p1.y() + strokeWidth);
+            p2.setY(p2.y() - strokeWidth);
+        } else {
+            p1.setX(p1.x() + strokeWidth);
+            p2.setX(p2.x() - strokeWidth);
+        }
+    }
+
+    if (static_cast<int>(strokeWidth) % 2) { //odd
+        if (p1.x() == p2.x()) {
+            // We're a vertical line.  Adjust our x.
+            p1.setX(p1.x() + 0.5f);
+            p2.setX(p2.x() + 0.5f);
+        } else {
+            // We're a horizontal line. Adjust our y.
+            p1.setY(p1.y() + 0.5f);
+            p2.setY(p2.y() + 0.5f);
+        }
+    }
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.h b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.h
index 0237abf..e0d9294 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2003, 2006, 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2008-2009 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -48,8 +49,8 @@ typedef QPainter PlatformGraphicsContext;
 class wxGCDC;
 class wxWindowDC;
 
-// wxGraphicsContext allows us to support Path, etc. 
-// but on some platforms, e.g. Linux, it requires fairly 
+// wxGraphicsContext allows us to support Path, etc.
+// but on some platforms, e.g. Linux, it requires fairly
 // new software.
 #if USE(WXGC)
 // On OS X, wxGCDC is just a typedef for wxDC, so use wxDC explicitly to make
@@ -65,6 +66,12 @@ class wxWindowDC;
 #endif
 #elif PLATFORM(SKIA)
 typedef class PlatformContextSkia PlatformGraphicsContext;
+#elif PLATFORM(HAIKU)
+class BView;
+typedef BView PlatformGraphicsContext;
+struct pattern;
+#elif PLATFORM(WINCE)
+typedef struct HDC__ PlatformGraphicsContext;
 #else
 typedef void PlatformGraphicsContext;
 #endif
@@ -88,6 +95,12 @@ typedef unsigned char UInt8;
 
 namespace WebCore {
 
+#if PLATFORM(WINCE) && !PLATFORM(QT)
+    class SharedBitmap;
+    class SimpleFontData;
+    class GlyphBuffer;
+#endif
+
     const int cMisspellingLineThickness = 3;
     const int cMisspellingLinePatternWidth = 4;
     const int cMisspellingLinePatternGapWidth = 1;
@@ -109,7 +122,7 @@ namespace WebCore {
     const int cTextFill = 1;
     const int cTextStroke = 2;
     const int cTextClip = 4;
-    
+
     enum StrokeStyle {
         NoStroke,
         SolidStroke,
@@ -117,12 +130,12 @@ namespace WebCore {
         DashedStroke
     };
 
-// FIXME: This is a place-holder until we decide to add
-// real color space support to WebCore.  At that time, ColorSpace will be a
-// class and instances will be held  off of Colors.   There will be
-// special singleton Gradient and Pattern color spaces to mark when
-// a fill or stroke is using a gradient or pattern instead of a solid color.
-// https://bugs.webkit.org/show_bug.cgi?id=20558
+    // FIXME: This is a place-holder until we decide to add
+    // real color space support to WebCore.  At that time, ColorSpace will be a
+    // class and instances will be held  off of Colors.   There will be
+    // special singleton Gradient and Pattern color spaces to mark when
+    // a fill or stroke is using a gradient or pattern instead of a solid color.
+    // https://bugs.webkit.org/show_bug.cgi?id=20558
     enum ColorSpace {
         SolidColorSpace,
         PatternColorSpace,
@@ -141,9 +154,11 @@ namespace WebCore {
     public:
         GraphicsContext(PlatformGraphicsContext*);
         ~GraphicsContext();
-       
+
+#if !PLATFORM(WINCE) || PLATFORM(QT)
         PlatformGraphicsContext* platformContext() const;
-        
+#endif
+
         float strokeThickness() const;
         void setStrokeThickness(float);
         StrokeStyle strokeStyle() const;
@@ -219,7 +234,7 @@ namespace WebCore {
                        CompositeOperator = CompositeSourceOver, bool useLowQualityScale = false);
         void drawTiledImage(Image*, const IntRect& destRect, const IntPoint& srcPoint, const IntSize& tileSize,
                        CompositeOperator = CompositeSourceOver);
-        void drawTiledImage(Image*, const IntRect& destRect, const IntRect& srcRect, 
+        void drawTiledImage(Image*, const IntRect& destRect, const IntRect& srcRect,
                             Image::TileRule hRule = Image::StretchTile, Image::TileRule vRule = Image::StretchTile,
                             CompositeOperator = CompositeSourceOver);
 
@@ -243,13 +258,13 @@ namespace WebCore {
         void drawHighlightForText(const Font&, const TextRun&, const IntPoint&, int h, const Color& backgroundColor, int from = 0, int to = -1);
 
         FloatRect roundToDevicePixels(const FloatRect&);
-        
+
         void drawLineForText(const IntPoint&, int width, bool printing);
         void drawLineForMisspellingOrBadGrammar(const IntPoint&, int width, bool grammar);
-        
+
         bool paintingDisabled() const;
         void setPaintingDisabled(bool);
-        
+
         bool updatingControlTints() const;
         void setUpdatingControlTints(bool);
 
@@ -288,13 +303,29 @@ namespace WebCore {
         void rotate(float angleInRadians);
         void translate(float x, float y);
         IntPoint origin();
-        
+
         void setURLForRect(const KURL&, const IntRect&);
 
         void concatCTM(const TransformationMatrix&);
         TransformationMatrix getCTM() const;
 
-#if PLATFORM(WIN)
+#if PLATFORM(WINCE) && !PLATFORM(QT)
+        void setBitmap(PassRefPtr<SharedBitmap>);
+        const TransformationMatrix& affineTransform() const;
+        TransformationMatrix& affineTransform();
+        void resetAffineTransform();
+        void fillRect(const FloatRect&, const Gradient*);
+        void drawText(const SimpleFontData* fontData, const GlyphBuffer& glyphBuffer, int from, int numGlyphs, const FloatPoint& point);
+        void drawFrameControl(const IntRect& rect, unsigned type, unsigned state);
+        void drawFocusRect(const IntRect& rect);
+        void paintTextField(const IntRect& rect, unsigned state);
+        void drawBitmap(SharedBitmap*, const IntRect& dstRect, const IntRect& srcRect, CompositeOperator compositeOp);
+        void drawBitmapPattern(SharedBitmap*, const FloatRect& tileRectIn, const TransformationMatrix& patternTransform, const FloatPoint& phase, CompositeOperator op, const FloatRect& destRect, const IntSize& origSourceSize);
+        void drawIcon(HICON icon, const IntRect& dstRect, UINT flags);
+        HDC getWindowsContext(const IntRect&, bool supportAlphaBlend = false, bool mayCreateBitmap = true); // The passed in rect is used to create a bitmap for compositing inside transparency layers.
+        void releaseWindowsContext(HDC, const IntRect&, bool supportAlphaBlend = false, bool mayCreateBitmap = true);    // The passed in HDC should be the one handed back by getWindowsContext.
+        void drawRoundCorner(bool newClip, RECT clipRect, RECT rectWin, HDC dc, int width, int height);
+#elif PLATFORM(WIN)
         GraphicsContext(HDC, bool hasAlpha = false); // FIXME: To be removed.
         bool inTransparencyLayer() const;
         HDC getWindowsContext(const IntRect&, bool supportAlphaBlend = true, bool mayCreateBitmap = true); // The passed in rect is used to create a bitmap for compositing inside transparency layers.
@@ -354,6 +385,10 @@ namespace WebCore {
         GdkEventExpose* gdkExposeEvent() const;
 #endif
 
+#if PLATFORM(HAIKU)
+        pattern getHaikuStrokeStyle();
+#endif
+
     private:
         void savePlatformState();
         void restorePlatformState();
@@ -376,6 +411,8 @@ namespace WebCore {
         void setPlatformShadow(const IntSize&, int blur, const Color&);
         void clearPlatformShadow();
 
+        static void adjustLineToPixelBoundaries(FloatPoint& p1, FloatPoint& p2, float strokeWidth, const StrokeStyle&);
+
         int focusRingWidth() const;
         int focusRingOffset() const;
         const Vector<IntRect>& focusRingRects() const;
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext3D.h b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext3D.h
new file mode 100644
index 0000000..cbbf2b4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext3D.h
@@ -0,0 +1,328 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef GraphicsContext3D_h
+#define GraphicsContext3D_h
+
+#include "PlatformString.h"
+
+#include <wtf/Noncopyable.h>
+
+#if PLATFORM(MAC)
+#include <OpenGL/OpenGL.h>
+
+typedef void* PlatformGraphicsContext3D;
+const  PlatformGraphicsContext3D NullPlatformGraphicsContext3D = 0;
+typedef GLuint Platform3DObject;
+const Platform3DObject NullPlatform3DObject = 0;
+#else
+typedef void* PlatformGraphicsContext3D;
+const  PlatformGraphicsContext3D NullPlatformGraphicsContext3D = 0;
+typedef int Platform3DObject;
+const Platform3DObject NullPlatform3DObject = 0;
+#endif
+
+namespace WebCore {
+    class CanvasArray;
+    class CanvasBuffer;
+    class CanvasUnsignedByteArray;
+    class CanvasFloatArray;
+    class CanvasFramebuffer;
+    class CanvasIntArray;
+    class CanvasProgram;
+    class CanvasRenderbuffer;
+    class CanvasRenderingContext3D;
+    class CanvasShader;
+    class CanvasTexture;
+    class HTMLCanvasElement;
+    class HTMLImageElement;
+    class HTMLVideoElement;
+    class ImageData;
+    class WebKitCSSMatrix;
+    
+    class GraphicsContext3D : Noncopyable {
+    public:
+        enum ShaderType { FRAGMENT_SHADER, VERTEX_SHADER };
+    
+        GraphicsContext3D();
+        virtual ~GraphicsContext3D();
+
+#if PLATFORM(MAC)
+        PlatformGraphicsContext3D platformGraphicsContext3D() const { return m_contextObj; }
+        Platform3DObject platformTexture() const { return m_texture; }
+#elif PLATFORM(SKIA)
+        PlatformGraphicsContext3D platformGraphicsContext3D() const;
+        Platform3DObject platformTexture() const;
+#else
+        PlatformGraphicsContext3D platformGraphicsContext3D() const { return NullPlatformGraphicsContext3D; }
+        Platform3DObject platformTexture() const { return NullPlatform3DObject; }
+#endif
+        void checkError() const;
+        
+        void makeContextCurrent();
+        
+        // Helper to return the size in bytes of OpenGL data types
+        // like GL_FLOAT, GL_INT, etc.
+        int sizeInBytes(int type);
+
+        void activeTexture(unsigned long texture);
+        void attachShader(CanvasProgram* program, CanvasShader* shader);
+        void bindAttribLocation(CanvasProgram*, unsigned long index, const String& name);
+        void bindBuffer(unsigned long target, CanvasBuffer*);
+        void bindFramebuffer(unsigned long target, CanvasFramebuffer*);
+        void bindRenderbuffer(unsigned long target, CanvasRenderbuffer*);
+        void bindTexture(unsigned long target, CanvasTexture* texture);
+        void blendColor(double red, double green, double blue, double alpha);
+        void blendEquation(unsigned long mode);
+        void blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha);
+        void blendFunc(unsigned long sfactor, unsigned long dfactor);
+        void blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha);
+
+        void bufferData(unsigned long target, int size, unsigned long usage);
+        void bufferData(unsigned long target, CanvasArray* data, unsigned long usage);
+        void bufferSubData(unsigned long target, long offset, CanvasArray* data);
+
+        unsigned long checkFramebufferStatus(unsigned long target);
+        void clear(unsigned long mask);
+        void clearColor(double red, double green, double blue, double alpha);
+        void clearDepth(double depth);
+        void clearStencil(long s);
+        void colorMask(bool red, bool green, bool blue, bool alpha);
+        void compileShader(CanvasShader*);
+        
+        //void compressedTexImage2D(unsigned long target, long level, unsigned long internalformat, unsigned long width, unsigned long height, long border, unsigned long imageSize, const void* data);
+        //void compressedTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, unsigned long width, unsigned long height, unsigned long format, unsigned long imageSize, const void* data);
+        
+        void copyTexImage2D(unsigned long target, long level, unsigned long internalformat, long x, long y, unsigned long width, unsigned long height, long border);
+        void copyTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, long x, long y, unsigned long width, unsigned long height);
+        void cullFace(unsigned long mode);
+        void depthFunc(unsigned long func);
+        void depthMask(bool flag);
+        void depthRange(double zNear, double zFar);
+        void detachShader(CanvasProgram*, CanvasShader*);
+        void disable(unsigned long cap);
+        void disableVertexAttribArray(unsigned long index);
+        void drawArrays(unsigned long mode, long first, long count);
+        void drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset);
+
+        void enable(unsigned long cap);
+        void enableVertexAttribArray(unsigned long index);
+        void finish();
+        void flush();
+        void framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, CanvasRenderbuffer*);
+        void framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, CanvasTexture*, long level);
+        void frontFace(unsigned long mode);
+        void generateMipmap(unsigned long target);
+
+        int  getAttribLocation(CanvasProgram*, const String& name);
+
+        bool getBoolean(unsigned long pname);
+        PassRefPtr<CanvasUnsignedByteArray> getBooleanv(unsigned long pname);
+        int getBufferParameteri(unsigned long target, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getBufferParameteriv(unsigned long target, unsigned long pname);
+
+        unsigned long getError();
+
+        float getFloat(unsigned long pname);
+        PassRefPtr<CanvasFloatArray> getFloatv(unsigned long pname);
+        int getFramebufferAttachmentParameteri(unsigned long target, unsigned long attachment, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long pname);
+        int getInteger(unsigned long pname);
+        PassRefPtr<CanvasIntArray> getIntegerv(unsigned long pname);
+        int getProgrami(CanvasProgram*, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getProgramiv(CanvasProgram*, unsigned long pname);
+        String getProgramInfoLog(CanvasProgram*);
+        int getRenderbufferParameteri(unsigned long target, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getRenderbufferParameteriv(unsigned long target, unsigned long pname);
+        int getShaderi(CanvasShader*, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getShaderiv(CanvasShader*, unsigned long pname);
+
+        String getShaderInfoLog(CanvasShader*);
+
+        // TBD
+        // void glGetShaderPrecisionFormat (GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision);
+
+        String getShaderSource(CanvasShader*);
+        String getString(unsigned long name);
+        
+        float getTexParameterf(unsigned long target, unsigned long pname);
+        PassRefPtr<CanvasFloatArray> getTexParameterfv(unsigned long target, unsigned long pname);
+        int getTexParameteri(unsigned long target, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getTexParameteriv(unsigned long target, unsigned long pname);
+
+        float getUniformf(CanvasProgram* program, long location);
+        PassRefPtr<CanvasFloatArray> getUniformfv(CanvasProgram* program, long location);
+        int getUniformi(CanvasProgram* program, long location);
+        PassRefPtr<CanvasIntArray> getUniformiv(CanvasProgram* program, long location);
+
+        long getUniformLocation(CanvasProgram*, const String& name);
+
+        float getVertexAttribf(unsigned long index, unsigned long pname);
+        PassRefPtr<CanvasFloatArray> getVertexAttribfv(unsigned long index, unsigned long pname);
+        int getVertexAttribi(unsigned long index, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getVertexAttribiv(unsigned long index, unsigned long pname);
+        
+        long getVertexAttribOffset(unsigned long index, unsigned long pname);
+
+        void hint(unsigned long target, unsigned long mode);
+        bool isBuffer(CanvasBuffer*);
+        bool isEnabled(unsigned long cap);
+        bool isFramebuffer(CanvasFramebuffer*);
+        bool isProgram(CanvasProgram*);
+        bool isRenderbuffer(CanvasRenderbuffer*);
+        bool isShader(CanvasShader*);
+        bool isTexture(CanvasTexture*);
+        void lineWidth(double);
+        void linkProgram(CanvasProgram*);
+        void pixelStorei(unsigned long pname, long param);
+        void polygonOffset(double factor, double units);
+        
+        // TBD
+        //void readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type, void* pixels);
+        
+        void releaseShaderCompiler();
+        void renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height);
+        void sampleCoverage(double value, bool invert);
+        void scissor(long x, long y, unsigned long width, unsigned long height);
+        void shaderSource(CanvasShader*, const String& string);
+        void stencilFunc(unsigned long func, long ref, unsigned long mask);
+        void stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask);
+        void stencilMask(unsigned long mask);
+        void stencilMaskSeparate(unsigned long face, unsigned long mask);
+        void stencilOp(unsigned long fail, unsigned long zfail, unsigned long zpass);
+        void stencilOpSeparate(unsigned long face, unsigned long fail, unsigned long zfail, unsigned long zpass);
+
+        // These next several functions return an error code (0 if no errors) rather than using an ExceptionCode.
+        // Currently they return -1 on any error.
+        int texImage2D(unsigned target, unsigned level, unsigned internalformat,
+                       unsigned width, unsigned height, unsigned border,
+                       unsigned format, unsigned type, CanvasArray* pixels);
+        int texImage2D(unsigned target, unsigned level, unsigned internalformat,
+                       unsigned width, unsigned height, unsigned border,
+                       unsigned format, unsigned type, ImageData* pixels);
+        int texImage2D(unsigned target, unsigned level, HTMLImageElement* image,
+                       bool flipY, bool premultiplyAlpha);
+        int texImage2D(unsigned target, unsigned level, HTMLCanvasElement* canvas,
+                       bool flipY, bool premultiplyAlpha);
+        int texImage2D(unsigned target, unsigned level, HTMLVideoElement* video,
+                       bool flipY, bool premultiplyAlpha);
+
+        void texParameterf(unsigned target, unsigned pname, float param);
+        void texParameteri(unsigned target, unsigned pname, int param);
+
+        int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                          unsigned width, unsigned height,
+                          unsigned format, unsigned type, CanvasArray* pixels);
+        int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                          unsigned width, unsigned height,
+                          unsigned format, unsigned type, ImageData* pixels);
+        int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                          unsigned width, unsigned height, HTMLImageElement* image,
+                          bool flipY, bool premultiplyAlpha);
+        int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                          unsigned width, unsigned height, HTMLCanvasElement* canvas,
+                          bool flipY, bool premultiplyAlpha);
+        int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                          unsigned width, unsigned height, HTMLVideoElement* video,
+                          bool flipY, bool premultiplyAlpha);
+
+        void uniform1f(long location, float x);
+        void uniform1fv(long location, float* v, int size);
+        void uniform1i(long location, int x);
+        void uniform1iv(long location, int* v, int size);
+        void uniform2f(long location, float x, float y);
+        void uniform2fv(long location, float* v, int size);
+        void uniform2i(long location, int x, int y);
+        void uniform2iv(long location, int* v, int size);
+        void uniform3f(long location, float x, float y, float z);
+        void uniform3fv(long location, float* v, int size);
+        void uniform3i(long location, int x, int y, int z);
+        void uniform3iv(long location, int* v, int size);
+        void uniform4f(long location, float x, float y, float z, float w);
+        void uniform4fv(long location, float* v, int size);
+        void uniform4i(long location, int x, int y, int z, int w);
+        void uniform4iv(long location, int* v, int size);
+        void uniformMatrix2fv(long location, bool transpose, float* value, int size);
+        void uniformMatrix3fv(long location, bool transpose, float* value, int size);
+        void uniformMatrix4fv(long location, bool transpose, float* value, int size);
+
+        void useProgram(CanvasProgram*);
+        void validateProgram(CanvasProgram*);
+
+        void vertexAttrib1f(unsigned long indx, float x);
+        void vertexAttrib1fv(unsigned long indx, float* values);
+        void vertexAttrib2f(unsigned long indx, float x, float y);
+        void vertexAttrib2fv(unsigned long indx, float* values);
+        void vertexAttrib3f(unsigned long indx, float x, float y, float z);
+        void vertexAttrib3fv(unsigned long indx, float* values);
+        void vertexAttrib4f(unsigned long indx, float x, float y, float z, float w);
+        void vertexAttrib4fv(unsigned long indx, float* values);
+        void vertexAttribPointer(unsigned long indx, int size, int type, bool normalized,
+                                 unsigned long stride, unsigned long offset);
+
+        void viewport(long x, long y, unsigned long width, unsigned long height);
+
+        void reshape(int width, int height);
+        
+        // Helpers for notification about paint events
+        void beginPaint(CanvasRenderingContext3D* context);
+        void endPaint();
+
+        // Support for buffer creation and deletion
+        unsigned createBuffer();
+        unsigned createFramebuffer();
+        unsigned createProgram();
+        unsigned createRenderbuffer();
+        unsigned createShader(ShaderType);
+        unsigned createTexture();
+        
+        void deleteBuffer(unsigned);
+        void deleteFramebuffer(unsigned);
+        void deleteProgram(unsigned);
+        void deleteRenderbuffer(unsigned);
+        void deleteShader(unsigned);
+        void deleteTexture(unsigned);        
+        
+    private:        
+        int m_currentWidth, m_currentHeight;
+        
+#if PLATFORM(SKIA)
+#include "GraphicsContext3DSkia.h"
+#endif
+
+#if PLATFORM(MAC)
+        Vector<Vector<float> > m_vertexArray;
+        
+        CGLContextObj m_contextObj;
+        GLuint m_texture;
+        GLuint m_fbo;
+        GLuint m_depthBuffer;
+#endif        
+    };
+
+} // namespace WebCore
+
+#endif // GraphicsContext3D_h
+
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.cpp
index b182548..b375bd3 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.cpp
@@ -35,147 +35,24 @@
 
 namespace WebCore {
 
-void GraphicsLayer::FloatValue::set(float key, float value, const TimingFunction* timingFunction)
-{
-    m_key = key;
-    m_value = value;
-    if (timingFunction != m_timingFunction) {
-        if (timingFunction)
-            m_timingFunction.set(new TimingFunction(*timingFunction));
-        else
-            m_timingFunction.clear();
-    }
-}
-
-void GraphicsLayer::TransformValue::set(float key, const TransformOperations* value, const TimingFunction* timingFunction)
-{
-    m_key = key;
-    if (value != m_value) {
-        if (value)
-            m_value.set(new TransformOperations(*value));
-        else
-            m_value.clear();
-    }
-    if (timingFunction != m_timingFunction) {
-        if (timingFunction)
-            m_timingFunction.set(new TimingFunction(*timingFunction));
-        else
-            m_timingFunction.clear();
-    }
-}
-
-void GraphicsLayer::FloatValueList::insert(float key, float value, const TimingFunction* timingFunction)
-{
-    for (size_t i = 0; i < m_values.size(); ++i) {
-        FloatValue& curFloatValue = m_values[i];
-        if (curFloatValue.key() == key) {
-            curFloatValue.set(key, value, timingFunction);
-            return;
-        }
-        if (curFloatValue.key() > key) {
-            // insert before
-            m_values.insert(i, FloatValue(key, value, timingFunction));
-            return;
-        }
-    }
-    
-    // append
-    m_values.append(FloatValue(key, value, timingFunction));
-}
-
-void GraphicsLayer::TransformValueList::insert(float key, const TransformOperations* value, const TimingFunction* timingFunction)
+void KeyframeValueList::insert(const AnimationValue* value)
 {
     for (size_t i = 0; i < m_values.size(); ++i) {
-        TransformValue& curTransValue = m_values[i];
-        if (curTransValue.key() == key) {
-            curTransValue.set(key, value, timingFunction);
+        const AnimationValue* curValue = m_values[i];
+        if (curValue->keyTime() == value->keyTime()) {
+            ASSERT_NOT_REACHED();
+            // insert after
+            m_values.insert(i + 1, value);
             return;
         }
-        if (curTransValue.key() > key) {
+        if (curValue->keyTime() > value->keyTime()) {
             // insert before
-            m_values.insert(i, TransformValue(key, value, timingFunction));
+            m_values.insert(i, value);
             return;
         }
     }
     
-    // append
-    m_values.append(TransformValue(key, value, timingFunction));
-}
-
-// An "invalid" list is one whose functions don't match, and therefore has to be animated as a Matrix
-// The hasBigRotation flag will always return false if isValid is false. Otherwise hasBigRotation is 
-// true if the rotation between any two keyframes is >= 180 degrees.
-void GraphicsLayer::TransformValueList::makeFunctionList(FunctionList& list, bool& isValid, bool& hasBigRotation) const
-{
-    list.clear();
-    isValid = false;
-    hasBigRotation = false;
-    
-    if (m_values.size() < 2)
-        return;
-    
-    // empty transforms match anything, so find the first non-empty entry as the reference
-    size_t firstIndex = 0;
-    for ( ; firstIndex < m_values.size(); ++firstIndex) {
-        if (m_values[firstIndex].value()->operations().size() > 0)
-            break;
-    }
-    
-    if (firstIndex >= m_values.size())
-        return;
-        
-    const TransformOperations* firstVal = m_values[firstIndex].value();
-    
-    // see if the keyframes are valid
-    for (size_t i = firstIndex + 1; i < m_values.size(); ++i) {
-        const TransformOperations* val = m_values[i].value();
-        
-        // a null transform matches anything
-        if (val->operations().isEmpty())
-            continue;
-            
-        if (firstVal->operations().size() != val->operations().size())
-            return;
-            
-        for (size_t j = 0; j < firstVal->operations().size(); ++j) {
-            if (!firstVal->operations().at(j)->isSameType(*val->operations().at(j)))
-                return;
-        }
-    }
-
-    // keyframes are valid, fill in the list
-    isValid = true;
-    
-    double lastRotAngle = 0.0;
-    double maxRotAngle = -1.0;
-        
-    list.resize(firstVal->operations().size());
-    for (size_t j = 0; j < firstVal->operations().size(); ++j) {
-        TransformOperation::OperationType type = firstVal->operations().at(j)->getOperationType();
-        list[j] = type;
-        
-        // if this is a rotation entry, we need to see if any angle differences are >= 180 deg
-        if (type == TransformOperation::ROTATE_X ||
-            type == TransformOperation::ROTATE_Y ||
-            type == TransformOperation::ROTATE_Z ||
-            type == TransformOperation::ROTATE_3D) {
-            lastRotAngle = static_cast<RotateTransformOperation*>(firstVal->operations().at(j).get())->angle();
-            
-            if (maxRotAngle < 0)
-                maxRotAngle = fabs(lastRotAngle);
-            
-            for (size_t i = firstIndex + 1; i < m_values.size(); ++i) {
-                const TransformOperations* val = m_values[i].value();
-                double rotAngle = val->operations().isEmpty() ? 0 : (static_cast<RotateTransformOperation*>(val->operations().at(j).get())->angle());
-                double diffAngle = fabs(rotAngle - lastRotAngle);
-                if (diffAngle > maxRotAngle)
-                    maxRotAngle = diffAngle;
-                lastRotAngle = rotAngle;
-            }
-        }
-    }
-    
-    hasBigRotation = maxRotAngle >= 180.0;
+    m_values.append(value);
 }
 
 GraphicsLayer::GraphicsLayer(GraphicsLayerClient* client)
@@ -192,9 +69,11 @@ GraphicsLayer::GraphicsLayer(GraphicsLayerClient* client)
     , m_usingTiledLayer(false)
     , m_masksToBounds(false)
     , m_drawsContent(false)
-    , m_paintingPhase(GraphicsLayerPaintAllMask)
+    , m_paintingPhase(GraphicsLayerPaintAll)
+    , m_geometryOrientation(CompositingCoordinatesTopDown)
     , m_contentsOrientation(CompositingCoordinatesTopDown)
     , m_parent(0)
+    , m_maskLayer(0)
 #ifndef NDEBUG
     , m_repaintCount(0)
 #endif
@@ -203,8 +82,6 @@ GraphicsLayer::GraphicsLayer(GraphicsLayerClient* client)
 
 GraphicsLayer::~GraphicsLayer()
 {
-    removeAllAnimations();    
-
     removeAllChildren();
     removeFromParent();
 }
@@ -316,9 +193,9 @@ void GraphicsLayer::removeFromParent()
     }
 }
 
-void GraphicsLayer::setBackgroundColor(const Color& inColor, const Animation*, double /*beginTime*/)
+void GraphicsLayer::setBackgroundColor(const Color& color)
 {
-    m_backgroundColor = inColor;
+    m_backgroundColor = color;
     m_backgroundColorSet = true;
 }
 
@@ -328,96 +205,13 @@ void GraphicsLayer::clearBackgroundColor()
     m_backgroundColorSet = false;
 }
 
-bool GraphicsLayer::setOpacity(float opacity, const Animation*, double)
-{
-    m_opacity = opacity;
-    return false;       // not animating
-}
-
 void GraphicsLayer::paintGraphicsLayerContents(GraphicsContext& context, const IntRect& clip)
 {
-    m_client->paintContents(this, context, m_paintingPhase, clip);
-}
-
-String GraphicsLayer::propertyIdToString(AnimatedPropertyID property)
-{
-    switch (property) {
-        case AnimatedPropertyWebkitTransform:
-            return "transform";
-        case AnimatedPropertyOpacity:
-            return "opacity";
-        case AnimatedPropertyBackgroundColor:
-            return "backgroundColor";
-        case AnimatedPropertyInvalid:
-            ASSERT_NOT_REACHED();
-    }
-    ASSERT_NOT_REACHED();
-    return "";
-}
-
-int GraphicsLayer::findAnimationEntry(AnimatedPropertyID property, short index) const
-{
-    for (size_t i = 0; i < m_animations.size(); ++i) {
-        if (m_animations[i].matches(property, index))
-            return static_cast<int>(i);
-    }
-    return -1;
-}
-
-void GraphicsLayer::addAnimationEntry(AnimatedPropertyID property, short index, bool isTransition, const Animation* transition)
-{
-    int i = findAnimationEntry(property, index);
-    
-    if (i >= 0)
-        m_animations[i].reset(transition, isTransition);
-    else
-        m_animations.append(AnimationEntry(transition, property, index, isTransition));
-}
-
-void GraphicsLayer::removeAllAnimations()
-{
-    size_t size = m_animations.size();
-    for (size_t i = 0; i < size; ++i)
-        removeAnimation(0, true);
-}
-
-void GraphicsLayer::removeAllAnimationsForProperty(AnimatedPropertyID property)
-{
-    for (short j = 0; ; ++j) {
-        int i = findAnimationEntry(property, j);
-        if (i < 0)
-            break;
-        removeAnimation(i, false);
-    }
-}
-
-void GraphicsLayer::removeFinishedAnimations(const String& name, int /*index*/, bool reset)
-{
-    size_t size = m_animations.size();
-    for (size_t i = 0; i < size; ) {
-        AnimationEntry& anim = m_animations[i];
-        if (!anim.isTransition() && anim.animation()->name() == name) {
-            removeAnimation(i, reset);
-            --size;
-        } else
-            ++i;
-    }
-}
-
-void GraphicsLayer::removeFinishedTransitions(AnimatedPropertyID property)
-{
-    size_t size = m_animations.size();
-    for (size_t i = 0; i < size; ) {
-        AnimationEntry& anim = m_animations[i];
-        if (anim.isTransition() && property == anim.property()) {
-            removeAnimation(i, false);
-            --size;
-        } else
-            ++i;
-    }
+    if (m_client)
+        m_client->paintContents(this, context, m_paintingPhase, clip);
 }
 
-void GraphicsLayer::suspendAnimations()
+void GraphicsLayer::suspendAnimations(double)
 {
 }
 
@@ -474,6 +268,91 @@ void GraphicsLayer::distributeOpacity(float accumulatedOpacity)
     }
 }
 
+// An "invalid" list is one whose functions don't match, and therefore has to be animated as a Matrix
+// The hasBigRotation flag will always return false if isValid is false. Otherwise hasBigRotation is 
+// true if the rotation between any two keyframes is >= 180 degrees.
+
+static inline const TransformOperations* operationsAt(const KeyframeValueList& valueList, size_t index)
+{
+    return static_cast<const TransformAnimationValue*>(valueList.at(index))->value();
+}
+
+void GraphicsLayer::fetchTransformOperationList(const KeyframeValueList& valueList, TransformOperationList& list, bool& isValid, bool& hasBigRotation)
+{
+    ASSERT(valueList.property() == AnimatedPropertyWebkitTransform);
+
+    list.clear();
+    isValid = false;
+    hasBigRotation = false;
+    
+    if (valueList.size() < 2)
+        return;
+    
+    // Empty transforms match anything, so find the first non-empty entry as the reference.
+    size_t firstIndex = 0;
+    for ( ; firstIndex < valueList.size(); ++firstIndex) {
+        if (operationsAt(valueList, firstIndex)->operations().size() > 0)
+            break;
+    }
+    
+    if (firstIndex >= valueList.size())
+        return;
+        
+    const TransformOperations* firstVal = operationsAt(valueList, firstIndex);
+    
+    // See if the keyframes are valid.
+    for (size_t i = firstIndex + 1; i < valueList.size(); ++i) {
+        const TransformOperations* val = operationsAt(valueList, i);
+        
+        // a null transform matches anything
+        if (val->operations().isEmpty())
+            continue;
+            
+        if (firstVal->operations().size() != val->operations().size())
+            return;
+            
+        for (size_t j = 0; j < firstVal->operations().size(); ++j) {
+            if (!firstVal->operations().at(j)->isSameType(*val->operations().at(j)))
+                return;
+        }
+    }
+
+    // Keyframes are valid, fill in the list.
+    isValid = true;
+    
+    double lastRotAngle = 0.0;
+    double maxRotAngle = -1.0;
+        
+    list.resize(firstVal->operations().size());
+    for (size_t j = 0; j < firstVal->operations().size(); ++j) {
+        TransformOperation::OperationType type = firstVal->operations().at(j)->getOperationType();
+        list[j] = type;
+        
+        // if this is a rotation entry, we need to see if any angle differences are >= 180 deg
+        if (type == TransformOperation::ROTATE_X ||
+            type == TransformOperation::ROTATE_Y ||
+            type == TransformOperation::ROTATE_Z ||
+            type == TransformOperation::ROTATE_3D) {
+            lastRotAngle = static_cast<RotateTransformOperation*>(firstVal->operations().at(j).get())->angle();
+            
+            if (maxRotAngle < 0)
+                maxRotAngle = fabs(lastRotAngle);
+            
+            for (size_t i = firstIndex + 1; i < valueList.size(); ++i) {
+                const TransformOperations* val = operationsAt(valueList, i);
+                double rotAngle = val->operations().isEmpty() ? 0 : (static_cast<RotateTransformOperation*>(val->operations().at(j).get())->angle());
+                double diffAngle = fabs(rotAngle - lastRotAngle);
+                if (diffAngle > maxRotAngle)
+                    maxRotAngle = diffAngle;
+                lastRotAngle = rotAngle;
+            }
+        }
+    }
+    
+    hasBigRotation = maxRotAngle >= 180.0;
+}
+
+
 static void writeIndent(TextStream& ts, int indent)
 {
     for (int i = 0; i != indent; ++i)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.h b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.h
index 3cc1128..2924073 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayer.h
@@ -33,16 +33,21 @@
 #include "FloatPoint.h"
 #include "FloatPoint3D.h"
 #include "FloatSize.h"
+#if ENABLE(3D_CANVAS)
+#include "GraphicsContext3D.h"
+#endif
 #include "GraphicsLayerClient.h"
+#include "IntRect.h"
 #include "TransformationMatrix.h"
 #include "TransformOperations.h"
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 #if PLATFORM(MAC)
 #ifdef __OBJC__
 @class WebLayer;
 @class CALayer;
-typedef WebLayer PlatformLayer;
+typedef CALayer PlatformLayer;
 typedef CALayer* NativeLayer;
 #else
 typedef void* PlatformLayer;
@@ -61,119 +66,97 @@ class Image;
 class TextStream;
 class TimingFunction;
 
-// GraphicsLayer is an abstraction for a rendering surface with backing store,
-// which may have associated transformation and animations.
+// Base class for animation values (also used for transitions). Here to
+// represent values for properties being animated via the GraphicsLayer,
+// without pulling in style-related data from outside of the platform directory.
+class AnimationValue : public Noncopyable {
+public:
+    AnimationValue(float keyTime, const TimingFunction* timingFunction = 0)
+        : m_keyTime(keyTime)
+        , m_timingFunction(0)
+    {
+        if (timingFunction)
+            m_timingFunction.set(new TimingFunction(*timingFunction));
+    }
+    
+    virtual ~AnimationValue() { }
 
-class GraphicsLayer {
+    float keyTime() const { return m_keyTime; }
+    const TimingFunction* timingFunction() const { return m_timingFunction.get(); }
+
+private:
+    float m_keyTime;
+    OwnPtr<TimingFunction> m_timingFunction;
+};
+
+// Used to store one float value of an animation.
+class FloatAnimationValue : public AnimationValue {
+public:
+    FloatAnimationValue(float keyTime, float value, const TimingFunction* timingFunction = 0)
+        : AnimationValue(keyTime, timingFunction)
+        , m_value(value)
+    {
+    }
+
+    float value() const { return m_value; }
+
+private:
+    float m_value;
+};
+
+// Used to store one transform value in a keyframe list.
+class TransformAnimationValue : public AnimationValue {
 public:
-    // Used to store one float value of a keyframe animation.
-    class FloatValue {
-    public:
-        FloatValue(float key, float value, const TimingFunction* timingFunction = 0)
-            : m_key(key), m_value(value), m_timingFunction(0)
-        {
-            if (timingFunction)
-                m_timingFunction.set(new TimingFunction(*timingFunction));
-        }
-
-        FloatValue(const FloatValue& other)
-            : m_key(other.key()), m_value(other.value()), m_timingFunction(0)
-        {
-            if (other.timingFunction())
-                m_timingFunction.set(new TimingFunction(*other.timingFunction()));
-        }
-
-        const FloatValue& operator=(const FloatValue& other)
-        {
-            if (&other != this)
-                set(other.key(), other.value(), other.timingFunction());
-            return *this;
-        }
-
-        void set(float key, float value, const TimingFunction*);
-        
-        float key() const { return m_key; }
-        float value() const { return m_value; }
-        const TimingFunction* timingFunction() const { return m_timingFunction.get(); }
-
-    private:
-        float m_key;
-        float m_value;
-        OwnPtr<TimingFunction> m_timingFunction;
-    };
+    TransformAnimationValue(float keyTime, const TransformOperations* value = 0, const TimingFunction* timingFunction = 0)
+        : AnimationValue(keyTime, timingFunction)
+    {
+        if (value)
+            m_value.set(new TransformOperations(*value));
+    }
+
+    const TransformOperations* value() const { return m_value.get(); }
+
+private:
+    OwnPtr<TransformOperations> m_value;
+};
+
+// Used to store a series of values in a keyframe list. Values will all be of the same type,
+// which can be inferred from the property.
+class KeyframeValueList : public Noncopyable {
+public:
+
+    KeyframeValueList(AnimatedPropertyID property)
+        : m_property(property)
+    {
+    }
     
+    ~KeyframeValueList()
+    {
+        deleteAllValues(m_values);
+    }
     
-    class FloatValueList {
-    public:
-        void insert(float key, float value, const TimingFunction* timingFunction);
-
-        size_t size() const { return m_values.size(); }
-        const FloatValue& at(size_t i) const { return m_values.at(i); }
-        const Vector<FloatValue>& values() const { return m_values; }
-
-    private:
-        Vector<FloatValue> m_values;
-    };
-
-    // Used to store one transform in a keyframe list.
-    class TransformValue {
-    public:
-        TransformValue(float key = NAN, const TransformOperations* value = 0, const TimingFunction* timingFunction = 0)
-            : m_key(key)
-        {
-            if (value)
-                m_value.set(new TransformOperations(*value));
-            if (timingFunction)
-                m_timingFunction.set(new TimingFunction(*timingFunction));
-        }
-
-        TransformValue(const TransformValue& other)
-            : m_key(other.key())
-        {
-            if (other.value())
-                m_value.set(new TransformOperations(*other.value()));
-            if (other.timingFunction())
-                m_timingFunction.set(new TimingFunction(*other.timingFunction()));
-        }
-
-        const TransformValue& operator=(const TransformValue& other)
-        {
-            if (&other != this)
-                set(other.key(), other.value(), other.timingFunction());
-            return *this;
-        }
-
-        void set(float key, const TransformOperations* value, const TimingFunction* timingFunction);
-
-        float key() const { return m_key; }
-        const TransformOperations* value() const { return m_value.get(); }
-        const TimingFunction* timingFunction() const { return m_timingFunction.get(); }
-        
-    private:
-        float m_key;
-        OwnPtr<TransformOperations> m_value;
-        OwnPtr<TimingFunction> m_timingFunction;
-    };
+    AnimatedPropertyID property() const { return m_property; }
+
+    size_t size() const { return m_values.size(); }
+    const AnimationValue* at(size_t i) const { return m_values.at(i); }
     
-    // Used to store a series of transforms in a keyframe list.
-    class TransformValueList {
-    public:
-        typedef Vector<TransformOperation::OperationType> FunctionList;
-
-        size_t size() const { return m_values.size(); }
-        const TransformValue& at(size_t i) const { return m_values.at(i); }
-        const Vector<TransformValue>& values() const { return m_values; }
-        
-        void insert(float key, const TransformOperations* value, const TimingFunction* timingFunction);
-        
-        // return a list of the required functions. List is empty if keyframes are not valid
-        // If return value is true, functions contain rotations of >= 180 degrees
-        void makeFunctionList(FunctionList& list, bool& isValid, bool& hasBigRotation) const;
-    private:
-        Vector<TransformValue> m_values;
-    };
-
-    static GraphicsLayer* createGraphicsLayer(GraphicsLayerClient*);
+    // Insert, sorted by keyTime. Takes ownership of the pointer.
+    void insert(const AnimationValue*);
+    
+protected:
+    Vector<const AnimationValue*> m_values;
+    AnimatedPropertyID m_property;
+};
+
+
+
+// GraphicsLayer is an abstraction for a rendering surface with backing store,
+// which may have associated transformation and animations.
+
+class GraphicsLayer {
+public:
+
+    static PassOwnPtr<GraphicsLayer> create(GraphicsLayerClient*);
     
     virtual ~GraphicsLayer();
 
@@ -201,6 +184,9 @@ public:
     void removeAllChildren();
     virtual void removeFromParent();
 
+    GraphicsLayer* maskLayer() const { return m_maskLayer; }
+    virtual void setMaskLayer(GraphicsLayer* layer) { m_maskLayer = layer; }
+    
     // Offset is origin of the renderer minus origin of the graphics layer (so either zero or negative).
     IntSize offsetFromRenderer() const { return m_offsetFromRenderer; }
     void setOffsetFromRenderer(const IntSize& offset) { m_offsetFromRenderer = offset; }
@@ -235,7 +221,7 @@ public:
 
     // The color used to paint the layer backgrounds
     const Color& backgroundColor() const { return m_backgroundColor; }
-    virtual void setBackgroundColor(const Color&, const Animation* = 0, double beginTime = 0);
+    virtual void setBackgroundColor(const Color&);
     virtual void clearBackgroundColor();
     bool backgroundColorSet() const { return m_backgroundColorSet; }
 
@@ -247,35 +233,39 @@ public:
     virtual void setBackfaceVisibility(bool b) { m_backfaceVisibility = b; }
 
     float opacity() const { return m_opacity; }
-    // return true if we started an animation
-    virtual bool setOpacity(float o, const Animation* = 0, double beginTime = 0);
+    virtual void setOpacity(float opacity) { m_opacity = opacity; }
 
     // Some GraphicsLayers paint only the foreground or the background content
-    GraphicsLayerPaintingPhase drawingPhase() const { return m_paintingPhase; }
-    void setDrawingPhase(GraphicsLayerPaintingPhase phase) { m_paintingPhase = phase; }
+    GraphicsLayerPaintingPhase paintingPhase() const { return m_paintingPhase; }
+    void setPaintingPhase(GraphicsLayerPaintingPhase phase) { m_paintingPhase = phase; }
 
     virtual void setNeedsDisplay() = 0;
     // mark the given rect (in layer coords) as needing dispay. Never goes deep.
     virtual void setNeedsDisplayInRect(const FloatRect&) = 0;
 
-    virtual bool animateTransform(const TransformValueList&, const IntSize&, const Animation*, double beginTime, bool isTransition) = 0;
-    virtual bool animateFloat(AnimatedPropertyID, const FloatValueList&, const Animation*, double beginTime) = 0;
+    // Set that the position/size of the contents (image or video).
+    IntRect contentsRect() const { return m_contentsRect; }
+    virtual void setContentsRect(const IntRect& r) { m_contentsRect = r; }
     
-    void removeFinishedAnimations(const String& name, int index, bool reset);
-    void removeFinishedTransitions(AnimatedPropertyID);
-    void removeAllAnimations();
-
-    virtual void suspendAnimations();
+    // Return true if the animation is handled by the compositing system. If this returns
+    // false, the animation will be run by AnimationController.
+    virtual bool addAnimation(const KeyframeValueList&, const IntSize& /*boxSize*/, const Animation*, const String& /*keyframesName*/, double /*beginTime*/) { return false; }
+    virtual void removeAnimationsForProperty(AnimatedPropertyID) { }
+    virtual void removeAnimationsForKeyframes(const String& /* keyframesName */) { }
+    virtual void pauseAnimation(const String& /* keyframesName */) { }
+    
+    virtual void suspendAnimations(double time);
     virtual void resumeAnimations();
     
     // Layer contents
     virtual void setContentsToImage(Image*) { }
     virtual void setContentsToVideo(PlatformLayer*) { }
     virtual void setContentsBackgroundColor(const Color&) { }
-    virtual void clearContents() { }
     
-    virtual void updateContentsRect() { }
-
+#if ENABLE(3D_CANVAS)
+    virtual void setContentsToGraphicsContext3D(const GraphicsContext3D*) { }
+    virtual void setGraphicsContext3DNeedsDisplay() { }
+#endif
     // Callback from the underlying graphics system to draw layer contents.
     void paintGraphicsLayerContents(GraphicsContext&, const IntRect& clip);
     
@@ -294,12 +284,12 @@ public:
     static CompositingCoordinatesOrientation compositingCoordinatesOrientation();
 
     // Set the geometry orientation (top-down, or bottom-up) for this layer, which also controls sublayer geometry.
-    virtual void setGeometryOrientation(CompositingCoordinatesOrientation) { }
-    virtual CompositingCoordinatesOrientation geometryOrientation() const { return CompositingCoordinatesTopDown; }
+    virtual void setGeometryOrientation(CompositingCoordinatesOrientation orientation) { m_geometryOrientation = orientation; }
+    CompositingCoordinatesOrientation geometryOrientation() const { return m_geometryOrientation; }
 
     // Flippedness of the contents of this layer. Does not affect sublayer geometry.
     virtual void setContentsOrientation(CompositingCoordinatesOrientation orientation) { m_contentsOrientation = orientation; }
-    virtual CompositingCoordinatesOrientation contentsOrientation() const { return m_contentsOrientation; }
+    CompositingCoordinatesOrientation contentsOrientation() const { return m_contentsOrientation; }
 
 #ifndef NDEBUG
     static bool showDebugBorders();
@@ -314,25 +304,26 @@ public:
     virtual void setZPosition(float);
 #endif
 
-    static String propertyIdToString(AnimatedPropertyID);
-    
     virtual void distributeOpacity(float);
     virtual float accumulatedOpacity() const;
 
+    // Some compositing systems may do internal batching to synchronize compositing updates
+    // with updates drawn into the window. This is a signal to flush any internal batched state.
+    virtual void syncCompositingState() { }
+
 protected:
+
+    typedef Vector<TransformOperation::OperationType> TransformOperationList;
+    // Given a list of TransformAnimationValues, return an array of transform operations.
+    // On return, if hasBigRotation is true, functions contain rotations of >= 180 degrees
+    static void fetchTransformOperationList(const KeyframeValueList&, TransformOperationList&, bool& isValid, bool& hasBigRotation);
+
     virtual void setOpacityInternal(float) { }
     
     GraphicsLayer(GraphicsLayerClient*);
 
     void dumpProperties(TextStream&, int indent) const;
 
-    // returns -1 if not found
-    int findAnimationEntry(AnimatedPropertyID, short index) const;
-    void addAnimationEntry(AnimatedPropertyID, short index, bool isTransition, const Animation*);
-
-    virtual void removeAnimation(int /*index*/, bool /*reset*/) {}
-    void removeAllAnimationsForProperty(AnimatedPropertyID);
-
     GraphicsLayerClient* m_client;
     String m_name;
     
@@ -361,54 +352,16 @@ protected:
     bool m_drawsContent : 1;
 
     GraphicsLayerPaintingPhase m_paintingPhase;
-    CompositingCoordinatesOrientation m_contentsOrientation;
+    CompositingCoordinatesOrientation m_geometryOrientation;    // affects geometry of layer positions
+    CompositingCoordinatesOrientation m_contentsOrientation;    // affects orientation of layer contents
 
     Vector<GraphicsLayer*> m_children;
     GraphicsLayer* m_parent;
-    
-    // AnimationEntry represents an animation of a property on this layer.
-    // For transform only, there may be more than one, in which case 'index'
-    // is an index into the list of transforms. 
-    class AnimationEntry {
-    public:
-        AnimationEntry(const Animation* animation, AnimatedPropertyID property, short index, bool isTransition)
-            : m_animation(const_cast<Animation*>(animation))
-            , m_property(property)
-            , m_index(index)
-            , m_isCurrent(true)
-            , m_isTransition(isTransition)
-        {
-        }
-        
-        const Animation* animation() const { return m_animation.get(); }
-        AnimatedPropertyID property() const { return m_property; }
-        int index() const { return m_index; }
-        bool isCurrent() const { return m_isCurrent; }
-        void setIsCurrent(bool b = true) { m_isCurrent = b; }
-        bool isTransition() const { return m_isTransition; }
-
-        bool matches(AnimatedPropertyID property, short index) const
-        {
-            return m_property == property && m_index == index;
-        }
-        
-        void reset(const Animation* animation, bool isTransition)
-        {
-            m_animation = const_cast<Animation*>(animation);
-            m_isTransition = isTransition;
-            m_isCurrent = true;
-        }
-    
-    private:
-        RefPtr<Animation> m_animation;
-        AnimatedPropertyID m_property : 14;
-        short m_index : 16;
-        bool m_isCurrent : 1;
-        bool m_isTransition : 1;
-    };
-    
-    Vector<AnimationEntry> m_animations;      // running animations/transitions
-    
+
+    GraphicsLayer* m_maskLayer; // Reference to mask layer. We don't own this.
+
+    IntRect m_contentsRect;
+
 #ifndef NDEBUG
     int m_repaintCount;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayerClient.h b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayerClient.h
index 46382f2..5facc94 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayerClient.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsLayerClient.h
@@ -37,9 +37,10 @@ class IntRect;
 class FloatPoint;
 
 enum GraphicsLayerPaintingPhase {
-    GraphicsLayerPaintBackgroundMask = (1 << 0),
-    GraphicsLayerPaintForegroundMask = (1 << 1),
-    GraphicsLayerPaintAllMask = (GraphicsLayerPaintBackgroundMask | GraphicsLayerPaintForegroundMask)
+    GraphicsLayerPaintBackground = (1 << 0),
+    GraphicsLayerPaintForeground = (1 << 1),
+    GraphicsLayerPaintMask = (1 << 2),
+    GraphicsLayerPaintAll = (GraphicsLayerPaintBackground | GraphicsLayerPaintForeground | GraphicsLayerPaintMask)
 };
 
 enum AnimatedPropertyID {
@@ -53,13 +54,14 @@ class GraphicsLayerClient {
 public:
     virtual ~GraphicsLayerClient() {}
 
-    // Callbacks for when hardware-accelerated transitions and animation started
+    // Callback for when hardware-accelerated animation started.
     virtual void notifyAnimationStarted(const GraphicsLayer*, double time) = 0;
+
+    // Notification that a layer property changed that requires a subsequent call to syncCompositingState()
+    // to appear on the screen.
+    virtual void notifySyncRequired(const GraphicsLayer*) = 0;
     
     virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const IntRect& inClip) = 0;
-
-    // Return a rect for the "contents" of the graphics layer, i.e. video or image content, in GraphicsLayer coordinates.
-    virtual IntRect contentsBox(const GraphicsLayer*) = 0;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/ImageBuffer.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/ImageBuffer.cpp
new file mode 100644
index 0000000..55305d1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/ImageBuffer.cpp
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ImageBuffer.h"
+
+#if !PLATFORM(CG)
+
+#include <math.h>
+
+namespace WebCore {
+
+void ImageBuffer::transformColorSpace(ImageColorSpace srcColorSpace, ImageColorSpace dstColorSpace)
+{
+    if (srcColorSpace == dstColorSpace)
+        return;
+
+    // only sRGB <-> linearRGB are supported at the moment
+    if ((srcColorSpace != LinearRGB && srcColorSpace != DeviceRGB) || 
+        (dstColorSpace != LinearRGB && dstColorSpace != DeviceRGB))
+        return;
+
+    Vector<int> lookUpTable;
+    if (dstColorSpace == LinearRGB) {
+        if (m_linearRgbLUT.isEmpty()) {
+            for (unsigned i = 0; i < 256; i++) {
+                float color = i  / 255.0f;
+                color = (color <= 0.04045f ? color / 12.92f : pow((color + 0.055f) / 1.055f, 2.4f));
+                color = std::max(0.0f, color);
+                color = std::min(1.0f, color);
+                m_linearRgbLUT.append(static_cast<int>(color * 255));
+            }
+        }
+        platformTransformColorSpace(m_linearRgbLUT);
+    } else if (dstColorSpace == DeviceRGB) {
+        if (m_deviceRgbLUT.isEmpty()) {
+            for (unsigned i = 0; i < 256; i++) {
+                float color = i  / 255.0f;
+                color = pow(1.055f * color, 1.0f / 2.4f) - 0.055f;
+                color = std::max(0.0f, color);
+                color = std::min(1.0f, color);
+                m_deviceRgbLUT.append(static_cast<int>(color * 255));
+            }
+        }
+        platformTransformColorSpace(m_deviceRgbLUT);
+    }
+}
+
+}
+
+#endif // PLATFORM(CG)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/ImageBuffer.h b/src/3rdparty/webkit/WebCore/platform/graphics/ImageBuffer.h
index 841a891..9432058 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/ImageBuffer.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/ImageBuffer.h
@@ -43,13 +43,25 @@ namespace WebCore {
     class IntRect;
     class String;
 
+    enum ImageColorSpace {
+        Unknown,
+        DeviceRGB, // like sRGB
+        GrayScale,
+        LinearRGB
+    };
+
+    enum Multiply {
+        Premultiplied,
+        Unmultiplied
+    };
+
     class ImageBuffer : public Noncopyable {
     public:
         // Will return a null pointer on allocation failure.
-        static PassOwnPtr<ImageBuffer> create(const IntSize& size, bool grayScale)
+        static PassOwnPtr<ImageBuffer> create(const IntSize& size, ImageColorSpace colorSpace = DeviceRGB)
         {
             bool success = false;
-            OwnPtr<ImageBuffer> buf(new ImageBuffer(size, grayScale, success));
+            OwnPtr<ImageBuffer> buf(new ImageBuffer(size, colorSpace, success));
             if (success)
                 return buf.release();
             return 0;
@@ -64,12 +76,17 @@ namespace WebCore {
 
         void clearImage() { m_image.clear(); }
 
-        PassRefPtr<ImageData> getImageData(const IntRect& rect) const;
-        void putImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint);
+        PassRefPtr<ImageData> getUnmultipliedImageData(const IntRect&) const;
+        PassRefPtr<ImageData> getPremultipliedImageData(const IntRect&) const;
+
+        void putUnmultipliedImageData(ImageData*, const IntRect& sourceRect, const IntPoint& destPoint);
+        void putPremultipliedImageData(ImageData*, const IntRect& sourceRect, const IntPoint& destPoint);
 
         String toDataURL(const String& mimeType) const;
 #if !PLATFORM(CG)
         TransformationMatrix baseTransform() const { return TransformationMatrix(); }
+        void transformColorSpace(ImageColorSpace srcColorSpace, ImageColorSpace dstColorSpace);
+        void platformTransformColorSpace(const Vector<int>&);
 #else
         TransformationMatrix baseTransform() const { return TransformationMatrix(1, 0, 0, -1, 0, m_size.height()); }
 #endif
@@ -80,9 +97,14 @@ namespace WebCore {
         OwnPtr<GraphicsContext> m_context;
         mutable RefPtr<Image> m_image;
 
+#if !PLATFORM(CG)
+        Vector<int> m_linearRgbLUT;
+        Vector<int> m_deviceRgbLUT;
+#endif
+
         // This constructor will place its success into the given out-variable
         // so that create() knows when it should return failure.
-        ImageBuffer(const IntSize&, bool grayScale, bool& success);
+        ImageBuffer(const IntSize&, ImageColorSpace colorSpace, bool& success);
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.cpp
new file mode 100644
index 0000000..799368b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.cpp
@@ -0,0 +1,185 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2007 Alp Toker <alp.toker@collabora.co.uk>
+ * Copyright (C) 2008, Google Inc. All rights reserved.
+ * Copyright (C) 2007-2009 Torch Mobile, Inc
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ImageSource.h"
+
+#if PLATFORM(QT)
+#include "ImageDecoderQt.h"
+#else
+#include "ImageDecoder.h"
+#endif
+
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+#ifndef IMAGE_DECODER_DOWN_SAMPLING_MAX_NUMBER_OF_PIXELS
+#define IMAGE_DECODER_DOWN_SAMPLING_MAX_NUMBER_OF_PIXELS (1024 * 1024)
+#endif
+#endif
+
+namespace WebCore {
+
+ImageSource::ImageSource()
+    : m_decoder(0)
+{
+}
+
+ImageSource::~ImageSource()
+{
+    clear(true);
+}
+
+void ImageSource::clear(bool destroyAll, size_t clearBeforeFrame, SharedBuffer* data, bool allDataReceived)
+{
+    if (!destroyAll) {
+        if (m_decoder)
+            m_decoder->clearFrameBufferCache(clearBeforeFrame);
+        return;
+    }
+
+    delete m_decoder;
+    m_decoder = 0;
+    if (data)
+        setData(data, allDataReceived);
+}
+
+bool ImageSource::initialized() const
+{
+    return m_decoder;
+}
+
+void ImageSource::setData(SharedBuffer* data, bool allDataReceived)
+{
+    // Make the decoder by sniffing the bytes.
+    // This method will examine the data and instantiate an instance of the appropriate decoder plugin.
+    // If insufficient bytes are available to determine the image type, no decoder plugin will be
+    // made.
+    if (!m_decoder) {
+        m_decoder = static_cast<NativeImageSourcePtr>(ImageDecoder::create(*data));
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+        if (m_decoder)
+            m_decoder->setMaxNumPixels(IMAGE_DECODER_DOWN_SAMPLING_MAX_NUMBER_OF_PIXELS);
+#endif
+    }
+
+    if (m_decoder)
+        m_decoder->setData(data, allDataReceived);
+}
+
+String ImageSource::filenameExtension() const
+{
+    return m_decoder ? m_decoder->filenameExtension() : String();
+}
+
+bool ImageSource::isSizeAvailable()
+{
+    return m_decoder && m_decoder->isSizeAvailable();
+}
+
+IntSize ImageSource::size() const
+{
+    return m_decoder ? m_decoder->size() : IntSize();
+}
+
+IntSize ImageSource::frameSizeAtIndex(size_t index) const
+{
+    return m_decoder ? m_decoder->frameSizeAtIndex(index) : IntSize();
+}
+
+int ImageSource::repetitionCount()
+{
+    return m_decoder ? m_decoder->repetitionCount() : cAnimationNone;
+}
+
+size_t ImageSource::frameCount() const
+{
+    return m_decoder ? m_decoder->frameCount() : 0;
+}
+
+#if !PLATFORM(QT)
+
+NativeImagePtr ImageSource::createFrameAtIndex(size_t index)
+{
+    if (!m_decoder)
+        return 0;
+
+    RGBA32Buffer* buffer = m_decoder->frameBufferAtIndex(index);
+    if (!buffer || buffer->status() == RGBA32Buffer::FrameEmpty)
+        return 0;
+
+    // Zero-height images can cause problems for some ports.  If we have an
+    // empty image dimension, just bail.
+    if (size().isEmpty())
+        return 0;
+
+    // Return the buffer contents as a native image.  For some ports, the data
+    // is already in a native container, and this just increments its refcount.
+    return buffer->asNewNativeImage();
+}
+
+float ImageSource::frameDurationAtIndex(size_t index)
+{
+    if (!m_decoder)
+        return 0;
+
+    RGBA32Buffer* buffer = m_decoder->frameBufferAtIndex(index);
+    if (!buffer || buffer->status() == RGBA32Buffer::FrameEmpty)
+        return 0;
+
+    // Many annoying ads specify a 0 duration to make an image flash as quickly
+    // as possible.  We follow WinIE's behavior and use a duration of 100 ms
+    // for any frames that specify a duration of <= 50 ms.  See
+    // <http://bugs.webkit.org/show_bug.cgi?id=14413> or Radar 4051389 for
+    // more.
+    const float duration = buffer->duration() / 1000.0f;
+    return (duration < 0.051f) ? 0.100f : duration;
+}
+
+bool ImageSource::frameHasAlphaAtIndex(size_t index)
+{
+    // When a frame has not finished decoding, always mark it as having alpha.
+    // Ports that check the result of this function to determine their
+    // compositing op need this in order to not draw the undecoded portion as
+    // black.
+    // TODO: Perhaps we should ensure that each individual decoder returns true
+    // in this case.
+    return !frameIsCompleteAtIndex(index)
+        || m_decoder->frameBufferAtIndex(index)->hasAlpha();
+}
+
+bool ImageSource::frameIsCompleteAtIndex(size_t index)
+{
+    if (!m_decoder)
+        return false;
+
+    RGBA32Buffer* buffer = m_decoder->frameBufferAtIndex(index);
+    return buffer && buffer->status() == RGBA32Buffer::FrameComplete;
+}
+
+#endif
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.h b/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.h
index acb64de..3559abe 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2007-2008 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -46,6 +47,10 @@ struct _cairo_surface;
 typedef struct _cairo_surface cairo_surface_t;
 #elif PLATFORM(SKIA)
 class NativeImageSkia;
+#elif PLATFORM(HAIKU)
+class BBitmap;
+#elif PLATFORM(WINCE)
+#include "SharedBitmap.h"
 #endif
 
 namespace WebCore {
@@ -54,30 +59,31 @@ class IntSize;
 class SharedBuffer;
 class String;
 
-#if PLATFORM(WX)
-class ImageDecoder;
-typedef ImageDecoder* NativeImageSourcePtr;
-typedef const Vector<char>* NativeBytePtr;
-#if USE(WXGC)
-typedef wxGraphicsBitmap* NativeImagePtr;
-#else
-typedef wxBitmap* NativeImagePtr;
-#endif
-#elif PLATFORM(CG)
+#if PLATFORM(CG)
 typedef CGImageSourceRef NativeImageSourcePtr;
 typedef CGImageRef NativeImagePtr;
 #elif PLATFORM(QT)
 class ImageDecoderQt;
 typedef ImageDecoderQt* NativeImageSourcePtr;
 typedef QPixmap* NativeImagePtr;
-#elif PLATFORM(CAIRO)
+#else
 class ImageDecoder;
 typedef ImageDecoder* NativeImageSourcePtr;
+#if PLATFORM(WX)
+#if USE(WXGC)
+typedef wxGraphicsBitmap* NativeImagePtr;
+#else
+typedef wxBitmap* NativeImagePtr;
+#endif
+#elif PLATFORM(CAIRO)
 typedef cairo_surface_t* NativeImagePtr;
 #elif PLATFORM(SKIA)
-class ImageDecoder;
-typedef ImageDecoder* NativeImageSourcePtr;
 typedef NativeImageSkia* NativeImagePtr;
+#elif PLATFORM(HAIKU)
+typedef BBitmap* NativeImagePtr;
+#elif PLATFORM(WINCE)
+typedef RefPtr<SharedBitmap> NativeImagePtr;
+#endif
 #endif
 
 const int cAnimationLoopOnce = -1;
@@ -135,9 +141,7 @@ public:
     bool frameHasAlphaAtIndex(size_t); // Whether or not the frame actually used any alpha.
     bool frameIsCompleteAtIndex(size_t); // Whether or not the frame is completely decoded.
 
-    // FIXME: This is protected only to allow ImageSourceSkia to set ICO decoder
-    // with a preferred size. See ImageSourceSkia.h for discussion.
-protected:
+private:
     NativeImageSourcePtr m_decoder;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/IntPoint.h b/src/3rdparty/webkit/WebCore/platform/graphics/IntPoint.h
index 21af67b..ab5f3ec 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/IntPoint.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/IntPoint.h
@@ -55,6 +55,8 @@ class QPoint;
 QT_END_NAMESPACE
 #elif PLATFORM(GTK)
 typedef struct _GdkPoint GdkPoint;
+#elif PLATFORM(HAIKU)
+class BPoint;
 #endif
 
 #if PLATFORM(WX)
@@ -121,6 +123,9 @@ public:
 #elif PLATFORM(GTK)
     IntPoint(const GdkPoint&);
     operator GdkPoint() const;
+#elif PLATFORM(HAIKU)
+    explicit IntPoint(const BPoint&);
+    operator BPoint() const;
 #endif
 
 #if PLATFORM(WX)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/IntRect.h b/src/3rdparty/webkit/WebCore/platform/graphics/IntRect.h
index 6c02d21..7578e6b 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/IntRect.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/IntRect.h
@@ -49,6 +49,8 @@ class QRect;
 QT_END_NAMESPACE
 #elif PLATFORM(GTK)
 typedef struct _GdkRectangle GdkRectangle;
+#elif PLATFORM(HAIKU)
+class BRect;
 #endif
 
 #if PLATFORM(WX)
@@ -144,6 +146,9 @@ public:
 #elif PLATFORM(GTK)
     IntRect(const GdkRectangle&);
     operator GdkRectangle() const;
+#elif PLATFORM(HAIKU)
+    explicit IntRect(const BRect&);
+    operator BRect() const;
 #endif
 
 #if PLATFORM(CG)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/IntSize.h b/src/3rdparty/webkit/WebCore/platform/graphics/IntSize.h
index dc7a85d..b242784 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/IntSize.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/IntSize.h
@@ -47,6 +47,12 @@ typedef struct tagSIZE SIZE;
 QT_BEGIN_NAMESPACE
 class QSize;
 QT_END_NAMESPACE
+#elif PLATFORM(HAIKU)
+class BSize;
+#endif
+
+#if PLATFORM(WX)
+class wxSize;
 #endif
 
 namespace WebCore {
@@ -113,6 +119,15 @@ public:
     operator QSize() const;
 #endif
 
+#if PLATFORM(HAIKU)
+    explicit IntSize(const BSize&);
+    operator BSize() const;
+#endif
+
+#if PLATFORM(WX)
+    IntSize(const wxSize&);
+    operator wxSize() const;
+#endif
 
 private:
     int m_width, m_height;
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.cpp
index d4fab52..20dbc00 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.cpp
@@ -35,9 +35,12 @@
 #include "FrameView.h"
 #include "Frame.h"
 #include "Document.h"
+#include "TimeRanges.h"
 
 #if PLATFORM(MAC)
 #include "MediaPlayerPrivateQTKit.h"
+#elif PLATFORM(WINCE)
+#include "MediaPlayerPrivateWince.h"
 #elif PLATFORM(WIN)
 #include "MediaPlayerPrivateQuickTimeWin.h"
 #elif PLATFORM(GTK)
@@ -67,6 +70,7 @@ public:
     virtual IntSize naturalSize() const { return IntSize(0, 0); }
 
     virtual bool hasVideo() const { return false; }
+    virtual bool hasAudio() const { return false; }
 
     virtual void setVisible(bool) { }
 
@@ -88,7 +92,7 @@ public:
     virtual MediaPlayer::ReadyState readyState() const { return MediaPlayer::HaveNothing; }
 
     virtual float maxTimeSeekable() const { return 0; }
-    virtual float maxTimeBuffered() const { return 0; }
+    virtual PassRefPtr<TimeRanges> buffered() const { return TimeRanges::create(); }
 
     virtual int dataRate() const { return 0; }
 
@@ -316,11 +320,16 @@ IntSize MediaPlayer::naturalSize()
     return m_private->naturalSize();
 }
 
-bool MediaPlayer::hasVideo()
+bool MediaPlayer::hasVideo() const
 {
     return m_private->hasVideo();
 }
 
+bool MediaPlayer::hasAudio() const
+{
+    return m_private->hasAudio();
+}
+
 bool MediaPlayer::inMediaDocument()
 {
     Frame* frame = m_frameView ? m_frameView->frame() : 0;
@@ -382,9 +391,9 @@ void MediaPlayer::setEndTime(float time)
     m_private->setEndTime(time);
 }
 
-float MediaPlayer::maxTimeBuffered()
+PassRefPtr<TimeRanges> MediaPlayer::buffered()
 {
-    return m_private->maxTimeBuffered();
+    return m_private->buffered();
 }
 
 float MediaPlayer::maxTimeSeekable()
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.h b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.h
index 7f5f2a0..4c5ee5b 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -48,6 +48,7 @@ class IntSize;
 class MediaPlayer;
 class MediaPlayerPrivateInterface;
 class String;
+class TimeRanges;
 
 #if USE(ACCELERATED_COMPOSITING)
 class GraphicsLayer;
@@ -110,7 +111,8 @@ public:
     bool supportsFullscreen() const;
     bool supportsSave() const;
     IntSize naturalSize();
-    bool hasVideo();
+    bool hasVideo() const;
+    bool hasAudio() const;
     
     void setFrameView(FrameView* frameView) { m_frameView = frameView; }
     FrameView* frameView() { return m_frameView; }
@@ -145,7 +147,7 @@ public:
     bool preservesPitch() const;    
     void setPreservesPitch(bool);
     
-    float maxTimeBuffered();
+    PassRefPtr<TimeRanges> buffered();
     float maxTimeSeekable();
 
     unsigned bytesLoaded();
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayerPrivate.h b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayerPrivate.h
index 6d1359b..9cc89c5 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayerPrivate.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayerPrivate.h
@@ -52,6 +52,7 @@ public:
     virtual IntSize naturalSize() const = 0;
 
     virtual bool hasVideo() const = 0;
+    virtual bool hasAudio() const = 0;
 
     virtual void setVisible(bool) = 0;
 
@@ -76,7 +77,7 @@ public:
     virtual MediaPlayer::ReadyState readyState() const = 0;
 
     virtual float maxTimeSeekable() const = 0;
-    virtual float maxTimeBuffered() const = 0;
+    virtual PassRefPtr<TimeRanges> buffered() const = 0;
 
     virtual int dataRate() const = 0;
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/Path.h b/src/3rdparty/webkit/WebCore/platform/graphics/Path.h
index 0471724..26927a1 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/Path.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/Path.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2003, 2006, 2009 Apple Inc. All rights reserved.
  *               2006 Rob Buis <buis@kde.org>
+ * Copyright (C) 2007-2008 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -48,6 +49,13 @@ typedef WebCore::CairoPath PlatformPath;
 #elif PLATFORM(SKIA)
 class SkPath;
 typedef SkPath PlatformPath;
+#elif PLATFORM(HAIKU)
+class BRegion;
+typedef BRegion PlatformPath;
+#elif PLATFORM(WINCE)
+namespace WebCore {
+    class PlatformPath;
+}
 #else
 typedef void PlatformPath;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/Pattern.h b/src/3rdparty/webkit/WebCore/platform/graphics/Pattern.h
index d4aa3b9..aa0a357 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/Pattern.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/Pattern.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2006, 2007, 2008 Apple Computer, Inc.  All rights reserved.
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
+ * Copyright (C) 2007-2008 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -52,6 +53,11 @@ typedef wxGraphicsBrush* PlatformPatternPtr;
 class wxBrush;
 typedef wxBrush* PlatformPatternPtr;
 #endif // USE(WXGC)
+#elif PLATFORM(HAIKU)
+#include <interface/GraphicsDefs.h>
+typedef pattern* PlatformPatternPtr;
+#elif PLATFORM(WINCE)
+typedef void* PlatformPatternPtr;
 #endif
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/SimpleFontData.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/SimpleFontData.cpp
index c879228..2ec8abb 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/SimpleFontData.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/SimpleFontData.cpp
@@ -48,7 +48,9 @@ using namespace std;
 namespace WebCore {
 
 SimpleFontData::SimpleFontData(const FontPlatformData& f, bool customFont, bool loading, SVGFontData* svgFontData)
-    : m_unitsPerEm(defaultUnitsPerEm)
+    : m_maxCharWidth(-1)
+    , m_avgCharWidth(-1)
+    , m_unitsPerEm(defaultUnitsPerEm)
     , m_platformData(f)
     , m_treatAsFixedPitch(false)
 #if ENABLE(SVG_FONTS)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/SimpleFontData.h b/src/3rdparty/webkit/WebCore/platform/graphics/SimpleFontData.h
index cb472b0..d326658 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/SimpleFontData.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/SimpleFontData.h
@@ -2,6 +2,7 @@
  * This file is part of the internal font implementation.
  *
  * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007-2008 Torch Mobile, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -33,7 +34,7 @@
 typedef struct OpaqueATSUStyle* ATSUStyle;
 #endif
 
-#if PLATFORM(WIN)
+#if PLATFORM(WIN) && !PLATFORM(WINCE)
 #include <usp10.h>
 #endif
 
@@ -45,6 +46,10 @@ typedef struct OpaqueATSUStyle* ATSUStyle;
 #include <QFont>
 #endif
 
+#if PLATFORM(HAIKU)
+#include <Font.h>
+#endif
+
 namespace WebCore {
 
 class FontDescription;
@@ -134,17 +139,14 @@ public:
 
 #if PLATFORM(WIN)
     bool isSystemFont() const { return m_isSystemFont; }
+#if !PLATFORM(WINCE)    // disable unused members to save space
     SCRIPT_FONTPROPERTIES* scriptFontProperties() const;
     SCRIPT_CACHE* scriptCache() const { return &m_scriptCache; }
-
+#endif
     static void setShouldApplyMacAscentHack(bool);
     static bool shouldApplyMacAscentHack();
 #endif
 
-#if PLATFORM(CAIRO)
-    void setFont(cairo_t*) const;
-#endif
-
 #if PLATFORM(WX)
     wxFont* getWxFont() const { return m_platformData.font(); }
 #endif
@@ -159,7 +161,7 @@ private:
 
     void commonInit();
 
-#if PLATFORM(WIN)
+#if PLATFORM(WIN) && !PLATFORM(WINCE)
     void initGDIFont();
     void platformCommonDestroy();
     float widthForGDIGlyph(Glyph glyph) const;
@@ -224,9 +226,11 @@ private:
 
 #if PLATFORM(WIN)
     bool m_isSystemFont;
+#if !PLATFORM(WINCE)    // disable unused members to save space
     mutable SCRIPT_CACHE m_scriptCache;
     mutable SCRIPT_FONTPROPERTIES* m_scriptFontProperties;
 #endif
+#endif
 };
     
     
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEBlend.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEBlend.cpp
index 86b702f..2364cc4 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEBlend.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEBlend.cpp
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
                   2005 Eric Seidel <eric@webkit.org>
+                  2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -24,7 +25,13 @@
 #if ENABLE(FILTERS)
 #include "FEBlend.h"
 
+#include "CanvasPixelArray.h"
 #include "Filter.h"
+#include "FloatPoint.h"
+#include "GraphicsContext.h"
+#include "ImageData.h"
+
+typedef unsigned char (*BlendType)(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char alphaB);
 
 namespace WebCore {
 
@@ -61,8 +68,77 @@ void FEBlend::setBlendMode(BlendModeType mode)
     m_mode = mode;
 }
 
-void FEBlend::apply(Filter*)
+static unsigned char unknown(unsigned char, unsigned char, unsigned char, unsigned char)
+{
+    return 0;
+}
+
+static unsigned char normal(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char)
+{
+    return (((255 - alphaA) * colorB + colorA * 255) / 255);
+}
+
+static unsigned char multiply(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char alphaB)
+{
+    return (((255 - alphaA) * colorB + (255 - alphaB + colorB) * colorA) / 255);
+}
+
+static unsigned char screen(unsigned char colorA, unsigned char colorB, unsigned char, unsigned char)
+{
+    return (((colorB + colorA) * 255 - colorA * colorB) / 255);
+}
+
+static unsigned char darken(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char alphaB)
+{
+    return ((std::min((255 - alphaA) * colorB + colorA * 255, (255 - alphaB) * colorA + colorB * 255)) / 255);
+}
+
+static unsigned char lighten(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char alphaB)
 {
+    return ((std::max((255 - alphaA) * colorB + colorA * 255, (255 - alphaB) * colorA + colorB * 255)) / 255);
+}
+
+void FEBlend::apply(Filter* filter)
+{
+    m_in->apply(filter);
+    m_in2->apply(filter);
+    if (!m_in->resultImage() || !m_in2->resultImage())
+        return;
+
+    if (m_mode == FEBLEND_MODE_UNKNOWN)
+        return;
+
+    if (!getEffectContext())
+        return;
+
+    IntRect effectADrawingRect = calculateDrawingIntRect(m_in->subRegion());
+    RefPtr<CanvasPixelArray> srcPixelArrayA(m_in->resultImage()->getPremultipliedImageData(effectADrawingRect)->data());
+
+    IntRect effectBDrawingRect = calculateDrawingIntRect(m_in2->subRegion());
+    RefPtr<CanvasPixelArray> srcPixelArrayB(m_in2->resultImage()->getPremultipliedImageData(effectBDrawingRect)->data());
+
+    IntRect imageRect(IntPoint(), resultImage()->size());
+    RefPtr<ImageData> imageData = ImageData::create(imageRect.width(), imageRect.height());
+
+    // Keep synchronized with BlendModeType
+    static const BlendType callEffect[] = {unknown, normal, multiply, screen, darken, lighten};
+
+    ASSERT(srcPixelArrayA->length() == srcPixelArrayB->length());
+    for (unsigned pixelOffset = 0; pixelOffset < srcPixelArrayA->length(); pixelOffset += 4) {
+        unsigned char alphaA = srcPixelArrayA->get(pixelOffset + 3);
+        unsigned char alphaB = srcPixelArrayB->get(pixelOffset + 3);
+        for (unsigned channel = 0; channel < 3; ++channel) {
+            unsigned char colorA = srcPixelArrayA->get(pixelOffset + channel);
+            unsigned char colorB = srcPixelArrayB->get(pixelOffset + channel);
+
+            unsigned char result = (*callEffect[m_mode])(colorA, colorB, alphaA, alphaB);
+            imageData->data()->set(pixelOffset + channel, result);
+        }
+        unsigned char alphaR = 255 - ((255 - alphaA) * (255 - alphaB)) / 255;
+        imageData->data()->set(pixelOffset + 3, alphaR);
+    }
+
+    resultImage()->putPremultipliedImageData(imageData.get(), imageRect, IntPoint());
 }
 
 void FEBlend::dump()
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEBlend.h b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEBlend.h
index b09cd72..31c625f 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEBlend.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEBlend.h
@@ -41,7 +41,7 @@ namespace WebCore {
     class FEBlend : public FilterEffect {
     public:
         static PassRefPtr<FEBlend> create(FilterEffect*, FilterEffect*, BlendModeType);
-        
+
         FilterEffect* in2() const;
         void setIn2(FilterEffect*);
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEColorMatrix.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEColorMatrix.cpp
index 8704e64..1e2e552 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEColorMatrix.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEColorMatrix.cpp
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
                   2005 Eric Seidel <eric@webkit.org>
+                  2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -24,7 +25,11 @@
 #if ENABLE(FILTERS)
 #include "FEColorMatrix.h"
 
+#include "CanvasPixelArray.h"
 #include "Filter.h"
+#include "GraphicsContext.h"
+#include "ImageData.h"
+#include <math.h>
 
 namespace WebCore {
 
@@ -61,8 +66,127 @@ void FEColorMatrix::setValues(const Vector<float> &values)
     m_values = values;
 }
 
-void FEColorMatrix::apply(Filter*)
+inline void matrix(double& red, double& green, double& blue, double& alpha, const Vector<float>& values)
 {
+    double r = values[0]  * red + values[1]  * green + values[2]  * blue + values[3]  * alpha;
+    double g = values[5]  * red + values[6]  * green + values[7]  * blue + values[8]  * alpha;
+    double b = values[10]  * red + values[11]  * green + values[12] * blue + values[13] * alpha;
+    double a = values[15] * red + values[16] * green + values[17] * blue + values[18] * alpha;
+
+    red = r;
+    green = g;
+    blue = b;
+    alpha = a;
+}
+
+inline void saturate(double& red, double& green, double& blue, const float& s)
+{
+    double r = (0.213 + 0.787 * s) * red + (0.715 - 0.715 * s) * green + (0.072 - 0.072 * s) * blue;
+    double g = (0.213 - 0.213 * s) * red + (0.715 + 0.285 * s) * green + (0.072 - 0.072 * s) * blue;
+    double b = (0.213 - 0.213 * s) * red + (0.715 - 0.715 * s) * green + (0.072 + 0.928 * s) * blue;
+
+    red = r;
+    green = g;
+    blue = b;
+}
+
+inline void huerotate(double& red, double& green, double& blue, const float& hue)
+{
+    double cosHue = cos(hue * M_PI / 180); 
+    double sinHue = sin(hue * M_PI / 180); 
+    double r = red   * (0.213 + cosHue * 0.787 - sinHue * 0.213) +
+               green * (0.715 - cosHue * 0.715 - sinHue * 0.715) +
+               blue  * (0.072 - cosHue * 0.072 + sinHue * 0.928);
+    double g = red   * (0.213 - cosHue * 0.213 + sinHue * 0.143) +
+               green * (0.715 + cosHue * 0.285 + sinHue * 0.140) +
+               blue  * (0.072 - cosHue * 0.072 - sinHue * 0.283);
+    double b = red   * (0.213 - cosHue * 0.213 - sinHue * 0.787) +
+               green * (0.715 - cosHue * 0.715 + sinHue * 0.715) +
+               blue  * (0.072 + cosHue * 0.928 + sinHue * 0.072);
+
+    red = r;
+    green = g;
+    blue = b;
+}
+
+inline void luminance(double& red, double& green, double& blue, double& alpha)
+{
+    alpha = 0.2125 * red + 0.7154 * green + 0.0721 * blue;
+    red = 0.;
+    green = 0.;
+    blue = 0.;
+}
+
+template<ColorMatrixType filterType>
+void effectType(const PassRefPtr<CanvasPixelArray>& srcPixelArray, PassRefPtr<ImageData>& imageData, const Vector<float>& values)
+{
+    for (unsigned pixelOffset = 0; pixelOffset < srcPixelArray->length(); pixelOffset++) {
+        unsigned pixelByteOffset = pixelOffset * 4;
+
+        unsigned char r = 0, g = 0, b = 0, a = 0;
+        srcPixelArray->get(pixelByteOffset, r);
+        srcPixelArray->get(pixelByteOffset + 1, g);
+        srcPixelArray->get(pixelByteOffset + 2, b);
+        srcPixelArray->get(pixelByteOffset + 3, a);
+
+        double red = r, green = g, blue = b, alpha = a;
+        
+        switch (filterType) {
+            case FECOLORMATRIX_TYPE_MATRIX:
+                matrix(red, green, blue, alpha, values);
+                break;
+            case FECOLORMATRIX_TYPE_SATURATE: 
+                saturate(red, green, blue, values[0]);
+                break;
+            case FECOLORMATRIX_TYPE_HUEROTATE:
+                huerotate(red, green, blue, values[0]);
+                break;
+            case FECOLORMATRIX_TYPE_LUMINANCETOALPHA:
+                luminance(red, green, blue, alpha);
+                break;
+        }
+
+        imageData->data()->set(pixelByteOffset, red);
+        imageData->data()->set(pixelByteOffset + 1, green);
+        imageData->data()->set(pixelByteOffset + 2, blue);
+        imageData->data()->set(pixelByteOffset + 3, alpha);
+    }
+}
+
+void FEColorMatrix::apply(Filter* filter)
+{
+    m_in->apply(filter);
+    if (!m_in->resultImage())
+        return;
+
+    GraphicsContext* filterContext = getEffectContext();
+    if (!filterContext)
+        return;
+
+    filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()));
+
+    IntRect imageRect(IntPoint(), resultImage()->size());
+    PassRefPtr<ImageData> imageData(resultImage()->getUnmultipliedImageData(imageRect));
+    PassRefPtr<CanvasPixelArray> srcPixelArray(imageData->data());
+
+    switch (m_type) {
+        case FECOLORMATRIX_TYPE_UNKNOWN:
+            break;
+        case FECOLORMATRIX_TYPE_MATRIX:
+            effectType<FECOLORMATRIX_TYPE_MATRIX>(srcPixelArray, imageData, m_values);
+            break;
+        case FECOLORMATRIX_TYPE_SATURATE: 
+            effectType<FECOLORMATRIX_TYPE_SATURATE>(srcPixelArray, imageData, m_values);
+            break;
+        case FECOLORMATRIX_TYPE_HUEROTATE:
+            effectType<FECOLORMATRIX_TYPE_HUEROTATE>(srcPixelArray, imageData, m_values);
+            break;
+        case FECOLORMATRIX_TYPE_LUMINANCETOALPHA:
+            effectType<FECOLORMATRIX_TYPE_LUMINANCETOALPHA>(srcPixelArray, imageData, m_values);
+            break;
+    }
+
+    resultImage()->putUnmultipliedImageData(imageData.get(), imageRect, IntPoint());
 }
 
 void FEColorMatrix::dump()
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComponentTransfer.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
index 54ac123..43e5edd 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
                   2005 Eric Seidel <eric@webkit.org>
+                  2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -24,10 +25,16 @@
 #if ENABLE(FILTERS)
 #include "FEComponentTransfer.h"
 
+#include "CanvasPixelArray.h"
 #include "Filter.h"
+#include "GraphicsContext.h"
+#include "ImageData.h"
+#include <math.h>
 
 namespace WebCore {
 
+typedef void (*TransferType)(unsigned char*, const ComponentTransferFunction&);
+
 FEComponentTransfer::FEComponentTransfer(FilterEffect* in, const ComponentTransferFunction& redFunc, 
     const ComponentTransferFunction& greenFunc, const ComponentTransferFunction& blueFunc, const ComponentTransferFunction& alphaFunc)
     : FilterEffect()
@@ -85,8 +92,91 @@ void FEComponentTransfer::setAlphaFunction(const ComponentTransferFunction& func
     m_alphaFunc = func;
 }
 
-void FEComponentTransfer::apply(Filter*)
+void identity(unsigned char*, const ComponentTransferFunction&)
+{
+}
+
+void table(unsigned char* values, const ComponentTransferFunction& transferFunction)
+{
+    const Vector<float>& tableValues = transferFunction.tableValues;
+    unsigned n = tableValues.size();
+    if (n < 1)
+        return;            
+    for (unsigned i = 0; i < 256; ++i) {
+        double c = i / 255.0;                
+        unsigned k = static_cast<unsigned>(c * (n - 1));
+        double v1 = tableValues[k];
+        double v2 = tableValues[std::min((k + 1), (n - 1))];
+        double val = 255.0 * (v1 + (c * (n - 1) - k) * (v2 - v1));
+        val = std::max(0.0, std::min(255.0, val));
+        values[i] = static_cast<unsigned char>(val);
+    }
+}
+
+void discrete(unsigned char* values, const ComponentTransferFunction& transferFunction)
+{
+    const Vector<float>& tableValues = transferFunction.tableValues;
+    unsigned n = tableValues.size();
+    if (n < 1)
+        return;
+    for (unsigned i = 0; i < 256; ++i) {
+        unsigned k = static_cast<unsigned>((i * n) / 255.0);
+        k = std::min(k, n - 1);
+        double val = 255 * tableValues[k];
+        val = std::max(0.0, std::min(255.0, val));
+        values[i] = static_cast<unsigned char>(val);
+    }
+}
+
+void linear(unsigned char* values, const ComponentTransferFunction& transferFunction)
+{
+    for (unsigned i = 0; i < 256; ++i) {
+        double val = transferFunction.slope * i + 255 * transferFunction.intercept;
+        val = std::max(0.0, std::min(255.0, val));
+        values[i] = static_cast<unsigned char>(val);
+    }
+}
+
+void gamma(unsigned char* values, const ComponentTransferFunction& transferFunction)
+{
+    for (unsigned i = 0; i < 256; ++i) {
+        double val = 255.0 * (transferFunction.amplitude * pow((i / 255.0), transferFunction.exponent) + transferFunction.offset);
+        val = std::max(0.0, std::min(255.0, val));
+        values[i] = static_cast<unsigned char>(val);
+    }
+}
+
+void FEComponentTransfer::apply(Filter* filter)
 {
+    m_in->apply(filter);
+    if (!m_in->resultImage())
+        return;
+
+    if (!getEffectContext())
+        return;
+
+    unsigned char rValues[256], gValues[256], bValues[256], aValues[256];
+    for (unsigned i = 0; i < 256; ++i)
+        rValues[i] = gValues[i] = bValues[i] = aValues[i] = i;
+    unsigned char* tables[] = { rValues, gValues, bValues, aValues };
+    ComponentTransferFunction transferFunction[] = {m_redFunc, m_greenFunc, m_blueFunc, m_alphaFunc};
+    TransferType callEffect[] = {identity, identity, table, discrete, linear, gamma};
+
+    for (unsigned channel = 0; channel < 4; channel++)
+        (*callEffect[transferFunction[channel].type])(tables[channel], transferFunction[channel]);
+
+    IntRect drawingRect = calculateDrawingIntRect(m_in->subRegion());
+    RefPtr<ImageData> imageData(m_in->resultImage()->getUnmultipliedImageData(drawingRect));
+    CanvasPixelArray* srcPixelArray(imageData->data());
+
+    for (unsigned pixelOffset = 0; pixelOffset < srcPixelArray->length(); pixelOffset += 4) {
+        for (unsigned channel = 0; channel < 4; ++channel) {
+            unsigned char c = srcPixelArray->get(pixelOffset + channel);
+            imageData->data()->set(pixelOffset + channel, tables[channel][c]);
+        }
+    }
+
+    resultImage()->putUnmultipliedImageData(imageData.get(), IntRect(IntPoint(), resultImage()->size()), IntPoint());
 }
 
 void FEComponentTransfer::dump()
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.cpp
index 43ebf33..5818e50 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.cpp
@@ -59,6 +59,13 @@ FloatRect FilterEffect::calculateEffectRect(Filter* filter)
     return subRegion();
 }
 
+IntRect FilterEffect::calculateDrawingIntRect(const FloatRect& effectRect)
+{
+    IntPoint location = roundedIntPoint(FloatPoint(subRegion().x() - effectRect.x(),
+                                                   subRegion().y() - effectRect.y()));
+    return IntRect(location, resultImage()->size());
+}
+
 FloatRect FilterEffect::calculateDrawingRect(const FloatRect& srcRect)
 {
     FloatPoint startPoint = FloatPoint(srcRect.x() - subRegion().x(), srcRect.y() - subRegion().y());
@@ -69,7 +76,7 @@ FloatRect FilterEffect::calculateDrawingRect(const FloatRect& srcRect)
 GraphicsContext* FilterEffect::getEffectContext()
 {
     IntRect bufferRect = enclosingIntRect(subRegion());
-    m_effectBuffer = ImageBuffer::create(bufferRect.size(), false);
+    m_effectBuffer = ImageBuffer::create(bufferRect.size(), LinearRGB);
     return m_effectBuffer->context();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.h b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.h
index 8dc6233..e2b8a0e 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/filters/FilterEffect.h
@@ -77,6 +77,7 @@ namespace WebCore {
 
         GraphicsContext* getEffectContext();
         FloatRect calculateDrawingRect(const FloatRect&);
+        IntRect calculateDrawingIntRect(const FloatRect&);
 
         virtual FloatRect uniteChildEffectSubregions(Filter* filter) { return filter->filterRegion(); }
         virtual FloatRect calculateEffectRect(Filter*);
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp
index 895887f..b2e3d92 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008, 2009 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -339,7 +340,10 @@ bool getEOTHeader(SharedBuffer* fontData, EOTHeader& eotHeader, size_t& overlayD
     return true;
 }
 
-HANDLE renameAndActivateFont(SharedBuffer* fontData, const String& fontName)
+// code shared by renameFont and renameAndActivateFont
+// adds fontName to the font table in fontData, and writes the new font table to rewrittenFontTable
+// returns the size of the name table (which is used by renameAndActivateFont), or 0 on early abort
+static size_t renameFontInternal(SharedBuffer* fontData, const String& fontName, Vector<char> &rewrittenFontData)
 {
     size_t originalDataSize = fontData->size();
     const sfntHeader* sfnt = reinterpret_cast<const sfntHeader*>(fontData->data());
@@ -357,7 +361,7 @@ HANDLE renameAndActivateFont(SharedBuffer* fontData, const String& fontName)
     // Rounded up to a multiple of 4 to simplify the checksum calculation.
     size_t nameTableSize = ((offsetof(nameTable, nameRecords) + nameRecordCount * sizeof(nameRecord) + fontName.length() * sizeof(UChar)) & ~3) + 4;
 
-    Vector<char> rewrittenFontData(fontData->size() + nameTableSize);
+    rewrittenFontData.resize(fontData->size() + nameTableSize);
     char* data = rewrittenFontData.data();
     memcpy(data, fontData->data(), originalDataSize);
 
@@ -394,8 +398,42 @@ HANDLE renameAndActivateFont(SharedBuffer* fontData, const String& fontName)
     for (unsigned i = 0; i * sizeof(BigEndianULong) < nameTableSize; ++i)
         rewrittenSfnt->tables[t].checkSum = rewrittenSfnt->tables[t].checkSum + reinterpret_cast<BigEndianULong*>(name)[i];
 
+    return nameTableSize;
+}
+
+#if PLATFORM(WINCE)
+// AddFontMemResourceEx does not exist on WinCE, so we must handle the font data manually
+// This function just renames the font and overwrites the old font data with the new
+bool renameFont(SharedBuffer* fontData, const String& fontName)
+{
+    // abort if the data is too small to be a font header with a "tables" entry
+    if (fontData->size() < offsetof(sfntHeader, tables))
+        return false;
+
+    // abort if the data is too small to hold all the tables specified in the header
+    const sfntHeader* header = reinterpret_cast<const sfntHeader*>(fontData->data());
+    if (fontData->size() < offsetof(sfntHeader, tables) + header->numTables * sizeof(TableDirectoryEntry))
+        return false;
+
+    Vector<char> rewrittenFontData;
+    if (!renameFontInternal(fontData, fontName, rewrittenFontData))
+        return false;
+
+    fontData->clear();
+    fontData->append(rewrittenFontData.data(), rewrittenFontData.size());
+    return true;
+}
+#else
+// Rename the font and install the new font data into the system
+HANDLE renameAndActivateFont(SharedBuffer* fontData, const String& fontName)
+{
+    Vector<char> rewrittenFontData;
+    size_t nameTableSize = renameFontInternal(fontData, fontName, rewrittenFontData);
+    if (!nameTableSize)
+        return 0;
+
     DWORD numFonts = 0;
-    HANDLE fontHandle = AddFontMemResourceEx(data, originalDataSize + nameTableSize, 0, &numFonts);
+    HANDLE fontHandle = AddFontMemResourceEx(rewrittenFontData.data(), fontData->size() + nameTableSize, 0, &numFonts);
 
     if (fontHandle && numFonts != 1) {
         RemoveFontMemResourceEx(fontHandle);
@@ -404,5 +442,6 @@ HANDLE renameAndActivateFont(SharedBuffer* fontData, const String& fontName)
 
     return fontHandle;
 }
+#endif
 
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/opentype/OpenTypeUtilities.h b/src/3rdparty/webkit/WebCore/platform/graphics/opentype/OpenTypeUtilities.h
index 13dad6f..4c75314 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/opentype/OpenTypeUtilities.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/opentype/OpenTypeUtilities.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008, 2009 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,6 +36,10 @@ struct BigEndianUShort;
 struct EOTPrefix;
 class SharedBuffer;
 
+#if PLATFORM(WINCE)
+typedef unsigned __int8 UInt8;
+#endif
+
 struct EOTHeader {
     EOTHeader();
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontCacheQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontCacheQt.cpp
index 5d29389..aa79cb9 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontCacheQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontCacheQt.cpp
@@ -58,8 +58,8 @@ class FontPlatformDataCacheKey {
 public:
     FontPlatformDataCacheKey(const FontDescription& description)
         : m_familyName()
-        , m_bold(false)
         , m_size(description.computedPixelSize())
+        , m_bold(false)
         , m_italic(description.italic())
         , m_smallCaps(description.smallCaps())
         , m_hash(0)
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontQt.cpp
index f89ff9f..e8eb923 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/FontQt.cpp
@@ -221,7 +221,10 @@ FloatRect Font::selectionRectForComplexText(const TextRun& run, const IntPoint&
 
 QFont Font::font() const
 {
-    return primaryFont()->getQtFont();
+    QFont f = primaryFont()->getQtFont();
+    f.setLetterSpacing(QFont::AbsoluteSpacing, m_letterSpacing);
+    f.setWordSpacing(m_wordSpacing);
+    return f;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
index a35c5ac..2f367fa 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
@@ -34,29 +34,29 @@
  */
 
 #include "config.h"
+#include "GraphicsContext.h"
 
 #ifdef Q_WS_WIN
 #include <windows.h>
 #endif
 
-#include "TransformationMatrix.h"
 #include "Color.h"
 #include "FloatConversion.h"
 #include "Font.h"
-#include "GraphicsContext.h"
 #include "GraphicsContextPrivate.h"
 #include "ImageBuffer.h"
+#include "NotImplemented.h"
 #include "Path.h"
 #include "Pattern.h"
 #include "Pen.h"
-#include "NotImplemented.h"
+#include "TransformationMatrix.h"
 
 #include <QBrush>
 #include <QDebug>
 #include <QGradient>
-#include <QPainter>
 #include <QPaintDevice>
 #include <QPaintEngine>
+#include <QPainter>
 #include <QPainterPath>
 #include <QPixmap>
 #include <QPolygonF>
@@ -72,34 +72,35 @@ namespace WebCore {
 static inline QPainter::CompositionMode toQtCompositionMode(CompositeOperator op)
 {
     switch (op) {
-        case CompositeClear:
-            return QPainter::CompositionMode_Clear;
-        case CompositeCopy:
-            return QPainter::CompositionMode_Source;
-        case CompositeSourceOver:
-            return QPainter::CompositionMode_SourceOver;
-        case CompositeSourceIn:
-            return QPainter::CompositionMode_SourceIn;
-        case CompositeSourceOut:
-            return QPainter::CompositionMode_SourceOut;
-        case CompositeSourceAtop:
-            return QPainter::CompositionMode_SourceAtop;
-        case CompositeDestinationOver:
-            return QPainter::CompositionMode_DestinationOver;
-        case CompositeDestinationIn:
-            return QPainter::CompositionMode_DestinationIn;
-        case CompositeDestinationOut:
-            return QPainter::CompositionMode_DestinationOut;
-        case CompositeDestinationAtop:
-            return QPainter::CompositionMode_DestinationAtop;
-        case CompositeXOR:
-            return QPainter::CompositionMode_Xor;
-        case CompositePlusDarker:
-            return QPainter::CompositionMode_SourceOver;
-        case CompositeHighlight:
-            return QPainter::CompositionMode_SourceOver;
-        case CompositePlusLighter:
-            return QPainter::CompositionMode_Plus;
+    case CompositeClear:
+        return QPainter::CompositionMode_Clear;
+    case CompositeCopy:
+        return QPainter::CompositionMode_Source;
+    case CompositeSourceOver:
+        return QPainter::CompositionMode_SourceOver;
+    case CompositeSourceIn:
+        return QPainter::CompositionMode_SourceIn;
+    case CompositeSourceOut:
+        return QPainter::CompositionMode_SourceOut;
+    case CompositeSourceAtop:
+        return QPainter::CompositionMode_SourceAtop;
+    case CompositeDestinationOver:
+        return QPainter::CompositionMode_DestinationOver;
+    case CompositeDestinationIn:
+        return QPainter::CompositionMode_DestinationIn;
+    case CompositeDestinationOut:
+        return QPainter::CompositionMode_DestinationOut;
+    case CompositeDestinationAtop:
+        return QPainter::CompositionMode_DestinationAtop;
+    case CompositeXOR:
+        return QPainter::CompositionMode_Xor;
+    case CompositePlusDarker:
+        // there is no exact match, but this is the closest
+        return QPainter::CompositionMode_Darken;
+    case CompositeHighlight:
+        return QPainter::CompositionMode_SourceOver;
+    case CompositePlusLighter:
+        return QPainter::CompositionMode_Plus;
     }
 
     return QPainter::CompositionMode_SourceOver;
@@ -108,12 +109,12 @@ static inline QPainter::CompositionMode toQtCompositionMode(CompositeOperator op
 static inline Qt::PenCapStyle toQtLineCap(LineCap lc)
 {
     switch (lc) {
-        case ButtCap:
-            return Qt::FlatCap;
-        case RoundCap:
-            return Qt::RoundCap;
-        case SquareCap:
-            return Qt::SquareCap;
+    case ButtCap:
+        return Qt::FlatCap;
+    case RoundCap:
+        return Qt::RoundCap;
+    case SquareCap:
+        return Qt::SquareCap;
     }
 
     return Qt::FlatCap;
@@ -122,12 +123,12 @@ static inline Qt::PenCapStyle toQtLineCap(LineCap lc)
 static inline Qt::PenJoinStyle toQtLineJoin(LineJoin lj)
 {
     switch (lj) {
-        case MiterJoin:
-            return Qt::SvgMiterJoin;
-        case RoundJoin:
-            return Qt::RoundJoin;
-        case BevelJoin:
-            return Qt::BevelJoin;
+    case MiterJoin:
+        return Qt::SvgMiterJoin;
+    case RoundJoin:
+        return Qt::RoundJoin;
+    case BevelJoin:
+        return Qt::BevelJoin;
     }
 
     return Qt::MiterJoin;
@@ -209,8 +210,8 @@ public:
                 return redirect;
 
             return painter;
-        } else
-            return &layers.top()->painter;
+        }
+        return &layers.top()->painter;
     }
 
     bool antiAliasingForRectsAndLines;
@@ -410,46 +411,25 @@ void GraphicsContext::drawRect(const IntRect& rect)
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     const bool antiAlias = p->testRenderHint(QPainter::Antialiasing);
     p->setRenderHint(QPainter::Antialiasing, m_data->antiAliasingForRectsAndLines);
 
+    IntSize shadowSize;
+    int shadowBlur;
+    Color shadowColor;
+    if (getShadow(shadowSize, shadowBlur, shadowColor)) {
+        IntRect shadowRect = rect;
+        shadowRect.move(shadowSize.width(), shadowSize.height());
+        shadowRect.inflate(static_cast<int>(p->pen().widthF()));
+        p->fillRect(shadowRect, shadowColor);
+    }
+
     p->drawRect(rect);
 
     p->setRenderHint(QPainter::Antialiasing, antiAlias);
 }
 
-// FIXME: Now that this is refactored, it should be shared by all contexts.
-static void adjustLineToPixelBoundaries(FloatPoint& p1, FloatPoint& p2, float strokeWidth,
-                                        const StrokeStyle& penStyle)
-{
-    // For odd widths, we add in 0.5 to the appropriate x/y so that the float arithmetic
-    // works out.  For example, with a border width of 3, KHTML will pass us (y1+y2)/2, e.g.,
-    // (50+53)/2 = 103/2 = 51 when we want 51.5.  It is always true that an even width gave
-    // us a perfect position, but an odd width gave us a position that is off by exactly 0.5.
-    if (penStyle == DottedStroke || penStyle == DashedStroke) {
-        if (p1.x() == p2.x()) {
-            p1.setY(p1.y() + strokeWidth);
-            p2.setY(p2.y() - strokeWidth);
-        } else {
-            p1.setX(p1.x() + strokeWidth);
-            p2.setX(p2.x() - strokeWidth);
-        }
-    }
-
-    if (((int) strokeWidth) % 2) {
-        if (p1.x() == p2.x()) {
-            // We're a vertical line.  Adjust our x.
-            p1.setX(p1.x() + 0.5);
-            p2.setX(p2.x() + 0.5);
-        } else {
-            // We're a horizontal line. Adjust our y.
-            p1.setY(p1.y() + 0.5);
-            p2.setY(p2.y() + 0.5);
-        }
-    }
-}
-
 // This is only used to draw borders.
 void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
 {
@@ -467,7 +447,7 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
     FloatPoint p2 = point2;
     bool isVerticalLine = (p1.x() == p2.x());
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     const bool antiAlias = p->testRenderHint(QPainter::Antialiasing);
     p->setRenderHint(QPainter::Antialiasing, m_data->antiAliasingForRectsAndLines);
     adjustLineToPixelBoundaries(p1, p2, width, style);
@@ -478,22 +458,22 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
     if (textDrawingMode() == cTextFill && getShadow(shadowSize, shadowBlur, shadowColor)) {
         p->save();
         p->translate(shadowSize.width(), shadowSize.height());
-        p->setPen(QColor(shadowColor));
+        p->setPen(shadowColor);
         p->drawLine(p1, p2);
         p->restore();
     }
 
     int patWidth = 0;
     switch (style) {
-        case NoStroke:
-        case SolidStroke:
-            break;
-        case DottedStroke:
-            patWidth = (int)width;
-            break;
-        case DashedStroke:
-            patWidth = 3 * (int)width;
-            break;
+    case NoStroke:
+    case SolidStroke:
+        break;
+    case DottedStroke:
+        patWidth = static_cast<int>(width);
+        break;
+    case DashedStroke:
+        patWidth = 3 * static_cast<int>(width);
+        break;
     }
 
     if (patWidth) {
@@ -502,11 +482,11 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
         // Do a rect fill of our endpoints.  This ensures we always have the
         // appearance of being a border.  We then draw the actual dotted/dashed line.
         if (isVerticalLine) {
-            p->fillRect(FloatRect(p1.x() - width / 2, p1.y() - width, width, width), QColor(color));
-            p->fillRect(FloatRect(p2.x() - width / 2, p2.y(), width, width), QColor(color));
+            p->fillRect(FloatRect(p1.x() - width / 2, p1.y() - width, width, width), color);
+            p->fillRect(FloatRect(p2.x() - width / 2, p2.y(), width, width), color);
         } else {
-            p->fillRect(FloatRect(p1.x() - width, p1.y() - width / 2, width, width), QColor(color));
-            p->fillRect(FloatRect(p2.x(), p2.y() - width / 2, width, width), QColor(color));
+            p->fillRect(FloatRect(p1.x() - width, p1.y() - width / 2, width, width), color);
+            p->fillRect(FloatRect(p2.x(), p2.y() - width / 2, width, width), color);
         }
 
         // Example: 80 pixels with a width of 30 pixels.
@@ -522,7 +502,7 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
         if (patWidth == 1)
             patternOffset = 1.0f;
         else {
-            bool evenNumberOfSegments = numSegments % 2 == 0;
+            bool evenNumberOfSegments = !(numSegments % 2);
             if (remainder)
                 evenNumberOfSegments = !evenNumberOfSegments;
             if (evenNumberOfSegments) {
@@ -570,11 +550,25 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
     if (paintingDisabled() || strokeStyle() == NoStroke || strokeThickness() <= 0.0f || !strokeColor().alpha())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     const bool antiAlias = p->testRenderHint(QPainter::Antialiasing);
     p->setRenderHint(QPainter::Antialiasing, true);
 
-    p->drawArc(rect, startAngle * 16, angleSpan * 16);
+    IntSize shadowSize;
+    int shadowBlur;
+    Color shadowColor;
+    startAngle *= 16;
+    angleSpan *= 16;
+    if (getShadow(shadowSize, shadowBlur, shadowColor)) {
+        p->save();
+        p->translate(shadowSize.width(), shadowSize.height());
+        QPen pen(p->pen());
+        pen.setColor(shadowColor);
+        p->setPen(pen);
+        p->drawArc(rect, startAngle, angleSpan);
+        p->restore();
+    }
+    p->drawArc(rect, startAngle, angleSpan);
 
     p->setRenderHint(QPainter::Antialiasing, antiAlias);
 }
@@ -592,9 +586,25 @@ void GraphicsContext::drawConvexPolygon(size_t npoints, const FloatPoint* points
     for (size_t i = 0; i < npoints; i++)
         polygon[i] = points[i];
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     p->save();
     p->setRenderHint(QPainter::Antialiasing, shouldAntialias);
+    IntSize shadowSize;
+    int shadowBlur;
+    Color shadowColor;
+    if (getShadow(shadowSize, shadowBlur, shadowColor)) {
+        p->save();
+        p->translate(shadowSize.width(), shadowSize.height());
+        if (p->brush().style() != Qt::NoBrush)
+            p->setBrush(QBrush(shadowColor));
+        QPen pen(p->pen());
+        if (pen.style() != Qt::NoPen) {
+            pen.setColor(shadowColor);
+            p->setPen(pen);
+        }
+        p->drawConvexPolygon(polygon);
+        p->restore();
+    }
     p->drawConvexPolygon(polygon);
     p->restore();
 }
@@ -604,34 +614,50 @@ QPen GraphicsContext::pen()
     if (paintingDisabled())
         return QPen();
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     return p->pen();
 }
 
+static void inline drawFilledShadowPath(GraphicsContext* context, QPainter* p, const QPainterPath *path)
+{
+    IntSize shadowSize;
+    int shadowBlur;
+    Color shadowColor;
+    if (context->getShadow(shadowSize, shadowBlur, shadowColor)) {
+        p->translate(shadowSize.width(), shadowSize.height());
+        p->fillPath(*path, QBrush(shadowColor));
+        p->translate(-shadowSize.width(), -shadowSize.height());
+    }
+}
+
 void GraphicsContext::fillPath()
 {
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QPainterPath path = m_data->currentPath;
     path.setFillRule(toQtFillRule(fillRule()));
 
-    switch (m_common->state.fillColorSpace) {
-    case SolidColorSpace:
-        if (fillColor().alpha())
-            p->fillPath(path, p->brush());
-        break;
-    case PatternColorSpace: {
-        TransformationMatrix affine;
-        p->fillPath(path, QBrush(m_common->state.fillPattern->createPlatformPattern(affine)));
-        break;
-    }
-    case GradientColorSpace:
-        QBrush brush(*m_common->state.fillGradient->platformGradient());
-        brush.setTransform(m_common->state.fillGradient->gradientSpaceTransform());
-        p->fillPath(path, brush);
-        break;
+    if ((m_common->state.fillColorSpace != SolidColorSpace)
+            || (fillColor().alpha())) {
+        drawFilledShadowPath(this, p, &path);
+        switch (m_common->state.fillColorSpace) {
+        case SolidColorSpace:
+            if (fillColor().alpha())
+                p->fillPath(path, p->brush());
+            break;
+        case PatternColorSpace: {
+            TransformationMatrix affine;
+            p->fillPath(path, QBrush(m_common->state.fillPattern->createPlatformPattern(affine)));
+            break;
+        }
+        case GradientColorSpace:
+            QBrush brush(*m_common->state.fillGradient->platformGradient());
+            brush.setTransform(m_common->state.fillGradient->gradientSpaceTransform());
+            p->fillPath(path, brush);
+            break;
+        }
     }
     m_data->currentPath = QPainterPath();
 }
@@ -641,59 +667,88 @@ void GraphicsContext::strokePath()
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
-    QPen pen = p->pen();
+    QPainter* p = m_data->p();
+    QPen pen(p->pen());
     QPainterPath path = m_data->currentPath;
     path.setFillRule(toQtFillRule(fillRule()));
 
-    switch (m_common->state.strokeColorSpace) {
-    case SolidColorSpace:
-        if (strokeColor().alpha())
+    if ((m_common->state.strokeColorSpace != SolidColorSpace)
+            || (strokeColor().alpha())) {
+        IntSize shadowSize;
+        int shadowBlur;
+        Color shadowColor;
+        if (getShadow(shadowSize, shadowBlur, shadowColor)) {
+            QTransform t(p->worldTransform());
+            p->translate(shadowSize.width(), shadowSize.height());
+            QPen shadowPen(pen);
+            shadowPen.setColor(shadowColor);
+            p->strokePath(path, shadowPen);
+            p->setWorldTransform(t);
+        }
+        switch (m_common->state.strokeColorSpace) {
+        case SolidColorSpace:
+            if (strokeColor().alpha())
+                p->strokePath(path, pen);
+            break;
+        case PatternColorSpace: {
+            TransformationMatrix affine;
+            pen.setBrush(QBrush(m_common->state.strokePattern->createPlatformPattern(affine)));
+            p->setPen(pen);
             p->strokePath(path, pen);
-        break;
-    case PatternColorSpace: {
-        TransformationMatrix affine;
-        pen.setBrush(QBrush(m_common->state.strokePattern->createPlatformPattern(affine)));
-        p->setPen(pen);
-        p->strokePath(path, pen);
-        break;
-    }
-    case GradientColorSpace: {
-        QBrush brush(*m_common->state.strokeGradient->platformGradient());
-        brush.setTransform(m_common->state.strokeGradient->gradientSpaceTransform());
-        pen.setBrush(brush);
-        p->setPen(pen);
-        p->strokePath(path, pen);
-        break;
-    }
+            break;
+        }
+        case GradientColorSpace: {
+            QBrush brush(*m_common->state.strokeGradient->platformGradient());
+            brush.setTransform(m_common->state.strokeGradient->gradientSpaceTransform());
+            pen.setBrush(brush);
+            p->setPen(pen);
+            p->strokePath(path, pen);
+            break;
+        }
+        }
     }
     m_data->currentPath = QPainterPath();
 }
 
+static inline void drawBorderlessRectShadow(GraphicsContext* context, QPainter* p, const FloatRect& rect)
+{
+    IntSize shadowSize;
+    int shadowBlur;
+    Color shadowColor;
+    if (context->getShadow(shadowSize, shadowBlur, shadowColor)) {
+        FloatRect shadowRect(rect);
+        shadowRect.move(shadowSize.width(), shadowSize.height());
+        p->fillRect(shadowRect, shadowColor);
+    }
+}
+
 void GraphicsContext::fillRect(const FloatRect& rect)
 {
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
 
-    switch (m_common->state.fillColorSpace) {
-    case SolidColorSpace:
-        if (fillColor().alpha())
-            p->fillRect(rect, p->brush());
-        break;
-    case PatternColorSpace: {
-        TransformationMatrix affine;
-        p->fillRect(rect, QBrush(m_common->state.fillPattern->createPlatformPattern(affine)));
-        break;
-    }
-    case GradientColorSpace:
-        QBrush brush(*m_common->state.fillGradient->platformGradient());
-        brush.setTransform(m_common->state.fillGradient->gradientSpaceTransform());
-        p->fillRect(rect, brush);
-        break;
+    if ((m_common->state.fillColorSpace != SolidColorSpace)
+            || (fillColor().alpha())) {
+        drawBorderlessRectShadow(this, p, rect);
+        switch (m_common->state.fillColorSpace) {
+        case SolidColorSpace:
+            if (fillColor().alpha())
+                p->fillRect(rect, p->brush());
+            break;
+        case PatternColorSpace: {
+            TransformationMatrix affine;
+            p->fillRect(rect, QBrush(m_common->state.fillPattern->createPlatformPattern(affine)));
+            break;
+        }
+        case GradientColorSpace:
+            QBrush brush(*m_common->state.fillGradient->platformGradient());
+            brush.setTransform(m_common->state.fillGradient->gradientSpaceTransform());
+            p->fillRect(rect, brush);
+            break;
+        }
     }
-    m_data->currentPath = QPainterPath();
 }
 
 void GraphicsContext::fillRect(const FloatRect& rect, const Color& c)
@@ -701,8 +756,10 @@ void GraphicsContext::fillRect(const FloatRect& rect, const Color& c)
     if (paintingDisabled())
         return;
 
-    m_data->solidColor.setColor(QColor(c));
-    m_data->p()->fillRect(rect, m_data->solidColor);
+    m_data->solidColor.setColor(c);
+    QPainter* p = m_data->p();
+    drawBorderlessRectShadow(this, p, rect);
+    p->fillRect(rect, m_data->solidColor);
 }
 
 void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color)
@@ -711,7 +768,9 @@ void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLef
         return;
 
     Path path = Path::createRoundedRectangle(rect, topLeft, topRight, bottomLeft, bottomRight);
-    m_data->p()->fillPath(*path.platformPath(), QColor(color));
+    QPainter* p = m_data->p();
+    drawFilledShadowPath(this, p, path.platformPath());
+    p->fillPath(*path.platformPath(), QColor(color));
 }
 
 void GraphicsContext::beginPath()
@@ -749,7 +808,7 @@ void GraphicsContext::clipPath(WindRule clipRule)
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QPainterPath newPath = m_data->currentPath;
     newPath.setFillRule(clipRule == RULE_EVENODD ? Qt::OddEvenFill : Qt::WindingFill);
     p->setClipPath(newPath);
@@ -768,10 +827,10 @@ void GraphicsContext::drawFocusRing(const Color& color)
     const Vector<IntRect>& rects = focusRingRects();
     unsigned rectCount = rects.size();
 
-    if (rects.size() == 0)
+    if (!rects.size())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     const bool antiAlias = p->testRenderHint(QPainter::Antialiasing);
     p->setRenderHint(QPainter::Antialiasing, m_data->antiAliasingForRectsAndLines);
 
@@ -792,7 +851,7 @@ void GraphicsContext::drawFocusRing(const Color& color)
     QPainterPath newPath = stroker.createStroke(path);
     p->strokePath(newPath, nPen);
 #else
-    for (int i = 0; i < rectCount; ++i)
+    for (unsigned i = 0; i < rectCount; ++i)
         p->drawRect(QRectF(rects[i]));
 #endif
     p->setPen(oldPen);
@@ -828,10 +887,16 @@ FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& frect)
     return FloatRect(QRectF(result));
 }
 
-void GraphicsContext::setPlatformShadow(const IntSize& pos, int blur, const Color &color)
+void GraphicsContext::setPlatformShadow(const IntSize& size, int blur, const Color &color)
 {
     // Qt doesn't support shadows natively, they are drawn manually in the draw*
     // functions
+
+    if (m_common->state.shadowsIgnoreTransforms) {
+        // Meaning that this graphics context is associated with a CanvasRenderingContext
+        // We flip the height since CG and HTML5 Canvas have opposite Y axis
+        m_common->state.shadowSize = IntSize(size.width(), -size.height());
+    }
 }
 
 void GraphicsContext::clearPlatformShadow()
@@ -847,8 +912,8 @@ void GraphicsContext::beginTransparencyLayer(float opacity)
 
     int x, y, w, h;
     x = y = 0;
-    QPainter *p = m_data->p();
-    const QPaintDevice *device = p->device();
+    QPainter* p = m_data->p();
+    const QPaintDevice* device = p->device();
     w = device->width();
     h = device->height();
 
@@ -870,10 +935,10 @@ void GraphicsContext::endTransparencyLayer()
     if (paintingDisabled())
         return;
 
-    TransparencyLayer *layer = m_data->layers.pop();
+    TransparencyLayer* layer = m_data->layers.pop();
     layer->painter.end();
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     p->save();
     p->resetTransform();
     p->setOpacity(layer->opacity);
@@ -888,7 +953,7 @@ void GraphicsContext::clearRect(const FloatRect& rect)
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QPainter::CompositionMode currentCompositionMode = p->compositionMode();
     if (p->paintEngine()->hasFeature(QPaintEngine::PorterDuff))
         p->setCompositionMode(QPainter::CompositionMode_Source);
@@ -915,7 +980,7 @@ void GraphicsContext::setLineCap(LineCap lc)
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QPen nPen = p->pen();
     nPen.setCapStyle(toQtLineCap(lc));
     p->setPen(nPen);
@@ -947,7 +1012,7 @@ void GraphicsContext::setLineJoin(LineJoin lj)
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QPen nPen = p->pen();
     nPen.setJoinStyle(toQtLineJoin(lj));
     p->setPen(nPen);
@@ -958,7 +1023,7 @@ void GraphicsContext::setMiterLimit(float limit)
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QPen nPen = p->pen();
     nPen.setMiterLimit(limit);
     p->setPen(nPen);
@@ -968,7 +1033,7 @@ void GraphicsContext::setAlpha(float opacity)
 {
     if (paintingDisabled())
         return;
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     p->setOpacity(opacity);
 }
 
@@ -994,7 +1059,7 @@ void GraphicsContext::clipOut(const Path& path)
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QRectF clipBounds = p->clipPath().boundingRect();
     QPainterPath clippedOut = *path.platformPath();
     QPainterPath newClip;
@@ -1060,7 +1125,7 @@ void GraphicsContext::clipOut(const IntRect& rect)
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QRectF clipBounds = p->clipPath().boundingRect();
     QPainterPath newClip;
     newClip.setFillRule(Qt::OddEvenFill);
@@ -1075,7 +1140,7 @@ void GraphicsContext::clipOutEllipseInRect(const IntRect& rect)
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QRectF clipBounds = p->clipPath().boundingRect();
     QPainterPath newClip;
     newClip.setFillRule(Qt::OddEvenFill);
@@ -1108,7 +1173,7 @@ void GraphicsContext::addInnerRoundedRectClip(const IntRect& rect,
 
     path.setFillRule(Qt::OddEvenFill);
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
 
     const bool antiAlias = p->testRenderHint(QPainter::Antialiasing);
     p->setRenderHint(QPainter::Antialiasing, true);
@@ -1142,7 +1207,7 @@ void GraphicsContext::setPlatformStrokeColor(const Color& color)
 {
     if (paintingDisabled())
         return;
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QPen newPen(p->pen());
     newPen.setColor(color);
     p->setPen(newPen);
@@ -1152,7 +1217,7 @@ void GraphicsContext::setPlatformStrokeStyle(const StrokeStyle& strokeStyle)
 {
     if (paintingDisabled())
         return;
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QPen newPen(p->pen());
     newPen.setStyle(toQPenStyle(strokeStyle));
     p->setPen(newPen);
@@ -1162,7 +1227,7 @@ void GraphicsContext::setPlatformStrokeThickness(float thickness)
 {
     if (paintingDisabled())
         return;
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QPen newPen(p->pen());
     newPen.setWidthF(thickness);
     p->setPen(newPen);
@@ -1183,7 +1248,6 @@ void GraphicsContext::setPlatformShouldAntialias(bool enable)
 }
 
 #ifdef Q_WS_WIN
-#include <windows.h>
 
 HDC GraphicsContext::getWindowsContext(const IntRect& dstRect, bool supportAlphaBlend, bool mayCreateBitmap)
 {
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageBufferQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageBufferQt.cpp
index 506a8ea..be32797 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageBufferQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageBufferQt.cpp
@@ -40,6 +40,7 @@
 #include <QImageWriter>
 #include <QPainter>
 #include <QPixmap>
+#include <math.h>
 
 namespace WebCore {
 
@@ -67,7 +68,7 @@ ImageBufferData::ImageBufferData(const IntSize& size)
     painter->setCompositionMode(QPainter::CompositionMode_SourceOver);
 }
 
-ImageBuffer::ImageBuffer(const IntSize& size, bool grayScale, bool& success)
+ImageBuffer::ImageBuffer(const IntSize& size, ImageColorSpace imageColorSpace, bool& success)
     : m_data(size)
     , m_size(size)
 {
@@ -98,12 +99,39 @@ Image* ImageBuffer::image() const
     return m_image.get();
 }
 
-PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
+void ImageBuffer::platformTransformColorSpace(const Vector<int>& lookUpTable)
+{
+    bool isPainting = m_data.m_painter->isActive();
+    if (isPainting)
+        m_data.m_painter->end();
+
+    QImage image = m_data.m_pixmap.toImage().convertToFormat(QImage::Format_ARGB32);
+    ASSERT(!image.isNull());
+
+    for (int y = 0; y < m_size.height(); ++y) {
+        for (int x = 0; x < m_size.width(); x++) {
+            QRgb value = image.pixel(x, y);
+            value = qRgba(lookUpTable[qRed(value)],
+                          lookUpTable[qGreen(value)],
+                          lookUpTable[qBlue(value)],
+                          lookUpTable[qAlpha(value)]);
+            image.setPixel(x, y, value);
+        }
+    }
+
+    m_data.m_pixmap = QPixmap::fromImage(image);
+
+    if (isPainting)
+        m_data.m_painter->begin(&m_data.m_pixmap);
+}
+
+template <Multiply multiplied>
+PassRefPtr<ImageData> getImageData(const IntRect& rect, const ImageBufferData& imageData, const IntSize& size)
 {
     PassRefPtr<ImageData> result = ImageData::create(rect.width(), rect.height());
     unsigned char* data = result->data()->data()->data();
 
-    if (rect.x() < 0 || rect.y() < 0 || (rect.x() + rect.width()) > m_size.width() || (rect.y() + rect.height()) > m_size.height())
+    if (rect.x() < 0 || rect.y() < 0 || (rect.x() + rect.width()) > size.width() || (rect.y() + rect.height()) > size.height())
         memset(data, 0, result->data()->length());
 
     int originx = rect.x();
@@ -113,8 +141,8 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
         originx = 0;
     }
     int endx = rect.x() + rect.width();
-    if (endx > m_size.width())
-        endx = m_size.width();
+    if (endx > size.width())
+        endx = size.width();
     int numColumns = endx - originx;
 
     int originy = rect.y();
@@ -124,11 +152,16 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
         originy = 0;
     }
     int endy = rect.y() + rect.height();
-    if (endy > m_size.height())
-        endy = m_size.height();
+    if (endy > size.height())
+        endy = size.height();
     int numRows = endy - originy;
 
-    QImage image = m_data.m_pixmap.toImage().convertToFormat(QImage::Format_ARGB32);
+    QImage image = imageData.m_pixmap.toImage();
+    if (multiplied == Unmultiplied)
+        image = image.convertToFormat(QImage::Format_ARGB32);
+    else
+        image = image.convertToFormat(QImage::Format_ARGB32_Premultiplied);
+
     ASSERT(!image.isNull());
 
     unsigned destBytesPerRow = 4 * rect.width();
@@ -149,7 +182,18 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
     return result;
 }
 
-void ImageBuffer::putImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+PassRefPtr<ImageData> ImageBuffer::getUnmultipliedImageData(const IntRect& rect) const
+{
+    return getImageData<Unmultiplied>(rect, m_data, m_size);
+}
+
+PassRefPtr<ImageData> ImageBuffer::getPremultipliedImageData(const IntRect& rect) const
+{
+    return getImageData<Premultiplied>(rect, m_data, m_size);
+}
+
+template <Multiply multiplied>
+void putImageData(ImageData*& source, const IntRect& sourceRect, const IntPoint& destPoint, ImageBufferData& data, const IntSize& size)
 {
     ASSERT(sourceRect.width() > 0);
     ASSERT(sourceRect.height() > 0);
@@ -157,49 +201,65 @@ void ImageBuffer::putImageData(ImageData* source, const IntRect& sourceRect, con
     int originx = sourceRect.x();
     int destx = destPoint.x() + sourceRect.x();
     ASSERT(destx >= 0);
-    ASSERT(destx < m_size.width());
+    ASSERT(destx < size.width());
     ASSERT(originx >= 0);
     ASSERT(originx <= sourceRect.right());
 
     int endx = destPoint.x() + sourceRect.right();
-    ASSERT(endx <= m_size.width());
+    ASSERT(endx <= size.width());
 
     int numColumns = endx - destx;
 
     int originy = sourceRect.y();
     int desty = destPoint.y() + sourceRect.y();
     ASSERT(desty >= 0);
-    ASSERT(desty < m_size.height());
+    ASSERT(desty < size.height());
     ASSERT(originy >= 0);
     ASSERT(originy <= sourceRect.bottom());
 
     int endy = destPoint.y() + sourceRect.bottom();
-    ASSERT(endy <= m_size.height());
+    ASSERT(endy <= size.height());
     int numRows = endy - desty;
 
     unsigned srcBytesPerRow = 4 * source->width();
 
-    bool isPainting = m_data.m_painter->isActive();
+    bool isPainting = data.m_painter->isActive();
     if (isPainting)
-        m_data.m_painter->end();
+        data.m_painter->end();
 
-    QImage image = m_data.m_pixmap.toImage().convertToFormat(QImage::Format_ARGB32);
+    QImage image = data.m_pixmap.toImage();
+    if (multiplied == Unmultiplied)
+        image = image.convertToFormat(QImage::Format_ARGB32);
+    else
+        image = image.convertToFormat(QImage::Format_ARGB32_Premultiplied);
 
     unsigned char* srcRows = source->data()->data()->data() + originy * srcBytesPerRow + originx * 4;
     for (int y = 0; y < numRows; ++y) {
         quint32* scanLine = reinterpret_cast<quint32*>(image.scanLine(y + desty));
         for (int x = 0; x < numColumns; x++) {
-            int basex = x * 4;
-            scanLine[x + destx] = reinterpret_cast<quint32*>(srcRows + basex)[0];
+            // ImageData stores the pixels in RGBA while QImage is ARGB
+            quint32 pixel = reinterpret_cast<quint32*>(srcRows + 4 * x)[0];
+            pixel = ((pixel << 16) & 0xff0000) | ((pixel >> 16) & 0xff) | (pixel & 0xff00ff00);
+            scanLine[x + destx] = pixel;
         }
 
         srcRows += srcBytesPerRow;
     }
 
-    m_data.m_pixmap = QPixmap::fromImage(image);
+    data.m_pixmap = QPixmap::fromImage(image);
 
     if (isPainting)
-        m_data.m_painter->begin(&m_data.m_pixmap);
+        data.m_painter->begin(&data.m_pixmap);
+}
+
+void ImageBuffer::putUnmultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    putImageData<Unmultiplied>(source, sourceRect, destPoint, m_data, m_size);
+}
+
+void ImageBuffer::putPremultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    putImageData<Premultiplied>(source, sourceRect, destPoint, m_data, m_size);
 }
 
 // We get a mimeType here but QImageWriter does not support mimetypes but
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
index 669be1c..bf6210b 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
@@ -41,6 +41,25 @@ namespace {
 }
 
 namespace WebCore {
+
+ImageDecoder* ImageDecoder::create(const SharedBuffer& data)
+{
+    // We need at least 4 bytes to figure out what kind of image we're dealing with.
+    if (data.size() < 4)
+        return 0;
+
+    QByteArray bytes = QByteArray::fromRawData(data.data(), data.size());
+    QBuffer buffer(&bytes);
+    if (!buffer.open(QBuffer::ReadOnly))
+        return 0;
+
+    QString imageFormat = QString::fromLatin1(QImageReader::imageFormat(&buffer).toLower());
+    if (imageFormat.isEmpty())
+        return 0; // Image format not supported
+
+    return new ImageDecoderQt(imageFormat);
+}
+
 ImageDecoderQt::ImageData::ImageData(const QImage& image, ImageState imageState, int duration) :
     m_image(image), m_imageState(imageState), m_duration(duration)
 {
@@ -59,7 +78,7 @@ public:
             // Load images only if  all data have been received
             LoadComplete };
 
-    ReadContext(const IncomingData & data, LoadMode loadMode, ImageList &target);
+    ReadContext(SharedBuffer* data, LoadMode loadMode, ImageList &target);
 
     enum ReadResult { ReadEOF, ReadFailed, ReadPartial, ReadComplete };
 
@@ -89,9 +108,9 @@ private:
 
 };
 
-ImageDecoderQt::ReadContext::ReadContext(const IncomingData & data, LoadMode loadMode, ImageList &target)
+ImageDecoderQt::ReadContext::ReadContext(SharedBuffer* data, LoadMode loadMode, ImageList &target)
     : m_loadMode(loadMode)
-    , m_data(data.data(), data.size())
+    , m_data(data->data(), data->size())
     , m_buffer(&m_data)
     , m_reader(&m_buffer)
     , m_target(target)
@@ -178,25 +197,7 @@ ImageDecoderQt::ReadContext::IncrementalReadResult
     return IncrementalReadComplete;
 }
 
-ImageDecoderQt* ImageDecoderQt::create(const SharedBuffer& data)
-{
-    // We need at least 4 bytes to figure out what kind of image we're dealing with.
-    if (data.size() < 4)
-        return 0;
-
-    QByteArray bytes = QByteArray::fromRawData(data.data(), data.size());
-    QBuffer buffer(&bytes);
-    if (!buffer.open(QBuffer::ReadOnly))
-        return 0;
-
-    QString imageFormat = QString::fromLatin1(QImageReader::imageFormat(&buffer).toLower());
-    if (imageFormat.isEmpty())
-        return 0; // Image format not supported
-
-    return new ImageDecoderQt(imageFormat);
-}
-
-ImageDecoderQt::ImageDecoderQt(const QString &imageFormat)
+ImageDecoderQt::ImageDecoderQt(const QString& imageFormat)
     : m_hasAlphaChannel(false)
     , m_imageFormat(imageFormat)
 {
@@ -220,13 +221,13 @@ void ImageDecoderQt::reset()
     m_loopCount = cAnimationNone;
 }
 
-void ImageDecoderQt::setData(const IncomingData &data, bool allDataReceived)
+void ImageDecoderQt::setData(SharedBuffer* data, bool allDataReceived)
 {
     reset();
     ReadContext readContext(data, ReadContext::LoadComplete, m_imageList);
 
     if (debugImageDecoderQt)
-        qDebug() << " setData " << data.size() << " image bytes, complete=" << allDataReceived;
+        qDebug() << " setData " << data->size() << " image bytes, complete=" << allDataReceived;
 
     const  ReadContext::ReadResult readResult =  readContext.read(allDataReceived);
 
@@ -267,7 +268,7 @@ bool ImageDecoderQt::isSizeAvailable()
     return ImageDecoder::isSizeAvailable();
 }
 
-int ImageDecoderQt::frameCount() const
+size_t ImageDecoderQt::frameCount() const
 {
     if (debugImageDecoderQt)
         qDebug() << " ImageDecoderQt::frameCount() returns" << m_imageList.size();
@@ -288,7 +289,7 @@ bool ImageDecoderQt::supportsAlpha() const
 
 int ImageDecoderQt::duration(size_t index) const
 {
-    if (index >= m_imageList.size())
+    if (index >= static_cast<size_t>(m_imageList.size()))
         return 0;
     return  m_imageList[index].m_duration;
 }
@@ -311,7 +312,7 @@ QPixmap* ImageDecoderQt::imageAtIndex(size_t index) const
     if (debugImageDecoderQt)
         qDebug() << "ImageDecoderQt::imageAtIndex(" << index << ')';
 
-    if (index >= m_imageList.size())
+    if (index >= static_cast<size_t>(m_imageList.size()))
         return 0;
 
     if (!m_pixmapCache.contains(index)) {
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.h b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.h
index ece0e48..59751c5 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageDecoderQt.h
@@ -39,14 +39,12 @@ namespace WebCore {
 class ImageDecoderQt : public ImageDecoder
 {
 public:
-    static ImageDecoderQt* create(const SharedBuffer& data);
+    ImageDecoderQt(const QString& imageFormat);
     ~ImageDecoderQt();
 
-    typedef Vector<char> IncomingData;
-
-    virtual void setData(const IncomingData& data, bool allDataReceived);
+    virtual void setData(SharedBuffer* data, bool allDataReceived);
     virtual bool isSizeAvailable();
-    virtual int frameCount() const;
+    virtual size_t frameCount() const;
     virtual int repetitionCount() const;
     virtual RGBA32Buffer* frameBufferAtIndex(size_t index);
 
@@ -58,7 +56,6 @@ public:
     void clearFrame(size_t index);
 
 private:
-    ImageDecoderQt(const QString &imageFormat);
     ImageDecoderQt(const ImageDecoderQt&);
     ImageDecoderQt &operator=(const ImageDecoderQt&);
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageSourceQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageSourceQt.cpp
index 1ffc1eb..dc5c03b 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageSourceQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/ImageSourceQt.cpp
@@ -29,95 +29,12 @@
 #include "config.h"
 #include "ImageSource.h"
 #include "ImageDecoderQt.h"
-#include "SharedBuffer.h"
-
-#include <QBuffer>
-#include <QImage>
-#include <QImageReader>
 
 namespace WebCore {
 
-ImageSource::ImageSource()
-    : m_decoder(0)
-{
-}
-
-ImageSource::~ImageSource()
-{
-    clear(true);
-}
-
-bool ImageSource::initialized() const
-{
-    return m_decoder;
-}
-
-void ImageSource::setData(SharedBuffer* data, bool allDataReceived)
-{
-    // Make the decoder by sniffing the bytes.
-    // This method will examine the data and instantiate an instance of the appropriate decoder plugin.
-    // If insufficient bytes are available to determine the image type, no decoder plugin will be
-    // made.
-    if (!m_decoder)
-        m_decoder = ImageDecoderQt::create(*data);
-
-    if (!m_decoder)
-        return;
-
-    m_decoder->setData(data->buffer(), allDataReceived);
-}
-
-String ImageSource::filenameExtension() const
-{
-    if (!m_decoder)
-        return String();
-
-    return m_decoder->filenameExtension();
-}
-
-bool ImageSource::isSizeAvailable()
-{
-    if (!m_decoder)
-        return false;
-
-    return m_decoder->isSizeAvailable();
-}
-
-IntSize ImageSource::size() const
-{
-    if (!m_decoder)
-        return IntSize();
-
-    return m_decoder->size();
-}
-
-IntSize ImageSource::frameSizeAtIndex(size_t) const
-{
-    return size();
-}
-
-int ImageSource::repetitionCount()
-{
-    if (!m_decoder)
-        return cAnimationNone;
-
-    return m_decoder->repetitionCount();
-}
-
-size_t ImageSource::frameCount() const
-{
-    if (!m_decoder)
-        return 0;
-
-    return m_decoder->frameCount();
-}
-
 NativeImagePtr ImageSource::createFrameAtIndex(size_t index)
 {
-    if (!m_decoder)
-        return 0;
-
-    return m_decoder->imageAtIndex(index);
+    return m_decoder ? m_decoder->imageAtIndex(index) : 0;
 }
 
 float ImageSource::frameDurationAtIndex(size_t index)
@@ -136,33 +53,13 @@ float ImageSource::frameDurationAtIndex(size_t index)
 
 bool ImageSource::frameHasAlphaAtIndex(size_t index)
 {
-    if (!m_decoder || !m_decoder->supportsAlpha())
-        return false;
-
-    const QPixmap* source = m_decoder->imageAtIndex(index);
-    if (!source)
-        return false;
-
-    return source->hasAlphaChannel();
+    return frameIsCompleteAtIndex(index) && m_decoder->supportsAlpha() &&
+        m_decoder->imageAtIndex(index)->hasAlphaChannel();
 }
 
 bool ImageSource::frameIsCompleteAtIndex(size_t index)
 {
-    return (m_decoder && m_decoder->imageAtIndex(index));
-}
-
-void ImageSource::clear(bool destroyAll, size_t clearBeforeFrame, SharedBuffer* data, bool allDataReceived)
-{
-    if (!destroyAll) {
-        if (m_decoder)
-            m_decoder->clearFrameBufferCache(clearBeforeFrame);
-        return;
-    }
-
-    delete m_decoder;
-    m_decoder = 0;
-    if (data)
-        setData(data, allDataReceived);
+    return m_decoder && m_decoder->imageAtIndex(index);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
index 76b1494..be06c14 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
@@ -27,6 +27,7 @@
 #include "FrameView.h"
 #include "GraphicsContext.h"
 #include "NotImplemented.h"
+#include "TimeRanges.h"
 #include "Widget.h"
 #include <wtf/HashSet.h>
 
@@ -37,9 +38,9 @@
 #include <QUrl>
 #include <QEvent>
 
-#include <Phonon/AudioOutput>
-#include <Phonon/MediaObject>
-#include <Phonon/VideoWidget>
+#include <audiooutput.h>
+#include <mediaobject.h>
+#include <videowidget.h>
 
 using namespace Phonon;
 
@@ -160,6 +161,14 @@ bool MediaPlayerPrivate::hasVideo() const
     return hasVideo;
 }
 
+bool MediaPlayerPrivate::hasAudio() const
+{
+    // FIXME: Phonon::MediaObject does not have such a hasAudio() function
+    bool hasAudio = true;
+    LOG(Media, "MediaPlayerPrivatePhonon::hasAudio() -> %s", hasAudio ? "true" : "false");
+    return hasAudio;
+}
+
 void MediaPlayerPrivate::load(const String& url)
 {
     LOG(Media, "MediaPlayerPrivatePhonon::load(\"%s\")", url.utf8().data());
@@ -252,10 +261,10 @@ void MediaPlayerPrivate::setEndTime(float endTime)
     notImplemented();
 }
 
-float MediaPlayerPrivate::maxTimeBuffered() const
+PassRefPtr<TimeRanges> MediaPlayerPrivate::buffered() const
 {
     notImplemented();
-    return 0.0f;
+    return TimeRanges::create();
 }
 
 float MediaPlayerPrivate::maxTimeSeekable() const
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.h b/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.h
index 9572d61..e1193b6 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.h
@@ -80,6 +80,7 @@ namespace WebCore {
 
         IntSize naturalSize() const;
         bool hasVideo() const;
+        bool hasAudio() const;
 
         void load(const String &url);
         void cancelLoad();
@@ -104,7 +105,7 @@ namespace WebCore {
         MediaPlayer::NetworkState networkState() const;
         MediaPlayer::ReadyState readyState() const;
 
-        float maxTimeBuffered() const;
+        PassRefPtr<TimeRanges> buffered() const;
         float maxTimeSeekable() const;
         unsigned bytesLoaded() const;
         bool totalBytesKnown() const;
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/PathQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/PathQt.cpp
index 39e243e..e5cecc8 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/PathQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/PathQt.cpp
@@ -92,7 +92,7 @@ bool Path::strokeContains(StrokeStyleApplier* applier, const FloatPoint& point)
 
     // FIXME: We should try to use a 'shared Context' instead of creating a new ImageBuffer
     // on each call.
-    OwnPtr<ImageBuffer> scratchImage = ImageBuffer::create(IntSize(1, 1), false);
+    OwnPtr<ImageBuffer> scratchImage = ImageBuffer::create(IntSize(1, 1));
     GraphicsContext* gc = scratchImage->context();
     QPainterPathStroker stroke;
     applier->strokeStyle(gc);
@@ -124,7 +124,7 @@ FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier)
 {
     // FIXME: We should try to use a 'shared Context' instead of creating a new ImageBuffer
     // on each call.
-    OwnPtr<ImageBuffer> scratchImage = ImageBuffer::create(IntSize(1, 1), false);
+    OwnPtr<ImageBuffer> scratchImage = ImageBuffer::create(IntSize(1, 1));
     GraphicsContext* gc = scratchImage->context();
     QPainterPathStroker stroke;
     if (applier) {
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/Matrix3DTransformOperation.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/Matrix3DTransformOperation.cpp
index ab3413b..230be3c 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/Matrix3DTransformOperation.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/Matrix3DTransformOperation.cpp
@@ -47,7 +47,7 @@ PassRefPtr<TransformOperation> Matrix3DTransformOperation::blend(const Transform
     apply(toT, size);
 
     if (blendToIdentity)
-        swap(fromT, toT);
+        std::swap(fromT, toT);
 
     toT.blend(fromT, progress);
     return Matrix3DTransformOperation::create(toT);
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/MatrixTransformOperation.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/MatrixTransformOperation.cpp
index 4934fa6..0eaccea 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/MatrixTransformOperation.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/MatrixTransformOperation.cpp
@@ -43,7 +43,7 @@ PassRefPtr<TransformOperation> MatrixTransformOperation::blend(const TransformOp
     }
     
     if (blendToIdentity)
-        swap(fromT, toT);
+        std::swap(fromT, toT);
 
     toT.blend(fromT, progress);
     return MatrixTransformOperation::create(toT.a(), toT.b(), toT.c(), toT.d(), toT.e(), toT.f());
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformOperations.h b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformOperations.h
index 11605e8..dd56408 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformOperations.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformOperations.h
@@ -60,6 +60,9 @@ public:
     Vector<RefPtr<TransformOperation> >& operations() { return m_operations; }
     const Vector<RefPtr<TransformOperation> >& operations() const { return m_operations; }
 
+    size_t size() const { return m_operations.size(); }
+    const TransformOperation* at(size_t index) const { return index < m_operations.size() ? m_operations.at(index).get() : 0; }
+
 private:
     Vector<RefPtr<TransformOperation> > m_operations;
 };
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformationMatrix.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
index a358aaf..13ef281 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2005, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2009 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -865,6 +866,16 @@ TransformationMatrix& TransformationMatrix::applyPerspective(double p)
     return *this;
 }
 
+TransformationMatrix TransformationMatrix::rectToRect(const FloatRect& from, const FloatRect& to)
+{
+    ASSERT(!from.isEmpty());
+    return TransformationMatrix(to.width() / from.width(),
+                                0, 0,
+                                to.height() / from.height(),
+                                to.x() - from.x(),
+                                to.y() - from.y());
+}
+
 //
 // *this = mat * *this
 //
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformationMatrix.h b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformationMatrix.h
index 36e4b70..83719d2 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformationMatrix.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/transforms/TransformationMatrix.h
@@ -225,6 +225,9 @@ public:
     TransformationMatrix& applyPerspective(double p);
     bool hasPerspective() const { return m_matrix[2][3] != 0.0f; }
 
+    // returns a transformation that maps a rect to a rect
+    static TransformationMatrix rectToRect(const FloatRect&, const FloatRect&);
+
     bool isInvertible() const;
 
     // This method returns the identity matrix if it is not invertible.
@@ -284,7 +287,7 @@ public:
     }
     
     // result = *this * t (i.e., a multRight)
-    TransformationMatrix operator*(const TransformationMatrix& t)
+    TransformationMatrix operator*(const TransformationMatrix& t) const
     {
         TransformationMatrix result = t;
         result.multLeft(*this);
diff --git a/src/3rdparty/webkit/WebCore/platform/image-decoders/ImageDecoder.cpp b/src/3rdparty/webkit/WebCore/platform/image-decoders/ImageDecoder.cpp
new file mode 100644
index 0000000..a16b940
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/image-decoders/ImageDecoder.cpp
@@ -0,0 +1,248 @@
+/*
+ * Copyright (C) 2008-2009 Torch Mobile, Inc.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+
+#include "ImageDecoder.h"
+
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+#include <algorithm>
+#endif
+
+#include "BMPImageDecoder.h"
+#include "GIFImageDecoder.h"
+#include "ICOImageDecoder.h"
+#include "JPEGImageDecoder.h"
+#include "PNGImageDecoder.h"
+#include "SharedBuffer.h"
+#include "XBMImageDecoder.h"
+
+namespace WebCore {
+
+ImageDecoder* ImageDecoder::create(const SharedBuffer& data)
+{
+    // We need at least 4 bytes to figure out what kind of image we're dealing with.
+    int length = data.size();
+    if (length < 4)
+        return 0;
+
+    const unsigned char* uContents = (const unsigned char*)data.data();
+    const char* contents = data.data();
+
+    // GIFs begin with GIF8(7 or 9).
+    if (strncmp(contents, "GIF8", 4) == 0)
+        return new GIFImageDecoder();
+
+    // Test for PNG.
+    if (uContents[0]==0x89 &&
+        uContents[1]==0x50 &&
+        uContents[2]==0x4E &&
+        uContents[3]==0x47)
+        return new PNGImageDecoder();
+
+    // JPEG
+    if (uContents[0]==0xFF &&
+        uContents[1]==0xD8 &&
+        uContents[2]==0xFF)
+        return new JPEGImageDecoder();
+
+    // BMP
+    if (strncmp(contents, "BM", 2) == 0)
+        return new BMPImageDecoder();
+
+    // ICOs always begin with a 2-byte 0 followed by a 2-byte 1.
+    // CURs begin with 2-byte 0 followed by 2-byte 2.
+    if (!memcmp(contents, "\000\000\001\000", 4) ||
+        !memcmp(contents, "\000\000\002\000", 4))
+        return new ICOImageDecoder();
+
+    // XBMs require 8 bytes of info.
+    if (length >= 8 && strncmp(contents, "#define ", 8) == 0)
+        return new XBMImageDecoder();
+
+    // Give up. We don't know what the heck this is.
+    return 0;
+}
+
+#if !PLATFORM(SKIA)
+
+RGBA32Buffer::RGBA32Buffer()
+    : m_hasAlpha(false)
+    , m_status(FrameEmpty)
+    , m_duration(0)
+    , m_disposalMethod(DisposeNotSpecified)
+{
+} 
+
+void RGBA32Buffer::clear()
+{
+    m_bytes.clear();
+    m_status = FrameEmpty;
+    // NOTE: Do not reset other members here; clearFrameBufferCache()
+    // calls this to free the bitmap data, but other functions like
+    // initFrameBuffer() and frameComplete() may still need to read
+    // other metadata out of this frame later.
+}
+
+void RGBA32Buffer::zeroFill()
+{
+    m_bytes.fill(0);
+    m_hasAlpha = true;
+}
+
+void RGBA32Buffer::copyBitmapData(const RGBA32Buffer& other)
+{
+    if (this == &other)
+        return;
+
+    m_bytes = other.m_bytes;
+    m_size = other.m_size;
+    setHasAlpha(other.m_hasAlpha);
+}
+
+bool RGBA32Buffer::setSize(int newWidth, int newHeight)
+{
+    // NOTE: This has no way to check for allocation failure if the
+    // requested size was too big...
+    m_bytes.resize(newWidth * newHeight);
+    m_size = IntSize(newWidth, newHeight);
+
+    // Zero the image.
+    zeroFill();
+
+    return true;
+}
+
+bool RGBA32Buffer::hasAlpha() const
+{
+    return m_hasAlpha;
+}
+
+void RGBA32Buffer::setHasAlpha(bool alpha)
+{
+    m_hasAlpha = alpha;
+}
+
+void RGBA32Buffer::setStatus(FrameStatus status)
+{
+    m_status = status;
+}
+
+RGBA32Buffer& RGBA32Buffer::operator=(const RGBA32Buffer& other)
+{
+    if (this == &other)
+        return *this;
+
+    copyBitmapData(other);
+    setRect(other.rect());
+    setStatus(other.status());
+    setDuration(other.duration());
+    setDisposalMethod(other.disposalMethod());
+    return *this;
+}
+
+int RGBA32Buffer::width() const
+{
+    return m_size.width();
+}
+
+int RGBA32Buffer::height() const
+{
+    return m_size.height();
+}
+
+#endif
+
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+
+namespace {
+
+enum MatchType {
+    Exact,
+    UpperBound,
+    LowerBound
+};
+
+inline void fillScaledValues(Vector<int>& scaledValues, double scaleRate, int length)
+{
+    double inflateRate = 1. / scaleRate;
+    scaledValues.reserveCapacity(static_cast<int>(length * scaleRate + 0.5));
+    for (int scaledIndex = 0;;) {
+        int index = static_cast<int>(scaledIndex * inflateRate + 0.5);
+        if (index < length) {
+            scaledValues.append(index);
+            ++scaledIndex;
+        } else
+            break;
+    }
+}
+
+template <MatchType type> int getScaledValue(const Vector<int>& scaledValues, int valueToMatch, int searchStart)
+{
+    const int* dataStart = scaledValues.data();
+    const int* dataEnd = dataStart + scaledValues.size();
+    const int* matched = std::lower_bound(dataStart + searchStart, dataEnd, valueToMatch);
+    switch (type) {
+    case Exact:
+        return matched != dataEnd && *matched == valueToMatch ? matched - dataStart : -1;
+    case LowerBound:
+        return matched != dataEnd && *matched == valueToMatch ? matched - dataStart : matched - dataStart - 1;
+    case UpperBound:
+    default:
+        return matched != dataEnd ? matched - dataStart : -1;
+    }
+}
+
+}
+
+void ImageDecoder::prepareScaleDataIfNecessary()
+{
+    int width = m_size.width();
+    int height = m_size.height();
+    int numPixels = height * width;
+    if (m_maxNumPixels <= 0 || numPixels <= m_maxNumPixels) {
+        m_scaled = false;
+        return;
+    }
+
+    m_scaled = true;
+    double scale = sqrt(m_maxNumPixels / (double)numPixels);
+    fillScaledValues(m_scaledColumns, scale, width);
+    fillScaledValues(m_scaledRows, scale, height);
+}
+
+int ImageDecoder::upperBoundScaledX(int origX, int searchStart)
+{
+    return getScaledValue<UpperBound>(m_scaledColumns, origX, searchStart);
+}
+
+int ImageDecoder::lowerBoundScaledX(int origX, int searchStart)
+{
+    return getScaledValue<LowerBound>(m_scaledColumns, origX, searchStart);
+}
+
+int ImageDecoder::scaledY(int origY, int searchStart)
+{
+    return getScaledValue<Exact>(m_scaledRows, origY, searchStart);
+}
+
+#endif // ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/image-decoders/ImageDecoder.h b/src/3rdparty/webkit/WebCore/platform/image-decoders/ImageDecoder.h
index 494e2bb..2df3df9 100644
--- a/src/3rdparty/webkit/WebCore/platform/image-decoders/ImageDecoder.h
+++ b/src/3rdparty/webkit/WebCore/platform/image-decoders/ImageDecoder.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2008-2009 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -36,7 +37,6 @@
 
 #if PLATFORM(SKIA)
 #include "NativeImageSkia.h"
-#include "SkBitmap.h"
 #endif
 
 namespace WebCore {
@@ -52,7 +52,7 @@ namespace WebCore {
             DisposeNotSpecified,       // Leave frame in framebuffer
             DisposeKeep,               // Leave frame in framebuffer
             DisposeOverwriteBgcolor,   // Clear frame to transparent
-            DisposeOverwritePrevious   // Clear frame to previous framebuffer contents
+            DisposeOverwritePrevious,  // Clear frame to previous framebuffer contents
         };
 #if PLATFORM(SKIA)
         typedef uint32_t PixelData;
@@ -134,13 +134,10 @@ namespace WebCore {
 
         inline PixelData* getAddr(int x, int y)
         {
-#if PLATFORM(CAIRO) || PLATFORM(WX)
-            return m_bytes.data() + (y * width()) + x;
-#elif PLATFORM(SKIA)
+#if PLATFORM(SKIA)
             return m_bitmap.getAddr32(x, y);
 #else
-            ASSERT_NOT_REACHED();
-            return 0;
+            return m_bytes.data() + (y * width()) + x;
 #endif
         }
 
@@ -160,13 +157,13 @@ namespace WebCore {
             }
         }
 
-#if PLATFORM(CAIRO) || PLATFORM(WX)
+#if PLATFORM(SKIA)
+        NativeImageSkia m_bitmap;
+#else
         Vector<PixelData> m_bytes;
         IntSize m_size;       // The size of the buffer.  This should be the
                               // same as ImageDecoder::m_size.
         bool m_hasAlpha;      // Whether or not any of the pixels in the buffer have transparency.
-#elif PLATFORM(SKIA)
-        NativeImageSkia m_bitmap;
 #endif
         IntRect m_rect;       // The rect of the original specified frame within the overall buffer.
                               // This will always just be the entire buffer except for GIF frames
@@ -182,14 +179,27 @@ namespace WebCore {
     // and the base class manages the RGBA32 frame cache.
     class ImageDecoder {
     public:
+        // ENABLE(IMAGE_DECODER_DOWN_SAMPLING) allows image decoders to write directly to
+        // scaled output buffers by down sampling. Call setMaxNumPixels() to specify the
+        // biggest size that decoded images can have. Image decoders will deflate those
+        // images that are bigger than m_maxNumPixels. (Not supported by all image decoders yet)
         ImageDecoder()
             : m_failed(false)
             , m_sizeAvailable(false)
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+            , m_maxNumPixels(-1)
+            , m_scaled(false)
+#endif
         {
         }
 
         virtual ~ImageDecoder() {}
 
+        // Factory function to create an ImageDecoder.  Ports that subclass
+        // ImageDecoder can provide their own implementation of this to avoid
+        // needing to write a dedicated setData() implementation.
+        static ImageDecoder* create(const SharedBuffer& data);
+
         // The the filename extension usually associated with an undecoded image of this type.
         virtual String filenameExtension() const = 0;
 
@@ -205,7 +215,7 @@ namespace WebCore {
             return !m_failed && m_sizeAvailable; 
         }
 
-        // Requests the size.
+        // Returns the size of the image.
         virtual IntSize size() const
         {
             // Requesting the size of an invalid bitmap is meaningless.
@@ -213,6 +223,17 @@ namespace WebCore {
             return m_size;
         }
 
+        // Returns the size of frame |index|.  This will only differ from size()
+        // for formats where different frames are different sizes (namely ICO,
+        // where each frame represents a different icon within the master file).
+        // Notably, this does not return different sizes for different GIF
+        // frames, since while these may be stored as smaller rectangles, during
+        // decoding they are composited to create a full-size frame.
+        virtual IntSize frameSizeAtIndex(size_t) const
+        {
+            return size();
+        }
+
         // Called by the image decoders to set their decoded size, this also check
         // the size for validity. It will return true if the size was set, or false
         // if there is an error. On error, the m_failed flag will be set and the
@@ -231,7 +252,7 @@ namespace WebCore {
         // The total number of frames for the image.  Classes that support multiple frames
         // will scan the image data for the answer if they need to (without necessarily
         // decoding all of the individual frames).
-        virtual int frameCount() { return 1; }
+        virtual size_t frameCount() { return 1; }
 
         // The number of repetitions to perform for an animation loop.
         virtual int repetitionCount() const { return cAnimationNone; }
@@ -239,7 +260,7 @@ namespace WebCore {
         // Called to obtain the RGBA32Buffer full of decoded data for rendering.  The
         // decoder plugin will decode as much of the frame as it can before handing
         // back the buffer.
-        virtual RGBA32Buffer* frameBufferAtIndex(size_t index) = 0;
+        virtual RGBA32Buffer* frameBufferAtIndex(size_t) = 0;
 
         // Whether or not the underlying image format even supports alpha transparency.
         virtual bool supportsAlpha() const { return true; }
@@ -255,8 +276,25 @@ namespace WebCore {
         // since in practice only GIFs will ever use this.
         virtual void clearFrameBufferCache(size_t clearBeforeFrame) { }
 
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+        void setMaxNumPixels(int m) { m_maxNumPixels = m; }
+#endif
+
     protected:
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+        void prepareScaleDataIfNecessary();
+        int upperBoundScaledX(int origX, int searchStart = 0);
+        int lowerBoundScaledX(int origX, int searchStart = 0);
+        int scaledY(int origY, int searchStart = 0);
+#endif
+
         RefPtr<SharedBuffer> m_data; // The encoded data.
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+        int m_maxNumPixels;
+        Vector<int> m_scaledColumns;
+        Vector<int> m_scaledRows;
+        bool m_scaled;
+#endif
         Vector<RGBA32Buffer> m_frameBufferCache;
         bool m_failed;
 
diff --git a/src/3rdparty/webkit/WebCore/platform/image-decoders/cairo/ImageDecoderCairo.cpp b/src/3rdparty/webkit/WebCore/platform/image-decoders/cairo/ImageDecoderCairo.cpp
index c53eabd..203205d 100644
--- a/src/3rdparty/webkit/WebCore/platform/image-decoders/cairo/ImageDecoderCairo.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/image-decoders/cairo/ImageDecoderCairo.cpp
@@ -30,53 +30,6 @@
 
 namespace WebCore {
 
-RGBA32Buffer::RGBA32Buffer()
-    : m_hasAlpha(false)
-    , m_status(FrameEmpty)
-    , m_duration(0)
-    , m_disposalMethod(DisposeNotSpecified)
-{
-} 
-
-void RGBA32Buffer::clear()
-{
-    m_bytes.clear();
-    m_status = FrameEmpty;
-    // NOTE: Do not reset other members here; clearFrameBufferCache()
-    // calls this to free the bitmap data, but other functions like
-    // initFrameBuffer() and frameComplete() may still need to read
-    // other metadata out of this frame later.
-}
-
-void RGBA32Buffer::zeroFill()
-{
-    m_bytes.fill(0);
-    m_hasAlpha = true;
-}
-
-void RGBA32Buffer::copyBitmapData(const RGBA32Buffer& other)
-{
-    if (this == &other)
-        return;
-
-    m_bytes = other.m_bytes;
-    m_size = other.m_size;
-    setHasAlpha(other.m_hasAlpha);
-}
-
-bool RGBA32Buffer::setSize(int newWidth, int newHeight)
-{
-    // NOTE: This has no way to check for allocation failure if the
-    // requested size was too big...
-    m_bytes.resize(newWidth * newHeight);
-    m_size = IntSize(newWidth, newHeight);
-
-    // Zero the image.
-    zeroFill();
-
-    return true;
-}
-
 NativeImagePtr RGBA32Buffer::asNewNativeImage() const
 {
     return cairo_image_surface_create_for_data(
@@ -85,40 +38,4 @@ NativeImagePtr RGBA32Buffer::asNewNativeImage() const
         width() * sizeof(PixelData));
 }
 
-bool RGBA32Buffer::hasAlpha() const
-{
-    return m_hasAlpha;
-}
-
-void RGBA32Buffer::setHasAlpha(bool alpha)
-{
-    m_hasAlpha = alpha;
-}
-
-void RGBA32Buffer::setStatus(FrameStatus status)
-{
-    m_status = status;
-}
-
-RGBA32Buffer& RGBA32Buffer::operator=(const RGBA32Buffer& other)
-{
-    if (this == &other)
-        return *this;
-
-    copyBitmapData(other);
-    setRect(other.rect());
-    setStatus(other.status());
-    setDuration(other.duration());
-    setDisposalMethod(other.disposalMethod());
-    return *this;
-}
-
-int RGBA32Buffer::width() const {
-    return m_size.width();
-}
-
-int RGBA32Buffer::height() const {
-    return m_size.height();
-}
-
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/image-decoders/wx/ImageDecoderWx.cpp b/src/3rdparty/webkit/WebCore/platform/image-decoders/wx/ImageDecoderWx.cpp
index 8e8809e..3cadf1c 100644
--- a/src/3rdparty/webkit/WebCore/platform/image-decoders/wx/ImageDecoderWx.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/image-decoders/wx/ImageDecoderWx.cpp
@@ -37,73 +37,21 @@
 
 namespace WebCore {
 
-RGBA32Buffer::RGBA32Buffer()
-    : m_hasAlpha(false)
-    , m_status(FrameEmpty)
-    , m_duration(0)
-    , m_disposalMethod(DisposeNotSpecified)
-{
-} 
-
-void RGBA32Buffer::clear()
-{
-    m_bytes.clear();
-    m_status = FrameEmpty;
-    // NOTE: Do not reset other members here; clearFrameBufferCache()
-    // calls this to free the bitmap data, but other functions like
-    // initFrameBuffer() and frameComplete() may still need to read
-    // other metadata out of this frame later.
-}
-
-void RGBA32Buffer::zeroFill()
-{
-    m_bytes.fill(0);
-    m_hasAlpha = true;
-}
-
-void RGBA32Buffer::copyBitmapData(const RGBA32Buffer& other)
-{
-    if (this == &other)
-        return;
-
-    m_bytes = other.m_bytes;
-    m_size = other.m_size;
-    setHasAlpha(other.m_hasAlpha);
-}
-
-bool RGBA32Buffer::setSize(int newWidth, int newHeight)
-{
-    // NOTE: This has no way to check for allocation failure if the
-    // requested size was too big...
-    m_bytes.resize(newWidth * newHeight);
-    m_size = IntSize(newWidth, newHeight);
-
-    // Zero the image.
-    zeroFill();
-
-    return true;
-}
-
 NativeImagePtr RGBA32Buffer::asNewNativeImage() const
 {
-    const unsigned char* bytes = (const unsigned char*)m_bytes.data();
-    
-    typedef wxPixelData<wxBitmap, wxAlphaPixelFormat> WxPixelData;
-
     wxBitmap* bmp = new wxBitmap(width(), height(), 32);
+    typedef wxPixelData<wxBitmap, wxAlphaPixelFormat> WxPixelData;
     WxPixelData data(*bmp);
     
+    // NB: It appears that the data is in BGRA format instead of RGBA format.
+    // This code works properly on both ppc and intel, meaning the issue is
+    // likely not an issue of byte order getting mixed up on different archs. 
+    const unsigned char* bytes = (const unsigned char*)m_bytes.data();
     int rowCounter = 0;
     long pixelCounter = 0;
-    
     WxPixelData::Iterator p(data);
-    
     WxPixelData::Iterator rowStart = p; 
-    
-    // NB: It appears that the data is in BGRA format instead of RGBA format.
-    // This code works properly on both ppc and intel, meaning the issue is
-    // likely not an issue of byte order getting mixed up on different archs. 
-    for (long i = 0; i < m_bytes.size() * sizeof(PixelData); i += sizeof(PixelData)) {
+    for (size_t i = 0; i < m_bytes.size() * sizeof(PixelData); i += sizeof(PixelData)) {
         p.Red() = bytes[i+2];
         p.Green() = bytes[i+1];
         p.Blue() = bytes[i+0];
@@ -112,12 +60,11 @@ NativeImagePtr RGBA32Buffer::asNewNativeImage() const
         p++;
 
         pixelCounter++;
-        if ( (pixelCounter % width() ) == 0 ) {
+        if ((pixelCounter % width()) == 0) {
             rowCounter++;
             p = rowStart;
             p.MoveTo(data, 0, rowCounter);
         }
-
     }
 #if !wxCHECK_VERSION(2,9,0)
     bmp->UseAlpha();
@@ -125,7 +72,7 @@ NativeImagePtr RGBA32Buffer::asNewNativeImage() const
     ASSERT(bmp->IsOk());
 
 #if USE(WXGC)
-    wxGraphicsBitmap* bitmap =  new wxGraphicsBitmap(wxGraphicsRenderer::GetDefaultRenderer()->CreateBitmap(*bmp));
+    wxGraphicsBitmap* bitmap = new wxGraphicsBitmap(wxGraphicsRenderer::GetDefaultRenderer()->CreateBitmap(*bmp));
     delete bmp;
     return bitmap;
 #else
@@ -133,40 +80,4 @@ NativeImagePtr RGBA32Buffer::asNewNativeImage() const
 #endif
 }
 
-bool RGBA32Buffer::hasAlpha() const
-{
-    return m_hasAlpha;
-}
-
-void RGBA32Buffer::setHasAlpha(bool alpha)
-{
-    m_hasAlpha = alpha;
-}
-
-void RGBA32Buffer::setStatus(FrameStatus status)
-{
-    m_status = status;
-}
-
-RGBA32Buffer& RGBA32Buffer::operator=(const RGBA32Buffer& other)
-{
-    if (this == &other)
-        return *this;
-
-    copyBitmapData(other);
-    setRect(other.rect());
-    setStatus(other.status());
-    setDuration(other.duration());
-    setDisposalMethod(other.disposalMethod());
-    return *this;
-}
-
-int RGBA32Buffer::width() const {
-    return m_size.width();
-}
-
-int RGBA32Buffer::height() const {
-    return m_size.height();
-}
-
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.h b/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.h
index 9bdd276..3d3c78e 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.h
+++ b/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.h
@@ -67,7 +67,9 @@ public:
     void setDragImageElement(Node *, const IntPoint&);
     
     virtual DragImageRef createDragImage(IntPoint& dragLoc) const;
+#if ENABLE(DRAG_SUPPORT)
     virtual void declareAndWriteDragImage(Element*, const KURL&, const String& title, Frame*);
+#endif
     virtual void writeRange(Range*, Frame* frame);
     virtual void writeURL(const KURL&, const String&, Frame* frame);
     
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.mm
index 52bc952..78fb659 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.mm
@@ -63,7 +63,7 @@ bool ClipboardMac::hasData()
     return m_pasteboard && [m_pasteboard.get() types] && [[m_pasteboard.get() types] count] > 0;
 }
     
-static NSString *cocoaTypeFromMIMEType(const String& type)
+static NSString *cocoaTypeFromHTMLClipboardType(const String& type)
 {
     String qType = type.stripWhiteSpace();
 
@@ -82,10 +82,9 @@ static NSString *cocoaTypeFromMIMEType(const String& type)
     
     // Try UTI now
     NSString *mimeType = qType;
-    CFStringRef UTIType = UTTypeCreatePreferredIdentifierForTag(kUTTagClassMIMEType, (CFStringRef)mimeType, NULL);
-    if (UTIType) {
-        CFStringRef pbType = UTTypeCopyPreferredTagWithClass(UTIType, kUTTagClassNSPboardType);
-        CFRelease(UTIType);
+    RetainPtr<CFStringRef> utiType(AdoptCF, UTTypeCreatePreferredIdentifierForTag(kUTTagClassMIMEType, (CFStringRef)mimeType, NULL));
+    if (utiType) {
+        CFStringRef pbType = UTTypeCopyPreferredTagWithClass(utiType.get(), kUTTagClassNSPboardType);
         if (pbType)
             return HardAutorelease(pbType);
     }
@@ -94,28 +93,41 @@ static NSString *cocoaTypeFromMIMEType(const String& type)
     return qType;
 }
 
-static String MIMETypeFromCocoaType(NSString *type)
+static String utiTypeFromCocoaType(NSString *type)
+{
+    RetainPtr<CFStringRef> utiType(AdoptCF, UTTypeCreatePreferredIdentifierForTag(kUTTagClassNSPboardType, (CFStringRef)type, NULL));
+    if (utiType) {
+        RetainPtr<CFStringRef> mimeType(AdoptCF, UTTypeCopyPreferredTagWithClass(utiType.get(), kUTTagClassMIMEType));
+        if (mimeType)
+            return String(mimeType.get());
+    }
+    return String();
+}
+
+static void addHTMLClipboardTypesForCocoaType(HashSet<String>& resultTypes, NSString *cocoaType, NSPasteboard *pasteboard)
 {
     // UTI may not do these right, so make sure we get the right, predictable result
-    if ([type isEqualToString:NSStringPboardType])
-        return "text/plain";
-    if ([type isEqualToString:NSURLPboardType] || [type isEqualToString:NSFilenamesPboardType])
-        return "text/uri-list";
-    
-    // Now try the general UTI mechanism
-    CFStringRef UTIType = UTTypeCreatePreferredIdentifierForTag(kUTTagClassNSPboardType, (CFStringRef)type, NULL);
-    if (UTIType) {
-        CFStringRef mimeType = UTTypeCopyPreferredTagWithClass(UTIType, kUTTagClassMIMEType);
-        CFRelease(UTIType);
-        if (mimeType) {
-            String result = mimeType;
-            CFRelease(mimeType);
-            return result;
+    if ([cocoaType isEqualToString:NSStringPboardType])
+        resultTypes.add("text/plain");
+    else if ([cocoaType isEqualToString:NSURLPboardType])
+        resultTypes.add("text/uri-list");
+    else if ([cocoaType isEqualToString:NSFilenamesPboardType]) {
+        // If file list is empty, add nothing.
+        // Note that there is a chance that the file list count could have changed since we grabbed the types array.
+        // However, this is not really an issue for us doing a sanity check here.
+        NSArray *fileList = [pasteboard propertyListForType:NSFilenamesPboardType];
+        if ([fileList count]) {
+            // It is unknown if NSFilenamesPboardType always implies NSURLPboardType in Cocoa,
+            // but NSFilenamesPboardType should imply both 'text/uri-list' and 'Files'
+            resultTypes.add("text/uri-list");
+            resultTypes.add("Files");
         }
+    } else if (String utiType = utiTypeFromCocoaType(cocoaType))
+        resultTypes.add(utiType);
+    else {
+        // No mapping, just pass the whole string though
+        resultTypes.add(cocoaType);
     }
-
-    // No mapping, just pass the whole string though
-    return type;
 }
 
 void ClipboardMac::clearData(const String& type)
@@ -125,7 +137,7 @@ void ClipboardMac::clearData(const String& type)
 
     // note NSPasteboard enforces changeCount itself on writing - can't write if not the owner
 
-    NSString *cocoaType = cocoaTypeFromMIMEType(type);
+    NSString *cocoaType = cocoaTypeFromHTMLClipboardType(type);
     if (cocoaType)
         [m_pasteboard.get() setString:@"" forType:cocoaType];
 }
@@ -192,12 +204,12 @@ String ClipboardMac::getData(const String& type, bool& success) const
     if (policy() != ClipboardReadable)
         return String();
 
-    NSString *cocoaType = cocoaTypeFromMIMEType(type);
+    NSString *cocoaType = cocoaTypeFromHTMLClipboardType(type);
     NSString *cocoaValue = nil;
 
     // Grab the value off the pasteboard corresponding to the cocoaType
     if ([cocoaType isEqualToString:NSURLPboardType]) {
-        // "URL" and "text/url-list" both map to NSURLPboardType in cocoaTypeFromMIMEType(), "URL" only wants the first URL
+        // "URL" and "text/url-list" both map to NSURLPboardType in cocoaTypeFromHTMLClipboardType(), "URL" only wants the first URL
         bool onlyFirstURL = (type == "URL");
         NSArray *absoluteURLs = absoluteURLsFromPasteboard(m_pasteboard.get(), onlyFirstURL);
         cocoaValue = [absoluteURLs componentsJoinedByString:@"\n"];
@@ -222,7 +234,7 @@ bool ClipboardMac::setData(const String &type, const String &data)
         return false;
     // note NSPasteboard enforces changeCount itself on writing - can't write if not the owner
 
-    NSString *cocoaType = cocoaTypeFromMIMEType(type);
+    NSString *cocoaType = cocoaTypeFromHTMLClipboardType(type);
     NSString *cocoaData = data;
 
     if ([cocoaType isEqualToString:NSURLPboardType]) {
@@ -263,15 +275,16 @@ HashSet<String> ClipboardMac::types() const
 
     HashSet<String> result;
     NSUInteger count = [types count];
+    // FIXME: This loop could be split into two stages. One which adds all the HTML5 specified types
+    // and a second which adds all the extra types from the cocoa clipboard (which is Mac-only behavior).
     for (NSUInteger i = 0; i < count; i++) {
         NSString *pbType = [types objectAtIndex:i];
         if ([pbType isEqualToString:@"NeXT plain ascii pasteboard type"])
             continue;   // skip this ancient type that gets auto-supplied by some system conversion
 
-        String str = MIMETypeFromCocoaType(pbType);
-        if (!result.contains(str))
-            result.add(str);
+        addHTMLClipboardTypesForCocoaType(result, pbType, m_pasteboard.get());
     }
+
     return result;
 }
 
@@ -283,7 +296,7 @@ PassRefPtr<FileList> ClipboardMac::files() const
     if (policy() != ClipboardReadable)
         return FileList::create();
 
-    NSArray *absoluteURLs = absoluteURLsFromPasteboard(m_pasteboard.get());
+    NSArray *absoluteURLs = absoluteURLsFromPasteboardFilenames(m_pasteboard.get());
     NSUInteger count = [absoluteURLs count];
 
     RefPtr<FileList> fileList = FileList::create();
@@ -355,12 +368,14 @@ void ClipboardMac::writeURL(const KURL& url, const String& title, Frame* frame)
     Pasteboard::writeURL(m_pasteboard.get(), nil, url, title, frame);
 }
     
+#if ENABLE(DRAG_SUPPORT)
 void ClipboardMac::declareAndWriteDragImage(Element* element, const KURL& url, const String& title, Frame* frame)
 {
     ASSERT(frame);
     if (Page* page = frame->page())
         page->dragController()->client()->declareAndWriteDragImage(m_pasteboard.get(), kit(element), url, title, frame);
 }
+#endif // ENABLE(DRAG_SUPPORT)
     
 DragImageRef ClipboardMac::createDragImage(IntPoint& loc) const
 {
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/ContextMenuItemMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/ContextMenuItemMac.mm
index c5e2942..48da786 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/ContextMenuItemMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/ContextMenuItemMac.mm
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "ContextMenuItem.h"
 
+#if ENABLE(CONTEXT_MENUS)
+
 #include "ContextMenu.h"
 
 namespace WebCore {
@@ -152,4 +154,6 @@ bool ContextMenuItem::enabled() const
     return [m_platformDescription.get() isEnabled];
 }
 
-}
+} // namespace WebCore
+
+#endif // ENABLE(CONTEXT_MENUS)
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/ContextMenuMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/ContextMenuMac.mm
index b56d0b9..8ced8cb 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/ContextMenuMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/ContextMenuMac.mm
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "ContextMenu.h"
 
+#if ENABLE(CONTEXT_MENUS)
+
 #include "ContextMenuController.h"
 
 @interface WebCoreMenuTarget : NSObject {
@@ -151,4 +153,6 @@ NSMutableArray* ContextMenu::releasePlatformDescription()
     return m_platformDescription.releaseRef();
 }
 
-}
+} // namespace WebCore
+
+#endif // ENABLE(CONTEXT_MENUS)
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/CookieJar.mm b/src/3rdparty/webkit/WebCore/platform/mac/CookieJar.mm
index d8df601..e1d3e5a 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/CookieJar.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/CookieJar.mm
@@ -27,6 +27,7 @@
 #import "CookieJar.h"
 
 #import "BlockExceptions.h"
+#import "Cookie.h"
 #import "Document.h"
 #import "KURL.h"
 #import <wtf/RetainPtr.h>
@@ -116,4 +117,52 @@ bool cookiesEnabled(const Document*)
     return false;
 }
 
+bool getRawCookies(const Document*, const KURL& url, Vector<Cookie>& rawCookies)
+{
+    rawCookies.clear();
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+
+    NSURL *cookieURL = url;
+    NSArray *cookies = [[NSHTTPCookieStorage sharedHTTPCookieStorage] cookiesForURL:cookieURL];
+
+    NSUInteger count = [cookies count];
+    rawCookies.reserveCapacity(count);
+    for (NSUInteger i = 0; i < count; ++i) {
+        NSHTTPCookie *cookie = (NSHTTPCookie *)[cookies objectAtIndex:i];
+        NSString *name = [cookie name];
+        NSString *value = [cookie value];
+        NSString *domain = [cookie domain];
+        NSString *path = [cookie path];
+        NSTimeInterval expires = [[cookie expiresDate] timeIntervalSince1970] * 1000;
+        bool httpOnly = [cookie isHTTPOnly];
+        bool secure = [cookie isSecure];
+        bool session = [cookie isSessionOnly];
+        rawCookies.uncheckedAppend(Cookie(name, value, domain, path, expires, httpOnly, secure, session));
+    }
+
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return true;
+}
+
+void deleteCookie(const Document*, const KURL& url, const String& cookieName)
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+
+    NSURL *cookieURL = url;
+    NSHTTPCookieStorage *cookieStorage = [NSHTTPCookieStorage sharedHTTPCookieStorage];
+    NSArray *cookies = [cookieStorage cookiesForURL:cookieURL];
+    NSString *cookieNameString = (NSString *) cookieName;
+
+    NSUInteger count = [cookies count];
+    for (NSUInteger i = 0; i < count; ++i) {
+        NSHTTPCookie *cookie = (NSHTTPCookie *)[cookies objectAtIndex:i];
+        if ([[cookie name] isEqualToString:cookieNameString]) {
+            [cookieStorage deleteCookie:cookie];
+            break;
+        }
+    }
+
+    END_BLOCK_OBJC_EXCEPTIONS;
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/DragDataMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/DragDataMac.mm
index a7b751c..02a6af7 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/DragDataMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/DragDataMac.mm
@@ -26,6 +26,7 @@
 #import "config.h"
 #import "DragData.h"
 
+#if ENABLE(DRAG_SUPPORT)
 #import "ClipboardMac.h"
 #import "ClipboardAccessPolicy.h"
 #import "Document.h"
@@ -127,5 +128,6 @@ PassRefPtr<DocumentFragment> DragData::asFragment(Document*) const
     return core(m_pasteboardHelper->fragmentFromPasteboard([m_platformDragData draggingPasteboard]));
 }
     
-}
+} // namespace WebCore
 
+#endif // ENABLE(DRAG_SUPPORT)
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/DragImageMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/DragImageMac.mm
index 842e6d4..7b51018 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/DragImageMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/DragImageMac.mm
@@ -26,6 +26,7 @@
 #import "config.h"
 #import "DragImage.h"
 
+#if ENABLE(DRAG_SUPPORT)
 #import "CachedImage.h"
 #import "Image.h"
 #import "KURL.h"
@@ -98,4 +99,6 @@ RetainPtr<NSImage> createDragImageIconForCachedImage(CachedImage* image)
     return [[NSWorkspace sharedWorkspace] iconForFileType:extension];
 }
     
-}
+} // namespace WebCore
+
+#endif // ENABLE(DRAG_SUPPORT)
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/GeolocationServiceMac.h b/src/3rdparty/webkit/WebCore/platform/mac/GeolocationServiceMac.h
index d0342e7..4beefca 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/GeolocationServiceMac.h
+++ b/src/3rdparty/webkit/WebCore/platform/mac/GeolocationServiceMac.h
@@ -45,7 +45,7 @@ namespace WebCore {
 
 class GeolocationServiceMac : public GeolocationService {
 public:
-    GeolocationServiceMac(GeolocationServiceClient*);
+    static GeolocationService* create(GeolocationServiceClient*);
     virtual ~GeolocationServiceMac();
     
     virtual bool startUpdating(PositionOptions*);
@@ -61,6 +61,8 @@ public:
     void errorOccurred(PassRefPtr<PositionError>);
 
 private:
+    GeolocationServiceMac(GeolocationServiceClient*);
+
     RetainPtr<CLLocationManager> m_locationManager;
     RetainPtr<WebCoreCoreLocationObserver> m_objcObserver;
     
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/GeolocationServiceMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/GeolocationServiceMac.mm
index 01eca4a..1093e69 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/GeolocationServiceMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/GeolocationServiceMac.mm
@@ -65,11 +65,13 @@ using namespace WebCore;
 
 namespace WebCore {
 
-GeolocationService* GeolocationService::create(GeolocationServiceClient* client)
+GeolocationService* GeolocationServiceMac::create(GeolocationServiceClient* client)
 {
     return new GeolocationServiceMac(client);
 }
 
+GeolocationService::FactoryFunction* GeolocationService::s_factoryFunction = &GeolocationServiceMac::create;
+
 GeolocationServiceMac::GeolocationServiceMac(GeolocationServiceClient* client)
     : GeolocationService(client)
     , m_objcObserver(AdoptNS, [[WebCoreCoreLocationObserver alloc] initWithCallback:this])
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/LocalizedStringsMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/LocalizedStringsMac.mm
index fdd7df5..261347f 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/LocalizedStringsMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/LocalizedStringsMac.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2003, 2006, 2009 Apple Computer, Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -89,6 +89,7 @@ String copyImageUnknownFileLabel()
     return String();
 }
 
+#if ENABLE(CONTEXT_MENUS)
 String contextMenuItemTagOpenLinkInNewWindow()
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
@@ -544,6 +545,7 @@ String contextMenuItemTagInspectElement()
     END_BLOCK_OBJC_EXCEPTIONS;
     return String();
 }
+#endif // ENABLE(CONTEXT_MENUS)
 
 String searchMenuNoRecentSearchesText()
 {
@@ -625,6 +627,14 @@ String AXDefinitionListDefinitionText()
     return String();
 }
     
+String AXARIAContentGroupText(const String& ariaType)
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] AXARIAContentGroupText:ariaType];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();        
+}
+    
 String AXButtonActionVerb()
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
@@ -713,4 +723,29 @@ String mediaElementLiveBroadcastStateText()
     return String();
 }
 
+String localizedMediaControlElementString(const String& controlName)
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] localizedMediaControlElementString:controlName];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String localizedMediaControlElementHelpText(const String& controlName)
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] localizedMediaControlElementHelpText:controlName];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String localizedMediaTimeDescription(float time)
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] localizedMediaTimeDescription:time];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/PasteboardMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/PasteboardMac.mm
index c0e43b3..e21f549 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/PasteboardMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/PasteboardMac.mm
@@ -279,7 +279,7 @@ void Pasteboard::writeImage(Node* node, const KURL& url, const String& title)
 
     ASSERT(node->renderer() && node->renderer()->isImage());
     RenderImage* renderer = toRenderImage(node->renderer());
-    CachedImage* cachedImage = static_cast<CachedImage*>(renderer->cachedImage());
+    CachedImage* cachedImage = renderer->cachedImage();
     ASSERT(cachedImage);
     
     if (cachedImage->errorOccurred())
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/PopupMenuMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/PopupMenuMac.mm
index 23324d3..dfb0fff 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/PopupMenuMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/PopupMenuMac.mm
@@ -91,6 +91,7 @@ void PopupMenu::populate()
             NSMenuItem* menuItem = [m_popup.get() lastItem];
             [menuItem setAttributedTitle:string];
             [menuItem setEnabled:client()->itemIsEnabled(i)];
+            [menuItem setToolTip:client()->itemToolTip(i)];
             [string release];
         }
     }
@@ -104,7 +105,7 @@ void PopupMenu::show(const IntRect& r, FrameView* v, int index)
     int numItems = [m_popup.get() numberOfItems];
     if (numItems <= 0) {
         if (client())
-            client()->hidePopup();
+            client()->popupDidHide();
         return;
     }
     ASSERT(numItems > index);
@@ -161,7 +162,7 @@ void PopupMenu::show(const IntRect& r, FrameView* v, int index)
 
     if (client()) {
         int newIndex = [m_popup.get() indexOfSelectedItem];
-        client()->hidePopup();
+        client()->popupDidHide();
 
         // Adjust newIndex for hidden first item.
         if (!client()->shouldPopOver())
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/ScrollViewMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/ScrollViewMac.mm
index 5ff0ff5..202d49e 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/ScrollViewMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/ScrollViewMac.mm
@@ -163,26 +163,12 @@ bool ScrollView::platformScroll(ScrollDirection, ScrollGranularity)
 void ScrollView::platformRepaintContentRectangle(const IntRect& rect, bool now)
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
-
     NSView *view = documentView();
-    NSRect visibleRect = visibleContentRect();
-
-    // FIXME: I don't think this intersection is necessary any more now that
-    // selection doesn't call this method directly (but has to go through FrameView's
-    // repaintContentRectangle, which does the intersection test also).  Leaving it in
-    // for now until I'm sure.
-    // Checking for rect visibility is an important optimization for the case of
-    // Select All of a large document. AppKit does not do this check, and so ends
-    // up building a large complicated NSRegion if we don't perform the check.
-    NSRect dirtyRect = NSIntersectionRect(rect, visibleRect);
-    if (!NSIsEmptyRect(dirtyRect)) {
-        [view setNeedsDisplayInRect:dirtyRect];
-        if (now) {
-            [[view window] displayIfNeeded];
-            [[view window] flushWindowIfNeeded];
-        }
+    [view setNeedsDisplayInRect:rect];
+    if (now) {
+        [[view window] displayIfNeeded];
+        [[view window] flushWindowIfNeeded];
     }
-
     END_BLOCK_OBJC_EXCEPTIONS;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/ScrollbarThemeMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/ScrollbarThemeMac.mm
index 759a6e1..0a20e2f 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/ScrollbarThemeMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/ScrollbarThemeMac.mm
@@ -391,7 +391,7 @@ bool ScrollbarThemeMac::paint(Scrollbar* scrollbar, GraphicsContext* context, co
         bufferRect.intersect(damageRect);
         bufferRect.move(-scrollbar->frameRect().x(), -scrollbar->frameRect().y());
         
-        OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(bufferRect.size(), false);
+        OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(bufferRect.size());
         if (!imageBuffer)
             return true;
         
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/WebCoreNSStringExtras.mm b/src/3rdparty/webkit/WebCore/platform/mac/WebCoreNSStringExtras.mm
index b7087f1..d6c3f0c 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/WebCoreNSStringExtras.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/WebCoreNSStringExtras.mm
@@ -29,6 +29,8 @@
 #import "config.h"
 #import "WebCoreNSStringExtras.h"
 
+#import <wtf/RetainPtr.h>
+
 BOOL stringIsCaseInsensitiveEqualToString(NSString *first, NSString *second)
 {
     return [first compare:second options:(NSCaseInsensitiveSearch|NSLiteralSearch)] == NSOrderedSame;
@@ -69,50 +71,41 @@ NSString *filenameByFixingIllegalCharacters(NSString *string)
 CFStringEncoding stringEncodingForResource(Handle resource)
 {
     short resRef = HomeResFile(resource);
-    if (ResError() != noErr) {
+    if (ResError() != noErr)
         return NSMacOSRomanStringEncoding;
-    }
     
     // Get the FSRef for the current resource file
     FSRef fref;
     OSStatus error = FSGetForkCBInfo(resRef, 0, NULL, NULL, NULL, &fref, NULL);
-    if (error != noErr) {
+    if (error != noErr)
         return NSMacOSRomanStringEncoding;
-    }
     
-    CFURLRef URL = CFURLCreateFromFSRef(NULL, &fref);
-    if (URL == NULL) {
+    RetainPtr<CFURLRef> url(AdoptCF, CFURLCreateFromFSRef(NULL, &fref));
+    if (!url)
         return NSMacOSRomanStringEncoding;
-    }
-    
-    NSString *path = [(NSURL *)URL path];
-    CFRelease(URL);
-    
+
+    NSString *path = [(NSURL *)url.get() path];
+
     // Get the lproj directory name
     path = [path stringByDeletingLastPathComponent];
-    if (!stringIsCaseInsensitiveEqualToString([path pathExtension], @"lproj")) {
+    if (!stringIsCaseInsensitiveEqualToString([path pathExtension], @"lproj"))
         return NSMacOSRomanStringEncoding;
-    }
     
     NSString *directoryName = [[path stringByDeletingPathExtension] lastPathComponent];
-    CFStringRef locale = CFLocaleCreateCanonicalLocaleIdentifierFromString(NULL, (CFStringRef)directoryName);
-    if (locale == NULL) {
+    RetainPtr<CFStringRef> locale(AdoptCF, CFLocaleCreateCanonicalLocaleIdentifierFromString(NULL, (CFStringRef)directoryName));
+    if (!locale)
         return NSMacOSRomanStringEncoding;
-    }
-            
+
     LangCode lang;
     RegionCode region;
-    error = LocaleStringToLangAndRegionCodes([(NSString *)locale UTF8String], &lang, &region);
-    CFRelease(locale);
-    if (error != noErr) {
+    error = LocaleStringToLangAndRegionCodes([(NSString *)locale.get() UTF8String], &lang, &region);
+    if (error != noErr)
         return NSMacOSRomanStringEncoding;
-    }
-    
+
     TextEncoding encoding;
     error = UpgradeScriptInfoToTextEncoding(kTextScriptDontCare, lang, region, NULL, &encoding);
-    if (error != noErr) {
+    if (error != noErr)
         return NSMacOSRomanStringEncoding;
-    }
     
     return encoding;
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/mock/GeolocationServiceMock.cpp b/src/3rdparty/webkit/WebCore/platform/mock/GeolocationServiceMock.cpp
new file mode 100644
index 0000000..f187104
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/mock/GeolocationServiceMock.cpp
@@ -0,0 +1,136 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "GeolocationServiceMock.h"
+
+#include "Logging.h"
+#include "Geolocation.h"
+#include "Geoposition.h"
+#include "PositionError.h"
+#include "PositionOptions.h"
+
+namespace WebCore {
+
+GeolocationServiceMock::GeolocationServiceSet* GeolocationServiceMock::s_instances = 0;
+RefPtr<Geoposition>* GeolocationServiceMock::s_lastPosition;
+RefPtr<PositionError>* GeolocationServiceMock::s_lastError;
+
+GeolocationService* GeolocationServiceMock::create(GeolocationServiceClient* client)
+{
+    initStatics();
+    return new GeolocationServiceMock(client);
+}
+
+GeolocationServiceMock::GeolocationServiceMock(GeolocationServiceClient* client)
+    : GeolocationService(client)
+    , m_timer(this, &GeolocationServiceMock::timerFired)
+    , m_isActive(false)
+{
+    s_instances->add(this);
+}
+
+GeolocationServiceMock::~GeolocationServiceMock()
+{
+    GeolocationServiceSet::iterator iter = s_instances->find(this);
+    ASSERT(iter != s_instances->end());
+    s_instances->remove(iter);
+    cleanUpStatics();
+}
+
+void GeolocationServiceMock::setPosition(PassRefPtr<Geoposition> position)
+{
+    initStatics();
+    GeolocationService::useMock();
+    *s_lastPosition = position;
+    *s_lastError = 0;
+    makeGeolocationCallbackFromAllInstances();
+}
+
+void GeolocationServiceMock::setError(PassRefPtr<PositionError> error)
+{
+    initStatics();
+    GeolocationService::useMock();
+    *s_lastError = error;
+    *s_lastPosition = 0;
+    makeGeolocationCallbackFromAllInstances();
+}
+
+bool GeolocationServiceMock::startUpdating(PositionOptions*)
+{
+    m_isActive = true;
+    m_timer.startOneShot(0);
+    return true;
+}
+
+void GeolocationServiceMock::stopUpdating()
+{
+    m_isActive = false;
+}
+
+void GeolocationServiceMock::timerFired(Timer<GeolocationServiceMock>* timer)
+{
+    ASSERT_UNUSED(timer, timer == &m_timer);
+    makeGeolocationCallback();
+}
+
+void GeolocationServiceMock::makeGeolocationCallbackFromAllInstances()
+{
+    GeolocationServiceSet::const_iterator end = s_instances->end();
+    for (GeolocationServiceSet::const_iterator iter = s_instances->begin(); iter != end; ++iter)
+        (*iter)->makeGeolocationCallback();
+}
+
+void GeolocationServiceMock::makeGeolocationCallback()
+{
+    if (!m_isActive)
+        return;
+
+    if (*s_lastPosition)
+        positionChanged();
+    else if (*s_lastError)
+        errorOccurred();
+}
+
+void GeolocationServiceMock::initStatics()
+{
+    if (s_instances == 0) { 
+        s_instances = new GeolocationServiceSet;
+        s_lastPosition = new RefPtr<Geoposition>;
+        s_lastError = new RefPtr<PositionError>;
+    }
+}
+
+void GeolocationServiceMock::cleanUpStatics()
+{
+    if (s_instances->size() == 0) {
+        delete s_instances;
+        s_instances = 0;
+        delete s_lastPosition;
+        delete s_lastError;
+    }
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/mock/GeolocationServiceMock.h b/src/3rdparty/webkit/WebCore/platform/mock/GeolocationServiceMock.h
new file mode 100644
index 0000000..7d02797
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/mock/GeolocationServiceMock.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef GeolocationServiceMock_h
+#define GeolocationServiceMock_h
+
+#include "GeolocationService.h"
+#include "Timer.h"
+#include <wtf/HashSet.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+// This class provides a mock implementation of a GeolocationService for testing
+// purposes. It allows the position or error that will be reported by this class
+// to be set manually using the setPosition and setError methods. Objects of
+// this class call back to their respective GeolocationServiceClient with the
+// position or error every time either of these is updated.
+class GeolocationServiceMock : public GeolocationService {
+  public:
+    static GeolocationService* create(GeolocationServiceClient*);
+
+    GeolocationServiceMock(GeolocationServiceClient*);
+    virtual ~GeolocationServiceMock();
+
+    virtual bool startUpdating(PositionOptions*);
+    virtual void stopUpdating();
+
+    static void setPosition(PassRefPtr<Geoposition> position);
+    static void setError(PassRefPtr<PositionError> position);
+
+    virtual Geoposition* lastPosition() const { return s_lastPosition->get(); }
+    virtual PositionError* lastError() const { return s_lastError->get(); }
+
+  private:
+    static void makeGeolocationCallbackFromAllInstances();
+    void makeGeolocationCallback();
+
+    void timerFired(Timer<GeolocationServiceMock>*);
+
+    static void initStatics();
+    static void cleanUpStatics();
+
+    typedef HashSet<GeolocationServiceMock*> GeolocationServiceSet;
+    static GeolocationServiceSet* s_instances;
+
+    static RefPtr<Geoposition>* s_lastPosition;
+    static RefPtr<PositionError>* s_lastError;
+
+    Timer<GeolocationServiceMock> m_timer;
+
+    bool m_isActive;
+};
+
+} // namespace WebCore
+
+#endif // GeolocationServiceMock_h
diff --git a/src/3rdparty/webkit/WebCore/platform/network/Credential.cpp b/src/3rdparty/webkit/WebCore/platform/network/Credential.cpp
index 4743959..caca785 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/Credential.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/Credential.cpp
@@ -43,6 +43,11 @@ Credential::Credential(const String& user, const String& password, CredentialPer
     , m_persistence(persistence)
 {
 }
+
+bool Credential::isEmpty()
+{
+    return m_user.isEmpty() && m_password.isEmpty();
+}
     
 const String& Credential::user() const
 { 
diff --git a/src/3rdparty/webkit/WebCore/platform/network/Credential.h b/src/3rdparty/webkit/WebCore/platform/network/Credential.h
index 4d80490..ca4a45a 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/Credential.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/Credential.h
@@ -41,6 +41,8 @@ public:
     Credential();
     Credential(const String& user, const String& password, CredentialPersistence);
     
+    bool isEmpty();
+    
     const String& user() const;
     const String& password() const;
     bool hasPassword() const;
diff --git a/src/3rdparty/webkit/WebCore/platform/network/CredentialStorage.cpp b/src/3rdparty/webkit/WebCore/platform/network/CredentialStorage.cpp
new file mode 100644
index 0000000..b7f4c01
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/network/CredentialStorage.cpp
@@ -0,0 +1,120 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CredentialStorage.h"
+
+#include "CString.h"
+#include "Credential.h"
+#include "KURL.h"
+#include "ProtectionSpaceHash.h"
+#include "StringHash.h"
+
+#include <wtf/StdLibExtras.h>
+
+namespace WebCore {
+
+typedef HashMap<ProtectionSpace, Credential> ProtectionSpaceToCredentialMap;
+static ProtectionSpaceToCredentialMap& protectionSpaceToCredentialMap()
+{
+    DEFINE_STATIC_LOCAL(ProtectionSpaceToCredentialMap, map, ());
+    return map;
+}
+
+typedef HashMap<String, HashMap<String, Credential> > OriginToDefaultBasicCredentialMap;
+static OriginToDefaultBasicCredentialMap& originToDefaultBasicCredentialMap()
+{
+    DEFINE_STATIC_LOCAL(OriginToDefaultBasicCredentialMap, map, ());
+    return map;
+}
+    
+static String originStringFromURL(const KURL& url)
+{
+    if (url.port())
+        return url.protocol() + "://" + url.host() + String::format(":%i/", url.port());
+    
+    return url.protocol() + "://" + url.host() + "/";
+}
+
+void CredentialStorage::set(const Credential& credential, const ProtectionSpace& protectionSpace, const KURL& url)
+{
+    protectionSpaceToCredentialMap().set(protectionSpace, credential);
+    
+    ProtectionSpaceAuthenticationScheme scheme = protectionSpace.authenticationScheme();
+    if (url.protocolInHTTPFamily() && (scheme == ProtectionSpaceAuthenticationSchemeHTTPBasic || scheme == ProtectionSpaceAuthenticationSchemeDefault)) {
+        String origin = originStringFromURL(url);
+        
+        HashMap<String, Credential> pathToCredentialMap;
+        pair<HashMap<String, HashMap<String, Credential> >::iterator, bool> result = originToDefaultBasicCredentialMap().add(origin, pathToCredentialMap);
+        
+        // Remove the last path component that is not a directory to determine the subpath for which this credential applies.
+        String path = url.path();
+        if (!path.endsWith("/")) {
+            int index = path.reverseFind('/');
+            if (index != -1)
+                path = path.substring(0, index);
+        }
+        if (path.endsWith("/") && path.length() > 1)
+            path = path.substring(0, path.length() - 1);
+        
+        result.first->second.set(path, credential);
+    }
+}
+
+Credential CredentialStorage::get(const ProtectionSpace& protectionSpace)
+{
+    return protectionSpaceToCredentialMap().get(protectionSpace);
+}
+
+Credential CredentialStorage::getDefaultAuthenticationCredential(const KURL& url)
+{
+    ASSERT(url.protocolInHTTPFamily());
+    String origin = originStringFromURL(url);
+    const HashMap<String, Credential>& pathToCredentialMap(originToDefaultBasicCredentialMap().get(origin));
+    if (pathToCredentialMap.isEmpty())
+        return Credential();
+    
+    // Check to see if there is a stored credential for the subpath ancestry of this url.
+    String path = url.path();
+    Credential credential = pathToCredentialMap.get(path);
+    while (credential.isEmpty() && !path.isNull()) {
+        int index = path.reverseFind('/');
+        if (index == 0) {
+            path = String();
+            credential = pathToCredentialMap.get("/");
+        } else if (index == -1) {
+            // This case should never happen, as all HTTP URL paths should start with a leading /
+            ASSERT_NOT_REACHED();
+            credential = pathToCredentialMap.get(path);
+            path = String();
+        } else {
+            path = path.substring(0, index);
+            credential = pathToCredentialMap.get(path);
+        }
+    }
+    return credential;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/Coordinates.cpp b/src/3rdparty/webkit/WebCore/platform/network/CredentialStorage.h
index 728882a..737efa6 100644
--- a/src/3rdparty/webkit/WebCore/page/Coordinates.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/CredentialStorage.h
@@ -23,16 +23,22 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#include "config.h"
-#include "Coordinates.h"
+#ifndef SessionCredentialStorage_h
+#define SessionCredentialStorage_h
 
 namespace WebCore {
 
-String Coordinates::toString() const
-{
-    return String::format("coordinate(%.6lg, %.6lg, %.6lg, %.6lg, %.6lg, %.6lg, %.6lg)",
-                          m_latitude, m_longitude, m_altitude, m_accuracy,
-                          m_altitudeAccuracy, m_heading, m_speed);
-}
+class Credential;
+class KURL;
+class ProtectionSpace;
+
+class CredentialStorage {
+public:
+    static void set(const Credential&, const ProtectionSpace&, const KURL&);
+    static Credential get(const ProtectionSpace&);
+    static Credential getDefaultAuthenticationCredential(const KURL&);
+};
 
 } // namespace WebCore
+
+#endif // SessionCredentialStorage_h
diff --git a/src/3rdparty/webkit/WebCore/platform/network/HTTPParsers.cpp b/src/3rdparty/webkit/WebCore/platform/network/HTTPParsers.cpp
index e57401e..9202660 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/HTTPParsers.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/HTTPParsers.cpp
@@ -100,6 +100,13 @@ bool parseHTTPRefresh(const String& refresh, bool fromHttpEquivMeta, double& del
                 if (refresh[urlEndPos] == quotationMark)
                     break;
             }
+            
+            // https://bugs.webkit.org/show_bug.cgi?id=27868
+            // Sometimes there is no closing quote for the end of the URL even though there was an opening quote.
+            // If we looped over the entire alleged URL string back to the opening quote, just go ahead and use everything
+            // after the opening quote instead.
+            if (urlEndPos == urlStartPos)
+                urlEndPos = len;
         }
 
         url = refresh.substring(urlStartPos, urlEndPos - urlStartPos).stripWhiteSpace();
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ProtectionSpace.cpp b/src/3rdparty/webkit/WebCore/platform/network/ProtectionSpace.cpp
index bd73558..d04bcbe 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ProtectionSpace.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/ProtectionSpace.cpp
@@ -37,7 +37,11 @@ namespace WebCore {
 // combined with the semantics of the String(NSString*) constructor
 ProtectionSpace::ProtectionSpace()
     : m_host("")
+    , m_port(0)
+    , m_serverType(ProtectionSpaceServerHTTP)
     , m_realm("")
+    , m_authenticationScheme(ProtectionSpaceAuthenticationSchemeDefault)
+    , m_isHashTableDeletedValue(false)
 {
 }
  
@@ -49,6 +53,7 @@ ProtectionSpace::ProtectionSpace(const String& host, int port, ProtectionSpaceSe
     , m_serverType(serverType)
     , m_realm(realm.length() ? realm : "")
     , m_authenticationScheme(authenticationScheme)
+    , m_isHashTableDeletedValue(false)
 {    
 }
     
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ProtectionSpace.h b/src/3rdparty/webkit/WebCore/platform/network/ProtectionSpace.h
index b7d4574..126b499 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ProtectionSpace.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/ProtectionSpace.h
@@ -46,7 +46,7 @@ enum ProtectionSpaceAuthenticationScheme {
   ProtectionSpaceAuthenticationSchemeHTTPDigest = 3,
   ProtectionSpaceAuthenticationSchemeHTMLForm = 4,
   ProtectionSpaceAuthenticationSchemeNTLM = 5,
-  ProtectionSpaceAuthenticationSchemeNegotiate = 6
+  ProtectionSpaceAuthenticationSchemeNegotiate = 6,
 };
 
 class ProtectionSpace {
@@ -54,6 +54,10 @@ class ProtectionSpace {
 public:
     ProtectionSpace();
     ProtectionSpace(const String& host, int port, ProtectionSpaceServerType, const String& realm, ProtectionSpaceAuthenticationScheme);
+
+    // Hash table deleted values, which are only constructed and never copied or destroyed.
+    ProtectionSpace(WTF::HashTableDeletedValueType) : m_isHashTableDeletedValue(true) { }
+    bool isHashTableDeletedValue() const { return m_isHashTableDeletedValue; }
     
     const String& host() const;
     int port() const;
@@ -70,10 +74,12 @@ private:
     ProtectionSpaceServerType m_serverType;
     String m_realm;
     ProtectionSpaceAuthenticationScheme m_authenticationScheme;
+    bool m_isHashTableDeletedValue;
 };
 
 bool operator==(const ProtectionSpace& a, const ProtectionSpace& b);
 inline bool operator!=(const ProtectionSpace& a, const ProtectionSpace& b) { return !(a == b); }
     
-}
-#endif
+} // namespace WebCore
+
+#endif // ProtectionSpace_h
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ProtectionSpaceHash.h b/src/3rdparty/webkit/WebCore/platform/network/ProtectionSpaceHash.h
new file mode 100644
index 0000000..6f68b5b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/network/ProtectionSpaceHash.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef ProtectionSpaceHash_h
+#define ProtectionSpaceHash_h
+
+#include "ProtectionSpace.h"
+
+namespace WebCore {
+
+struct ProtectionSpaceHash {
+    static unsigned hash(const ProtectionSpace& protectionSpace)
+    { 
+        unsigned hashCodes[5] = {
+            protectionSpace.host().impl() ? protectionSpace.host().impl()->hash() : 0, 
+            protectionSpace.port(), 
+            protectionSpace.serverType(),
+            protectionSpace.realm().impl() ? protectionSpace.realm().impl()->hash() : 0,
+            protectionSpace.authenticationScheme()
+        };
+
+        return StringImpl::computeHash(reinterpret_cast<UChar*>(hashCodes), sizeof(hashCodes) / sizeof(UChar));    
+    }
+    
+    static bool equal(const ProtectionSpace& a, const ProtectionSpace& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = false;
+};
+
+} // namespace WebCore
+
+namespace WTF {
+
+    // WebCore::ProtectionSpaceHash is the default hash for ProtectionSpace
+    template<> struct HashTraits<WebCore::ProtectionSpace> : GenericHashTraits<WebCore::ProtectionSpace> {
+        static const bool emptyValueIsZero = true;
+        static void constructDeletedValue(WebCore::ProtectionSpace& slot) { new (&slot) WebCore::ProtectionSpace(HashTableDeletedValue); }
+        static bool isDeletedValue(const WebCore::ProtectionSpace& slot) { return slot.isHashTableDeletedValue(); }
+    };
+
+    template<typename T> struct DefaultHash;
+    template<> struct DefaultHash<WebCore::ProtectionSpace> {
+        typedef WebCore::ProtectionSpaceHash Hash;
+    };
+
+} // namespace WTF
+
+
+#endif // ProtectionSpaceHash_h
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceHandle.h b/src/3rdparty/webkit/WebCore/platform/network/ResourceHandle.h
index 4cb3561..a7dc956 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceHandle.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceHandle.h
@@ -105,7 +105,7 @@ public:
     static PassRefPtr<ResourceHandle> create(const ResourceRequest&, ResourceHandleClient*, Frame*, bool defersLoading, bool shouldContentSniff, bool mightDownloadFromHandle = false);
 
     static void loadResourceSynchronously(const ResourceRequest&, StoredCredentials, ResourceError&, ResourceResponse&, Vector<char>& data, Frame* frame);
-    static bool willLoadFromCache(ResourceRequest&);
+    static bool willLoadFromCache(ResourceRequest&, Frame*);
 #if PLATFORM(MAC)
     static bool didSendBodyDataDelegateExists();
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceHandleClient.h b/src/3rdparty/webkit/WebCore/platform/network/ResourceHandleClient.h
index b8a8cbb..c99be54 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceHandleClient.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceHandleClient.h
@@ -56,7 +56,7 @@ namespace WebCore {
     enum CacheStoragePolicy {
         StorageAllowed,
         StorageAllowedInMemoryOnly,
-        StorageNotAllowed
+        StorageNotAllowed,
     };
     
     class ResourceHandleClient {
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceHandleInternal.h b/src/3rdparty/webkit/WebCore/platform/network/ResourceHandleInternal.h
index 091a26b..1733dea 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceHandleInternal.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceHandleInternal.h
@@ -150,6 +150,8 @@ namespace WebCore {
         String m_user;
         String m_pass;
         
+        Credential m_initialCredential;
+        
         int status;
 
         bool m_defersLoading;
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.cpp b/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.cpp
index bfa3dc6..a651a3f 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.cpp
@@ -62,7 +62,7 @@ auto_ptr<ResourceRequest> ResourceRequestBase::adopt(auto_ptr<CrossThreadResourc
         request->setResponseContentDispositionEncodingFallbackArray(encoding1, encoding2, encoding3);
     }
     request->setHTTPBody(data->m_httpBody);
-    request->setAllowHTTPCookies(data->m_allowHTTPCookies);
+    request->setAllowCookies(data->m_allowCookies);
     return request;
 }
 
@@ -83,7 +83,7 @@ auto_ptr<CrossThreadResourceRequestData> ResourceRequestBase::copyData() const
     }
     if (m_httpBody)
         data->m_httpBody = m_httpBody->deepCopy();
-    data->m_allowHTTPCookies = m_allowHTTPCookies;
+    data->m_allowCookies = m_allowCookies;
     return data;
 }
 
@@ -251,18 +251,18 @@ void ResourceRequestBase::setHTTPBody(PassRefPtr<FormData> httpBody)
         m_platformRequestUpdated = false;
 } 
 
-bool ResourceRequestBase::allowHTTPCookies() const 
+bool ResourceRequestBase::allowCookies() const
 {
     updateResourceRequest(); 
     
-    return m_allowHTTPCookies; 
+    return m_allowCookies;
 }
 
-void ResourceRequestBase::setAllowHTTPCookies(bool allowHTTPCookies)
+void ResourceRequestBase::setAllowCookies(bool allowCookies)
 {
     updateResourceRequest(); 
     
-    m_allowHTTPCookies = allowHTTPCookies; 
+    m_allowCookies = allowCookies;
     
     if (url().protocolInHTTPFamily())
         m_platformRequestUpdated = false;
@@ -274,6 +274,9 @@ void ResourceRequestBase::addHTTPHeaderField(const AtomicString& name, const Str
     pair<HTTPHeaderMap::iterator, bool> result = m_httpHeaderFields.add(name, value); 
     if (!result.second)
         result.first->second += "," + value;
+
+    if (url().protocolInHTTPFamily())
+        m_platformRequestUpdated = false;
 }
 
 void ResourceRequestBase::addHTTPHeaderFields(const HTTPHeaderMap& headerFields)
@@ -300,7 +303,7 @@ bool equalIgnoringHeaderFields(const ResourceRequestBase& a, const ResourceReque
     if (a.httpMethod() != b.httpMethod())
         return false;
     
-    if (a.allowHTTPCookies() != b.allowHTTPCookies())
+    if (a.allowCookies() != b.allowCookies())
         return false;
     
     FormData* formDataA = a.httpBody();
@@ -355,7 +358,7 @@ void ResourceRequestBase::updateResourceRequest() const
     m_resourceRequestUpdated = true;
 }
 
-#if !PLATFORM(MAC) && !USE(CFNETWORK)
+#if !PLATFORM(MAC) && !USE(CFNETWORK) && !USE(SOUP)
 unsigned initializeMaximumHTTPConnectionCountPerHost()
 {
     // This is used by the loader to control the number of issued parallel load requests. 
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.h b/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.h
index 740ebed..348e6b3 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceRequestBase.h
@@ -41,7 +41,7 @@ namespace WebCore {
         UseProtocolCachePolicy, // normal load
         ReloadIgnoringCacheData, // reload
         ReturnCacheDataElseLoad, // back/forward or encoding change - allow stale data
-        ReturnCacheDataDontLoad // results of a post - allow stale data and only use cache
+        ReturnCacheDataDontLoad, // results of a post - allow stale data and only use cache
     };
 
     const int unspecifiedTimeoutInterval = INT_MAX;
@@ -105,8 +105,8 @@ namespace WebCore {
         FormData* httpBody() const;
         void setHTTPBody(PassRefPtr<FormData> httpBody);
         
-        bool allowHTTPCookies() const;
-        void setAllowHTTPCookies(bool allowHTTPCookies);
+        bool allowCookies() const;
+        void setAllowCookies(bool allowCookies);
 
         bool isConditional() const;
 
@@ -129,7 +129,7 @@ namespace WebCore {
             , m_cachePolicy(policy)
             , m_timeoutInterval(unspecifiedTimeoutInterval)
             , m_httpMethod("GET")
-            , m_allowHTTPCookies(true)
+            , m_allowCookies(true)
             , m_resourceRequestUpdated(true)
             , m_platformRequestUpdated(false)
             , m_reportUploadProgress(false)
@@ -148,7 +148,7 @@ namespace WebCore {
         HTTPHeaderMap m_httpHeaderFields;
         Vector<String> m_responseContentDispositionEncodingFallbackArray;
         RefPtr<FormData> m_httpBody;
-        bool m_allowHTTPCookies;
+        bool m_allowCookies;
         mutable bool m_resourceRequestUpdated;
         mutable bool m_platformRequestUpdated;
         bool m_reportUploadProgress;
@@ -173,7 +173,7 @@ namespace WebCore {
         OwnPtr<CrossThreadHTTPHeaderMapData> m_httpHeaders;
         Vector<String> m_responseContentDispositionEncodingFallbackArray;
         RefPtr<FormData> m_httpBody;
-        bool m_allowHTTPCookies;
+        bool m_allowCookies;
     };
     
     unsigned initializeMaximumHTTPConnectionCountPerHost();
diff --git a/src/3rdparty/webkit/WebCore/platform/network/SocketStreamErrorBase.cpp b/src/3rdparty/webkit/WebCore/platform/network/SocketStreamErrorBase.cpp
new file mode 100644
index 0000000..72fb44c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/network/SocketStreamErrorBase.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SocketStreamError.h"
+
+namespace WebCore {
+
+SocketStreamError SocketStreamErrorBase::copy() const
+{
+    SocketStreamError errorCopy;
+    errorCopy.m_errorCode = m_errorCode;
+    return errorCopy;
+}
+
+bool SocketStreamErrorBase::compare(const SocketStreamError& a, const SocketStreamError& b)
+{
+    return a.errorCode() == b.errorCode();
+}
+
+}  // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/network/SocketStreamErrorBase.h b/src/3rdparty/webkit/WebCore/platform/network/SocketStreamErrorBase.h
new file mode 100644
index 0000000..b7ca35b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/network/SocketStreamErrorBase.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SocketStreamErrorBase_h
+#define SocketStreamErrorBase_h
+
+namespace WebCore {
+
+    class SocketStreamError;
+
+    class SocketStreamErrorBase {
+    public:
+        // Makes a deep copy.  Useful for when you need to use a SocketStreamError on another thread.
+        SocketStreamError copy() const;
+
+        bool isNull() const { return m_isNull; }
+
+        int errorCode() const { return m_errorCode; }
+
+        static bool compare(const SocketStreamError&, const SocketStreamError&);
+
+    protected:
+        SocketStreamErrorBase()
+            : m_errorCode(0)
+            , m_isNull(true)
+        {
+        }
+
+        explicit SocketStreamErrorBase(int errorCode)
+            : m_errorCode(errorCode)
+            , m_isNull(false)
+        {
+        }
+
+        int m_errorCode;
+        bool m_isNull;
+    };
+
+    inline bool operator==(const SocketStreamError& a, const SocketStreamError& b) { return SocketStreamErrorBase::compare(a, b); }
+    inline bool operator!=(const SocketStreamError& a, const SocketStreamError& b) { return !(a == b); }
+
+}  // namespace WebCore
+
+#endif  // SocketStreamErrorBase_h
diff --git a/src/3rdparty/webkit/WebCore/platform/network/SocketStreamHandleBase.cpp b/src/3rdparty/webkit/WebCore/platform/network/SocketStreamHandleBase.cpp
new file mode 100644
index 0000000..875c248
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/network/SocketStreamHandleBase.cpp
@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SocketStreamHandleBase.h"
+
+#include "SocketStreamHandleClient.h"
+
+namespace WebCore {
+
+const unsigned int bufferSize = 100 * 1024 * 1024;
+
+SocketStreamHandleBase::SocketStreamHandleBase(const KURL& url, SocketStreamHandleClient* client)
+    : m_url(url)
+    , m_client(client)
+    , m_state(Connecting)
+{
+}
+
+SocketStreamHandleBase::SocketStreamState SocketStreamHandleBase::state() const
+{
+    return m_state;
+}
+
+bool SocketStreamHandleBase::send(const char* data, int length)
+{
+    if (m_state == Connecting)
+        return false;
+    if (!m_buffer.isEmpty()) {
+        if (m_buffer.size() + length > bufferSize) {
+            // FIXME: report error to indicate that buffer has no more space.
+            return false;
+        }
+        m_buffer.append(data, length);
+        return true;
+    }
+    int bytesWritten = 0;
+    if (m_state == Open)
+        bytesWritten = platformSend(data, length);
+    if (bytesWritten <= 0)
+        return false;
+    if (m_buffer.size() + length - bytesWritten > bufferSize) {
+        // FIXME: report error to indicate that buffer has no more space.
+        return false;
+    }
+    if (bytesWritten < length)
+        m_buffer.append(data + bytesWritten, length - bytesWritten);
+    return true;
+}
+
+void SocketStreamHandleBase::close()
+{
+    platformClose();
+    m_state = Closed;
+}
+
+void SocketStreamHandleBase::setClient(SocketStreamHandleClient* client)
+{
+    ASSERT(!client || (!m_client && m_state == Connecting));
+    m_client = client;
+}
+
+bool SocketStreamHandleBase::sendPendingData()
+{
+    if (m_state != Open)
+        return false;
+    if (m_buffer.isEmpty())
+        return false;
+    int bytesWritten = platformSend(m_buffer.data(), m_buffer.size());
+    if (bytesWritten <= 0)
+        return false;
+    Vector<char> remainingData;
+    ASSERT(m_buffer.size() - bytesWritten <= bufferSize);
+    remainingData.append(m_buffer.data() + bytesWritten, m_buffer.size() - bytesWritten);
+    m_buffer.swap(remainingData);
+    return true;
+}
+
+}  // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/network/SocketStreamHandleBase.h b/src/3rdparty/webkit/WebCore/platform/network/SocketStreamHandleBase.h
new file mode 100644
index 0000000..fc011dd
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/network/SocketStreamHandleBase.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SocketStreamHandleBase_h
+#define SocketStreamHandleBase_h
+
+#include "KURL.h"
+
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+    class SocketStreamHandle;
+    class SocketStreamHandleClient;
+
+    class SocketStreamHandleBase {
+    public:
+        enum SocketStreamState { Connecting, Open, Closed };
+        virtual ~SocketStreamHandleBase() { }
+        SocketStreamState state() const;
+
+        bool send(const char* data, int length);
+        void close();
+        int bufferedAmount() const { return m_buffer.size(); }
+
+        SocketStreamHandleClient* client() const { return m_client; }
+        void setClient(SocketStreamHandleClient*);
+
+    protected:
+        SocketStreamHandleBase(const KURL&, SocketStreamHandleClient*);
+
+        bool sendPendingData();
+        virtual int platformSend(const char* data, int length) = 0;
+        virtual void platformClose() = 0;
+
+        KURL m_url;
+        SocketStreamHandleClient* m_client;
+        Vector<char> m_buffer;
+        SocketStreamState m_state;
+    };
+
+}  // namespace WebCore
+
+#endif  // SocketStreamHandleBase_h
diff --git a/src/3rdparty/webkit/WebCore/platform/network/SocketStreamHandleClient.h b/src/3rdparty/webkit/WebCore/platform/network/SocketStreamHandleClient.h
new file mode 100644
index 0000000..04c744e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/network/SocketStreamHandleClient.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SocketStreamHandleClient_h
+#define SocketStreamHandleClient_h
+
+namespace WebCore {
+
+    class AuthenticationChallenge;
+    class KURL;
+    class SocketStreamError;
+    class SocketStreamHandle;
+
+    class SocketStreamHandleClient {
+    public:
+        virtual ~SocketStreamHandleClient() { }
+
+        virtual void willOpenStream(SocketStreamHandle*, const KURL&) { }
+        virtual void willSendData(SocketStreamHandle*, const char* /*data*/, int /*length*/) { }
+
+        virtual void didOpen(SocketStreamHandle*) { }
+        virtual void didClose(SocketStreamHandle*) { }
+        virtual void didReceiveData(SocketStreamHandle*, const char* /*data*/, int /*length*/) { }
+
+        virtual void didFail(SocketStreamHandle*, const SocketStreamError&) { }
+
+        virtual void didReceiveAuthenticationChallenge(SocketStreamHandle*, const AuthenticationChallenge&) { }
+        virtual void didCancelAuthenticationChallenge(SocketStreamHandle*, const AuthenticationChallenge&) { }
+        virtual void receivedCancellation(SocketStreamHandle*, const AuthenticationChallenge&) { }
+    };
+
+}  // namespace WebCore
+
+#endif  // SocketStreamHandleClient_h
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/DnsPrefetchHelper.cpp b/src/3rdparty/webkit/WebCore/platform/network/qt/DnsPrefetchHelper.cpp
new file mode 100644
index 0000000..73da0a9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/DnsPrefetchHelper.cpp
@@ -0,0 +1,34 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "DnsPrefetchHelper.h"
+
+#include "CString.h"
+
+namespace WebCore {
+// this is called on mouse over a href and on page loading
+void prefetchDNS(const String& hostname)
+{
+    if (QWebSettings::globalSettings()->testAttribute(QWebSettings::DnsPrefetchEnabled)) {
+        static DnsPrefetchHelper dnsPrefetchHelper;
+        dnsPrefetchHelper.lookup(QString(hostname));
+    }
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/DnsPrefetchHelper.h b/src/3rdparty/webkit/WebCore/platform/network/qt/DnsPrefetchHelper.h
new file mode 100644
index 0000000..e85d2dc
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/DnsPrefetchHelper.h
@@ -0,0 +1,75 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+#ifndef DNSPREFETCHHELPER_H
+#define DNSPREFETCHHELPER_H
+
+#include <QObject>
+#include <QCache>
+#include <QHostInfo>
+#include <QSet>
+#include <QString>
+#include <QTime>
+#include "qwebsettings.h"
+
+namespace WebCore {
+
+    class DnsPrefetchHelper : public QObject {
+        Q_OBJECT
+    public:
+        DnsPrefetchHelper() : QObject(), currentLookups(0) {};
+
+    public slots:
+        void lookup(QString hostname)
+        {
+            if (hostname.isEmpty())
+                return; // this actually happens
+            if (currentLookups >= 10)
+                return; // do not launch more than 10 lookups at the same time
+
+            QTime* entryTime = lookupCache.object(hostname);
+            if (entryTime && entryTime->elapsed() > 300*1000) {
+                // delete knowledge about lookup if it is already 300 seconds old
+                lookupCache.remove(hostname);
+            } else if (!entryTime) {
+                // not in cache yet, can look it up
+                QTime *tmpTime = new QTime();
+                *tmpTime = QTime::currentTime();
+                lookupCache.insert(hostname, tmpTime);
+                currentLookups++;
+                QHostInfo::lookupHost(hostname, this, SLOT(lookedUp(QHostInfo)));
+            }
+        }
+
+        void lookedUp(const QHostInfo &host)
+        {
+            // we do not cache the result, we throw it away.
+            // we currently rely on the OS to cache the results. If it does not do that
+            // then at least the ISP nameserver did it.
+            currentLookups--;
+        }
+
+    protected:
+        QCache<QString, QTime> lookupCache; // 100 entries
+        int currentLookups;
+    };
+
+
+}
+
+#endif // DNSPREFETCHHELPER_H
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
index 898e5f4..eac430f 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
@@ -131,10 +131,11 @@ void FormDataIODevice::slotFinished()
 
 QNetworkReplyHandler::QNetworkReplyHandler(ResourceHandle* handle, LoadMode loadMode)
     : QObject(0)
-    , m_resourceHandle(handle)
     , m_reply(0)
+    , m_resourceHandle(handle)
     , m_redirected(false)
     , m_responseSent(false)
+    , m_responseDataSent(false)
     , m_loadMode(loadMode)
     , m_shouldStart(true)
     , m_shouldFinish(false)
@@ -226,8 +227,12 @@ void QNetworkReplyHandler::finish()
         start();
     } else if (m_reply->error() != QNetworkReply::NoError
                // a web page that returns 401/403/404 can still have content
-               && m_reply->error() != QNetworkReply::ContentOperationNotPermittedError
+               && ((m_reply->error() != QNetworkReply::ContentOperationNotPermittedError
                && m_reply->error() != QNetworkReply::ContentNotFoundError
+               && m_reply->error() != QNetworkReply::ProtocolUnknownError
+               && m_reply->error() != QNetworkReply::UnknownContentError)
+               // If the web page sent content, let's give it to the user.
+               || !m_responseDataSent)
                && m_reply->error() != QNetworkReply::AuthenticationRequiredError
                && m_reply->error() != QNetworkReply::ProxyAuthenticationRequiredError) {
         QUrl url = m_reply->url();
@@ -347,8 +352,10 @@ void QNetworkReplyHandler::forwardData()
     if (!client)
         return;
 
-    if (!data.isEmpty())
+    if (!data.isEmpty()) {
+        m_responseDataSent = true;
         client->didReceiveData(m_resourceHandle, data.constData(), data.length(), data.length() /*FixMe*/);
+    }
 }
 
 void QNetworkReplyHandler::start()
@@ -421,6 +428,7 @@ void QNetworkReplyHandler::resetState()
 {
     m_redirected = false;
     m_responseSent = false;
+    m_responseDataSent = false;
     m_shouldStart = true;
     m_shouldFinish = false;
     m_shouldSendResponse = false;
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.h b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.h
index f88ce8a..545119e 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.h
@@ -73,6 +73,7 @@ private:
     ResourceHandle* m_resourceHandle;
     bool m_redirected;
     bool m_responseSent;
+    bool m_responseDataSent;
     LoadMode m_loadMode;
     QNetworkAccessManager::Operation m_method;
     QNetworkRequest m_request;
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/ResourceHandleQt.cpp b/src/3rdparty/webkit/WebCore/platform/network/qt/ResourceHandleQt.cpp
index c5816a4..f4c30c9 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/qt/ResourceHandleQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/ResourceHandleQt.cpp
@@ -35,6 +35,7 @@
 #include "ResourceHandleClient.h"
 #include "ResourceHandleInternal.h"
 #include "qwebpage_p.h"
+#include "qwebframe_p.h"
 #include "ChromeClientQt.h"
 #include "FrameLoaderClientQt.h"
 #include "Page.h"
@@ -42,6 +43,9 @@
 
 #include "NotImplemented.h"
 
+#if QT_VERSION >= 0x040500
+#include <QAbstractNetworkCache>
+#endif
 #include <QCoreApplication>
 #include <QUrl>
 #if QT_VERSION >= 0x040400
@@ -73,11 +77,10 @@ private:
     ResourceResponse m_response;
     ResourceError m_error;
     Vector<char> m_data;
-    bool m_finished;
+    QEventLoop m_eventLoop;
 };
 
 WebCoreSynchronousLoader::WebCoreSynchronousLoader()
-    : m_finished(false)
 {
 }
 
@@ -93,19 +96,18 @@ void WebCoreSynchronousLoader::didReceiveData(ResourceHandle*, const char* data,
 
 void WebCoreSynchronousLoader::didFinishLoading(ResourceHandle*)
 {
-    m_finished = true;
+    m_eventLoop.exit();
 }
 
 void WebCoreSynchronousLoader::didFail(ResourceHandle*, const ResourceError& error)
 {
     m_error = error;
-    m_finished = true;
+    m_eventLoop.exit();
 }
 
 void WebCoreSynchronousLoader::waitForCompletion()
 {
-    while (!m_finished)
-        QCoreApplication::processEvents(QEventLoop::ExcludeUserInputEvents);
+    m_eventLoop.exec(QEventLoop::ExcludeUserInputEvents);
 }
 
 ResourceHandleInternal::~ResourceHandleInternal()
@@ -154,10 +156,28 @@ bool ResourceHandle::loadsBlocked()
     return false;
 }
 
-bool ResourceHandle::willLoadFromCache(ResourceRequest& request)
+bool ResourceHandle::willLoadFromCache(ResourceRequest& request, Frame* frame)
 {
-    notImplemented();
+    if (!frame)
+        return false;
+
+#if QT_VERSION >= 0x040500
+    QNetworkAccessManager* manager = QWebFramePrivate::kit(frame)->page()->networkAccessManager();
+    QAbstractNetworkCache* cache = manager->cache();
+
+    if (!cache)
+        return false;
+
+    QNetworkCacheMetaData data = cache->metaData(request.url());
+    if (data.isValid()) {
+        request.setCachePolicy(ReturnCacheDataDontLoad);
+        return true;
+    }
+
     return false;
+#else
+    return false;
+#endif
 }
 
 bool ResourceHandle::supportsBufferedData()
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/ResourceRequest.h b/src/3rdparty/webkit/WebCore/platform/network/qt/ResourceRequest.h
index af76f61..93dacf3 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/qt/ResourceRequest.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/ResourceRequest.h
@@ -38,7 +38,7 @@ namespace WebCore {
     struct ResourceRequest : ResourceRequestBase {
 
         ResourceRequest(const String& url) 
-            : ResourceRequestBase(KURL(url), UseProtocolCachePolicy)
+            : ResourceRequestBase(KURL(ParsedURLString, url), UseProtocolCachePolicy)
         {
         }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.cpp
index 82b12a8..666ad18 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.cpp
@@ -229,7 +229,7 @@ static CachedImage* getCachedImage(Element* element)
     if (!renderer || !renderer->isImage())
         return 0;
 
-    RenderImage* image = static_cast<RenderImage*>(renderer);
+    RenderImage* image = toRenderImage(renderer);
     if (image->cachedImage() && !image->cachedImage()->errorOccurred())
         return image->cachedImage();
 
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/CookieJarQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/CookieJarQt.cpp
index 40d9309..56d3372 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/CookieJarQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/CookieJarQt.cpp
@@ -28,6 +28,7 @@
 #include "config.h"
 #include "CookieJar.h"
 
+#include "Cookie.h"
 #include "Document.h"
 #include "KURL.h"
 #include "PlatformString.h"
@@ -128,6 +129,18 @@ bool cookiesEnabled(const Document* document)
 #endif
 }
 
+bool getRawCookies(const Document*, const KURL&, Vector<Cookie>& rawCookies)
+{
+    // FIXME: Not yet implemented
+    rawCookies.clear();
+    return false; // return true when implemented
+}
+
+void deleteCookie(const Document*, const KURL&, const String&)
+{
+    // FIXME: Not yet implemented
+}
+
 }
 
 // vim: ts=4 sw=4 et
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/DragDataQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/DragDataQt.cpp
index 7b1eff8..c8c0be1 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/DragDataQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/DragDataQt.cpp
@@ -128,7 +128,7 @@ String DragData::asURL(String* title) const
     if (urls.isEmpty())
         return String();
 
-    return urls.first().toString();
+    return encodeWithURLEscapeSequences(urls.first().toString());
 }
 
 PassRefPtr<DocumentFragment> DragData::asFragment(Document* doc) const
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/FileSystemQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/FileSystemQt.cpp
index 28d3ca7..4093fad 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/FileSystemQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/FileSystemQt.cpp
@@ -81,7 +81,7 @@ bool makeAllDirectories(const String& path)
 
 String pathByAppendingComponent(const String& path, const String& component)
 {
-    return QDir(path).filePath(component);
+    return QDir::toNativeSeparators(QDir(path).filePath(component));
 }
 
 String homeDirectoryPath()
@@ -117,7 +117,9 @@ Vector<String> listDirectory(const String& path, const String& filter)
 
 CString openTemporaryFile(const char* prefix, PlatformFileHandle& handle)
 {
-    QFile *temp = new QTemporaryFile(QLatin1String(prefix));
+    QTemporaryFile* tempFile = new QTemporaryFile(QLatin1String(prefix));
+    tempFile->setAutoRemove(false);
+    QFile* temp = tempFile;
     if (temp->open(QIODevice::ReadWrite)) {
         handle = temp;
         return String(temp->fileName()).utf8();
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/Localizations.cpp b/src/3rdparty/webkit/WebCore/platform/qt/Localizations.cpp
index d1853fc..0733617 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/Localizations.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/Localizations.cpp
@@ -362,5 +362,111 @@ String mediaElementLiveBroadcastStateText()
     return QCoreApplication::translate("QWebPage", "Live Broadcast", "Media controller status message when watching a live broadcast");
 }
 
+#if ENABLE(VIDEO)
+
+String localizedMediaControlElementString(const String& name)
+{
+    if (name == "AudioElement")
+        return QCoreApplication::translate("QWebPage", "Audio Element", "Media controller element");
+    if (name == "VideoElement")
+        return QCoreApplication::translate("QWebPage", "Video Element", "Media controller element");
+    if (name == "MuteButton")
+        return QCoreApplication::translate("QWebPage", "Mute Button", "Media controller element");
+    if (name == "UnMuteButton")
+        return QCoreApplication::translate("QWebPage", "Unmute Button", "Media controller element");
+    if (name == "PlayButton")
+        return QCoreApplication::translate("QWebPage", "Play Button", "Media controller element");
+    if (name == "PauseButton")
+        return QCoreApplication::translate("QWebPage", "Pause Button", "Media controller element");
+    if (name == "Slider")
+        return QCoreApplication::translate("QWebPage", "Slider", "Media controller element");
+    if (name == "SliderThumb")
+        return QCoreApplication::translate("QWebPage", "Slider Thumb", "Media controller element");
+    if (name == "RewindButton")
+        return QCoreApplication::translate("QWebPage", "Rewind Button", "Media controller element");
+    if (name == "ReturnToRealtimeButton")
+        return QCoreApplication::translate("QWebPage", "Return to Real-time Button", "Media controller element");
+    if (name == "CurrentTimeDisplay")
+        return QCoreApplication::translate("QWebPage", "Elapsed Time", "Media controller element");
+    if (name == "TimeRemainingDisplay")
+        return QCoreApplication::translate("QWebPage", "Remaining Time", "Media controller element");
+    if (name == "StatusDisplay")
+        return QCoreApplication::translate("QWebPage", "Status Display", "Media controller element");
+    if (name == "FullscreenButton")
+        return QCoreApplication::translate("QWebPage", "Fullscreen Button", "Media controller element");
+    if (name == "SeekForwardButton")
+        return QCoreApplication::translate("QWebPage", "Seek Forward Button", "Media controller element");
+    if (name == "SeekBackButton")
+        return QCoreApplication::translate("QWebPage", "Seek Back Button", "Media controller element");
+
+    return String();
+}
+
+String localizedMediaControlElementHelpText(const String& name)
+{
+    if (name == "AudioElement")
+        return QCoreApplication::translate("QWebPage", "Audio element playback controls and status display", "Media controller element");
+    if (name == "VideoElement")
+        return QCoreApplication::translate("QWebPage", "Video element playback controls and status display", "Media controller element");
+    if (name == "MuteButton")
+        return QCoreApplication::translate("QWebPage", "Mute audio tracks", "Media controller element");
+    if (name == "UnMuteButton")
+        return QCoreApplication::translate("QWebPage", "Unmute audio tracks", "Media controller element");
+    if (name == "PlayButton")
+        return QCoreApplication::translate("QWebPage", "Begin playback", "Media controller element");
+    if (name == "PauseButton")
+        return QCoreApplication::translate("QWebPage", "Pause playback", "Media controller element");
+    if (name == "Slider")
+        return QCoreApplication::translate("QWebPage", "Movie time scrubber", "Media controller element");
+    if (name == "SliderThumb")
+        return QCoreApplication::translate("QWebPage", "Movie time scrubber thumb", "Media controller element");
+    if (name == "RewindButton")
+        return QCoreApplication::translate("QWebPage", "Rewind movie", "Media controller element");
+    if (name == "ReturnToRealtimeButton")
+        return QCoreApplication::translate("QWebPage", "Return streaming movie to real-time", "Media controller element");
+    if (name == "CurrentTimeDisplay")
+        return QCoreApplication::translate("QWebPage", "Current movie time", "Media controller element");
+    if (name == "TimeRemainingDisplay")
+        return QCoreApplication::translate("QWebPage", "Remaining move time", "Media controller element");
+    if (name == "StatusDisplay")
+        return QCoreApplication::translate("QWebPage", "Current movie status", "Media controller element");
+    if (name == "FullscreenButton")
+        return QCoreApplication::translate("QWebPage", "Play movie in full-screen mode", "Media controller element");
+    if (name == "SeekForwardButton")
+        return QCoreApplication::translate("QWebPage", "Seek quickly back", "Media controller element");
+    if (name == "SeekBackButton")
+        return QCoreApplication::translate("QWebPage", "Seek quickly forward", "Media controller element");
+
+    ASSERT_NOT_REACHED();
+    return String();
+}
+
+String localizedMediaTimeDescription(float time)
+{
+    if (!isfinite(time))
+        return QCoreApplication::translate("QWebPage," "Indefinite time", "Media time description");
+
+    int seconds = (int)fabsf(time);
+    int days = seconds / (60 * 60 * 24);
+    int hours = seconds / (60 * 60);
+    int minutes = (seconds / 60) % 60;
+    seconds %= 60;
+
+    if (days) {
+        return QCoreApplication::translate("QWebPage," "%1 days %2 hours %3 minutes %4 seconds", "Media time description").arg(days).arg(hours).arg(minutes).arg(seconds);
+    }
+
+    if (hours) {
+        return QCoreApplication::translate("QWebPage," "%1 hours %2 minutes %3 seconds", "Media time description").arg(hours).arg(minutes).arg(seconds);
+    }
+
+    if (minutes) {
+        return QCoreApplication::translate("QWebPage," "%1 minutes %2 seconds", "Media time description").arg(minutes).arg(seconds);
+    }
+
+    return QCoreApplication::translate("QWebPage," "%1 seconds", "Media time description").arg(seconds);
+}
+#endif  // ENABLE(VIDEO)
+
 }
 // vim: ts=4 sw=4 et
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/PasteboardQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/PasteboardQt.cpp
index 8a377ad..969de62 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/PasteboardQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/PasteboardQt.cpp
@@ -138,7 +138,7 @@ void Pasteboard::writeImage(Node* node, const KURL&, const String&)
     ASSERT(node && node->renderer() && node->renderer()->isImage());
 
 #ifndef QT_NO_CLIPBOARD
-    CachedImage* cachedImage = static_cast<RenderImage*>(node->renderer())->cachedImage();
+    CachedImage* cachedImage = toRenderImage(node->renderer())->cachedImage();
     ASSERT(cachedImage);
 
     Image* image = cachedImage->image();
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/PlatformKeyboardEventQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
index 43a294b..935882a 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
@@ -138,42 +138,48 @@ static String keyIdentifierForQtKeyCode(int keyCode)
     }
 }
 
-static int windowsKeyCodeForKeyEvent(unsigned int keycode)
+static int windowsKeyCodeForKeyEvent(unsigned int keycode, bool isKeypad = false)
 {
-    switch (keycode) {
-        /* FIXME: Need to supply a bool in this func, to determine wheter the event comes from the keypad
+    // Determine wheter the event comes from the keypad
+    if (isKeypad) {
+        switch (keycode) {
         case Qt::Key_0:
-            return VK_NUMPAD0;// (60) Numeric keypad 0 key
+            return VK_NUMPAD0;  // (60) Numeric keypad 0 key
         case Qt::Key_1:
-            return VK_NUMPAD1;// (61) Numeric keypad 1 key
+            return VK_NUMPAD1;  // (61) Numeric keypad 1 key
         case Qt::Key_2:
             return  VK_NUMPAD2; // (62) Numeric keypad 2 key
         case Qt::Key_3:
-            return VK_NUMPAD3; // (63) Numeric keypad 3 key
+            return VK_NUMPAD3;  // (63) Numeric keypad 3 key
         case Qt::Key_4:
-            return VK_NUMPAD4; // (64) Numeric keypad 4 key
+            return VK_NUMPAD4;  // (64) Numeric keypad 4 key
         case Qt::Key_5:
-            return VK_NUMPAD5; //(65) Numeric keypad 5 key
+            return VK_NUMPAD5;  // (65) Numeric keypad 5 key
         case Qt::Key_6:
-            return VK_NUMPAD6; // (66) Numeric keypad 6 key
+            return VK_NUMPAD6;  // (66) Numeric keypad 6 key
         case Qt::Key_7:
-            return VK_NUMPAD7; // (67) Numeric keypad 7 key
+            return VK_NUMPAD7;  // (67) Numeric keypad 7 key
         case Qt::Key_8:
-            return VK_NUMPAD8; // (68) Numeric keypad 8 key
+            return VK_NUMPAD8;  // (68) Numeric keypad 8 key
         case Qt::Key_9:
-            return VK_NUMPAD9; // (69) Numeric keypad 9 key
+            return VK_NUMPAD9;  // (69) Numeric keypad 9 key
         case Qt::Key_Asterisk:
             return VK_MULTIPLY; // (6A) Multiply key
         case Qt::Key_Plus:
-            return VK_ADD; // (6B) Add key
+            return VK_ADD;      // (6B) Add key
         case Qt::Key_Minus:
             return VK_SUBTRACT; // (6D) Subtract key
         case Qt::Key_Period:
-            return VK_DECIMAL; // (6E) Decimal key
+            return VK_DECIMAL;  // (6E) Decimal key
         case Qt::Key_Slash:
-            return VK_DIVIDE; // (6F) Divide key
+            return VK_DIVIDE;   // (6F) Divide key
+        default:
+            return 0;
+        }
 
-        */
+    } else
+
+    switch (keycode) {
         case Qt::Key_Backspace:
             return VK_BACK; // (08) BACKSPACE key
         case Qt::Key_Backtab:
@@ -494,9 +500,9 @@ PlatformKeyboardEvent::PlatformKeyboardEvent(QKeyEvent* event)
     m_ctrlKey = (state & Qt::ControlModifier) != 0;
     m_altKey = (state & Qt::AltModifier) != 0;
     m_metaKey = (state & Qt::MetaModifier) != 0;
-    m_windowsVirtualKeyCode = windowsKeyCodeForKeyEvent(event->key());
-    m_nativeVirtualKeyCode = event->nativeVirtualKey();
     m_isKeypad = (state & Qt::KeypadModifier) != 0;
+    m_windowsVirtualKeyCode = windowsKeyCodeForKeyEvent(event->key(), m_isKeypad);
+    m_nativeVirtualKeyCode = event->nativeVirtualKey();
     m_shiftKey = (state & Qt::ShiftModifier) != 0 || event->key() == Qt::Key_Backtab; // Simulate Shift+Tab with Key_Backtab
     m_qtEvent = event;
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/PlatformMouseEventQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/PlatformMouseEventQt.cpp
index 6c1d82d..e486e68 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/PlatformMouseEventQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/PlatformMouseEventQt.cpp
@@ -31,9 +31,46 @@
 #include <wtf/CurrentTime.h>
 
 #include <QMouseEvent>
+#include <QGraphicsSceneMouseEvent>
 
 namespace WebCore {
 
+PlatformMouseEvent::PlatformMouseEvent(QGraphicsSceneMouseEvent* event, int clickCount)
+{
+    m_timestamp = WTF::currentTime();
+
+    switch (event->type()) {
+    case QEvent::GraphicsSceneMouseDoubleClick:
+    case QEvent::GraphicsSceneMousePress:
+        m_eventType = MouseEventPressed;
+        break;
+    case QEvent::GraphicsSceneMouseRelease:
+        m_eventType = MouseEventReleased;
+        break;
+    case QEvent::GraphicsSceneMouseMove:
+    default:
+        m_eventType = MouseEventMoved;
+    }
+
+    m_position = IntPoint(event->pos().toPoint());
+    m_globalPosition = IntPoint(event->screenPos());
+
+    if (event->button() == Qt::LeftButton || (event->buttons() & Qt::LeftButton))
+        m_button = LeftButton;
+    else if (event->button() == Qt::RightButton || (event->buttons() & Qt::RightButton))
+        m_button = RightButton;
+    else if (event->button() == Qt::MidButton || (event->buttons() & Qt::MidButton))
+        m_button = MiddleButton;
+    else
+        m_button = NoButton;
+
+    m_clickCount = clickCount;
+    m_shiftKey =  (event->modifiers() & Qt::ShiftModifier) != 0;
+    m_ctrlKey = (event->modifiers() & Qt::ControlModifier) != 0;
+    m_altKey =  (event->modifiers() & Qt::AltModifier) != 0;
+    m_metaKey = (event->modifiers() & Qt::MetaModifier) != 0;
+}
+
 PlatformMouseEvent::PlatformMouseEvent(QInputEvent* event, int clickCount)
 {
     m_timestamp = WTF::currentTime();
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/PopupMenuQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/PopupMenuQt.cpp
index 867e4ea..11dfe41 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/PopupMenuQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/PopupMenuQt.cpp
@@ -34,10 +34,11 @@
 
 #include <QAction>
 #include <QDebug>
-#include <QMenu>
-#include <QPoint>
 #include <QListWidget>
 #include <QListWidgetItem>
+#include <QMenu>
+#include <QPoint>
+#include <QStandardItemModel>
 #include <QWidgetAction>
 
 namespace WebCore {
@@ -63,25 +64,21 @@ void PopupMenu::populate(const IntRect& r)
     clear();
     Q_ASSERT(client());
 
+    QStandardItemModel* model = qobject_cast<QStandardItemModel*>(m_popup->model());
+    Q_ASSERT(model);
+
     int size = client()->listSize();
     for (int i = 0; i < size; i++) {
-        if (client()->itemIsSeparator(i)) {
-            //FIXME: better seperator item
-            m_popup->insertItem(i, QString::fromLatin1("---"));
-        } else {
-            //PopupMenuStyle style = client()->itemStyle(i);
+        if (client()->itemIsSeparator(i))
+            m_popup->insertSeparator(i);
+        else {
             m_popup->insertItem(i, client()->itemText(i));
-#if 0
-            item = new QListWidgetItem(client()->itemText(i));
-            m_actions.insert(item, i);
-            if (style->font() != Font())
-                item->setFont(style->font());
-
-            Qt::ItemFlags flags = Qt::ItemIsSelectable;
-            if (client()->itemIsEnabled(i))
-                flags |= Qt::ItemIsEnabled;
-            item->setFlags(flags);
-#endif
+
+            if (model && !client()->itemIsEnabled(i))
+                model->item(i)->setEnabled(false);
+
+            if (client()->itemIsSelected(i))
+                m_popup->setCurrentIndex(i);
         }
     }
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/QWebPopup.cpp b/src/3rdparty/webkit/WebCore/platform/qt/QWebPopup.cpp
index f437c27..d077079 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/QWebPopup.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/QWebPopup.cpp
@@ -71,7 +71,7 @@ void QWebPopup::hidePopup()
         return;
 
     m_popupVisible = false;
-    m_client->hidePopup();
+    m_client->popupDidHide();
 }
 
 void QWebPopup::activeChanged(int index)
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.cpp
index 5f64219..f250047 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.cpp
@@ -28,36 +28,36 @@
  */
 
 #include "config.h"
-
-#include "qwebpage.h"
 #include "RenderThemeQt.h"
+
+#include "CSSStyleSelector.h"
+#include "CSSStyleSheet.h"
 #include "ChromeClientQt.h"
+#include "Color.h"
+#include "Document.h"
+#include "Font.h"
+#include "FontSelector.h"
+#include "GraphicsContext.h"
+#include "HTMLMediaElement.h"
+#include "HTMLNames.h"
 #include "NotImplemented.h"
+#include "Page.h"
+#include "RenderBox.h"
+#include "RenderTheme.h"
+#include "qwebpage.h"
 
 #include <QApplication>
 #include <QColor>
 #include <QDebug>
 #include <QFile>
-#include <QWidget>
+#include <QLineEdit>
 #include <QPainter>
 #include <QPushButton>
-#include <QLineEdit>
 #include <QStyleFactory>
 #include <QStyleOptionButton>
 #include <QStyleOptionFrameV2>
+#include <QWidget>
 
-#include "Color.h"
-#include "CSSStyleSelector.h"
-#include "CSSStyleSheet.h"
-#include "FontSelector.h"
-#include "Document.h"
-#include "Page.h"
-#include "Font.h"
-#include "RenderTheme.h"
-#include "GraphicsContext.h"
-#include "HTMLMediaElement.h"
-#include "HTMLNames.h"
-#include "RenderBox.h"
 
 namespace WebCore {
 
@@ -182,8 +182,7 @@ int RenderThemeQt::baselinePosition(const RenderObject* o) const
     if (!o->isBox())
         return 0;
 
-    if (o->style()->appearance() == CheckboxPart ||
-        o->style()->appearance() == RadioPart)
+    if (o->style()->appearance() == CheckboxPart || o->style()->appearance() == RadioPart)
         return toRenderBox(o)->marginTop() + toRenderBox(o)->height() - 2; // Same as in old khtml
     return RenderTheme::baselinePosition(o);
 }
@@ -227,8 +226,8 @@ static QRect inflateButtonRect(const QRect& originalRect, QStyle* style)
         int paddingBottom = originalRect.bottom() - layoutRect.bottom();
 
         return originalRect.adjusted(-paddingLeft, -paddingTop, paddingRight, paddingBottom);
-    } else
-        return originalRect;
+    }
+    return originalRect;
 }
 
 void RenderThemeQt::adjustRepaintRect(const RenderObject* o, IntRect& rect)
@@ -419,8 +418,6 @@ void RenderThemeQt::adjustButtonStyle(CSSStyleSelector* selector, RenderStyle* s
 
     setButtonSize(style);
     setButtonPadding(style);
-
-    style->setColor(QApplication::palette().text().color());
 }
 
 void RenderThemeQt::setButtonSize(RenderStyle* style) const
@@ -492,7 +489,6 @@ bool RenderThemeQt::paintButton(RenderObject* o, const RenderObject::PaintInfo&
 void RenderThemeQt::adjustTextFieldStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
 {
     style->setBackgroundColor(Color::transparent);
-    style->setColor(QApplication::palette().text().color());
     style->resetBorder();
     style->resetPadding();
     computeSizeBasedOnStyle(style);
@@ -551,8 +547,6 @@ void RenderThemeQt::adjustMenuListStyle(CSSStyleSelector*, RenderStyle* style, E
 
     // Add in the padding that we'd like to use.
     setPopupPadding(style);
-
-    style->setColor(QApplication::palette().text().color());
 }
 
 void RenderThemeQt::setPopupPadding(RenderStyle* style) const
@@ -578,7 +572,7 @@ bool RenderThemeQt::paintMenuList(RenderObject* o, const RenderObject::PaintInfo
     QStyleOptionComboBox opt;
     if (p.widget)
         opt.initFrom(p.widget);
-    ControlPart appearance = applyTheme(opt, o);
+    applyTheme(opt, o);
 
     const QPoint topLeft = r.topLeft();
     p.painter->translate(topLeft);
@@ -607,8 +601,6 @@ void RenderThemeQt::adjustMenuListButtonStyle(CSSStyleSelector* selector, Render
 
     // Add in the padding that we'd like to use.
     setPopupPadding(style);
-
-    style->setColor(QApplication::palette().text().color());
 }
 
 bool RenderThemeQt::paintMenuListButton(RenderObject* o, const RenderObject::PaintInfo& i,
@@ -705,17 +697,17 @@ bool RenderThemeQt::paintSearchFieldResultsDecoration(RenderObject* o, const Ren
 bool RenderThemeQt::supportsFocus(ControlPart appearance) const
 {
     switch (appearance) {
-        case PushButtonPart:
-        case ButtonPart:
-        case TextFieldPart:
-        case TextAreaPart:
-        case ListboxPart:
-        case MenulistPart:
-        case RadioPart:
-        case CheckboxPart:
-            return true;
-        default: // No for all others...
-            return false;
+    case PushButtonPart:
+    case ButtonPart:
+    case TextFieldPart:
+    case TextAreaPart:
+    case ListboxPart:
+    case MenulistPart:
+    case RadioPart:
+    case CheckboxPart:
+        return true;
+    default: // No for all others...
+        return false;
     }
 }
 
@@ -746,20 +738,20 @@ ControlPart RenderThemeQt::applyTheme(QStyleOption& option, RenderObject* o) con
     ControlPart result = o->style()->appearance();
 
     switch (result) {
-        case PushButtonPart:
-        case SquareButtonPart:
-        case ButtonPart:
-        case ButtonBevelPart:
-        case ListItemPart:
-        case MenulistButtonPart:
-        case SearchFieldResultsButtonPart:
-        case SearchFieldCancelButtonPart: {
-            if (isPressed(o))
-                option.state |= QStyle::State_Sunken;
-            else if (result == PushButtonPart)
-                option.state |= QStyle::State_Raised;
-            break;
-        }
+    case PushButtonPart:
+    case SquareButtonPart:
+    case ButtonPart:
+    case ButtonBevelPart:
+    case ListItemPart:
+    case MenulistButtonPart:
+    case SearchFieldResultsButtonPart:
+    case SearchFieldCancelButtonPart: {
+        if (isPressed(o))
+            option.state |= QStyle::State_Sunken;
+        else if (result == PushButtonPart)
+            option.state |= QStyle::State_Raised;
+        break;
+    }
     }
 
     if (result == RadioPart || result == CheckboxPart)
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/TemporaryLinkStubs.cpp b/src/3rdparty/webkit/WebCore/platform/qt/TemporaryLinkStubs.cpp
index 8ef598f..d37d412 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/TemporaryLinkStubs.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/TemporaryLinkStubs.cpp
@@ -114,11 +114,6 @@ float userIdleTime()
 }
 #endif
 
-void prefetchDNS(const String& hostname)
-{
-    notImplemented();
-}
-
 }
 
 // vim: ts=4 sw=4 et
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/WheelEventQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/WheelEventQt.cpp
index 9534f20..66118e1 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/WheelEventQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/WheelEventQt.cpp
@@ -25,9 +25,48 @@
 
 #include <qapplication.h>
 #include <QWheelEvent>
+#include <QGraphicsSceneWheelEvent>
 
 namespace WebCore {
 
+void PlatformWheelEvent::applyDelta(int delta, Qt::Orientation orientation)
+{
+    if (orientation == Qt::Horizontal) {
+        m_deltaX = (delta / 120);
+        m_deltaY = 0;
+    } else {
+        m_deltaX = 0;
+        m_deltaY = (delta / 120);
+    }
+
+    m_wheelTicksX = m_deltaX;
+    m_wheelTicksY = m_deltaY;
+
+    // Use the same single scroll step as QTextEdit
+    // (in QTextEditPrivate::init [h,v]bar->setSingleStep)
+    static const float cDefaultQtScrollStep = 20.f;
+    m_deltaX *= QApplication::wheelScrollLines() * cDefaultQtScrollStep;
+    m_deltaY *= QApplication::wheelScrollLines() * cDefaultQtScrollStep;
+}
+
+PlatformWheelEvent::PlatformWheelEvent(QGraphicsSceneWheelEvent* e)
+#ifdef QT_NO_WHEELEVENT
+{
+    Q_UNUSED(e);
+}
+#else
+    : m_position(e->pos().toPoint())
+    , m_globalPosition(e->screenPos())
+    , m_granularity(ScrollByPixelWheelEvent)
+    , m_isAccepted(false)
+    , m_shiftKey(e->modifiers() & Qt::ShiftModifier)
+    , m_ctrlKey(e->modifiers() & Qt::ControlModifier)
+    , m_altKey(e->modifiers() & Qt::AltModifier)
+    , m_metaKey(e->modifiers() & Qt::MetaModifier)
+{
+    applyDelta(e->delta(), e->orientation());
+}
+#endif // QT_NO_WHEELEVENT
 
 PlatformWheelEvent::PlatformWheelEvent(QWheelEvent* e)
 #ifdef QT_NO_WHEELEVENT
@@ -44,21 +83,7 @@ PlatformWheelEvent::PlatformWheelEvent(QWheelEvent* e)
     , m_altKey(e->modifiers() & Qt::AltModifier)
     , m_metaKey(e->modifiers() & Qt::MetaModifier)
 {
-    if (e->orientation() == Qt::Horizontal) {
-        m_deltaX = (e->delta() / 120);
-        m_deltaY = 0;
-    } else {
-        m_deltaX = 0;
-        m_deltaY = (e->delta() / 120);
-    }
-    m_wheelTicksX = m_deltaX;
-    m_wheelTicksY = m_deltaY;
-
-    // use the same single scroll step as QTextEdit (in
-    // QTextEditPrivate::init [h,v]bar->setSingleStep )
-    static const float cDefaultQtScrollStep = 20.f;
-    m_deltaX *= QApplication::wheelScrollLines() * cDefaultQtScrollStep;
-    m_deltaY *= QApplication::wheelScrollLines() * cDefaultQtScrollStep;
+    applyDelta(e->delta(), e->orientation());
 }
 #endif // QT_NO_WHEELEVENT
 
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/WidgetQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/WidgetQt.cpp
index 9f1a1e8..abcd584 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/WidgetQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/WidgetQt.cpp
@@ -81,8 +81,15 @@ void Widget::setFocus()
 void Widget::setCursor(const Cursor& cursor)
 {
 #ifndef QT_NO_CURSOR
-    if (QWidget* widget = root()->hostWindow()->platformWindow())
-        QCoreApplication::postEvent(widget, new SetCursorEvent(cursor.impl()));
+    QWidget* widget = root()->hostWindow()->platformWindow();
+
+    if (!widget)
+        return;
+
+    if (!cursor.impl().bitmap() && widget->cursor().shape() == cursor.impl().shape())
+        return;
+
+    widget->setProperty("WebCoreCursor", cursor.impl());
 #endif
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/sql/SQLiteTransaction.cpp b/src/3rdparty/webkit/WebCore/platform/sql/SQLiteTransaction.cpp
index 5018f5a..0a236be 100644
--- a/src/3rdparty/webkit/WebCore/platform/sql/SQLiteTransaction.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/sql/SQLiteTransaction.cpp
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -38,16 +38,16 @@ SQLiteTransaction::SQLiteTransaction(SQLiteDatabase& db)
 
 SQLiteTransaction::~SQLiteTransaction()
 {
-    if (m_inProgress) 
+    if (m_inProgress)
         rollback();
 }
-    
+
 void SQLiteTransaction::begin()
 {
     if (!m_inProgress) {
         ASSERT(!m_db.m_transactionInProgress);
         m_inProgress = m_db.executeCommand("BEGIN;");
-        m_db.m_transactionInProgress = true;
+        m_db.m_transactionInProgress = m_inProgress;
     }
 }
 
@@ -76,5 +76,5 @@ void SQLiteTransaction::stop()
     m_inProgress = false;
     m_db.m_transactionInProgress = false;
 }
-    
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/text/CString.cpp b/src/3rdparty/webkit/WebCore/platform/text/CString.cpp
index 90990f8..5b8ac58 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/CString.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/CString.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,10 +27,19 @@
 #include "config.h"
 #include "CString.h"
 
+#include "Base64.h"
+
 using std::min;
 
 namespace WebCore {
 
+PassRefPtr<CStringBuffer> CStringBuffer::base64Encode()
+{
+    Vector<char> encoded;
+    WebCore::base64Encode(m_vector, encoded);
+    return CStringBuffer::create(encoded);
+}
+
 CString::CString(const char* str)
 {
     init(str, strlen(str));
@@ -90,6 +99,11 @@ void CString::copyBufferIfNeeded()
     memcpy(m_buffer->mutableData(), m_temp->data(), len);
 }
 
+CString CString::base64Encode()
+{
+    return CString(m_buffer->base64Encode().get());
+}
+
 bool operator==(const CString& a, const CString& b)
 {
     if (a.isNull() != b.isNull())
diff --git a/src/3rdparty/webkit/WebCore/platform/text/CString.h b/src/3rdparty/webkit/WebCore/platform/text/CString.h
index f084ddf..2d1cc2b 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/CString.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/CString.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -43,9 +43,12 @@ namespace WebCore {
         friend class CString;
 
         static PassRefPtr<CStringBuffer> create(unsigned length) { return adoptRef(new CStringBuffer(length)); }
+        static PassRefPtr<CStringBuffer> create(const Vector<char>& vectorToAdopt) { return adoptRef(new CStringBuffer(vectorToAdopt)); }
         CStringBuffer(unsigned length) : m_vector(length) { }
+        CStringBuffer(const Vector<char>& vectorToAdopt) : m_vector(vectorToAdopt) { }
         char* mutableData() { return m_vector.data(); }
 
+        PassRefPtr<CStringBuffer> base64Encode();
         Vector<char> m_vector;
     };
 
@@ -59,6 +62,8 @@ namespace WebCore {
         CString(CStringBuffer* buffer) : m_buffer(buffer) { }
         static CString newUninitialized(size_t length, char*& characterBuffer);
 
+        CString base64Encode();
+        
         const char* data() const;
         char* mutableData();
         unsigned length() const;
diff --git a/src/3rdparty/webkit/WebCore/platform/text/PlatformString.h b/src/3rdparty/webkit/WebCore/platform/text/PlatformString.h
index ee2c8ce..258b28d 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/PlatformString.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/PlatformString.h
@@ -56,6 +56,10 @@ QT_END_NAMESPACE
 class wxString;
 #endif
 
+#if PLATFORM(HAIKU)
+class BString;
+#endif
+
 namespace WebCore {
 
 class CString;
@@ -229,6 +233,11 @@ public:
     operator wxString() const;
 #endif
 
+#if PLATFORM(HAIKU)
+    String(const BString&);
+    operator BString() const;
+#endif
+
 #ifndef NDEBUG
     Vector<char> ascii() const;
 #endif
@@ -272,6 +281,8 @@ inline bool equalIgnoringCase(const String& a, const String& b) { return equalIg
 inline bool equalIgnoringCase(const String& a, const char* b) { return equalIgnoringCase(a.impl(), b); }
 inline bool equalIgnoringCase(const char* a, const String& b) { return equalIgnoringCase(a, b.impl()); }
 
+inline bool equalIgnoringNullity(const String& a, const String& b) { return equalIgnoringNullity(a.impl(), b.impl()); }
+
 inline bool operator!(const String& str) { return str.isNull(); }
 
 inline void swap(String& a, String& b) { a.swap(b); }
diff --git a/src/3rdparty/webkit/WebCore/platform/text/RegularExpression.cpp b/src/3rdparty/webkit/WebCore/platform/text/RegularExpression.cpp
index 6329b3b..9b063c9 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/RegularExpression.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/RegularExpression.cpp
@@ -32,7 +32,7 @@
 
 namespace WebCore {
 
-class RegularExpression::Private : public RefCounted<Private> {
+class RegularExpression::Private : public RefCounted<RegularExpression::Private> {
 public:
     static PassRefPtr<Private> create(const String& pattern, TextCaseSensitivity);
     ~Private();
diff --git a/src/3rdparty/webkit/WebCore/platform/text/String.cpp b/src/3rdparty/webkit/WebCore/platform/text/String.cpp
index 97e2d4d..2730939 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/String.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/String.cpp
@@ -1,6 +1,7 @@
 /*
  * (C) 1999 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007-2009 Torch Mobile, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -353,6 +354,29 @@ String String::format(const char *format, ...)
     va_end(args);
 
     return buffer;
+
+#elif PLATFORM(WINCE)
+    va_list args;
+    va_start(args, format);
+
+    Vector<char, 256> buffer;
+
+    int bufferSize = 256;
+    buffer.resize(bufferSize);
+    for (;;) {
+        int written = vsnprintf(buffer.data(), bufferSize, format, args);
+        va_end(args);
+
+        if (written == 0)
+            return String("");
+        if (written > 0)
+            return StringImpl::create(buffer.data(), written);
+        
+        bufferSize <<= 1;
+        buffer.resize(bufferSize);
+        va_start(args, format);
+    }
+
 #else
     va_list args;
     va_start(args, format);
diff --git a/src/3rdparty/webkit/WebCore/platform/text/StringImpl.cpp b/src/3rdparty/webkit/WebCore/platform/text/StringImpl.cpp
index 8cbcc0d..8b749c7 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/StringImpl.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/StringImpl.cpp
@@ -539,9 +539,8 @@ static bool equal(const UChar* a, const char* b, int length)
     return true;
 }
 
-static bool equalIgnoringCase(const UChar* a, const char* b, int length)
+bool equalIgnoringCase(const UChar* a, const char* b, unsigned length)
 {
-    ASSERT(length >= 0);
     while (length--) {
         unsigned char bc = *b++;
         if (foldCase(*a++) != foldCase(bc))
@@ -929,6 +928,18 @@ bool equalIgnoringCase(StringImpl* a, const char* b)
     return equal && !b[length];
 }
 
+bool equalIgnoringNullity(StringImpl* a, StringImpl* b)
+{
+    if (StringHash::equal(a, b))
+        return true;
+    if (!a && b && !b->length())
+        return true;
+    if (!b && a && !a->length())
+        return true;
+
+    return false;
+}
+
 Vector<char> StringImpl::ascii()
 {
     Vector<char> buffer(m_length + 1);
diff --git a/src/3rdparty/webkit/WebCore/platform/text/StringImpl.h b/src/3rdparty/webkit/WebCore/platform/text/StringImpl.h
index 4325925..8b4e82d 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/StringImpl.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/StringImpl.h
@@ -199,7 +199,7 @@ private:
 
     enum StringImplFlags {
         HasTerminatingNullCharacter,
-        InTable
+        InTable,
     };
 
     unsigned m_length;
@@ -220,6 +220,10 @@ inline bool equal(const char* a, StringImpl* b) { return equal(b, a); }
 bool equalIgnoringCase(StringImpl*, StringImpl*);
 bool equalIgnoringCase(StringImpl*, const char*);
 inline bool equalIgnoringCase(const char* a, StringImpl* b) { return equalIgnoringCase(b, a); }
+bool equalIgnoringCase(const UChar* a, const char* b, unsigned length);
+inline bool equalIgnoringCase(const char* a, const UChar* b, unsigned length) { return equalIgnoringCase(b, a, length); }
+
+bool equalIgnoringNullity(StringImpl*, StringImpl*);
 
 // Golden ratio - arbitrary start value to avoid mapping all 0's to all 0's
 // or anything like that.
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextCodec.h b/src/3rdparty/webkit/WebCore/platform/text/TextCodec.h
index 36d7c6e..3c74165 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextCodec.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextCodec.h
@@ -51,7 +51,7 @@ namespace WebCore {
         // Encodes the character as en entity as above, but escaped
         // non-alphanumeric characters. This is used in URLs.
         // For example, U+6DE would be "%26%231758%3B".
-        URLEncodedEntitiesForUnencodables
+        URLEncodedEntitiesForUnencodables,
     };
 
     typedef char UnencodableReplacementArray[32];
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextEncoding.cpp b/src/3rdparty/webkit/WebCore/platform/text/TextEncoding.cpp
index 5fa927b..b76f739 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextEncoding.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextEncoding.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2004, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov <ap@nypop.com>
+ * Copyright (C) 2007-2009 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -113,6 +114,10 @@ CString TextEncoding::encode(const UChar* characters, size_t length, Unencodable
     QString str(reinterpret_cast<const QChar*>(characters), length);
     str = str.normalized(QString::NormalizationForm_C);
     return newTextCodec(*this)->encode(reinterpret_cast<const UChar *>(str.utf16()), str.length(), handling);
+#elif PLATFORM(WINCE)
+    // normalization will be done by Windows CE API
+    OwnPtr<TextCodec> textCodec = newTextCodec(*this);
+    return textCodec.get() ? textCodec->encode(characters, length, handling) : CString();
 #endif
 }
 
diff --git a/src/3rdparty/webkit/WebCore/platform/text/TextEncodingRegistry.cpp b/src/3rdparty/webkit/WebCore/platform/text/TextEncodingRegistry.cpp
index 3c9d65f..5ab1c87 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/TextEncodingRegistry.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/TextEncodingRegistry.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007-2009 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -47,6 +48,9 @@
 #if PLATFORM(QT)
 #include "qt/TextCodecQt.h"
 #endif
+#if PLATFORM(WINCE)
+#include "TextCodecWince.h"
+#endif
 
 using namespace WTF;
 
@@ -189,6 +193,11 @@ static void buildBaseTextCodecMaps()
     TextCodecICU::registerBaseEncodingNames(addToTextEncodingNameMap);
     TextCodecICU::registerBaseCodecs(addToTextCodecMap);
 #endif
+
+#if PLATFORM(WINCE)
+    TextCodecWince::registerBaseEncodingNames(addToTextEncodingNameMap);
+    TextCodecWince::registerBaseCodecs(addToTextCodecMap);
+#endif
 }
 
 static void extendTextCodecMaps()
@@ -207,6 +216,11 @@ static void extendTextCodecMaps()
     TextCodecMac::registerEncodingNames(addToTextEncodingNameMap);
     TextCodecMac::registerCodecs(addToTextCodecMap);
 #endif
+
+#if PLATFORM(WINCE)
+    TextCodecWince::registerExtendedEncodingNames(addToTextEncodingNameMap);
+    TextCodecWince::registerExtendedCodecs(addToTextCodecMap);
+#endif
 }
 
 PassOwnPtr<TextCodec> newTextCodec(const TextEncoding& encoding)
diff --git a/src/3rdparty/webkit/WebCore/platform/text/UnicodeRange.h b/src/3rdparty/webkit/WebCore/platform/text/UnicodeRange.h
index 7ecf03f..2278a0e 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/UnicodeRange.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/UnicodeRange.h
@@ -35,6 +35,10 @@
 #ifndef UnicodeRange_H
 #define UnicodeRange_H
 
+#if PLATFORM(HAIKU)
+#include "stdint.h"
+#endif
+
 #include <wtf/unicode/Unicode.h>
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/platform/text/cf/StringCF.cpp b/src/3rdparty/webkit/WebCore/platform/text/cf/StringCF.cpp
index 5e12ba9..b770d0e 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/cf/StringCF.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/cf/StringCF.cpp
@@ -45,7 +45,7 @@ String::String(CFStringRef str)
 CFStringRef String::createCFString() const
 {
     if (!m_impl)
-        return CFSTR("");
+        return static_cast<CFStringRef>(CFRetain(CFSTR("")));
 
     return m_impl->createCFString();
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/text/mac/TextCodecMac.cpp b/src/3rdparty/webkit/WebCore/platform/text/mac/TextCodecMac.cpp
index 93b9da2..a1750c9 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/mac/TextCodecMac.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/mac/TextCodecMac.cpp
@@ -36,7 +36,7 @@
 #include <wtf/PassOwnPtr.h>
 #include <wtf/Threading.h>
 
-using std::min;
+using namespace std;
 
 namespace WebCore {
 
@@ -141,7 +141,7 @@ OSStatus TextCodecMac::decode(const unsigned char* inputBuffer, int inputBufferL
         // First, fill the partial character buffer with as many bytes as are available.
         ASSERT(m_numBufferedBytes < sizeof(m_bufferedBytes));
         const int spaceInBuffer = sizeof(m_bufferedBytes) - m_numBufferedBytes;
-        const int bytesToPutInBuffer = MIN(spaceInBuffer, inputBufferLength);
+        const int bytesToPutInBuffer = min(spaceInBuffer, inputBufferLength);
         ASSERT(bytesToPutInBuffer != 0);
         memcpy(m_bufferedBytes + m_numBufferedBytes, inputBuffer, bytesToPutInBuffer);
 
@@ -283,28 +283,28 @@ CString TextCodecMac::encode(const UChar* characters, size_t length, Unencodable
     // Encoding will change the yen sign back into a backslash.
     String copy(characters, length);
     copy.replace('\\', m_backslashAsCurrencySymbol);
-    CFStringRef cfs = copy.createCFString();
+    RetainPtr<CFStringRef> cfs(AdoptCF, copy.createCFString());
 
     CFIndex startPos = 0;
-    CFIndex charactersLeft = CFStringGetLength(cfs);
+    CFIndex charactersLeft = CFStringGetLength(cfs.get());
     Vector<char> result;
     size_t size = 0;
     UInt8 lossByte = handling == QuestionMarksForUnencodables ? '?' : 0;
     while (charactersLeft > 0) {
         CFRange range = CFRangeMake(startPos, charactersLeft);
         CFIndex bufferLength;
-        CFStringGetBytes(cfs, range, m_encoding, lossByte, false, NULL, 0x7FFFFFFF, &bufferLength);
+        CFStringGetBytes(cfs.get(), range, m_encoding, lossByte, false, NULL, 0x7FFFFFFF, &bufferLength);
 
         result.grow(size + bufferLength);
         unsigned char* buffer = reinterpret_cast<unsigned char*>(result.data() + size);
-        CFIndex charactersConverted = CFStringGetBytes(cfs, range, m_encoding, lossByte, false, buffer, bufferLength, &bufferLength);
+        CFIndex charactersConverted = CFStringGetBytes(cfs.get(), range, m_encoding, lossByte, false, buffer, bufferLength, &bufferLength);
         size += bufferLength;
 
         if (charactersConverted != charactersLeft) {
-            unsigned badChar = CFStringGetCharacterAtIndex(cfs, startPos + charactersConverted);
+            unsigned badChar = CFStringGetCharacterAtIndex(cfs.get(), startPos + charactersConverted);
             ++charactersConverted;
             if ((badChar & 0xFC00) == 0xD800 && charactersConverted != charactersLeft) { // is high surrogate
-                UniChar low = CFStringGetCharacterAtIndex(cfs, startPos + charactersConverted);
+                UniChar low = CFStringGetCharacterAtIndex(cfs.get(), startPos + charactersConverted);
                 if ((low & 0xFC00) == 0xDC00) { // is low surrogate
                     badChar <<= 10;
                     badChar += low;
@@ -322,7 +322,6 @@ CString TextCodecMac::encode(const UChar* characters, size_t length, Unencodable
         startPos += charactersConverted;
         charactersLeft -= charactersConverted;
     }
-    CFRelease(cfs);
     return CString(result.data(), size);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginDatabase.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginDatabase.cpp
index de1c298..f40ed95 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginDatabase.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginDatabase.cpp
@@ -21,7 +21,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -29,11 +29,19 @@
 
 #include "Frame.h"
 #include "KURL.h"
+#include "PluginDatabaseClient.h"
 #include "PluginPackage.h"
 #include <stdlib.h>
 
 namespace WebCore {
 
+typedef HashMap<String, RefPtr<PluginPackage> > PluginPackageByNameMap;
+
+PluginDatabase::PluginDatabase()
+    : m_client(0)
+{
+}
+
 PluginDatabase* PluginDatabase::installedPlugins(bool populate)
 {
     static PluginDatabase* plugins = 0;
@@ -109,9 +117,11 @@ bool PluginDatabase::refresh()
             remove(oldPackage.get());
         }
 
-        RefPtr<PluginPackage> package = PluginPackage::createPackage(*it, lastModified);
-        if (package && add(package.release()))
-            pluginSetChanged = true;
+        if (!m_client || m_client->shouldLoadPluginAtPath(*it)) {
+            RefPtr<PluginPackage> package = PluginPackage::createPackage(*it, lastModified);
+            if (package && (!m_client || m_client->shouldLoadPluginPackage(package.get())) && add(package.release()))
+                pluginSetChanged = true;
+        }
     }
 
     // Cache all the paths we found with their timestamps for next time.
@@ -126,10 +136,10 @@ bool PluginDatabase::refresh()
     PluginSet::const_iterator end = m_plugins.end();
     for (PluginSet::const_iterator it = m_plugins.begin(); it != end; ++it) {
         // Get MIME types
+        MIMEToDescriptionsMap::const_iterator map_it = (*it)->mimeToDescriptions().begin();
         MIMEToDescriptionsMap::const_iterator map_end = (*it)->mimeToDescriptions().end();
-        for (MIMEToDescriptionsMap::const_iterator map_it = (*it)->mimeToDescriptions().begin(); map_it != map_end; ++map_it) {
+        for (; map_it != map_end; ++map_it)
             m_registeredMIMETypes.add(map_it->first);
-        }
     }
 
     return true;
@@ -161,12 +171,23 @@ PluginPackage* PluginDatabase::pluginForMIMEType(const String& mimeType)
 
     String key = mimeType.lower();
     PluginSet::const_iterator end = m_plugins.end();
+    PluginPackage* preferredPlugin = m_preferredPlugins.get(key).get();
+    if (preferredPlugin
+        && preferredPlugin->isEnabled()
+        && preferredPlugin->mimeToDescriptions().contains(key)) {
+        return preferredPlugin;
+    }
 
     Vector<PluginPackage*, 2> pluginChoices;
 
     for (PluginSet::const_iterator it = m_plugins.begin(); it != end; ++it) {
-        if ((*it)->mimeToDescriptions().contains(key))
-            pluginChoices.append((*it).get());
+        PluginPackage* plugin = (*it).get();
+
+        if (!plugin->isEnabled())
+            continue;
+
+        if (plugin->mimeToDescriptions().contains(key))
+            pluginChoices.append(plugin);
     }
 
     if (pluginChoices.isEmpty())
@@ -188,16 +209,25 @@ String PluginDatabase::MIMETypeForExtension(const String& extension) const
     HashMap<PluginPackage*, String> mimeTypeForPlugin;
 
     for (PluginSet::const_iterator it = m_plugins.begin(); it != end; ++it) {
+        if (!(*it)->isEnabled())
+            continue;
+
         MIMEToExtensionsMap::const_iterator mime_end = (*it)->mimeToExtensions().end();
 
         for (MIMEToExtensionsMap::const_iterator mime_it = (*it)->mimeToExtensions().begin(); mime_it != mime_end; ++mime_it) {
+            mimeType = mime_it->first;
+            PluginPackage* preferredPlugin = m_preferredPlugins.get(mimeType).get();
             const Vector<String>& extensions = mime_it->second;
             bool foundMapping = false;
             for (unsigned i = 0; i < extensions.size(); i++) {
                 if (equalIgnoringCase(extensions[i], extension)) {
                     PluginPackage* plugin = (*it).get();
+
+                    if (preferredPlugin && PluginPackage::equal(*plugin, *preferredPlugin))
+                        return mimeType;
+
                     pluginChoices.append(plugin);
-                    mimeTypeForPlugin.add(plugin, mime_it->first);
+                    mimeTypeForPlugin.add(plugin, mimeType);
                     foundMapping = true;
                     break;
                 }
@@ -219,7 +249,7 @@ PluginPackage* PluginDatabase::findPlugin(const KURL& url, String& mimeType)
 {
     PluginPackage* plugin = pluginForMIMEType(mimeType);
     String filename = url.string();
-    
+
     if (!plugin) {
         String filename = url.lastPathComponent();
         if (!filename.endsWith("/")) {
@@ -233,12 +263,18 @@ PluginPackage* PluginDatabase::findPlugin(const KURL& url, String& mimeType)
         }
     }
 
-    // FIXME: if no plugin could be found, query Windows for the mime type 
+    // FIXME: if no plugin could be found, query Windows for the mime type
     // corresponding to the extension.
 
     return plugin;
 }
 
+void PluginDatabase::setPreferredPluginForMIMEType(const String& mimeType, PluginPackage* plugin)
+{
+    if (!plugin || plugin->mimeToExtensions().contains(mimeType))
+        m_preferredPlugins.set(mimeType.lower(), plugin);
+}
+
 void PluginDatabase::getDeletedPlugins(PluginSet& plugins) const
 {
     PluginSet::const_iterator end = m_plugins.end();
@@ -263,6 +299,14 @@ bool PluginDatabase::add(PassRefPtr<PluginPackage> prpPackage)
 
 void PluginDatabase::remove(PluginPackage* package)
 {
+    MIMEToExtensionsMap::const_iterator it = package->mimeToExtensions().begin();
+    MIMEToExtensionsMap::const_iterator end = package->mimeToExtensions().end();
+    for ( ; it != end; ++it) {
+        PluginPackageByNameMap::iterator packageInMap = m_preferredPlugins.find(it->first);
+        if (packageInMap != m_preferredPlugins.end() && packageInMap->second == package)
+            m_preferredPlugins.remove(packageInMap);
+    }
+
     m_plugins.remove(package);
     m_pluginsByPath.remove(package->path());
 }
@@ -273,6 +317,7 @@ void PluginDatabase::clear()
     m_pluginsByPath.clear();
     m_pluginPathsWithTimes.clear();
     m_registeredMIMETypes.clear();
+    m_preferredPlugins.clear();
 }
 
 #if !PLATFORM(WIN_OS) || PLATFORM(WX)
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginDatabase.h b/src/3rdparty/webkit/WebCore/plugins/PluginDatabase.h
index b8d2bfe..fdc9330 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginDatabase.h
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginDatabase.h
@@ -22,7 +22,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef PluginDatabase_H
@@ -32,20 +32,23 @@
 #include "PluginPackage.h"
 #include "StringHash.h"
 
-#include <wtf/Vector.h>
 #include <wtf/HashSet.h>
+#include <wtf/Vector.h>
 
 namespace WebCore {
     class Element;
     class Frame;
     class IntSize;
     class KURL;
+    class PluginDatabaseClient;
     class PluginPackage;
 
     typedef HashSet<RefPtr<PluginPackage>, PluginPackageHash> PluginSet;
 
     class PluginDatabase {
     public:
+        PluginDatabase();
+
         // The first call to installedPlugins creates the plugin database
         // and by default populates it with the plugins installed on the system.
         // For testing purposes, it is possible to not populate the database
@@ -63,6 +66,8 @@ namespace WebCore {
         static int preferredPluginCompare(const void*, const void*);
 
         PluginPackage* findPlugin(const KURL&, String& mimeType);
+        PluginPackage* pluginForMIMEType(const String& mimeType);
+        void setPreferredPluginForMIMEType(const String& mimeType, PluginPackage* plugin);
 
         void setPluginDirectories(const Vector<String>& directories)
         {
@@ -70,6 +75,14 @@ namespace WebCore {
             m_pluginDirectories = directories;
         }
 
+        void setClient(PluginDatabaseClient* client)
+        {
+            m_client = client;
+        }
+
+        static Vector<String> defaultPluginDirectories();
+        Vector<String> pluginDirectories() const { return m_pluginDirectories; }
+
     private:
         void getPluginPathsInDirectories(HashSet<String>&) const;
         void getDeletedPlugins(PluginSet&) const;
@@ -78,16 +91,15 @@ namespace WebCore {
         bool add(PassRefPtr<PluginPackage>);
         void remove(PluginPackage*);
 
-        PluginPackage* pluginForMIMEType(const String& mimeType);
         String MIMETypeForExtension(const String& extension) const;
 
-        static Vector<String> defaultPluginDirectories();
-
         Vector<String> m_pluginDirectories;
         HashSet<String> m_registeredMIMETypes;
         PluginSet m_plugins;
         HashMap<String, RefPtr<PluginPackage> > m_pluginsByPath;
         HashMap<String, time_t> m_pluginPathsWithTimes;
+        HashMap<String, RefPtr<PluginPackage> > m_preferredPlugins;
+        PluginDatabaseClient* m_client;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginDatabaseClient.h b/src/3rdparty/webkit/WebCore/plugins/PluginDatabaseClient.h
new file mode 100644
index 0000000..b19ab83
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginDatabaseClient.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2007 Marius Renn <damarvy@gmail.com> All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef PluginDatabaseClient_h
+#define PluginDatabaseClient_h
+
+namespace WebCore {
+
+    class PluginPackage;
+    class String;
+
+    class PluginDatabaseClient {
+    public:
+        virtual ~PluginDatabaseClient() { }
+        virtual bool shouldLoadPluginAtPath(const String&) = 0;
+        virtual bool shouldLoadPluginPackage(const PluginPackage*) = 0;
+    };
+
+} // namespace WebCore
+
+#endif // PluginDatabaseClient_h
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginPackage.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginPackage.cpp
index 8adba98..612a9d7 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginPackage.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginPackage.cpp
@@ -22,7 +22,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -47,7 +47,7 @@ PluginPackage::~PluginPackage()
     // course would cause a crash, so we check to call unload before we
     // ASSERT.
     // FIXME: There is probably a better way to fix this.
-    if (m_loadCount == 0)
+    if (!m_loadCount)
         unloadWithoutShutdown();
     else
         unload();
@@ -59,7 +59,7 @@ void PluginPackage::freeLibrarySoon()
 {
     ASSERT(!m_freeLibraryTimer.isActive());
     ASSERT(m_module);
-    ASSERT(m_loadCount == 0);
+    ASSERT(!m_loadCount);
 
     m_freeLibraryTimer.startOneShot(0);
 }
@@ -67,7 +67,7 @@ void PluginPackage::freeLibrarySoon()
 void PluginPackage::freeLibraryTimerFired(Timer<PluginPackage>*)
 {
     ASSERT(m_module);
-    ASSERT(m_loadCount == 0);
+    ASSERT(!m_loadCount);
 
     unloadModule(m_module);
     m_module = 0;
@@ -100,7 +100,8 @@ int PluginPackage::compare(const PluginPackage& compareTo) const
 }
 
 PluginPackage::PluginPackage(const String& path, const time_t& lastModified)
-    : m_isLoaded(false)
+    : m_isEnabled(true)
+    , m_isLoaded(false)
     , m_loadCount(0)
     , m_path(path)
     , m_moduleVersion(0)
@@ -130,7 +131,7 @@ void PluginPackage::unloadWithoutShutdown()
     if (!m_isLoaded)
         return;
 
-    ASSERT(m_loadCount == 0);
+    ASSERT(!m_loadCount);
     ASSERT(m_module);
 
     // <rdar://5530519>: Crash when closing tab with pdf file (Reader 7 only)
@@ -144,6 +145,11 @@ void PluginPackage::unloadWithoutShutdown()
     m_isLoaded = false;
 }
 
+void PluginPackage::setEnabled(bool enabled)
+{
+    m_isEnabled = enabled;
+}
+
 PassRefPtr<PluginPackage> PluginPackage::createPackage(const String& path, const time_t& lastModified)
 {
     RefPtr<PluginPackage> package = adoptRef(new PluginPackage(path, lastModified));
@@ -243,7 +249,7 @@ void PluginPackage::determineModuleVersionFromDescription()
 void PluginPackage::initializeBrowserFuncs()
 {
     memset(&m_browserFuncs, 0, sizeof(m_browserFuncs));
-    m_browserFuncs.size = sizeof (m_browserFuncs);
+    m_browserFuncs.size = sizeof(m_browserFuncs);
     m_browserFuncs.version = NP_VERSION_MINOR;
 
     m_browserFuncs.geturl = NPN_GetURL;
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginPackage.h b/src/3rdparty/webkit/WebCore/plugins/PluginPackage.h
index 02d0dfc..3afc57f 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginPackage.h
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginPackage.h
@@ -21,7 +21,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef PluginPackage_H
@@ -44,7 +44,7 @@ namespace WebCore {
     public:
         ~PluginPackage();
         static PassRefPtr<PluginPackage> createPackage(const String& path, const time_t& lastModified);
-        
+
         const String& name() const { return m_name; }
         const String& description() const { return m_description; }
         const String& path() const { return m_path; }
@@ -62,6 +62,9 @@ namespace WebCore {
         void unload();
         void unloadWithoutShutdown();
 
+        bool isEnabled() const { return m_isEnabled; }
+        void setEnabled(bool);
+
         const NPPluginFuncs* pluginFuncs() const { return &m_pluginFuncs; }
         int compareFileVersion(const PlatformModuleVersion&) const;
         int compare(const PluginPackage&) const;
@@ -77,6 +80,7 @@ namespace WebCore {
         void determineModuleVersionFromDescription();
         void initializeBrowserFuncs();
 
+        bool m_isEnabled;
         bool m_isLoaded;
         int m_loadCount;
 
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginQuirkSet.h b/src/3rdparty/webkit/WebCore/plugins/PluginQuirkSet.h
index 8183050..b652c6e 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginQuirkSet.h
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginQuirkSet.h
@@ -45,7 +45,7 @@ namespace WebCore {
         PluginQuirkDontClipToZeroRectWhenScrolling = 1 << 9,
         PluginQuirkDontSetNullWindowHandleOnDestroy = 1 << 10,
         PluginQuirkDontAllowMultipleInstances = 1 << 11,
-        PluginQuirkRequiresGtkToolKit = 1 << 12
+        PluginQuirkRequiresGtkToolKit = 1 << 12,
     };
 
     class PluginQuirkSet {
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginStream.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginStream.cpp
index d2d5d3c..cd9f83d 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginStream.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginStream.cpp
@@ -248,6 +248,11 @@ void PluginStream::destroyStream()
 
     bool newStreamCalled = m_stream.ndata;
 
+    // Protect from destruction if:
+    //  NPN_DestroyStream is called from NPP_NewStream or
+    //  PluginStreamClient::streamDidFinishLoading() removes the last reference
+    RefPtr<PluginStream> protect(this);
+
     if (newStreamCalled) {
         if (m_reason == NPRES_DONE && (m_transferMode == NP_ASFILE || m_transferMode == NP_ASFILEONLY)) {
             ASSERT(!m_path.isNull());
@@ -281,9 +286,6 @@ void PluginStream::destroyStream()
             m_loader->setDefersLoading(true);
         if (!newStreamCalled && m_quirks.contains(PluginQuirkFlashURLNotifyBug) &&
             equalIgnoringCase(m_resourceRequest.httpMethod(), "POST")) {
-            // Protect the stream if NPN_DestroyStream is called from NPP_NewStream
-            RefPtr<PluginStream> protect(this);
-
             m_transferMode = NP_NORMAL;
             m_stream.url = "";
             m_stream.notifyData = m_notifyData;
@@ -303,8 +305,6 @@ void PluginStream::destroyStream()
 
     m_streamState = StreamStopped;
 
-    // streamDidFinishLoading can cause us to be deleted.
-    RefPtr<PluginStream> protect(this);
     if (!m_loadManually)
         m_client->streamDidFinishLoading(this);
 
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginView.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginView.cpp
index 2cecdc4..c28e586 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginView.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginView.cpp
@@ -149,11 +149,55 @@ void PluginView::handleEvent(Event* event)
         handleKeyboardEvent(static_cast<KeyboardEvent*>(event));
 }
 
+void PluginView::init()
+{
+    if (m_haveInitialized)
+        return;
+
+    m_haveInitialized = true;
+
+    if (!m_plugin) {
+        ASSERT(m_status == PluginStatusCanNotFindPlugin);
+        return;
+    }
+
+    LOG(Plugins, "PluginView::init(): Initializing plug-in '%s'", m_plugin->name().utf8().data());
+
+    if (!m_plugin->load()) {
+        m_plugin = 0;
+        m_status = PluginStatusCanNotLoadPlugin;
+        return;
+    }
+
+    if (!startOrAddToUnstartedList()) {
+        m_status = PluginStatusCanNotLoadPlugin;
+        return;
+    }
+
+    m_status = PluginStatusLoadedSuccessfully;
+}
+
+bool PluginView::startOrAddToUnstartedList()
+{
+    if (!m_parentFrame->page())
+        return false;
+
+    if (!m_parentFrame->page()->canStartPlugins()) {
+        m_parentFrame->page()->addUnstartedPlugin(this);
+        m_isWaitingToStart = true;
+        return true;
+    }
+
+    return start();
+}
+
 bool PluginView::start()
 {
     if (m_isStarted)
         return false;
 
+    m_isWaitingToStart = false;
+
     PluginMainThreadScheduler::scheduler().registerPlugin(m_instance);
 
     ASSERT(m_plugin);
@@ -164,14 +208,17 @@ bool PluginView::start()
         PluginView::setCurrentPluginView(this);
         JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
         setCallingPlugin(true);
-        npErr = m_plugin->pluginFuncs()->newp((NPMIMEType)m_mimeType.data(), m_instance, m_mode, m_paramCount, m_paramNames, m_paramValues, NULL);
+        npErr = m_plugin->pluginFuncs()->newp((NPMIMEType)m_mimeType.utf8().data(), m_instance, m_mode, m_paramCount, m_paramNames, m_paramValues, NULL);
         setCallingPlugin(false);
         LOG_NPERROR(npErr);
         PluginView::setCurrentPluginView(0);
     }
 
-    if (npErr != NPERR_NO_ERROR)
+    if (npErr != NPERR_NO_ERROR) {
+        m_status = PluginStatusCanNotLoadPlugin;
+        PluginMainThreadScheduler::scheduler().unregisterPlugin(m_instance);
         return false;
+    }
 
     m_isStarted = true;
 
@@ -182,7 +229,125 @@ bool PluginView::start()
         load(frameLoadRequest, false, 0);
     }
 
-    return true;
+    m_status = PluginStatusLoadedSuccessfully;
+
+    if (!platformStart())
+        m_status = PluginStatusCanNotLoadPlugin;
+
+    return (m_status == PluginStatusLoadedSuccessfully);
+}
+
+PluginView::~PluginView()
+{
+    LOG(Plugins, "PluginView::~PluginView()");
+
+    removeFromUnstartedListIfNecessary();
+
+    stop();
+
+    deleteAllValues(m_requests);
+
+    freeStringArray(m_paramNames, m_paramCount);
+    freeStringArray(m_paramValues, m_paramCount);
+
+    platformDestroy();
+
+    m_parentFrame->script()->cleanupScriptObjectsForPlugin(this);
+
+    if (m_plugin && !(m_plugin->quirks().contains(PluginQuirkDontUnloadPlugin)))
+        m_plugin->unload();
+}
+
+void PluginView::removeFromUnstartedListIfNecessary()
+{
+    if (!m_isWaitingToStart)
+        return;
+
+    if (!m_parentFrame->page())
+        return;
+
+    m_parentFrame->page()->removeUnstartedPlugin(this);
+}
+
+void PluginView::stop()
+{
+    if (!m_isStarted)
+        return;
+
+    LOG(Plugins, "PluginView::stop(): Stopping plug-in '%s'", m_plugin->name().utf8().data());
+
+    HashSet<RefPtr<PluginStream> > streams = m_streams;
+    HashSet<RefPtr<PluginStream> >::iterator end = streams.end();
+    for (HashSet<RefPtr<PluginStream> >::iterator it = streams.begin(); it != end; ++it) {
+        (*it)->stop();
+        disconnectStream((*it).get());
+    }
+
+    ASSERT(m_streams.isEmpty());
+
+    m_isStarted = false;
+
+    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+
+#if !PLATFORM(WX) // FIXME: Revisit this when implementing plugins for wx
+#ifdef XP_WIN
+    // Unsubclass the window
+    if (m_isWindowed) {
+#if PLATFORM(WINCE)
+        WNDPROC currentWndProc = (WNDPROC)GetWindowLong(platformPluginWidget(), GWL_WNDPROC);
+
+        if (currentWndProc == PluginViewWndProc)
+            SetWindowLong(platformPluginWidget(), GWL_WNDPROC, (LONG)m_pluginWndProc);
+#else
+        WNDPROC currentWndProc = (WNDPROC)GetWindowLongPtr(platformPluginWidget(), GWLP_WNDPROC);
+
+        if (currentWndProc == PluginViewWndProc)
+            SetWindowLongPtr(platformPluginWidget(), GWLP_WNDPROC, (LONG)m_pluginWndProc);
+#endif
+    }
+#endif // XP_WIN
+#endif // !PLATFORM(WX)
+
+#if !defined(XP_MACOSX)
+    // Clear the window
+    m_npWindow.window = 0;
+
+    if (m_plugin->pluginFuncs()->setwindow && !m_plugin->quirks().contains(PluginQuirkDontSetNullWindowHandleOnDestroy)) {
+        PluginView::setCurrentPluginView(this);
+        setCallingPlugin(true);
+        m_plugin->pluginFuncs()->setwindow(m_instance, &m_npWindow);
+        setCallingPlugin(false);
+        PluginView::setCurrentPluginView(0);
+    }
+
+#ifdef XP_UNIX
+    if (m_isWindowed && m_npWindow.ws_info)
+           delete (NPSetWindowCallbackStruct *)m_npWindow.ws_info;
+    m_npWindow.ws_info = 0;
+#endif
+
+#endif // !defined(XP_MACOSX)
+
+    PluginMainThreadScheduler::scheduler().unregisterPlugin(m_instance);
+
+    NPSavedData* savedData = 0;
+    PluginView::setCurrentPluginView(this);
+    setCallingPlugin(true);
+    NPError npErr = m_plugin->pluginFuncs()->destroy(m_instance, &savedData);
+    setCallingPlugin(false);
+    LOG_NPERROR(npErr);
+    PluginView::setCurrentPluginView(0);
+
+#if ENABLE(NETSCAPE_PLUGIN_API)
+    if (savedData) {
+        // TODO: Actually save this data instead of just discarding it
+        if (savedData->buf)
+            NPN_MemFree(savedData->buf);
+        NPN_MemFree(savedData);
+    }
+#endif
+
+    m_instance->pdata = 0;
 }
 
 void PluginView::setCurrentPluginView(PluginView* pluginView)
@@ -221,6 +386,9 @@ static bool getString(ScriptController* proxy, JSValue result, String& string)
 
 void PluginView::performRequest(PluginRequest* request)
 {
+    if (!m_isStarted)
+        return;
+
     // don't let a plugin start any loads if it is no longer part of a document that is being 
     // displayed unless the loads are in the same frame as the plugin.
     const String& targetFrameName = request->frameLoadRequest().frameName();
@@ -522,7 +690,7 @@ PassRefPtr<JSC::Bindings::Instance> PluginView::bindingInstance()
 #if ENABLE(NETSCAPE_PLUGIN_API)
     NPObject* object = 0;
 
-    if (!m_plugin || !m_plugin->pluginFuncs()->getvalue)
+    if (!m_isStarted || !m_plugin || !m_plugin->pluginFuncs()->getvalue)
         return 0;
 
     // On Windows, calling Java's NPN_GetValue can allow the message loop to
@@ -582,6 +750,9 @@ void PluginView::setParameters(const Vector<String>& paramNames, const Vector<St
         if (m_plugin->quirks().contains(PluginQuirkRemoveWindowlessVideoParam) && equalIgnoringCase(paramNames[i], "windowlessvideo"))
             continue;
 
+        if (paramNames[i] == "pluginspage")
+            m_pluginsPage = paramValues[i];
+
         m_paramNames[paramCount] = createUTF8String(paramNames[i]);
         m_paramValues[paramCount] = createUTF8String(paramValues[i]);
 
@@ -604,7 +775,7 @@ PluginView::PluginView(Frame* parentFrame, const IntSize& size, PluginPackage* p
     , m_popPopupsStateTimer(this, &PluginView::popPopupsStateTimerFired)
     , m_paramNames(0)
     , m_paramValues(0)
-    , m_instance(0)
+    , m_mimeType(mimeType)
 #if defined(XP_MACOSX)
     , m_isWindowed(false)
 #else
@@ -612,7 +783,8 @@ PluginView::PluginView(Frame* parentFrame, const IntSize& size, PluginPackage* p
 #endif
     , m_isTransparent(false)
     , m_haveInitialized(false)
-#if PLATFORM(GTK) || defined(Q_WS_X11)
+    , m_isWaitingToStart(false)
+#if defined(XP_UNIX) || defined(Q_WS_X11)
     , m_needsXEmbed(false)
 #endif
 #if PLATFORM(WIN_OS) && !PLATFORM(WX) && ENABLE(NETSCAPE_PLUGIN_API)
@@ -620,6 +792,7 @@ PluginView::PluginView(Frame* parentFrame, const IntSize& size, PluginPackage* p
     , m_lastMessage(0)
     , m_isCallingPluginWndProc(false)
     , m_wmPrintHDC(0)
+    , m_haveUpdatedPluginWidget(false)
 #endif
 #if (PLATFORM(QT) && PLATFORM(WIN_OS)) || defined(XP_MACOSX)
     , m_window(0)
@@ -628,6 +801,9 @@ PluginView::PluginView(Frame* parentFrame, const IntSize& size, PluginPackage* p
     , m_drawingModel(NPDrawingModel(-1))
     , m_eventModel(NPEventModel(-1))
 #endif
+#if defined(Q_WS_X11)
+    , m_hasPendingGeometryChange(false)
+#endif
     , m_loadManually(loadManually)
     , m_manualStream(0)
     , m_isJavaScriptPaused(false)
@@ -641,8 +817,6 @@ PluginView::PluginView(Frame* parentFrame, const IntSize& size, PluginPackage* p
     m_instance->ndata = this;
     m_instance->pdata = 0;
 
-    m_mimeType = mimeType.utf8();
-
     setParameters(paramNames, paramValues);
 
     memset(&m_npWindow, 0, sizeof(m_npWindow));
@@ -1005,4 +1179,37 @@ void PluginView::paintMissingPluginIcon(GraphicsContext* context, const IntRect&
     context->restore();
 }
 
+static const char* MozillaUserAgent = "Mozilla/5.0 ("
+#if defined(XP_MACOSX)
+        "Macintosh; U; Intel Mac OS X;"
+#elif defined(XP_WIN)
+        "Windows; U; Windows NT 5.1;"
+#elif defined(XP_UNIX)
+// The Gtk port uses X11 plugins in Mac.
+#if PLATFORM(DARWIN) && PLATFORM(GTK)
+    "X11; U; Intel Mac OS X;"
+#else
+    "X11; U; Linux i686;"
+#endif
+#endif
+        " en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0";
+
+const char* PluginView::userAgent()
+{
+    if (m_plugin->quirks().contains(PluginQuirkWantsMozillaUserAgent))
+        return MozillaUserAgent;
+
+    if (m_userAgent.isNull())
+        m_userAgent = m_parentFrame->loader()->userAgent(m_url).utf8();
+
+    return m_userAgent.data();
+}
+
+#if ENABLE(NETSCAPE_PLUGIN_API)
+const char* PluginView::userAgentStatic()
+{
+    return MozillaUserAgent;
+}
+#endif
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginView.h b/src/3rdparty/webkit/WebCore/plugins/PluginView.h
index 95d73db..54c1065 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginView.h
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginView.h
@@ -177,6 +177,10 @@ namespace WebCore {
 
         void focusPluginElement();
 
+        const String& pluginsPage() const { return m_pluginsPage; }
+        const String& mimeType() const { return m_mimeType; }
+        const KURL& url() const { return m_url; }
+
 #if PLATFORM(WIN_OS) && !PLATFORM(WX) && ENABLE(NETSCAPE_PLUGIN_API)
         static LRESULT CALLBACK PluginViewWndProc(HWND, UINT, WPARAM, LPARAM);
         LRESULT wndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam);
@@ -191,13 +195,18 @@ namespace WebCore {
 
         static bool isCallingPlugin();
 
+        bool start();
+
     private:
         PluginView(Frame* parentFrame, const IntSize&, PluginPackage*, Element*, const KURL&, const Vector<String>& paramNames, const Vector<String>& paramValues, const String& mimeType, bool loadManually);
 
         void setParameters(const Vector<String>& paramNames, const Vector<String>& paramValues);
+        bool startOrAddToUnstartedList();
+        void removeFromUnstartedListIfNecessary();
         void init();
-        bool start();
+        bool platformStart();
         void stop();
+        void platformDestroy();
         static void setCurrentPluginView(PluginView*);
         NPError load(const FrameLoadRequest&, bool sendNotification, void* notifyData);
         NPError handlePost(const char* url, const char* target, uint32 len, const char* buf, bool file, void* notifyData, bool sendNotification, bool allowHeaders);
@@ -245,8 +254,9 @@ namespace WebCore {
         int m_paramCount;
         char** m_paramNames;
         char** m_paramValues;
+        String m_pluginsPage;
 
-        CString m_mimeType;
+        String m_mimeType;
         CString m_userAgent;
 
         NPP m_instance;
@@ -261,8 +271,9 @@ namespace WebCore {
         bool m_isWindowed;
         bool m_isTransparent;
         bool m_haveInitialized;
+        bool m_isWaitingToStart;
 
-#if PLATFORM(GTK) || defined(Q_WS_X11)
+#if defined(XP_UNIX) || defined(Q_WS_X11)
         bool m_needsXEmbed;
 #endif
 
@@ -272,6 +283,7 @@ namespace WebCore {
         unsigned m_lastMessage;
         bool m_isCallingPluginWndProc;
         HDC m_wmPrintHDC;
+        bool m_haveUpdatedPluginWidget;
 #endif
 
 #if (PLATFORM(QT) && PLATFORM(WIN_OS)) || defined(XP_MACOSX)
@@ -288,7 +300,7 @@ public:
 
 private:
 
-#if PLATFORM(GTK) || defined(Q_WS_X11)
+#if defined(XP_UNIX) || defined(Q_WS_X11)
         void setNPWindowIfNeeded();
 #elif defined(XP_MACOSX)
         NP_CGContext m_npCgContext;
diff --git a/src/3rdparty/webkit/WebCore/plugins/PluginViewNone.cpp b/src/3rdparty/webkit/WebCore/plugins/PluginViewNone.cpp
index a3b6a17..b694214 100644
--- a/src/3rdparty/webkit/WebCore/plugins/PluginViewNone.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/PluginViewNone.cpp
@@ -73,25 +73,6 @@ void PluginView::setNPWindowRect(const IntRect&)
     notImplemented();
 }
 
-void PluginView::stop()
-{
-    notImplemented();
-}
-
-const char* PluginView::userAgent()
-{
-    notImplemented();
-    return 0;
-}
-
-#if ENABLE(NETSCAPE_PLUGIN_API)
-const char* PluginView::userAgentStatic()
-{
-    notImplemented();
-    return 0;
-}
-#endif
-
 NPError PluginView::handlePostReadFile(Vector<char>&, uint32, const char*)
 {
     notImplemented();
@@ -133,12 +114,14 @@ void PluginView::forceRedraw()
     notImplemented();
 }
 
-PluginView::~PluginView()
+bool PluginView::platformStart()
 {
     notImplemented();
+
+    return true;
 }
 
-void PluginView::init()
+void PluginView::platformDestroy()
 {
     notImplemented();
 }
diff --git a/src/3rdparty/webkit/WebCore/plugins/mac/PluginPackageMac.cpp b/src/3rdparty/webkit/WebCore/plugins/mac/PluginPackageMac.cpp
index bf6a81b..d242fb8 100644
--- a/src/3rdparty/webkit/WebCore/plugins/mac/PluginPackageMac.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/mac/PluginPackageMac.cpp
@@ -246,9 +246,6 @@ bool PluginPackage::fetchInfo()
 
 bool PluginPackage::isPluginBlacklisted()
 {
-    if (name() == "Silverlight Plug-In" || name().startsWith("QuickTime Plug-in"))
-        return true;
-
     return false;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/plugins/mac/PluginViewMac.cpp b/src/3rdparty/webkit/WebCore/plugins/mac/PluginViewMac.cpp
index 721ec29..d0a3288 100644
--- a/src/3rdparty/webkit/WebCore/plugins/mac/PluginViewMac.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/mac/PluginViewMac.cpp
@@ -125,30 +125,10 @@ static inline IntPoint topLevelOffsetFor(PlatformWidget widget)
 
 // --------------- Lifetime management -----------------
 
-void PluginView::init()
+bool PluginView::platformStart()
 {
-    LOG(Plugins, "PluginView::init(): Initializing plug-in '%s'", m_plugin->name().utf8().data());
-
-    if (m_haveInitialized)
-        return;
-    m_haveInitialized = true;
-
-    if (!m_plugin) {
-        ASSERT(m_status == PluginStatusCanNotFindPlugin);
-        return;
-    }
-
-    if (!m_plugin->load()) {
-        m_plugin = 0;
-        m_status = PluginStatusCanNotLoadPlugin;
-        return;
-    }
-
-    if (!start()) {
-        m_status = PluginStatusCanNotLoadPlugin;
-        stop(); // Make sure we unregister the plugin
-        return;
-    }
+    ASSERT(m_isStarted);
+    ASSERT(m_status == PluginStatusLoadedSuccessfully);
 
     if (m_drawingModel == NPDrawingModel(-1)) {
         // We default to QuickDraw, even though we don't support it,
@@ -180,8 +160,7 @@ void PluginView::init()
         m_status = PluginStatusCanNotLoadPlugin;
         LOG(Plugins, "Plug-in '%s' uses unsupported event model %s",
                 m_plugin->name().utf8().data(), prettyNameForEventModel(m_eventModel));
-        stop();
-        return;
+        return false;
     }
 
     if (getValueStatic(NPNVariable(NPNVsupportsQuickDrawBool + m_drawingModel), &drawingModelSupported) != NPERR_NO_ERROR
@@ -189,70 +168,24 @@ void PluginView::init()
         m_status = PluginStatusCanNotLoadPlugin;
         LOG(Plugins, "Plug-in '%s' uses unsupported drawing model %s",
                 m_plugin->name().utf8().data(), prettyNameForDrawingModel(m_drawingModel));
-        stop();
-        return;
+        return false;
     }
 
     setPlatformPluginWidget(m_parentFrame->view()->hostWindow()->platformWindow());
 
     show();
 
-    m_status = PluginStatusLoadedSuccessfully;
-
     // TODO: Implement null timer throttling depending on plugin activation
     m_nullEventTimer.set(new Timer<PluginView>(this, &PluginView::nullEventTimerFired));
     m_nullEventTimer->startRepeating(0.02);
-}
-
-PluginView::~PluginView()
-{
-    LOG(Plugins, "PluginView::~PluginView()");
 
-    stop();
-
-    deleteAllValues(m_requests);
-
-    freeStringArray(m_paramNames, m_paramCount);
-    freeStringArray(m_paramValues, m_paramCount);
-
-    m_parentFrame->script()->cleanupScriptObjectsForPlugin(this);
-
-    if (m_plugin && !(m_plugin->quirks().contains(PluginQuirkDontUnloadPlugin)))
-        m_plugin->unload();
-
-    m_window = 0;
+    return true;
 }
 
-void PluginView::stop()
+void PluginView::platformDestroy()
 {
-    if (!m_isStarted)
-        return;
-
-    LOG(Plugins, "PluginView::stop(): Stopping plug-in '%s'", m_plugin->name().utf8().data());
-
-    HashSet<RefPtr<PluginStream> > streams = m_streams;
-    HashSet<RefPtr<PluginStream> >::iterator end = streams.end();
-    for (HashSet<RefPtr<PluginStream> >::iterator it = streams.begin(); it != end; ++it) {
-        (*it)->stop();
-        disconnectStream((*it).get());
-    }
-
-    ASSERT(m_streams.isEmpty());
-
-    m_isStarted = false;
-
-    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
-
-    PluginMainThreadScheduler::scheduler().unregisterPlugin(m_instance);
-
-    // Destroy the plugin
-    PluginView::setCurrentPluginView(this);
-    setCallingPlugin(true);
-    m_plugin->pluginFuncs()->destroy(m_instance, 0);
-    setCallingPlugin(false);
-    PluginView::setCurrentPluginView(0);
-
-    m_instance->pdata = 0;
+    if (platformPluginWidget())
+        setPlatformPluginWidget(0);
 }
 
 // Used before the plugin view has been initialized properly, and as a
@@ -724,24 +657,6 @@ bool PluginView::dispatchNPEvent(NPEvent& event)
 
 // ------------------- Miscellaneous  ------------------
 
-static const char* MozillaUserAgent = "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0";
-
-const char* PluginView::userAgent()
-{
-    if (m_plugin->quirks().contains(PluginQuirkWantsMozillaUserAgent))
-        return MozillaUserAgent;
-
-    if (m_userAgent.isNull())
-        m_userAgent = m_parentFrame->loader()->userAgent(m_url).utf8();
-
-    return m_userAgent.data();
-}
-
-const char* PluginView::userAgentStatic()
-{
-    return MozillaUserAgent;
-}
-
 NPError PluginView::handlePostReadFile(Vector<char>& buffer, uint32 len, const char* buf)
 {
     String filename(buf, len);
diff --git a/src/3rdparty/webkit/WebCore/plugins/npapi.cpp b/src/3rdparty/webkit/WebCore/plugins/npapi.cpp
index d275a39..4135b64 100644
--- a/src/3rdparty/webkit/WebCore/plugins/npapi.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/npapi.cpp
@@ -171,9 +171,7 @@ void NPN_PopPopupsEnabledState(NPP instance)
     pluginViewForInstance(instance)->popPopupsEnabledState();
 }
 
-extern "C" {
 void NPN_PluginThreadAsyncCall(NPP instance, void (*func) (void *), void *userData)
 {
     PluginMainThreadScheduler::scheduler().scheduleCall(instance, func, userData);
 }
-}
diff --git a/src/3rdparty/webkit/WebCore/plugins/qt/PluginPackageQt.cpp b/src/3rdparty/webkit/WebCore/plugins/qt/PluginPackageQt.cpp
index b9c1656..7f5a7b9 100644
--- a/src/3rdparty/webkit/WebCore/plugins/qt/PluginPackageQt.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/qt/PluginPackageQt.cpp
@@ -63,7 +63,7 @@ bool PluginPackage::fetchInfo()
     String s = gm();
     Vector<String> types;
     s.split(UChar(';'), false, types);
-    for (int i = 0; i < types.size(); ++i) {
+    for (unsigned i = 0; i < types.size(); ++i) {
         Vector<String> mime;
         types[i].split(UChar(':'), true, mime);
         if (mime.size() > 0) {
diff --git a/src/3rdparty/webkit/WebCore/plugins/qt/PluginViewQt.cpp b/src/3rdparty/webkit/WebCore/plugins/qt/PluginViewQt.cpp
index 883c9aa..fdeac2f 100644
--- a/src/3rdparty/webkit/WebCore/plugins/qt/PluginViewQt.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/qt/PluginViewQt.cpp
@@ -45,6 +45,7 @@
 #include "NotImplemented.h"
 #include "Page.h"
 #include "PlatformMouseEvent.h"
+#include "PlatformKeyboardEvent.h"
 #include "PluginContainerQt.h"
 #include "PluginDebug.h"
 #include "PluginPackage.h"
@@ -55,10 +56,12 @@
 #include "npruntime_impl.h"
 #include "runtime.h"
 #include "runtime_root.h"
+#include <QKeyEvent>
 #include <QWidget>
 #include <QX11Info>
 #include <runtime/JSLock.h>
 #include <runtime/JSValue.h>
+#include <X11/X.h>
 
 using JSC::ExecState;
 using JSC::Interpreter;
@@ -150,14 +153,76 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
         setNPWindowIfNeeded();
 }
 
+// TODO: Unify across ports.
+bool PluginView::dispatchNPEvent(NPEvent& event)
+{
+    if (!m_plugin->pluginFuncs()->event)
+        return false;
+
+    PluginView::setCurrentPluginView(this);
+    JSC::JSLock::DropAllLocks dropAllLocks(false);
+
+    setCallingPlugin(true);
+    bool accepted = m_plugin->pluginFuncs();
+    setCallingPlugin(false);
+
+    return accepted;
+}
+
+void setSharedXEventFields(XEvent& xEvent, QWidget* hostWindow)
+{
+    xEvent.xany.serial = 0; // we are unaware of the last request processed by X Server
+    xEvent.xany.send_event = false;
+    xEvent.xany.display = hostWindow->x11Info().display();
+    // NOTE: event.xany.window doesn't always respond to the .window property of other XEvent's
+    // but does in the case of KeyPress, KeyRelease, ButtonPress, ButtonRelease, and MotionNotify
+    // events; thus, this is right:
+    xEvent.xany.window = hostWindow->window()->handle();
+}
+
+void setXKeyEventSpecificFields(XEvent& xEvent, KeyboardEvent* event)
+{
+    QKeyEvent* qKeyEvent = event->keyEvent()->qtEvent();
+
+    xEvent.xkey.root = QX11Info::appRootWindow();
+    xEvent.xkey.subwindow = 0; // we have no child window
+    xEvent.xkey.time = event->timeStamp();
+    xEvent.xkey.state = qKeyEvent->nativeModifiers();
+    xEvent.xkey.keycode = qKeyEvent->nativeScanCode();
+    xEvent.xkey.same_screen = true;
+
+    // NOTE: As the XEvents sent to the plug-in are synthesized and there is not a native window
+    // corresponding to the plug-in rectangle, some of the members of the XEvent structures are not
+    // set to their normal Xserver values. e.g. Key events don't have a position.
+    // source: https://developer.mozilla.org/en/NPEvent
+    xEvent.xkey.x = 0;
+    xEvent.xkey.y = 0;
+    xEvent.xkey.x_root = 0;
+    xEvent.xkey.y_root = 0;
+}
+
 void PluginView::handleKeyboardEvent(KeyboardEvent* event)
 {
-    notImplemented();
+    if (m_isWindowed)
+        return;
+
+    if (event->type() != "keydown" && event->type() != "keyup")
+        return;
+
+    XEvent npEvent; // On UNIX NPEvent is a typedef for XEvent.
+
+    npEvent.type = (event->type() == "keydown") ? 2 : 3; // ints as Qt unsets KeyPress and KeyRelease
+    setSharedXEventFields(npEvent, m_parentFrame->view()->hostWindow()->platformWindow());
+    setXKeyEventSpecificFields(npEvent, event);
+
+    if (!dispatchNPEvent(npEvent))
+        event->setDefaultHandled();
 }
 
 void PluginView::handleMouseEvent(MouseEvent* event)
 {
-    notImplemented();
+    if (m_isWindowed)
+        return;
 }
 
 void PluginView::setParent(ScrollView* parent)
@@ -227,70 +292,6 @@ void PluginView::setParentVisible(bool visible)
         platformPluginWidget()->setVisible(visible);
 }
 
-void PluginView::stop()
-{
-    if (!m_isStarted)
-        return;
-
-    HashSet<RefPtr<PluginStream> > streams = m_streams;
-    HashSet<RefPtr<PluginStream> >::iterator end = streams.end();
-    for (HashSet<RefPtr<PluginStream> >::iterator it = streams.begin(); it != end; ++it) {
-        (*it)->stop();
-        disconnectStream((*it).get());
-    }
-
-    ASSERT(m_streams.isEmpty());
-
-    m_isStarted = false;
-
-    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
-
-    PluginMainThreadScheduler::scheduler().unregisterPlugin(m_instance);
-
-    // Clear the window
-    m_npWindow.window = 0;
-    if (m_plugin->pluginFuncs()->setwindow && !m_plugin->quirks().contains(PluginQuirkDontSetNullWindowHandleOnDestroy)) {
-        PluginView::setCurrentPluginView(this);
-        setCallingPlugin(true);
-        m_plugin->pluginFuncs()->setwindow(m_instance, &m_npWindow);
-        setCallingPlugin(false);
-        PluginView::setCurrentPluginView(0);
-    }
-
-    delete (NPSetWindowCallbackStruct *)m_npWindow.ws_info;
-    m_npWindow.ws_info = 0;
-
-    // Destroy the plugin
-    {
-        PluginView::setCurrentPluginView(this);
-        setCallingPlugin(true);
-        m_plugin->pluginFuncs()->destroy(m_instance, 0);
-        setCallingPlugin(false);
-        PluginView::setCurrentPluginView(0);
-    }
-
-    m_instance->pdata = 0;
-}
-
-static const char* MozillaUserAgent = "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0";
-
-const char* PluginView::userAgent()
-{
-    if (m_plugin->quirks().contains(PluginQuirkWantsMozillaUserAgent))
-        return MozillaUserAgent;
-
-    if (m_userAgent.isNull())
-        m_userAgent = m_parentFrame->loader()->userAgent(m_url).utf8();
-
-    return m_userAgent.data();
-}
-
-const char* PluginView::userAgentStatic()
-{
-    // FIXME - Just say we are Mozilla
-    return MozillaUserAgent;
-}
-
 NPError PluginView::handlePostReadFile(Vector<char>& buffer, uint32 len, const char* buf)
 {
     String filename(buf, len);
@@ -435,46 +436,10 @@ void PluginView::forceRedraw()
     notImplemented();
 }
 
-PluginView::~PluginView()
-{
-    stop();
-
-    deleteAllValues(m_requests);
-
-    freeStringArray(m_paramNames, m_paramCount);
-    freeStringArray(m_paramValues, m_paramCount);
-
-    m_parentFrame->script()->cleanupScriptObjectsForPlugin(this);
-
-    if (m_plugin && !(m_plugin->quirks().contains(PluginQuirkDontUnloadPlugin)))
-        m_plugin->unload();
-
-    delete platformPluginWidget();
-}
-
-void PluginView::init()
+bool PluginView::platformStart()
 {
-    if (m_haveInitialized)
-        return;
-    m_haveInitialized = true;
-
-    m_hasPendingGeometryChange = false;
-
-    if (!m_plugin) {
-        ASSERT(m_status == PluginStatusCanNotFindPlugin);
-        return;
-    }
-
-    if (!m_plugin->load()) {
-        m_plugin = 0;
-        m_status = PluginStatusCanNotLoadPlugin;
-        return;
-    }
-
-    if (!start()) {
-        m_status = PluginStatusCanNotLoadPlugin;
-        return;
-    }
+    ASSERT(m_isStarted);
+    ASSERT(m_status == PluginStatusLoadedSuccessfully);
 
     if (m_plugin->pluginFuncs()->getvalue) {
         PluginView::setCurrentPluginView(this);
@@ -489,9 +454,9 @@ void PluginView::init()
         setPlatformWidget(new PluginContainerQt(this, m_parentFrame->view()->hostWindow()->platformWindow()));
     } else {
         notImplemented();
-        m_status = PluginStatusCanNotLoadPlugin;
-        return;
+        return false;
     }
+
     show();
 
     NPSetWindowCallbackStruct *wsi = new NPSetWindowCallbackStruct();
@@ -514,7 +479,13 @@ void PluginView::init()
         setNPWindowIfNeeded();
     }
 
-    m_status = PluginStatusLoadedSuccessfully;
+    return true;
+}
+
+void PluginView::platformDestroy()
+{
+    if (platformPluginWidget())
+        delete platformPluginWidget();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/plugins/win/PluginPackageWin.cpp b/src/3rdparty/webkit/WebCore/plugins/win/PluginPackageWin.cpp
index 9e38925..e6fb9d5 100644
--- a/src/3rdparty/webkit/WebCore/plugins/win/PluginPackageWin.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/win/PluginPackageWin.cpp
@@ -245,7 +245,9 @@ bool PluginPackage::load()
         m_loadCount++;
         return true;
     } else {
-#if !PLATFORM(WINCE)
+#if PLATFORM(WINCE)
+        m_module = ::LoadLibraryW(m_path.charactersWithNullTermination());
+#else
         WCHAR currentPath[MAX_PATH];
 
         if (!::GetCurrentDirectoryW(MAX_PATH, currentPath))
@@ -255,12 +257,10 @@ bool PluginPackage::load()
 
         if (!::SetCurrentDirectoryW(path.charactersWithNullTermination()))
             return false;
-#endif
 
         // Load the library
         m_module = ::LoadLibraryExW(m_path.charactersWithNullTermination(), 0, LOAD_WITH_ALTERED_SEARCH_PATH);
 
-#if !PLATFORM(WINCE)
         if (!::SetCurrentDirectoryW(currentPath)) {
             if (m_module)
                 ::FreeLibrary(m_module);
diff --git a/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp b/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp
index 2687186..9ee8ee6 100644
--- a/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp
@@ -104,8 +104,6 @@ using namespace HTMLNames;
 const LPCWSTR kWebPluginViewdowClassName = L"WebPluginView";
 const LPCWSTR kWebPluginViewProperty = L"WebPluginViewProperty";
 
-static const char* MozillaUserAgent = "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0";
-
 #if !PLATFORM(WINCE)
 // The code used to hook BeginPaint/EndPaint originally came from
 // <http://www.fengyuan.com/article/wmprint.html>.
@@ -411,7 +409,7 @@ void PluginView::updatePluginWidget()
     m_clipRect = windowClipRect();
     m_clipRect.move(-m_windowRect.x(), -m_windowRect.y());
 
-    if (platformPluginWidget() && (m_windowRect != oldWindowRect || m_clipRect != oldClipRect)) {
+    if (platformPluginWidget() && (!m_haveUpdatedPluginWidget || m_windowRect != oldWindowRect || m_clipRect != oldClipRect)) {
         HRGN rgn;
 
         setCallingPlugin(true);
@@ -429,7 +427,7 @@ void PluginView::updatePluginWidget()
             ::SetWindowRgn(platformPluginWidget(), rgn, TRUE);
         }
 
-        if (m_windowRect != oldWindowRect)
+        if (!m_haveUpdatedPluginWidget || m_windowRect != oldWindowRect)
             ::MoveWindow(platformPluginWidget(), m_windowRect.x(), m_windowRect.y(), m_windowRect.width(), m_windowRect.height(), TRUE);
 
         if (clipToZeroRect) {
@@ -438,6 +436,8 @@ void PluginView::updatePluginWidget()
         }
 
         setCallingPlugin(false);
+
+        m_haveUpdatedPluginWidget = true;
     }
 }
 
@@ -795,80 +795,6 @@ void PluginView::setNPWindowRect(const IntRect& rect)
     }
 }
 
-void PluginView::stop()
-{
-    if (!m_isStarted)
-        return;
-
-    HashSet<RefPtr<PluginStream> > streams = m_streams;
-    HashSet<RefPtr<PluginStream> >::iterator end = streams.end();
-    for (HashSet<RefPtr<PluginStream> >::iterator it = streams.begin(); it != end; ++it) {
-        (*it)->stop();
-        disconnectStream((*it).get());
-    }
-
-    ASSERT(m_streams.isEmpty());
-
-    m_isStarted = false;
-
-    // Unsubclass the window
-    if (m_isWindowed) {
-#if PLATFORM(WINCE)
-        WNDPROC currentWndProc = (WNDPROC)GetWindowLong(platformPluginWidget(), GWL_WNDPROC);
-
-        if (currentWndProc == PluginViewWndProc)
-            SetWindowLong(platformPluginWidget(), GWL_WNDPROC, (LONG)m_pluginWndProc);
-#else
-        WNDPROC currentWndProc = (WNDPROC)GetWindowLongPtr(platformPluginWidget(), GWLP_WNDPROC);
-
-        if (currentWndProc == PluginViewWndProc)
-            SetWindowLongPtr(platformPluginWidget(), GWLP_WNDPROC, (LONG)m_pluginWndProc);
-#endif
-    }
-
-    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
-
-    // Clear the window
-    m_npWindow.window = 0;
-    if (m_plugin->pluginFuncs()->setwindow && !m_plugin->quirks().contains(PluginQuirkDontSetNullWindowHandleOnDestroy)) {
-        setCallingPlugin(true);
-        m_plugin->pluginFuncs()->setwindow(m_instance, &m_npWindow);
-        setCallingPlugin(false);
-    }
-
-    PluginMainThreadScheduler::scheduler().unregisterPlugin(m_instance);
-
-    // Destroy the plugin
-    NPSavedData* savedData = 0;
-    setCallingPlugin(true);
-    NPError npErr = m_plugin->pluginFuncs()->destroy(m_instance, &savedData);
-    setCallingPlugin(false);
-    LOG_NPERROR(npErr);
-
-    if (savedData) {
-        if (savedData->buf)
-            NPN_MemFree(savedData->buf);
-        NPN_MemFree(savedData);
-    }
-
-    m_instance->pdata = 0;
-}
-
-const char* PluginView::userAgentStatic()
-{
-    return 0;
-}
-
-const char* PluginView::userAgent()
-{
-    if (m_plugin->quirks().contains(PluginQuirkWantsMozillaUserAgent))
-        return MozillaUserAgent;
-
-    if (m_userAgent.isNull())
-        m_userAgent = m_parentFrame->loader()->userAgent(m_url).utf8();
-    return m_userAgent.data();
-}
-
 NPError PluginView::handlePostReadFile(Vector<char>& buffer, uint32 len, const char* buf)
 {
     String filename(buf, len);
@@ -1029,47 +955,10 @@ void PluginView::forceRedraw()
         ::UpdateWindow(windowHandleForPlatformWidget(parent() ? parent()->hostWindow()->platformWindow() : 0));
 }
 
-PluginView::~PluginView()
+bool PluginView::platformStart()
 {
-    if (m_instance)
-        m_instance->ndata = 0;
-    stop();
-
-    deleteAllValues(m_requests);
-
-    freeStringArray(m_paramNames, m_paramCount);
-    freeStringArray(m_paramValues, m_paramCount);
-
-    if (platformPluginWidget())
-        DestroyWindow(platformPluginWidget());
-
-    m_parentFrame->script()->cleanupScriptObjectsForPlugin(this);
-
-    if (m_plugin && !m_plugin->quirks().contains(PluginQuirkDontUnloadPlugin))
-        m_plugin->unload();
-}
-
-void PluginView::init()
-{
-    if (m_haveInitialized)
-        return;
-    m_haveInitialized = true;
-
-    if (!m_plugin) {
-        ASSERT(m_status == PluginStatusCanNotFindPlugin);
-        return;
-    }
-
-    if (!m_plugin->load()) {
-        m_plugin = 0;
-        m_status = PluginStatusCanNotLoadPlugin;
-        return;
-    }
-
-    if (!start()) {
-        m_status = PluginStatusCanNotLoadPlugin;
-        return;
-    }
+    ASSERT(m_isStarted);
+    ASSERT(m_status == PluginStatusLoadedSuccessfully);
 
     if (m_isWindowed) {
         registerPluginView();
@@ -1109,10 +998,18 @@ void PluginView::init()
         m_npWindow.window = 0;
     }
 
+    updatePluginWidget();
+
     if (!m_plugin->quirks().contains(PluginQuirkDeferFirstSetWindowCall))
         setNPWindowRect(frameRect());
 
-    m_status = PluginStatusLoadedSuccessfully;
+    return true;
+}
+
+void PluginView::platformDestroy()
+{
+    if (platformPluginWidget())
+        DestroyWindow(platformPluginWidget());
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/AutoTableLayout.cpp b/src/3rdparty/webkit/WebCore/rendering/AutoTableLayout.cpp
index afb72cf..3749782 100644
--- a/src/3rdparty/webkit/WebCore/rendering/AutoTableLayout.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/AutoTableLayout.cpp
@@ -60,9 +60,9 @@ void AutoTableLayout::recalcColumn(int effCol)
 
     while (child) {
         if (child->isTableCol())
-            static_cast<RenderTableCol*>(child)->calcPrefWidths();
+            toRenderTableCol(child)->calcPrefWidths();
         else if (child->isTableSection()) {
-            RenderTableSection* section = static_cast<RenderTableSection*>(child);
+            RenderTableSection* section = toRenderTableSection(child);
             int numRows = section->numRows();
             RenderTableCell* last = 0;
             for (int i = 0; i < numRows; i++) {
@@ -169,7 +169,7 @@ void AutoTableLayout::fullRecalc()
     int cCol = 0;
     while (child) {
         if (child->isTableCol()) {
-            RenderTableCol *col = static_cast<RenderTableCol*>(child);
+            RenderTableCol *col = toRenderTableCol(child);
             int span = col->span();
             if (col->firstChild()) {
                 grpWidth = col->style()->width();
@@ -227,7 +227,7 @@ static bool shouldScaleColumns(RenderTable* table)
                 if (tw.isPercent())
                     scale = false;
                 else {
-                    RenderTableCell* cell = static_cast<RenderTableCell*>(cb);
+                    RenderTableCell* cell = toRenderTableCell(cb);
                     if (cell->colSpan() > 1 || cell->table()->style()->width().isAuto())
                         scale = false;
                     else
diff --git a/src/3rdparty/webkit/WebCore/rendering/CounterNode.cpp b/src/3rdparty/webkit/WebCore/rendering/CounterNode.cpp
index c30ca9a..22a11b9 100644
--- a/src/3rdparty/webkit/WebCore/rendering/CounterNode.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/CounterNode.cpp
@@ -167,13 +167,13 @@ static void showTreeAndMark(const CounterNode* node)
 
     for (const CounterNode* c = root; c; c = nextInPreOrder(c)) {
         if (c == node)
-            fprintf(stderr, "*");                        
+            fprintf(stderr, "*");
         for (const CounterNode* d = c; d && d != root; d = d->parent())
             fprintf(stderr, "\t");
         if (c->isReset())
-            fprintf(stderr, "reset: %d\n", c->value());
+            fprintf(stderr, "reset: %d %d\n", c->value(), c->countInParent());
         else
-            fprintf(stderr, "increment: %d\n", c->value());
+            fprintf(stderr, "increment: %d %d\n", c->value(), c->countInParent());
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/FixedTableLayout.cpp b/src/3rdparty/webkit/WebCore/rendering/FixedTableLayout.cpp
index 63a4f54..ee3e75a 100644
--- a/src/3rdparty/webkit/WebCore/rendering/FixedTableLayout.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/FixedTableLayout.cpp
@@ -93,7 +93,7 @@ int FixedTableLayout::calcWidthArray(int)
     Length grpWidth;
     while (child) {
         if (child->isTableCol()) {
-            RenderTableCol* col = static_cast<RenderTableCol*>(child);
+            RenderTableCol* col = toRenderTableCol(child);
             if (col->firstChild())
                 grpWidth = col->style()->width();
             else {
@@ -128,7 +128,7 @@ int FixedTableLayout::calcWidthArray(int)
                     currentEffectiveColumn++;
                 }
             }
-            static_cast<RenderTableCol*>(child)->calcPrefWidths();
+            toRenderTableCol(child)->calcPrefWidths();
         } else
             break;
 
@@ -156,7 +156,7 @@ int FixedTableLayout::calcWidthArray(int)
         child = firstRow->firstChild();
         while (child) {
             if (child->isTableCell()) {
-                RenderTableCell* cell = static_cast<RenderTableCell*>(child);
+                RenderTableCell* cell = toRenderTableCell(child);
                 if (cell->prefWidthsDirty())
                     cell->calcPrefWidths();
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/HitTestResult.cpp b/src/3rdparty/webkit/WebCore/rendering/HitTestResult.cpp
index b7de46b..0aaddc9 100644
--- a/src/3rdparty/webkit/WebCore/rendering/HitTestResult.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/HitTestResult.cpp
@@ -209,7 +209,7 @@ String HitTestResult::altDisplayString() const
     
     if (m_innerNonSharedNode->hasTagName(imgTag)) {
         HTMLImageElement* image = static_cast<HTMLImageElement*>(m_innerNonSharedNode.get());
-        return displayString(image->alt(), m_innerNonSharedNode.get());
+        return displayString(image->getAttribute(altAttr), m_innerNonSharedNode.get());
     }
     
     if (m_innerNonSharedNode->hasTagName(inputTag)) {
diff --git a/src/3rdparty/webkit/WebCore/rendering/InlineBox.cpp b/src/3rdparty/webkit/WebCore/rendering/InlineBox.cpp
index bbf11b3..2575fb7 100644
--- a/src/3rdparty/webkit/WebCore/rendering/InlineBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/InlineBox.cpp
@@ -98,18 +98,11 @@ int InlineBox::height() const
         return toRenderBox(m_renderer)->height();
 
     ASSERT(isInlineFlowBox());
-    const InlineFlowBox* flowBox = static_cast<const InlineFlowBox*>(this);
     RenderBoxModelObject* flowObject = boxModelObject();
     const Font& font = renderer()->style(m_firstLine)->font();
     int result = font.height();
-    bool strictMode = renderer()->document()->inStrictMode();
     if (parent())
         result += flowObject->borderTop() + flowObject->paddingTop() + flowObject->borderBottom() + flowObject->paddingBottom();
-    if (strictMode || flowBox->hasTextChildren() || flowObject->hasHorizontalBordersOrPadding())
-        return result;
-    int bottom = root()->bottomOverflow();
-    if (y() + result > bottom)
-        result = bottom - y();
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/InlineBox.h b/src/3rdparty/webkit/WebCore/rendering/InlineBox.h
index 0f66edd..e165f0c 100644
--- a/src/3rdparty/webkit/WebCore/rendering/InlineBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/InlineBox.h
@@ -208,11 +208,6 @@ public:
     inline int baselinePosition(bool isRootLineBox) const { return renderer()->baselinePosition(m_firstLine, isRootLineBox); }
     inline int lineHeight(bool isRootLineBox) const { return renderer()->lineHeight(m_firstLine, isRootLineBox); }
 
-    virtual int topOverflow() const { return y(); }
-    virtual int bottomOverflow() const { return y() + height(); }
-    virtual int leftOverflow() const { return x(); }
-    virtual int rightOverflow() const { return x() + width(); }
-
     virtual int caretMinOffset() const;
     virtual int caretMaxOffset() const;
     virtual unsigned caretMaxRenderedOffset() const;
@@ -246,7 +241,7 @@ public:
     RenderBoxModelObject* boxModelObject() const
     { 
         if (!m_renderer->isText())
-            return static_cast<RenderBoxModelObject*>(m_renderer);
+            return toRenderBoxModelObject(m_renderer);
         return 0;
     }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.cpp b/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.cpp
index b397bce..599129b 100644
--- a/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.cpp
@@ -29,6 +29,7 @@
 #include "RootInlineBox.h"
 #include "RenderBlock.h"
 #include "RenderInline.h"
+#include "RenderLayer.h"
 #include "RenderListMarker.h"
 #include "RenderTableCell.h"
 #include "RootInlineBox.h"
@@ -167,6 +168,8 @@ void InlineFlowBox::adjustPosition(int dx, int dy)
     InlineRunBox::adjustPosition(dx, dy);
     for (InlineBox* child = firstChild(); child; child = child->nextOnLine())
         child->adjustPosition(dx, dy);
+    if (m_overflow)
+        m_overflow->move(dx, dy);
 }
 
 RenderLineBoxList* InlineFlowBox::rendererLineBoxes() const
@@ -248,18 +251,21 @@ void InlineFlowBox::determineSpacingForFlowBoxes(bool lastLine, RenderObject* en
     }
 }
 
-int InlineFlowBox::placeBoxesHorizontally(int xPos, int& leftPosition, int& rightPosition, bool& needsWordSpacing)
+int InlineFlowBox::placeBoxesHorizontally(int xPos, bool& needsWordSpacing)
 {
     // Set our x position.
     setX(xPos);
 
-    int boxShadowLeft = 0;
-    int boxShadowRight = 0;
-    for (ShadowData* boxShadow = renderer()->style(m_firstLine)->boxShadow(); boxShadow; boxShadow = boxShadow->next) {
-        boxShadowLeft = min(boxShadow->x - boxShadow->blur - boxShadow->spread, boxShadowLeft);
-        boxShadowRight = max(boxShadow->x + boxShadow->blur + boxShadow->spread, boxShadowRight);
-    }
-    leftPosition = min(xPos + boxShadowLeft, leftPosition);
+    int leftLayoutOverflow = xPos;
+    int rightLayoutOverflow = xPos;
+    int leftVisualOverflow = xPos;
+    int rightVisualOverflow = xPos;
+
+    int boxShadowLeft;
+    int boxShadowRight;
+    renderer()->style(m_firstLine)->getBoxShadowHorizontalExtent(boxShadowLeft, boxShadowRight);
+
+    leftVisualOverflow = min(xPos + boxShadowLeft, leftVisualOverflow);
 
     int startX = xPos;
     xPos += borderLeft() + paddingLeft();
@@ -277,23 +283,24 @@ int InlineFlowBox::placeBoxesHorizontally(int xPos, int& leftPosition, int& righ
             
             int strokeOverflow = static_cast<int>(ceilf(rt->style()->textStrokeWidth() / 2.0f));
             
-            // If letter-spacing is negative, we should factor that into right overflow. (Even in RTL, letter-spacing is
+            // If letter-spacing is negative, we should factor that into right layout overflow. (Even in RTL, letter-spacing is
             // applied to the right, so this is not an issue with left overflow.
             int letterSpacing = min(0, (int)rt->style(m_firstLine)->font().letterSpacing());
-            
+            rightLayoutOverflow = max(xPos + text->width() - letterSpacing, rightLayoutOverflow);
+
             int leftGlyphOverflow = -strokeOverflow;
             int rightGlyphOverflow = strokeOverflow - letterSpacing;
             
-            int visualOverflowLeft = leftGlyphOverflow;
-            int visualOverflowRight = rightGlyphOverflow;
+            int childOverflowLeft = leftGlyphOverflow;
+            int childOverflowRight = rightGlyphOverflow;
             for (ShadowData* shadow = rt->style()->textShadow(); shadow; shadow = shadow->next) {
-                visualOverflowLeft = min(visualOverflowLeft, shadow->x - shadow->blur + leftGlyphOverflow);
-                visualOverflowRight = max(visualOverflowRight, shadow->x + shadow->blur + rightGlyphOverflow);
+                childOverflowLeft = min(childOverflowLeft, shadow->x - shadow->blur + leftGlyphOverflow);
+                childOverflowRight = max(childOverflowRight, shadow->x + shadow->blur + rightGlyphOverflow);
             }
             
-            leftPosition = min(xPos + visualOverflowLeft, leftPosition);
-            rightPosition = max(xPos + text->width() + visualOverflowRight, rightPosition);
-            m_maxHorizontalVisualOverflow = max(max(visualOverflowRight, -visualOverflowLeft), (int)m_maxHorizontalVisualOverflow);
+            leftVisualOverflow = min(xPos + childOverflowLeft, leftVisualOverflow);
+            rightVisualOverflow = max(xPos + text->width() + childOverflowRight, rightVisualOverflow);
+            
             xPos += text->width();
         } else {
             if (curr->renderer()->isPositioned()) {
@@ -309,13 +316,26 @@ int InlineFlowBox::placeBoxesHorizontally(int xPos, int& leftPosition, int& righ
             if (curr->renderer()->isRenderInline()) {
                 InlineFlowBox* flow = static_cast<InlineFlowBox*>(curr);
                 xPos += flow->marginLeft();
-                xPos = flow->placeBoxesHorizontally(xPos, leftPosition, rightPosition, needsWordSpacing);
+                xPos = flow->placeBoxesHorizontally(xPos, needsWordSpacing);
                 xPos += flow->marginRight();
-            } else if (!curr->renderer()->isListMarker() || static_cast<RenderListMarker*>(curr->renderer())->isInside()) {
+                leftLayoutOverflow = min(leftLayoutOverflow, flow->leftLayoutOverflow());
+                rightLayoutOverflow = max(rightLayoutOverflow, flow->rightLayoutOverflow());
+                leftVisualOverflow = min(leftVisualOverflow, flow->leftVisualOverflow());
+                rightVisualOverflow = max(rightVisualOverflow, flow->rightVisualOverflow());
+            } else if (!curr->renderer()->isListMarker() || toRenderListMarker(curr->renderer())->isInside()) {
                 xPos += curr->boxModelObject()->marginLeft();
                 curr->setX(xPos);
-                leftPosition = min(xPos + toRenderBox(curr->renderer())->overflowLeft(false), leftPosition);
-                rightPosition = max(xPos + toRenderBox(curr->renderer())->overflowWidth(false), rightPosition);
+                 
+                RenderBox* box = toRenderBox(curr->renderer());
+                int childLeftOverflow = box->hasOverflowClip() ? 0 : box->leftLayoutOverflow();
+                int childRightOverflow = box->hasOverflowClip() ? curr->width() : box->rightLayoutOverflow();
+                
+                leftLayoutOverflow = min(xPos + childLeftOverflow, leftLayoutOverflow);
+                rightLayoutOverflow = max(xPos + childRightOverflow, rightLayoutOverflow);
+
+                leftVisualOverflow = min(xPos + box->leftVisualOverflow(), leftVisualOverflow);
+                rightVisualOverflow = max(xPos + box->rightVisualOverflow(), rightVisualOverflow);
+               
                 xPos += curr->width() + curr->boxModelObject()->marginRight();
             }
         }
@@ -323,45 +343,13 @@ int InlineFlowBox::placeBoxesHorizontally(int xPos, int& leftPosition, int& righ
 
     xPos += borderRight() + paddingRight();
     setWidth(xPos - startX);
-    rightPosition = max(x() + width() + boxShadowRight, rightPosition);
+    rightVisualOverflow = max(x() + width() + boxShadowRight, rightVisualOverflow);
+    rightLayoutOverflow = max(x() + width(), rightLayoutOverflow);
 
+    setHorizontalOverflowPositions(leftLayoutOverflow, rightLayoutOverflow, leftVisualOverflow, rightVisualOverflow);
     return xPos;
 }
 
-int InlineFlowBox::verticallyAlignBoxes(int heightOfBlock)
-{
-    int maxPositionTop = 0;
-    int maxPositionBottom = 0;
-    int maxAscent = 0;
-    int maxDescent = 0;
-
-    // Figure out if we're in strict mode.  Note that we can't simply use !style()->htmlHacks(),
-    // because that would match almost strict mode as well.
-    RenderObject* curr = renderer();
-    while (curr && !curr->node())
-        curr = curr->container();
-    bool strictMode = (curr && curr->document()->inStrictMode());
-    
-    computeLogicalBoxHeights(maxPositionTop, maxPositionBottom, maxAscent, maxDescent, strictMode);
-
-    if (maxAscent + maxDescent < max(maxPositionTop, maxPositionBottom))
-        adjustMaxAscentAndDescent(maxAscent, maxDescent, maxPositionTop, maxPositionBottom);
-
-    int maxHeight = maxAscent + maxDescent;
-    int topPosition = heightOfBlock;
-    int bottomPosition = heightOfBlock;
-    int selectionTop = heightOfBlock;
-    int selectionBottom = heightOfBlock;
-    placeBoxesVertically(heightOfBlock, maxHeight, maxAscent, strictMode, topPosition, bottomPosition, selectionTop, selectionBottom);
-
-    setVerticalOverflowPositions(topPosition, bottomPosition);
-    setVerticalSelectionPositions(selectionTop, selectionBottom);
-    
-    heightOfBlock += maxHeight;
-    
-    return heightOfBlock;
-}
-
 void InlineFlowBox::adjustMaxAscentAndDescent(int& maxAscent, int& maxDescent,
                                               int maxPositionTop, int maxPositionBottom)
 {
@@ -481,11 +469,10 @@ void InlineFlowBox::computeLogicalBoxHeights(int& maxPositionTop, int& maxPositi
     }
 }
 
-void InlineFlowBox::placeBoxesVertically(int yPos, int maxHeight, int maxAscent, bool strictMode,
-                                         int& topPosition, int& bottomPosition, int& selectionTop, int& selectionBottom)
+void InlineFlowBox::placeBoxesVertically(int yPos, int maxHeight, int maxAscent, bool strictMode, int& selectionTop, int& selectionBottom)
 {
     if (isRootInlineBox())
-        setY(yPos + max(0, maxAscent - baselinePosition(true))); // Place our root box.
+        setY(yPos + maxAscent - baselinePosition(true)); // Place our root box.
 
     for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
         if (curr->renderer()->isPositioned())
@@ -495,7 +482,7 @@ void InlineFlowBox::placeBoxesVertically(int yPos, int maxHeight, int maxAscent,
         // line-height).
         bool isInlineFlow = curr->isInlineFlowBox();
         if (isInlineFlow)
-            static_cast<InlineFlowBox*>(curr)->placeBoxesVertically(yPos, maxHeight, maxAscent, strictMode, topPosition, bottomPosition, selectionTop, selectionBottom);
+            static_cast<InlineFlowBox*>(curr)->placeBoxesVertically(yPos, maxHeight, maxAscent, strictMode, selectionTop, selectionBottom);
 
         bool childAffectsTopBottomPos = true;
         if (curr->y() == PositionTop)
@@ -506,51 +493,18 @@ void InlineFlowBox::placeBoxesVertically(int yPos, int maxHeight, int maxAscent,
             if ((isInlineFlow && !static_cast<InlineFlowBox*>(curr)->hasTextChildren()) && !curr->boxModelObject()->hasHorizontalBordersOrPadding() && !strictMode)
                 childAffectsTopBottomPos = false;
             int posAdjust = maxAscent - curr->baselinePosition(false);
-            if (!childAffectsTopBottomPos)
-                posAdjust = max(0, posAdjust);
             curr->setY(curr->y() + yPos + posAdjust);
         }
         
-        // FIXME: By only considering overflow as part of the root line box, we can't get an accurate picture regarding what the line
-        // actually needs to paint.  A line box that is part of a self-painting layer technically shouldn't contribute to the overflow
-        // of the line, but in order to not do this and paint accurately, we have to track the overflow somewhere else (either by storing overflow
-        // in each InlineFlowBox up the chain or in the layer itself).  Relative positioned objects on a line will cause scrollbars
-        // to appear when they shouldn't until we fix this issue.
         int newY = curr->y();
-        int overflowTop = 0;
-        int overflowBottom = 0;
         if (curr->isText() || curr->isInlineFlowBox()) {
             const Font& font = curr->renderer()->style(m_firstLine)->font();
             newY += curr->baselinePosition(false) - font.ascent();
-
-            for (ShadowData* shadow = curr->renderer()->style()->textShadow(); shadow; shadow = shadow->next) {
-                overflowTop = min(overflowTop, shadow->y - shadow->blur);
-                overflowBottom = max(overflowBottom, shadow->y + shadow->blur);
-            }
-
-            for (ShadowData* boxShadow = curr->renderer()->style(m_firstLine)->boxShadow(); boxShadow; boxShadow = boxShadow->next) {
-                overflowTop = min(overflowTop, boxShadow->y - boxShadow->blur - boxShadow->spread);
-                overflowBottom = max(overflowBottom, boxShadow->y + boxShadow->blur + boxShadow->spread);
-            }
-
-            for (ShadowData* textShadow = curr->renderer()->style(m_firstLine)->textShadow(); textShadow; textShadow = textShadow->next) {
-                overflowTop = min(overflowTop, textShadow->y - textShadow->blur);
-                overflowBottom = max(overflowBottom, textShadow->y + textShadow->blur);
-            }
-
-            if (curr->renderer()->hasReflection()) {
-                RenderBox* box = toRenderBox(curr->renderer());
-                overflowTop = min(overflowTop, box->reflectionBox().y());
-                overflowBottom = max(overflowBottom, box->reflectionBox().bottom());
-            }
-
             if (curr->isInlineFlowBox())
                 newY -= curr->boxModelObject()->borderTop() + curr->boxModelObject()->paddingTop();
         } else if (!curr->renderer()->isBR()) {
             RenderBox* box = toRenderBox(curr->renderer());
             newY += box->marginTop();
-            overflowTop = box->overflowTop(false);
-            overflowBottom = box->overflowHeight(false) - box->height();
         }
 
         curr->setY(newY);
@@ -559,8 +513,6 @@ void InlineFlowBox::placeBoxesVertically(int yPos, int maxHeight, int maxAscent,
             int boxHeight = curr->height();
             selectionTop = min(selectionTop, newY);
             selectionBottom = max(selectionBottom, newY + boxHeight);
-            topPosition = min(topPosition, newY + overflowTop);
-            bottomPosition = max(bottomPosition, newY + boxHeight + overflowBottom);
         }
     }
 
@@ -574,8 +526,93 @@ void InlineFlowBox::placeBoxesVertically(int yPos, int maxHeight, int maxAscent,
     }
 }
 
+void InlineFlowBox::computeVerticalOverflow(int lineTop, int lineBottom, bool strictMode)
+{
+    int boxHeight = height();
+
+    // Any spillage outside of the line top and bottom is not considered overflow.  We just ignore this, since it only happens
+    // from the "your ascent/descent don't affect the line" quirk.
+    // FIXME: Technically this means there can be repaint errors in the case where a line box has a shadow or background that spills
+    // outside of the block. We should consider making any line box that has anything to render just stop respecting the quirk or making
+    // boxes that render something set visual overflow.
+    int topOverflow = max(y(), lineTop);
+    int bottomOverflow = min(y() + boxHeight, lineBottom);
+    
+    int topLayoutOverflow = topOverflow;
+    int bottomLayoutOverflow = bottomOverflow;
+    
+    int topVisualOverflow = topOverflow;
+    int bottomVisualOverflow = bottomOverflow;
+  
+    // box-shadow on root line boxes is applying to the block and not to the lines.
+    if (parent()) {
+        int boxShadowTop;
+        int boxShadowBottom;
+        renderer()->style(m_firstLine)->getBoxShadowVerticalExtent(boxShadowTop, boxShadowBottom);
+        
+        topVisualOverflow = min(y() + boxShadowTop, topVisualOverflow);
+        bottomVisualOverflow = max(y() + boxHeight + boxShadowBottom, bottomVisualOverflow);
+    }
+
+    for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
+        if (curr->renderer()->isPositioned())
+            continue; // Positioned placeholders don't affect calculations.
+        
+        if (curr->renderer()->isText()) {
+            InlineTextBox* text = static_cast<InlineTextBox*>(curr);
+            RenderText* rt = toRenderText(text->renderer());
+            if (rt->isBR())
+                continue;
+
+            int strokeOverflow = static_cast<int>(ceilf(rt->style()->textStrokeWidth() / 2.0f));
+            
+            int topGlyphOverflow = -strokeOverflow;
+            int bottomGlyphOverflow = strokeOverflow;
+            
+            int childOverflowTop = topGlyphOverflow;
+            int childOverflowBottom = bottomGlyphOverflow;
+            for (ShadowData* shadow = rt->style()->textShadow(); shadow; shadow = shadow->next) {
+                childOverflowTop = min(childOverflowTop, shadow->y - shadow->blur + topGlyphOverflow);
+                childOverflowBottom = max(childOverflowBottom, shadow->y + shadow->blur + bottomGlyphOverflow);
+            }
+            
+            topVisualOverflow = min(curr->y() + childOverflowTop, topVisualOverflow);
+            bottomVisualOverflow = max(curr->y() + text->height() + childOverflowBottom, bottomVisualOverflow);
+        } else {
+            // Only include overflow from inline flows and replaced inlines if they do not paint themselves.
+            bool childIsSelfPainting = curr->boxModelObject()->hasSelfPaintingLayer();
+            if (curr->renderer()->isRenderInline()) {
+                InlineFlowBox* flow = static_cast<InlineFlowBox*>(curr);
+                flow->computeVerticalOverflow(lineTop, lineBottom, strictMode);
+                if (!childIsSelfPainting) {
+                    topLayoutOverflow = min(topLayoutOverflow, flow->topLayoutOverflow());
+                    bottomLayoutOverflow = max(bottomLayoutOverflow, flow->bottomLayoutOverflow());
+                    topVisualOverflow = min(topVisualOverflow, flow->topVisualOverflow());
+                    bottomVisualOverflow = max(bottomVisualOverflow, flow->bottomVisualOverflow());
+                }
+            } else if (!childIsSelfPainting){
+                RenderBox* box = toRenderBox(curr->renderer());
+                int boxY = curr->y();
+                int childTopOverflow = box->hasOverflowClip() ? 0 : box->topLayoutOverflow();
+                int childBottomOverflow = box->hasOverflowClip() ? curr->height() : box->bottomLayoutOverflow();
+                topLayoutOverflow = min(boxY + childTopOverflow, topLayoutOverflow);
+                bottomLayoutOverflow = max(boxY + childBottomOverflow, bottomLayoutOverflow);
+                topVisualOverflow = min(boxY + box->topVisualOverflow(), topVisualOverflow);
+                bottomVisualOverflow = max(boxY + box->bottomVisualOverflow(), bottomVisualOverflow);
+            }
+        }
+    }
+    
+    setVerticalOverflowPositions(topLayoutOverflow, bottomLayoutOverflow, topVisualOverflow, bottomVisualOverflow, boxHeight);
+}
+
 bool InlineFlowBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty)
 {
+    IntRect overflowRect(visibleOverflowRect());
+    overflowRect.move(tx, ty);
+    if (!overflowRect.contains(x, y))
+        return false;
+
     // Check children first.
     for (InlineBox* curr = lastChild(); curr; curr = curr->prevOnLine()) {
         if ((curr->renderer()->isText() || !curr->boxModelObject()->hasSelfPaintingLayer()) && curr->nodeAtPoint(request, result, x, y, tx, ty)) {
@@ -596,23 +633,14 @@ bool InlineFlowBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& re
 
 void InlineFlowBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
 {
-    int xPos = tx + m_x - renderer()->maximalOutlineSize(paintInfo.phase);
-    int w = width() + 2 * renderer()->maximalOutlineSize(paintInfo.phase);
-    int shadowLeft = 0;
-    int shadowRight = 0;
-    for (ShadowData* boxShadow = renderer()->style(m_firstLine)->boxShadow(); boxShadow; boxShadow = boxShadow->next) {
-        shadowLeft = min(boxShadow->x - boxShadow->blur - boxShadow->spread, shadowLeft);
-        shadowRight = max(boxShadow->x + boxShadow->blur + boxShadow->spread, shadowRight);
-    }
-    for (ShadowData* textShadow = renderer()->style(m_firstLine)->textShadow(); textShadow; textShadow = textShadow->next) {
-        shadowLeft = min(textShadow->x - textShadow->blur, shadowLeft);
-        shadowRight = max(textShadow->x + textShadow->blur, shadowRight);
-    }
-    xPos += shadowLeft;
-    w += -shadowLeft + shadowRight;
-    bool intersectsDamageRect = xPos < paintInfo.rect.right() && xPos + w > paintInfo.rect.x();
+    IntRect overflowRect(visibleOverflowRect());
+    overflowRect.inflate(renderer()->maximalOutlineSize(paintInfo.phase));
+    overflowRect.move(tx, ty);
+    
+    if (!paintInfo.rect.intersects(overflowRect))
+        return;
 
-    if (intersectsDamageRect && paintInfo.phase != PaintPhaseChildOutlines) {
+    if (paintInfo.phase != PaintPhaseChildOutlines) {
         if (paintInfo.phase == PaintPhaseOutline || paintInfo.phase == PaintPhaseSelfOutline) {
             // Add ourselves to the paint info struct's list of inlines that need to paint their
             // outlines.
@@ -655,7 +683,7 @@ void InlineFlowBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
     }
 
     // 4. Paint our strike-through
-    if (intersectsDamageRect && (paintInfo.phase == PaintPhaseForeground || paintInfo.phase == PaintPhaseSelection))
+    if (paintInfo.phase == PaintPhaseForeground || paintInfo.phase == PaintPhaseSelection)
         paintTextDecorations(paintInfo, tx, ty, true);
 }
 
@@ -784,18 +812,23 @@ void InlineFlowBox::paintMask(RenderObject::PaintInfo& paintInfo, int tx, int ty
     int w = width();
     int h = height();
 
-    // Figure out if we need to push a transparency layer to render our mask.
-    bool pushTransparencyLayer = false;
     const NinePieceImage& maskNinePieceImage = renderer()->style()->maskBoxImage();
     StyleImage* maskBoxImage = renderer()->style()->maskBoxImage().image();
-    if ((maskBoxImage && renderer()->style()->maskLayers()->hasImage()) || renderer()->style()->maskLayers()->next())
-        pushTransparencyLayer = true;
-    
-    CompositeOperator compositeOp = CompositeDestinationIn;
-    if (pushTransparencyLayer) {
-        paintInfo.context->setCompositeOperation(CompositeDestinationIn);
-        paintInfo.context->beginTransparencyLayer(1.0f);
-        compositeOp = CompositeSourceOver;
+
+    // Figure out if we need to push a transparency layer to render our mask.
+    bool pushTransparencyLayer = false;
+    bool compositedMask = renderer()->hasLayer() && boxModelObject()->layer()->hasCompositedMask();
+    CompositeOperator compositeOp = CompositeSourceOver;
+    if (!compositedMask) {
+        if ((maskBoxImage && renderer()->style()->maskLayers()->hasImage()) || renderer()->style()->maskLayers()->next())
+            pushTransparencyLayer = true;
+        
+        compositeOp = CompositeDestinationIn;
+        if (pushTransparencyLayer) {
+            paintInfo.context->setCompositeOperation(CompositeDestinationIn);
+            paintInfo.context->beginTransparencyLayer(1.0f);
+            compositeOp = CompositeSourceOver;
+        }
     }
 
     paintFillLayers(paintInfo, Color(), renderer()->style()->maskLayers(), tx, ty, w, h, compositeOp);
diff --git a/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.h b/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.h
index 809fd54..23b5cc9 100644
--- a/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.h
@@ -22,6 +22,7 @@
 #define InlineFlowBox_h
 
 #include "InlineRunBox.h"
+#include "RenderOverflow.h"
 
 namespace WebCore {
 
@@ -35,10 +36,8 @@ public:
         : InlineRunBox(obj)
         , m_firstChild(0)
         , m_lastChild(0)
-        , m_maxHorizontalVisualOverflow(0)
         , m_includeLeftEdge(false)
         , m_includeRightEdge(false)
-        , m_hasTextChildren(true)
 #ifndef NDEBUG
         , m_hasBadChildList(false)
 #endif
@@ -121,18 +120,13 @@ public:
     void determineSpacingForFlowBoxes(bool lastLine, RenderObject* endObject);
     int getFlowSpacingWidth();
     bool onEndChain(RenderObject* endObject);
-    virtual int placeBoxesHorizontally(int x, int& leftPosition, int& rightPosition, bool& needsWordSpacing);
-    virtual int verticallyAlignBoxes(int heightOfBlock);
+    virtual int placeBoxesHorizontally(int x, bool& needsWordSpacing);
     void computeLogicalBoxHeights(int& maxPositionTop, int& maxPositionBottom,
                                   int& maxAscent, int& maxDescent, bool strictMode);
     void adjustMaxAscentAndDescent(int& maxAscent, int& maxDescent,
                                    int maxPositionTop, int maxPositionBottom);
-    void placeBoxesVertically(int y, int maxHeight, int maxAscent, bool strictMode,
-                              int& topPosition, int& bottomPosition, int& selectionTop, int& selectionBottom);
-    
-    virtual void setVerticalOverflowPositions(int /*top*/, int /*bottom*/) { }
-    virtual void setVerticalSelectionPositions(int /*top*/, int /*bottom*/) { }
-    short maxHorizontalVisualOverflow() const { return m_maxHorizontalVisualOverflow; }
+    void placeBoxesVertically(int y, int maxHeight, int maxAscent, bool strictMode, int& lineTop, int& lineBottom);
+    void computeVerticalOverflow(int lineTop, int lineBottom, bool strictMode);
 
     void removeChild(InlineBox* child);
 
@@ -146,12 +140,35 @@ public:
     void checkConsistency() const;
     void setHasBadChildList();
 
+    int topVisibleOverflow() const { return std::min(topLayoutOverflow(), topVisualOverflow()); }
+    int bottomVisibleOverflow() const { return std::max(bottomLayoutOverflow(), bottomVisualOverflow()); }
+    int leftVisibleOverflow() const { return std::min(leftLayoutOverflow(), leftVisualOverflow()); }
+    int rightVisibleOverflow() const { return std::max(rightLayoutOverflow(), rightVisualOverflow()); }
+    IntRect visibleOverflowRect() const { return m_overflow ? m_overflow->visibleOverflowRect() : IntRect(m_x, m_y, m_width, height());  }
+
+    int topLayoutOverflow() const { return m_overflow ? m_overflow->topLayoutOverflow() : m_y; }
+    int bottomLayoutOverflow() const { return m_overflow ? m_overflow->bottomLayoutOverflow() : m_y + height(); }
+    int leftLayoutOverflow() const { return m_overflow ? m_overflow->leftLayoutOverflow() : m_x; }
+    int rightLayoutOverflow() const { return m_overflow ? m_overflow->rightLayoutOverflow() : m_x + m_width; }
+    IntRect layoutOverflowRect() const { return m_overflow ? m_overflow->layoutOverflowRect() : IntRect(m_x, m_y, m_width, height()); }
+
+    int topVisualOverflow() const { return m_overflow ? m_overflow->topVisualOverflow() : m_y; }
+    int bottomVisualOverflow() const { return m_overflow ? m_overflow->bottomVisualOverflow() : m_y + height(); }
+    int leftVisualOverflow() const { return m_overflow ? m_overflow->leftVisualOverflow() : m_x; }
+    int rightVisualOverflow() const { return m_overflow ? m_overflow->rightVisualOverflow() : m_x + m_width; }
+    IntRect visualOverflowRect() const { return m_overflow ? m_overflow->visualOverflowRect() : IntRect(m_x, m_y, m_width, height()); }
+
+    void setHorizontalOverflowPositions(int leftLayoutOverflow, int rightLayoutOverflow, int leftVisualOverflow, int rightVisualOverflow);
+    void setVerticalOverflowPositions(int topLayoutOverflow, int bottomLayoutOverflow, int topVisualOverflow, int bottomVisualOverflow, int boxHeight);
+
+protected:
+    OwnPtr<RenderOverflow> m_overflow;
+
 private:
     virtual bool isInlineFlowBox() const { return true; }
 
     InlineBox* m_firstChild;
     InlineBox* m_lastChild;
-    short m_maxHorizontalVisualOverflow;
     
     bool m_includeLeftEdge : 1;
     bool m_includeRightEdge : 1;
@@ -162,6 +179,34 @@ private:
 #endif
 };
 
+inline void InlineFlowBox::setHorizontalOverflowPositions(int leftLayoutOverflow, int rightLayoutOverflow, int leftVisualOverflow, int rightVisualOverflow) 
+{ 
+    if (!m_overflow) {
+        if (leftLayoutOverflow == m_x && rightLayoutOverflow == m_x + m_width && leftVisualOverflow == m_x && rightVisualOverflow == m_x + m_width)
+            return;
+        m_overflow.set(new RenderOverflow(IntRect(m_x, m_y, m_width, m_renderer->style(m_firstLine)->font().height())));    
+    }
+
+    m_overflow->setLeftLayoutOverflow(leftLayoutOverflow);
+    m_overflow->setRightLayoutOverflow(rightLayoutOverflow);
+    m_overflow->setLeftVisualOverflow(leftVisualOverflow); 
+    m_overflow->setRightVisualOverflow(rightVisualOverflow);  
+}
+
+inline void InlineFlowBox::setVerticalOverflowPositions(int topLayoutOverflow, int bottomLayoutOverflow, int topVisualOverflow, int bottomVisualOverflow, int boxHeight)
+{
+    if (!m_overflow) {
+        if (topLayoutOverflow == m_y && bottomLayoutOverflow == m_y + boxHeight && topVisualOverflow == m_y && bottomVisualOverflow == m_y + boxHeight)
+            return;
+        m_overflow.set(new RenderOverflow(IntRect(m_x, m_y, m_width, boxHeight)));
+    }
+
+    m_overflow->setTopLayoutOverflow(topLayoutOverflow);
+    m_overflow->setBottomLayoutOverflow(bottomLayoutOverflow);
+    m_overflow->setTopVisualOverflow(topVisualOverflow); 
+    m_overflow->setBottomVisualOverflow(bottomVisualOverflow);  
+}
+
 #ifdef NDEBUG
 inline void InlineFlowBox::checkConsistency() const
 {
diff --git a/src/3rdparty/webkit/WebCore/rendering/InlineTextBox.cpp b/src/3rdparty/webkit/WebCore/rendering/InlineTextBox.cpp
index 619fb95..751340d 100644
--- a/src/3rdparty/webkit/WebCore/rendering/InlineTextBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/InlineTextBox.cpp
@@ -312,8 +312,12 @@ void InlineTextBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
 
     ASSERT(paintInfo.phase != PaintPhaseSelfOutline && paintInfo.phase != PaintPhaseChildOutlines);
 
-    int xPos = tx + m_x - parent()->maxHorizontalVisualOverflow();
-    int w = width() + 2 * parent()->maxHorizontalVisualOverflow();
+    // FIXME: Technically we're potentially incorporating other visual overflow that had nothing to do with us.
+    // Would it be simpler to just check our own shadow and stroke overflow by hand here?
+    int leftOverflow = parent()->x() - parent()->leftVisualOverflow();
+    int rightOverflow = parent()->rightVisualOverflow() - (parent()->x() + parent()->width());
+    int xPos = tx + m_x - leftOverflow;
+    int w = width() + leftOverflow + rightOverflow;
     if (xPos >= paintInfo.rect.right() || xPos + w <= paintInfo.rect.x())
         return;
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp
index d0af981..969716f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp
@@ -32,28 +32,27 @@
 
 #include "MediaControlElements.h"
 
-#include "LocalizedStrings.h"
 #include "EventNames.h"
 #include "FloatConversion.h"
 #include "Frame.h"
 #include "HTMLNames.h"
+#include "LocalizedStrings.h"
 #include "MouseEvent.h"
 #include "RenderMedia.h"
 #include "RenderSlider.h"
 #include "RenderTheme.h"
-#include "CString.h"
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
-// FIXME: These constants may need to be tweaked to better match the seeking in the QT plugin
+// FIXME: These constants may need to be tweaked to better match the seeking in the QuickTime plug-in.
 static const float cSeekRepeatDelay = 0.1f;
 static const float cStepTime = 0.07f;
 static const float cSeekTime = 0.2f;
 
-MediaControlShadowRootElement::MediaControlShadowRootElement(Document* doc, HTMLMediaElement* mediaElement) 
-    : HTMLDivElement(divTag, doc)
+MediaControlShadowRootElement::MediaControlShadowRootElement(Document* document, HTMLMediaElement* mediaElement)
+    : HTMLDivElement(divTag, document)
     , m_mediaElement(mediaElement) 
 {
     RefPtr<RenderStyle> rootStyle = RenderStyle::create();
@@ -76,14 +75,36 @@ void MediaControlShadowRootElement::updateStyle()
 }
 
 // ----------------------------
-    
 
-MediaControlElement::MediaControlElement(Document* doc, PseudoId pseudo, HTMLMediaElement* mediaElement) 
-    : HTMLDivElement(divTag, doc)
+MediaControlElement::MediaControlElement(Document* document, PseudoId pseudo, HTMLMediaElement* mediaElement)
+    : HTMLDivElement(divTag, document)
     , m_mediaElement(mediaElement)
     , m_pseudoStyleId(pseudo)
 {
     setInDocument(true);
+    switch (pseudo) {
+    case MEDIA_CONTROLS_CURRENT_TIME_DISPLAY:
+        m_displayType = MediaCurrentTimeDisplay;
+        break;
+    case MEDIA_CONTROLS_TIME_REMAINING_DISPLAY:
+        m_displayType = MediaTimeRemainingDisplay;
+        break;
+    case MEDIA_CONTROLS_TIMELINE_CONTAINER:
+        m_displayType = MediaTimelineContainer;
+        break;
+    case MEDIA_CONTROLS_STATUS_DISPLAY:
+        m_displayType = MediaStatusDisplay;
+        break;
+    case MEDIA_CONTROLS_PANEL:
+        m_displayType = MediaControlsPanel;
+        break;
+    case MEDIA_CONTROLS_VOLUME_SLIDER_CONTAINER:
+        m_displayType = MediaVolumeSliderContainer;
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        break;
+    }
 }
 
 void MediaControlElement::attachToParent(Element* parent)
@@ -165,8 +186,8 @@ void MediaControlElement::updateStyle()
 
 // ----------------------------
 
-MediaControlTimelineContainerElement::MediaControlTimelineContainerElement(Document* doc, HTMLMediaElement* element)
-: MediaControlElement(doc, MEDIA_CONTROLS_TIMELINE_CONTAINER, element)
+MediaControlTimelineContainerElement::MediaControlTimelineContainerElement(Document* document, HTMLMediaElement* element)
+    : MediaControlElement(document, MEDIA_CONTROLS_TIMELINE_CONTAINER, element)
 {
 }
 
@@ -185,12 +206,54 @@ bool MediaControlTimelineContainerElement::rendererIsNeeded(RenderStyle* style)
     return !isnan(duration) && !isinf(duration);
 }
 
-    
 // ----------------------------
 
-MediaControlStatusDisplayElement::MediaControlStatusDisplayElement(Document* doc, HTMLMediaElement* element)
-: MediaControlElement(doc, MEDIA_CONTROLS_STATUS_DISPLAY, element)
-, m_stateBeingDisplayed(Nothing)
+MediaControlVolumeSliderContainerElement::MediaControlVolumeSliderContainerElement(Document* doc, HTMLMediaElement* element)
+    : MediaControlElement(doc, MEDIA_CONTROLS_VOLUME_SLIDER_CONTAINER, element)
+    , m_isVisible(false)
+    , m_x(0)
+    , m_y(0)
+{
+}
+
+PassRefPtr<RenderStyle> MediaControlVolumeSliderContainerElement::styleForElement()
+{
+    RefPtr<RenderStyle> style = MediaControlElement::styleForElement();
+    style->setPosition(AbsolutePosition);
+    style->setLeft(Length(m_x, Fixed));
+    style->setTop(Length(m_y, Fixed));
+    style->setDisplay(m_isVisible ? BLOCK : NONE);
+    return style;
+}
+
+void MediaControlVolumeSliderContainerElement::setVisible(bool visible)
+{
+    if (visible == m_isVisible)
+        return;
+    m_isVisible = visible;
+}
+
+void MediaControlVolumeSliderContainerElement::setPosition(int x, int y)
+{
+    if (x == m_x && y == m_y)
+        return;
+    m_x = x;
+    m_y = y;
+}
+
+bool MediaControlVolumeSliderContainerElement::hitTest(const IntPoint& absPoint)
+{
+    if (renderer() && renderer()->style()->hasAppearance())
+        return renderer()->theme()->hitTestMediaControlPart(renderer(), absPoint);
+
+    return false;
+}
+
+// ----------------------------
+
+MediaControlStatusDisplayElement::MediaControlStatusDisplayElement(Document* document, HTMLMediaElement* element)
+    : MediaControlElement(document, MEDIA_CONTROLS_STATUS_DISPLAY, element)
+    , m_stateBeingDisplayed(Nothing)
 {
 }
 
@@ -235,14 +298,46 @@ bool MediaControlStatusDisplayElement::rendererIsNeeded(RenderStyle* style)
 
 // ----------------------------
     
-MediaControlInputElement::MediaControlInputElement(Document* doc, PseudoId pseudo, const String& type, HTMLMediaElement* mediaElement, MediaControlElementType displayType) 
-    : HTMLInputElement(inputTag, doc)
+MediaControlInputElement::MediaControlInputElement(Document* document, PseudoId pseudo, const String& type, HTMLMediaElement* mediaElement)
+    : HTMLInputElement(inputTag, document)
     , m_mediaElement(mediaElement)
     , m_pseudoStyleId(pseudo)
-    , m_displayType(displayType)
 {
     setInputType(type);
     setInDocument(true);
+
+    switch (pseudo) {
+    case MEDIA_CONTROLS_MUTE_BUTTON:
+        m_displayType = MediaMuteButton;
+        break;
+    case MEDIA_CONTROLS_PLAY_BUTTON:
+        m_displayType = MediaPlayButton;
+        break;
+    case MEDIA_CONTROLS_SEEK_FORWARD_BUTTON:
+        m_displayType = MediaSeekForwardButton;
+        break;
+    case MEDIA_CONTROLS_SEEK_BACK_BUTTON:
+        m_displayType = MediaSeekBackButton;
+        break;
+    case MEDIA_CONTROLS_FULLSCREEN_BUTTON:
+        m_displayType = MediaFullscreenButton;
+        break;
+    case MEDIA_CONTROLS_TIMELINE:
+        m_displayType = MediaSlider;
+        break;
+    case MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON:
+        m_displayType = MediaReturnToRealtimeButton;
+        break;
+    case MEDIA_CONTROLS_REWIND_BUTTON:
+        m_displayType = MediaRewindButton;
+        break;
+    case MEDIA_CONTROLS_VOLUME_SLIDER:
+        m_displayType = MediaVolumeSlider;
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        break;
+    }
 }
 
 void MediaControlInputElement::attachToParent(Element* parent)
@@ -324,14 +419,14 @@ void MediaControlInputElement::setDisplayType(MediaControlElementType displayTyp
         return;
 
     m_displayType = displayType;
-    if (RenderObject* o = renderer())
-        o->repaint();
+    if (RenderObject* object = renderer())
+        object->repaint();
 }
 
 // ----------------------------
 
-MediaControlMuteButtonElement::MediaControlMuteButtonElement(Document* doc, HTMLMediaElement* element)
-    : MediaControlInputElement(doc, MEDIA_CONTROLS_MUTE_BUTTON, "button", element, element->muted() ? MediaUnMuteButton : MediaMuteButton)
+MediaControlMuteButtonElement::MediaControlMuteButtonElement(Document* document, HTMLMediaElement* element)
+    : MediaControlInputElement(document, MEDIA_CONTROLS_MUTE_BUTTON, "button", element)
 {
 }
 
@@ -349,10 +444,20 @@ void MediaControlMuteButtonElement::updateDisplayType()
     setDisplayType(m_mediaElement->muted() ? MediaUnMuteButton : MediaMuteButton);
 }
 
+bool MediaControlMuteButtonElement::disabled() const
+{
+    return !m_mediaElement->hasAudio();
+}
+
+bool MediaControlMuteButtonElement::rendererIsNeeded(RenderStyle* style)
+{
+    return MediaControlInputElement::rendererIsNeeded(style) && !disabled();
+}
+
 // ----------------------------
 
-MediaControlPlayButtonElement::MediaControlPlayButtonElement(Document* doc, HTMLMediaElement* element)
-    : MediaControlInputElement(doc, MEDIA_CONTROLS_PLAY_BUTTON, "button", element, element->canPlay() ? MediaPlayButton : MediaPauseButton)
+MediaControlPlayButtonElement::MediaControlPlayButtonElement(Document* document, HTMLMediaElement* element)
+    : MediaControlInputElement(document, MEDIA_CONTROLS_PLAY_BUTTON, "button", element)
 {
 }
 
@@ -372,9 +477,9 @@ void MediaControlPlayButtonElement::updateDisplayType()
 
 // ----------------------------
 
-MediaControlSeekButtonElement::MediaControlSeekButtonElement(Document* doc, HTMLMediaElement* element, bool forward)
-    : MediaControlInputElement(doc, forward ? MEDIA_CONTROLS_SEEK_FORWARD_BUTTON : MEDIA_CONTROLS_SEEK_BACK_BUTTON,
-                               "button", element, forward ? MediaSeekForwardButton : MediaSeekBackButton)
+MediaControlSeekButtonElement::MediaControlSeekButtonElement(Document* document, HTMLMediaElement* element, bool forward)
+    : MediaControlInputElement(document, forward ? MEDIA_CONTROLS_SEEK_FORWARD_BUTTON : MEDIA_CONTROLS_SEEK_BACK_BUTTON,
+                               "button", element)
     , m_forward(forward)
     , m_seeking(false)
     , m_capturing(false)
@@ -432,8 +537,8 @@ void MediaControlSeekButtonElement::detach()
 
 // ----------------------------
 
-MediaControlRewindButtonElement::MediaControlRewindButtonElement(Document* doc, HTMLMediaElement* element)
-: MediaControlInputElement(doc, MEDIA_CONTROLS_REWIND_BUTTON, "button", element, MediaRewindButton)
+MediaControlRewindButtonElement::MediaControlRewindButtonElement(Document* document, HTMLMediaElement* element)
+    : MediaControlInputElement(document, MEDIA_CONTROLS_REWIND_BUTTON, "button", element)
 {
 }
 
@@ -454,8 +559,8 @@ bool MediaControlRewindButtonElement::rendererIsNeeded(RenderStyle* style)
 
 // ----------------------------
 
-MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeButtonElement(Document* doc, HTMLMediaElement* element)
-: MediaControlInputElement(doc, MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON, "button", element, MediaReturnToRealtimeButton)
+MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeButtonElement(Document* document, HTMLMediaElement* element)
+    : MediaControlInputElement(document, MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON, "button", element)
 {
 }
 
@@ -476,20 +581,23 @@ bool MediaControlReturnToRealtimeButtonElement::rendererIsNeeded(RenderStyle* st
 // ----------------------------
 
 MediaControlTimelineElement::MediaControlTimelineElement(Document* document, HTMLMediaElement* element)
-    : MediaControlInputElement(document, MEDIA_CONTROLS_TIMELINE, "range", element, MediaTimelineContainer)
-{ 
+    : MediaControlInputElement(document, MEDIA_CONTROLS_TIMELINE, "range", element)
+{
 }
 
 void MediaControlTimelineElement::defaultEventHandler(Event* event)
 {
+    // Left button is 0. Rejects mouse events not from left button.
+    if (event->isMouseEvent() && static_cast<MouseEvent*>(event)->button())
+        return;
+
     if (event->type() == eventNames().mousedownEvent)
         m_mediaElement->beginScrubbing();
 
     MediaControlInputElement::defaultEventHandler(event);
 
-    if (event->type() == eventNames().mouseoverEvent || event->type() == eventNames().mouseoutEvent || event->type() == eventNames().mousemoveEvent) {
+    if (event->type() == eventNames().mouseoverEvent || event->type() == eventNames().mouseoutEvent || event->type() == eventNames().mousemoveEvent)
         return;
-    }
 
     float time = narrowPrecisionToFloat(value().toDouble());
     if (time != m_mediaElement->currentTime()) {
@@ -497,9 +605,9 @@ void MediaControlTimelineElement::defaultEventHandler(Event* event)
         m_mediaElement->setCurrentTime(time, ec);
     }
 
-    RenderSlider* slider = static_cast<RenderSlider*>(renderer());
+    RenderSlider* slider = toRenderSlider(renderer());
     if (slider && slider->inDragMode())
-        static_cast<RenderMedia*>(m_mediaElement->renderer())->updateTimeDisplay();
+        toRenderMedia(m_mediaElement->renderer())->updateTimeDisplay();
 
     if (event->type() == eventNames().mouseupEvent)
         m_mediaElement->endScrubbing();
@@ -517,8 +625,34 @@ void MediaControlTimelineElement::update(bool updateDuration)
 
 // ----------------------------
 
-MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement(Document* doc, HTMLMediaElement* element)
-    : MediaControlInputElement(doc, MEDIA_CONTROLS_FULLSCREEN_BUTTON, "button", element, MediaFullscreenButton)
+MediaControlVolumeSliderElement::MediaControlVolumeSliderElement(Document* document, HTMLMediaElement* element)
+    : MediaControlInputElement(document, MEDIA_CONTROLS_VOLUME_SLIDER, "range", element)
+{
+}
+
+void MediaControlVolumeSliderElement::defaultEventHandler(Event* event)
+{
+    // Left button is 0. Rejects mouse events not from left button.
+    if (event->isMouseEvent() && static_cast<MouseEvent*>(event)->button())
+        return;
+
+    MediaControlInputElement::defaultEventHandler(event);
+
+    if (event->type() == eventNames().mouseoverEvent || event->type() == eventNames().mouseoutEvent || event->type() == eventNames().mousemoveEvent)
+        return;
+
+    float volume = narrowPrecisionToFloat(value().toDouble());
+    if (volume != m_mediaElement->volume()) {
+        ExceptionCode ec = 0;
+        m_mediaElement->setVolume(volume, ec);
+        ASSERT(!ec);
+    }
+}
+
+// ----------------------------
+
+MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement(Document* document, HTMLMediaElement* element)
+    : MediaControlInputElement(document, MEDIA_CONTROLS_FULLSCREEN_BUTTON, "button", element)
 {
 }
 
@@ -538,8 +672,9 @@ bool MediaControlFullscreenButtonElement::rendererIsNeeded(RenderStyle* style)
 
 // ----------------------------
 
-MediaControlTimeDisplayElement::MediaControlTimeDisplayElement(Document* doc, PseudoId pseudo, HTMLMediaElement* element)
-    : MediaControlElement(doc, pseudo, element)
+MediaControlTimeDisplayElement::MediaControlTimeDisplayElement(Document* document, PseudoId pseudo, HTMLMediaElement* element)
+    : MediaControlElement(document, pseudo, element)
+    , m_currentValue(0)
     , m_isVisible(true)
 {
 }
@@ -569,6 +704,32 @@ void MediaControlTimeDisplayElement::setVisible(bool visible)
     renderer()->setStyle(style.get());
 }
 
+String MediaControlTimeDisplayElement::formatTime(float time)
+{
+    if (!isfinite(time))
+        time = 0;
+    int seconds = (int)fabsf(time);
+    int hours = seconds / (60 * 60);
+    int minutes = (seconds / 60) % 60;
+    seconds %= 60;
+    if (hours) {
+        if (hours > 9)
+            return String::format("%s%02d:%02d:%02d", (time < 0 ? "-" : ""), hours, minutes, seconds);
+
+        return String::format("%s%01d:%02d:%02d", (time < 0 ? "-" : ""), hours, minutes, seconds);
+    }
+
+    return String::format("%s%02d:%02d", (time < 0 ? "-" : ""), minutes, seconds);
+}
+
+void MediaControlTimeDisplayElement::setCurrentValue(float time)
+{
+    m_currentValue = time;
+
+    ExceptionCode ec;
+    setInnerText(formatTime(m_currentValue), ec);
+}
+
 
 } //namespace WebCore
 #endif // enable(video)
diff --git a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h
index d5fa5d2..e80f7fa 100644
--- a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h
+++ b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h
@@ -57,10 +57,13 @@ enum MediaControlElementType {
     MediaUnMuteButton,
     MediaPauseButton,
     MediaTimelineContainer,
-    MediaCurrentTimeDisplay, 
+    MediaCurrentTimeDisplay,
     MediaTimeRemainingDisplay,
     MediaStatusDisplay,
-    MediaControlsPanel
+    MediaControlsPanel,
+    MediaVolumeSliderContainer,
+    MediaVolumeSlider,
+    MediaVolumeSliderThumb
 };
 
 class MediaControlShadowRootElement : public HTMLDivElement {
@@ -89,9 +92,15 @@ public:
     void update();
     virtual void updateStyle();
 
+    MediaControlElementType displayType() const { return m_displayType; }
+
+    HTMLMediaElement* mediaElement() const { return m_mediaElement; }
+    virtual bool isMediaControlElement() const { return true; }
+
 protected:
     HTMLMediaElement* m_mediaElement;   
     PseudoId m_pseudoStyleId;
+    MediaControlElementType m_displayType;  // some elements can show multiple types (e.g. play/pause)
 };
 
 // ----------------------------
@@ -104,6 +113,22 @@ public:
 
 // ----------------------------
 
+class MediaControlVolumeSliderContainerElement : public MediaControlElement {
+public:
+    MediaControlVolumeSliderContainerElement(Document*, HTMLMediaElement*);
+    virtual PassRefPtr<RenderStyle> styleForElement();
+    void setVisible(bool);
+    bool isVisible() { return m_isVisible; }
+    void setPosition(int x, int y);
+    bool hitTest(const IntPoint& absPoint);
+
+private:
+    bool m_isVisible;
+    int m_x, m_y;
+};
+
+// ----------------------------
+
 class MediaControlStatusDisplayElement : public MediaControlElement {
 public:
     MediaControlStatusDisplayElement(Document*, HTMLMediaElement*);
@@ -118,7 +143,7 @@ private:
 
 class MediaControlInputElement : public HTMLInputElement {
 public:
-    MediaControlInputElement(Document*, PseudoId, const String& type, HTMLMediaElement*, MediaControlElementType);
+    MediaControlInputElement(Document*, PseudoId, const String& type, HTMLMediaElement*);
     virtual void attach();
     virtual bool rendererIsNeeded(RenderStyle*);
 
@@ -130,13 +155,19 @@ public:
     bool hitTest(const IntPoint& absPoint);
     MediaControlElementType displayType() const { return m_displayType; }
 
+    // Some elements are disabled by movie state (eg. mute if no audio).
+    virtual bool disabled() const  { return false; }
+
+    HTMLMediaElement* mediaElement() const { return m_mediaElement; }
+    virtual bool isMediaControlElement() const { return true; }
+
 protected:
     virtual void updateDisplayType() { }
     void setDisplayType(MediaControlElementType);
 
     HTMLMediaElement* m_mediaElement;   
     PseudoId m_pseudoStyleId;
-    MediaControlElementType m_displayType;  // some elements can show multiple types (e.g. play/pause)
+    MediaControlElementType m_displayType;
 };
 
 // ----------------------------
@@ -146,6 +177,8 @@ public:
     MediaControlMuteButtonElement(Document*, HTMLMediaElement*);
     virtual void defaultEventHandler(Event*);
     virtual void updateDisplayType();
+    virtual bool disabled() const;
+    virtual bool rendererIsNeeded(RenderStyle*);
 };
 
 // ----------------------------
@@ -202,6 +235,14 @@ public:
 
 // ----------------------------
 
+class MediaControlVolumeSliderElement : public MediaControlInputElement {
+public:
+    MediaControlVolumeSliderElement(Document*, HTMLMediaElement*);
+    virtual void defaultEventHandler(Event*);
+};
+
+// ----------------------------
+
 class MediaControlFullscreenButtonElement : public MediaControlInputElement {
 public:
     MediaControlFullscreenButtonElement(Document*, HTMLMediaElement*);
@@ -217,7 +258,13 @@ public:
     void setVisible(bool);
     virtual PassRefPtr<RenderStyle> styleForElement();
 
+    void setCurrentValue(float);
+    float currentValue() const { return m_currentValue; }
+
 private:
+    String formatTime(float time);
+
+    float m_currentValue;
     bool m_isVisible;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderApplet.h b/src/3rdparty/webkit/WebCore/rendering/RenderApplet.h
index b481d87..343421e 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderApplet.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderApplet.h
@@ -46,6 +46,15 @@ namespace WebCore {
         HashMap<String, String> m_args;
     };
 
+    inline RenderApplet* toRenderApplet(RenderObject* object)
+    {
+        ASSERT(!object || object->isApplet());
+        return static_cast<RenderApplet*>(object);
+    }
+
+    // This will catch anyone doing an unnecessary cast.
+    void toRenderApplet(const RenderApplet*);
+
 } // namespace WebCore
 
 #endif // RenderApplet_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBlock.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderBlock.cpp
index be1bab3..7056bca 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBlock.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBlock.cpp
@@ -33,6 +33,7 @@
 #include "HTMLNames.h"
 #include "HitTestResult.h"
 #include "InlineTextBox.h"
+#include "RenderFlexibleBox.h"
 #include "RenderImage.h"
 #include "RenderInline.h"
 #include "RenderMarquee.h"
@@ -114,8 +115,6 @@ RenderBlock::MarginInfo::MarginInfo(RenderBlock* block, int top, int bottom)
 
     m_posMargin = m_canCollapseTopWithChildren ? block->maxTopMargin(true) : 0;
     m_negMargin = m_canCollapseTopWithChildren ? block->maxTopMargin(false) : 0;
-
-    m_selfCollapsingBlockClearedFloat = false;
     
     m_topQuirk = m_bottomQuirk = m_determinedTopQuirk = false;
 }
@@ -128,10 +127,6 @@ RenderBlock::RenderBlock(Node* node)
       , m_positionedObjects(0)
       , m_inlineContinuation(0)
       , m_maxMargin(0)
-      , m_overflowHeight(0)
-      , m_overflowWidth(0)
-      , m_overflowLeft(0)
-      , m_overflowTop(0)
       , m_lineHeight(-1)
 {
     setChildrenInline(true);
@@ -550,104 +545,6 @@ void RenderBlock::removeChild(RenderObject* oldChild)
     }
 }
 
-int RenderBlock::overflowHeight(bool includeInterior) const
-{
-    if (!includeInterior && hasOverflowClip()) {
-        int shadowHeight = 0;
-        for (ShadowData* boxShadow = style()->boxShadow(); boxShadow; boxShadow = boxShadow->next)
-            shadowHeight = max(boxShadow->y + boxShadow->blur + boxShadow->spread, shadowHeight);
-        int inflatedHeight = height() + shadowHeight;
-        if (hasReflection())
-            inflatedHeight = max(inflatedHeight, reflectionBox().bottom());
-        return inflatedHeight;
-    }
-    return m_overflowHeight;
-}
-
-int RenderBlock::overflowWidth(bool includeInterior) const
-{
-    if (!includeInterior && hasOverflowClip()) {
-        int shadowWidth = 0;
-        for (ShadowData* boxShadow = style()->boxShadow(); boxShadow; boxShadow = boxShadow->next)
-            shadowWidth = max(boxShadow->x + boxShadow->blur + boxShadow->spread, shadowWidth);
-        int inflatedWidth = width() + shadowWidth;
-        if (hasReflection())
-            inflatedWidth = max(inflatedWidth, reflectionBox().right());
-        return inflatedWidth;
-    }
-    return m_overflowWidth;
-}
-
-int RenderBlock::overflowLeft(bool includeInterior) const
-{
-    if (!includeInterior && hasOverflowClip()) {
-        int shadowLeft = 0;
-        for (ShadowData* boxShadow = style()->boxShadow(); boxShadow; boxShadow = boxShadow->next)
-            shadowLeft = min(boxShadow->x - boxShadow->blur - boxShadow->spread, shadowLeft);
-        int left = shadowLeft;
-        if (hasReflection())
-            left = min(left, reflectionBox().x());
-        return left;
-    }
-    return m_overflowLeft;
-}
-
-int RenderBlock::overflowTop(bool includeInterior) const
-{
-    if (!includeInterior && hasOverflowClip()) {
-        int shadowTop = 0;
-        for (ShadowData* boxShadow = style()->boxShadow(); boxShadow; boxShadow = boxShadow->next)
-            shadowTop = min(boxShadow->y - boxShadow->blur - boxShadow->spread, shadowTop);
-        int top = shadowTop;
-        if (hasReflection())
-            top = min(top, reflectionBox().y());
-        return top;
-    }
-    return m_overflowTop;
-}
-
-IntRect RenderBlock::overflowRect(bool includeInterior) const
-{
-    if (!includeInterior && hasOverflowClip()) {
-        IntRect box = borderBoxRect();
-        int shadowLeft = 0;
-        int shadowRight = 0;
-        int shadowTop = 0;
-        int shadowBottom = 0;
-
-        for (ShadowData* boxShadow = style()->boxShadow(); boxShadow; boxShadow = boxShadow->next) {
-            shadowLeft = min(boxShadow->x - boxShadow->blur - boxShadow->spread, shadowLeft);
-            shadowRight = max(boxShadow->x + boxShadow->blur + boxShadow->spread, shadowRight);
-            shadowTop = min(boxShadow->y - boxShadow->blur - boxShadow->spread, shadowTop);
-            shadowBottom = max(boxShadow->y + boxShadow->blur + boxShadow->spread, shadowBottom);
-        }
-
-        box.move(shadowLeft, shadowTop);
-        box.setWidth(box.width() - shadowLeft + shadowRight);
-        box.setHeight(box.height() - shadowTop + shadowBottom);
-
-        if (hasReflection()) {
-            IntRect reflection(reflectionBox());
-            int reflectTop = min(box.y(), reflection.y());
-            int reflectBottom = max(box.bottom(), reflection.bottom());
-            box.setHeight(reflectBottom - reflectTop);
-            box.setY(reflectTop);
-            
-            int reflectLeft = min(box.x(), reflection.x());
-            int reflectRight = max(box.right(), reflection.right());
-            box.setWidth(reflectRight - reflectLeft);
-            box.setX(reflectLeft);
-        }
-        return box;
-    }
-
-    if (!includeInterior && hasOverflowClip())
-        return borderBoxRect();
-    int l = overflowLeft(includeInterior);
-    int t = overflowTop(includeInterior);
-    return IntRect(l, t, overflowWidth(includeInterior) - l, max(overflowHeight(includeInterior), height()) - t);
-}
-
 bool RenderBlock::isSelfCollapsingBlock() const
 {
     // We are not self-collapsing if we
@@ -741,13 +638,9 @@ void RenderBlock::layout()
     layoutBlock(false);
     
     // It's safe to check for control clip here, since controls can never be table cells.
-    if (hasControlClip()) {
-        // Because of the lightweight clip, there can never be any overflow from children.
-        m_overflowWidth = width();
-        m_overflowHeight = height();
-        m_overflowLeft = 0;
-        m_overflowTop = 0;
-    }
+    // If we have a lightweight clip, there can never be any overflow from children.
+    if (hasControlClip() && m_overflow)
+        clearLayoutOverflow();
 }
 
 void RenderBlock::layoutBlock(bool relayoutChildren)
@@ -769,8 +662,7 @@ void RenderBlock::layoutBlock(bool relayoutChildren)
     calcWidth();
     calcColumnWidth();
 
-    m_overflowWidth = width();
-    m_overflowLeft = 0;
+    m_overflow.clear();
 
     if (oldWidth != width() || oldColumnWidth != desiredColumnWidth())
         relayoutChildren = true;
@@ -780,8 +672,6 @@ void RenderBlock::layoutBlock(bool relayoutChildren)
     int previousHeight = height();
     setHeight(0);
 
-    m_overflowHeight = 0;
-
     // We use four values, maxTopPos, maxTopNeg, maxBottomPos, and maxBottomNeg, to track
     // our current maximal positive and negative margins.  These values are used when we
     // are collapsed with adjacent blocks, so for example, if you have block A and B
@@ -846,43 +736,35 @@ void RenderBlock::layoutBlock(bool relayoutChildren)
                 }
             }
         }
+        
         // We have to rebalance columns to the new height.
         layoutColumns(singleColumnBottom);
-
-        // If the block got expanded in size, then increase our overflowheight to match.
-        if (m_overflowHeight > height())
-            m_overflowHeight -= toAdd;
-        if (m_overflowHeight < height())
-            m_overflowHeight = height();
     }
+
     if (previousHeight != height())
         relayoutChildren = true;
 
-    if ((isCell || isInline() || isFloatingOrPositioned() || isRoot()) && !hasOverflowClip() && !hasControlClip())
-        addVisualOverflow(floatRect());
-
-    layoutPositionedObjects(relayoutChildren || isRoot());
+    // It's weird that we're treating float information as normal flow overflow, but we do this because floatRect() isn't
+    // able to be propagated up the render tree yet.  Overflow information is however.  This check is designed to catch anyone
+    // who wasn't going to propagate float information up to the parent and yet could potentially be painted by its ancestor.
+    if (isRoot() || expandsToEncloseOverhangingFloats())
+        addOverflowFromFloats();
 
-    positionListMarker();
+    // Add overflow from children (unless we're multi-column, since in that case all our child overflow is clipped anyway).
+    if (!hasColumns()) {
+        if (childrenInline())
+            addOverflowFromInlineChildren();
+        else
+            addOverflowFromBlockChildren();
+    }
 
-    // Always ensure our overflow width/height are at least as large as our width/height.
-    m_overflowWidth = max(m_overflowWidth, width());
-    m_overflowHeight = max(m_overflowHeight, height());
+    // Add visual overflow from box-shadow and reflections.
+    addShadowOverflow();
 
-    if (!hasOverflowClip()) {
-        for (ShadowData* boxShadow = style()->boxShadow(); boxShadow; boxShadow = boxShadow->next) {
-            m_overflowLeft = min(m_overflowLeft, boxShadow->x - boxShadow->blur - boxShadow->spread);
-            m_overflowWidth = max(m_overflowWidth, width() + boxShadow->x + boxShadow->blur + boxShadow->spread);
-            m_overflowTop = min(m_overflowTop, boxShadow->y - boxShadow->blur - boxShadow->spread);
-            m_overflowHeight = max(m_overflowHeight, height() + boxShadow->y + boxShadow->blur + boxShadow->spread);
-        }
-        
-        if (hasReflection()) {
-            m_overflowTop = min(m_overflowTop, reflectionBox().y());
-            m_overflowHeight = max(m_overflowHeight, reflectionBox().bottom());
-        }
-    }
+    layoutPositionedObjects(relayoutChildren || isRoot());
 
+    positionListMarker();
+    
     statePusher.pop();
 
     // Update our scroll information if we're overflow:auto/scroll/hidden now that we know if
@@ -892,7 +774,7 @@ void RenderBlock::layoutBlock(bool relayoutChildren)
     // Repaint with our new bounds if they are different from our old bounds.
     bool didFullRepaint = repainter.repaintAfterLayout();
     if (!didFullRepaint && repaintTop != repaintBottom && (style()->visibility() == VISIBLE || enclosingLayer()->hasVisibleContent())) {
-        IntRect repaintRect(m_overflowLeft, repaintTop, m_overflowWidth - m_overflowLeft, repaintBottom - repaintTop);
+        IntRect repaintRect(leftVisibleOverflow(), repaintTop, rightVisibleOverflow() - leftVisibleOverflow(), repaintBottom - repaintTop);
 
         // FIXME: Deal with multiple column repainting.  We have to split the repaint
         // rect up into multiple rects if it spans columns.
@@ -921,6 +803,28 @@ void RenderBlock::layoutBlock(bool relayoutChildren)
     setNeedsLayout(false);
 }
 
+void RenderBlock::addOverflowFromBlockChildren()
+{
+    for (RenderBox* child = firstChildBox(); child; child = child->nextSiblingBox()) {
+        if (!child->isFloatingOrPositioned())
+            addOverflowFromChild(child);
+    }
+}
+
+void RenderBlock::addOverflowFromFloats()
+{
+    IntRect result;
+    if (!m_floatingObjects)
+        return;
+    FloatingObject* r;
+    DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
+    for (; (r = it.current()); ++it) {
+        if (r->m_shouldPaint && !r->m_renderer->hasSelfPaintingLayer())
+            addOverflowFromChild(r->m_renderer, IntSize(r->m_left + r->m_renderer->marginLeft(), r->m_top + r->m_renderer->marginTop()));
+    }
+    return;
+}
+
 bool RenderBlock::expandsToEncloseOverhangingFloats() const
 {
     return isInlineBlockOrInlineTable() || isFloatingOrPositioned() || hasOverflowClip() || (parent() && parent()->isFlexibleBox()) || hasColumns() || isTableCell() || isFieldset();
@@ -1010,7 +914,10 @@ bool RenderBlock::handleRunInChild(RenderBox* child)
     // See if we have a run-in element with inline children.  If the
     // children aren't inline, then just treat the run-in as a normal
     // block.
-    if (!child->isRunIn() || !child->childrenInline() && !child->isReplaced())
+    if (!child->isRunIn() || !child->childrenInline())
+        return false;
+    // FIXME: We don't handle non-block elements with run-in for now.
+    if (!child->isRenderBlock())
         return false;
 
     // Get the next non-positioned/non-floating RenderBlock.
@@ -1144,8 +1051,6 @@ int RenderBlock::collapseMargins(RenderBox* child, MarginInfo& marginInfo)
 
         if (marginInfo.margin())
             marginInfo.setBottomQuirk(child->isBottomMarginQuirk() || style()->marginBottomCollapse() == MDISCARD);
-
-        marginInfo.setSelfCollapsingBlockClearedFloat(false);
     }
     
     return ypos;
@@ -1161,16 +1066,26 @@ int RenderBlock::clearFloatsIfNeeded(RenderBox* child, MarginInfo& marginInfo, i
         // For self-collapsing blocks that clear, they can still collapse their
         // margins with following siblings.  Reset the current margins to represent
         // the self-collapsing block's margins only.
-        marginInfo.setPosMargin(max(child->maxTopMargin(true), child->maxBottomMargin(true)));
-        marginInfo.setNegMargin(max(child->maxTopMargin(false), child->maxBottomMargin(false)));
+        // CSS2.1 states:
+        // "An element that has had clearance applied to it never collapses its top margin with its parent block's bottom margin.
+        // Therefore if we are at the bottom of the block, let's go ahead and reset margins to only include the
+        // self-collapsing block's bottom margin.
+        bool atBottomOfBlock = true;
+        for (RenderBox* curr = child->nextSiblingBox(); curr && atBottomOfBlock; curr = curr->nextSiblingBox()) {
+            if (!curr->isFloatingOrPositioned())
+                atBottomOfBlock = false;
+        }
+        if (atBottomOfBlock) {
+            marginInfo.setPosMargin(child->maxBottomMargin(true));
+            marginInfo.setNegMargin(child->maxBottomMargin(false));
+        } else {
+            marginInfo.setPosMargin(max(child->maxTopMargin(true), child->maxBottomMargin(true)));
+            marginInfo.setNegMargin(max(child->maxTopMargin(false), child->maxBottomMargin(false)));
+        }
         
-        // Adjust our height such that we are ready to be collapsed with subsequent siblings.
+        // Adjust our height such that we are ready to be collapsed with subsequent siblings (or the bottom
+        // of the parent block).
         setHeight(child->y() - max(0, marginInfo.margin()));
-        
-        // Set a flag that we cleared a float so that we know both to increase the height of the block
-        // to compensate for the clear and to avoid collapsing our margins with the parent block's
-        // bottom margin.
-        marginInfo.setSelfCollapsingBlockClearedFloat(true);
     } else
         // Increase our height by the amount we had to clear.
         setHeight(height() + heightIncrease);
@@ -1274,17 +1189,7 @@ void RenderBlock::setCollapsedBottomMargin(const MarginInfo& marginInfo)
 
 void RenderBlock::handleBottomOfBlock(int top, int bottom, MarginInfo& marginInfo)
 {
-    // If our last flow was a self-collapsing block that cleared a float, then we don't
-    // collapse it with the bottom of the block.
-    if (!marginInfo.selfCollapsingBlockClearedFloat())
-        marginInfo.setAtBottomOfBlock(true);
-    else {
-        // We have to special case the negative margin situation (where the collapsed
-        // margin of the self-collapsing block is negative), since there's no need
-        // to make an adjustment in that case.
-        if (marginInfo.margin() < 0)
-            marginInfo.clearMargin();
-    }
+    marginInfo.setAtBottomOfBlock(true);
 
     // If we can't collapse with children then go ahead and add in the bottom margin.
     if (!marginInfo.canCollapseWithBottom() && !marginInfo.canCollapseWithTop()
@@ -1298,9 +1203,6 @@ void RenderBlock::handleBottomOfBlock(int top, int bottom, MarginInfo& marginInf
     // If this happens, ensure that the computed height is increased to the minimal height.
     setHeight(max(height(), top + bottom));
 
-    // Always make sure our overflow height is at least our height.
-    m_overflowHeight = max(height(), m_overflowHeight);
-
     // Update our bottom collapsed margin info.
     setCollapsedBottomMargin(marginInfo);
 }
@@ -1328,8 +1230,7 @@ void RenderBlock::layoutBlockChildren(bool relayoutChildren, int& maxFloatBottom
     int top = borderTop() + paddingTop();
     int bottom = borderBottom() + paddingBottom() + horizontalScrollbarHeight();
 
-    m_overflowHeight = top;
-    setHeight(m_overflowHeight);
+    setHeight(top);
 
     // The margin struct caches all our current margin collapsing state.  The compact struct caches state when we encounter compacts,
     MarginInfo marginInfo(this, top, bottom);
@@ -1350,9 +1251,6 @@ void RenderBlock::layoutBlockChildren(bool relayoutChildren, int& maxFloatBottom
         if (legend == child)
             continue; // Skip the legend, since it has already been positioned up in the fieldset's border.
 
-        int oldTopPosMargin = maxTopPosMargin();
-        int oldTopNegMargin = maxTopNegMargin();
-
         // Make sure we layout children if they need it.
         // FIXME: Technically percentage height objects only need a relayout if their percentage isn't going to be turned into
         // an auto value.  Add a method to determine this, so that we can avoid the relayout.
@@ -1368,127 +1266,127 @@ void RenderBlock::layoutBlockChildren(bool relayoutChildren, int& maxFloatBottom
         if (handleSpecialChild(child, marginInfo))
             continue;
 
-        // The child is a normal flow object.  Compute its vertical margins now.
-        child->calcVerticalMargins();
+        // Lay out the child.
+        layoutBlockChild(child, marginInfo, previousFloatBottom, maxFloatBottom);
+    }
+    
+    // Now do the handling of the bottom of the block, adding in our bottom border/padding and
+    // determining the correct collapsed bottom margin information.
+    handleBottomOfBlock(top, bottom, marginInfo);
+}
 
-        // Do not allow a collapse if the margin top collapse style is set to SEPARATE.
-        if (child->style()->marginTopCollapse() == MSEPARATE) {
-            marginInfo.setAtTopOfBlock(false);
-            marginInfo.clearMargin();
-        }
+void RenderBlock::layoutBlockChild(RenderBox* child, MarginInfo& marginInfo, int& previousFloatBottom, int& maxFloatBottom)
+{
+    int oldTopPosMargin = maxTopPosMargin();
+    int oldTopNegMargin = maxTopNegMargin();
 
-        // Try to guess our correct y position.  In most cases this guess will
-        // be correct.  Only if we're wrong (when we compute the real y position)
-        // will we have to potentially relayout.
-        int yPosEstimate = estimateVerticalPosition(child, marginInfo);
+    // The child is a normal flow object.  Compute its vertical margins now.
+    child->calcVerticalMargins();
 
-        // Cache our old rect so that we can dirty the proper repaint rects if the child moves.
-        IntRect oldRect(child->x(), child->y() , child->width(), child->height());
+    // Do not allow a collapse if the margin top collapse style is set to SEPARATE.
+    if (child->style()->marginTopCollapse() == MSEPARATE) {
+        marginInfo.setAtTopOfBlock(false);
+        marginInfo.clearMargin();
+    }
+
+    // Try to guess our correct y position.  In most cases this guess will
+    // be correct.  Only if we're wrong (when we compute the real y position)
+    // will we have to potentially relayout.
+    int yPosEstimate = estimateVerticalPosition(child, marginInfo);
+
+    // Cache our old rect so that we can dirty the proper repaint rects if the child moves.
+    IntRect oldRect(child->x(), child->y() , child->width(), child->height());
 #ifndef NDEBUG
-        IntSize oldLayoutDelta = view()->layoutDelta();
+    IntSize oldLayoutDelta = view()->layoutDelta();
 #endif
-        // Go ahead and position the child as though it didn't collapse with the top.
-        view()->addLayoutDelta(IntSize(0, child->y() - yPosEstimate));
-        child->setLocation(child->x(), yPosEstimate);
-
-        bool markDescendantsWithFloats = false;
-        if (yPosEstimate != oldRect.y() && !child->avoidsFloats() && child->isBlockFlow() && toRenderBlock(child)->containsFloats())
+    // Go ahead and position the child as though it didn't collapse with the top.
+    view()->addLayoutDelta(IntSize(0, child->y() - yPosEstimate));
+    child->setLocation(child->x(), yPosEstimate);
+
+    bool markDescendantsWithFloats = false;
+    if (yPosEstimate != oldRect.y() && !child->avoidsFloats() && child->isBlockFlow() && toRenderBlock(child)->containsFloats())
+        markDescendantsWithFloats = true;
+    else if (!child->avoidsFloats() || child->shrinkToAvoidFloats()) {
+        // If an element might be affected by the presence of floats, then always mark it for
+        // layout.
+        int fb = max(previousFloatBottom, floatBottom());
+        if (fb > yPosEstimate)
             markDescendantsWithFloats = true;
-        else if (!child->avoidsFloats() || child->shrinkToAvoidFloats()) {
-            // If an element might be affected by the presence of floats, then always mark it for
-            // layout.
-            int fb = max(previousFloatBottom, floatBottom());
-            if (fb > yPosEstimate)
-                markDescendantsWithFloats = true;
-        }
+    }
 
-        if (child->isRenderBlock()) {
-            if (markDescendantsWithFloats)
-                toRenderBlock(child)->markAllDescendantsWithFloatsForLayout();
+    if (child->isRenderBlock()) {
+        if (markDescendantsWithFloats)
+            toRenderBlock(child)->markAllDescendantsWithFloatsForLayout();
 
-            previousFloatBottom = max(previousFloatBottom, oldRect.y() + toRenderBlock(child)->floatBottom());
-        }
+        previousFloatBottom = max(previousFloatBottom, oldRect.y() + toRenderBlock(child)->floatBottom());
+    }
 
-        bool childHadLayout = child->m_everHadLayout;
-        bool childNeededLayout = child->needsLayout();
-        if (childNeededLayout)
-            child->layout();
+    bool childHadLayout = child->m_everHadLayout;
+    bool childNeededLayout = child->needsLayout();
+    if (childNeededLayout)
+        child->layout();
 
-        // Now determine the correct ypos based off examination of collapsing margin
-        // values.
-        int yBeforeClear = collapseMargins(child, marginInfo);
+    // Now determine the correct ypos based off examination of collapsing margin
+    // values.
+    int yBeforeClear = collapseMargins(child, marginInfo);
 
-        // Now check for clear.
-        int yAfterClear = clearFloatsIfNeeded(child, marginInfo, oldTopPosMargin, oldTopNegMargin, yBeforeClear);
-        
-        view()->addLayoutDelta(IntSize(0, yPosEstimate - yAfterClear));
-        child->setLocation(child->x(), yAfterClear);
+    // Now check for clear.
+    int yAfterClear = clearFloatsIfNeeded(child, marginInfo, oldTopPosMargin, oldTopNegMargin, yBeforeClear);
     
-        // Now we have a final y position.  See if it really does end up being different from our estimate.
-        if (yAfterClear != yPosEstimate) {
-            if (child->shrinkToAvoidFloats()) {
-                // The child's width depends on the line width.
-                // When the child shifts to clear an item, its width can
-                // change (because it has more available line width).
-                // So go ahead and mark the item as dirty.
-                child->setChildNeedsLayout(true, false);
-            }
-            if (!child->avoidsFloats() && child->isBlockFlow() && toRenderBlock(child)->containsFloats())
-                toRenderBlock(child)->markAllDescendantsWithFloatsForLayout();
-            // Our guess was wrong. Make the child lay itself out again.
-            child->layoutIfNeeded();
+    view()->addLayoutDelta(IntSize(0, yPosEstimate - yAfterClear));
+    child->setLocation(child->x(), yAfterClear);
+
+    // Now we have a final y position.  See if it really does end up being different from our estimate.
+    if (yAfterClear != yPosEstimate) {
+        if (child->shrinkToAvoidFloats()) {
+            // The child's width depends on the line width.
+            // When the child shifts to clear an item, its width can
+            // change (because it has more available line width).
+            // So go ahead and mark the item as dirty.
+            child->setChildNeedsLayout(true, false);
         }
+        if (!child->avoidsFloats() && child->isBlockFlow() && toRenderBlock(child)->containsFloats())
+            toRenderBlock(child)->markAllDescendantsWithFloatsForLayout();
+        // Our guess was wrong. Make the child lay itself out again.
+        child->layoutIfNeeded();
+    }
 
-        // We are no longer at the top of the block if we encounter a non-empty child.  
-        // This has to be done after checking for clear, so that margins can be reset if a clear occurred.
-        if (marginInfo.atTopOfBlock() && !child->isSelfCollapsingBlock())
-            marginInfo.setAtTopOfBlock(false);
-
-        // Now place the child in the correct horizontal position
-        determineHorizontalPosition(child);
+    // We are no longer at the top of the block if we encounter a non-empty child.  
+    // This has to be done after checking for clear, so that margins can be reset if a clear occurred.
+    if (marginInfo.atTopOfBlock() && !child->isSelfCollapsingBlock())
+        marginInfo.setAtTopOfBlock(false);
 
-        // Update our height now that the child has been placed in the correct position.
-        setHeight(height() + child->height());
-        if (child->style()->marginBottomCollapse() == MSEPARATE) {
-            setHeight(height() + child->marginBottom());
-            marginInfo.clearMargin();
-        }
-        // If the child has overhanging floats that intrude into following siblings (or possibly out
-        // of this block), then the parent gets notified of the floats now.
-        if (child->isBlockFlow() && toRenderBlock(child)->containsFloats())
-            maxFloatBottom = max(maxFloatBottom, addOverhangingFloats(toRenderBlock(child), -child->x(), -child->y(), !childNeededLayout));
-
-        // Update our visual overflow in case the child spills out the block, but only if we were going to paint
-        // the child block ourselves.
-        if (!child->hasSelfPaintingLayer()) {
-            m_overflowTop = min(m_overflowTop, child->y() + child->overflowTop(false));
-            m_overflowHeight = max(m_overflowHeight, height() + child->overflowHeight(false) - child->height());
-            m_overflowWidth = max(child->x() + child->overflowWidth(false), m_overflowWidth);
-            m_overflowLeft = min(child->x() + child->overflowLeft(false), m_overflowLeft);
-        }
+    // Now place the child in the correct horizontal position
+    determineHorizontalPosition(child);
 
-        IntSize childOffset(child->x() - oldRect.x(), child->y() - oldRect.y());
-        if (childOffset.width() || childOffset.height()) {
-            view()->addLayoutDelta(childOffset);
+    // Update our height now that the child has been placed in the correct position.
+    setHeight(height() + child->height());
+    if (child->style()->marginBottomCollapse() == MSEPARATE) {
+        setHeight(height() + child->marginBottom());
+        marginInfo.clearMargin();
+    }
+    // If the child has overhanging floats that intrude into following siblings (or possibly out
+    // of this block), then the parent gets notified of the floats now.
+    if (child->isBlockFlow() && toRenderBlock(child)->containsFloats())
+        maxFloatBottom = max(maxFloatBottom, addOverhangingFloats(toRenderBlock(child), -child->x(), -child->y(), !childNeededLayout));
 
-            // If the child moved, we have to repaint it as well as any floating/positioned
-            // descendants.  An exception is if we need a layout.  In this case, we know we're going to
-            // repaint ourselves (and the child) anyway.
-            if (childHadLayout && !selfNeedsLayout() && child->checkForRepaintDuringLayout())
-                child->repaintDuringLayoutIfMoved(oldRect);
-        }
+    IntSize childOffset(child->x() - oldRect.x(), child->y() - oldRect.y());
+    if (childOffset.width() || childOffset.height()) {
+        view()->addLayoutDelta(childOffset);
 
-        if (!childHadLayout && child->checkForRepaintDuringLayout()) {
-            child->repaint();
-            child->repaintOverhangingFloats(true);
-        }
+        // If the child moved, we have to repaint it as well as any floating/positioned
+        // descendants.  An exception is if we need a layout.  In this case, we know we're going to
+        // repaint ourselves (and the child) anyway.
+        if (childHadLayout && !selfNeedsLayout() && child->checkForRepaintDuringLayout())
+            child->repaintDuringLayoutIfMoved(oldRect);
+    }
 
-        ASSERT(oldLayoutDelta == view()->layoutDelta());
+    if (!childHadLayout && child->checkForRepaintDuringLayout()) {
+        child->repaint();
+        child->repaintOverhangingFloats(true);
     }
 
-    // Now do the handling of the bottom of the block, adding in our bottom border/padding and
-    // determining the correct collapsed bottom margin information.
-    handleBottomOfBlock(top, bottom, marginInfo);
+    ASSERT(oldLayoutDelta == view()->layoutDelta());
 }
 
 bool RenderBlock::layoutOnlyPositionedObjects()
@@ -1594,7 +1492,7 @@ void RenderBlock::paint(PaintInfo& paintInfo, int tx, int ty)
     // FIXME: Could eliminate the isRoot() check if we fix background painting so that the RenderView
     // paints the root's background.
     if (!isRoot()) {
-        IntRect overflowBox = overflowRect(false);
+        IntRect overflowBox = visibleOverflowRect();
         overflowBox.inflate(maximalOutlineSize(paintInfo.phase));
         overflowBox.move(tx, ty);
         if (!overflowBox.intersects(paintInfo.rect))
@@ -2131,9 +2029,9 @@ GapRects RenderBlock::fillInlineSelectionGaps(RenderBlock* rootBlock, int blockX
 
     if (lastSelectedLine && selectionState() != SelectionEnd && selectionState() != SelectionBoth) {
         // Go ahead and update our lastY to be the bottom of the last selected line.
-        lastTop = (ty - blockY) + lastSelectedLine->bottomOverflow();
-        lastLeft = leftSelectionOffset(rootBlock, lastSelectedLine->bottomOverflow());
-        lastRight = rightSelectionOffset(rootBlock, lastSelectedLine->bottomOverflow());
+        lastTop = (ty - blockY) + lastSelectedLine->selectionBottom();
+        lastLeft = leftSelectionOffset(rootBlock, lastSelectedLine->selectionBottom());
+        lastRight = rightSelectionOffset(rootBlock, lastSelectedLine->selectionBottom());
     }
     return result;
 }
@@ -2684,13 +2582,13 @@ RenderBlock::floatBottom() const
 IntRect RenderBlock::floatRect() const
 {
     IntRect result;
-    if (!m_floatingObjects || hasOverflowClip())
+    if (!m_floatingObjects || hasOverflowClip() || hasColumns())
         return result;
     FloatingObject* r;
     DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
     for (; (r = it.current()); ++it) {
         if (r->m_shouldPaint && !r->m_renderer->hasSelfPaintingLayer()) {
-            IntRect childRect = r->m_renderer->overflowRect(false);
+            IntRect childRect = r->m_renderer->visibleOverflowRect();
             childRect.move(r->m_left + r->m_renderer->marginLeft(), r->m_top + r->m_renderer->marginTop());
             result.unite(childRect);
         }
@@ -2701,10 +2599,11 @@ IntRect RenderBlock::floatRect() const
 
 int RenderBlock::lowestPosition(bool includeOverflowInterior, bool includeSelf) const
 {
+    int bottom = includeSelf && width() > 0 ? height() : 0;
+
     if (!includeOverflowInterior && (hasOverflowClip() || hasControlClip()))
-        return includeSelf && width() > 0 ? overflowHeight(false) : 0;
+        return bottom;
     
-    int bottom = includeSelf && width() > 0 ? height() : 0;
     if (!hasColumns()) {
         // FIXME: Come up with a way to use the layer tree to avoid visiting all the kids.
         // For now, we have to descend into all the children, since we may have a huge abs div inside
@@ -2728,7 +2627,7 @@ int RenderBlock::lowestPosition(bool includeOverflowInterior, bool includeSelf)
     int relativeOffset = includeSelf && isRelPositioned() ? relativePositionOffsetY() : 0;
 
     if (includeSelf)
-        bottom = max(bottom, m_overflowHeight + relativeOffset);
+        bottom = max(bottom, bottomLayoutOverflow() + relativeOffset);
         
     if (m_positionedObjects) {
         RenderBox* r;
@@ -2770,8 +2669,8 @@ int RenderBlock::lowestPosition(bool includeOverflowInterior, bool includeSelf)
     if (!includeSelf) {
         bottom = max(bottom, borderTop() + paddingTop() + paddingBottom() + relativeOffset);
         if (childrenInline()) {
-            if (lastLineBox()) {
-                int childBottomEdge = lastLineBox()->y() + lastLineBox()->height();
+            if (lastRootBox()) {
+                int childBottomEdge = lastRootBox()->selectionBottom();
                 bottom = max(bottom, childBottomEdge + paddingBottom() + relativeOffset);
             }
         } else {
@@ -2791,11 +2690,11 @@ int RenderBlock::lowestPosition(bool includeOverflowInterior, bool includeSelf)
 
 int RenderBlock::rightmostPosition(bool includeOverflowInterior, bool includeSelf) const
 {
-    if (!includeOverflowInterior && (hasOverflowClip() || hasControlClip()))
-        return includeSelf && height() > 0 ? overflowWidth(false) : 0;
-
     int right = includeSelf && height() > 0 ? width() : 0;
 
+    if (!includeOverflowInterior && (hasOverflowClip() || hasControlClip()))
+        return right;
+
     if (!hasColumns()) {
         // FIXME: Come up with a way to use the layer tree to avoid visiting all the kids.
         // For now, we have to descend into all the children, since we may have a huge abs div inside
@@ -2818,7 +2717,7 @@ int RenderBlock::rightmostPosition(bool includeOverflowInterior, bool includeSel
     int relativeOffset = includeSelf && isRelPositioned() ? relativePositionOffsetX() : 0;
 
     if (includeSelf)
-        right = max(right, m_overflowWidth + relativeOffset);
+        right = max(right, rightLayoutOverflow() + relativeOffset);
 
     if (m_positionedObjects) {
         RenderBox* r;
@@ -2885,10 +2784,11 @@ int RenderBlock::rightmostPosition(bool includeOverflowInterior, bool includeSel
 
 int RenderBlock::leftmostPosition(bool includeOverflowInterior, bool includeSelf) const
 {
+    int left = includeSelf && height() > 0 ? 0 : width();
+    
     if (!includeOverflowInterior && (hasOverflowClip() || hasControlClip()))
-        return includeSelf && height() > 0 ? overflowLeft(false) : width();
+        return left;
 
-    int left = includeSelf && height() > 0 ? 0 : width();
     if (!hasColumns()) {
         // FIXME: Come up with a way to use the layer tree to avoid visiting all the kids.
         // For now, we have to descend into all the children, since we may have a huge abs div inside
@@ -2911,7 +2811,7 @@ int RenderBlock::leftmostPosition(bool includeOverflowInterior, bool includeSelf
     int relativeOffset = includeSelf && isRelPositioned() ? relativePositionOffsetX() : 0;
 
     if (includeSelf)
-        left = min(left, m_overflowLeft + relativeOffset);
+        left = min(left, leftLayoutOverflow() + relativeOffset);
 
     if (m_positionedObjects) {
         RenderBox* r;
@@ -3105,9 +3005,8 @@ int RenderBlock::addOverhangingFloats(RenderBlock* child, int xoff, int yoff, bo
 
     int lowestFloatBottom = 0;
 
-    // Floats that will remain the child's responsiblity to paint should factor into its
-    // visual overflow.
-    IntRect floatsOverflowRect;
+    // Floats that will remain the child's responsibility to paint should factor into its
+    // overflow.
     DeprecatedPtrListIterator<FloatingObject> it(*child->m_floatingObjects);
     for (FloatingObject* r; (r = it.current()); ++it) {
         int bottom = child->y() + r->m_bottom;
@@ -3148,13 +3047,9 @@ int RenderBlock::addOverhangingFloats(RenderBlock* child, int xoff, int yoff, bo
             // it should paint.
             r->m_shouldPaint = true;
 
-        if (r->m_shouldPaint && !r->m_renderer->hasSelfPaintingLayer()) {
-            IntRect floatOverflowRect = r->m_renderer->overflowRect(false);
-            floatOverflowRect.move(r->m_left + r->m_renderer->marginLeft(), r->m_top + r->m_renderer->marginTop());
-            floatsOverflowRect.unite(floatOverflowRect);
-        }
+        if (r->m_shouldPaint && !r->m_renderer->hasSelfPaintingLayer())
+            child->addOverflowFromChild(r->m_renderer, IntSize(r->m_left + r->m_renderer->marginLeft(), r->m_top + r->m_renderer->marginTop()));
     }
-    child->addVisualOverflow(floatsOverflowRect);
     return lowestFloatBottom;
 }
 
@@ -3269,26 +3164,20 @@ int RenderBlock::getClearDelta(RenderBox* child, int yPos)
     // We also clear floats if we are too big to sit on the same line as a float (and wish to avoid floats by default).
     // FIXME: Note that the remaining space checks aren't quite accurate, since you should be able to clear only some floats (the minimum # needed
     // to fit) and not all (we should be using nextFloatBottomBelow and looping).
-    // Do not allow tables to wrap in quirks or even in almost strict mode 
-    // (ebay on the PLT, finance.yahoo.com in the real world, versiontracker.com forces even almost strict mode not to work)
     int result = clearSet ? max(0, bottom - yPos) : 0;
-    if (!result && child->avoidsFloats() && child->style()->width().isFixed() && 
-        child->minPrefWidth() > lineWidth(yPos, false) && child->minPrefWidth() <= availableWidth() && 
-        document()->inStrictMode())   
-        result = max(0, floatBottom() - yPos);
+    if (!result && child->avoidsFloats()) {
+        int oldYPos = child->y();
+        int oldWidth = child->width();
+        child->setY(yPos);
+        child->calcWidth();
+        if (child->width() > lineWidth(yPos, false) && child->minPrefWidth() <= availableWidth())
+            result = max(0, floatBottom() - yPos);
+        child->setY(oldYPos);
+        child->setWidth(oldWidth);
+    }
     return result;
 }
 
-void RenderBlock::addVisualOverflow(const IntRect& r)
-{
-    if (r.isEmpty())
-        return;
-    m_overflowLeft = min(m_overflowLeft, r.x());
-    m_overflowWidth = max(m_overflowWidth, r.right());
-    m_overflowTop = min(m_overflowTop, r.y());
-    m_overflowHeight = max(m_overflowHeight, r.bottom());
-}
-
 bool RenderBlock::isPointInOverflowControl(HitTestResult& result, int _x, int _y, int _tx, int _ty)
 {
     if (!scrollsOverflow())
@@ -3304,7 +3193,7 @@ bool RenderBlock::nodeAtPoint(const HitTestRequest& request, HitTestResult& resu
 
     if (!isRenderView()) {
         // Check if we need to do anything at all.
-        IntRect overflowBox = overflowRect(false);
+        IntRect overflowBox = visibleOverflowRect();
         overflowBox.move(tx, ty);
         if (!overflowBox.contains(_x, _y))
             return false;
@@ -3513,9 +3402,9 @@ VisiblePosition RenderBlock::positionForPointWithInlineChildren(const IntPoint&
         if (root->nextRootBox()) {
             // FIXME: We would prefer to make the break point halfway between the bottom
             // of the previous root box and the top of the next root box.
-            bottom = root->nextRootBox()->topOverflow();
+            bottom = root->nextRootBox()->lineTop();
         } else
-            bottom = root->bottomOverflow() + verticalLineClickFudgeFactor;
+            bottom = root->lineBottom() + verticalLineClickFudgeFactor;
 
         // check if this root line box is located at this y coordinate
         if (pointInContents.y() < bottom) {
@@ -3534,7 +3423,7 @@ VisiblePosition RenderBlock::positionForPointWithInlineChildren(const IntPoint&
     }
 
     if (closestBox) {
-        if (!useWindowsBehavior && pointInContents.y() < firstRootBoxWithChildren->topOverflow() - verticalLineClickFudgeFactor) {
+        if (!useWindowsBehavior && pointInContents.y() < firstRootBoxWithChildren->lineTop() - verticalLineClickFudgeFactor) {
             // y coordinate is above first root line box, so return the start of the first
             return VisiblePosition(positionForBox(firstRootBoxWithChildren->firstLeafChild(), true), DOWNSTREAM);
         }
@@ -3807,14 +3696,16 @@ int RenderBlock::layoutColumns(int endOfContent)
             colCount++;
     }
 
-    m_overflowWidth = max(width(), currX - colGap);
-    m_overflowLeft = min(0, currX + desiredColumnWidth + colGap);
-
-    m_overflowHeight = maxColBottom;
+    int overflowRight = max(width(), currX - colGap);
+    int overflowLeft = min(0, currX + desiredColumnWidth + colGap);
+    int overflowHeight = maxColBottom;
     int toAdd = borderBottom() + paddingBottom() + horizontalScrollbarHeight();
         
     if (computeIntrinsicHeight)
-        setHeight(m_overflowHeight + toAdd);
+        setHeight(maxColBottom + toAdd);
+
+    m_overflow.clear();
+    addLayoutOverflow(IntRect(overflowLeft, 0, overflowRight - overflowLeft, overflowHeight));
 
     v->setPrintRect(IntRect());
     v->setTruncatedAt(0);
@@ -3918,7 +3809,7 @@ void RenderBlock::calcPrefWidths()
         }
 
         if (isTableCell()) {
-            Length w = static_cast<const RenderTableCell*>(this)->styleOrColWidth();
+            Length w = toRenderTableCell(this)->styleOrColWidth();
             if (w.isFixed() && w.value() > 0)
                 m_maxPrefWidth = max(m_minPrefWidth, calcContentBoxWidth(w.value()));
         }
@@ -4734,7 +4625,7 @@ static int getHeightForLineCount(RenderBlock* block, int l, bool includeBottom,
         if (block->childrenInline()) {
             for (RootInlineBox* box = block->firstRootBox(); box; box = box->nextRootBox()) {
                 if (++count == l)
-                    return box->bottomOverflow() + (includeBottom ? (block->borderBottom() + block->paddingBottom()) : 0);
+                    return box->lineBottom() + (includeBottom ? (block->borderBottom() + block->paddingBottom()) : 0);
             }
         }
         else {
@@ -5065,8 +4956,11 @@ void RenderBlock::addFocusRingRects(GraphicsContext* graphicsContext, int tx, in
         graphicsContext->addFocusRingRect(IntRect(tx, ty, width(), height()));
 
     if (!hasOverflowClip() && !hasControlClip()) {
-        for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox())
-            graphicsContext->addFocusRingRect(IntRect(tx + curr->x(), ty + curr->y(), curr->width(), curr->height()));
+        for (RootInlineBox* curr = firstRootBox(); curr; curr = curr->nextRootBox()) {
+            int top = max(curr->lineTop(), curr->y());
+            int bottom = min(curr->lineBottom(), curr->y() + curr->height());
+            graphicsContext->addFocusRingRect(IntRect(tx + curr->x(), ty + top, curr->width(), bottom - top));
+        }
 
         for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
             if (!curr->isText() && !curr->isListMarker() && curr->isBox()) {
@@ -5088,13 +4982,20 @@ void RenderBlock::addFocusRingRects(GraphicsContext* graphicsContext, int tx, in
                                                 ty - y() + inlineContinuation()->containingBlock()->y());
 }
 
-RenderBlock* RenderBlock::createAnonymousBlock() const
+RenderBlock* RenderBlock::createAnonymousBlock(bool isFlexibleBox) const
 {
     RefPtr<RenderStyle> newStyle = RenderStyle::create();
     newStyle->inheritFrom(style());
-    newStyle->setDisplay(BLOCK);
 
-    RenderBlock* newBox = new (renderArena()) RenderBlock(document() /* anonymous box */);
+    RenderBlock* newBox = 0;
+    if (isFlexibleBox) {
+        newStyle->setDisplay(BOX);
+        newBox = new (renderArena()) RenderFlexibleBox(document() /* anonymous box */);
+    } else {
+        newStyle->setDisplay(BLOCK);
+        newBox = new (renderArena()) RenderBlock(document() /* anonymous box */);
+    }
+
     newBox->setStyle(newStyle.release());
     return newBox;
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBlock.h b/src/3rdparty/webkit/WebCore/rendering/RenderBlock.h
index 871e439..7ba5fce 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBlock.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBlock.h
@@ -1,10 +1,8 @@
 /*
- * This file is part of the render object implementation for KHTML.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -52,26 +50,15 @@ public:
     RenderBlock(Node*);
     virtual ~RenderBlock();
 
-    virtual RenderObjectChildList* virtualChildren() { return children(); }
-    virtual const RenderObjectChildList* virtualChildren() const { return children(); }
     const RenderObjectChildList* children() const { return &m_children; }
     RenderObjectChildList* children() { return &m_children; }
 
     virtual void destroy();
 
-    virtual const char* renderName() const;
-
     // These two functions are overridden for inline-block.
     virtual int lineHeight(bool firstLine, bool isRootLineBox = false) const;
     virtual int baselinePosition(bool firstLine, bool isRootLineBox = false) const;
 
-    virtual bool isRenderBlock() const { return true; }
-    virtual bool isBlockFlow() const { return (!isInline() || isReplaced()) && !isTable(); }
-    virtual bool isInlineBlockOrInlineTable() const { return isInline() && isReplaced(); }
-
-    void makeChildrenNonInline(RenderObject* insertionPoint = 0);
-    virtual void removeLeftoverAnonymousBlock(RenderBlock* child);
-
     RenderLineBoxList* lineBoxes() { return &m_lineBoxes; }
     const RenderLineBoxList* lineBoxes() const { return &m_lineBoxes; }
 
@@ -79,26 +66,80 @@ public:
     InlineFlowBox* lastLineBox() const { return m_lineBoxes.lastLineBox(); }
 
     void deleteLineBoxTree();
-    virtual void dirtyLinesFromChangedChild(RenderObject* child) { m_lineBoxes.dirtyLinesFromChangedChild(this, child); }
 
-    // The height (and width) of a block when you include overflow spillage out of the bottom
-    // of the block (e.g., a <div style="height:25px"> that has a 100px tall image inside
-    // it would have an overflow height of borderTop() + paddingTop() + 100px.
-    virtual int overflowHeight(bool includeInterior = true) const;
-    virtual int overflowWidth(bool includeInterior = true) const;
-    virtual int overflowLeft(bool includeInterior = true) const;
-    virtual int overflowTop(bool includeInterior = true) const;
-    virtual IntRect overflowRect(bool includeInterior = true) const;
-    virtual void setOverflowHeight(int h) { m_overflowHeight = h; }
-    virtual void setOverflowWidth(int w) { m_overflowWidth = w; }
+    virtual void addChild(RenderObject* newChild, RenderObject* beforeChild = 0);
+    virtual void removeChild(RenderObject*);
+
+    virtual void layoutBlock(bool relayoutChildren);
 
-    void addVisualOverflow(const IntRect&);
+    void insertPositionedObject(RenderBox*);
+    void removePositionedObject(RenderBox*);
+    void removePositionedObjects(RenderBlock*);
 
-    virtual bool isSelfCollapsingBlock() const;
+    void addPercentHeightDescendant(RenderBox*);
+    static void removePercentHeightDescendant(RenderBox*);
+    HashSet<RenderBox*>* percentHeightDescendants() const;
 
-    virtual int maxTopMargin(bool positive) const { return positive ? maxTopPosMargin() : maxTopNegMargin(); }
-    virtual int maxBottomMargin(bool positive) const { return positive ? maxBottomPosMargin() : maxBottomNegMargin(); }
+    RootInlineBox* createAndAppendRootInlineBox();
 
+    bool generatesLineBoxesForInlineChild(RenderObject*, bool isLineEmpty = true, bool previousLineBrokeCleanly = true);
+
+    void markAllDescendantsWithFloatsForLayout(RenderBox* floatToRemove = 0, bool inLayout = true);
+    void markPositionedObjectsForLayout();
+
+    bool containsFloats() { return m_floatingObjects && !m_floatingObjects->isEmpty(); }
+    bool containsFloat(RenderObject*);
+
+    IntRect floatRect() const;
+
+    int lineWidth(int y, bool firstLine) const;
+    
+    virtual int lowestPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
+    virtual int rightmostPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
+    virtual int leftmostPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
+
+    int rightOffset(int y, bool firstLine) const { return rightRelOffset(y, rightOffset(), firstLine); }
+    int leftOffset(int y, bool firstLine) const { return leftRelOffset(y, leftOffset(), firstLine); }
+
+    virtual VisiblePosition positionForPoint(const IntPoint&);
+    
+    // Block flows subclass availableWidth to handle multi column layout (shrinking the width available to children when laying out.)
+    virtual int availableWidth() const;
+    
+    RootInlineBox* firstRootBox() const { return static_cast<RootInlineBox*>(firstLineBox()); }
+    RootInlineBox* lastRootBox() const { return static_cast<RootInlineBox*>(lastLineBox()); }
+
+    bool containsNonZeroBidiLevel() const;
+
+    virtual void setSelectionState(SelectionState s);
+
+    GapRects selectionGapRectsForRepaint(RenderBoxModelObject* repaintContainer);
+    IntRect fillLeftSelectionGap(RenderObject* selObj, int xPos, int yPos, int height, RenderBlock* rootBlock, 
+                                 int blockX, int blockY, int tx, int ty, const PaintInfo*);
+    IntRect fillRightSelectionGap(RenderObject* selObj, int xPos, int yPos, int height, RenderBlock* rootBlock,
+                                  int blockX, int blockY, int tx, int ty, const PaintInfo*);
+    IntRect fillHorizontalSelectionGap(RenderObject* selObj, int xPos, int yPos, int width, int height, const PaintInfo*);
+
+    void getHorizontalSelectionGapInfo(SelectionState, bool& leftGap, bool& rightGap);
+
+    // Helper methods for computing line counts and heights for line counts.
+    RootInlineBox* lineAtIndex(int);
+    int lineCount();
+    int heightForLineCount(int);
+    void clearTruncation();
+
+    void adjustRectForColumns(IntRect&) const;
+
+    void addContinuationWithOutline(RenderInline*);
+
+    RenderInline* inlineContinuation() const { return m_inlineContinuation; }
+    void setInlineContinuation(RenderInline* c) { m_inlineContinuation = c; }
+
+    // This function is a convenience helper for creating an anonymous block that inherits its
+    // style from this RenderBlock.
+    RenderBlock* createAnonymousBlock(bool isFlexibleBox = false) const;
+
+protected:
     int maxTopPosMargin() const { return m_maxMargin ? m_maxMargin->m_topPos : MaxMargin::topPosDefault(this); }
     int maxTopNegMargin() const { return m_maxMargin ? m_maxMargin->m_topNeg : MaxMargin::topNegDefault(this); }
     int maxBottomPosMargin() const { return m_maxMargin ? m_maxMargin->m_bottomPos : MaxMargin::bottomPosDefault(this); }
@@ -116,32 +157,72 @@ public:
         }
     }
 
-    virtual void addChild(RenderObject* newChild, RenderObject* beforeChild = 0);
-    virtual void removeChild(RenderObject*);
+    virtual void layout();
+
+    void layoutPositionedObjects(bool relayoutChildren);
+
+    virtual void paint(PaintInfo&, int tx, int ty);
+    virtual void paintObject(PaintInfo&, int tx, int ty);
+
+    int rightRelOffset(int y, int fixedOffset, bool applyTextIndent = true, int* heightRemaining = 0) const;
+    int leftRelOffset(int y, int fixedOffset, bool applyTextIndent = true, int* heightRemaining = 0) const;
+
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
+
+    virtual void calcPrefWidths();
+
+    virtual int firstLineBoxBaseline() const;
+    virtual int lastLineBoxBaseline() const;
+
+    virtual void updateFirstLetter();
+
+    virtual void updateHitTestResult(HitTestResult&, const IntPoint&);
+
+    // Delay update scrollbar until finishDelayRepaint() will be
+    // called. This function is used when a flexbox is laying out its
+    // descendant. If multiple calls are made to startDelayRepaint(),
+    // finishDelayRepaint() will do nothing until finishDelayRepaint()
+    // is called the same number of times.
+    static void startDelayUpdateScrollInfo();
+    static void finishDelayUpdateScrollInfo();
+
+    virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
+
+    virtual bool hasLineIfEmpty() const;
+    bool layoutOnlyPositionedObjects();
+
+private:
+    virtual RenderObjectChildList* virtualChildren() { return children(); }
+    virtual const RenderObjectChildList* virtualChildren() const { return children(); }
+
+    virtual const char* renderName() const;
+
+    virtual bool isRenderBlock() const { return true; }
+    virtual bool isBlockFlow() const { return (!isInline() || isReplaced()) && !isTable(); }
+    virtual bool isInlineBlockOrInlineTable() const { return isInline() && isReplaced(); }
+
+    void makeChildrenNonInline(RenderObject* insertionPoint = 0);
+    virtual void removeLeftoverAnonymousBlock(RenderBlock* child);
+
+    virtual void dirtyLinesFromChangedChild(RenderObject* child) { m_lineBoxes.dirtyLinesFromChangedChild(this, child); }
+
+    virtual bool isSelfCollapsingBlock() const;
+
+    virtual int maxTopMargin(bool positive) const { return positive ? maxTopPosMargin() : maxTopNegMargin(); }
+    virtual int maxBottomMargin(bool positive) const { return positive ? maxBottomPosMargin() : maxBottomNegMargin(); }
 
     virtual void repaintOverhangingFloats(bool paintAllDescendants);
 
-    virtual void layout();
-    virtual void layoutBlock(bool relayoutChildren);
     void layoutBlockChildren(bool relayoutChildren, int& maxFloatBottom);
     void layoutInlineChildren(bool relayoutChildren, int& repaintTop, int& repaintBottom);
 
-    void layoutPositionedObjects(bool relayoutChildren);
-    void insertPositionedObject(RenderBox*);
-    void removePositionedObject(RenderBox*);
-    void removePositionedObjects(RenderBlock*);
-
-    void addPercentHeightDescendant(RenderBox*);
-    static void removePercentHeightDescendant(RenderBox*);
-    HashSet<RenderBox*>* percentHeightDescendants() const;
-
     virtual void positionListMarker() { }
 
     virtual void borderFitAdjust(int& x, int& w) const; // Shrink the box in which the border paints if border-fit is set.
 
     virtual void updateBeforeAfterContent(PseudoId);
 
-    RootInlineBox* createAndAppendRootInlineBox();
     virtual RootInlineBox* createRootInlineBox(); // Subclassed by SVG and Ruby.
 
     // Called to lay out the legend for a fieldset.
@@ -169,7 +250,7 @@ public:
                                         int& yPos);
     bool matchedEndLine(const InlineBidiResolver&, const InlineIterator& endLineStart, const BidiStatus& endLineStatus,
                         RootInlineBox*& endLine, int& endYPos, int& repaintBottom, int& repaintTop);
-    bool generatesLineBoxesForInlineChild(RenderObject*, bool isLineEmpty = true, bool previousLineBrokeCleanly = true);
+
     void skipTrailingWhitespace(InlineIterator&, bool isLineEmpty, bool previousLineBrokeCleanly);
     int skipLeadingWhitespace(InlineBidiResolver&, bool firstLine, bool isLineEmpty, bool previousLineBrokeCleanly);
     void fitBelowFloats(int widthToFit, bool firstLine, int& availableWidth);
@@ -178,13 +259,14 @@ public:
     InlineFlowBox* createLineBoxes(RenderObject*, bool firstLine);
     void computeHorizontalPositionsForLine(RootInlineBox*, bool firstLine, BidiRun* firstRun, BidiRun* trailingSpaceRun, bool reachedEnd);
     void computeVerticalPositionsForLine(RootInlineBox*, BidiRun*);
-    void checkLinesForOverflow();
     void deleteEllipsisLineBoxes();
     void checkLinesForTextOverflow();
+    void addOverflowFromInlineChildren();
     // End of functions defined in RenderBlockLineLayout.cpp.
 
-    virtual void paint(PaintInfo&, int tx, int ty);
-    virtual void paintObject(PaintInfo&, int tx, int ty);
+    void addOverflowFromBlockChildren();
+    void addOverflowFromFloats();
+
     void paintFloats(PaintInfo&, int tx, int ty, bool preservePhase = false);
     void paintContents(PaintInfo&, int tx, int ty);
     void paintColumnContents(PaintInfo&, int tx, int ty, bool paintFloats = false);
@@ -202,11 +284,6 @@ public:
     bool positionNewFloats();
     void clearFloats();
     int getClearDelta(RenderBox* child, int yPos);
-    void markAllDescendantsWithFloatsForLayout(RenderBox* floatToRemove = 0, bool inLayout = true);
-    void markPositionedObjectsForLayout();
-
-    bool containsFloats() { return m_floatingObjects && !m_floatingObjects->isEmpty(); }
-    bool containsFloat(RenderObject*);
 
     virtual bool avoidsFloats() const;
 
@@ -218,49 +295,20 @@ public:
     int floatBottom() const;
     inline int leftBottom();
     inline int rightBottom();
-    IntRect floatRect() const;
-
-    int lineWidth(int y, bool firstLine) const;
-    virtual int lowestPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
-    virtual int rightmostPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
-    virtual int leftmostPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
 
     int rightOffset() const;
-    int rightRelOffset(int y, int fixedOffset, bool applyTextIndent = true, int* heightRemaining = 0) const;
-    int rightOffset(int y, bool firstLine) const { return rightRelOffset(y, rightOffset(), firstLine); }
-
     int leftOffset() const;
-    int leftRelOffset(int y, int fixedOffset, bool applyTextIndent = true, int* heightRemaining = 0) const;
-    int leftOffset(int y, bool firstLine) const { return leftRelOffset(y, leftOffset(), firstLine); }
-
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
     virtual bool hitTestColumns(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
     virtual bool hitTestContents(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
 
     virtual bool isPointInOverflowControl(HitTestResult&, int x, int y, int tx, int ty);
 
-    virtual VisiblePosition positionForPoint(const IntPoint&);
-    
-    // Block flows subclass availableWidth to handle multi column layout (shrinking the width available to children when laying out.)
-    virtual int availableWidth() const;
-    
-    virtual void calcPrefWidths();
     void calcInlinePrefWidths();
     void calcBlockPrefWidths();
 
-    virtual int firstLineBoxBaseline() const;
-    virtual int lastLineBoxBaseline() const;
-
-    RootInlineBox* firstRootBox() const { return static_cast<RootInlineBox*>(firstLineBox()); }
-    RootInlineBox* lastRootBox() const { return static_cast<RootInlineBox*>(lastLineBox()); }
-
-    bool containsNonZeroBidiLevel() const;
-
     // Obtains the nearest enclosing block (including this block) that contributes a first-line style to our inline
     // children.
     virtual RenderBlock* firstLineBlock() const;
-    virtual void updateFirstLetter();
-
     bool inRootBlockContext() const;
 
     virtual IntRect rectWithOutlineForRepaint(RenderBoxModelObject* repaintContainer, int outlineWidth);
@@ -268,17 +316,12 @@ public:
     
     virtual RenderObject* hoverAncestor() const;
     virtual void updateDragState(bool dragOn);
-    virtual void updateHitTestResult(HitTestResult&, const IntPoint&);
-    
     virtual void childBecameNonInline(RenderObject* child);
 
-    virtual void setSelectionState(SelectionState s);
-
     virtual IntRect selectionRectForRepaint(RenderBoxModelObject* repaintContainer, bool /*clipToVisibleContent*/)
     {
         return selectionGapRectsForRepaint(repaintContainer);
     }
-    GapRects selectionGapRectsForRepaint(RenderBoxModelObject* repaintContainer);
     virtual bool shouldPaintSelectionGaps() const;
     bool isSelectionRoot() const;
     GapRects fillSelectionGaps(RenderBlock* rootBlock, int blockX, int blockY, int tx, int ty,
@@ -289,71 +332,31 @@ public:
                                     int& lastTop, int& lastLeft, int& lastRight, const PaintInfo*);
     IntRect fillVerticalSelectionGap(int lastTop, int lastLeft, int lastRight, int bottomY, RenderBlock* rootBlock,
                                      int blockX, int blockY, const PaintInfo*);
-    IntRect fillLeftSelectionGap(RenderObject* selObj, int xPos, int yPos, int height, RenderBlock* rootBlock, 
-                                 int blockX, int blockY, int tx, int ty, const PaintInfo*);
-    IntRect fillRightSelectionGap(RenderObject* selObj, int xPos, int yPos, int height, RenderBlock* rootBlock,
-                                  int blockX, int blockY, int tx, int ty, const PaintInfo*);
-    IntRect fillHorizontalSelectionGap(RenderObject* selObj, int xPos, int yPos, int width, int height, const PaintInfo*);
-
-    void getHorizontalSelectionGapInfo(SelectionState, bool& leftGap, bool& rightGap);
     int leftSelectionOffset(RenderBlock* rootBlock, int y);
     int rightSelectionOffset(RenderBlock* rootBlock, int y);
 
     virtual void absoluteRects(Vector<IntRect>&, int tx, int ty);
     virtual void absoluteQuads(Vector<FloatQuad>&);
 
-    // Helper methods for computing line counts and heights for line counts.
-    RootInlineBox* lineAtIndex(int);
-    int lineCount();
-    int heightForLineCount(int);
-    void clearTruncation();
-
     int desiredColumnWidth() const;
     unsigned desiredColumnCount() const;
     Vector<IntRect>* columnRects() const;
     void setDesiredColumnCountAndWidth(int count, int width);
     int columnGap() const;
     
-    void adjustRectForColumns(IntRect&) const;
-
-    void addContinuationWithOutline(RenderInline*);
     void paintContinuationOutlines(PaintInfo&, int tx, int ty);
 
-    RenderInline* inlineContinuation() const { return m_inlineContinuation; }
-    void setInlineContinuation(RenderInline* c) { m_inlineContinuation = c; }
-
     virtual IntRect localCaretRect(InlineBox*, int caretOffset, int* extraWidthToEndOfLine = 0);
 
     virtual void addFocusRingRects(GraphicsContext*, int tx, int ty);
 
-    // This function is a convenience helper for creating an anonymous block that inherits its
-    // style from this RenderBlock.
-    RenderBlock* createAnonymousBlock() const;
-
-    // Delay update scrollbar until finishDelayRepaint() will be
-    // called.  This function is used when a flexbox is layouting its
-    // descendant.  If multiple startDelayRepaint() is called,
-    // finishDelayRepaint() will do nothing until finishDelayRepaint()
-    // is called same times.
-    static void startDelayUpdateScrollInfo();
-    static void finishDelayUpdateScrollInfo();
-
-private:
     void adjustPointToColumnContents(IntPoint&) const;
     void adjustForBorderFit(int x, int& left, int& right) const; // Helper function for borderFitAdjust
 
     void markLinesDirtyInVerticalRange(int top, int bottom);
 
-protected:
-    virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
-    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
-
     void newLine(EClear);
-    virtual bool hasLineIfEmpty() const;
-    bool layoutOnlyPositionedObjects();
 
-    
-private:
     Position positionForBox(InlineBox*, bool start = true) const;
     Position positionForRenderer(RenderObject*, bool start = true) const;
     VisiblePosition positionForPointWithInlineChildren(const IntPoint&);
@@ -368,7 +371,6 @@ private:
 
     void updateScrollInfoAfterLayout();
 
-protected:
     struct FloatingObject {
         enum Type {
             FloatLeft,
@@ -419,10 +421,6 @@ protected:
         // This flag is set when we know we're examining bottom margins and we know we're at the bottom of the block.
         bool m_atBottomOfBlock : 1;
 
-        // If our last normal flow child was a self-collapsing block that cleared a float,
-        // we track it in this variable.
-        bool m_selfCollapsingBlockClearedFloat : 1;
-
         // These variables are used to detect quirky margins that we need to collapse away (in table cells
         // and in the body element).
         bool m_topQuirk : 1;
@@ -439,7 +437,6 @@ protected:
         void setAtTopOfBlock(bool b) { m_atTopOfBlock = b; }
         void setAtBottomOfBlock(bool b) { m_atBottomOfBlock = b; }
         void clearMargin() { m_posMargin = m_negMargin = 0; }
-        void setSelfCollapsingBlockClearedFloat(bool b) { m_selfCollapsingBlockClearedFloat = b; }
         void setTopQuirk(bool b) { m_topQuirk = b; }
         void setBottomQuirk(bool b) { m_bottomQuirk = b; }
         void setDeterminedTopQuirk(bool b) { m_determinedTopQuirk = b; }
@@ -455,7 +452,6 @@ protected:
         bool canCollapseWithBottom() const { return m_atBottomOfBlock && m_canCollapseBottomWithChildren; }
         bool canCollapseTopWithChildren() const { return m_canCollapseTopWithChildren; }
         bool canCollapseBottomWithChildren() const { return m_canCollapseBottomWithChildren; }
-        bool selfCollapsingBlockClearedFloat() const { return m_selfCollapsingBlockClearedFloat; }
         bool quirkContainer() const { return m_quirkContainer; }
         bool determinedTopQuirk() const { return m_determinedTopQuirk; }
         bool topQuirk() const { return m_topQuirk; }
@@ -465,6 +461,7 @@ protected:
         int margin() const { return m_posMargin - m_negMargin; }
     };
 
+    void layoutBlockChild(RenderBox* child, MarginInfo&, int& previousFloatBottom, int& maxFloatBottom);
     void adjustPositionedBlock(RenderBox* child, const MarginInfo&);
     void adjustFloatingBlock(const MarginInfo&);
     bool handleSpecialChild(RenderBox* child, const MarginInfo&);
@@ -479,7 +476,6 @@ protected:
     void setCollapsedBottomMargin(const MarginInfo&);
     // End helper functions and structs used by layoutBlockChildren.
 
-private:
     typedef ListHashSet<RenderBox*>::const_iterator Iterator;
     DeprecatedPtrList<FloatingObject>* m_floatingObjects;
     ListHashSet<RenderBox*>* m_positionedObjects;
@@ -513,33 +509,26 @@ private:
 
     MaxMargin* m_maxMargin;
 
-protected:
     RenderObjectChildList m_children;
     RenderLineBoxList m_lineBoxes;   // All of the root line boxes created for this block flow.  For example, <div>Hello<br>world.</div> will have two total lines for the <div>.
 
-    // How much content overflows out of our block vertically or horizontally.
-    int m_overflowHeight;
-    int m_overflowWidth;
-    int m_overflowLeft;
-    int m_overflowTop;
-    
     mutable int m_lineHeight;
 };
 
-inline RenderBlock* toRenderBlock(RenderObject* o)
+inline RenderBlock* toRenderBlock(RenderObject* object)
 { 
-    ASSERT(!o || o->isRenderBlock());
-    return static_cast<RenderBlock*>(o);
+    ASSERT(!object || object->isRenderBlock());
+    return static_cast<RenderBlock*>(object);
 }
 
-inline const RenderBlock* toRenderBlock(const RenderObject* o)
+inline const RenderBlock* toRenderBlock(const RenderObject* object)
 { 
-    ASSERT(!o || o->isRenderBlock());
-    return static_cast<const RenderBlock*>(o);
+    ASSERT(!object || object->isRenderBlock());
+    return static_cast<const RenderBlock*>(object);
 }
 
 // This will catch anyone doing an unnecessary cast.
-void toRenderBlock(const RenderBlock* o);
+void toRenderBlock(const RenderBlock*);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBlockLineLayout.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderBlockLineLayout.cpp
index c243dc1..19923f1 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBlockLineLayout.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBlockLineLayout.cpp
@@ -763,11 +763,8 @@ void RenderBlock::computeHorizontalPositionsForLine(RootInlineBox* lineBox, bool
 
     // The widths of all runs are now known.  We can now place every inline box (and
     // compute accurate widths for the inline flow boxes).
-    int leftPosition = x;
-    int rightPosition = x;
     needsWordSpacing = false;
-    lineBox->placeBoxesHorizontally(x, leftPosition, rightPosition, needsWordSpacing);
-    lineBox->setHorizontalOverflowPositions(leftPosition, rightPosition);
+    lineBox->placeBoxesHorizontally(x, needsWordSpacing);
 }
 
 void RenderBlock::computeVerticalPositionsForLine(RootInlineBox* lineBox, BidiRun* firstRun)
@@ -775,11 +772,6 @@ void RenderBlock::computeVerticalPositionsForLine(RootInlineBox* lineBox, BidiRu
     setHeight(lineBox->verticallyAlignBoxes(height()));
     lineBox->setBlockHeight(height());
 
-    // See if the line spilled out.  If so set overflow height accordingly.
-    int bottomOfLine = lineBox->bottomOverflow();
-    if (bottomOfLine > height() && bottomOfLine > m_overflowHeight)
-        m_overflowHeight = bottomOfLine;
-
     // Now make sure we place replaced render objects correctly.
     for (BidiRun* r = firstRun; r; r = r->next()) {
         ASSERT(r->m_box);
@@ -824,7 +816,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
 {
     bool useRepaintBounds = false;
     
-    m_overflowHeight = 0;
+    m_overflow.clear();
         
     setHeight(borderTop() + paddingTop());
     int toAdd = borderBottom() + paddingBottom() + horizontalScrollbarHeight();
@@ -921,8 +913,8 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
             RenderArena* arena = renderArena();
             RootInlineBox* box = startLine;
             while (box) {
-                repaintTop = min(repaintTop, box->topOverflow());
-                repaintBottom = max(repaintBottom, box->bottomOverflow());
+                repaintTop = min(repaintTop, box->topVisibleOverflow());
+                repaintBottom = max(repaintBottom, box->bottomVisibleOverflow());
                 RootInlineBox* next = box->nextRootBox();
                 box->deleteLine(arena);
                 box = next;
@@ -1058,8 +1050,8 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
                 if (lineBox) {
                     lineBox->setLineBreakInfo(end.obj, end.pos, resolver.status());
                     if (useRepaintBounds) {
-                        repaintTop = min(repaintTop, lineBox->topOverflow());
-                        repaintBottom = max(repaintBottom, lineBox->bottomOverflow());
+                        repaintTop = min(repaintTop, lineBox->topVisibleOverflow());
+                        repaintBottom = max(repaintBottom, lineBox->bottomVisibleOverflow());
                     }
                 }
 
@@ -1098,8 +1090,8 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
                 for (RootInlineBox* line = endLine; line; line = line->nextRootBox()) {
                     line->attachLine();
                     if (delta) {
-                        repaintTop = min(repaintTop, line->topOverflow() + min(delta, 0));
-                        repaintBottom = max(repaintBottom, line->bottomOverflow() + max(delta, 0));
+                        repaintTop = min(repaintTop, line->topVisibleOverflow() + min(delta, 0));
+                        repaintBottom = max(repaintBottom, line->bottomVisibleOverflow() + max(delta, 0));
                         line->adjustPosition(0, delta);
                     }
                     if (Vector<RenderBox*>* cleanLineFloats = line->floatsPtr()) {
@@ -1115,12 +1107,12 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
                 setHeight(lastRootBox()->blockHeight());
             } else {
                 // Delete all the remaining lines.
-                InlineRunBox* line = endLine;
+                RootInlineBox* line = endLine;
                 RenderArena* arena = renderArena();
                 while (line) {
-                    repaintTop = min(repaintTop, line->topOverflow());
-                    repaintBottom = max(repaintBottom, line->bottomOverflow());
-                    InlineRunBox* next = line->nextLineBox();
+                    repaintTop = min(repaintTop, line->topVisibleOverflow());
+                    repaintBottom = max(repaintBottom, line->bottomVisibleOverflow());
+                    RootInlineBox* next = line->nextRootBox();
                     line->deleteLine(arena);
                     line = next;
                 }
@@ -1158,12 +1150,6 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
     // Now add in the bottom border/padding.
     setHeight(height() + toAdd);
 
-    // Always make sure this is at least our height.
-    m_overflowHeight = max(height(), m_overflowHeight);
-
-    // See if any lines spill out of the block.  If so, we need to update our overflow width.
-    checkLinesForOverflow();
-
     if (!firstLineBox() && hasLineIfEmpty())
         setHeight(height() + lineHeight(true, true));
 
@@ -1390,8 +1376,8 @@ bool RenderBlock::matchedEndLine(const InlineBidiResolver& resolver, const Inlin
             RootInlineBox* boxToDelete = endLine;
             RenderArena* arena = renderArena();
             while (boxToDelete && boxToDelete != result) {
-                repaintTop = min(repaintTop, boxToDelete->topOverflow());
-                repaintBottom = max(repaintBottom, boxToDelete->bottomOverflow());
+                repaintTop = min(repaintTop, boxToDelete->topVisibleOverflow());
+                repaintBottom = max(repaintBottom, boxToDelete->bottomVisibleOverflow());
                 RootInlineBox* next = boxToDelete->nextRootBox();
                 boxToDelete->deleteLine(arena);
                 boxToDelete = next;
@@ -1786,7 +1772,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
             
             // Optimize for a common case. If we can't find whitespace after the list
             // item, then this is all moot. -dwh
-            if (o->isListMarker() && !static_cast<RenderListMarker*>(o)->isInside()) {
+            if (o->isListMarker() && !toRenderListMarker(o)->isInside()) {
                 if (style()->collapseWhiteSpace() && shouldSkipWhitespaceAfterStartObject(this, o, lineMidpointState)) {
                     // Like with inline flows, we start ignoring spaces to make sure that any 
                     // additional spaces we see will be discarded.
@@ -2106,7 +2092,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
 
         if (!o->isFloatingOrPositioned()) {
             last = o;
-            if (last->isReplaced() && autoWrap && (!last->isImage() || allowImagesToBreak) && (!last->isListMarker() || static_cast<RenderListMarker*>(last)->isInside())) {
+            if (last->isReplaced() && autoWrap && (!last->isImage() || allowImagesToBreak) && (!last->isListMarker() || toRenderListMarker(last)->isInside())) {
                 w += tmpW;
                 tmpW = 0;
                 lBreak.obj = next;
@@ -2211,14 +2197,12 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
     return lBreak;
 }
 
-void RenderBlock::checkLinesForOverflow()
+void RenderBlock::addOverflowFromInlineChildren()
 {
-    m_overflowWidth = width();
     for (RootInlineBox* curr = firstRootBox(); curr; curr = curr->nextRootBox()) {
-        m_overflowLeft = min(curr->leftOverflow(), m_overflowLeft);
-        m_overflowTop = min(curr->topOverflow(), m_overflowTop);
-        m_overflowWidth = max(curr->rightOverflow(), m_overflowWidth);
-        m_overflowHeight = max(curr->bottomOverflow(), m_overflowHeight);
+        addLayoutOverflow(curr->layoutOverflowRect());
+        if (!hasOverflowClip())
+            addVisualOverflow(curr->visualOverflowRect());
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp
index 19a2167..8a38769 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp
@@ -410,6 +410,11 @@ bool RenderBox::scroll(ScrollDirection direction, ScrollGranularity granularity,
         return b->scroll(direction, granularity, multiplier);
     return false;
 }
+
+bool RenderBox::canBeScrolledAndHasScrollableArea() const
+{
+   return canBeProgramaticallyScrolled(false) && (scrollHeight() != clientHeight() || scrollWidth() != clientWidth());
+}
     
 bool RenderBox::canBeProgramaticallyScrolled(bool) const
 {
@@ -647,31 +652,36 @@ void RenderBox::paintMaskImages(const PaintInfo& paintInfo, int tx, int ty, int
 {
     // Figure out if we need to push a transparency layer to render our mask.
     bool pushTransparencyLayer = false;
-    StyleImage* maskBoxImage = style()->maskBoxImage().image();
-    if (maskBoxImage && style()->maskLayers()->hasImage()) {
-        pushTransparencyLayer = true;
-    } else {
-        // We have to use an extra image buffer to hold the mask. Multiple mask images need
-        // to composite together using source-over so that they can then combine into a single unified mask that
-        // can be composited with the content using destination-in.  SVG images need to be able to set compositing modes
-        // as they draw images contained inside their sub-document, so we paint all our images into a separate buffer
-        // and composite that buffer as the mask.
-        // We have to check that the mask images to be rendered contain at least one image that can be actually used in rendering
-        // before pushing the transparency layer.
-        for (const FillLayer* fillLayer = style()->maskLayers()->next(); fillLayer; fillLayer = fillLayer->next()) {
-            if (fillLayer->hasImage() && fillLayer->image()->canRender(style()->effectiveZoom())) {
-                pushTransparencyLayer = true;
-                // We found one image that can be used in rendering, exit the loop
-                break;
+    bool compositedMask = hasLayer() && layer()->hasCompositedMask();
+    CompositeOperator compositeOp = CompositeSourceOver;
+
+    if (!compositedMask) {
+        StyleImage* maskBoxImage = style()->maskBoxImage().image();
+        if (maskBoxImage && style()->maskLayers()->hasImage()) {
+            pushTransparencyLayer = true;
+        } else {
+            // We have to use an extra image buffer to hold the mask. Multiple mask images need
+            // to composite together using source-over so that they can then combine into a single unified mask that
+            // can be composited with the content using destination-in.  SVG images need to be able to set compositing modes
+            // as they draw images contained inside their sub-document, so we paint all our images into a separate buffer
+            // and composite that buffer as the mask.
+            // We have to check that the mask images to be rendered contain at least one image that can be actually used in rendering
+            // before pushing the transparency layer.
+            for (const FillLayer* fillLayer = style()->maskLayers()->next(); fillLayer; fillLayer = fillLayer->next()) {
+                if (fillLayer->hasImage() && fillLayer->image()->canRender(style()->effectiveZoom())) {
+                    pushTransparencyLayer = true;
+                    // We found one image that can be used in rendering, exit the loop
+                    break;
+                }
             }
         }
-    }
-    
-    CompositeOperator compositeOp = CompositeDestinationIn;
-    if (pushTransparencyLayer) {
-        paintInfo.context->setCompositeOperation(CompositeDestinationIn);
-        paintInfo.context->beginTransparencyLayer(1.0f);
-        compositeOp = CompositeSourceOver;
+        
+        compositeOp = CompositeDestinationIn;
+        if (pushTransparencyLayer) {
+            paintInfo.context->setCompositeOperation(CompositeDestinationIn);
+            paintInfo.context->beginTransparencyLayer(1.0f);
+            compositeOp = CompositeSourceOver;
+        }
     }
 
     paintFillLayers(paintInfo, Color(), style()->maskLayers(), tx, ty, w, h, compositeOp);
@@ -1062,7 +1072,7 @@ IntRect RenderBox::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintCo
     if (style()->visibility() != VISIBLE && !enclosingLayer()->hasVisibleContent())
         return IntRect();
 
-    IntRect r = overflowRect(false);
+    IntRect r = visibleOverflowRect();
 
     RenderView* v = view();
     if (v) {
@@ -1469,7 +1479,7 @@ int RenderBox::calcHeightUsing(const Length& h)
 int RenderBox::calcPercentageHeight(const Length& height)
 {
     int result = -1;
-    bool includeBorderPadding = isTable();
+    bool skippedAutoHeightContainingBlock = false;
     RenderBlock* cb = containingBlock();
     if (style()->htmlHacks()) {
         // In quirks mode, blocks with auto height are skipped, and we keep looking for an enclosing
@@ -1477,6 +1487,7 @@ int RenderBox::calcPercentageHeight(const Length& height)
         // specification, which states that percentage heights just revert to auto if the containing
         // block has an auto height.
         while (!cb->isRenderView() && !cb->isBody() && !cb->isTableCell() && !cb->isPositioned() && cb->style()->height().isAuto()) {
+            skippedAutoHeightContainingBlock = true;
             cb = cb->containingBlock();
             cb->addPercentHeightDescendant(this);
         }
@@ -1486,25 +1497,29 @@ int RenderBox::calcPercentageHeight(const Length& height)
     // explicitly specified that can be used for any percentage computations.
     bool isPositionedWithSpecifiedHeight = cb->isPositioned() && (!cb->style()->height().isAuto() || (!cb->style()->top().isAuto() && !cb->style()->bottom().isAuto()));
 
+    bool includeBorderPadding = isTable();
+
     // Table cells violate what the CSS spec says to do with heights.  Basically we
     // don't care if the cell specified a height or not.  We just always make ourselves
     // be a percentage of the cell's current content height.
     if (cb->isTableCell()) {
-        result = cb->overrideSize();
-        if (result == -1) {
-            // Normally we would let the cell size intrinsically, but scrolling overflow has to be
-            // treated differently, since WinIE lets scrolled overflow regions shrink as needed.
-            // While we can't get all cases right, we can at least detect when the cell has a specified
-            // height or when the table has a specified height.  In these cases we want to initially have
-            // no size and allow the flexing of the table or the cell to its specified height to cause us
-            // to grow to fill the space.  This could end up being wrong in some cases, but it is
-            // preferable to the alternative (sizing intrinsically and making the row end up too big).
-            RenderTableCell* cell = static_cast<RenderTableCell*>(cb);
-            if (scrollsOverflowY() && (!cell->style()->height().isAuto() || !cell->table()->style()->height().isAuto()))
-                return 0;
-            return -1;
+        if (!skippedAutoHeightContainingBlock) {
+            result = cb->overrideSize();
+            if (result == -1) {
+                // Normally we would let the cell size intrinsically, but scrolling overflow has to be
+                // treated differently, since WinIE lets scrolled overflow regions shrink as needed.
+                // While we can't get all cases right, we can at least detect when the cell has a specified
+                // height or when the table has a specified height.  In these cases we want to initially have
+                // no size and allow the flexing of the table or the cell to its specified height to cause us
+                // to grow to fill the space.  This could end up being wrong in some cases, but it is
+                // preferable to the alternative (sizing intrinsically and making the row end up too big).
+                RenderTableCell* cell = toRenderTableCell(cb);
+                if (scrollsOverflowY() && (!cell->style()->height().isAuto() || !cell->table()->style()->height().isAuto()))
+                    return 0;
+                return -1;
+            }
+            includeBorderPadding = true;
         }
-        includeBorderPadding = true;
     }
     // Otherwise we only use our percentage height if our containing block had a specified
     // height.
@@ -2595,9 +2610,9 @@ IntRect RenderBox::localCaretRect(InlineBox* box, int caretOffset, int* extraWid
 
     if (box) {
         RootInlineBox* rootBox = box->root();
-        int top = rootBox->topOverflow();
+        int top = rootBox->lineTop();
         rect.setY(top);
-        rect.setHeight(rootBox->bottomOverflow() - top);
+        rect.setHeight(rootBox->lineBottom() - top);
     }
 
     // If height of box is smaller than font height, use the latter one,
@@ -2650,11 +2665,6 @@ int RenderBox::leftmostPosition(bool /*includeOverflowInterior*/, bool includeSe
     return left;
 }
 
-bool RenderBox::isAfterContent(RenderObject* child) const
-{
-    return (child && child->style()->styleType() == AFTER && (!child->isText() || child->isBR()));
-}
-
 VisiblePosition RenderBox::positionForPoint(const IntPoint& point)
 {
     // no children...return this render object's element, if there is one, and offset 0
@@ -2762,6 +2772,81 @@ bool RenderBox::avoidsFloats() const
     return isReplaced() || hasOverflowClip() || isHR();
 }
 
+void RenderBox::addShadowOverflow()
+{
+    int shadowLeft;
+    int shadowRight;
+    int shadowTop;
+    int shadowBottom;
+    style()->getBoxShadowExtent(shadowTop, shadowRight, shadowBottom, shadowLeft);
+    IntRect borderBox = borderBoxRect();
+    int overflowLeft = borderBox.x() + shadowLeft;
+    int overflowRight = borderBox.right() + shadowRight;
+    int overflowTop = borderBox.y() + shadowTop;
+    int overflowBottom = borderBox.bottom() + shadowBottom;
+    addVisualOverflow(IntRect(overflowLeft, overflowTop, overflowRight - overflowLeft, overflowBottom - overflowTop));
+}
+
+void RenderBox::addOverflowFromChild(RenderBox* child, const IntSize& delta)
+{
+    // Update our overflow in case the child spills out the block, but only if we were going to paint
+    // the child block ourselves.
+    if (child->hasSelfPaintingLayer())
+        return;
+
+    // Only propagate layout overflow from the child if the child isn't clipping its overflow.  If it is, then
+    // its overflow is internal to it, and we don't care about it.
+    IntRect childLayoutOverflowRect = child->hasOverflowClip() ? child->borderBoxRect() : child->layoutOverflowRect();
+    childLayoutOverflowRect.move(delta);
+    addLayoutOverflow(childLayoutOverflowRect);
+            
+    // Add in visual overflow from the child.  Even if the child clips its overflow, it may still
+    // have visual overflow of its own set from box shadows or reflections.  It is unnecessary to propagate this
+    // overflow if we are clipping our own overflow.
+    if (hasOverflowClip())
+        return;
+    IntRect childVisualOverflowRect = child->visualOverflowRect();
+    childVisualOverflowRect.move(delta);
+    addVisualOverflow(childVisualOverflowRect);
+}
+
+void RenderBox::addLayoutOverflow(const IntRect& rect)
+{
+    IntRect borderBox = borderBoxRect();
+    if (borderBox.contains(rect))
+        return;
+        
+    if (!m_overflow)
+        m_overflow.set(new RenderOverflow(borderBox));
+    
+    m_overflow->addLayoutOverflow(rect);
+}
+
+void RenderBox::addVisualOverflow(const IntRect& rect)
+{
+    IntRect borderBox = borderBoxRect();
+    if (borderBox.contains(rect))
+        return;
+        
+    if (!m_overflow)
+        m_overflow.set(new RenderOverflow(borderBox));
+    
+    m_overflow->addVisualOverflow(rect);
+}
+
+void RenderBox::clearLayoutOverflow()
+{
+    if (!m_overflow)
+        return;
+    
+    if (visualOverflowRect() == borderBoxRect()) {
+        m_overflow.clear();
+        return;
+    }
+    
+    m_overflow->resetLayoutOverflow(borderBoxRect());
+}
+
 #if ENABLE(SVG)
 
 TransformationMatrix RenderBox::localTransform() const
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBox.h b/src/3rdparty/webkit/WebCore/rendering/RenderBox.h
index 95c0637..b493ae9 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBox.h
@@ -24,6 +24,7 @@
 #define RenderBox_h
 
 #include "RenderBoxModelObject.h"
+#include "RenderOverflow.h"
 #include "ScrollTypes.h"
 
 namespace WebCore {
@@ -80,16 +81,31 @@ public:
     RenderBox* nextSiblingBox() const;
     RenderBox* parentBox() const;
 
-    // The height of a block when you include normal flow overflow spillage out of the bottom
-    // of the block (e.g., a <div style="height:25px"> that has a 100px tall image inside
-    // it would have an overflow height of borderTop() + paddingTop() + 100px.
-    virtual int overflowHeight(bool /*includeInterior*/ = true) const { return height(); }
-    virtual int overflowWidth(bool /*includeInterior*/ = true) const { return width(); }
-    virtual void setOverflowHeight(int) { }
-    virtual void setOverflowWidth(int) { }
-    virtual int overflowLeft(bool /*includeInterior*/ = true) const { return 0; }
-    virtual int overflowTop(bool /*includeInterior*/ = true) const { return 0; }
-    virtual IntRect overflowRect(bool /*includeInterior*/ = true) const { return borderBoxRect(); }
+    IntRect visibleOverflowRect() const { return hasOverflowClip() ? visualOverflowRect() : (m_overflow ? m_overflow->visibleOverflowRect() : borderBoxRect()); }
+    int topVisibleOverflow() const { return hasOverflowClip() ? topVisualOverflow() : std::min(topLayoutOverflow(), topVisualOverflow()); }
+    int bottomVisibleOverflow() const { return hasOverflowClip() ? bottomVisualOverflow() : std::max(bottomLayoutOverflow(), bottomVisualOverflow()); }
+    int leftVisibleOverflow() const { return hasOverflowClip() ? leftVisualOverflow() : std::min(leftLayoutOverflow(), leftVisualOverflow()); }
+    int rightVisibleOverflow() const { return hasOverflowClip() ? rightVisualOverflow() :  std::max(rightLayoutOverflow(), rightVisualOverflow()); }
+    
+    IntRect layoutOverflowRect() const { return m_overflow ? m_overflow->layoutOverflowRect() : borderBoxRect(); }
+    int topLayoutOverflow() const { return m_overflow? m_overflow->topLayoutOverflow() : 0; }
+    int bottomLayoutOverflow() const { return m_overflow ? m_overflow->bottomLayoutOverflow() : height(); }
+    int leftLayoutOverflow() const { return m_overflow ? m_overflow->leftLayoutOverflow() : 0; }
+    int rightLayoutOverflow() const { return m_overflow ? m_overflow->rightLayoutOverflow() : width(); }
+    
+    IntRect visualOverflowRect() const { return m_overflow ? m_overflow->visualOverflowRect() : borderBoxRect(); }
+    int topVisualOverflow() const { return m_overflow? m_overflow->topVisualOverflow() : 0; }
+    int bottomVisualOverflow() const { return m_overflow ? m_overflow->bottomVisualOverflow() : height(); }
+    int leftVisualOverflow() const { return m_overflow ? m_overflow->leftVisualOverflow() : 0; }
+    int rightVisualOverflow() const { return m_overflow ? m_overflow->rightVisualOverflow() : width(); }
+
+    void addLayoutOverflow(const IntRect&);
+    void addVisualOverflow(const IntRect&);
+    
+    void addShadowOverflow();
+    void addOverflowFromChild(RenderBox* child) { addOverflowFromChild(child, IntSize(child->x(), child->y())); }
+    void addOverflowFromChild(RenderBox* child, const IntSize& delta);
+    void clearLayoutOverflow();
 
     int contentWidth() const { return clientWidth() - paddingLeft() - paddingRight(); }
     int contentHeight() const { return clientHeight() - paddingTop() - paddingBottom(); }
@@ -230,6 +246,7 @@ public:
     virtual int verticalScrollbarWidth() const;
     int horizontalScrollbarHeight() const;
     virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1.0f);
+    bool canBeScrolledAndHasScrollableArea() const;
     virtual bool canBeProgramaticallyScrolled(bool) const;
     virtual void autoscroll();
     virtual void stopAutoscroll() { }
@@ -251,7 +268,7 @@ public:
 
     virtual void paintObject(PaintInfo&, int /*tx*/, int /*ty*/) { ASSERT_NOT_REACHED(); }
     virtual void paintBoxDecorations(PaintInfo&, int tx, int ty);
-    virtual void paintMask(PaintInfo& paintInfo, int tx, int ty);
+    virtual void paintMask(PaintInfo&, int tx, int ty);
     virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
 
     // Called when a positioned object moves but doesn't change size.  A simplified layout is done
@@ -333,9 +350,6 @@ private:
     // These include tables, positioned objects, floats and flexible boxes.
     virtual void calcPrefWidths() { setPrefWidthsDirty(false); }
 
-protected:
-    bool isAfterContent(RenderObject* child) const;
-
 private:
     // The width/height of the contents + borders + padding.  The x/y location is relative to our container (which is not always our parent).
     IntRect m_frameRect;
@@ -355,21 +369,24 @@ protected:
     // For inline replaced elements, the inline box that owns us.
     InlineBox* m_inlineBoxWrapper;
 
+    // Our overflow information.
+    OwnPtr<RenderOverflow> m_overflow;
+
 private:
     // Used to store state between styleWillChange and styleDidChange
     static bool s_hadOverflowClip;
 };
 
-inline RenderBox* toRenderBox(RenderObject* o)
+inline RenderBox* toRenderBox(RenderObject* object)
 { 
-    ASSERT(!o || o->isBox());
-    return static_cast<RenderBox*>(o);
+    ASSERT(!object || object->isBox());
+    return static_cast<RenderBox*>(object);
 }
 
-inline const RenderBox* toRenderBox(const RenderObject* o)
+inline const RenderBox* toRenderBox(const RenderObject* object)
 { 
-    ASSERT(!o || o->isBox());
-    return static_cast<const RenderBox*>(o);
+    ASSERT(!object || object->isBox());
+    return static_cast<const RenderBox*>(object);
 }
 
 // This will catch anyone doing an unnecessary cast.
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.cpp
index c224625..23dad2d 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.cpp
@@ -316,10 +316,14 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
 
     bool clippedToBorderRadius = false;
     if (style()->hasBorderRadius() && (includeLeftEdge || includeRightEdge)) {
+        IntRect borderRect(tx, ty, w, h);
+
+        if (borderRect.isEmpty())
+            return;
+
         context->save();
 
         IntSize topLeft, topRight, bottomLeft, bottomRight;
-        IntRect borderRect(tx, ty, w, h);
         style()->getBorderRadiiForRect(borderRect, topLeft, topRight, bottomLeft, bottomRight);
 
         context->addRoundedRectClip(borderRect, includeLeftEdge ? topLeft : IntSize(),
@@ -358,7 +362,7 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
         maskRect.intersect(paintInfo.rect);
         
         // Now create the mask.
-        OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(maskRect.size(), false);
+        OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(maskRect.size());
         if (!maskImage)
             return;
         
@@ -489,153 +493,130 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
         context->restore();
 }
 
-IntSize RenderBoxModelObject::calculateBackgroundSize(const FillLayer* bgLayer, int scaledWidth, int scaledHeight) const
+IntSize RenderBoxModelObject::calculateFillTileSize(const FillLayer* fillLayer, IntSize positioningAreaSize) const
 {
-    StyleImage* bg = bgLayer->image();
-    bg->setImageContainerSize(IntSize(scaledWidth, scaledHeight)); // Use the box established by background-origin.
-
-    if (bgLayer->isSizeSet()) {
-        int w = scaledWidth;
-        int h = scaledHeight;
-        Length bgWidth = bgLayer->size().width();
-        Length bgHeight = bgLayer->size().height();
-
-        if (bgWidth.isFixed())
-            w = bgWidth.value();
-        else if (bgWidth.isPercent())
-            w = bgWidth.calcValue(scaledWidth);
-        
-        if (bgHeight.isFixed())
-            h = bgHeight.value();
-        else if (bgHeight.isPercent())
-            h = bgHeight.calcValue(scaledHeight);
-        
-        // If one of the values is auto we have to use the appropriate
-        // scale to maintain our aspect ratio.
-        if (bgWidth.isAuto() && !bgHeight.isAuto())
-            w = bg->imageSize(this, style()->effectiveZoom()).width() * h / bg->imageSize(this, style()->effectiveZoom()).height();        
-        else if (!bgWidth.isAuto() && bgHeight.isAuto())
-            h = bg->imageSize(this, style()->effectiveZoom()).height() * w / bg->imageSize(this, style()->effectiveZoom()).width();
-        else if (bgWidth.isAuto() && bgHeight.isAuto()) {
-            // If both width and height are auto, we just want to use the image's
-            // intrinsic size.
-            w = bg->imageSize(this, style()->effectiveZoom()).width();
-            h = bg->imageSize(this, style()->effectiveZoom()).height();
+    StyleImage* image = fillLayer->image();
+    image->setImageContainerSize(positioningAreaSize); // Use the box established by background-origin.
+
+    EFillSizeType type = fillLayer->size().type;
+
+    switch (type) {
+        case SizeLength: {
+            int w = positioningAreaSize.width();
+            int h = positioningAreaSize.height();
+            Length layerWidth = fillLayer->size().size.width();
+            Length layerHeight = fillLayer->size().size.height();
+
+            if (layerWidth.isFixed())
+                w = layerWidth.value();
+            else if (layerWidth.isPercent())
+                w = layerWidth.calcValue(positioningAreaSize.width());
+            
+            if (layerHeight.isFixed())
+                h = layerHeight.value();
+            else if (layerHeight.isPercent())
+                h = layerHeight.calcValue(positioningAreaSize.height());
+            
+            // If one of the values is auto we have to use the appropriate
+            // scale to maintain our aspect ratio.
+            if (layerWidth.isAuto() && !layerHeight.isAuto())
+                w = image->imageSize(this, style()->effectiveZoom()).width() * h / image->imageSize(this, style()->effectiveZoom()).height();        
+            else if (!layerWidth.isAuto() && layerHeight.isAuto())
+                h = image->imageSize(this, style()->effectiveZoom()).height() * w / image->imageSize(this, style()->effectiveZoom()).width();
+            else if (layerWidth.isAuto() && layerHeight.isAuto()) {
+                // If both width and height are auto, we just want to use the image's
+                // intrinsic size.
+                w = image->imageSize(this, style()->effectiveZoom()).width();
+                h = image->imageSize(this, style()->effectiveZoom()).height();
+            }
+            
+            return IntSize(max(1, w), max(1, h));
         }
-        
-        return IntSize(max(1, w), max(1, h));
-    } else
-        return bg->imageSize(this, style()->effectiveZoom());
+        case Contain:
+        case Cover: {
+            IntSize imageIntrinsicSize = image->imageSize(this, 1);
+            float horizontalScaleFactor = static_cast<float>(positioningAreaSize.width()) / imageIntrinsicSize.width();
+            float verticalScaleFactor = static_cast<float>(positioningAreaSize.height()) / imageIntrinsicSize.height();
+            float scaleFactor = type == Contain ? min(horizontalScaleFactor, verticalScaleFactor) : max(horizontalScaleFactor, verticalScaleFactor);
+
+            return IntSize(max<int>(1, imageIntrinsicSize.width() * scaleFactor), max<int>(1, imageIntrinsicSize.height() * scaleFactor));
+        }
+        case SizeNone:
+            break;
+    }
+    return image->imageSize(this, style()->effectiveZoom());
 }
 
-void RenderBoxModelObject::calculateBackgroundImageGeometry(const FillLayer* bgLayer, int tx, int ty, int w, int h, 
+void RenderBoxModelObject::calculateBackgroundImageGeometry(const FillLayer* fillLayer, int tx, int ty, int w, int h, 
                                                             IntRect& destRect, IntPoint& phase, IntSize& tileSize)
 {
-    int pw;
-    int ph;
     int left = 0;
-    int right = 0;
     int top = 0;
-    int bottom = 0;
-    int cx;
-    int cy;
-    int rw = 0;
-    int rh = 0;
-
-    // CSS2 chapter 14.2.1
-    bool fixedAttachment = bgLayer->attachment() == FixedBackgroundAttachment;
+    IntSize positioningAreaSize;
+
+    // Determine the background positioning area and set destRect to the background painting area.
+    // destRect will be adjusted later if the background is non-repeating.
+    bool fixedAttachment = fillLayer->attachment() == FixedBackgroundAttachment;
     if (!fixedAttachment) {
-        // Scroll and Local
-        if (bgLayer->origin() != BorderFillBox) {
+        destRect = IntRect(tx, ty, w, h);
+
+        int right = 0;
+        int bottom = 0;
+        // Scroll and Local.
+        if (fillLayer->origin() != BorderFillBox) {
             left = borderLeft();
             right = borderRight();
             top = borderTop();
             bottom = borderBottom();
-            if (bgLayer->origin() == ContentFillBox) {
+            if (fillLayer->origin() == ContentFillBox) {
                 left += paddingLeft();
                 right += paddingRight();
                 top += paddingTop();
                 bottom += paddingBottom();
             }
         }
-        
+
         // The background of the box generated by the root element covers the entire canvas including
-        // its margins.  Since those were added in already, we have to factor them out when computing the
-        // box used by background-origin/size/position.
+        // its margins. Since those were added in already, we have to factor them out when computing
+        // the background positioning area.
         if (isRoot()) {
-            rw = toRenderBox(this)->width() - left - right;
-            rh = toRenderBox(this)->height() - top - bottom; 
+            positioningAreaSize = IntSize(toRenderBox(this)->width() - left - right, toRenderBox(this)->height() - top - bottom);
             left += marginLeft();
-            right += marginRight();
             top += marginTop();
-            bottom += marginBottom();
-        }
-        cx = tx;
-        cy = ty;
-        pw = w - left - right;
-        ph = h - top - bottom;
+        } else
+            positioningAreaSize = IntSize(w - left - right, h - top - bottom);
     } else {
-        // Fixed background attachment.
-        IntRect vr = viewRect();
-        cx = vr.x();
-        cy = vr.y();
-        pw = vr.width();
-        ph = vr.height();
+        destRect = viewRect();
+        positioningAreaSize = destRect.size();
     }
 
-    int sx = 0;
-    int sy = 0;
-    int cw;
-    int ch;
+    tileSize = calculateFillTileSize(fillLayer, positioningAreaSize);
 
-    IntSize scaledImageSize;
-    if (isRoot() && !fixedAttachment)
-        scaledImageSize = calculateBackgroundSize(bgLayer, rw, rh);
-    else
-        scaledImageSize = calculateBackgroundSize(bgLayer, pw, ph);
-        
-    int scaledImageWidth = scaledImageSize.width();
-    int scaledImageHeight = scaledImageSize.height();
+    EFillRepeat backgroundRepeatX = fillLayer->repeatX();
+    EFillRepeat backgroundRepeatY = fillLayer->repeatY();
 
-    EFillRepeat backgroundRepeat = bgLayer->repeat();
-    
-    int xPosition;
-    if (isRoot() && !fixedAttachment)
-        xPosition = bgLayer->xPosition().calcMinValue(rw - scaledImageWidth, true);
-    else
-        xPosition = bgLayer->xPosition().calcMinValue(pw - scaledImageWidth, true);
-    if (backgroundRepeat == RepeatFill || backgroundRepeat == RepeatXFill) {
-        cw = pw + left + right;
-        sx = scaledImageWidth ? scaledImageWidth - (xPosition + left) % scaledImageWidth : 0;
-    } else {
-        cx += max(xPosition + left, 0);
-        sx = -min(xPosition + left, 0);
-        cw = scaledImageWidth + min(xPosition + left, 0);
-    }
-    
-    int yPosition;
-    if (isRoot() && !fixedAttachment)
-        yPosition = bgLayer->yPosition().calcMinValue(rh - scaledImageHeight, true);
-    else 
-        yPosition = bgLayer->yPosition().calcMinValue(ph - scaledImageHeight, true);
-    if (backgroundRepeat == RepeatFill || backgroundRepeat == RepeatYFill) {
-        ch = ph + top + bottom;
-        sy = scaledImageHeight ? scaledImageHeight - (yPosition + top) % scaledImageHeight : 0;
-    } else {
-        cy += max(yPosition + top, 0);
-        sy = -min(yPosition + top, 0);
-        ch = scaledImageHeight + min(yPosition + top, 0);
+    int xPosition = fillLayer->xPosition().calcMinValue(positioningAreaSize.width() - tileSize.width(), true);
+    if (backgroundRepeatX == RepeatFill)
+        phase.setX(tileSize.width() ? tileSize.width() - (xPosition + left) % tileSize.width() : 0);
+    else {
+        destRect.move(max(xPosition + left, 0), 0);
+        phase.setX(-min(xPosition + left, 0));
+        destRect.setWidth(tileSize.width() + min(xPosition + left, 0));
     }
 
-    if (fixedAttachment) {
-        sx += max(tx - cx, 0);
-        sy += max(ty - cy, 0);
+    int yPosition = fillLayer->yPosition().calcMinValue(positioningAreaSize.height() - tileSize.height(), true);
+    if (backgroundRepeatY == RepeatFill)
+        phase.setY(tileSize.height() ? tileSize.height() - (yPosition + top) % tileSize.height() : 0);
+    else {
+        destRect.move(0, max(yPosition + top, 0));
+        phase.setY(-min(yPosition + top, 0));
+        destRect.setHeight(tileSize.height() + min(yPosition + top, 0));
     }
 
-    destRect = IntRect(cx, cy, cw, ch);
+    if (fixedAttachment)
+        phase.move(max(tx - destRect.x(), 0), max(ty - destRect.y(), 0));
+
     destRect.intersect(IntRect(tx, ty, w, h));
-    phase = IntPoint(sx, sy);
-    tileSize = IntSize(scaledImageWidth, scaledImageHeight);
 }
 
 int RenderBoxModelObject::verticalPosition(bool firstLine) const
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.h b/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.h
index c674778..c9a4a0a 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.h
@@ -100,10 +100,12 @@ public:
 
 protected:
     void calculateBackgroundImageGeometry(const FillLayer*, int tx, int ty, int w, int h, IntRect& destRect, IntPoint& phase, IntSize& tileSize);
-    IntSize calculateBackgroundSize(const FillLayer*, int scaledWidth, int scaledHeight) const;
 
 private:
     virtual bool isBoxModelObject() const { return true; }
+
+    IntSize calculateFillTileSize(const FillLayer*, IntSize scaledSize) const;
+
     friend class RenderView;
 
     RenderLayer* m_layer;
@@ -114,16 +116,16 @@ private:
     static bool s_layerWasSelfPainting;
 };
 
-inline RenderBoxModelObject* toRenderBoxModelObject(RenderObject* o)
+inline RenderBoxModelObject* toRenderBoxModelObject(RenderObject* object)
 { 
-    ASSERT(!o || o->isBoxModelObject());
-    return static_cast<RenderBoxModelObject*>(o);
+    ASSERT(!object || object->isBoxModelObject());
+    return static_cast<RenderBoxModelObject*>(object);
 }
 
-inline const RenderBoxModelObject* toRenderBoxModelObject(const RenderObject* o)
+inline const RenderBoxModelObject* toRenderBoxModelObject(const RenderObject* object)
 { 
-    ASSERT(!o || o->isBoxModelObject());
-    return static_cast<const RenderBoxModelObject*>(o);
+    ASSERT(!object || object->isBoxModelObject());
+    return static_cast<const RenderBoxModelObject*>(object);
 }
 
 // This will catch anyone doing an unnecessary cast.
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderButton.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderButton.cpp
index 6d36a0f..f3ae558 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderButton.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderButton.cpp
@@ -52,7 +52,8 @@ void RenderButton::addChild(RenderObject* newChild, RenderObject* beforeChild)
     if (!m_inner) {
         // Create an anonymous block.
         ASSERT(!firstChild());
-        m_inner = createAnonymousBlock();
+        bool isFlexibleBox = style()->display() == BOX || style()->display() == INLINE_BOX;
+        m_inner = createAnonymousBlock(isFlexibleBox);
         setupInnerStyle(m_inner->style());
         RenderFlexibleBox::addChild(m_inner);
     }
@@ -108,6 +109,7 @@ void RenderButton::setupInnerStyle(RenderStyle* innerStyle)
     // RenderBlock::createAnonymousBlock creates a new RenderStyle, so this is
     // safe to modify.
     innerStyle->setBoxFlex(1.0f);
+    innerStyle->setBoxOrient(style()->boxOrient());
 
     innerStyle->setPaddingTop(Length(theme()->buttonInternalPaddingTop(), Fixed));
     innerStyle->setPaddingRight(Length(theme()->buttonInternalPaddingRight(), Fixed));
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderButton.h b/src/3rdparty/webkit/WebCore/rendering/RenderButton.h
index 3b4ff3f..3a74589 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderButton.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderButton.h
@@ -74,16 +74,16 @@ protected:
     bool m_default;
 };
 
-inline RenderButton* toRenderButton(RenderObject* o)
+inline RenderButton* toRenderButton(RenderObject* object)
 { 
-    ASSERT(!o || o->isRenderButton());
-    return static_cast<RenderButton*>(o);
+    ASSERT(!object || object->isRenderButton());
+    return static_cast<RenderButton*>(object);
 }
 
-inline const RenderButton* toRenderButton(const RenderObject* o)
+inline const RenderButton* toRenderButton(const RenderObject* object)
 { 
-    ASSERT(!o || o->isRenderButton());
-    return static_cast<const RenderButton*>(o);
+    ASSERT(!object || object->isRenderButton());
+    return static_cast<const RenderButton*>(object);
 }
 
 // This will catch anyone doing an unnecessary cast.
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderCounter.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderCounter.cpp
index fd6d80d..67e5cba 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderCounter.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderCounter.cpp
@@ -107,8 +107,8 @@ static bool planCounter(RenderObject* object, const AtomicString& counterName, b
 
     if (counterName == "list-item") {
         if (object->isListItem()) {
-            if (static_cast<RenderListItem*>(object)->hasExplicitValue()) {
-                value = static_cast<RenderListItem*>(object)->explicitValue();
+            if (toRenderListItem(object)->hasExplicitValue()) {
+                value = toRenderListItem(object)->explicitValue();
                 isReset = true;
                 return true;
             }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderCounter.h b/src/3rdparty/webkit/WebCore/rendering/RenderCounter.h
index 55aab73..961968e 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderCounter.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderCounter.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2004 Allan Sandfeld Jensen (kde@carewolf.com)
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -33,21 +33,30 @@ class RenderCounter : public RenderText {
 public:
     RenderCounter(Document*, const CounterContent&);
 
+    void invalidate();
+
+    static void destroyCounterNodes(RenderObject*);
+
+private:
     virtual const char* renderName() const;
     virtual bool isCounter() const;
     virtual PassRefPtr<StringImpl> originalText() const;
     
     virtual void calcPrefWidths(int leadWidth);
 
-    void invalidate();
-
-    static void destroyCounterNodes(RenderObject*);
-
-private:
     CounterContent m_counter;
     mutable CounterNode* m_counterNode;
 };
 
+inline RenderCounter* toRenderCounter(RenderObject* object)
+{
+    ASSERT(!object || object->isCounter());
+    return static_cast<RenderCounter*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderCounter(const RenderCounter*);
+
 } // namespace WebCore
 
 #endif // RenderCounter_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderFieldset.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderFieldset.cpp
index 437991a..8618d11 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderFieldset.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderFieldset.cpp
@@ -108,10 +108,11 @@ RenderBox* RenderFieldset::findLegend() const
 {
     for (RenderObject* legend = firstChild(); legend; legend = legend->nextSibling()) {
         if (!legend->isFloatingOrPositioned() && legend->node() &&
-            legend->node()->hasTagName(legendTag)
+            (legend->node()->hasTagName(legendTag)
 #if ENABLE(WML)
             || legend->node()->hasTagName(WMLNames::insertedLegendTag)
 #endif
+            )
            )
             return toRenderBox(legend);
     }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderFieldset.h b/src/3rdparty/webkit/WebCore/rendering/RenderFieldset.h
index ed57d3a..df6a1da 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderFieldset.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderFieldset.h
@@ -1,10 +1,8 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2006 Apple Computer, Inc.
+ * Copyright (C) 2004, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -34,6 +32,9 @@ class RenderFieldset : public RenderBlock {
 public:
     RenderFieldset(Node*);
 
+    RenderBox* findLegend() const;
+
+private:
     virtual const char* renderName() const { return "RenderFieldSet"; }
     virtual bool isFieldset() const { return true; }
 
@@ -43,17 +44,23 @@ public:
     virtual bool avoidsFloats() const { return true; }
     virtual bool stretchesToMinIntrinsicWidth() const { return true; }
 
-    RenderBox* findLegend() const;
-
-protected:
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
-private:
     virtual void paintBoxDecorations(PaintInfo&, int tx, int ty);
-    virtual void paintMask(PaintInfo& paintInfo, int tx, int ty);
+    virtual void paintMask(PaintInfo&, int tx, int ty);
+
     void paintBorderMinusLegend(GraphicsContext*, int tx, int ty, int w, int h, const RenderStyle*, int lx, int lw, int lb);
 };
 
+inline RenderFieldset* toRenderFieldset(RenderObject* object)
+{
+    ASSERT(!object || object->isFieldset());
+    return static_cast<RenderFieldset*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderFieldset(const RenderFieldset*);
+
 } // namespace WebCore
 
 #endif // RenderFieldset_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderFileUploadControl.h b/src/3rdparty/webkit/WebCore/rendering/RenderFileUploadControl.h
index 85bc09f..bd7d62a 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderFileUploadControl.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderFileUploadControl.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -35,13 +35,7 @@ class HTMLInputElement;
 class RenderFileUploadControl : public RenderBlock, private FileChooserClient {
 public:
     RenderFileUploadControl(HTMLInputElement*);
-    ~RenderFileUploadControl();
-
-    virtual const char* renderName() const { return "RenderFileUploadControl"; }
-
-    virtual void updateFromElement();
-    virtual void calcPrefWidths();
-    virtual void paintObject(PaintInfo&, int tx, int ty);
+    virtual ~RenderFileUploadControl();
 
     void click();
 
@@ -54,10 +48,15 @@ public:
     
     bool allowsMultipleFiles();
 
-protected:
+private:
+    virtual const char* renderName() const { return "RenderFileUploadControl"; }
+
+    virtual void updateFromElement();
+    virtual void calcPrefWidths();
+    virtual void paintObject(PaintInfo&, int tx, int ty);
+
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
-private:
     int maxFilenameWidth() const;
     PassRefPtr<RenderStyle> createButtonStyle(const RenderStyle* parentStyle) const;
 
@@ -65,6 +64,15 @@ private:
     RefPtr<FileChooser> m_fileChooser;
 };
 
+inline RenderFileUploadControl* toRenderFileUploadControl(RenderObject* object)
+{
+    ASSERT(!object || !strcmp(object->renderName(), "RenderFileUploadControl"));
+    return static_cast<RenderFileUploadControl*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderFileUploadControl(const RenderFileUploadControl*);
+
 } // namespace WebCore
 
 #endif // RenderFileUploadControl_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderFlexibleBox.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderFlexibleBox.cpp
index e9fc7aa..63c72fd 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderFlexibleBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderFlexibleBox.cpp
@@ -216,7 +216,8 @@ void RenderFlexibleBox::layoutBlock(bool relayoutChildren)
     
     calcWidth();
     calcHeight();
-    m_overflowWidth = width();
+    
+    m_overflow.clear();
 
     if (previousWidth != width() || previousHeight != height() ||
         (parent()->isFlexibleBox() && parent()->style()->boxOrient() == HORIZONTAL &&
@@ -224,7 +225,7 @@ void RenderFlexibleBox::layoutBlock(bool relayoutChildren)
         relayoutChildren = true;
 
     setHeight(0);
-    m_overflowHeight = 0;
+
     m_flexingChildren = m_stretchingChildren = false;
 
     initMaxMarginValues();
@@ -242,15 +243,8 @@ void RenderFlexibleBox::layoutBlock(bool relayoutChildren)
     else
         layoutVerticalBox(relayoutChildren);
 
-    int oldHeight = height();
     calcHeight();
-    if (oldHeight != height()) {
-        // If the block got expanded in size, then increase our overflowheight to match.
-        if (m_overflowHeight > height())
-            m_overflowHeight -= (borderBottom() + paddingBottom() + horizontalScrollbarHeight());
-        if (m_overflowHeight < height())
-            m_overflowHeight = height();
-    }
+
     if (previousHeight != height())
         relayoutChildren = true;
 
@@ -273,27 +267,14 @@ void RenderFlexibleBox::layoutBlock(bool relayoutChildren)
         setMaxTopMargins(pos, neg);
         setMaxBottomMargins(0, 0);
     }
+    
+    // Add in the overflow from children.
+    FlexBoxIterator iterator(this);
+    for (RenderBox* child = iterator.first(); child; child = iterator.next())
+        addOverflowFromChild(child);
 
-    // Always ensure our overflow width is at least as large as our width.
-    if (m_overflowWidth < width())
-        m_overflowWidth = width();
-
-    if (!hasOverflowClip()) {
-        for (ShadowData* boxShadow = style()->boxShadow(); boxShadow; boxShadow = boxShadow->next) {
-            m_overflowLeft = min(m_overflowLeft, boxShadow->x - boxShadow->blur - boxShadow->spread);
-            m_overflowWidth = max(m_overflowWidth, width() + boxShadow->x + boxShadow->blur + boxShadow->spread);
-            m_overflowTop = min(m_overflowTop, boxShadow->y - boxShadow->blur - boxShadow->spread);
-            m_overflowHeight = max(m_overflowHeight, height() + boxShadow->y + boxShadow->blur + boxShadow->spread);
-        }
-        
-        if (hasReflection()) {
-            IntRect reflection(reflectionBox());
-            m_overflowTop = min(m_overflowTop, reflection.y());
-            m_overflowHeight = max(m_overflowHeight, reflection.bottom());
-            m_overflowLeft = min(m_overflowLeft, reflection.x());
-            m_overflowHeight = max(m_overflowWidth, reflection.right());
-        }
-    }
+    // Add visual overflow from box-shadow and reflections.
+    addShadowOverflow();
 
     statePusher.pop();
 
@@ -308,23 +289,10 @@ void RenderFlexibleBox::layoutBlock(bool relayoutChildren)
     setNeedsLayout(false);
 }
 
-void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
+// The first walk over our kids is to find out if we have any flexible children.
+static void gatherFlexChildrenInfo(FlexBoxIterator& iterator, bool relayoutChildren, unsigned int& highestFlexGroup, unsigned int& lowestFlexGroup, bool& haveFlex)
 {
-    int toAdd = borderBottom() + paddingBottom() + horizontalScrollbarHeight();
-    int yPos = borderTop() + paddingTop();
-    int xPos = borderLeft() + paddingLeft();
-    bool heightSpecified = false;
-    int oldHeight = 0;
-    
-    unsigned int highestFlexGroup = 0;
-    unsigned int lowestFlexGroup = 0;
-    bool haveFlex = false;
-    int remainingSpace = 0;
-    m_overflowHeight = height();
-
-    // The first walk over our kids is to find out if we have any flexible children.
-    FlexBoxIterator iterator(this);
-    RenderBox* child = iterator.next();
+    RenderBox* child = iterator.first();
     while (child) {
         // Check to see if this child flexes.
         if (!child->isPositioned() && child->style()->boxFlex() > 0.0f) {
@@ -344,6 +312,26 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
         }
         child = iterator.next();
     }
+}
+
+void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
+{
+    int toAdd = borderBottom() + paddingBottom() + horizontalScrollbarHeight();
+    int yPos = borderTop() + paddingTop();
+    int xPos = borderLeft() + paddingLeft();
+    bool heightSpecified = false;
+    int oldHeight = 0;
+
+    int remainingSpace = 0;
+
+
+    FlexBoxIterator iterator(this);
+    unsigned int highestFlexGroup = 0;
+    unsigned int lowestFlexGroup = 0;
+    bool haveFlex = false;
+    gatherFlexChildrenInfo(iterator, relayoutChildren, highestFlexGroup, lowestFlexGroup, haveFlex);
+
+    RenderBox* child;
 
     RenderBlock::startDelayUpdateScrollInfo();
 
@@ -352,7 +340,7 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
     do {
         // Reset our height.
         setHeight(yPos);
-        m_overflowHeight = height();
+
         xPos = borderLeft() + paddingLeft();
                 
         // Our first pass is done without flexing.  We simply lay the children
@@ -403,10 +391,6 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
             setHeight(height() + lineHeight(true, true));
         
         setHeight(height() + toAdd);
-
-        // Always make sure our overflowheight is at least our height.
-        if (m_overflowHeight < height())
-            m_overflowHeight = height();
         
         oldHeight = height();
         calcHeight();
@@ -465,12 +449,6 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
             }
 
             placeChild(child, xPos, childY);
-
-            if (child->isRenderBlock())
-                toRenderBlock(child)->addVisualOverflow(toRenderBlock(child)->floatRect());
-
-            m_overflowHeight = max(m_overflowHeight, childY + child->overflowHeight(false));
-            m_overflowTop = min(m_overflowTop, child->y() + child->overflowTop(false));
             
             xPos += child->width() + child->marginRight();
     
@@ -634,22 +612,6 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
         }
     }
     
-    child = iterator.first();
-    while (child && child->isPositioned()) {
-        child = iterator.next();
-    }
-    
-    if (child) {
-        m_overflowLeft = min(child->x() + child->overflowLeft(false), m_overflowLeft);
-
-        RenderBox* lastChild = child;
-        while ((child = iterator.next())) {
-            if (!child->isPositioned())
-                lastChild = child;
-        }
-        m_overflowWidth = max(lastChild->x() + lastChild->overflowWidth(false), m_overflowWidth);
-    }
-    
     // So that the calcHeight in layoutBlock() knows to relayout positioned objects because of
     // a height change, we revert our height back to the intrinsic height before returning.
     if (heightSpecified)
@@ -665,34 +627,16 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
     int toAdd = borderBottom() + paddingBottom() + horizontalScrollbarHeight();
     bool heightSpecified = false;
     int oldHeight = 0;
-    
+
+    int remainingSpace = 0;
+
+    FlexBoxIterator iterator(this);
     unsigned int highestFlexGroup = 0;
     unsigned int lowestFlexGroup = 0;
     bool haveFlex = false;
-    int remainingSpace = 0;
-    
-    // The first walk over our kids is to find out if we have any flexible children.
-    FlexBoxIterator iterator(this);
-    RenderBox* child = iterator.next();
-    while (child) {
-        // Check to see if this child flexes.
-        if (!child->isPositioned() && child->style()->boxFlex() > 0.0f) {
-            // We always have to lay out flexible objects again, since the flex distribution
-            // may have changed, and we need to reallocate space.
-            child->setOverrideSize(-1);
-            if (!relayoutChildren)
-                child->setChildNeedsLayout(true, false);
-            haveFlex = true;
-            unsigned int flexGroup = child->style()->boxFlexGroup();
-            if (lowestFlexGroup == 0)
-                lowestFlexGroup = flexGroup;
-            if (flexGroup < lowestFlexGroup)
-                lowestFlexGroup = flexGroup;
-            if (flexGroup > highestFlexGroup)
-                highestFlexGroup = flexGroup;
-        }
-        child = iterator.next();
-    }
+    gatherFlexChildrenInfo(iterator, relayoutChildren, highestFlexGroup, lowestFlexGroup, haveFlex);
+
+    RenderBox* child;
 
     // We confine the line clamp ugliness to vertical flexible boxes (thus keeping it out of
     // mainstream block layout); this is not really part of the XUL box model.
@@ -810,7 +754,6 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
     do {
         setHeight(borderTop() + paddingTop());
         int minHeight = height() + toAdd;
-        m_overflowHeight = height();
 
         child = iterator.first();
         while (child) {
@@ -818,8 +761,7 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
             if (!haveLineClamp && (relayoutChildren || (child->isReplaced() && (child->style()->width().isPercent() || child->style()->height().isPercent()))))
                 child->setChildNeedsLayout(true, false);
     
-            if (child->isPositioned())
-            {
+            if (child->isPositioned()) {
                 child->containingBlock()->insertPositionedObject(child);
                 if (child->style()->hasStaticX()) {
                     if (style()->direction() == LTR)
@@ -866,14 +808,7 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
             // Place the child.
             placeChild(child, childX, height());
             setHeight(height() + child->height() + child->marginBottom());
-    
-            if (child->isRenderBlock())
-                toRenderBlock(child)->addVisualOverflow(toRenderBlock(child)->floatRect());
 
-            // See if this child has made our overflow need to grow.
-            m_overflowWidth = max(child->x() + child->overflowWidth(false), m_overflowWidth);
-            m_overflowLeft = min(child->x() + child->overflowLeft(false), m_overflowLeft);
-            
             child = iterator.next();
         }
 
@@ -889,10 +824,6 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
         if (height() < minHeight)
             setHeight(minHeight);
 
-        // Always make sure our overflowheight is at least our height.
-        if (m_overflowHeight < height())
-            m_overflowHeight = height();
-
         // Now we have to calc our height, so we know how much space we have remaining.
         oldHeight = height();
         calcHeight();
@@ -1050,22 +981,6 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
             }
         }
     }
-    
-    child = iterator.first();
-    while (child && child->isPositioned()) {
-        child = iterator.next();
-    }
-    
-    if (child) {
-        m_overflowTop = min(child->y() + child->overflowTop(false), m_overflowTop);
-
-        RenderBox* lastChild = child;
-        while ((child = iterator.next())) {
-            if (!child->isPositioned())
-                lastChild = child;
-        }
-        m_overflowHeight = max(lastChild->y() + lastChild->overflowHeight(false), m_overflowHeight);
-    }
 
     // So that the calcHeight in layoutBlock() knows to relayout positioned objects because of
     // a height change, we revert our height back to the intrinsic height before returning.
@@ -1151,6 +1066,8 @@ const char *RenderFlexibleBox::renderName() const
         return "RenderFlexibleBox (floating)";
     if (isPositioned())
         return "RenderFlexibleBox (positioned)";
+    if (isAnonymous())
+        return "RenderFlexibleBox (generated)";
     if (isRelPositioned())
         return "RenderFlexibleBox (relative positioned)";
     return "RenderFlexibleBox";
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderFrame.h b/src/3rdparty/webkit/WebCore/rendering/RenderFrame.h
index 2716e14..587a8bd 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderFrame.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderFrame.h
@@ -43,6 +43,15 @@ private:
     virtual void viewCleared();
 };
 
+inline RenderFrame* toRenderFrame(RenderObject* object)
+{
+    ASSERT(!object || object->isFrame());
+    return static_cast<RenderFrame*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderFrame(const RenderFrame*);
+
 } // namespace WebCore
 
 #endif // RenderFrame_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderFrameSet.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderFrameSet.cpp
index 57c8a2f..2fe1ddb 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderFrameSet.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderFrameSet.cpp
@@ -416,9 +416,9 @@ void RenderFrameSet::computeEdgeInfo()
         for (int c = 0; c < cols; ++c) {
             FrameEdgeInfo edgeInfo;
             if (child->isFrameSet())
-                edgeInfo = static_cast<RenderFrameSet*>(child)->edgeInfo();
+                edgeInfo = toRenderFrameSet(child)->edgeInfo();
             else
-                edgeInfo = static_cast<RenderFrame*>(child)->edgeInfo();
+                edgeInfo = toRenderFrame(child)->edgeInfo();
             fillFromEdgeInfo(edgeInfo, r, c);
             child = child->nextSibling();
             if (!child)
@@ -590,9 +590,10 @@ bool RenderFrameSet::userResize(MouseEvent* evt)
 void RenderFrameSet::setIsResizing(bool isResizing)
 {
     m_isResizing = isResizing;
-    for (RenderObject* p = parent(); p; p = p->parent())
-        if (p->isFrameSet())
-            static_cast<RenderFrameSet*>(p)->m_isChildResizing = isResizing;
+    for (RenderObject* ancestor = parent(); ancestor; ancestor = ancestor->parent()) {
+        if (ancestor->isFrameSet())
+            toRenderFrameSet(ancestor)->m_isChildResizing = isResizing;
+    }
     if (Frame* frame = document()->frame())
         frame->eventHandler()->setResizingFrameSet(isResizing ? frameSet() : 0);
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderFrameSet.h b/src/3rdparty/webkit/WebCore/rendering/RenderFrameSet.h
index 9f90502..26bf732 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderFrameSet.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderFrameSet.h
@@ -57,19 +57,9 @@ public:
     RenderFrameSet(HTMLFrameSetElement*);
     virtual ~RenderFrameSet();
 
-    virtual RenderObjectChildList* virtualChildren() { return children(); }
-    virtual const RenderObjectChildList* virtualChildren() const { return children(); }
     const RenderObjectChildList* children() const { return &m_children; }
     RenderObjectChildList* children() { return &m_children; }
 
-    virtual const char* renderName() const { return "RenderFrameSet"; }
-    virtual bool isFrameSet() const { return true; }
-
-    virtual void layout();
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
-    virtual void paint(PaintInfo& paintInfo, int tx, int ty);
-    virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
-    
     FrameEdgeInfo edgeInfo() const;
 
     bool userResize(MouseEvent*);
@@ -95,6 +85,17 @@ private:
         int m_splitResizeOffset;
     };
 
+    virtual RenderObjectChildList* virtualChildren() { return children(); }
+    virtual const RenderObjectChildList* virtualChildren() const { return children(); }
+
+    virtual const char* renderName() const { return "RenderFrameSet"; }
+    virtual bool isFrameSet() const { return true; }
+
+    virtual void layout();
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
+    virtual void paint(PaintInfo&, int tx, int ty);
+    virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
+    
     inline HTMLFrameSetElement* frameSet() const;
 
     void setIsResizing(bool);
@@ -110,8 +111,8 @@ private:
     void startResizing(GridAxis&, int position);
     void continueResizing(GridAxis&, int position);
 
-    void paintRowBorder(const PaintInfo& paintInfo, const IntRect& rect);
-    void paintColumnBorder(const PaintInfo& paintInfo, const IntRect& rect);
+    void paintRowBorder(const PaintInfo&, const IntRect&);
+    void paintColumnBorder(const PaintInfo&, const IntRect&);
 
     RenderObjectChildList m_children;
 
@@ -122,6 +123,16 @@ private:
     bool m_isChildResizing;
 };
 
+
+inline RenderFrameSet* toRenderFrameSet(RenderObject* object)
+{
+    ASSERT(!object || object->isFrameSet());
+    return static_cast<RenderFrameSet*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderFrameSet(const RenderFrameSet*);
+
 } // namespace WebCore
 
 #endif // RenderFrameSet_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderHTMLCanvas.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderHTMLCanvas.cpp
index 1fc07f0..8c17a0e 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderHTMLCanvas.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderHTMLCanvas.cpp
@@ -43,6 +43,19 @@ RenderHTMLCanvas::RenderHTMLCanvas(HTMLCanvasElement* element)
     view()->frameView()->setIsVisuallyNonEmpty();
 }
 
+bool RenderHTMLCanvas::requiresLayer() const
+{
+    if (RenderReplaced::requiresLayer())
+        return true;
+    
+#if ENABLE(3D_CANVAS)
+    HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(node());
+    return canvas && canvas->is3D();
+#else
+    return false;
+#endif
+}
+
 void RenderHTMLCanvas::paintReplaced(PaintInfo& paintInfo, int tx, int ty)
 {
     IntRect rect = contentBoxRect();
@@ -55,10 +68,13 @@ void RenderHTMLCanvas::canvasSizeChanged()
     IntSize canvasSize = static_cast<HTMLCanvasElement*>(node())->size();
     IntSize zoomedSize(canvasSize.width() * style()->effectiveZoom(), canvasSize.height() * style()->effectiveZoom());
 
-    if (canvasSize == intrinsicSize())
+    if (zoomedSize == intrinsicSize())
         return;
 
-    setIntrinsicSize(canvasSize);
+    setIntrinsicSize(zoomedSize);
+
+    if (!parent())
+        return;
 
     if (!prefWidthsDirty())
         setPrefWidthsDirty(true);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderHTMLCanvas.h b/src/3rdparty/webkit/WebCore/rendering/RenderHTMLCanvas.h
index ad6c505..473dad5 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderHTMLCanvas.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderHTMLCanvas.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -36,17 +36,26 @@ class RenderHTMLCanvas : public RenderReplaced {
 public:
     RenderHTMLCanvas(HTMLCanvasElement*);
 
-    virtual const char* renderName() const { return "RenderHTMLCanvas"; }
-
-    virtual void paintReplaced(PaintInfo& paintInfo, int tx, int ty);
+    virtual bool isCanvas() const { return true; }
+    virtual bool requiresLayer() const;
 
     void canvasSizeChanged();
     
-protected:
+private:
+    virtual const char* renderName() const { return "RenderHTMLCanvas"; }
+    virtual void paintReplaced(PaintInfo&, int tx, int ty);
     virtual void intrinsicSizeChanged() { canvasSizeChanged(); }
-
 };
 
+inline RenderHTMLCanvas* toRenderHTMLCanvas(RenderObject* object)
+{
+    ASSERT(!object || !strcmp(object->renderName(), "RenderHTMLCanvas"));
+    return static_cast<RenderHTMLCanvas*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderHTMLCanvas(const RenderHTMLCanvas*);
+
 } // namespace WebCore
 
 #endif // RenderHTMLCanvas_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderImage.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderImage.cpp
index 559406b..51c3073 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderImage.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderImage.cpp
@@ -26,9 +26,6 @@
 #include "config.h"
 #include "RenderImage.h"
 
-#include "BitmapImage.h"
-#include "Document.h"
-#include "FrameView.h"
 #include "GraphicsContext.h"
 #include "HTMLImageElement.h"
 #include "HTMLInputElement.h"
@@ -439,20 +436,21 @@ int RenderImage::minimumReplacedHeight() const
 HTMLMapElement* RenderImage::imageMap()
 {
     HTMLImageElement* i = node() && node()->hasTagName(imgTag) ? static_cast<HTMLImageElement*>(node()) : 0;
-    return i ? i->document()->getImageMap(i->useMap()) : 0;
+    return i ? i->document()->getImageMap(i->getAttribute(usemapAttr)) : 0;
 }
 
-bool RenderImage::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int _x, int _y, int _tx, int _ty, HitTestAction hitTestAction)
+bool RenderImage::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty, HitTestAction hitTestAction)
 {
     HitTestResult tempResult(result.point());
-    bool inside = RenderReplaced::nodeAtPoint(request, tempResult, _x, _y, _tx, _ty, hitTestAction);
+    bool inside = RenderReplaced::nodeAtPoint(request, tempResult, x, y, tx, ty, hitTestAction);
 
     if (inside && node()) {
-        int tx = _tx + x();
-        int ty = _ty + y();
-        
         if (HTMLMapElement* map = imageMap()) {
-            if (map->mapMouseEvent(_x - tx, _y - ty, IntSize(contentWidth(), contentHeight()), tempResult))
+            IntRect contentBox = contentBoxRect();
+            float zoom = style()->effectiveZoom();
+            int mapX = lroundf((x - tx - this->x() - contentBox.x()) / zoom);
+            int mapY = lroundf((y - ty - this->y() - contentBox.y()) / zoom);
+            if (map->mapMouseEvent(mapX, mapY, contentBox.size(), tempResult))
                 tempResult.setInnerNonSharedNode(node());
         }
     }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderImage.h b/src/3rdparty/webkit/WebCore/rendering/RenderImage.h
index 042452f..2224412 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderImage.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderImage.h
@@ -3,7 +3,7 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2006 Allan Sandfeld Jensen (kde@carewolf.com) 
  *           (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
- * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,8 +25,6 @@
 #ifndef RenderImage_h
 #define RenderImage_h
 
-#include "CachedImage.h"
-#include "CachedResourceHandle.h"
 #include "RenderReplaced.h"
 
 namespace WebCore {
@@ -38,18 +36,6 @@ public:
     RenderImage(Node*);
     virtual ~RenderImage();
 
-    virtual const char* renderName() const { return "RenderImage"; }
-
-    virtual bool isImage() const { return true; }
-    virtual bool isRenderImage() const { return true; }
-    
-    virtual void paintReplaced(PaintInfo& paintInfo, int tx, int ty);
-
-    virtual int minimumReplacedHeight() const;
-
-    virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
-    virtual void notifyFinished(CachedResource*);
-    
     bool setImageSizeForAltText(CachedImage* newImage = 0);
 
     void updateAltText();
@@ -57,13 +43,6 @@ public:
     void setCachedImage(CachedImage*);
     CachedImage* cachedImage() const { return m_cachedImage.get(); }
 
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
-
-    virtual int calcReplacedWidth(bool includeMaxWidth = true) const;
-    virtual int calcReplacedHeight() const;
-
-    virtual void calcPrefWidths();
-
     HTMLMapElement* imageMap();
 
     void resetAnimation();
@@ -73,8 +52,29 @@ public:
     void highQualityRepaintTimerFired(Timer<RenderImage>*);
 
 protected:
-    virtual Image* image(int /*w*/ = 0, int /*h*/ = 0) { return m_cachedImage ? m_cachedImage->image() : nullImage(); }
+    virtual Image* image(int /* width */ = 0, int /* height */ = 0) { return m_cachedImage ? m_cachedImage->image() : nullImage(); }
     virtual bool errorOccurred() const { return m_cachedImage && m_cachedImage->errorOccurred(); }
+
+    virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
+
+private:
+    virtual const char* renderName() const { return "RenderImage"; }
+
+    virtual bool isImage() const { return true; }
+    virtual bool isRenderImage() const { return true; }
+    
+    virtual void paintReplaced(PaintInfo&, int tx, int ty);
+
+    virtual int minimumReplacedHeight() const;
+
+    virtual void notifyFinished(CachedResource*);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
+
+    virtual int calcReplacedWidth(bool includeMaxWidth = true) const;
+    virtual int calcReplacedHeight() const;
+
+    virtual void calcPrefWidths();
+
     virtual bool usesImageContainerSize() const { return m_cachedImage ? m_cachedImage->usesImageContainerSize() : false; }
     virtual void setImageContainerSize(const IntSize& size) const { if (m_cachedImage) m_cachedImage->setImageContainerSize(size); }
     virtual bool imageHasRelativeWidth() const { return m_cachedImage ? m_cachedImage->imageHasRelativeWidth() : false; }
@@ -84,7 +84,6 @@ protected:
 
     virtual void intrinsicSizeChanged() { imageChanged(imagePtr()); }
 
-private:
     int calcAspectRatioWidth() const;
     int calcAspectRatioHeight() const;
 
@@ -95,6 +94,7 @@ protected:
     // The image we are rendering.
     CachedResourceHandle<CachedImage> m_cachedImage;
 
+private:
     // Text to display as long as the image isn't available.
     String m_altText;
 
@@ -103,16 +103,16 @@ protected:
     friend class RenderImageScaleObserver;
 };
 
-inline RenderImage* toRenderImage(RenderObject* o)
+inline RenderImage* toRenderImage(RenderObject* object)
 { 
-    ASSERT(!o || o->isRenderImage());
-    return static_cast<RenderImage*>(o);
+    ASSERT(!object || object->isRenderImage());
+    return static_cast<RenderImage*>(object);
 }
 
-inline const RenderImage* toRenderImage(const RenderObject* o)
+inline const RenderImage* toRenderImage(const RenderObject* object)
 { 
-    ASSERT(!o || o->isRenderImage());
-    return static_cast<const RenderImage*>(o);
+    ASSERT(!object || object->isRenderImage());
+    return static_cast<const RenderImage*>(object);
 }
 
 // This will catch anyone doing an unnecessary cast.
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderInline.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderInline.cpp
index f798a56..07b28cc 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderInline.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderInline.cpp
@@ -1,9 +1,7 @@
 /*
- * This file is part of the render object implementation for KHTML.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -51,10 +49,6 @@ RenderInline::RenderInline(Node* node)
     setChildrenInline(true);
 }
 
-RenderInline::~RenderInline()
-{
-}
-
 void RenderInline::destroy()
 {
     // Detach our continuation first.
@@ -137,18 +131,6 @@ void RenderInline::styleDidChange(StyleDifference diff, const RenderStyle* oldSt
     }
 }
 
-static inline bool isAfterContent(RenderObject* child)
-{
-    if (!child)
-        return false;
-    if (child->style()->styleType() != AFTER)
-        return false;
-    // Text nodes don't have their own styles, so ignore the style on a text node.
-    if (child->isText() && !child->isBR())
-        return false;
-    return true;
-}
-
 void RenderInline::addChild(RenderObject* newChild, RenderObject* beforeChild)
 {
     if (continuation())
@@ -258,7 +240,7 @@ void RenderInline::splitInlines(RenderBlock* fromBlock, RenderBlock* toBlock,
     // We have been reparented and are now under the fromBlock.  We need
     // to walk up our inline parent chain until we hit the containing block.
     // Once we hit the containing block we're done.
-    RenderBoxModelObject* curr = static_cast<RenderBoxModelObject*>(parent());
+    RenderBoxModelObject* curr = toRenderBoxModelObject(parent());
     RenderBoxModelObject* currChild = this;
     
     // FIXME: Because splitting is O(n^2) as tags nest pathologically, we cap the depth at which we're willing to clone.
@@ -302,7 +284,7 @@ void RenderInline::splitInlines(RenderBlock* fromBlock, RenderBlock* toBlock,
         
         // Keep walking up the chain.
         currChild = curr;
-        curr = static_cast<RenderBoxModelObject*>(curr->parent());
+        curr = toRenderBoxModelObject(curr->parent());
         splitDepth++;
     }
 
@@ -384,7 +366,7 @@ void RenderInline::addChildToContinuation(RenderObject* newChild, RenderObject*
     ASSERT(!beforeChild || beforeChild->parent()->isRenderBlock() || beforeChild->parent()->isRenderInline());
     RenderBoxModelObject* beforeChildParent = 0;
     if (beforeChild)
-        beforeChildParent = static_cast<RenderBoxModelObject*>(beforeChild->parent());
+        beforeChildParent = toRenderBoxModelObject(beforeChild->parent());
     else {
         RenderBoxModelObject* cont = nextContinuation(flow);
         if (cont)
@@ -562,6 +544,23 @@ IntRect RenderInline::linesBoundingBox() const
     return result;
 }
 
+IntRect RenderInline::linesVisibleOverflowBoundingBox() const
+{
+    if (!firstLineBox() || !lastLineBox())
+        return IntRect();
+
+    // Return the width of the minimal left side and the maximal right side.
+    int leftSide = numeric_limits<int>::max();
+    int rightSide = numeric_limits<int>::min();
+    for (InlineFlowBox* curr = firstLineBox(); curr; curr = curr->nextFlowBox()) {
+        leftSide = min(leftSide, curr->leftVisibleOverflow());
+        rightSide = max(rightSide, curr->rightVisibleOverflow());
+    }
+
+    return IntRect(leftSide, firstLineBox()->topVisibleOverflow(), rightSide - leftSide,
+        lastLineBox()->bottomVisibleOverflow() - firstLineBox()->topVisibleOverflow());
+}
+
 IntRect RenderInline::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
 {
     // Only run-ins are allowed in here during layout.
@@ -571,7 +570,7 @@ IntRect RenderInline::clippedOverflowRectForRepaint(RenderBoxModelObject* repain
         return IntRect();
 
     // Find our leftmost position.
-    IntRect boundingBox(linesBoundingBox());
+    IntRect boundingBox(linesVisibleOverflowBoundingBox());
     int left = boundingBox.x();
     int top = boundingBox.y();
 
@@ -836,8 +835,12 @@ void RenderInline::imageChanged(WrappedImagePtr, const IntRect*)
 
 void RenderInline::addFocusRingRects(GraphicsContext* graphicsContext, int tx, int ty)
 {
-    for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox())
-        graphicsContext->addFocusRingRect(IntRect(tx + curr->x(), ty + curr->y(), curr->width(), curr->height()));
+    for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox()) {
+        RootInlineBox* root = curr->root();
+        int top = max(root->lineTop(), curr->y());
+        int bottom = min(root->lineBottom(), curr->y() + curr->height());
+        graphicsContext->addFocusRingRect(IntRect(tx + curr->x(), ty + top, curr->width(), bottom - top));
+    }
 
     for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
         if (!curr->isText() && !curr->isListMarker()) {
@@ -889,9 +892,12 @@ void RenderInline::paintOutline(GraphicsContext* graphicsContext, int tx, int ty
     Vector<IntRect> rects;
 
     rects.append(IntRect());
-    for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox())
-        rects.append(IntRect(curr->x(), curr->y(), curr->width(), curr->height()));
-
+    for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox()) {
+        RootInlineBox* root = curr->root();
+        int top = max(root->lineTop(), curr->y());
+        int bottom = min(root->lineBottom(), curr->y() + curr->height());
+        rects.append(IntRect(curr->x(), top, curr->width(), bottom - top));
+    }
     rects.append(IntRect());
 
     for (unsigned i = 1; i < rects.size() - 1; i++)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderInline.h b/src/3rdparty/webkit/WebCore/rendering/RenderInline.h
index 5a10068..8e0064e 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderInline.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderInline.h
@@ -1,9 +1,7 @@
 /*
- * This file is part of the render object implementation for KHTML.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003 Apple Computer, Inc.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -35,20 +33,52 @@ class Position;
 class RenderInline : public RenderBoxModelObject {
 public:
     RenderInline(Node*);
-    virtual ~RenderInline();
 
+    virtual void destroy();
+
+    virtual void addChild(RenderObject* newChild, RenderObject* beforeChild = 0);
+
+    virtual int marginLeft() const;
+    virtual int marginRight() const;
+    
+    virtual void absoluteRects(Vector<IntRect>&, int tx, int ty);
+    virtual void absoluteQuads(Vector<FloatQuad>&);
+
+    IntRect linesBoundingBox() const;
+    IntRect linesVisibleOverflowBoundingBox() const;
+
+    InlineFlowBox* createAndAppendInlineFlowBox();
+
+    void dirtyLineBoxes(bool fullLayout);
+
+    RenderLineBoxList* lineBoxes() { return &m_lineBoxes; }
+    const RenderLineBoxList* lineBoxes() const { return &m_lineBoxes; }
+
+    InlineFlowBox* firstLineBox() const { return m_lineBoxes.firstLineBox(); }
+    InlineFlowBox* lastLineBox() const { return m_lineBoxes.lastLineBox(); }
+
+    RenderBoxModelObject* continuation() const { return m_continuation; }
+
+    virtual void updateDragState(bool dragOn);
+    
+    IntSize relativePositionedInlineOffset(const RenderBox* child) const;
+
+    virtual void addFocusRingRects(GraphicsContext*, int tx, int ty);
+    void paintOutline(GraphicsContext*, int tx, int ty);
+
+    int verticalPositionFromCache(bool firstLine) const;
+    void invalidateVerticalPosition() { m_verticalPosition = PositionUndefined; }
+
+private:
     virtual RenderObjectChildList* virtualChildren() { return children(); }
     virtual const RenderObjectChildList* virtualChildren() const { return children(); }
     const RenderObjectChildList* children() const { return &m_children; }
     RenderObjectChildList* children() { return &m_children; }
 
-    virtual void destroy();
-
     virtual const char* renderName() const;
 
     virtual bool isRenderInline() const { return true; }
 
-    virtual void addChild(RenderObject* newChild, RenderObject* beforeChild = 0);
     void addChildToContinuation(RenderObject* newChild, RenderObject* beforeChild);
     virtual void addChildIgnoringContinuation(RenderObject* newChild, RenderObject* beforeChild = 0);
 
@@ -73,95 +103,64 @@ public:
     // Just ignore top/bottom margins on RenderInlines.
     virtual int marginTop() const { return 0; }
     virtual int marginBottom() const { return 0; }
-    virtual int marginLeft() const;
-    virtual int marginRight() const;
-    
-    virtual void absoluteRects(Vector<IntRect>&, int tx, int ty);
-    virtual void absoluteQuads(Vector<FloatQuad>&);
-
     virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
     virtual IntRect rectWithOutlineForRepaint(RenderBoxModelObject* repaintContainer, int outlineWidth);
     virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& rect, bool fixed);
 
     virtual VisiblePosition positionForPoint(const IntPoint&);
 
-    IntRect linesBoundingBox() const;
-    
     virtual IntRect borderBoundingBox() const
     {
         IntRect boundingBox = linesBoundingBox();
         return IntRect(0, 0, boundingBox.width(), boundingBox.height());
     }
 
-    InlineFlowBox* createAndAppendInlineFlowBox();    
     virtual InlineFlowBox* createInlineFlowBox(); // Subclassed by SVG and Ruby
 
-    void dirtyLineBoxes(bool fullLayout);
     virtual void dirtyLinesFromChangedChild(RenderObject* child) { m_lineBoxes.dirtyLinesFromChangedChild(this, child); }
 
-    RenderLineBoxList* lineBoxes() { return &m_lineBoxes; }
-    const RenderLineBoxList* lineBoxes() const { return &m_lineBoxes; }
-
-    InlineFlowBox* firstLineBox() const { return m_lineBoxes.firstLineBox(); }
-    InlineFlowBox* lastLineBox() const { return m_lineBoxes.lastLineBox(); }
-
     virtual int lineHeight(bool firstLine, bool isRootLineBox = false) const;
 
-    RenderBoxModelObject* continuation() const { return m_continuation; }
     RenderInline* inlineContinuation() const;
     void setContinuation(RenderBoxModelObject* c) { m_continuation = c; }
     
-    virtual void updateDragState(bool dragOn);
-    
     virtual void childBecameNonInline(RenderObject* child);
 
     virtual void updateHitTestResult(HitTestResult&, const IntPoint&);
 
-    IntSize relativePositionedInlineOffset(const RenderBox* child) const;
-
-    virtual void addFocusRingRects(GraphicsContext*, int tx, int ty);
-    void paintOutline(GraphicsContext*, int tx, int ty);
-
     virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
 
-    int verticalPositionFromCache(bool firstLine) const;
-    void invalidateVerticalPosition() { m_verticalPosition = PositionUndefined; }
-
 #if ENABLE(DASHBOARD_SUPPORT)
     virtual void addDashboardRegions(Vector<DashboardRegionValue>&);
 #endif
     
-protected:
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
     virtual void updateBoxModelInfoFromStyle();
     
     static RenderInline* cloneInline(RenderInline* src);
 
-private:
     void paintOutlineForLine(GraphicsContext*, int tx, int ty, const IntRect& prevLine, const IntRect& thisLine, const IntRect& nextLine);
     RenderBoxModelObject* continuationBefore(RenderObject* beforeChild);
 
-protected:
     RenderObjectChildList m_children;
     RenderLineBoxList m_lineBoxes;   // All of the line boxes created for this inline flow.  For example, <i>Hello<br>world.</i> will have two <i> line boxes.
 
-private:
     RenderBoxModelObject* m_continuation; // Can be either a block or an inline. <b><i><p>Hello</p></i></b>. In this example the <i> will have a block as its continuation but the
                                           // <b> will just have an inline as its continuation.
     mutable int m_lineHeight;
     mutable int m_verticalPosition;
 };
 
-inline RenderInline* toRenderInline(RenderObject* o)
+inline RenderInline* toRenderInline(RenderObject* object)
 { 
-    ASSERT(!o || o->isRenderInline());
-    return static_cast<RenderInline*>(o);
+    ASSERT(!object || object->isRenderInline());
+    return static_cast<RenderInline*>(object);
 }
 
-inline const RenderInline* toRenderInline(const RenderObject* o)
+inline const RenderInline* toRenderInline(const RenderObject* object)
 { 
-    ASSERT(!o || o->isRenderInline());
-    return static_cast<const RenderInline*>(o);
+    ASSERT(!object || object->isRenderInline());
+    return static_cast<const RenderInline*>(object);
 }
 
 // This will catch anyone doing an unnecessary cast.
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp
index d92746b..08f5f57 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp
@@ -207,12 +207,8 @@ RenderLayer::~RenderLayer()
     // Make sure we have no lingering clip rects.
     ASSERT(!m_clipRects);
     
-    if (m_reflection) {
-        if (!m_reflection->documentBeingDestroyed())
-            m_reflection->removeLayers(this);
-        m_reflection->setParent(0);
-        m_reflection->destroy();
-    }
+    if (m_reflection)
+        removeReflection();
     
     if (m_scrollCorner)
         m_scrollCorner->destroy();
@@ -584,10 +580,10 @@ void RenderLayer::updateLayerPosition()
         setHeight(box->height());
 
         if (!box->hasOverflowClip()) {
-            if (box->overflowWidth() > box->width())
-                setWidth(box->overflowWidth());
-            if (box->overflowHeight() > box->height())
-                setHeight(box->overflowHeight());
+            if (box->rightLayoutOverflow() > box->width())
+                setWidth(box->rightLayoutOverflow());
+            if (box->bottomLayoutOverflow() > box->height())
+                setHeight(box->bottomLayoutOverflow());
         }
     }
 }
@@ -642,19 +638,27 @@ RenderLayer* RenderLayer::stackingContext() const
     return layer;
 }
 
+static inline bool isPositionedContainer(RenderLayer* layer)
+{
+    RenderObject* o = layer->renderer();
+    return o->isRenderView() || o->isPositioned() || o->isRelPositioned() || layer->hasTransform();
+}
+
 RenderLayer* RenderLayer::enclosingPositionedAncestor() const
 {
     RenderLayer* curr = parent();
-    for ( ; curr && !curr->renderer()->isRenderView() && !curr->renderer()->isPositioned() && !curr->renderer()->isRelPositioned() && !curr->hasTransform();
-         curr = curr->parent()) { }
+    while (curr && !isPositionedContainer(curr))
+        curr = curr->parent();
+
     return curr;
 }
 
 RenderLayer* RenderLayer::enclosingTransformedAncestor() const
 {
     RenderLayer* curr = parent();
-    for ( ; curr && !curr->renderer()->isRenderView() && !curr->transform(); curr = curr->parent())
-        { }
+    while (curr && !curr->renderer()->isRenderView() && !curr->transform())
+        curr = curr->parent();
+
     return curr;
 }
 
@@ -760,6 +764,19 @@ static IntRect transparencyClipBox(const TransformationMatrix& enclosingTransfor
         }
     }
 
+    // If we have a reflection, then we need to account for that when we push the clip.  Reflect our entire
+    // current transparencyClipBox to catch all child layers.
+    // FIXME: Accelerated compositing will eventually want to do something smart here to avoid incorporating this
+    // size into the parent layer.
+    if (l->renderer()->hasReflection()) {
+        int deltaX = 0;
+        int deltaY = 0;
+        l->convertToLayerCoords(rootLayer, deltaX, deltaY);
+        clipRect.move(-deltaX, -deltaY);
+        clipRect.unite(l->renderBox()->reflectedRect(clipRect));
+        clipRect.move(deltaX, deltaY);
+    }
+
     // Now map the clipRect via the enclosing transform
     return enclosingTransform.mapRect(clipRect);
 }
@@ -946,12 +963,44 @@ RenderLayer::convertToLayerCoords(const RenderLayer* ancestorLayer, int& xPos, i
     }
  
     RenderLayer* parentLayer;
-    if (renderer()->style()->position() == AbsolutePosition)
-        parentLayer = enclosingPositionedAncestor();
-    else
+    if (renderer()->style()->position() == AbsolutePosition) {
+        // Do what enclosingPositionedAncestor() does, but check for ancestorLayer along the way
+        parentLayer = parent();
+        bool foundAncestorFirst = false;
+        while (parentLayer) {
+            if (isPositionedContainer(parentLayer))
+                break;
+
+            if (parentLayer == ancestorLayer) {
+                foundAncestorFirst = true;
+                break;
+            }
+
+            parentLayer = parentLayer->parent();
+        }
+
+        if (foundAncestorFirst) {
+            // Found ancestorLayer before the abs. positioned container, so compute offset of both relative
+            // to enclosingPositionedAncestor and subtract.
+            RenderLayer* positionedAncestor = parentLayer->enclosingPositionedAncestor();
+
+            int thisX = 0;
+            int thisY = 0;
+            convertToLayerCoords(positionedAncestor, thisX, thisY);
+            
+            int ancestorX = 0;
+            int ancestorY = 0;
+            ancestorLayer->convertToLayerCoords(positionedAncestor, ancestorX, ancestorY);
+        
+            xPos += (thisX - ancestorX);
+            yPos += (thisY - ancestorY);
+            return;
+        }
+    } else
         parentLayer = parent();
     
-    if (!parentLayer) return;
+    if (!parentLayer)
+        return;
     
     parentLayer->convertToLayerCoords(ancestorLayer, xPos, yPos);
 
@@ -959,12 +1008,22 @@ RenderLayer::convertToLayerCoords(const RenderLayer* ancestorLayer, int& xPos, i
     yPos += y();
 }
 
+static inline int adjustedScrollDelta(int beginningDelta) {
+    // This implemention matches Firefox's.
+    // http://mxr.mozilla.org/firefox/source/toolkit/content/widgets/browser.xml#856.
+    const int speedReducer = 12;
+
+    int adjustedDelta = beginningDelta / speedReducer;
+    if (adjustedDelta > 1)
+        adjustedDelta = static_cast<int>(adjustedDelta * sqrt(static_cast<double>(adjustedDelta))) - 1;
+    else if (adjustedDelta < -1)
+        adjustedDelta = static_cast<int>(adjustedDelta * sqrt(static_cast<double>(-adjustedDelta))) + 1;
+
+    return adjustedDelta;
+}
+
 void RenderLayer::panScrollFromPoint(const IntPoint& sourcePoint) 
 {
-    // We want to reduce the speed if we're close from the original point to improve the handleability of the scroll
-    const int shortDistanceLimit = 100;  // We delimit a 200 pixels long square enclosing the original point
-    const int speedReducer = 2;          // Within this square we divide the scrolling speed by 2
-    
     Frame* frame = renderer()->document()->frame();
     if (!frame)
         return;
@@ -981,22 +1040,19 @@ void RenderLayer::panScrollFromPoint(const IntPoint& sourcePoint)
     int xDelta = currentMousePosition.x() - sourcePoint.x();
     int yDelta = currentMousePosition.y() - sourcePoint.y();
 
-    if (abs(xDelta) < ScrollView::noPanScrollRadius) // at the center we let the space for the icon
+    if (abs(xDelta) <= ScrollView::noPanScrollRadius) // at the center we let the space for the icon
         xDelta = 0;
-    if (abs(yDelta) < ScrollView::noPanScrollRadius)
+    if (abs(yDelta) <= ScrollView::noPanScrollRadius)
         yDelta = 0;
 
-    // Let's attenuate the speed for the short distances
-    if (abs(xDelta) < shortDistanceLimit)
-        xDelta /= speedReducer;
-    if (abs(yDelta) < shortDistanceLimit)
-        yDelta /= speedReducer;
-
-    scrollByRecursively(xDelta, yDelta);
+    scrollByRecursively(adjustedScrollDelta(xDelta), adjustedScrollDelta(yDelta));
 }
 
 void RenderLayer::scrollByRecursively(int xDelta, int yDelta)
 {
+    if (!xDelta && !yDelta)
+        return;
+
     bool restrictedByLineClamp = false;
     if (renderer()->parent())
         restrictedByLineClamp = renderer()->parent()->style()->lineClamp() >= 0;
@@ -1006,17 +1062,30 @@ void RenderLayer::scrollByRecursively(int xDelta, int yDelta)
         int newOffsetY = scrollYOffset() + yDelta;
         scrollToOffset(newOffsetX, newOffsetY);
 
-        // If this layer can't do the scroll we ask its parent
+        // If this layer can't do the scroll we ask the next layer up that can scroll to try
         int leftToScrollX = newOffsetX - scrollXOffset();
         int leftToScrollY = newOffsetY - scrollYOffset();
         if ((leftToScrollX || leftToScrollY) && renderer()->parent()) {
-            renderer()->parent()->enclosingLayer()->scrollByRecursively(leftToScrollX, leftToScrollY);
+            RenderObject* nextRenderer = renderer()->parent();
+            while (nextRenderer) {
+                if (nextRenderer->isBox() && toRenderBox(nextRenderer)->canBeScrolledAndHasScrollableArea()) {
+                    nextRenderer->enclosingLayer()->scrollByRecursively(leftToScrollX, leftToScrollY);
+                    break;
+                }
+                nextRenderer = nextRenderer->parent();
+            }
+
             Frame* frame = renderer()->document()->frame();
             if (frame)
                 frame->eventHandler()->updateAutoscrollRenderer();
         }
-    } else if (renderer()->view()->frameView())
+    } else if (renderer()->view()->frameView()) {
+        // If we are here, we were called on a renderer that can be programatically scrolled, but doesn't
+        // have an overflow clip. Which means that it is a document node that can be scrolled.
         renderer()->view()->frameView()->scrollBy(IntSize(xDelta, yDelta));
+        // FIXME: If we didn't scroll the whole way, do we want to try looking at the frames ownerElement? 
+        // https://bugs.webkit.org/show_bug.cgi?id=28237
+    }
 }
 
 
@@ -1275,7 +1344,9 @@ void RenderLayer::autoscroll()
     if (!frameView)
         return;
 
+#if ENABLE(DRAG_SUPPORT)
     frame->eventHandler()->updateSelectionForMouseDrag();
+#endif
 
     IntPoint currentDocumentPosition = frameView->windowToContents(frame->eventHandler()->currentMousePosition());
     scrollRectToVisible(IntRect(currentDocumentPosition, IntSize(1, 1)), false, ScrollAlignment::alignToEdgeIfNeeded, ScrollAlignment::alignToEdgeIfNeeded);
@@ -2707,10 +2778,13 @@ void RenderLayer::calculateRects(const RenderLayer* rootLayer, const IntRect& pa
         if (ShadowData* boxShadow = renderer()->style()->boxShadow()) {
             IntRect overflow = layerBounds;
             do {
-                IntRect shadowRect = layerBounds;
-                shadowRect.move(boxShadow->x, boxShadow->y);
-                shadowRect.inflate(boxShadow->blur + boxShadow->spread);
-                overflow.unite(shadowRect);
+                if (boxShadow->style == Normal) {
+                    IntRect shadowRect = layerBounds;
+                    shadowRect.move(boxShadow->x, boxShadow->y);
+                    shadowRect.inflate(boxShadow->blur + boxShadow->spread);
+                    overflow.unite(shadowRect);
+                }
+
                 boxShadow = boxShadow->next;
             } while (boxShadow);
             backgroundRect.intersect(overflow);
@@ -2763,7 +2837,7 @@ IntRect RenderLayer::localBoundingBox() const
 {
     // There are three special cases we need to consider.
     // (1) Inline Flows.  For inline flows we will create a bounding box that fully encompasses all of the lines occupied by the
-    // inline.  In other words, if some <span> wraps to three lines, we'll create a bounding box that fully encloses the root
+    // inline.  In other words, if some <span> wraps to three lines, we'll create a bounding box that fully encloses the
     // line boxes of all three lines (including overflow on those lines).
     // (2) Left/Top Overflow.  The width/height of layers already includes right/bottom overflow.  However, in the case of left/top
     // overflow, we have to create a bounding box that will extend to include this overflow.
@@ -2777,8 +2851,8 @@ IntRect RenderLayer::localBoundingBox() const
         InlineFlowBox* firstBox = inlineFlow->firstLineBox();
         if (!firstBox)
             return result;
-        int top = firstBox->root()->topOverflow();
-        int bottom = inlineFlow->lastLineBox()->root()->bottomOverflow();
+        int top = firstBox->topVisibleOverflow();
+        int bottom = inlineFlow->lastLineBox()->bottomVisibleOverflow();
         int left = firstBox->x();
         for (InlineRunBox* curr = firstBox->nextLineBox(); curr; curr = curr->nextLineBox())
             left = min(left, curr->x());
@@ -2789,7 +2863,7 @@ IntRect RenderLayer::localBoundingBox() const
             if (child->isTableCell()) {
                 IntRect bbox = toRenderBox(child)->borderBoxRect();
                 result.unite(bbox);
-                IntRect overflowRect = renderBox()->overflowRect(false);
+                IntRect overflowRect = renderBox()->visibleOverflowRect();
                 if (bbox != overflowRect)
                     result.unite(overflowRect);
             }
@@ -2802,7 +2876,7 @@ IntRect RenderLayer::localBoundingBox() const
         else {
             IntRect bbox = box->borderBoxRect();
             result = bbox;
-            IntRect overflowRect = box->overflowRect(false);
+            IntRect overflowRect = box->visibleOverflowRect();
             if (bbox != overflowRect)
                 result.unite(overflowRect);
         }
@@ -2865,6 +2939,11 @@ void RenderLayer::clearBacking()
 {
     m_backing.clear();
 }
+
+bool RenderLayer::hasCompositedMask() const
+{
+    return m_backing && m_backing->hasMaskLayer();
+}
 #endif
 
 void RenderLayer::setParent(RenderLayer* parent)
@@ -3175,10 +3254,9 @@ void RenderLayer::styleChanged(StyleDifference diff, const RenderStyle*)
         m_marquee = 0;
     }
     
-    if (!hasReflection() && m_reflection) {
-        m_reflection->destroy();
-        m_reflection = 0;
-    } else if (hasReflection()) {
+    if (!hasReflection() && m_reflection)
+        removeReflection();
+    else if (hasReflection()) {
         if (!m_reflection)
             createReflection();
         updateReflectionStyle();
@@ -3211,7 +3289,7 @@ void RenderLayer::styleChanged(StyleDifference diff, const RenderStyle*)
 void RenderLayer::updateScrollCornerStyle()
 {
     RenderObject* actualRenderer = renderer()->node() ? renderer()->node()->shadowAncestorNode()->renderer() : renderer();
-    RefPtr<RenderStyle> corner = renderer()->hasOverflowClip() ? actualRenderer->getUncachedPseudoStyle(SCROLLBAR_CORNER, actualRenderer->style()) : PassRefPtr<RenderStyle>(0);
+    RefPtr<RenderStyle> corner = renderer()->hasOverflowClip() ? actualRenderer->getUncachedPseudoStyle(SCROLLBAR_CORNER, actualRenderer->style()) : 0;
     if (corner) {
         if (!m_scrollCorner) {
             m_scrollCorner = new (renderer()->renderArena()) RenderScrollbarPart(renderer()->document());
@@ -3227,7 +3305,7 @@ void RenderLayer::updateScrollCornerStyle()
 void RenderLayer::updateResizerStyle()
 {
     RenderObject* actualRenderer = renderer()->node() ? renderer()->node()->shadowAncestorNode()->renderer() : renderer();
-    RefPtr<RenderStyle> resizer = renderer()->hasOverflowClip() ? actualRenderer->getUncachedPseudoStyle(RESIZER, actualRenderer->style()) : PassRefPtr<RenderStyle>(0);
+    RefPtr<RenderStyle> resizer = renderer()->hasOverflowClip() ? actualRenderer->getUncachedPseudoStyle(RESIZER, actualRenderer->style()) : 0;
     if (resizer) {
         if (!m_resizer) {
             m_resizer = new (renderer()->renderArena()) RenderScrollbarPart(renderer()->document());
@@ -3252,6 +3330,16 @@ void RenderLayer::createReflection()
     m_reflection->setParent(renderer()); // We create a 1-way connection.
 }
 
+void RenderLayer::removeReflection()
+{
+    if (!m_reflection->documentBeingDestroyed())
+        m_reflection->removeLayers(this);
+
+    m_reflection->setParent(0);
+    m_reflection->destroy();
+    m_reflection = 0;
+}
+
 void RenderLayer::updateReflectionStyle()
 {
     RefPtr<RenderStyle> newStyle = RenderStyle::create();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.h b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.h
index 541002f..16ad4d4 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.h
@@ -298,7 +298,7 @@ public:
     enum UpdateLayerPositionsFlag {
         DoFullRepaint = 1,
         CheckForRepaint = 1 << 1,
-        UpdateCompositingLayers = 1 << 2
+        UpdateCompositingLayers = 1 << 2,
     };
     typedef unsigned UpdateLayerPositionsFlags;
     void updateLayerPositions(UpdateLayerPositionsFlags = DoFullRepaint | UpdateCompositingLayers);
@@ -415,11 +415,13 @@ public:
 
 #if USE(ACCELERATED_COMPOSITING)
     bool isComposited() const { return m_backing != 0; }
+    bool hasCompositedMask() const;
     RenderLayerBacking* backing() const { return m_backing.get(); }
     RenderLayerBacking* ensureBacking();
     void clearBacking();
 #else
     bool isComposited() const { return false; }
+    bool hasCompositedMask() const { return false; }
 #endif
 
     bool paintsWithTransparency() const
@@ -507,6 +509,8 @@ private:
     Node* enclosingElement() const;
 
     void createReflection();
+    void removeReflection();
+
     void updateReflectionStyle();
     bool paintingInsideReflection() const { return m_paintingInsideReflection; }
     void setPaintingInsideReflection(bool b) { m_paintingInsideReflection = b; }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp
index ce0ffb1..69a8f7d 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp
@@ -28,11 +28,13 @@
 #if USE(ACCELERATED_COMPOSITING)
 
 #include "AnimationController.h"
+#include "CanvasRenderingContext3D.h"
 #include "CSSPropertyNames.h"
 #include "CSSStyleSelector.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
 #include "GraphicsLayer.h"
+#include "HTMLCanvasElement.h"
 #include "HTMLElement.h"
 #include "HTMLNames.h"
 #include "RenderBox.h"
@@ -47,16 +49,14 @@ using namespace std;
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
 static bool hasBorderOutlineOrShadow(const RenderStyle*);
 static bool hasBoxDecorations(const RenderStyle*);
 static bool hasBoxDecorationsWithBackgroundImage(const RenderStyle*);
 
 RenderLayerBacking::RenderLayerBacking(RenderLayer* layer)
     : m_owningLayer(layer)
-    , m_ancestorClippingLayer(0)
-    , m_graphicsLayer(0)
-    , m_contentsLayer(0)
-    , m_clippingLayer(0)
     , m_hasDirectlyCompositedContent(false)
 {
     createGraphicsLayer();
@@ -65,13 +65,14 @@ RenderLayerBacking::RenderLayerBacking(RenderLayer* layer)
 RenderLayerBacking::~RenderLayerBacking()
 {
     updateClippingLayers(false, false);
-    updateContentsLayer(false);
+    updateForegroundLayer(false);
+    updateMaskLayer(false);
     destroyGraphicsLayer();
 }
 
 void RenderLayerBacking::createGraphicsLayer()
 {
-    m_graphicsLayer = GraphicsLayer::createGraphicsLayer(this);
+    m_graphicsLayer = GraphicsLayer::create(this);
     
 #ifndef NDEBUG
     if (renderer()->node()) {
@@ -79,7 +80,7 @@ void RenderLayerBacking::createGraphicsLayer()
             m_graphicsLayer->setName("Document Node");
         else {
             if (renderer()->node()->isHTMLElement() && renderer()->node()->hasID())
-                m_graphicsLayer->setName(renderer()->renderName() + String(" ") + static_cast<HTMLElement*>(renderer()->node())->id());
+                m_graphicsLayer->setName(renderer()->renderName() + String(" ") + static_cast<HTMLElement*>(renderer()->node())->getAttribute(idAttr));
             else
                 m_graphicsLayer->setName(renderer()->renderName());
         }
@@ -96,19 +97,15 @@ void RenderLayerBacking::destroyGraphicsLayer()
     if (m_graphicsLayer)
         m_graphicsLayer->removeFromParent();
 
-    delete m_graphicsLayer;
     m_graphicsLayer = 0;
-
-    delete m_contentsLayer;
-    m_contentsLayer = 0;
-
-    delete m_clippingLayer;
+    m_foregroundLayer = 0;
     m_clippingLayer = 0;
+    m_maskLayer = 0;
 }
 
 void RenderLayerBacking::updateLayerOpacity()
 {
-    m_graphicsLayer->setOpacity(compositingOpacity(renderer()->opacity()), 0, 0);
+    m_graphicsLayer->setOpacity(compositingOpacity(renderer()->opacity()));
 }
 
 void RenderLayerBacking::updateLayerTransform()
@@ -152,12 +149,15 @@ bool RenderLayerBacking::updateGraphicsLayerConfiguration()
     RenderLayerCompositor* compositor = this->compositor();
 
     bool layerConfigChanged = false;
-    if (updateContentsLayer(compositor->needsContentsCompositingLayer(m_owningLayer)))
+    if (updateForegroundLayer(compositor->needsContentsCompositingLayer(m_owningLayer)))
         layerConfigChanged = true;
     
     if (updateClippingLayers(compositor->clippedByAncestor(m_owningLayer), compositor->clipsCompositingDescendants(m_owningLayer)))
         layerConfigChanged = true;
 
+    if (updateMaskLayer(m_owningLayer->renderer()->hasMask()))
+        m_graphicsLayer->setMaskLayer(m_maskLayer.get());
+
     m_hasDirectlyCompositedContent = false;
     if (canUseDirectCompositing()) {
         if (renderer()->isImage()) {
@@ -165,6 +165,16 @@ bool RenderLayerBacking::updateGraphicsLayerConfiguration()
             m_hasDirectlyCompositedContent = true;
             m_graphicsLayer->setDrawsContent(false);
         }
+#if ENABLE(3D_CANVAS)    
+        else if (renderer()->isCanvas()) {
+            HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(renderer()->node());
+            if (canvas->is3D()) {
+                CanvasRenderingContext3D* context = static_cast<CanvasRenderingContext3D*>(canvas->renderingContext());
+                if (context->graphicsContext3D()->platformGraphicsContext3D())
+                    m_graphicsLayer->setContentsToGraphicsContext3D(context->graphicsContext3D());
+            }
+        }
+#endif
 
         if (rendererHasBackground())
             m_graphicsLayer->setBackgroundColor(rendererBackgroundColor());
@@ -251,13 +261,19 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
     }
 
     // If we have a layer that clips children, position it.
+    IntRect clippingBox;
     if (m_clippingLayer) {
-        IntRect clippingBox = toRenderBox(renderer())->overflowClipRect(0, 0);
+        clippingBox = toRenderBox(renderer())->overflowClipRect(0, 0);
         m_clippingLayer->setPosition(FloatPoint() + (clippingBox.location() - localCompositingBounds.location()));
         m_clippingLayer->setSize(clippingBox.size());
         m_clippingLayer->setOffsetFromRenderer(clippingBox.location() - IntPoint());
     }
     
+    if (m_maskLayer) {
+        m_maskLayer->setSize(m_graphicsLayer->size());
+        m_maskLayer->setPosition(FloatPoint());
+    }
+    
     if (m_owningLayer->hasTransform()) {
         const IntRect borderBox = toRenderBox(renderer())->borderBoxRect();
 
@@ -292,31 +308,41 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
         m_graphicsLayer->setAnchorPoint(FloatPoint3D(0.5f, 0.5f, 0));
     }
 
-    if (m_contentsLayer) {
-        // The contents layer is always coincidental with the graphicsLayer for now.
-        m_contentsLayer->setPosition(IntPoint(0, 0));
-        m_contentsLayer->setSize(newSize);
-        m_contentsLayer->setOffsetFromRenderer(m_graphicsLayer->offsetFromRenderer());
+    if (m_foregroundLayer) {
+        FloatPoint foregroundPosition;
+        FloatSize foregroundSize = newSize;
+        IntSize foregroundOffset = m_graphicsLayer->offsetFromRenderer();
+        // If we have a clipping layer (which clips descendants), then the foreground layer is a child of it,
+        // so that it gets correctly sorted with children. In that case, position relative to the clipping layer.
+        if (m_clippingLayer) {
+            foregroundPosition = FloatPoint() + (localCompositingBounds.location() - clippingBox.location());
+            foregroundSize = FloatSize(clippingBox.size());
+            foregroundOffset = clippingBox.location() - IntPoint();
+        }
+
+        m_foregroundLayer->setPosition(foregroundPosition);
+        m_foregroundLayer->setSize(foregroundSize);
+        m_foregroundLayer->setOffsetFromRenderer(foregroundOffset);
     }
 
-    m_graphicsLayer->updateContentsRect();
+    m_graphicsLayer->setContentsRect(contentsBox());
     if (!m_hasDirectlyCompositedContent)
         m_graphicsLayer->setDrawsContent(!isSimpleContainerCompositingLayer() && !paintingGoesToWindow());
 }
 
 void RenderLayerBacking::updateInternalHierarchy()
 {
-    // m_contentsLayer has to be inserted in the correct order with child layers,
+    // m_foregroundLayer has to be inserted in the correct order with child layers,
     // so it's not inserted here.
     if (m_ancestorClippingLayer) {
         m_ancestorClippingLayer->removeAllChildren();
         m_graphicsLayer->removeFromParent();
-        m_ancestorClippingLayer->addChild(m_graphicsLayer);
+        m_ancestorClippingLayer->addChild(m_graphicsLayer.get());
     }
 
     if (m_clippingLayer) {
         m_clippingLayer->removeFromParent();
-        m_graphicsLayer->addChild(m_clippingLayer);
+        m_graphicsLayer->addChild(m_clippingLayer.get());
     }
 }
 
@@ -327,7 +353,7 @@ bool RenderLayerBacking::updateClippingLayers(bool needsAncestorClip, bool needs
 
     if (needsAncestorClip) {
         if (!m_ancestorClippingLayer) {
-            m_ancestorClippingLayer = GraphicsLayer::createGraphicsLayer(this);
+            m_ancestorClippingLayer = GraphicsLayer::create(this);
 #ifndef NDEBUG
             m_ancestorClippingLayer->setName("Ancestor clipping Layer");
 #endif
@@ -336,14 +362,13 @@ bool RenderLayerBacking::updateClippingLayers(bool needsAncestorClip, bool needs
         }
     } else if (m_ancestorClippingLayer) {
         m_ancestorClippingLayer->removeFromParent();
-        delete m_ancestorClippingLayer;
         m_ancestorClippingLayer = 0;
         layersChanged = true;
     }
     
     if (needsDescendantClip) {
         if (!m_clippingLayer) {
-            m_clippingLayer = GraphicsLayer::createGraphicsLayer(0);
+            m_clippingLayer = GraphicsLayer::create(0);
 #ifndef NDEBUG
             m_clippingLayer->setName("Child clipping Layer");
 #endif
@@ -352,7 +377,6 @@ bool RenderLayerBacking::updateClippingLayers(bool needsAncestorClip, bool needs
         }
     } else if (m_clippingLayer) {
         m_clippingLayer->removeFromParent();
-        delete m_clippingLayer;
         m_clippingLayer = 0;
         layersChanged = true;
     }
@@ -363,30 +387,66 @@ bool RenderLayerBacking::updateClippingLayers(bool needsAncestorClip, bool needs
     return layersChanged;
 }
 
-bool RenderLayerBacking::updateContentsLayer(bool needsContentsLayer)
+bool RenderLayerBacking::updateForegroundLayer(bool needsForegroundLayer)
+{
+    bool layerChanged = false;
+    if (needsForegroundLayer) {
+        if (!m_foregroundLayer) {
+            m_foregroundLayer = GraphicsLayer::create(this);
+#ifndef NDEBUG
+            m_foregroundLayer->setName("Foreground");
+#endif
+            m_foregroundLayer->setDrawsContent(true);
+            m_foregroundLayer->setPaintingPhase(GraphicsLayerPaintForeground);
+            layerChanged = true;
+        }
+    } else if (m_foregroundLayer) {
+        m_foregroundLayer->removeFromParent();
+        m_foregroundLayer = 0;
+        layerChanged = true;
+    }
+
+    if (layerChanged)
+        m_graphicsLayer->setPaintingPhase(paintingPhaseForPrimaryLayer());
+
+    return layerChanged;
+}
+
+bool RenderLayerBacking::updateMaskLayer(bool needsMaskLayer)
 {
     bool layerChanged = false;
-    if (needsContentsLayer) {
-        if (!m_contentsLayer) {
-            m_contentsLayer = GraphicsLayer::createGraphicsLayer(this);
+    if (needsMaskLayer) {
+        if (!m_maskLayer) {
+            m_maskLayer = GraphicsLayer::create(this);
 #ifndef NDEBUG
-            m_contentsLayer->setName("Contents");
+            m_maskLayer->setName("Mask");
 #endif
-            m_contentsLayer->setDrawsContent(true);
-            m_contentsLayer->setDrawingPhase(GraphicsLayerPaintForegroundMask);
-            m_graphicsLayer->setDrawingPhase(GraphicsLayerPaintBackgroundMask);
+            m_maskLayer->setDrawsContent(true);
+            m_maskLayer->setPaintingPhase(GraphicsLayerPaintMask);
             layerChanged = true;
         }
-    } else if (m_contentsLayer) {
-        m_contentsLayer->removeFromParent();
-        delete m_contentsLayer;
-        m_contentsLayer = 0;
-        m_graphicsLayer->setDrawingPhase(GraphicsLayerPaintAllMask);
+    } else if (m_maskLayer) {
+        m_maskLayer = 0;
         layerChanged = true;
     }
+
+    if (layerChanged)
+        m_graphicsLayer->setPaintingPhase(paintingPhaseForPrimaryLayer());
+
     return layerChanged;
 }
 
+GraphicsLayerPaintingPhase RenderLayerBacking::paintingPhaseForPrimaryLayer() const
+{
+    unsigned phase = GraphicsLayerPaintBackground;
+    if (!m_foregroundLayer)
+        phase |= GraphicsLayerPaintForeground;
+    if (!m_maskLayer)
+        phase |= GraphicsLayerPaintMask;
+
+    return static_cast<GraphicsLayerPaintingPhase>(phase);
+}
+
 float RenderLayerBacking::compositingOpacity(float rendererOpacity) const
 {
     float finalOpacity = rendererOpacity;
@@ -500,7 +560,7 @@ bool RenderLayerBacking::isSimpleContainerCompositingLayer() const
         
         // Now look at the body's renderer.
         HTMLElement* body = renderObject->document()->body();
-        RenderObject* bodyObject = (body && body->hasLocalName(HTMLNames::bodyTag)) ? body->renderer() : 0;
+        RenderObject* bodyObject = (body && body->hasLocalName(bodyTag)) ? body->renderer() : 0;
         if (!bodyObject)
             return false;
         
@@ -582,6 +642,14 @@ bool RenderLayerBacking::canUseDirectCompositing() const
 {
     RenderObject* renderObject = renderer();
     
+    // Canvas3D is always direct composited
+#if ENABLE(3D_CANVAS)    
+    if (renderer()->isCanvas()) {
+        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(renderer()->node());
+        return canvas->is3D();
+    }
+#endif
+
     // Reject anything that isn't an image
     if (!renderObject->isImage() && !renderObject->isVideo())
         return false;
@@ -600,14 +668,25 @@ bool RenderLayerBacking::canUseDirectCompositing() const
     
 void RenderLayerBacking::rendererContentChanged()
 {
-    if (canUseDirectCompositing() && renderer()->isImage())
-        updateImageContents();
+    if (canUseDirectCompositing()) {
+        if (renderer()->isImage())
+            updateImageContents();
+        else {
+#if ENABLE(3D_CANVAS)    
+            if (renderer()->isCanvas()) {
+                HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(renderer()->node());
+                if (canvas->is3D())
+                    m_graphicsLayer->setGraphicsContext3DNeedsDisplay();
+            }
+#endif
+        }
+    }
 }
 
 void RenderLayerBacking::updateImageContents()
 {
     ASSERT(renderer()->isImage());
-    RenderImage* imageRenderer = static_cast<RenderImage*>(renderer());
+    RenderImage* imageRenderer = toRenderImage(renderer());
 
     CachedImage* cachedImage = imageRenderer->cachedImage();
     if (!cachedImage)
@@ -657,12 +736,12 @@ FloatPoint RenderLayerBacking::computePerspectiveOrigin(const IntRect& borderBox
 }
 
 // Return the offset from the top-left of this compositing layer at which the renderer's contents are painted.
-IntSize RenderLayerBacking::contentOffsetInCompostingLayer()
+IntSize RenderLayerBacking::contentOffsetInCompostingLayer() const
 {
     return IntSize(-m_compositedBounds.x(), -m_compositedBounds.y());
 }
 
-IntRect RenderLayerBacking::contentsBox(const GraphicsLayer*)
+IntRect RenderLayerBacking::contentsBox() const
 {
     if (!renderer()->isBox())
         return IntRect();
@@ -670,7 +749,7 @@ IntRect RenderLayerBacking::contentsBox(const GraphicsLayer*)
     IntRect contentsRect;
 #if ENABLE(VIDEO)
     if (renderer()->isVideo()) {
-        RenderVideo* videoRenderer = static_cast<RenderVideo*>(renderer());
+        RenderVideo* videoRenderer = toRenderVideo(renderer());
         contentsRect = videoRenderer->videoBox();
     } else
 #endif
@@ -700,47 +779,36 @@ bool RenderLayerBacking::paintingGoesToWindow() const
 
 void RenderLayerBacking::setContentsNeedDisplay()
 {
-    bool needViewUpdate = false;
-
-    if (m_graphicsLayer && m_graphicsLayer->drawsContent()) {
+    if (m_graphicsLayer && m_graphicsLayer->drawsContent())
         m_graphicsLayer->setNeedsDisplay();
-        needViewUpdate = true;
-    }
-    
-    if (m_contentsLayer && m_contentsLayer->drawsContent()) {
-        m_contentsLayer->setNeedsDisplay();
-        needViewUpdate = true;
-    }
     
-    // Make sure layout happens before we get rendered again.
-    if (needViewUpdate)
-        compositor()->scheduleViewUpdate();
+    if (m_foregroundLayer && m_foregroundLayer->drawsContent())
+        m_foregroundLayer->setNeedsDisplay();
+
+    if (m_maskLayer && m_maskLayer->drawsContent())
+        m_maskLayer->setNeedsDisplay();
 }
 
 // r is in the coordinate space of the layer's render object
 void RenderLayerBacking::setContentsNeedDisplayInRect(const IntRect& r)
 {
-    bool needViewUpdate = false;
-
     if (m_graphicsLayer && m_graphicsLayer->drawsContent()) {
-        FloatPoint dirtyOrigin = contentsToGraphicsLayerCoordinates(m_graphicsLayer, FloatPoint(r.x(), r.y()));
+        FloatPoint dirtyOrigin = contentsToGraphicsLayerCoordinates(m_graphicsLayer.get(), FloatPoint(r.x(), r.y()));
         FloatRect dirtyRect(dirtyOrigin, r.size());
         FloatRect bounds(FloatPoint(), m_graphicsLayer->size());
-        if (bounds.intersects(dirtyRect)) {
+        if (bounds.intersects(dirtyRect))
             m_graphicsLayer->setNeedsDisplayInRect(dirtyRect);
-            needViewUpdate = true;
-        }
     }
 
-    if (m_contentsLayer && m_contentsLayer->drawsContent()) {
+    if (m_foregroundLayer && m_foregroundLayer->drawsContent()) {
         // FIXME: do incremental repaint
-        m_contentsLayer->setNeedsDisplay();
-        needViewUpdate = true;
+        m_foregroundLayer->setNeedsDisplay();
     }
 
-    // Make sure layout happens before we get rendered again.
-    if (needViewUpdate)
-        compositor()->scheduleViewUpdate();
+    if (m_maskLayer && m_maskLayer->drawsContent()) {
+        // FIXME: do incremental repaint
+        m_maskLayer->setNeedsDisplay();
+    }
 }
 
 static void setClip(GraphicsContext* p, const IntRect& paintDirtyRect, const IntRect& clipRect)
@@ -798,7 +866,7 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
 
     bool shouldPaint = m_owningLayer->hasVisibleContent() && m_owningLayer->isSelfPaintingLayer();
 
-    if (shouldPaint && (paintingPhase & GraphicsLayerPaintBackgroundMask)) {
+    if (shouldPaint && (paintingPhase & GraphicsLayerPaintBackground)) {
         // If this is the root then we need to send in a bigger bounding box
         // because we'll be painting the background as well (see RenderBox::paintRootBoxDecorations()).
         IntRect paintBox = clipRectToApply;
@@ -842,7 +910,10 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
         restoreClip(context, paintDirtyRect, damageRect);
     }
                 
-    if (shouldPaint && (paintingPhase & GraphicsLayerPaintForegroundMask)) {
+    bool forceBlackText = paintRestriction == PaintRestrictionSelectionOnlyBlackText;
+    bool selectionOnly  = paintRestriction == PaintRestrictionSelectionOnly || paintRestriction == PaintRestrictionSelectionOnlyBlackText;
+
+    if (shouldPaint && (paintingPhase & GraphicsLayerPaintForeground)) {
         // Now walk the sorted list of children with negative z-indices. Only RenderLayers without compositing layers will paint.
         // FIXME: should these be painted as background?
         Vector<RenderLayer*>* negZOrderList = m_owningLayer->negZOrderList();
@@ -851,9 +922,6 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
                 it[0]->paintLayer(rootLayer, context, paintDirtyRect, paintRestriction, paintingRoot);
         }
 
-        bool forceBlackText = paintRestriction == PaintRestrictionSelectionOnlyBlackText;
-        bool selectionOnly  = paintRestriction == PaintRestrictionSelectionOnly || paintRestriction == PaintRestrictionSelectionOnlyBlackText;
-
         // Set up the clip used when painting our children.
         setClip(context, paintDirtyRect, clipRectToApply);
         RenderObject::PaintInfo paintInfo(context, clipRectToApply, 
@@ -896,7 +964,9 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
             for (Vector<RenderLayer*>::iterator it = posZOrderList->begin(); it != posZOrderList->end(); ++it)
                 it[0]->paintLayer(rootLayer, context, paintDirtyRect, paintRestriction, paintingRoot);
         }
-        
+    }
+    
+    if (shouldPaint && (paintingPhase & GraphicsLayerPaintMask)) {
         if (renderer()->hasMask() && !selectionOnly && !damageRect.isEmpty()) {
             setClip(context, paintDirtyRect, damageRect);
 
@@ -913,7 +983,7 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
 }
 
 // Up-call from compositing layer drawing callback.
-void RenderLayerBacking::paintContents(const GraphicsLayer*, GraphicsContext& context, GraphicsLayerPaintingPhase drawingPhase, const IntRect& clip)
+void RenderLayerBacking::paintContents(const GraphicsLayer*, GraphicsContext& context, GraphicsLayerPaintingPhase paintingPhase, const IntRect& clip)
 {
     // We have to use the same root as for hit testing, because both methods
     // can compute and cache clipRects.
@@ -931,7 +1001,7 @@ void RenderLayerBacking::paintContents(const GraphicsLayer*, GraphicsContext& co
     IntRect dirtyRect = enclosingBBox;
     dirtyRect.intersect(clipRect);
 
-    paintIntoLayer(m_owningLayer, &context, dirtyRect, PaintRestrictionNone, drawingPhase, renderer());
+    paintIntoLayer(m_owningLayer, &context, dirtyRect, PaintRestrictionNone, paintingPhase, renderer());
 }
 
 bool RenderLayerBacking::startAnimation(double beginTime, const Animation* anim, const KeyframeList& keyframes)
@@ -942,8 +1012,8 @@ bool RenderLayerBacking::startAnimation(double beginTime, const Animation* anim,
     if (!hasOpacity && !hasTransform)
         return false;
     
-    GraphicsLayer::TransformValueList transformVector;
-    GraphicsLayer::FloatValueList opacityVector;
+    KeyframeValueList transformVector(AnimatedPropertyWebkitTransform);
+    KeyframeValueList opacityVector(AnimatedPropertyOpacity);
 
     for (Vector<KeyframeValue>::const_iterator it = keyframes.beginKeyframes(); it != keyframes.endKeyframes(); ++it) {
         const RenderStyle* keyframeStyle = it->style();
@@ -956,19 +1026,19 @@ bool RenderLayerBacking::startAnimation(double beginTime, const Animation* anim,
         const TimingFunction* tf = keyframeStyle->hasAnimations() ? &((*keyframeStyle->animations()).animation(0)->timingFunction()) : 0;
         
         if (hasTransform)
-            transformVector.insert(key, &(keyframeStyle->transform()), tf);
-
+            transformVector.insert(new TransformAnimationValue(key, &(keyframeStyle->transform()), tf));
+        
         if (hasOpacity)
-            opacityVector.insert(key, keyframeStyle->opacity(), tf);
+            opacityVector.insert(new FloatAnimationValue(key, keyframeStyle->opacity(), tf));
     }
 
     bool didAnimateTransform = !hasTransform;
     bool didAnimateOpacity = !hasOpacity;
     
-    if (hasTransform && m_graphicsLayer->animateTransform(transformVector, toRenderBox(renderer())->borderBoxRect().size(), anim, beginTime, false))
+    if (hasTransform && m_graphicsLayer->addAnimation(transformVector, toRenderBox(renderer())->borderBoxRect().size(), anim, keyframes.animationName(), beginTime))
         didAnimateTransform = true;
 
-    if (hasOpacity && m_graphicsLayer->animateFloat(AnimatedPropertyOpacity, opacityVector, anim, beginTime))
+    if (hasOpacity && m_graphicsLayer->addAnimation(opacityVector, IntSize(), anim, keyframes.animationName(), beginTime))
         didAnimateOpacity = true;
     
     bool runningAcceleratedAnimation = didAnimateTransform && didAnimateOpacity;
@@ -986,26 +1056,21 @@ bool RenderLayerBacking::startTransition(double beginTime, int property, const R
     if (property == (int)CSSPropertyOpacity) {
         const Animation* opacityAnim = toStyle->transitionForProperty(CSSPropertyOpacity);
         if (opacityAnim && !opacityAnim->isEmptyOrZeroDuration()) {
-            // If beginTime is not 0, we are restarting this transition, so first set the from value
-            // in case it was smashed by a previous animation.
-            if (beginTime > 0)
-                m_graphicsLayer->setOpacity(compositingOpacity(fromStyle->opacity()), 0, 0);
-
-            if (m_graphicsLayer->setOpacity(compositingOpacity(toStyle->opacity()), opacityAnim, beginTime))
+            KeyframeValueList opacityVector(AnimatedPropertyOpacity);
+            opacityVector.insert(new FloatAnimationValue(0, compositingOpacity(fromStyle->opacity())));
+            opacityVector.insert(new FloatAnimationValue(1, compositingOpacity(toStyle->opacity())));
+            if (m_graphicsLayer->addAnimation(opacityVector, toRenderBox(renderer())->borderBoxRect().size(), opacityAnim, String(), beginTime))
                 didAnimate = true;
         }
     }
 
     if (property == (int)CSSPropertyWebkitTransform && m_owningLayer->hasTransform()) {
-        // We get a TransformOperation, which is a linked list of primitive operations and their arguments.
-        // Arguments can be floats or Length values, which need to be converted to numbers using
-        // val.calcFloatValue(renderer()->width()) (or height()).
         const Animation* transformAnim = toStyle->transitionForProperty(CSSPropertyWebkitTransform);
         if (transformAnim && !transformAnim->isEmptyOrZeroDuration()) {
-            GraphicsLayer::TransformValueList transformVector;
-            transformVector.insert(0, &fromStyle->transform(), 0);        
-            transformVector.insert(1, &toStyle->transform(), 0);        
-            if (m_graphicsLayer->animateTransform(transformVector, toRenderBox(renderer())->borderBoxRect().size(), transformAnim, beginTime, true))
+            KeyframeValueList transformVector(AnimatedPropertyWebkitTransform);
+            transformVector.insert(new TransformAnimationValue(0, &fromStyle->transform()));
+            transformVector.insert(new TransformAnimationValue(1, &toStyle->transform()));
+            if (m_graphicsLayer->addAnimation(transformVector, toRenderBox(renderer())->borderBoxRect().size(), transformAnim, String(), beginTime))
                 didAnimate = true;
         }
     }
@@ -1021,21 +1086,32 @@ void RenderLayerBacking::notifyAnimationStarted(const GraphicsLayer*, double tim
     renderer()->animation()->notifyAnimationStarted(renderer(), time);
 }
 
-void RenderLayerBacking::animationFinished(const String& name, int index, bool reset)
+void RenderLayerBacking::notifySyncRequired(const GraphicsLayer*)
+{
+    if (!renderer()->documentBeingDestroyed())
+        compositor()->scheduleSync();
+}
+
+void RenderLayerBacking::animationFinished(const String& animationName)
+{
+    m_graphicsLayer->removeAnimationsForKeyframes(animationName);
+}
+
+void RenderLayerBacking::animationPaused(const String& animationName)
 {
-    m_graphicsLayer->removeFinishedAnimations(name, index, reset);
+    m_graphicsLayer->pauseAnimation(animationName);
 }
 
 void RenderLayerBacking::transitionFinished(int property)
 {
     AnimatedPropertyID animatedProperty = cssToGraphicsLayerProperty(property);
     if (animatedProperty != AnimatedPropertyInvalid)
-        m_graphicsLayer->removeFinishedTransitions(animatedProperty);
+        m_graphicsLayer->removeAnimationsForProperty(animatedProperty);
 }
 
-void RenderLayerBacking::suspendAnimations()
+void RenderLayerBacking::suspendAnimations(double time)
 {
-    m_graphicsLayer->suspendAnimations();
+    m_graphicsLayer->suspendAnimations(time);
 }
 
 void RenderLayerBacking::resumeAnimations()
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.h b/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.h
index 25b1a31..731e741 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.h
@@ -63,21 +63,23 @@ public:
     // Update contents and clipping structure.
     void updateInternalHierarchy(); // make private
     
-    GraphicsLayer* graphicsLayer() const { return m_graphicsLayer; }
+    GraphicsLayer* graphicsLayer() const { return m_graphicsLayer.get(); }
 
     // Layer to clip children
     bool hasClippingLayer() const { return m_clippingLayer != 0; }
-    GraphicsLayer* clippingLayer() const { return m_clippingLayer; }
+    GraphicsLayer* clippingLayer() const { return m_clippingLayer.get(); }
 
     // Layer to get clipped by ancestor
     bool hasAncestorClippingLayer() const { return m_ancestorClippingLayer != 0; }
-    GraphicsLayer* ancestorClippingLayer() const { return m_ancestorClippingLayer; }
+    GraphicsLayer* ancestorClippingLayer() const { return m_ancestorClippingLayer.get(); }
 
-    bool hasContentsLayer() const { return m_contentsLayer != 0; }
-    GraphicsLayer* contentsLayer() const { return m_contentsLayer; }
+    bool hasContentsLayer() const { return m_foregroundLayer != 0; }
+    GraphicsLayer* foregroundLayer() const { return m_foregroundLayer.get(); }
     
-    GraphicsLayer* parentForSublayers() const { return m_clippingLayer ? m_clippingLayer : m_graphicsLayer; }
-    GraphicsLayer* childForSuperlayers() const { return m_ancestorClippingLayer ? m_ancestorClippingLayer : m_graphicsLayer; }
+    bool hasMaskLayer() const { return m_maskLayer != 0; }
+
+    GraphicsLayer* parentForSublayers() const { return m_clippingLayer ? m_clippingLayer.get() : m_graphicsLayer.get(); }
+    GraphicsLayer* childForSuperlayers() const { return m_ancestorClippingLayer ? m_ancestorClippingLayer.get() : m_graphicsLayer.get(); }
 
     // RenderLayers with backing normally short-circuit paintLayer() because
     // their content is rendered via callbacks from GraphicsLayer. However, the document
@@ -97,10 +99,11 @@ public:
     // Interface to start, finish, suspend and resume animations and transitions
     bool startAnimation(double beginTime, const Animation* anim, const KeyframeList& keyframes);
     bool startTransition(double beginTime, int property, const RenderStyle* fromStyle, const RenderStyle* toStyle);
-    void animationFinished(const String& name, int index, bool reset);
+    void animationFinished(const String& name);
+    void animationPaused(const String& name);
     void transitionFinished(int property);
 
-    void suspendAnimations();
+    void suspendAnimations(double time = 0);
     void resumeAnimations();
 
     IntRect compositedBounds() const;
@@ -111,10 +114,11 @@ public:
 
     // GraphicsLayerClient interface
     virtual void notifyAnimationStarted(const GraphicsLayer*, double startTime);
+    virtual void notifySyncRequired(const GraphicsLayer*);
 
     virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const IntRect& clip);
 
-    virtual IntRect contentsBox(const GraphicsLayer*);
+    IntRect contentsBox() const;
     
 private:
     void createGraphicsLayer();
@@ -124,9 +128,12 @@ private:
     RenderLayerCompositor* compositor() const { return m_owningLayer->compositor(); }
 
     bool updateClippingLayers(bool needsAncestorClip, bool needsDescendantClip);
-    bool updateContentsLayer(bool needsContentsLayer);
+    bool updateForegroundLayer(bool needsForegroundLayer);
+    bool updateMaskLayer(bool needsMaskLayer);
 
-    IntSize contentOffsetInCompostingLayer();
+    GraphicsLayerPaintingPhase paintingPhaseForPrimaryLayer() const;
+    
+    IntSize contentOffsetInCompostingLayer() const;
     // Result is transform origin in pixels.
     FloatPoint3D computeTransformOrigin(const IntRect& borderBox) const;
     // Result is perspective origin in pixels.
@@ -160,10 +167,11 @@ private:
 private:
     RenderLayer* m_owningLayer;
 
-    GraphicsLayer* m_ancestorClippingLayer; // only used if we are clipped by an ancestor which is not a stacking context
-    GraphicsLayer* m_graphicsLayer;
-    GraphicsLayer* m_contentsLayer;         // only used in cases where we need to draw the foreground separately
-    GraphicsLayer* m_clippingLayer;         // only used if we have clipping on a stacking context, with compositing children
+    OwnPtr<GraphicsLayer> m_ancestorClippingLayer; // only used if we are clipped by an ancestor which is not a stacking context
+    OwnPtr<GraphicsLayer> m_graphicsLayer;
+    OwnPtr<GraphicsLayer> m_foregroundLayer;       // only used in cases where we need to draw the foreground separately
+    OwnPtr<GraphicsLayer> m_clippingLayer;         // only used if we have clipping on a stacking context, with compositing children
+    OwnPtr<GraphicsLayer> m_maskLayer;             // only used if we have a mask
 
     IntRect m_compositedBounds;
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp
index b7bccaa..65a9c4a 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp
@@ -34,8 +34,8 @@
 #include "Frame.h"
 #include "FrameView.h"
 #include "GraphicsLayer.h"
-#include "HitTestRequest.h"
 #include "HitTestResult.h"
+#include "HTMLCanvasElement.h"
 #include "Page.h"
 #include "RenderLayerBacking.h"
 #include "RenderVideo.h"
@@ -92,7 +92,6 @@ RenderLayerCompositor::RenderLayerCompositor(RenderView* renderView)
 RenderLayerCompositor::~RenderLayerCompositor()
 {
     ASSERT(!m_rootLayerAttached);
-    delete m_rootPlatformLayer;
 }
 
 void RenderLayerCompositor::enableCompositingMode(bool enable /* = true */)
@@ -124,22 +123,18 @@ void RenderLayerCompositor::cacheAcceleratedCompositingEnabledFlag()
 
 void RenderLayerCompositor::setCompositingLayersNeedRebuild(bool needRebuild)
 {
-    if (inCompositingMode()) {
-        if (!m_compositingLayersNeedRebuild && needRebuild)
-            scheduleViewUpdate();
-
+    if (inCompositingMode())
         m_compositingLayersNeedRebuild = needRebuild;
-    }
 }
 
-void RenderLayerCompositor::scheduleViewUpdate()
+void RenderLayerCompositor::scheduleSync()
 {
     Frame* frame = m_renderView->frameView()->frame();
     Page* page = frame ? frame->page() : 0;
     if (!page)
         return;
 
-    page->chrome()->client()->scheduleViewUpdate();
+    page->chrome()->client()->scheduleCompositingLayerSync();
 }
 
 void RenderLayerCompositor::updateCompositingLayers(RenderLayer* updateRoot)
@@ -236,7 +231,7 @@ bool RenderLayerCompositor::updateBacking(RenderLayer* layer, CompositingChangeR
 #if ENABLE(VIDEO)
     if (layerChanged && layer->renderer()->isVideo()) {
         // If it's a video, give the media player a chance to hook up to the layer.
-        RenderVideo* video = static_cast<RenderVideo*>(layer->renderer());
+        RenderVideo* video = toRenderVideo(layer->renderer());
         video->acceleratedRenderingStateChanged();
     }
 #endif
@@ -257,6 +252,10 @@ bool RenderLayerCompositor::updateLayerCompositingState(RenderLayer* layer, Comp
 
 void RenderLayerCompositor::repaintOnCompositingChange(RenderLayer* layer)
 {
+    // If the renderer is not attached yet, no need to repaint.
+    if (!layer->renderer()->parent())
+        return;
+
     RenderBoxModelObject* repaintContainer = layer->renderer()->containerForRepaint();
     if (!repaintContainer)
         repaintContainer = m_renderView;
@@ -287,6 +286,13 @@ IntRect RenderLayerCompositor::calculateCompositedBounds(const RenderLayer* laye
         return boundingBoxRect;
     }
 
+    if (RenderLayer* reflection = layer->reflectionLayer()) {
+        if (!reflection->isComposited()) {
+            IntRect childUnionBounds = calculateCompositedBounds(reflection, layer);
+            unionBounds.unite(childUnionBounds);
+        }
+    }
+    
     ASSERT(layer->isStackingContext() || (!layer->m_posZOrderList || layer->m_posZOrderList->size() == 0));
 
     if (Vector<RenderLayer*>* negZOrderList = layer->negZOrderList()) {
@@ -503,8 +509,7 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
     // If we have a software transform, and we have layers under us, we need to also
     // be composited. Also, if we have opacity < 1, then we need to be a layer so that
     // the child layers are opaque, then rendered with opacity on this layer.
-    if (childState.m_subtreeIsCompositing &&
-        (layer->renderer()->hasTransform() || layer->renderer()->style()->opacity() < 1)) {
+    if (childState.m_subtreeIsCompositing && requiresCompositingWhenDescendantsAreCompositing(layer->renderer())) {
         layer->setMustOverlapCompositedLayers(true);
         if (overlapMap)
             addToOverlapMap(*overlapMap, layer, absBounds, haveComputedBounds);
@@ -573,7 +578,7 @@ bool RenderLayerCompositor::canAccelerateVideoRendering(RenderVideo* o) const
 {
     // FIXME: ideally we need to look at all ancestors for mask or video. But for now,
     // just bail on the obvious cases.
-    if (o->hasMask() || o->hasReflection() || !m_hasAcceleratedCompositing)
+    if (o->hasReflection() || !m_hasAcceleratedCompositing)
         return false;
 
     return o->supportsAcceleratedRendering();
@@ -631,12 +636,12 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, stru
             }
         }
 
-        if (updateHierarchy && layerBacking && layerBacking->contentsLayer()) {
-            // we only have a contents layer if we have an m_layer
-            layerBacking->contentsLayer()->removeFromParent();
-
-            GraphicsLayer* hostingLayer = layerBacking->clippingLayer() ? layerBacking->clippingLayer() : layerBacking->graphicsLayer();
-            hostingLayer->addChild(layerBacking->contentsLayer());
+        if (updateHierarchy && layerBacking && layerBacking->foregroundLayer()) {
+            layerBacking->foregroundLayer()->removeFromParent();
+            
+            // The foreground layer has to be correctly sorted with child layers, so needs to become a child of the clipping layer.
+            GraphicsLayer* hostingLayer = layerBacking->parentForSublayers();
+            hostingLayer->addChild(layerBacking->foregroundLayer());
         }
     }
 
@@ -759,7 +764,7 @@ RenderLayer* RenderLayerCompositor::rootRenderLayer() const
 
 GraphicsLayer* RenderLayerCompositor::rootPlatformLayer() const
 {
-    return m_rootPlatformLayer;
+    return m_rootPlatformLayer.get();
 }
 
 void RenderLayerCompositor::didMoveOnscreen()
@@ -772,7 +777,7 @@ void RenderLayerCompositor::didMoveOnscreen()
     if (!page)
         return;
 
-    page->chrome()->client()->attachRootGraphicsLayer(frame, m_rootPlatformLayer);
+    page->chrome()->client()->attachRootGraphicsLayer(frame, m_rootPlatformLayer.get());
     m_rootLayerAttached = true;
 }
 
@@ -793,7 +798,7 @@ void RenderLayerCompositor::willMoveOffscreen()
 void RenderLayerCompositor::updateRootLayerPosition()
 {
     if (m_rootPlatformLayer)
-        m_rootPlatformLayer->setSize(FloatSize(m_renderView->overflowWidth(), m_renderView->overflowHeight()));
+        m_rootPlatformLayer->setSize(FloatSize(m_renderView->rightLayoutOverflow(), m_renderView->bottomLayoutOverflow()));
 }
 
 void RenderLayerCompositor::didStartAcceleratedAnimation()
@@ -821,11 +826,12 @@ bool RenderLayerCompositor::needsToBeComposited(const RenderLayer* layer) const
 // Use needsToBeComposited() to determine if a RL actually needs a compositing layer.
 // static
 bool RenderLayerCompositor::requiresCompositingLayer(const RenderLayer* layer) const
-{
+{    
     // The root layer always has a compositing layer, but it may not have backing.
     return (inCompositingMode() && layer->isRootLayer()) ||
              requiresCompositingForTransform(layer->renderer()) ||
              requiresCompositingForVideo(layer->renderer()) ||
+             requiresCompositingForCanvas(layer->renderer()) ||
              layer->renderer()->style()->backfaceVisibility() == BackfaceVisibilityHidden ||
              clipsCompositingDescendants(layer) ||
              requiresCompositingForAnimation(layer->renderer());
@@ -890,13 +896,26 @@ bool RenderLayerCompositor::requiresCompositingForVideo(RenderObject* renderer)
 {
 #if ENABLE(VIDEO)
     if (renderer->isVideo()) {
-        RenderVideo* video = static_cast<RenderVideo*>(renderer);
+        RenderVideo* video = toRenderVideo(renderer);
         return canAccelerateVideoRendering(video);
     }
 #endif
     return false;
 }
 
+bool RenderLayerCompositor::requiresCompositingForCanvas(RenderObject* renderer) const
+{
+#if ENABLE(3D_CANVAS)    
+    if (renderer->isCanvas()) {
+        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(renderer->node());
+        return canvas->is3D();
+    }
+#else
+    UNUSED_PARAM(renderer);
+#endif
+    return false;
+}
+
 bool RenderLayerCompositor::requiresCompositingForAnimation(RenderObject* renderer) const
 {
     if (AnimationController* animController = renderer->animation()) {
@@ -906,6 +925,11 @@ bool RenderLayerCompositor::requiresCompositingForAnimation(RenderObject* render
     return false;
 }
 
+bool RenderLayerCompositor::requiresCompositingWhenDescendantsAreCompositing(RenderObject* renderer) const
+{
+    return renderer->hasTransform() || renderer->isTransparent() || renderer->hasMask();
+}
+
 // If an element has negative z-index children, those children render in front of the 
 // layer background, so we need an extra 'contents' layer for the foreground of the layer
 // object.
@@ -919,8 +943,8 @@ void RenderLayerCompositor::ensureRootPlatformLayer()
     if (m_rootPlatformLayer)
         return;
 
-    m_rootPlatformLayer = GraphicsLayer::createGraphicsLayer(0);
-    m_rootPlatformLayer->setSize(FloatSize(m_renderView->overflowWidth(), m_renderView->overflowHeight()));
+    m_rootPlatformLayer = GraphicsLayer::create(0);
+    m_rootPlatformLayer->setSize(FloatSize(m_renderView->rightLayoutOverflow(), m_renderView->bottomLayoutOverflow()));
     m_rootPlatformLayer->setPosition(FloatPoint(0, 0));
     // The root layer does flipping if we need it on this platform.
     m_rootPlatformLayer->setGeometryOrientation(GraphicsLayer::compositingCoordinatesOrientation());
@@ -937,7 +961,6 @@ void RenderLayerCompositor::destroyRootPlatformLayer()
         return;
 
     willMoveOffscreen();
-    delete m_rootPlatformLayer;
     m_rootPlatformLayer = 0;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.h b/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.h
index 778eccc..a809a70 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.h
@@ -64,7 +64,7 @@ public:
     // Copy the acceleratedCompositingEnabledFlag from Settings
     void cacheAcceleratedCompositingEnabledFlag();
 
-    // Called when the layer hierarchy needs to be udpated (compositing layers have been
+    // Called when the layer hierarchy needs to be updated (compositing layers have been
     // created, destroyed or re-parented).
     void setCompositingLayersNeedRebuild(bool needRebuild = true);
     bool compositingLayersNeedRebuild() const { return m_compositingLayersNeedRebuild; }
@@ -74,7 +74,7 @@ public:
     void setCompositingConsultsOverlap(bool b) { m_compositingConsultsOverlap = b; }
     bool compositingConsultsOverlap() const { return m_compositingConsultsOverlap; }
     
-    void scheduleViewUpdate();
+    void scheduleSync();
     
     // Rebuild the tree of compositing layers
     void updateCompositingLayers(RenderLayer* updateRoot = 0);
@@ -164,10 +164,12 @@ private:
     bool requiresCompositingForAnimation(RenderObject*) const;
     bool requiresCompositingForTransform(RenderObject*) const;
     bool requiresCompositingForVideo(RenderObject*) const;
+    bool requiresCompositingForCanvas(RenderObject*) const;
+    bool requiresCompositingWhenDescendantsAreCompositing(RenderObject*) const;
 
 private:
     RenderView* m_renderView;
-    GraphicsLayer* m_rootPlatformLayer;
+    OwnPtr<GraphicsLayer> m_rootPlatformLayer;
     bool m_hasAcceleratedCompositing;
     bool m_compositingConsultsOverlap;
     bool m_compositing;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLineBoxList.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderLineBoxList.cpp
index 00566b8..76a2e2f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLineBoxList.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLineBoxList.cpp
@@ -162,8 +162,8 @@ void RenderLineBoxList::paint(RenderBoxModelObject* renderer, RenderObject::Pain
     // intersect.  This is a quick short-circuit that we can take to avoid walking any lines.
     // FIXME: This check is flawed in the following extremely obscure way:
     // if some line in the middle has a huge overflow, it might actually extend below the last line.
-    int yPos = firstLineBox()->root()->topOverflow() - renderer->maximalOutlineSize(paintInfo.phase);
-    int h = renderer->maximalOutlineSize(paintInfo.phase) + lastLineBox()->root()->bottomOverflow() - yPos;
+    int yPos = firstLineBox()->topVisibleOverflow() - renderer->maximalOutlineSize(paintInfo.phase);
+    int h = renderer->maximalOutlineSize(paintInfo.phase) + lastLineBox()->bottomVisibleOverflow() - yPos;
     yPos += ty;
     if (yPos >= paintInfo.rect.bottom() || yPos + h <= paintInfo.rect.y())
         return;
@@ -184,19 +184,19 @@ void RenderLineBoxList::paint(RenderBoxModelObject* renderer, RenderObject::Pain
             // The whole way objects break across pages needs to be redone.
             // Try to avoid splitting a line vertically, but only if it's less than the height
             // of the entire page.
-            if (curr->root()->bottomOverflow() - curr->root()->topOverflow() <= v->printRect().height()) {
-                if (ty + curr->root()->bottomOverflow() > v->printRect().bottom()) {
-                    if (ty + curr->root()->topOverflow() < v->truncatedAt())
-                        v->setBestTruncatedAt(ty + curr->root()->topOverflow(), renderer);
+            if (curr->bottomVisibleOverflow() - curr->topVisibleOverflow() <= v->printRect().height()) {
+                if (ty + curr->bottomVisibleOverflow() > v->printRect().bottom()) {
+                    if (ty + curr->topVisibleOverflow() < v->truncatedAt())
+                        v->setBestTruncatedAt(ty + curr->root()->topVisibleOverflow(), renderer);
                     // If we were able to truncate, don't paint.
-                    if (ty + curr->root()->topOverflow() >= v->truncatedAt())
+                    if (ty + curr->topVisibleOverflow() >= v->truncatedAt())
                         break;
                 }
             }
         }
 
-        int top = min(curr->root()->topOverflow(), curr->root()->selectionTop()) - renderer->maximalOutlineSize(info.phase);
-        int bottom = curr->root()->bottomOverflow() + renderer->maximalOutlineSize(info.phase);
+        int top = min(curr->topVisibleOverflow(), curr->root()->selectionTop()) - renderer->maximalOutlineSize(info.phase);
+        int bottom = curr->bottomVisibleOverflow() + renderer->maximalOutlineSize(info.phase);
         h = bottom - top;
         yPos = ty + top;
         if (yPos < info.rect.bottom() && yPos + h > info.rect.y())
@@ -229,14 +229,14 @@ bool RenderLineBoxList::hitTest(RenderBoxModelObject* renderer, const HitTestReq
     // contain the point.  This is a quick short-circuit that we can take to avoid walking any lines.
     // FIXME: This check is flawed in the following extremely obscure way:
     // if some line in the middle has a huge overflow, it might actually extend below the last line.
-    if ((y >= ty + lastLineBox()->root()->bottomOverflow()) || (y < ty + firstLineBox()->root()->topOverflow()))
+    if ((y >= ty + lastLineBox()->root()->bottomVisibleOverflow()) || (y < ty + firstLineBox()->root()->topVisibleOverflow()))
         return false;
 
     // See if our root lines contain the point.  If so, then we hit test
     // them further.  Note that boxes can easily overlap, so we can't make any assumptions
     // based off positions of our first line box or our last line box.
     for (InlineFlowBox* curr = lastLineBox(); curr; curr = curr->prevFlowBox()) {
-        if (y >= ty + curr->root()->topOverflow() && y < ty + curr->root()->bottomOverflow()) {
+        if (y >= ty + curr->root()->topVisibleOverflow() && y < ty + curr->root()->bottomVisibleOverflow()) {
             bool inside = curr->nodeAtPoint(request, result, x, y, tx, ty);
             if (inside) {
                 renderer->updateHitTestResult(result, IntPoint(x - tx, y - ty));
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderListBox.h b/src/3rdparty/webkit/WebCore/rendering/RenderListBox.h
index dd257a8..e5454e5 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderListBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderListBox.h
@@ -1,7 +1,7 @@
 /*
  * This file is part of the select element renderer in WebCore.
  *
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -39,8 +39,21 @@ namespace WebCore {
 class RenderListBox : public RenderBlock, private ScrollbarClient {
 public:
     RenderListBox(Element*);
-    ~RenderListBox();
+    virtual ~RenderListBox();
 
+    void selectionChanged();
+
+    void setOptionsChanged(bool changed) { m_optionsChanged = changed; }
+
+    int listIndexAtOffset(int x, int y);
+    IntRect itemBoundingBoxRect(int tx, int ty, int index);
+
+    bool scrollToRevealElementAtListIndex(int index);
+    bool listIndexIsVisible(int index);
+
+    int scrollToward(const IntPoint&); // Returns the new index or -1 if no scroll occurred
+
+private:
     virtual const char* renderName() const { return "RenderListBox"; }
 
     virtual bool isListBox() const { return true; }
@@ -63,16 +76,6 @@ public:
 
     virtual void layout();
 
-    void selectionChanged();
-
-    void setOptionsChanged(bool changed) { m_optionsChanged = changed; }
-
-    int listIndexAtOffset(int x, int y);
-    IntRect itemBoundingBoxRect(int tx, int ty, int index);
-
-    bool scrollToRevealElementAtListIndex(int index);
-    bool listIndexIsVisible(int index);
-
     virtual bool canBeProgramaticallyScrolled(bool) const { return true; }
     virtual void autoscroll();
     virtual void stopAutoscroll();
@@ -80,8 +83,6 @@ public:
     virtual bool shouldPanScroll() const { return true; }
     virtual void panScroll(const IntPoint&);
 
-    int scrollToward(const IntPoint&); // Returns the new index or -1 if no scroll occurred
-
     virtual int verticalScrollbarWidth() const;
     virtual int scrollLeft() const;
     virtual int scrollTop() const;
@@ -92,10 +93,8 @@ public:
 
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
 
-protected:
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
-private:
     // ScrollbarClient interface.
     virtual void valueChanged(Scrollbar*);
     virtual void invalidateScrollbarRect(Scrollbar*, const IntRect&);
@@ -130,6 +129,15 @@ private:
     RefPtr<Scrollbar> m_vBar;
 };
 
+inline RenderListBox* toRenderListBox(RenderObject* object)
+{ 
+    ASSERT(!object || object->isListBox());
+    return static_cast<RenderListBox*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderListBox(const RenderListBox*);
+
 } // namepace WebCore
 
 #endif // RenderListBox_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderListItem.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderListItem.cpp
index fb965d2..e487c60 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderListItem.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderListItem.cpp
@@ -91,20 +91,20 @@ static Node* enclosingList(Node* node)
 
 static RenderListItem* previousListItem(Node* list, const RenderListItem* item)
 {
-    for (Node* n = item->node()->traversePreviousNode(); n != list; n = n->traversePreviousNode()) {
-        RenderObject* o = n->renderer();
-        if (o && o->isListItem()) {
-            Node* otherList = enclosingList(n);
-            // This item is part of our current list, so it's what we're looking for.
-            if (list == otherList)
-                return static_cast<RenderListItem*>(o);
-            // We found ourself inside another list; lets skip the rest of it.
-            // Use traverseNextNode() here because the other list itself may actually
-            // be a list item itself. We need to examine it, so we do this to counteract
-            // the traversePreviousNode() that will be done by the loop.
-            if (otherList)
-                n = otherList->traverseNextNode();
-        }
+    for (Node* node = item->node()->traversePreviousNode(); node != list; node = node->traversePreviousNode()) {
+        RenderObject* renderer = node->renderer();
+        if (!renderer || !renderer->isListItem())
+            continue;
+        Node* otherList = enclosingList(node);
+        // This item is part of our current list, so it's what we're looking for.
+        if (list == otherList)
+            return toRenderListItem(renderer);
+        // We found ourself inside another list; lets skip the rest of it.
+        // Use traverseNextNode() here because the other list itself may actually
+        // be a list item itself. We need to examine it, so we do this to counteract
+        // the traversePreviousNode() that will be done by the loop.
+        if (otherList)
+            node = otherList->traverseNextNode();
     }
     return 0;
 }
@@ -247,21 +247,30 @@ void RenderListItem::positionListMarker()
         int markerXPos;
         RootInlineBox* root = m_marker->inlineBoxWrapper()->root();
 
+        // FIXME: Inline flows in the line box hierarchy that have self-painting layers should act as cutoff points
+        // and really shouldn't keep propagating overflow up.  This won't really break anything other than repainting
+        // not being as tight as it could be though.
         if (style()->direction() == LTR) {
             int leftLineOffset = leftRelOffset(yOffset, leftOffset(yOffset, false), false);
             markerXPos = leftLineOffset - xOffset - paddingLeft() - borderLeft() + m_marker->marginLeft();
             m_marker->inlineBoxWrapper()->adjustPosition(markerXPos - markerOldX, 0);
-            if (markerXPos < root->leftOverflow()) {
-                root->setHorizontalOverflowPositions(markerXPos, root->rightOverflow());
-                adjustOverflow = true;
+            for (InlineFlowBox* box = m_marker->inlineBoxWrapper()->parent(); box; box = box->parent()) {
+                if (markerXPos < box->leftLayoutOverflow()) {
+                    box->setHorizontalOverflowPositions(markerXPos, box->rightLayoutOverflow(), box->leftVisualOverflow(), box->rightVisualOverflow());
+                    if (box == root)
+                        adjustOverflow = true;
+                }
             }
         } else {
             int rightLineOffset = rightRelOffset(yOffset, rightOffset(yOffset, false), false);
             markerXPos = rightLineOffset - xOffset + paddingRight() + borderRight() + m_marker->marginLeft();
             m_marker->inlineBoxWrapper()->adjustPosition(markerXPos - markerOldX, 0);
-            if (markerXPos + m_marker->width() > root->rightOverflow()) {
-                root->setHorizontalOverflowPositions(root->leftOverflow(), markerXPos + m_marker->width());
-                adjustOverflow = true;
+            for (InlineFlowBox* box = m_marker->inlineBoxWrapper()->parent(); box; box = box->parent()) {
+                if (markerXPos + m_marker->width() > box->rightLayoutOverflow()) {
+                    box->setHorizontalOverflowPositions(box->leftLayoutOverflow(), markerXPos + m_marker->width(), box->leftVisualOverflow(), box->rightVisualOverflow());
+                    if (box == root)
+                        adjustOverflow = true;
+                }
             }
         }
 
@@ -271,9 +280,9 @@ void RenderListItem::positionListMarker()
             do {
                 o = o->parentBox();
                 if (o->isRenderBlock())
-                    toRenderBlock(o)->addVisualOverflow(markerRect);
+                    toRenderBlock(o)->addLayoutOverflow(markerRect);
                 markerRect.move(-o->x(), -o->y());
-            } while (o != this);
+            } while (o != this && !o->hasSelfPaintingLayer());
         }
     }
 }
@@ -302,9 +311,9 @@ void RenderListItem::explicitValueChanged()
     RenderObject* listRenderer = 0;
     if (listNode)
         listRenderer = listNode->renderer();
-    for (RenderObject* r = this; r; r = r->nextInPreOrder(listRenderer))
-        if (r->isListItem()) {
-            RenderListItem* item = static_cast<RenderListItem*>(r);
+    for (RenderObject* renderer = this; renderer; renderer = renderer->nextInPreOrder(listRenderer))
+        if (renderer->isListItem()) {
+            RenderListItem* item = toRenderListItem(renderer);
             if (!item->m_hasExplicitValue) {
                 item->m_isValueUpToDate = false;
                 if (RenderListMarker* marker = item->m_marker)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderListItem.h b/src/3rdparty/webkit/WebCore/rendering/RenderListItem.h
index 91844f7..c4c41dc 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderListItem.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderListItem.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -33,12 +33,6 @@ class RenderListItem : public RenderBlock {
 public:
     RenderListItem(Node*);
 
-    virtual const char* renderName() const { return "RenderListItem"; }
-
-    virtual bool isListItem() const { return true; }
-    
-    virtual void destroy();
-
     int value() const { if (!m_isValueUpToDate) updateValueNow(); return m_value; }
     void updateValue();
 
@@ -47,6 +41,18 @@ public:
     void setExplicitValue(int value);
     void clearExplicitValue();
 
+    void setNotInList(bool notInList) { m_notInList = notInList; }
+    bool notInList() const { return m_notInList; }
+
+    const String& markerText() const;
+
+private:
+    virtual const char* renderName() const { return "RenderListItem"; }
+
+    virtual bool isListItem() const { return true; }
+    
+    virtual void destroy();
+
     virtual bool isEmpty() const;
     virtual void paint(PaintInfo&, int tx, int ty);
 
@@ -55,15 +61,8 @@ public:
 
     virtual void positionListMarker();
 
-    void setNotInList(bool notInList) { m_notInList = notInList; }
-    bool notInList() const { return m_notInList; }
-
-    const String& markerText() const;
-
-protected:
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
-private:
     void updateMarkerLocation();
     inline int calcValue() const;
     void updateValueNow() const;
@@ -78,6 +77,15 @@ private:
     bool m_notInList : 1;
 };
 
+inline RenderListItem* toRenderListItem(RenderObject* object)
+{
+    ASSERT(!object || object->isListItem());
+    return static_cast<RenderListItem*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderListItem(const RenderListItem*);
+
 } // namespace WebCore
 
 #endif // RenderListItem_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderListMarker.h b/src/3rdparty/webkit/WebCore/rendering/RenderListMarker.h
index 57580a8..5b46278 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderListMarker.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderListMarker.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -36,8 +36,15 @@ String listMarkerText(EListStyleType, int value);
 class RenderListMarker : public RenderBox {
 public:
     RenderListMarker(RenderListItem*);
-    ~RenderListMarker();
+    virtual ~RenderListMarker();
 
+    virtual void calcPrefWidths();
+
+    const String& text() const { return m_text; }
+
+    bool isInside() const;
+
+private:
     virtual const char* renderName() const { return "RenderListMarker"; }
 
     virtual bool isListMarker() const { return true; }
@@ -45,7 +52,6 @@ public:
     virtual void paint(PaintInfo&, int tx, int ty);
 
     virtual void layout();
-    virtual void calcPrefWidths();
 
     virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
 
@@ -56,9 +62,6 @@ public:
 
     bool isImage() const;
     bool isText() const { return !isImage(); }
-    const String& text() const { return m_text; }
-
-    bool isInside() const;
 
     virtual void setSelectionState(SelectionState);
     virtual IntRect selectionRectForRepaint(RenderBoxModelObject* repaintContainer, bool clipToVisibleContent = true);
@@ -66,11 +69,9 @@ public:
 
     void updateMargins();
 
-protected:
     virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
-private:
     IntRect getRelativeMarkerRect();
 
     String m_text;
@@ -78,6 +79,21 @@ private:
     RenderListItem* m_listItem;
 };
 
+inline RenderListMarker* toRenderListMarker(RenderObject* object)
+{
+    ASSERT(!object || object->isListMarker());
+    return static_cast<RenderListMarker*>(object);
+}
+
+inline const RenderListMarker* toRenderListMarker(const RenderObject* object)
+{
+    ASSERT(!object || object->isListMarker());
+    return static_cast<const RenderListMarker*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderListMarker(const RenderListMarker*);
+
 } // namespace WebCore
 
 #endif // RenderListMarker_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMarquee.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderMarquee.cpp
index 31a8305..bb917f8 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderMarquee.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMarquee.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * Portions are Copyright (C) 1998 Netscape Communications Corporation.
  *
@@ -152,7 +153,11 @@ int RenderMarquee::computePosition(EMarqueeDirection dir, bool stopAtContentEdge
 
 void RenderMarquee::start()
 {
-    if (m_timer.isActive() || m_layer->renderer()->style()->marqueeIncrement().isZero())
+    if (m_timer.isActive() || m_layer->renderer()->style()->marqueeIncrement().isZero()
+#if ENABLE(WCSS) && ENABLE(XHTMLMP)
+        || (m_layer->renderer()->document()->isXHTMLMPDocument() && !m_layer->renderer()->style()->marqueeLoopCount())
+#endif
+       )
         return;
 
     // We may end up propagating a scroll event. It is important that we suspend events until 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMedia.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderMedia.cpp
index b87e99d..1da2628 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderMedia.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMedia.cpp
@@ -33,6 +33,7 @@
 #include "HTMLNames.h"
 #include "MediaControlElements.h"
 #include "MouseEvent.h"
+#include "RenderTheme.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/MathExtras.h>
 
@@ -132,6 +133,10 @@ void RenderMedia::styleDidChange(StyleDifference diff, const RenderStyle* oldSty
             m_currentTimeDisplay->updateStyle();
         if (m_timeRemainingDisplay)
             m_timeRemainingDisplay->updateStyle();
+        if (m_volumeSliderContainer)
+            m_volumeSliderContainer->updateStyle();
+        if (m_volumeSlider)
+            m_volumeSlider->updateStyle();
     }
 }
 
@@ -240,6 +245,22 @@ void RenderMedia::createTimeline()
     m_timeline->attachToParent(m_timelineContainer.get());
 }
 
+void RenderMedia::createVolumeSliderContainer()
+{
+    ASSERT(!m_volumeSliderContainer);
+    m_volumeSliderContainer = new MediaControlVolumeSliderContainerElement(document(), mediaElement());
+    m_volumeSliderContainer->attachToParent(m_panel.get());
+}
+
+void RenderMedia::createVolumeSlider()
+{
+    ASSERT(!m_volumeSlider);
+    m_volumeSlider = new MediaControlVolumeSliderElement(document(), mediaElement());
+    m_volumeSlider->setAttribute(precisionAttr, "float");
+    m_volumeSlider->setAttribute(maxAttr, "1");
+    m_volumeSlider->attachToParent(m_volumeSliderContainer.get());
+}
+
 void RenderMedia::createCurrentTimeDisplay()
 {
     ASSERT(!m_currentTimeDisplay);
@@ -285,6 +306,8 @@ void RenderMedia::updateControls()
             m_currentTimeDisplay = 0;
             m_timeRemainingDisplay = 0;
             m_fullscreenButton = 0;
+            m_volumeSliderContainer = 0;
+            m_volumeSlider = 0;
             m_controlsShadowRoot = 0;
         }
         m_opacityAnimationTo = 1.0f;
@@ -298,19 +321,22 @@ void RenderMedia::updateControls()
         createPanel();
         if (m_panel) {
             createRewindButton();
-            createMuteButton();
             createPlayButton();
             createReturnToRealtimeButton();
             createStatusDisplay();
             createTimelineContainer();
-            createSeekBackButton();
-            createSeekForwardButton();
-            createFullscreenButton();
             if (m_timelineContainer) {
                 createCurrentTimeDisplay();
                 createTimeline();
                 createTimeRemainingDisplay();
             }
+            createSeekBackButton();
+            createSeekForwardButton();
+            createFullscreenButton();
+            createMuteButton();
+            createVolumeSliderContainer();
+            if (m_volumeSliderContainer)
+                createVolumeSlider();
             m_panel->attach();
         }
     }
@@ -336,6 +362,8 @@ void RenderMedia::updateControls()
         m_playButton->update();
     if (m_timelineContainer)
         m_timelineContainer->update();
+    if (m_volumeSliderContainer)
+        m_volumeSliderContainer->update();
     if (m_timeline)
         m_timeline->update();
     if (m_currentTimeDisplay)
@@ -354,6 +382,8 @@ void RenderMedia::updateControls()
         m_statusDisplay->update();
     if (m_fullscreenButton)
         m_fullscreenButton->update();
+    if (m_volumeSlider)
+        m_volumeSlider->update();
 
     updateTimeDisplay();
     updateControlVisibility();
@@ -366,24 +396,6 @@ void RenderMedia::timeUpdateTimerFired(Timer<RenderMedia>*)
     updateTimeDisplay();
 }
     
-String RenderMedia::formatTime(float time)
-{
-    if (!isfinite(time))
-        time = 0;
-    int seconds = (int)fabsf(time); 
-    int hours = seconds / (60 * 60);
-    int minutes = (seconds / 60) % 60;
-    seconds %= 60;
-    if (hours) {
-        if (hours > 9)
-            return String::format("%s%02d:%02d:%02d", (time < 0 ? "-" : ""), hours, minutes, seconds);
-        else
-            return String::format("%s%01d:%02d:%02d", (time < 0 ? "-" : ""), hours, minutes, seconds);
-    }
-    else
-        return String::format("%s%02d:%02d", (time < 0 ? "-" : ""), minutes, seconds);
-}
-
 void RenderMedia::updateTimeDisplay()
 {
     if (!m_currentTimeDisplay || !m_currentTimeDisplay->renderer() || m_currentTimeDisplay->renderer()->style()->display() == NONE || style()->visibility() != VISIBLE)
@@ -391,12 +403,8 @@ void RenderMedia::updateTimeDisplay()
     float now = mediaElement()->currentTime();
     float duration = mediaElement()->duration();
 
-    String timeString = formatTime(now);
-    ExceptionCode ec;
-    m_currentTimeDisplay->setInnerText(timeString, ec);
-    
-    timeString = formatTime(now - duration);
-    m_timeRemainingDisplay->setInnerText(timeString, ec);
+    m_currentTimeDisplay->setCurrentValue(now);
+    m_timeRemainingDisplay->setCurrentValue(now - duration);
 }
 
 void RenderMedia::updateControlVisibility() 
@@ -463,13 +471,53 @@ void RenderMedia::opacityAnimationTimerFired(Timer<RenderMedia>*)
     changeOpacity(m_panel.get(), opacity);
 }
 
+void RenderMedia::updateVolumeSliderContainer(bool visible)
+{
+    if (!mediaElement()->hasAudio() || !m_volumeSliderContainer || !m_volumeSlider)
+        return;
+
+    if (visible && !m_volumeSliderContainer->isVisible()) {
+        if (!m_muteButton || !m_muteButton->renderer() || !m_muteButton->renderBox())
+            return;
+
+        RefPtr<RenderStyle> s = m_volumeSliderContainer->styleForElement();
+        int height = s->height().isPercent() ? 0 : s->height().value();
+        int x = m_muteButton->renderBox()->offsetLeft();
+        int y = m_muteButton->renderBox()->offsetTop() - height;
+        FloatPoint absPoint = m_muteButton->renderer()->localToAbsolute(FloatPoint(x, y), true, true);
+        if (absPoint.y() < 0)
+            y = m_muteButton->renderBox()->offsetTop() + m_muteButton->renderBox()->height();
+        m_volumeSliderContainer->setVisible(true);
+        m_volumeSliderContainer->setPosition(x, y);
+        m_volumeSliderContainer->update();
+        m_volumeSlider->update();
+    } else if (!visible && m_volumeSliderContainer->isVisible()) {
+        m_volumeSliderContainer->setVisible(false);
+        m_volumeSliderContainer->updateStyle();
+    }
+}
+
 void RenderMedia::forwardEvent(Event* event)
 {
     if (event->isMouseEvent() && m_controlsShadowRoot) {
         MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
         IntPoint point(mouseEvent->absoluteLocation());
-        if (m_muteButton && m_muteButton->hitTest(point))
+        bool showVolumeSlider = false;
+        if (m_muteButton && m_muteButton->hitTest(point)) {
             m_muteButton->defaultEventHandler(event);
+            if (event->type() != eventNames().mouseoutEvent)
+                showVolumeSlider = true;
+        }
+
+        if (m_volumeSliderContainer && m_volumeSliderContainer->hitTest(point))
+            showVolumeSlider = true;
+
+        if (m_volumeSlider && m_volumeSlider->hitTest(point)) {
+            m_volumeSlider->defaultEventHandler(event);
+            showVolumeSlider = true;
+        }
+
+        updateVolumeSliderContainer(showVolumeSlider);
 
         if (m_playButton && m_playButton->hitTest(point))
             m_playButton->defaultEventHandler(event);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMedia.h b/src/3rdparty/webkit/WebCore/rendering/RenderMedia.h
index e1149bb..602cd26 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderMedia.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMedia.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -41,10 +41,12 @@ class MediaControlSeekButtonElement;
 class MediaControlRewindButtonElement;
 class MediaControlReturnToRealtimeButtonElement;
 class MediaControlTimelineElement;
+class MediaControlVolumeSliderElement;
 class MediaControlFullscreenButtonElement;
 class MediaControlTimeDisplayElement;
 class MediaControlStatusDisplayElement;
 class MediaControlTimelineContainerElement;
+class MediaControlVolumeSliderContainerElement;
 class MediaControlElement;
 class MediaPlayer;
 
@@ -54,23 +56,12 @@ public:
     RenderMedia(HTMLMediaElement*, const IntSize& intrinsicSize);
     virtual ~RenderMedia();
     
-    virtual RenderObjectChildList* virtualChildren() { return children(); }
-    virtual const RenderObjectChildList* virtualChildren() const { return children(); }
     const RenderObjectChildList* children() const { return &m_children; }
     RenderObjectChildList* children() { return &m_children; }
 
-    virtual void destroy();
-    
-    virtual void layout();
-
-    virtual const char* renderName() const { return "RenderMedia"; }
-    virtual bool isMedia() const { return true; }
-    
     HTMLMediaElement* mediaElement() const;
     MediaPlayer* player() const;
 
-    static String formatTime(float time);
-
     bool shouldShowTimeDisplayControls() const;
 
     void updateFromElement();
@@ -80,11 +71,22 @@ public:
     
     void forwardEvent(Event*);
 
+protected:
+    virtual void layout();
+
+private:
+    virtual RenderObjectChildList* virtualChildren() { return children(); }
+    virtual const RenderObjectChildList* virtualChildren() const { return children(); }
+
+    virtual void destroy();
+    
+    virtual const char* renderName() const { return "RenderMedia"; }
+    virtual bool isMedia() const { return true; }
+
     virtual int lowestPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
     virtual int rightmostPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
     virtual int leftmostPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
 
-private:
     void createControlsShadowRoot();
     void destroyControlsShadowRoot();
     void createPanel();
@@ -97,6 +99,8 @@ private:
     void createStatusDisplay();
     void createTimelineContainer();
     void createTimeline();
+    void createVolumeSliderContainer();
+    void createVolumeSlider();
     void createCurrentTimeDisplay();
     void createTimeRemainingDisplay();
     void createFullscreenButton();
@@ -107,6 +111,8 @@ private:
     void changeOpacity(HTMLElement*, float opacity);
     void opacityAnimationTimerFired(Timer<RenderMedia>*);
 
+    void updateVolumeSliderContainer(bool visible);
+
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
     RefPtr<HTMLElement> m_controlsShadowRoot;
@@ -118,8 +124,10 @@ private:
     RefPtr<MediaControlRewindButtonElement> m_rewindButton;
     RefPtr<MediaControlReturnToRealtimeButtonElement> m_returnToRealtimeButton;
     RefPtr<MediaControlTimelineElement> m_timeline;
+    RefPtr<MediaControlVolumeSliderElement> m_volumeSlider;
     RefPtr<MediaControlFullscreenButtonElement> m_fullscreenButton;
     RefPtr<MediaControlTimelineContainerElement> m_timelineContainer;
+    RefPtr<MediaControlVolumeSliderContainerElement> m_volumeSliderContainer;
     RefPtr<MediaControlTimeDisplayElement> m_currentTimeDisplay;
     RefPtr<MediaControlTimeDisplayElement> m_timeRemainingDisplay;
     RefPtr<MediaControlStatusDisplayElement> m_statusDisplay;
@@ -136,6 +144,15 @@ private:
     float m_opacityAnimationTo;
 };
 
+inline RenderMedia* toRenderMedia(RenderObject* object)
+{
+    ASSERT(!object || object->isMedia());
+    return static_cast<RenderMedia*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderMedia(const RenderMedia*);
+
 } // namespace WebCore
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMediaControls.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderMediaControls.cpp
index 06d901a..0ce0642 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderMediaControls.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMediaControls.cpp
@@ -110,8 +110,8 @@ bool RenderMediaControls::paintMediaControlsPart(MediaControlElementType part, R
         case MediaPauseButton:
         case MediaPlayButton:
             if (MediaControlPlayButtonElement* btn = static_cast<MediaControlPlayButtonElement*>(o->node())) {
-                bool currentlyPlaying = btn->displayType() == MediaPlayButton;
-                paintThemePart(currentlyPlaying ? SafariTheme::MediaPauseButtonPart : SafariTheme::MediaPlayButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
+                bool canPlay = btn->displayType() == MediaPlayButton;
+                paintThemePart(canPlay ? SafariTheme::MediaPlayButtonPart : SafariTheme::MediaPauseButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
             }
             break;
         case MediaSeekBackButton:
@@ -128,6 +128,18 @@ bool RenderMediaControls::paintMediaControlsPart(MediaControlElementType part, R
         case MediaSliderThumb:
             paintThemePart(SafariTheme::MediaSliderThumbPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
             break;
+        case MediaVolumeSliderContainer:
+            // FIXME: Implement volume slider.
+            ASSERT_NOT_REACHED();
+            break;
+        case MediaVolumeSlider:
+            // FIXME: Implement volume slider.
+            ASSERT_NOT_REACHED();
+            break;
+        case MediaVolumeSliderThumb:
+            // FIXME: Implement volume slider.
+            ASSERT_NOT_REACHED();
+            break;
         case MediaTimelineContainer:
             ASSERT_NOT_REACHED();
             break;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.cpp
index ed8c8ba..cbbc7cb 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.cpp
@@ -292,7 +292,6 @@ void RenderMenuList::hidePopup()
 {
     if (m_popup)
         m_popup->hide();
-    m_popupIsVisible = false;
 }
 
 void RenderMenuList::valueChanged(unsigned listIndex, bool fireOnChange)
@@ -318,6 +317,13 @@ String RenderMenuList::itemText(unsigned listIndex) const
     return String();
 }
 
+String RenderMenuList::itemToolTip(unsigned listIndex) const
+{
+    SelectElement* select = toSelectElement(static_cast<Element*>(node()));
+    Element* element = select->listItems()[listIndex];
+    return element->title();
+}
+
 bool RenderMenuList::itemIsEnabled(unsigned listIndex) const
 {
     SelectElement* select = toSelectElement(static_cast<Element*>(node()));
@@ -421,6 +427,11 @@ int RenderMenuList::selectedIndex() const
     return select->optionToListIndex(select->selectedIndex());
 }
 
+void RenderMenuList::popupDidHide()
+{
+    m_popupIsVisible = false;
+}
+
 bool RenderMenuList::itemIsSeparator(unsigned listIndex) const
 {
     SelectElement* select = toSelectElement(static_cast<Element*>(node()));
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.h b/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.h
index 7966eff..2d617c1 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.h
@@ -40,7 +40,16 @@ class RenderText;
 class RenderMenuList : public RenderFlexibleBox, private PopupMenuClient {
 public:
     RenderMenuList(Element*);
-    ~RenderMenuList();
+    virtual ~RenderMenuList();
+
+public:
+    bool popupIsVisible() const { return m_popupIsVisible; }
+    void showPopup();
+    void hidePopup();
+
+    void setOptionsChanged(bool changed) { m_optionsChanged = changed; }
+
+    String text() const;
 
 private:
     virtual bool isMenuList() const { return true; }
@@ -59,20 +68,11 @@ private:
 
     virtual void calcPrefWidths();
 
-public:
-    bool popupIsVisible() const { return m_popupIsVisible; }
-    void showPopup();
-    void hidePopup();
-
-    void setOptionsChanged(bool changed) { m_optionsChanged = changed; }
-
-    String text() const;
-
-private:
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
     // PopupMenuClient methods
     virtual String itemText(unsigned listIndex) const;
+    virtual String itemToolTip(unsigned listIndex) const;
     virtual bool itemIsEnabled(unsigned listIndex) const;
     virtual PopupMenuStyle itemStyle(unsigned listIndex) const;
     virtual PopupMenuStyle menuStyle() const;
@@ -82,6 +82,7 @@ private:
     virtual int clientPaddingRight() const;
     virtual int listSize() const;
     virtual int selectedIndex() const;
+    virtual void popupDidHide();
     virtual bool itemIsSeparator(unsigned listIndex) const;
     virtual bool itemIsLabel(unsigned listIndex) const;
     virtual bool itemIsSelected(unsigned listIndex) const;
@@ -113,6 +114,15 @@ private:
     bool m_popupIsVisible;
 };
 
+inline RenderMenuList* toRenderMenuList(RenderObject* object)
+{ 
+    ASSERT(!object || object->isMenuList());
+    return static_cast<RenderMenuList*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderMenuList(const RenderMenuList*);
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderObject.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderObject.cpp
index df8c58a..4cbc530 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderObject.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderObject.cpp
@@ -4,6 +4,7 @@
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  *           (C) 2004 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -46,6 +47,7 @@
 #include "RenderTheme.h"
 #include "RenderView.h"
 #include "TransformState.h"
+#include "htmlediting.h"
 #include <algorithm>
 #include <stdio.h>
 #include <wtf/RefCountedLeakCounter.h>
@@ -142,6 +144,12 @@ RenderObject* RenderObject::createObject(Node* node, RenderStyle* style)
             o = new (arena) RenderTableCell(node);
             break;
         case TABLE_CAPTION:
+#if ENABLE(WCSS)
+        // As per the section 17.1 of the spec WAP-239-WCSS-20011026-a.pdf, 
+        // the marquee box inherits and extends the characteristics of the 
+        // principal block box ([CSS2] section 9.2.1).
+        case WAP_MARQUEE:
+#endif
             o = new (arena) RenderBlock(node);
             break;
         case BOX:
@@ -197,7 +205,6 @@ RenderObject::RenderObject(Node* node)
     , m_selectionState(SelectionNone)
     , m_hasColumns(false)
     , m_cellWidthChanged(false)
-    , m_replacedHasOverflow(false)
 {
 #ifndef NDEBUG
     renderObjectCounter.increment();
@@ -247,9 +254,10 @@ bool RenderObject::isHTMLMarquee() const
 
 static void updateListMarkerNumbers(RenderObject* child)
 {
-    for (RenderObject* r = child; r; r = r->nextSibling())
-        if (r->isListItem())
-            static_cast<RenderListItem*>(r)->updateValue();
+    for (RenderObject* sibling = child; sibling; sibling = sibling->nextSibling()) {
+        if (sibling->isListItem())
+            toRenderListItem(sibling)->updateValue();
+    }
 }
 
 void RenderObject::addChild(RenderObject* newChild, RenderObject* beforeChild)
@@ -285,7 +293,7 @@ void RenderObject::addChild(RenderObject* newChild, RenderObject* beforeChild)
         RenderTable* table;
         RenderObject* afterChild = beforeChild ? beforeChild->previousSibling() : children->lastChild();
         if (afterChild && afterChild->isAnonymous() && afterChild->isTable())
-            table = static_cast<RenderTable*>(afterChild);
+            table = toRenderTable(afterChild);
         else {
             table = new (renderArena()) RenderTable(document() /* is anonymous */);
             RefPtr<RenderStyle> newStyle = RenderStyle::create();
@@ -595,7 +603,7 @@ void RenderObject::setLayerNeedsFullRepaint()
 RenderBlock* RenderObject::containingBlock() const
 {
     if (isTableCell()) {
-        const RenderTableCell* cell = static_cast<const RenderTableCell*>(this);
+        const RenderTableCell* cell = toRenderTableCell(this);
         if (parent() && cell->section())
             return cell->table();
         return 0;
@@ -649,10 +657,10 @@ static bool mustRepaintFillLayers(const RenderObject* renderer, const FillLayer*
     if (!layer->xPosition().isZero() || !layer->yPosition().isZero())
         return true;
 
-    if (layer->isSizeSet()) {
-        if (layer->size().width().isPercent() || layer->size().height().isPercent())
+    if (layer->size().type == SizeLength) {
+        if (layer->size().size.width().isPercent() || layer->size().size.height().isPercent())
             return true;
-    } else if (img->usesImageContainerSize())
+    } else if (layer->size().type == Contain || layer->size().type == Cover || img->usesImageContainerSize())
         return true;
 
     return false;
@@ -1213,12 +1221,11 @@ bool RenderObject::repaintAfterLayoutIfNeeded(RenderBoxModelObject* repaintConta
     // two rectangles (but typically only one).
     RenderStyle* outlineStyle = outlineStyleForRepaint();
     int ow = outlineStyle->outlineSize();
-    ShadowData* boxShadow = style()->boxShadow();
     int width = abs(newOutlineBox.width() - oldOutlineBox.width());
     if (width) {
-        int shadowRight = 0;
-        for (ShadowData* shadow = boxShadow; shadow; shadow = shadow->next)
-            shadowRight = max(shadow->x + shadow->blur + shadow->spread, shadowRight);
+        int shadowLeft;
+        int shadowRight;
+        style()->getBoxShadowHorizontalExtent(shadowLeft, shadowRight);
 
         int borderRight = isBox() ? toRenderBox(this)->borderRight() : 0;
         int borderWidth = max(-outlineStyle->outlineOffset(), max(borderRight, max(style()->borderTopRightRadius().width(), style()->borderBottomRightRadius().width()))) + max(ow, shadowRight);
@@ -1234,9 +1241,9 @@ bool RenderObject::repaintAfterLayoutIfNeeded(RenderBoxModelObject* repaintConta
     }
     int height = abs(newOutlineBox.height() - oldOutlineBox.height());
     if (height) {
-        int shadowBottom = 0;
-        for (ShadowData* shadow = boxShadow; shadow; shadow = shadow->next)
-            shadowBottom = max(shadow->y + shadow->blur + shadow->spread, shadowBottom);
+        int shadowTop;
+        int shadowBottom;
+        style()->getBoxShadowVerticalExtent(shadowTop, shadowBottom);
 
         int borderBottom = isBox() ? toRenderBox(this)->borderBottom() : 0;
         int borderHeight = max(-outlineStyle->outlineOffset(), max(borderBottom, max(style()->borderBottomLeftRadius().height(), style()->borderBottomRightRadius().height()))) + max(ow, shadowBottom);
@@ -1362,6 +1369,7 @@ Color RenderObject::selectionForegroundColor() const
     return color;
 }
 
+#if ENABLE(DRAG_SUPPORT)
 Node* RenderObject::draggableNode(bool dhtmlOK, bool uaOK, int x, int y, bool& dhtmlWillDrag) const
 {
     if (!dhtmlOK && !uaOK)
@@ -1396,6 +1404,7 @@ Node* RenderObject::draggableNode(bool dhtmlOK, bool uaOK, int x, int y, bool& d
     }
     return 0;
 }
+#endif // ENABLE(DRAG_SUPPORT)
 
 void RenderObject::selectionStartEnd(int& spos, int& epos) const
 {
@@ -1609,15 +1618,20 @@ void RenderObject::styleDidChange(StyleDifference diff, const RenderStyle*)
 
 void RenderObject::updateFillImages(const FillLayer* oldLayers, const FillLayer* newLayers)
 {
-    // FIXME: This will be slow when a large number of images is used.  Fix by using a dict.
-    for (const FillLayer* currOld = oldLayers; currOld; currOld = currOld->next()) {
-        if (currOld->image() && (!newLayers || !newLayers->containsImage(currOld->image())))
-            currOld->image()->removeClient(this);
-    }
+    // Optimize the common case
+    if (oldLayers && !oldLayers->next() && newLayers && !newLayers->next() && (oldLayers->image() == newLayers->image()))
+        return;
+    
+    // Go through the new layers and addClients first, to avoid removing all clients of an image.
     for (const FillLayer* currNew = newLayers; currNew; currNew = currNew->next()) {
-        if (currNew->image() && (!oldLayers || !oldLayers->containsImage(currNew->image())))
+        if (currNew->image())
             currNew->image()->addClient(this);
     }
+
+    for (const FillLayer* currOld = oldLayers; currOld; currOld = currOld->next()) {
+        if (currOld->image())
+            currOld->image()->removeClient(this);
+    }
 }
 
 void RenderObject::updateImage(StyleImage* oldImage, StyleImage* newImage)
@@ -1822,7 +1836,12 @@ void RenderObject::destroy()
         children->destroyLeftoverChildren();
 
     // If this renderer is being autoscrolled, stop the autoscroll timer
-    if (document()->frame()->eventHandler()->autoscrollRenderer() == this)
+    
+    // FIXME: RenderObject::destroy should not get called with a renderar whose document
+    // has a null frame, so we assert this. However, we don't want release builds to crash which is why we
+    // check that the frame is not null.
+    ASSERT(document()->frame());
+    if (document()->frame() && document()->frame()->eventHandler()->autoscrollRenderer() == this)
         document()->frame()->eventHandler()->stopAutoscrollTimer(true);
 
     if (m_hasCounterNodeMap)
@@ -2240,10 +2259,12 @@ void RenderObject::adjustRectForOutlineAndShadow(IntRect& rect) const
         int shadowBottom = 0;
 
         do {
-            shadowLeft = min(boxShadow->x - boxShadow->blur - boxShadow->spread - outlineSize, shadowLeft);
-            shadowRight = max(boxShadow->x + boxShadow->blur + boxShadow->spread + outlineSize, shadowRight);
-            shadowTop = min(boxShadow->y - boxShadow->blur - boxShadow->spread - outlineSize, shadowTop);
-            shadowBottom = max(boxShadow->y + boxShadow->blur + boxShadow->spread + outlineSize, shadowBottom);
+            if (boxShadow->style == Normal) {
+                shadowLeft = min(boxShadow->x - boxShadow->blur - boxShadow->spread - outlineSize, shadowLeft);
+                shadowRight = max(boxShadow->x + boxShadow->blur + boxShadow->spread + outlineSize, shadowRight);
+                shadowTop = min(boxShadow->y - boxShadow->blur - boxShadow->spread - outlineSize, shadowTop);
+                shadowBottom = max(boxShadow->y + boxShadow->blur + boxShadow->spread + outlineSize, shadowBottom);
+            }
 
             boxShadow = boxShadow->next;
         } while (boxShadow);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderObject.h b/src/3rdparty/webkit/WebCore/rendering/RenderObject.h
index 911169d..f361198 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderObject.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderObject.h
@@ -278,6 +278,7 @@ public:
     virtual bool isTextField() const { return false; }
     virtual bool isVideo() const { return false; }
     virtual bool isWidget() const { return false; }
+    virtual bool isCanvas() const { return false; }
 
     bool isRoot() const { return document()->documentElement() == m_node; }
     bool isBody() const;
@@ -285,6 +286,9 @@ public:
 
     bool isHTMLMarquee() const;
 
+    inline bool isAfterContent() const;
+    static inline bool isAfterContent(const RenderObject* obj) { return obj && obj->isAfterContent(); }
+
     bool childrenInline() const { return m_childrenInline; }
     void setChildrenInline(bool b = true) { m_childrenInline = b; }
     bool hasColumns() const { return m_hasColumns; }
@@ -658,7 +662,9 @@ public:
     // Whether or not a given block needs to paint selection gaps.
     virtual bool shouldPaintSelectionGaps() const { return false; }
 
+#if ENABLE(DRAG_SUPPORT)
     Node* draggableNode(bool dhtmlOK, bool uaOK, int x, int y, bool& dhtmlWillDrag) const;
+#endif
 
     /**
      * Returns the local coordinates of the caret within this render object.
@@ -734,9 +740,6 @@ public:
         return outlineBoundsForRepaint(0);
     }
 
-    bool replacedHasOverflow() const { return m_replacedHasOverflow; }
-    void setReplacedHasOverflow(bool b = true) { m_replacedHasOverflow = b; }
-    
 protected:
     // Overrides should call the superclass at the end
     virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
@@ -845,9 +848,6 @@ private:
     // from RenderTableCell
     bool m_cellWidthChanged : 1;
 
-    // from RenderReplaced
-    bool m_replacedHasOverflow : 1;
-
 private:
     // Store state between styleWillChange and styleDidChange
     static bool s_affectsParentBlock;
@@ -858,6 +858,16 @@ inline bool RenderObject::documentBeingDestroyed() const
     return !document()->renderer();
 }
 
+inline bool RenderObject::isAfterContent() const
+{
+    if (style()->styleType() != AFTER)
+        return false;
+    // Text nodes don't have their own styles, so ignore the style on a text node.
+    if (isText() && !isBR())
+        return false;
+    return true;
+}
+
 inline void RenderObject::setNeedsLayout(bool b, bool markParents)
 {
     bool alreadyNeededLayout = m_needsLayout;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderObjectChildList.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderObjectChildList.cpp
index 32e856f..23ab98f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderObjectChildList.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderObjectChildList.cpp
@@ -41,13 +41,12 @@ namespace WebCore {
 
 static void updateListMarkerNumbers(RenderObject* child)
 {
-    for (RenderObject* r = child; r; r = r->nextSibling()) {
-        if (r->isListItem())
-            static_cast<RenderListItem*>(r)->updateValue();
+    for (RenderObject* sibling = child; sibling; sibling = sibling->nextSibling()) {
+        if (sibling->isListItem())
+            toRenderListItem(sibling)->updateValue();
     }
 }
 
-
 void RenderObjectChildList::destroyLeftoverChildren()
 {
     while (firstChild()) {
@@ -281,7 +280,7 @@ static void invalidateCountersInContainer(RenderObject* container)
         return;
     for (RenderObject* content = container->firstChild(); content; content = content->nextSibling()) {
         if (content->isCounter())
-            static_cast<RenderCounter*>(content)->invalidate();
+            toRenderCounter(content)->invalidate();
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderOverflow.h b/src/3rdparty/webkit/WebCore/rendering/RenderOverflow.h
new file mode 100644
index 0000000..ed8976a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderOverflow.h
@@ -0,0 +1,153 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef RenderOverflow_h
+#define RenderOverflow_h
+
+#include "IntRect.h"
+
+namespace WebCore
+{
+// RenderOverflow is a class for tracking content that spills out of a box.  This class is used by RenderBox and
+// InlineFlowBox.
+//
+// There are two types of overflow: layout overflow (which is expected to be reachable via scrolling mechanisms) and
+// visual overflow (which is not expected to be reachable via scrolling mechanisms).
+//
+// Layout overflow examples include other boxes that spill out of our box,  For example, in the inline case a tall image
+// could spill out of a line box. 
+    
+// Examples of visual overflow are shadows, text stroke (and eventually outline and border-image).
+
+// This object is allocated only when some of these fields have non-default values in the owning box.
+class RenderOverflow {
+public:
+    RenderOverflow(const IntRect& defaultRect = IntRect()) 
+        : m_topLayoutOverflow(defaultRect.y())
+        , m_bottomLayoutOverflow(defaultRect.bottom())
+        , m_leftLayoutOverflow(defaultRect.x())
+        , m_rightLayoutOverflow(defaultRect.right())
+        , m_topVisualOverflow(defaultRect.y())
+        , m_bottomVisualOverflow(defaultRect.bottom())
+        , m_leftVisualOverflow(defaultRect.x())
+        , m_rightVisualOverflow(defaultRect.right())
+    {
+    }
+   
+    int topLayoutOverflow() const { return m_topLayoutOverflow; }
+    int bottomLayoutOverflow() const { return m_bottomLayoutOverflow; }
+    int leftLayoutOverflow() const { return m_leftLayoutOverflow; }
+    int rightLayoutOverflow() const { return m_rightLayoutOverflow; }
+    IntRect layoutOverflowRect() const;
+
+    int topVisualOverflow() const { return m_topVisualOverflow; }
+    int bottomVisualOverflow() const { return m_bottomVisualOverflow; }
+    int leftVisualOverflow() const { return m_leftVisualOverflow; }
+    int rightVisualOverflow() const { return m_rightVisualOverflow; }
+    IntRect visualOverflowRect() const;
+
+    IntRect visibleOverflowRect() const;
+
+    void setTopLayoutOverflow(int overflow) { m_topLayoutOverflow = overflow; }
+    void setBottomLayoutOverflow(int overflow) { m_bottomLayoutOverflow = overflow; }
+    void setLeftLayoutOverflow(int overflow) { m_leftLayoutOverflow = overflow; }
+    void setRightLayoutOverflow(int overflow) { m_rightLayoutOverflow = overflow; }
+    
+    void setTopVisualOverflow(int overflow) { m_topVisualOverflow = overflow; }
+    void setBottomVisualOverflow(int overflow) { m_bottomVisualOverflow = overflow; }
+    void setLeftVisualOverflow(int overflow) { m_leftVisualOverflow = overflow; }
+    void setRightVisualOverflow(int overflow) { m_rightVisualOverflow = overflow; }
+    
+    void move(int dx, int dy);
+    
+    void addLayoutOverflow(const IntRect&);
+    void addVisualOverflow(const IntRect&);
+
+    void resetLayoutOverflow(const IntRect& defaultRect);
+
+private:
+    int m_topLayoutOverflow;
+    int m_bottomLayoutOverflow;
+    int m_leftLayoutOverflow;
+    int m_rightLayoutOverflow;
+
+    int m_topVisualOverflow;
+    int m_bottomVisualOverflow;
+    int m_leftVisualOverflow;
+    int m_rightVisualOverflow;
+};
+
+inline IntRect RenderOverflow::layoutOverflowRect() const
+{
+    return IntRect(m_leftLayoutOverflow, m_topLayoutOverflow, m_rightLayoutOverflow - m_leftLayoutOverflow, m_bottomLayoutOverflow - m_topLayoutOverflow);
+}
+
+inline IntRect RenderOverflow::visualOverflowRect() const
+{
+    return IntRect(m_leftVisualOverflow, m_topVisualOverflow, m_rightVisualOverflow - m_leftVisualOverflow, m_bottomVisualOverflow - m_topVisualOverflow);
+}
+
+inline IntRect RenderOverflow::visibleOverflowRect() const
+{
+    IntRect combinedRect(layoutOverflowRect());
+    combinedRect.unite(visualOverflowRect());
+    return combinedRect;
+}
+
+inline void RenderOverflow::move(int dx, int dy)
+{
+    m_topLayoutOverflow += dy;
+    m_bottomLayoutOverflow += dy;
+    m_leftLayoutOverflow += dx;
+    m_rightLayoutOverflow += dx;
+    
+    m_topVisualOverflow += dy;
+    m_bottomVisualOverflow += dy;
+    m_leftVisualOverflow += dx;
+    m_rightVisualOverflow += dx;
+}
+
+inline void RenderOverflow::addLayoutOverflow(const IntRect& rect)
+{
+    m_topLayoutOverflow = std::min(rect.y(), m_topLayoutOverflow);
+    m_bottomLayoutOverflow = std::max(rect.bottom(), m_bottomLayoutOverflow);
+    m_leftLayoutOverflow = std::min(rect.x(), m_leftLayoutOverflow);
+    m_rightLayoutOverflow = std::max(rect.right(), m_rightLayoutOverflow);
+}
+
+inline void RenderOverflow::addVisualOverflow(const IntRect& rect)
+{
+    m_topVisualOverflow = std::min(rect.y(), m_topVisualOverflow);
+    m_bottomVisualOverflow = std::max(rect.bottom(), m_bottomVisualOverflow);
+    m_leftVisualOverflow = std::min(rect.x(), m_leftVisualOverflow);
+    m_rightVisualOverflow = std::max(rect.right(), m_rightVisualOverflow);
+}
+
+inline void RenderOverflow::resetLayoutOverflow(const IntRect& rect)
+{
+    m_topLayoutOverflow = rect.y();
+    m_bottomLayoutOverflow = rect.bottom();
+    m_leftLayoutOverflow = rect.x();
+    m_rightLayoutOverflow = rect.right();
+}
+
+} // namespace WebCore
+
+#endif // RenderOverflow_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderPart.h b/src/3rdparty/webkit/WebCore/rendering/RenderPart.h
index a1d2e2b..08abf99 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderPart.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderPart.h
@@ -45,6 +45,15 @@ private:
     virtual const char* renderName() const { return "RenderPart"; }
 };
 
+inline RenderPart* toRenderPart(RenderObject* object)
+{
+    ASSERT(!object || object->isRenderPart());
+    return static_cast<RenderPart*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderPart(const RenderPart*);
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.cpp
index 7a3aa64..199c0da 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.cpp
@@ -33,8 +33,8 @@
 #include "HTMLParamElement.h"
 #include "MIMETypeRegistry.h"
 #include "Page.h"
-#include "PluginData.h"
 #include "RenderView.h"
+#include "RenderWidgetProtector.h"
 #include "Text.h"
 
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
@@ -72,7 +72,7 @@ static bool isURLAllowed(Document* doc, const String& url)
     KURL completeURL = doc->completeURL(url);
     bool foundSelfReference = false;
     for (Frame* frame = doc->frame(); frame; frame = frame->tree()->parent()) {
-        if (equalIgnoringRef(frame->loader()->url(), completeURL)) {
+        if (equalIgnoringFragmentIdentifier(frame->loader()->url(), completeURL)) {
             if (foundSelfReference)
                 return false;
             foundSelfReference = true;
@@ -90,25 +90,12 @@ static ClassIdToTypeMap* createClassIdToTypeMap()
     map->add("clsid:CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA", "audio/x-pn-realaudio-plugin");
     map->add("clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B", "video/quicktime");
     map->add("clsid:166B1BCA-3F9C-11CF-8075-444553540000", "application/x-director");
-#if ENABLE(ACTIVEX_TYPE_CONVERSION_WMPLAYER)
     map->add("clsid:6BF52A52-394A-11D3-B153-00C04F79FAA6", "application/x-mplayer2");
     map->add("clsid:22D6F312-B0F6-11D0-94AB-0080C74C7E95", "application/x-mplayer2");
-#endif
     return map;
 }
 
-static const String& activeXType()
-{
-    DEFINE_STATIC_LOCAL(String, activeXType, ("application/x-oleobject"));
-    return activeXType;
-}
-
-static inline bool havePlugin(const PluginData* pluginData, const String& type)
-{
-    return pluginData && !type.isEmpty() && pluginData->supportsMimeType(type);
-}
-
-static String serviceTypeForClassId(const String& classId, const PluginData* pluginData)
+static String serviceTypeForClassId(const String& classId)
 {
     // Return early if classId is empty (since we won't do anything below).
     // Furthermore, if classId is null, calling get() below will crash.
@@ -116,30 +103,7 @@ static String serviceTypeForClassId(const String& classId, const PluginData* plu
         return String();
 
     static ClassIdToTypeMap* map = createClassIdToTypeMap();
-    String type = map->get(classId);
-
-    // If we do have a plug-in that supports generic ActiveX content and don't have a plug-in
-    // for the MIME type we came up with, ignore the MIME type we came up with and just use
-    // the ActiveX type.
-    if (havePlugin(pluginData, activeXType()) && !havePlugin(pluginData, type))
-        return activeXType();
-
-    return type;
-}
-
-static inline bool shouldUseEmbedDescendant(HTMLObjectElement* objectElement, const PluginData* pluginData)
-{
-#if PLATFORM(MAC)
-    UNUSED_PARAM(objectElement);
-    UNUSED_PARAM(pluginData);
-    // On Mac, we always want to use the embed descendant.
-    return true;
-#else
-    // If we have both an <object> and <embed>, we always want to use the <embed> except when we have
-    // an ActiveX plug-in and plan to use it.
-    return !(havePlugin(pluginData, activeXType())
-        && serviceTypeForClassId(objectElement->classId(), pluginData) == activeXType());
-#endif
+    return map->get(classId);
 }
 
 static void mapDataParamToSrc(Vector<String>* paramNames, Vector<String>* paramValues)
@@ -168,6 +132,12 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
     Vector<String> paramValues;
     Frame* frame = frameView()->frame();
 
+    // The calls to FrameLoader::requestObject within this function can result in a plug-in being initialized.
+    // This can run cause arbitrary JavaScript to run and may result in this RenderObject being detached from
+    // the render tree and destroyed, causing a crash like <rdar://problem/6954546>.  By extending our lifetime
+    // artifically to ensure that we remain alive for the duration of plug-in initialization.
+    RenderWidgetProtector protector(this);
+
     if (node()->hasTagName(objectTag)) {
         HTMLObjectElement* o = static_cast<HTMLObjectElement*>(node());
 
@@ -177,17 +147,14 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
 
         // Check for a child EMBED tag.
         HTMLEmbedElement* embed = 0;
-        const PluginData* pluginData = frame->page()->pluginData();
-        if (shouldUseEmbedDescendant(o, pluginData)) {
-            for (Node* child = o->firstChild(); child; ) {
-                if (child->hasTagName(embedTag)) {
-                    embed = static_cast<HTMLEmbedElement*>(child);
-                    break;
-                } else if (child->hasTagName(objectTag))
-                    child = child->nextSibling();         // Don't descend into nested OBJECT tags
-                else
-                    child = child->traverseNextNode(o);   // Otherwise descend (EMBEDs may be inside COMMENT tags)
-            }
+        for (Node* child = o->firstChild(); child; ) {
+            if (child->hasTagName(embedTag)) {
+                embed = static_cast<HTMLEmbedElement*>(child);
+                break;
+            } else if (child->hasTagName(objectTag))
+                child = child->nextSibling();         // Don't descend into nested OBJECT tags
+            else
+                child = child->traverseNextNode(o);   // Otherwise descend (EMBEDs may be inside COMMENT tags)
         }
 
         // Use the attributes from the EMBED tag instead of the OBJECT tag including WIDTH and HEIGHT.
@@ -260,7 +227,7 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
 
         // If we still don't have a type, try to map from a specific CLASSID to a type.
         if (serviceType.isEmpty())
-            serviceType = serviceTypeForClassId(o->classId(), pluginData);
+            serviceType = serviceTypeForClassId(o->classId());
 
         if (!isURLAllowed(document(), url))
             return;
@@ -282,7 +249,7 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
                 return;
         }
 
-        bool success = frame->loader()->requestObject(this, url, AtomicString(o->name()), serviceType, paramNames, paramValues);
+        bool success = frame->loader()->requestObject(this, url, o->getAttribute(nameAttr), serviceType, paramNames, paramValues);
         if (!success && m_hasFallbackContent)
             o->renderFallbackContent();
     } else if (node()->hasTagName(embedTag)) {
@@ -350,10 +317,12 @@ void RenderPartObject::layout()
 
     calcWidth();
     calcHeight();
-    adjustOverflowForBoxShadowAndReflect();
 
     RenderPart::layout();
 
+    m_overflow.clear();
+    addShadowOverflow();
+
     if (!widget() && frameView())
         frameView()->addWidgetToUpdate(this);
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.h b/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.h
index 2159d3c..ad956bd 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
- * Copyright (C) 2006, 2009 Apple Inc.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -42,6 +42,15 @@ private:
     virtual void viewCleared();
 };
 
+inline RenderPartObject* toRenderPartObject(RenderObject* object)
+{
+    ASSERT(!object || !strcmp(object->renderName(), "RenderPartObject"));
+    return static_cast<RenderPartObject*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderPartObject(const RenderPartObject*);
+
 } // namespace WebCore
 
 #endif // RenderPartObject_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderPath.h b/src/3rdparty/webkit/WebCore/rendering/RenderPath.h
index a4aefed..2ff179e 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderPath.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderPath.h
@@ -40,6 +40,9 @@ class RenderPath : public RenderSVGModelObject {
 public:
     RenderPath(SVGStyledTransformableElement*);
 
+    const Path& path() const;
+
+private:
     // Hit-detection seperated for the fill and the stroke
     bool fillContains(const FloatPoint&, bool requiresFill = true) const;
     bool strokeContains(const FloatPoint&, bool requiresStroke = true) const;
@@ -49,7 +52,6 @@ public:
 
     virtual TransformationMatrix localToParentTransform() const;
 
-    const Path& path() const;
     void setPath(const Path&);
 
     virtual bool isRenderPath() const { return true; }
@@ -73,6 +75,21 @@ private:
     TransformationMatrix m_localTransform;
 };
 
+inline RenderPath* toRenderPath(RenderObject* object)
+{
+    ASSERT(!object || object->isRenderPath());
+    return static_cast<RenderPath*>(object);
+}
+
+inline const RenderPath* toRenderPath(const RenderObject* object)
+{
+    ASSERT(!object || object->isRenderPath());
+    return static_cast<const RenderPath*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderPath(const RenderPath*);
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderReplaced.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderReplaced.cpp
index ba045ea..27d2e72 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderReplaced.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderReplaced.cpp
@@ -34,9 +34,6 @@ using namespace std;
 
 namespace WebCore {
 
-typedef WTF::HashMap<const RenderReplaced*, IntRect> OverflowRectMap;
-static OverflowRectMap* gOverflowRectMap = 0;
-
 const int cDefaultWidth = 300;
 const int cDefaultHeight = 150;
 
@@ -56,8 +53,6 @@ RenderReplaced::RenderReplaced(Node* node, const IntSize& intrinsicSize)
 
 RenderReplaced::~RenderReplaced()
 {
-    if (replacedHasOverflow())
-        gOverflowRectMap->remove(this);
 }
 
 void RenderReplaced::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
@@ -66,7 +61,7 @@ void RenderReplaced::styleDidChange(StyleDifference diff, const RenderStyle* old
 
     bool hadStyle = (oldStyle != 0);
     float oldZoom = hadStyle ? oldStyle->effectiveZoom() : RenderStyle::initialZoom();
-    if (hadStyle && style() && style()->effectiveZoom() != oldZoom)
+    if (style() && style()->effectiveZoom() != oldZoom)
         intrinsicSizeChanged();
 }
 
@@ -77,10 +72,12 @@ void RenderReplaced::layout()
     LayoutRepainter repainter(*this, checkForRepaintDuringLayout());
     
     setHeight(minimumReplacedHeight());
-    
+
     calcWidth();
     calcHeight();
-    adjustOverflowForBoxShadowAndReflect();
+
+    m_overflow.clear();
+    addShadowOverflow();
     
     repainter.repaintAfterLayout();    
 
@@ -127,21 +124,29 @@ void RenderReplaced::paint(PaintInfo& paintInfo, int tx, int ty)
         drawSelectionTint = false;
     }
 
+    bool completelyClippedOut = false;
     if (style()->hasBorderRadius()) {
-        // Push a clip if we have a border radius, since we want to round the foreground content that gets painted.
-        paintInfo.context->save();
-        
-        IntSize topLeft, topRight, bottomLeft, bottomRight;
         IntRect borderRect = IntRect(tx, ty, width(), height());
-        style()->getBorderRadiiForRect(borderRect, topLeft, topRight, bottomLeft, bottomRight);
 
-        paintInfo.context->addRoundedRectClip(borderRect, topLeft, topRight, bottomLeft, bottomRight);
+        if (borderRect.isEmpty())
+            completelyClippedOut = true;
+        else {
+            // Push a clip if we have a border radius, since we want to round the foreground content that gets painted.
+            paintInfo.context->save();
+            
+            IntSize topLeft, topRight, bottomLeft, bottomRight;
+            style()->getBorderRadiiForRect(borderRect, topLeft, topRight, bottomLeft, bottomRight);
+
+            paintInfo.context->addRoundedRectClip(borderRect, topLeft, topRight, bottomLeft, bottomRight);
+        }
     }
 
-    paintReplaced(paintInfo, tx, ty);
+    if (!completelyClippedOut) {
+        paintReplaced(paintInfo, tx, ty);
 
-    if (style()->hasBorderRadius())
-        paintInfo.context->restore();
+        if (style()->hasBorderRadius())
+            paintInfo.context->restore();
+    }
         
     // The selection tint never gets clipped by border-radius rounding, since we want it to run right up to the edges of
     // surrounding content.
@@ -169,8 +174,8 @@ bool RenderReplaced::shouldPaint(PaintInfo& paintInfo, int& tx, int& ty)
     int currentTY = ty + y();
 
     // Early exit if the element touches the edges.
-    int top = currentTY + overflowTop();
-    int bottom = currentTY + overflowHeight();
+    int top = currentTY + topVisibleOverflow();
+    int bottom = currentTY + bottomVisibleOverflow();
     if (isSelected() && m_inlineBoxWrapper) {
         int selTop = ty + m_inlineBoxWrapper->root()->selectionTop();
         int selBottom = ty + selTop + m_inlineBoxWrapper->root()->selectionHeight();
@@ -179,7 +184,7 @@ bool RenderReplaced::shouldPaint(PaintInfo& paintInfo, int& tx, int& ty)
     }
     
     int os = 2 * maximalOutlineSize(paintInfo.phase);
-    if (currentTX + overflowLeft() >= paintInfo.rect.right() + os || currentTX + overflowWidth() <= paintInfo.rect.x() - os)
+    if (currentTX + leftVisibleOverflow() >= paintInfo.rect.right() + os || currentTX + rightVisibleOverflow() <= paintInfo.rect.x() - os)
         return false;
     if (top >= paintInfo.rect.bottom() + os || bottom <= paintInfo.rect.y() - os)
         return false;
@@ -231,8 +236,8 @@ VisiblePosition RenderReplaced::positionForPoint(const IntPoint& point)
 
     RootInlineBox* root = box->root();
 
-    int top = root->topOverflow();
-    int bottom = root->nextRootBox() ? root->nextRootBox()->topOverflow() : root->bottomOverflow();
+    int top = root->lineTop();
+    int bottom = root->nextRootBox() ? root->nextRootBox()->lineTop() : root->lineBottom();
 
     if (point.y() + y() < top)
         return createVisiblePosition(caretMinOffset(), DOWNSTREAM); // coordinates are above
@@ -327,80 +332,6 @@ void RenderReplaced::setIntrinsicSize(const IntSize& size)
     m_intrinsicSize = size;
 }
 
-void RenderReplaced::adjustOverflowForBoxShadowAndReflect()
-{
-    IntRect overflow;
-    for (ShadowData* boxShadow = style()->boxShadow(); boxShadow; boxShadow = boxShadow->next) {
-        IntRect shadow = borderBoxRect();
-        shadow.move(boxShadow->x, boxShadow->y);
-        shadow.inflate(boxShadow->blur + boxShadow->spread);
-        overflow.unite(shadow);
-    }
-
-    // Now that we have an overflow rect including shadow, let's make sure that
-    // the reflection (which can also include the shadow) is also included.
-    if (hasReflection()) {
-        if (overflow.isEmpty())
-            overflow = borderBoxRect();
-        overflow.unite(reflectedRect(overflow));
-    }
-
-    if (!overflow.isEmpty()) {
-        if (!gOverflowRectMap)
-            gOverflowRectMap = new OverflowRectMap();
-        overflow.unite(borderBoxRect());
-        gOverflowRectMap->set(this, overflow);
-        setReplacedHasOverflow(true);
-    } else if (replacedHasOverflow()) {
-        gOverflowRectMap->remove(this);
-        setReplacedHasOverflow(false);
-    }
-}
-
-int RenderReplaced::overflowHeight(bool) const
-{
-    if (replacedHasOverflow()) {
-        IntRect *r = &gOverflowRectMap->find(this)->second;
-        return r->height() + r->y();
-    }
-
-    return height();
-}
-
-int RenderReplaced::overflowWidth(bool) const
-{
-    if (replacedHasOverflow()) {
-        IntRect *r = &gOverflowRectMap->find(this)->second;
-        return r->width() + r->x();
-    }
-
-    return width();
-}
-
-int RenderReplaced::overflowLeft(bool) const
-{
-    if (replacedHasOverflow())
-        return gOverflowRectMap->get(this).x();
-
-    return 0;
-}
-
-int RenderReplaced::overflowTop(bool) const
-{
-    if (replacedHasOverflow())
-        return gOverflowRectMap->get(this).y();
-
-    return 0;
-}
-
-IntRect RenderReplaced::overflowRect(bool) const
-{
-    if (replacedHasOverflow())
-        return gOverflowRectMap->find(this)->second;
-
-    return borderBoxRect();
-}
-
 IntRect RenderReplaced::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
 {
     if (style()->visibility() != VISIBLE && !enclosingLayer()->hasVisibleContent())
@@ -408,7 +339,7 @@ IntRect RenderReplaced::clippedOverflowRectForRepaint(RenderBoxModelObject* repa
 
     // The selectionRect can project outside of the overflowRect, so take their union
     // for repainting to avoid selection painting glitches.
-    IntRect r = unionRect(localSelectionRect(false), overflowRect(false));
+    IntRect r = unionRect(localSelectionRect(false), visibleOverflowRect());
 
     RenderView* v = view();
     if (v) {
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderReplaced.h b/src/3rdparty/webkit/WebCore/rendering/RenderReplaced.h
index 4937446..0ba6b8a 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderReplaced.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderReplaced.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -32,6 +32,25 @@ public:
     RenderReplaced(Node*, const IntSize& intrinsicSize);
     virtual ~RenderReplaced();
 
+protected:
+    virtual void layout();
+
+    virtual IntSize intrinsicSize() const;
+
+    virtual void setSelectionState(SelectionState);
+
+    bool isSelected() const;
+
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
+
+    void setIntrinsicSize(const IntSize&);
+    virtual void intrinsicSizeChanged();
+
+    bool shouldPaint(PaintInfo&, int& tx, int& ty);
+    void adjustOverflowForBoxShadowAndReflect();
+    IntRect localSelectionRect(bool checkWhetherSelected = true) const;
+
+private:
     virtual const char* renderName() const { return "RenderReplaced"; }
 
     virtual bool canHaveChildren() const { return false; }
@@ -40,43 +59,21 @@ public:
     virtual int baselinePosition(bool firstLine, bool isRootLineBox = false) const;
 
     virtual void calcPrefWidths();
-    
-    virtual void layout();
+
     virtual int minimumReplacedHeight() const { return 0; }
 
     virtual void paint(PaintInfo&, int tx, int ty);
     virtual void paintReplaced(PaintInfo&, int /*tx*/, int /*ty*/) { }
 
-    virtual IntSize intrinsicSize() const;
-
-    virtual int overflowHeight(bool includeInterior = true) const;
-    virtual int overflowWidth(bool includeInterior = true) const;
-    virtual int overflowLeft(bool includeInterior = true) const;
-    virtual int overflowTop(bool includeInterior = true) const;
-    virtual IntRect overflowRect(bool includeInterior = true) const;
-
     virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
 
     virtual unsigned caretMaxRenderedOffset() const;
     virtual VisiblePosition positionForPoint(const IntPoint&);
     
     virtual bool canBeSelectionLeaf() const { return true; }
-    virtual void setSelectionState(SelectionState);
-    virtual IntRect selectionRectForRepaint(RenderBoxModelObject* repaintContainer, bool clipToVisibleContent = true);
-
-    bool isSelected() const;
-
-protected:
-    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
-
-    void setIntrinsicSize(const IntSize&);
-    virtual void intrinsicSizeChanged();
 
-    bool shouldPaint(PaintInfo&, int& tx, int& ty);
-    void adjustOverflowForBoxShadowAndReflect();
-    IntRect localSelectionRect(bool checkWhetherSelected = true) const;
+    virtual IntRect selectionRectForRepaint(RenderBoxModelObject* repaintContainer, bool clipToVisibleContent = true);
 
-private:
     IntSize m_intrinsicSize;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGBlock.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGBlock.h
index f8afd0f..a4ececb 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGBlock.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGBlock.h
@@ -34,6 +34,8 @@ class SVGElement;
 class RenderSVGBlock : public RenderBlock, protected SVGRenderBase {
 public:
     RenderSVGBlock(SVGElement*);
+
+private:
     virtual void setStyle(PassRefPtr<RenderStyle>);
 };
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGContainer.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGContainer.cpp
index 8a77d2e..d7aec99 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGContainer.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGContainer.cpp
@@ -42,10 +42,6 @@ RenderSVGContainer::RenderSVGContainer(SVGStyledElement* node)
 {
 }
 
-RenderSVGContainer::~RenderSVGContainer()
-{
-}
-
 bool RenderSVGContainer::drawsContents() const
 {
     return m_drawsContents;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGContainer.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGContainer.h
index 4bb7e44..f2195e3 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGContainer.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGContainer.h
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
     Copyright (C) 2009 Google, Inc.  All rights reserved.
+    Copyright (C) 2009 Apple Inc. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -33,10 +34,7 @@ class SVGElement;
 class RenderSVGContainer : public RenderSVGModelObject {
 public:
     RenderSVGContainer(SVGStyledElement*);
-    ~RenderSVGContainer();
 
-    virtual RenderObjectChildList* virtualChildren() { return children(); }
-    virtual const RenderObjectChildList* virtualChildren() const { return children(); }
     const RenderObjectChildList* children() const { return &m_children; }
     RenderObjectChildList* children() { return &m_children; }
 
@@ -44,11 +42,18 @@ public:
     void setDrawsContents(bool);
     bool drawsContents() const;
 
+protected:
+    virtual void paint(PaintInfo&, int parentX, int parentY);
+
+private:
+    virtual RenderObjectChildList* virtualChildren() { return children(); }
+    virtual const RenderObjectChildList* virtualChildren() const { return children(); }
+
     virtual bool isSVGContainer() const { return true; }
     virtual const char* renderName() const { return "RenderSVGContainer"; }
 
     virtual void layout();
-    virtual void paint(PaintInfo&, int parentX, int parentY);
+
     virtual void addFocusRingRects(GraphicsContext*, int tx, int ty);
 
     virtual FloatRect objectBoundingBox() const;
@@ -56,7 +61,6 @@ public:
 
     virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction);
 
-protected:
     // Allow RenderSVGTransformableContainer to hook in at the right time in layout()
     virtual void calculateLocalTransform() { }
 
@@ -65,13 +69,29 @@ protected:
     virtual void applyViewportClip(PaintInfo&) { }
     virtual bool pointIsInsideViewportClip(const FloatPoint& /*pointInParent*/) { return true; }
 
-private:
     bool selfWillPaint() const;
 
     RenderObjectChildList m_children;
     bool m_drawsContents : 1;
 };
   
+inline RenderSVGContainer* toRenderSVGContainer(RenderObject* object)
+{
+    // Note: isSVGContainer is also true for RenderSVGViewportContainer, which is not derived from this.
+    ASSERT(!object || object->isSVGContainer() && strcmp(object->renderName(), "RenderSVGViewportContainer"));
+    return static_cast<RenderSVGContainer*>(object);
+}
+
+inline const RenderSVGContainer* toRenderSVGContainer(const RenderObject* object)
+{
+    // Note: isSVGContainer is also true for RenderSVGViewportContainer, which is not derived from this.
+    ASSERT(!object || object->isSVGContainer() && strcmp(object->renderName(), "RenderSVGViewportContainer"));
+    return static_cast<const RenderSVGContainer*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderSVGContainer(const RenderSVGContainer*);
+
 } // namespace WebCore
 
 #endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGHiddenContainer.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGHiddenContainer.cpp
index f08c008..d4b39d3 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGHiddenContainer.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGHiddenContainer.cpp
@@ -35,10 +35,6 @@ RenderSVGHiddenContainer::RenderSVGHiddenContainer(SVGStyledElement* element)
 {
 }
 
-RenderSVGHiddenContainer::~RenderSVGHiddenContainer()
-{
-}
-
 void RenderSVGHiddenContainer::layout()
 {
     ASSERT(needsLayout());
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGHiddenContainer.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGHiddenContainer.h
index 5a208d0..0ef0a43 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGHiddenContainer.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGHiddenContainer.h
@@ -36,9 +36,8 @@ namespace WebCore {
     class RenderSVGHiddenContainer : public RenderSVGContainer {
     public:
         RenderSVGHiddenContainer(SVGStyledElement*);
-        virtual ~RenderSVGHiddenContainer();
 
-        virtual bool isSVGContainer() const { return true; }
+    private:
         virtual bool isSVGHiddenContainer() const { return true; }
 
         virtual const char* renderName() const { return "RenderSVGHiddenContainer"; }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGImage.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGImage.cpp
index f494709..7e0b40d 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGImage.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGImage.cpp
@@ -47,10 +47,6 @@ RenderSVGImage::RenderSVGImage(SVGImageElement* impl)
 {
 }
 
-RenderSVGImage::~RenderSVGImage()
-{
-}
-
 void RenderSVGImage::adjustRectsForAspectRatio(FloatRect& destRect, FloatRect& srcRect, SVGPreserveAspectRatio* aspectRatio)
 {
     float origDestWidth = destRect.width();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGImage.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGImage.h
index 01b8b65..ef11719 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGImage.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGImage.h
@@ -1,6 +1,6 @@
 /*
     Copyright (C) 2006 Alexander Kellett <lypanov@kde.org>
-    Copyright (C) 2006 Apple Computer, Inc.
+    Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
     Copyright (C) 2007 Rob Buis <buis@kde.org>
     Copyright (C) 2009 Google, Inc.
 
@@ -38,8 +38,8 @@ namespace WebCore {
     class RenderSVGImage : public RenderImage, SVGRenderBase {
     public:
         RenderSVGImage(SVGImageElement*);
-        virtual ~RenderSVGImage();
 
+    private:
         virtual const char* renderName() const { return "RenderSVGImage"; }
         virtual bool isSVGImage() const { return true; }
 
@@ -63,12 +63,11 @@ namespace WebCore {
         virtual void layout();
         virtual void paint(PaintInfo&, int parentX, int parentY);
 
-        bool requiresLayer() const { return false; }
+        virtual bool requiresLayer() const { return false; }
 
         virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction);
-        virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int _x, int _y, int _tx, int _ty, HitTestAction);
+        virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
 
-    private:
         virtual TransformationMatrix localTransform() const { return m_localTransform; }
 
         TransformationMatrix m_localTransform;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGInlineText.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGInlineText.h
index c4a096d..e9c5d6e 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGInlineText.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGInlineText.h
@@ -33,6 +33,8 @@ namespace WebCore {
 class RenderSVGInlineText : public RenderText {
 public:
     RenderSVGInlineText(Node*, PassRefPtr<StringImpl>);
+
+private:
     virtual const char* renderName() const { return "RenderSVGInlineText"; }
         
     virtual void styleDidChange(StyleDifference, const RenderStyle*);
@@ -49,7 +51,6 @@ public:
 
     virtual void destroy();
 
-private:
     virtual InlineTextBox* createTextBox();
     IntRect computeRepaintRectForRange(RenderBoxModelObject* repaintContainer, int startPos, int endPos);
     FloatQuad computeRepaintQuadForRange(RenderBoxModelObject* repaintContainer, int startPos, int endPos);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGRoot.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGRoot.cpp
index 80c29dd..0a39bf4 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGRoot.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGRoot.cpp
@@ -48,10 +48,6 @@ RenderSVGRoot::RenderSVGRoot(SVGStyledElement* node)
     setReplaced(true);
 }
 
-RenderSVGRoot::~RenderSVGRoot()
-{
-}
-
 int RenderSVGRoot::lineHeight(bool, bool) const
 {
     return height() + marginTop() + marginBottom();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGRoot.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGRoot.h
index 50866d2..08c3058 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGRoot.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGRoot.h
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
     Copyright (C) 2009 Google, Inc.  All rights reserved.
+    Copyright (C) 2009 Apple Inc. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -35,13 +36,14 @@ class TransformationMatrix;
 class RenderSVGRoot : public RenderBox, SVGRenderBase {
 public:
     RenderSVGRoot(SVGStyledElement*);
-    ~RenderSVGRoot();
 
-    virtual RenderObjectChildList* virtualChildren() { return children(); }
-    virtual const RenderObjectChildList* virtualChildren() const { return children(); }
     const RenderObjectChildList* children() const { return &m_children; }
     RenderObjectChildList* children() { return &m_children; }
 
+private:
+    virtual RenderObjectChildList* virtualChildren() { return children(); }
+    virtual const RenderObjectChildList* virtualChildren() const { return children(); }
+
     virtual bool isSVGRoot() const { return true; }
     virtual const char* renderName() const { return "RenderSVGRoot"; }
 
@@ -70,7 +72,6 @@ public:
 
     virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&) const;
 
-private:
     void calcViewport();
     const FloatSize& viewportSize() const;
 
@@ -85,6 +86,21 @@ private:
     FloatSize m_viewportSize;
 };
 
+inline RenderSVGRoot* toRenderSVGRoot(RenderObject* object)
+{ 
+    ASSERT(!object || object->isSVGRoot());
+    return static_cast<RenderSVGRoot*>(object);
+}
+
+inline const RenderSVGRoot* toRenderSVGRoot(const RenderObject* object)
+{ 
+    ASSERT(!object || object->isSVGRoot());
+    return static_cast<const RenderSVGRoot*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderSVGRoot(const RenderSVGRoot*);
+
 } // namespace WebCore
 
 #endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGText.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGText.h
index 088332e..9a2770b 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGText.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGText.h
@@ -37,6 +37,7 @@ class RenderSVGText : public RenderSVGBlock {
 public:
     RenderSVGText(SVGTextElement* node);
 
+private:
     virtual const char* renderName() const { return "RenderSVGText"; }
 
     virtual bool isSVGText() const { return true; }
@@ -61,7 +62,6 @@ public:
     virtual FloatRect objectBoundingBox() const;
     virtual FloatRect repaintRectInLocalCoordinates() const;
 
-private:
     // FIXME: This can be removed when localTransform() is removed from RenderObject
     virtual TransformationMatrix localTransform() const { return m_localTransform; }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGTextPath.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGTextPath.h
index efab659..8e6ff42 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGTextPath.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGTextPath.h
@@ -2,6 +2,7 @@
  * This file is part of the WebKit project.
  *
  * Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -37,9 +38,9 @@ namespace WebCore {
         bool exactAlignment() const;
         bool stretchMethod() const;
 
+    private:
         virtual const char* renderName() const { return "RenderSVGTextPath"; }
 
-    private:
         float m_startOffset;
 
         bool m_exactAlignment : 1;
@@ -47,6 +48,16 @@ namespace WebCore {
 
         Path m_layoutPath;
     };
+
+    inline RenderSVGTextPath* toRenderSVGTextPath(RenderObject* object)
+    { 
+        ASSERT(!object || !strcmp(object->renderName(), "RenderSVGTextPath"));
+        return static_cast<RenderSVGTextPath*>(object);
+    }
+
+    // This will catch anyone doing an unnecessary cast.
+    void toRenderSVGTextPath(const RenderSVGTextPath*);
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGViewportContainer.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGViewportContainer.cpp
index d208621..a432ef3 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGViewportContainer.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGViewportContainer.cpp
@@ -38,14 +38,14 @@ RenderSVGViewportContainer::RenderSVGViewportContainer(SVGStyledElement* node)
 {
 }
 
-RenderSVGViewportContainer::~RenderSVGViewportContainer()
-{
-}
-
 void RenderSVGViewportContainer::paint(PaintInfo& paintInfo, int parentX, int parentY)
 {
+    // FIXME: The if statement here evaluates to false. isEmpty() is exactly the same
+    // as what is on the right side, so it's basically !isEmpty && isEmpty. So this
+    // function does nothing.
+
     // A value of zero disables rendering of the element. 
-    if (!viewport().isEmpty() && (viewport().width() <= 0. || viewport().height() <= 0.))
+    if (!m_viewport.isEmpty() && (m_viewport.width() <= 0. || m_viewport.height() <= 0.))
         return;
 
     RenderSVGContainer::paint(paintInfo, parentX, parentY);
@@ -54,12 +54,7 @@ void RenderSVGViewportContainer::paint(PaintInfo& paintInfo, int parentX, int pa
 void RenderSVGViewportContainer::applyViewportClip(PaintInfo& paintInfo)
 {
     if (style()->overflowX() != OVISIBLE)
-        paintInfo.context->clip(enclosingIntRect(viewport())); // FIXME: Eventually we'll want float-precision clipping
-}
-
-FloatRect RenderSVGViewportContainer::viewport() const
-{
-    return m_viewport;
+        paintInfo.context->clip(enclosingIntRect(m_viewport)); // FIXME: Eventually we'll want float-precision clipping
 }
 
 void RenderSVGViewportContainer::calcViewport()
@@ -91,10 +86,10 @@ TransformationMatrix RenderSVGViewportContainer::viewportTransform() const
 {
     if (node()->hasTagName(SVGNames::svgTag)) {
         SVGSVGElement* svg = static_cast<SVGSVGElement*>(node());
-        return svg->viewBoxToViewTransform(viewport().width(), viewport().height());
+        return svg->viewBoxToViewTransform(m_viewport.width(), m_viewport.height());
     } else if (node()->hasTagName(SVGNames::markerTag)) {
         SVGMarkerElement* marker = static_cast<SVGMarkerElement*>(node());
-        return marker->viewBoxToViewTransform(viewport().width(), viewport().height());
+        return marker->viewBoxToViewTransform(m_viewport.width(), m_viewport.height());
     }
 
     return TransformationMatrix();
@@ -103,7 +98,7 @@ TransformationMatrix RenderSVGViewportContainer::viewportTransform() const
 TransformationMatrix RenderSVGViewportContainer::localToParentTransform() const
 {
     TransformationMatrix viewportTranslation;
-    viewportTranslation.translate(viewport().x(), viewport().y());
+    viewportTranslation.translate(m_viewport.x(), m_viewport.y());
     return viewportTransform() * viewportTranslation;
     // If this class were ever given a localTransform(), then the above would read:
     // return viewportTransform() * localTransform() * viewportTranslation;
@@ -121,7 +116,7 @@ bool RenderSVGViewportContainer::pointIsInsideViewportClip(const FloatPoint& poi
     // Respect the viewport clip (which is in parent coords).  SVG does not support separate x/y overflow rules.
     if (style()->overflowX() == OHIDDEN) {
         ASSERT(style()->overflowY() == OHIDDEN);
-        if (!viewport().contains(pointInParent))
+        if (!m_viewport.contains(pointInParent))
             return false;
     }
     return true;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGViewportContainer.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGViewportContainer.h
index 8657af4..b8b30b5 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGViewportContainer.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGViewportContainer.h
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
                   2009 Google, Inc.
+    Copyright (C) 2009 Apple Inc. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -33,24 +34,21 @@ namespace WebCore {
 class RenderSVGViewportContainer : public RenderSVGContainer {
 public:
     RenderSVGViewportContainer(SVGStyledElement*);
-    ~RenderSVGViewportContainer();
 
-    virtual bool isSVGContainer() const { return true; }
-    virtual const char* renderName() const { return "RenderSVGViewportContainer"; }
+    // FIXME: This is only public for SVGResourceMarker::draw, likely the callsite should be changed.
+    TransformationMatrix viewportTransform() const;
 
     virtual void paint(PaintInfo&, int parentX, int parentY);
 
+private:
+    virtual bool isSVGContainer() const { return true; }
+    virtual const char* renderName() const { return "RenderSVGViewportContainer"; }
+
     virtual TransformationMatrix localToParentTransform() const;
 
     // FIXME: This override should be removed once callers of RenderBox::absoluteTransform() can be removed.
     virtual TransformationMatrix absoluteTransform() const;
 
-    FloatRect viewport() const;
-
-    // FIXME: This is only public for SVGResourceMarker::draw, likely the callsite should be changed.
-    TransformationMatrix viewportTransform() const;
-
-private:
     virtual void calcViewport();
 
     virtual void applyViewportClip(PaintInfo&);
@@ -59,6 +57,15 @@ private:
     FloatRect m_viewport;
 };
   
+inline RenderSVGViewportContainer* toRenderSVGViewportContainer(RenderObject* object)
+{
+    ASSERT(!object || !strcmp(object->renderName(), "RenderSVGViewportContainer"));
+    return static_cast<RenderSVGViewportContainer*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderSVGViewportContainer(const RenderSVGViewportContainer*);
+
 } // namespace WebCore
 
 #endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderScrollbar.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderScrollbar.cpp
index 32cea92..63fce8d 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderScrollbar.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderScrollbar.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -25,6 +25,7 @@
 
 #include "config.h"
 #include "RenderScrollbar.h"
+
 #include "RenderScrollbarPart.h"
 #include "RenderScrollbarTheme.h"
 
@@ -39,6 +40,16 @@ RenderScrollbar::RenderScrollbar(ScrollbarClient* client, ScrollbarOrientation o
     : Scrollbar(client, orientation, RegularScrollbar, RenderScrollbarTheme::renderScrollbarTheme())
     , m_owner(renderer)
 {
+    // FIXME: We need to do this because RenderScrollbar::styleChanged is called as soon as the scrollbar is created.
+    
+    // Update the scrollbar size.
+    updateScrollbarPart(ScrollbarBGPart);
+    RenderScrollbarPart* part = m_parts.get(ScrollbarBGPart);
+    if (!part)
+        return;
+
+    part->layout();
+    setFrameRect(IntRect(0, 0, part->width(), part->height()));
 }
 
 RenderScrollbar::~RenderScrollbar()
@@ -173,9 +184,14 @@ static PseudoId pseudoForScrollbarPart(ScrollbarPart part)
             return SCROLLBAR_THUMB;
         case TrackBGPart:
             return SCROLLBAR_TRACK;
-        default:
+        case ScrollbarBGPart:
             return SCROLLBAR;
+        case NoPart:
+        case AllParts:
+            break;
     }
+    ASSERT_NOT_REACHED();
+    return SCROLLBAR;
 }
 
 void RenderScrollbar::updateScrollbarPart(ScrollbarPart partType, bool destroy)
@@ -183,7 +199,7 @@ void RenderScrollbar::updateScrollbarPart(ScrollbarPart partType, bool destroy)
     if (partType == NoPart)
         return;
 
-    RefPtr<RenderStyle> partStyle = !destroy ? getScrollbarPseudoStyle(partType,  pseudoForScrollbarPart(partType)) : PassRefPtr<RenderStyle>(0);
+    RefPtr<RenderStyle> partStyle = !destroy ? getScrollbarPseudoStyle(partType,  pseudoForScrollbarPart(partType)) : 0;
     
     bool needRenderer = !destroy && partStyle && partStyle->display() != NONE && partStyle->visibility() == VISIBLE;
     
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderScrollbar.h b/src/3rdparty/webkit/WebCore/rendering/RenderScrollbar.h
index 245d750..b3c00ef 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderScrollbar.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderScrollbar.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -33,7 +33,6 @@
 namespace WebCore {
 
 class RenderBox;
-class RenderStyle;
 class RenderScrollbarPart;
 class RenderStyle;
 
@@ -46,21 +45,9 @@ public:
     static PassRefPtr<Scrollbar> createCustomScrollbar(ScrollbarClient*, ScrollbarOrientation, RenderBox*);
     virtual ~RenderScrollbar();
 
-    virtual void setParent(ScrollView*);
-    virtual void setEnabled(bool);
-
-    virtual void paint(GraphicsContext*, const IntRect& damageRect);
-
-    virtual void setHoveredPart(ScrollbarPart);
-    virtual void setPressedPart(ScrollbarPart);
-
-    void updateScrollbarParts(bool destroy = false);
-
     static ScrollbarPart partForStyleResolve();
     static RenderScrollbar* scrollbarForStyleResolve();
 
-    virtual void styleChanged();
-
     RenderBox* owningRenderer() const { return m_owner; }
 
     void paintPart(GraphicsContext*, ScrollbarPart, const IntRect&);
@@ -70,9 +57,22 @@ public:
     IntRect trackPieceRectWithMargins(ScrollbarPart, const IntRect&);
 
     int minimumThumbLength();
-    virtual bool isCustomScrollbar() const { return true; }
 
 private:
+    virtual void setParent(ScrollView*);
+    virtual void setEnabled(bool);
+
+    virtual void paint(GraphicsContext*, const IntRect& damageRect);
+
+    virtual void setHoveredPart(ScrollbarPart);
+    virtual void setPressedPart(ScrollbarPart);
+
+    virtual void styleChanged();
+
+    virtual bool isCustomScrollbar() const { return true; }
+
+    void updateScrollbarParts(bool destroy = false);
+
     PassRefPtr<RenderStyle> getScrollbarPseudoStyle(ScrollbarPart, PseudoId);
     void updateScrollbarPart(ScrollbarPart, bool destroy = false);
 
@@ -80,6 +80,15 @@ private:
     HashMap<unsigned, RenderScrollbarPart*> m_parts;
 };
 
+inline RenderScrollbar* toRenderScrollbar(Scrollbar* scrollbar)
+{
+    ASSERT(!scrollbar || scrollbar->isCustomScrollbar());
+    return static_cast<RenderScrollbar*>(scrollbar);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderScrollbar(const RenderScrollbar*);
+
 } // namespace WebCore
 
 #endif // RenderScrollbar_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderScrollbarPart.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderScrollbarPart.cpp
index 0f29aeb..c83248a 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderScrollbarPart.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderScrollbarPart.cpp
@@ -27,6 +27,7 @@
 #include "RenderScrollbarPart.h"
 #include "RenderScrollbar.h"
 #include "RenderScrollbarTheme.h"
+#include "RenderView.h"
 
 using namespace std;
 
@@ -51,9 +52,6 @@ void RenderScrollbarPart::layout()
     else
         layoutVerticalPart();
 
-    m_overflowWidth = max(width(), m_overflowWidth);
-    m_overflowHeight = max(height(), m_overflowHeight);
-    
     setNeedsLayout(false);
 }
 
@@ -143,8 +141,16 @@ void RenderScrollbarPart::imageChanged(WrappedImagePtr image, const IntRect* rec
 {
     if (m_scrollbar && m_part != NoPart)
         m_scrollbar->theme()->invalidatePart(m_scrollbar, m_part);
-    else
+    else {
+        if (FrameView* frameView = view()->frameView()) {
+            if (frameView->isFrameViewScrollCorner(this)) {
+                frameView->invalidateScrollCorner();
+                return;
+            }
+        }
+        
         RenderBlock::imageChanged(image, rect);
+    }
 }
 
 void RenderScrollbarPart::paintIntoRect(GraphicsContext* graphicsContext, int tx, int ty, const IntRect& rect)
@@ -153,8 +159,6 @@ void RenderScrollbarPart::paintIntoRect(GraphicsContext* graphicsContext, int tx
     setLocation(rect.x() - tx, rect.y() - ty);
     setWidth(rect.width());
     setHeight(rect.height());
-    setOverflowWidth(max(rect.width(), overflowWidth()));
-    setOverflowHeight(max(rect.height(), overflowHeight()));
 
     if (graphicsContext->paintingDisabled())
         return;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderScrollbarTheme.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderScrollbarTheme.cpp
index d7cfb2b..06ca32a 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderScrollbarTheme.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderScrollbarTheme.cpp
@@ -66,17 +66,17 @@ bool RenderScrollbarTheme::hasThumb(Scrollbar* scrollbar)
 
 int RenderScrollbarTheme::minimumThumbLength(Scrollbar* scrollbar)
 {
-    return static_cast<RenderScrollbar*>(scrollbar)->minimumThumbLength();
+    return toRenderScrollbar(scrollbar)->minimumThumbLength();
 }
 
 IntRect RenderScrollbarTheme::backButtonRect(Scrollbar* scrollbar, ScrollbarPart partType, bool)
 {
-    return static_cast<RenderScrollbar*>(scrollbar)->buttonRect(partType);
+    return toRenderScrollbar(scrollbar)->buttonRect(partType);
 }
 
 IntRect RenderScrollbarTheme::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart partType, bool)
 {
-    return static_cast<RenderScrollbar*>(scrollbar)->buttonRect(partType);
+    return toRenderScrollbar(scrollbar)->buttonRect(partType);
 }
 
 IntRect RenderScrollbarTheme::trackRect(Scrollbar* scrollbar, bool)
@@ -88,13 +88,13 @@ IntRect RenderScrollbarTheme::trackRect(Scrollbar* scrollbar, bool)
     int endLength;
     buttonSizesAlongTrackAxis(scrollbar, startLength, endLength);
     
-    return static_cast<RenderScrollbar*>(scrollbar)->trackRect(startLength, endLength);
+    return toRenderScrollbar(scrollbar)->trackRect(startLength, endLength);
 }
 
 IntRect RenderScrollbarTheme::constrainTrackRectToTrackPieces(Scrollbar* scrollbar, const IntRect& rect)
 { 
-    IntRect backRect = static_cast<RenderScrollbar*>(scrollbar)->trackPieceRectWithMargins(BackTrackPart, rect);
-    IntRect forwardRect = static_cast<RenderScrollbar*>(scrollbar)->trackPieceRectWithMargins(ForwardTrackPart, rect);
+    IntRect backRect = toRenderScrollbar(scrollbar)->trackPieceRectWithMargins(BackTrackPart, rect);
+    IntRect forwardRect = toRenderScrollbar(scrollbar)->trackPieceRectWithMargins(ForwardTrackPart, rect);
     IntRect result = rect;
     if (scrollbar->orientation() == HorizontalScrollbar) {
         result.setX(backRect.x());
@@ -114,27 +114,27 @@ void RenderScrollbarTheme::paintScrollCorner(ScrollView*, GraphicsContext* conte
 
 void RenderScrollbarTheme::paintScrollbarBackground(GraphicsContext* context, Scrollbar* scrollbar)
 {
-    static_cast<RenderScrollbar*>(scrollbar)->paintPart(context, ScrollbarBGPart, scrollbar->frameRect());
+    toRenderScrollbar(scrollbar)->paintPart(context, ScrollbarBGPart, scrollbar->frameRect());
 }
 
 void RenderScrollbarTheme::paintTrackBackground(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect)
 {
-    static_cast<RenderScrollbar*>(scrollbar)->paintPart(context, TrackBGPart, rect);
+    toRenderScrollbar(scrollbar)->paintPart(context, TrackBGPart, rect);
 }
 
 void RenderScrollbarTheme::paintTrackPiece(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart part)
 {
-    static_cast<RenderScrollbar*>(scrollbar)->paintPart(context, part, rect);
+    toRenderScrollbar(scrollbar)->paintPart(context, part, rect);
 }
 
 void RenderScrollbarTheme::paintButton(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart part)
 {
-    static_cast<RenderScrollbar*>(scrollbar)->paintPart(context, part, rect);
+    toRenderScrollbar(scrollbar)->paintPart(context, part, rect);
 }
 
 void RenderScrollbarTheme::paintThumb(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect)
 {
-    static_cast<RenderScrollbar*>(scrollbar)->paintPart(context, ThumbPart, rect);
+    toRenderScrollbar(scrollbar)->paintPart(context, ThumbPart, rect);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSlider.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSlider.cpp
index 7df7743..247acda 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSlider.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSlider.cpp
@@ -152,7 +152,7 @@ void SliderThumbElement::defaultEventHandler(Event* event)
 
     if (eventType == eventNames().mousedownEvent && isLeftButton) {
         if (document()->frame() && renderer()) {
-            RenderSlider* slider = static_cast<RenderSlider*>(renderer()->parent());
+            RenderSlider* slider = toRenderSlider(renderer()->parent());
             if (slider) {
                 if (slider->mouseEventIsInThumb(mouseEvent)) {
                     // We selected the thumb, we want the cursor to always stay at
@@ -181,7 +181,7 @@ void SliderThumbElement::defaultEventHandler(Event* event)
         }
     } else if (eventType == eventNames().mousemoveEvent) {
         if (m_inDragMode && renderer() && renderer()->parent()) {
-            RenderSlider* slider = static_cast<RenderSlider*>(renderer()->parent());
+            RenderSlider* slider = toRenderSlider(renderer()->parent());
             if (slider) {
                 FloatPoint curPoint = slider->absoluteToLocal(mouseEvent->absoluteLocation(), false, true);
                 IntPoint eventOffset(curPoint.x() + m_offsetToThumb.x(), curPoint.y() + m_offsetToThumb.y());
@@ -281,10 +281,36 @@ PassRefPtr<RenderStyle> RenderSlider::createThumbStyle(const RenderStyle* parent
         style->setAppearance(SliderThumbHorizontalPart);
     else if (parentStyle->appearance() == MediaSliderPart)
         style->setAppearance(MediaSliderThumbPart);
+    else if (parentStyle->appearance() == MediaVolumeSliderPart)
+        style->setAppearance(MediaVolumeSliderThumbPart);
 
     return style.release();
 }
 
+IntRect RenderSlider::thumbRect()
+{
+    if (!m_thumb)
+        return IntRect();
+
+    IntRect thumbRect;
+    RenderBox* thumb = toRenderBox(m_thumb->renderer());
+
+    thumbRect.setWidth(thumb->style()->width().calcMinValue(contentWidth()));
+    thumbRect.setHeight(thumb->style()->height().calcMinValue(contentHeight()));
+
+    double fraction = sliderPosition(static_cast<HTMLInputElement*>(node()));
+    IntRect contentRect = contentBoxRect();
+    if (style()->appearance() == SliderVerticalPart || style()->appearance() == MediaVolumeSliderPart) {
+        thumbRect.setX(contentRect.x() + (contentRect.width() - thumbRect.width()) / 2);
+        thumbRect.setY(contentRect.y() + static_cast<int>(nextafter((contentRect.height() - thumbRect.height()) + 1, 0) * (1 - fraction)));
+    } else {
+        thumbRect.setX(contentRect.x() + static_cast<int>(nextafter((contentRect.width() - thumbRect.width()) + 1, 0) * fraction));
+        thumbRect.setY(contentRect.y() + (contentRect.height() - thumbRect.height()) / 2);
+    }
+
+    return thumbRect;
+}
+
 void RenderSlider::layout()
 {
     ASSERT(needsLayout());
@@ -312,8 +338,6 @@ void RenderSlider::layout()
     calcWidth();
     calcHeight();
 
-    IntRect overflowRect(IntPoint(), size());
-
     if (thumb) {
         if (oldSize != size())
             thumb->setChildNeedsLayout(true, false);
@@ -324,39 +348,15 @@ void RenderSlider::layout()
 
         thumb->layoutIfNeeded();
 
-        IntRect thumbRect;
-
-        thumbRect.setWidth(thumb->style()->width().calcMinValue(contentWidth()));
-        thumbRect.setHeight(thumb->style()->height().calcMinValue(contentHeight()));
-
-        double fraction = sliderPosition(static_cast<HTMLInputElement*>(node()));
-        IntRect contentRect = contentBoxRect();
-        if (style()->appearance() == SliderVerticalPart) {
-            thumbRect.setX(contentRect.x() + (contentRect.width() - thumbRect.width()) / 2);
-            thumbRect.setY(contentRect.y() + static_cast<int>(nextafter((contentRect.height() - thumbRect.height()) + 1, 0) * (1 - fraction)));
-        } else {
-            thumbRect.setX(contentRect.x() + static_cast<int>(nextafter((contentRect.width() - thumbRect.width()) + 1, 0) * fraction));
-            thumbRect.setY(contentRect.y() + (contentRect.height() - thumbRect.height()) / 2);
-        }
-
-        thumb->setFrameRect(thumbRect);
-
+        IntRect rect = thumbRect();
+        thumb->setFrameRect(rect);
         if (thumb->checkForRepaintDuringLayout())
             thumb->repaintDuringLayoutIfMoved(oldThumbRect);
 
         statePusher.pop();
-
-        IntRect thumbOverflowRect = thumb->overflowRect();
-        thumbOverflowRect.move(thumb->x(), thumb->y());
-        overflowRect.unite(thumbOverflowRect);
     }
 
-    // FIXME: m_overflowWidth and m_overflowHeight should be renamed
-    // m_overflowRight and m_overflowBottom.
-    m_overflowLeft = overflowRect.x();
-    m_overflowTop = overflowRect.y();
-    m_overflowWidth = overflowRect.right();
-    m_overflowHeight = overflowRect.bottom();
+    addOverflowFromChild(thumb);
 
     repainter.repaintAfterLayout();    
 
@@ -393,7 +393,7 @@ bool RenderSlider::mouseEventIsInThumb(MouseEvent* evt)
         return false;
 
 #if ENABLE(VIDEO)
-    if (style()->appearance() == MediaSliderPart) {
+    if (style()->appearance() == MediaSliderPart || style()->appearance() == MediaVolumeSliderPart) {
         MediaControlInputElement *sliderThumb = static_cast<MediaControlInputElement*>(m_thumb->renderer()->node());
         return sliderThumb->hitTest(evt->absoluteLocation());
     }
@@ -425,7 +425,7 @@ void RenderSlider::setValueForPosition(int position)
     // Calculate the new value based on the position, and send it to the element.
     SliderRange range(element);
     double fraction = static_cast<double>(position) / trackSize();
-    if (style()->appearance() == SliderVerticalPart)
+    if (style()->appearance() == SliderVerticalPart || style()->appearance() == MediaVolumeSliderPart)
         fraction = 1 - fraction;
     double value = range.clampValue(range.valueFromProportion(fraction));
     element->setValueFromRenderer(String::number(value));
@@ -446,7 +446,7 @@ int RenderSlider::positionForOffset(const IntPoint& p)
         return 0;
 
     int position;
-    if (style()->appearance() == SliderVerticalPart)
+    if (style()->appearance() == SliderVerticalPart || style()->appearance() == MediaVolumeSliderPart)
         position = p.y() - m_thumb->renderBox()->height() / 2;
     else
         position = p.x() - m_thumb->renderBox()->width() / 2;
@@ -459,7 +459,7 @@ int RenderSlider::currentPosition()
     ASSERT(m_thumb);
     ASSERT(m_thumb->renderer());
 
-    if (style()->appearance() == SliderVerticalPart)
+    if (style()->appearance() == SliderVerticalPart || style()->appearance() == MediaVolumeSliderPart)
         return toRenderBox(m_thumb->renderer())->y() - contentBoxRect().y();
     return toRenderBox(m_thumb->renderer())->x() - contentBoxRect().x();
 }
@@ -469,7 +469,7 @@ int RenderSlider::trackSize()
     ASSERT(m_thumb);
     ASSERT(m_thumb->renderer());
 
-    if (style()->appearance() == SliderVerticalPart)
+    if (style()->appearance() == SliderVerticalPart || style()->appearance() == MediaVolumeSliderPart)
         return contentHeight() - m_thumb->renderBox()->height();
     return contentWidth() - m_thumb->renderBox()->width();
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSlider.h b/src/3rdparty/webkit/WebCore/rendering/RenderSlider.h
index 779d82f..92ad73b 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSlider.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSlider.h
@@ -36,6 +36,7 @@ namespace WebCore {
 
         void forwardEvent(Event*);
         bool inDragMode() const;
+        IntRect thumbRect();
 
     private:
         virtual const char* renderName() const { return "RenderSlider"; }
@@ -66,6 +67,15 @@ namespace WebCore {
         friend class SliderThumbElement;
     };
 
+    inline RenderSlider* toRenderSlider(RenderObject* object)
+    {
+        ASSERT(!object || object->isSlider());
+        return static_cast<RenderSlider*>(object);
+    }
+
+    // This will catch anyone doing an unnecessary cast.
+    void toRenderSlider(const RenderSlider*);
+
 } // namespace WebCore
 
 #endif // RenderSlider_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTable.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTable.cpp
index 009a375..73f3654 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTable.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTable.cpp
@@ -50,7 +50,6 @@ RenderTable::RenderTable(Node* node)
     , m_head(0)
     , m_foot(0)
     , m_firstBody(0)
-    , m_tableLayout(0)
     , m_currentBorder(0)
     , m_hasColElements(false)
     , m_needsSectionRecalc(0)
@@ -63,11 +62,6 @@ RenderTable::RenderTable(Node* node)
     m_columns.fill(ColumnStruct(), 1);
 }
 
-RenderTable::~RenderTable()
-{
-    delete m_tableLayout;
-}
-
 void RenderTable::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderBlock::styleDidChange(diff, oldStyle);
@@ -80,14 +74,12 @@ void RenderTable::styleDidChange(StyleDifference diff, const RenderStyle* oldSty
     m_columnPos[0] = m_hSpacing;
 
     if (!m_tableLayout || style()->tableLayout() != oldTableLayout) {
-        delete m_tableLayout;
-
         // According to the CSS2 spec, you only use fixed table layout if an
         // explicit width is specified on the table.  Auto width implies auto table layout.
         if (style()->tableLayout() == TFIXED && !style()->width().isAuto())
-            m_tableLayout = new FixedTableLayout(this);
+            m_tableLayout.set(new FixedTableLayout(this));
         else
-            m_tableLayout = new AutoTableLayout(this);
+            m_tableLayout.set(new AutoTableLayout(this));
     }
 }
 
@@ -130,18 +122,18 @@ void RenderTable::addChild(RenderObject* child, RenderObject* beforeChild)
             case TABLE_HEADER_GROUP:
                 resetSectionPointerIfNotBefore(m_head, beforeChild);
                 if (!m_head) {
-                    m_head = static_cast<RenderTableSection*>(child);
+                    m_head = toRenderTableSection(child);
                 } else {
                     resetSectionPointerIfNotBefore(m_firstBody, beforeChild);
                     if (!m_firstBody) 
-                        m_firstBody = static_cast<RenderTableSection*>(child);
+                        m_firstBody = toRenderTableSection(child);
                 }
                 wrapInAnonymousSection = false;
                 break;
             case TABLE_FOOTER_GROUP:
                 resetSectionPointerIfNotBefore(m_foot, beforeChild);
                 if (!m_foot) {
-                    m_foot = static_cast<RenderTableSection*>(child);
+                    m_foot = toRenderTableSection(child);
                     wrapInAnonymousSection = false;
                     break;
                 }
@@ -149,7 +141,7 @@ void RenderTable::addChild(RenderObject* child, RenderObject* beforeChild)
             case TABLE_ROW_GROUP:
                 resetSectionPointerIfNotBefore(m_firstBody, beforeChild);
                 if (!m_firstBody)
-                    m_firstBody = static_cast<RenderTableSection*>(child);
+                    m_firstBody = toRenderTableSection(child);
                 wrapInAnonymousSection = false;
                 break;
             default:
@@ -252,8 +244,8 @@ void RenderTable::layout()
     LayoutStateMaintainer statePusher(view(), this, IntSize(x(), y()));
 
     setHeight(0);
-    m_overflowHeight = 0;
-    m_overflowTop = 0;
+    m_overflow.clear();
+
     initMaxMarginValues();
     
     int oldWidth = width();
@@ -280,7 +272,7 @@ void RenderTable::layout()
     for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
         if (child->isTableSection()) {
             child->layoutIfNeeded();
-            RenderTableSection* section = static_cast<RenderTableSection*>(child);
+            RenderTableSection* section = toRenderTableSection(child);
             calculatedHeight += section->calcRowHeight();
             if (collapsing)
                 section->recalcOuterBorder();
@@ -295,9 +287,6 @@ void RenderTable::layout()
     if (m_caption)
         m_caption->layoutIfNeeded();
 
-    m_overflowWidth = width() + (collapsing ? outerBorderRight() - borderRight() : 0);
-    m_overflowLeft = collapsing ? borderLeft() - outerBorderLeft() : 0;
-
     // If any table section moved vertically, we will just repaint everything from that
     // section down (it is quite unlikely that any of the following sections
     // did not shift).
@@ -313,10 +302,6 @@ void RenderTable::layout()
             m_caption->repaintDuringLayoutIfMoved(captionRect);
 
         setHeight(height() + m_caption->height() + m_caption->marginTop() + m_caption->marginBottom());
-        m_overflowLeft = min(m_overflowLeft, m_caption->x() + m_caption->overflowLeft(false));
-        m_overflowWidth = max(m_overflowWidth, m_caption->x() + m_caption->overflowWidth(false));
-        m_overflowTop = min(m_overflowTop, m_caption->y() + m_caption->overflowTop(false));
-        m_overflowHeight = max(m_overflowHeight, m_caption->y() + m_caption->overflowHeight(false));
 
         if (height() != oldTableTop) {
             sectionMoved = true;
@@ -344,7 +329,7 @@ void RenderTable::layout()
     for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
         if (child->isTableSection())
             // FIXME: Distribute extra height between all table body sections instead of giving it all to the first one.
-            static_cast<RenderTableSection*>(child)->layoutRows(child == m_firstBody ? max(0, th - calculatedHeight) : 0);
+            toRenderTableSection(child)->layoutRows(child == m_firstBody ? max(0, th - calculatedHeight) : 0);
     }
 
     if (!m_firstBody && th > calculatedHeight && !style()->htmlHacks()) {
@@ -362,15 +347,11 @@ void RenderTable::layout()
     while (section) {
         if (!sectionMoved && section->y() != height()) {
             sectionMoved = true;
-            movedSectionTop = min(height(), section->y()) + section->overflowTop(false);
+            movedSectionTop = min(height(), section->y()) + section->topVisibleOverflow();
         }
         section->setLocation(bl, height());
 
         setHeight(height() + section->height());
-        m_overflowLeft = min(m_overflowLeft, section->x() + section->overflowLeft(false));
-        m_overflowWidth = max(m_overflowWidth, section->x() + section->overflowWidth(false));
-        m_overflowTop = min(m_overflowTop, section->y() + section->overflowTop(false));
-        m_overflowHeight = max(m_overflowHeight, section->y() + section->overflowHeight(false));
         section = sectionBelow(section);
     }
 
@@ -384,33 +365,34 @@ void RenderTable::layout()
             m_caption->repaintDuringLayoutIfMoved(captionRect);
 
         setHeight(height() + m_caption->height() + m_caption->marginTop() + m_caption->marginBottom());
-        m_overflowLeft = min(m_overflowLeft, m_caption->x() + m_caption->overflowLeft(false));
-        m_overflowWidth = max(m_overflowWidth, m_caption->x() + m_caption->overflowWidth(false));
     }
 
     if (isPositioned())
         calcHeight();
 
-    m_overflowHeight = max(m_overflowHeight, height());
-
     // table can be containing block of positioned elements.
     // FIXME: Only pass true if width or height changed.
     layoutPositionedObjects(true);
 
-    if (!hasOverflowClip()) {
-        for (ShadowData* boxShadow = style()->boxShadow(); boxShadow; boxShadow = boxShadow->next) {
-            m_overflowLeft = min(m_overflowLeft, boxShadow->x - boxShadow->blur);
-            m_overflowWidth = max(m_overflowWidth, width() + boxShadow->x + boxShadow->blur);
-            m_overflowTop = min(m_overflowTop, boxShadow->y - boxShadow->blur);
-            m_overflowHeight = max(m_overflowHeight, height() + boxShadow->y + boxShadow->blur);
-        }
-        
-        if (hasReflection()) {
-            IntRect reflection(reflectionBox());
-            m_overflowTop = min(m_overflowTop, reflection.y());
-            m_overflowHeight = max(m_overflowHeight, reflection.bottom());
-            m_overflowLeft = min(m_overflowLeft, reflection.x());
-            m_overflowHeight = max(m_overflowWidth, reflection.right());
+    // Add overflow from borders.
+    int rightBorderOverflow = width() + (collapsing ? outerBorderRight() - borderRight() : 0);
+    int leftBorderOverflow = collapsing ? borderLeft() - outerBorderLeft() : 0;
+    int bottomBorderOverflow = height() + (collapsing ? outerBorderBottom() - borderBottom() : 0);
+    int topBorderOverflow = collapsing ? borderTop() - outerBorderTop() : 0;
+    addLayoutOverflow(IntRect(leftBorderOverflow, topBorderOverflow, rightBorderOverflow - leftBorderOverflow, bottomBorderOverflow - topBorderOverflow));
+    
+    // Add visual overflow from box-shadow and reflections.
+    addShadowOverflow();
+    
+    // Add overflow from our caption.
+    if (m_caption)
+        addOverflowFromChild(m_caption);
+
+    // Add overflow from our sections.
+    for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
+        if (child->isTableSection()) {
+            RenderTableSection* section = toRenderTableSection(child);
+            addOverflowFromChild(section);
         }
     }
 
@@ -419,7 +401,7 @@ void RenderTable::layout()
     bool didFullRepaint = repainter.repaintAfterLayout();
     // Repaint with our new bounds if they are different from our old bounds.
     if (!didFullRepaint && sectionMoved)
-        repaintRectangle(IntRect(m_overflowLeft, movedSectionTop, m_overflowWidth - m_overflowLeft, m_overflowHeight - movedSectionTop));
+        repaintRectangle(IntRect(leftVisibleOverflow(), movedSectionTop, rightVisibleOverflow() - leftVisibleOverflow(), bottomVisibleOverflow() - movedSectionTop));
     
     setNeedsLayout(false);
 }
@@ -428,7 +410,7 @@ void RenderTable::setCellWidths()
 {
     for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
         if (child->isTableSection())
-            static_cast<RenderTableSection*>(child)->setCellWidths();
+            toRenderTableSection(child)->setCellWidths();
     }
 }
 
@@ -440,9 +422,9 @@ void RenderTable::paint(PaintInfo& paintInfo, int tx, int ty)
     PaintPhase paintPhase = paintInfo.phase;
 
     int os = 2 * maximalOutlineSize(paintPhase);
-    if (ty + overflowTop(false) >= paintInfo.rect.bottom() + os || ty + overflowHeight(false) <= paintInfo.rect.y() - os)
+    if (ty + topVisibleOverflow() >= paintInfo.rect.bottom() + os || ty + bottomVisibleOverflow() <= paintInfo.rect.y() - os)
         return;
-    if (tx + overflowLeft(false) >= paintInfo.rect.right() + os || tx + overflowWidth(false) <= paintInfo.rect.x() - os)
+    if (tx + leftVisibleOverflow() >= paintInfo.rect.right() + os || tx + rightVisibleOverflow() <= paintInfo.rect.x() - os)
         return;
 
     bool pushedClip = pushContentsClip(paintInfo, tx, ty);    
@@ -488,7 +470,7 @@ void RenderTable::paintObject(PaintInfo& paintInfo, int tx, int ty)
         RenderObject* stop = nextInPreOrderAfterChildren();
         for (RenderObject* o = firstChild(); o && o != stop; o = o->nextInPreOrder())
             if (o->isTableCell())
-                static_cast<RenderTableCell*>(o)->collectBorderStyles(borderStyles);
+                toRenderTableCell(o)->collectBorderStyles(borderStyles);
         RenderTableCell::sortBorderStyles(borderStyles);
         size_t count = borderStyles.size();
         for (size_t i = 0; i < count; ++i) {
@@ -571,7 +553,7 @@ void RenderTable::splitColumn(int pos, int firstSpan)
     // change width of all rows.
     for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
         if (child->isTableSection())
-            static_cast<RenderTableSection*>(child)->splitColumn(pos, oldSize + 1);
+            toRenderTableSection(child)->splitColumn(pos, oldSize + 1);
     }
 
     m_columnPos.grow(numEffCols() + 1);
@@ -589,7 +571,7 @@ void RenderTable::appendColumn(int span)
     // change width of all rows.
     for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
         if (child->isTableSection())
-            static_cast<RenderTableSection*>(child)->appendColumn(pos);
+            toRenderTableSection(child)->appendColumn(pos);
     }
 
     m_columnPos.grow(numEffCols() + 1);
@@ -605,7 +587,7 @@ RenderTableCol* RenderTable::colElement(int col, bool* startEdge, bool* endEdge)
 
     while (child) {
         if (child->isTableCol()) {
-            RenderTableCol* colElem = static_cast<RenderTableCol*>(child);
+            RenderTableCol* colElem = toRenderTableCol(child);
             int span = colElem->span();
             if (!colElem->firstChild()) {
                 int startCol = cCol;
@@ -658,7 +640,7 @@ void RenderTable::recalcSections() const
                 break;
             case TABLE_HEADER_GROUP:
                 if (child->isTableSection()) {
-                    RenderTableSection* section = static_cast<RenderTableSection*>(child);
+                    RenderTableSection* section = toRenderTableSection(child);
                     if (!m_head)
                         m_head = section;
                     else if (!m_firstBody)
@@ -668,7 +650,7 @@ void RenderTable::recalcSections() const
                 break;
             case TABLE_FOOTER_GROUP:
                 if (child->isTableSection()) {
-                    RenderTableSection* section = static_cast<RenderTableSection*>(child);
+                    RenderTableSection* section = toRenderTableSection(child);
                     if (!m_foot)
                         m_foot = section;
                     else if (!m_firstBody)
@@ -678,7 +660,7 @@ void RenderTable::recalcSections() const
                 break;
             case TABLE_ROW_GROUP:
                 if (child->isTableSection()) {
-                    RenderTableSection* section = static_cast<RenderTableSection*>(child);
+                    RenderTableSection* section = toRenderTableSection(child);
                     if (!m_firstBody)
                         m_firstBody = section;
                     section->recalcCellsIfNeeded();
@@ -693,7 +675,7 @@ void RenderTable::recalcSections() const
     int maxCols = 0;
     for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
         if (child->isTableSection()) {
-            RenderTableSection* section = static_cast<RenderTableSection*>(child);
+            RenderTableSection* section = toRenderTableSection(child);
             int sectionCols = section->numColumns();
             if (sectionCols > maxCols)
                 maxCols = sectionCols;
@@ -884,7 +866,7 @@ int RenderTable::outerBorderBottom() const
     else {
         RenderObject* child;
         for (child = lastChild(); child && !child->isTableSection(); child = child->previousSibling()) { }
-        bottomSection = child ? static_cast<RenderTableSection*>(child) : 0;
+        bottomSection = child ? toRenderTableSection(child) : 0;
     }
     if (bottomSection) {
         borderWidth = bottomSection->outerBorderBottom();
@@ -916,7 +898,7 @@ int RenderTable::outerBorderLeft() const
     for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
         if (!child->isTableSection())
             continue;
-        int sw = static_cast<RenderTableSection*>(child)->outerBorderLeft();
+        int sw = toRenderTableSection(child)->outerBorderLeft();
         if (sw == -1)
             continue;
         else
@@ -946,7 +928,7 @@ int RenderTable::outerBorderRight() const
     for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
         if (!child->isTableSection())
             continue;
-        int sw = static_cast<RenderTableSection*>(child)->outerBorderRight();
+        int sw = toRenderTableSection(child)->outerBorderRight();
         if (sw == -1)
             continue;
         else
@@ -968,13 +950,13 @@ RenderTableSection* RenderTable::sectionAbove(const RenderTableSection* section,
 
     RenderObject* prevSection = section == m_foot ? lastChild() : section->previousSibling();
     while (prevSection) {
-        if (prevSection->isTableSection() && prevSection != m_head && prevSection != m_foot && (!skipEmptySections || static_cast<RenderTableSection*>(prevSection)->numRows()))
+        if (prevSection->isTableSection() && prevSection != m_head && prevSection != m_foot && (!skipEmptySections || toRenderTableSection(prevSection)->numRows()))
             break;
         prevSection = prevSection->previousSibling();
     }
     if (!prevSection && m_head && (!skipEmptySections || m_head->numRows()))
         prevSection = m_head;
-    return static_cast<RenderTableSection*>(prevSection);
+    return toRenderTableSection(prevSection);
 }
 
 RenderTableSection* RenderTable::sectionBelow(const RenderTableSection* section, bool skipEmptySections) const
@@ -986,13 +968,13 @@ RenderTableSection* RenderTable::sectionBelow(const RenderTableSection* section,
 
     RenderObject* nextSection = section == m_head ? firstChild() : section->nextSibling();
     while (nextSection) {
-        if (nextSection->isTableSection() && nextSection != m_head && nextSection != m_foot && (!skipEmptySections || static_cast<RenderTableSection*>(nextSection)->numRows()))
+        if (nextSection->isTableSection() && nextSection != m_head && nextSection != m_foot && (!skipEmptySections || toRenderTableSection(nextSection)->numRows()))
             break;
         nextSection = nextSection->nextSibling();
     }
     if (!nextSection && m_foot && (!skipEmptySections || m_foot->numRows()))
         nextSection = m_foot;
-    return static_cast<RenderTableSection*>(nextSection);
+    return toRenderTableSection(nextSection);
 }
 
 RenderTableCell* RenderTable::cellAbove(const RenderTableCell* cell) const
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTable.h b/src/3rdparty/webkit/WebCore/rendering/RenderTable.h
index 07e02b0..e75d644 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTable.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTable.h
@@ -1,12 +1,10 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
  *           (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -40,13 +38,6 @@ class TableLayout;
 class RenderTable : public RenderBlock {
 public:
     RenderTable(Node*);
-    ~RenderTable();
-
-    virtual const char* renderName() const { return "RenderTable"; }
-
-    virtual bool isTable() const { return true; }
-
-    virtual bool avoidsFloats() const { return true; }
 
     int getColumnPos(int col) const { return m_columnPos[col]; }
 
@@ -70,26 +61,7 @@ public:
     int calcBorderRight() const;
     void recalcHorizontalBorders();
 
-    // overrides
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
-    virtual void removeChild(RenderObject* oldChild);
-
-    virtual void paint(PaintInfo&, int tx, int ty);
-    virtual void paintObject(PaintInfo&, int tx, int ty);
-    virtual void paintBoxDecorations(PaintInfo&, int tx, int ty);
-    virtual void paintMask(PaintInfo& paintInfo, int tx, int ty);
-    virtual void layout();
-    virtual void calcPrefWidths();
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int xPos, int yPos, int tx, int ty, HitTestAction);
-    
-    virtual int firstLineBoxBaseline() const;
-
-    virtual RenderBlock* firstLineBlock() const;
-    virtual void updateFirstLetter();
-    
-    virtual void setCellWidths();
-
-    virtual void calcWidth();
 
     struct ColumnStruct {
         enum {
@@ -163,8 +135,6 @@ public:
     
     bool hasSections() const { return m_head || m_foot || m_firstBody; }
 
-    virtual IntRect overflowClipRect(int tx, int ty);
-
     void recalcSectionsIfNeeded() const
     {
         if (m_needsSectionRecalc)
@@ -175,6 +145,33 @@ protected:
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
 private:
+    virtual const char* renderName() const { return "RenderTable"; }
+
+    virtual bool isTable() const { return true; }
+
+    virtual bool avoidsFloats() const { return true; }
+
+    virtual void removeChild(RenderObject* oldChild);
+
+    virtual void paint(PaintInfo&, int tx, int ty);
+    virtual void paintObject(PaintInfo&, int tx, int ty);
+    virtual void paintBoxDecorations(PaintInfo&, int tx, int ty);
+    virtual void paintMask(PaintInfo&, int tx, int ty);
+    virtual void layout();
+    virtual void calcPrefWidths();
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int xPos, int yPos, int tx, int ty, HitTestAction);
+    
+    virtual int firstLineBoxBaseline() const;
+
+    virtual RenderBlock* firstLineBlock() const;
+    virtual void updateFirstLetter();
+    
+    virtual void setCellWidths();
+
+    virtual void calcWidth();
+
+    virtual IntRect overflowClipRect(int tx, int ty);
+
     void recalcSections() const;
 
     mutable Vector<int> m_columnPos;
@@ -185,7 +182,7 @@ private:
     mutable RenderTableSection* m_foot;
     mutable RenderTableSection* m_firstBody;
 
-    TableLayout* m_tableLayout;
+    OwnPtr<TableLayout> m_tableLayout;
 
     const CollapsedBorderValue* m_currentBorder;
     
@@ -198,6 +195,21 @@ private:
     int m_borderRight;
 };
 
+inline RenderTable* toRenderTable(RenderObject* object)
+{
+    ASSERT(!object || object->isTable());
+    return static_cast<RenderTable*>(object);
+}
+
+inline const RenderTable* toRenderTable(const RenderObject* object)
+{
+    ASSERT(!object || object->isTable());
+    return static_cast<const RenderTable*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderTable(const RenderTable*);
+
 } // namespace WebCore
 
 #endif // RenderTable_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.cpp
index acdd5d5..8dc9145 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.cpp
@@ -193,9 +193,9 @@ IntRect RenderTableCell::clippedOverflowRectForRepaint(RenderBoxModelObject* rep
             right = max(right, below->borderHalfRight(true));
         }
     }
-    left = max(left, -overflowLeft(false));
-    top = max(top, -overflowTop(false));
-    IntRect r(-left, - top, left + max(width() + right, overflowWidth(false)), top + max(height() + bottom, overflowHeight(false)));
+    left = max(left, -leftVisibleOverflow());
+    top = max(top, -topVisibleOverflow());
+    IntRect r(-left, - top, left + max(width() + right, rightVisibleOverflow()), top + max(height() + bottom, bottomVisibleOverflow()));
 
     if (RenderView* v = view()) {
         // FIXME: layoutDelta needs to be applied in parts before/after transforms and
@@ -550,7 +550,7 @@ CollapsedBorderValue RenderTableCell::collapsedBottomBorder() const
     
     // Now check row groups.
     RenderTableSection* currSection = section();
-    if (row() + rowSpan() >= static_cast<RenderTableSection*>(currSection)->numRows()) {
+    if (row() + rowSpan() >= currSection->numRows()) {
         // (5) Our row group's bottom border.
         result = compareBorders(result, CollapsedBorderValue(&currSection->style()->borderBottom(), BROWGROUP));
         if (!result.exists())
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.h b/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.h
index a57b24b..8855dff 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.h
@@ -4,7 +4,7 @@
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
  *           (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -33,12 +33,6 @@ class RenderTableCell : public RenderBlock {
 public:
     RenderTableCell(Node*);
 
-    virtual const char* renderName() const { return isAnonymous() ? "RenderTableCell (anonymous)" : "RenderTableCell"; }
-
-    virtual bool isTableCell() const { return true; }
-
-    virtual void destroy();
-
     // FIXME: need to implement cellIndex
     int cellIndex() const { return 0; }
     void setCellIndex(int) { }
@@ -54,15 +48,13 @@ public:
     int row() const { return m_row; }
     void setRow(int row) { m_row = row; }
 
-    RenderTableSection* section() const { return static_cast<RenderTableSection*>(parent()->parent()); }
-    RenderTable* table() const { return static_cast<RenderTable*>(parent()->parent()->parent()); }
+    RenderTableSection* section() const { return toRenderTableSection(parent()->parent()); }
+    RenderTable* table() const { return toRenderTable(parent()->parent()->parent()); }
 
     Length styleOrColWidth() const;
 
-    virtual bool requiresLayer() const { return isPositioned() || isTransparent() || hasOverflowClip() || hasTransform() || hasMask() || hasReflection(); }
-
     virtual void calcPrefWidths();
-    virtual void calcWidth();
+
     void updateWidth(int);
 
     int borderLeft() const;
@@ -89,13 +81,8 @@ public:
     virtual void layout();
 
     virtual void paint(PaintInfo&, int tx, int ty);
-    virtual void paintBoxDecorations(PaintInfo&, int tx, int ty);
-    virtual void paintMask(PaintInfo& paintInfo, int tx, int ty);
-    void paintCollapsedBorder(GraphicsContext*, int x, int y, int w, int h);
-    void paintBackgroundsBehindCell(PaintInfo&, int tx, int ty, RenderObject* backgroundObject);
 
-    virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
-    virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect&, bool fixed = false);
+    void paintBackgroundsBehindCell(PaintInfo&, int tx, int ty, RenderObject* backgroundObject);
 
     virtual int baselinePosition(bool firstLine = false, bool isRootLineBox = false) const;
 
@@ -120,6 +107,24 @@ protected:
     virtual void mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, TransformState&) const;
 
 private:
+    virtual const char* renderName() const { return isAnonymous() ? "RenderTableCell (anonymous)" : "RenderTableCell"; }
+
+    virtual bool isTableCell() const { return true; }
+
+    virtual void destroy();
+
+    virtual bool requiresLayer() const { return isPositioned() || isTransparent() || hasOverflowClip() || hasTransform() || hasMask() || hasReflection(); }
+
+    virtual void calcWidth();
+
+    virtual void paintBoxDecorations(PaintInfo&, int tx, int ty);
+    virtual void paintMask(PaintInfo&, int tx, int ty);
+
+    virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
+    virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect&, bool fixed = false);
+
+    void paintCollapsedBorder(GraphicsContext*, int x, int y, int w, int h);
+
     int m_row;
     int m_column;
     int m_rowSpan;
@@ -129,6 +134,21 @@ private:
     int m_percentageHeight;
 };
 
+inline RenderTableCell* toRenderTableCell(RenderObject* object)
+{
+    ASSERT(!object || object->isTableCell());
+    return static_cast<RenderTableCell*>(object);
+}
+
+inline const RenderTableCell* toRenderTableCell(const RenderObject* object)
+{
+    ASSERT(!object || object->isTableCell());
+    return static_cast<const RenderTableCell*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderTableCell(const RenderTableCell*);
+
 } // namespace WebCore
 
 #endif // RenderTableCell_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTableCol.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTableCol.cpp
index d9a4172..80e74e1 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTableCol.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTableCol.cpp
@@ -1,12 +1,10 @@
-/**
- * This file is part of the DOM implementation for KDE.
- *
+/*
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
  *           (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
@@ -31,13 +29,15 @@
 #include "CachedImage.h"
 #include "HTMLNames.h"
 #include "HTMLTableColElement.h"
+#include "RenderTable.h"
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
 RenderTableCol::RenderTableCol(Node* node)
-    : RenderBox(node), m_span(1)
+    : RenderBox(node)
+    , m_span(1)
 {
     // init RenderObject attributes
     setInline(true); // our object is not Inline
@@ -75,10 +75,11 @@ IntRect RenderTableCol::clippedOverflowRectForRepaint(RenderBoxModelObject* repa
     // FIXME: Find a better way to do this, e.g., need to repaint all the cells that we
     // might have propagated a background color or borders into.
     // FIXME: check for repaintContainer each time here?
-    if (RenderObject* parentTable = table())
-        return parentTable->clippedOverflowRectForRepaint(repaintContainer);
 
-    return IntRect();
+    RenderTable* parentTable = table();
+    if (!parentTable)
+        return IntRect();
+    return parentTable->clippedOverflowRectForRepaint(repaintContainer);
 }
 
 void RenderTableCol::imageChanged(WrappedImagePtr, const IntRect*)
@@ -100,7 +101,7 @@ RenderTable* RenderTableCol::table() const
     RenderObject* table = parent();
     if (table && !table->isTable())
         table = table->parent();
-    return table && table->isTable() ? static_cast<RenderTable*>(table) : 0;
+    return table && table->isTable() ? toRenderTable(table) : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTableCol.h b/src/3rdparty/webkit/WebCore/rendering/RenderTableCol.h
index 12b6d9d..87209a1 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTableCol.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTableCol.h
@@ -1,12 +1,10 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
  *           (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
@@ -29,19 +27,27 @@
 #define RenderTableCol_h
 
 #include "RenderBox.h"
-#include "RenderTable.h"
 
 namespace WebCore {
 
+class RenderTable;
+
 class RenderTableCol : public RenderBox {
 public:
     RenderTableCol(Node*);
 
-    virtual RenderObjectChildList* virtualChildren() { return children(); }
-    virtual const RenderObjectChildList* virtualChildren() const { return children(); }
     const RenderObjectChildList* children() const { return &m_children; }
     RenderObjectChildList* children() { return &m_children; }
 
+    virtual void calcPrefWidths();
+
+    int span() const { return m_span; }
+    void setSpan(int span) { m_span = span; }
+
+private:
+    virtual RenderObjectChildList* virtualChildren() { return children(); }
+    virtual const RenderObjectChildList* virtualChildren() const { return children(); }
+
     virtual const char* renderName() const { return "RenderTableCol"; }
     virtual bool isTableCol() const { return true; }
     virtual int lineHeight(bool) const { return 0; }
@@ -54,18 +60,27 @@ public:
     virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
     virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
 
-    virtual void calcPrefWidths();
-
-    int span() const { return m_span; }
-    void setSpan(int s) { m_span = s; }
-
-private:
     RenderTable* table() const;
 
     RenderObjectChildList m_children;
     int m_span;
 };
 
+inline RenderTableCol* toRenderTableCol(RenderObject* object)
+{
+    ASSERT(!object || object->isTableCol());
+    return static_cast<RenderTableCol*>(object);
+}
+
+inline const RenderTableCol* toRenderTableCol(const RenderObject* object)
+{
+    ASSERT(!object || object->isTableCol());
+    return static_cast<const RenderTableCol*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderTableCol(const RenderTableCol*);
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTableRow.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTableRow.cpp
index 33b2c39..bafadfc 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTableRow.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTableRow.cpp
@@ -99,7 +99,7 @@ void RenderTableRow::addChild(RenderObject* child, RenderObject* beforeChild)
     while (beforeChild && beforeChild->parent() != this)
         beforeChild = beforeChild->parent();
 
-    RenderTableCell* cell = static_cast<RenderTableCell*>(child);
+    RenderTableCell* cell = toRenderTableCell(child);
 
     // Generated content can result in us having a null section so make sure to null check our parent.
     if (parent())
@@ -121,7 +121,7 @@ void RenderTableRow::layout()
 
     for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
         if (child->isTableCell()) {
-            RenderTableCell* cell = static_cast<RenderTableCell*>(child);
+            RenderTableCell* cell = toRenderTableCell(child);
             if (child->needsLayout()) {
                 cell->calcVerticalMargins();
                 cell->layout();
@@ -147,6 +147,11 @@ void RenderTableRow::layout()
 
 IntRect RenderTableRow::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
 {
+    ASSERT(parent());
+
+    if (repaintContainer == this)
+        return RenderBox::clippedOverflowRectForRepaint(repaintContainer);
+
     // For now, just repaint the whole table.
     // FIXME: Find a better way to do this, e.g., need to repaint all the cells that we
     // might have propagated a background color into.
@@ -185,7 +190,7 @@ void RenderTableRow::paint(PaintInfo& paintInfo, int tx, int ty)
         if (child->isTableCell()) {
             // Paint the row background behind the cell.
             if (paintInfo.phase == PaintPhaseBlockBackground || paintInfo.phase == PaintPhaseChildBlockBackground) {
-                RenderTableCell* cell = static_cast<RenderTableCell*>(child);
+                RenderTableCell* cell = toRenderTableCell(child);
                 cell->paintBackgroundsBehindCell(paintInfo, tx, ty, this);
             }
             if (!toRenderBox(child)->hasSelfPaintingLayer())
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTableRow.h b/src/3rdparty/webkit/WebCore/rendering/RenderTableRow.h
index 9622480..588252b 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTableRow.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTableRow.h
@@ -1,12 +1,10 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
  *           (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -35,15 +33,16 @@ class RenderTableRow : public RenderBox {
 public:
     RenderTableRow(Node*);
 
-    virtual RenderObjectChildList* virtualChildren() { return children(); }
-    virtual const RenderObjectChildList* virtualChildren() const { return children(); }
     const RenderObjectChildList* children() const { return &m_children; }
     RenderObjectChildList* children() { return &m_children; }
 
-    RenderTableSection* section() const { return static_cast<RenderTableSection*>(parent()); }
-    RenderTable* table() const { return static_cast<RenderTable*>(parent()->parent()); }
+    RenderTableSection* section() const { return toRenderTableSection(parent()); }
+    RenderTable* table() const { return toRenderTable(parent()->parent()); }
 
 private:
+    virtual RenderObjectChildList* virtualChildren() { return children(); }
+    virtual const RenderObjectChildList* virtualChildren() const { return children(); }
+
     virtual const char* renderName() const { return isAnonymous() ? "RenderTableRow (anonymous)" : "RenderTableRow"; }
 
     virtual bool isTableRow() const { return true; }
@@ -65,10 +64,24 @@ private:
 
     virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
 
-private:
     RenderObjectChildList m_children;
 };
 
+inline RenderTableRow* toRenderTableRow(RenderObject* object)
+{
+    ASSERT(!object || object->isTableRow());
+    return static_cast<RenderTableRow*>(object);
+}
+
+inline const RenderTableRow* toRenderTableRow(const RenderObject* object)
+{
+    ASSERT(!object || object->isTableRow());
+    return static_cast<const RenderTableRow*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderTableRow(const RenderTableRow*);
+
 } // namespace WebCore
 
 #endif // RenderTableRow_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTableSection.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTableSection.cpp
index 27c230b..b8ac497 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTableSection.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTableSection.cpp
@@ -51,10 +51,6 @@ RenderTableSection::RenderTableSection(Node* node)
     , m_outerBorderRight(0)
     , m_outerBorderTop(0)
     , m_outerBorderBottom(0)
-    , m_overflowLeft(0)
-    , m_overflowWidth(0)
-    , m_overflowTop(0)
-    , m_overflowHeight(0)
     , m_needsCellRecalc(false)
     , m_hasOverflowingCell(false)
 {
@@ -124,7 +120,7 @@ void RenderTableSection::addChild(RenderObject* child, RenderObject* beforeChild
     if (!ensureRows(m_cRow + 1))
         return;
 
-    m_grid[m_cRow].rowRenderer = static_cast<RenderTableRow*>(child);
+    m_grid[m_cRow].rowRenderer = toRenderTableRow(child);
 
     if (!beforeChild) {
         m_grid[m_cRow].height = child->style()->height();
@@ -419,10 +415,7 @@ int RenderTableSection::layoutRows(int toAdd)
     
     // Set the width of our section now.  The rows will also be this width.
     setWidth(table()->contentWidth());
-    m_overflowLeft = 0;
-    m_overflowWidth = width();
-    m_overflowTop = 0;
-    m_overflowHeight = 0;
+    m_overflow.clear();
     m_hasOverflowingCell = false;
 
     if (toAdd && totalRows && (m_rowPos[totalRows] || !nextSibling())) {
@@ -530,7 +523,7 @@ int RenderTableSection::layoutRows(int toAdd)
             for (RenderObject* o = cell->firstChild(); o; o = o->nextSibling()) {
                 if (!o->isText() && o->style()->height().isPercent() && (flexAllChildren || o->isReplaced() || (o->isBox() && toRenderBox(o)->scrollsOverflow()))) {
                     // Tables with no sections do not flex.
-                    if (!o->isTable() || static_cast<RenderTable*>(o)->hasSections()) {
+                    if (!o->isTable() || toRenderTable(o)->hasSections()) {
                         o->setNeedsLayout(true, false);
                         cellChildrenFlex = true;
                     }
@@ -623,12 +616,6 @@ int RenderTableSection::layoutRows(int toAdd)
             } else
                 cell->setLocation(table()->columnPositions()[c] + hspacing, m_rowPos[rindx]);
 
-            m_overflowLeft = min(m_overflowLeft, cell->x() + cell->overflowLeft(false));
-            m_overflowWidth = max(m_overflowWidth, cell->x() + cell->overflowWidth(false));
-            m_overflowTop = min(m_overflowTop, cell->y() + cell->overflowTop(false));
-            m_overflowHeight = max(m_overflowHeight, cell->y() + cell->overflowHeight(false));
-            m_hasOverflowingCell |= cell->overflowLeft(false) || cell->overflowWidth(false) > cell->width() || cell->overflowTop(false) || cell->overflowHeight(false) > cell->height();
-
             // If the cell moved, we have to repaint it as well as any floating/positioned
             // descendants.  An exception is if we need a layout.  In this case, we know we're going to
             // repaint ourselves (and the cell) anyway.
@@ -643,10 +630,23 @@ int RenderTableSection::layoutRows(int toAdd)
 
     ASSERT(!needsLayout());
 
+    setHeight(m_rowPos[totalRows]);
+
+    // Now that our height has been determined, add in overflow from cells.
+    for (int r = 0; r < totalRows; r++) {
+        for (int c = 0; c < nEffCols; c++) {
+            RenderTableCell* cell = cellAt(r, c).cell;
+            if (!cell)
+                continue;
+            if (r < totalRows - 1 && cell == cellAt(r + 1, c).cell)
+                continue;
+            addOverflowFromChild(cell);
+        }
+    }
+    m_hasOverflowingCell = m_overflow;
+    
     statePusher.pop();
 
-    setHeight(m_rowPos[totalRows]);
-    m_overflowHeight = max(m_overflowHeight, height());
     return height();
 }
 
@@ -659,7 +659,7 @@ int RenderTableSection::lowestPosition(bool includeOverflowInterior, bool includ
     for (RenderObject* row = firstChild(); row; row = row->nextSibling()) {
         for (RenderObject* curr = row->firstChild(); curr; curr = curr->nextSibling()) {
             if (curr->isTableCell()) {
-                RenderTableCell* cell = static_cast<RenderTableCell*>(curr);
+                RenderTableCell* cell = toRenderTableCell(curr);
                 bottom = max(bottom, cell->y() + cell->lowestPosition(false));
             }
         }
@@ -677,7 +677,7 @@ int RenderTableSection::rightmostPosition(bool includeOverflowInterior, bool inc
     for (RenderObject* row = firstChild(); row; row = row->nextSibling()) {
         for (RenderObject* curr = row->firstChild(); curr; curr = curr->nextSibling()) {
             if (curr->isTableCell()) {
-                RenderTableCell* cell = static_cast<RenderTableCell*>(curr);
+                RenderTableCell* cell = toRenderTableCell(curr);
                 right = max(right, cell->x() + cell->rightmostPosition(false));
             }
         }
@@ -695,7 +695,7 @@ int RenderTableSection::leftmostPosition(bool includeOverflowInterior, bool incl
     for (RenderObject* row = firstChild(); row; row = row->nextSibling()) {
         for (RenderObject* curr = row->firstChild(); curr; curr = curr->nextSibling()) {
             if (curr->isTableCell()) {
-                RenderTableCell* cell = static_cast<RenderTableCell*>(curr);
+                RenderTableCell* cell = toRenderTableCell(curr);
                 left = min(left, cell->x() + cell->leftmostPosition(false));
             }
         }
@@ -1027,7 +1027,7 @@ void RenderTableSection::paintObject(PaintInfo& paintInfo, int tx, int ty)
                 if (!cell || (r > startrow && (cellAt(r - 1, c).cell == cell)))
                     continue;
 
-                RenderTableRow* row = static_cast<RenderTableRow*>(cell->parent());
+                RenderTableRow* row = toRenderTableRow(cell->parent());
 
                 if (paintPhase == PaintPhaseBlockBackground || paintPhase == PaintPhaseChildBlockBackground) {
                     // We need to handle painting a stack of backgrounds.  This stack (from bottom to top) consists of
@@ -1081,12 +1081,12 @@ void RenderTableSection::recalcCells()
             if (!ensureRows(m_cRow + 1))
                 break;
             
-            RenderTableRow* tableRow = static_cast<RenderTableRow*>(row);
+            RenderTableRow* tableRow = toRenderTableRow(row);
             m_grid[m_cRow].rowRenderer = tableRow;
 
             for (RenderObject* cell = row->firstChild(); cell; cell = cell->nextSibling()) {
                 if (cell->isTableCell())
-                    addCell(static_cast<RenderTableCell*>(cell), tableRow);
+                    addCell(toRenderTableCell(cell), tableRow);
             }
         }
     }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTableSection.h b/src/3rdparty/webkit/WebCore/rendering/RenderTableSection.h
index 30614f0..9f6d5ea 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTableSection.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTableSection.h
@@ -1,12 +1,10 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
  *           (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -38,23 +36,12 @@ class RenderTableRow;
 class RenderTableSection : public RenderBox {
 public:
     RenderTableSection(Node*);
-    ~RenderTableSection();
+    virtual ~RenderTableSection();
 
-    virtual RenderObjectChildList* virtualChildren() { return children(); }
-    virtual const RenderObjectChildList* virtualChildren() const { return children(); }
     const RenderObjectChildList* children() const { return &m_children; }
     RenderObjectChildList* children() { return &m_children; }
 
-    virtual const char* renderName() const { return isAnonymous() ? "RenderTableSection (anonymous)" : "RenderTableSection"; }
-
-    virtual bool isTableSection() const { return true; }
-
-    virtual void destroy();
-
-    virtual void layout();
-
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
-    virtual void removeChild(RenderObject* oldChild);
 
     virtual int firstLineBoxBaseline() const;
 
@@ -64,7 +51,7 @@ public:
     int calcRowHeight();
     int layoutRows(int height);
 
-    RenderTable* table() const { return static_cast<RenderTable*>(parent()); }
+    RenderTable* table() const { return toRenderTable(parent()); }
 
     struct CellStruct {
         RenderTableCell* cell;
@@ -86,15 +73,6 @@ public:
     void appendColumn(int pos);
     void splitColumn(int pos, int newSize);
 
-    virtual int overflowWidth(bool includeInterior = true) const { return (!includeInterior && hasOverflowClip()) ? width() : m_overflowWidth; }
-    virtual int overflowLeft(bool includeInterior = true) const { return (!includeInterior && hasOverflowClip()) ? 0 : m_overflowLeft; }
-    virtual int overflowHeight(bool includeInterior = true) const { return (!includeInterior && hasOverflowClip()) ? height() : m_overflowHeight; }
-    virtual int overflowTop(bool includeInterior = true) const { return (!includeInterior && hasOverflowClip()) ? 0 : m_overflowTop; }
-
-    virtual int lowestPosition(bool includeOverflowInterior, bool includeSelf) const;
-    virtual int rightmostPosition(bool includeOverflowInterior, bool includeSelf) const;
-    virtual int leftmostPosition(bool includeOverflowInterior, bool includeSelf) const;
-
     int calcOuterBorderTop() const;
     int calcOuterBorderBottom() const;
     int calcOuterBorderLeft(bool rtl) const;
@@ -106,11 +84,6 @@ public:
     int outerBorderLeft() const { return m_outerBorderLeft; }
     int outerBorderRight() const { return m_outerBorderRight; }
 
-    virtual void paint(PaintInfo&, int tx, int ty);
-    virtual void paintObject(PaintInfo&, int tx, int ty);
-
-    virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
-
     int numRows() const { return m_gridRows; }
     int numColumns() const;
     void recalcCells();
@@ -129,9 +102,31 @@ public:
 
     int getBaseline(int row) { return m_grid[row].baseline; }
 
+private:
+    virtual RenderObjectChildList* virtualChildren() { return children(); }
+    virtual const RenderObjectChildList* virtualChildren() const { return children(); }
+
+    virtual const char* renderName() const { return isAnonymous() ? "RenderTableSection (anonymous)" : "RenderTableSection"; }
+
+    virtual bool isTableSection() const { return true; }
+
+    virtual void destroy();
+
+    virtual void layout();
+
+    virtual void removeChild(RenderObject* oldChild);
+
+    virtual int lowestPosition(bool includeOverflowInterior, bool includeSelf) const;
+    virtual int rightmostPosition(bool includeOverflowInterior, bool includeSelf) const;
+    virtual int leftmostPosition(bool includeOverflowInterior, bool includeSelf) const;
+
+    virtual void paint(PaintInfo&, int tx, int ty);
+    virtual void paintObject(PaintInfo&, int tx, int ty);
+
+    virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
+
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
 
-private:
     virtual int lineHeight(bool, bool) const { return 0; }
 
     bool ensureRows(int);
@@ -152,15 +147,26 @@ private:
     int m_outerBorderRight;
     int m_outerBorderTop;
     int m_outerBorderBottom;
-    int m_overflowLeft;
-    int m_overflowWidth;
-    int m_overflowTop;
-    int m_overflowHeight;
 
     bool m_needsCellRecalc;
     bool m_hasOverflowingCell;
 };
 
+inline RenderTableSection* toRenderTableSection(RenderObject* object)
+{
+    ASSERT(!object || object->isTableSection());
+    return static_cast<RenderTableSection*>(object);
+}
+
+inline const RenderTableSection* toRenderTableSection(const RenderObject* object)
+{
+    ASSERT(!object || object->isTableSection());
+    return static_cast<const RenderTableSection*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderTableSection(const RenderTableSection*);
+
 } // namespace WebCore
 
 #endif // RenderTableSection_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderText.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderText.cpp
index ada3961..40c3d75 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderText.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderText.cpp
@@ -207,7 +207,7 @@ void RenderText::deleteTextBoxes()
 PassRefPtr<StringImpl> RenderText::originalText() const
 {
     Node* e = node();
-    return e ? static_cast<Text*>(e)->string() : 0;
+    return e ? static_cast<Text*>(e)->dataImpl() : 0;
 }
 
 void RenderText::absoluteRects(Vector<IntRect>& rects, int tx, int ty)
@@ -328,13 +328,13 @@ VisiblePosition RenderText::positionForPoint(const IntPoint& point)
     int offset;
 
     // FIXME: We should be able to roll these special cases into the general cases in the loop below.
-    if (firstTextBox() && point.y() <  firstTextBox()->root()->bottomOverflow() && point.x() < firstTextBox()->m_x) {
+    if (firstTextBox() && point.y() <  firstTextBox()->root()->lineBottom() && point.x() < firstTextBox()->m_x) {
         // at the y coordinate of the first line or above
         // and the x coordinate is to the left of the first text box left edge
         offset = firstTextBox()->offsetForPosition(point.x());
         return createVisiblePosition(offset + firstTextBox()->start(), DOWNSTREAM);
     }
-    if (lastTextBox() && point.y() >= lastTextBox()->root()->topOverflow() && point.x() >= lastTextBox()->m_x + lastTextBox()->m_width) {
+    if (lastTextBox() && point.y() >= lastTextBox()->root()->lineTop() && point.x() >= lastTextBox()->m_x + lastTextBox()->m_width) {
         // at the y coordinate of the last line or below
         // and the x coordinate is to the right of the last text box right edge
         offset = lastTextBox()->offsetForPosition(point.x());
@@ -343,8 +343,8 @@ VisiblePosition RenderText::positionForPoint(const IntPoint& point)
 
     InlineTextBox* lastBoxAbove = 0;
     for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox()) {
-        if (point.y() >= box->root()->topOverflow()) {
-            int bottom = box->root()->nextRootBox() ? box->root()->nextRootBox()->topOverflow() : box->root()->bottomOverflow();
+        if (point.y() >= box->root()->lineTop()) {
+            int bottom = box->root()->nextRootBox() ? box->root()->nextRootBox()->lineTop() : box->root()->lineBottom();
             if (point.y() < bottom) {
                 offset = box->offsetForPosition(point.x());
 
@@ -387,8 +387,8 @@ IntRect RenderText::localCaretRect(InlineBox* inlineBox, int caretOffset, int* e
 
     InlineTextBox* box = static_cast<InlineTextBox*>(inlineBox);
 
-    int height = box->root()->bottomOverflow() - box->root()->topOverflow();
-    int top = box->root()->topOverflow();
+    int height = box->root()->lineBottom() - box->root()->lineTop();
+    int top = box->root()->lineTop();
 
     int left = box->positionForOffset(caretOffset);
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderText.h b/src/3rdparty/webkit/WebCore/rendering/RenderText.h
index 2e04a9e..915ff40 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderText.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderText.h
@@ -173,16 +173,16 @@ private:
     mutable bool m_knownNotToUseFallbackFonts : 1;
 };
 
-inline RenderText* toRenderText(RenderObject* o)
+inline RenderText* toRenderText(RenderObject* object)
 { 
-    ASSERT(!o || o->isText());
-    return static_cast<RenderText*>(o);
+    ASSERT(!object || object->isText());
+    return static_cast<RenderText*>(object);
 }
 
-inline const RenderText* toRenderText(const RenderObject* o)
+inline const RenderText* toRenderText(const RenderObject* object)
 { 
-    ASSERT(!o || o->isText());
-    return static_cast<const RenderText*>(o);
+    ASSERT(!object || object->isText());
+    return static_cast<const RenderText*>(object);
 }
 
 // This will catch anyone doing an unnecessary cast.
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.cpp
index 95e71dd..4f4b570 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.cpp
@@ -69,6 +69,7 @@ static Color disabledTextColor(const Color& textColor, const Color& backgroundCo
 
 RenderTextControl::RenderTextControl(Node* node)
     : RenderBlock(node)
+    , m_placeholderVisible(false)
     , m_edited(false)
     , m_userEdited(false)
 {
@@ -92,14 +93,22 @@ void RenderTextControl::styleDidChange(StyleDifference diff, const RenderStyle*
         // Reset them now to avoid getting a spurious layout hint.
         textBlockRenderer->style()->setHeight(Length());
         textBlockRenderer->style()->setWidth(Length());
-        textBlockRenderer->setStyle(textBlockStyle);
+        setInnerTextStyle(textBlockStyle);
+    }
+
+    setReplaced(isInline());
+}
+
+void RenderTextControl::setInnerTextStyle(PassRefPtr<RenderStyle> style)
+{
+    if (m_innerText) {
+        RefPtr<RenderStyle> textStyle = style;
+        m_innerText->renderer()->setStyle(textStyle);
         for (Node* n = m_innerText->firstChild(); n; n = n->traverseNextNode(m_innerText.get())) {
             if (n->renderer())
-                n->renderer()->setStyle(textBlockStyle);
+                n->renderer()->setStyle(textStyle);
         }
     }
-
-    setReplaced(isInline());
 }
 
 static inline bool updateUserModifyProperty(Node* node, RenderStyle* style)
@@ -173,7 +182,7 @@ void RenderTextControl::setInnerTextValue(const String& innerTextValue)
                 frame->editor()->clearUndoRedoOperations();
                 
                 if (AXObjectCache::accessibilityEnabled())
-                    document()->axObjectCache()->postNotification(this, "AXValueChanged", false);
+                    document()->axObjectCache()->postNotification(this, AXObjectCache::AXValueChanged, false);
             }
         }
 
@@ -506,4 +515,18 @@ HTMLElement* RenderTextControl::innerTextElement() const
     return m_innerText.get();
 }
 
+void RenderTextControl::updatePlaceholderVisibility(bool placeholderShouldBeVisible, bool placeholderValueChanged)
+{
+    bool oldPlaceholderVisible = m_placeholderVisible;
+    m_placeholderVisible = placeholderShouldBeVisible;
+    if (oldPlaceholderVisible != m_placeholderVisible || placeholderValueChanged) {
+        // Sets the inner text style to the normal style or :placeholder style.
+        setInnerTextStyle(createInnerTextStyle(textBaseStyle()));
+
+        // updateFromElement() of the subclasses updates the text content
+        // to the element's value(), placeholder(), or the empty string.
+        updateFromElement();
+    }
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.h b/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.h
index bce9619..3212a1b 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.h
@@ -34,17 +34,6 @@ class RenderTextControl : public RenderBlock {
 public:
     virtual ~RenderTextControl();
 
-    virtual const char* renderName() const { return "RenderTextControl"; }
-    virtual bool isTextControl() const { return true; }
-    virtual bool hasControlClip() const { return false; }
-    virtual IntRect controlClipRect(int tx, int ty) const;
-    virtual void calcHeight();
-    virtual void calcPrefWidths();
-    virtual void removeLeftoverAnonymousBlock(RenderBlock*) { }
-    virtual void updateFromElement();
-    virtual bool canHaveChildren() const { return false; }
-    virtual bool avoidsFloats() const { return true; }
-    
     bool isEdited() const { return m_edited; }
     void setEdited(bool isEdited) { m_edited = isEdited; }
 
@@ -64,13 +53,11 @@ public:
     String textWithHardLineBreaks();
     void selectionChanged(bool userTriggered);
 
-    virtual void addFocusRingRects(GraphicsContext*, int tx, int ty);
-
-    virtual bool canBeProgramaticallyScrolled(bool) const { return true; }
-
     VisiblePosition visiblePositionForIndex(int index);
     int indexForVisiblePosition(const VisiblePosition&);
 
+    void updatePlaceholderVisibility(bool, bool);
+
 protected:
     RenderTextControl(Node*);
 
@@ -91,11 +78,31 @@ protected:
     virtual void adjustControlHeightBasedOnLineHeight(int lineHeight) = 0;
     virtual void cacheSelection(int start, int end) = 0;
     virtual PassRefPtr<RenderStyle> createInnerTextStyle(const RenderStyle* startStyle) const = 0;
+    virtual RenderStyle* textBaseStyle() const = 0;
+
+    virtual void updateFromElement();
+    virtual void calcHeight();
 
     friend class TextIterator;
     HTMLElement* innerTextElement() const;
 
+    bool m_placeholderVisible;
+
 private:
+    virtual const char* renderName() const { return "RenderTextControl"; }
+    virtual bool isTextControl() const { return true; }
+    virtual bool hasControlClip() const { return false; }
+    virtual IntRect controlClipRect(int tx, int ty) const;
+    virtual void calcPrefWidths();
+    virtual void removeLeftoverAnonymousBlock(RenderBlock*) { }
+    virtual bool canHaveChildren() const { return false; }
+    virtual bool avoidsFloats() const { return true; }
+    void setInnerTextStyle(PassRefPtr<RenderStyle>);
+    
+    virtual void addFocusRingRects(GraphicsContext*, int tx, int ty);
+
+    virtual bool canBeProgramaticallyScrolled(bool) const { return true; }
+
     String finishText(Vector<UChar>&) const;
 
     bool m_edited;
@@ -103,16 +110,16 @@ private:
     RefPtr<TextControlInnerTextElement> m_innerText;
 };
 
-inline RenderTextControl* toRenderTextControl(RenderObject* o)
+inline RenderTextControl* toRenderTextControl(RenderObject* object)
 { 
-    ASSERT(!o || o->isTextControl());
-    return static_cast<RenderTextControl*>(o);
+    ASSERT(!object || object->isTextControl());
+    return static_cast<RenderTextControl*>(object);
 }
 
-inline const RenderTextControl* toRenderTextControl(const RenderObject* o)
+inline const RenderTextControl* toRenderTextControl(const RenderObject* object)
 { 
-    ASSERT(!o || o->isTextControl());
-    return static_cast<const RenderTextControl*>(o);
+    ASSERT(!object || object->isTextControl());
+    return static_cast<const RenderTextControl*>(object);
 }
 
 // This will catch anyone doing an unnecessary cast.
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.cpp
index 566a81c..8dfb858 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.cpp
@@ -24,14 +24,16 @@
 
 #include "EventNames.h"
 #include "Frame.h"
-#include "HitTestResult.h"
+#include "HTMLNames.h"
 #include "HTMLTextAreaElement.h"
+#include "HitTestResult.h"
 
 namespace WebCore {
 
 RenderTextControlMultiLine::RenderTextControlMultiLine(Node* node)
     : RenderTextControl(node)
 {
+    m_placeholderVisible = static_cast<HTMLTextAreaElement*>(node)->placeholderShouldBeVisible();
 }
 
 RenderTextControlMultiLine::~RenderTextControlMultiLine()
@@ -60,7 +62,10 @@ bool RenderTextControlMultiLine::nodeAtPoint(const HitTestRequest& request, HitT
     if (!RenderTextControl::nodeAtPoint(request, result, x, y, tx, ty, hitTestAction))
         return false;
 
-    if (result.innerNode() == node() || result.innerNode() == innerTextElement())
+    bool resultIsTextValueOrPlaceholder
+        = !m_placeholderVisible && result.innerNode() == innerTextElement()
+        || m_placeholderVisible && result.innerNode()->isDescendantOf(innerTextElement());
+    if (result.innerNode() == node() || resultIsTextValueOrPlaceholder)
         hitInnerTextElement(result, x, y, tx, ty);
 
     return true;
@@ -92,7 +97,11 @@ void RenderTextControlMultiLine::updateFromElement()
     createSubtreeIfNeeded(0);
     RenderTextControl::updateFromElement();
 
-    setInnerTextValue(static_cast<HTMLTextAreaElement*>(node())->value());
+    HTMLTextAreaElement* textArea = static_cast<HTMLTextAreaElement*>(node());
+    if (m_placeholderVisible)
+        setInnerTextValue(textArea->getAttribute(HTMLNames::placeholderAttr));
+    else
+        setInnerTextValue(textArea->value());
 }
 
 void RenderTextControlMultiLine::cacheSelection(int start, int end)
@@ -102,8 +111,15 @@ void RenderTextControlMultiLine::cacheSelection(int start, int end)
 
 PassRefPtr<RenderStyle> RenderTextControlMultiLine::createInnerTextStyle(const RenderStyle* startStyle) const
 {
-    RefPtr<RenderStyle> textBlockStyle = RenderStyle::create();
-    textBlockStyle->inheritFrom(startStyle);
+    RefPtr<RenderStyle> textBlockStyle;
+    if (m_placeholderVisible) {
+        if (RenderStyle* pseudoStyle = getCachedPseudoStyle(INPUT_PLACEHOLDER))
+            textBlockStyle = RenderStyle::clone(pseudoStyle);
+    }
+    if (!textBlockStyle) {
+        textBlockStyle = RenderStyle::create();
+        textBlockStyle->inheritFrom(startStyle);
+    }
 
     adjustInnerTextStyle(startStyle, textBlockStyle.get());
     textBlockStyle->setDisplay(BLOCK);
@@ -111,4 +127,9 @@ PassRefPtr<RenderStyle> RenderTextControlMultiLine::createInnerTextStyle(const R
     return textBlockStyle.release();
 }
 
+RenderStyle* RenderTextControlMultiLine::textBaseStyle() const
+{
+    return style();
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.h b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.h
index 579047d..333cfa8 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/) 
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -30,14 +31,15 @@ public:
     RenderTextControlMultiLine(Node*);
     virtual ~RenderTextControlMultiLine();
 
+    void forwardEvent(Event*);
+
+private:
     virtual bool isTextArea() const { return true; }
 
     virtual void subtreeHasChanged();
 
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
-    void forwardEvent(Event*);
 
-private:
     virtual int preferredContentWidth(float charWidth) const;
     virtual void adjustControlHeightBasedOnLineHeight(int lineHeight);
     virtual int baselinePosition(bool firstLine, bool isRootLineBox) const;
@@ -45,9 +47,19 @@ private:
     virtual void updateFromElement();
     virtual void cacheSelection(int start, int end);
 
+    virtual RenderStyle* textBaseStyle() const;
     virtual PassRefPtr<RenderStyle> createInnerTextStyle(const RenderStyle* startStyle) const;
 };
 
+inline RenderTextControlMultiLine* toRenderTextControlMultiLine(RenderObject* object)
+{ 
+    ASSERT(!object || object->isTextArea());
+    return static_cast<RenderTextControlMultiLine*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderTextControlMultiLine(const RenderTextControlMultiLine*);
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.cpp
index 9c022d6..794be17 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.cpp
@@ -50,12 +50,12 @@ using namespace HTMLNames;
 
 RenderTextControlSingleLine::RenderTextControlSingleLine(Node* node)
     : RenderTextControl(node)
-    , m_placeholderVisible(false)
     , m_searchPopupIsVisible(false)
     , m_shouldDrawCapsLockIndicator(false)
     , m_searchEventTimer(this, &RenderTextControlSingleLine::searchEventTimerFired)
     , m_searchPopup(0)
 {
+    m_placeholderVisible = inputElement()->placeholderShouldBeVisible();
 }
 
 RenderTextControlSingleLine::~RenderTextControlSingleLine()
@@ -69,25 +69,9 @@ RenderTextControlSingleLine::~RenderTextControlSingleLine()
         m_innerBlock->detach();
 }
 
-bool RenderTextControlSingleLine::placeholderShouldBeVisible() const
+RenderStyle* RenderTextControlSingleLine::textBaseStyle() const
 {
-    return inputElement()->placeholderShouldBeVisible();
-}
-
-void RenderTextControlSingleLine::updatePlaceholderVisibility()
-{
-    RenderStyle* parentStyle = m_innerBlock ? m_innerBlock->renderer()->style() : style();
-
-    RefPtr<RenderStyle> textBlockStyle = createInnerTextStyle(parentStyle);
-    HTMLElement* innerText = innerTextElement();
-    innerText->renderer()->setStyle(textBlockStyle);
-
-    for (Node* n = innerText->firstChild(); n; n = n->traverseNextNode(innerText)) {
-        if (RenderObject* renderer = n->renderer())
-            renderer->setStyle(textBlockStyle);
-    }
-
-    updateFromElement();
+    return m_innerBlock ? m_innerBlock->renderer()->style() : style();
 }
 
 void RenderTextControlSingleLine::addSearchResult()
@@ -163,8 +147,6 @@ void RenderTextControlSingleLine::hidePopup()
     ASSERT(node()->isHTMLElement());
     if (m_searchPopup)
         m_searchPopup->hide();
-
-    m_searchPopupIsVisible = false;
 }
 
 void RenderTextControlSingleLine::subtreeHasChanged()
@@ -173,7 +155,11 @@ void RenderTextControlSingleLine::subtreeHasChanged()
     RenderTextControl::subtreeHasChanged();
 
     InputElement* input = inputElement();
-    input->setValueFromRenderer(input->constrainValue(text()));
+    // We don't need to call sanitizeUserInputValue() function here because
+    // InputElement::handleBeforeTextInsertedEvent() has already called
+    // sanitizeUserInputValue().
+    // sanitizeValue() is needed because IME input doesn't dispatch BeforeTextInsertedEvent.
+    input->setValueFromRenderer(input->sanitizeValue(text()));
 
     if (m_cancelButton)
         updateCancelButtonVisibility();
@@ -469,9 +455,6 @@ void RenderTextControlSingleLine::updateFromElement()
     createSubtreeIfNeeded();
     RenderTextControl::updateFromElement();
 
-    bool placeholderVisibilityShouldChange = m_placeholderVisible != placeholderShouldBeVisible();
-    m_placeholderVisible = placeholderShouldBeVisible();
-
     if (m_cancelButton)
         updateCancelButtonVisibility();
 
@@ -479,7 +462,7 @@ void RenderTextControlSingleLine::updateFromElement()
         ExceptionCode ec = 0;
         innerTextElement()->setInnerText(inputElement()->placeholder(), ec);
         ASSERT(!ec);
-    } else if (!static_cast<Element*>(node())->formControlValueMatchesRenderer() || placeholderVisibilityShouldChange)
+    } else
         setInnerTextValue(inputElement()->value());
 
     if (m_searchPopupIsVisible)
@@ -494,7 +477,7 @@ void RenderTextControlSingleLine::cacheSelection(int start, int end)
 PassRefPtr<RenderStyle> RenderTextControlSingleLine::createInnerTextStyle(const RenderStyle* startStyle) const
 {
     RefPtr<RenderStyle> textBlockStyle;
-    if (placeholderShouldBeVisible()) {
+    if (m_placeholderVisible) {
         if (RenderStyle* pseudoStyle = getCachedPseudoStyle(INPUT_PLACEHOLDER))
             textBlockStyle = RenderStyle::clone(pseudoStyle);
     } 
@@ -524,7 +507,7 @@ PassRefPtr<RenderStyle> RenderTextControlSingleLine::createInnerTextStyle(const
     // After this, updateFromElement will immediately update the text displayed.
     // When the placeholder is no longer visible, updatePlaceholderVisiblity will reset the style, 
     // and the text security mode will be set back to the computed value correctly.
-    if (placeholderShouldBeVisible())
+    if (m_placeholderVisible)
         textBlockStyle->setTextSecurity(TSNONE);
 
     return textBlockStyle.release();
@@ -742,6 +725,11 @@ int RenderTextControlSingleLine::selectedIndex() const
     return -1;
 }
 
+void RenderTextControlSingleLine::popupDidHide()
+{
+    m_searchPopupIsVisible = false;
+}
+
 bool RenderTextControlSingleLine::itemIsSeparator(unsigned listIndex) const
 {
     // The separator will be the second to last item in our list.
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.h b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.h
index 23352b4..817efb2 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.h
@@ -1,4 +1,5 @@
 /*
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
@@ -38,28 +39,29 @@ public:
     RenderTextControlSingleLine(Node*);
     virtual ~RenderTextControlSingleLine();
 
-    virtual bool hasControlClip() const { return m_cancelButton; }
-    virtual bool isTextField() const { return true; }
-
     bool placeholderIsVisible() const { return m_placeholderVisible; }
     bool placeholderShouldBeVisible() const;
-    void updatePlaceholderVisibility();
 
     void addSearchResult();
     void stopSearchEventTimer();
 
     bool popupIsVisible() const { return m_searchPopupIsVisible; }
     void showPopup();
-    virtual void hidePopup(); // PopupMenuClient method
+    void hidePopup();
+
+    void forwardEvent(Event*);
+
+    void capsLockStateMayHaveChanged();
+
+private:
+    virtual bool hasControlClip() const { return m_cancelButton; }
+    virtual bool isTextField() const { return true; }
 
     virtual void subtreeHasChanged();
     virtual void paint(PaintInfo&, int tx, int ty);
     virtual void layout();
 
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
-    void forwardEvent(Event*);
-
-    void capsLockStateMayHaveChanged();
 
     virtual void autoscroll();
 
@@ -72,7 +74,6 @@ public:
     virtual void setScrollTop(int);
     virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1.0f);
 
-private:
     int textBlockWidth() const;
     virtual int preferredContentWidth(float charWidth) const;
     virtual void adjustControlHeightBasedOnLineHeight(int lineHeight);
@@ -82,6 +83,7 @@ private:
     virtual void cacheSelection(int start, int end);
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
+    virtual RenderStyle* textBaseStyle() const;
     virtual PassRefPtr<RenderStyle> createInnerTextStyle(const RenderStyle* startStyle) const;
     PassRefPtr<RenderStyle> createInnerBlockStyle(const RenderStyle* startStyle) const;
     PassRefPtr<RenderStyle> createResultsButtonStyle(const RenderStyle* startStyle) const;
@@ -94,10 +96,10 @@ private:
     void startSearchEventTimer();
     void searchEventTimerFired(Timer<RenderTextControlSingleLine>*);
 
-private:
     // PopupMenuClient methods
     virtual void valueChanged(unsigned listIndex, bool fireEvents = true);
     virtual String itemText(unsigned listIndex) const;
+    virtual String itemToolTip(unsigned) const { return String(); }
     virtual bool itemIsEnabled(unsigned listIndex) const;
     virtual PopupMenuStyle itemStyle(unsigned listIndex) const;
     virtual PopupMenuStyle menuStyle() const;
@@ -107,6 +109,7 @@ private:
     virtual int clientPaddingRight() const;
     virtual int listSize() const;
     virtual int selectedIndex() const;
+    virtual void popupDidHide();
     virtual bool itemIsSeparator(unsigned listIndex) const;
     virtual bool itemIsLabel(unsigned listIndex) const;
     virtual bool itemIsSelected(unsigned listIndex) const;
@@ -119,8 +122,6 @@ private:
 
     InputElement* inputElement() const;
 
-private:
-    bool m_placeholderVisible;
     bool m_searchPopupIsVisible;
     bool m_shouldDrawCapsLockIndicator;
 
@@ -133,6 +134,15 @@ private:
     Vector<String> m_recentSearches;
 };
 
+inline RenderTextControlSingleLine* toRenderTextControlSingleLine(RenderObject* object)
+{ 
+    ASSERT(!object || object->isTextField());
+    return static_cast<RenderTextControlSingleLine*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderTextControlSingleLine(const RenderTextControlSingleLine*);
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextFragment.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTextFragment.cpp
index 1d8fca6..9ff1106 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextFragment.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextFragment.cpp
@@ -28,7 +28,7 @@
 namespace WebCore {
 
 RenderTextFragment::RenderTextFragment(Node* node, StringImpl* str, int startOffset, int length)
-    : RenderText(node, str ? str->substring(startOffset, length) : PassRefPtr<StringImpl>(0))
+    : RenderText(node, str ? str->substring(startOffset, length) : 0)
     , m_start(startOffset)
     , m_end(length)
     , m_firstLetter(0)
@@ -47,7 +47,7 @@ RenderTextFragment::RenderTextFragment(Node* node, StringImpl* str)
 PassRefPtr<StringImpl> RenderTextFragment::originalText() const
 {
     Node* e = node();
-    RefPtr<StringImpl> result = (e ? static_cast<Text*>(e)->string() : contentString());
+    RefPtr<StringImpl> result = (e ? static_cast<Text*>(e)->dataImpl() : contentString());
     if (result && (start() > 0 || start() < result->length()))
         result = result->substring(start(), end());
     return result.release();
@@ -76,7 +76,7 @@ UChar RenderTextFragment::previousCharacter()
 {
     if (start()) {
         Node* e = node();
-        StringImpl*  original = (e ? static_cast<Text*>(e)->string() : contentString());
+        StringImpl*  original = (e ? static_cast<Text*>(e)->dataImpl() : contentString());
         if (original)
             return (*original)[start() - 1];
     }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTheme.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTheme.cpp
index d48652f..7b4dfe3 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTheme.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTheme.cpp
@@ -183,6 +183,7 @@ void RenderTheme::adjustStyle(CSSStyleSelector* selector, RenderStyle* style, El
         case MenulistButtonPart:
             return adjustMenuListButtonStyle(selector, style, e);
         case MediaSliderPart:
+        case MediaVolumeSliderPart:
         case SliderHorizontalPart:
         case SliderVerticalPart:
             return adjustSliderTrackStyle(selector, style, e);
@@ -278,6 +279,14 @@ bool RenderTheme::paint(RenderObject* o, const RenderObject::PaintInfo& paintInf
             if (o->parent()->isSlider())
                 return paintMediaSliderThumb(o, paintInfo, r);
             break;
+        case MediaVolumeSliderContainerPart:
+            return paintMediaVolumeSliderContainer(o, paintInfo, r);
+        case MediaVolumeSliderPart:
+            return paintMediaVolumeSliderTrack(o, paintInfo, r);
+        case MediaVolumeSliderThumbPart:
+            if (o->parent()->isSlider())
+                return paintMediaVolumeSliderThumb(o, paintInfo, r);
+            break;
         case MediaTimeRemainingPart:
             return paintMediaTimeRemaining(o, paintInfo, r);
         case MediaCurrentTimePart:
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTheme.h b/src/3rdparty/webkit/WebCore/rendering/RenderTheme.h
index 795daa2..c00c2eb 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTheme.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTheme.h
@@ -244,6 +244,9 @@ protected:
     virtual bool paintMediaSeekForwardButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaVolumeSliderContainer(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaVolumeSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaVolumeSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaRewindButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaReturnToRealtimeButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaControlsBackground(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumLinux.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumLinux.cpp
index c4020d3..9048ce3 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumLinux.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumLinux.cpp
@@ -45,6 +45,7 @@ PassRefPtr<RenderTheme> RenderTheme::themeForPage(Page* page)
 
 RenderThemeChromiumLinux::RenderThemeChromiumLinux()
 {
+    m_caretBlinkInterval = RenderTheme::caretBlinkInterval();
 }
 
 RenderThemeChromiumLinux::~RenderThemeChromiumLinux()
@@ -91,9 +92,34 @@ Color RenderThemeChromiumLinux::inactiveListBoxSelectionForegroundColor() const
     return Color(0x32, 0x32, 0x32);
 }
 
+void RenderThemeChromiumLinux::adjustSliderThumbSize(RenderObject* o) const
+{
+    // These sizes match the sizes in Chromium Win.
+    const int sliderThumbAlongAxis = 11;
+    const int sliderThumbAcrossAxis = 21;
+    if (o->style()->appearance() == SliderThumbHorizontalPart) {
+        o->style()->setWidth(Length(sliderThumbAlongAxis, Fixed));
+        o->style()->setHeight(Length(sliderThumbAcrossAxis, Fixed));
+    } else if (o->style()->appearance() == SliderThumbVerticalPart) {
+        o->style()->setWidth(Length(sliderThumbAcrossAxis, Fixed));
+        o->style()->setHeight(Length(sliderThumbAlongAxis, Fixed));
+    } else
+        RenderThemeChromiumSkia::adjustSliderThumbSize(o);
+}
+
 bool RenderThemeChromiumLinux::supportsControlTints() const
 {
     return true;
 }
 
+void RenderThemeChromiumLinux::setCaretBlinkInterval(double interval)
+{
+    m_caretBlinkInterval = interval;
+}
+
+double RenderThemeChromiumLinux::caretBlinkIntervalInternal() const
+{
+    return m_caretBlinkInterval;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumLinux.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumLinux.h
index e75ddd5..e137ad5 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumLinux.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumLinux.h
@@ -49,12 +49,19 @@ namespace WebCore {
         virtual Color inactiveListBoxSelectionBackgroundColor() const;
         virtual Color inactiveListBoxSelectionForegroundColor() const;
 
+        virtual void adjustSliderThumbSize(RenderObject*) const;
+
+        void setCaretBlinkInterval(double interval);
+        virtual double caretBlinkIntervalInternal() const;
+
     private:
         RenderThemeChromiumLinux();
         virtual ~RenderThemeChromiumLinux();
 
         // A general method asking if any control tinting is supported at all.
         virtual bool supportsControlTints() const;
+
+        double m_caretBlinkInterval;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.h
index f8204cf..0c417a2 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.h
@@ -62,7 +62,7 @@ namespace WebCore {
 
         virtual Color platformActiveSelectionBackgroundColor() const;
         virtual Color platformInactiveSelectionBackgroundColor() const;
-        virtual Color activeListBoxSelectionBackgroundColor() const;
+        virtual Color platformActiveListBoxSelectionBackgroundColor() const;
 
         virtual Color platformFocusRingColor() const;
         
@@ -156,6 +156,7 @@ namespace WebCore {
         IntSize sizeForSystemFont(RenderStyle*, const IntSize* sizes) const;
         void setFontFromControlSize(CSSStyleSelector*, RenderStyle*, NSControlSize) const;
 
+        void updateActiveState(NSCell*, const RenderObject*);
         void updateCheckedState(NSCell*, const RenderObject*);
         void updateEnabledState(NSCell*, const RenderObject*);
         void updateFocusedState(NSCell*, const RenderObject*);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.mm b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.mm
index efd28d9..659a0c6 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.mm
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.mm
@@ -50,6 +50,7 @@
 #import "RenderSlider.h"
 #import "RenderView.h"
 #import "SharedBuffer.h"
+#import "TimeRanges.h"
 #import "WebCoreSystemInterface.h"
 #import <wtf/RetainPtr.h>
 
@@ -167,7 +168,7 @@ Color RenderThemeChromiumMac::platformInactiveSelectionBackgroundColor() const
     return Color(static_cast<int>(255.0 * [color redComponent]), static_cast<int>(255.0 * [color greenComponent]), static_cast<int>(255.0 * [color blueComponent]));
 }
 
-Color RenderThemeChromiumMac::activeListBoxSelectionBackgroundColor() const
+Color RenderThemeChromiumMac::platformActiveListBoxSelectionBackgroundColor() const
 {
     NSColor* color = [[NSColor alternateSelectedControlColor] colorUsingColorSpaceName:NSDeviceRGBColorSpace];
     return Color(static_cast<int>(255.0 * [color redComponent]), static_cast<int>(255.0 * [color greenComponent]), static_cast<int>(255.0 * [color blueComponent]));
@@ -549,6 +550,25 @@ IntRect RenderThemeChromiumMac::inflateRect(const IntRect& r, const IntSize& siz
     return result;
 }
 
+// Updates the control tint (a.k.a. active state) of |cell| (from |o|).
+// In the Chromium port, the renderer runs as a background process and controls'
+// NSCell(s) lack a parent NSView. Therefore controls don't have their tint
+// color updated correctly when the application is activated/deactivated.
+// FocusController's setActive() is called when the application is
+// activated/deactivated, which causes a repaint at which time this code is
+// called.
+// This function should be called before drawing any NSCell-derived controls,
+// unless you're sure it isn't needed.
+void RenderThemeChromiumMac::updateActiveState(NSCell* cell, const RenderObject* o)
+{
+    NSControlTint oldTint = [cell controlTint];
+    NSControlTint tint = isActive(o) ? [NSColor currentControlTint] :
+                                       NSClearControlTint;
+
+    if (tint != oldTint)
+        [cell setControlTint:tint];
+}
+
 void RenderThemeChromiumMac::updateCheckedState(NSCell* cell, const RenderObject* o)
 {
     bool oldIndeterminate = [cell state] == NSMixedState;
@@ -765,6 +785,7 @@ void RenderThemeChromiumMac::setCheckboxCellState(const RenderObject* o, const I
     setControlSize(checkbox, checkboxSizes(), r.size(), o->style()->effectiveZoom());
 
     // Update the various states we respond to.
+    updateActiveState(checkbox, o);
     updateCheckedState(checkbox, o);
     updateEnabledState(checkbox, o);
     updatePressedState(checkbox, o);
@@ -846,6 +867,7 @@ void RenderThemeChromiumMac::setRadioCellState(const RenderObject* o, const IntR
     setControlSize(radio, radioSizes(), r.size(), o->style()->effectiveZoom());
 
     // Update the various states we respond to.
+    updateActiveState(radio, o);
     updateCheckedState(radio, o);
     updateEnabledState(radio, o);
     updatePressedState(radio, o);
@@ -976,6 +998,7 @@ void RenderThemeChromiumMac::setButtonCellState(const RenderObject* o, const Int
     [button setKeyEquivalent:(isDefaultButton ? @"\r" : @"")];
 
     // Update the various states we respond to.
+    updateActiveState(button, o);
     updateCheckedState(button, o);
     updateEnabledState(button, o);
     updatePressedState(button, o);
@@ -1414,6 +1437,7 @@ void RenderThemeChromiumMac::setPopupButtonCellState(const RenderObject* o, cons
     setControlSize(popupButton, popupButtonSizes(), r.size(), o->style()->effectiveZoom());
 
     // Update the various states we respond to.
+    updateActiveState(popupButton, o);
     updateCheckedState(popupButton, o);
     updateEnabledState(popupButton, o);
     updatePressedState(popupButton, o);
@@ -1496,6 +1520,7 @@ bool RenderThemeChromiumMac::paintSliderThumb(RenderObject* o, const RenderObjec
     LocalCurrentGraphicsContext localContext(paintInfo.context);
 
     // Update the various states we respond to.
+    updateActiveState(sliderThumbCell, o);
     updateEnabledState(sliderThumbCell, o->parent());
     updateFocusedState(sliderThumbCell, o->parent());
 
@@ -1506,7 +1531,7 @@ bool RenderThemeChromiumMac::paintSliderThumb(RenderObject* o, const RenderObjec
     else
         oldPressed = m_isSliderThumbHorizontalPressed;
 
-    bool pressed = static_cast<RenderSlider*>(o->parent())->inDragMode();
+    bool pressed = toRenderSlider(o->parent())->inDragMode();
 
     if (o->style()->appearance() == SliderThumbVerticalPart)
         m_isSliderThumbVerticalPressed = pressed;
@@ -1607,6 +1632,7 @@ void RenderThemeChromiumMac::setSearchCellState(RenderObject* o, const IntRect&
     [search setControlSize:controlSizeForFont(o->style())];
 
     // Update the various states we respond to.
+    updateActiveState(search, o);
     updateEnabledState(search, o);
     updateFocusedState(search, o);
 }
@@ -1667,6 +1693,7 @@ bool RenderThemeChromiumMac::paintSearchFieldCancelButton(RenderObject* o, const
 
     NSSearchFieldCell* search = this->search();
 
+    updateActiveState([search cancelButtonCell], o);
     updatePressedState([search cancelButtonCell], o);
 
     paintInfo.context->save();
@@ -1742,6 +1769,8 @@ bool RenderThemeChromiumMac::paintSearchFieldResultsDecoration(RenderObject* o,
 
     NSSearchFieldCell* search = this->search();
 
+    updateActiveState([search searchButtonCell], o);
+
     if ([search searchMenuTemplate] != nil)
         [search setSearchMenuTemplate:nil];
 
@@ -1769,6 +1798,8 @@ bool RenderThemeChromiumMac::paintSearchFieldResultsButton(RenderObject* o, cons
 
     NSSearchFieldCell* search = this->search();
 
+    updateActiveState([search searchButtonCell], o);
+
     if (![search searchMenuTemplate])
         [search setSearchMenuTemplate:searchMenuTemplate()];
 
@@ -1901,16 +1932,15 @@ bool RenderThemeChromiumMac::paintMediaSliderTrack(RenderObject* o, const Render
     if (!mediaElement)
         return false;
 
-    float timeLoaded = 0;
-    float currentTime = 0;
-    float duration = 0;
-    if (MediaPlayer* player = mediaElement->player()) {
-        duration = player->duration();
-        timeLoaded = player->maxTimeBuffered();
-        currentTime = player->currentTime();
-    }
+    RefPtr<TimeRanges> timeRanges = mediaElement->buffered();
+    ExceptionCode ignoredException;
+    float timeLoaded = timeRanges->length() ? timeRanges->end(0, ignoredException) : 0;
+    float currentTime = mediaElement->currentTime();
+    float duration = mediaElement->duration();
+    if (isnan(duration))
+        duration = 0;
 
-    bool shouldDrawEndCaps = !static_cast<RenderMedia*>(mediaElement->renderer())->shouldShowTimeDisplayControls();
+    bool shouldDrawEndCaps = !toRenderMedia(mediaElement->renderer())->shouldShowTimeDisplayControls();
     wkDrawMediaSliderTrack(MediaControllerThemeClassic, paintInfo.context->platformContext(), r, timeLoaded, currentTime, duration, shouldDrawEndCaps ? MediaUIPartDrawEndCapsFlag : 0);
 #endif
     return false;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp
index 95ffd02..e25eed3 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp
@@ -34,7 +34,9 @@
 #include "PlatformContextSkia.h"
 #include "RenderBox.h"
 #include "RenderObject.h"
+#include "RenderSlider.h"
 #include "ScrollbarTheme.h"
+#include "TimeRanges.h"
 #include "TransformationMatrix.h"
 #include "UserAgentStyleSheets.h"
 
@@ -52,10 +54,6 @@ enum PaddingType {
 
 static const int styledMenuListInternalPadding[4] = { 1, 4, 1, 4 };
 
-// The background for the media player controls should be a 60% opaque black rectangle. This
-// matches the UI mockups for the default UI theme.
-static const float defaultMediaControlOpacity = 0.6f;
-
 // These values all match Safari/Win.
 static const float defaultControlFontPixelSize = 13;
 static const float defaultCancelButtonSize = 9;
@@ -74,6 +72,30 @@ static void setSizeIfAuto(RenderStyle* style, const IntSize& size)
         style->setHeight(Length(size.height(), Fixed));
 }
 
+static void drawVertLine(SkCanvas* canvas, int x, int y1, int y2, const SkPaint& paint)
+{
+    SkIRect skrect;
+    skrect.set(x, y1, x + 1, y2 + 1);
+    canvas->drawIRect(skrect, paint);
+}
+
+static void drawHorizLine(SkCanvas* canvas, int x1, int x2, int y, const SkPaint& paint)
+{
+    SkIRect skrect;
+    skrect.set(x1, y, x2 + 1, y + 1);
+    canvas->drawIRect(skrect, paint);
+}
+
+static void drawBox(SkCanvas* canvas, const IntRect& rect, const SkPaint& paint)
+{
+    const int right = rect.x() + rect.width() - 1;
+    const int bottom = rect.y() + rect.height() - 1;
+    drawHorizLine(canvas, rect.x(), right, rect.y(), paint);
+    drawVertLine(canvas, right, rect.y(), bottom, paint);
+    drawHorizLine(canvas, rect.x(), right, bottom, paint);
+    drawVertLine(canvas, rect.x(), rect.y(), bottom, paint);
+}
+
 #if ENABLE(VIDEO)
 // Attempt to retrieve a HTMLMediaElement from a Node. Returns NULL if one cannot be found.
 static HTMLMediaElement* mediaElementParent(Node* node)
@@ -306,7 +328,7 @@ static void paintButtonLike(RenderTheme* theme, RenderObject* o, const RenderObj
     canvas->drawLine(rect.x() + 1, bottom - 1, right - 1, bottom - 1, paint);
     canvas->drawLine(rect.x(), rect.y() + 1, rect.x(), bottom - 1, paint);
 
-    paint.setARGB(0xff, 0, 0, 0);
+    paint.setColor(SK_ColorBLACK);
     SkPoint p[2];
     const int lightEnd = theme->isPressed(o) ? 1 : 0;
     const int darkEnd = !lightEnd;
@@ -466,58 +488,238 @@ bool RenderThemeChromiumSkia::paintSearchFieldResultsButton(RenderObject* o, con
 
 bool RenderThemeChromiumSkia::paintMediaButtonInternal(GraphicsContext* context, const IntRect& rect, Image* image)
 {
-    context->beginTransparencyLayer(defaultMediaControlOpacity);
-
-    // Draw background.
-    Color oldFill = context->fillColor();
-    Color oldStroke = context->strokeColor();
-
-    context->setFillColor(Color::black);
-    context->setStrokeColor(Color::black);
-    context->drawRect(rect);
-
-    context->setFillColor(oldFill);
-    context->setStrokeColor(oldStroke);
-
     // Create a destination rectangle for the image that is centered in the drawing rectangle, rounded left, and down.
     IntRect imageRect = image->rect();
     imageRect.setY(rect.y() + (rect.height() - image->height() + 1) / 2);
     imageRect.setX(rect.x() + (rect.width() - image->width() + 1) / 2);
 
-    context->drawImage(image, imageRect, CompositeSourceAtop);
-    context->endTransparencyLayer();
+    context->drawImage(image, imageRect);
+    return true;
+}
+
+bool RenderThemeChromiumSkia::paintMediaControlsBackground(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
+    if (!mediaElement)
+        return false;
+
+    if (!rect.isEmpty())
+    {
+        SkCanvas* canvas = paintInfo.context->platformContext()->canvas();
+        SkPaint paint;
+
+        // Draws the left border, it is always 1px wide.
+        paint.setColor(object->style()->borderLeftColor().rgb());
+        canvas->drawLine(rect.x() + 1, rect.y(),
+                         rect.x() + 1, rect.y() + rect.height(),
+                         paint);
+
+        // Draws the right border, it is always 1px wide.
+        paint.setColor(object->style()->borderRightColor().rgb());
+        canvas->drawLine(rect.x() + rect.width() - 1, rect.y(),
+                         rect.x() + rect.width() - 1, rect.y() + rect.height(),
+                         paint);
+    }
+    return true;
+#else
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(paintInfo);
+    UNUSED_PARAM(rect);
+    return false;
+#endif
+}
+
+bool RenderThemeChromiumSkia::paintMediaSliderTrack(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
+    if (!mediaElement)
+        return false;
+
+    SkCanvas* canvas = paintInfo.context->platformContext()->canvas();
+    SkRect backgroundRect;
+    backgroundRect.set(rect.x(), rect.y(), rect.x() + rect.width(), rect.y() + rect.height());
+
+    SkPaint paint;
+    paint.setAntiAlias(true);
+
+    // Draw the border of the time bar. The border only has one single color,
+    // width and radius. So use the property of the left border.
+    SkColor borderColor = object->style()->borderLeftColor().rgb();
+    int borderWidth = object->style()->borderLeftWidth();
+    IntSize borderRadius = object->style()->borderTopLeftRadius();
+    paint.setStyle(SkPaint::kStroke_Style);
+    paint.setStrokeWidth(borderWidth);
+    paint.setColor(borderColor);
+    canvas->drawRoundRect(backgroundRect, borderRadius.width(), borderRadius.height(), paint);
+
+    // Draw the background of the time bar.
+    SkColor backgroundColor = object->style()->backgroundColor().rgb();
+    paint.setStyle(SkPaint::kFill_Style);
+    paint.setColor(backgroundColor);
+    canvas->drawRoundRect(backgroundRect, borderRadius.width(), borderRadius.height(), paint);
+
+    if (backgroundRect.width() >= 3 && backgroundRect.height() >= 3)
+    {
+        // Draw the buffered ranges.
+        // FIXME: Draw multiple ranges if there are multiple buffered ranges.
+        SkRect bufferedRect;
+        bufferedRect.set(backgroundRect.fLeft + 2, backgroundRect.fTop + 2,
+                         backgroundRect.fRight - 1, backgroundRect.fBottom - 1);
+        int width = static_cast<int>(bufferedRect.width() * mediaElement->percentLoaded());
+        bufferedRect.fRight = bufferedRect.fLeft + width;
+
+        SkPoint points[2] = { { 0, bufferedRect.fTop }, { 0, bufferedRect.fBottom } };
+        SkColor startColor = object->style()->color().rgb();
+        SkColor endColor = SkColorSetRGB(SkColorGetR(startColor) / 2,
+                                         SkColorGetG(startColor) / 2,
+                                         SkColorGetB(startColor) / 2);
+        SkColor colors[2] = { startColor, endColor };
+        SkShader* gradient = SkGradientShader::CreateLinear(points, colors, 0,
+                                                            sizeof(points) / sizeof(points[0]),
+                                                            SkShader::kMirror_TileMode, 0);
+
+        paint.reset();
+        paint.setShader(gradient);
+        paint.setAntiAlias(true);
+        // Check for round rect with zero width or height, otherwise Skia will assert
+        if (bufferedRect.width() > 0 && bufferedRect.height() > 0)
+            canvas->drawRoundRect(bufferedRect, borderRadius.width(), borderRadius.height(), paint);
+        gradient->unref();
+    }
+    return true;
+#else
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(paintInfo);
+    UNUSED_PARAM(rect);
+    return false;
+#endif
+}
+
+bool RenderThemeChromiumSkia::paintMediaVolumeSliderTrack(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
+    if (!mediaElement)
+        return false;
+
+    SkCanvas* canvas = paintInfo.context->platformContext()->canvas();
+    SkPaint paint;
+    paint.setColor(SK_ColorWHITE);
+
+    int x = rect.x() + rect.width() / 2;
+    canvas->drawLine(x, rect.y(), x, rect.y() + rect.height(), paint);
+    return true;
+#else
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(paintInfo);
+    UNUSED_PARAM(rect);
+    return false;
+#endif
+}
+
+static Image* mediaSliderThumbImage()
+{
+    static Image* mediaSliderThumb = Image::loadPlatformResource("mediaSliderThumb").releaseRef();
+    return mediaSliderThumb;
+}
+
+static Image* mediaVolumeSliderThumbImage()
+{
+    static Image* mediaVolumeSliderThumb = Image::loadPlatformResource("mediaVolumeSliderThumb").releaseRef();
+    return mediaVolumeSliderThumb;
+}
 
+void RenderThemeChromiumSkia::adjustSliderThumbSize(RenderObject* object) const
+{
+#if ENABLE(VIDEO)
+    Image* thumbImage = 0;
+    if (object->style()->appearance() == MediaSliderThumbPart)
+        thumbImage = mediaSliderThumbImage();
+    else if (object->style()->appearance() == MediaVolumeSliderThumbPart)
+        thumbImage = mediaVolumeSliderThumbImage();
+
+    ASSERT(thumbImage);
+    object->style()->setWidth(Length(thumbImage->width(), Fixed));
+    object->style()->setHeight(Length(thumbImage->height(), Fixed));
+#else
+    UNUSED_PARAM(object);
+#endif
+}
+
+bool RenderThemeChromiumSkia::paintMediaSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    if (!object->parent()->isSlider())
+        return false;
+
+    return paintMediaButtonInternal(paintInfo.context, rect, mediaSliderThumbImage());
+#else
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(paintInfo);
+    UNUSED_PARAM(rect);
+    return false;
+#endif
+}
+
+bool RenderThemeChromiumSkia::paintMediaVolumeSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    if (!object->parent()->isSlider())
+        return false;
+
+    return paintMediaButtonInternal(paintInfo.context, rect, mediaVolumeSliderThumbImage());
+#else
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(paintInfo);
+    UNUSED_PARAM(rect);
     return false;
+#endif
 }
 
-bool RenderThemeChromiumSkia::paintMediaPlayButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+bool RenderThemeChromiumSkia::paintMediaPlayButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
-    HTMLMediaElement* mediaElement = mediaElementParent(o->node());
+    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
     if (!mediaElement)
         return false;
 
     static Image* mediaPlay = Image::loadPlatformResource("mediaPlay").releaseRef();
     static Image* mediaPause = Image::loadPlatformResource("mediaPause").releaseRef();
+    static Image* mediaPlayDisabled = Image::loadPlatformResource("mediaPlayDisabled").releaseRef();
+
+    if (mediaElement->networkState() == HTMLMediaElement::NETWORK_NO_SOURCE)
+        return paintMediaButtonInternal(paintInfo.context, rect, mediaPlayDisabled);
 
     return paintMediaButtonInternal(paintInfo.context, rect, mediaElement->paused() ? mediaPlay : mediaPause);
 #else
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(paintInfo);
+    UNUSED_PARAM(rect);
     return false;
 #endif
 }
 
-bool RenderThemeChromiumSkia::paintMediaMuteButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+bool RenderThemeChromiumSkia::paintMediaMuteButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
-    HTMLMediaElement* mediaElement = mediaElementParent(o->node());
+    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
     if (!mediaElement)
         return false;
 
     static Image* soundFull = Image::loadPlatformResource("mediaSoundFull").releaseRef();
     static Image* soundNone = Image::loadPlatformResource("mediaSoundNone").releaseRef();
+    static Image* soundDisabled = Image::loadPlatformResource("mediaSoundDisabled").releaseRef();
+
+    if (mediaElement->networkState() == HTMLMediaElement::NETWORK_NO_SOURCE || !mediaElement->hasAudio())
+        return paintMediaButtonInternal(paintInfo.context, rect, soundDisabled);
 
     return paintMediaButtonInternal(paintInfo.context, rect, mediaElement->muted() ? soundNone: soundFull);
 #else
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(paintInfo);
+    UNUSED_PARAM(rect);
     return false;
 #endif
 }
@@ -537,7 +739,7 @@ bool RenderThemeChromiumSkia::paintMenuList(RenderObject* o, const RenderObject:
     paintButtonLike(this, o, i, rect);
 
     SkPaint paint;
-    paint.setARGB(0xff, 0, 0, 0);
+    paint.setColor(SK_ColorBLACK);
     paint.setAntiAlias(true);
     paint.setStyle(SkPaint::kFill_Style);
 
@@ -562,6 +764,69 @@ bool RenderThemeChromiumSkia::paintMenuListButton(RenderObject* o, const RenderO
     return paintMenuList(o, i, rect);
 }
 
+bool RenderThemeChromiumSkia::paintSliderTrack(RenderObject*, const RenderObject::PaintInfo& i, const IntRect& rect)
+{
+    // Just paint a grey box for now (matches the color of a scrollbar background.
+    SkCanvas* const canvas = i.context->platformContext()->canvas();
+    int verticalCenter = rect.y() + rect.height() / 2;
+    int top = std::max(rect.y(), verticalCenter - 2);
+    int bottom = std::min(rect.y() + rect.height(), verticalCenter + 2);
+
+    SkPaint paint;
+    const SkColor grey = SkColorSetARGB(0xff, 0xe3, 0xdd, 0xd8);
+    paint.setColor(grey);
+
+    SkRect skrect;
+    skrect.set(rect.x(), top, rect.x() + rect.width(), bottom);
+    canvas->drawRect(skrect, paint);
+
+    return false;
+}
+
+bool RenderThemeChromiumSkia::paintSliderThumb(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+{
+    // Make a thumb similar to the scrollbar thumb.
+    const bool hovered = isHovered(o) || toRenderSlider(o->parent())->inDragMode();
+    const int midx = rect.x() + rect.width() / 2;
+    const int midy = rect.y() + rect.height() / 2;
+    const bool vertical = (o->style()->appearance() == SliderThumbVerticalPart);
+    SkCanvas* const canvas = i.context->platformContext()->canvas();
+
+    const SkColor thumbLightGrey = SkColorSetARGB(0xff, 0xf4, 0xf2, 0xef);
+    const SkColor thumbDarkGrey = SkColorSetARGB(0xff, 0xea, 0xe5, 0xe0);
+    SkPaint paint;
+    paint.setColor(hovered ? SK_ColorWHITE : thumbLightGrey);
+
+    SkIRect skrect;
+    if (vertical)
+        skrect.set(rect.x(), rect.y(), midx + 1, rect.bottom());
+    else
+        skrect.set(rect.x(), rect.y(), rect.right(), midy + 1);
+
+    canvas->drawIRect(skrect, paint);
+
+    paint.setColor(hovered ? thumbLightGrey : thumbDarkGrey);
+
+    if (vertical)
+        skrect.set(midx + 1, rect.y(), rect.right(), rect.bottom());
+    else
+        skrect.set(rect.x(), midy + 1, rect.right(), rect.bottom());
+
+    canvas->drawIRect(skrect, paint);
+
+    const SkColor borderDarkGrey = SkColorSetARGB(0xff, 0x9d, 0x96, 0x8e);
+    paint.setColor(borderDarkGrey);
+    drawBox(canvas, rect, paint);
+
+    if (rect.height() > 10 && rect.width() > 10) {
+        drawHorizLine(canvas, midx - 2, midx + 2, midy, paint);
+        drawHorizLine(canvas, midx - 2, midx + 2, midy - 3, paint);
+        drawHorizLine(canvas, midx - 2, midx + 2, midy + 3, paint);
+    }
+
+    return false;
+}
+
 int RenderThemeChromiumSkia::popupInternalPaddingLeft(RenderStyle* style) const
 {
     return menuListInternalPadding(style, LeftPadding);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.h
index 8be64e5..37e656f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.h
@@ -89,6 +89,12 @@ namespace WebCore {
         virtual void adjustSearchFieldResultsButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
         virtual bool paintSearchFieldResultsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 
+        virtual bool paintMediaControlsBackground(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintMediaVolumeSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual void adjustSliderThumbSize(RenderObject*) const;
+        virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintMediaVolumeSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
         virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
         virtual bool paintMediaMuteButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 
@@ -106,6 +112,9 @@ namespace WebCore {
         virtual void adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
         virtual bool paintMenuListButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 
+        virtual bool paintSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
         // These methods define the padding for the MenuList's inner block.
         virtual int popupInternalPaddingLeft(RenderStyle*) const;
         virtual int popupInternalPaddingRight(RenderStyle*) const;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.cpp
index 8459144..169bd02 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.cpp
@@ -316,13 +316,14 @@ void RenderThemeChromiumWin::adjustSliderThumbSize(RenderObject* o) const
     // These sizes match what WinXP draws for various menus.
     const int sliderThumbAlongAxis = 11;
     const int sliderThumbAcrossAxis = 21;
-    if (o->style()->appearance() == SliderThumbHorizontalPart || o->style()->appearance() == MediaSliderThumbPart) {
+    if (o->style()->appearance() == SliderThumbHorizontalPart) {
         o->style()->setWidth(Length(sliderThumbAlongAxis, Fixed));
         o->style()->setHeight(Length(sliderThumbAcrossAxis, Fixed));
     } else if (o->style()->appearance() == SliderThumbVerticalPart) {
         o->style()->setWidth(Length(sliderThumbAcrossAxis, Fixed));
         o->style()->setHeight(Length(sliderThumbAlongAxis, Fixed));
-    }
+    } else
+        RenderThemeChromiumSkia::adjustSliderThumbSize(o);
 }
 
 bool RenderThemeChromiumWin::paintCheckbox(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
@@ -464,7 +465,7 @@ unsigned RenderThemeChromiumWin::determineSliderThumbState(RenderObject* o)
         result = TUS_DISABLED;
     else if (supportsFocus(o->style()->appearance()) && isFocused(o->parent()))
         result = TUS_FOCUSED;
-    else if (static_cast<RenderSlider*>(o->parent())->inDragMode())
+    else if (toRenderSlider(o->parent())->inDragMode())
         result = TUS_PRESSED;
     else if (isHovered(o))
         result = TUS_HOT;
@@ -474,14 +475,36 @@ unsigned RenderThemeChromiumWin::determineSliderThumbState(RenderObject* o)
 unsigned RenderThemeChromiumWin::determineClassicState(RenderObject* o)
 {
     unsigned result = 0;
-    if (!isEnabled(o))
-        result = DFCS_INACTIVE;
-    else if (isPressed(o)) // Active supersedes hover
-        result = DFCS_PUSHED;
-    else if (isHovered(o))
-        result = DFCS_HOT;
-    if (isChecked(o))
-        result |= DFCS_CHECKED;
+
+    ControlPart part = o->style()->appearance();
+
+    // Sliders are always in the normal state.
+    if (part == SliderHorizontalPart || part == SliderVerticalPart)
+        return result;
+
+    // So are readonly text fields.
+    if (isReadOnlyControl(o) && (part == TextFieldPart || part == TextAreaPart || part == SearchFieldPart))
+        return result;   
+
+    if (part == SliderThumbHorizontalPart || part == SliderThumbVerticalPart) {
+        if (!isEnabled(o->parent()))
+            result = DFCS_INACTIVE;
+        else if (toRenderSlider(o->parent())->inDragMode()) // Active supersedes hover
+            result = DFCS_PUSHED;
+        else if (isHovered(o))
+            result = DFCS_HOT;
+    } else {
+        if (!isEnabled(o))
+            result = DFCS_INACTIVE;
+        else if (isPressed(o)) // Active supersedes hover
+            result = DFCS_PUSHED;
+        else if (supportsFocus(part) && isFocused(o)) // So does focused
+            result = 0;
+        else if (isHovered(o))
+            result = DFCS_HOT;
+        if (isChecked(o))
+            result |= DFCS_CHECKED;
+    }
     return result;
 }
 
@@ -523,6 +546,7 @@ ThemeData RenderThemeChromiumWin::getThemeData(RenderObject* o)
         break;
     case ListboxPart:
     case MenulistPart:
+    case MenulistButtonPart:
     case SearchFieldPart:
     case TextFieldPart:
     case TextAreaPart:
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.cpp
index 05facef..8e53088 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc.
  * Copyright (C) 2009 Kenneth Rohde Christiansen
  *
  * This library is free software; you can redistribute it and/or
@@ -744,11 +744,21 @@ static void TrackGradientInterpolate(void* info, const CGFloat* inData, CGFloat*
 
 void RenderThemeSafari::paintMenuListButtonGradients(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
+    if (r.isEmpty())
+        return;
+
     CGContextRef context = paintInfo.context->platformContext();
 
     paintInfo.context->save();
 
-    int radius = o->style()->borderTopLeftRadius().width();
+    IntSize topLeftRadius;
+    IntSize topRightRadius;
+    IntSize bottomLeftRadius;
+    IntSize bottomRightRadius;
+
+    o->style()->getBorderRadiiForRect(r, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius);
+
+    int radius = topLeftRadius.width();
 
     RetainPtr<CGColorSpaceRef> cspace(AdoptCF, CGColorSpaceCreateDeviceRGB());
 
@@ -771,33 +781,27 @@ void RenderThemeSafari::paintMenuListButtonGradients(RenderObject* o, const Rend
     RetainPtr<CGShadingRef> rightShading(AdoptCF, CGShadingCreateAxial(cspace.get(), CGPointMake(r.right(),  r.y()), CGPointMake(r.right() - radius, r.y()), mainFunction.get(), false, false));
     paintInfo.context->save();
     CGContextClipToRect(context, r);
-    paintInfo.context->addRoundedRectClip(r,
-        o->style()->borderTopLeftRadius(), o->style()->borderTopRightRadius(),
-        o->style()->borderBottomLeftRadius(), o->style()->borderBottomRightRadius());
+    paintInfo.context->addRoundedRectClip(r, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius);
     CGContextDrawShading(context, mainShading.get());
     paintInfo.context->restore();
 
     paintInfo.context->save();
     CGContextClipToRect(context, topGradient);
-    paintInfo.context->addRoundedRectClip(enclosingIntRect(topGradient),
-        o->style()->borderTopLeftRadius(), o->style()->borderTopRightRadius(),
-        IntSize(), IntSize());
+    paintInfo.context->addRoundedRectClip(enclosingIntRect(topGradient), topLeftRadius, topRightRadius, IntSize(), IntSize());
     CGContextDrawShading(context, topShading.get());
     paintInfo.context->restore();
 
-    paintInfo.context->save();
-    CGContextClipToRect(context, bottomGradient);
-    paintInfo.context->addRoundedRectClip(enclosingIntRect(bottomGradient),
-        IntSize(), IntSize(),
-        o->style()->borderBottomLeftRadius(), o->style()->borderBottomRightRadius());
-    CGContextDrawShading(context, bottomShading.get());
-    paintInfo.context->restore();
+    if (!bottomGradient.isEmpty()) {
+        paintInfo.context->save();
+        CGContextClipToRect(context, bottomGradient);
+        paintInfo.context->addRoundedRectClip(enclosingIntRect(bottomGradient), IntSize(), IntSize(), bottomLeftRadius, bottomRightRadius);
+        CGContextDrawShading(context, bottomShading.get());
+        paintInfo.context->restore();
+    }
 
     paintInfo.context->save();
     CGContextClipToRect(context, r);
-    paintInfo.context->addRoundedRectClip(r,
-        o->style()->borderTopLeftRadius(), o->style()->borderTopRightRadius(),
-        o->style()->borderBottomLeftRadius(), o->style()->borderBottomRightRadius());
+    paintInfo.context->addRoundedRectClip(r, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius);
     CGContextDrawShading(context, leftShading.get());
     CGContextDrawShading(context, rightShading.get());
     paintInfo.context->restore();
@@ -807,8 +811,6 @@ void RenderThemeSafari::paintMenuListButtonGradients(RenderObject* o, const Rend
 
 bool RenderThemeSafari::paintMenuListButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-    paintInfo.context->save();
-
     IntRect bounds = IntRect(r.x() + o->style()->borderLeftWidth(),
                              r.y() + o->style()->borderTopWidth(),
                              r.width() - o->style()->borderLeftWidth() - o->style()->borderRightWidth(),
@@ -826,6 +828,8 @@ bool RenderThemeSafari::paintMenuListButton(RenderObject* o, const RenderObject:
     if (bounds.width() < arrowWidth + arrowPaddingLeft)
         return false;
 
+    paintInfo.context->save();
+
     paintInfo.context->setFillColor(o->style()->color());
     paintInfo.context->setStrokeColor(NoStroke);
 
@@ -1000,7 +1004,7 @@ bool RenderThemeSafari::paintSliderThumb(RenderObject* o, const RenderObject::Pa
 
     ASSERT(o->parent()->isSlider());
 
-    bool pressed = static_cast<RenderSlider*>(o->parent())->inDragMode();
+    bool pressed = toRenderSlider(o->parent())->inDragMode();
     ThemeControlState state = determineState(o->parent());
     state &= ~SafariTheme::PressedState;
     if (pressed)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeWin.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderThemeWin.cpp
index 9491aae..92bfd03 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeWin.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeWin.cpp
@@ -428,7 +428,7 @@ unsigned RenderThemeWin::determineSliderThumbState(RenderObject* o)
         result = TUS_DISABLED;
     else if (supportsFocus(o->style()->appearance()) && isFocused(o->parent()))
         result = TUS_FOCUSED;
-    else if (static_cast<RenderSlider*>(o->parent())->inDragMode())
+    else if (toRenderSlider(o->parent())->inDragMode())
         result = TUS_PRESSED;
     else if (isHovered(o))
         result = TUS_HOT;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTreeAsText.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTreeAsText.cpp
index 79d1724..5c6e738 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTreeAsText.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTreeAsText.cpp
@@ -204,14 +204,14 @@ static TextStream &operator<<(TextStream& ts, const RenderObject& o)
         // FIXME: Deliberately dump the "inner" box of table cells, since that is what current results reflect.  We'd like
         // to clean up the results to dump both the outer box and the intrinsic padding so that both bits of information are
         // captured by the results.
-        const RenderTableCell& cell = static_cast<const RenderTableCell&>(o);
+        const RenderTableCell& cell = *toRenderTableCell(&o);
         r = IntRect(cell.x(), cell.y() + cell.intrinsicPaddingTop(), cell.width(), cell.height() - cell.intrinsicPaddingTop() - cell.intrinsicPaddingBottom());
     } else if (o.isBox())
         r = toRenderBox(&o)->frameRect();
 
     // FIXME: Temporary in order to ensure compatibility with existing layout test results.
     if (adjustForTableCells)
-        r.move(0, -static_cast<RenderTableCell*>(o.containingBlock())->intrinsicPaddingTop());
+        r.move(0, -toRenderTableCell(o.containingBlock())->intrinsicPaddingTop());
 
     ts << " " << r;
 
@@ -307,12 +307,12 @@ static TextStream &operator<<(TextStream& ts, const RenderObject& o)
     }
 
     if (o.isTableCell()) {
-        const RenderTableCell& c = static_cast<const RenderTableCell&>(o);
+        const RenderTableCell& c = *toRenderTableCell(&o);
         ts << " [r=" << c.row() << " c=" << c.col() << " rs=" << c.rowSpan() << " cs=" << c.colSpan() << "]";
     }
 
     if (o.isListMarker()) {
-        String text = static_cast<const RenderListMarker&>(o).text();
+        String text = toRenderListMarker(&o)->text();
         if (!text.isEmpty()) {
             if (text.length() != 1)
                 text = quoteAndEscapeNonPrintables(text);
@@ -343,7 +343,7 @@ static void writeTextRun(TextStream& ts, const RenderText& o, const InlineTextBo
     // FIXME: Table cell adjustment is temporary until results can be updated.
     int y = run.m_y;
     if (o.containingBlock()->isTableCell())
-        y -= static_cast<RenderTableCell*>(o.containingBlock())->intrinsicPaddingTop();
+        y -= toRenderTableCell(o.containingBlock())->intrinsicPaddingTop();
     ts << "text run at (" << run.m_x << "," << y << ") width " << run.m_width;
     if (run.direction() == RTL || run.m_dirOverride) {
         ts << (run.direction() == RTL ? " RTL" : " LTR");
@@ -359,26 +359,26 @@ void write(TextStream& ts, const RenderObject& o, int indent)
 {
 #if ENABLE(SVG)
     if (o.isRenderPath()) {
-        write(ts, static_cast<const RenderPath&>(o), indent);
+        write(ts, *toRenderPath(&o), indent);
         return;
     }
     if (o.isSVGContainer()) {
-        write(ts, static_cast<const RenderSVGContainer&>(o), indent);
+        writeSVGContainer(ts, o, indent);
         return;
     }
     if (o.isSVGRoot()) {
-        write(ts, static_cast<const RenderSVGRoot&>(o), indent);
+        write(ts, *toRenderSVGRoot(&o), indent);
         return;
     }
     if (o.isSVGText()) {
         if (!o.isText())
-            write(ts, static_cast<const RenderSVGText&>(o), indent);
+            writeSVGText(ts, *toRenderBlock(&o), indent);
         else
-            write(ts, static_cast<const RenderSVGInlineText&>(o), indent);
+            writeSVGInlineText(ts, *toRenderText(&o), indent);
         return;
     }
     if (o.isSVGImage()) {
-        write(ts, static_cast<const RenderSVGImage&>(o), indent);
+        writeSVGImage(ts, *toRenderImage(&o), indent);
         return;
     }
 #endif
@@ -402,7 +402,7 @@ void write(TextStream& ts, const RenderObject& o, int indent)
     }
 
     if (o.isWidget()) {
-        Widget* widget = static_cast<const RenderWidget&>(o).widget();
+        Widget* widget = toRenderWidget(&o)->widget();
         if (widget && widget->isFrameView()) {
             FrameView* view = static_cast<FrameView*>(widget);
             RenderView* root = view->frame()->contentRenderer();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderVideo.h b/src/3rdparty/webkit/WebCore/rendering/RenderVideo.h
index 1c7b259..79e5b4e 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderVideo.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderVideo.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -42,12 +42,26 @@ public:
     RenderVideo(HTMLMediaElement*);
     virtual ~RenderVideo();
 
+    void videoSizeChanged();
+    IntRect videoBox() const;
+    
+#if USE(ACCELERATED_COMPOSITING)
+    bool supportsAcceleratedRendering() const;
+    void acceleratedRenderingStateChanged();
+    GraphicsLayer* videoGraphicsLayer() const;
+#endif
+
+private:
+    virtual void updateFromElement();
+
+    virtual void intrinsicSizeChanged() { videoSizeChanged(); }
+
     virtual const char* renderName() const { return "RenderVideo"; }
 
     virtual bool requiresLayer() const { return true; }
     virtual bool isVideo() const { return true; }
 
-    virtual void paintReplaced(PaintInfo& paintInfo, int tx, int ty);
+    virtual void paintReplaced(PaintInfo&, int tx, int ty);
 
     virtual void layout();
 
@@ -56,21 +70,6 @@ public:
 
     virtual void calcPrefWidths();
     
-    void videoSizeChanged();
-    IntRect videoBox() const;
-    
-    void updateFromElement();
-
-#if USE(ACCELERATED_COMPOSITING)
-    bool supportsAcceleratedRendering() const;
-    virtual void acceleratedRenderingStateChanged();
-    GraphicsLayer* videoGraphicsLayer() const;
-#endif
-
-protected:
-    virtual void intrinsicSizeChanged() { videoSizeChanged(); }
-
-private:
     int calcAspectRatioWidth() const;
     int calcAspectRatioHeight() const;
 
@@ -80,6 +79,15 @@ private:
     void updatePlayer();
 };
 
+inline RenderVideo* toRenderVideo(RenderObject* object)
+{
+    ASSERT(!object || object->isVideo());
+    return static_cast<RenderVideo*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderVideo(const RenderVideo*);
+
 } // namespace WebCore
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderView.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderView.cpp
index 3b8a4fb..e2b4b04 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderView.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderView.cpp
@@ -121,12 +121,10 @@ void RenderView::layout()
     if (needsLayout())
         RenderBlock::layout();
 
-    // Reset overflowWidth and overflowHeight, since they act as a lower bound for docWidth() and docHeight().
-    setOverflowWidth(width());
-    setOverflowHeight(height());
-    
-    setOverflowWidth(docWidth());
-    setOverflowHeight(docHeight());
+    // Reset overflow and then replace it with docWidth and docHeight.
+    m_overflow.clear();
+    addLayoutOverflow(IntRect(0, 0, docWidth(), docHeight()));
+
 
     ASSERT(layoutDelta() == IntSize());
     ASSERT(m_layoutStateDisableCount == 0);
@@ -460,6 +458,8 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
         return;
     }
 
+    m_frameView->beginDeferredRepaints();
+
     // Have any of the old selected objects changed compared to the new selection?
     for (SelectedObjectMap::iterator i = oldSelectedObjects.begin(); i != oldObjectsEnd; ++i) {
         RenderObject* obj = i->first;
@@ -511,6 +511,8 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
         newInfo->repaint();
         delete newInfo;
     }
+
+    m_frameView->endDeferredRepaints();
 }
 
 void RenderView::clearSelection()
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderView.h b/src/3rdparty/webkit/WebCore/rendering/RenderView.h
index 854a421..bc5db9e 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderView.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderView.h
@@ -205,16 +205,16 @@ private:
 #endif
 };
 
-inline RenderView* toRenderView(RenderObject* o)
+inline RenderView* toRenderView(RenderObject* object)
 {
-    ASSERT(!o || o->isRenderView());
-    return static_cast<RenderView*>(o);
+    ASSERT(!object || object->isRenderView());
+    return static_cast<RenderView*>(object);
 }
 
-inline const RenderView* toRenderView(const RenderObject* o)
+inline const RenderView* toRenderView(const RenderObject* object)
 {
-    ASSERT(!o || o->isRenderView());
-    return static_cast<const RenderView*>(o);
+    ASSERT(!object || object->isRenderView());
+    return static_cast<const RenderView*>(object);
 }
 
 // This will catch anyone doing an unnecessary cast.
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderWidget.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderWidget.cpp
index 16526ca..ef78b07 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderWidget.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderWidget.cpp
@@ -28,6 +28,7 @@
 #include "GraphicsContext.h"
 #include "HitTestResult.h"
 #include "RenderView.h"
+#include "RenderWidgetProtector.h"
 
 using namespace std;
 
@@ -60,6 +61,15 @@ void RenderWidget::destroy()
     // So the code below includes copied and pasted contents of
     // both RenderBox::destroy() and RenderObject::destroy().
     // Fix originally made for <rdar://problem/4228818>.
+
+    // <rdar://problem/6937089> suggests that node() can be null by the time we call renderArena()
+    // in the end of this function. One way this might happen is if this function was invoked twice
+    // in a row, so bail out and turn a crash into an assertion failure in debug builds and a leak
+    // in release builds.
+    ASSERT(node());
+    if (!node())
+        return;
+
     animation()->cancelAnimations(this);
 
     if (RenderView* v = view())
@@ -90,6 +100,14 @@ void RenderWidget::destroy()
         destroyLayer();
     }
 
+    // <rdar://problem/6937089> suggests that node() can be null here. One way this might happen is
+    // if this function was re-entered (and therefore the null check at the beginning did not fail),
+    // so bail out and turn a crash into an assertion failure in debug builds and a leak in release
+    // builds.
+    ASSERT(node());
+    if (!node())
+        return;
+
     // Grab the arena from node()->document()->renderArena() before clearing the node pointer.
     // Clear the node before deref-ing, as this may be deleted when deref is called.
     RenderArena* arena = renderArena();
@@ -106,10 +124,9 @@ RenderWidget::~RenderWidget()
 void RenderWidget::setWidgetGeometry(const IntRect& frame)
 {
     if (node() && m_widget->frameRect() != frame) {
-        RenderArena* arena = ref();
-        RefPtr<Node> protectedElement(node());
+        RenderWidgetProtector protector(this);
+        RefPtr<Node> protectedNode(node());
         m_widget->setFrameRect(frame);
-        deref(arena);
     }
 }
 
@@ -183,11 +200,15 @@ void RenderWidget::paint(PaintInfo& paintInfo, int tx, int ty)
 #endif
 
     if (style()->hasBorderRadius()) {
+        IntRect borderRect = IntRect(tx, ty, width(), height());
+
+        if (borderRect.isEmpty())
+            return;
+
         // Push a clip if we have a border radius, since we want to round the foreground content that gets painted.
         paintInfo.context->save();
         
         IntSize topLeft, topRight, bottomLeft, bottomRight;
-        IntRect borderRect = IntRect(tx, ty, width(), height());
         style()->getBorderRadiiForRect(borderRect, topLeft, topRight, bottomLeft, bottomRight);
 
         paintInfo.context->addRoundedRectClip(borderRect, topLeft, topRight, bottomLeft, bottomRight);
@@ -248,11 +269,9 @@ void RenderWidget::updateWidgetPosition()
     IntRect oldBounds(m_widget->frameRect());
     bool boundsChanged = newBounds != oldBounds;
     if (boundsChanged) {
-        RenderArena* arena = ref();
-        node()->ref();
+        RenderWidgetProtector protector(this);
+        RefPtr<Node> protectedNode(node());
         m_widget->setFrameRect(newBounds);
-        node()->deref();
-        deref(arena);
     }
     
     // if the frame bounds got changed, or if view needs layout (possibly indicating
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderWidget.h b/src/3rdparty/webkit/WebCore/rendering/RenderWidget.h
index 97d0b72..098f69e 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderWidget.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderWidget.h
@@ -61,6 +61,7 @@ private:
 
     void setWidgetGeometry(const IntRect&);
 
+    friend class RenderWidgetProtector;
     RenderArena* ref() { ++m_refCount; return renderArena(); }
     void deref(RenderArena*);
 
@@ -69,6 +70,21 @@ private:
     int m_refCount;
 };
 
+inline RenderWidget* toRenderWidget(RenderObject* object)
+{
+    ASSERT(!object || object->isWidget());
+    return static_cast<RenderWidget*>(object);
+}
+
+inline const RenderWidget* toRenderWidget(const RenderObject* object)
+{
+    ASSERT(!object || object->isWidget());
+    return static_cast<const RenderWidget*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderWidget(const RenderWidget*);
+
 } // namespace WebCore
 
 #endif // RenderWidget_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderWidgetProtector.h b/src/3rdparty/webkit/WebCore/rendering/RenderWidgetProtector.h
new file mode 100644
index 0000000..788304c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderWidgetProtector.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RenderWidgetProtector_h
+#define RenderWidgetProtector_h
+
+#include "RenderWidget.h"
+
+namespace WebCore {
+
+class RenderWidgetProtector : private Noncopyable {
+public:
+    RenderWidgetProtector(RenderWidget* object)
+        : m_object(object)
+        , m_arena(object->ref())
+    {
+    }
+
+    ~RenderWidgetProtector()
+    {
+        m_object->deref(m_arena);
+    }
+
+private:
+    RenderWidget* m_object;
+    RenderArena* m_arena;
+};
+
+}
+
+#endif // RenderWidgetProtector_h
diff --git a/src/3rdparty/webkit/WebCore/rendering/RootInlineBox.cpp b/src/3rdparty/webkit/WebCore/rendering/RootInlineBox.cpp
index e8f04da..c8e072e 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RootInlineBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RootInlineBox.cpp
@@ -38,28 +38,8 @@ namespace WebCore {
 typedef WTF::HashMap<const RootInlineBox*, EllipsisBox*> EllipsisBoxMap;
 static EllipsisBoxMap* gEllipsisBoxMap = 0;
 
-void* RootInlineBox::Overflow::operator new(size_t sz, RenderArena* renderArena) throw()
-{
-    return renderArena->allocate(sz);
-}
-
-void RootInlineBox::Overflow::operator delete(void* ptr, size_t sz)
-{
-    // Stash size where destroy can find it.
-    *(size_t *)ptr = sz;
-}
-
-void RootInlineBox::Overflow::destroy(RenderArena* renderArena)
-{
-    delete this;
-    // Recover the size left there for us by operator delete and free the memory.
-    renderArena->free(*(size_t *)this, this);
-}
-
 void RootInlineBox::destroy(RenderArena* arena)
 {
-    if (m_overflow)
-        m_overflow->destroy(arena);
     detachEllipsisBox(arena);
     InlineFlowBox::destroy(arena);
 }
@@ -155,8 +135,8 @@ void RootInlineBox::addHighlightOverflow()
     // Highlight acts as a selection inflation.
     FloatRect rootRect(0, selectionTop(), width(), selectionHeight());
     IntRect inflatedRect = enclosingIntRect(page->chrome()->client()->customHighlightRect(renderer()->node(), renderer()->style()->highlight(), rootRect));
-    setHorizontalOverflowPositions(min(leftOverflow(), inflatedRect.x()), max(rightOverflow(), inflatedRect.right()));
-    setVerticalOverflowPositions(min(topOverflow(), inflatedRect.y()), max(bottomOverflow(), inflatedRect.bottom()));
+    setHorizontalOverflowPositions(leftLayoutOverflow(), rightLayoutOverflow(), min(leftVisualOverflow(), inflatedRect.x()), max(rightVisualOverflow(), inflatedRect.right()));
+    setVerticalOverflowPositions(topLayoutOverflow(), bottomLayoutOverflow(), min(topVisualOverflow(), inflatedRect.y()), max(bottomVisualOverflow(), inflatedRect.bottom()), height());
 }
 
 void RootInlineBox::paintCustomHighlight(RenderObject::PaintInfo& paintInfo, int tx, int ty, const AtomicString& highlightType)
@@ -205,12 +185,8 @@ bool RootInlineBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& re
 void RootInlineBox::adjustPosition(int dx, int dy)
 {
     InlineFlowBox::adjustPosition(dx, dy);
-    if (m_overflow) {
-        m_overflow->m_topOverflow += dy;
-        m_overflow->m_bottomOverflow += dy;
-        m_overflow->m_selectionTop += dy;
-        m_overflow->m_selectionBottom += dy;
-    }
+    m_lineTop += dy;
+    m_lineBottom += dy;
     m_blockHeight += dy;
 }
 
@@ -225,6 +201,37 @@ void RootInlineBox::childRemoved(InlineBox* box)
     }
 }
 
+int RootInlineBox::verticallyAlignBoxes(int heightOfBlock)
+{
+    int maxPositionTop = 0;
+    int maxPositionBottom = 0;
+    int maxAscent = 0;
+    int maxDescent = 0;
+
+    // Figure out if we're in strict mode.  Note that we can't simply use !style()->htmlHacks(),
+    // because that would match almost strict mode as well.
+    RenderObject* curr = renderer();
+    while (curr && !curr->node())
+        curr = curr->container();
+    bool strictMode = (curr && curr->document()->inStrictMode());
+
+    computeLogicalBoxHeights(maxPositionTop, maxPositionBottom, maxAscent, maxDescent, strictMode);
+
+    if (maxAscent + maxDescent < max(maxPositionTop, maxPositionBottom))
+        adjustMaxAscentAndDescent(maxAscent, maxDescent, maxPositionTop, maxPositionBottom);
+
+    int maxHeight = maxAscent + maxDescent;
+    int lineTop = heightOfBlock;
+    int lineBottom = heightOfBlock;
+    placeBoxesVertically(heightOfBlock, maxHeight, maxAscent, strictMode, lineTop, lineBottom);
+    computeVerticalOverflow(lineTop, lineBottom, strictMode);
+    setLineTopBottomPositions(lineTop, lineBottom);
+    
+    heightOfBlock += maxHeight;
+    
+    return heightOfBlock;
+}
+
 GapRects RootInlineBox::fillLineSelectionGap(int selTop, int selHeight, RenderBlock* rootBlock, int blockX, int blockY, int tx, int ty,
                                              const RenderObject::PaintInfo* paintInfo)
 {
@@ -321,9 +328,9 @@ InlineBox* RootInlineBox::lastSelectedBox()
     return 0;
 }
 
-int RootInlineBox::selectionTop()
+int RootInlineBox::selectionTop() const
 {
-    int selectionTop = m_overflow ? m_overflow->m_selectionTop : m_y;
+    int selectionTop = m_lineTop;
     if (!prevRootBox())
         return selectionTop;
 
@@ -407,18 +414,6 @@ EllipsisBox* RootInlineBox::ellipsisBox() const
     return gEllipsisBoxMap->get(this);
 }
 
-void RootInlineBox::setVerticalOverflowPositions(int top, int bottom) 
-{ 
-    if (!m_overflow) {
-        const Font& font = renderer()->style(m_firstLine)->font();
-        if (top == m_y && bottom == m_y + font.height())
-            return;
-        m_overflow = new (renderer()->renderArena()) Overflow(this);
-    }
-    m_overflow->m_topOverflow = top; 
-    m_overflow->m_bottomOverflow = bottom; 
-}
-
 void RootInlineBox::removeLineBoxFromRenderObject()
 {
     block()->lineBoxes()->removeLineBox(this);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RootInlineBox.h b/src/3rdparty/webkit/WebCore/rendering/RootInlineBox.h
index 171be9d..b0b0e15 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RootInlineBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RootInlineBox.h
@@ -38,31 +38,33 @@ class RootInlineBox : public InlineFlowBox {
 public:
     RootInlineBox(RenderObject* obj)
         : InlineFlowBox(obj)
-        , m_overflow(0)
         , m_lineBreakObj(0)
         , m_lineBreakPos(0)
+        , m_lineTop(0)
+        , m_lineBottom(0)
     {
     }
 
+    virtual void destroy(RenderArena*);
+
     virtual bool isRootInlineBox() const { return true; }
 
-    virtual void destroy(RenderArena*);
     void detachEllipsisBox(RenderArena*);
 
-    RootInlineBox* nextRootBox() { return static_cast<RootInlineBox*>(m_nextLine); }
-    RootInlineBox* prevRootBox() { return static_cast<RootInlineBox*>(m_prevLine); }
+    RootInlineBox* nextRootBox() const { return static_cast<RootInlineBox*>(m_nextLine); }
+    RootInlineBox* prevRootBox() const { return static_cast<RootInlineBox*>(m_prevLine); }
 
     virtual void adjustPosition(int dx, int dy);
 
-    virtual int topOverflow() const { return m_overflow ? m_overflow->m_topOverflow : m_y; }
-    virtual int bottomOverflow() const { return m_overflow ? m_overflow->m_bottomOverflow : m_y + m_renderer->style(m_firstLine)->font().height(); }
-    virtual int leftOverflow() const { return m_overflow ? m_overflow->m_leftOverflow : m_x; }
-    virtual int rightOverflow() const { return m_overflow ? m_overflow->m_rightOverflow : m_x + m_width; }
+    int lineTop() const { return m_lineTop; }
+    int lineBottom() const { return m_lineBottom; }
 
-    virtual void setVerticalOverflowPositions(int top, int bottom);
-    void setHorizontalOverflowPositions(int left, int right);
+    int selectionTop() const;
+    int selectionBottom() const { return lineBottom(); }
+    int selectionHeight() const { return max(0, selectionBottom() - selectionTop()); }
 
-    virtual void setVerticalSelectionPositions(int top, int bottom);
+    virtual int verticallyAlignBoxes(int heightOfBlock);
+    void setLineTopBottomPositions(int top, int bottom);
 
     virtual RenderLineBoxList* rendererLineBoxes() const;
 
@@ -116,68 +118,36 @@ public:
 
     RenderBlock* block() const;
 
-    int selectionTop();
-    int selectionBottom() { return m_overflow ? m_overflow->m_selectionBottom : m_y + height(); }
-    int selectionHeight() { return max(0, selectionBottom() - selectionTop()); }
-
     InlineBox* closestLeafChildForXPos(int x, bool onlyEditableLeaves = false);
 
     Vector<RenderBox*>& floats()
     {
         ASSERT(!isDirty());
-        if (!m_overflow)
-            m_overflow = new (m_renderer->renderArena()) Overflow(this);
-        return m_overflow->floats;
+        if (!m_floats)
+            m_floats.set(new Vector<RenderBox*>());
+        return *m_floats;
     }
 
-    Vector<RenderBox*>* floatsPtr() { ASSERT(!isDirty()); return m_overflow ? &m_overflow->floats : 0; }
+    Vector<RenderBox*>* floatsPtr() { ASSERT(!isDirty()); return m_floats.get(); }
 
     virtual void extractLineBoxFromRenderObject();
     virtual void attachLineBoxToRenderObject();
     virtual void removeLineBoxFromRenderObject();
 
 protected:
-    // Normally we are only as tall as the style on our block dictates, but we might have content
-    // that spills out above the height of our font (e.g, a tall image), or something that extends further
-    // below our line (e.g., a child whose font has a huge descent).
-        
-    // Allocated only when some of these fields have non-default values
-    struct Overflow {
-        Overflow(RootInlineBox* box) 
-            : m_topOverflow(box->m_y)
-            , m_bottomOverflow(box->m_y + box->height())
-            , m_leftOverflow(box->m_x)
-            , m_rightOverflow(box->m_x + box->m_width)
-            , m_selectionTop(box->m_y)
-            , m_selectionBottom(box->m_y + box->height())
-        {
-        }
-
-        void destroy(RenderArena*);
-        void* operator new(size_t, RenderArena*) throw();
-        void operator delete(void*, size_t);
-        
-        int m_topOverflow;
-        int m_bottomOverflow;
-        int m_leftOverflow;
-        int m_rightOverflow;
-        int m_selectionTop;
-        int m_selectionBottom;
-        // Floats hanging off the line are pushed into this vector during layout. It is only
-        // good for as long as the line has not been marked dirty.
-        Vector<RenderBox*> floats;
-    private:
-        void* operator new(size_t) throw();
-    };
-    
-    Overflow* m_overflow;
-
     // Where this line ended.  The exact object and the position within that object are stored so that
     // we can create an InlineIterator beginning just after the end of this line.
     RenderObject* m_lineBreakObj;
     unsigned m_lineBreakPos;
     RefPtr<BidiContext> m_lineBreakContext;
 
+    int m_lineTop;
+    int m_lineBottom;
+
+    // Floats hanging off the line are pushed into this vector during layout. It is only
+    // good for as long as the line has not been marked dirty.
+    OwnPtr<Vector<RenderBox*> > m_floats;
+
     // The height of the block at the end of this line.  This is where the next line starts.
     int m_blockHeight;
 
@@ -186,27 +156,10 @@ protected:
     WTF::Unicode::Direction m_lineBreakBidiStatusLast : 5;
 };
 
-inline void RootInlineBox::setHorizontalOverflowPositions(int left, int right) 
-{ 
-    if (!m_overflow) {
-        if (left == m_x && right == m_x + m_width)
-            return;
-        m_overflow = new (m_renderer->renderArena()) Overflow(this);       
-    }
-    m_overflow->m_leftOverflow = left; 
-    m_overflow->m_rightOverflow = right; 
-}
-
-inline void RootInlineBox::setVerticalSelectionPositions(int top, int bottom) 
+inline void RootInlineBox::setLineTopBottomPositions(int top, int bottom) 
 { 
-    if (!m_overflow) {
-        const Font& font = m_renderer->style(m_firstLine)->font();
-        if (top == m_y && bottom == m_y + font.height())
-            return;
-        m_overflow = new (m_renderer->renderArena()) Overflow(this);
-    }
-    m_overflow->m_selectionTop = top; 
-    m_overflow->m_selectionBottom = bottom; 
+    m_lineTop = top; 
+    m_lineBottom = bottom; 
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGCharacterLayoutInfo.cpp b/src/3rdparty/webkit/WebCore/rendering/SVGCharacterLayoutInfo.cpp
index b53e3d9..900e0ba 100644
--- a/src/3rdparty/webkit/WebCore/rendering/SVGCharacterLayoutInfo.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGCharacterLayoutInfo.cpp
@@ -274,7 +274,7 @@ void SVGCharacterLayoutInfo::addLayoutInformation(InlineFlowBox* flowBox, float
                            angleStack.isEmpty() && baselineShiftStack.isEmpty() &&
                            curx == 0.0f && cury == 0.0f;
 
-    RenderSVGTextPath* textPath = static_cast<RenderSVGTextPath*>(flowBox->renderer());
+    RenderSVGTextPath* textPath = toRenderSVGTextPath(flowBox->renderer());
     Path path = textPath->layoutPath();
 
     float baselineShift = calculateBaselineShift(textPath);
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.cpp b/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.cpp
index f3f2b8c..fb6866f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGRenderSupport.cpp
@@ -169,9 +169,11 @@ void renderSubtreeToImage(ImageBuffer* image, RenderObject* item)
     ASSERT(image->context());
     RenderObject::PaintInfo info(image->context(), IntRect(), PaintPhaseForeground, 0, 0, 0);
 
+    // FIXME: isSVGContainer returns true for RenderSVGViewportContainer, so if this is ever
+    // called with one of those, we will read from the wrong offset in an object due to a bad cast.
     RenderSVGContainer* svgContainer = 0;
     if (item && item->isSVGContainer())
-        svgContainer = static_cast<RenderSVGContainer*>(item);
+        svgContainer = toRenderSVGContainer(item);
 
     bool drawsContents = svgContainer ? svgContainer->drawsContents() : false;
     if (svgContainer && !drawsContents)
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGRenderTreeAsText.cpp b/src/3rdparty/webkit/WebCore/rendering/SVGRenderTreeAsText.cpp
index cc5e4b8..28e506a 100644
--- a/src/3rdparty/webkit/WebCore/rendering/SVGRenderTreeAsText.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGRenderTreeAsText.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2007, 2009 Apple Inc. All rights reserved.
  *           (C) 2005 Rob Buis <buis@kde.org>
  *           (C) 2006 Alexander Kellett <lypanov@kde.org>
  *
@@ -31,15 +31,15 @@
 #include "SVGRenderTreeAsText.h"
 
 #include "GraphicsTypes.h"
-#include "InlineTextBox.h"
 #include "HTMLNames.h"
+#include "InlineTextBox.h"
 #include "NodeRenderStyle.h"
+#include "RenderImage.h"
 #include "RenderPath.h"
 #include "RenderSVGContainer.h"
-#include "RenderSVGImage.h"
 #include "RenderSVGInlineText.h"
-#include "RenderSVGText.h"
 #include "RenderSVGRoot.h"
+#include "RenderSVGText.h"
 #include "RenderTreeAsText.h"
 #include "SVGCharacterLayoutInfo.h"
 #include "SVGInlineTextBox.h"
@@ -322,35 +322,23 @@ static TextStream& operator<<(TextStream& ts, const RenderPath& path)
     return ts;
 }
 
-static TextStream& operator<<(TextStream& ts, const RenderSVGContainer& container)
-{
-    return writePositionAndStyle(ts, container);
-}
-
 static TextStream& operator<<(TextStream& ts, const RenderSVGRoot& root)
 {
     return writePositionAndStyle(ts, root);
 }
 
-static TextStream& operator<<(TextStream& ts, const RenderSVGImage& root)
-{
-    return writePositionAndStyle(ts, root);
-}
-
-static TextStream& operator<<(TextStream& ts, const RenderSVGText& text)
+static void writeRenderSVGTextBox(TextStream& ts, const RenderBlock& text)
 {
     SVGRootInlineBox* box = static_cast<SVGRootInlineBox*>(text.firstRootBox());
 
     if (!box)
-        return ts;
+        return;
 
     Vector<SVGTextChunk>& chunks = const_cast<Vector<SVGTextChunk>& >(box->svgTextChunks());
     ts << " at (" << text.x() << "," << text.y() << ") size " << box->width() << "x" << box->height() << " contains " << chunks.size() << " chunk(s)";
 
     if (text.parent() && (text.parent()->style()->color() != text.style()->color()))
         writeNameValuePair(ts, "color", text.style()->color().name());
-
-    return ts;
 }
 
 static inline bool containsInlineTextBox(SVGTextChunk& chunk, SVGInlineTextBox* box)
@@ -455,7 +443,7 @@ static inline void writeSVGInlineTextBox(TextStream& ts, SVGInlineTextBox* textB
     }
 }
 
-static inline void writeSVGInlineText(TextStream& ts, const RenderSVGInlineText& text, int indent)
+static inline void writeSVGInlineTextBoxes(TextStream& ts, const RenderText& text, int indent)
 {
     for (InlineTextBox* box = text.firstTextBox(); box; box = box->nextTextBox())
         writeSVGInlineTextBox(ts, static_cast<SVGInlineTextBox*>(box), indent);
@@ -476,10 +464,11 @@ static void writeChildren(TextStream& ts, const RenderObject& object, int indent
         write(ts, *child, indent + 1);
 }
 
-void write(TextStream& ts, const RenderSVGContainer& container, int indent)
+void writeSVGContainer(TextStream& ts, const RenderObject& container, int indent)
 {
     writeStandardPrefix(ts, container, indent);
-    ts << container << "\n";
+    writePositionAndStyle(ts, container);
+    ts << "\n";
     writeChildren(ts, container, indent);
 }
 
@@ -490,20 +479,21 @@ void write(TextStream& ts, const RenderSVGRoot& root, int indent)
     writeChildren(ts, root, indent);
 }
 
-void write(TextStream& ts, const RenderSVGText& text, int indent)
+void writeSVGText(TextStream& ts, const RenderBlock& text, int indent)
 {
     writeStandardPrefix(ts, text, indent);
-    ts << text << "\n";
+    writeRenderSVGTextBox(ts, text);
+    ts << "\n";
     writeChildren(ts, text, indent);
 }
 
-void write(TextStream& ts, const RenderSVGInlineText& text, int indent)
+void writeSVGInlineText(TextStream& ts, const RenderText& text, int indent)
 {
     writeStandardPrefix(ts, text, indent);
 
     // Why not just linesBoundingBox()?
     ts << " " << FloatRect(text.firstRunOrigin(), text.linesBoundingBox().size()) << "\n";
-    writeSVGInlineText(ts, text, indent);
+    writeSVGInlineTextBoxes(ts, text, indent);
 }
 
 void write(TextStream& ts, const RenderPath& path, int indent)
@@ -512,10 +502,11 @@ void write(TextStream& ts, const RenderPath& path, int indent)
     ts << path << "\n";
 }
 
-void write(TextStream& ts, const RenderSVGImage& image, int indent)
+void writeSVGImage(TextStream& ts, const RenderImage& image, int indent)
 {
     writeStandardPrefix(ts, image, indent);
-    ts << image << "\n";
+    writePositionAndStyle(ts, image);
+    ts << "\n";
 }
 
 void writeRenderResources(TextStream& ts, Node* parent)
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGRenderTreeAsText.h b/src/3rdparty/webkit/WebCore/rendering/SVGRenderTreeAsText.h
index 35c3d5c..bee4f36 100644
--- a/src/3rdparty/webkit/WebCore/rendering/SVGRenderTreeAsText.h
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGRenderTreeAsText.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2004, 2005, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,7 +32,6 @@
 
 namespace WebCore {
 
-    class TransformationMatrix;
     class Color;
     class FloatPoint;
     class FloatRect;
@@ -40,20 +39,21 @@ namespace WebCore {
     class IntPoint;
     class IntRect;
     class Node;
+    class RenderBlock;
+    class RenderImage;
+    class RenderObject;
     class RenderPath;
-    class RenderSVGContainer;
-    class RenderSVGInlineText;
     class RenderSVGRoot;
-    class RenderSVGText; 
-    class RenderSVGImage;
+    class RenderText;
+    class TransformationMatrix;
 
 // functions used by the main RenderTreeAsText code
-void write(TextStream&, const RenderPath&, int indent = 0);
-void write(TextStream&, const RenderSVGContainer&, int indent = 0);
-void write(TextStream&, const RenderSVGInlineText&, int indent = 0);
-void write(TextStream&, const RenderSVGRoot&, int indent = 0);
-void write(TextStream&, const RenderSVGText&, int indent = 0);
-void write(TextStream&, const RenderSVGImage&, int indent = 0);
+void write(TextStream&, const RenderPath&, int indent);
+void write(TextStream&, const RenderSVGRoot&, int indent);
+void writeSVGContainer(TextStream&, const RenderObject&, int indent);
+void writeSVGImage(TextStream&, const RenderImage&, int indent);
+void writeSVGInlineText(TextStream&, const RenderText&, int indent);
+void writeSVGText(TextStream&, const RenderBlock&, int indent);
 
 void writeRenderResources(TextStream&, Node* parent);
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/SVGRootInlineBox.cpp b/src/3rdparty/webkit/WebCore/rendering/SVGRootInlineBox.cpp
index d92f54c..5829742 100644
--- a/src/3rdparty/webkit/WebCore/rendering/SVGRootInlineBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/SVGRootInlineBox.cpp
@@ -285,14 +285,11 @@ static inline void closeTextChunk(SVGTextChunkLayoutInfo& info)
 
 RenderSVGRoot* findSVGRootObject(RenderObject* start)
 {
-    // Find associated root inline box
+    // Find associated root inline box.
     while (start && !start->isSVGRoot())
         start = start->parent();
-
     ASSERT(start);
-    ASSERT(start->isSVGRoot());
-
-    return static_cast<RenderSVGRoot*>(start);
+    return toRenderSVGRoot(start);
 }
 
 static inline FloatPoint topLeftPositionOfCharacterRange(Vector<SVGChar>& chars)
@@ -1090,8 +1087,8 @@ void SVGRootInlineBox::layoutInlineBoxes(InlineFlowBox* start, Vector<SVGChar>::
         start->setWidth(highX - lowX);
         static_cast<SVGRootInlineBox*>(start)->setHeight(highY - lowY);
 
-        start->setVerticalOverflowPositions(top, bottom);
-        start->setVerticalSelectionPositions(top, bottom);
+        start->computeVerticalOverflow(top, bottom, true);
+        static_cast<SVGRootInlineBox*>(start)->setLineTopBottomPositions(top, bottom);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/TextControlInnerElements.cpp b/src/3rdparty/webkit/WebCore/rendering/TextControlInnerElements.cpp
index e205882..fc7f7f0 100644
--- a/src/3rdparty/webkit/WebCore/rendering/TextControlInnerElements.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/TextControlInnerElements.cpp
@@ -56,7 +56,7 @@ bool RenderTextControlInnerBlock::nodeAtPoint(const HitTestRequest& request, Hit
 
     bool placeholderIsVisible = false;
     if (renderer->isTextField())
-        placeholderIsVisible = static_cast<RenderTextControlSingleLine*>(renderer)->placeholderIsVisible();
+        placeholderIsVisible = toRenderTextControlSingleLine(renderer)->placeholderIsVisible();
 
     return RenderBlock::nodeAtPoint(request, result, x, y, tx, ty, placeholderIsVisible ? HitTestBlockBackground : hitTestAction);
 }
@@ -69,7 +69,7 @@ VisiblePosition RenderTextControlInnerBlock::positionForPoint(const IntPoint& po
     // Multiline text controls have the scroll on shadowAncestorNode, so we need to take that
     // into account here.
     if (m_multiLine) {
-        RenderTextControl* renderer = static_cast<RenderTextControl*>(node()->shadowAncestorNode()->renderer());
+        RenderTextControl* renderer = toRenderTextControl(node()->shadowAncestorNode()->renderer());
         if (renderer->hasOverflowClip())
             renderer->layer()->addScrolledContentOffset(contentsX, contentsY);
     }
@@ -155,7 +155,7 @@ void SearchFieldResultsButtonElement::defaultEventHandler(Event* evt)
     if (evt->type() == eventNames().mousedownEvent && evt->isMouseEvent() && static_cast<MouseEvent*>(evt)->button() == LeftButton) {
         input->focus();
         input->select();
-        RenderTextControlSingleLine* renderer = static_cast<RenderTextControlSingleLine*>(input->renderer());
+        RenderTextControlSingleLine* renderer = toRenderTextControlSingleLine(input->renderer());
         if (renderer->popupIsVisible())
             renderer->hidePopup();
         else if (input->maxResults() > 0)
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/FillLayer.cpp b/src/3rdparty/webkit/WebCore/rendering/style/FillLayer.cpp
index 9c491aa..ec910c9 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/FillLayer.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/style/FillLayer.cpp
@@ -31,18 +31,20 @@ FillLayer::FillLayer(EFillLayerType type)
     , m_attachment(FillLayer::initialFillAttachment(type))
     , m_clip(FillLayer::initialFillClip(type))
     , m_origin(FillLayer::initialFillOrigin(type))
-    , m_repeat(FillLayer::initialFillRepeat(type))
+    , m_repeatX(FillLayer::initialFillRepeatX(type))
+    , m_repeatY(FillLayer::initialFillRepeatY(type))
     , m_composite(FillLayer::initialFillComposite(type))
-    , m_size(FillLayer::initialFillSize(type))
+    , m_sizeType(SizeNone)
+    , m_sizeLength(FillLayer::initialFillSizeLength(type))
     , m_imageSet(false)
     , m_attachmentSet(false)
     , m_clipSet(false)
     , m_originSet(false)
-    , m_repeatSet(false)
+    , m_repeatXSet(false)
+    , m_repeatYSet(false)
     , m_xPosSet(false)
     , m_yPosSet(false)
     , m_compositeSet(type == MaskFillLayer)
-    , m_sizeSet(false)
     , m_type(type)
     , m_next(0)
 {
@@ -55,18 +57,20 @@ FillLayer::FillLayer(const FillLayer& o)
     , m_attachment(o.m_attachment)
     , m_clip(o.m_clip)
     , m_origin(o.m_origin)
-    , m_repeat(o.m_repeat)
+    , m_repeatX(o.m_repeatX)
+    , m_repeatY(o.m_repeatY)
     , m_composite(o.m_composite)
-    , m_size(o.m_size)
+    , m_sizeType(o.m_sizeType)
+    , m_sizeLength(o.m_sizeLength)
     , m_imageSet(o.m_imageSet)
     , m_attachmentSet(o.m_attachmentSet)
     , m_clipSet(o.m_clipSet)
     , m_originSet(o.m_originSet)
-    , m_repeatSet(o.m_repeatSet)
+    , m_repeatXSet(o.m_repeatXSet)
+    , m_repeatYSet(o.m_repeatYSet)
     , m_xPosSet(o.m_xPosSet)
     , m_yPosSet(o.m_yPosSet)
     , m_compositeSet(o.m_compositeSet)
-    , m_sizeSet(o.m_sizeSet)
     , m_type(o.m_type)
     , m_next(o.m_next ? new FillLayer(*o.m_next) : 0)
 {
@@ -91,18 +95,20 @@ FillLayer& FillLayer::operator=(const FillLayer& o)
     m_clip = o.m_clip;
     m_composite = o.m_composite;
     m_origin = o.m_origin;
-    m_repeat = o.m_repeat;
-    m_size = o.m_size;
+    m_repeatX = o.m_repeatX;
+    m_repeatY = o.m_repeatY;
+    m_sizeType = o.m_sizeType;
+    m_sizeLength = o.m_sizeLength;
 
     m_imageSet = o.m_imageSet;
     m_attachmentSet = o.m_attachmentSet;
     m_clipSet = o.m_clipSet;
     m_compositeSet = o.m_compositeSet;
     m_originSet = o.m_originSet;
-    m_repeatSet = o.m_repeatSet;
+    m_repeatXSet = o.m_repeatXSet;
+    m_repeatYSet = o.m_repeatYSet;
     m_xPosSet = o.m_xPosSet;
     m_yPosSet = o.m_yPosSet;
-    m_sizeSet = o.m_sizeSet;
     
     m_type = o.m_type;
 
@@ -115,9 +121,9 @@ bool FillLayer::operator==(const FillLayer& o) const
     // to propagate patterns into layers.  All layer comparisons happen after values have all been filled in anyway.
     return StyleImage::imagesEquivalent(m_image.get(), o.m_image.get()) && m_xPosition == o.m_xPosition && m_yPosition == o.m_yPosition &&
            m_attachment == o.m_attachment && m_clip == o.m_clip && 
-           m_composite == o.m_composite && m_origin == o.m_origin && m_repeat == o.m_repeat &&
-           m_size == o.m_size && m_type == o.m_type &&
-           ((m_next && o.m_next) ? *m_next == *o.m_next : m_next == o.m_next);
+           m_composite == o.m_composite && m_origin == o.m_origin && m_repeatX == o.m_repeatX &&
+           m_repeatY == o.m_repeatY && m_sizeType == o.m_sizeType && m_sizeLength == o.m_sizeLength && 
+           m_type == o.m_type && ((m_next && o.m_next) ? *m_next == *o.m_next : m_next == o.m_next);
 }
 
 void FillLayer::fillUnsetProperties()
@@ -200,11 +206,22 @@ void FillLayer::fillUnsetProperties()
         }
     }
 
-    for (curr = this; curr && curr->isRepeatSet(); curr = curr->next()) { }
+    for (curr = this; curr && curr->isRepeatXSet(); curr = curr->next()) { }
     if (curr && curr != this) {
         // We need to fill in the remaining values with the pattern specified.
         for (FillLayer* pattern = this; curr; curr = curr->next()) {
-            curr->m_repeat = pattern->m_repeat;
+            curr->m_repeatX = pattern->m_repeatX;
+            pattern = pattern->next();
+            if (pattern == curr || !pattern)
+                pattern = this;
+        }
+    }
+
+    for (curr = this; curr && curr->isRepeatYSet(); curr = curr->next()) { }
+    if (curr && curr != this) {
+        // We need to fill in the remaining values with the pattern specified.
+        for (FillLayer* pattern = this; curr; curr = curr->next()) {
+            curr->m_repeatY = pattern->m_repeatY;
             pattern = pattern->next();
             if (pattern == curr || !pattern)
                 pattern = this;
@@ -215,7 +232,8 @@ void FillLayer::fillUnsetProperties()
     if (curr && curr != this) {
         // We need to fill in the remaining values with the pattern specified.
         for (FillLayer* pattern = this; curr; curr = curr->next()) {
-            curr->m_size = pattern->m_size;
+            curr->m_sizeType = pattern->m_sizeType;
+            curr->m_sizeLength = pattern->m_sizeLength;
             pattern = pattern->next();
             if (pattern == curr || !pattern)
                 pattern = this;
@@ -232,7 +250,8 @@ void FillLayer::cullEmptyLayers()
             !next->isXPositionSet() && !next->isYPositionSet() &&
             !next->isAttachmentSet() && !next->isClipSet() &&
             !next->isCompositeSet() && !next->isOriginSet() &&
-            !next->isRepeatSet() && !next->isSizeSet()) {
+            !next->isRepeatXSet() && !next->isRepeatYSet()
+            && !next->isSizeSet()) {
             delete next;
             p->m_next = 0;
             break;
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/FillLayer.h b/src/3rdparty/webkit/WebCore/rendering/style/FillLayer.h
index c3944ad..fb928b6 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/FillLayer.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/FillLayer.h
@@ -34,6 +34,31 @@
 
 namespace WebCore {
 
+struct FillSize {
+    FillSize()
+        : type(SizeLength)
+    {
+    }
+
+    FillSize(EFillSizeType t, LengthSize l)
+        : type(t)
+        , size(l)
+    {
+    }
+
+    bool operator==(const FillSize& o) const
+    {
+        return type == o.type && size == o.size;
+    }
+    bool operator!=(const FillSize& o) const
+    {
+        return !(*this == o);
+    }
+
+    EFillSizeType type;
+    LengthSize size;
+};
+
 struct FillLayer {
 public:
     FillLayer(EFillLayerType);
@@ -45,9 +70,11 @@ public:
     EFillAttachment attachment() const { return static_cast<EFillAttachment>(m_attachment); }
     EFillBox clip() const { return static_cast<EFillBox>(m_clip); }
     EFillBox origin() const { return static_cast<EFillBox>(m_origin); }
-    EFillRepeat repeat() const { return static_cast<EFillRepeat>(m_repeat); }
+    EFillRepeat repeatX() const { return static_cast<EFillRepeat>(m_repeatX); }
+    EFillRepeat repeatY() const { return static_cast<EFillRepeat>(m_repeatY); }
     CompositeOperator composite() const { return static_cast<CompositeOperator>(m_composite); }
-    LengthSize size() const { return m_size; }
+    LengthSize sizeLength() const { return m_sizeLength; }
+    FillSize size() const { return FillSize(static_cast<EFillSizeType>(m_sizeType), m_sizeLength); }
 
     const FillLayer* next() const { return m_next; }
     FillLayer* next() { return m_next; }
@@ -58,19 +85,23 @@ public:
     bool isAttachmentSet() const { return m_attachmentSet; }
     bool isClipSet() const { return m_clipSet; }
     bool isOriginSet() const { return m_originSet; }
-    bool isRepeatSet() const { return m_repeatSet; }
+    bool isRepeatXSet() const { return m_repeatXSet; }
+    bool isRepeatYSet() const { return m_repeatYSet; }
     bool isCompositeSet() const { return m_compositeSet; }
-    bool isSizeSet() const { return m_sizeSet; }
+    bool isSizeSet() const { return m_sizeType != SizeNone; }
     
     void setImage(StyleImage* i) { m_image = i; m_imageSet = true; }
-    void setXPosition(const Length& l) { m_xPosition = l; m_xPosSet = true; }
-    void setYPosition(const Length& l) { m_yPosition = l; m_yPosSet = true; }
+    void setXPosition(Length l) { m_xPosition = l; m_xPosSet = true; }
+    void setYPosition(Length l) { m_yPosition = l; m_yPosSet = true; }
     void setAttachment(EFillAttachment attachment) { m_attachment = attachment; m_attachmentSet = true; }
     void setClip(EFillBox b) { m_clip = b; m_clipSet = true; }
     void setOrigin(EFillBox b) { m_origin = b; m_originSet = true; }
-    void setRepeat(EFillRepeat r) { m_repeat = r; m_repeatSet = true; }
+    void setRepeatX(EFillRepeat r) { m_repeatX = r; m_repeatXSet = true; }
+    void setRepeatY(EFillRepeat r) { m_repeatY = r; m_repeatYSet = true; }
     void setComposite(CompositeOperator c) { m_composite = c; m_compositeSet = true; }
-    void setSize(const LengthSize& b) { m_size = b; m_sizeSet = true; }
+    void setSizeType(EFillSizeType b) { m_sizeType = b; }
+    void setSizeLength(LengthSize l) { m_sizeLength = l; }
+    void setSize(FillSize f) { m_sizeType = f.type; m_sizeLength = f.size; }
     
     void clearImage() { m_imageSet = false; }
     void clearXPosition() { m_xPosSet = false; }
@@ -78,9 +109,10 @@ public:
     void clearAttachment() { m_attachmentSet = false; }
     void clearClip() { m_clipSet = false; }
     void clearOrigin() { m_originSet = false; }
-    void clearRepeat() { m_repeatSet = false; }
+    void clearRepeatX() { m_repeatXSet = false; }
+    void clearRepeatY() { m_repeatYSet = false; }
     void clearComposite() { m_compositeSet = false; }
-    void clearSize() { m_sizeSet = false; }
+    void clearSize() { m_sizeType = SizeNone; }
 
     void setNext(FillLayer* n) { if (m_next != n) { delete m_next; m_next = n; } }
 
@@ -117,9 +149,12 @@ public:
     static EFillAttachment initialFillAttachment(EFillLayerType) { return ScrollBackgroundAttachment; }
     static EFillBox initialFillClip(EFillLayerType) { return BorderFillBox; }
     static EFillBox initialFillOrigin(EFillLayerType type) { return type == BackgroundFillLayer ? PaddingFillBox : BorderFillBox; }
-    static EFillRepeat initialFillRepeat(EFillLayerType) { return RepeatFill; }
+    static EFillRepeat initialFillRepeatX(EFillLayerType) { return RepeatFill; }
+    static EFillRepeat initialFillRepeatY(EFillLayerType) { return RepeatFill; }
     static CompositeOperator initialFillComposite(EFillLayerType) { return CompositeSourceOver; }
-    static LengthSize initialFillSize(EFillLayerType) { return LengthSize(); }
+    static EFillSizeType initialFillSizeType(EFillLayerType) { return SizeLength; }
+    static LengthSize initialFillSizeLength(EFillLayerType) { return LengthSize(); }
+    static FillSize initialFillSize(EFillLayerType) { return FillSize(); }
     static Length initialFillXPosition(EFillLayerType) { return Length(0.0, Percent); }
     static Length initialFillYPosition(EFillLayerType) { return Length(0.0, Percent); }
     static StyleImage* initialFillImage(EFillLayerType) { return 0; }
@@ -136,20 +171,22 @@ public:
     unsigned m_attachment : 2; // EFillAttachment
     unsigned m_clip : 2; // EFillBox
     unsigned m_origin : 2; // EFillBox
-    unsigned m_repeat : 2; // EFillRepeat
+    unsigned m_repeatX : 3; // EFillRepeat
+    unsigned m_repeatY : 3; // EFillRepeat
     unsigned m_composite : 4; // CompositeOperator
-
-    LengthSize m_size;
+    unsigned m_sizeType : 2; // EFillSizeType
+    
+    LengthSize m_sizeLength;
 
     bool m_imageSet : 1;
     bool m_attachmentSet : 1;
     bool m_clipSet : 1;
     bool m_originSet : 1;
-    bool m_repeatSet : 1;
+    bool m_repeatXSet : 1;
+    bool m_repeatYSet : 1;
     bool m_xPosSet : 1;
     bool m_yPosSet : 1;
     bool m_compositeSet : 1;
-    bool m_sizeSet : 1;
     
     unsigned m_type : 1; // EFillLayerType
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.cpp b/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.cpp
index efec1bd..a861fea 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.cpp
@@ -324,6 +324,7 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
             *rareNonInheritedData->flexibleBox.get() != *other->rareNonInheritedData->flexibleBox.get())
             return StyleDifferenceLayout;
 
+        // FIXME: We should add an optimized form of layout that just recomputes visual overflow.
         if (!rareNonInheritedData->shadowDataEquivalent(*other->rareNonInheritedData.get()))
             return StyleDifferenceLayout;
 
@@ -453,6 +454,12 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
     if (inherited->m_effectiveZoom != other->inherited->m_effectiveZoom)
         return StyleDifferenceLayout;
 
+    if (rareNonInheritedData->opacity == 1 && other->rareNonInheritedData->opacity < 1 ||
+        rareNonInheritedData->opacity < 1 && other->rareNonInheritedData->opacity == 1) {
+        // FIXME: We should add an optimized form of layout that just recomputes visual overflow.
+        return StyleDifferenceLayout;
+    }
+
     // Make sure these left/top/right/bottom checks stay below all layout checks and above
     // all visible checks.
     if (position() != StaticPosition) {
@@ -695,7 +702,7 @@ void RenderStyle::addBindingURI(StringImpl* uri)
 
 void RenderStyle::setTextShadow(ShadowData* val, bool add)
 {
-    ASSERT(!val || !val->spread);
+    ASSERT(!val || !val->spread && val->style == Normal);
 
     StyleRareInheritedData* rareData = rareInheritedData.access();
     if (!add) {
@@ -906,4 +913,53 @@ void RenderStyle::setBlendedFontSize(int size)
     font().update(font().fontSelector());
 }
 
+void RenderStyle::getBoxShadowExtent(int &top, int &right, int &bottom, int &left) const
+{
+    top = 0;
+    right = 0;
+    bottom = 0;
+    left = 0;
+
+    for (ShadowData* boxShadow = this->boxShadow(); boxShadow; boxShadow = boxShadow->next) {
+        if (boxShadow->style == Inset)
+            continue;
+        int blurAndSpread = boxShadow->blur + boxShadow->spread;
+
+        top = min(top, boxShadow->y - blurAndSpread);
+        right = max(right, boxShadow->x + blurAndSpread);
+        bottom = max(bottom, boxShadow->y + blurAndSpread);
+        left = min(left, boxShadow->x - blurAndSpread);
+    }
+}
+
+void RenderStyle::getBoxShadowHorizontalExtent(int &left, int &right) const
+{
+    left = 0;
+    right = 0;
+
+    for (ShadowData* boxShadow = this->boxShadow(); boxShadow; boxShadow = boxShadow->next) {
+        if (boxShadow->style == Inset)
+            continue;
+        int blurAndSpread = boxShadow->blur + boxShadow->spread;
+
+        left = min(left, boxShadow->x - blurAndSpread);
+        right = max(right, boxShadow->x + blurAndSpread);
+    }
+}
+
+void RenderStyle::getBoxShadowVerticalExtent(int &top, int &bottom) const
+{
+    top = 0;
+    bottom = 0;
+
+    for (ShadowData* boxShadow = this->boxShadow(); boxShadow; boxShadow = boxShadow->next) {
+        if (boxShadow->style == Inset)
+            continue;
+        int blurAndSpread = boxShadow->blur + boxShadow->spread;
+
+        top = min(top, boxShadow->y - blurAndSpread);
+        bottom = max(bottom, boxShadow->y + blurAndSpread);
+    }
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.h b/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.h
index 4582dbb..1a216fe 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/RenderStyle.h
@@ -434,6 +434,7 @@ public:
     const Font& font() const { return inherited->font; }
     const FontDescription& fontDescription() const { return inherited->font.fontDescription(); }
     int fontSize() const { return inherited->font.pixelSize(); }
+    FontSmoothing fontSmoothing() const { return inherited->font.fontDescription().fontSmoothing(); }
 
     const Color& color() const { return inherited->color; }
     Length textIndent() const { return inherited->indent; }
@@ -521,26 +522,29 @@ public:
 
     const Color& backgroundColor() const { return background->m_color; }
     StyleImage* backgroundImage() const { return background->m_background.m_image.get(); }
-    EFillRepeat backgroundRepeat() const { return static_cast<EFillRepeat>(background->m_background.m_repeat); }
+    EFillRepeat backgroundRepeatX() const { return static_cast<EFillRepeat>(background->m_background.m_repeatX); }
+    EFillRepeat backgroundRepeatY() const { return static_cast<EFillRepeat>(background->m_background.m_repeatY); }
     CompositeOperator backgroundComposite() const { return static_cast<CompositeOperator>(background->m_background.m_composite); }
     EFillAttachment backgroundAttachment() const { return static_cast<EFillAttachment>(background->m_background.m_attachment); }
     EFillBox backgroundClip() const { return static_cast<EFillBox>(background->m_background.m_clip); }
     EFillBox backgroundOrigin() const { return static_cast<EFillBox>(background->m_background.m_origin); }
     Length backgroundXPosition() const { return background->m_background.m_xPosition; }
     Length backgroundYPosition() const { return background->m_background.m_yPosition; }
-    LengthSize backgroundSize() const { return background->m_background.m_size; }
+    EFillSizeType backgroundSizeType() const { return static_cast<EFillSizeType>(background->m_background.m_sizeType); }
+    LengthSize backgroundSizeLength() const { return background->m_background.m_sizeLength; }
     FillLayer* accessBackgroundLayers() { return &(background.access()->m_background); }
     const FillLayer* backgroundLayers() const { return &(background->m_background); }
 
     StyleImage* maskImage() const { return rareNonInheritedData->m_mask.m_image.get(); }
-    EFillRepeat maskRepeat() const { return static_cast<EFillRepeat>(rareNonInheritedData->m_mask.m_repeat); }
+    EFillRepeat maskRepeatX() const { return static_cast<EFillRepeat>(rareNonInheritedData->m_mask.m_repeatX); }
+    EFillRepeat maskRepeatY() const { return static_cast<EFillRepeat>(rareNonInheritedData->m_mask.m_repeatY); }
     CompositeOperator maskComposite() const { return static_cast<CompositeOperator>(rareNonInheritedData->m_mask.m_composite); }
     EFillAttachment maskAttachment() const { return static_cast<EFillAttachment>(rareNonInheritedData->m_mask.m_attachment); }
     EFillBox maskClip() const { return static_cast<EFillBox>(rareNonInheritedData->m_mask.m_clip); }
     EFillBox maskOrigin() const { return static_cast<EFillBox>(rareNonInheritedData->m_mask.m_origin); }
     Length maskXPosition() const { return rareNonInheritedData->m_mask.m_xPosition; }
     Length maskYPosition() const { return rareNonInheritedData->m_mask.m_yPosition; }
-    LengthSize maskSize() const { return rareNonInheritedData->m_mask.m_size; }
+    LengthSize maskSize() const { return rareNonInheritedData->m_mask.m_sizeLength; }
     FillLayer* accessMaskLayers() { return &(rareNonInheritedData.access()->m_mask); }
     const FillLayer* maskLayers() const { return &(rareNonInheritedData->m_mask); }
     const NinePieceImage& maskBoxImage() const { return rareNonInheritedData->m_maskBoxImage; }
@@ -606,7 +610,12 @@ public:
     unsigned int boxOrdinalGroup() const { return rareNonInheritedData->flexibleBox->ordinal_group; }
     EBoxOrient boxOrient() const { return static_cast<EBoxOrient>(rareNonInheritedData->flexibleBox->orient); }
     EBoxAlignment boxPack() const { return static_cast<EBoxAlignment>(rareNonInheritedData->flexibleBox->pack); }
+
     ShadowData* boxShadow() const { return rareNonInheritedData->m_boxShadow.get(); }
+    void getBoxShadowExtent(int &top, int &right, int &bottom, int &left) const;
+    void getBoxShadowHorizontalExtent(int &left, int &right) const;
+    void getBoxShadowVerticalExtent(int &top, int &bottom) const;
+
     StyleReflection* boxReflect() const { return rareNonInheritedData->m_boxReflect.get(); }
     EBoxSizing boxSizing() const { return static_cast<EBoxSizing>(box->boxSizing); }
     Length marqueeIncrement() const { return rareNonInheritedData->marquee->increment; }
@@ -746,7 +755,8 @@ public:
 
     void setBackgroundXPosition(Length l) { SET_VAR(background, m_background.m_xPosition, l) }
     void setBackgroundYPosition(Length l) { SET_VAR(background, m_background.m_yPosition, l) }
-    void setBackgroundSize(LengthSize l) { SET_VAR(background, m_background.m_size, l) }
+    void setBackgroundSize(EFillSizeType b) { SET_VAR(background, m_background.m_sizeType, b) }
+    void setBackgroundSizeLength(LengthSize l) { SET_VAR(background, m_background.m_sizeLength, l) }
     
     void setBorderImage(const NinePieceImage& b) { SET_VAR(surround, border.image, b) }
 
@@ -859,7 +869,7 @@ public:
     void setMaskBoxImage(const NinePieceImage& b) { SET_VAR(rareNonInheritedData, m_maskBoxImage, b) }
     void setMaskXPosition(Length l) { SET_VAR(rareNonInheritedData, m_mask.m_xPosition, l) }
     void setMaskYPosition(Length l) { SET_VAR(rareNonInheritedData, m_mask.m_yPosition, l) }
-    void setMaskSize(LengthSize l) { SET_VAR(rareNonInheritedData, m_mask.m_size, l) }
+    void setMaskSize(LengthSize l) { SET_VAR(rareNonInheritedData, m_mask.m_sizeLength, l) }
 
     void setBorderCollapse(bool collapse) { inherited_flags._border_collapse = collapse; }
     void setHorizontalBorderSpacing(short v) { SET_VAR(inherited, horizontal_border_spacing, v) }
diff --git a/src/3rdparty/webkit/WebCore/rendering/style/RenderStyleConstants.h b/src/3rdparty/webkit/WebCore/rendering/style/RenderStyleConstants.h
index 1b3e1f4..6a7277d 100644
--- a/src/3rdparty/webkit/WebCore/rendering/style/RenderStyleConstants.h
+++ b/src/3rdparty/webkit/WebCore/rendering/style/RenderStyleConstants.h
@@ -4,6 +4,7 @@
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2003, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Graham Dennis (graham.dennis@gmail.com)
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -68,10 +69,9 @@ enum PseudoId {
     NOPSEUDO, FIRST_LINE, FIRST_LETTER, BEFORE, AFTER, SELECTION, FIRST_LINE_INHERITED, SCROLLBAR, FILE_UPLOAD_BUTTON, INPUT_PLACEHOLDER,
     SLIDER_THUMB, SEARCH_CANCEL_BUTTON, SEARCH_DECORATION, SEARCH_RESULTS_DECORATION, SEARCH_RESULTS_BUTTON, MEDIA_CONTROLS_PANEL,
     MEDIA_CONTROLS_PLAY_BUTTON, MEDIA_CONTROLS_MUTE_BUTTON, MEDIA_CONTROLS_TIMELINE, MEDIA_CONTROLS_TIMELINE_CONTAINER,
-    MEDIA_CONTROLS_CURRENT_TIME_DISPLAY, MEDIA_CONTROLS_TIME_REMAINING_DISPLAY, MEDIA_CONTROLS_SEEK_BACK_BUTTON, 
-    MEDIA_CONTROLS_SEEK_FORWARD_BUTTON, MEDIA_CONTROLS_FULLSCREEN_BUTTON, MEDIA_CONTROLS_REWIND_BUTTON,
-    MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON, MEDIA_CONTROLS_STATUS_DISPLAY,
-    SCROLLBAR_THUMB, SCROLLBAR_BUTTON, SCROLLBAR_TRACK, SCROLLBAR_TRACK_PIECE, SCROLLBAR_CORNER, RESIZER,
+    MEDIA_CONTROLS_VOLUME_SLIDER, MEDIA_CONTROLS_VOLUME_SLIDER_CONTAINER, MEDIA_CONTROLS_CURRENT_TIME_DISPLAY, MEDIA_CONTROLS_TIME_REMAINING_DISPLAY, MEDIA_CONTROLS_SEEK_BACK_BUTTON,
+    MEDIA_CONTROLS_SEEK_FORWARD_BUTTON, MEDIA_CONTROLS_FULLSCREEN_BUTTON, MEDIA_CONTROLS_REWIND_BUTTON, MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON,
+    MEDIA_CONTROLS_STATUS_DISPLAY, SCROLLBAR_THUMB, SCROLLBAR_BUTTON, SCROLLBAR_TRACK, SCROLLBAR_TRACK_PIECE, SCROLLBAR_CORNER, RESIZER,
 
     FIRST_INTERNAL_PSEUDOID = FILE_UPLOAD_BUTTON
 };
@@ -131,13 +131,16 @@ enum EFillBox {
 };
 
 enum EFillRepeat {
-    RepeatFill, RepeatXFill, RepeatYFill, NoRepeatFill
+    RepeatFill, NoRepeatFill, RoundFill, SpaceFill
 };
 
 enum EFillLayerType {
     BackgroundFillLayer, MaskFillLayer
 };
 
+// CSS3 Background Values
+enum EFillSizeType { Contain, Cover, SizeLength, SizeNone };
+
 // CSS3 Marquee Properties
 
 enum EMarqueeBehavior { MNONE, MSCROLL, MSLIDE, MALTERNATE };
@@ -212,6 +215,11 @@ enum StyleContentType {
 
 enum EBorderFit { BorderFitBorder, BorderFitLines };
 
+enum EAnimPlayState {
+    AnimPlayStatePlaying = 0x0,
+    AnimPlayStatePaused = 0x1
+};
+
 enum ETimingFunctionType { LinearTimingFunction, CubicBezierTimingFunction };
 
 enum EWhiteSpace {
@@ -293,7 +301,11 @@ enum EDisplay {
     TABLE, INLINE_TABLE, TABLE_ROW_GROUP,
     TABLE_HEADER_GROUP, TABLE_FOOTER_GROUP, TABLE_ROW,
     TABLE_COLUMN_GROUP, TABLE_COLUMN, TABLE_CELL,
-    TABLE_CAPTION, BOX, INLINE_BOX, NONE
+    TABLE_CAPTION, BOX, INLINE_BOX, 
+#if ENABLE(WCSS)
+    WAP_MARQUEE,
+#endif
+    NONE
 };
 
 enum EPointerEvents {
@@ -309,6 +321,10 @@ enum EBackfaceVisibility {
     BackfaceVisibilityVisible, BackfaceVisibilityHidden
 };
 
+enum FontSmoothing {
+    AutoSmoothing, NoSmoothing, Antialiased, SubpixelAntialiased
+};
+
 } // namespace WebCore
 
 #endif // RenderStyleConstants_h
diff --git a/src/3rdparty/webkit/WebCore/storage/ChangeVersionWrapper.cpp b/src/3rdparty/webkit/WebCore/storage/ChangeVersionWrapper.cpp
index a2be615..33660e7 100644
--- a/src/3rdparty/webkit/WebCore/storage/ChangeVersionWrapper.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/ChangeVersionWrapper.cpp
@@ -42,21 +42,21 @@ ChangeVersionWrapper::ChangeVersionWrapper(const String& oldVersion, const Strin
 bool ChangeVersionWrapper::performPreflight(SQLTransaction* transaction)
 {
     ASSERT(transaction && transaction->database());
-    
+
     String actualVersion;
-    
+
     if (!transaction->database()->getVersionFromDatabase(actualVersion)) {
         LOG_ERROR("Unable to retrieve actual current version from database");
         m_sqlError = SQLError::create(0, "unable to verify current version of database");
         return false;
     }
-    
+
     if (actualVersion != m_oldVersion) {
         LOG_ERROR("Old version doesn't match actual version");
         m_sqlError = SQLError::create(2, "current version of the database and `oldVersion` argument do not match");
         return false;
     }
-    
+
     return true;
 }
 
@@ -71,10 +71,10 @@ bool ChangeVersionWrapper::performPostflight(SQLTransaction* transaction)
     }
 
     transaction->database()->setExpectedVersion(m_newVersion);
-    
+
     return true;
 }
-    
+
 } // namespace WebCore
 
 #endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/storage/Database.cpp b/src/3rdparty/webkit/WebCore/storage/Database.cpp
index 2292a0a..be0c490 100644
--- a/src/3rdparty/webkit/WebCore/storage/Database.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/Database.cpp
@@ -50,6 +50,8 @@
 #include "SQLiteFileSystem.h"
 #include "SQLiteStatement.h"
 #include "SQLResultSet.h"
+#include "SQLTransactionClient.h"
+#include "SQLTransactionCoordinator.h"
 #include <wtf/MainThread.h>
 #endif
 
@@ -109,20 +111,22 @@ PassRefPtr<Database> Database::openDatabase(Document* document, const String& na
         LOG(StorageAPI, "Database %s for origin %s not allowed to be established", name.ascii().data(), document->securityOrigin()->toString().ascii().data());
         return 0;
     }
-    
+
     RefPtr<Database> database = adoptRef(new Database(document, name, expectedVersion));
 
     if (!database->openAndVerifyVersion(e)) {
        LOG(StorageAPI, "Failed to open and verify version (expected %s) of database %s", expectedVersion.ascii().data(), database->databaseDebugName().ascii().data());
        return 0;
     }
-    
+
     DatabaseTracker::tracker().setDatabaseDetails(document->securityOrigin(), name, displayName, estimatedSize);
 
     document->setHasOpenDatabases();
 
+#if ENABLE(INSPECTOR)
     if (Page* page = document->frame()->page())
         page->inspectorController()->didOpenDatabase(database.get(), document->securityOrigin()->host(), name, expectedVersion);
+#endif
 
     return database;
 }
@@ -292,7 +296,7 @@ bool Database::versionMatchesExpected() const
         MutexLocker locker(guidMutex());
         return m_expectedVersion == guidToVersionMap().get(m_guid);
     }
-    
+
     return true;
 }
 
@@ -334,8 +338,8 @@ void Database::stop()
     // FIXME: The net effect of the following code is to remove all pending transactions and statements, but allow the current statement
     // to run to completion.  In the future we can use the sqlite3_progress_handler or sqlite3_interrupt interfaces to cancel the current
     // statement in response to close(), as well.
-    
-    // This method is meant to be used as an analog to cancelling a loader, and is used when a document is shut down as the result of 
+
+    // This method is meant to be used as an analog to cancelling a loader, and is used when a document is shut down as the result of
     // a page load or closing the page
     m_stopped = true;
 
@@ -355,10 +359,10 @@ unsigned long long Database::maximumSize() const
 {
     // The maximum size for this database is the full quota for this origin, minus the current usage within this origin,
     // except for the current usage of this database
-    
+
     OriginQuotaManager& manager(DatabaseTracker::tracker().originQuotaManager());
     Locker<OriginQuotaManager> locker(manager);
-    
+
     return DatabaseTracker::tracker().quotaForOrigin(m_securityOrigin.get()) - manager.diskUsage(m_securityOrigin.get()) + databaseSize();
 }
 
@@ -441,14 +445,6 @@ bool Database::performOpenAndVerify(ExceptionCode& e)
     m_sqliteDatabase.setAuthorizer(m_databaseAuthorizer);
     m_sqliteDatabase.setBusyTimeout(maxSqliteBusyWaitTime);
 
-    if (!m_sqliteDatabase.tableExists(databaseInfoTableName())) {
-        if (!m_sqliteDatabase.executeCommand("CREATE TABLE " + databaseInfoTableName() + " (key TEXT NOT NULL ON CONFLICT FAIL UNIQUE ON CONFLICT REPLACE,value TEXT NOT NULL ON CONFLICT FAIL);")) {
-            LOG_ERROR("Unable to create table %s in database %s", databaseInfoTableName().ascii().data(), databaseDebugName().ascii().data());
-            e = INVALID_STATE_ERR;
-            return false;
-        }
-    }
-
     String currentVersion;
     {
         MutexLocker locker(guidMutex());
@@ -466,6 +462,15 @@ bool Database::performOpenAndVerify(ExceptionCode& e)
             LOG(StorageAPI, "Current cached version for guid %i is %s", m_guid, currentVersion.ascii().data());
         } else {
             LOG(StorageAPI, "No cached version for guid %i", m_guid);
+
+            if (!m_sqliteDatabase.tableExists(databaseInfoTableName())) {
+                if (!m_sqliteDatabase.executeCommand("CREATE TABLE " + databaseInfoTableName() + " (key TEXT NOT NULL ON CONFLICT FAIL UNIQUE ON CONFLICT REPLACE,value TEXT NOT NULL ON CONFLICT FAIL);")) {
+                    LOG_ERROR("Unable to create table %s in database %s", databaseInfoTableName().ascii().data(), databaseDebugName().ascii().data());
+                    e = INVALID_STATE_ERR;
+                    return false;
+                }
+            }
+
             if (!getVersionFromDatabase(currentVersion)) {
                 LOG_ERROR("Failed to get current version from database %s", databaseDebugName().ascii().data());
                 e = INVALID_STATE_ERR;
@@ -507,7 +512,7 @@ bool Database::performOpenAndVerify(ExceptionCode& e)
     return true;
 }
 
-void Database::changeVersion(const String& oldVersion, const String& newVersion, 
+void Database::changeVersion(const String& oldVersion, const String& newVersion,
                              PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback,
                              PassRefPtr<VoidCallback> successCallback)
 {
@@ -518,9 +523,9 @@ void Database::changeVersion(const String& oldVersion, const String& newVersion,
 }
 
 void Database::transaction(PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback,
-                           PassRefPtr<VoidCallback> successCallback)
+                           PassRefPtr<VoidCallback> successCallback, bool readOnly)
 {
-    m_transactionQueue.append(SQLTransaction::create(this, callback, errorCallback, successCallback, 0));
+    m_transactionQueue.append(SQLTransaction::create(this, callback, errorCallback, successCallback, 0, readOnly));
     MutexLocker locker(m_transactionInProgressMutex);
     if (!m_transactionInProgress)
         scheduleTransaction();
@@ -539,13 +544,17 @@ void Database::scheduleTransaction()
         m_transactionInProgress = false;
 }
 
-void Database::scheduleTransactionStep(SQLTransaction* transaction)
+void Database::scheduleTransactionStep(SQLTransaction* transaction, bool immediately)
 {
-    if (m_document->databaseThread()) {
-        RefPtr<DatabaseTransactionTask> task = DatabaseTransactionTask::create(transaction);
-        LOG(StorageAPI, "Scheduling DatabaseTransactionTask %p for the transaction step\n", task.get());
+    if (!m_document->databaseThread())
+        return;
+
+    RefPtr<DatabaseTransactionTask> task = DatabaseTransactionTask::create(transaction);
+    LOG(StorageAPI, "Scheduling DatabaseTransactionTask %p for the transaction step\n", task.get());
+    if (immediately)
+        m_document->databaseThread()->scheduleImmediateTask(task.release());
+    else
         m_document->databaseThread()->scheduleTask(task.release());
-    }
 }
 
 void Database::scheduleTransactionCallback(SQLTransaction* transaction)
@@ -583,6 +592,16 @@ Vector<String> Database::performGetTableNames()
     return tableNames;
 }
 
+SQLTransactionClient* Database::transactionClient() const
+{
+    return m_document->databaseThread()->transactionClient();
+}
+
+SQLTransactionCoordinator* Database::transactionCoordinator() const
+{
+    return m_document->databaseThread()->transactionCoordinator();
+}
+
 String Database::version() const
 {
     if (m_deleted)
diff --git a/src/3rdparty/webkit/WebCore/storage/Database.h b/src/3rdparty/webkit/WebCore/storage/Database.h
index 0bdb37b..b850686 100644
--- a/src/3rdparty/webkit/WebCore/storage/Database.h
+++ b/src/3rdparty/webkit/WebCore/storage/Database.h
@@ -41,7 +41,6 @@
 
 #include <wtf/Forward.h>
 #include <wtf/HashSet.h>
-#include <wtf/OwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Deque.h>
@@ -57,9 +56,11 @@ class DatabaseThread;
 class Document;
 class SQLResultSet;
 class SQLTransactionCallback;
+class SQLTransactionClient;
+class SQLTransactionCoordinator;
 class SQLTransactionErrorCallback;
 class SQLValue;
-    
+
 typedef int ExceptionCode;
 
 class Database : public ThreadSafeShared<Database> {
@@ -72,12 +73,12 @@ public:
 // Direct support for the DOM API
     static PassRefPtr<Database> openDatabase(Document* document, const String& name, const String& expectedVersion, const String& displayName, unsigned long estimatedSize, ExceptionCode&);
     String version() const;
-    void changeVersion(const String& oldVersion, const String& newVersion, 
+    void changeVersion(const String& oldVersion, const String& newVersion,
                        PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback,
                        PassRefPtr<VoidCallback> successCallback);
     void transaction(PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback,
-                     PassRefPtr<VoidCallback> successCallback);
-    
+                     PassRefPtr<VoidCallback> successCallback, bool readOnly);
+
 // Internal engine support
     static const String& databaseInfoTableName();
 
@@ -90,7 +91,7 @@ public:
     Document* document() const { return m_document.get(); }
     PassRefPtr<SecurityOrigin> securityOriginCopy() const;
     String stringIdentifier() const;
-    
+
     bool getVersionFromDatabase(String&);
     bool setVersionInDatabase(const String&);
     void setExpectedVersion(const String&);
@@ -101,7 +102,7 @@ public:
 
     void close();
     bool opened() const { return m_opened; }
-    
+
     void stop();
     bool stopped() const { return m_stopped; }
 
@@ -116,6 +117,9 @@ public:
 
     Vector<String> performGetTableNames();
 
+    SQLTransactionClient* transactionClient() const;
+    SQLTransactionCoordinator* transactionCoordinator() const;
+
 private:
     Database(Document* document, const String& name, const String& expectedVersion);
 
@@ -123,8 +127,8 @@ private:
 
     void scheduleTransaction();
     void scheduleTransactionCallback(SQLTransaction*);
-    void scheduleTransactionStep(SQLTransaction* transaction);
-    
+    void scheduleTransactionStep(SQLTransaction* transaction, bool immediately = false);
+
     MessageQueue<RefPtr<SQLTransaction> > m_transactionQueue;
     Mutex m_transactionInProgressMutex;
     bool m_transactionInProgress;
@@ -139,7 +143,7 @@ private:
     String m_filename;
 
     bool m_deleted;
-    
+
     bool m_stopped;
 
     bool m_opened;
diff --git a/src/3rdparty/webkit/WebCore/storage/Database.idl b/src/3rdparty/webkit/WebCore/storage/Database.idl
index 1e4b316..6ca9c95 100644
--- a/src/3rdparty/webkit/WebCore/storage/Database.idl
+++ b/src/3rdparty/webkit/WebCore/storage/Database.idl
@@ -34,6 +34,7 @@ module storage {
         readonly attribute DOMString version;
         [Custom] void changeVersion(in DOMString oldVersion, in DOMString newVersion, in SQLTransactionCallback callback, in SQLTransactionErrorCallback errorCallback, in VoidCallback successCallback);
         [Custom] void transaction(in SQLTransactionCallback callback, in SQLTransactionErrorCallback errorCallback, in VoidCallback successCallback);
+        [Custom] void readTransaction(in SQLTransactionCallback callback, in SQLTransactionErrorCallback errorCallback, in VoidCallback successCallback);
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseAuthorizer.cpp b/src/3rdparty/webkit/WebCore/storage/DatabaseAuthorizer.cpp
index 2d182ce..93f9106 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseAuthorizer.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseAuthorizer.cpp
@@ -58,6 +58,12 @@ int DatabaseAuthorizer::createTable(const String& tableName)
 
 int DatabaseAuthorizer::createTempTable(const String& tableName)
 {
+    // SQLITE_CREATE_TEMP_TABLE results in a UPDATE operation, which is not
+    // allowed in read-only transactions or private browsing, so we might as
+    // well disallow SQLITE_CREATE_TEMP_TABLE in these cases
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
@@ -71,6 +77,12 @@ int DatabaseAuthorizer::dropTable(const String& tableName)
 
 int DatabaseAuthorizer::dropTempTable(const String& tableName)
 {
+    // SQLITE_DROP_TEMP_TABLE results in a DELETE operation, which is not
+    // allowed in read-only transactions or private browsing, so we might as
+    // well disallow SQLITE_DROP_TEMP_TABLE in these cases
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
@@ -94,6 +106,12 @@ int DatabaseAuthorizer::createIndex(const String&, const String& tableName)
 
 int DatabaseAuthorizer::createTempIndex(const String&, const String& tableName)
 {
+    // SQLITE_CREATE_TEMP_INDEX should result in a UPDATE or INSERT operation,
+    // which is not allowed in read-only transactions or private browsing,
+    // so we might as well disallow SQLITE_CREATE_TEMP_INDEX in these cases
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
@@ -107,6 +125,12 @@ int DatabaseAuthorizer::dropIndex(const String&, const String& tableName)
 
 int DatabaseAuthorizer::dropTempIndex(const String&, const String& tableName)
 {
+    // SQLITE_DROP_TEMP_INDEX should result in a DELETE operation, which is
+    // not allowed in read-only transactions or private browsing, so we might
+    // as well disallow SQLITE_DROP_TEMP_INDEX in these cases
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
@@ -121,6 +145,12 @@ int DatabaseAuthorizer::createTrigger(const String&, const String& tableName)
 
 int DatabaseAuthorizer::createTempTrigger(const String&, const String& tableName)
 {
+    // SQLITE_CREATE_TEMP_TRIGGER results in a INSERT operation, which is not
+    // allowed in read-only transactions or private browsing, so we might as
+    // well disallow SQLITE_CREATE_TEMP_TRIGGER in these cases
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
@@ -134,9 +164,41 @@ int DatabaseAuthorizer::dropTrigger(const String&, const String& tableName)
 
 int DatabaseAuthorizer::dropTempTrigger(const String&, const String& tableName)
 {
+    // SQLITE_DROP_TEMP_TRIGGER results in a DELETE operation, which is not
+    // allowed in read-only transactions or private browsing, so we might as
+    // well disallow SQLITE_DROP_TEMP_TRIGGER in these cases
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
+int DatabaseAuthorizer::createView(const String&)
+{
+    return (m_readOnly && m_securityEnabled ? SQLAuthDeny : SQLAuthAllow);
+}
+
+int DatabaseAuthorizer::createTempView(const String&)
+{
+    // SQLITE_CREATE_TEMP_VIEW results in a UPDATE operation, which is not
+    // allowed in read-only transactions or private browsing, so we might as
+    // well disallow SQLITE_CREATE_TEMP_VIEW in these cases
+    return (m_readOnly && m_securityEnabled ? SQLAuthDeny : SQLAuthAllow);
+}
+
+int DatabaseAuthorizer::dropView(const String&)
+{
+    return (m_readOnly && m_securityEnabled ? SQLAuthDeny : SQLAuthAllow);
+}
+
+int DatabaseAuthorizer::dropTempView(const String&)
+{
+    // SQLITE_DROP_TEMP_VIEW results in a DELETE operation, which is not
+    // allowed in read-only transactions or private browsing, so we might as
+    // well disallow SQLITE_DROP_TEMP_VIEW in these cases
+    return (m_readOnly && m_securityEnabled ? SQLAuthDeny : SQLAuthAllow);
+}
+
 int DatabaseAuthorizer::createVTable(const String&, const String&)
 {
     if (m_readOnly && m_securityEnabled)
@@ -191,6 +253,11 @@ int DatabaseAuthorizer::allowRead(const String& tableName, const String&)
     return denyBasedOnTableName(tableName);
 }
 
+int DatabaseAuthorizer::allowReindex(const String&)
+{
+    return (m_readOnly && m_securityEnabled ? SQLAuthDeny : SQLAuthAllow);
+}
+
 int DatabaseAuthorizer::allowAnalyze(const String& tableName)
 {
     return denyBasedOnTableName(tableName);
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseAuthorizer.h b/src/3rdparty/webkit/WebCore/storage/DatabaseAuthorizer.h
index e53ea50..248b659 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseAuthorizer.h
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseAuthorizer.h
@@ -59,10 +59,10 @@ public:
     int dropTrigger(const String& triggerName, const String& tableName);
     int dropTempTrigger(const String& triggerName, const String& tableName);
 
-    int createView(const String& /*viewName*/) { return SQLAuthAllow; }
-    int createTempView(const String& /*viewName*/) { return SQLAuthAllow; }
-    int dropView(const String& /*viewName*/) { return SQLAuthAllow; }
-    int dropTempView(const String& /*viewName*/) { return SQLAuthAllow; }
+    int createView(const String& viewName);
+    int createTempView(const String& viewName);
+    int dropView(const String& viewName);
+    int dropTempView(const String& viewName);
 
     int createVTable(const String& tableName, const String& moduleName);
     int dropVTable(const String& tableName, const String& moduleName);
@@ -75,7 +75,7 @@ public:
     int allowSelect() { return SQLAuthAllow; }
     int allowRead(const String& tableName, const String& columnName);
 
-    int allowReindex(const String& /*indexName*/) { return SQLAuthAllow; }
+    int allowReindex(const String& indexName);
     int allowAnalyze(const String& tableName);
     int allowFunction(const String& functionName);
     int allowPragma(const String& pragmaName, const String& firstArgument);
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseDetails.h b/src/3rdparty/webkit/WebCore/storage/DatabaseDetails.h
index a4d85fd..9b0f506 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseDetails.h
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseDetails.h
@@ -60,7 +60,7 @@ private:
     String m_name;
     String m_displayName;
     unsigned long long m_expectedUsage;
-    unsigned long long m_currentUsage; 
+    unsigned long long m_currentUsage;
 
 };
 
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseThread.cpp b/src/3rdparty/webkit/WebCore/storage/DatabaseThread.cpp
index b6c9b5d..9e3afdd 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseThread.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseThread.cpp
@@ -35,11 +35,15 @@
 #include "Database.h"
 #include "DatabaseTask.h"
 #include "Logging.h"
+#include "SQLTransactionClient.h"
+#include "SQLTransactionCoordinator.h"
 
 namespace WebCore {
 
 DatabaseThread::DatabaseThread()
     : m_threadID(0)
+    , m_transactionClient(new SQLTransactionClient())
+    , m_transactionCoordinator(new SQLTransactionCoordinator())
 {
     m_selfRef = this;
 }
@@ -97,6 +101,9 @@ void* DatabaseThread::databaseThread()
         pool.cycle();
     }
 
+    // Clean up the list of all pending transactions on this database thread
+    m_transactionCoordinator->shutdown();
+
     LOG(StorageAPI, "About to detach thread %i and clear the ref to DatabaseThread %p, which currently has %i ref(s)", m_threadID, this, refCount());
 
     // Close the databases that we ran transactions on. This ensures that if any transactions are still open, they are rolled back and we don't leave the database in an
@@ -119,7 +126,7 @@ void* DatabaseThread::databaseThread()
     return 0;
 }
 
-void DatabaseThread::recordDatabaseOpen(Database* database) 
+void DatabaseThread::recordDatabaseOpen(Database* database)
 {
     ASSERT(currentThread() == m_threadID);
     ASSERT(database);
@@ -127,7 +134,7 @@ void DatabaseThread::recordDatabaseOpen(Database* database)
     m_openDatabaseSet.add(database);
 }
 
-void DatabaseThread::recordDatabaseClosed(Database* database) 
+void DatabaseThread::recordDatabaseClosed(Database* database)
 {
     ASSERT(currentThread() == m_threadID);
     ASSERT(database);
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseThread.h b/src/3rdparty/webkit/WebCore/storage/DatabaseThread.h
index 5aab5fd..83b1baf 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseThread.h
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseThread.h
@@ -33,6 +33,7 @@
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/MessageQueue.h>
+#include <wtf/OwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Threading.h>
@@ -42,6 +43,8 @@ namespace WebCore {
 class Database;
 class DatabaseTask;
 class Document;
+class SQLTransactionClient;
+class SQLTransactionCoordinator;
 
 class DatabaseThread : public ThreadSafeShared<DatabaseThread> {
 public:
@@ -60,6 +63,9 @@ public:
     void recordDatabaseClosed(Database*);
     ThreadIdentifier getThreadID() { return m_threadID; }
 
+    SQLTransactionClient* transactionClient() { return m_transactionClient.get(); }
+    SQLTransactionCoordinator* transactionCoordinator() { return m_transactionCoordinator.get(); }
+
 private:
     DatabaseThread();
 
@@ -75,6 +81,9 @@ private:
     // This set keeps track of the open databases that have been used on this thread.
     typedef HashSet<RefPtr<Database> > DatabaseSet;
     DatabaseSet m_openDatabaseSet;
+
+    OwnPtr<SQLTransactionClient> m_transactionClient;
+    OwnPtr<SQLTransactionCoordinator> m_transactionCoordinator;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.cpp b/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.cpp
index e7c9485..491e6f1 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.cpp
@@ -131,7 +131,7 @@ bool DatabaseTracker::canEstablishDatabase(Document* document, const String& nam
     // Since we're imminently opening a database within this Document's origin, make sure this origin is being tracked by the QuotaTracker
     // by fetching it's current usage now
     unsigned long long usage = usageForOrigin(origin);
-    
+
     // If a database already exists, ignore the passed-in estimated size and say it's OK.
     if (hasEntryForDatabase(origin, name))
         return true;
@@ -197,11 +197,11 @@ String DatabaseTracker::fullPathForDatabase(SecurityOrigin* origin, const String
 
     String originIdentifier = origin->databaseIdentifier();
     String originPath = this->originPath(origin);
-    
+
     // Make sure the path for this SecurityOrigin exists
     if (createIfNotExists && !SQLiteFileSystem::ensureDatabaseDirectoryExists(originPath))
         return String();
-    
+
     // See if we have a path for this database yet
     openTrackerDatabase(false);
     if (!m_database.isOpen())
@@ -220,14 +220,14 @@ String DatabaseTracker::fullPathForDatabase(SecurityOrigin* origin, const String
         return SQLiteFileSystem::appendDatabaseFileNameToPath(originPath, statement.getColumnText(0));
     if (!createIfNotExists)
         return String();
-        
+
     if (result != SQLResultDone) {
         LOG_ERROR("Failed to retrieve filename from Database Tracker for origin %s, name %s", origin->databaseIdentifier().ascii().data(), name.ascii().data());
         return String();
     }
     statement.finalize();
-    
-    String fileName = SQLiteFileSystem::getFileNameForNewDatabase(originPath, origin->databaseIdentifier(), name, &m_database);
+
+    String fileName = SQLiteFileSystem::getFileNameForNewDatabase(originPath, name, origin->databaseIdentifier(), &m_database);
     if (!addDatabase(origin, name, fileName))
         return String();
 
@@ -239,7 +239,7 @@ String DatabaseTracker::fullPathForDatabase(SecurityOrigin* origin, const String
         if (originQuotaManager().tracksOrigin(origin))
             originQuotaManager().addDatabase(origin, name, fullFilePath);
     }
-    
+
     return fullFilePath;
 }
 
@@ -321,19 +321,19 @@ DatabaseDetails DatabaseTracker::detailsForNameAndOrigin(const String& name, Sec
     SQLiteStatement statement(m_database, "SELECT displayName, estimatedSize FROM Databases WHERE origin=? AND name=?");
     if (statement.prepare() != SQLResultOk)
         return DatabaseDetails();
-   
+
     statement.bindText(1, originIdentifier);
     statement.bindText(2, name);
-    
+
     int result = statement.step();
     if (result == SQLResultDone)
         return DatabaseDetails();
-    
+
     if (result != SQLResultRow) {
         LOG_ERROR("Error retrieving details for database %s in origin %s from tracker database", name.ascii().data(), originIdentifier.ascii().data());
         return DatabaseDetails();
     }
-    
+
     return DatabaseDetails(name, statement.getColumnText(0), statement.getColumnInt64(1), usageForDatabase(name, origin));
 }
 
@@ -343,17 +343,17 @@ void DatabaseTracker::setDatabaseDetails(SecurityOrigin* origin, const String& n
 
     String originIdentifier = origin->databaseIdentifier();
     int64_t guid = 0;
-    
+
     openTrackerDatabase(true);
     if (!m_database.isOpen())
         return;
     SQLiteStatement statement(m_database, "SELECT guid FROM Databases WHERE origin=? AND name=?");
     if (statement.prepare() != SQLResultOk)
         return;
-        
+
     statement.bindText(1, originIdentifier);
     statement.bindText(2, name);
-    
+
     int result = statement.step();
     if (result == SQLResultRow)
         guid = statement.getColumnInt64(0);
@@ -371,20 +371,20 @@ void DatabaseTracker::setDatabaseDetails(SecurityOrigin* origin, const String& n
         }
         return;
     }
-    
+
     SQLiteStatement updateStatement(m_database, "UPDATE Databases SET displayName=?, estimatedSize=? WHERE guid=?");
     if (updateStatement.prepare() != SQLResultOk)
         return;
-    
+
     updateStatement.bindText(1, displayName);
     updateStatement.bindInt64(2, estimatedSize);
     updateStatement.bindInt64(3, guid);
-    
+
     if (updateStatement.step() != SQLResultDone) {
         LOG_ERROR("Failed to update details for database %s in origin %s", name.ascii().data(), originIdentifier.ascii().data());
-        return;  
+        return;
     }
-    
+
     if (m_client)
         m_client->dispatchDidModifyDatabase(origin, name);
 }
@@ -395,7 +395,7 @@ unsigned long long DatabaseTracker::usageForDatabase(const String& name, Securit
     String path = fullPathForDatabase(origin, name, false);
     if (path.isEmpty())
         return 0;
-        
+
     return SQLiteFileSystem::getDatabaseFileSize(path);
 }
 
@@ -481,16 +481,16 @@ unsigned long long DatabaseTracker::usageForOrigin(SecurityOrigin* origin)
     // Use the OriginQuotaManager mechanism to calculate the usage
     if (originQuotaManager().tracksOrigin(origin))
         return originQuotaManager().diskUsage(origin);
-    
+
     // If the OriginQuotaManager doesn't track this origin already, prime it to do so
     originQuotaManager().trackOrigin(origin);
-    
+
     Vector<String> names;
     databaseNamesForOrigin(origin, names);
 
     for (unsigned i = 0; i < names.size(); ++i)
         originQuotaManager().addDatabase(origin, names[i], fullPathForDatabase(origin, names[i], false));
-    
+
     if (!originQuotaManager().tracksOrigin(origin))
         return 0;
     return originQuotaManager().diskUsage(origin);
@@ -529,7 +529,7 @@ void DatabaseTracker::setQuota(SecurityOrigin* origin, unsigned long long quota)
                     LOG_ERROR("Unable to establish origin %s in the tracker", origin->databaseIdentifier().ascii().data());
             }
         } else {
-            SQLiteStatement statement(m_database, "UPDATE Origins SET quota=? WHERE origin=?");        
+            SQLiteStatement statement(m_database, "UPDATE Origins SET quota=? WHERE origin=?");
             bool error = statement.prepare() != SQLResultOk;
             if (!error) {
                 statement.bindInt64(1, quota);
@@ -556,7 +556,7 @@ bool DatabaseTracker::addDatabase(SecurityOrigin* origin, const String& name, co
     openTrackerDatabase(true);
     if (!m_database.isOpen())
         return false;
-        
+
     // New database should never be added until the origin has been established
     ASSERT(hasEntryForOrigin(origin));
 
@@ -573,10 +573,10 @@ bool DatabaseTracker::addDatabase(SecurityOrigin* origin, const String& name, co
         LOG_ERROR("Failed to add database %s to origin %s: %s\n", name.ascii().data(), origin->databaseIdentifier().ascii().data(), m_database.lastErrorMsg());
         return false;
     }
-    
+
     if (m_client)
         m_client->dispatchDidModifyOrigin(origin);
-    
+
     return true;
 }
 
@@ -603,27 +603,27 @@ void DatabaseTracker::deleteOrigin(SecurityOrigin* origin)
         LOG_ERROR("Unable to retrieve list of database names for origin %s", origin->databaseIdentifier().ascii().data());
         return;
     }
-    
+
     for (unsigned i = 0; i < databaseNames.size(); ++i) {
         if (!deleteDatabaseFile(origin, databaseNames[i])) {
+            // Even if the file can't be deleted, we want to try and delete the rest, don't return early here.
             LOG_ERROR("Unable to delete file for database %s in origin %s", databaseNames[i].ascii().data(), origin->databaseIdentifier().ascii().data());
-            return;
         }
     }
-    
+
     SQLiteStatement statement(m_database, "DELETE FROM Databases WHERE origin=?");
     if (statement.prepare() != SQLResultOk) {
         LOG_ERROR("Unable to prepare deletion of databases from origin %s from tracker", origin->databaseIdentifier().ascii().data());
         return;
     }
-        
+
     statement.bindText(1, origin->databaseIdentifier());
-    
+
     if (!statement.executeCommand()) {
         LOG_ERROR("Unable to execute deletion of databases from origin %s from tracker", origin->databaseIdentifier().ascii().data());
         return;
     }
-    
+
     SQLiteStatement originStatement(m_database, "DELETE FROM Origins WHERE origin=?");
     if (originStatement.prepare() != SQLResultOk) {
         LOG_ERROR("Unable to prepare deletion of origin %s from tracker", origin->databaseIdentifier().ascii().data());
@@ -631,7 +631,7 @@ void DatabaseTracker::deleteOrigin(SecurityOrigin* origin)
     }
 
     originStatement.bindText(1, origin->databaseIdentifier());
-    
+
     if (!originStatement.executeCommand()) {
         LOG_ERROR("Unable to execute deletion of databases from origin %s from tracker", origin->databaseIdentifier().ascii().data());
         return;
@@ -674,26 +674,26 @@ void DatabaseTracker::deleteDatabase(SecurityOrigin* origin, const String& name)
         LOG_ERROR("Unable to delete file for database %s in origin %s", name.ascii().data(), origin->databaseIdentifier().ascii().data());
         return;
     }
-    
+
     SQLiteStatement statement(m_database, "DELETE FROM Databases WHERE origin=? AND name=?");
     if (statement.prepare() != SQLResultOk) {
         LOG_ERROR("Unable to prepare deletion of database %s from origin %s from tracker", name.ascii().data(), origin->databaseIdentifier().ascii().data());
         return;
     }
-        
+
     statement.bindText(1, origin->databaseIdentifier());
     statement.bindText(2, name);
-    
+
     if (!statement.executeCommand()) {
         LOG_ERROR("Unable to execute deletion of database %s from origin %s from tracker", name.ascii().data(), origin->databaseIdentifier().ascii().data());
         return;
     }
-    
+
     {
         Locker<OriginQuotaManager> quotaManagerLocker(originQuotaManager());
         originQuotaManager().removeDatabase(origin, name);
     }
-    
+
     if (m_client) {
         m_client->dispatchDidModifyOrigin(origin);
         m_client->dispatchDidModifyDatabase(origin, name);
diff --git a/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.h b/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.h
index dc50965..2f6e06d 100644
--- a/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.h
+++ b/src/3rdparty/webkit/WebCore/storage/DatabaseTracker.h
@@ -70,18 +70,18 @@ public:
     unsigned long long usageForOrigin(SecurityOrigin*);
     unsigned long long quotaForOrigin(SecurityOrigin*);
     void setQuota(SecurityOrigin*, unsigned long long);
-    
+
     void deleteAllDatabases();
     void deleteOrigin(SecurityOrigin*);
     void deleteDatabase(SecurityOrigin*, const String& name);
 
     void setClient(DatabaseTrackerClient*);
-    
+
     // From a secondary thread, must be thread safe with its data
     void scheduleNotifyDatabaseChanged(SecurityOrigin*, const String& name);
-    
+
     OriginQuotaManager& originQuotaManager();
-    
+
     static DatabaseTracker& tracker();
 
     bool hasEntryForOrigin(SecurityOrigin*);
@@ -93,12 +93,12 @@ private:
     void openTrackerDatabase(bool createIfDoesNotExist);
 
     String originPath(SecurityOrigin*) const;
-    
+
     bool hasEntryForDatabase(SecurityOrigin*, const String& databaseIdentifier);
-    
+
     bool addDatabase(SecurityOrigin*, const String& name, const String& path);
     void populateOrigins();
-    
+
     bool deleteDatabaseFile(SecurityOrigin*, const String& name);
 
     SQLiteDatabase m_database;
@@ -117,7 +117,7 @@ private:
     OwnPtr<OriginQuotaManager> m_quotaManager;
 
     String m_databaseDirectoryPath;
-    
+
     DatabaseTrackerClient* m_client;
 
     std::pair<SecurityOrigin*, DatabaseDetails>* m_proposedDatabase;
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.cpp b/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.cpp
index f5d4890..4cea845 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.cpp
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -73,4 +73,3 @@ void LocalStorageTask::performTask()
 }
 
 #endif // ENABLE(DOM_STORAGE)
-
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.h b/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.h
index b12a26b..726b41f 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.h
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef LocalStorageTask_h
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp b/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp
index 2da5934..c85d5e6 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -101,7 +101,7 @@ void LocalStorageThread::scheduleSync(PassRefPtr<StorageAreaSync> area)
 void LocalStorageThread::terminate()
 {
     ASSERT(isMainThread());
-    
+
     // Ideally we'd never be killing a thread that wasn't live, so ASSERT it.
     // But if we do in a release build, make sure to not wait on a condition that will never get signalled
     ASSERT(!m_queue.killed() && m_threadID);
@@ -109,9 +109,9 @@ void LocalStorageThread::terminate()
         return;
 
     MutexLocker locker(m_terminateLock);
-    
+
     m_queue.append(LocalStorageTask::createTerminate(this));
-    
+
     m_terminateCondition.wait(m_terminateLock);
 }
 
@@ -120,7 +120,7 @@ void LocalStorageThread::performTerminate()
     ASSERT(!isMainThread());
 
     m_queue.kill();
-        
+
     MutexLocker locker(m_terminateLock);
     m_terminateCondition.signal();
 }
@@ -128,4 +128,3 @@ void LocalStorageThread::performTerminate()
 }
 
 #endif // ENABLE(DOM_STORAGE)
-
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.h b/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.h
index 3d58427..b903fb9 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.h
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef LocalStorageThread_h
@@ -64,7 +64,7 @@ namespace WebCore {
         RefPtr<LocalStorageThread> m_selfRef;
 
         MessageQueue<RefPtr<LocalStorageTask> > m_queue;
-        
+
         Mutex m_terminateLock;
         ThreadCondition m_terminateCondition;
     };
diff --git a/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.cpp b/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.cpp
index 2b98ab7..b757f70 100644
--- a/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/OriginQuotaManager.cpp
@@ -75,25 +75,25 @@ bool OriginQuotaManager::tracksOrigin(SecurityOrigin* origin) const
 void OriginQuotaManager::addDatabase(SecurityOrigin* origin, const String& databaseIdentifier, const String& fullPath)
 {
     ASSERT(m_usageRecordGuardLocked);
-    
+
     OriginUsageRecord* usageRecord = m_usageMap.get(origin);
     ASSERT(usageRecord);
-    
+
     usageRecord->addDatabase(databaseIdentifier.copy(), fullPath.copy());
 }
 
 void OriginQuotaManager::removeDatabase(SecurityOrigin* origin, const String& databaseIdentifier)
 {
     ASSERT(m_usageRecordGuardLocked);
-    
-    if (OriginUsageRecord* usageRecord = m_usageMap.get(origin))    
+
+    if (OriginUsageRecord* usageRecord = m_usageMap.get(origin))
         usageRecord->removeDatabase(databaseIdentifier);
 }
 
 void OriginQuotaManager::removeOrigin(SecurityOrigin* origin)
 {
     ASSERT(m_usageRecordGuardLocked);
-    
+
     if (OriginUsageRecord* usageRecord = m_usageMap.get(origin)) {
         m_usageMap.remove(origin);
         delete usageRecord;
@@ -107,21 +107,20 @@ void OriginQuotaManager::markDatabase(Database* database)
     RefPtr<SecurityOrigin> origin = database->securityOriginCopy();
     OriginUsageRecord* usageRecord = m_usageMap.get(origin);
     ASSERT(usageRecord);
-    
+
     usageRecord->markDatabase(database->stringIdentifier());
 }
 
 unsigned long long OriginQuotaManager::diskUsage(SecurityOrigin* origin) const
 {
     ASSERT(m_usageRecordGuardLocked);
-    
+
     OriginUsageRecord* usageRecord = m_usageMap.get(origin);
     ASSERT(usageRecord);
-    
+
     return usageRecord->diskUsage();
 }
 
-
 }
 
 #endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/storage/OriginUsageRecord.cpp b/src/3rdparty/webkit/WebCore/storage/OriginUsageRecord.cpp
index 5f4957f..684df53 100644
--- a/src/3rdparty/webkit/WebCore/storage/OriginUsageRecord.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/OriginUsageRecord.cpp
@@ -44,10 +44,10 @@ void OriginUsageRecord::addDatabase(const String& identifier, const String& full
     ASSERT(!m_databaseMap.contains(identifier));
     ASSERT_ARG(identifier, identifier.impl()->refCount() == 1);
     ASSERT_ARG(fullPath, fullPath.impl()->refCount() == 1);
-    
+
     m_databaseMap.set(identifier, DatabaseEntry(fullPath));
     m_unknownSet.add(identifier);
-     
+
     m_cachedDiskUsageIsValid = false;
 }
 
@@ -81,13 +81,13 @@ unsigned long long OriginUsageRecord::diskUsage()
     for (; iUnknown != endUnknown; ++iUnknown) {
         const String& path = m_databaseMap.get(*iUnknown).filename;
         ASSERT(!path.isEmpty());
-                
+
         // When we can't determine the file size, we'll just have to assume the file is missing/inaccessible.
         long long size = SQLiteFileSystem::getDatabaseFileSize(path);
         m_databaseMap.set(*iUnknown, DatabaseEntry(path, size));
     }
     m_unknownSet.clear();
-    
+
     // Recalculate the cached usage value.
     m_cachedDiskUsage = 0;
     HashMap<String, DatabaseEntry>::iterator iDatabase = m_databaseMap.begin();
@@ -98,7 +98,7 @@ unsigned long long OriginUsageRecord::diskUsage()
     m_cachedDiskUsageIsValid = true;
     return m_cachedDiskUsage;
 }
-    
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/storage/OriginUsageRecord.h b/src/3rdparty/webkit/WebCore/storage/OriginUsageRecord.h
index 3442ae1..609a793 100644
--- a/src/3rdparty/webkit/WebCore/storage/OriginUsageRecord.h
+++ b/src/3rdparty/webkit/WebCore/storage/OriginUsageRecord.h
@@ -68,4 +68,4 @@ private:
 
 #endif
 
-#endif 
+#endif
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLError.h b/src/3rdparty/webkit/WebCore/storage/SQLError.h
index b6ebb5c..a17efa9 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLError.h
+++ b/src/3rdparty/webkit/WebCore/storage/SQLError.h
@@ -42,7 +42,7 @@ public:
 
     unsigned code() const { return m_code; }
     String message() const { return m_message.copy(); }
-    
+
 private:
     SQLError(unsigned code, const String& message) : m_code(code), m_message(message.copy()) { }
     unsigned m_code;
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLResultSetRowList.h b/src/3rdparty/webkit/WebCore/storage/SQLResultSetRowList.h
index 96a6aa1..92b5ec0 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLResultSetRowList.h
+++ b/src/3rdparty/webkit/WebCore/storage/SQLResultSetRowList.h
@@ -39,7 +39,7 @@ namespace WebCore {
 class SQLResultSetRowList : public RefCounted<SQLResultSetRowList> {
 public:
     static PassRefPtr<SQLResultSetRowList> create() { return adoptRef(new SQLResultSetRowList); }
-    
+
     const Vector<String>& columnNames() const { return m_columns; }
     const Vector<SQLValue>& values() const { return m_result; }
 
@@ -50,7 +50,7 @@ public:
 
 private:
     SQLResultSetRowList() { }
-    
+
     Vector<String> m_columns;
     Vector<SQLValue> m_result;
 };
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLStatement.cpp b/src/3rdparty/webkit/WebCore/storage/SQLStatement.cpp
index 38ca75d..970f757 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLStatement.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/SQLStatement.cpp
@@ -57,24 +57,24 @@ SQLStatement::SQLStatement(const String& statement, const Vector<SQLValue>& argu
     , m_readOnly(readOnly)
 {
 }
-   
+
 bool SQLStatement::execute(Database* db)
 {
     ASSERT(!m_resultSet);
-        
+
     // If we're re-running this statement after a quota violation, we need to clear that error now
     clearFailureDueToQuota();
 
-    // This transaction might have been marked bad while it was being set up on the main thread, 
+    // This transaction might have been marked bad while it was being set up on the main thread,
     // so if there is still an error, return false.
     if (m_error)
         return false;
-        
+
     if (m_readOnly)
         db->setAuthorizerReadOnly();
-    
+
     SQLiteDatabase* database = &db->m_sqliteDatabase;
-    
+
     SQLiteStatement statement(*database, m_statement);
     int result = statement.prepare();
 
@@ -98,7 +98,7 @@ bool SQLStatement::execute(Database* db)
             setFailureDueToQuota();
             return false;
         }
-        
+
         if (result != SQLResultOk) {
             LOG(StorageAPI, "Failed to bind value index %i to statement for query '%s'", i + 1, m_statement.ascii().data());
             m_error = SQLError::create(1, database->lastErrorMsg());
@@ -165,9 +165,9 @@ void SQLStatement::setVersionMismatchedError()
 bool SQLStatement::performCallback(SQLTransaction* transaction)
 {
     ASSERT(transaction);
-    
+
     bool callbackError = false;
-    
+
     // Call the appropriate statement callback and track if it resulted in an error,
     // because then we need to jump to the transaction error callback.
     if (m_error) {
@@ -195,9 +195,9 @@ void SQLStatement::clearFailureDueToQuota()
         m_error = 0;
 }
 
-bool SQLStatement::lastExecutionFailedDueToQuota() const 
-{ 
-    return m_error && m_error->code() == 4; 
+bool SQLStatement::lastExecutionFailedDueToQuota() const
+{
+    return m_error && m_error->code() == 4;
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLStatement.h b/src/3rdparty/webkit/WebCore/storage/SQLStatement.h
index 831aecc..f01f7bf 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLStatement.h
+++ b/src/3rdparty/webkit/WebCore/storage/SQLStatement.h
@@ -52,10 +52,10 @@ class String;
 class SQLStatement : public ThreadSafeShared<SQLStatement> {
 public:
     static PassRefPtr<SQLStatement> create(const String&, const Vector<SQLValue>&, PassRefPtr<SQLStatementCallback>, PassRefPtr<SQLStatementErrorCallback>, bool readOnly);
-    
+
     bool execute(Database*);
     bool lastExecutionFailedDueToQuota() const;
-    
+
     bool hasStatementCallback() const { return m_statementCallback; }
     bool hasStatementErrorCallback() const { return m_statementErrorCallback; }
 
@@ -63,22 +63,22 @@ public:
     void setVersionMismatchedError();
 
     bool performCallback(SQLTransaction*);
-    
+
     SQLError* sqlError() const { return m_error.get(); }
 private:
     SQLStatement(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback, bool readOnly);
 
     void setFailureDueToQuota();
     void clearFailureDueToQuota();
-    
+
     String m_statement;
     Vector<SQLValue> m_arguments;
     RefPtr<SQLStatementCallback> m_statementCallback;
     RefPtr<SQLStatementErrorCallback> m_statementErrorCallback;
-    
+
     RefPtr<SQLError> m_error;
     RefPtr<SQLResultSet> m_resultSet;
-    
+
     bool m_readOnly;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLStatementCallback.h b/src/3rdparty/webkit/WebCore/storage/SQLStatementCallback.h
index 14d19bb..31f5c0c 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLStatementCallback.h
+++ b/src/3rdparty/webkit/WebCore/storage/SQLStatementCallback.h
@@ -36,7 +36,7 @@ namespace WebCore {
 
 class SQLTransaction;
 class SQLResultSet;
-    
+
 class SQLStatementCallback : public ThreadSafeShared<SQLStatementCallback> {
 public:
     virtual ~SQLStatementCallback() { }
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLStatementErrorCallback.h b/src/3rdparty/webkit/WebCore/storage/SQLStatementErrorCallback.h
index ef0c328..29127ce 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLStatementErrorCallback.h
+++ b/src/3rdparty/webkit/WebCore/storage/SQLStatementErrorCallback.h
@@ -37,7 +37,7 @@ namespace WebCore {
 
 class SQLTransaction;
 class SQLError;
-    
+
 class SQLStatementErrorCallback : public ThreadSafeShared<SQLStatementErrorCallback> {
 public:
     virtual ~SQLStatementErrorCallback() { }
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLTransaction.cpp b/src/3rdparty/webkit/WebCore/storage/SQLTransaction.cpp
index 3331e6e..28940a7 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLTransaction.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/SQLTransaction.cpp
@@ -35,11 +35,9 @@
 #include "Database.h"
 #include "DatabaseAuthorizer.h"
 #include "DatabaseDetails.h"
-#include "DatabaseTracker.h"
 #include "Document.h"
 #include "ExceptionCode.h"
 #include "Logging.h"
-#include "OriginQuotaManager.h"
 #include "Page.h"
 #include "PlatformString.h"
 #include "SecurityOrigin.h"
@@ -50,24 +48,26 @@
 #include "SQLStatement.h"
 #include "SQLStatementCallback.h"
 #include "SQLStatementErrorCallback.h"
+#include "SQLTransactionClient.h"
+#include "SQLTransactionCoordinator.h"
 #include "SQLValue.h"
 
-// There's no way of knowing exactly how much more space will be required when a statement hits the quota limit.  
+// There's no way of knowing exactly how much more space will be required when a statement hits the quota limit.
 // For now, we'll arbitrarily choose currentQuota + 1mb.
 // In the future we decide to track if a size increase wasn't enough, and ask for larger-and-larger increases until its enough.
 static const int DefaultQuotaSizeIncrease = 1048576;
 
 namespace WebCore {
 
-PassRefPtr<SQLTransaction> SQLTransaction::create(Database* db, PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback, 
-                                           PassRefPtr<VoidCallback> successCallback, PassRefPtr<SQLTransactionWrapper> wrapper)
+PassRefPtr<SQLTransaction> SQLTransaction::create(Database* db, PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback,
+                                                  PassRefPtr<VoidCallback> successCallback, PassRefPtr<SQLTransactionWrapper> wrapper, bool readOnly)
 {
-    return adoptRef(new SQLTransaction(db, callback, errorCallback, successCallback, wrapper));
+    return adoptRef(new SQLTransaction(db, callback, errorCallback, successCallback, wrapper, readOnly));
 }
 
-SQLTransaction::SQLTransaction(Database* db, PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback, PassRefPtr<VoidCallback> successCallback, 
-                               PassRefPtr<SQLTransactionWrapper> wrapper)
-    : m_nextStep(&SQLTransaction::openTransactionAndPreflight)
+SQLTransaction::SQLTransaction(Database* db, PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback, PassRefPtr<VoidCallback> successCallback,
+                               PassRefPtr<SQLTransactionWrapper> wrapper, bool readOnly)
+    : m_nextStep(&SQLTransaction::acquireLock)
     , m_executeSqlAllowed(false)
     , m_database(db)
     , m_wrapper(wrapper)
@@ -76,6 +76,8 @@ SQLTransaction::SQLTransaction(Database* db, PassRefPtr<SQLTransactionCallback>
     , m_errorCallback(errorCallback)
     , m_shouldRetryCurrentStatement(false)
     , m_modifiedDatabase(false)
+    , m_lockAcquired(false)
+    , m_readOnly(readOnly)
 {
     ASSERT(m_database);
 }
@@ -91,11 +93,13 @@ void SQLTransaction::executeSQL(const String& sqlStatement, const Vector<SQLValu
         return;
     }
 
-    bool readOnlyMode = false;
-    Page* page = m_database->document()->page();
-    if (!page || page->settings()->privateBrowsingEnabled())
-        readOnlyMode = true;
-    
+    bool readOnlyMode = m_readOnly;
+    if (!readOnlyMode) {
+        Page* page = m_database->document()->page();
+        if (!page || page->settings()->privateBrowsingEnabled())
+            readOnlyMode = true;
+    }
+
     RefPtr<SQLStatement> statement = SQLStatement::create(sqlStatement, arguments, callback, callbackError, readOnlyMode);
 
     if (m_database->deleted())
@@ -116,7 +120,9 @@ void SQLTransaction::enqueueStatement(PassRefPtr<SQLStatement> statement)
 #ifndef NDEBUG
 const char* SQLTransaction::debugStepName(SQLTransaction::TransactionStepMethod step)
 {
-    if (step == &SQLTransaction::openTransactionAndPreflight)
+    if (step == &SQLTransaction::acquireLock)
+        return "acquireLock";
+    else if (step == &SQLTransaction::openTransactionAndPreflight)
         return "openTransactionAndPreflight";
     else if (step == &SQLTransaction::runStatements)
         return "runStatements";
@@ -145,18 +151,21 @@ void SQLTransaction::checkAndHandleClosedDatabase()
 {
     if (!m_database->stopped())
         return;
-        
+
     // If the database was stopped, don't do anything and cancel queued work
     LOG(StorageAPI, "Database was stopped - cancelling work for this transaction");
     MutexLocker locker(m_statementMutex);
     m_statementQueue.clear();
     m_nextStep = 0;
-    
+
     // The current SQLite transaction should be stopped, as well
     if (m_sqliteTransaction) {
         m_sqliteTransaction->stop();
         m_sqliteTransaction.clear();
     }
+
+    if (m_lockAcquired)
+        m_database->transactionCoordinator()->releaseLock(this);
 }
 
 
@@ -164,14 +173,15 @@ bool SQLTransaction::performNextStep()
 {
     LOG(StorageAPI, "Step %s\n", debugStepName(m_nextStep));
 
-    ASSERT(m_nextStep == &SQLTransaction::openTransactionAndPreflight ||
+    ASSERT(m_nextStep == &SQLTransaction::acquireLock ||
+           m_nextStep == &SQLTransaction::openTransactionAndPreflight ||
            m_nextStep == &SQLTransaction::runStatements ||
            m_nextStep == &SQLTransaction::postflightAndCommit ||
            m_nextStep == &SQLTransaction::cleanupAfterSuccessCallback ||
            m_nextStep == &SQLTransaction::cleanupAfterTransactionErrorCallback);
-    
+
     checkAndHandleClosedDatabase();
-    
+
     if (m_nextStep)
         (this->*m_nextStep)();
 
@@ -190,14 +200,28 @@ void SQLTransaction::performPendingCallback()
            m_nextStep == &SQLTransaction::deliverSuccessCallback);
 
     checkAndHandleClosedDatabase();
-    
+
     if (m_nextStep)
         (this->*m_nextStep)();
 }
 
+void SQLTransaction::acquireLock()
+{
+    m_database->transactionCoordinator()->acquireLock(this, m_readOnly);
+}
+
+void SQLTransaction::lockAcquired()
+{
+    m_lockAcquired = true;
+    m_nextStep = &SQLTransaction::openTransactionAndPreflight;
+    LOG(StorageAPI, "Scheduling openTransactionAndPreflight immediately for transaction %p\n", this);
+    m_database->scheduleTransactionStep(this, true);
+}
+
 void SQLTransaction::openTransactionAndPreflight()
 {
     ASSERT(!m_database->m_sqliteDatabase.transactionInProgress());
+    ASSERT(m_lockAcquired);
 
     LOG(StorageAPI, "Opening and preflighting transaction %p", this);
 
@@ -210,14 +234,14 @@ void SQLTransaction::openTransactionAndPreflight()
 
     // Set the maximum usage for this transaction
     m_database->m_sqliteDatabase.setMaximumSize(m_database->maximumSize());
-    
+
     ASSERT(!m_sqliteTransaction);
     m_sqliteTransaction.set(new SQLiteTransaction(m_database->m_sqliteDatabase));
-    
+
     m_database->m_databaseAuthorizer->disable();
     m_sqliteTransaction->begin();
-    m_database->m_databaseAuthorizer->enable();    
-    
+    m_database->m_databaseAuthorizer->enable();
+
     // Transaction Steps 1+2 - Open a transaction to the database, jumping to the error callback if that fails
     if (!m_sqliteTransaction->inProgress()) {
         ASSERT(!m_database->m_sqliteDatabase.transactionInProgress());
@@ -226,7 +250,7 @@ void SQLTransaction::openTransactionAndPreflight()
         handleTransactionError(false);
         return;
     }
-    
+
     // Transaction Steps 3 - Peform preflight steps, jumping to the error callback if they fail
     if (m_wrapper && !m_wrapper->performPreflight(this)) {
         ASSERT(!m_database->m_sqliteDatabase.transactionInProgress());
@@ -238,7 +262,7 @@ void SQLTransaction::openTransactionAndPreflight()
         handleTransactionError(false);
         return;
     }
-    
+
     // Transaction Step 4 - Invoke the transaction callback with the new SQLTransaction object
     m_nextStep = &SQLTransaction::deliverTransactionCallback;
     LOG(StorageAPI, "Scheduling deliverTransactionCallback for transaction %p\n", this);
@@ -273,6 +297,8 @@ void SQLTransaction::scheduleToRunStatements()
 
 void SQLTransaction::runStatements()
 {
+    ASSERT(m_lockAcquired);
+
     // If there is a series of statements queued up that are all successful and have no associated
     // SQLStatementCallback objects, then we can burn through the queue
     do {
@@ -280,7 +306,7 @@ void SQLTransaction::runStatements()
             m_shouldRetryCurrentStatement = false;
             // FIXME - Another place that needs fixing up after <rdar://problem/5628468> is addressed.
             // See ::openTransactionAndPreflight() for discussion
-            
+
             // Reset the maximum size here, as it was increased to allow us to retry this statement
             m_database->m_sqliteDatabase.setMaximumSize(m_database->maximumSize());
         } else {
@@ -290,14 +316,14 @@ void SQLTransaction::runStatements()
                 handleCurrentStatementError();
                 break;
             }
-            
+
             // Otherwise, advance to the next statement
             getNextStatement();
         }
     } while (runCurrentStatement());
-    
+
     // If runCurrentStatement() returned false, that means either there was no current statement to run,
-    // or the current statement requires a callback to complete.  In the later case, it also scheduled 
+    // or the current statement requires a callback to complete.  In the later case, it also scheduled
     // the callback or performed any other additional work so we can return
     if (!m_currentStatement)
         postflightAndCommit();
@@ -306,7 +332,7 @@ void SQLTransaction::runStatements()
 void SQLTransaction::getNextStatement()
 {
     m_currentStatement = 0;
-    
+
     MutexLocker locker(m_statementMutex);
     if (!m_statementQueue.isEmpty()) {
         m_currentStatement = m_statementQueue.first();
@@ -318,20 +344,17 @@ bool SQLTransaction::runCurrentStatement()
 {
     if (!m_currentStatement)
         return false;
-        
+
     m_database->m_databaseAuthorizer->reset();
-    
+
     if (m_currentStatement->execute(m_database.get())) {
         if (m_database->m_databaseAuthorizer->lastActionChangedDatabase()) {
             // Flag this transaction as having changed the database for later delegate notification
             m_modifiedDatabase = true;
             // Also dirty the size of this database file for calculating quota usage
-            OriginQuotaManager& manager(DatabaseTracker::tracker().originQuotaManager());
-            Locker<OriginQuotaManager> locker(manager);
-            
-            manager.markDatabase(m_database.get());
+            m_database->transactionClient()->didExecuteStatement(this);
         }
-            
+
         if (m_currentStatement->hasStatementCallback()) {
             m_nextStep = &SQLTransaction::deliverStatementCallback;
             LOG(StorageAPI, "Scheduling deliverStatementCallback for transaction %p\n", this);
@@ -340,16 +363,16 @@ bool SQLTransaction::runCurrentStatement()
         }
         return true;
     }
-    
+
     if (m_currentStatement->lastExecutionFailedDueToQuota()) {
         m_nextStep = &SQLTransaction::deliverQuotaIncreaseCallback;
         LOG(StorageAPI, "Scheduling deliverQuotaIncreaseCallback for transaction %p\n", this);
         m_database->scheduleTransactionCallback(this);
         return false;
     }
-    
+
     handleCurrentStatementError();
-    
+
     return false;
 }
 
@@ -372,7 +395,7 @@ void SQLTransaction::handleCurrentStatementError()
 void SQLTransaction::deliverStatementCallback()
 {
     ASSERT(m_currentStatement);
-    
+
     // Transaction Step 6.6 and 6.3(error) - If the statement callback went wrong, jump to the transaction error callback
     // Otherwise, continue to loop through the statement queue
     m_executeSqlAllowed = true;
@@ -390,27 +413,18 @@ void SQLTransaction::deliverQuotaIncreaseCallback()
 {
     ASSERT(m_currentStatement);
     ASSERT(!m_shouldRetryCurrentStatement);
-    
-    Page* page = m_database->document()->page();
-    ASSERT(page);
-    
-    RefPtr<SecurityOrigin> origin = m_database->securityOriginCopy();
-    
-    unsigned long long currentQuota = DatabaseTracker::tracker().quotaForOrigin(origin.get());
-    page->chrome()->client()->exceededDatabaseQuota(m_database->document()->frame(), m_database->stringIdentifier());
-    unsigned long long newQuota = DatabaseTracker::tracker().quotaForOrigin(origin.get());
-    
-    // If the new quota ended up being larger than the old quota, we will retry the statement.
-    if (newQuota > currentQuota)
-        m_shouldRetryCurrentStatement = true;
-        
+
+    m_shouldRetryCurrentStatement = m_database->transactionClient()->didExceedQuota(this);
+
     m_nextStep = &SQLTransaction::runStatements;
     LOG(StorageAPI, "Scheduling runStatements for transaction %p\n", this);
     m_database->scheduleTransactionStep(this);
 }
 
 void SQLTransaction::postflightAndCommit()
-{    
+{
+    ASSERT(m_lockAcquired);
+
     // Transaction Step 7 - Peform postflight steps, jumping to the error callback if they fail
     if (m_wrapper && !m_wrapper->performPostflight(this)) {
         m_transactionError = m_wrapper->sqlError();
@@ -419,10 +433,10 @@ void SQLTransaction::postflightAndCommit()
         handleTransactionError(false);
         return;
     }
-    
+
     // Transacton Step 8+9 - Commit the transaction, jumping to the error callback if that fails
     ASSERT(m_sqliteTransaction);
-    
+
     m_database->m_databaseAuthorizer->disable();
     m_sqliteTransaction->commit();
     m_database->m_databaseAuthorizer->enable();
@@ -433,21 +447,21 @@ void SQLTransaction::postflightAndCommit()
         handleTransactionError(false);
         return;
     }
-    
+
     // The commit was successful, notify the delegates if the transaction modified this database
     if (m_modifiedDatabase)
-        DatabaseTracker::tracker().scheduleNotifyDatabaseChanged(m_database->m_securityOrigin.get(), m_database->m_name);
-    
+        m_database->transactionClient()->didCommitTransaction(this);
+
     // Now release our unneeded callbacks, to break reference cycles.
     m_callback = 0;
     m_errorCallback = 0;
-    
+
     // Transaction Step 10 - Deliver success callback, if there is one
     if (m_successCallback) {
         m_nextStep = &SQLTransaction::deliverSuccessCallback;
         LOG(StorageAPI, "Scheduling deliverSuccessCallback for transaction %p\n", this);
         m_database->scheduleTransactionCallback(this);
-    } else 
+    } else
         cleanupAfterSuccessCallback();
 }
 
@@ -456,7 +470,7 @@ void SQLTransaction::deliverSuccessCallback()
     // Transaction Step 10 - Deliver success callback
     ASSERT(m_successCallback);
     m_successCallback->handleEvent();
-    
+
     // Release the last callback to break reference cycle
     m_successCallback = 0;
 
@@ -469,11 +483,16 @@ void SQLTransaction::deliverSuccessCallback()
 
 void SQLTransaction::cleanupAfterSuccessCallback()
 {
+    ASSERT(m_lockAcquired);
+
     // Transaction Step 11 - End transaction steps
     // There is no next step
     LOG(StorageAPI, "Transaction %p is complete\n", this);
     ASSERT(!m_database->m_sqliteDatabase.transactionInProgress());
     m_nextStep = 0;
+
+    // Release the lock on this database
+    m_database->transactionCoordinator()->releaseLock(this);
 }
 
 void SQLTransaction::handleTransactionError(bool inCallback)
@@ -488,7 +507,7 @@ void SQLTransaction::handleTransactionError(bool inCallback)
         }
         return;
     }
-    
+
     // No error callback, so fast-forward to:
     // Transaction Step 12 - Rollback the transaction.
     if (inCallback) {
@@ -503,7 +522,7 @@ void SQLTransaction::handleTransactionError(bool inCallback)
 void SQLTransaction::deliverTransactionErrorCallback()
 {
     ASSERT(m_transactionError);
-    
+
     // Transaction Step 12 - If exists, invoke error callback with the last
     // error to have occurred in this transaction.
     if (m_errorCallback)
@@ -516,22 +535,24 @@ void SQLTransaction::deliverTransactionErrorCallback()
 
 void SQLTransaction::cleanupAfterTransactionErrorCallback()
 {
+    ASSERT(m_lockAcquired);
+
     m_database->m_databaseAuthorizer->disable();
     if (m_sqliteTransaction) {
         // Transaction Step 12 - Rollback the transaction.
         m_sqliteTransaction->rollback();
-        
+
         ASSERT(!m_database->m_sqliteDatabase.transactionInProgress());
         m_sqliteTransaction.clear();
     }
     m_database->m_databaseAuthorizer->enable();
-    
+
     // Transaction Step 12 - Any still-pending statements in the transaction are discarded.
     {
         MutexLocker locker(m_statementMutex);
         m_statementQueue.clear();
     }
-    
+
     // Transaction is complete!  There is no next step
     LOG(StorageAPI, "Transaction %p is complete with an error\n", this);
     ASSERT(!m_database->m_sqliteDatabase.transactionInProgress());
@@ -540,6 +561,9 @@ void SQLTransaction::cleanupAfterTransactionErrorCallback()
     // Now release our callbacks, to break reference cycles.
     m_callback = 0;
     m_errorCallback = 0;
+
+    // Now release the lock on this database
+    m_database->transactionCoordinator()->releaseLock(this);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLTransaction.h b/src/3rdparty/webkit/WebCore/storage/SQLTransaction.h
index e77c183..0586cc5 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLTransaction.h
+++ b/src/3rdparty/webkit/WebCore/storage/SQLTransaction.h
@@ -60,34 +60,38 @@ public:
     virtual ~SQLTransactionWrapper() { }
     virtual bool performPreflight(SQLTransaction*) = 0;
     virtual bool performPostflight(SQLTransaction*) = 0;
-    
+
     virtual SQLError* sqlError() const = 0;
 };
 
 class SQLTransaction : public ThreadSafeShared<SQLTransaction> {
 public:
-    static PassRefPtr<SQLTransaction> create(Database*, PassRefPtr<SQLTransactionCallback>, PassRefPtr<SQLTransactionErrorCallback>, PassRefPtr<VoidCallback>, PassRefPtr<SQLTransactionWrapper>);
+    static PassRefPtr<SQLTransaction> create(Database*, PassRefPtr<SQLTransactionCallback>, PassRefPtr<SQLTransactionErrorCallback>,
+                                             PassRefPtr<VoidCallback>, PassRefPtr<SQLTransactionWrapper>, bool readOnly = false);
 
     ~SQLTransaction();
-    
-    void executeSQL(const String& sqlStatement, const Vector<SQLValue>& arguments, 
+
+    void executeSQL(const String& sqlStatement, const Vector<SQLValue>& arguments,
                     PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> callbackError, ExceptionCode& e);
-                                        
+
+    void lockAcquired();
     bool performNextStep();
     void performPendingCallback();
-    
+
     Database* database() { return m_database.get(); }
 
 private:
-    SQLTransaction(Database*, PassRefPtr<SQLTransactionCallback>, PassRefPtr<SQLTransactionErrorCallback>, PassRefPtr<VoidCallback>, PassRefPtr<SQLTransactionWrapper>);
+    SQLTransaction(Database*, PassRefPtr<SQLTransactionCallback>, PassRefPtr<SQLTransactionErrorCallback>,
+                   PassRefPtr<VoidCallback>, PassRefPtr<SQLTransactionWrapper>, bool readOnly);
 
     typedef void (SQLTransaction::*TransactionStepMethod)();
     TransactionStepMethod m_nextStep;
-    
+
     void enqueueStatement(PassRefPtr<SQLStatement>);
-    
+
     void checkAndHandleClosedDatabase();
-    
+
+    void acquireLock();
     void openTransactionAndPreflight();
     void deliverTransactionCallback();
     void scheduleToRunStatements();
@@ -109,9 +113,9 @@ private:
 #endif
 
     RefPtr<SQLStatement> m_currentStatement;
-    
+
     bool m_executeSqlAllowed;
-    
+
     RefPtr<Database> m_database;
     RefPtr<SQLTransactionWrapper> m_wrapper;
     RefPtr<SQLTransactionCallback> m_callback;
@@ -120,13 +124,15 @@ private:
     RefPtr<SQLError> m_transactionError;
     bool m_shouldRetryCurrentStatement;
     bool m_modifiedDatabase;
-    
+    bool m_lockAcquired;
+    bool m_readOnly;
+
     Mutex m_statementMutex;
     Deque<RefPtr<SQLStatement> > m_statementQueue;
 
     OwnPtr<SQLiteTransaction> m_sqliteTransaction;
 };
-    
+
 } // namespace WebCore
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLTransactionCallback.h b/src/3rdparty/webkit/WebCore/storage/SQLTransactionCallback.h
index a4cd940..de3e85d 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLTransactionCallback.h
+++ b/src/3rdparty/webkit/WebCore/storage/SQLTransactionCallback.h
@@ -37,7 +37,7 @@ namespace WebCore {
 
 class SQLTransaction;
 class SQLError;
-    
+
 class SQLTransactionCallback : public ThreadSafeShared<SQLTransactionCallback> {
 public:
     virtual ~SQLTransactionCallback() { }
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLTransactionClient.cpp b/src/3rdparty/webkit/WebCore/storage/SQLTransactionClient.cpp
new file mode 100644
index 0000000..e72f5ed
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/storage/SQLTransactionClient.cpp
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SQLTransactionClient.h"
+
+#include "ChromeClient.h"
+#include "Database.h"
+#include "DatabaseThread.h"
+#include "DatabaseTracker.h"
+#include "Document.h"
+#include "OriginQuotaManager.h"
+#include "Page.h"
+#include "SQLTransaction.h"
+
+namespace WebCore {
+
+void SQLTransactionClient::didCommitTransaction(SQLTransaction* transaction)
+{
+    ASSERT(currentThread() == transaction->database()->document()->databaseThread()->getThreadID());
+    Database* database = transaction->database();
+    DatabaseTracker::tracker().scheduleNotifyDatabaseChanged(
+        database->document()->securityOrigin(), database->stringIdentifier());
+}
+
+void SQLTransactionClient::didExecuteStatement(SQLTransaction* transaction)
+{
+    ASSERT(currentThread() == transaction->database()->document()->databaseThread()->getThreadID());
+    OriginQuotaManager& manager(DatabaseTracker::tracker().originQuotaManager());
+    Locker<OriginQuotaManager> locker(manager);
+    manager.markDatabase(transaction->database());
+}
+
+bool SQLTransactionClient::didExceedQuota(SQLTransaction* transaction)
+{
+    ASSERT(isMainThread());
+    Database* database = transaction->database();
+    Page* page = database->document()->page();
+    ASSERT(page);
+
+    RefPtr<SecurityOrigin> origin = database->securityOriginCopy();
+
+    unsigned long long currentQuota = DatabaseTracker::tracker().quotaForOrigin(origin.get());
+    page->chrome()->client()->exceededDatabaseQuota(database->document()->frame(), database->stringIdentifier());
+    unsigned long long newQuota = DatabaseTracker::tracker().quotaForOrigin(origin.get());
+    return (newQuota > currentQuota);
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLTransactionClient.h b/src/3rdparty/webkit/WebCore/storage/SQLTransactionClient.h
new file mode 100644
index 0000000..941c163
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/storage/SQLTransactionClient.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SQLTransactionClient_h
+#define SQLTransactionClient_h
+
+namespace WebCore {
+
+    class SQLTransaction;
+
+    // A client to the SQLTransaction class. Allows SQLTransaction to notify interested
+    // parties that certain things have happened in a transaction.
+    class SQLTransactionClient {
+    public:
+        void didCommitTransaction(SQLTransaction*);
+        void didExecuteStatement(SQLTransaction*);
+        bool didExceedQuota(SQLTransaction*);
+    };
+}
+
+#endif // SQLTransactionClient_h
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLTransactionCoordinator.cpp b/src/3rdparty/webkit/WebCore/storage/SQLTransactionCoordinator.cpp
new file mode 100644
index 0000000..a42734f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/storage/SQLTransactionCoordinator.cpp
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SQLTransactionCoordinator.h"
+
+#include "CString.h"
+#include "Database.h"
+#include "SQLTransaction.h"
+#include <wtf/Deque.h>
+#include <wtf/HashMap.h>
+#include <wtf/RefPtr.h>
+#include <wtf/UnusedParam.h>
+
+namespace WebCore {
+
+static String getDatabaseIdentifier(SQLTransaction* transaction)
+{
+    Database* database = transaction->database();
+    ASSERT(database);
+    return database->stringIdentifier();
+}
+
+void SQLTransactionCoordinator::acquireLock(SQLTransaction* transaction, bool readOnly)
+{
+    UNUSED_PARAM(readOnly);
+
+    String dbIdentifier = getDatabaseIdentifier(transaction);
+
+    TransactionsHashMap::iterator it = m_pendingTransactions.find(dbIdentifier);
+    if (it == m_pendingTransactions.end()) {
+        // No pending transactions for this DB
+        TransactionsQueue pendingTransactions;
+        pendingTransactions.append(transaction);
+        m_pendingTransactions.add(dbIdentifier, pendingTransactions);
+
+        // Start the transaction
+        transaction->lockAcquired();
+    } else {
+        // Another transaction is running on this DB; put this one in the queue
+        TransactionsQueue& pendingTransactions = it->second;
+        pendingTransactions.append(transaction);
+    }
+}
+
+void SQLTransactionCoordinator::releaseLock(SQLTransaction* transaction)
+{
+    if (m_pendingTransactions.isEmpty())
+        return;
+
+    String dbIdentifier = getDatabaseIdentifier(transaction);
+
+    TransactionsHashMap::iterator it = m_pendingTransactions.find(dbIdentifier);
+    ASSERT(it != m_pendingTransactions.end());
+    TransactionsQueue& pendingTransactions = it->second;
+    ASSERT(!pendingTransactions.isEmpty());
+
+    // 'transaction' should always be the first transaction in this queue
+    ASSERT(pendingTransactions.first().get() == transaction);
+
+    // Remove 'transaction' from the queue of pending transactions
+    pendingTransactions.removeFirst();
+    if (pendingTransactions.isEmpty()) {
+        // No more pending transactions; delete dbIdentifier's queue
+        m_pendingTransactions.remove(it);
+    } else {
+        // We have more pending transactions; start the next one
+        pendingTransactions.first()->lockAcquired();
+    }
+}
+
+void SQLTransactionCoordinator::shutdown()
+{
+    // Clean up all pending transactions for all databases
+    m_pendingTransactions.clear();
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLTransactionCoordinator.h b/src/3rdparty/webkit/WebCore/storage/SQLTransactionCoordinator.h
new file mode 100644
index 0000000..08985cf
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/storage/SQLTransactionCoordinator.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SQLTransactionCoordinator_h
+#define SQLTransactionCoordinator_h
+
+#include "CString.h"
+#include "StringHash.h"
+#include <wtf/Deque.h>
+#include <wtf/HashMap.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+    class SQLTransaction;
+
+    class SQLTransactionCoordinator {
+    public:
+        void acquireLock(SQLTransaction*, bool readOnly);
+        void releaseLock(SQLTransaction*);
+        void shutdown();
+    private:
+        typedef Deque<RefPtr<SQLTransaction> > TransactionsQueue;
+        typedef HashMap<String, TransactionsQueue> TransactionsHashMap;
+        TransactionsHashMap m_pendingTransactions;
+    };
+}
+
+#endif // SQLTransactionCoordinator_h
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLTransactionErrorCallback.h b/src/3rdparty/webkit/WebCore/storage/SQLTransactionErrorCallback.h
index 9dd3fd3..de99212 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLTransactionErrorCallback.h
+++ b/src/3rdparty/webkit/WebCore/storage/SQLTransactionErrorCallback.h
@@ -34,19 +34,17 @@
 #include <wtf/Threading.h>
 
 namespace WebCore {
-    
+
     class SQLError;
-    
+
     class SQLTransactionErrorCallback : public ThreadSafeShared<SQLTransactionErrorCallback> {
     public:
         virtual ~SQLTransactionErrorCallback() { }
         virtual void handleEvent(SQLError*) = 0;
     };
-    
+
 }
 
 #endif
 
 #endif // SQLTransactionErrorCallback_h
-
-
diff --git a/src/3rdparty/webkit/WebCore/storage/Storage.cpp b/src/3rdparty/webkit/WebCore/storage/Storage.cpp
index 0166098..0a8eed7 100644
--- a/src/3rdparty/webkit/WebCore/storage/Storage.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/Storage.cpp
@@ -20,9 +20,9 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
- 
+
 #include "config.h"
 #include "Storage.h"
 
@@ -59,13 +59,12 @@ unsigned Storage::length() const
     return m_storageArea->length();
 }
 
-String Storage::key(unsigned index, ExceptionCode& ec) const
+String Storage::key(unsigned index) const
 {
-    ec = 0;
     if (!m_frame)
         return String();
 
-    return m_storageArea->key(index, ec);
+    return m_storageArea->key(index);
 }
 
 String Storage::getItem(const String& key) const
@@ -112,4 +111,3 @@ bool Storage::contains(const String& key) const
 }
 
 #endif // ENABLE(DOM_STORAGE)
-
diff --git a/src/3rdparty/webkit/WebCore/storage/Storage.h b/src/3rdparty/webkit/WebCore/storage/Storage.h
index 77c5720..06cc97b 100644
--- a/src/3rdparty/webkit/WebCore/storage/Storage.h
+++ b/src/3rdparty/webkit/WebCore/storage/Storage.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef Storage_h
@@ -45,7 +45,7 @@ namespace WebCore {
         ~Storage();
 
         unsigned length() const;
-        String key(unsigned index, ExceptionCode&) const;
+        String key(unsigned index) const;
         String getItem(const String&) const;
         void setItem(const String& key, const String& value, ExceptionCode&);
         void removeItem(const String&);
@@ -53,11 +53,12 @@ namespace WebCore {
 
         bool contains(const String& key) const;
 
+        Frame* frame() { return m_frame; }
         void disconnectFrame() { m_frame = 0; }
 
     private:
         Storage(Frame*, PassRefPtr<StorageArea>);
-            
+
         Frame* m_frame;
         RefPtr<StorageArea> m_storageArea;
     };
diff --git a/src/3rdparty/webkit/WebCore/storage/Storage.idl b/src/3rdparty/webkit/WebCore/storage/Storage.idl
index 00c89ec..7127efd 100644
--- a/src/3rdparty/webkit/WebCore/storage/Storage.idl
+++ b/src/3rdparty/webkit/WebCore/storage/Storage.idl
@@ -34,8 +34,7 @@ module storage {
         Conditional=DOM_STORAGE
     ] Storage {
         readonly attribute [DontEnum] unsigned long length;
-        [DontEnum] DOMString key(in unsigned long index) 
-            raises(DOMException);
+        [DontEnum, ConvertNullStringTo=Null] DOMString key(in unsigned long index);
         [DontEnum, ConvertNullStringTo=Null] DOMString getItem(in DOMString key);
         [DontEnum] void setItem(in DOMString key, in DOMString data) 
             raises(DOMException);
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageArea.h b/src/3rdparty/webkit/WebCore/storage/StorageArea.h
index 6ae10c1..e0f7f06 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageArea.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageArea.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef StorageArea_h
@@ -48,7 +48,7 @@ namespace WebCore {
 
         // The HTML5 DOM Storage API
         virtual unsigned length() const = 0;
-        virtual String key(unsigned index, ExceptionCode& ec) const = 0;
+        virtual String key(unsigned index) const = 0;
         virtual String getItem(const String& key) const = 0;
         virtual void setItem(const String& key, const String& value, ExceptionCode& ec, Frame* sourceFrame) = 0;
         virtual void removeItem(const String& key, Frame* sourceFrame) = 0;
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.cpp b/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.cpp
index 9eb59e3..0d69216 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.cpp
@@ -20,9 +20,9 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
- 
+
 #include "config.h"
 #include "StorageAreaImpl.h"
 
@@ -47,7 +47,7 @@ StorageAreaImpl::~StorageAreaImpl()
 {
 }
 
-StorageAreaImpl::StorageAreaImpl(StorageType storageType, SecurityOrigin* origin, PassRefPtr<StorageSyncManager> syncManager)
+StorageAreaImpl::StorageAreaImpl(StorageType storageType, PassRefPtr<SecurityOrigin> origin, PassRefPtr<StorageSyncManager> syncManager)
     : m_storageType(storageType)
     , m_securityOrigin(origin)
     , m_storageMap(StorageMap::create())
@@ -67,15 +67,15 @@ StorageAreaImpl::StorageAreaImpl(StorageType storageType, SecurityOrigin* origin
     }
 }
 
-PassRefPtr<StorageAreaImpl> StorageAreaImpl::copy(SecurityOrigin* origin)
+PassRefPtr<StorageAreaImpl> StorageAreaImpl::copy()
 {
     ASSERT(!m_isShutdown);
-    return adoptRef(new StorageAreaImpl(origin, this));
+    return adoptRef(new StorageAreaImpl(this));
 }
 
-StorageAreaImpl::StorageAreaImpl(SecurityOrigin* origin, StorageAreaImpl* area)
+StorageAreaImpl::StorageAreaImpl(StorageAreaImpl* area)
     : m_storageType(area->m_storageType)
-    , m_securityOrigin(origin)
+    , m_securityOrigin(area->m_securityOrigin)
     , m_storageMap(area->m_storageMap)
     , m_storageSyncManager(area->m_storageSyncManager)
 #ifndef NDEBUG
@@ -87,32 +87,37 @@ StorageAreaImpl::StorageAreaImpl(SecurityOrigin* origin, StorageAreaImpl* area)
     ASSERT(!m_isShutdown);
 }
 
+static bool privateBrowsingEnabled(Frame* frame)
+{
+#if PLATFORM(CHROMIUM)
+    // The frame pointer can be NULL in Chromium since this call is made in a different
+    // process from where the Frame object exists.  Luckily, private browseing is
+    // implemented differently in Chromium, so it'd never return true anyway.
+    ASSERT(!frame);
+    return false;
+#else
+    return frame->page()->settings()->privateBrowsingEnabled();
+#endif
+}
+
 unsigned StorageAreaImpl::length() const
 {
     ASSERT(!m_isShutdown);
     return m_storageMap->length();
 }
 
-String StorageAreaImpl::key(unsigned index, ExceptionCode& ec) const
+String StorageAreaImpl::key(unsigned index) const
 {
     ASSERT(!m_isShutdown);
     blockUntilImportComplete();
-    
-    String key;
-    
-    if (!m_storageMap->key(index, key)) {
-        ec = INDEX_SIZE_ERR;
-        return String();
-    }
-        
-    return key;
+    return m_storageMap->key(index);
 }
 
 String StorageAreaImpl::getItem(const String& key) const
 {
     ASSERT(!m_isShutdown);
     blockUntilImportComplete();
-    
+
     return m_storageMap->getItem(key);
 }
 
@@ -121,8 +126,8 @@ void StorageAreaImpl::setItem(const String& key, const String& value, ExceptionC
     ASSERT(!m_isShutdown);
     ASSERT(!value.isNull());
     blockUntilImportComplete();
-    
-    if (frame->page()->settings()->privateBrowsingEnabled()) {
+
+    if (privateBrowsingEnabled(frame)) {
         ec = QUOTA_EXCEEDED_ERR;
         return;
     }
@@ -133,10 +138,10 @@ void StorageAreaImpl::setItem(const String& key, const String& value, ExceptionC
     //     ec = QUOTA_EXCEEDED_ERR;
     //     return;
     // }
-    
-    String oldValue;   
+
+    String oldValue;
     RefPtr<StorageMap> newMap = m_storageMap->setItem(key, value, oldValue);
-    
+
     if (newMap)
         m_storageMap = newMap.release();
 
@@ -152,8 +157,8 @@ void StorageAreaImpl::removeItem(const String& key, Frame* frame)
 {
     ASSERT(!m_isShutdown);
     blockUntilImportComplete();
-    
-    if (frame->page()->settings()->privateBrowsingEnabled())
+
+    if (privateBrowsingEnabled(frame))
         return;
 
     String oldValue;
@@ -173,12 +178,12 @@ void StorageAreaImpl::clear(Frame* frame)
 {
     ASSERT(!m_isShutdown);
     blockUntilImportComplete();
-    
-    if (frame->page()->settings()->privateBrowsingEnabled())
+
+    if (privateBrowsingEnabled(frame))
         return;
-    
+
     m_storageMap = StorageMap::create();
-    
+
     if (m_storageAreaSync)
         m_storageAreaSync->scheduleClear();
     dispatchStorageEvent(String(), String(), String(), frame);
@@ -188,7 +193,7 @@ bool StorageAreaImpl::contains(const String& key) const
 {
     ASSERT(!m_isShutdown);
     blockUntilImportComplete();
-    
+
     return m_storageMap->contains(key);
 }
 
@@ -221,22 +226,25 @@ void StorageAreaImpl::blockUntilImportComplete() const
 
 void StorageAreaImpl::dispatchStorageEvent(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame)
 {
-    // We need to copy all relevant frames from every page to a vector since sending the event to one frame might mutate the frame tree
-    // of any given page in the group or mutate the page group itself.
-    Vector<RefPtr<Frame> > frames;
+#if PLATFORM(CHROMIUM)
+    // FIXME: Events are currently broken in Chromium.
+    return;
+#endif
 
-    // FIXME: When can this occur?
     Page* page = sourceFrame->page();
     if (!page)
         return;
 
+    // We need to copy all relevant frames from every page to a vector since sending the event to one frame might mutate the frame tree
+    // of any given page in the group or mutate the page group itself.
+    Vector<RefPtr<Frame> > frames;
     if (m_storageType == SessionStorage) {
         // Send events only to our page.
         for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
             if (frame->document()->securityOrigin()->equal(securityOrigin()))
                 frames.append(frame);
         }
-        
+
         for (unsigned i = 0; i < frames.size(); ++i)
             frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->sessionStorage()));
     } else {
@@ -249,13 +257,12 @@ void StorageAreaImpl::dispatchStorageEvent(const String& key, const String& oldV
                     frames.append(frame);
             }
         }
-        
+
         for (unsigned i = 0; i < frames.size(); ++i)
             frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->localStorage()));
-    }        
+    }
 }
 
 }
 
 #endif // ENABLE(DOM_STORAGE)
-
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.h b/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.h
index d3f0785..b98482b 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef StorageAreaImpl_h
@@ -40,19 +40,19 @@ namespace WebCore {
 
     class StorageAreaImpl : public StorageArea {
     public:
-        StorageAreaImpl(StorageType, SecurityOrigin*, PassRefPtr<StorageSyncManager>);
+        StorageAreaImpl(StorageType, PassRefPtr<SecurityOrigin>, PassRefPtr<StorageSyncManager>);
         virtual ~StorageAreaImpl();
 
         // The HTML5 DOM Storage API (and contains)
         virtual unsigned length() const;
-        virtual String key(unsigned index, ExceptionCode& ec) const;
+        virtual String key(unsigned index) const;
         virtual String getItem(const String& key) const;
         virtual void setItem(const String& key, const String& value, ExceptionCode& ec, Frame* sourceFrame);
         virtual void removeItem(const String& key, Frame* sourceFrame);
         virtual void clear(Frame* sourceFrame);
         virtual bool contains(const String& key) const;
 
-        PassRefPtr<StorageAreaImpl> copy(SecurityOrigin*);
+        PassRefPtr<StorageAreaImpl> copy();
         void close();
 
         // Could be called from a background thread.
@@ -60,7 +60,7 @@ namespace WebCore {
         SecurityOrigin* securityOrigin();
 
     private:
-        StorageAreaImpl(SecurityOrigin*, StorageAreaImpl*);
+        StorageAreaImpl(StorageAreaImpl*);
 
         void blockUntilImportComplete() const;
 
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.cpp b/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.cpp
index 01d2a65..2a642b4 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.cpp
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -76,7 +76,7 @@ void StorageAreaSync::scheduleFinalSync()
     ASSERT(isMainThread());
     // FIXME: We do this to avoid races, but it'd be better to make things safe without blocking.
     blockUntilImportComplete();
-    
+
     if (m_syncTimer.isActive())
         m_syncTimer.stop();
     else {
@@ -127,7 +127,7 @@ void StorageAreaSync::syncTimerFired(Timer<StorageAreaSync>*)
 
     HashMap<String, String>::iterator it = m_changedItems.begin();
     HashMap<String, String>::iterator end = m_changedItems.end();
-    
+
     {
         MutexLocker locker(m_syncLock);
 
@@ -182,14 +182,14 @@ void StorageAreaSync::performImport()
         markImported();
         return;
     }
-    
+
     SQLiteStatement query(m_database, "SELECT key, value FROM ItemTable");
     if (query.prepare() != SQLResultOk) {
         LOG_ERROR("Unable to select items from ItemTable for local storage");
         markImported();
         return;
     }
-    
+
     HashMap<String, String> itemMap;
 
     int result = query.step();
@@ -205,13 +205,13 @@ void StorageAreaSync::performImport()
     }
 
     MutexLocker locker(m_importLock);
-    
+
     HashMap<String, String>::iterator it = itemMap.begin();
     HashMap<String, String>::iterator end = itemMap.end();
-    
+
     for (; it != end; ++it)
         m_storageArea->importItem(it->first, it->second);
-    
+
     // Break the (ref count) cycle.
     m_storageArea = 0;
     m_importComplete = true;
@@ -265,7 +265,7 @@ void StorageAreaSync::sync(bool clearItems, const HashMap<String, String>& items
             LOG_ERROR("Failed to prepare clear statement - cannot write to local storage database");
             return;
         }
-        
+
         int result = clear.step();
         if (result != SQLResultDone) {
             LOG_ERROR("Failed to clear all items in the local storage database - %i", result);
@@ -289,11 +289,11 @@ void StorageAreaSync::sync(bool clearItems, const HashMap<String, String>& items
 
     for (HashMap<String, String>::const_iterator it = items.begin(); it != end; ++it) {
         // Based on the null-ness of the second argument, decide whether this is an insert or a delete.
-        SQLiteStatement& query = it->second.isNull() ? remove : insert;        
+        SQLiteStatement& query = it->second.isNull() ? remove : insert;
 
         query.bindText(1, it->first);
 
-        // If the second argument is non-null, we're doing an insert, so bind it as the value. 
+        // If the second argument is non-null, we're doing an insert, so bind it as the value.
         if (!it->second.isNull())
             query.bindText(2, it->second);
 
@@ -335,4 +335,3 @@ void StorageAreaSync::performSync()
 } // namespace WebCore
 
 #endif // ENABLE(DOM_STORAGE)
-
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.h b/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.h
index e436bef..9d6436f 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef StorageAreaSync_h
@@ -39,7 +39,7 @@ namespace WebCore {
     class Frame;
     class StorageAreaImpl;
     class StorageSyncManager;
-    
+
     class StorageAreaSync : public RefCounted<StorageAreaSync> {
     public:
         static PassRefPtr<StorageAreaSync> create(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea);
@@ -50,16 +50,16 @@ namespace WebCore {
 
         void scheduleItemForSync(const String& key, const String& value);
         void scheduleClear();
-        
+
     private:
         StorageAreaSync(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea);
 
         void dispatchStorageEvent(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame);
 
-        Timer<StorageAreaSync> m_syncTimer;        
+        Timer<StorageAreaSync> m_syncTimer;
         HashMap<String, String> m_changedItems;
         bool m_itemsCleared;
-        
+
         bool m_finalSyncScheduled;
 
         RefPtr<StorageAreaImpl> m_storageArea;
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageEvent.cpp b/src/3rdparty/webkit/WebCore/storage/StorageEvent.cpp
index 2e620d5..f3b3b70 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageEvent.cpp
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -76,4 +76,3 @@ void StorageEvent::initStorageEvent(const AtomicString& type, bool canBubble, bo
 } // namespace WebCore
 
 #endif // ENABLE(DOM_STORAGE)
-
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageEvent.h b/src/3rdparty/webkit/WebCore/storage/StorageEvent.h
index 703fb5a..7e2bcff 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageEvent.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageEvent.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef StorageEvent_h
@@ -55,16 +55,16 @@ namespace WebCore {
 
         virtual bool isStorageEvent() const { return true; }
 
-    private:    
+    private:
         StorageEvent();
         StorageEvent(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea);
-        
+
         String m_key;
         String m_oldValue;
         String m_newValue;
         String m_uri;
         RefPtr<DOMWindow> m_source;
-        RefPtr<Storage> m_storageArea;        
+        RefPtr<Storage> m_storageArea;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageMap.cpp b/src/3rdparty/webkit/WebCore/storage/StorageMap.cpp
index 4c350c8..6ddf323 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageMap.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageMap.cpp
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -34,7 +34,7 @@ PassRefPtr<StorageMap> StorageMap::create()
 {
     return adoptRef(new StorageMap);
 }
-    
+
 StorageMap::StorageMap()
     : m_iterator(m_map.end())
     , m_iteratorIndex(UINT_MAX)
@@ -57,19 +57,19 @@ void StorageMap::invalidateIterator()
 void StorageMap::setIteratorToIndex(unsigned index) const
 {
     // FIXME: Once we have bidirectional iterators for HashMap we can be more intelligent about this.
-    // The requested index will be closest to begin(), our current iterator, or end(), and we 
+    // The requested index will be closest to begin(), our current iterator, or end(), and we
     // can take the shortest route.
     // Until that mechanism is available, we'll always increment our iterator from begin() or current.
-    
+
     if (m_iteratorIndex == index)
         return;
-    
+
     if (index < m_iteratorIndex) {
         m_iteratorIndex = 0;
         m_iterator = m_map.begin();
         ASSERT(m_iterator != m_map.end());
     }
-    
+
     while (m_iteratorIndex < index) {
         ++m_iteratorIndex;
         ++m_iterator;
@@ -82,15 +82,13 @@ unsigned StorageMap::length() const
     return m_map.size();
 }
 
-bool StorageMap::key(unsigned index, String& key) const
+String StorageMap::key(unsigned index) const
 {
     if (index >= length())
-        return false;
-    
+        return String();
+
     setIteratorToIndex(index);
-    
-    key = m_iterator->first;
-    return true;
+    return m_iterator->first;
 }
 
 String StorageMap::getItem(const String& key) const
@@ -101,7 +99,7 @@ String StorageMap::getItem(const String& key) const
 PassRefPtr<StorageMap> StorageMap::setItem(const String& key, const String& value, String& oldValue)
 {
     ASSERT(!value.isNull());
-    
+
     // Implement copy-on-write semantics here.  We're guaranteed that the only refs of StorageMaps belong to Storage objects
     // so if more than one Storage object refs this map, copy it before mutating it.
     if (refCount() > 1) {
@@ -160,4 +158,3 @@ void StorageMap::importItem(const String& key, const String& value) const
 }
 
 #endif // ENABLE(DOM_STORAGE)
-
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageMap.h b/src/3rdparty/webkit/WebCore/storage/StorageMap.h
index c6f3bc9..afb90bb 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageMap.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageMap.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef StorageMap_h
@@ -42,7 +42,7 @@ namespace WebCore {
         static PassRefPtr<StorageMap> create();
 
         unsigned length() const;
-        bool key(unsigned index, String& key) const;
+        String key(unsigned index) const;
         String getItem(const String&) const;
         PassRefPtr<StorageMap> setItem(const String& key, const String& value, String& oldValue);
         PassRefPtr<StorageMap> removeItem(const String&, String& oldValue);
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageNamespace.h b/src/3rdparty/webkit/WebCore/storage/StorageNamespace.h
index edbe339..825581f 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageNamespace.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageNamespace.h
@@ -48,6 +48,7 @@ namespace WebCore {
         virtual PassRefPtr<StorageArea> storageArea(SecurityOrigin*) = 0;
         virtual PassRefPtr<StorageNamespace> copy() = 0;
         virtual void close() = 0;
+        virtual void unlock() = 0;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.cpp b/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.cpp
index 8b08a27..5ac22cf 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.cpp
@@ -64,11 +64,9 @@ PassRefPtr<StorageNamespace> StorageNamespaceImpl::sessionStorageNamespace()
 
 StorageNamespaceImpl::StorageNamespaceImpl(StorageType storageType, const String& path)
     : m_storageType(storageType)
-    , m_path(path.copy())  // FIXME: Is the .copy necessary?
+    , m_path(path.copy())  // Copy makes it safe for our other thread to access the path.
     , m_syncManager(0)
-#ifndef NDEBUG
     , m_isShutdown(false)
-#endif
 {
     if (m_storageType == LocalStorage && !m_path.isEmpty())
         m_syncManager = StorageSyncManager::create(m_path);
@@ -82,21 +80,22 @@ StorageNamespaceImpl::~StorageNamespaceImpl()
         ASSERT(localStorageNamespaceMap().get(m_path) == this);
         localStorageNamespaceMap().remove(m_path);
     }
+
+    if (!m_isShutdown)
+        close();
 }
 
 PassRefPtr<StorageNamespace> StorageNamespaceImpl::copy()
 {
     ASSERT(isMainThread());
     ASSERT(!m_isShutdown);
+    ASSERT(m_storageType == SessionStorage);
 
     StorageNamespaceImpl* newNamespace = new StorageNamespaceImpl(m_storageType, m_path);
 
     StorageAreaMap::iterator end = m_storageAreaMap.end();
-    for (StorageAreaMap::iterator i = m_storageAreaMap.begin(); i != end; ++i) {
-        RefPtr<StorageAreaImpl> areaCopy = i->second->copy(i->first.get());
-        newNamespace->m_storageAreaMap.set(i->first, areaCopy.release());
-    }
-
+    for (StorageAreaMap::iterator i = m_storageAreaMap.begin(); i != end; ++i)
+        newNamespace->m_storageAreaMap.set(i->first, i->second->copy());
     return adoptRef(newNamespace);
 }
 
@@ -109,7 +108,7 @@ PassRefPtr<StorageArea> StorageNamespaceImpl::storageArea(SecurityOrigin* origin
     if (storageArea = m_storageAreaMap.get(origin))
         return storageArea.release();
 
-    storageArea = new StorageAreaImpl(m_storageType, origin, m_syncManager);
+    storageArea = adoptRef(new StorageAreaImpl(m_storageType, origin, m_syncManager));
     m_storageAreaMap.set(origin, storageArea);
     return storageArea.release();
 }
@@ -119,13 +118,25 @@ void StorageNamespaceImpl::close()
     ASSERT(isMainThread());
     ASSERT(!m_isShutdown);
 
+    // If we're session storage, we shouldn't need to do any work here.
+    if (m_storageType == SessionStorage) {
+        ASSERT(!m_syncManager);
+        return;
+    }
+
     StorageAreaMap::iterator end = m_storageAreaMap.end();
     for (StorageAreaMap::iterator it = m_storageAreaMap.begin(); it != end; ++it)
         it->second->close();
 
-#ifndef NDEBUG
+    if (m_syncManager)
+        m_syncManager->close();
+
     m_isShutdown = true;
-#endif
+}
+
+void StorageNamespaceImpl::unlock()
+{
+    // Because there's a single event loop per-process, this is a no-op.
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.h b/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.h
index 4ec2f72..d3ef37f 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.h
@@ -49,6 +49,7 @@ namespace WebCore {
         virtual PassRefPtr<StorageArea> storageArea(SecurityOrigin*);
         virtual PassRefPtr<StorageNamespace> copy();
         virtual void close();
+        virtual void unlock();
 
     private:
         StorageNamespaceImpl(StorageType, const String& path);
@@ -62,9 +63,7 @@ namespace WebCore {
         String m_path;
         RefPtr<StorageSyncManager> m_syncManager;
 
-#ifndef NDEBUG
         bool m_isShutdown;
-#endif
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.cpp b/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.cpp
index a935242..961b9b2 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.cpp
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -101,4 +101,3 @@ void StorageSyncManager::scheduleSync(PassRefPtr<StorageAreaSync> area)
 } // namespace WebCore
 
 #endif // ENABLE(DOM_STORAGE)
-
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.h b/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.h
index 4c5e821..b8c817f 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef StorageSyncManager_h
diff --git a/src/3rdparty/webkit/WebCore/svg/ElementTimeControl.h b/src/3rdparty/webkit/WebCore/svg/ElementTimeControl.h
index 4c185b9..4800cb1 100644
--- a/src/3rdparty/webkit/WebCore/svg/ElementTimeControl.h
+++ b/src/3rdparty/webkit/WebCore/svg/ElementTimeControl.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,10 +36,10 @@ namespace WebCore {
     class ElementTimeControl {
     public:
         virtual ~ElementTimeControl() {}
-        virtual bool beginElement(ExceptionCode&) = 0;
-        virtual bool beginElementAt(float offset, ExceptionCode&) = 0;
-        virtual bool endElement(ExceptionCode&) = 0;
-        virtual bool endElementAt(float offset, ExceptionCode&) = 0;
+        virtual void beginElement() = 0;
+        virtual void beginElementAt(float offset) = 0;
+        virtual void endElement() = 0;
+        virtual void endElementAt(float offset) = 0;
     };
         
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/ElementTimeControl.idl b/src/3rdparty/webkit/WebCore/svg/ElementTimeControl.idl
index 569fefa..e8ca615 100644
--- a/src/3rdparty/webkit/WebCore/svg/ElementTimeControl.idl
+++ b/src/3rdparty/webkit/WebCore/svg/ElementTimeControl.idl
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,14 +27,10 @@
 module svg {
 
     interface [Conditional=SVG, ObjCProtocol] ElementTimeControl { 
-        boolean beginElement()
-                      raises(DOMException);
-        boolean beginElementAt(in float offset)
-                      raises(DOMException);
-        boolean endElement()
-                      raises(DOMException);
-        boolean endElementAt(in float offset)
-                      raises(DOMException);
+        void beginElement();
+        void beginElementAt(in float offset);
+        void endElement();
+        void endElementAt(in float offset);
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGAElement.cpp
index 9919702..6bf7f91 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAElement.cpp
@@ -165,20 +165,15 @@ bool SVGAElement::supportsFocus() const
 {
     if (isContentEditable())
         return SVGStyledTransformableElement::supportsFocus();
-    return isFocusable() || (document() && !document()->haveStylesheetsLoaded());
+    return true;
 }
 
 bool SVGAElement::isFocusable() const
 {
-    if (isContentEditable())
-        return SVGStyledTransformableElement::isFocusable();
-    
-    // FIXME: Even if we are not visible, we might have a child that is visible.
-    // Dave wants to fix that some day with a "has visible content" flag or the like.
-    if (!renderer() || !(renderer()->style()->visibility() == VISIBLE))
+    if (renderer() && renderer()->absoluteClippedOverflowRect().isEmpty())
         return false;
     
-    return !renderer()->absoluteClippedOverflowRect().isEmpty();
+    return SVGElement::isFocusable();
 }
 
 bool SVGAElement::isMouseFocusable() const
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAllInOne.cpp b/src/3rdparty/webkit/WebCore/svg/SVGAllInOne.cpp
index 2e34ee3..6ca4539 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAllInOne.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAllInOne.cpp
@@ -41,7 +41,6 @@
 #include "SVGColor.cpp"
 #include "SVGComponentTransferFunctionElement.cpp"
 #include "SVGCursorElement.cpp"
-#include "SVGDefinitionSrcElement.cpp"
 #include "SVGDefsElement.cpp"
 #include "SVGDescElement.cpp"
 #include "SVGDocument.cpp"
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.cpp
index b817ad8..cf945f8 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.cpp
@@ -3,6 +3,7 @@
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
     Copyright (C) 2007 Eric Seidel <eric@webkit.org>
     Copyright (C) 2008 Apple Inc. All rights reserved.
+    Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 
     This file is part of the KDE project
 
@@ -156,29 +157,24 @@ float SVGAnimationElement::getSimpleDuration(ExceptionCode&) const
     return narrowPrecisionToFloat(simpleDuration().value());
 }    
     
-bool SVGAnimationElement::beginElement(ExceptionCode& ec)
+void SVGAnimationElement::beginElement()
 {
-    return beginElementAt(0, ec);
+    beginElementAt(0);
 }
 
-bool SVGAnimationElement::beginElementAt(float offset, ExceptionCode&)
+void SVGAnimationElement::beginElementAt(float offset)
 {
     addBeginTime(elapsed() + offset);
-    return true;
 }
 
-bool SVGAnimationElement::endElement(ExceptionCode& ec)
+void SVGAnimationElement::endElement()
 {
-    return endElementAt(0, ec);
+    endElementAt(0);
 }
 
-bool SVGAnimationElement::endElementAt(float offset, ExceptionCode&)
+void SVGAnimationElement::endElementAt(float offset)
 {
-    if (offset < 0)
-        return false;
-    
     addEndTime(elapsed() + offset);
-    return true;
 }
 
 SVGAnimationElement::AnimationMode SVGAnimationElement::animationMode() const
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.h b/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.h
index d43ed57..1835a8d 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimationElement.h
@@ -3,6 +3,7 @@
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
     Copyright (C) 2007 Eric Seidel <eric@webkit.org>
     Copyright (C) 2008 Apple Inc. All rights reserved.
+    Copyright (C) 2008 Cameron McCormack <cam@mcc.id.au>
 
     This file is part of the KDE project
 
@@ -57,10 +58,10 @@ namespace WebCore {
         float getSimpleDuration(ExceptionCode&) const;
         
         // ElementTimeControl
-        virtual bool beginElement(ExceptionCode&);
-        virtual bool beginElementAt(float offset, ExceptionCode&);
-        virtual bool endElement(ExceptionCode&);
-        virtual bool endElementAt(float offset, ExceptionCode&);
+        virtual void beginElement();
+        virtual void beginElementAt(float offset);
+        virtual void endElement();
+        virtual void endElementAt(float offset);
         
         static bool attributeIsCSS(const String& attributeName);
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGColor.cpp b/src/3rdparty/webkit/WebCore/svg/SVGColor.cpp
index f939ef0..d819ebf 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGColor.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGColor.cpp
@@ -62,9 +62,9 @@ unsigned short SVGColor::colorType() const
     return m_colorType;
 }
 
-RGBColor* SVGColor::rgbColor() const
+PassRefPtr<RGBColor> SVGColor::rgbColor() const
 {
-    return RGBColor::create(m_color.rgb()).releaseRef();
+    return RGBColor::create(m_color.rgb());
 }
 
 void SVGColor::setRGBColor(const String& rgbColor, ExceptionCode& ec)
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGColor.h b/src/3rdparty/webkit/WebCore/svg/SVGColor.h
index 5dfb694..406166b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGColor.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGColor.h
@@ -57,8 +57,8 @@ namespace WebCore {
         // 'SVGColor' functions
         unsigned short colorType() const;
 
-        RGBColor* rgbColor() const;
-        
+        PassRefPtr<RGBColor> rgbColor() const;
+
         static Color colorFromRGBColorString(const String&);
 
         void setRGBColor(const String& rgbColor) { ExceptionCode ignored = 0; setRGBColor(rgbColor, ignored); }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGComponentTransferFunctionElement.h b/src/3rdparty/webkit/WebCore/svg/SVGComponentTransferFunctionElement.h
index 82d57b4..a26c953 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGComponentTransferFunctionElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGComponentTransferFunctionElement.h
@@ -25,6 +25,7 @@
 
 #if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGElement.h"
+#include "SVGNames.h"
 #include "SVGNumberList.h"
 #include "FEComponentTransfer.h"
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGDefinitionSrcElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGDefinitionSrcElement.cpp
deleted file mode 100644
index 1419ec0..0000000
--- a/src/3rdparty/webkit/WebCore/svg/SVGDefinitionSrcElement.cpp
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
-   Copyright (C) 2007 Eric Seidel <eric@webkit.org>
-
-   This library is free software; you can redistribute it and/or
-   modify it under the terms of the GNU Library General Public
-   License as published by the Free Software Foundation; either
-   version 2 of the License, or (at your option) any later version.
-
-   This library is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   Library General Public License for more details.
-
-   You should have received a copy of the GNU Library General Public License
-   along with this library; see the file COPYING.LIB.  If not, write to
-   the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-   Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-
-#if ENABLE(SVG_FONTS)
-#include "SVGDefinitionSrcElement.h"
-
-#include "SVGFontFaceElement.h"
-#include "SVGNames.h"
-
-namespace WebCore {
-    
-SVGDefinitionSrcElement::SVGDefinitionSrcElement(const QualifiedName& tagName, Document* doc)
-    : SVGElement(tagName, doc)
-{
-}
-
-void SVGDefinitionSrcElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
-{
-    SVGElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
-    if (parentNode() && parentNode()->hasTagName(SVGNames::font_faceTag))
-        static_cast<SVGFontFaceElement*>(parentNode())->rebuildFontFace();
-}
-
-}
-
-#endif // ENABLE(SVG_FONTS)
-
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGDefinitionSrcElement.h b/src/3rdparty/webkit/WebCore/svg/SVGDefinitionSrcElement.h
deleted file mode 100644
index aaefd05..0000000
--- a/src/3rdparty/webkit/WebCore/svg/SVGDefinitionSrcElement.h
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
-   Copyright (C) 2007 Eric Seidel <eric@webkit.org>
-
-   This library is free software; you can redistribute it and/or
-   modify it under the terms of the GNU Library General Public
-   License as published by the Free Software Foundation; either
-   version 2 of the License, or (at your option) any later version.
-
-   This library is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   Library General Public License for more details.
-
-   You should have received a copy of the GNU Library General Public License
-   along with this library; see the file COPYING.LIB.  If not, write to
-   the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-   Boston, MA 02110-1301, USA.
- */
-
-#ifndef SVGDefinitionSrcElement_h
-#define SVGDefinitionSrcElement_h
-
-#if ENABLE(SVG_FONTS)
-#include "SVGElement.h"
-
-namespace WebCore {
-    class SVGDefinitionSrcElement : public SVGElement {
-    public:
-        SVGDefinitionSrcElement(const QualifiedName&, Document*);
-    
-        virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
-    };
-
-} // namespace WebCore
-
-#endif // ENABLE(SVG_FONTS)
-#endif
-
-// vim:ts=4:noet
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGDocument.h b/src/3rdparty/webkit/WebCore/svg/SVGDocument.h
index 02e3649..c7006f9 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGDocument.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGDocument.h
@@ -35,13 +35,11 @@ namespace WebCore {
     public:
         static PassRefPtr<SVGDocument> create(Frame* frame)
         {
-            return new SVGDocument(frame);
+            return adoptRef(new SVGDocument(frame));
         }
 
         virtual ~SVGDocument();
         
-        virtual bool isSVGDocument() const { return true; }
-
         SVGSVGElement* rootElement() const;
         
         void dispatchZoomEvent(float prevScale, float newScale);
@@ -52,11 +50,13 @@ namespace WebCore {
         void startPan(const FloatPoint& start);
         void updatePan(const FloatPoint& pos) const;
 
-        virtual bool childShouldCreateRenderer(Node*) const;
-
     private:
         SVGDocument(Frame*);
 
+        virtual bool isSVGDocument() const { return true; }
+
+        virtual bool childShouldCreateRenderer(Node*) const;
+
         FloatPoint m_translate;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGElement.cpp
index a04b095..5c5d609 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGElement.cpp
@@ -51,14 +51,19 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-SVGElement::SVGElement(const QualifiedName& tagName, Document* doc)
-    : StyledElement(tagName, doc)
+SVGElement::SVGElement(const QualifiedName& tagName, Document* document)
+    : StyledElement(tagName, document, CreateElementZeroRefCount)
     , m_shadowParent(0)
     , m_cursorElement(0)
     , m_cursorImageValue(0)
 {
 }
 
+PassRefPtr<SVGElement> SVGElement::create(const QualifiedName& tagName, Document* document)
+{
+    return new SVGElement(tagName, document);
+}
+
 SVGElement::~SVGElement()
 {
     if (m_cursorElement)
@@ -214,7 +219,7 @@ void SVGElement::sendSVGLoadEventIfPossible(bool sendParentLoadEvents)
             event->setTarget(currentTarget);
             currentTarget->dispatchGenericEvent(event.release());
         }
-        currentTarget = (parent && parent->isSVGElement()) ? static_pointer_cast<SVGElement>(parent) : RefPtr<SVGElement>(0);
+        currentTarget = (parent && parent->isSVGElement()) ? static_pointer_cast<SVGElement>(parent) : 0;
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGElement.h b/src/3rdparty/webkit/WebCore/svg/SVGElement.h
index aed7e59..3a17567 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGElement.h
@@ -1,8 +1,7 @@
 /*
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
-
-    This file is part of the KDE project
+    Copyright (C) 2009 Apple Inc. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -26,25 +25,22 @@
 #if ENABLE(SVG)
 #include "StyledElement.h"
 #include "SVGAnimatedProperty.h"
-#include "SVGNames.h"
 
 namespace WebCore {
 
-    class TransformationMatrix;
     class CSSCursorImageValue;
     class Document;
     class SVGCursorElement;
     class SVGDocumentExtensions;
     class SVGElementInstance;
     class SVGSVGElement;
+    class TransformationMatrix;
 
     class SVGElement : public StyledElement {
     public:
-        SVGElement(const QualifiedName&, Document*);
+        static PassRefPtr<SVGElement> create(const QualifiedName&, Document*);
         virtual ~SVGElement();
-        virtual bool isSVGElement() const { return true; }
-        virtual bool isSupported(StringImpl* feature, StringImpl* version) const;
-        
+
         String id() const;
         void setId(const String&, ExceptionCode&);
         String xmlbase() const;
@@ -52,6 +48,7 @@ namespace WebCore {
 
         SVGSVGElement* ownerSVGElement() const;
         SVGElement* viewportElement() const;
+
         SVGDocumentExtensions* accessDocumentSVGExtensions() const;
 
         virtual void parseMappedAttribute(MappedAttribute*);
@@ -64,33 +61,53 @@ namespace WebCore {
         virtual bool isGradientStop() const { return false; }
         virtual bool isTextContent() const { return false; }
 
-        virtual bool isShadowNode() const { return m_shadowParent; }
-        virtual Node* shadowParentNode() { return m_shadowParent; }
         void setShadowParentNode(ContainerNode* node) { m_shadowParent = node; }
-        virtual ContainerNode* eventParentNode();
 
         // For SVGTests
         virtual bool isValid() const { return true; }
-  
-        virtual void finishParsingChildren();
+
         virtual bool rendererIsNeeded(RenderStyle*) { return false; }
         virtual bool childShouldCreateRenderer(Node*) const;
 
-        virtual void insertedIntoDocument();
-        virtual void buildPendingResource() { }
-
         virtual void svgAttributeChanged(const QualifiedName&) { }
-        virtual void attributeChanged(Attribute*, bool preserveDecls = false);
 
         void sendSVGLoadEventIfPossible(bool sendParentLoadEvents = false);
         
         virtual TransformationMatrix* supplementalTransform() { return 0; }
 
-        virtual void updateAnimatedSVGAttribute(const String&) const;
         virtual void setSynchronizedSVGAttributes(bool) const;
 
         HashSet<SVGElementInstance*> instancesForElement() const;
- 
+
+        void addSVGPropertySynchronizer(const QualifiedName& attrName, const SVGAnimatedPropertyBase& base) const
+        {
+            m_svgPropertyMap.set(attrName.localName(), &base);
+        }
+
+        void setCursorElement(SVGCursorElement* cursorElement) { m_cursorElement = cursorElement; }
+        void setCursorImageValue(CSSCursorImageValue* cursorImageValue) { m_cursorImageValue = cursorImageValue; }
+
+    protected:
+        SVGElement(const QualifiedName&, Document*);
+
+        virtual void finishParsingChildren();
+        virtual void insertedIntoDocument();
+        virtual void attributeChanged(Attribute*, bool preserveDecls = false);
+        virtual void updateAnimatedSVGAttribute(const String&) const;
+
+    private:
+        friend class SVGElementInstance;
+
+        virtual bool isSVGElement() const { return true; }
+
+        virtual bool isSupported(StringImpl* feature, StringImpl* version) const;
+        
+        virtual bool isShadowNode() const { return m_shadowParent; }
+        virtual Node* shadowParentNode() { return m_shadowParent; }
+        virtual ContainerNode* eventParentNode();
+
+        virtual void buildPendingResource() { }
+
         // Inlined methods handling SVG property synchronization
         void invokeSVGPropertySynchronizer(const String& name) const
         {
@@ -114,17 +131,6 @@ namespace WebCore {
             }
         }
 
-        void addSVGPropertySynchronizer(const QualifiedName& attrName, const SVGAnimatedPropertyBase& base) const
-        {
-            m_svgPropertyMap.set(attrName.localName(), &base);
-        }
-
-        void setCursorElement(SVGCursorElement* cursorElement) { m_cursorElement = cursorElement; }
-        void setCursorImageValue(CSSCursorImageValue* cursorImageValue) { m_cursorImageValue = cursorImageValue; }
-
-    private:
-        friend class SVGElementInstance;
-
         void mapInstanceToElement(SVGElementInstance*);
         void removeInstanceMapping(SVGElementInstance*);
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.cpp b/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.cpp
index 7cc1798..3a82067 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.cpp
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -25,7 +23,6 @@
 #include "SVGElementInstance.h"
 
 #include "ContainerNodeAlgorithms.h"
-#include "Document.h"
 #include "Event.h"
 #include "EventException.h"
 #include "EventListener.h"
@@ -46,7 +43,7 @@ namespace WebCore {
 static WTF::RefCountedLeakCounter instanceCounter("WebCoreSVGElementInstance");
 #endif
 
-SVGElementInstance::SVGElementInstance(SVGUseElement* useElement, SVGElement* originalElement)
+SVGElementInstance::SVGElementInstance(SVGUseElement* useElement, PassRefPtr<SVGElement> originalElement)
     : m_needsUpdate(false)
     , m_useElement(useElement)
     , m_element(originalElement)
@@ -136,7 +133,7 @@ void SVGElementInstance::setNeedsUpdate(bool value)
 ScriptExecutionContext* SVGElementInstance::scriptExecutionContext() const
 {
     if (SVGElement* element = correspondingElement())
-        return element->scriptExecutionContext();
+        return element->document();
     return 0;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.h b/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.h
index c477718..048c66c 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGElementInstance.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -27,9 +25,6 @@
 #include "SVGElement.h"
 #include "TreeShared.h"
 
-#include <wtf/RefPtr.h>
-#include <wtf/PassRefPtr.h>
-
 namespace WebCore {
 
     namespace Private { 
@@ -37,8 +32,6 @@ namespace WebCore {
         void addChildNodesToDeletionQueue(GenericNode*& head, GenericNode*& tail, GenericNodeContainer* container);
     };
 
-    class EventListener;
-    class Frame;
     class SVGUseElement;
     class SVGElementInstanceList;
 
@@ -46,7 +39,11 @@ namespace WebCore {
     class SVGElementInstance : public TreeShared<SVGElementInstance>,
                                public EventTarget {
     public:
-        SVGElementInstance(SVGUseElement*, SVGElement* originalElement);
+        static PassRefPtr<SVGElementInstance> create(SVGUseElement* useElement, PassRefPtr<SVGElement> originalElement)
+        {
+            return adoptRef(new SVGElementInstance(useElement, originalElement));
+        }
+
         virtual ~SVGElementInstance();
 
         bool needsUpdate() const { return m_needsUpdate; }
@@ -54,9 +51,6 @@ namespace WebCore {
 
         virtual ScriptExecutionContext* scriptExecutionContext() const;
 
-        virtual Node* toNode() { return shadowTreeElement(); }
-        virtual SVGElementInstance* toSVGElementInstance() { return this; }
-
         virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
         virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
         virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
@@ -167,6 +161,11 @@ namespace WebCore {
     private:
         friend class SVGUseElement;
 
+        SVGElementInstance(SVGUseElement*, PassRefPtr<SVGElement> originalElement);
+
+        virtual Node* toNode() { return shadowTreeElement(); }
+        virtual SVGElementInstance* toSVGElementInstance() { return this; }
+
         void appendChild(PassRefPtr<SVGElementInstance> child);
         void setShadowTreeElement(SVGElement*);
         void forgetWrapper();
@@ -191,7 +190,6 @@ namespace WebCore {
         virtual void refEventTarget() { ref(); }
         virtual void derefEventTarget() { deref(); }
 
-    private:
         bool m_needsUpdate : 1;
 
         SVGUseElement* m_useElement;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.h b/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.h
index 0ab6dc9..e491e4b 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGExternalResourcesRequired.h
@@ -25,6 +25,7 @@
 
 #if ENABLE(SVG)
 #include "SVGElement.h"
+#include "SVGNames.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFELightElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFELightElement.h
index a66ccf5..f6e79fb 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFELightElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFELightElement.h
@@ -25,6 +25,7 @@
 #if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGElement.h"
 #include "SVGLightSource.h"
+#include "SVGNames.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.h b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.h
index e2af642..4633f98 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFEMergeNodeElement.h
@@ -25,6 +25,7 @@
 
 #if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGElement.h"
+#include "SVGNames.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h b/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
index fa82f6a..3cdbb37 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
@@ -25,6 +25,7 @@
 
 #if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFilterBuilder.h"
+#include "SVGNames.h"
 #include "SVGResourceFilter.h"
 #include "SVGStyledElement.h"
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFontFaceElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFontFaceElement.cpp
index 1e5a0fe..aa0b6d8 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGFontFaceElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGFontFaceElement.cpp
@@ -37,7 +37,6 @@
 #include "Document.h"
 #include "Font.h"
 #include "MappedAttribute.h"
-#include "SVGDefinitionSrcElement.h"
 #include "SVGFontElement.h"
 #include "SVGFontFaceSrcElement.h"
 #include "SVGGlyphElement.h"
@@ -277,21 +276,12 @@ void SVGFontFaceElement::rebuildFontFace()
 
     // we currently ignore all but the first src element, alternatively we could concat them
     SVGFontFaceSrcElement* srcElement = 0;
-    SVGDefinitionSrcElement* definitionSrc = 0;
 
-    for (Node* child = firstChild(); child; child = child->nextSibling()) {
-        if (child->hasTagName(font_face_srcTag) && !srcElement)
+    for (Node* child = firstChild(); child && !srcElement; child = child->nextSibling()) {
+        if (child->hasTagName(font_face_srcTag))
             srcElement = static_cast<SVGFontFaceSrcElement*>(child);
-        else if (child->hasTagName(definition_srcTag) && !definitionSrc)
-            definitionSrc = static_cast<SVGDefinitionSrcElement*>(child);
     }
 
-#if 0
-    // @font-face (CSSFontFace) does not yet support definition-src, as soon as it does this code should do the trick!
-    if (definitionSrc)
-        m_styleDeclaration->setProperty(CSSPropertyDefinitionSrc, definitionSrc->getAttribute(XLinkNames::hrefAttr), false);
-#endif
-
     bool describesParentFont = parentNode()->hasTagName(fontTag);
     RefPtr<CSSValueList> list;
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGImageElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGImageElement.cpp
index a5684a2..299828f 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGImageElement.cpp
@@ -3,8 +3,6 @@
                   2004, 2005, 2006, 2007, 2008, 2009 Rob Buis <buis@kde.org>
                   2006 Alexander Kellett <lypanov@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -130,7 +128,7 @@ void SVGImageElement::attach()
 {
     SVGStyledTransformableElement::attach();
 
-    if (RenderSVGImage* imageObj = static_cast<RenderSVGImage*>(renderer())) {
+    if (RenderImage* imageObj = toRenderImage(renderer())) {
         if (imageObj->hasImage())
             return;
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.cpp
index 5580993..b09e718 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGMarkerElement.cpp
@@ -170,7 +170,7 @@ SVGResource* SVGMarkerElement::canvasResource()
     if (!m_marker)
         m_marker = SVGResourceMarker::create();
 
-    m_marker->setMarker(static_cast<RenderSVGViewportContainer*>(renderer()));
+    m_marker->setMarker(toRenderSVGViewportContainer(renderer()));
 
     if (orientType() == SVG_MARKER_ORIENT_ANGLE) {
         if (orientAngle())
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.cpp
index 59a5e01..6b75527 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGMaskElement.cpp
@@ -154,7 +154,7 @@ PassOwnPtr<ImageBuffer> SVGMaskElement::drawMaskerContent(const FloatRect& targe
     if (imageSize.height() < static_cast<int>(heightValue))
         heightValue = imageSize.height();
 
-    OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(imageSize, false);
+    OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(imageSize);
     if (!maskImage)
         return 0;
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGNumberList.cpp b/src/3rdparty/webkit/WebCore/svg/SVGNumberList.cpp
index be1e895..4e904f4 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGNumberList.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGNumberList.cpp
@@ -41,6 +41,7 @@ SVGNumberList::~SVGNumberList()
 void SVGNumberList::parse(const String& value)
 {
     ExceptionCode ec = 0;
+    clear(ec);
 
     float number = 0.0f;
    
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGParserUtilities.cpp b/src/3rdparty/webkit/WebCore/svg/SVGParserUtilities.cpp
index 6f696e6..c05e0f8 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGParserUtilities.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGParserUtilities.cpp
@@ -509,8 +509,8 @@ bool SVGPathParser::parseSVG(const String& s, bool process)
             return true;
 
         // Check for remaining coordinates in the current command.
-        if ((*ptr == '+' || *ptr == '-' || (*ptr >= '0' && *ptr <= '9')) &&
-            (command != 'z' && command != 'Z')) {
+        if ((*ptr == '+' || *ptr == '-' || *ptr == '.' || (*ptr >= '0' && *ptr <= '9'))
+            && (command != 'z' && command != 'Z')) {
             if (command == 'M')
                 command = 'L';
             else if (command == 'm')
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.cpp
index cfae425..befca85 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGPatternElement.cpp
@@ -214,7 +214,7 @@ void SVGPatternElement::buildPattern(const FloatRect& targetRect) const
     IntSize imageSize(lroundf(patternBoundariesIncludingOverflow.width()), lroundf(patternBoundariesIncludingOverflow.height()));
     clampImageBufferSizeToViewport(document()->view(), imageSize);
 
-    OwnPtr<ImageBuffer> patternImage = ImageBuffer::create(imageSize, false);
+    OwnPtr<ImageBuffer> patternImage = ImageBuffer::create(imageSize);
 
     if (!patternImage)
         return;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.cpp
index fcecd8c..29e72b8 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.cpp
@@ -307,15 +307,14 @@ void SVGSVGElement::svgAttributeChanged(const QualifiedName& attrName)
         renderer()->setNeedsLayout(true);
 }
 
-unsigned long SVGSVGElement::suspendRedraw(unsigned long /* max_wait_milliseconds */)
+unsigned SVGSVGElement::suspendRedraw(unsigned /* maxWaitMilliseconds */)
 {
     // FIXME: Implement me (see bug 11275)
     return 0;
 }
 
-void SVGSVGElement::unsuspendRedraw(unsigned long /* suspend_handle_id */, ExceptionCode&)
+void SVGSVGElement::unsuspendRedraw(unsigned /* suspendHandleId */)
 {
-    // if suspend_handle_id is not found, throw exception
     // FIXME: Implement me (see bug 11275)
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.h b/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.h
index f92ed72..223ebf6 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.h
@@ -94,8 +94,8 @@ namespace WebCore {
         float getCurrentTime() const;
         void setCurrentTime(float seconds);
 
-        unsigned long suspendRedraw(unsigned long max_wait_milliseconds);
-        void unsuspendRedraw(unsigned long suspend_handle_id, ExceptionCode&);
+        unsigned suspendRedraw(unsigned maxWaitMilliseconds);
+        void unsuspendRedraw(unsigned suspendHandleId);
         void unsuspendRedrawAll();
         void forceRedraw();
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.idl
index 32b4e3c..b188894 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.idl
@@ -56,8 +56,7 @@ module svg {
         readonly attribute SVGPoint currentTranslate;
 
         unsigned long suspendRedraw(in unsigned long maxWaitMilliseconds);
-        void unsuspendRedraw(in unsigned long suspendHandleId)
-            setter raises(DOMException);
+        void unsuspendRedraw(in unsigned long suspendHandleId);
         void unsuspendRedrawAll();
         void forceRedraw();
         void pauseAnimations();
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGStopElement.h b/src/3rdparty/webkit/WebCore/svg/SVGStopElement.h
index bbfd770..5d14a40 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGStopElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGStopElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -24,6 +22,7 @@
 #define SVGStopElement_h
 
 #if ENABLE(SVG)
+#include "SVGNames.h"
 #include "SVGStyledElement.h"
 
 namespace WebCore {
@@ -33,13 +32,13 @@ namespace WebCore {
         SVGStopElement(const QualifiedName&, Document*);
         virtual ~SVGStopElement();
 
+    private:
         virtual bool isGradientStop() const { return true; }
 
         virtual void parseMappedAttribute(MappedAttribute*);
 
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
-    private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGStopElement, SVGNames::stopTagString, SVGNames::offsetAttrString, float, Offset, offset)
     };
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGStyleElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGStyleElement.cpp
index 72f70e6..31f5920 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGStyleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGStyleElement.cpp
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
     Copyright (C) 2006 Apple Computer, Inc.
+    Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 
     This file is part of the KDE project
 
@@ -29,31 +30,21 @@
 #include "CSSStyleSheet.h"
 #include "Document.h"
 #include "ExceptionCode.h"
-#include "HTMLNames.h"
 #include "MappedAttribute.h"
-#include "XMLNames.h"
+#include "SVGNames.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
-using namespace HTMLNames;
+using namespace SVGNames;
 
 SVGStyleElement::SVGStyleElement(const QualifiedName& tagName, Document* doc, bool createdByParser)
      : SVGElement(tagName, doc)
+     , SVGLangSpace()
      , m_createdByParser(createdByParser)
 {
 }
 
-const AtomicString& SVGStyleElement::xmlspace() const
-{
-    return getAttribute(XMLNames::spaceAttr);
-}
-
-void SVGStyleElement::setXmlspace(const AtomicString&, ExceptionCode& ec)
-{
-    ec = NO_MODIFICATION_ALLOWED_ERR;
-}
-
 const AtomicString& SVGStyleElement::type() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, defaultValue, ("text/css"));
@@ -61,9 +52,9 @@ const AtomicString& SVGStyleElement::type() const
     return n.isNull() ? defaultValue : n;
 }
 
-void SVGStyleElement::setType(const AtomicString&, ExceptionCode& ec)
+void SVGStyleElement::setType(const AtomicString& type, ExceptionCode& ec)
 {
-    ec = NO_MODIFICATION_ALLOWED_ERR;
+    setAttribute(typeAttr, type, ec);
 }
 
 const AtomicString& SVGStyleElement::media() const
@@ -73,9 +64,9 @@ const AtomicString& SVGStyleElement::media() const
     return n.isNull() ? defaultValue : n;
 }
 
-void SVGStyleElement::setMedia(const AtomicString&, ExceptionCode& ec)
+void SVGStyleElement::setMedia(const AtomicString& media, ExceptionCode& ec)
 {
-    ec = NO_MODIFICATION_ALLOWED_ERR;
+    setAttribute(mediaAttr, media, ec);
 }
 
 String SVGStyleElement::title() const
@@ -83,17 +74,20 @@ String SVGStyleElement::title() const
     return getAttribute(titleAttr);
 }
 
-void SVGStyleElement::setTitle(const AtomicString&, ExceptionCode& ec)
+void SVGStyleElement::setTitle(const AtomicString& title, ExceptionCode& ec)
 {
-    ec = NO_MODIFICATION_ALLOWED_ERR;
+    setAttribute(titleAttr, title, ec);
 }
 
 void SVGStyleElement::parseMappedAttribute(MappedAttribute* attr)
 {
     if (attr->name() == titleAttr && m_sheet)
         m_sheet->setTitle(attr->value());
-    else
+    else {
+        if (SVGLangSpace::parseMappedAttribute(attr))
+            return;
         SVGElement::parseMappedAttribute(attr);
+    }
 }
 
 void SVGStyleElement::finishParsingChildren()
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGStyleElement.h b/src/3rdparty/webkit/WebCore/svg/SVGStyleElement.h
index 48afdb1..3853fb3 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGStyleElement.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGStyleElement.h
@@ -25,11 +25,14 @@
 #if ENABLE(SVG)
 
 #include <SVGElement.h>
+#include "SVGLangSpace.h"
 #include "StyleElement.h"
 
 namespace WebCore {
 
-    class SVGStyleElement : public SVGElement, public StyleElement {
+    class SVGStyleElement : public SVGElement,
+                            public SVGLangSpace,
+                            public StyleElement {
     public:
         SVGStyleElement(const QualifiedName&, Document*, bool createdByParser);
 
@@ -41,10 +44,6 @@ namespace WebCore {
 
         virtual void finishParsingChildren();
 
-        // 'SVGStyleElement' functions
-        const AtomicString& xmlspace() const;
-        void setXmlspace(const AtomicString&, ExceptionCode&);
-
         virtual bool sheetLoaded();
 
         virtual const AtomicString& type() const;
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGStyleElement.idl b/src/3rdparty/webkit/WebCore/svg/SVGStyleElement.idl
index e87b79f..e47ed1d 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGStyleElement.idl
+++ b/src/3rdparty/webkit/WebCore/svg/SVGStyleElement.idl
@@ -26,9 +26,8 @@
 
 module svg {
 
-    interface [Conditional=SVG] SVGStyleElement : SVGElement {
-                 attribute core::DOMString xmlspace
-                     setter raises(DOMException);
+    interface [Conditional=SVG] SVGStyleElement : SVGElement,
+                                                  SVGLangSpace {
                  attribute core::DOMString type
                      setter raises(DOMException);
                  attribute core::DOMString media
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.cpp
index 067f35f..86009c1 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGTextContentElement.cpp
@@ -328,7 +328,7 @@ static inline SVGRootInlineBox* rootInlineBoxForTextContentElement(const SVGText
     if (!object || !object->isSVGText() || object->isText())
         return 0;
 
-    RenderSVGText* svgText = static_cast<RenderSVGText*>(object);
+    RenderBlock* svgText = toRenderBlock(object);
 
     // Find root inline box
     SVGRootInlineBox* rootBox = static_cast<SVGRootInlineBox*>(svgText->firstRootBox());
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGUseElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGUseElement.cpp
index b73a692..9cb3024 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGUseElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGUseElement.cpp
@@ -324,7 +324,7 @@ void SVGUseElement::buildPendingResource()
     // Spec: If the 'use' element references a simple graphics element such as a 'rect', then there is only a
     // single SVGElementInstance object, and the correspondingElement attribute on this SVGElementInstance object
     // is the SVGRectElement that corresponds to the referenced 'rect' element.
-    m_targetElementInstance = new SVGElementInstance(this, target);
+    m_targetElementInstance = SVGElementInstance::create(this, target);
 
     // Eventually enter recursion to build SVGElementInstance objects for the sub-tree children
     bool foundProblem = false;
@@ -474,17 +474,17 @@ void SVGUseElement::buildInstanceTree(SVGElement* target, SVGElementInstance* ta
             continue;
 
         // Create SVGElementInstance object, for both container/non-container nodes.
-        SVGElementInstance* instancePtr = new SVGElementInstance(this, element);
-        targetInstance->appendChild(instancePtr);
+        RefPtr<SVGElementInstance> instancePtr = SVGElementInstance::create(this, element);
+        targetInstance->appendChild(instancePtr.get());
 
         // Enter recursion, appending new instance tree nodes to the "instance" object.
         if (element->hasChildNodes())
-            buildInstanceTree(element, instancePtr, foundProblem);
+            buildInstanceTree(element, instancePtr.get(), foundProblem);
 
         // Spec: If the referenced object is itself a 'use', or if there are 'use' subelements within the referenced
         // object, the instance tree will contain recursive expansion of the indirect references to form a complete tree.
         if (element->hasTagName(SVGNames::useTag))
-            handleDeepUseReferencing(static_cast<SVGUseElement*>(element), instancePtr, foundProblem);
+            handleDeepUseReferencing(static_cast<SVGUseElement*>(element), instancePtr.get(), foundProblem);
     }
 
     // Spec: If the referenced object is itself a 'use', or if there are 'use' subelements within the referenced
@@ -524,11 +524,11 @@ void SVGUseElement::handleDeepUseReferencing(SVGUseElement* use, SVGElementInsta
     }
 
     // Create an instance object, even if we're dealing with a cycle
-    SVGElementInstance* newInstance = new SVGElementInstance(this, target);
+    RefPtr<SVGElementInstance> newInstance = SVGElementInstance::create(this, target);
     targetInstance->appendChild(newInstance);
 
     // Eventually enter recursion to build SVGElementInstance objects for the sub-tree children
-    buildInstanceTree(target, newInstance, foundProblem);
+    buildInstanceTree(target, newInstance.get(), foundProblem);
 }
 
 void SVGUseElement::alterShadowTreeForSVGTag(SVGElement* target)
diff --git a/src/3rdparty/webkit/WebCore/svg/animation/SVGSMILElement.cpp b/src/3rdparty/webkit/WebCore/svg/animation/SVGSMILElement.cpp
index 63a0d82..982afd5 100644
--- a/src/3rdparty/webkit/WebCore/svg/animation/SVGSMILElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/animation/SVGSMILElement.cpp
@@ -61,6 +61,15 @@ public:
         return adoptRef(new ConditionEventListener(animation, eventBase, condition));
     }
 
+    static const ConditionEventListener* cast(const EventListener* listener)
+    {
+        return listener->type() == ConditionEventListenerType
+            ? static_cast<const ConditionEventListener*>(listener)
+            : 0;
+    }
+
+    virtual bool operator==(const EventListener& other);
+
     void unregister()
     {
         // If this has only one ref then the event base is dead already and we don't need to remove ourself.
@@ -68,25 +77,37 @@ public:
             m_eventBase->removeEventListener(m_condition->m_name, this, false);
     }
 
-    virtual void handleEvent(Event* event, bool) 
-    {
-        m_animation->handleConditionEvent(event, m_condition);
-    }
-
 private:
     ConditionEventListener(SVGSMILElement* animation, Element* eventBase, SVGSMILElement::Condition* condition) 
-        : m_animation(animation)
+        : EventListener(ConditionEventListenerType)
+        , m_animation(animation)
         , m_condition(condition) 
         , m_eventBase(eventBase)
     {
         m_eventBase->addEventListener(m_condition->m_name, this, false);
     }
 
+    virtual void handleEvent(Event*, bool);
+
     SVGSMILElement* m_animation;
     SVGSMILElement::Condition* m_condition;
     Element* m_eventBase;
 };
-    
+
+bool ConditionEventListener::operator==(const EventListener& listener)
+{
+    if (const ConditionEventListener* conditionEventListener = ConditionEventListener::cast(&listener))
+        return m_animation == conditionEventListener->m_animation
+               && m_condition == conditionEventListener->m_condition
+               && m_eventBase == conditionEventListener->m_eventBase;
+    return false;
+}
+
+void ConditionEventListener::handleEvent(Event* event, bool) 
+{
+    m_animation->handleConditionEvent(event, m_condition);
+}
+
 SVGSMILElement::Condition::Condition(Type type, BeginOrEnd beginOrEnd, const String& baseID, const String& name, SMILTime offset, int repeats)
     : m_type(type)
     , m_beginOrEnd(beginOrEnd)
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp
index 4efcf2e..e301c86 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp
@@ -211,7 +211,7 @@ NativeImagePtr SVGImage::nativeImageForCurrentFrame()
     if (!m_frameCache) {
         if (!m_page)
             return 0;
-        m_frameCache = ImageBuffer::create(size(), false);
+        m_frameCache = ImageBuffer::create(size());
         if (!m_frameCache) // failed to allocate image
             return 0;
         renderSubtreeToImage(m_frameCache.get(), m_page->mainFrame()->contentRenderer());
@@ -228,8 +228,16 @@ bool SVGImage::dataChanged(bool allDataReceived)
     if (allDataReceived) {
         static FrameLoaderClient* dummyFrameLoaderClient =  new EmptyFrameLoaderClient;
         static EditorClient* dummyEditorClient = new EmptyEditorClient;
+#if ENABLE(CONTEXT_MENUS)
         static ContextMenuClient* dummyContextMenuClient = new EmptyContextMenuClient;
+#else
+        static ContextMenuClient* dummyContextMenuClient = 0;
+#endif
+#if ENABLE(DRAG_SUPPORT)
         static DragClient* dummyDragClient = new EmptyDragClient;
+#else
+        static DragClient* dummyDragClient = 0;
+#endif
         static InspectorClient* dummyInspectorClient = new EmptyInspectorClient;
 
         m_chromeClient.set(new SVGImageChromeClient(this));
@@ -244,7 +252,7 @@ bool SVGImage::dataChanged(bool allDataReceived)
         RefPtr<Frame> frame = Frame::create(m_page.get(), 0, dummyFrameLoaderClient);
         frame->setView(FrameView::create(frame.get()));
         frame->init();
-        ResourceRequest fakeRequest(KURL(""));
+        ResourceRequest fakeRequest(KURL(ParsedURLString, ""));
         FrameLoader* loader = frame->loader();
         loader->load(fakeRequest, false); // Make sure the DocumentLoader is created
         loader->cancelContentPolicyCheck(); // cancel any policy checks
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerGradient.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerGradient.cpp
index 9ba224e..4a8e9e0 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerGradient.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerGradient.cpp
@@ -137,7 +137,7 @@ static inline bool createMaskAndSwapContextForTextGradient(
     IntSize maskSize(maskRect.width(), maskRect.height());
     clampImageBufferSizeToViewport(object->view()->frameView(), maskSize);
 
-    OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(maskSize, false);
+    OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(maskSize);
 
     if (!maskImage)
         return false;
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerPattern.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerPattern.cpp
index 74ea27a..e825a0b 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerPattern.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGPaintServerPattern.cpp
@@ -118,7 +118,7 @@ bool SVGPaintServerPattern::setup(GraphicsContext*& context, const RenderObject*
         // Draw the first cell of the pattern manually to support overflow="visible" on all platforms.
         int tileWidth = static_cast<int>(patternBoundaries().width() + 0.5f);
         int tileHeight = static_cast<int>(patternBoundaries().height() + 0.5f);
-        OwnPtr<ImageBuffer> tileImage = ImageBuffer::create(IntSize(tileWidth, tileHeight), false);
+        OwnPtr<ImageBuffer> tileImage = ImageBuffer::create(IntSize(tileWidth, tileHeight));
   
         GraphicsContext* tileImageContext = tileImage->context();
 
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.cpp
index 0dd4e0a..4a4bdd5 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceFilter.cpp
@@ -85,7 +85,7 @@ void SVGResourceFilter::prepareFilter(GraphicsContext*& context, const RenderObj
     // Draw the content of the current element and it's childs to a imageBuffer to get the SourceGraphic.
     // The size of the SourceGraphic is clipped to the size of the filterRegion.
     IntRect bufferRect = enclosingIntRect(clippedSourceRect);
-    OwnPtr<ImageBuffer> sourceGraphic(ImageBuffer::create(bufferRect.size(), false));
+    OwnPtr<ImageBuffer> sourceGraphic(ImageBuffer::create(bufferRect.size(), LinearRGB));
     
     if (!sourceGraphic.get())
         return;
@@ -106,6 +106,9 @@ void SVGResourceFilter::applyFilter(GraphicsContext*& context, const RenderObjec
 
     context = m_savedContext;
     m_savedContext = 0;
+#if !PLATFORM(CG)
+    m_sourceGraphicBuffer->transformColorSpace(DeviceRGB, LinearRGB);
+#endif
 
     FilterEffect* lastEffect = m_filterBuilder->lastEffect();
 
@@ -113,8 +116,13 @@ void SVGResourceFilter::applyFilter(GraphicsContext*& context, const RenderObjec
         m_filter->setSourceImage(m_sourceGraphicBuffer.release());
         lastEffect->apply(m_filter.get());
 
-        if (lastEffect->resultImage())
-            context->drawImage(lastEffect->resultImage()->image(), lastEffect->subRegion());
+        ImageBuffer* resultImage = lastEffect->resultImage();
+        if (resultImage) {
+#if !PLATFORM(CG)
+            resultImage->transformColorSpace(LinearRGB, DeviceRGB);
+#endif
+            context->drawImage(resultImage->image(), lastEffect->subRegion());
+        }
     }
 
     m_sourceGraphicBuffer.clear();
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceMasker.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceMasker.cpp
index 3c21350..97467c1 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceMasker.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGResourceMasker.cpp
@@ -72,12 +72,12 @@ void SVGResourceMasker::applyMask(GraphicsContext* context, const FloatRect& bou
     IntRect intImageRect(0, 0, imageSize.width(), imageSize.height());
 
     // Create new ImageBuffer to apply luminance
-    OwnPtr<ImageBuffer> luminancedImage = ImageBuffer::create(imageSize, false);
+    OwnPtr<ImageBuffer> luminancedImage = ImageBuffer::create(imageSize);
     if (!luminancedImage)
         return;
 
-    PassRefPtr<CanvasPixelArray> srcPixelArray(m_mask->getImageData(intImageRect)->data());
-    PassRefPtr<ImageData> destImageData(luminancedImage->getImageData(intImageRect));
+    PassRefPtr<CanvasPixelArray> srcPixelArray(m_mask->getUnmultipliedImageData(intImageRect)->data());
+    PassRefPtr<ImageData> destImageData(luminancedImage->getUnmultipliedImageData(intImageRect));
 
     for (unsigned pixelOffset = 0; pixelOffset < srcPixelArray->length(); pixelOffset++) {
         unsigned pixelByteOffset = pixelOffset * 4;
@@ -93,7 +93,7 @@ void SVGResourceMasker::applyMask(GraphicsContext* context, const FloatRect& bou
         destImageData->data()->set(pixelByteOffset + 3, luma);
     }
 
-    luminancedImage->putImageData(destImageData.get(), intImageRect, IntPoint(0, 0));
+    luminancedImage->putUnmultipliedImageData(destImageData.get(), intImageRect, IntPoint(0, 0));
 
     context->clipToImageBuffer(m_maskRect, luminancedImage.get());
 }
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFETile.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFETile.cpp
index 4d7ddf0..3071501 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFETile.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/filters/SVGFETile.cpp
@@ -65,7 +65,7 @@ void FETile::apply(Filter* filter)
     if (m_in->isSourceInput())
         tileRect = enclosingIntRect(filter->filterRegion());
 
-    OwnPtr<ImageBuffer> tileImage = ImageBuffer::create(tileRect.size(), false);
+    OwnPtr<ImageBuffer> tileImage = ImageBuffer::create(tileRect.size());
     GraphicsContext* tileImageContext = tileImage->context();
     tileImageContext->drawImage(m_in->resultImage()->image(), IntPoint());
     RefPtr<Pattern> pattern = Pattern::create(tileImage->image(), true, true);
diff --git a/src/3rdparty/webkit/WebCore/svg/svgtags.in b/src/3rdparty/webkit/WebCore/svg/svgtags.in
index 6ac430d..471c77b 100644
--- a/src/3rdparty/webkit/WebCore/svg/svgtags.in
+++ b/src/3rdparty/webkit/WebCore/svg/svgtags.in
@@ -3,114 +3,111 @@ namespaceURI="http://www.w3.org/2000/svg"
 guardFactoryWith="ENABLE(SVG)"
 exportStrings
 
-a
+a createWithNew
 #if ENABLE_SVG_FONTS
-altGlyph
+altGlyph createWithNew
 #endif
 #if 0
-altGlyphDef
-altGlyphItem
+altGlyphDef createWithNew
+altGlyphItem createWithNew
 #endif
 #if ENABLE_SVG_ANIMATION
-animate
-animateColor
-animateMotion JSInterfaceName=SVGElement
-animateTransform
-set
+animate createWithNew
+animateColor createWithNew
+animateMotion JSInterfaceName=SVGElement, createWithNew
+animateTransform createWithNew
+set createWithNew
 #endif
-circle
-clipPath
+circle createWithNew
+clipPath createWithNew
 #if 0
-color_profile
+color_profile createWithNew
 #endif
-cursor
-#if ENABLE_SVG_FONTS
-definition_src
-#endif
-defs
-desc
-ellipse
+cursor createWithNew
+defs createWithNew
+desc createWithNew
+ellipse createWithNew
 #if ENABLE_FILTERS
-feBlend
-feColorMatrix
-feComponentTransfer
-feComposite
+feBlend createWithNew
+feColorMatrix createWithNew
+feComponentTransfer createWithNew
+feComposite createWithNew
 #if 0
-feConvolveMatrix
+feConvolveMatrix createWithNew
 #endif
-feDiffuseLighting
-feDisplacementMap
-feDistantLight
-feFlood
-feFuncA
-feFuncB
-feFuncG
-feFuncR
-feGaussianBlur
-feImage
-feMerge
-feMergeNode
+feDiffuseLighting createWithNew
+feDisplacementMap createWithNew
+feDistantLight createWithNew
+feFlood createWithNew
+feFuncA createWithNew
+feFuncB createWithNew
+feFuncG createWithNew
+feFuncR createWithNew
+feGaussianBlur createWithNew
+feImage createWithNew
+feMerge createWithNew
+feMergeNode createWithNew
 #if 0
-feMorphology
+feMorphology createWithNew
 #endif
-feOffset
-fePointLight
-feSpecularLighting
-feSpotLight
-feTile
-feTurbulence
-filter
+feOffset createWithNew
+fePointLight createWithNew
+feSpecularLighting createWithNew
+feSpotLight createWithNew
+feTile createWithNew
+feTurbulence createWithNew
+filter createWithNew
 #endif
 #if ENABLE_SVG_FONTS
-font
-font_face
-font_face_format
-font_face_name
-font_face_src
-font_face_uri
+font createWithNew
+font_face createWithNew
+font_face_format createWithNew
+font_face_name createWithNew
+font_face_src createWithNew
+font_face_uri createWithNew
 #endif
 #if ENABLE_SVG_FOREIGN_OBJECT
-foreignObject
+foreignObject createWithNew
 #endif
-g
+g createWithNew
 #if ENABLE_SVG_FONTS
-glyph
+glyph createWithNew
 #endif
 #if 0
-glyphRef
+glyphRef createWithNew
 #endif
 #if ENABLE_SVG_FONTS
-hkern interfaceName=SVGHKernElement, JSInterfaceName=SVGElement
+hkern interfaceName=SVGHKernElement, JSInterfaceName=SVGElement, createWithNew
 #endif
-image
-line
-linearGradient
-marker
-mask
-metadata
+image createWithNew
+line createWithNew
+linearGradient createWithNew
+marker createWithNew
+mask createWithNew
+metadata createWithNew
 #if ENABLE_SVG_FONTS
-missing_glyph
+missing_glyph createWithNew
 #endif
-mpath interfaceName=SVGMPathElement, JSInterfaceName=SVGElement
-path
-pattern
-polygon
-polyline
-radialGradient
-rect
-script constructorNeedsCreatedByParser
-stop
-style constructorNeedsCreatedByParser
-svg interfaceName=SVGSVGElement
-switch
-symbol
-text
-textPath
-title
-tref interfaceName=SVGTRefElement
-tspan interfaceName=SVGTSpanElement
-use
-view
+mpath interfaceName=SVGMPathElement, JSInterfaceName=SVGElement, createWithNew
+path createWithNew
+pattern createWithNew
+polygon createWithNew
+polyline createWithNew
+radialGradient createWithNew
+rect createWithNew
+script constructorNeedsCreatedByParser, createWithNew
+stop createWithNew
+style constructorNeedsCreatedByParser, createWithNew
+svg interfaceName=SVGSVGElement, createWithNew
+switch createWithNew
+symbol createWithNew
+text createWithNew
+textPath createWithNew
+title createWithNew
+tref interfaceName=SVGTRefElement, createWithNew
+tspan interfaceName=SVGTSpanElement, createWithNew
+use createWithNew
+view createWithNew
 #if 0
-vkern interfaceName=SVGVKernElement
+vkern interfaceName=SVGVKernElement, createWithNew
 #endif
diff --git a/src/3rdparty/webkit/WebCore/websockets/WebSocket.cpp b/src/3rdparty/webkit/WebCore/websockets/WebSocket.cpp
new file mode 100644
index 0000000..8f90b1c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/websockets/WebSocket.cpp
@@ -0,0 +1,292 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "WebSocket.h"
+
+#include "CString.h"
+#include "DOMWindow.h"
+#include "Event.h"
+#include "EventException.h"
+#include "EventListener.h"
+#include "EventNames.h"
+#include "Logging.h"
+#include "MessageEvent.h"
+#include "ScriptExecutionContext.h"
+#include "SecurityOrigin.h"
+#include "WebSocketChannel.h"
+#include <wtf/StdLibExtras.h>
+
+namespace WebCore {
+
+class ProcessWebSocketEventTask : public ScriptExecutionContext::Task {
+public:
+    typedef void (WebSocket::*Method)(Event*);
+    static PassRefPtr<ProcessWebSocketEventTask> create(PassRefPtr<WebSocket> webSocket, Method method, PassRefPtr<Event> event)
+    {
+        return adoptRef(new ProcessWebSocketEventTask(webSocket, method, event));
+    }
+    virtual void performTask(ScriptExecutionContext*)
+    {
+        (m_webSocket.get()->*m_method)(m_event.get());
+    }
+
+  private:
+    ProcessWebSocketEventTask(PassRefPtr<WebSocket> webSocket, Method method, PassRefPtr<Event> event)
+        : m_webSocket(webSocket)
+        , m_method(method)
+        , m_event(event) { }
+
+    RefPtr<WebSocket> m_webSocket;
+    Method m_method;
+    RefPtr<Event> m_event;
+};
+
+static bool isValidProtocolString(const WebCore::String& protocol)
+{
+    if (protocol.isNull())
+        return true;
+    if (protocol.isEmpty())
+        return false;
+    const UChar* characters = protocol.characters();
+    for (size_t i = 0; i < protocol.length(); i++) {
+        if (characters[i] < 0x21 || characters[i] > 0x7E)
+            return false;
+    }
+    return true;
+}
+
+WebSocket::WebSocket(ScriptExecutionContext* context)
+    : ActiveDOMObject(context, this)
+    , m_state(CONNECTING)
+{
+}
+
+WebSocket::~WebSocket()
+{
+    close();
+}
+
+void WebSocket::connect(const KURL& url, ExceptionCode& ec)
+{
+    connect(url, String(), ec);
+}
+
+void WebSocket::connect(const KURL& url, const String& protocol, ExceptionCode& ec)
+{
+    LOG(Network, "WebSocket %p connect to %s protocol=%s", this, url.string().utf8().data(), protocol.utf8().data());
+    m_url = url;
+    m_protocol = protocol;
+
+    if (!m_url.protocolIs("ws") && !m_url.protocolIs("wss")) {
+        LOG_ERROR("Error: wrong url for WebSocket %s", url.string().utf8().data());
+        m_state = CLOSED;
+        ec = SYNTAX_ERR;
+        return;
+    }
+    if (!isValidProtocolString(m_protocol)) {
+        LOG_ERROR("Error: wrong protocol for WebSocket %s", m_protocol.utf8().data());
+        m_state = CLOSED;
+        ec = SYNTAX_ERR;
+        return;
+    }
+    // FIXME: if m_url.port() is blocking port, raise SECURITY_ERR.
+
+    m_channel = WebSocketChannel::create(scriptExecutionContext(), this, m_url, m_protocol);
+    m_channel->connect();
+}
+
+bool WebSocket::send(const String& message, ExceptionCode& ec)
+{
+    LOG(Network, "WebSocket %p send %s", this, message.utf8().data());
+    if (m_state == CONNECTING) {
+        ec = INVALID_STATE_ERR;
+        return false;
+    }
+    // No exception is raised if the connection was once established but has subsequently been closed.
+    if (m_state == CLOSED)
+        return false;
+    // FIXME: check message is valid utf8.
+    return m_channel->send(message);
+}
+
+void WebSocket::close()
+{
+    LOG(Network, "WebSocket %p close", this);
+    if (m_state == CLOSED)
+        return;
+    m_state = CLOSED;
+    m_channel->close();
+}
+
+const KURL& WebSocket::url() const
+{
+    return m_url;
+}
+
+WebSocket::State WebSocket::readyState() const
+{
+    return m_state;
+}
+
+unsigned long WebSocket::bufferedAmount() const
+{
+    if (m_state == OPEN)
+        return m_channel->bufferedAmount();
+    return 0;
+}
+
+ScriptExecutionContext* WebSocket::scriptExecutionContext() const
+{
+    return ActiveDOMObject::scriptExecutionContext();
+}
+
+void WebSocket::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> eventListener, bool)
+{
+    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
+    if (iter == m_eventListeners.end()) {
+        ListenerVector listeners;
+        listeners.append(eventListener);
+        m_eventListeners.add(eventType, listeners);
+    } else {
+        ListenerVector& listeners = iter->second;
+        for (ListenerVector::iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter)
+            if (*listenerIter == eventListener)
+                return;
+
+        listeners.append(eventListener);
+        m_eventListeners.add(eventType, listeners);
+    }
+}
+
+void WebSocket::removeEventListener(const AtomicString& eventType, EventListener* eventListener, bool)
+{
+    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
+    if (iter == m_eventListeners.end())
+        return;
+
+    ListenerVector& listeners = iter->second;
+    for (ListenerVector::const_iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter)
+        if (*listenerIter == eventListener) {
+            listeners.remove(listenerIter - listeners.begin());
+            return;
+        }
+}
+
+bool WebSocket::dispatchEvent(PassRefPtr<Event> evt, ExceptionCode& ec)
+{
+    if (!evt || evt->type().isEmpty()) {
+        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
+        return true;
+    }
+
+    ListenerVector listenersCopy = m_eventListeners.get(evt->type());
+    for (ListenerVector::const_iterator listenerIter = listenersCopy.begin(); listenerIter != listenersCopy.end(); ++listenerIter) {
+        evt->setTarget(this);
+        evt->setCurrentTarget(this);
+        listenerIter->get()->handleEvent(evt.get(), false);
+    }
+    return !evt->defaultPrevented();
+}
+
+void WebSocket::didConnect()
+{
+    LOG(Network, "WebSocket %p didConnect", this);
+    if (m_state != CONNECTING) {
+        didClose();
+        return;
+    }
+    m_state = OPEN;
+    scriptExecutionContext()->postTask(ProcessWebSocketEventTask::create(this, &WebSocket::dispatchOpenEvent, Event::create(eventNames().openEvent, false, false)));
+}
+
+void WebSocket::didReceiveMessage(const String& msg)
+{
+    LOG(Network, "WebSocket %p didReceiveMessage %s", this, msg.utf8().data());
+    if (m_state != OPEN)
+        return;
+    RefPtr<MessageEvent> evt = MessageEvent::create();
+    // FIXME: origin, lastEventId, source, messagePort.
+    evt->initMessageEvent(eventNames().messageEvent, false, false, msg, "", "", 0, 0);
+    scriptExecutionContext()->postTask(ProcessWebSocketEventTask::create(this, &WebSocket::dispatchMessageEvent, evt));
+}
+
+void WebSocket::didClose()
+{
+    LOG(Network, "WebSocket %p didClose", this);
+    m_state = CLOSED;
+    scriptExecutionContext()->postTask(ProcessWebSocketEventTask::create(this, &WebSocket::dispatchCloseEvent, Event::create(eventNames().closeEvent, false, false)));
+}
+
+void WebSocket::dispatchOpenEvent(Event* evt)
+{
+    if (m_onopen) {
+        evt->setTarget(this);
+        evt->setCurrentTarget(this);
+        m_onopen->handleEvent(evt, false);
+    }
+
+    ExceptionCode ec = 0;
+    dispatchEvent(evt, ec);
+    ASSERT(!ec);
+}
+
+void WebSocket::dispatchMessageEvent(Event* evt)
+{
+    if (m_onmessage) {
+        evt->setTarget(this);
+        evt->setCurrentTarget(this);
+        m_onmessage->handleEvent(evt, false);
+    }
+
+    ExceptionCode ec = 0;
+    dispatchEvent(evt, ec);
+    ASSERT(!ec);
+}
+
+void WebSocket::dispatchCloseEvent(Event* evt)
+{
+    if (m_onclose) {
+        evt->setTarget(this);
+        evt->setCurrentTarget(this);
+        m_onclose->handleEvent(evt, false);
+    }
+
+    ExceptionCode ec = 0;
+    dispatchEvent(evt, ec);
+    ASSERT(!ec);
+}
+
+}  // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/websockets/WebSocket.h b/src/3rdparty/webkit/WebCore/websockets/WebSocket.h
new file mode 100644
index 0000000..2be3445
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/websockets/WebSocket.h
@@ -0,0 +1,134 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSocket_h
+#define WebSocket_h
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "ActiveDOMObject.h"
+#include "AtomicStringHash.h"
+#include "EventListener.h"
+#include "EventTarget.h"
+#include "KURL.h"
+#include "WebSocketChannelClient.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+    class String;
+    class WebSocketChannel;
+
+    class WebSocket : public RefCounted<WebSocket>, public EventTarget, public ActiveDOMObject, public WebSocketChannelClient {
+    public:
+        static PassRefPtr<WebSocket> create(ScriptExecutionContext* context) { return adoptRef(new WebSocket(context)); }
+        virtual ~WebSocket();
+
+        enum State {
+            CONNECTING = 0,
+            OPEN = 1,
+            CLOSED = 2
+        };
+
+        void connect(const KURL&, ExceptionCode&);
+        void connect(const KURL&, const String& protocol, ExceptionCode&);
+
+        bool send(const String& message, ExceptionCode&);
+
+        void close();
+
+        const KURL& url() const;
+        State readyState() const;
+        unsigned long bufferedAmount() const;
+
+        void setOnopen(PassRefPtr<EventListener> eventListener) { m_onopen = eventListener; }
+        EventListener* onopen() const { return m_onopen.get(); }
+        void setOnmessage(PassRefPtr<EventListener> eventListener) { m_onmessage = eventListener; }
+        EventListener* onmessage() const { return m_onmessage.get(); }
+        void setOnclose(PassRefPtr<EventListener> eventListener) { m_onclose = eventListener; }
+        EventListener* onclose() const { return m_onclose.get(); }
+
+        // EventTarget
+        virtual WebSocket* toWebSocket() { return this; }
+
+        virtual ScriptExecutionContext* scriptExecutionContext() const;
+
+        typedef Vector<RefPtr<EventListener> > ListenerVector;
+        typedef HashMap<AtomicString, ListenerVector> EventListenersMap;
+
+        virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
+        virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
+        virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
+        EventListenersMap& eventListeners() { return m_eventListeners; }
+
+        // ActiveDOMObject
+        //  virtual bool hasPendingActivity() const;
+        // virtual void contextDestroyed();
+        // virtual bool canSuspend() const;
+        // virtual void suspend();
+        // virtual void resume();
+        // virtual void stop();
+
+        using RefCounted<WebSocket>::ref;
+        using RefCounted<WebSocket>::deref;
+
+        // WebSocketChannelClient
+        virtual void didConnect();
+        virtual void didReceiveMessage(const String& msg);
+        virtual void didClose();
+
+    private:
+        WebSocket(ScriptExecutionContext*);
+
+        virtual void refEventTarget() { ref(); }
+        virtual void derefEventTarget() { deref(); }
+
+        void dispatchOpenEvent(Event*);
+        void dispatchMessageEvent(Event*);
+        void dispatchCloseEvent(Event*);
+
+        RefPtr<WebSocketChannel> m_channel;
+
+        RefPtr<EventListener> m_onopen;
+        RefPtr<EventListener> m_onmessage;
+        RefPtr<EventListener> m_onclose;
+        EventListenersMap m_eventListeners;
+
+        State m_state;
+        KURL m_url;
+        String m_protocol;
+    };
+
+}  // namespace WebCore
+
+#endif  // ENABLE(WEB_SOCKETS)
+
+#endif  // WebSocket_h
diff --git a/src/3rdparty/webkit/WebCore/websockets/WebSocket.idl b/src/3rdparty/webkit/WebCore/websockets/WebSocket.idl
new file mode 100644
index 0000000..cdb916f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/websockets/WebSocket.idl
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module websockets {
+
+    interface [
+        CustomMarkFunction,
+        NoStaticTables,
+        Conditional=WEB_SOCKETS
+    ] WebSocket {
+        readonly attribute DOMString URL;
+
+        // ready state
+        const unsigned short CONNECTING = 0;
+        const unsigned short OPEN = 1;
+        const unsigned short CLOSED = 2;
+        readonly attribute unsigned short readyState;
+
+        readonly attribute unsigned long bufferedAmount;
+
+        // networking
+        attribute EventListener onopen;
+        attribute EventListener onmessage;
+        attribute EventListener onclose;
+
+        [Custom] boolean send(in DOMString data)
+          raises(DOMException);
+        void close();
+
+        // EventTarget interface
+        // [Custom] void addEventListener(in DOMString type,
+        //   in EventListener listener,
+        //   in boolean useCapture);
+        // [Custom] void removeEventListener(in DOMString type,
+        //   in EventListener listener,
+        //   in boolean useCapture);
+        // boolean dispatchEvent(in Event evt)
+        //   raises(EventException);
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/websockets/WebSocketChannel.cpp b/src/3rdparty/webkit/WebCore/websockets/WebSocketChannel.cpp
new file mode 100644
index 0000000..145cd34
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/websockets/WebSocketChannel.cpp
@@ -0,0 +1,246 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "WebSocketChannel.h"
+
+#include "CString.h"
+#include "CookieJar.h"
+#include "Document.h"
+#include "Logging.h"
+#include "PlatformString.h"
+#include "ScriptExecutionContext.h"
+#include "SocketStreamError.h"
+#include "SocketStreamHandle.h"
+#include "StringHash.h"
+#include "WebSocketChannelClient.h"
+
+#include <wtf/Deque.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/HashMap.h>
+
+namespace WebCore {
+
+WebSocketChannel::WebSocketChannel(ScriptExecutionContext* context, WebSocketChannelClient* client, const KURL& url, const String& protocol)
+    : m_context(context)
+    , m_client(client)
+    , m_handshake(url, protocol, context)
+    , m_buffer(0)
+    , m_bufferSize(0)
+    , m_unhandledBufferSize(0)
+{
+}
+
+WebSocketChannel::~WebSocketChannel()
+{
+    fastFree(m_buffer);
+}
+
+void WebSocketChannel::connect()
+{
+    LOG(Network, "WebSocketChannel %p connect", this);
+    ASSERT(!m_handle.get());
+    m_handshake.reset();
+    m_handle = SocketStreamHandle::create(m_handshake.url(), this);
+}
+
+bool WebSocketChannel::send(const String& msg)
+{
+    LOG(Network, "WebSocketChannel %p send %s", this, msg.utf8().data());
+    Vector<char> buf;
+    buf.append('\0');  // frame type
+    buf.append(msg.utf8().data(), msg.utf8().length());
+    buf.append('\xff');  // frame end
+    if (!m_handle.get()) {
+        m_unhandledBufferSize += buf.size();
+        return false;
+    }
+    return m_handle->send(buf.data(), buf.size());
+}
+
+unsigned long WebSocketChannel::bufferedAmount() const
+{
+    LOG(Network, "WebSocketChannel %p bufferedAmount", this);
+    if (!m_handle.get())
+        return m_unhandledBufferSize;
+    return m_handle->bufferedAmount();
+}
+
+void WebSocketChannel::close()
+{
+    LOG(Network, "WebSocketChannel %p close", this);
+    if (m_handle.get())
+        m_handle->close();  // will call didClose()
+}
+
+void WebSocketChannel::willOpenStream(SocketStreamHandle*, const KURL&)
+{
+}
+
+void WebSocketChannel::willSendData(SocketStreamHandle*, const char*, int)
+{
+}
+
+void WebSocketChannel::didOpen(SocketStreamHandle* handle)
+{
+    LOG(Network, "WebSocketChannel %p didOpen", this);
+    ASSERT(handle == m_handle.get());
+    const CString& handshakeMessage = m_handshake.clientHandshakeMessage();
+    if (!handle->send(handshakeMessage.data(), handshakeMessage.length())) {
+        LOG(Network, "Error in sending handshake message.");
+        handle->close();
+    }
+}
+
+void WebSocketChannel::didClose(SocketStreamHandle* handle)
+{
+    LOG(Network, "WebSocketChannel %p didClose", this);
+    ASSERT(handle == m_handle.get() || !m_handle.get());
+    if (!m_handle.get())
+        return;
+    m_unhandledBufferSize = handle->bufferedAmount();
+    WebSocketChannelClient* client = m_client;
+    m_client = 0;
+    m_handle = 0;
+    client->didClose();
+}
+
+void WebSocketChannel::didReceiveData(SocketStreamHandle* handle, const char* data, int len)
+{
+    LOG(Network, "WebSocketChannel %p didReceiveData %d", this, len);
+    ASSERT(handle == m_handle.get());
+    if (!appendToBuffer(data, len)) {
+        handle->close();
+        return;
+    }
+    if (m_handshake.mode() != WebSocketHandshake::Connected) {
+        int headerLength = m_handshake.readServerHandshake(m_buffer, m_bufferSize);
+        if (headerLength <= 0)
+            return;
+        switch (m_handshake.mode()) {
+        case WebSocketHandshake::Connected:
+            if (!m_handshake.serverSetCookie().isEmpty()) {
+                if (m_context->isDocument()) {
+                    Document* document = static_cast<Document*>(m_context);
+                    if (cookiesEnabled(document))
+                        document->setCookie(m_handshake.serverSetCookie());
+                }
+            }
+            // FIXME: handle set-cookie2.
+            LOG(Network, "WebSocketChannel %p connected", this);
+            m_client->didConnect();
+            break;
+        default:
+            LOG(Network, "WebSocketChannel %p connection failed", this);
+            handle->close();
+            return;
+        }
+        skipBuffer(headerLength);
+        if (!m_buffer)
+            return;
+        LOG(Network, "remaining in read buf %ul", m_bufferSize);
+    }
+
+    const char* nextFrame = m_buffer;
+    const char* p = m_buffer;
+    const char* end = p + m_bufferSize;
+    while (p < end) {
+        unsigned char frameByte = static_cast<unsigned char>(*p++);
+        if ((frameByte & 0x80) == 0x80) {
+            int length = 0;
+            while (p < end && (*p & 0x80) == 0x80) {
+                if (length > std::numeric_limits<int>::max() / 128) {
+                    LOG(Network, "frame length overflow %d", length);
+                    handle->close();
+                    return;
+                }
+                length = length * 128 + *p & 0x7f;
+                ++p;
+            }
+            if (p + length < end) {
+                p += length;
+                nextFrame = p;
+            }
+        } else {
+            const char* msgStart = p;
+            while (p < end && *p != '\xff')
+                ++p;
+            if (p < end && *p == '\xff') {
+                if (frameByte == 0x00)
+                    m_client->didReceiveMessage(String::fromUTF8(msgStart, p - msgStart));
+                ++p;
+                nextFrame = p;
+            }
+        }
+    }
+    skipBuffer(nextFrame - m_buffer);
+}
+
+void WebSocketChannel::didFail(SocketStreamHandle* handle, const SocketStreamError&)
+{
+    LOG(Network, "WebSocketChannel %p didFail", this);
+    ASSERT(handle == m_handle.get() || !m_handle.get());
+    handle->close();
+}
+
+bool WebSocketChannel::appendToBuffer(const char* data, int len)
+{
+    char* newBuffer = 0;
+    if (tryFastMalloc(m_bufferSize + len).getValue(newBuffer)) {
+        if (m_buffer)
+            memcpy(newBuffer, m_buffer, m_bufferSize);
+        memcpy(newBuffer + m_bufferSize, data, len);
+        fastFree(m_buffer);
+        m_buffer = newBuffer;
+        m_bufferSize += len;
+        return true;
+    }
+    LOG(Network, "Too long WebSocket frame %d", m_bufferSize + len);
+    return false;
+}
+
+void WebSocketChannel::skipBuffer(int len)
+{
+    ASSERT(len <= m_bufferSize);
+    m_bufferSize -= len;
+    if (!m_bufferSize) {
+        fastFree(m_buffer);
+        m_buffer = 0;
+        return;
+    }
+    memmove(m_buffer, m_buffer + len, m_bufferSize);
+}
+
+}  // namespace WebCore
+
+#endif  // ENABLE(WEB_SOCKETS)
diff --git a/src/3rdparty/webkit/WebCore/websockets/WebSocketChannel.h b/src/3rdparty/webkit/WebCore/websockets/WebSocketChannel.h
new file mode 100644
index 0000000..75f41f6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/websockets/WebSocketChannel.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSocketChannel_h
+#define WebSocketChannel_h
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "SocketStreamHandleClient.h"
+#include "WebSocketHandshake.h"
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+    class ScriptExecutionContext;
+    class String;
+    class SocketStreamHandle;
+    class SocketStreamError;
+    class WebSocketChannelClient;
+
+    class WebSocketChannel : public RefCounted<WebSocketChannel>, public SocketStreamHandleClient {
+    public:
+        static PassRefPtr<WebSocketChannel> create(ScriptExecutionContext* context, WebSocketChannelClient* client, const KURL& url, const String& protocol) { return new WebSocketChannel(context, client, url, protocol); }
+        virtual ~WebSocketChannel();
+
+        virtual void connect();
+
+        virtual bool send(const String& msg);
+        virtual unsigned long bufferedAmount() const;
+
+        virtual void close();
+
+        virtual void willOpenStream(SocketStreamHandle*, const KURL&);
+        virtual void willSendData(SocketStreamHandle*, const char*, int);
+        virtual void didOpen(SocketStreamHandle*);
+        virtual void didClose(SocketStreamHandle*);
+        virtual void didReceiveData(SocketStreamHandle*, const char*, int);
+        virtual void didFail(SocketStreamHandle*, const SocketStreamError&);
+
+    private:
+        WebSocketChannel(ScriptExecutionContext*, WebSocketChannelClient*, const KURL&, const String&);
+
+        bool appendToBuffer(const char* data, int len);
+        void skipBuffer(int len);
+
+        ScriptExecutionContext* m_context;
+        WebSocketChannelClient* m_client;
+        WebSocketHandshake m_handshake;
+        RefPtr<SocketStreamHandle> m_handle;
+        char* m_buffer;
+        int m_bufferSize;
+        unsigned long m_unhandledBufferSize;
+    };
+
+}  // namespace WebCore
+
+#endif  // ENABLE(WEB_SOCKETS)
+
+#endif  // WebSocketChannel_h
diff --git a/src/3rdparty/webkit/WebCore/websockets/WebSocketChannelClient.h b/src/3rdparty/webkit/WebCore/websockets/WebSocketChannelClient.h
new file mode 100644
index 0000000..463cada
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/websockets/WebSocketChannelClient.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSocketChannelClient_h
+#define WebSocketChannelClient_h
+
+#if ENABLE(WEB_SOCKETS)
+
+namespace WebCore {
+
+    class WebSocketChannelClient {
+    public:
+        virtual ~WebSocketChannelClient() { }
+        virtual void didConnect() { }
+        virtual void didReceiveMessage(const String&) { }
+        virtual void didClose() { }
+
+    protected:
+        WebSocketChannelClient() { }
+    };
+
+}  // namespace WebCore
+
+#endif  // ENABLE(WEB_SOCKETS)
+
+#endif  // WebSocketChannelClient_h
diff --git a/src/3rdparty/webkit/WebCore/websockets/WebSocketHandshake.cpp b/src/3rdparty/webkit/WebCore/websockets/WebSocketHandshake.cpp
new file mode 100644
index 0000000..691fa1c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/websockets/WebSocketHandshake.cpp
@@ -0,0 +1,462 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "WebSocketHandshake.h"
+
+#include "AtomicString.h"
+#include "CString.h"
+#include "CookieJar.h"
+#include "Document.h"
+#include "HTTPHeaderMap.h"
+#include "KURL.h"
+#include "Logging.h"
+#include "ScriptExecutionContext.h"
+#include "SecurityOrigin.h"
+#include "StringBuilder.h"
+#include <wtf/StringExtras.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+const char webSocketServerHandshakeHeader[] = "HTTP/1.1 101 Web Socket Protocol Handshake\r\n";
+const char webSocketUpgradeHeader[] = "Upgrade: WebSocket\r\n";
+const char webSocketConnectionHeader[] = "Connection: Upgrade\r\n";
+
+static String extractResponseCode(const char* header, int len)
+{
+    const char* space1 = 0;
+    const char* space2 = 0;
+    const char* p;
+    for (p = header; p - header < len; p++) {
+        if (*p == ' ') {
+            if (!space1)
+                space1 = p;
+            else if (!space2)
+                space2 = p;
+        } else if (*p == '\n')
+            break;
+    }
+    if (p - header == len)
+        return String();
+    if (!space1 || !space2)
+        return "";
+    return String(space1 + 1, space2 - space1 - 1);
+}
+
+WebSocketHandshake::WebSocketHandshake(const KURL& url, const String& protocol, ScriptExecutionContext* context)
+    : m_url(url)
+    , m_clientProtocol(protocol)
+    , m_secure(m_url.protocolIs("wss"))
+    , m_context(context)
+    , m_mode(Incomplete)
+{
+}
+
+WebSocketHandshake::~WebSocketHandshake()
+{
+}
+
+const KURL& WebSocketHandshake::url() const
+{
+    return m_url;
+}
+
+void WebSocketHandshake::setURL(const KURL& url)
+{
+    m_url = url.copy();
+}
+
+const String WebSocketHandshake::host() const
+{
+    return m_url.host().lower();
+}
+
+const String& WebSocketHandshake::clientProtocol() const
+{
+    return m_clientProtocol;
+}
+
+void WebSocketHandshake::setClientProtocol(const String& protocol)
+{
+    m_clientProtocol = protocol;
+}
+
+bool WebSocketHandshake::secure() const
+{
+    return m_secure;
+}
+
+void WebSocketHandshake::setSecure(bool secure)
+{
+    m_secure = secure;
+}
+
+String WebSocketHandshake::clientOrigin() const
+{
+    return m_context->securityOrigin()->toString();
+}
+
+String WebSocketHandshake::clientLocation() const
+{
+    StringBuilder builder;
+    builder.append(m_secure ? "wss" : "ws");
+    builder.append("://");
+    builder.append(m_url.host().lower());
+    if (m_url.port()) {
+        if ((!m_secure && m_url.port() != 80) || (m_secure && m_url.port() != 443)) {
+            builder.append(":");
+            builder.append(String::number(m_url.port()));
+        }
+    }
+    builder.append(m_url.path());
+    return builder.toString();
+}
+
+CString WebSocketHandshake::clientHandshakeMessage() const
+{
+    StringBuilder builder;
+
+    builder.append("GET ");
+    builder.append(m_url.path());
+    if (!m_url.query().isEmpty()) {
+        builder.append("?");
+        builder.append(m_url.query());
+    }
+    builder.append(" HTTP/1.1\r\n");
+    builder.append("Upgrade: WebSocket\r\n");
+    builder.append("Connection: Upgrade\r\n");
+    builder.append("Host: ");
+    builder.append(m_url.host().lower());
+    if (m_url.port()) {
+        if ((!m_secure && m_url.port() != 80) || (m_secure && m_url.port() != 443)) {
+            builder.append(":");
+            builder.append(String::number(m_url.port()));
+        }
+    }
+    builder.append("\r\n");
+    builder.append("Origin: ");
+    builder.append(clientOrigin());
+    builder.append("\r\n");
+    if (!m_clientProtocol.isEmpty()) {
+        builder.append("WebSocket-Protocol: ");
+        builder.append(m_clientProtocol);
+        builder.append("\r\n");
+    }
+    KURL url = httpURLForAuthenticationAndCookies();
+    // FIXME: set authentication information or cookies for url.
+    // Set "Authorization: <credentials>" if authentication information exists for url.
+    if (m_context->isDocument()) {
+        Document* document = static_cast<Document*>(m_context);
+        String cookie = cookies(document, url);
+        if (!cookie.isEmpty()) {
+            builder.append("Cookie: ");
+            builder.append(cookie);
+            builder.append("\r\n");
+        }
+        // Set "Cookie2: <cookie>" if cookies 2 exists for url?
+    }
+    builder.append("\r\n");
+    return builder.toString().utf8();
+}
+
+void WebSocketHandshake::reset()
+{
+    m_mode = Incomplete;
+
+    m_wsOrigin = String();
+    m_wsLocation = String();
+    m_wsProtocol = String();
+    m_setCookie = String();
+    m_setCookie2 = String();
+}
+
+int WebSocketHandshake::readServerHandshake(const char* header, size_t len)
+{
+    m_mode = Incomplete;
+    if (len < sizeof(webSocketServerHandshakeHeader) - 1) {
+        // Just hasn't been received fully yet.
+        return -1;
+    }
+    if (!memcmp(header, webSocketServerHandshakeHeader, sizeof(webSocketServerHandshakeHeader) - 1))
+        m_mode = Normal;
+    else {
+        const String& code = extractResponseCode(header, len);
+        if (code.isNull()) {
+            LOG(Network, "short server handshake: %s", header);
+            return -1;
+        }
+        if (code.isEmpty()) {
+            LOG(Network, "no response code found: %s", header);
+            return len;
+        }
+        LOG(Network, "response code: %s", code.utf8().data());
+        if (code == "401") {
+            LOG(Network, "Authentication required");
+            return len;
+        } else {
+            LOG(Network, "Mismatch server handshake: %s", header);
+            return len;
+        }
+    }
+    const char* p = header + sizeof(webSocketServerHandshakeHeader) - 1;
+    const char* end = header + len + 1;
+
+    if (m_mode == Normal) {
+        size_t headerSize = end - p;
+        if (headerSize < sizeof(webSocketUpgradeHeader) - 1)
+            return 0;
+        if (memcmp(p, webSocketUpgradeHeader, sizeof(webSocketUpgradeHeader) - 1)) {
+            LOG(Network, "Bad upgrade header: %s", p);
+            return p - header + sizeof(webSocketUpgradeHeader) - 1;
+        }
+        p += sizeof(webSocketUpgradeHeader) - 1;
+
+        headerSize = end - p;
+        if (headerSize < sizeof(webSocketConnectionHeader) - 1)
+            return -1;
+        if (memcmp(p, webSocketConnectionHeader, sizeof(webSocketConnectionHeader) - 1)) {
+            LOG(Network, "Bad connection header: %s", p);
+            return p - header + sizeof(webSocketConnectionHeader) - 1;
+        }
+        p += sizeof(webSocketConnectionHeader) - 1;
+    }
+
+    if (!strnstr(p, "\r\n\r\n", end - p)) {
+        // Just hasn't been received fully yet.
+        return -1;
+    }
+    HTTPHeaderMap headers;
+    p = readHTTPHeaders(p, end, &headers);
+    if (!p) {
+        LOG(Network, "readHTTPHeaders failed");
+        m_mode = Failed;
+        return len;
+    }
+    if (!processHeaders(headers)) {
+        LOG(Network, "header process failed");
+        m_mode = Failed;
+        return p - header;
+    }
+    switch (m_mode) {
+    case Normal:
+        checkResponseHeaders();
+        break;
+    default:
+        m_mode = Failed;
+        break;
+    }
+    return p - header;
+}
+
+WebSocketHandshake::Mode WebSocketHandshake::mode() const
+{
+    return m_mode;
+}
+
+const String& WebSocketHandshake::serverWebSocketOrigin() const
+{
+    return m_wsOrigin;
+}
+
+void WebSocketHandshake::setServerWebSocketOrigin(const String& webSocketOrigin)
+{
+    m_wsOrigin = webSocketOrigin;
+}
+
+const String& WebSocketHandshake::serverWebSocketLocation() const
+{
+    return m_wsLocation;
+}
+
+void WebSocketHandshake::setServerWebSocketLocation(const String& webSocketLocation)
+{
+    m_wsLocation = webSocketLocation;
+}
+
+const String& WebSocketHandshake::serverWebSocketProtocol() const
+{
+    return m_wsProtocol;
+}
+
+void WebSocketHandshake::setServerWebSocketProtocol(const String& webSocketProtocol)
+{
+    m_wsProtocol = webSocketProtocol;
+}
+
+const String& WebSocketHandshake::serverSetCookie() const
+{
+    return m_setCookie;
+}
+
+void WebSocketHandshake::setServerSetCookie(const String& setCookie)
+{
+    m_setCookie = setCookie;
+}
+
+const String& WebSocketHandshake::serverSetCookie2() const
+{
+    return m_setCookie2;
+}
+
+void WebSocketHandshake::setServerSetCookie2(const String& setCookie2)
+{
+    m_setCookie2 = setCookie2;
+}
+
+KURL WebSocketHandshake::httpURLForAuthenticationAndCookies() const
+{
+    KURL url = m_url.copy();
+    url.setProtocol(m_secure ? "https" : "http");
+    return url;
+}
+
+const char* WebSocketHandshake::readHTTPHeaders(const char* start, const char* end, HTTPHeaderMap* headers)
+{
+    Vector<char> name;
+    Vector<char> value;
+    for (const char* p = start; p < end; p++) {
+        name.clear();
+        value.clear();
+
+        for (; p < end; p++) {
+            switch (*p) {
+            case '\r':
+                if (name.isEmpty()) {
+                    if (p + 1 < end && *(p + 1) == '\n')
+                        return p + 2;
+                    LOG(Network, "CR doesn't follow LF p=%p end=%p", p, end);
+                    return 0;
+                }
+                LOG(Network, "Unexpected CR in name");
+                return 0;
+            case '\n':
+                LOG(Network, "Unexpected LF in name");
+                return 0;
+            case ':':
+                break;
+            default:
+                if (*p >= 0x41 && *p <= 0x5a)
+                    name.append(*p + 0x20);
+                else
+                    name.append(*p);
+                continue;
+            }
+            if (*p == ':') {
+                ++p;
+                break;
+            }
+        }
+
+        for (; p < end && *p == 0x20; p++) { }
+
+        for (; p < end; p++) {
+            switch (*p) {
+            case '\r':
+                break;
+            case '\n':
+                LOG(Network, "Unexpected LF in value");
+                return 0;
+            default:
+                value.append(*p);
+            }
+            if (*p == '\r') {
+                ++p;
+                break;
+            }
+        }
+        if (p >= end || *p != '\n') {
+            LOG(Network, "CR doesn't follow LF after value p=%p end=%p", p, end);
+            return 0;
+        }
+        AtomicString nameStr(String::fromUTF8(name.data(), name.size()));
+        String valueStr = String::fromUTF8(value.data(), value.size());
+        LOG(Network, "name=%s value=%s", nameStr.string().utf8().data(), valueStr.utf8().data());
+        headers->add(nameStr, valueStr);
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+bool WebSocketHandshake::processHeaders(const HTTPHeaderMap& headers)
+{
+    for (HTTPHeaderMap::const_iterator it = headers.begin(); it != headers.end(); ++it) {
+        switch (m_mode) {
+        case Normal:
+            if (it->first == "websocket-origin")
+                m_wsOrigin = it->second;
+            else if (it->first == "websocket-location")
+                m_wsLocation = it->second;
+            else if (it->first == "websocket-protocol")
+                m_wsProtocol = it->second;
+            else if (it->first == "set-cookie")
+                m_setCookie = it->second;
+            else if (it->first == "set-cookie2")
+                m_setCookie2 = it->second;
+            continue;
+        case Incomplete:
+        case Failed:
+        case Connected:
+            ASSERT_NOT_REACHED();
+        }
+        ASSERT_NOT_REACHED();
+    }
+    return true;
+}
+
+void WebSocketHandshake::checkResponseHeaders()
+{
+    ASSERT(m_mode == Normal);
+    m_mode = Failed;
+    if (m_wsOrigin.isNull() || m_wsLocation.isNull())
+        return;
+
+    if (clientOrigin() != m_wsOrigin) {
+        LOG(Network, "Mismatch origin: %s != %s", clientOrigin().utf8().data(), m_wsOrigin.utf8().data());
+        return;
+    }
+    if (clientLocation() != m_wsLocation) {
+        LOG(Network, "Mismatch location: %s != %s", clientLocation().utf8().data(), m_wsLocation.utf8().data());
+        return;
+    }
+    if (!m_clientProtocol.isEmpty() && m_clientProtocol != m_wsProtocol) {
+        LOG(Network, "Mismatch protocol: %s != %s", m_clientProtocol.utf8().data(), m_wsProtocol.utf8().data());
+        return;
+    }
+    m_mode = Connected;
+    return;
+}
+
+}  // namespace WebCore
+
+#endif  // ENABLE(WEB_SOCKETS)
diff --git a/src/3rdparty/webkit/WebCore/websockets/WebSocketHandshake.h b/src/3rdparty/webkit/WebCore/websockets/WebSocketHandshake.h
new file mode 100644
index 0000000..d5dbe68
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/websockets/WebSocketHandshake.h
@@ -0,0 +1,113 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSocketHandshake_h
+#define WebSocketHandshake_h
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "KURL.h"
+#include "PlatformString.h"
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+    class ScriptExecutionContext;
+    class HTTPHeaderMap;
+
+    class WebSocketHandshake : public Noncopyable {
+    public:
+        enum Mode {
+            Incomplete, Normal, Failed, Connected
+        };
+        WebSocketHandshake(const KURL&, const String& protocol, ScriptExecutionContext*);
+        ~WebSocketHandshake();
+
+        const KURL& url() const;
+        void setURL(const KURL&);
+        const String host() const;
+
+        const String& clientProtocol() const;
+        void setClientProtocol(const String& protocol);
+
+        bool secure() const;
+        void setSecure(bool secure);
+
+        String clientOrigin() const;
+        String clientLocation() const;
+
+        CString clientHandshakeMessage() const;
+
+        void reset();
+
+        int readServerHandshake(const char* header, size_t len);
+        Mode mode() const;
+
+        const String& serverWebSocketOrigin() const;
+        void setServerWebSocketOrigin(const String& webSocketOrigin);
+
+        const String& serverWebSocketLocation() const;
+        void setServerWebSocketLocation(const String& webSocketLocation);
+
+        const String& serverWebSocketProtocol() const;
+        void setServerWebSocketProtocol(const String& webSocketProtocol);
+
+        const String& serverSetCookie() const;
+        void setServerSetCookie(const String& setCookie);
+        const String& serverSetCookie2() const;
+        void setServerSetCookie2(const String& setCookie2);
+
+    private:
+        KURL httpURLForAuthenticationAndCookies() const;
+
+        // Reads all headers except for the two predefined ones.
+        const char* readHTTPHeaders(const char* start, const char* end, HTTPHeaderMap* headers);
+        bool processHeaders(const HTTPHeaderMap& headers);
+        void checkResponseHeaders();
+
+        KURL m_url;
+        String m_clientProtocol;
+        bool m_secure;
+        ScriptExecutionContext* m_context;
+
+        Mode m_mode;
+
+        String m_wsOrigin;
+        String m_wsLocation;
+        String m_wsProtocol;
+        String m_setCookie;
+        String m_setCookie2;
+    };
+
+}  // namespace WebCore
+
+#endif  // ENABLE(WEB_SOCKETS)
+
+#endif  // WebSocketHandshake_h
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLAElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLAElement.cpp
index 9c84193..074c371 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLAElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLAElement.cpp
@@ -73,17 +73,7 @@ void WMLAElement::parseMappedAttribute(MappedAttribute* attr)
 
 bool WMLAElement::supportsFocus() const
 {
-    return isFocusable() || (isLink() && document() && !document()->haveStylesheetsLoaded());
-}
-
-bool WMLAElement::isFocusable() const
-{
-    // FIXME: Even if we are not visible, we might have a child that is visible.
-    // Dave wants to fix that some day with a "has visible content" flag or the like.
-    if (!(isLink() && renderer() && renderer()->style()->visibility() == VISIBLE))
-        return false;
-
-    return true;
+    return isLink() || WMLElement::supportsFocus();
 }
 
 bool WMLAElement::isMouseFocusable() const
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLAElement.h b/src/3rdparty/webkit/WebCore/wml/WMLAElement.h
index 3eece4c..7b19081 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLAElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLAElement.h
@@ -36,7 +36,6 @@ public:
     WMLAElement(const QualifiedName& tagName, Document*);
 
     virtual bool supportsFocus() const;
-    virtual bool isFocusable() const;
     virtual bool isMouseFocusable() const;
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
 
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLAccessElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLAccessElement.cpp
index db0ab67..a633260 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLAccessElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLAccessElement.cpp
@@ -43,16 +43,14 @@ void WMLAccessElement::parseMappedAttribute(MappedAttribute* attr)
         String value = parseValueForbiddingVariableReferences(attr->value());
         if (value.isEmpty())
             return;
-            
-        if (WMLPageState* pageState = wmlPageStateForDocument(document()))
-            pageState->restrictDeckAccessToDomain(value);
+
+        m_domain = value;
     } else if (attr->name() == pathAttr) {
         String value = parseValueForbiddingVariableReferences(attr->value());
         if (value.isEmpty())
             return;
 
-        if (WMLPageState* pageState = wmlPageStateForDocument(document()))
-            pageState->restrictDeckAccessToPath(value);
+        m_path = value;
     } else
         WMLElement::parseMappedAttribute(attr);
 }
@@ -62,8 +60,11 @@ void WMLAccessElement::insertedIntoDocument()
     WMLElement::insertedIntoDocument();
 
     WMLPageState* pageState = wmlPageStateForDocument(document());
-    if (pageState && !pageState->setNeedCheckDeckAccess(true))
-        reportWMLError(document(), WMLErrorMultipleAccessElements);
+    if (!pageState || pageState->processAccessControlData(m_domain, m_path))
+        return;
+
+    pageState->resetAccessControlData();
+    reportWMLError(document(), WMLErrorMultipleAccessElements);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLAccessElement.h b/src/3rdparty/webkit/WebCore/wml/WMLAccessElement.h
index 023d113..1bc44ab 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLAccessElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLAccessElement.h
@@ -32,6 +32,10 @@ public:
 
     virtual void parseMappedAttribute(MappedAttribute*);
     virtual void insertedIntoDocument();
+
+private:
+    String m_domain;
+    String m_path;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLAnchorElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLAnchorElement.cpp
index aac99db..b9b3f53 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLAnchorElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLAnchorElement.cpp
@@ -54,7 +54,7 @@ void WMLAnchorElement::defaultEventHandler(Event* event)
         shouldHandle = static_cast<KeyboardEvent*>(event)->keyIdentifier() == "Enter";
 
     if (shouldHandle && m_task) {
-        m_task->executeTask(event);
+        m_task->executeTask();
         event->setDefaultHandled();
         return;
     }
@@ -63,6 +63,18 @@ void WMLAnchorElement::defaultEventHandler(Event* event)
     WMLElement::defaultEventHandler(event); 
 }
 
+void WMLAnchorElement::registerTask(WMLTaskElement* task)
+{
+    ASSERT(!m_task);
+    m_task = task;
+}
+
+void WMLAnchorElement::deregisterTask(WMLTaskElement* task)
+{
+    ASSERT_UNUSED(task, m_task == task);
+    m_task = 0;
+}
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLAnchorElement.h b/src/3rdparty/webkit/WebCore/wml/WMLAnchorElement.h
index f4afee4..abc01c9 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLAnchorElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLAnchorElement.h
@@ -37,7 +37,8 @@ public:
 
 private:
     friend class WMLTaskElement;
-    void registerTask(WMLTaskElement* task) { m_task = task; }
+    void registerTask(WMLTaskElement*);
+    void deregisterTask(WMLTaskElement*);
 
     WMLTaskElement* m_task;
 };
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLCardElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLCardElement.cpp
index 0b73f52..818b818 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLCardElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLCardElement.cpp
@@ -142,6 +142,9 @@ void WMLCardElement::handleIntrinsicEventIfNeeded()
     case FrameLoadTypeBack:
         eventType = WMLIntrinsicEventOnEnterBackward;
         break;
+    case FrameLoadTypeBackWMLDeckNotAccessible:
+        reportWMLError(document(), WMLErrorDeckNotAccessible);
+        return;
     default:
         eventType = WMLIntrinsicEventOnEnterForward;
         break;
@@ -308,7 +311,7 @@ WMLCardElement* WMLCardElement::determineActiveCard(Document* doc)
         return 0;
 
     // Figure out the new target card
-    String cardName = doc->url().ref();
+    String cardName = doc->url().fragmentIdentifier();
 
     WMLCardElement* activeCard = findNamedCardInDocument(doc, cardName);
     if (activeCard) {
@@ -336,8 +339,6 @@ WMLCardElement* WMLCardElement::determineActiveCard(Document* doc)
     // Update the document title
     doc->setTitle(activeCard->title());
 
-    // Set the active activeCard in the WMLPageState object
-    pageState->setActiveCard(activeCard);
     return activeCard;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLDoElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLDoElement.cpp
index 830009e..38ad5dd 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLDoElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLDoElement.cpp
@@ -70,14 +70,17 @@ void WMLDoElement::defaultEventHandler(Event* event)
 
     if (m_type == "accept" || m_type == "options") {
         if (m_task)
-            m_task->executeTask(event);
+            m_task->executeTask();
     } else if (m_type == "prev") {
-        WMLPageState* pageState = wmlPageStateForDocument(document());
+        ASSERT(document()->isWMLDocument());
+        WMLDocument* document = static_cast<WMLDocument*>(this->document());
+
+        WMLPageState* pageState = wmlPageStateForDocument(document);
         if (!pageState)
             return;
-
+    
         // Stop the timer of the current card if it is active
-        if (WMLCardElement* card = pageState->activeCard()) {
+        if (WMLCardElement* card = document->activeCard()) {
             if (WMLTimerElement* eventTimer = card->eventTimer())
                 eventTimer->stop();
         }
@@ -113,8 +116,6 @@ void WMLDoElement::insertedIntoDocument()
         m_name = m_type;
 
     Node* parent = parentNode();
-    ASSERT(parent);
-
     if (!parent || !parent->isWMLElement())
         return;
 
@@ -122,6 +123,18 @@ void WMLDoElement::insertedIntoDocument()
         eventHandlingElement->registerDoElement(this, document());
 }
 
+void WMLDoElement::removedFromDocument()
+{
+    Node* parent = parentNode();
+
+    if (parent  && parent->isWMLElement()) {
+        if (WMLEventHandlingElement* eventHandlingElement = toWMLEventHandlingElement(static_cast<WMLElement*>(parent)))
+            eventHandlingElement->deregisterDoElement(this);
+    }
+
+    WMLElement::removedFromDocument();
+}
+
 void WMLDoElement::attach()
 {
     WMLElement::attach();
@@ -154,6 +167,18 @@ void WMLDoElement::recalcStyle(StyleChange change)
         renderer()->updateFromElement();
 }
 
+void WMLDoElement::registerTask(WMLTaskElement* task)
+{
+    ASSERT(!m_task);
+    m_task = task;
+}
+
+void WMLDoElement::deregisterTask(WMLTaskElement* task)
+{
+    ASSERT_UNUSED(task, m_task == task);
+    m_task = 0;
+}
+
 String WMLDoElement::label() const
 {
     return parseValueSubstitutingVariableReferences(getAttribute(HTMLNames::labelAttr));
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLDoElement.h b/src/3rdparty/webkit/WebCore/wml/WMLDoElement.h
index eff2589..fe48eae 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLDoElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLDoElement.h
@@ -35,12 +35,14 @@ public:
     virtual void defaultEventHandler(Event*);
     virtual void parseMappedAttribute(MappedAttribute*);
     virtual void insertedIntoDocument();
+    virtual void removedFromDocument();
 
     virtual void attach();
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual void recalcStyle(StyleChange);
 
-    void registerTask(WMLTaskElement* task) { m_task = task; }
+    void registerTask(WMLTaskElement*);
+    void deregisterTask(WMLTaskElement*);
 
     bool isActive() const { return m_isActive; }
     String label() const;
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLDocument.cpp b/src/3rdparty/webkit/WebCore/wml/WMLDocument.cpp
index 7f73848..ef0bfc8 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLDocument.cpp
@@ -23,6 +23,7 @@
 #if ENABLE(WML)
 #include "WMLDocument.h"
 
+#include "Frame.h"
 #include "Page.h"
 #include "Tokenizer.h"
 #include "WMLCardElement.h"
@@ -34,6 +35,7 @@ namespace WebCore {
 
 WMLDocument::WMLDocument(Frame* frame)
     : Document(frame, false) 
+    , m_activeCard(0)
 {
     clearXMLVersion();
 }
@@ -51,38 +53,63 @@ void WMLDocument::finishedParsing()
         }
     }
 
-    WMLPageState* wmlPageState = wmlPageStateForDocument(this);
-    if (!wmlPageState->isDeckAccessible()) {
-        reportWMLError(this, WMLErrorDeckNotAccessible);
-        Document::finishedParsing();
+    bool hasAccess = initialize(true);
+    Document::finishedParsing();
+
+    if (!hasAccess) {
+        m_activeCard = 0;
+
+        WMLPageState* wmlPageState = wmlPageStateForDocument(this);
+        if (!wmlPageState)
+            return;
+
+        Page* page = wmlPageState->page();
+        if (!page)
+            return;
+
+        BackForwardList* list = page->backForwardList();
+        if (!list)
+            return;
+
+        HistoryItem* item = list->backItem();
+        if (!item)
+            return;
+
+        page->goToItem(item, FrameLoadTypeBackWMLDeckNotAccessible);
         return;
     }
 
-    // Remember that we'e successfully entered the deck
-    wmlPageState->setNeedCheckDeckAccess(false);
-
-    initialize();
-    Document::finishedParsing();
+    if (m_activeCard)
+        m_activeCard->handleIntrinsicEventIfNeeded();
 }
 
-void WMLDocument::initialize()
+bool WMLDocument::initialize(bool aboutToFinishParsing)
 {
+    WMLPageState* wmlPageState = wmlPageStateForDocument(this);
+    if (!wmlPageState || !wmlPageState->canAccessDeck())
+        return false;
+
+    // Remember that we'e successfully entered the deck
+    wmlPageState->resetAccessControlData();
+
     // Notify the existance of templates to all cards of the current deck
     WMLTemplateElement::registerTemplatesInDocument(this);
 
     // Set destination card
-    WMLCardElement* card = WMLCardElement::determineActiveCard(this);
-    if (!card) {
+    m_activeCard = WMLCardElement::determineActiveCard(this);
+    if (!m_activeCard) {
         reportWMLError(this, WMLErrorNoCardInDocument);
-        Document::finishedParsing();
-        return;
+        return true;
     }
 
     // Handle deck-level task overrides
-    card->handleDeckLevelTaskOverridesIfNeeded();
+    m_activeCard->handleDeckLevelTaskOverridesIfNeeded();
 
     // Handle card-level intrinsic event
-    card->handleIntrinsicEventIfNeeded();
+    if (!aboutToFinishParsing)
+        m_activeCard->handleIntrinsicEventIfNeeded();
+
+    return true;
 }
 
 WMLPageState* wmlPageStateForDocument(Document* doc)
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLDocument.h b/src/3rdparty/webkit/WebCore/wml/WMLDocument.h
index 9189085..9053518 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLDocument.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLDocument.h
@@ -28,11 +28,13 @@
 
 namespace WebCore {
 
+class WMLCardElement;
+
 class WMLDocument : public Document {
 public:
     static PassRefPtr<WMLDocument> create(Frame* frame)
     {
-        return new WMLDocument(frame);
+        return adoptRef(new WMLDocument(frame));
     }
 
     virtual ~WMLDocument();
@@ -40,10 +42,13 @@ public:
     virtual bool isWMLDocument() const { return true; }
     virtual void finishedParsing();
 
-    void initialize();
+    bool initialize(bool aboutToFinishParsing = false);
+
+    WMLCardElement* activeCard() const { return m_activeCard; }
 
 private:
     WMLDocument(Frame*);
+    WMLCardElement* m_activeCard;
 };
 
 WMLPageState* wmlPageStateForDocument(Document*);
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLElement.cpp
index a9e4b5d..50b0fe4 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLElement.cpp
@@ -38,11 +38,16 @@ namespace WebCore {
 
 using namespace WMLNames;
 
-WMLElement::WMLElement(const QualifiedName& tagName, Document* doc)
-    : StyledElement(tagName, doc)
+WMLElement::WMLElement(const QualifiedName& tagName, Document* document)
+    : StyledElement(tagName, document, CreateElementZeroRefCount)
 {
 }
 
+PassRefPtr<WMLElement> WMLElement::create(const QualifiedName& tagName, Document* document)
+{
+    return new WMLElement(tagName, document);
+}
+
 bool WMLElement::mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const
 {
     if (attrName == HTMLNames::alignAttr) {
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLElement.h b/src/3rdparty/webkit/WebCore/wml/WMLElement.h
index 46b0ff4..0bfaceb 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLElement.h
@@ -29,7 +29,7 @@ namespace WebCore {
 
 class WMLElement : public StyledElement {
 public:
-    WMLElement(const QualifiedName& tagName, Document*);
+    static PassRefPtr<WMLElement> create(const QualifiedName& tagName, Document*);
 
     virtual bool isWMLElement() const { return true; }
     virtual bool isWMLTaskElement() const { return false; }
@@ -43,6 +43,8 @@ public:
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
 protected:
+    WMLElement(const QualifiedName& tagName, Document*);
+
     // Helper function for derived classes
     String parseValueSubstitutingVariableReferences(const AtomicString&, WMLErrorCode defaultErrorCode = WMLErrorInvalidVariableReference) const;
     String parseValueForbiddingVariableReferences(const AtomicString&) const;
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLErrorHandling.cpp b/src/3rdparty/webkit/WebCore/wml/WMLErrorHandling.cpp
index 87c8003..d62ccb7 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLErrorHandling.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLErrorHandling.cpp
@@ -38,7 +38,8 @@ void reportWMLError(Document* doc, WMLErrorCode error)
         return;
 
     String errorMessage = errorMessageForErrorCode(error);
-    if (XMLTokenizer* tokenizer = static_cast<XMLTokenizer*>(doc->tokenizer())) {
+    XMLTokenizer* tokenizer = static_cast<XMLTokenizer*>(doc->tokenizer());
+    if (tokenizer && error != WMLErrorDeckNotAccessible) {
         // Some errors are reported as result of an insertedIntoDocument() call.
         // If this happened, parsing has been stopped, and the document fragment
         // is wrapped in a XHTML error document. That means insertedIntoDocument()
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLEventHandlingElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLEventHandlingElement.cpp
index 2848985..faa80c7 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLEventHandlingElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLEventHandlingElement.cpp
@@ -61,10 +61,22 @@ void WMLEventHandlingElement::registerDoElement(WMLDoElement* doElement, Documen
         }
     }
 
+    ASSERT(m_doElements.find(doElement) == WTF::notFound);
     m_doElements.append(doElement);
     doElement->setActive(true);
 }
 
+void WMLEventHandlingElement::deregisterDoElement(WMLDoElement* doElement)
+{
+    doElement->setActive(false);
+
+    size_t position = m_doElements.find(doElement);
+    if (position == WTF::notFound)
+        return;
+
+    m_doElements.remove(position);
+}
+
 WMLEventHandlingElement* toWMLEventHandlingElement(WMLElement* element)
 {
     if (!element->isWMLElement())
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLEventHandlingElement.h b/src/3rdparty/webkit/WebCore/wml/WMLEventHandlingElement.h
index 92ae289..15cef7b 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLEventHandlingElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLEventHandlingElement.h
@@ -42,6 +42,7 @@ public:
 
     Vector<WMLDoElement*>& doElements() { return m_doElements; }
     void registerDoElement(WMLDoElement*, Document*);
+    void deregisterDoElement(WMLDoElement*);
 
 private:
     OwnPtr<WMLIntrinsicEventHandler> m_eventHandler;
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.cpp
index c0b4bc5..3930de2 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.cpp
@@ -66,8 +66,8 @@ void WMLFieldSetElement::insertedIntoDocument()
 
 void WMLFieldSetElement::removedFromDocument()
 {
-    WMLElement::removedFromDocument();
     m_insertedLegendElement.clear();
+    WMLElement::removedFromDocument();
 }
 
 RenderObject* WMLFieldSetElement::createRenderer(RenderArena* arena, RenderStyle*)
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLFormControlElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLFormControlElement.cpp
index f849ac8..93ffbda 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLFormControlElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLFormControlElement.cpp
@@ -39,6 +39,11 @@ WMLFormControlElement::~WMLFormControlElement()
 {
 }
 
+bool WMLFormControlElement::supportsFocus() const
+{
+    return true;
+}
+
 bool WMLFormControlElement::isFocusable() const
 {
     if (!renderer() || !renderer()->isBox())
@@ -46,14 +51,10 @@ bool WMLFormControlElement::isFocusable() const
 
     if (toRenderBox(renderer())->size().isEmpty())
         return false;
-
-    if (RenderStyle* style = renderer()->style()) {
-        if (style->visibility() != VISIBLE)
-            return false;
-    }
-
-    return true;
+    
+    return WMLElement::isFocusable();
 }
+    
 
 void WMLFormControlElement::attach()
 {
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLFormControlElement.h b/src/3rdparty/webkit/WebCore/wml/WMLFormControlElement.h
index dde86ed..43f8dee 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLFormControlElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLFormControlElement.h
@@ -38,6 +38,7 @@ public:
     virtual bool formControlValueMatchesRenderer() const { return m_valueMatchesRenderer; }
     virtual void setFormControlValueMatchesRenderer(bool b = true) { m_valueMatchesRenderer = b; }
 
+    virtual bool supportsFocus() const;
     virtual bool isFocusable() const;
 
     virtual void attach();
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLGoElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLGoElement.cpp
index c1bf283..8076207 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLGoElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLGoElement.cpp
@@ -50,8 +50,16 @@ WMLGoElement::WMLGoElement(const QualifiedName& tagName, Document* doc)
  
 void WMLGoElement::registerPostfieldElement(WMLPostfieldElement* postfield)
 {
+    ASSERT(m_postfieldElements.find(postfield) == WTF::notFound);
     m_postfieldElements.append(postfield);
 }
+ 
+void WMLGoElement::deregisterPostfieldElement(WMLPostfieldElement* postfield)
+{
+    size_t position = m_postfieldElements.find(postfield);
+    ASSERT(position != WTF::notFound);
+    m_postfieldElements.remove(position);
+}
 
 void WMLGoElement::parseMappedAttribute(MappedAttribute* attr)
 {
@@ -65,18 +73,20 @@ void WMLGoElement::parseMappedAttribute(MappedAttribute* attr)
         WMLTaskElement::parseMappedAttribute(attr);
 }
 
-void WMLGoElement::executeTask(Event*)
+void WMLGoElement::executeTask()
 {
-    Document* doc = document();
-    WMLPageState* pageState = wmlPageStateForDocument(doc);
+    ASSERT(document()->isWMLDocument());
+    WMLDocument* document = static_cast<WMLDocument*>(this->document());
+
+    WMLPageState* pageState = wmlPageStateForDocument(document);
     if (!pageState)
         return;
 
-    WMLCardElement* card = pageState->activeCard();
+    WMLCardElement* card = document->activeCard();
     if (!card)
         return;
 
-    Frame* frame = doc->frame();
+    Frame* frame = document->frame();
     if (!frame)
         return;
 
@@ -89,7 +99,7 @@ void WMLGoElement::executeTask(Event*)
         return;
 
     // Substitute variables within target url attribute value
-    KURL url = doc->completeURL(substituteVariableReferences(href, doc, WMLVariableEscapingEscape));
+    KURL url = document->completeURL(substituteVariableReferences(href, document, WMLVariableEscapingEscape));
     if (url.isEmpty())
         return;
 
@@ -100,9 +110,9 @@ void WMLGoElement::executeTask(Event*)
         eventTimer->stop();
 
     // FIXME: 'newcontext' handling not implemented for external cards
-    bool inSameDeck = doc->url().path() == url.path();
-    if (inSameDeck && url.hasRef()) {
-        if (WMLCardElement* card = WMLCardElement::findNamedCardInDocument(doc, url.ref())) {
+    bool inSameDeck = document->url().path() == url.path();
+    if (inSameDeck && url.hasFragmentIdentifier()) {
+        if (WMLCardElement* card = WMLCardElement::findNamedCardInDocument(document, url.fragmentIdentifier())) {
             if (card->isNewContext())
                 pageState->reset();
         }
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLGoElement.h b/src/3rdparty/webkit/WebCore/wml/WMLGoElement.h
index 3c70289..36c7be2 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLGoElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLGoElement.h
@@ -36,9 +36,10 @@ public:
     WMLGoElement(const QualifiedName& tagName, Document*);
 
     void registerPostfieldElement(WMLPostfieldElement*);
+    void deregisterPostfieldElement(WMLPostfieldElement*);
 
     virtual void parseMappedAttribute(MappedAttribute*);
-    virtual void executeTask(Event*);
+    virtual void executeTask();
 
 private:
     void preparePOSTRequest(ResourceRequest&, bool inSameDeck, const String& cacheControl);
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLInputElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLInputElement.cpp
index cb824d1..2dbdaf0 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLInputElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLInputElement.cpp
@@ -69,7 +69,7 @@ bool WMLInputElement::isMouseFocusable() const
 
 void WMLInputElement::dispatchFocusEvent()
 {
-    InputElement::dispatchFocusEvent(m_data, this, this);
+    InputElement::dispatchFocusEvent(this, this);
     WMLElement::dispatchFocusEvent();
 }
 
@@ -87,7 +87,7 @@ void WMLInputElement::dispatchBlurEvent()
     if (!nameVariable.isEmpty())
         wmlPageStateForDocument(document())->storeVariable(nameVariable, val); 
 
-    InputElement::dispatchBlurEvent(m_data, this, this);
+    InputElement::dispatchBlurEvent(this, this);
     WMLElement::dispatchBlurEvent();
 }
 
@@ -134,7 +134,7 @@ String WMLInputElement::value() const
 
 void WMLInputElement::setValue(const String& value)
 {
-    InputElement::updatePlaceholderVisibility(m_data, this, this);
+    InputElement::updatePlaceholderVisibility(this, this);
     setFormControlValueMatchesRenderer(false);
     m_data.setValue(constrainValue(value));
     if (inDocument())
@@ -295,10 +295,10 @@ void WMLInputElement::defaultEventHandler(Event* evt)
     }
 
     if (evt->isBeforeTextInsertedEvent())
-        InputElement::handleBeforeTextInsertedEvent(m_data, this, document(), evt);
+        InputElement::handleBeforeTextInsertedEvent(m_data, this, this, evt);
 
     if (renderer() && (evt->isMouseEvent() || evt->isDragEvent() || evt->isWheelEvent() || evt->type() == eventNames().blurEvent || evt->type() == eventNames().focusEvent))
-        static_cast<RenderTextControlSingleLine*>(renderer())->forwardEvent(evt);
+        toRenderTextControlSingleLine(renderer())->forwardEvent(evt);
 }
 
 void WMLInputElement::cacheSelection(int start, int end)
@@ -309,7 +309,7 @@ void WMLInputElement::cacheSelection(int start, int end)
 
 String WMLInputElement::constrainValue(const String& proposedValue) const
 {
-    return InputElement::constrainValue(this, proposedValue, m_data.maxLength());
+    return InputElement::sanitizeUserInputValue(this, proposedValue, m_data.maxLength());
 }
 
 void WMLInputElement::documentDidBecomeActive()
@@ -320,7 +320,7 @@ void WMLInputElement::documentDidBecomeActive()
 
 bool WMLInputElement::placeholderShouldBeVisible() const
 {
-    return m_data.placeholderShouldBeVisible();
+    return InputElement::placeholderShouldBeVisible(this, this);
 }
 
 void WMLInputElement::willMoveToNewOwnerDocument()
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLInputElement.h b/src/3rdparty/webkit/WebCore/wml/WMLInputElement.h
index 7529968..7eb2455 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLInputElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLInputElement.h
@@ -79,7 +79,7 @@ public:
     virtual void defaultEventHandler(Event*);
     virtual void cacheSelection(int start, int end);
 
-    virtual String constrainValue(const String& proposedValue) const;
+    virtual String sanitizeValue(const String& proposedValue) const { return constrainValue(proposedValue); }
 
     virtual void documentDidBecomeActive();
     virtual bool placeholderShouldBeVisible() const;
@@ -96,6 +96,7 @@ private:
 
     String validateInputMask(const String&);
     unsigned cursorPositionToMaskIndex(unsigned);
+    String constrainValue(const String&) const;
 
     InputElementData m_data;
     bool m_isPasswordField;
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLIntrinsicEventHandler.cpp b/src/3rdparty/webkit/WebCore/wml/WMLIntrinsicEventHandler.cpp
index 46cdb8c..8e4c276 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLIntrinsicEventHandler.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLIntrinsicEventHandler.cpp
@@ -38,11 +38,17 @@ bool WMLIntrinsicEventHandler::registerIntrinsicEvent(WMLIntrinsicEventType type
     return true;
 }
 
+void WMLIntrinsicEventHandler::deregisterIntrinsicEvent(WMLIntrinsicEventType type)
+{
+    if (m_events.contains(type))
+        m_events.remove(type);
+}
+
 void WMLIntrinsicEventHandler::triggerIntrinsicEvent(WMLIntrinsicEventType type) const
 {
     RefPtr<WMLIntrinsicEvent> event = m_events.get(type);
     ASSERT(event->taskElement());
-    event->taskElement()->executeTask(0);
+    event->taskElement()->executeTask();
 }
 
 bool WMLIntrinsicEventHandler::hasIntrinsicEvent(WMLIntrinsicEventType type) const
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLIntrinsicEventHandler.h b/src/3rdparty/webkit/WebCore/wml/WMLIntrinsicEventHandler.h
index b24bb54..8ac6d1b 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLIntrinsicEventHandler.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLIntrinsicEventHandler.h
@@ -44,6 +44,7 @@ public:
     WMLIntrinsicEventHandler();
 
     bool registerIntrinsicEvent(WMLIntrinsicEventType, PassRefPtr<WMLIntrinsicEvent>);
+    void deregisterIntrinsicEvent(WMLIntrinsicEventType);
     void triggerIntrinsicEvent(WMLIntrinsicEventType) const;
     bool hasIntrinsicEvent(WMLIntrinsicEventType) const;
 
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLNoopElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLNoopElement.cpp
index 7c69ddc..b2ce506 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLNoopElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLNoopElement.cpp
@@ -45,8 +45,6 @@ void WMLNoopElement::insertedIntoDocument()
     WMLElement::insertedIntoDocument();
 
     Node* parent = parentNode();
-    ASSERT(parent);
-
     if (!parent || !parent->isWMLElement())
         return;
 
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLOnEventElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLOnEventElement.cpp
index a8d35a0..6fc4e8b 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLOnEventElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLOnEventElement.cpp
@@ -60,19 +60,21 @@ void WMLOnEventElement::parseMappedAttribute(MappedAttribute* attr)
         WMLElement::parseMappedAttribute(attr);
 }
 
+static inline WMLEventHandlingElement* eventHandlingParent(Node* parent)
+{
+    if (!parent || !parent->isWMLElement())
+        return 0;
+
+    return toWMLEventHandlingElement(static_cast<WMLElement*>(parent));
+}
+
 void WMLOnEventElement::registerTask(WMLTaskElement* task)
 {
     if (m_type == WMLIntrinsicEventUnknown)
         return;
 
     // Register intrinsic event to the event handler of the owner of onevent element 
-    Node* parent = parentNode();
-    ASSERT(parent);
-
-    if (!parent || !parent->isWMLElement())
-        return;
-
-    WMLEventHandlingElement* eventHandlingElement = toWMLEventHandlingElement(static_cast<WMLElement*>(parent));
+    WMLEventHandlingElement* eventHandlingElement = eventHandlingParent(parentNode());
     if (!eventHandlingElement)
         return;
 
@@ -83,6 +85,15 @@ void WMLOnEventElement::registerTask(WMLTaskElement* task)
         reportWMLError(document(), WMLErrorConflictingEventBinding);
 }
 
+void WMLOnEventElement::deregisterTask(WMLTaskElement*)
+{
+    WMLEventHandlingElement* eventHandlingElement = eventHandlingParent(parentNode());
+    if (!eventHandlingElement)
+        return;
+
+    eventHandlingElement->eventHandler()->deregisterIntrinsicEvent(m_type);
+}
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLOnEventElement.h b/src/3rdparty/webkit/WebCore/wml/WMLOnEventElement.h
index bb004fe..de33600 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLOnEventElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLOnEventElement.h
@@ -36,6 +36,7 @@ public:
     virtual void parseMappedAttribute(MappedAttribute*);
 
     void registerTask(WMLTaskElement*);
+    void deregisterTask(WMLTaskElement*);
 
 private:
     WMLIntrinsicEventType m_type;
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLOptionElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLOptionElement.cpp
index 60d3de6..61fa762 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLOptionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLOptionElement.cpp
@@ -143,7 +143,7 @@ String WMLOptionElement::value() const
 
 String WMLOptionElement::text() const
 {
-    return OptionElement::collectOptionText(m_data, this);
+    return OptionElement::collectOptionLabelOrText(m_data, this);
 }
 
 String WMLOptionElement::textIndentedToRespectGroupLabel() const
@@ -158,6 +158,10 @@ RenderStyle* WMLOptionElement::nonRendererRenderStyle() const
 
 void WMLOptionElement::handleIntrinsicEventIfNeeded()
 {
+    WMLSelectElement* select = ownerSelectElement(this);
+    if (!select || !select->initialized())
+        return;
+
     WMLIntrinsicEventHandler* eventHandler = this->eventHandler();
     if (!eventHandler)
         return;
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLPageState.cpp b/src/3rdparty/webkit/WebCore/wml/WMLPageState.cpp
index 6b6a763..3e1863d 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLPageState.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLPageState.cpp
@@ -25,6 +25,8 @@
 #include "WMLPageState.h"
 
 #include "CString.h"
+#include "Document.h"
+#include "Frame.h"
 #include "HistoryItem.h"
 #include "KURL.h"
 #include "Page.h"
@@ -33,8 +35,7 @@ namespace WebCore {
 
 WMLPageState::WMLPageState(Page* page)
     : m_page(page)
-    , m_activeCard(0)
-    , m_hasDeckAccess(false)
+    , m_hasAccessControlData(false)
 {
 }
 
@@ -66,74 +67,200 @@ void WMLPageState::reset()
         list->clearWMLPageHistory();
 }
 
-bool WMLPageState::setNeedCheckDeckAccess(bool need)
+static inline String normalizedHostName(const String& passedHost)
 {
-    if (m_hasDeckAccess && need)
+    if (passedHost.contains("127.0.0.1")) {
+        String host = passedHost;
+        return host.replace("127.0.0.1", "localhost");
+    }
+
+    return passedHost;
+}
+
+static inline String hostFromURL(const KURL& url)
+{
+    // Default to "localhost"
+    String host = normalizedHostName(url.host());
+    return host.isEmpty() ? "localhost" : host;
+}
+
+static KURL urlForHistoryItem(Frame* frame, HistoryItem* item)
+{
+    // For LayoutTests we need to find the corresponding WML frame in the test document
+    // to be able to test access-control correctly. Remember that WML is never supposed
+    // to be embedded anywhere, so the purpose is to simulate a standalone WML document.
+    if (frame->document()->isWMLDocument())
+        return item->url();
+
+    const HistoryItemVector& childItems = item->children();
+    HistoryItemVector::const_iterator it = childItems.begin();
+    const HistoryItemVector::const_iterator end = childItems.end();
+
+    for (; it != end; ++it) {
+        const RefPtr<HistoryItem> childItem = *it;
+        Frame* childFrame = frame->tree()->child(childItem->target());
+        if (!childFrame)
+            continue;
+
+        if (Document* childDocument = childFrame->document()) {
+            if (childDocument->isWMLDocument())
+                return childItem->url();
+        }
+    }
+
+    return item->url();
+}
+
+static bool tryAccessHistoryURLs(Page* page, KURL& previousURL, KURL& currentURL)
+{
+    if (!page)
         return false;
 
-    m_hasDeckAccess = need;
-    m_accessPath = String();
-    m_accessDomain = String();
+    Frame* frame = page->mainFrame();
+    if (!frame || !frame->document())    
+        return false;
+
+    BackForwardList* list = page->backForwardList();
+    if (!list)
+        return false;
+
+    HistoryItem* previousItem = list->backItem();
+    if (!previousItem)
+        return false;
+
+    HistoryItem* currentItem = list->currentItem();
+    if (!currentItem)
+        return false;
+
+    previousURL = urlForHistoryItem(frame, previousItem);
+    currentURL = urlForHistoryItem(frame, currentItem);
+
     return true;
 }
 
-// FIXME: We may want another name, it does far more than just checking wheter the deck is accessable
-bool WMLPageState::isDeckAccessible()
+bool WMLPageState::processAccessControlData(const String& domain, const String& path)
 {
-    if (!m_hasDeckAccess || !m_page || !m_page->backForwardList() || !m_page->backForwardList()->backItem())
+    if (m_hasAccessControlData)
+        return false;
+
+    m_hasAccessControlData = true;
+
+    KURL previousURL, currentURL;
+    if (!tryAccessHistoryURLs(m_page, previousURL, currentURL))
         return true;
 
-    HistoryItem* histItem = m_page->backForwardList()->backItem();
-    KURL url(histItem->urlString());
+    // Spec: The path attribute defaults to the value "/"
+    m_accessPath = path.isEmpty() ? "/" : path;
 
-    String prevHost = url.host();
-    String prevPath = url.path();
+    // Spec: The domain attribute defaults to the current decks domain.
+    String previousHost = hostFromURL(previousURL);
+    m_accessDomain = domain.isEmpty() ? previousHost : normalizedHostName(domain);
 
-    // for 'file' URI, the host part may be empty, so we should complete it.
-    if (prevHost.isEmpty())
-        prevHost = "localhost";
+    // Spec: To simplify the development of applications that may not know the absolute path to the 
+    // current deck, the path attribute accepts relative URIs. The user agent converts the relative 
+    // path to an absolute path and then performs prefix matching against the PATH attribute.
+    Document* document = m_page->mainFrame() ? m_page->mainFrame()->document() : 0;
+    if (document && previousHost == m_accessDomain && !m_accessPath.startsWith("/")) {
+        String currentPath = currentURL.path();
 
-    histItem = m_page->backForwardList()->currentItem();
-    KURL curUrl(histItem->urlString());
-    String curPath = curUrl.path();
+        size_t index = currentPath.reverseFind('/');
+        if (index != WTF::notFound)
+            m_accessPath = document->completeURL(currentPath.left(index + 1) + m_accessPath).path();
+    }
+
+    return true;
+}
+
+void WMLPageState::resetAccessControlData()
+{
+    m_hasAccessControlData = false;
+    m_accessDomain = String();
+    m_accessPath = String();
+}
+
+bool WMLPageState::canAccessDeck() const
+{
+    if (!m_hasAccessControlData)
+        return true;
 
-    if (equalIgnoringRef(url, curUrl))
+    KURL previousURL, currentURL;
+    if (!tryAccessHistoryURLs(m_page, previousURL, currentURL))
+        return true;
+
+    if (equalIgnoringFragmentIdentifier(previousURL, currentURL))
        return true;
 
-    // "/" is the default value if not specified
-    if (m_accessPath.isEmpty())  
-        m_accessPath = "/";
-    else if (m_accessPath.endsWith("/") && (m_accessPath != "/"))
-        m_accessPath = m_accessPath.left((m_accessPath.length()-1));
-
-
-    // current deck domain is the default value if not specified
-    if (m_accessDomain.isEmpty())
-        m_accessDomain = prevHost;
-
-    // convert relative URL to absolute URL before performing path matching
-    if (prevHost == m_accessDomain) {
-        if (!m_accessPath.startsWith("/")) {
-           int index = curPath.reverseFind('/');
-           if (index != -1) {
-               curPath = curPath.left(index + 1);
-               curPath += m_accessPath;
-               curUrl.setPath(curPath);
-               m_accessPath = curUrl.path();
-           }
+    return hostIsAllowedToAccess(hostFromURL(previousURL)) && pathIsAllowedToAccess(previousURL.path());
+}
+
+bool WMLPageState::hostIsAllowedToAccess(const String& host) const
+{
+    // Spec: The access domain is suffix-matched against the domain name portion of the referring URI
+    Vector<String> subdomainsAllowed;
+    if (m_accessDomain.contains('.'))
+        m_accessDomain.split('.', subdomainsAllowed);
+    else
+        subdomainsAllowed.append(m_accessDomain);
+
+    Vector<String> subdomainsCheck;
+    if (host.contains('.'))
+        host.split('.', subdomainsCheck);
+    else
+        subdomainsCheck.append(host);
+
+    Vector<String>::iterator itAllowed = subdomainsAllowed.end() - 1;
+    Vector<String>::iterator beginAllowed = subdomainsAllowed.begin();
+
+    Vector<String>::iterator itCheck = subdomainsCheck.end() - 1;
+    Vector<String>::iterator beginCheck = subdomainsCheck.begin();
+
+    bool hostOk = true;
+    for (; itAllowed >= beginAllowed && itCheck >= beginCheck; ) {
+        if (*itAllowed != *itCheck) {
+            hostOk = false;
+            break;
         }
+
+        --itAllowed;
+        --itCheck;
     }
 
-    // path prefix matching
-    if (prevPath.startsWith(m_accessPath) && 
-       (prevPath[m_accessPath.length()] == '/' || prevPath.length() == m_accessPath.length())) {
-        // domain suffix matching
-        unsigned domainLength = m_accessDomain.length();
-        unsigned hostLength = prevHost.length();
-        return (prevHost.endsWith(m_accessDomain) && prevHost[hostLength - domainLength - 1] == '.') || hostLength == domainLength;
+    return hostOk;
+}
+
+bool WMLPageState::pathIsAllowedToAccess(const String& path) const
+{
+    // Spec: The access path is prefix matched against the path portion of the referring URI
+    Vector<String> subpathsAllowed;
+    if (m_accessPath.contains('/'))
+        m_accessPath.split('/', subpathsAllowed);
+    else
+        subpathsAllowed.append(m_accessPath);
+
+    Vector<String> subpathsCheck;
+    if (path.contains('/'))
+        path.split('/', subpathsCheck);
+    else
+        subpathsCheck.append(path);
+
+    Vector<String>::iterator itAllowed = subpathsAllowed.begin();
+    Vector<String>::iterator endAllowed = subpathsAllowed.end();
+
+    Vector<String>::iterator itCheck = subpathsCheck.begin();
+    Vector<String>::iterator endCheck = subpathsCheck.end();
+
+    bool pathOk = true;
+    for (; itAllowed != endAllowed && itCheck != endCheck; ) {
+        if (*itAllowed != *itCheck) {
+            pathOk = false;
+            break;
+        }
+
+        ++itAllowed;
+        ++itCheck;
     }
 
-    return false;
+    return pathOk;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLPageState.h b/src/3rdparty/webkit/WebCore/wml/WMLPageState.h
index 72bc72c..a5d8b23 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLPageState.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLPageState.h
@@ -43,40 +43,33 @@ public:
     void dump();
 #endif
 
-    // reset the browser context when 'newcontext' attribute
-    // of card element is performed as part of go task
+    // Reset the browser context
     void reset();
 
-    // variables operations 
+    // Variable handling
     void storeVariable(const String& name, const String& value) { m_variables.set(name, value); }
     void storeVariables(WMLVariableMap& variables) { m_variables = variables; }
     String getVariable(const String& name) const { return m_variables.get(name); }
     bool hasVariables() const { return !m_variables.isEmpty(); }
 
-    int historyLength() const { return m_historyLength; }
-    void setHistoryLength(int length) { m_historyLength = length; }
-
     Page* page() const { return m_page; }
 
-    WMLCardElement* activeCard() const { return m_activeCard; }
-    void setActiveCard(WMLCardElement* card) { m_activeCard = card; }
+    // Deck access control
+    bool processAccessControlData(const String& dmain, const String& path);
+    void resetAccessControlData();
+
+    bool canAccessDeck() const;
 
-    // deck access control
-    void restrictDeckAccessToDomain(const String& domain) { m_accessDomain = domain; }
-    void restrictDeckAccessToPath(const String& path) { m_accessPath = path; }
-    bool hasDeckAccess() const { return m_hasDeckAccess; }
- 
-    bool setNeedCheckDeckAccess(bool);
-    bool isDeckAccessible();
+private:
+    bool hostIsAllowedToAccess(const String&) const;
+    bool pathIsAllowedToAccess(const String&) const;
 
 private:
     Page* m_page;
     WMLVariableMap m_variables;
-    int m_historyLength;
-    WMLCardElement* m_activeCard;
     String m_accessDomain;
     String m_accessPath;
-    bool m_hasDeckAccess;
+    bool m_hasAccessControlData;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.cpp
index ca43f69..21f4c5b 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.cpp
@@ -44,12 +44,17 @@ void WMLPostfieldElement::insertedIntoDocument()
     WMLElement::insertedIntoDocument();
 
     Node* parent = parentNode();
-    ASSERT(parent);
+    if (parent && parent->hasTagName(goTag))
+        static_cast<WMLGoElement*>(parent)->registerPostfieldElement(this);
+}
 
-    if (!parent->hasTagName(goTag))
-        return;
+void WMLPostfieldElement::removedFromDocument()
+{
+    Node* parent = parentNode();
+    if (parent && parent->hasTagName(goTag))
+        static_cast<WMLGoElement*>(parent)->deregisterPostfieldElement(this);
 
-    static_cast<WMLGoElement*>(parent)->registerPostfieldElement(this);
+    WMLElement::removedFromDocument();
 }
 
 String WMLPostfieldElement::name() const
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.h b/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.h
index 945e6d3..dd10b47 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.h
@@ -31,6 +31,7 @@ public:
     WMLPostfieldElement(const QualifiedName& tagName, Document*);
 
     virtual void insertedIntoDocument();
+    virtual void removedFromDocument();
 
     String name() const;
     String value() const;
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLPrevElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLPrevElement.cpp
index 2688d03..3d487ea 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLPrevElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLPrevElement.cpp
@@ -40,13 +40,16 @@ WMLPrevElement::~WMLPrevElement()
 {
 }
 
-void WMLPrevElement::executeTask(Event*)
+void WMLPrevElement::executeTask()
 {
-    WMLPageState* pageState = wmlPageStateForDocument(document());
+    ASSERT(document()->isWMLDocument());
+    WMLDocument* document = static_cast<WMLDocument*>(this->document());
+
+    WMLPageState* pageState = wmlPageStateForDocument(document);
     if (!pageState)
         return;
 
-    WMLCardElement* card = pageState->activeCard();
+    WMLCardElement* card = document->activeCard();
     if (!card)
         return;
 
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLPrevElement.h b/src/3rdparty/webkit/WebCore/wml/WMLPrevElement.h
index 232c1b0..ce8596e 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLPrevElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLPrevElement.h
@@ -31,7 +31,7 @@ public:
     WMLPrevElement(const QualifiedName& tagName, Document*);
     virtual ~WMLPrevElement();
 
-    virtual void executeTask(Event*);
+    virtual void executeTask();
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLRefreshElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLRefreshElement.cpp
index c05a2c9..bcf87ac 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLRefreshElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLRefreshElement.cpp
@@ -41,13 +41,16 @@ WMLRefreshElement::~WMLRefreshElement()
 {
 }
 
-void WMLRefreshElement::executeTask(Event*)
+void WMLRefreshElement::executeTask()
 {
-    WMLPageState* pageState = wmlPageStateForDocument(document());
+    ASSERT(document()->isWMLDocument());
+    WMLDocument* document = static_cast<WMLDocument*>(this->document());
+
+    WMLPageState* pageState = wmlPageStateForDocument(document);
     if (!pageState)
         return;
 
-    WMLCardElement* card = pageState->activeCard();
+    WMLCardElement* card = document->activeCard();
     if (!card)
         return;
 
@@ -62,7 +65,7 @@ void WMLRefreshElement::executeTask(Event*)
     storeVariableState(pageState);
 
     // Redisplay curremt card with current variable state
-    if (Frame* frame = document()->frame()) {
+    if (Frame* frame = document->frame()) {
         if (FrameLoader* loader = frame->loader())
             loader->reload();
     }
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLRefreshElement.h b/src/3rdparty/webkit/WebCore/wml/WMLRefreshElement.h
index 7b1729e..43b71b5 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLRefreshElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLRefreshElement.h
@@ -31,7 +31,7 @@ public:
     WMLRefreshElement(const QualifiedName& tagName, Document*);
     virtual ~WMLRefreshElement();
 
-    virtual void executeTask(Event*);
+    virtual void executeTask();
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLSelectElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLSelectElement.cpp
index 2d03a3f..03ca05a 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLSelectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLSelectElement.cpp
@@ -39,6 +39,7 @@ using namespace WMLNames;
 
 WMLSelectElement::WMLSelectElement(const QualifiedName& tagName, Document* document)
     : WMLFormControlElement(tagName, document)
+    , m_initialized(false)
 {
 }
 
@@ -242,14 +243,17 @@ void WMLSelectElement::selectInitialOptions()
     // Spec: Step 1 - the default option index is determined using iname and ivalue
     calculateDefaultOptionIndices();
 
-    if (m_defaultOptionIndices.isEmpty())
+    if (m_defaultOptionIndices.isEmpty()) {
+        m_initialized = true;
         return;
+    }
 
     // Spec: Step 2 – initialise variables
     initializeVariables();
 
     // Spec: Step 3 – pre-select option(s) specified by the default option index 
     selectDefaultOptions();
+    m_initialized = true;
 }
 
 void WMLSelectElement::insertedIntoTree(bool deep)
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLSelectElement.h b/src/3rdparty/webkit/WebCore/wml/WMLSelectElement.h
index 412a950..5ab7da6 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLSelectElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLSelectElement.h
@@ -85,6 +85,8 @@ public:
     void scrollToSelection();
     void selectInitialOptions();
 
+    bool initialized() const { return m_initialized; }
+
 private:
     virtual void insertedIntoTree(bool);
 
@@ -104,6 +106,7 @@ private:
     String ivalue() const;
 
     SelectElementData m_data;
+    bool m_initialized;
     Vector<unsigned> m_defaultOptionIndices;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.cpp
index e59b070..5e10ca8 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.cpp
@@ -56,8 +56,6 @@ void WMLSetvarElement::insertedIntoDocument()
     WMLElement::insertedIntoDocument();
  
     Node* parent = parentNode();
-    ASSERT(parent);
-
     if (!parent || !parent->isWMLElement())
         return;
 
@@ -65,6 +63,17 @@ void WMLSetvarElement::insertedIntoDocument()
         static_cast<WMLTaskElement*>(parent)->registerVariableSetter(this);
 }
 
+void WMLSetvarElement::removedFromDocument()
+{
+    Node* parent = parentNode();
+    if (parent && parent->isWMLElement()) {
+        if (static_cast<WMLElement*>(parent)->isWMLTaskElement())
+            static_cast<WMLTaskElement*>(parent)->deregisterVariableSetter(this);
+    }
+
+    WMLElement::removedFromDocument(); 
+}
+
 String WMLSetvarElement::name() const
 {
     return parseValueSubstitutingVariableReferences(getAttribute(HTMLNames::nameAttr), WMLErrorInvalidVariableName);
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.h b/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.h
index 12400a5..0171b95 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.h
@@ -33,6 +33,7 @@ public:
 
     virtual void parseMappedAttribute(MappedAttribute*);
     virtual void insertedIntoDocument();
+    virtual void removedFromDocument();
 
     String name() const;
     String value() const;
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLTableElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLTableElement.cpp
index 92c7580..b589fe8 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLTableElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLTableElement.cpp
@@ -176,7 +176,7 @@ void WMLTableElement::joinSuperflousColumns(Vector<WMLElement*>& columnElements,
     ASSERT(lastColumn);
 
     // Merge superflous columns into a single one
-    RefPtr<WMLElement> newCell = new WMLElement(tdTag, document());
+    RefPtr<WMLElement> newCell = WMLElement::create(tdTag, document());
     transferAllChildrenOfElementToTargetElement(lastColumn, newCell.get(), 0);
 
     ExceptionCode ec = 0;
@@ -213,7 +213,7 @@ void WMLTableElement::padWithEmptyColumns(Vector<WMLElement*>& columnElements, W
     ExceptionCode ec = 0;
 
     for (unsigned i = columnElements.size(); i < m_columns; ++i) {
-        RefPtr<WMLElement> newCell = new WMLElement(tdTag, document());
+        RefPtr<WMLElement> newCell = WMLElement::create(tdTag, document());
         rowElement->appendChild(newCell.release(), ec);
         ASSERT(ec == 0);
     }
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLTagNames.in b/src/3rdparty/webkit/WebCore/wml/WMLTagNames.in
index fd7c762..1c24f42 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLTagNames.in
+++ b/src/3rdparty/webkit/WebCore/wml/WMLTagNames.in
@@ -2,34 +2,34 @@ namespace="WML"
 namespaceURI="http://www.wapforum.org/DTD/wml_1.1.xml"
 guardFactoryWith="ENABLE(WML)"
 
-a
-access
-anchor
-br interfaceName=WMLBRElement
-card
-do
-fieldset interfaceName=WMLFieldSetElement
-go
+a createWithNew
+access createWithNew
+anchor createWithNew
+br interfaceName=WMLBRElement, createWithNew
+card createWithNew
+do createWithNew
+fieldset interfaceName=WMLFieldSetElement, createWithNew
+go createWithNew
 head interfaceName=WMLElement
-img interfaceName=WMLImageElement
-input
+img interfaceName=WMLImageElement, createWithNew
+input createWithNew
 #if 0
 # Note: 'insertedLegend' is not an official WML element - internal purpose only!
 #endif
-insertedLegend interfaceName=WMLInsertedLegendElement
-meta
-noop
-onevent interfaceName=WMLOnEventElement
-optgroup interfaceName=WMLOptGroupElement
-option
-p
-postfield
-prev
-refresh
-select
-setvar
-table
+insertedLegend interfaceName=WMLInsertedLegendElement, createWithNew
+meta createWithNew
+noop createWithNew
+onevent interfaceName=WMLOnEventElement, createWithNew
+optgroup interfaceName=WMLOptGroupElement, createWithNew
+option createWithNew
+p createWithNew
+postfield createWithNew
+prev createWithNew
+refresh createWithNew
+select createWithNew
+setvar createWithNew
+table createWithNew
 td interfaceName=WMLElement
-template
-timer
+template createWithNew
+timer createWithNew
 tr interfaceName=WMLElement
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLTaskElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLTaskElement.cpp
index 1add1da..d49a03e 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLTaskElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLTaskElement.cpp
@@ -48,8 +48,6 @@ void WMLTaskElement::insertedIntoDocument()
     WMLElement::insertedIntoDocument();
 
     Node* parent = parentNode();
-    ASSERT(parent);
-
     if (!parent || !parent->isWMLElement())
         return;
 
@@ -61,10 +59,32 @@ void WMLTaskElement::insertedIntoDocument()
         static_cast<WMLOnEventElement*>(parent)->registerTask(this);
 }
 
+void WMLTaskElement::removedFromDocument()
+{
+    Node* parent = parentNode();
+    if (parent && parent->isWMLElement()) {
+        if (parent->hasTagName(anchorTag))
+            static_cast<WMLAnchorElement*>(parent)->deregisterTask(this);
+        else if (parent->hasTagName(doTag))
+            static_cast<WMLDoElement*>(parent)->deregisterTask(this);
+        else if (parent->hasTagName(oneventTag))
+            static_cast<WMLOnEventElement*>(parent)->deregisterTask(this);
+    }
+
+    WMLElement::removedFromDocument();
+}
+
 void WMLTaskElement::registerVariableSetter(WMLSetvarElement* element)
 {
-    ASSERT(element);
-    m_variableSetterElements.add(element);
+    ASSERT(m_variableSetterElements.find(element) == WTF::notFound);
+    m_variableSetterElements.append(element);
+}
+
+void WMLTaskElement::deregisterVariableSetter(WMLSetvarElement* element)
+{
+    size_t position = m_variableSetterElements.find(element);
+    ASSERT(position != WTF::notFound);
+    m_variableSetterElements.remove(position);
 }
 
 void WMLTaskElement::storeVariableState(WMLPageState* pageState)
@@ -73,19 +93,23 @@ void WMLTaskElement::storeVariableState(WMLPageState* pageState)
         return;
 
     WMLVariableMap variables;
-    HashSet<WMLSetvarElement*>::iterator it = m_variableSetterElements.begin();
-    HashSet<WMLSetvarElement*>::iterator end = m_variableSetterElements.end();
+    Vector<WMLSetvarElement*>::iterator it = m_variableSetterElements.begin();
+    Vector<WMLSetvarElement*>::iterator end = m_variableSetterElements.end();
 
     for (; it != end; ++it) {
         WMLSetvarElement* setterElement = (*it);
-        if (setterElement->name().isEmpty())
+
+        String name = setterElement->name();
+        if (name.isEmpty())
             continue;
 
-        variables.set(setterElement->name(), setterElement->value());
-    }
+        String value = setterElement->value();
+        variables.set(name, value);
 
-    if (variables.isEmpty())
-        return;
+        // The next setvar element may depend on this variable value. It's safe to store the current
+        // name value pair in the page state, as the whole page state is replaced soon by this new map
+        pageState->storeVariable(name, value);
+    }
 
     pageState->storeVariables(variables);
 }
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLTaskElement.h b/src/3rdparty/webkit/WebCore/wml/WMLTaskElement.h
index f28571a..b813285 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLTaskElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLTaskElement.h
@@ -24,7 +24,7 @@
 #if ENABLE(WML)
 #include "WMLElement.h"
 
-#include <wtf/HashSet.h>
+#include <wtf/Vector.h>
 
 namespace WebCore {
 
@@ -39,15 +39,17 @@ public:
     virtual bool isWMLTaskElement() const { return true; }
 
     virtual void insertedIntoDocument();
-    virtual void executeTask(Event*) = 0;
+    virtual void removedFromDocument();
+    virtual void executeTask() = 0;
 
     void registerVariableSetter(WMLSetvarElement*);
+    void deregisterVariableSetter(WMLSetvarElement*);
 
 protected:
     void storeVariableState(WMLPageState*);
 
 private:
-    HashSet<WMLSetvarElement*> m_variableSetterElements;
+    Vector<WMLSetvarElement*> m_variableSetterElements;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.cpp
index a41daf5..c6476f7 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.cpp
@@ -59,8 +59,6 @@ void WMLTimerElement::insertedIntoDocument()
         return;
 
     Node* parent = parentNode();
-    ASSERT(parent);
-
     if (!parent || !parent->isWMLElement())
         return;
 
@@ -70,6 +68,17 @@ void WMLTimerElement::insertedIntoDocument()
     }
 }
 
+void WMLTimerElement::removedFromDocument()
+{
+    Node* parent = parentNode();
+    if (parent && parent->isWMLElement() && parent->hasTagName(cardTag)) {
+        m_card->setIntrinsicEventTimer(0);
+        m_card = 0;
+    }
+
+    WMLElement::removedFromDocument();
+}
+
 void WMLTimerElement::timerFired(Timer<WMLTimerElement>*)
 {
     if (!m_card)
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.h b/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.h
index b367eb9..8402027 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.h
@@ -35,6 +35,7 @@ public:
 
     virtual void parseMappedAttribute(MappedAttribute*);
     virtual void insertedIntoDocument();
+    virtual void removedFromDocument();
 
     void timerFired(Timer<WMLTimerElement>*);
 
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLVariables.cpp b/src/3rdparty/webkit/WebCore/wml/WMLVariables.cpp
index f206234..f48aa1c 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLVariables.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLVariables.cpp
@@ -117,8 +117,6 @@ bool containsVariableReference(const String& text, bool& isValid)
                 if (!isValidVariableNameCharacter(text[nameEndPosition]))
                     break;
             }
-
-            --nameEndPosition;
         }
 
         if (nameEndPosition < nameStartPosition) {
@@ -127,7 +125,7 @@ bool containsVariableReference(const String& text, bool& isValid)
             break;
         }
     
-        // Eventually split of conversion string, and check it's syntax afterwards
+        // Eventually split of conversion string, and check its syntax afterwards
         String conversionString;
         String variableName = text.substring(nameStartPosition, nameEndPosition - nameStartPosition);
 
diff --git a/src/3rdparty/webkit/WebCore/workers/AbstractWorker.cpp b/src/3rdparty/webkit/WebCore/workers/AbstractWorker.cpp
index 7cb2c11..d28b011 100644
--- a/src/3rdparty/webkit/WebCore/workers/AbstractWorker.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/AbstractWorker.cpp
@@ -38,6 +38,8 @@
 #include "Event.h"
 #include "EventException.h"
 #include "EventNames.h"
+#include "ScriptExecutionContext.h"
+#include "SecurityOrigin.h"
 
 namespace WebCore {
 
@@ -60,7 +62,7 @@ void AbstractWorker::addEventListener(const AtomicString& eventType, PassRefPtr<
     } else {
         ListenerVector& listeners = iter->second;
         for (ListenerVector::iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-            if (*listenerIter == eventListener)
+            if (**listenerIter == *eventListener)
                 return;
         }
 
@@ -77,7 +79,7 @@ void AbstractWorker::removeEventListener(const AtomicString& eventType, EventLis
 
     ListenerVector& listeners = iter->second;
     for (ListenerVector::const_iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-        if (*listenerIter == eventListener) {
+        if (**listenerIter == *eventListener) {
             listeners.remove(listenerIter - listeners.begin());
             return;
         }
@@ -128,12 +130,33 @@ bool AbstractWorker::dispatchScriptErrorEvent(const String& message, const Strin
     }
 
     ExceptionCode ec = 0;
-    dispatchEvent(event.release(), ec);
+    handled = !dispatchEvent(event.release(), ec);
     ASSERT(!ec);
 
     return handled;
 }
 
+KURL AbstractWorker::resolveURL(const String& url, ExceptionCode& ec)
+{
+    if (url.isEmpty()) {
+        ec = SYNTAX_ERR;
+        return KURL();
+    }
+
+    // FIXME: This should use the dynamic global scope (bug #27887)
+    KURL scriptURL = scriptExecutionContext()->completeURL(url);
+    if (!scriptURL.isValid()) {
+        ec = SYNTAX_ERR;
+        return KURL();
+    }
+
+    if (!scriptExecutionContext()->securityOrigin()->canAccess(SecurityOrigin::create(scriptURL).get())) {
+        ec = SECURITY_ERR;
+        return KURL();
+    }
+    return scriptURL;
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/workers/AbstractWorker.h b/src/3rdparty/webkit/WebCore/workers/AbstractWorker.h
index 28cc50d..a882542 100644
--- a/src/3rdparty/webkit/WebCore/workers/AbstractWorker.h
+++ b/src/3rdparty/webkit/WebCore/workers/AbstractWorker.h
@@ -43,6 +43,7 @@
 
 namespace WebCore {
 
+    class KURL;
     class ScriptExecutionContext;
 
     class AbstractWorker : public RefCounted<AbstractWorker>, public ActiveDOMObject, public EventTarget {
@@ -70,8 +71,11 @@ namespace WebCore {
         AbstractWorker(ScriptExecutionContext*);
         virtual ~AbstractWorker();
 
-    private:
+    protected:
+        // Helper function that converts a URL to an absolute URL and checks the result for validity.
+        KURL resolveURL(const String& url, ExceptionCode& ec);
 
+    private:
         virtual void refEventTarget() { ref(); }
         virtual void derefEventTarget() { deref(); }
 
diff --git a/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.cpp b/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.cpp
index 97c1581..8c5ee47 100644
--- a/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.cpp
@@ -34,56 +34,48 @@
 
 #include "DedicatedWorkerContext.h"
 
+#include "DedicatedWorkerThread.h"
 #include "DOMWindow.h"
 #include "MessageEvent.h"
 #include "WorkerObjectProxy.h"
-#include "WorkerThread.h"
 
 namespace WebCore {
 
-DedicatedWorkerContext::DedicatedWorkerContext(const KURL& url, const String& userAgent, WorkerThread* thread)
+DedicatedWorkerContext::DedicatedWorkerContext(const KURL& url, const String& userAgent, DedicatedWorkerThread* thread)
     : WorkerContext(url, userAgent, thread)
 {
 }
 
-DedicatedWorkerContext::~DedicatedWorkerContext()
-{
-    ASSERT(currentThread() == thread()->threadID());
-    // Notify parent worker we are going away. This can free the WorkerThread object, so do not access it after this.
-    thread()->workerObjectProxy().workerContextDestroyed();
-}
-
-void DedicatedWorkerContext::reportException(const String& errorMessage, int lineNumber, const String& sourceURL)
+// FIXME: remove this when we update the ObjC bindings (bug #28774).
+void DedicatedWorkerContext::postMessage(const String& message, MessagePort* port, ExceptionCode& ec)
 {
-    bool errorHandled = false;
-    if (onerror())
-        errorHandled = onerror()->reportError(errorMessage, sourceURL, lineNumber);
-
-    if (!errorHandled)
-        thread()->workerObjectProxy().postExceptionToWorkerObject(errorMessage, lineNumber, sourceURL);
+    MessagePortArray ports;
+    if (port)
+        ports.append(port);
+    postMessage(message, &ports, ec);
 }
 
 void DedicatedWorkerContext::postMessage(const String& message, ExceptionCode& ec)
 {
-    postMessage(message, 0, ec);
+    postMessage(message, static_cast<MessagePortArray*>(0), ec);
 }
 
-void DedicatedWorkerContext::postMessage(const String& message, MessagePort* port, ExceptionCode& ec)
+void DedicatedWorkerContext::postMessage(const String& message, const MessagePortArray* ports, ExceptionCode& ec)
 {
     if (isClosing())
         return;
     // Disentangle the port in preparation for sending it to the remote context.
-    OwnPtr<MessagePortChannel> channel = port ? port->disentangle(ec) : 0;
+    OwnPtr<MessagePortChannelArray> channels = MessagePort::disentanglePorts(ports, ec);
     if (ec)
         return;
-    thread()->workerObjectProxy().postMessageToWorkerObject(message, channel.release());
+    thread()->workerObjectProxy().postMessageToWorkerObject(message, channels.release());
 }
 
-void DedicatedWorkerContext::dispatchMessage(const String& message, PassRefPtr<MessagePort> port)
+void DedicatedWorkerContext::dispatchMessage(const String& message, PassOwnPtr<MessagePortArray> ports)
 {
     // Since close() stops the thread event loop, this should not ever get called while closing.
     ASSERT(!isClosing());
-    RefPtr<Event> evt = MessageEvent::create(message, "", "", 0, port);
+    RefPtr<Event> evt = MessageEvent::create(message, "", "", 0, ports);
 
     if (m_onmessageListener.get()) {
         evt->setTarget(this);
@@ -96,6 +88,17 @@ void DedicatedWorkerContext::dispatchMessage(const String& message, PassRefPtr<M
     ASSERT(!ec);
 }
 
+void DedicatedWorkerContext::importScripts(const Vector<String>& urls, const String& callerURL, int callerLine, ExceptionCode& ec)
+{
+    Base::importScripts(urls, callerURL, callerLine, ec);
+    thread()->workerObjectProxy().reportPendingActivity(hasPendingActivity());
+}
+
+DedicatedWorkerThread* DedicatedWorkerContext::thread()
+{
+    return static_cast<DedicatedWorkerThread*>(Base::thread());
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.h b/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.h
index e37c13f..3bc4aee 100644
--- a/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.h
+++ b/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.h
@@ -31,34 +31,47 @@
 #ifndef DedicatedWorkerContext_h
 #define DedicatedWorkerContext_h
 
+#if ENABLE(WORKERS)
+
+#include "MessagePort.h"
 #include "WorkerContext.h"
 
 namespace WebCore {
 
+    class DedicatedWorkerThread;
+
     class DedicatedWorkerContext : public WorkerContext {
     public:
-        static PassRefPtr<DedicatedWorkerContext> create(const KURL& url, const String& userAgent, WorkerThread* thread)
+        typedef WorkerContext Base;
+        static PassRefPtr<DedicatedWorkerContext> create(const KURL& url, const String& userAgent, DedicatedWorkerThread* thread)
         {
             return adoptRef(new DedicatedWorkerContext(url, userAgent, thread));
         }
-        virtual ~DedicatedWorkerContext();
 
-        virtual void reportException(const String& errorMessage, int lineNumber, const String& sourceURL);
+        virtual bool isDedicatedWorkerContext() const { return true; }
+
+        // Overridden to allow us to check our pending activity after executing imported script.
+        virtual void importScripts(const Vector<String>& urls, const String& callerURL, int callerLine, ExceptionCode&);
 
         // EventTarget
         virtual DedicatedWorkerContext* toDedicatedWorkerContext() { return this; }
         void postMessage(const String&, ExceptionCode&);
+        void postMessage(const String&, const MessagePortArray*, ExceptionCode&);
+        // FIXME: remove this when we update the ObjC bindings (bug #28774).
         void postMessage(const String&, MessagePort*, ExceptionCode&);
         void setOnmessage(PassRefPtr<EventListener> eventListener) { m_onmessageListener = eventListener; }
         EventListener* onmessage() const { return m_onmessageListener.get(); }
 
-        void dispatchMessage(const String&, PassRefPtr<MessagePort>);
+        void dispatchMessage(const String&, PassOwnPtr<MessagePortArray>);
 
+        DedicatedWorkerThread* thread();
     private:
-        DedicatedWorkerContext(const KURL&, const String&, WorkerThread*);
+        DedicatedWorkerContext(const KURL&, const String&, DedicatedWorkerThread*);
         RefPtr<EventListener> m_onmessageListener;
     };
 
 } // namespace WebCore
 
+#endif // ENABLE(WORKERS)
+
 #endif // DedicatedWorkerContext_h
diff --git a/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.idl b/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.idl
index ebbee33..ef3ebfe 100644
--- a/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.idl
+++ b/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerContext.idl
@@ -39,8 +39,14 @@ module threads {
         NoStaticTables
     ] DedicatedWorkerContext : WorkerContext {
 
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
+        [Custom] void postMessage(in DOMString message, in [Optional] Array messagePorts)
+            raises(DOMException);
+#else
+        // There's no good way to expose an array via the ObjC bindings, so for now just allow passing in a single port.
         void postMessage(in DOMString message, in [Optional] MessagePort messagePort)
             raises(DOMException);
+#endif
                  attribute EventListener onmessage;
 
     };
diff --git a/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerThread.cpp b/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerThread.cpp
new file mode 100644
index 0000000..d4789a1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerThread.cpp
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WORKERS)
+
+#include "DedicatedWorkerThread.h"
+
+#include "DedicatedWorkerContext.h"
+#include "WorkerObjectProxy.h"
+
+namespace WebCore {
+
+PassRefPtr<DedicatedWorkerThread> DedicatedWorkerThread::create(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerObjectProxy& workerObjectProxy)
+{
+    return adoptRef(new DedicatedWorkerThread(scriptURL, userAgent, sourceCode, workerLoaderProxy, workerObjectProxy));
+}
+
+DedicatedWorkerThread::DedicatedWorkerThread(const KURL& url, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerObjectProxy& workerObjectProxy)
+    : WorkerThread(url, userAgent, sourceCode, workerLoaderProxy, workerObjectProxy)
+    , m_workerObjectProxy(workerObjectProxy)
+{
+}
+
+DedicatedWorkerThread::~DedicatedWorkerThread()
+{
+}
+
+PassRefPtr<WorkerContext> DedicatedWorkerThread::createWorkerContext(const KURL& url, const String& userAgent)
+{
+    return DedicatedWorkerContext::create(url, userAgent, this);
+}
+
+void DedicatedWorkerThread::runEventLoop()
+{
+    // Notify the parent object of our current active state before calling the superclass to run the event loop.
+    m_workerObjectProxy.reportPendingActivity(workerContext()->hasPendingActivity());
+    WorkerThread::runEventLoop();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerThread.h b/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerThread.h
new file mode 100644
index 0000000..225243b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/workers/DedicatedWorkerThread.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef DedicatedWorkerThread_h
+#define DedicatedWorkerThread_h
+
+#if ENABLE(WORKERS)
+
+#include "WorkerThread.h"
+
+namespace WebCore {
+
+    class WorkerObjectProxy;
+
+    class DedicatedWorkerThread : public WorkerThread {
+    public:
+        static PassRefPtr<DedicatedWorkerThread> create(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerLoaderProxy&, WorkerObjectProxy&);
+        WorkerObjectProxy& workerObjectProxy() const { return m_workerObjectProxy; }
+        ~DedicatedWorkerThread();
+
+    protected:
+        virtual PassRefPtr<WorkerContext> createWorkerContext(const KURL& url, const String& userAgent);
+        virtual void runEventLoop();
+
+    private:
+        DedicatedWorkerThread(const KURL&, const String& userAgent, const String& sourceCode, WorkerLoaderProxy&, WorkerObjectProxy&);
+
+        WorkerObjectProxy& m_workerObjectProxy;
+    };
+} // namespace WebCore
+
+#endif // ENABLE(WORKERS)
+
+#endif // DedicatedWorkerThread_h
diff --git a/src/3rdparty/webkit/WebCore/workers/DefaultSharedWorkerRepository.cpp b/src/3rdparty/webkit/WebCore/workers/DefaultSharedWorkerRepository.cpp
new file mode 100644
index 0000000..e955f24
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/workers/DefaultSharedWorkerRepository.cpp
@@ -0,0 +1,387 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(SHARED_WORKERS)
+
+#include "DefaultSharedWorkerRepository.h"
+
+#include "ActiveDOMObject.h"
+#include "Document.h"
+#include "GenericWorkerTask.h"
+#include "MessagePort.h"
+#include "NotImplemented.h"
+#include "PlatformString.h"
+#include "SecurityOrigin.h"
+#include "SecurityOriginHash.h"
+#include "SharedWorker.h"
+#include "SharedWorkerContext.h"
+#include "SharedWorkerRepository.h"
+#include "SharedWorkerThread.h"
+#include "WorkerLoaderProxy.h"
+#include "WorkerReportingProxy.h"
+#include "WorkerScriptLoader.h"
+#include "WorkerScriptLoaderClient.h"
+#include <wtf/HashSet.h>
+#include <wtf/Threading.h>
+
+namespace WebCore {
+
+class SharedWorkerProxy : public ThreadSafeShared<SharedWorkerProxy>, public WorkerLoaderProxy, public WorkerReportingProxy {
+public:
+    static PassRefPtr<SharedWorkerProxy> create(const String& name, const KURL& url, PassRefPtr<SecurityOrigin> origin) { return adoptRef(new SharedWorkerProxy(name, url, origin)); }
+
+    void setThread(PassRefPtr<SharedWorkerThread> thread) { m_thread = thread; }
+    SharedWorkerThread* thread() { return m_thread.get(); }
+    bool isClosing() const { return m_closing; }
+    KURL url() const { return m_url.copy(); }
+    String name() const { return m_name.copy(); }
+    bool matches(const String& name, PassRefPtr<SecurityOrigin> origin) const { return name == m_name && origin->equal(m_origin.get()); }
+
+    // WorkerLoaderProxy
+    virtual void postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task>);
+    virtual void postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task>, const String&);
+
+    // WorkerReportingProxy
+    virtual void postExceptionToWorkerObject(const String& errorMessage, int lineNumber, const String& sourceURL);
+    virtual void postConsoleMessageToWorkerObject(MessageDestination, MessageSource, MessageType, MessageLevel, const String& message, int lineNumber, const String& sourceURL);
+    virtual void workerContextClosed();
+    virtual void workerContextDestroyed();
+
+    // Updates the list of the worker's documents, per section 4.5 of the WebWorkers spec.
+    void addToWorkerDocuments(ScriptExecutionContext*);
+
+    bool isInWorkerDocuments(Document* document) { return m_workerDocuments.contains(document); }
+
+    // Removes a detached document from the list of worker's documents. May set the closing flag if this is the last document in the list.
+    void documentDetached(Document*);
+
+private:
+    SharedWorkerProxy(const String& name, const KURL&, PassRefPtr<SecurityOrigin>);
+    void close();
+
+    bool m_closing;
+    String m_name;
+    KURL m_url;
+    // The thread is freed when the proxy is destroyed, so we need to make sure that the proxy stays around until the SharedWorkerContext exits.
+    RefPtr<SharedWorkerThread> m_thread;
+    RefPtr<SecurityOrigin> m_origin;
+    HashSet<Document*> m_workerDocuments;
+    // Ensures exclusive access to the worker documents. Must not grab any other locks (such as the DefaultSharedWorkerRepository lock) while holding this one.
+    Mutex m_workerDocumentsLock;
+};
+
+SharedWorkerProxy::SharedWorkerProxy(const String& name, const KURL& url, PassRefPtr<SecurityOrigin> origin)
+    : m_closing(false)
+    , m_name(name.copy())
+    , m_url(url.copy())
+    , m_origin(origin)
+{
+    // We should be the sole owner of the SecurityOrigin, as we will free it on another thread.
+    ASSERT(m_origin->hasOneRef());
+}
+
+void SharedWorkerProxy::postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task> task)
+{
+    MutexLocker lock(m_workerDocumentsLock);
+
+    if (isClosing())
+        return;
+
+    // If we aren't closing, then we must have at least one document.
+    ASSERT(m_workerDocuments.size());
+
+    // Just pick an arbitrary active document from the HashSet and pass load requests to it.
+    // FIXME: Do we need to deal with the case where the user closes the document mid-load, via a shadow document or some other solution?
+    Document* document = *(m_workerDocuments.begin());
+    document->postTask(task);
+}
+
+void SharedWorkerProxy::postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
+{
+    if (isClosing())
+        return;
+    ASSERT(m_thread);
+    m_thread->runLoop().postTaskForMode(task, mode);
+}
+
+static void postExceptionTask(ScriptExecutionContext* context, const String& errorMessage, int lineNumber, const String& sourceURL)
+{
+    context->reportException(errorMessage, lineNumber, sourceURL);
+}
+
+void SharedWorkerProxy::postExceptionToWorkerObject(const String& errorMessage, int lineNumber, const String& sourceURL)
+{
+    MutexLocker lock(m_workerDocumentsLock);
+    for (HashSet<Document*>::iterator iter = m_workerDocuments.begin(); iter != m_workerDocuments.end(); ++iter)
+        (*iter)->postTask(createCallbackTask(&postExceptionTask, errorMessage, lineNumber, sourceURL));
+}
+
+static void postConsoleMessageTask(ScriptExecutionContext* document, MessageDestination destination, MessageSource source, MessageType type, MessageLevel level, const String& message, unsigned lineNumber, const String& sourceURL)
+{
+    document->addMessage(destination, source, type, level, message, lineNumber, sourceURL);
+}
+
+void SharedWorkerProxy::postConsoleMessageToWorkerObject(MessageDestination destination, MessageSource source, MessageType type, MessageLevel level, const String& message, int lineNumber, const String& sourceURL)
+{
+    MutexLocker lock(m_workerDocumentsLock);
+    for (HashSet<Document*>::iterator iter = m_workerDocuments.begin(); iter != m_workerDocuments.end(); ++iter)
+        (*iter)->postTask(createCallbackTask(&postConsoleMessageTask, destination, source, type, level, message, lineNumber, sourceURL));
+}
+
+void SharedWorkerProxy::workerContextClosed()
+{
+    if (isClosing())
+        return;
+    close();
+}
+
+void SharedWorkerProxy::workerContextDestroyed()
+{
+    // The proxy may be freed by this call, so do not reference it any further.
+    DefaultSharedWorkerRepository::instance().removeProxy(this);
+}
+
+void SharedWorkerProxy::addToWorkerDocuments(ScriptExecutionContext* context)
+{
+    // Nested workers are not yet supported, so passed-in context should always be a Document.
+    ASSERT(context->isDocument());
+    ASSERT(!isClosing());
+    MutexLocker lock(m_workerDocumentsLock);
+    Document* document = static_cast<Document*>(context);
+    m_workerDocuments.add(document);
+}
+
+void SharedWorkerProxy::documentDetached(Document* document)
+{
+    if (isClosing())
+        return;
+    // Remove the document from our set (if it's there) and if that was the last document in the set, mark the proxy as closed.
+    MutexLocker lock(m_workerDocumentsLock);
+    m_workerDocuments.remove(document);
+    if (!m_workerDocuments.size())
+        close();
+}
+
+void SharedWorkerProxy::close()
+{
+    ASSERT(!isClosing());
+    m_closing = true;
+    // Stop the worker thread - the proxy will stay around until we get workerThreadExited() notification.
+    if (m_thread)
+        m_thread->stop();
+}
+
+class SharedWorkerConnectTask : public ScriptExecutionContext::Task {
+public:
+    static PassRefPtr<SharedWorkerConnectTask> create(PassOwnPtr<MessagePortChannel> channel)
+    {
+        return adoptRef(new SharedWorkerConnectTask(channel));
+    }
+
+private:
+    SharedWorkerConnectTask(PassOwnPtr<MessagePortChannel> channel)
+        : m_channel(channel)
+    {
+    }
+
+    virtual void performTask(ScriptExecutionContext* scriptContext)
+    {
+        RefPtr<MessagePort> port = MessagePort::create(*scriptContext);
+        port->entangle(m_channel.release());
+        ASSERT(scriptContext->isWorkerContext());
+        WorkerContext* workerContext = static_cast<WorkerContext*>(scriptContext);
+        ASSERT(workerContext->isSharedWorkerContext());
+        workerContext->toSharedWorkerContext()->dispatchConnect(port);
+    }
+
+    OwnPtr<MessagePortChannel> m_channel;
+};
+
+// Loads the script on behalf of a worker.
+class SharedWorkerScriptLoader : public RefCounted<SharedWorkerScriptLoader>, public ActiveDOMObject, private WorkerScriptLoaderClient {
+public:
+    SharedWorkerScriptLoader(PassRefPtr<SharedWorker>, PassOwnPtr<MessagePortChannel>, PassRefPtr<SharedWorkerProxy>);
+    void load(const KURL&);
+
+private:
+    // WorkerScriptLoaderClient callback
+    virtual void notifyFinished();
+
+    RefPtr<SharedWorker> m_worker;
+    OwnPtr<MessagePortChannel> m_port;
+    RefPtr<SharedWorkerProxy> m_proxy;
+    OwnPtr<WorkerScriptLoader> m_scriptLoader;
+};
+
+SharedWorkerScriptLoader::SharedWorkerScriptLoader(PassRefPtr<SharedWorker> worker, PassOwnPtr<MessagePortChannel> port, PassRefPtr<SharedWorkerProxy> proxy)
+    : ActiveDOMObject(worker->scriptExecutionContext(), this)
+    , m_worker(worker)
+    , m_port(port)
+    , m_proxy(proxy)
+{
+}
+
+void SharedWorkerScriptLoader::load(const KURL& url)
+{
+    // Mark this object as active for the duration of the load.
+    ASSERT(!hasPendingActivity());
+    m_scriptLoader = new WorkerScriptLoader();
+    m_scriptLoader->loadAsynchronously(scriptExecutionContext(), url, DenyCrossOriginRequests, this);
+
+    // Stay alive until the load finishes.
+    setPendingActivity(this);
+}
+
+void SharedWorkerScriptLoader::notifyFinished()
+{
+    // Hand off the just-loaded code to the repository to start up the worker thread.
+    if (m_scriptLoader->failed())
+        m_worker->dispatchLoadErrorEvent();
+    else
+        DefaultSharedWorkerRepository::instance().workerScriptLoaded(*m_proxy, scriptExecutionContext()->userAgent(m_scriptLoader->url()), m_scriptLoader->script(), m_port.release());
+
+    // This frees this object - must be the last action in this function.
+    unsetPendingActivity(this);
+}
+
+DefaultSharedWorkerRepository& DefaultSharedWorkerRepository::instance()
+{
+    AtomicallyInitializedStatic(DefaultSharedWorkerRepository*, instance = new DefaultSharedWorkerRepository);
+    return *instance;
+}
+
+void DefaultSharedWorkerRepository::workerScriptLoaded(SharedWorkerProxy& proxy, const String& userAgent, const String& workerScript, PassOwnPtr<MessagePortChannel> port)
+{
+    MutexLocker lock(m_lock);
+    if (proxy.isClosing())
+        return;
+
+    // Another loader may have already started up a thread for this proxy - if so, just send a connect to the pre-existing thread.
+    if (!proxy.thread()) {
+        RefPtr<SharedWorkerThread> thread = SharedWorkerThread::create(proxy.name(), proxy.url(), userAgent, workerScript, proxy, proxy);
+        proxy.setThread(thread);
+        thread->start();
+    }
+    proxy.thread()->runLoop().postTask(SharedWorkerConnectTask::create(port));
+}
+
+void SharedWorkerRepository::connect(PassRefPtr<SharedWorker> worker, PassOwnPtr<MessagePortChannel> port, const KURL& url, const String& name, ExceptionCode& ec)
+{
+    DefaultSharedWorkerRepository::instance().connectToWorker(worker, port, url, name, ec);
+}
+
+void SharedWorkerRepository::documentDetached(Document* document)
+{
+    DefaultSharedWorkerRepository::instance().documentDetached(document);
+}
+
+bool SharedWorkerRepository::hasSharedWorkers(Document* document)
+{
+    return DefaultSharedWorkerRepository::instance().hasSharedWorkers(document);
+}
+
+bool DefaultSharedWorkerRepository::hasSharedWorkers(Document* document)
+{
+    MutexLocker lock(m_lock);
+    for (unsigned i = 0; i < m_proxies.size(); i++) {
+        if (m_proxies[i]->isInWorkerDocuments(document))
+            return true;
+    }
+    return false;
+}
+
+void DefaultSharedWorkerRepository::removeProxy(SharedWorkerProxy* proxy)
+{
+    MutexLocker lock(m_lock);
+    for (unsigned i = 0; i < m_proxies.size(); i++) {
+        if (proxy == m_proxies[i].get()) {
+            m_proxies.remove(i);
+            return;
+        }
+    }
+}
+
+void DefaultSharedWorkerRepository::documentDetached(Document* document)
+{
+    MutexLocker lock(m_lock);
+    for (unsigned i = 0; i < m_proxies.size(); i++)
+        m_proxies[i]->documentDetached(document);
+}
+
+void DefaultSharedWorkerRepository::connectToWorker(PassRefPtr<SharedWorker> worker, PassOwnPtr<MessagePortChannel> port, const KURL& url, const String& name, ExceptionCode& ec)
+{
+    MutexLocker lock(m_lock);
+    ASSERT(worker->scriptExecutionContext()->securityOrigin()->canAccess(SecurityOrigin::create(url).get()));
+    // Fetch a proxy corresponding to this SharedWorker.
+    RefPtr<SharedWorkerProxy> proxy = getProxy(name, url);
+    proxy->addToWorkerDocuments(worker->scriptExecutionContext());
+    if (proxy->url() != url) {
+        // Proxy already existed under alternate URL - return an error.
+        ec = URL_MISMATCH_ERR;
+        return;
+    }
+    // If proxy is already running, just connect to it - otherwise, kick off a loader to load the script.
+    if (proxy->thread())
+        proxy->thread()->runLoop().postTask(SharedWorkerConnectTask::create(port));
+    else {
+        RefPtr<SharedWorkerScriptLoader> loader = adoptRef(new SharedWorkerScriptLoader(worker, port.release(), proxy.release()));
+        loader->load(url);
+    }
+}
+
+// Creates a new SharedWorkerProxy or returns an existing one from the repository. Must only be called while the repository mutex is held.
+PassRefPtr<SharedWorkerProxy> DefaultSharedWorkerRepository::getProxy(const String& name, const KURL& url)
+{
+    // Look for an existing worker, and create one if it doesn't exist.
+    // Items in the cache are freed on another thread, so copy the URL before creating the origin, to make sure no references to external strings linger.
+    RefPtr<SecurityOrigin> origin = SecurityOrigin::create(url.copy());
+    for (unsigned i = 0; i < m_proxies.size(); i++) {
+        if (!m_proxies[i]->isClosing() && m_proxies[i]->matches(name, origin))
+            return m_proxies[i];
+    }
+    // Proxy is not in the repository currently - create a new one.
+    RefPtr<SharedWorkerProxy> proxy = SharedWorkerProxy::create(name, url, origin.release());
+    m_proxies.append(proxy);
+    return proxy.release();
+}
+
+DefaultSharedWorkerRepository::DefaultSharedWorkerRepository()
+{
+}
+
+DefaultSharedWorkerRepository::~DefaultSharedWorkerRepository()
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SHARED_WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/workers/DefaultSharedWorkerRepository.h b/src/3rdparty/webkit/WebCore/workers/DefaultSharedWorkerRepository.h
new file mode 100644
index 0000000..c2eaff4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/workers/DefaultSharedWorkerRepository.h
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DefaultSharedWorkerRepository_h
+#define DefaultSharedWorkerRepository_h
+
+#if ENABLE(SHARED_WORKERS)
+
+#include "ExceptionCode.h"
+#include "StringHash.h"
+#include <wtf/HashMap.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Threading.h>
+
+namespace WebCore {
+
+    class Document;
+    class KURL;
+    class MessagePortChannel;
+    class ScriptExecutionContext;
+    class SharedWorker;
+    class SharedWorkerProxy;
+    class String;
+
+    // Platform-specific implementation of the SharedWorkerRepository static interface.
+    class DefaultSharedWorkerRepository : public Noncopyable {
+    public:
+        // Invoked once the worker script has been loaded to fire up the worker thread.
+        void workerScriptLoaded(SharedWorkerProxy&, const String& userAgent, const String& workerScript, PassOwnPtr<MessagePortChannel>);
+
+        // Internal implementation of SharedWorkerRepository::connect()
+        void connectToWorker(PassRefPtr<SharedWorker>, PassOwnPtr<MessagePortChannel>, const KURL&, const String& name, ExceptionCode&);
+
+        // Notification that a document has been detached.
+        void documentDetached(Document*);
+
+        // Removes the passed SharedWorkerProxy from the repository.
+        void removeProxy(SharedWorkerProxy*);
+
+        bool hasSharedWorkers(Document*);
+
+        static DefaultSharedWorkerRepository& instance();
+    private:
+        DefaultSharedWorkerRepository();
+        ~DefaultSharedWorkerRepository();
+
+        PassRefPtr<SharedWorkerProxy> getProxy(const String& name, const KURL&);
+        // Mutex used to protect internal data structures.
+        Mutex m_lock;
+
+        // List of shared workers. Expectation is that there will be a limited number of shared workers, and so tracking them in a Vector is more efficient than nested HashMaps.
+        typedef Vector<RefPtr<SharedWorkerProxy> > SharedWorkerProxyRepository;
+        SharedWorkerProxyRepository m_proxies;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(SHARED_WORKERS)
+
+#endif // DefaultSharedWorkerRepository_h
diff --git a/src/3rdparty/webkit/WebCore/workers/SharedWorker.cpp b/src/3rdparty/webkit/WebCore/workers/SharedWorker.cpp
index e1d30d3..71fcc68 100644
--- a/src/3rdparty/webkit/WebCore/workers/SharedWorker.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/SharedWorker.cpp
@@ -27,20 +27,32 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
+
 #include "config.h"
 
 #if ENABLE(SHARED_WORKERS)
 
 #include "SharedWorker.h"
 
+#include "KURL.h"
+#include "MessageChannel.h"
 #include "MessagePort.h"
+#include "SharedWorkerRepository.h"
 
 namespace WebCore {
 
-SharedWorker::SharedWorker(const String&, const String&, ScriptExecutionContext* context, ExceptionCode&)
+SharedWorker::SharedWorker(const String& url, const String& name, ScriptExecutionContext* context, ExceptionCode& ec)
     : AbstractWorker(context)
 {
-    // Placeholder - ultimately we'll look up the worker in the SharedWorkerRepository.
+    RefPtr<MessageChannel> channel = MessageChannel::create(scriptExecutionContext());
+    m_port = channel->port1();
+    OwnPtr<MessagePortChannel> remotePort = channel->port2()->disentangle(ec);
+    ASSERT(!ec);
+
+    KURL scriptUrl = resolveURL(url, ec);
+    if (ec)
+        return;
+    SharedWorkerRepository::connect(this, remotePort.release(), scriptUrl, name, ec);
 }
 
 SharedWorker::~SharedWorker()
diff --git a/src/3rdparty/webkit/WebCore/workers/SharedWorker.h b/src/3rdparty/webkit/WebCore/workers/SharedWorker.h
index 36c7d85..24aa02d 100644
--- a/src/3rdparty/webkit/WebCore/workers/SharedWorker.h
+++ b/src/3rdparty/webkit/WebCore/workers/SharedWorker.h
@@ -36,6 +36,7 @@
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 
+#if ENABLE(SHARED_WORKERS)
 
 namespace WebCore {
 
@@ -58,4 +59,6 @@ namespace WebCore {
 
 } // namespace WebCore
 
+#endif // ENABLE(SHARED_WORKERS)
+
 #endif // SharedWorker_h
diff --git a/src/3rdparty/webkit/WebCore/workers/SharedWorkerContext.cpp b/src/3rdparty/webkit/WebCore/workers/SharedWorkerContext.cpp
new file mode 100644
index 0000000..bebcc73
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/workers/SharedWorkerContext.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(SHARED_WORKERS)
+
+#include "SharedWorkerContext.h"
+
+#include "DOMWindow.h"
+#include "EventNames.h"
+#include "MessageEvent.h"
+#include "NotImplemented.h"
+#include "SharedWorkerThread.h"
+
+namespace WebCore {
+
+SharedWorkerContext::SharedWorkerContext(const String& name, const KURL& url, const String& userAgent, SharedWorkerThread* thread)
+    : WorkerContext(url, userAgent, thread)
+    , m_name(name)
+{
+}
+
+SharedWorkerContext::~SharedWorkerContext()
+{
+}
+
+void SharedWorkerContext::dispatchConnect(PassRefPtr<MessagePort> port)
+{
+    // Since close() stops the thread event loop, this should not ever get called while closing.
+    ASSERT(!isClosing());
+    // The connect event uses the MessageEvent interface, but has the name "connect".
+    OwnPtr<MessagePortArray> portArray(new MessagePortArray());
+    portArray->append(port);
+    RefPtr<Event> event = MessageEvent::create("", "", "", 0, portArray.release());
+    event->initEvent(eventNames().connectEvent, false, false);
+
+    if (m_onconnectListener.get()) {
+        event->setTarget(this);
+        event->setCurrentTarget(this);
+        m_onconnectListener->handleEvent(event.get(), false);
+    }
+
+    ExceptionCode ec = 0;
+    dispatchEvent(event.release(), ec);
+    ASSERT(!ec);
+}
+
+SharedWorkerThread* SharedWorkerContext::thread()
+{
+    return static_cast<SharedWorkerThread*>(Base::thread());
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SHARED_WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/workers/SharedWorkerContext.h b/src/3rdparty/webkit/WebCore/workers/SharedWorkerContext.h
new file mode 100644
index 0000000..d6956cd
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/workers/SharedWorkerContext.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SharedWorkerContext_h
+#define SharedWorkerContext_h
+
+#if ENABLE(SHARED_WORKERS)
+
+#include "WorkerContext.h"
+
+namespace WebCore {
+
+    class SharedWorkerThread;
+
+    class SharedWorkerContext : public WorkerContext {
+    public:
+        typedef WorkerContext Base;
+        static PassRefPtr<SharedWorkerContext> create(const String& name, const KURL& url, const String& userAgent, SharedWorkerThread* thread)
+        {
+            return adoptRef(new SharedWorkerContext(name, url, userAgent, thread));
+        }
+        virtual ~SharedWorkerContext();
+
+        virtual bool isSharedWorkerContext() const { return true; }
+
+        // EventTarget
+        virtual SharedWorkerContext* toSharedWorkerContext() { return this; }
+
+        // Setters/Getters for attributes in SharedWorkerContext.idl
+        void setOnconnect(PassRefPtr<EventListener> eventListener) { m_onconnectListener = eventListener; }
+        EventListener* onconnect() const { return m_onconnectListener.get(); }
+        String name() const { return m_name; }
+
+        void dispatchConnect(PassRefPtr<MessagePort>);
+
+        SharedWorkerThread* thread();
+    private:
+        SharedWorkerContext(const String& name, const KURL&, const String&, SharedWorkerThread*);
+        RefPtr<EventListener> m_onconnectListener;
+        String m_name;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(SHARED_WORKERS)
+
+#endif // SharedWorkerContext_h
diff --git a/src/3rdparty/webkit/WebCore/workers/SharedWorkerContext.idl b/src/3rdparty/webkit/WebCore/workers/SharedWorkerContext.idl
new file mode 100644
index 0000000..8e450e0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/workers/SharedWorkerContext.idl
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module threads {
+
+    interface [
+        Conditional=SHARED_WORKERS,
+        CustomMarkFunction,
+        ExtendsDOMGlobalObject,
+        IsWorkerContext,
+        GenerateNativeConverter,
+        NoStaticTables
+    ] SharedWorkerContext : WorkerContext {
+
+        readonly attribute DOMString name;
+                 attribute EventListener onconnect;
+
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/workers/SharedWorkerRepository.h b/src/3rdparty/webkit/WebCore/workers/SharedWorkerRepository.h
new file mode 100644
index 0000000..96d2fb1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/workers/SharedWorkerRepository.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SharedWorkerRepository_h
+#define SharedWorkerRepository_h
+
+#if ENABLE(SHARED_WORKERS)
+
+#include "ExceptionCode.h"
+#include <wtf/PassOwnPtr.h>
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+    class Document;
+    class KURL;
+    class MessagePortChannel;
+    class SharedWorker;
+    class String;
+
+    // Interface to a repository which manages references to the set of active shared workers.
+    class SharedWorkerRepository {
+    public:
+        // Connects the passed SharedWorker object with the specified worker thread, creating a new thread if necessary.
+        static void connect(PassRefPtr<SharedWorker>, PassOwnPtr<MessagePortChannel>, const KURL&, const String& name, ExceptionCode&);
+
+        // Invoked when a document has been detached.
+        static void documentDetached(Document*);
+
+        // Returns true if the passed document is associated with any SharedWorkers.
+        static bool hasSharedWorkers(Document*);
+    private:
+        SharedWorkerRepository() { }
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(SHARED_WORKERS)
+
+#endif // SharedWorkerRepository_h
diff --git a/src/3rdparty/webkit/WebCore/workers/SharedWorkerThread.cpp b/src/3rdparty/webkit/WebCore/workers/SharedWorkerThread.cpp
new file mode 100644
index 0000000..ded4834
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/workers/SharedWorkerThread.cpp
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(SHARED_WORKERS)
+
+#include "SharedWorkerThread.h"
+
+#include "SharedWorkerContext.h"
+
+namespace WebCore {
+
+PassRefPtr<SharedWorkerThread> SharedWorkerThread::create(const String& name, const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerReportingProxy& workerReportingProxy)
+{
+    return adoptRef(new SharedWorkerThread(name, scriptURL, userAgent, sourceCode, workerLoaderProxy, workerReportingProxy));
+}
+
+SharedWorkerThread::SharedWorkerThread(const String& name, const KURL& url, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerReportingProxy& workerReportingProxy)
+    : WorkerThread(url, userAgent, sourceCode, workerLoaderProxy, workerReportingProxy)
+    , m_name(name.copy())
+{
+}
+
+SharedWorkerThread::~SharedWorkerThread()
+{
+}
+
+PassRefPtr<WorkerContext> SharedWorkerThread::createWorkerContext(const KURL& url, const String& userAgent)
+{
+    return SharedWorkerContext::create(m_name, url, userAgent, this);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SHARED_WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/workers/SharedWorkerThread.h b/src/3rdparty/webkit/WebCore/workers/SharedWorkerThread.h
new file mode 100644
index 0000000..d96fd2a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/workers/SharedWorkerThread.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef SharedWorkerThread_h
+#define SharedWorkerThread_h
+
+#if ENABLE(SHARED_WORKERS)
+
+#include "WorkerThread.h"
+
+namespace WebCore {
+
+    class SharedWorkerThread : public WorkerThread {
+    public:
+        static PassRefPtr<SharedWorkerThread> create(const String& name, const KURL&, const String& userAgent, const String& sourceCode, WorkerLoaderProxy&, WorkerReportingProxy&);
+        ~SharedWorkerThread();
+
+    protected:
+        virtual PassRefPtr<WorkerContext> createWorkerContext(const KURL&, const String&);
+
+    private:
+        SharedWorkerThread(const String& name, const KURL&, const String& userAgent, const String& sourceCode, WorkerLoaderProxy&, WorkerReportingProxy&);
+
+        String m_name;
+    };
+} // namespace WebCore
+
+#endif // ENABLE(SHARED_WORKERS)
+
+#endif // SharedWorkerThread_h
diff --git a/src/3rdparty/webkit/WebCore/workers/Worker.cpp b/src/3rdparty/webkit/WebCore/workers/Worker.cpp
index 22c7d71..922cd33 100644
--- a/src/3rdparty/webkit/WebCore/workers/Worker.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/Worker.cpp
@@ -41,7 +41,6 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "MessageEvent.h"
-#include "SecurityOrigin.h"
 #include "TextEncoding.h"
 #include "WorkerContextProxy.h"
 #include "WorkerScriptLoader.h"
@@ -50,12 +49,16 @@
 
 namespace WebCore {
 
-Worker::Worker(const String& url, ScriptExecutionContext* context)
+Worker::Worker(const String& url, ScriptExecutionContext* context, ExceptionCode& ec)
     : AbstractWorker(context)
     , m_contextProxy(WorkerContextProxy::create(this))
 {
+    KURL scriptURL = resolveURL(url, ec);
+    if (ec)
+        return;
+
     m_scriptLoader = new WorkerScriptLoader();
-    m_scriptLoader->loadAsynchronously(scriptExecutionContext(), url, CompleteURL, DenyCrossOriginLoad, this);
+    m_scriptLoader->loadAsynchronously(scriptExecutionContext(), scriptURL, DenyCrossOriginRequests, this);
     setPendingActivity(this);  // The worker context does not exist while loading, so we must ensure that the worker object is not collected, as well as its event listeners.
 }
 
@@ -66,18 +69,27 @@ Worker::~Worker()
     m_contextProxy->workerObjectDestroyed();
 }
 
+// FIXME: remove this when we update the ObjC bindings (bug #28774).
+void Worker::postMessage(const String& message, MessagePort* port, ExceptionCode& ec)
+{
+    MessagePortArray ports;
+    if (port)
+        ports.append(port);
+    postMessage(message, &ports, ec);
+}
+
 void Worker::postMessage(const String& message, ExceptionCode& ec)
 {
-    postMessage(message, 0, ec);
+    postMessage(message, static_cast<MessagePortArray*>(0), ec);
 }
 
-void Worker::postMessage(const String& message, MessagePort* messagePort, ExceptionCode& ec)
+void Worker::postMessage(const String& message, const MessagePortArray* ports, ExceptionCode& ec)
 {
     // Disentangle the port in preparation for sending it to the remote context.
-    OwnPtr<MessagePortChannel> channel = messagePort ? messagePort->disentangle(ec) : PassOwnPtr<MessagePortChannel>(0);
+    OwnPtr<MessagePortChannelArray> channels = MessagePort::disentanglePorts(ports, ec);
     if (ec)
         return;
-    m_contextProxy->postMessageToWorkerContext(message, channel.release());
+    m_contextProxy->postMessageToWorkerContext(message, channels.release());
 }
 
 void Worker::terminate()
@@ -113,9 +125,9 @@ void Worker::notifyFinished()
     unsetPendingActivity(this);
 }
 
-void Worker::dispatchMessage(const String& message, PassRefPtr<MessagePort> port)
+void Worker::dispatchMessage(const String& message, PassOwnPtr<MessagePortArray> ports)
 {
-    RefPtr<Event> evt = MessageEvent::create(message, "", "", 0, port);
+    RefPtr<Event> evt = MessageEvent::create(message, "", "", 0, ports);
 
     if (m_onMessageListener.get()) {
         evt->setTarget(this);
diff --git a/src/3rdparty/webkit/WebCore/workers/Worker.h b/src/3rdparty/webkit/WebCore/workers/Worker.h
index 6b8ee63..6bc00c1 100644
--- a/src/3rdparty/webkit/WebCore/workers/Worker.h
+++ b/src/3rdparty/webkit/WebCore/workers/Worker.h
@@ -34,6 +34,7 @@
 #include "AtomicStringHash.h"
 #include "EventListener.h"
 #include "EventTarget.h"
+#include "MessagePort.h"
 #include "WorkerScriptLoaderClient.h"
 #include <wtf/OwnPtr.h>
 #include <wtf/PassRefPtr.h>
@@ -51,17 +52,19 @@ namespace WebCore {
 
     class Worker : public AbstractWorker, private WorkerScriptLoaderClient {
     public:
-        static PassRefPtr<Worker> create(const String& url, ScriptExecutionContext* context) { return adoptRef(new Worker(url, context)); }
+        static PassRefPtr<Worker> create(const String& url, ScriptExecutionContext* context, ExceptionCode& ec) { return adoptRef(new Worker(url, context, ec)); }
         ~Worker();
 
         virtual Worker* toWorker() { return this; }
 
         void postMessage(const String&, ExceptionCode&);
-        void postMessage(const String&, MessagePort*, ExceptionCode&);
+        void postMessage(const String&, const MessagePortArray*, ExceptionCode&);
+        // FIXME: remove this when we update the ObjC bindings (bug #28774).
+        void postMessage(const String& message, MessagePort*, ExceptionCode&);
 
         void terminate();
 
-        void dispatchMessage(const String&, PassRefPtr<MessagePort>);
+        void dispatchMessage(const String&, PassOwnPtr<MessagePortArray>);
         void dispatchErrorEvent();
 
         virtual bool canSuspend() const;
@@ -72,7 +75,7 @@ namespace WebCore {
         EventListener* onmessage() const { return m_onMessageListener.get(); }
 
     private:
-        Worker(const String&, ScriptExecutionContext*);
+        Worker(const String&, ScriptExecutionContext*, ExceptionCode&);
 
         virtual void notifyFinished();
 
diff --git a/src/3rdparty/webkit/WebCore/workers/Worker.idl b/src/3rdparty/webkit/WebCore/workers/Worker.idl
index e701523..3b4a3ff 100644
--- a/src/3rdparty/webkit/WebCore/workers/Worker.idl
+++ b/src/3rdparty/webkit/WebCore/workers/Worker.idl
@@ -34,8 +34,15 @@ module threads {
     ] Worker : AbstractWorker {
 
         attribute EventListener onmessage;
+
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
+        [Custom] void postMessage(in DOMString message, in [Optional] Array messagePorts)
+            raises(DOMException);
+#else
+        // There's no good way to expose an array via the ObjC bindings, so for now just allow passing in a single port.
         void postMessage(in DOMString message, in [Optional] MessagePort messagePort)
             raises(DOMException);
+#endif
 
         void terminate();
     };
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerContext.cpp b/src/3rdparty/webkit/WebCore/workers/WorkerContext.cpp
index 9d88b75..12620f4 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerContext.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerContext.cpp
@@ -50,6 +50,10 @@
 #include "XMLHttpRequestException.h"
 #include <wtf/RefPtr.h>
 
+#if ENABLE(NOTIFICATIONS)
+#include "NotificationCenter.h"
+#endif
+
 namespace WebCore {
 
 WorkerContext::WorkerContext(const KURL& url, const String& userAgent, WorkerThread* thread)
@@ -64,6 +68,12 @@ WorkerContext::WorkerContext(const KURL& url, const String& userAgent, WorkerThr
 
 WorkerContext::~WorkerContext()
 {
+    ASSERT(currentThread() == thread()->threadID());
+#if ENABLE(NOTIFICATIONS)
+    m_notifications.clear();
+#endif
+    // Notify proxy that we are going away. This can free the WorkerThread object, so do not access it after this.
+    thread()->workerReportingProxy().workerContextDestroyed();
 }
 
 ScriptExecutionContext* WorkerContext::scriptExecutionContext() const
@@ -109,7 +119,8 @@ void WorkerContext::close()
         return;
 
     m_closing = true;
-    m_thread->stop();
+    // Notify parent that this context is closed. Parent is responsible for calling WorkerThread::stop().
+    thread()->workerReportingProxy().workerContextClosed();
 }
 
 WorkerNavigator* WorkerContext::navigator() const
@@ -138,11 +149,6 @@ bool WorkerContext::hasPendingActivity() const
     return false;
 }
 
-void WorkerContext::addMessage(MessageDestination destination, MessageSource source, MessageType type, MessageLevel level, const String& message, unsigned lineNumber, const String& sourceURL)
-{
-    m_thread->workerObjectProxy().postConsoleMessageToWorkerObject(destination, source, type, level, message, lineNumber, sourceURL);
-}
-
 void WorkerContext::resourceRetrievedByXMLHttpRequest(unsigned long, const ScriptString&)
 {
     // FIXME: The implementation is pending the fixes in https://bugs.webkit.org/show_bug.cgi?id=23175
@@ -165,7 +171,7 @@ void WorkerContext::addEventListener(const AtomicString& eventType, PassRefPtr<E
     } else {
         ListenerVector& listeners = iter->second;
         for (ListenerVector::iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-            if (*listenerIter == eventListener)
+            if (**listenerIter == *eventListener)
                 return;
         }
         
@@ -182,7 +188,7 @@ void WorkerContext::removeEventListener(const AtomicString& eventType, EventList
     
     ListenerVector& listeners = iter->second;
     for (ListenerVector::const_iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-        if (*listenerIter == eventListener) {
+        if (**listenerIter == *eventListener) {
             listeners.remove(listenerIter - listeners.begin());
             return;
         }
@@ -233,6 +239,10 @@ void WorkerContext::clearInterval(int timeoutId)
 
 void WorkerContext::importScripts(const Vector<String>& urls, const String& callerURL, int callerLine, ExceptionCode& ec)
 {
+#if !ENABLE(INSPECTOR)
+    UNUSED_PARAM(callerURL);
+    UNUSED_PARAM(callerLine);
+#endif
     ec = 0;
     Vector<String>::const_iterator urlsEnd = urls.end();
     Vector<KURL> completedURLs;
@@ -244,12 +254,11 @@ void WorkerContext::importScripts(const Vector<String>& urls, const String& call
         }
         completedURLs.append(url);
     }
-    String securityOrigin = scriptExecutionContext()->securityOrigin()->toString();
     Vector<KURL>::const_iterator end = completedURLs.end();
 
     for (Vector<KURL>::const_iterator it = completedURLs.begin(); it != end; ++it) {
         WorkerScriptLoader scriptLoader;
-        scriptLoader.loadSynchronously(scriptExecutionContext(), *it, DoNotCompleteURL, AllowCrossOriginLoad);
+        scriptLoader.loadSynchronously(scriptExecutionContext(), *it, AllowCrossOriginRequests);
 
         // If the fetching attempt failed, throw a NETWORK_ERR exception and abort all these steps.
         if (scriptLoader.failed()) {
@@ -258,7 +267,9 @@ void WorkerContext::importScripts(const Vector<String>& urls, const String& call
         }
 
         scriptExecutionContext()->scriptImported(scriptLoader.identifier(), scriptLoader.script());
+#if ENABLE(INSPECTOR)
         scriptExecutionContext()->addMessage(InspectorControllerDestination, JSMessageSource, LogMessageType, LogMessageLevel, "Worker script imported: \"" + *it + "\".", callerLine, callerURL);
+#endif
 
         ScriptValue exception;
         m_script->evaluate(ScriptSourceCode(scriptLoader.script(), *it), &exception);
@@ -269,6 +280,30 @@ void WorkerContext::importScripts(const Vector<String>& urls, const String& call
     }
 }
 
+void WorkerContext::reportException(const String& errorMessage, int lineNumber, const String& sourceURL)
+{
+    bool errorHandled = false;
+    if (onerror())
+        errorHandled = onerror()->reportError(errorMessage, sourceURL, lineNumber);
+
+    if (!errorHandled)
+        thread()->workerReportingProxy().postExceptionToWorkerObject(errorMessage, lineNumber, sourceURL);
+}
+
+void WorkerContext::addMessage(MessageDestination destination, MessageSource source, MessageType type, MessageLevel level, const String& message, unsigned lineNumber, const String& sourceURL)
+{
+    thread()->workerReportingProxy().postConsoleMessageToWorkerObject(destination, source, type, level, message, lineNumber, sourceURL);
+}
+
+#if ENABLE(NOTIFICATIONS)
+NotificationCenter* WorkerContext::webkitNotifications() const
+{
+    if (!m_notifications)
+        m_notifications = NotificationCenter::create(scriptExecutionContext(), m_thread->getNotificationPresenter());
+    return m_notifications.get();
+}
+#endif
+
 } // namespace WebCore
 
 #endif // ENABLE(WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerContext.h b/src/3rdparty/webkit/WebCore/workers/WorkerContext.h
index 266553a..a3c3820 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerContext.h
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerContext.h
@@ -41,6 +41,7 @@
 
 namespace WebCore {
 
+    class NotificationCenter;
     class ScheduledAction;
     class WorkerLocation;
     class WorkerNavigator;
@@ -48,13 +49,15 @@ namespace WebCore {
 
     class WorkerContext : public RefCounted<WorkerContext>, public ScriptExecutionContext, public EventTarget {
     public:
-
         virtual ~WorkerContext();
 
         virtual bool isWorkerContext() const { return true; }
 
         virtual ScriptExecutionContext* scriptExecutionContext() const;
 
+        virtual bool isSharedWorkerContext() const { return false; }
+        virtual bool isDedicatedWorkerContext() const { return false; }
+
         const KURL& url() const { return m_url; }
         KURL completeURL(const String&) const;
 
@@ -67,8 +70,6 @@ namespace WebCore {
 
         bool hasPendingActivity() const;
 
-        virtual void reportException(const String& errorMessage, int lineNumber, const String& sourceURL) = 0;
-        virtual void addMessage(MessageDestination, MessageSource, MessageType, MessageLevel, const String& message, unsigned lineNumber, const String& sourceURL);
         virtual void resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString);
         virtual void scriptImported(unsigned long identifier, const String& sourceString);
 
@@ -82,7 +83,7 @@ namespace WebCore {
         EventListener* onerror() const { return m_onerrorListener.get(); }
 
         // WorkerUtils
-        void importScripts(const Vector<String>& urls, const String& callerURL, int callerLine, ExceptionCode&);
+        virtual void importScripts(const Vector<String>& urls, const String& callerURL, int callerLine, ExceptionCode&);
         WorkerNavigator* navigator() const;
 
         // Timers
@@ -100,8 +101,15 @@ namespace WebCore {
         typedef HashMap<AtomicString, ListenerVector> EventListenersMap;
         EventListenersMap& eventListeners() { return m_eventListeners; }
 
+        // ScriptExecutionContext
+        virtual void reportException(const String& errorMessage, int lineNumber, const String& sourceURL);
+        virtual void addMessage(MessageDestination, MessageSource, MessageType, MessageLevel, const String& message, unsigned lineNumber, const String& sourceURL);
+
+#if ENABLE(NOTIFICATIONS)
+        NotificationCenter* webkitNotifications() const;
+#endif
 
-        // These methods are used for GC marking. See JSWorkerContext::mark() in
+        // These methods are used for GC marking. See JSWorkerContext::markChildren(MarkStack&) in
         // JSWorkerContextCustom.cpp.
         WorkerNavigator* optionalNavigator() const { return m_navigator.get(); }
         WorkerLocation* optionalLocation() const { return m_location.get(); }
@@ -109,9 +117,10 @@ namespace WebCore {
         using RefCounted<WorkerContext>::ref;
         using RefCounted<WorkerContext>::deref;
 
+        bool isClosing() { return m_closing; }
+
     protected:
         WorkerContext(const KURL&, const String&, WorkerThread*);
-        bool isClosing() { return m_closing; }
 
     private:
         virtual void refScriptExecutionContext() { ref(); }
@@ -134,6 +143,9 @@ namespace WebCore {
         RefPtr<EventListener> m_onerrorListener;
         EventListenersMap m_eventListeners;
 
+#if ENABLE_NOTIFICATIONS
+        mutable RefPtr<NotificationCenter> m_notifications;
+#endif
         bool m_closing;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerContext.idl b/src/3rdparty/webkit/WebCore/workers/WorkerContext.idl
index 2404d22..6a4a7fa 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerContext.idl
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerContext.idl
@@ -69,6 +69,10 @@ module threads {
         boolean dispatchEvent(in Event evt)
             raises(EventException);
 
+#if defined(ENABLE_NOTIFICATIONS) && ENABLE_NOTIFICATIONS
+        // Notification interface
+        readonly attribute NotificationCenter webkitNotifications;
+#endif
 
         // Constructors
         attribute MessageEventConstructor MessageEvent;
@@ -77,6 +81,9 @@ module threads {
 #if ENABLE_CHANNEL_MESSAGING
         attribute [JSCCustomGetter] MessageChannelConstructor MessageChannel;
 #endif
+#if ENABLE_EVENTSOURCE
+        attribute [JSCCustomGetter] EventSourceConstructor EventSource;
+#endif
         attribute [JSCCustomGetter] XMLHttpRequestConstructor XMLHttpRequest;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerContextProxy.h b/src/3rdparty/webkit/WebCore/workers/WorkerContextProxy.h
index f42527e..d55452e 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerContextProxy.h
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerContextProxy.h
@@ -33,12 +33,12 @@
 
 #if ENABLE(WORKERS)
 
+#include "MessagePort.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
     class KURL;
-    class MessagePortChannel;
     class String;
     class Worker;
 
@@ -53,7 +53,7 @@ namespace WebCore {
 
         virtual void terminateWorkerContext() = 0;
 
-        virtual void postMessageToWorkerContext(const String&, PassOwnPtr<MessagePortChannel>) = 0;
+        virtual void postMessageToWorkerContext(const String&, PassOwnPtr<MessagePortChannelArray>) = 0;
 
         virtual bool hasPendingActivity() const = 0;
 
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerLocation.cpp b/src/3rdparty/webkit/WebCore/workers/WorkerLocation.cpp
index e84bf93..e1fe9d7 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerLocation.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerLocation.cpp
@@ -71,7 +71,7 @@ String WorkerLocation::search() const
 
 String WorkerLocation::hash() const
 {
-    return m_url.ref().isEmpty() ? "" : "#" + m_url.ref();
+    return m_url.fragmentIdentifier().isEmpty() ? "" : "#" + m_url.fragmentIdentifier();
 }
 
 String WorkerLocation::toString() const
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.cpp b/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.cpp
index 5971c1d..49c88c0 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.cpp
@@ -32,27 +32,27 @@
 #include "WorkerMessagingProxy.h"
 
 #include "DedicatedWorkerContext.h"
+#include "DedicatedWorkerThread.h"
 #include "DOMWindow.h"
 #include "Document.h"
 #include "GenericWorkerTask.h"
 #include "MessageEvent.h"
 #include "ScriptExecutionContext.h"
 #include "Worker.h"
-#include "WorkerThread.h"
 
 namespace WebCore {
 
 class MessageWorkerContextTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<MessageWorkerContextTask> create(const String& message, PassOwnPtr<MessagePortChannel> channel)
+    static PassRefPtr<MessageWorkerContextTask> create(const String& message, PassOwnPtr<MessagePortChannelArray> channels)
     {
-        return adoptRef(new MessageWorkerContextTask(message, channel));
+        return adoptRef(new MessageWorkerContextTask(message, channels));
     }
 
 private:
-    MessageWorkerContextTask(const String& message, PassOwnPtr<MessagePortChannel> channel)
+    MessageWorkerContextTask(const String& message, PassOwnPtr<MessagePortChannelArray> channels)
         : m_message(message.copy())
-        , m_channel(channel)
+        , m_channels(channels)
     {
     }
 
@@ -60,31 +60,27 @@ private:
     {
         ASSERT(scriptContext->isWorkerContext());
         DedicatedWorkerContext* context = static_cast<DedicatedWorkerContext*>(scriptContext);
-        RefPtr<MessagePort> port;
-        if (m_channel) {
-            port = MessagePort::create(*scriptContext);
-            port->entangle(m_channel.release());
-        }
-        context->dispatchMessage(m_message, port.release());
+        OwnPtr<MessagePortArray> ports = MessagePort::entanglePorts(*scriptContext, m_channels.release());
+        context->dispatchMessage(m_message, ports.release());
         context->thread()->workerObjectProxy().confirmMessageFromWorkerObject(context->hasPendingActivity());
     }
 
 private:
     String m_message;
-    OwnPtr<MessagePortChannel> m_channel;
+    OwnPtr<MessagePortChannelArray> m_channels;
 };
 
 class MessageWorkerTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<MessageWorkerTask> create(const String& message, PassOwnPtr<MessagePortChannel> channel, WorkerMessagingProxy* messagingProxy)
+    static PassRefPtr<MessageWorkerTask> create(const String& message, PassOwnPtr<MessagePortChannelArray> channels, WorkerMessagingProxy* messagingProxy)
     {
-        return adoptRef(new MessageWorkerTask(message, channel, messagingProxy));
+        return adoptRef(new MessageWorkerTask(message, channels, messagingProxy));
     }
 
 private:
-    MessageWorkerTask(const String& message, PassOwnPtr<MessagePortChannel> channel, WorkerMessagingProxy* messagingProxy)
+    MessageWorkerTask(const String& message, PassOwnPtr<MessagePortChannelArray> channels, WorkerMessagingProxy* messagingProxy)
         : m_message(message.copy())
-        , m_channel(channel)
+        , m_channels(channels)
         , m_messagingProxy(messagingProxy)
     {
     }
@@ -95,17 +91,13 @@ private:
         if (!workerObject || m_messagingProxy->askedToTerminate())
             return;
 
-        RefPtr<MessagePort> port;
-        if (m_channel) {
-            port = MessagePort::create(*scriptContext);
-            port->entangle(m_channel.release());
-        }
-        workerObject->dispatchMessage(m_message, port.release());
+        OwnPtr<MessagePortArray> ports = MessagePort::entanglePorts(*scriptContext, m_channels.release());
+        workerObject->dispatchMessage(m_message, ports.release());
     }
 
 private:
     String m_message;
-    OwnPtr<MessagePortChannel> m_channel;
+    OwnPtr<MessagePortChannelArray> m_channels;
     WorkerMessagingProxy* m_messagingProxy;
 };
 
@@ -128,12 +120,13 @@ private:
     virtual void performTask(ScriptExecutionContext* context)
     {
         Worker* workerObject = m_messagingProxy->workerObject();
-        if (!workerObject || m_messagingProxy->askedToTerminate())
+        if (!workerObject)
             return;
 
-        bool errorHandled = false;
-        if (workerObject->onerror())
-            errorHandled = workerObject->dispatchScriptErrorEvent(m_errorMessage, m_sourceURL, m_lineNumber);
+        // We don't bother checking the askedToTerminate() flag here, because exceptions should *always* be reported even if the thread is terminated.
+        // This is intentionally different than the behavior in MessageWorkerTask, because terminated workers no longer deliver messages (section 4.6 of the WebWorker spec), but they do report exceptions.
+
+        bool errorHandled = workerObject->dispatchScriptErrorEvent(m_errorMessage, m_sourceURL, m_lineNumber);
 
         if (!errorHandled)
             context->reportException(m_errorMessage, m_lineNumber, m_sourceURL);
@@ -166,6 +159,27 @@ private:
     WorkerMessagingProxy* m_messagingProxy;
 };
 
+class WorkerTerminateTask : public ScriptExecutionContext::Task {
+public:
+    static PassRefPtr<WorkerTerminateTask> create(WorkerMessagingProxy* messagingProxy)
+    {
+        return adoptRef(new WorkerTerminateTask(messagingProxy));
+    }
+
+private:
+    WorkerTerminateTask(WorkerMessagingProxy* messagingProxy)
+        : m_messagingProxy(messagingProxy)
+    {
+    }
+
+    virtual void performTask(ScriptExecutionContext*)
+    {
+        m_messagingProxy->terminateWorkerContext();
+    }
+
+    WorkerMessagingProxy* m_messagingProxy;
+};
+
 class WorkerThreadActivityReportTask : public ScriptExecutionContext::Task {
 public:
     static PassRefPtr<WorkerThreadActivityReportTask> create(WorkerMessagingProxy* messagingProxy, bool confirmingMessage, bool hasPendingActivity)
@@ -220,26 +234,26 @@ WorkerMessagingProxy::~WorkerMessagingProxy()
 
 void WorkerMessagingProxy::startWorkerContext(const KURL& scriptURL, const String& userAgent, const String& sourceCode)
 {
-    RefPtr<WorkerThread> thread = WorkerThread::create(scriptURL, userAgent, sourceCode, *this, *this);
+    RefPtr<DedicatedWorkerThread> thread = DedicatedWorkerThread::create(scriptURL, userAgent, sourceCode, *this, *this);
     workerThreadCreated(thread);
     thread->start();
 }
 
-void WorkerMessagingProxy::postMessageToWorkerObject(const String& message, PassOwnPtr<MessagePortChannel> channel)
+void WorkerMessagingProxy::postMessageToWorkerObject(const String& message, PassOwnPtr<MessagePortChannelArray> channels)
 {
-    m_scriptExecutionContext->postTask(MessageWorkerTask::create(message, channel, this));
+    m_scriptExecutionContext->postTask(MessageWorkerTask::create(message, channels.release(), this));
 }
 
-void WorkerMessagingProxy::postMessageToWorkerContext(const String& message, PassOwnPtr<MessagePortChannel> channel)
+void WorkerMessagingProxy::postMessageToWorkerContext(const String& message, PassOwnPtr<MessagePortChannelArray> channels)
 {
     if (m_askedToTerminate)
         return;
 
     if (m_workerThread) {
         ++m_unconfirmedMessageCount;
-        m_workerThread->runLoop().postTask(MessageWorkerContextTask::create(message, channel));
+        m_workerThread->runLoop().postTask(MessageWorkerContextTask::create(message, channels.release()));
     } else
-        m_queuedEarlyTasks.append(MessageWorkerContextTask::create(message, channel));
+        m_queuedEarlyTasks.append(MessageWorkerContextTask::create(message, channels.release()));
 }
 
 void WorkerMessagingProxy::postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
@@ -275,7 +289,7 @@ void WorkerMessagingProxy::postConsoleMessageToWorkerObject(MessageDestination d
     m_scriptExecutionContext->postTask(createCallbackTask(&postConsoleMessageTask, this, destination, source, type, level, message, lineNumber, sourceURL));
 }
 
-void WorkerMessagingProxy::workerThreadCreated(PassRefPtr<WorkerThread> workerThread)
+void WorkerMessagingProxy::workerThreadCreated(PassRefPtr<DedicatedWorkerThread> workerThread)
 {
     m_workerThread = workerThread;
 
@@ -309,6 +323,12 @@ void WorkerMessagingProxy::workerContextDestroyed()
     // Will execute workerContextDestroyedInternal() on context's thread.
 }
 
+void WorkerMessagingProxy::workerContextClosed()
+{
+    // Executes terminateWorkerContext() on parent context's thread.
+    m_scriptExecutionContext->postTask(WorkerTerminateTask::create(this));
+}
+
 void WorkerMessagingProxy::workerContextDestroyedInternal()
 {
     // WorkerContextDestroyedTask is always the last to be performed, so the proxy is not needed for communication
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.h b/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.h
index b705ca4..8ab0cb6 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.h
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerMessagingProxy.h
@@ -41,11 +41,10 @@
 
 namespace WebCore {
 
-    class MessagePortChannel;
+    class DedicatedWorkerThread;
     class ScriptExecutionContext;
     class String;
     class Worker;
-    class WorkerThread;
 
     class WorkerMessagingProxy : public WorkerContextProxy, public WorkerObjectProxy, public WorkerLoaderProxy, public Noncopyable {
     public:
@@ -55,17 +54,18 @@ namespace WebCore {
         // (Only use these methods in the worker object thread.)
         virtual void startWorkerContext(const KURL& scriptURL, const String& userAgent, const String& sourceCode);
         virtual void terminateWorkerContext();
-        virtual void postMessageToWorkerContext(const String&, PassOwnPtr<MessagePortChannel>);
+        virtual void postMessageToWorkerContext(const String&, PassOwnPtr<MessagePortChannelArray>);
         virtual bool hasPendingActivity() const;
         virtual void workerObjectDestroyed();
 
         // Implementations of WorkerObjectProxy.
         // (Only use these methods in the worker context thread.)
-        virtual void postMessageToWorkerObject(const String&, PassOwnPtr<MessagePortChannel>);
+        virtual void postMessageToWorkerObject(const String&, PassOwnPtr<MessagePortChannelArray>);
         virtual void postExceptionToWorkerObject(const String& errorMessage, int lineNumber, const String& sourceURL);
         virtual void postConsoleMessageToWorkerObject(MessageDestination, MessageSource, MessageType, MessageLevel, const String& message, int lineNumber, const String& sourceURL);
         virtual void confirmMessageFromWorkerObject(bool hasPendingActivity);
         virtual void reportPendingActivity(bool hasPendingActivity);
+        virtual void workerContextClosed();
         virtual void workerContextDestroyed();
 
         // Implementation of WorkerLoaderProxy.
@@ -74,7 +74,7 @@ namespace WebCore {
         virtual void postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task>);
         virtual void postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task>, const String& mode);
 
-        void workerThreadCreated(PassRefPtr<WorkerThread>);
+        void workerThreadCreated(PassRefPtr<DedicatedWorkerThread>);
 
         // Only use this method on the worker object thread.
         bool askedToTerminate() const { return m_askedToTerminate; }
@@ -93,7 +93,7 @@ namespace WebCore {
 
         RefPtr<ScriptExecutionContext> m_scriptExecutionContext;
         Worker* m_workerObject;
-        RefPtr<WorkerThread> m_workerThread;
+        RefPtr<DedicatedWorkerThread> m_workerThread;
 
         unsigned m_unconfirmedMessageCount; // Unconfirmed messages from worker object to worker thread.
         bool m_workerThreadHadPendingActivity; // The latest confirmation from worker thread reported that it was still active.
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerObjectProxy.h b/src/3rdparty/webkit/WebCore/workers/WorkerObjectProxy.h
index c5f4456..77a7d7d 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerObjectProxy.h
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerObjectProxy.h
@@ -33,31 +33,24 @@
 
 #if ENABLE(WORKERS)
 
-#include "Console.h"
-
+#include "WorkerReportingProxy.h"
+#include "MessagePort.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
     class MessagePortChannel;
-    class String;
 
     // A proxy to talk to the worker object.
-    class WorkerObjectProxy {
+    class WorkerObjectProxy : public WorkerReportingProxy {
     public:
-        virtual ~WorkerObjectProxy() {}
-
-        virtual void postMessageToWorkerObject(const String&, PassOwnPtr<MessagePortChannel>) = 0;
-
-        virtual void postExceptionToWorkerObject(const String& errorMessage, int lineNumber, const String& sourceURL) = 0;
-
-        virtual void postConsoleMessageToWorkerObject(MessageDestination, MessageSource, MessageType, MessageLevel, const String& message, int lineNumber, const String& sourceURL) = 0;
+        virtual void postMessageToWorkerObject(const String&, PassOwnPtr<MessagePortChannelArray>) = 0;
 
         virtual void confirmMessageFromWorkerObject(bool hasPendingActivity) = 0;
-
         virtual void reportPendingActivity(bool hasPendingActivity) = 0;
 
-        virtual void workerContextDestroyed() = 0;
+        // No need to notify the parent page context when dedicated workers are closing.
+        virtual void workerContextClosed() { }
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerReportingProxy.h b/src/3rdparty/webkit/WebCore/workers/WorkerReportingProxy.h
new file mode 100644
index 0000000..f0447c8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerReportingProxy.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WorkerReportingProxy_h
+#define WorkerReportingProxy_h
+
+#if ENABLE(WORKERS)
+
+#include "Console.h"
+
+namespace WebCore {
+
+    class String;
+
+    // APIs used by workers to report console activity.
+    class WorkerReportingProxy {
+    public:
+        virtual ~WorkerReportingProxy() {}
+
+        virtual void postExceptionToWorkerObject(const String& errorMessage, int lineNumber, const String& sourceURL) = 0;
+
+        virtual void postConsoleMessageToWorkerObject(MessageDestination, MessageSource, MessageType, MessageLevel, const String& message, int lineNumber, const String& sourceURL) = 0;
+
+        // Invoked when close() is invoked on the worker context.
+        virtual void workerContextClosed() = 0;
+
+        // Invoked when the thread has stopped.
+        virtual void workerContextDestroyed() = 0;
+    };
+} // namespace WebCore
+
+#endif // ENABLE(WORKERS)
+
+#endif // WorkerReportingProxy_h
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerRunLoop.cpp b/src/3rdparty/webkit/WebCore/workers/WorkerRunLoop.cpp
index cb31fe7..52d650f 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerRunLoop.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerRunLoop.cpp
@@ -173,6 +173,10 @@ MessageQueueWaitResult WorkerRunLoop::runInMode(WorkerContext* context, const Mo
     RefPtr<Task> task;
     MessageQueueWaitResult result = m_messageQueue.waitForMessageFilteredWithTimeout(task, predicate, absoluteTime);
 
+    // If the context is closing, don't dispatch any further tasks (per section 4.1.1 of the Web Workers spec).
+    if (context->isClosing())
+        return result;
+
     switch (result) {
     case MessageQueueTerminated:
         break;
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerScriptLoader.cpp b/src/3rdparty/webkit/WebCore/workers/WorkerScriptLoader.cpp
index 093bf07..52baf2d 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerScriptLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerScriptLoader.cpp
@@ -50,55 +50,42 @@ WorkerScriptLoader::WorkerScriptLoader()
 {
 }
 
-static CrossOriginRedirectPolicy toCrossOriginRedirectPolicy(CrossOriginLoadPolicy crossOriginLoadPolicy)
+void WorkerScriptLoader::loadSynchronously(ScriptExecutionContext* scriptExecutionContext, const KURL& url, CrossOriginRequestPolicy crossOriginRequestPolicy)
 {
-    return (crossOriginLoadPolicy == DenyCrossOriginLoad) ? DenyCrossOriginRedirect : AllowCrossOriginRedirect;
-}
+    m_url = url;
 
-void WorkerScriptLoader::loadSynchronously(ScriptExecutionContext* scriptExecutionContext, const String& url, URLCompletionPolicy urlCompletionPolicy, CrossOriginLoadPolicy crossOriginLoadPolicy)
-{
-    OwnPtr<ResourceRequest> request(createResourceRequest(scriptExecutionContext, url, urlCompletionPolicy, crossOriginLoadPolicy));
+    OwnPtr<ResourceRequest> request(createResourceRequest());
     if (!request)
         return;
 
     ASSERT(scriptExecutionContext->isWorkerContext());
-    WorkerThreadableLoader::loadResourceSynchronously(static_cast<WorkerContext*>(scriptExecutionContext), *request, *this, AllowStoredCredentials, toCrossOriginRedirectPolicy(crossOriginLoadPolicy));
+
+    ThreadableLoaderOptions options;
+    options.allowCredentials = true;
+    options.crossOriginRequestPolicy = crossOriginRequestPolicy;
+
+    WorkerThreadableLoader::loadResourceSynchronously(static_cast<WorkerContext*>(scriptExecutionContext), *request, *this, options);
 }
     
-void WorkerScriptLoader::loadAsynchronously(ScriptExecutionContext* scriptExecutionContext, const String& url, URLCompletionPolicy urlCompletionPolicy, CrossOriginLoadPolicy crossOriginLoadPolicy, WorkerScriptLoaderClient* client)
+void WorkerScriptLoader::loadAsynchronously(ScriptExecutionContext* scriptExecutionContext, const KURL& url, CrossOriginRequestPolicy crossOriginRequestPolicy, WorkerScriptLoaderClient* client)
 {
     ASSERT(client);
     m_client = client;
+    m_url = url;
 
-    OwnPtr<ResourceRequest> request(createResourceRequest(scriptExecutionContext, url, urlCompletionPolicy, crossOriginLoadPolicy));
+    OwnPtr<ResourceRequest> request(createResourceRequest());
     if (!request)
         return;
 
-    m_threadableLoader = ThreadableLoader::create(scriptExecutionContext, this, *request, DoNotSendLoadCallbacks, DoNotSniffContent, AllowStoredCredentials, toCrossOriginRedirectPolicy(crossOriginLoadPolicy));
-}
+    ThreadableLoaderOptions options;
+    options.allowCredentials = true;
+    options.crossOriginRequestPolicy = crossOriginRequestPolicy;
 
-static void notifyLoadErrorTask(ScriptExecutionContext* context, WorkerScriptLoader* loader)
-{
-    UNUSED_PARAM(context);
-    loader->notifyError();
+    m_threadableLoader = ThreadableLoader::create(scriptExecutionContext, this, *request, options);
 }
 
-PassOwnPtr<ResourceRequest> WorkerScriptLoader::createResourceRequest(ScriptExecutionContext* scriptExecutionContext, const String& url, URLCompletionPolicy urlCompletionPolicy, CrossOriginLoadPolicy crossOriginLoadPolicy)
+PassOwnPtr<ResourceRequest> WorkerScriptLoader::createResourceRequest()
 {
-    if (urlCompletionPolicy == CompleteURL) {
-        m_url = scriptExecutionContext->completeURL(url);
-        if (url.isEmpty() || !m_url.isValid()) {
-            scriptExecutionContext->postTask(createCallbackTask(&notifyLoadErrorTask, this));
-            return 0;
-        }
-    } else
-        m_url = KURL(url);
-
-    if (crossOriginLoadPolicy == DenyCrossOriginLoad && !scriptExecutionContext->securityOrigin()->canAccess(SecurityOrigin::create(m_url).get())) {
-        scriptExecutionContext->postTask(createCallbackTask(&notifyLoadErrorTask, this));
-        return 0;
-    }
-
     OwnPtr<ResourceRequest> request(new ResourceRequest(m_url));
     request->setHTTPMethod("GET");
 
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerScriptLoader.h b/src/3rdparty/webkit/WebCore/workers/WorkerScriptLoader.h
index f465d7f..47623f6 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerScriptLoader.h
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerScriptLoader.h
@@ -42,22 +42,12 @@ namespace WebCore {
     class ScriptExecutionContext;
     class WorkerScriptLoaderClient;
 
-    enum URLCompletionPolicy {
-        CompleteURL,
-        DoNotCompleteURL
-    };
-
-    enum CrossOriginLoadPolicy {
-        DenyCrossOriginLoad,
-        AllowCrossOriginLoad
-    };
-
     class WorkerScriptLoader : public ThreadableLoaderClient {
     public:
         WorkerScriptLoader();
 
-        void loadSynchronously(ScriptExecutionContext*, const String& url, URLCompletionPolicy, CrossOriginLoadPolicy);
-        void loadAsynchronously(ScriptExecutionContext*, const String& url, URLCompletionPolicy, CrossOriginLoadPolicy, WorkerScriptLoaderClient*);
+        void loadSynchronously(ScriptExecutionContext*, const KURL&, CrossOriginRequestPolicy);
+        void loadAsynchronously(ScriptExecutionContext*, const KURL&, CrossOriginRequestPolicy, WorkerScriptLoaderClient*);
 
         void notifyError();
 
@@ -74,7 +64,7 @@ namespace WebCore {
         virtual void didReceiveAuthenticationCancellation(const ResourceResponse&);
 
     private:
-        PassOwnPtr<ResourceRequest> createResourceRequest(ScriptExecutionContext*, const String& url, URLCompletionPolicy, CrossOriginLoadPolicy);
+        PassOwnPtr<ResourceRequest> createResourceRequest();
         void notifyFinished();
 
         WorkerScriptLoaderClient* m_client;
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerThread.cpp b/src/3rdparty/webkit/WebCore/workers/WorkerThread.cpp
index 5d58eea..22253bf 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerThread.cpp
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerThread.cpp
@@ -35,12 +35,26 @@
 #include "PlatformString.h"
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
-#include "WorkerObjectProxy.h"
 
 #include <utility>
 #include <wtf/Noncopyable.h>
 
 namespace WebCore {
+
+static Mutex& threadCountMutex()
+{
+    AtomicallyInitializedStatic(Mutex&, mutex = *new Mutex);
+    return mutex;
+}
+
+unsigned WorkerThread::m_threadCount = 0;
+
+unsigned WorkerThread::workerThreadCount()
+{
+    MutexLocker lock(threadCountMutex());
+    return m_threadCount;
+}
+
 struct WorkerThreadStartupData : Noncopyable {
 public:
     static std::auto_ptr<WorkerThreadStartupData> create(const KURL& scriptURL, const String& userAgent, const String& sourceCode)
@@ -62,21 +76,21 @@ WorkerThreadStartupData::WorkerThreadStartupData(const KURL& scriptURL, const St
 {
 }
 
-PassRefPtr<WorkerThread> WorkerThread::create(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerObjectProxy& workerObjectProxy)
-{
-    return adoptRef(new WorkerThread(scriptURL, userAgent, sourceCode, workerLoaderProxy, workerObjectProxy));
-}
-
-WorkerThread::WorkerThread(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerObjectProxy& workerObjectProxy)
+WorkerThread::WorkerThread(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerReportingProxy& workerReportingProxy)
     : m_threadID(0)
     , m_workerLoaderProxy(workerLoaderProxy)
-    , m_workerObjectProxy(workerObjectProxy)
+    , m_workerReportingProxy(workerReportingProxy)
     , m_startupData(WorkerThreadStartupData::create(scriptURL, userAgent, sourceCode))
 {
+    MutexLocker lock(threadCountMutex());
+    m_threadCount++;
 }
 
 WorkerThread::~WorkerThread()
 {
+    MutexLocker lock(threadCountMutex());
+    ASSERT(m_threadCount > 0);
+    m_threadCount--;
 }
 
 bool WorkerThread::start()
@@ -101,7 +115,8 @@ void* WorkerThread::workerThread()
 {
     {
         MutexLocker lock(m_threadCreationMutex);
-        m_workerContext = DedicatedWorkerContext::create(m_startupData->m_scriptURL, m_startupData->m_userAgent, this);
+        m_workerContext = createWorkerContext(m_startupData->m_scriptURL, m_startupData->m_userAgent);
+
         if (m_runLoop.terminated()) {
             // The worker was terminated before the thread had a chance to run. Since the context didn't exist yet,
             // forbidExecution() couldn't be called from stop().
@@ -116,10 +131,7 @@ void* WorkerThread::workerThread()
     // WorkerThread::~WorkerThread happens on a different thread where it was created.
     m_startupData.clear();
 
-    m_workerObjectProxy.reportPendingActivity(m_workerContext->hasPendingActivity());
-
-    // Blocks until terminated.
-    m_runLoop.run(m_workerContext.get());
+    runEventLoop();
 
     ThreadIdentifier threadID = m_threadID;
 
@@ -136,6 +148,12 @@ void* WorkerThread::workerThread()
     return 0;
 }
 
+void WorkerThread::runEventLoop()
+{
+    // Does not return until terminated.
+    m_runLoop.run(m_workerContext.get());
+}
+
 void WorkerThread::stop()
 {
     // Mutex protection is necessary because stop() can be called before the context is fully created.
diff --git a/src/3rdparty/webkit/WebCore/workers/WorkerThread.h b/src/3rdparty/webkit/WebCore/workers/WorkerThread.h
index 8a1ce6c..cb33308 100644
--- a/src/3rdparty/webkit/WebCore/workers/WorkerThread.h
+++ b/src/3rdparty/webkit/WebCore/workers/WorkerThread.h
@@ -37,16 +37,16 @@
 namespace WebCore {
 
     class KURL;
+    class NotificationPresenter;
     class String;
     class WorkerContext;
     class WorkerLoaderProxy;
-    class WorkerObjectProxy;
+    class WorkerReportingProxy;
     struct WorkerThreadStartupData;
 
     class WorkerThread : public RefCounted<WorkerThread> {
     public:
-        static PassRefPtr<WorkerThread> create(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerLoaderProxy&, WorkerObjectProxy&);
-        ~WorkerThread();
+        virtual ~WorkerThread();
 
         bool start();
         void stop();
@@ -54,23 +54,48 @@ namespace WebCore {
         ThreadIdentifier threadID() const { return m_threadID; }
         WorkerRunLoop& runLoop() { return m_runLoop; }
         WorkerLoaderProxy& workerLoaderProxy() const { return m_workerLoaderProxy; }
-        WorkerObjectProxy& workerObjectProxy() const { return m_workerObjectProxy; }
+        WorkerReportingProxy& workerReportingProxy() const { return m_workerReportingProxy; }
 
-    private:
-        WorkerThread(const KURL&, const String& userAgent, const String& sourceCode, WorkerLoaderProxy&, WorkerObjectProxy&);
+        // Number of active worker threads.
+        static unsigned workerThreadCount();
+
+#if ENABLE(NOTIFICATIONS)
+        NotificationPresenter* getNotificationPresenter() { return m_notificationPresenter; }
+        void setNotificationPresenter(NotificationPresenter* presenter) { m_notificationPresenter = presenter; }
+#endif
+
+    protected:
+        WorkerThread(const KURL&, const String& userAgent, const String& sourceCode, WorkerLoaderProxy&, WorkerReportingProxy&);
+
+        // Factory method for creating a new worker context for the thread.
+        virtual PassRefPtr<WorkerContext> createWorkerContext(const KURL& url, const String& userAgent) = 0;
+
+        // Executes the event loop for the worker thread. Derived classes can override to perform actions before/after entering the event loop.
+        virtual void runEventLoop();
 
+        WorkerContext* workerContext() { return m_workerContext.get(); }
+
+    private:
+        // Static function executed as the core routine on the new thread. Passed a pointer to a WorkerThread object.
         static void* workerThreadStart(void*);
         void* workerThread();
 
         ThreadIdentifier m_threadID;
         WorkerRunLoop m_runLoop;
         WorkerLoaderProxy& m_workerLoaderProxy;
-        WorkerObjectProxy& m_workerObjectProxy;
+        WorkerReportingProxy& m_workerReportingProxy;
 
         RefPtr<WorkerContext> m_workerContext;
         Mutex m_threadCreationMutex;
 
         OwnPtr<WorkerThreadStartupData> m_startupData;
+
+#if ENABLE(NOTIFICATIONS)
+        NotificationPresenter* m_notificationPresenter;
+#endif
+
+        // Track the number of WorkerThread instances for use in layout tests.
+        static unsigned m_threadCount;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.cpp b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.cpp
index 5e20252..e8df36d 100644
--- a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.cpp
@@ -25,7 +25,6 @@
 #include "Cache.h"
 #include "CString.h"
 #include "CrossOriginAccessControl.h"
-#include "CrossOriginPreflightResultCache.h"
 #include "DOMImplementation.h"
 #include "Document.h"
 #include "Event.h"
@@ -45,6 +44,7 @@
 #include "XMLHttpRequestUpload.h"
 #include "markup.h"
 #include <wtf/StdLibExtras.h>
+#include <wtf/RefCountedLeakCounter.h>
 
 #if USE(JSC)
 #include "JSDOMWindow.h"
@@ -52,6 +52,10 @@
 
 namespace WebCore {
 
+#ifndef NDEBUG
+static WTF::RefCountedLeakCounter xmlHttpRequestCounter("XMLHttpRequest");
+#endif
+
 struct XMLHttpRequestStaticData {
     XMLHttpRequestStaticData();
     String m_proxyHeaderPrefix;
@@ -93,25 +97,25 @@ static bool isValidToken(const String& name)
     unsigned length = name.length();
     for (unsigned i = 0; i < length; i++) {
         UChar c = name[i];
-        
+
         if (c >= 127 || c <= 32)
             return false;
-        
+
         if (c == '(' || c == ')' || c == '<' || c == '>' || c == '@' ||
             c == ',' || c == ';' || c == ':' || c == '\\' || c == '\"' ||
             c == '/' || c == '[' || c == ']' || c == '?' || c == '=' ||
             c == '{' || c == '}')
             return false;
     }
-    
+
     return true;
 }
-    
+
 static bool isValidHeaderValue(const String& name)
 {
-    // FIXME: This should really match name against 
+    // FIXME: This should really match name against
     // field-value in section 4.2 of RFC 2616.
-        
+
     return !name.contains('\r') && !name.contains('\n');
 }
 
@@ -143,15 +147,18 @@ XMLHttpRequest::XMLHttpRequest(ScriptExecutionContext* context)
     , m_responseText("")
     , m_createdDocument(false)
     , m_error(false)
+    , m_uploadEventsAllowed(true)
     , m_uploadComplete(false)
     , m_sameOriginRequest(true)
-    , m_inPreflight(false)
     , m_didTellLoaderAboutRequest(false)
     , m_receivedLength(0)
     , m_lastSendLineNumber(0)
     , m_exceptionCode(0)
 {
     initializeXMLHttpRequestStaticData();
+#ifndef NDEBUG
+    xmlHttpRequestCounter.increment();
+#endif
 }
 
 XMLHttpRequest::~XMLHttpRequest()
@@ -162,6 +169,10 @@ XMLHttpRequest::~XMLHttpRequest()
     }
     if (m_upload)
         m_upload->disconnectXMLHttpRequest();
+
+#ifndef NDEBUG
+    xmlHttpRequestCounter.decrement();
+#endif
 }
 
 Document* XMLHttpRequest::document() const
@@ -207,7 +218,7 @@ Document* XMLHttpRequest::responseXML() const
             m_responseXML->write(String(m_responseText));
             m_responseXML->finishParsing();
             m_responseXML->close();
-            
+
             if (!m_responseXML->wellFormed())
                 m_responseXML = 0;
         }
@@ -234,9 +245,9 @@ void XMLHttpRequest::addEventListener(const AtomicString& eventType, PassRefPtr<
     } else {
         ListenerVector& listeners = iter->second;
         for (ListenerVector::iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter)
-            if (*listenerIter == eventListener)
+            if (**listenerIter == *eventListener)
                 return;
-        
+
         listeners.append(eventListener);
         m_eventListeners.add(eventType, listeners);
     }
@@ -250,7 +261,7 @@ void XMLHttpRequest::removeEventListener(const AtomicString& eventType, EventLis
 
     ListenerVector& listeners = iter->second;
     for (ListenerVector::const_iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter)
-        if (*listenerIter == eventListener) {
+        if (**listenerIter == *eventListener) {
             listeners.remove(listenerIter - listeners.begin());
             return;
         }
@@ -322,10 +333,10 @@ void XMLHttpRequest::open(const String& method, const KURL& url, bool async, Exc
         ec = SYNTAX_ERR;
         return;
     }
-    
+
     // Method names are case sensitive. But since Firefox uppercases method names it knows, we'll do the same.
     String methodUpper(method.upper());
-    
+
     if (methodUpper == "TRACE" || methodUpper == "TRACK" || methodUpper == "CONNECT") {
         ec = SECURITY_ERR;
         return;
@@ -335,7 +346,7 @@ void XMLHttpRequest::open(const String& method, const KURL& url, bool async, Exc
 
     if (methodUpper == "COPY" || methodUpper == "DELETE" || methodUpper == "GET" || methodUpper == "HEAD"
         || methodUpper == "INDEX" || methodUpper == "LOCK" || methodUpper == "M-POST" || methodUpper == "MKCOL" || methodUpper == "MOVE"
-        || methodUpper == "OPTIONS" || methodUpper == "POST" || methodUpper == "PROPFIND" || methodUpper == "PROPPATCH" || methodUpper == "PUT" 
+        || methodUpper == "OPTIONS" || methodUpper == "POST" || methodUpper == "PROPFIND" || methodUpper == "PROPPATCH" || methodUpper == "PUT"
         || methodUpper == "UNLOCK")
         m_method = methodUpper;
     else
@@ -357,7 +368,7 @@ void XMLHttpRequest::open(const String& method, const KURL& url, bool async, con
 {
     KURL urlWithCredentials(url);
     urlWithCredentials.setUser(user);
-    
+
     open(method, urlWithCredentials, async, ec);
 }
 
@@ -366,7 +377,7 @@ void XMLHttpRequest::open(const String& method, const KURL& url, bool async, con
     KURL urlWithCredentials(url);
     urlWithCredentials.setUser(user);
     urlWithCredentials.setPass(password);
-    
+
     open(method, urlWithCredentials, async, ec);
 }
 
@@ -463,34 +474,23 @@ void XMLHttpRequest::send(File* body, ExceptionCode& ec)
 
 void XMLHttpRequest::createRequest(ExceptionCode& ec)
 {
-    // Upload event listeners should be disallowed for simple cross-origin requests, because POSTing to an URL that does not
-    // permit cross origin requests should look exactly like POSTing to an URL that does not respond at all. If a listener exists
-    // when creating the request, it will force preflight.
+    // The presence of upload event listeners forces us to use preflighting because POSTing to an URL that does not
+    // permit cross origin requests should look exactly like POSTing to an URL that does not respond at all.
     // Also, only async requests support upload progress events.
-    m_uploadEventsAllowed = false;
+    bool forcePreflight = false;
     if (m_async) {
         dispatchLoadStartEvent();
         if (m_requestEntityBody && m_upload) {
-            m_uploadEventsAllowed = m_upload->hasListeners();
+            forcePreflight = m_upload->hasListeners();
             m_upload->dispatchLoadStartEvent();
         }
     }
 
     m_sameOriginRequest = scriptExecutionContext()->securityOrigin()->canRequest(m_url);
 
-    if (!m_sameOriginRequest) {
-        makeCrossOriginAccessRequest(ec);
-        return;
-    }
-
-    m_uploadEventsAllowed = true;
-
-    makeSameOriginRequest(ec);
-}
-
-void XMLHttpRequest::makeSameOriginRequest(ExceptionCode& ec)
-{
-    ASSERT(m_sameOriginRequest);
+    // We also remember whether upload events should be allowed for this request in case the upload listeners are
+    // added after the request is started.
+    m_uploadEventsAllowed = !isSimpleCrossOriginAccessRequest(m_method, m_requestHeaders);
 
     ResourceRequest request(m_url);
     request.setHTTPMethod(m_method);
@@ -504,202 +504,49 @@ void XMLHttpRequest::makeSameOriginRequest(ExceptionCode& ec)
     if (m_requestHeaders.size() > 0)
         request.addHTTPHeaderFields(m_requestHeaders);
 
-    if (m_async)
-        loadRequestAsynchronously(request);
-    else
-        loadRequestSynchronously(request, ec);
-}
-
-void XMLHttpRequest::makeCrossOriginAccessRequest(ExceptionCode& ec)
-{
-    ASSERT(!m_sameOriginRequest);
-
-    if (!m_uploadEventsAllowed && isSimpleCrossOriginAccessRequest(m_method, m_requestHeaders))
-        makeSimpleCrossOriginAccessRequest(ec);
-    else
-        makeCrossOriginAccessRequestWithPreflight(ec);
-}
-
-void XMLHttpRequest::makeSimpleCrossOriginAccessRequest(ExceptionCode& ec)
-{
-    ASSERT(isSimpleCrossOriginAccessRequest(m_method, m_requestHeaders));
-
-    // Cross-origin requests are only defined for HTTP. We would catch this when checking response headers later, but there is no reason to send a request that's guaranteed to be denied.
-    if (!m_url.protocolInHTTPFamily()) {
-        ec = XMLHttpRequestException::NETWORK_ERR;
-        networkError();
-        return;
-    }
+    ThreadableLoaderOptions options;
+    options.sendLoadCallbacks = true;
+    options.sniffContent = false;
+    options.forcePreflight = forcePreflight;
+    options.allowCredentials = m_sameOriginRequest || m_includeCredentials;
+    options.crossOriginRequestPolicy = UseAccessControl;
 
-    KURL url = m_url;
-    url.setUser(String());
-    url.setPass(String());
-
-    ResourceRequest request(url);
-    request.setHTTPMethod(m_method);
-    request.setAllowHTTPCookies(m_includeCredentials);
-    request.setHTTPOrigin(scriptExecutionContext()->securityOrigin()->toString());
-
-    if (m_requestHeaders.size() > 0)
-        request.addHTTPHeaderFields(m_requestHeaders);
-
-    if (m_requestEntityBody) {
-        ASSERT(m_method != "GET");
-        ASSERT(m_method != "HEAD");
-        request.setHTTPBody(m_requestEntityBody.release());
-    }
+    m_exceptionCode = 0;
+    m_error = false;
 
-    if (m_async)
-        loadRequestAsynchronously(request);
-    else
-        loadRequestSynchronously(request, ec);
-}
-
-void XMLHttpRequest::makeCrossOriginAccessRequestWithPreflight(ExceptionCode& ec)
-{
-    String origin = scriptExecutionContext()->securityOrigin()->toString();
-    KURL url = m_url;
-    url.setUser(String());
-    url.setPass(String());
-
-    if (!CrossOriginPreflightResultCache::shared().canSkipPreflight(origin, url, m_includeCredentials, m_method, m_requestHeaders)) {
-        m_inPreflight = true;
-        ResourceRequest preflightRequest(url);
-        preflightRequest.setHTTPMethod("OPTIONS");
-        preflightRequest.setHTTPHeaderField("Origin", origin);
-        preflightRequest.setHTTPHeaderField("Access-Control-Request-Method", m_method);
-
-        if (m_requestHeaders.size() > 0) {
-            Vector<UChar> headerBuffer;
-            HTTPHeaderMap::const_iterator it = m_requestHeaders.begin();
-            append(headerBuffer, it->first);
-            ++it;
-
-            HTTPHeaderMap::const_iterator end = m_requestHeaders.end();
-            for (; it != end; ++it) {
-                headerBuffer.append(',');
-                headerBuffer.append(' ');
-                append(headerBuffer, it->first);
+    if (m_async) {
+        if (m_upload)
+            request.setReportUploadProgress(true);
+
+        // ThreadableLoader::create can return null here, for example if we're no longer attached to a page.
+        // This is true while running onunload handlers.
+        // FIXME: Maybe we need to be able to send XMLHttpRequests from onunload, <http://bugs.webkit.org/show_bug.cgi?id=10904>.
+        // FIXME: Maybe create() can return null for other reasons too?
+        m_loader = ThreadableLoader::create(scriptExecutionContext(), this, request, options);
+        if (m_loader) {
+            // Neither this object nor the JavaScript wrapper should be deleted while
+            // a request is in progress because we need to keep the listeners alive,
+            // and they are referenced by the JavaScript wrapper.
+            setPendingActivity(this);
+
+            // For now we should only balance the nonCached request count for main-thread XHRs and not
+            // Worker XHRs, as the Cache is not thread-safe.
+            // This will become irrelevant after https://bugs.webkit.org/show_bug.cgi?id=27165 is resolved.
+            if (!scriptExecutionContext()->isWorkerContext()) {
+                ASSERT(isMainThread());
+                ASSERT(!m_didTellLoaderAboutRequest);
+                cache()->loader()->nonCacheRequestInFlight(m_url);
+                m_didTellLoaderAboutRequest = true;
             }
-
-            preflightRequest.setHTTPHeaderField("Access-Control-Request-Headers", String::adopt(headerBuffer));
-            preflightRequest.addHTTPHeaderFields(m_requestHeaders);
         }
+    } else
+        ThreadableLoader::loadResourceSynchronously(scriptExecutionContext(), request, *this, options);
 
-        if (m_async) {
-            m_uploadEventsAllowed = true;
-            loadRequestAsynchronously(preflightRequest);
-            return;
-        }
-
-        loadRequestSynchronously(preflightRequest, ec);
-        m_inPreflight = false;
-
-        if (ec)
-            return;
-    }
-
-    // Send the actual request.
-    ResourceRequest request(url);
-    request.setHTTPMethod(m_method);
-    request.setAllowHTTPCookies(m_includeCredentials);
-    request.setHTTPHeaderField("Origin", origin);
-
-    if (m_requestHeaders.size() > 0)
-        request.addHTTPHeaderFields(m_requestHeaders);
-
-    if (m_requestEntityBody) {
-        ASSERT(m_method != "GET");
-        ASSERT(m_method != "HEAD");
-        request.setHTTPBody(m_requestEntityBody.release());
-    }
-
-    if (m_async) {
-        m_uploadEventsAllowed = true;
-        loadRequestAsynchronously(request);
-        return;
-    }
-
-    loadRequestSynchronously(request, ec);
-}
-
-void XMLHttpRequest::handleAsynchronousPreflightResult()
-{
-    ASSERT(m_inPreflight);
-    ASSERT(m_async);
-
-    m_inPreflight = false;
-
-    KURL url = m_url;
-    url.setUser(String());
-    url.setPass(String());
-
-    ResourceRequest request(url);
-    request.setHTTPMethod(m_method);
-    request.setAllowHTTPCookies(m_includeCredentials);
-    request.setHTTPOrigin(scriptExecutionContext()->securityOrigin()->toString());
-
-    if (m_requestHeaders.size() > 0)
-        request.addHTTPHeaderFields(m_requestHeaders);
-
-    if (m_requestEntityBody) {
-        ASSERT(m_method != "GET");
-        ASSERT(m_method != "HEAD");
-        request.setHTTPBody(m_requestEntityBody.release());
-    }
-
-    m_uploadEventsAllowed = true;
-    loadRequestAsynchronously(request);
-}
-
-void XMLHttpRequest::loadRequestSynchronously(ResourceRequest& request, ExceptionCode& ec)
-{
-    ASSERT(!m_async);
-
-    m_loader = 0;
-    m_exceptionCode = 0;
-    StoredCredentials storedCredentials = (m_sameOriginRequest || m_includeCredentials) ? AllowStoredCredentials : DoNotAllowStoredCredentials;
-
-    ThreadableLoader::loadResourceSynchronously(scriptExecutionContext(), request, *this, storedCredentials);
     if (!m_exceptionCode && m_error)
         m_exceptionCode = XMLHttpRequestException::NETWORK_ERR;
     ec = m_exceptionCode;
 }
 
-void XMLHttpRequest::loadRequestAsynchronously(ResourceRequest& request)
-{
-    ASSERT(m_async);
-    m_exceptionCode = 0;
-    // SubresourceLoader::create can return null here, for example if we're no longer attached to a page.
-    // This is true while running onunload handlers.
-    // FIXME: We need to be able to send XMLHttpRequests from onunload, <http://bugs.webkit.org/show_bug.cgi?id=10904>.
-    // FIXME: Maybe create can return null for other reasons too?
-    LoadCallbacks callbacks = m_inPreflight ? DoNotSendLoadCallbacks : SendLoadCallbacks;
-    StoredCredentials storedCredentials = (m_sameOriginRequest || m_includeCredentials) ? AllowStoredCredentials : DoNotAllowStoredCredentials;
-
-    if (m_upload)
-        request.setReportUploadProgress(true);
-
-    m_loader = ThreadableLoader::create(scriptExecutionContext(), this, request, callbacks, DoNotSniffContent, storedCredentials, DenyCrossOriginRedirect);
-
-    if (m_loader) {
-        // Neither this object nor the JavaScript wrapper should be deleted while
-        // a request is in progress because we need to keep the listeners alive,
-        // and they are referenced by the JavaScript wrapper.
-        setPendingActivity(this);
-        
-        // For now we should only balance the nonCached request count for main-thread XHRs and not
-        // Worker XHRs, as the Cache is not thread-safe.
-        // This will become irrelevant after https://bugs.webkit.org/show_bug.cgi?id=27165 is resolved.
-        if (!scriptExecutionContext()->isWorkerContext()) {
-            ASSERT(isMainThread());
-            ASSERT(!m_didTellLoaderAboutRequest);
-            cache()->loader()->nonCacheRequestInFlight(m_url);
-            m_didTellLoaderAboutRequest = true;
-        }
-    }
-}
-
 void XMLHttpRequest::abort()
 {
     // internalAbort() calls dropProtection(), which may release the last reference.
@@ -711,7 +558,7 @@ void XMLHttpRequest::abort()
 
     // Clear headers as required by the spec
     m_requestHeaders.clear();
-    
+
     if ((m_state <= OPENED && !sendFlag) || m_state == DONE)
         m_state = UNSENT;
     else {
@@ -794,7 +641,7 @@ void XMLHttpRequest::abortError()
     }
 }
 
-void XMLHttpRequest::dropProtection()        
+void XMLHttpRequest::dropProtection()
 {
 #if USE(JSC)
     // The XHR object itself holds on to the responseText, and
@@ -854,7 +701,7 @@ void XMLHttpRequest::setRequestHeader(const AtomicString& name, const String& va
 
 void XMLHttpRequest::setRequestHeaderInternal(const AtomicString& name, const String& value)
 {
-    pair<HTTPHeaderMap::iterator, bool> result = m_requestHeaders.add(name, value); 
+    pair<HTTPHeaderMap::iterator, bool> result = m_requestHeaders.add(name, value);
     if (!result.second)
         result.first->second += ", " + value;
 }
@@ -872,7 +719,7 @@ String XMLHttpRequest::getRequestHeader(const AtomicString& name) const
 
 String XMLHttpRequest::getAllResponseHeaders(ExceptionCode& ec) const
 {
-    if (m_state < LOADING) {
+    if (m_state < HEADERS_RECEIVED) {
         ec = INVALID_STATE_ERR;
         return "";
     }
@@ -906,7 +753,7 @@ String XMLHttpRequest::getAllResponseHeaders(ExceptionCode& ec) const
 
 String XMLHttpRequest::getResponseHeader(const AtomicString& name, ExceptionCode& ec) const
 {
-    if (m_state < LOADING) {
+    if (m_state < HEADERS_RECEIVED) {
         ec = INVALID_STATE_ERR;
         return "";
     }
@@ -939,7 +786,7 @@ String XMLHttpRequest::responseMIMEType() const
     }
     if (mimeType.isEmpty())
         mimeType = "text/xml";
-    
+
     return mimeType;
 }
 
@@ -981,7 +828,7 @@ void XMLHttpRequest::didFail(const ResourceError& error)
         cache()->loader()->nonCacheRequestComplete(m_url);
         m_didTellLoaderAboutRequest = false;
     }
-    
+
     // If we are already in an error state, for instance we called abort(), bail out early.
     if (m_error)
         return;
@@ -1011,11 +858,6 @@ void XMLHttpRequest::didFinishLoading(unsigned long identifier)
     if (m_error)
         return;
 
-    if (m_inPreflight) {
-        didFinishLoadingPreflight();
-        return;
-    }
-
     if (m_state < HEADERS_RECEIVED)
         changeState(HEADERS_RECEIVED);
 
@@ -1023,7 +865,9 @@ void XMLHttpRequest::didFinishLoading(unsigned long identifier)
         m_responseText += m_decoder->flush();
 
     scriptExecutionContext()->resourceRetrievedByXMLHttpRequest(identifier, m_responseText);
+#if ENABLE(INSPECTOR)
     scriptExecutionContext()->addMessage(InspectorControllerDestination, JSMessageSource, LogMessageType, LogMessageLevel, "XHR finished loading: \"" + m_url + "\".", m_lastSendLineNumber, m_lastSendURL);
+#endif
 
     bool hadLoader = m_loader;
     m_loader = 0;
@@ -1035,19 +879,6 @@ void XMLHttpRequest::didFinishLoading(unsigned long identifier)
         dropProtection();
 }
 
-void XMLHttpRequest::didFinishLoadingPreflight()
-{
-    ASSERT(m_inPreflight);
-    ASSERT(!m_sameOriginRequest);
-
-    // FIXME: this can probably be moved to didReceiveResponsePreflight.
-    if (m_async)
-        handleAsynchronousPreflightResult();
-
-    if (m_loader)
-        unsetPendingActivity(this);
-}
-
 void XMLHttpRequest::didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
 {
     if (!m_upload)
@@ -1065,45 +896,12 @@ void XMLHttpRequest::didSendData(unsigned long long bytesSent, unsigned long lon
 
 void XMLHttpRequest::didReceiveResponse(const ResourceResponse& response)
 {
-    if (m_inPreflight) {
-        didReceiveResponsePreflight(response);
-        return;
-    }
-
-    if (!m_sameOriginRequest) {
-        if (!passesAccessControlCheck(response, m_includeCredentials, scriptExecutionContext()->securityOrigin())) {
-            networkError();
-            return;
-        }
-    }
-
     m_response = response;
     m_responseEncoding = extractCharsetFromMediaType(m_mimeTypeOverride);
     if (m_responseEncoding.isEmpty())
         m_responseEncoding = response.textEncodingName();
 }
 
-void XMLHttpRequest::didReceiveResponsePreflight(const ResourceResponse& response)
-{
-    ASSERT(m_inPreflight);
-    ASSERT(!m_sameOriginRequest);
-
-    if (!passesAccessControlCheck(response, m_includeCredentials, scriptExecutionContext()->securityOrigin())) {
-        networkError();
-        return;
-    }
-
-    OwnPtr<CrossOriginPreflightResultCacheItem> preflightResult(new CrossOriginPreflightResultCacheItem(m_includeCredentials));
-    if (!preflightResult->parse(response)
-        || !preflightResult->allowsCrossOriginMethod(m_method)
-        || !preflightResult->allowsCrossOriginHeaders(m_requestHeaders)) {
-        networkError();
-        return;
-    }
-
-    CrossOriginPreflightResultCache::shared().appendEntry(scriptExecutionContext()->securityOrigin()->toString(), m_url, preflightResult.release());
-}
-
 void XMLHttpRequest::didReceiveAuthenticationCancellation(const ResourceResponse& failureResponse)
 {
     m_response = failureResponse;
@@ -1111,12 +909,12 @@ void XMLHttpRequest::didReceiveAuthenticationCancellation(const ResourceResponse
 
 void XMLHttpRequest::didReceiveData(const char* data, int len)
 {
-    if (m_inPreflight || m_error)
+    if (m_error)
         return;
 
     if (m_state < HEADERS_RECEIVED)
         changeState(HEADERS_RECEIVED);
-  
+
     if (!m_decoder) {
         if (!m_responseEncoding.isEmpty())
             m_decoder = TextResourceDecoder::create("text/plain", m_responseEncoding);
@@ -1210,7 +1008,7 @@ void XMLHttpRequest::dispatchLoadStartEvent()
 
 void XMLHttpRequest::dispatchProgressEvent(long long expectedLength)
 {
-    dispatchXMLHttpRequestProgressEvent(m_onProgressListener.get(), eventNames().progressEvent, expectedLength && m_receivedLength <= expectedLength, 
+    dispatchXMLHttpRequestProgressEvent(m_onProgressListener.get(), eventNames().progressEvent, expectedLength && m_receivedLength <= expectedLength,
                                         static_cast<unsigned>(m_receivedLength), static_cast<unsigned>(expectedLength));
 }
 
@@ -1235,4 +1033,4 @@ ScriptExecutionContext* XMLHttpRequest::scriptExecutionContext() const
     return ActiveDOMObject::scriptExecutionContext();
 }
 
-} // namespace WebCore 
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.h b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.h
index d581d3d..aa33b8b 100644
--- a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.h
+++ b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.h
@@ -117,7 +117,7 @@ public:
 
 private:
     XMLHttpRequest(ScriptExecutionContext*);
-    
+
     virtual void refEventTarget() { ref(); }
     virtual void derefEventTarget() { deref(); }
 
@@ -135,10 +135,6 @@ private:
     virtual void didFailRedirectCheck();
     virtual void didReceiveAuthenticationCancellation(const ResourceResponse&);
 
-    // Special versions for the preflight
-    void didReceiveResponsePreflight(const ResourceResponse&);
-    void didFinishLoadingPreflight();
-
     void updateAndDispatchOnProgress(unsigned int len);
 
     String responseMIMEType() const;
@@ -159,16 +155,6 @@ private:
 
     void createRequest(ExceptionCode&);
 
-    void makeSameOriginRequest(ExceptionCode&);
-    void makeCrossOriginAccessRequest(ExceptionCode&);
-
-    void makeSimpleCrossOriginAccessRequest(ExceptionCode&);
-    void makeCrossOriginAccessRequestWithPreflight(ExceptionCode&);
-    void handleAsynchronousPreflightResult();
-
-    void loadRequestSynchronously(ResourceRequest&, ExceptionCode&);
-    void loadRequestAsynchronously(ResourceRequest&);
-
     void genericError();
     void networkError();
     void abortError();
@@ -223,13 +209,11 @@ private:
     bool m_uploadComplete;
 
     bool m_sameOriginRequest;
-    bool m_allowAccess;
-    bool m_inPreflight;
     bool m_didTellLoaderAboutRequest;
 
     // Used for onprogress tracking
     long long m_receivedLength;
-    
+
     unsigned m_lastSendLineNumber;
     String m_lastSendURL;
     ExceptionCode m_exceptionCode;
diff --git a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestUpload.cpp b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestUpload.cpp
index d8a76d5..0fe329d 100644
--- a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestUpload.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequestUpload.cpp
@@ -64,7 +64,7 @@ void XMLHttpRequestUpload::addEventListener(const AtomicString& eventType, PassR
     } else {
         ListenerVector& listeners = iter->second;
         for (ListenerVector::iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-            if (*listenerIter == eventListener)
+            if (**listenerIter == *eventListener)
                 return;
         }
         
@@ -81,7 +81,7 @@ void XMLHttpRequestUpload::removeEventListener(const AtomicString& eventType, Ev
 
     ListenerVector& listeners = iter->second;
     for (ListenerVector::const_iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-        if (*listenerIter == eventListener) {
+        if (**listenerIter == *eventListener) {
             listeners.remove(listenerIter - listeners.begin());
             return;
         }
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathNamespace.cpp b/src/3rdparty/webkit/WebCore/xml/XPathNamespace.cpp
index 3c8c42c..9646402 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathNamespace.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XPathNamespace.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright 2005 Frerich Raabe <raabe@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -33,18 +33,14 @@
 
 namespace WebCore {
 
-XPathNamespace::XPathNamespace(PassRefPtr<Element> ownerElement, const String& prefix, const String& uri)
-    : Node(ownerElement->document())
+XPathNamespace::XPathNamespace(PassRefPtr<Element> ownerElement, const AtomicString& prefix, const AtomicString& uri)
+    : Node(ownerElement->document(), CreateOther)
     , m_ownerElement(ownerElement)
     , m_prefix(prefix)
     , m_uri(uri)
 {
 }
 
-XPathNamespace::~XPathNamespace()
-{
-}
-
 Document* XPathNamespace::ownerDocument() const
 {
     return m_ownerElement->ownerDocument();
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathNamespace.h b/src/3rdparty/webkit/WebCore/xml/XPathNamespace.h
index c0e4280..996cb9a 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathNamespace.h
+++ b/src/3rdparty/webkit/WebCore/xml/XPathNamespace.h
@@ -1,6 +1,6 @@
 /*
  * Copyright 2005 Frerich Raabe <raabe@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,13 +34,11 @@
 
 namespace WebCore {
 
-    class Document;
-    class Element;
+    // FIXME: This class is never instantiated. Maybe it should be removed.
 
     class XPathNamespace : public Node {
-    public:
-        XPathNamespace(PassRefPtr<Element> ownerElement, const String& prefix, const String& uri);
-        virtual ~XPathNamespace();
+    private:
+        XPathNamespace(PassRefPtr<Element> ownerElement, const AtomicString& prefix, const AtomicString& uri);
 
         virtual Document* ownerDocument() const;
         virtual Element* ownerElement() const;
@@ -50,9 +48,8 @@ namespace WebCore {
         virtual String nodeValue() const;
         virtual const AtomicString& namespaceURI() const;
 
-        virtual Node::NodeType nodeType() const;
+        virtual NodeType nodeType() const;
 
-    private:
         RefPtr<Element> m_ownerElement;
         AtomicString m_prefix;
         AtomicString m_uri;
diff --git a/src/3rdparty/webkit/WebCore/xml/XSLImportRule.cpp b/src/3rdparty/webkit/WebCore/xml/XSLImportRule.cpp
index 6ceb108..b697c0d 100644
--- a/src/3rdparty/webkit/WebCore/xml/XSLImportRule.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XSLImportRule.cpp
@@ -89,7 +89,7 @@ void XSLImportRule::loadSheet()
     XSLStyleSheet* parentSheet = parentStyleSheet();
     if (!parentSheet->href().isNull())
         // use parent styleheet's URL as the base URL
-        absHref = KURL(KURL(parentSheet->href()), m_strHref).string();
+        absHref = KURL(KURL(ParsedURLString, parentSheet->href()), m_strHref).string();
     
     // Check for a cycle in our import chain.  If we encounter a stylesheet
     // in our parent chain with the same URL, then just bail.
diff --git a/src/3rdparty/webkit/WebCore/xml/XSLTProcessor.cpp b/src/3rdparty/webkit/WebCore/xml/XSLTProcessor.cpp
index a26fe77..8eaef67 100644
--- a/src/3rdparty/webkit/WebCore/xml/XSLTProcessor.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XSLTProcessor.cpp
@@ -118,7 +118,7 @@ static xmlDocPtr docLoaderFunc(const xmlChar* uri,
         case XSLT_LOAD_DOCUMENT: {
             xsltTransformContextPtr context = (xsltTransformContextPtr)ctxt;
             xmlChar* base = xmlNodeGetBase(context->document->doc, context->node);
-            KURL url(KURL(reinterpret_cast<const char*>(base)), reinterpret_cast<const char*>(uri));
+            KURL url(KURL(ParsedURLString, reinterpret_cast<const char*>(base)), reinterpret_cast<const char*>(uri));
             xmlFree(base);
             ResourceError error;
             ResourceResponse response;
@@ -285,12 +285,12 @@ PassRefPtr<Document> XSLTProcessor::createDocumentFromSource(const String& sourc
 
 static inline RefPtr<DocumentFragment> createFragmentFromSource(const String& sourceString, const String& sourceMIMEType, Document* outputDoc)
 {
-    RefPtr<DocumentFragment> fragment = new DocumentFragment(outputDoc);
+    RefPtr<DocumentFragment> fragment = DocumentFragment::create(outputDoc);
     
     if (sourceMIMEType == "text/html")
         parseHTMLDocumentFragment(sourceString, fragment.get());
     else if (sourceMIMEType == "text/plain")
-        fragment->addChild(new Text(outputDoc, sourceString));
+        fragment->addChild(Text::create(outputDoc, sourceString));
     else {
         bool successfulParse = parseXMLDocumentFragment(sourceString, fragment.get(), outputDoc->documentElement());
         if (!successfulParse)
diff --git a/src/3rdparty/webkit/WebKit.pri b/src/3rdparty/webkit/WebKit.pri
index b363365..ded4701 100644
--- a/src/3rdparty/webkit/WebKit.pri
+++ b/src/3rdparty/webkit/WebKit.pri
@@ -39,15 +39,24 @@ CONFIG(release, debug|release) {
 BASE_DIR = $$PWD
 INCLUDEPATH += $$PWD/WebKit/qt/Api
 
+CONFIG -= warn_on
+*-g++*:QMAKE_CXXFLAGS += -Wreturn-type -fno-strict-aliasing
+#QMAKE_CXXFLAGS += -Wall -Wno-undef -Wno-unused-parameter
+
 # Enable GNU compiler extensions to the ARM compiler for all Qt ports using RVCT
-*-armcc {
-    QMAKE_CFLAGS += --gnu
-    QMAKE_CXXFLAGS += --gnu --no_parse_templates
+symbian|*-armcc {
+    RVCT_COMMON_CFLAGS = --gnu --diag_suppress 68,111,177,368,830,1293
+    RVCT_COMMON_CXXFLAGS = $$RVCT_COMMON_CFLAGS --no_parse_templates
+    DEFINES *= QT_NO_UITOOLS
 } 
 
+*-armcc {
+    QMAKE_CFLAGS += $$RVCT_COMMON_CFLAGS
+    QMAKE_CXXFLAGS += $$RVCT_COMMON_CXXFLAGS
+}
+
 symbian {
-    QMAKE_CXXFLAGS.ARMCC += --gnu --no_parse_templates
-    DEFINES *= QT_NO_UITOOLS
+    QMAKE_CXXFLAGS.ARMCC += $$RVCT_COMMON_CXXFLAGS
 }
 
 contains(DEFINES, QT_NO_UITOOLS): CONFIG -= uitools
diff --git a/src/3rdparty/webkit/WebKit/ChangeLog b/src/3rdparty/webkit/WebKit/ChangeLog
index c7913d2..a870e74 100644
--- a/src/3rdparty/webkit/WebKit/ChangeLog
+++ b/src/3rdparty/webkit/WebKit/ChangeLog
@@ -1,3 +1,324 @@
+2009-09-07  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Adds a mock Geolocation service. This will be used to provide predictable behavior of the
+        Geolocation API for use in LayoutTests. Later changes will integrate the the mock
+        Geolocation service with DumpRenderTree.
+        https://bugs.webkit.org/show_bug.cgi?id=28264
+
+        * WebKit.xcodeproj/project.pbxproj: Modified. Adds WebGeolocationMock.
+
+2009-09-03  John Sullivan  <sullivan@apple.com>
+
+        Reviewed by Adam Roben
+
+        * StringsNotToBeLocalized.txt:
+        Brought this file up to date.
+
+2009-08-31  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Beth Dakin.
+
+        Remove WebViewEditingContextMenu.nib and WebViewEditingContextMenuOld.nib.
+        We stopped using these back in r18592 when we switched over to context menus
+        driven by WebCore.
+
+        * English.lproj/WebViewEditingContextMenu.nib/classes.nib: Removed.
+        * English.lproj/WebViewEditingContextMenu.nib/info.nib: Removed.
+        * English.lproj/WebViewEditingContextMenu.nib/objects.nib: Removed.
+        * English.lproj/WebViewEditingContextMenuOld.nib/classes.nib: Removed.
+        * English.lproj/WebViewEditingContextMenuOld.nib/info.nib: Removed.
+        * English.lproj/WebViewEditingContextMenuOld.nib/objects.nib: Removed.
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-08-28  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by John Sullivan.
+
+        update-webkit-localizable-strings script can no longer complete
+        https://bugs.webkit.org/show_bug.cgi?id=28792
+
+        * English.lproj/Localizable.strings:
+
+2009-08-27  John Sullivan  <sullivan@apple.com>
+
+        * StringsNotToBeLocalized.txt:
+        Brought up to date, other than the problem mentioned in https://bugs.webkit.org/show_bug.cgi?id=28792
+
+2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <video> and <audio> controller should be accessible
+        https://bugs.webkit.org/show_bug.cgi?id=28081
+
+        Add localized strings for media controller accessiblility.
+
+        * English.lproj/Localizable.strings:
+
+2009-08-20  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Enable various "grouping" ARIA roles
+        https://bugs.webkit.org/show_bug.cgi?id=28486
+
+        * English.lproj/Localizable.strings:
+
+2009-08-18  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Need to extend DumpRenderTree to expose number of worker threads.
+        https://bugs.webkit.org/show_bug.cgi?id=28292
+
+        * WebKit.xcodeproj/project.pbxproj:
+        Added WebWorkersPrivate APIs to mac WebKit to expose workerThreadCount() for DumpRenderTree.
+
+2009-08-06  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Add explicit dependencies for our build verification scripts to ensure that they always run after linking has completed.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-08-06  Mark Rowe  <mrowe@apple.com>
+
+        Bring a little order to our otherwise out of control lives.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-08-06  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        Don't attempt to build a file that Anders just deleted.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-07-29  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/27788> Don't export WebPluginController.h as a private header
+
+        Reviewed by Mark Rowe.
+
+        WebPluginController.h includes WebPluginContainerCheck.h, which
+        is not a private header.  Since WebPluginController.h doesn't
+        appear to be used anywhere, remove its private header status.
+
+        * WebKit.xcodeproj/project.pbxproj: Remove private header
+        attribute from WebPluginController.h.
+
+2009-07-28  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by David Levin.
+
+        Added FrameLoaderClient for Haiku WebCore support.
+        https://bugs.webkit.org/show_bug.cgi?id=26952
+
+        * haiku/WebCoreSupport/FrameLoaderClientHaiku.cpp: Added.
+        (WebCore::FrameLoaderClientHaiku::FrameLoaderClientHaiku):
+        (WebCore::FrameLoaderClientHaiku::setFrame):
+        (WebCore::FrameLoaderClientHaiku::setWebView):
+        (WebCore::FrameLoaderClientHaiku::detachFrameLoader):
+        (WebCore::FrameLoaderClientHaiku::hasWebView):
+        (WebCore::FrameLoaderClientHaiku::hasBackForwardList):
+        (WebCore::FrameLoaderClientHaiku::resetBackForwardList):
+        (WebCore::FrameLoaderClientHaiku::provisionalItemIsTarget):
+        (WebCore::FrameLoaderClientHaiku::makeRepresentation):
+        (WebCore::FrameLoaderClientHaiku::forceLayout):
+        (WebCore::FrameLoaderClientHaiku::forceLayoutForNonHTML):
+        (WebCore::FrameLoaderClientHaiku::updateHistoryForCommit):
+        (WebCore::FrameLoaderClientHaiku::updateHistoryForBackForwardNavigation):
+        (WebCore::FrameLoaderClientHaiku::updateHistoryForReload):
+        (WebCore::FrameLoaderClientHaiku::updateHistoryForStandardLoad):
+        (WebCore::FrameLoaderClientHaiku::updateHistoryForInternalLoad):
+        (WebCore::FrameLoaderClientHaiku::updateHistoryAfterClientRedirect):
+        (WebCore::FrameLoaderClientHaiku::setCopiesOnScroll):
+        (WebCore::FrameLoaderClientHaiku::tokenForLoadErrorReset):
+        (WebCore::FrameLoaderClientHaiku::resetAfterLoadError):
+        (WebCore::FrameLoaderClientHaiku::doNotResetAfterLoadError):
+        (WebCore::FrameLoaderClientHaiku::willCloseDocument):
+        (WebCore::FrameLoaderClientHaiku::detachedFromParent2):
+        (WebCore::FrameLoaderClientHaiku::detachedFromParent3):
+        (WebCore::FrameLoaderClientHaiku::dispatchDidHandleOnloadEvents):
+        (WebCore::FrameLoaderClientHaiku::dispatchDidReceiveServerRedirectForProvisionalLoad):
+        (WebCore::FrameLoaderClientHaiku::dispatchDidCancelClientRedirect):
+        (WebCore::FrameLoaderClientHaiku::dispatchWillPerformClientRedirect):
+        (WebCore::FrameLoaderClientHaiku::dispatchDidChangeLocationWithinPage):
+        (WebCore::FrameLoaderClientHaiku::dispatchWillClose):
+        (WebCore::FrameLoaderClientHaiku::dispatchDidStartProvisionalLoad):
+        (WebCore::FrameLoaderClientHaiku::dispatchDidReceiveTitle):
+        (WebCore::FrameLoaderClientHaiku::dispatchDidCommitLoad):
+        (WebCore::FrameLoaderClientHaiku::dispatchDidFinishDocumentLoad):
+        (WebCore::FrameLoaderClientHaiku::dispatchDidFinishLoad):
+        (WebCore::FrameLoaderClientHaiku::dispatchDidFirstLayout):
+        (WebCore::FrameLoaderClientHaiku::dispatchDidFirstVisuallyNonEmptyLayout):
+        (WebCore::FrameLoaderClientHaiku::dispatchShow):
+        (WebCore::FrameLoaderClientHaiku::cancelPolicyCheck):
+        (WebCore::FrameLoaderClientHaiku::dispatchWillSubmitForm):
+        (WebCore::FrameLoaderClientHaiku::dispatchDidLoadMainResource):
+        (WebCore::FrameLoaderClientHaiku::revertToProvisionalState):
+        (WebCore::FrameLoaderClientHaiku::postProgressStartedNotification):
+        (WebCore::FrameLoaderClientHaiku::postProgressEstimateChangedNotification):
+        (WebCore::FrameLoaderClientHaiku::postProgressFinishedNotification):
+        (WebCore::FrameLoaderClientHaiku::progressStarted):
+        (WebCore::FrameLoaderClientHaiku::progressCompleted):
+        (WebCore::FrameLoaderClientHaiku::setMainFrameDocumentReady):
+        (WebCore::FrameLoaderClientHaiku::willChangeTitle):
+        (WebCore::FrameLoaderClientHaiku::didChangeTitle):
+        (WebCore::FrameLoaderClientHaiku::finishedLoading):
+        (WebCore::FrameLoaderClientHaiku::canShowMIMEType):
+        (WebCore::FrameLoaderClientHaiku::representationExistsForURLScheme):
+        (WebCore::FrameLoaderClientHaiku::generatedMIMETypeForURLScheme):
+        (WebCore::FrameLoaderClientHaiku::frameLoadCompleted):
+        (WebCore::FrameLoaderClientHaiku::saveViewStateToItem):
+        (WebCore::FrameLoaderClientHaiku::restoreViewState):
+        (WebCore::FrameLoaderClientHaiku::restoreScrollPositionAndViewState):
+        (WebCore::FrameLoaderClientHaiku::provisionalLoadStarted):
+        (WebCore::FrameLoaderClientHaiku::shouldTreatURLAsSameAsCurrent):
+        (WebCore::FrameLoaderClientHaiku::addHistoryItemForFragmentScroll):
+        (WebCore::FrameLoaderClientHaiku::didFinishLoad):
+        (WebCore::FrameLoaderClientHaiku::prepareForDataSourceReplacement):
+        (WebCore::FrameLoaderClientHaiku::setTitle):
+        (WebCore::FrameLoaderClientHaiku::userAgent):
+        (WebCore::FrameLoaderClientHaiku::dispatchDidReceiveIcon):
+        (WebCore::FrameLoaderClientHaiku::frameLoaderDestroyed):
+        (WebCore::FrameLoaderClientHaiku::canHandleRequest):
+        (WebCore::FrameLoaderClientHaiku::partClearedInBegin):
+        (WebCore::FrameLoaderClientHaiku::updateGlobalHistory):
+        (WebCore::FrameLoaderClientHaiku::updateGlobalHistoryRedirectLinks):
+        (WebCore::FrameLoaderClientHaiku::shouldGoToHistoryItem):
+        (WebCore::FrameLoaderClientHaiku::saveScrollPositionAndViewStateToItem):
+        (WebCore::FrameLoaderClientHaiku::canCachePage):
+        (WebCore::FrameLoaderClientHaiku::setMainDocumentError):
+        (WebCore::FrameLoaderClientHaiku::committedLoad):
+        (WebCore::FrameLoaderClientHaiku::cancelledError):
+        (WebCore::FrameLoaderClientHaiku::blockedError):
+        (WebCore::FrameLoaderClientHaiku::cannotShowURLError):
+        (WebCore::FrameLoaderClientHaiku::interruptForPolicyChangeError):
+        (WebCore::FrameLoaderClientHaiku::cannotShowMIMETypeError):
+        (WebCore::FrameLoaderClientHaiku::fileDoesNotExistError):
+        (WebCore::FrameLoaderClientHaiku::shouldFallBack):
+        (WebCore::FrameLoaderClientHaiku::createDocumentLoader):
+        (WebCore::FrameLoaderClientHaiku::download):
+        (WebCore::FrameLoaderClientHaiku::assignIdentifierToInitialRequest):
+        (WebCore::FrameLoaderClientHaiku::dispatchWillSendRequest):
+        (WebCore::FrameLoaderClientHaiku::shouldUseCredentialStorage):
+        (WebCore::FrameLoaderClientHaiku::dispatchDidReceiveAuthenticationChallenge):
+        (WebCore::FrameLoaderClientHaiku::dispatchDidCancelAuthenticationChallenge):
+        (WebCore::FrameLoaderClientHaiku::dispatchDidReceiveResponse):
+        (WebCore::FrameLoaderClientHaiku::dispatchDidReceiveContentLength):
+        (WebCore::FrameLoaderClientHaiku::dispatchDidFinishLoading):
+        (WebCore::FrameLoaderClientHaiku::dispatchDidFailLoading):
+        (WebCore::FrameLoaderClientHaiku::dispatchDidLoadResourceFromMemoryCache):
+        (WebCore::FrameLoaderClientHaiku::dispatchDidLoadResourceByXMLHttpRequest):
+        (WebCore::FrameLoaderClientHaiku::dispatchDidFailProvisionalLoad):
+        (WebCore::FrameLoaderClientHaiku::dispatchDidFailLoad):
+        (WebCore::FrameLoaderClientHaiku::dispatchCreatePage):
+        (WebCore::FrameLoaderClientHaiku::dispatchDecidePolicyForMIMEType):
+        (WebCore::FrameLoaderClientHaiku::dispatchDecidePolicyForNewWindowAction):
+        (WebCore::FrameLoaderClientHaiku::dispatchDecidePolicyForNavigationAction):
+        (WebCore::FrameLoaderClientHaiku::dispatchUnableToImplementPolicy):
+        (WebCore::FrameLoaderClientHaiku::startDownload):
+        (WebCore::FrameLoaderClientHaiku::createFrame):
+        (WebCore::FrameLoaderClientHaiku::objectContentType):
+        (WebCore::FrameLoaderClientHaiku::createPlugin):
+        (WebCore::FrameLoaderClientHaiku::redirectDataToPlugin):
+        (WebCore::FrameLoaderClientHaiku::pluginWillHandleLoadError):
+        (WebCore::FrameLoaderClientHaiku::createJavaAppletWidget):
+        (WebCore::FrameLoaderClientHaiku::overrideMediaType):
+        (WebCore::FrameLoaderClientHaiku::windowObjectCleared):
+        (WebCore::FrameLoaderClientHaiku::documentElementAvailable):
+        (WebCore::FrameLoaderClientHaiku::didPerformFirstNavigation):
+        (WebCore::FrameLoaderClientHaiku::registerForIconNotification):
+        (WebCore::FrameLoaderClientHaiku::savePlatformDataToCachedFrame):
+        (WebCore::FrameLoaderClientHaiku::transitionToCommittedFromCachedFrame):
+        (WebCore::FrameLoaderClientHaiku::transitionToCommittedForNewPage):
+        * haiku/WebCoreSupport/FrameLoaderClientHaiku.h: Added.
+        (WebCore::FrameLoaderClientHaiku::~FrameLoaderClientHaiku):
+
+2009-07-28  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by David Levin.
+
+        Added ChromeClient for Haiku WebCore support.
+        https://bugs.webkit.org/show_bug.cgi?id=26952
+
+        * haiku/WebCoreSupport/ChromeClientHaiku.cpp: Added.
+        (WebCore::ChromeClientHaiku::ChromeClientHaiku):
+        (WebCore::ChromeClientHaiku::~ChromeClientHaiku):
+        (WebCore::ChromeClientHaiku::chromeDestroyed):
+        (WebCore::ChromeClientHaiku::setWindowRect):
+        (WebCore::ChromeClientHaiku::windowRect):
+        (WebCore::ChromeClientHaiku::pageRect):
+        (WebCore::ChromeClientHaiku::scaleFactor):
+        (WebCore::ChromeClientHaiku::focus):
+        (WebCore::ChromeClientHaiku::unfocus):
+        (WebCore::ChromeClientHaiku::canTakeFocus):
+        (WebCore::ChromeClientHaiku::takeFocus):
+        (WebCore::ChromeClientHaiku::createWindow):
+        (WebCore::ChromeClientHaiku::createModalDialog):
+        (WebCore::ChromeClientHaiku::show):
+        (WebCore::ChromeClientHaiku::canRunModal):
+        (WebCore::ChromeClientHaiku::runModal):
+        (WebCore::ChromeClientHaiku::setToolbarsVisible):
+        (WebCore::ChromeClientHaiku::toolbarsVisible):
+        (WebCore::ChromeClientHaiku::setStatusbarVisible):
+        (WebCore::ChromeClientHaiku::statusbarVisible):
+        (WebCore::ChromeClientHaiku::setScrollbarsVisible):
+        (WebCore::ChromeClientHaiku::scrollbarsVisible):
+        (WebCore::ChromeClientHaiku::setMenubarVisible):
+        (WebCore::ChromeClientHaiku::menubarVisible):
+        (WebCore::ChromeClientHaiku::setResizable):
+        (WebCore::ChromeClientHaiku::addMessageToConsole):
+        (WebCore::ChromeClientHaiku::canRunBeforeUnloadConfirmPanel):
+        (WebCore::ChromeClientHaiku::runBeforeUnloadConfirmPanel):
+        (WebCore::ChromeClientHaiku::closeWindowSoon):
+        (WebCore::ChromeClientHaiku::runJavaScriptAlert):
+        (WebCore::ChromeClientHaiku::runJavaScriptConfirm):
+        (WebCore::ChromeClientHaiku::runJavaScriptPrompt):
+        (WebCore::ChromeClientHaiku::setStatusbarText):
+        (WebCore::ChromeClientHaiku::shouldInterruptJavaScript):
+        (WebCore::ChromeClientHaiku::tabsToLinks):
+        (WebCore::ChromeClientHaiku::windowResizerRect):
+        (WebCore::ChromeClientHaiku::repaint):
+        (WebCore::ChromeClientHaiku::scroll):
+        (WebCore::ChromeClientHaiku::screenToWindow):
+        (WebCore::ChromeClientHaiku::windowToScreen):
+        (WebCore::ChromeClientHaiku::platformWindow):
+        (WebCore::ChromeClientHaiku::contentsSizeChanged):
+        (WebCore::ChromeClientHaiku::scrollRectIntoView):
+        (WebCore::ChromeClientHaiku::addToDirtyRegion):
+        (WebCore::ChromeClientHaiku::scrollBackingStore):
+        (WebCore::ChromeClientHaiku::updateBackingStore):
+        (WebCore::ChromeClientHaiku::mouseDidMoveOverElement):
+        (WebCore::ChromeClientHaiku::setToolTip):
+        (WebCore::ChromeClientHaiku::print):
+        (WebCore::ChromeClientHaiku::exceededDatabaseQuota):
+        (WebCore::ChromeClientWx::reachedMaxAppCacheSize):
+        (WebCore::ChromeClientHaiku::requestGeolocationPermissionForFrame):
+        (WebCore::ChromeClientHaiku::runOpenPanel):
+        (WebCore::ChromeClientHaiku::setCursor):
+        (WebCore::ChromeClientHaiku::formStateDidChange):
+        (WebCore::ChromeClientHaiku::createHTMLParserQuirks):
+        * haiku/WebCoreSupport/ChromeClientHaiku.h: Added.
+
+2009-07-28  Robert Hogan  <robert@roberthogan.net>
+
+        Reviewed by Simon Hausmann.
+
+        Add WebKit version API to Qt.
+
+        Get the current version of WebKit from WebKit/mac/Configurations/Version.xcconfig
+        at compile time and make it available to webkit ports through WebKitVersion.h.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27158
+
+        * scripts/generate-webkitversion.pl: Added
+
 2009-07-24  Andrei Popescu  <andreip@google.com>
 
         ApplicationCache should have size limit
diff --git a/src/3rdparty/webkit/WebKit/StringsNotToBeLocalized.txt b/src/3rdparty/webkit/WebKit/StringsNotToBeLocalized.txt
index 7e593ca..3f1964d 100644
--- a/src/3rdparty/webkit/WebKit/StringsNotToBeLocalized.txt
+++ b/src/3rdparty/webkit/WebKit/StringsNotToBeLocalized.txt
@@ -8,7 +8,6 @@
 " Mac OS X %@; %@) AppleWebKit/%@ (KHTML, like Gecko) %@"
 " Mac OS X %@; %@) AppleWebKit/%@ (KHTML, like Gecko)"
 " Version/3.2.1"
-" webViewDrawResizer delegate call"
 "#"
 "%"
 "%.0f"
@@ -49,12 +48,12 @@
 "._"
 ".download"
 ".html"
+".jpg"
 ".svg"
 ".xhtml"
 "/"
 "/Frameworks/PDFKit.framework"
 "/Library/Internet Plug-Ins"
-"/System/Library/Frameworks/Accelerate.framework/Accelerate"
 "/System/Library/Frameworks/ApplicationServices.framework/Frameworks/LangAnalysis.framework/LangAnalysis"
 "/System/Library/Frameworks/Carbon.framework/Frameworks/HIToolbox.framework/HIToolbox"
 "/Volumes"
@@ -74,6 +73,7 @@
 "5CACD637-F82F-491F-947A-5DCA38AA0FEA"
 "6EB8D98F-2723-4472-88D3-5936F9D6E631"
 "7"
+"7.1"
 "9"
 ":"
 "://"
@@ -96,6 +96,22 @@
 "@"
 "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+-."
 "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+.-"
+"ARIAApplicationLog"
+"ARIAApplicationMarquee"
+"ARIAApplicationStatus"
+"ARIAApplicationTimer"
+"ARIADocument"
+"ARIADocumentArticle"
+"ARIADocumentNote"
+"ARIADocumentRegion"
+"ARIALandmarkApplication"
+"ARIALandmarkBanner"
+"ARIALandmarkComplementary"
+"ARIALandmarkContentInfo"
+"ARIALandmarkMain"
+"ARIALandmarkNavigation"
+"ARIALandmarkSearch"
+"ARIAUserInterfaceTooltip"
 "AXEnhancedUserInterface"
 "AccessibleBase"
 "AccessibleObjectFromWindow"
@@ -104,6 +120,7 @@
 "AppleKeyboardUIMode"
 "AppleLanguages"
 "AppleTextDirection"
+"AudioElement"
 "BEGIN:VCALENDAR"
 "BEGIN:VCARD"
 "BP_CreatePluginMIMETypesPreferences"
@@ -113,6 +130,7 @@
 "Content-Encoding"
 "Content-Length"
 "Content-Type"
+"CurrentTimeDisplay"
 "D"
 "DCMDictionaryServiceWindowShow"
 "DELEGATE METHODS"
@@ -133,12 +151,14 @@
 "FastMallocHeapSize"
 "FastMallocReturnedSize"
 "FrameName"
+"FullscreenButton"
 "GEN_DOMObject"
 "GET"
 "GroupName"
 "HIDictionaryWindowShow"
 "HTTP "
 "Helvetica"
+"HostedNetscapePluginStream"
 "IDNScriptWhiteList"
 "IDNScriptWhiteList.txt"
 "IMM32.DLL"
@@ -167,7 +187,6 @@
 "Library/Caches"
 "Library/Internet Plug-Ins"
 "LresultFromObject"
-"Lucida Grande"
 "MIME\\Database\\Content Type"
 "MainPageJavaScript.js"
 "MemoryStream"
@@ -198,9 +217,8 @@
 "MoveWordRight"
 "MoveWordRightAndModifySelection"
 "Mozilla/5.0 (Macintosh; U; "
-"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_7; en-us) AppleWebKit/525.28.3 (KHTML, like Gecko) Version/3.2.3 Safari/525.28.3"
 "Mozilla/5.0 (Windows; U; %s; %s) AppleWebKit/%s (KHTML, like Gecko)%s%s"
-"Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/525.28.3 (KHTML, like Gecko) Version/3.2.3 Safari/525.29"
+"MuteButton"
 "NP_GetEntryPoints"
 "NP_Initialize"
 "NP_Shutdown"
@@ -213,6 +231,7 @@
 "NSEvent"
 "NSView"
 "NeXT smart paste pasteboard type"
+"NetscapePluginInstanceProxy"
 "PDFDocument"
 "PDFPreviewView"
 "PDFView"
@@ -222,21 +241,33 @@
 "PNG"
 "POST"
 "PPC"
+"PauseButton"
+"PlayButton"
 "Quartz.framework"
 "RTL"
 "Referer"
+"ReturnToRealtimeButton"
+"RewindButton"
 "SAMILang"
 "SAMIStyle"
 "Safari.exe"
+"SeekBackButton"
+"SeekForwardButton"
 "SelectAll"
+"Slider"
+"SliderThumb"
+"StatusDisplay"
+"TimeRemainingDisplay"
 "Times"
 "ToggleBold"
 "ToggleItalic"
 "U+0009"
 "U+001B"
 "UTF-8"
+"UnMuteButton"
 "UseBackForwardList"
 "User-Agent"
+"VideoElement"
 "Volumes"
 "W"
 "WEBKIT_UNSET_DYLD_FRAMEWORK_PATH"
@@ -285,7 +316,14 @@
 "WebElementTitle"
 "WebError"
 "WebFrame"
+"WebFrameCanSuspendActiveDOMObjectsKey"
+"WebFrameHasPluginsKey"
+"WebFrameHasUnloadListenerKey"
+"WebFrameMainDocumentErrorKey"
 "WebFramePolicyListener"
+"WebFrameUsesApplicationCacheKey"
+"WebFrameUsesDatabasesKey"
+"WebFrameUsesGeolocationKey"
 "WebHTMLRepresentation"
 "WebHistory"
 "WebHistoryAllItemsRemovedNotification"
@@ -321,8 +359,6 @@
 "WebKitErrorPlugInPageURLStringKey"
 "WebKitHistoryAgeInDaysLimit"
 "WebKitHistoryItemLimit"
-"WebKitInspectorAttached"
-"WebKitInspectorAttachedViewHeight"
 "WebKitInspectorHiddenPanels"
 "WebKitLocalCache"
 "WebKitLogLevel"
@@ -402,6 +438,7 @@
 "WebViewDidChangeTypingStyleNotification"
 "WebViewDidEndEditingNotification"
 "WebViewWindowClass"
+"WebWorkersPrivate"
 "Windows %d.%d"
 "Windows 95"
 "Windows 98"
@@ -429,7 +466,8 @@
 "a"
 "ab"
 "about:"
-"ads.pointroll.com"
+"actions"
+"anchorPoint"
 "applewebdata"
 "applewebdata://%@"
 "application.pdf"
@@ -446,6 +484,7 @@
 "attributeValues"
 "b"
 "basefont"
+"bounds"
 "bundlePath"
 "c"
 "canGoBack"
@@ -517,6 +556,8 @@
 "com.sunrisebrowser.Sunrise"
 "com.thinkmac.NewsLife"
 "com.yahoo.messenger3"
+"contents"
+"contentsRect"
 "cp949"
 "cpuType"
 "de.codingmonkeys.SubEthaEdit"
@@ -552,11 +593,11 @@
 "img"
 "info.colloquy"
 "insertText:"
+"inspectorStartsAttached"
 "isLoading"
 "isindex"
 "javascript:"
 "jpeg"
-"jpg"
 "js"
 "kioskmode"
 "ks_c_5601-1987"
@@ -581,6 +622,7 @@
 "nullPlugin"
 "nullplugin"
 "oleacc.dll"
+"opacity"
 "org.xlife.NewsFire"
 "panEastCursor"
 "panIcon"
@@ -593,6 +635,7 @@
 "panWestCursor"
 "pluginHostPath"
 "pluginspage"
+"position"
 "public.url"
 "public.url-name"
 "r"
@@ -608,6 +651,8 @@
 "sourceURL"
 "src"
 "sub"
+"sublayerTransform"
+"sublayers"
 "text/calendar"
 "text/directory"
 "text/html"
@@ -626,13 +671,13 @@
 "text/x-vcf"
 "textAreaResizeCorner"
 "tiff"
+"transform"
 "txt"
 "u"
 "uk.co.opencommunity.vienna2"
 "userAgent"
 "userInfo"
 "utf-16"
-"vImagePermuteChannels_ARGB8888"
 "verticalTextCursor"
 "visibleName"
 "visitCount"
diff --git a/src/3rdparty/webkit/WebKit/mac/Configurations/Version.xcconfig b/src/3rdparty/webkit/WebKit/mac/Configurations/Version.xcconfig
new file mode 100644
index 0000000..d07d57f
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/mac/Configurations/Version.xcconfig
@@ -0,0 +1,57 @@
+// Copyright (C) 2009 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+
+MAJOR_VERSION = 532;
+MINOR_VERSION = 0;
+TINY_VERSION = 0;
+FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
+
+// The bundle version and short version string are set based on the current build configuration, see below.
+BUNDLE_VERSION = $(BUNDLE_VERSION_$(CONFIGURATION));
+SHORT_VERSION_STRING = $(SHORT_VERSION_STRING_$(CONFIGURATION))
+
+// The system version prefix is based on the current system version.
+SYSTEM_VERSION_PREFIX = $(SYSTEM_VERSION_PREFIX_$(MAC_OS_X_VERSION_MAJOR));
+SYSTEM_VERSION_PREFIX_ = 4; // Some Tiger versions of Xcode don't set MAC_OS_X_VERSION_MAJOR.
+SYSTEM_VERSION_PREFIX_1040 = 4;
+SYSTEM_VERSION_PREFIX_1050 = 5;
+SYSTEM_VERSION_PREFIX_1060 = 6;
+
+// The production build always uses the full version with a system version prefix.
+BUNDLE_VERSION_Production = $(SYSTEM_VERSION_PREFIX)$(FULL_VERSION);
+BUNDLE_VERSION_ = $(BUNDLE_VERSION_Production);
+
+// The production build always uses the major version with a system version prefix
+SHORT_VERSION_STRING_Production = $(SYSTEM_VERSION_PREFIX)$(MAJOR_VERSION);
+SHORT_VERSION_STRING_ = $(SHORT_VERSION_STRING_Production);
+
+// Local builds are the full version with a plus suffix.
+BUNDLE_VERSION_Release = $(FULL_VERSION)+;
+BUNDLE_VERSION_Debug = $(BUNDLE_VERSION_Release);
+
+// Local builds use the major version with a plus suffix
+SHORT_VERSION_STRING_Release = $(MAJOR_VERSION)+;
+SHORT_VERSION_STRING_Debug = $(SHORT_VERSION_STRING_Release);
+
+DYLIB_COMPATIBILITY_VERSION = 1;
+DYLIB_CURRENT_VERSION = $(FULL_VERSION);
diff --git a/src/3rdparty/webkit/WebKit/mac/Workers/WebWorkersPrivate.h b/src/3rdparty/webkit/WebKit/mac/Workers/WebWorkersPrivate.h
new file mode 100644
index 0000000..0ff60d5
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/mac/Workers/WebWorkersPrivate.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+@interface WebWorkersPrivate : NSObject {
+}
+
+// Returns the total number of currently executing worker threads (shared + dedicated).
++ (unsigned) workerThreadCount;
+
+@end
diff --git a/src/3rdparty/webkit/WebKit/mac/Workers/WebWorkersPrivate.mm b/src/3rdparty/webkit/WebKit/mac/Workers/WebWorkersPrivate.mm
new file mode 100644
index 0000000..2c14ad1
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/mac/Workers/WebWorkersPrivate.mm
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "WebWorkersPrivate.h"
+
+#import <WebCore/WorkerThread.h>
+
+@implementation WebWorkersPrivate
+
++ (unsigned) workerThreadCount
+{
+#if ENABLE_WORKERS
+    return WebCore::WorkerThread::workerThreadCount();
+#else
+    return 0;
+#endif
+}
+
+@end
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/headers.pri b/src/3rdparty/webkit/WebKit/qt/Api/headers.pri
index d92eb1c..51abba4 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/headers.pri
+++ b/src/3rdparty/webkit/WebKit/qt/Api/headers.pri
@@ -1,4 +1,5 @@
 WEBKIT_API_HEADERS = $$PWD/qwebframe.h \
+                     $$PWD/qwebgraphicsitem.h \
                      $$PWD/qwebkitglobal.h \
                      $$PWD/qwebpage.h \
                      $$PWD/qwebview.h \
@@ -7,5 +8,8 @@ WEBKIT_API_HEADERS = $$PWD/qwebframe.h \
                      $$PWD/qwebdatabase.h \
                      $$PWD/qwebsecurityorigin.h \
                      $$PWD/qwebelement.h \
+                     $$PWD/qwebplugindatabase.h \
                      $$PWD/qwebpluginfactory.h \
-                     $$PWD/qwebhistory.h
+                     $$PWD/qwebhistory.h \
+                     $$PWD/qwebinspector.h \
+                     $$PWD/qwebkitversion.h
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.cpp
index 57c8b0d..ff086f6 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.cpp
@@ -23,8 +23,8 @@
 #include "CSSComputedStyleDeclaration.h"
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSParser.h"
-#include "CSSRuleList.h"
 #include "CSSRule.h"
+#include "CSSRuleList.h"
 #include "CSSStyleRule.h"
 #include "CString.h"
 #include "Document.h"
@@ -42,6 +42,7 @@
 #include "qwebframe.h"
 #include "qwebframe_p.h"
 #include "runtime_root.h"
+#include <parser/SourceCode.h>
 #include <wtf/Vector.h>
 
 using namespace WebCore;
@@ -218,7 +219,7 @@ QList<QWebElement> QWebElement::findAll(const QString &selectorQuery) const
     if (!nodes)
         return elements;
 
-    for (int i = 0; i < nodes->length(); ++i) {
+    for (unsigned i = 0; i < nodes->length(); ++i) {
         WebCore::Node* n = nodes->item(i);
         elements.append(QWebElement(static_cast<Element*>(n)));
     }
@@ -697,7 +698,7 @@ static bool setupScriptObject(WebCore::Element* element, ScriptObject& object, S
     if (!thisObject)
         return false;
 
-    object = ScriptObject(thisObject);
+    object = ScriptObject(state, thisObject);
     return true;
 }
 
@@ -1661,6 +1662,23 @@ void QWebElement::replace(const QString &markup)
 }
 
 /*!
+    \internal
+    Walk \a node's parents until a valid QWebElement is found.
+    For example, a WebCore::Text node is not a valid Html QWebElement, but its
+    enclosing p tag is.
+*/
+QWebElement QWebElement::enclosingElement(WebCore::Node* node)
+{
+    QWebElement element(node);
+
+    while (element.isNull() && node) {
+        node = node->parentNode();
+        element = QWebElement(node);
+    }
+    return element;
+}
+
+/*!
     \fn inline bool QWebElement::operator==(const QWebElement& o) const;
 
     Returns true if this element points to the same underlying DOM object as
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.h
index bc6f8a9..5f4870c 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.h
@@ -141,9 +141,12 @@ private:
     explicit QWebElement(WebCore::Element*);
     explicit QWebElement(WebCore::Node*);
 
+    static QWebElement enclosingElement(WebCore::Node*);
+
     friend class QWebFrame;
     friend class QWebHitTestResult;
     friend class QWebHitTestResultPrivate;
+    friend class QWebPage;
 
     QWebElementPrivate* d;
     WebCore::Element* m_element;
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp
index f2fe108..fe813b8 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp
@@ -540,8 +540,12 @@ QUrl QWebFrame::url() const
 */
 QUrl QWebFrame::requestedUrl() const
 {
+    // In the following edge cases (where the failing document
+    // loader does not get commited by the frame loader) it is
+    // safer to rely on outgoingReferrer than originalRequest.
     if (!d->frame->loader()->activeDocumentLoader()
-        || !d->frameLoaderClient->m_loadSucceeded)
+        || (!d->frameLoaderClient->m_loadError.isNull()
+        &&  !d->frame->loader()->outgoingReferrer().isEmpty()))
         return QUrl(d->frame->loader()->outgoingReferrer());
 
     return d->frame->loader()->originalRequest().url();
@@ -799,13 +803,11 @@ void QWebFrame::setScrollBarPolicy(Qt::Orientation orientation, Qt::ScrollBarPol
         d->horizontalScrollBarPolicy = policy;
         if (d->frame->view()) {
             d->frame->view()->setHorizontalScrollbarMode((ScrollbarMode)policy);
-            d->frame->view()->updateDefaultScrollbarState();
         }
     } else {
         d->verticalScrollBarPolicy = policy;
         if (d->frame->view()) {
             d->frame->view()->setVerticalScrollbarMode((ScrollbarMode)policy);
-            d->frame->view()->updateDefaultScrollbarState();
         }
     }
 }
@@ -1022,7 +1024,8 @@ qreal QWebFrame::zoomFactor() const
 */
 bool QWebFrame::hasFocus() const
 {
-    return QWebFramePrivate::kit(d->frame->page()->focusController()->focusedFrame()) == this;
+    WebCore::Frame* ff = d->frame->page()->focusController()->focusedFrame();
+    return ff && QWebFramePrivate::kit(ff) == this;
 }
 
 /*!
@@ -1244,7 +1247,7 @@ QVariant QWebFrame::evaluateJavaScript(const QString& scriptSource)
     ScriptController *proxy = d->frame->script();
     QVariant rc;
     if (proxy) {
-        JSC::JSValue v = proxy->evaluate(ScriptSourceCode(scriptSource)).jsValue();
+        JSC::JSValue v = d->frame->loader()->executeScript(ScriptSourceCode(scriptSource)).jsValue();
         int distance = 0;
         rc = JSC::Bindings::convertValueToQVariant(proxy->globalObject()->globalExec(), v, QMetaType::Void, &distance);
     }
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe_p.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe_p.h
index d6afc01..632f83a 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe_p.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe_p.h
@@ -79,15 +79,14 @@ public:
     WebCore::Scrollbar* horizontalScrollBar() const;
     WebCore::Scrollbar* verticalScrollBar() const;
 
-    Qt::ScrollBarPolicy horizontalScrollBarPolicy;
-    Qt::ScrollBarPolicy verticalScrollBarPolicy;
-
     static WebCore::Frame* core(QWebFrame*);
     static QWebFrame* kit(WebCore::Frame*);
 
     void renderPrivate(QPainter *painter, const QRegion &clip);
 
     QWebFrame *q;
+    Qt::ScrollBarPolicy horizontalScrollBarPolicy;
+    Qt::ScrollBarPolicy verticalScrollBarPolicy;
     WebCore::FrameLoaderClientQt *frameLoaderClient;
     WebCore::Frame *frame;
     QWebPage *page;
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebgraphicsitem.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebgraphicsitem.cpp
new file mode 100644
index 0000000..be8f6ab
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebgraphicsitem.cpp
@@ -0,0 +1,764 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "qwebgraphicsitem.h"
+
+#include "qwebframe.h"
+#include "qwebpage.h"
+#include "qwebpage_p.h"
+#include <QtGui/QGraphicsScene>
+#include <QtGui/QGraphicsView>
+#include <QtGui/qapplication.h>
+#include <QtGui/qgraphicssceneevent.h>
+#include <QtGui/qstyleoption.h>
+
+class QWebGraphicsItemPrivate {
+public:
+    QWebGraphicsItemPrivate(QWebGraphicsItem* parent)
+        : q(parent)
+        , page(0)
+        , interactive(true)
+        , progress(1.0)
+    {}
+
+    void _q_doScroll(int dx, int dy, const QRect&);
+    void _q_doLoadProgress(int progress);
+    void _q_doLoadFinished(bool success);
+    void _q_doUpdate(const QRect& dirtyRect);
+    void _q_setStatusBarMessage(const QString& message);
+
+    QWebGraphicsItem* q;
+    QWebPage* page;
+
+    QString statusBarMessage;
+    bool interactive;
+    qreal progress;
+};
+
+void QWebGraphicsItemPrivate::_q_doLoadProgress(int progress)
+{
+    if (qFuzzyCompare(this->progress, qreal(progress / 100.)))
+        return;
+
+    this->progress = progress / 100.;
+
+    emit q->progressChanged(this->progress);
+}
+
+void QWebGraphicsItemPrivate::_q_doLoadFinished(bool success)
+{
+    // If the page had no title, still make sure it gets the signal
+    if (q->title().isEmpty())
+        emit q->urlChanged(q->url());
+
+    if (success)
+        emit q->loadFinished();
+    else
+        emit q->loadFailed();
+}
+
+void QWebGraphicsItemPrivate::_q_doScroll(int dx, int dy, const QRect& rectToScroll)
+{
+    q->scroll(qreal(dx), qreal(dy), QRectF(rectToScroll));
+}
+
+void QWebGraphicsItemPrivate::_q_doUpdate(const QRect & dirtyRect)
+{
+    q->update(QRectF(dirtyRect));
+}
+
+void QWebGraphicsItemPrivate::_q_setStatusBarMessage(const QString& s)
+{
+    statusBarMessage = s;
+    emit q->statusChanged();
+}
+
+/*!
+    \class QWebGraphicsItem
+    \brief The QWebGraphicsItem class allows web content to be added to a GraphicsView.
+    \inherits QGraphicsWidget.
+    \since 4.6
+
+    A WebGraphicsItem renders web content based on a URL or set data.
+
+    If the width and height of the item is not set, they will
+    dynamically adjust to a size appropriate for the content.
+    This width may be large (eg. 980) for typical online web pages.
+*/
+
+/*!
+    Constructs an empty QWebGraphicsItem with parent \a parent.
+
+    \sa load()
+*/
+QWebGraphicsItem::QWebGraphicsItem(QGraphicsItem* parent)
+    : QGraphicsWidget(parent)
+    , d(new QWebGraphicsItemPrivate(this))
+{
+#if QT_VERSION >= 0x040600
+    setFlag(QGraphicsItem::ItemUsesExtendedStyleOption, true);
+#endif
+    setAcceptHoverEvents(true);
+    setFocusPolicy(Qt::StrongFocus);
+}
+
+/*!
+    Destroys the web graphicsitem.
+*/
+QWebGraphicsItem::~QWebGraphicsItem()
+{
+    if (d->page)
+        d->page->d->view = 0;
+
+    if (d->page && d->page->parent() == this)
+        delete d->page;
+
+    delete d;
+}
+
+/*!
+    Returns a pointer to the underlying web page.
+
+    \sa setPage()
+*/
+QWebPage* QWebGraphicsItem::page() const
+{
+    if (!d->page) {
+        QWebGraphicsItem* that = const_cast<QWebGraphicsItem*>(this);
+        QWebPage* page = new QWebPage(that);
+
+        // Default to not having a background, in the case
+        // the page doesn't provide one.
+        QPalette palette = QApplication::palette();
+        palette.setBrush(QPalette::Base, QColor::fromRgbF(0, 0, 0, 0));
+        page->setPalette(palette);
+
+        that->setPage(page);
+    }
+
+    return d->page;
+}
+
+/*! \reimp
+*/
+void QWebGraphicsItem::paint(QPainter* painter, const QStyleOptionGraphicsItem* option, QWidget*)
+{
+    page()->mainFrame()->render(painter, option->exposedRect.toRect());
+}
+
+/*! \reimp
+*/
+bool QWebGraphicsItem::sceneEvent(QEvent* event)
+{
+    // Re-implemented in order to allows fixing event-related bugs in patch releases.
+    return QGraphicsWidget::sceneEvent(event);
+}
+
+/*! \reimp
+*/
+bool QWebGraphicsItem::event(QEvent* event)
+{
+    // Re-implemented in order to allows fixing event-related bugs in patch releases.
+    return QGraphicsWidget::event(event);
+}
+
+/*!
+    Makes \a page the new web page of the web graphicsitem.
+
+    The parent QObject of the provided page remains the owner
+    of the object. If the current document is a child of the web
+    view, it will be deleted.
+
+    \sa page()
+*/
+void QWebGraphicsItem::setPage(QWebPage* page)
+{
+    if (d->page == page)
+        return;
+
+    if (d->page) {
+        if (d->page->parent() == this)
+            delete d->page;
+        else
+            d->page->disconnect(this);
+    }
+
+    d->page = page;
+    if (!d->page)
+        return;
+
+    QSize size = geometry().size().toSize();
+    page->setViewportSize(size);
+
+    QWebFrame* mainFrame = d->page->mainFrame();
+
+    connect(mainFrame, SIGNAL(titleChanged(const QString&)),
+            this, SIGNAL(titleChanged(const QString&)));
+    connect(mainFrame, SIGNAL(iconChanged()),
+            this, SIGNAL(iconChanged()));
+    connect(mainFrame, SIGNAL(urlChanged(const QUrl&)),
+            this, SIGNAL(urlChanged(const QUrl&)));
+    connect(d->page, SIGNAL(loadStarted()),
+            this, SIGNAL(loadStarted()));
+    connect(d->page, SIGNAL(loadProgress(int)),
+            this, SLOT(_q_doLoadProgress(int)));
+    connect(d->page, SIGNAL(loadFinished(bool)),
+            this, SLOT(_q_doLoadFinished(bool)));
+    connect(d->page, SIGNAL(repaintRequested(QRect)),
+            this, SLOT(_q_doUpdate(const QRect&)));
+    connect(d->page, SIGNAL(scrollRequested(int, int, const QRect&)),
+            this, SLOT(_q_doScroll(int, int, const QRect&)));
+    connect(d->page, SIGNAL(statusBarMessage(const QString&)),
+            this, SLOT(_q_setStatusBarMessage(const QString&)));
+}
+
+/*!
+    \property QWebGraphicsItem::url
+    \brief the url of the web page currently viewed
+
+    Setting this property clears the view and loads the URL.
+
+    By default, this property contains an empty, invalid URL.
+
+    \sa load(), urlChanged()
+*/
+
+void QWebGraphicsItem::setUrl(const QUrl &url)
+{
+    page()->mainFrame()->setUrl(url);
+}
+
+QUrl QWebGraphicsItem::url() const
+{
+    if (d->page)
+        return d->page->mainFrame()->url();
+
+    return QUrl();
+}
+
+/*!
+    \property QWebGraphicsItem::title
+    \brief the title of the web page currently viewed
+
+    By default, this property contains an empty string.
+
+    \sa titleChanged()
+*/
+QString QWebGraphicsItem::title() const
+{
+    if (d->page)
+        return d->page->mainFrame()->title();
+
+    return QString();
+}
+
+/*!
+    \property QWebGraphicsItem::icon
+    \brief the icon associated with the web page currently viewed
+
+    By default, this property contains a null icon.
+
+    \sa iconChanged(), QWebSettings::iconForUrl()
+*/
+QIcon QWebGraphicsItem::icon() const
+{
+    if (d->page)
+        return d->page->mainFrame()->icon();
+
+    return QIcon();
+}
+
+/*!
+    \property QWebGraphicsItem::zoomFactor
+    \since 4.5
+    \brief the zoom factor for the view
+*/
+
+void QWebGraphicsItem::setZoomFactor(qreal factor)
+{
+    if (factor == page()->mainFrame()->zoomFactor())
+        return;
+
+    page()->mainFrame()->setZoomFactor(factor);
+    emit zoomFactorChanged();
+}
+
+qreal QWebGraphicsItem::zoomFactor() const
+{
+    return page()->mainFrame()->zoomFactor();
+}
+
+/*! \reimp
+*/
+void QWebGraphicsItem::updateGeometry()
+{
+    QGraphicsWidget::updateGeometry();
+
+    if (!d->page)
+        return;
+
+    QSize size = geometry().size().toSize();
+    d->page->setViewportSize(size);
+}
+
+/*! \reimp
+*/
+void QWebGraphicsItem::setGeometry(const QRectF& rect)
+{
+    QGraphicsWidget::setGeometry(rect);
+
+    if (!d->page)
+        return;
+
+    // NOTE: call geometry() as setGeometry ensures that
+    // the geometry is within legal bounds (minimumSize, maximumSize)
+    QSize size = geometry().size().toSize();
+    d->page->setViewportSize(size);
+}
+
+/*!
+    \brief The load status message associated to the web graphicsitem
+
+    Provides the latest status message set during the load of a URL.
+    Commonly shown by Status Bar widgets.
+
+    \sa statusChanged()
+*/
+
+QString QWebGraphicsItem::status() const
+{
+    return d->statusBarMessage;
+}
+
+/*!
+    Convenience slot that stops loading the document.
+
+    \sa reload(), pageAction(), loadFinished()
+*/
+void QWebGraphicsItem::stop()
+{
+    if (d->page)
+        d->page->triggerAction(QWebPage::Stop);
+}
+
+/*!
+    Convenience slot that loads the previous document in the list of documents
+    built by navigating links. Does nothing if there is no previous document.
+
+    \sa forward(), pageAction()
+*/
+void QWebGraphicsItem::back()
+{
+    if (d->page)
+        d->page->triggerAction(QWebPage::Back);
+}
+
+/*!
+    Convenience slot that loads the next document in the list of documents
+    built by navigating links. Does nothing if there is no next document.
+
+    \sa back(), pageAction()
+*/
+void QWebGraphicsItem::forward()
+{
+    if (d->page)
+        d->page->triggerAction(QWebPage::Forward);
+}
+
+/*!
+    Reloads the current document.
+
+    \sa stop(), pageAction(), loadStarted()
+*/
+void QWebGraphicsItem::reload()
+{
+    if (d->page)
+        d->page->triggerAction(QWebPage::Reload);
+}
+
+/*!
+    \property QWebGraphicsItem::progress
+    \brief the progress of loading the current URL, from 0 to 1.
+*/
+qreal QWebGraphicsItem::progress() const
+{
+    return d->progress;
+}
+
+/*!
+    Loads the specified \a url and displays it.
+
+    \note The view remains the same until enough data has arrived to display the new \a url.
+
+    \sa setUrl(), url(), urlChanged()
+*/
+void QWebGraphicsItem::load(const QUrl& url)
+{
+    page()->mainFrame()->load(url);
+}
+
+/*!
+    \fn void QWebGraphicsItem::load(const QNetworkRequest &request, QNetworkAccessManager::Operation operation, const QByteArray &body)
+
+    Loads a network request, \a request, using the method specified in \a operation.
+
+    \a body is optional and is only used for POST operations.
+
+    \note The view remains the same until enough data has arrived to display the new url.
+
+    \sa url(), urlChanged()
+*/
+
+void QWebGraphicsItem::load(const QNetworkRequest& request,
+                    QNetworkAccessManager::Operation operation,
+                    const QByteArray& body)
+{
+    page()->mainFrame()->load(request, operation, body);
+}
+
+/*!
+    Sets the content of the web graphicsitem to the specified \a html.
+
+    External objects such as stylesheets or images referenced in the HTML
+    document are located relative to \a baseUrl.
+
+    The \a html is loaded immediately; external objects are loaded asynchronously.
+
+    When using this method, WebKit assumes that external resources such as
+    JavaScript programs or style sheets are encoded in UTF-8 unless otherwise
+    specified. For example, the encoding of an external script can be specified
+    through the charset attribute of the HTML script tag. Alternatively, the
+    encoding can also be specified by the web server.
+
+    \sa load(), setContent(), QWebFrame::toHtml()
+*/
+void QWebGraphicsItem::setHtml(const QString& html, const QUrl& baseUrl)
+{
+    page()->mainFrame()->setHtml(html, baseUrl);
+}
+
+QString QWebGraphicsItem::toHtml() const
+{
+    return page()->mainFrame()->toHtml();
+}
+
+/*!
+    Sets the content of the web graphicsitem to the specified content \a data. If the \a mimeType argument
+    is empty it is currently assumed that the content is HTML but in future versions we may introduce
+    auto-detection.
+
+    External objects referenced in the content are located relative to \a baseUrl.
+
+    The \a data is loaded immediately; external objects are loaded asynchronously.
+
+    \sa load(), setHtml(), QWebFrame::toHtml()
+*/
+void QWebGraphicsItem::setContent(const QByteArray& data, const QString& mimeType, const QUrl& baseUrl)
+{
+    page()->mainFrame()->setContent(data, mimeType, baseUrl);
+}
+
+/*!
+    Returns a pointer to the view's history of navigated web pages.
+
+    It is equivalent to
+
+    \snippet webkitsnippets/qtwebkit_qwebview_snippet.cpp 0
+*/
+QWebHistory* QWebGraphicsItem::history() const
+{
+    return page()->history();
+}
+
+/*!
+  \property QWebGraphicsItem::interactive
+  \brief controls whether the item responds to mouse and key events.
+*/
+
+bool QWebGraphicsItem::isInteractive() const
+{
+    return d->interactive;
+}
+
+void QWebGraphicsItem::setInteractive(bool allowed)
+{
+    if (d->interactive == allowed)
+        return;
+
+    d->interactive = allowed;
+    emit interactivityChanged();
+}
+
+/*!
+    Returns a pointer to the view/page specific settings object.
+
+    It is equivalent to
+
+    \snippet webkitsnippets/qtwebkit_qwebview_snippet.cpp 1
+
+    \sa QWebSettings::globalSettings()
+*/
+QWebSettings* QWebGraphicsItem::settings() const
+{
+    return page()->settings();
+}
+
+/*! \reimp
+*/
+void QWebGraphicsItem::hoverMoveEvent(QGraphicsSceneHoverEvent* ev)
+{
+    if (d->interactive && d->page) {
+        const bool accepted = ev->isAccepted();
+        QMouseEvent me = QMouseEvent(QEvent::MouseMove,
+                ev->pos().toPoint(), Qt::NoButton,
+                Qt::NoButton, Qt::NoModifier);
+        d->page->setView(ev->widget());
+        d->page->event(&me);
+        ev->setAccepted(accepted);
+    }
+
+    if (!ev->isAccepted())
+        QGraphicsItem::hoverMoveEvent(ev);
+}
+
+/*! \reimp
+*/
+void QWebGraphicsItem::hoverLeaveEvent(QGraphicsSceneHoverEvent* ev)
+{
+    Q_UNUSED(ev);
+}
+
+/*! \reimp
+*/
+void QWebGraphicsItem::mouseMoveEvent(QGraphicsSceneMouseEvent* ev)
+{
+    if (d->interactive && d->page) {
+        const bool accepted = ev->isAccepted();
+        d->page->event(ev);
+        ev->setAccepted(accepted);
+    }
+
+    if (!ev->isAccepted())
+        QGraphicsItem::mouseMoveEvent(ev);
+}
+
+/*! \reimp
+*/
+void QWebGraphicsItem::mousePressEvent(QGraphicsSceneMouseEvent* ev)
+{
+    if (d->interactive && d->page) {
+        const bool accepted = ev->isAccepted();
+        d->page->event(ev);
+        ev->setAccepted(accepted);
+    }
+
+    if (!ev->isAccepted())
+        QGraphicsItem::mousePressEvent(ev);
+}
+
+/*! \reimp
+*/
+void QWebGraphicsItem::mouseReleaseEvent(QGraphicsSceneMouseEvent* ev)
+{
+    if (d->interactive && d->page) {
+        const bool accepted = ev->isAccepted();
+        d->page->event(ev);
+        ev->setAccepted(accepted);
+    }
+
+    if (!ev->isAccepted())
+        QGraphicsItem::mouseReleaseEvent(ev);
+}
+
+/*! \reimp
+*/
+void QWebGraphicsItem::mouseDoubleClickEvent(QGraphicsSceneMouseEvent* ev)
+{
+    if (d->interactive && d->page) {
+        const bool accepted = ev->isAccepted();
+        d->page->event(ev);
+        ev->setAccepted(accepted);
+    }
+
+    if (!ev->isAccepted())
+        QGraphicsItem::mouseDoubleClickEvent(ev);
+}
+
+/*! \reimp
+*/
+void QWebGraphicsItem::keyPressEvent(QKeyEvent* ev)
+{
+    if (d->interactive && d->page)
+        d->page->event(ev);
+
+    if (!ev->isAccepted())
+        QGraphicsItem::keyPressEvent(ev);
+}
+
+/*! \reimp
+*/
+void QWebGraphicsItem::keyReleaseEvent(QKeyEvent* ev)
+{
+    if (d->interactive && d->page)
+        d->page->event(ev);
+
+    if (!ev->isAccepted())
+        QGraphicsItem::keyReleaseEvent(ev);
+}
+
+/*! \reimp
+*/
+void QWebGraphicsItem::focusInEvent(QFocusEvent* ev)
+{
+    if (d->page)
+        d->page->event(ev);
+    else
+        QGraphicsItem::focusInEvent(ev);
+}
+
+/*! \reimp
+*/
+void QWebGraphicsItem::focusOutEvent(QFocusEvent* ev)
+{
+    if (d->page)
+        d->page->event(ev);
+    else
+        QGraphicsItem::focusOutEvent(ev);
+}
+
+/*! \reimp
+*/
+bool QWebGraphicsItem::focusNextPrevChild(bool next)
+{
+    if (d->page)
+        return d->page->focusNextPrevChild(next);
+
+    return QGraphicsWidget::focusNextPrevChild(next);
+}
+
+/*! \reimp
+*/
+void QWebGraphicsItem::dragEnterEvent(QGraphicsSceneDragDropEvent* ev)
+{
+#ifndef QT_NO_DRAGANDDROP
+    //if (d->page)
+    //    d->page->event(ev);
+    //Just remove this line below when the code above is working
+    Q_UNUSED(ev);
+#else
+    Q_UNUSED(ev);
+#endif
+}
+
+/*! \reimp
+*/
+void QWebGraphicsItem::dragLeaveEvent(QGraphicsSceneDragDropEvent* ev)
+{
+#ifndef QT_NO_DRAGANDDROP
+    if (d->interactive && d->page) {
+        const bool accepted = ev->isAccepted();
+        d->page->event(ev);
+        ev->setAccepted(accepted);
+    }
+
+    if (!ev->isAccepted())
+        QGraphicsWidget::dragLeaveEvent(ev);
+#else
+    Q_UNUSED(ev);
+#endif
+}
+
+/*! \reimp
+*/
+void QWebGraphicsItem::dragMoveEvent(QGraphicsSceneDragDropEvent* ev)
+{
+#ifndef QT_NO_DRAGANDDROP
+    if (d->interactive && d->page) {
+        const bool accepted = ev->isAccepted();
+        d->page->event(ev);
+        ev->setAccepted(accepted);
+    }
+
+    if (!ev->isAccepted())
+        QGraphicsWidget::dragMoveEvent(ev);
+#else
+    Q_UNUSED(ev);
+#endif
+}
+
+/*! \reimp
+*/
+void QWebGraphicsItem::dropEvent(QGraphicsSceneDragDropEvent* ev)
+{
+#ifndef QT_NO_DRAGANDDROP
+    if (d->interactive && d->page) {
+        const bool accepted = ev->isAccepted();
+        d->page->event(ev);
+        ev->setAccepted(accepted);
+    }
+
+    if (!ev->isAccepted())
+        QGraphicsWidget::dropEvent(ev);
+#else
+    Q_UNUSED(ev);
+#endif
+}
+
+#ifndef QT_NO_CONTEXTMENU
+/*! \reimp
+*/
+void QWebGraphicsItem::contextMenuEvent(QGraphicsSceneContextMenuEvent* ev)
+{
+    if (d->page) {
+        const bool accepted = ev->isAccepted();
+        d->page->event(ev);
+        ev->setAccepted(accepted);
+    }
+}
+#endif // QT_NO_CONTEXTMENU
+
+#ifndef QT_NO_WHEELEVENT
+/*! \reimp
+*/
+void QWebGraphicsItem::wheelEvent(QGraphicsSceneWheelEvent* ev)
+{
+    if (d->interactive && d->page) {
+        const bool accepted = ev->isAccepted();
+        d->page->event(ev);
+        ev->setAccepted(accepted);
+    }
+
+    if (!ev->isAccepted())
+        QGraphicsItem::wheelEvent(ev);
+}
+#endif // QT_NO_WHEELEVENT
+
+/*! \reimp
+*/
+void QWebGraphicsItem::inputMethodEvent(QInputMethodEvent* ev)
+{
+    if (d->interactive && d->page)
+        d->page->event(ev);
+
+    if (!ev->isAccepted())
+        QGraphicsItem::inputMethodEvent(ev);
+}
+
+#include "moc_qwebgraphicsitem.cpp"
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebgraphicsitem.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebgraphicsitem.h
new file mode 100644
index 0000000..223ac42
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebgraphicsitem.h
@@ -0,0 +1,146 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef QWebGraphicsItem_h
+#define QWebGraphicsItem_h
+
+#include "qwebkitglobal.h"
+#include <QtCore/qurl.h>
+#include <QtGui/qevent.h>
+#include <QtGui/qgraphicswidget.h>
+#include <QtGui/qicon.h>
+#include <QtGui/qpainter.h>
+#include <QtNetwork/qnetworkaccessmanager.h>
+
+class QWebPage;
+class QWebHistory;
+class QWebSettings;
+
+class QWebGraphicsItemPrivate;
+
+class QWEBKIT_EXPORT QWebGraphicsItem : public QGraphicsWidget {
+    Q_OBJECT
+
+    Q_PROPERTY(QString title READ title NOTIFY titleChanged)
+    Q_PROPERTY(QIcon icon READ icon NOTIFY iconChanged)
+    Q_PROPERTY(qreal zoomFactor READ zoomFactor WRITE setZoomFactor NOTIFY zoomFactorChanged)
+    Q_PROPERTY(QString status READ status NOTIFY statusChanged)
+
+    Q_PROPERTY(QString html READ toHtml WRITE setHtml)
+    Q_PROPERTY(QUrl url READ url WRITE setUrl NOTIFY urlChanged)
+    Q_PROPERTY(qreal progress READ progress NOTIFY progressChanged)
+
+    Q_PROPERTY(bool interactive READ isInteractive WRITE setInteractive NOTIFY interactivityChanged)
+
+public:
+    QWebGraphicsItem(QGraphicsItem* parent = 0);
+    ~QWebGraphicsItem();
+
+    QWebPage* page() const;
+    void setPage(QWebPage*);
+
+    QUrl url() const;
+    void setUrl(const QUrl&);
+
+    QString title() const;
+    QIcon icon() const;
+
+    qreal zoomFactor() const;
+    void setZoomFactor(qreal);
+
+    bool isInteractive() const;
+    void setInteractive(bool);
+
+    qreal progress() const;
+
+    void load(const QUrl &url);
+    void load(const QNetworkRequest& request, QNetworkAccessManager::Operation operation = QNetworkAccessManager::GetOperation, const QByteArray& body = QByteArray());
+
+    QString toHtml() const;
+    void setHtml(const QString& html, const QUrl& baseUrl = QUrl());
+    // FIXME: Consider rename to setHtml?
+    void setContent(const QByteArray& data, const QString& mimeType = QString(), const QUrl& baseUrl = QUrl());
+
+    QWebHistory* history() const;
+    QWebSettings* settings() const;
+
+    QString status() const;
+
+    virtual void setGeometry(const QRectF& rect);
+    virtual void updateGeometry();
+    virtual void paint(QPainter*, const QStyleOptionGraphicsItem* options, QWidget* widget = 0);
+    virtual bool event(QEvent*);
+
+public Q_SLOTS:
+    void stop();
+    void back();
+    void forward();
+    void reload();
+
+Q_SIGNALS:
+    void loadStarted();
+    void loadFinished();
+    void loadFailed();
+
+    void progressChanged(qreal);
+    void interactivityChanged();
+    void urlChanged(const QUrl&);
+    void titleChanged(const QString&);
+    void iconChanged();
+    void statusChanged();
+    void zoomFactorChanged();
+
+protected:
+    virtual void mousePressEvent(QGraphicsSceneMouseEvent*);
+    virtual void mouseDoubleClickEvent(QGraphicsSceneMouseEvent*);
+    virtual void mouseReleaseEvent(QGraphicsSceneMouseEvent*);
+    virtual void mouseMoveEvent(QGraphicsSceneMouseEvent*);
+    virtual void hoverMoveEvent(QGraphicsSceneHoverEvent*);
+    virtual void hoverLeaveEvent(QGraphicsSceneHoverEvent*);
+#ifndef QT_NO_WHEELEVENT
+    virtual void wheelEvent(QGraphicsSceneWheelEvent*);
+#endif
+    virtual void keyPressEvent(QKeyEvent*);
+    virtual void keyReleaseEvent(QKeyEvent*);
+#ifndef QT_NO_CONTEXTMENU
+    virtual void contextMenuEvent(QGraphicsSceneContextMenuEvent*);
+#endif
+    virtual void dragEnterEvent(QGraphicsSceneDragDropEvent*);
+    virtual void dragLeaveEvent(QGraphicsSceneDragDropEvent*);
+    virtual void dragMoveEvent(QGraphicsSceneDragDropEvent*);
+    virtual void dropEvent(QGraphicsSceneDragDropEvent*);
+    virtual void focusInEvent(QFocusEvent*);
+    virtual void focusOutEvent(QFocusEvent*);
+    virtual void inputMethodEvent(QInputMethodEvent*);
+    virtual bool focusNextPrevChild(bool next);
+
+    virtual bool sceneEvent(QEvent*);
+
+private:
+    Q_PRIVATE_SLOT(d, void _q_doScroll(int dx, int dy, const QRect&))
+    Q_PRIVATE_SLOT(d, void _q_doLoadProgress(int progress))
+    Q_PRIVATE_SLOT(d, void _q_doLoadFinished(bool success))
+    Q_PRIVATE_SLOT(d, void _q_doUpdate(const QRect& dirtyRect))
+    Q_PRIVATE_SLOT(d, void _q_setStatusBarMessage(const QString& message))
+
+    QWebGraphicsItemPrivate* const d;
+    friend class QWebGraphicsItemPrivate;
+};
+
+#endif // QWebGraphicsItem_h
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory.cpp
index b11ae56..b57272d 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory.cpp
@@ -248,17 +248,25 @@ QWebHistory::~QWebHistory()
 */
 void QWebHistory::clear()
 {
-    RefPtr<WebCore::HistoryItem> current = d->lst->currentItem();
-    int capacity = d->lst->capacity();
-    d->lst->setCapacity(0);
+    //shortcut to private BackForwardList
+    WebCore::BackForwardList* lst = d->lst;
 
-    WebCore::Page* page = d->lst->page();
+    //clear visited links
+    WebCore::Page* page = lst->page();
     if (page && page->groupPtr())
         page->groupPtr()->removeVisitedLinks();
 
-    d->lst->setCapacity(capacity);
-    d->lst->addItem(current.get());
-    d->lst->goToItem(current.get());
+    //if count() == 0 then just return
+    if (!lst->entries().size())
+        return;
+
+    RefPtr<WebCore::HistoryItem> current = lst->currentItem();
+    int capacity = lst->capacity();
+    lst->setCapacity(0);
+
+    lst->setCapacity(capacity);   //revert capacity
+    lst->addItem(current.get());  //insert old current item
+    lst->goToItem(current.get()); //and set it as current again
 }
 
 /*!
@@ -271,7 +279,7 @@ QList<QWebHistoryItem> QWebHistory::items() const
     const WebCore::HistoryItemVector &items = d->lst->entries();
 
     QList<QWebHistoryItem> ret;
-    for (int i = 0; i < items.size(); ++i) {
+    for (unsigned i = 0; i < items.size(); ++i) {
         QWebHistoryItemPrivate *priv = new QWebHistoryItemPrivate(items[i].get());
         ret.append(QWebHistoryItem(priv));
     }
@@ -290,7 +298,7 @@ QList<QWebHistoryItem> QWebHistory::backItems(int maxItems) const
     d->lst->backListWithLimit(maxItems, items);
 
     QList<QWebHistoryItem> ret;
-    for (int i = 0; i < items.size(); ++i) {
+    for (unsigned i = 0; i < items.size(); ++i) {
         QWebHistoryItemPrivate *priv = new QWebHistoryItemPrivate(items[i].get());
         ret.append(QWebHistoryItem(priv));
     }
@@ -309,7 +317,7 @@ QList<QWebHistoryItem> QWebHistory::forwardItems(int maxItems) const
     d->lst->forwardListWithLimit(maxItems, items);
 
     QList<QWebHistoryItem> ret;
-    for (int i = 0; i < items.size(); ++i) {
+    for (unsigned i = 0; i < items.size(); ++i) {
         QWebHistoryItemPrivate *priv = new QWebHistoryItemPrivate(items[i].get());
         ret.append(QWebHistoryItem(priv));
     }
@@ -533,7 +541,7 @@ QByteArray QWebHistory::saveState(HistoryStateVersion version) const
         stream << count() << currentItemIndex();
 
         const WebCore::HistoryItemVector &items = d->lst->entries();
-        for (int i = 0; i < items.size(); i++)
+        for (unsigned i = 0; i < items.size(); i++)
             items[i].get()->saveState(stream, version);
 
         if (stream.status() != QDataStream::Ok)
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory_p.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory_p.h
index e77adef..809d405 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory_p.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory_p.h
@@ -27,11 +27,11 @@
 
 class Q_AUTOTEST_EXPORT QWebHistoryItemPrivate : public QSharedData {
 public:
-    static QExplicitlySharedDataPointer<QWebHistoryItemPrivate> get(QWebHistoryItem *q)
+    static QExplicitlySharedDataPointer<QWebHistoryItemPrivate> get(QWebHistoryItem* q)
     {
         return q->d;
     }
-    QWebHistoryItemPrivate(WebCore::HistoryItem *i)
+    QWebHistoryItemPrivate(WebCore::HistoryItem* i)
     {
         if (i)
             i->ref();
@@ -43,30 +43,12 @@ public:
             item->deref();
     }
 
- /*   QByteArray saveStateWithoutVersionControl(QWebHistory::HistoryStateVersion version)
-    {
-        QByteArray buffer;
-        switch(version){
-            case QWebHistory::HistoryVersion1:
-                buffer=item->saveState(version);
-                break;
-            default:{}
-        }
-        return buffer;
-    }
-
-    bool restoreStateWithoutVersionControl(QWebHistory::HistoryStateVersion version,QDataStream& stream)
-    {
-
-    }
-*/
-
-    WebCore::HistoryItem *item;
+    WebCore::HistoryItem* item;
 };
 
 class QWebHistoryPrivate : public QSharedData {
 public:
-    QWebHistoryPrivate(WebCore::BackForwardList *l)
+    QWebHistoryPrivate(WebCore::BackForwardList* l)
     {
         l->ref();
         lst = l;
@@ -75,7 +57,7 @@ public:
     {
         lst->deref();
     }
-    WebCore::BackForwardList *lst;
+    WebCore::BackForwardList* lst;
 };
 
 
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebinspector.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebinspector.cpp
new file mode 100644
index 0000000..5a66cc6
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebinspector.cpp
@@ -0,0 +1,187 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "qwebinspector.h"
+
+#include "Element.h"
+#include "InspectorController.h"
+#include "qwebelement.h"
+#include "qwebinspector_p.h"
+#include "qwebpage_p.h"
+
+#include <QResizeEvent>
+
+// TODO: handle the "Always enable" commands with QWebSettings
+
+/*!
+    \class QWebInspector
+    \since 4.6
+    \brief The QWebInspector class allows the placement and control of a
+    QWebPage's inspector.
+    The inspector allows you to see a page current hierarchy and loading
+    statistics.
+
+    The QWebPage to be inspected is determined with the setPage() method.
+
+    A typical use of QWebInspector follows:
+
+    \snippet webkitsnippets/qtwebkit_qwebinspector_snippet.cpp 0
+
+    Most of the resources needed by the inspector are owned by the associated
+    QWebPage and are allocated the first time that:
+    \list
+        \o an element is inspected
+        \o the QWebInspector is shown.
+    \endlist
+
+    This class acts mostly as a container and a controller for the inspector.
+    You can defer the creation and association of the QWebInspector until
+    the first emission of QWebPage::webInspectorTriggered() to save additional
+    resources.
+
+    \note A QWebInspector will display a blank widget if either:
+    \list
+        \o page() is null
+        \o QWebSettings::DeveloperExtrasEnabled is false
+    \endlist
+
+    \sa QWebPage::webInspectorTriggered()
+*/
+
+/*!
+    Constructs an empty QWebInspector with parent \a parent.
+*/
+QWebInspector::QWebInspector(QWidget* parent)
+    : QWidget(parent)
+    , d(new QWebInspectorPrivate(this))
+{
+}
+
+/*!
+    Destroys the inspector.
+*/
+QWebInspector::~QWebInspector()
+{
+    // Remove association principally to prevent deleting a child frontend
+    setPage(0);
+}
+
+/*!
+    Sets the QWebPage to be inspected.
+
+    There can only be one QWebInspector associated with a QWebPage
+    and vices versa.
+
+    Calling with \a page as null will break the current association, if any.
+
+    If \a page is already associated to another QWebInspector, the association
+    will be replaced and the previous QWebInspector will have no page
+    associated.
+
+    \sa page()
+*/
+void QWebInspector::setPage(QWebPage* page)
+{
+    if (d->page) {
+        // Break currentPage-->this
+        d->page->d->setInspector(0);
+    }
+    if (page && page->d->inspector && page->d->inspector != this) {
+        // Break newPage<->newPageCurrentInspector
+        page->d->inspector->setPage(0);
+    }
+
+    d->page = page;
+
+    if (page) {
+        // Setup the reciprocal association
+        page->d->setInspector(this);
+    }
+}
+
+/*!
+    Returns the inspected QWebPage.
+    If no web page is currently associated, a null pointer is returned.
+*/
+QWebPage* QWebInspector::page() const
+{
+    return d->page;
+}
+
+/*! \reimp */
+QSize QWebInspector::sizeHint() const
+{
+    return QSize(450, 300);
+}
+
+/*! \reimp */
+bool QWebInspector::event(QEvent* ev)
+{
+    return QWidget::event(ev);
+}
+
+/*! \reimp */
+void QWebInspector::resizeEvent(QResizeEvent* event)
+{
+    d->adjustFrontendSize(event->size());
+}
+
+/*! \reimp */
+void QWebInspector::showEvent(QShowEvent* event)
+{
+    // Allows QWebInspector::show() to init the inspector.
+    if (d->page)
+        d->page->d->inspectorController()->show();
+}
+
+/*! \reimp */
+void QWebInspector::hideEvent(QHideEvent* event)
+{
+    if (d->page)
+        d->page->d->inspectorController()->setWindowVisible(false);
+}
+
+/*! \internal */
+void QWebInspectorPrivate::setFrontend(QWidget* newFrontend)
+{
+    if (frontend)
+        frontend->setParent(0);
+
+    frontend = newFrontend;
+
+    if (frontend) {
+        frontend->setParent(q);
+        frontend->show();
+        adjustFrontendSize(q->size());
+    }
+}
+
+void QWebInspectorPrivate::adjustFrontendSize(const QSize& size)
+{
+    if (frontend)
+        frontend->resize(size);
+}
+
+/*!
+    \fn void QWebInspector::windowTitleChanged(const QString& newTitle);
+
+    This is emitted to signal that this widget's title changed to \a newTitle.
+*/
+
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebinspector.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebinspector.h
new file mode 100644
index 0000000..bb5bd64
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebinspector.h
@@ -0,0 +1,58 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef QWEBINSPECTOR_H
+#define QWEBINSPECTOR_H
+
+#include "qwebkitglobal.h"
+#include "qwebpage.h"
+
+#include "qwebview.h"
+
+class QWebInspectorPrivate;
+
+class QWEBKIT_EXPORT QWebInspector : public QWidget {
+    Q_OBJECT
+public:
+    QWebInspector(QWidget* parent = 0);
+    ~QWebInspector();
+
+    void setPage(QWebPage* page);
+    QWebPage* page() const;
+
+    QSize sizeHint() const;
+    bool event(QEvent*);
+
+Q_SIGNALS:
+    void windowTitleChanged(const QString& newTitle);
+
+protected:
+    void resizeEvent(QResizeEvent* event);
+    void showEvent(QShowEvent* event);
+    void hideEvent(QHideEvent* event);
+
+private:
+    QWebInspectorPrivate* d;
+
+    friend class QWebInspectorPrivate;
+    friend class QWebPage;
+    friend class QWebPagePrivate;
+    friend class WebCore::InspectorClientQt;
+};
+#endif
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebinspector_p.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebinspector_p.h
new file mode 100644
index 0000000..b7af4f8
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebinspector_p.h
@@ -0,0 +1,44 @@
+/*
+    Copyright (C) 2008, 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef QWEBINSPECTOR_P_H
+#define QWEBINSPECTOR_P_H
+
+class QSize;
+class QWebInspector;
+class QWebPage;
+class QWidget;
+
+class QWebInspectorPrivate {
+public:
+    QWebInspectorPrivate(QWebInspector* qq)
+    : q(qq)
+    , page(0)
+    , frontend(0)
+    {}
+
+    void setFrontend(QWidget* newFrontend);
+    void adjustFrontendSize(const QSize& size);
+
+    QWebInspector* q;
+    QWebPage* page;
+    QWidget* frontend;
+};
+
+#endif
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebkitversion.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebkitversion.cpp
new file mode 100644
index 0000000..062839f
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebkitversion.cpp
@@ -0,0 +1,58 @@
+/*
+    Copyright (C) 2009 Robert Hogan <robert@roberthogan.net>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include <qwebkitversion.h>
+#include <WebKitVersion.h>
+
+/*!
+
+    Returns the version number of WebKit at run-time as a string (for
+    example, "531.3"). This is the version of WebKit the application
+    was compiled against.
+
+*/
+QString qWebKitVersion()
+{
+    return QString("%1.%2").arg(WEBKIT_MAJOR_VERSION).arg(WEBKIT_MINOR_VERSION);
+}
+
+/*!
+
+    Returns the 'major' version number of WebKit at run-time as an integer
+    (for example, 531). This is the version of WebKit the application
+    was compiled against.
+
+*/
+int qWebKitMajorVersion()
+{
+    return WEBKIT_MAJOR_VERSION;
+}
+
+/*!
+
+    Returns the 'minor' version number of WebKit at run-time as an integer
+    (for example, 3). This is the version of WebKit the application
+    was compiled against.
+
+*/
+int qWebKitMinorVersion()
+{
+    return WEBKIT_MINOR_VERSION;
+}
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebkitversion.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebkitversion.h
new file mode 100644
index 0000000..f0fbef0
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebkitversion.h
@@ -0,0 +1,32 @@
+/*
+    Copyright (C) 2009 Robert Hogan <robert@roberthogan.net>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include <qstring.h>
+
+#ifndef qwebkitversion_h
+#define qwebkitversion_h
+
+#include <QtCore/qstring.h>
+#include "qwebkitglobal.h"
+
+QWEBKIT_EXPORT QString qWebKitVersion();
+QWEBKIT_EXPORT int qWebKitMajorVersion();
+QWEBKIT_EXPORT int qWebKitMinorVersion();
+
+#endif // qwebkitversion_h
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
index 7860cec..98c0770 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
@@ -27,7 +27,10 @@
 #include "qwebframe_p.h"
 #include "qwebhistory.h"
 #include "qwebhistory_p.h"
+#include "qwebinspector.h"
+#include "qwebinspector_p.h"
 #include "qwebsettings.h"
+#include "qwebkitversion.h"
 
 #include "Frame.h"
 #include "FrameTree.h"
@@ -35,6 +38,7 @@
 #include "FrameLoaderClientQt.h"
 #include "FrameView.h"
 #include "FormState.h"
+#include "ApplicationCacheStorage.h"
 #include "ChromeClientQt.h"
 #include "ContextMenu.h"
 #include "ContextMenuClientQt.h"
@@ -223,18 +227,6 @@ const char* QWebPagePrivate::editorCommandForWebActions(QWebPage::WebAction acti
     return 0;
 }
 
-#ifndef QT_NO_CURSOR
-SetCursorEvent::SetCursorEvent(const QCursor& cursor)
-    : QEvent(static_cast<QEvent::Type>(EventType))
-    , m_cursor(cursor)
-{}
-
-QCursor SetCursorEvent::cursor() const
-{
-    return m_cursor;
-}
-#endif
-
 // If you change this make sure to also adjust the docs for QWebPage::userAgentForUrl
 #define WEBKIT_VERSION "527+"
 
@@ -265,6 +257,9 @@ static inline Qt::DropAction dragOpToDropAction(unsigned actions)
 QWebPagePrivate::QWebPagePrivate(QWebPage *qq)
     : q(qq)
     , view(0)
+    , inspectorFrontend(0)
+    , inspector(0)
+    , inspectorIsInternalOnly(false)
     , viewportSize(QSize(0, 0))
 {
     WebCore::InitializeLoggingChannelsIfNecessary();
@@ -437,13 +432,13 @@ void QWebPagePrivate::_q_webActionTriggered(bool checked)
     q->triggerAction(action, checked);
 }
 
-#ifndef NDEBUG
 void QWebPagePrivate::_q_cleanupLeakMessages()
 {
+#ifndef NDEBUG
     // Need this to make leak messages accurate.
     cache()->setCapacities(0, 0, 0);
-}
 #endif
+}
 
 void QWebPagePrivate::updateAction(QWebPage::WebAction action)
 {
@@ -580,6 +575,18 @@ void QWebPagePrivate::timerEvent(QTimerEvent *ev)
         q->QObject::timerEvent(ev);
 }
 
+void QWebPagePrivate::mouseMoveEvent(QGraphicsSceneMouseEvent* ev)
+{
+    q->setView(ev->widget());
+
+    WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
+    if (!frame->view())
+        return;
+
+    bool accepted = frame->eventHandler()->mouseMoved(PlatformMouseEvent(ev, 0));
+    ev->setAccepted(accepted);
+}
+
 void QWebPagePrivate::mouseMoveEvent(QMouseEvent *ev)
 {
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
@@ -590,6 +597,29 @@ void QWebPagePrivate::mouseMoveEvent(QMouseEvent *ev)
     ev->setAccepted(accepted);
 }
 
+void QWebPagePrivate::mousePressEvent(QGraphicsSceneMouseEvent* ev)
+{
+    q->setView(ev->widget());
+
+    WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
+    if (!frame->view())
+        return;
+
+    if (tripleClickTimer.isActive()
+            && (ev->pos().toPoint() - tripleClick).manhattanLength()
+                < QApplication::startDragDistance()) {
+        mouseTripleClickEvent(ev);
+        return;
+    }
+
+    bool accepted = false;
+    PlatformMouseEvent mev(ev, 1);
+    // ignore the event if we can't map Qt's mouse buttons to WebCore::MouseButton
+    if (mev.button() != NoButton)
+        accepted = frame->eventHandler()->handleMousePressEvent(mev);
+    ev->setAccepted(accepted);
+}
+
 void QWebPagePrivate::mousePressEvent(QMouseEvent *ev)
 {
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
@@ -611,6 +641,25 @@ void QWebPagePrivate::mousePressEvent(QMouseEvent *ev)
     ev->setAccepted(accepted);
 }
 
+void QWebPagePrivate::mouseDoubleClickEvent(QGraphicsSceneMouseEvent *ev)
+{
+    q->setView(ev->widget());
+
+    WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
+    if (!frame->view())
+        return;
+
+    bool accepted = false;
+    PlatformMouseEvent mev(ev, 2);
+    // ignore the event if we can't map Qt's mouse buttons to WebCore::MouseButton
+    if (mev.button() != NoButton)
+        accepted = frame->eventHandler()->handleMousePressEvent(mev);
+    ev->setAccepted(accepted);
+
+    tripleClickTimer.start(QApplication::doubleClickInterval(), q);
+    tripleClick = ev->pos().toPoint();
+}
+
 void QWebPagePrivate::mouseDoubleClickEvent(QMouseEvent *ev)
 {
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
@@ -628,7 +677,7 @@ void QWebPagePrivate::mouseDoubleClickEvent(QMouseEvent *ev)
     tripleClick = ev->pos();
 }
 
-void QWebPagePrivate::mouseTripleClickEvent(QMouseEvent *ev)
+void QWebPagePrivate::mouseTripleClickEvent(QGraphicsSceneMouseEvent *ev)
 {
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
     if (!frame->view())
@@ -642,30 +691,33 @@ void QWebPagePrivate::mouseTripleClickEvent(QMouseEvent *ev)
     ev->setAccepted(accepted);
 }
 
-void QWebPagePrivate::mouseReleaseEvent(QMouseEvent *ev)
+void QWebPagePrivate::mouseTripleClickEvent(QMouseEvent *ev)
 {
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
     if (!frame->view())
         return;
 
     bool accepted = false;
-    PlatformMouseEvent mev(ev, 0);
+    PlatformMouseEvent mev(ev, 3);
     // ignore the event if we can't map Qt's mouse buttons to WebCore::MouseButton
     if (mev.button() != NoButton)
-        accepted = frame->eventHandler()->handleMouseReleaseEvent(mev);
+        accepted = frame->eventHandler()->handleMousePressEvent(mev);
     ev->setAccepted(accepted);
+}
 
+void QWebPagePrivate::handleClipboard(QEvent* ev, Qt::MouseButton button)
+{
 #ifndef QT_NO_CLIPBOARD
     if (QApplication::clipboard()->supportsSelection()) {
         bool oldSelectionMode = Pasteboard::generalPasteboard()->isSelectionMode();
         Pasteboard::generalPasteboard()->setSelectionMode(true);
         WebCore::Frame* focusFrame = page->focusController()->focusedOrMainFrame();
-        if (ev->button() == Qt::LeftButton) {
+        if (button == Qt::LeftButton) {
             if (focusFrame && (focusFrame->editor()->canCopy() || focusFrame->editor()->canDHTMLCopy())) {
                 focusFrame->editor()->copy();
                 ev->setAccepted(true);
             }
-        } else if (ev->button() == Qt::MidButton) {
+        } else if (button == Qt::MidButton) {
             if (focusFrame && (focusFrame->editor()->canPaste() || focusFrame->editor()->canDHTMLPaste())) {
                 focusFrame->editor()->paste();
                 ev->setAccepted(true);
@@ -676,12 +728,46 @@ void QWebPagePrivate::mouseReleaseEvent(QMouseEvent *ev)
 #endif
 }
 
+void QWebPagePrivate::mouseReleaseEvent(QGraphicsSceneMouseEvent* ev)
+{
+    q->setView(ev->widget());
+
+    WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
+    if (!frame->view())
+        return;
+
+    bool accepted = false;
+    PlatformMouseEvent mev(ev, 0);
+    // ignore the event if we can't map Qt's mouse buttons to WebCore::MouseButton
+    if (mev.button() != NoButton)
+        accepted = frame->eventHandler()->handleMouseReleaseEvent(mev);
+    ev->setAccepted(accepted);
+
+    handleClipboard(ev, ev->button());
+}
+
+void QWebPagePrivate::mouseReleaseEvent(QMouseEvent *ev)
+{
+    WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
+    if (!frame->view())
+        return;
+
+    bool accepted = false;
+    PlatformMouseEvent mev(ev, 0);
+    // ignore the event if we can't map Qt's mouse buttons to WebCore::MouseButton
+    if (mev.button() != NoButton)
+        accepted = frame->eventHandler()->handleMouseReleaseEvent(mev);
+    ev->setAccepted(accepted);
+
+    handleClipboard(ev, ev->button());
+}
+
 #ifndef QT_NO_CONTEXTMENU
-void QWebPagePrivate::contextMenuEvent(QContextMenuEvent *ev)
+void QWebPagePrivate::contextMenuEvent(const QPoint& globalPos)
 {
     QMenu *menu = q->createStandardContextMenu();
     if (menu) {
-        menu->exec(ev->globalPos());
+        menu->exec(globalPos);
         delete menu;
     }
 }
@@ -706,6 +792,19 @@ QMenu *QWebPage::createStandardContextMenu()
 }
 
 #ifndef QT_NO_WHEELEVENT
+void QWebPagePrivate::wheelEvent(QGraphicsSceneWheelEvent* ev)
+{
+    q->setView(ev->widget());
+
+    WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
+    if (!frame->view())
+        return;
+
+    WebCore::PlatformWheelEvent pev(ev);
+    bool accepted = frame->eventHandler()->handleWheelEvent(pev);
+    ev->setAccepted(accepted);
+}
+
 void QWebPagePrivate::wheelEvent(QWheelEvent *ev)
 {
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
@@ -776,7 +875,6 @@ void QWebPagePrivate::keyPressEvent(QKeyEvent *ev)
 {
     bool handled = false;
     WebCore::Frame* frame = page->focusController()->focusedOrMainFrame();
-    WebCore::Editor* editor = frame->editor();
     // we forward the key event to WebCore first to handle potential DOM
     // defined event handlers and later on end up in EditorClientQt::handleKeyboardEvent
     // to trigger editor commands via triggerAction().
@@ -788,7 +886,6 @@ void QWebPagePrivate::keyPressEvent(QKeyEvent *ev)
         if (view)
             defaultFont = view->font();
         QFontMetrics fm(defaultFont);
-        int fontHeight = fm.height();
         if (!handleScrolling(ev, frame)) {
             switch (ev->key()) {
             case Qt::Key_Back:
@@ -852,7 +949,21 @@ void QWebPagePrivate::focusOutEvent(QFocusEvent *ev)
     focusController->setFocused(false);
 }
 
-void QWebPagePrivate::dragEnterEvent(QDragEnterEvent *ev)
+void QWebPagePrivate::dragEnterEvent(QGraphicsSceneDragDropEvent* ev)
+{
+    q->setView(ev->widget());
+
+#ifndef QT_NO_DRAGANDDROP
+    DragData dragData(ev->mimeData(), ev->pos().toPoint(),
+            QCursor::pos(), dropActionToDragOp(ev->possibleActions()));
+    Qt::DropAction action = dragOpToDropAction(page->dragController()->dragEntered(&dragData));
+    ev->setDropAction(action);
+    if (action != Qt::IgnoreAction)
+        ev->accept();
+#endif
+}
+
+void QWebPagePrivate::dragEnterEvent(QDragEnterEvent* ev)
 {
 #ifndef QT_NO_DRAGANDDROP
     DragData dragData(ev->mimeData(), ev->pos(), QCursor::pos(),
@@ -864,8 +975,10 @@ void QWebPagePrivate::dragEnterEvent(QDragEnterEvent *ev)
 #endif
 }
 
-void QWebPagePrivate::dragLeaveEvent(QDragLeaveEvent *ev)
+void QWebPagePrivate::dragLeaveEvent(QGraphicsSceneDragDropEvent* ev)
 {
+    q->setView(ev->widget());
+
 #ifndef QT_NO_DRAGANDDROP
     DragData dragData(0, IntPoint(), QCursor::pos(), DragOperationNone);
     page->dragController()->dragExited(&dragData);
@@ -873,7 +986,30 @@ void QWebPagePrivate::dragLeaveEvent(QDragLeaveEvent *ev)
 #endif
 }
 
-void QWebPagePrivate::dragMoveEvent(QDragMoveEvent *ev)
+void QWebPagePrivate::dragLeaveEvent(QDragLeaveEvent* ev)
+{
+#ifndef QT_NO_DRAGANDDROP
+    DragData dragData(0, IntPoint(), QCursor::pos(), DragOperationNone);
+    page->dragController()->dragExited(&dragData);
+    ev->accept();
+#endif
+}
+
+void QWebPagePrivate::dragMoveEvent(QGraphicsSceneDragDropEvent* ev)
+{
+    q->setView(ev->widget());
+
+#ifndef QT_NO_DRAGANDDROP
+    DragData dragData(ev->mimeData(), ev->pos().toPoint(),
+            QCursor::pos(), dropActionToDragOp(ev->possibleActions()));
+    Qt::DropAction action = dragOpToDropAction(page->dragController()->dragUpdated(&dragData));
+    ev->setDropAction(action);
+    if (action != Qt::IgnoreAction)
+        ev->accept();
+#endif
+}
+
+void QWebPagePrivate::dragMoveEvent(QDragMoveEvent* ev)
 {
 #ifndef QT_NO_DRAGANDDROP
     DragData dragData(ev->mimeData(), ev->pos(), QCursor::pos(),
@@ -885,7 +1021,18 @@ void QWebPagePrivate::dragMoveEvent(QDragMoveEvent *ev)
 #endif
 }
 
-void QWebPagePrivate::dropEvent(QDropEvent *ev)
+void QWebPagePrivate::dropEvent(QGraphicsSceneDragDropEvent* ev)
+{
+#ifndef QT_NO_DRAGANDDROP
+    DragData dragData(ev->mimeData(), ev->pos().toPoint(),
+            QCursor::pos(), dropActionToDragOp(ev->possibleActions()));
+    Qt::DropAction action = dragOpToDropAction(page->dragController()->performDrag(&dragData));
+    if (action != Qt::IgnoreAction)
+        ev->accept();
+#endif
+}
+
+void QWebPagePrivate::dropEvent(QDropEvent* ev)
 {
 #ifndef QT_NO_DRAGANDDROP
     DragData dragData(ev->mimeData(), ev->pos(), QCursor::pos(),
@@ -1087,6 +1234,54 @@ QVariant QWebPage::inputMethodQuery(Qt::InputMethodQuery property) const
 }
 
 /*!
+    \internal
+*/
+void QWebPagePrivate::setInspector(QWebInspector* insp)
+{
+    if (inspector)
+        inspector->d->setFrontend(0);
+
+    if (inspectorIsInternalOnly) {
+        QWebInspector* inspToDelete = inspector;
+        inspector = 0;
+        inspectorIsInternalOnly = false;
+        delete inspToDelete;    // Delete after to prevent infinite recursion
+    }
+
+    inspector = insp;
+
+    // Give inspector frontend web view if previously created
+    if (inspector && inspectorFrontend)
+        inspector->d->setFrontend(inspectorFrontend);
+}
+
+/*!
+    \internal
+    Returns the inspector and creates it if it wasn't created yet.
+    The instance created here will not be available through QWebPage's API.
+*/
+QWebInspector* QWebPagePrivate::getOrCreateInspector()
+{
+    if (!inspector) {
+        QWebInspector* insp = new QWebInspector;
+        insp->setPage(q);
+        insp->connect(q, SIGNAL(webInspectorTriggered(const QWebElement&)), SLOT(show()));
+        insp->show(); // The inspector is expected to be shown on inspection
+        inspectorIsInternalOnly = true;
+
+        Q_ASSERT(inspector); // Associated through QWebInspector::setPage(q)
+    }
+    return inspector;
+}
+
+/*! \internal */
+InspectorController* QWebPagePrivate::inspectorController()
+{
+    return page->inspectorController();
+}
+
+
+/*!
    \enum QWebPage::FindFlag
 
    This enum describes the options available to QWebPage's findText() function. The options
@@ -1298,6 +1493,8 @@ QWebPage::~QWebPage()
     FrameLoader *loader = d->mainFrame->d->frame->loader();
     if (loader)
         loader->detachFromParent();
+    if (d->inspector)
+        d->inspector->setPage(0);
     delete d;
 }
 
@@ -1593,12 +1790,16 @@ void QWebPage::triggerAction(WebAction action, bool checked)
         case SetTextDirectionRightToLeft:
             editor->setBaseWritingDirection(RightToLeftWritingDirection);
             break;
-        case InspectElement:
-            if (!d->hitTestResult.isNull())
+        case InspectElement: {
+            QWebElement inspectedElement(QWebElement::enclosingElement(d->hitTestResult.d->innerNonSharedNode.get()));
+            emit webInspectorTriggered(inspectedElement);
+
+            if (!d->hitTestResult.isNull()) {
+                d->getOrCreateInspector(); // Make sure the inspector is created
                 d->page->inspectorController()->inspect(d->hitTestResult.d->innerNonSharedNode.get());
-            else
-                d->page->inspectorController()->show();
+            }
             break;
+        }
         default:
             command = QWebPagePrivate::editorCommandForWebActions(action);
             break;
@@ -2053,24 +2254,42 @@ bool QWebPage::event(QEvent *ev)
     case QEvent::MouseMove:
         d->mouseMoveEvent(static_cast<QMouseEvent*>(ev));
         break;
+    case QEvent::GraphicsSceneMouseMove:
+        d->mouseMoveEvent(static_cast<QGraphicsSceneMouseEvent*>(ev));
+        break;
     case QEvent::MouseButtonPress:
         d->mousePressEvent(static_cast<QMouseEvent*>(ev));
         break;
+    case QEvent::GraphicsSceneMousePress:
+        d->mousePressEvent(static_cast<QGraphicsSceneMouseEvent*>(ev));
+        break;
     case QEvent::MouseButtonDblClick:
         d->mouseDoubleClickEvent(static_cast<QMouseEvent*>(ev));
         break;
+    case QEvent::GraphicsSceneMouseDoubleClick:
+        d->mouseDoubleClickEvent(static_cast<QGraphicsSceneMouseEvent*>(ev));
+        break;
     case QEvent::MouseButtonRelease:
         d->mouseReleaseEvent(static_cast<QMouseEvent*>(ev));
         break;
+    case QEvent::GraphicsSceneMouseRelease:
+        d->mouseReleaseEvent(static_cast<QGraphicsSceneMouseEvent*>(ev));
+        break;
 #ifndef QT_NO_CONTEXTMENU
     case QEvent::ContextMenu:
-        d->contextMenuEvent(static_cast<QContextMenuEvent*>(ev));
+        d->contextMenuEvent(static_cast<QContextMenuEvent*>(ev)->globalPos());
+        break;
+    case QEvent::GraphicsSceneContextMenu:
+        d->contextMenuEvent(static_cast<QGraphicsSceneContextMenuEvent*>(ev)->screenPos());
         break;
 #endif
 #ifndef QT_NO_WHEELEVENT
     case QEvent::Wheel:
         d->wheelEvent(static_cast<QWheelEvent*>(ev));
         break;
+    case QEvent::GraphicsSceneWheel:
+        d->wheelEvent(static_cast<QGraphicsSceneWheelEvent*>(ev));
+        break;
 #endif
     case QEvent::KeyPress:
         d->keyPressEvent(static_cast<QKeyEvent*>(ev));
@@ -2088,15 +2307,27 @@ bool QWebPage::event(QEvent *ev)
     case QEvent::DragEnter:
         d->dragEnterEvent(static_cast<QDragEnterEvent*>(ev));
         break;
+    case QEvent::GraphicsSceneDragEnter:
+        d->dragEnterEvent(static_cast<QGraphicsSceneDragDropEvent*>(ev));
+        break;
     case QEvent::DragLeave:
         d->dragLeaveEvent(static_cast<QDragLeaveEvent*>(ev));
         break;
+    case QEvent::GraphicsSceneDragLeave:
+        d->dragLeaveEvent(static_cast<QGraphicsSceneDragDropEvent*>(ev));
+        break;
     case QEvent::DragMove:
         d->dragMoveEvent(static_cast<QDragMoveEvent*>(ev));
         break;
+    case QEvent::GraphicsSceneDragMove:
+        d->dragMoveEvent(static_cast<QGraphicsSceneDragDropEvent*>(ev));
+        break;
     case QEvent::Drop:
         d->dropEvent(static_cast<QDropEvent*>(ev));
         break;
+    case QEvent::GraphicsSceneDrop:
+        d->dropEvent(static_cast<QGraphicsSceneDragDropEvent*>(ev));
+        break;
 #endif
     case QEvent::InputMethod:
         d->inputMethodEvent(static_cast<QInputMethodEvent*>(ev));
@@ -2538,7 +2769,7 @@ QWebPluginFactory *QWebPage::pluginFactory() const
 
     The default implementation returns the following value:
 
-    "Mozilla/5.0 (%Platform%; %Security%; %Subplatform%; %Locale%) AppleWebKit/%WebKitVersion% (KHTML, like Gecko, Safari/419.3) %AppVersion"
+    "Mozilla/5.0 (%Platform%; %Security%; %Subplatform%; %Locale%) AppleWebKit/%WebKitVersion% (KHTML, like Gecko) %AppVersion Safari/%WebKitVersion%"
 
     In this string the following values are replaced at run-time:
     \list
@@ -2546,7 +2777,7 @@ QWebPluginFactory *QWebPage::pluginFactory() const
     \o %Security% expands to U if SSL is enabled, otherwise N. SSL is enabled if QSslSocket::supportsSsl() returns true.
     \o %Locale% is replaced with QLocale::name(). The locale is determined from the view of the QWebPage. If no view is set on the QWebPage,
     then a default constructed QLocale is used instead.
-    \o %WebKitVersion% currently expands to 527+
+    \o %WebKitVersion% is the version of WebKit the application was compiled against.
     \o %AppVersion% expands to QCoreApplication::applicationName()/QCoreApplication::applicationVersion() if they're set; otherwise defaulting to Qt and the current Qt version.
     \endlist
 */
@@ -2678,6 +2909,9 @@ QString QWebPage::userAgentForUrl(const QUrl& url) const
         case QSysInfo::WV_VISTA:
             ver = "Windows NT 6.0";
             break;
+        case QSysInfo::WV_WINDOWS7:
+            ver = "Windows NT 6.1";
+            break;
         case QSysInfo::WV_CE:
             ver = "Windows CE";
             break;
@@ -2704,12 +2938,13 @@ QString QWebPage::userAgentForUrl(const QUrl& url) const
     ua.append(QLatin1String(") "));
 
     // webkit/qt version
-    ua.append(QLatin1String("AppleWebKit/" WEBKIT_VERSION " (KHTML, like Gecko, Safari/419.3) "));
+    ua.append(QString(QLatin1String("AppleWebKit/%1 (KHTML, like Gecko) "))
+                      .arg(QString(qWebKitVersion())));
 
     // Application name/version
     QString appName = QCoreApplication::applicationName();
     if (!appName.isEmpty()) {
-        ua.append(QLatin1Char(' ') + appName);
+        ua.append(appName);
 #if QT_VERSION >= 0x040400
         QString appVer = QCoreApplication::applicationVersion();
         if (!appVer.isEmpty())
@@ -2720,6 +2955,10 @@ QString QWebPage::userAgentForUrl(const QUrl& url) const
         ua.append(QLatin1String("Qt/"));
         ua.append(QLatin1String(qVersion()));
     }
+
+    ua.append(QString(QLatin1String(" Safari/%1"))
+                      .arg(qWebKitVersion()));
+
     return ua;
 }
 
@@ -2911,6 +3150,24 @@ quint64 QWebPage::bytesReceived() const
 */
 
 /*!
+    \fn void QWebPage::webInspectorTriggered(const QWebElement& inspectedElement);
+    \since 4.6
+
+    This signal is emitted when the user triggered an inspection through the
+    context menu. If a QWebInspector is associated to this page, it should be
+    visible to the user after this signal has been emitted.
+
+    If still no QWebInspector is associated to this QWebPage after the emission
+    of this signal, a privately owned inspector will be shown to the user.
+
+    \note \a inspectedElement contains the QWebElement under the context menu.
+    It is not garanteed to be the same as the focused element in the web
+    inspector.
+
+    \sa QWebInspector
+*/
+
+/*!
     \fn void QWebPage::toolBarVisibilityChangeRequested(bool visible)
 
     This signal is emitted whenever the visibility of the toolbar in a web browser
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.h
index 24741a1..aecd860 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.h
@@ -37,6 +37,7 @@ class QNetworkReply;
 class QNetworkAccessManager;
 QT_END_NAMESPACE
 
+class QWebElement;
 class QWebFrame;
 class QWebNetworkRequest;
 class QWebHistory;
@@ -306,6 +307,7 @@ Q_SIGNALS:
     void windowCloseRequested();
     void printRequested(QWebFrame *frame);
     void linkClicked(const QUrl &url);
+    void webInspectorTriggered(const QWebElement& inspectedElement);
 
     void toolBarVisibilityChangeRequested(bool visible);
     void statusBarVisibilityChangeRequested(bool visible);
@@ -343,14 +345,15 @@ protected:
 private:
     Q_PRIVATE_SLOT(d, void _q_onLoadProgressChanged(int))
     Q_PRIVATE_SLOT(d, void _q_webActionTriggered(bool checked))
-#ifndef NDEBUG
     Q_PRIVATE_SLOT(d, void _q_cleanupLeakMessages())
-#endif
+
     QWebPagePrivate *d;
 
     friend class QWebFrame;
     friend class QWebPagePrivate;
     friend class QWebView;
+    friend class QWebGraphicsItem;
+    friend class QWebInspector;
     friend class WebCore::ChromeClientQt;
     friend class WebCore::EditorClientQt;
     friend class WebCore::FrameLoaderClientQt;
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage_p.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage_p.h
index 87c624d..f765f98 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage_p.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage_p.h
@@ -25,6 +25,7 @@
 #include <qnetworkproxy.h>
 #include <qpointer.h>
 #include <qevent.h>
+#include <qgraphicssceneevent.h>
 
 #include "qwebpage.h"
 #include "qwebhistory.h"
@@ -42,21 +43,10 @@ namespace WebCore {
     class ContextMenu;
     class EditorClientQt;
     class Element;
+    class InspectorController;
     class Node;
     class Page;
     class Frame;
-
-#ifndef QT_NO_CURSOR
-    class SetCursorEvent : public QEvent {
-    public:
-        static const int EventType = 724;
-        SetCursorEvent(const QCursor&);
-
-        QCursor cursor() const;
-    private:
-        QCursor m_cursor;
-    };
-#endif
 }
 
 QT_BEGIN_NAMESPACE
@@ -65,6 +55,8 @@ class QMenu;
 class QBitArray;
 QT_END_NAMESPACE
 
+class QWebInspector;
+
 class QWebPagePrivate {
 public:
     QWebPagePrivate(QWebPage*);
@@ -75,9 +67,7 @@ public:
 #endif
     void _q_onLoadProgressChanged(int);
     void _q_webActionTriggered(bool checked);
-#ifndef NDEBUG
     void _q_cleanupLeakMessages();
-#endif
     void updateAction(QWebPage::WebAction action);
     void updateNavigationActions();
     void updateEditorActions();
@@ -85,32 +75,47 @@ public:
     void timerEvent(QTimerEvent*);
 
     void mouseMoveEvent(QMouseEvent*);
+    void mouseMoveEvent(QGraphicsSceneMouseEvent*);
     void mousePressEvent(QMouseEvent*);
+    void mousePressEvent(QGraphicsSceneMouseEvent*);
     void mouseDoubleClickEvent(QMouseEvent*);
+    void mouseDoubleClickEvent(QGraphicsSceneMouseEvent*);
     void mouseTripleClickEvent(QMouseEvent*);
+    void mouseTripleClickEvent(QGraphicsSceneMouseEvent*);
     void mouseReleaseEvent(QMouseEvent*);
+    void mouseReleaseEvent(QGraphicsSceneMouseEvent*);
 #ifndef QT_NO_CONTEXTMENU
-    void contextMenuEvent(QContextMenuEvent*);
+    void contextMenuEvent(const QPoint& globalPos);
 #endif
 #ifndef QT_NO_WHEELEVENT
     void wheelEvent(QWheelEvent*);
+    void wheelEvent(QGraphicsSceneWheelEvent*);
 #endif
     void keyPressEvent(QKeyEvent*);
     void keyReleaseEvent(QKeyEvent*);
     void focusInEvent(QFocusEvent*);
     void focusOutEvent(QFocusEvent*);
 
-    void dragEnterEvent(QDragEnterEvent *);
-    void dragLeaveEvent(QDragLeaveEvent *);
-    void dragMoveEvent(QDragMoveEvent *);
-    void dropEvent(QDropEvent *);
+    void dragEnterEvent(QDragEnterEvent*);
+    void dragEnterEvent(QGraphicsSceneDragDropEvent*);
+    void dragLeaveEvent(QDragLeaveEvent*);
+    void dragLeaveEvent(QGraphicsSceneDragDropEvent*);
+    void dragMoveEvent(QDragMoveEvent*);
+    void dragMoveEvent(QGraphicsSceneDragDropEvent*);
+    void dropEvent(QDropEvent*);
+    void dropEvent(QGraphicsSceneDragDropEvent*);
 
     void inputMethodEvent(QInputMethodEvent*);
 
     void shortcutOverrideEvent(QKeyEvent*);
-    void leaveEvent(QEvent *);
+    void leaveEvent(QEvent*);
+    void handleClipboard(QEvent*, Qt::MouseButton);
     bool handleScrolling(QKeyEvent*, WebCore::Frame*);
 
+    void setInspector(QWebInspector*);
+    QWebInspector* getOrCreateInspector();
+    WebCore::InspectorController* inspectorController();
+
 #ifndef QT_NO_SHORTCUT
     static QWebPage::WebAction editorActionForKeyEvent(QKeyEvent* event);
 #endif
@@ -168,6 +173,10 @@ public:
 
     QWebPluginFactory *pluginFactory;
 
+    QWidget* inspectorFrontend;
+    QWebInspector* inspector;
+    bool inspectorIsInternalOnly; // True if created through the Inspect context menu action
+
     static bool drtRun;
 };
 
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebplugindatabase.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebplugindatabase.cpp
new file mode 100644
index 0000000..a3781e6
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebplugindatabase.cpp
@@ -0,0 +1,376 @@
+/*
+    Copyright (C) 2009 Jakub Wieczorek <faw217@gmail.com>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "qwebplugindatabase.h"
+
+#include "PluginDatabase.h"
+#include "PluginPackage.h"
+
+using namespace WebCore;
+
+/*!
+    \typedef QWebPluginInfo::MimeType
+    \since 4.6
+    \brief Represents a single MIME type supported by a plugin.
+*/
+
+/*!
+    \class QWebPluginInfo
+    \since 4.6
+    \brief The QWebPluginInfo class represents a single Netscape plugin.
+
+    A QWebPluginInfo object represents a Netscape plugin picked up by WebKit
+    and included in the plugin database. This class contains information about
+    the plugin, such as its name(), description(), a list of MIME types that it
+    supports (can be accessed with mimeTypes()) and the path of the plugin
+    file.
+
+    Plugins can be enabled and disabled with setEnabled(). If a plugin is
+    disabled, it will not be used by WebKit to handle supported MIME types. To
+    check if a plugin is enabled or not, use enabled().
+
+    \sa QWebPluginDatabase
+*/
+
+/*!
+    Constructs a null QWebPluginInfo.
+*/
+QWebPluginInfo::QWebPluginInfo()
+    : m_package(0)
+{
+}
+
+QWebPluginInfo::QWebPluginInfo(PluginPackage* package)
+    : m_package(package)
+{
+    if (m_package)
+        m_package->ref();
+}
+
+/*!
+    Contructs a copy of \a other.
+*/
+QWebPluginInfo::QWebPluginInfo(const QWebPluginInfo& other)
+    : m_package(other.m_package)
+{
+    if (m_package)
+        m_package->ref();
+}
+
+/*!
+    Destroys the plugin info.
+*/
+QWebPluginInfo::~QWebPluginInfo()
+{
+    if (m_package)
+        m_package->deref();
+}
+
+/*!
+    Returns the name of the plugin.
+
+    \sa description()
+*/
+QString QWebPluginInfo::name() const
+{
+    if (!m_package)
+        return QString();
+    return m_package->name();
+}
+
+/*!
+    Returns the description of the plugin.
+
+    \sa name()
+*/
+QString QWebPluginInfo::description() const
+{
+    if (!m_package)
+        return QString();
+    return m_package->description();
+}
+
+/*!
+    Returns a list of MIME types supported by the plugin.
+
+    \sa supportsMimeType()
+*/
+QList<QWebPluginInfo::MimeType> QWebPluginInfo::mimeTypes() const
+{
+    if (m_package && m_mimeTypes.isEmpty()) {
+        const MIMEToDescriptionsMap& mimeToDescriptions = m_package->mimeToDescriptions();
+        MIMEToDescriptionsMap::const_iterator end = mimeToDescriptions.end();
+
+        for (MIMEToDescriptionsMap::const_iterator it = mimeToDescriptions.begin(); it != end; ++it) {
+            MimeType mimeType;
+            mimeType.name = it->first;
+            mimeType.description = it->second;
+
+            QStringList fileExtensions;
+            Vector<String> extensions = m_package->mimeToExtensions().get(mimeType.name);
+
+            for (unsigned i = 0; i < extensions.size(); ++i)
+                fileExtensions.append(extensions[i]);
+
+            mimeType.fileExtensions = fileExtensions;
+            m_mimeTypes.append(mimeType);
+        }
+    }
+
+    return m_mimeTypes;
+}
+
+/*!
+    Returns true if the plugin supports a specific \a mimeType; otherwise
+    returns false.
+
+    \sa mimeTypes()
+*/
+bool QWebPluginInfo::supportsMimeType(const QString& mimeType) const
+{
+    if (!m_package)
+        return false;
+    return m_package->mimeToDescriptions().contains(mimeType);
+}
+
+/*!
+    Returns an absolute path to the plugin file.
+*/
+QString QWebPluginInfo::path() const
+{
+    if (!m_package)
+        return QString();
+    return m_package->path();
+}
+
+/*!
+    Returns true if the plugin is a null plugin; otherwise returns false.
+*/
+bool QWebPluginInfo::isNull() const
+{
+    return !m_package;
+}
+
+/*!
+    Enables or disables the plugin, depending on the \a enabled parameter.
+
+    Disabled plugins will not be picked up by WebKit when looking for a plugin
+    supporting a particular MIME type.
+
+    \sa isEnabled()
+*/
+void QWebPluginInfo::setEnabled(bool enabled)
+{
+    if (!m_package)
+        return;
+    m_package->setEnabled(enabled);
+}
+
+/*!
+    Returns true if the plugin is enabled; otherwise returns false.
+
+    \sa setEnabled()
+*/
+bool QWebPluginInfo::isEnabled() const
+{
+    if (!m_package)
+        return false;
+    return m_package->isEnabled();
+}
+
+bool QWebPluginInfo::operator==(const QWebPluginInfo& other) const
+{
+    return m_package == other.m_package;
+}
+
+bool QWebPluginInfo::operator!=(const QWebPluginInfo& other) const
+{
+    return m_package != other.m_package;
+}
+
+QWebPluginInfo &QWebPluginInfo::operator=(const QWebPluginInfo& other)
+{
+    if (this == &other)
+        return *this;
+
+    if (m_package)
+        m_package->deref();
+    m_package = other.m_package;
+    if (m_package)
+        m_package->ref();
+    m_mimeTypes = other.m_mimeTypes;
+
+    return *this;
+}
+
+/*!
+    \class QWebPluginDatabase
+    \since 4.6
+    \brief The QWebPluginDatabase class provides an interface for managing
+    Netscape plugins used by WebKit in QWebPages.
+
+    The QWebPluginDatabase class is a database of Netscape plugins that are used
+    by WebKit. The plugins are picked up by WebKit by looking up a set of search paths.
+    The default set can be accessed using defaultSearchPaths(). The search paths
+    can be changed, see searchPaths() and setSearchPaths(). Additional search paths
+    can also be added using addSearchPath().
+
+    The plugins that have been detected are exposed by the plugins() method.
+    The list contains QWebPlugin objects that hold both the metadata and the MIME
+    types that are supported by particular plugins.
+
+    WebKit specifies a plugin for a MIME type by looking for the first plugin that
+    supports the specific MIME type. To get a plugin, that is used by WebKit to
+    handle a specific MIME type, you can use the pluginForMimeType() function.
+
+    To change the way of resolving MIME types ambiguity, you can explicitly set
+    a preferred plugin for a specific MIME type, using setPreferredPluginForMimeType().
+
+    \sa QWebPluginInfo, QWebSettings::pluginDatabase()
+*/
+
+QWebPluginDatabase::QWebPluginDatabase(QObject* parent)
+    : QObject(parent)
+    , m_database(PluginDatabase::installedPlugins())
+{
+}
+
+QWebPluginDatabase::~QWebPluginDatabase()
+{
+}
+
+/*!
+    Returns a list of plugins installed in the search paths.
+
+    This list will contain disabled plugins, although they will not be used by
+    WebKit.
+
+    \sa pluginForMimeType()
+*/
+QList<QWebPluginInfo> QWebPluginDatabase::plugins() const
+{
+    QList<QWebPluginInfo> qwebplugins;
+    const Vector<PluginPackage*>& plugins = m_database->plugins();
+
+    for (unsigned int i = 0; i < plugins.size(); ++i) {
+        PluginPackage* plugin = plugins[i];
+        qwebplugins.append(QWebPluginInfo(plugin));
+    }
+
+    return qwebplugins;
+}
+
+/*!
+    Returns a default set of search paths.
+
+    \sa searchPaths(), setSearchPaths()
+*/
+QStringList QWebPluginDatabase::defaultSearchPaths()
+{
+    QStringList paths;
+
+    const Vector<String>& directories = PluginDatabase::defaultPluginDirectories();
+    for (unsigned int i = 0; i < directories.size(); ++i)
+        paths.append(directories[i]);
+
+    return paths;
+}
+
+/*!
+    Returns a list of search paths that are used by WebKit to look for plugins.
+
+    \sa defaultSearchPaths(), setSearchPaths()
+*/
+QStringList QWebPluginDatabase::searchPaths() const
+{
+    QStringList paths;
+
+    const Vector<String>& directories = m_database->pluginDirectories();
+    for (unsigned int i = 0; i < directories.size(); ++i)
+        paths.append(directories[i]);
+
+    return paths;
+}
+
+/*!
+    Changes the search paths to \a paths.
+    The database is automatically refreshed.
+
+    \sa searchPaths(), defaultSearchPaths()
+*/
+void QWebPluginDatabase::setSearchPaths(const QStringList& paths)
+{
+    Vector<String> directories;
+
+    for (int i = 0; i < paths.count(); ++i)
+        directories.append(paths.at(i));
+
+    m_database->setPluginDirectories(directories);
+    // PluginDatabase::setPluginDirectories() does not refresh the database.
+    m_database->refresh();
+}
+
+/*!
+    Adds an additional \a path to the current set.
+    The database is automatically refreshed.
+
+    \sa searchPaths(), setSearchPaths()
+*/
+void QWebPluginDatabase::addSearchPath(const QString& path)
+{
+    m_database->addExtraPluginDirectory(path);
+    // PluginDatabase::addExtraPluginDirectory() does refresh the database.
+}
+
+/*!
+    Refreshes the plugin database, adds new plugins that have been found and removes
+    the ones that are no longer available in the search paths.
+
+    You can call this function when the set of plugins installed in the search paths
+    changes. You do not need to call this function when changing search paths,
+    in that case WebKit automatically refreshes the database.
+*/
+void QWebPluginDatabase::refresh()
+{
+    m_database->refresh();
+}
+
+/*!
+    Returns the plugin that is currently used by WebKit for a given \a mimeType.
+
+    \sa setPreferredPluginForMimeType()
+*/
+QWebPluginInfo QWebPluginDatabase::pluginForMimeType(const QString& mimeType)
+{
+    return QWebPluginInfo(m_database->pluginForMIMEType(mimeType));
+}
+
+/*!
+    Changes the preferred plugin for a given \a mimeType to \a plugin. The \a plugin
+    has to support the given \a mimeType, otherwise the setting will have no effect.
+
+    Calling the function with a null \a plugin resets the setting.
+
+    \sa pluginForMimeType()
+*/
+void QWebPluginDatabase::setPreferredPluginForMimeType(const QString& mimeType, const QWebPluginInfo& plugin)
+{
+    m_database->setPreferredPluginForMIMEType(mimeType, plugin.m_package);
+}
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebplugindatabase.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebplugindatabase.h
new file mode 100644
index 0000000..b22c3de
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebplugindatabase.h
@@ -0,0 +1,98 @@
+/*
+    Copyright (C) 2009 Jakub Wieczorek <faw217@gmail.com>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef QWEBPLUGINDATABASE_H
+#define QWEBPLUGINDATABASE_H
+
+#include "qwebkitglobal.h"
+#include "qwebpluginfactory.h"
+
+#include <QtCore/qobject.h>
+#include <QtCore/qstringlist.h>
+
+namespace WebCore {
+    class PluginDatabase;
+    class PluginPackage;
+}
+
+class QWebPluginInfoPrivate;
+class QWEBKIT_EXPORT QWebPluginInfo {
+public:
+    QWebPluginInfo();
+    QWebPluginInfo(const QWebPluginInfo& other);
+    QWebPluginInfo &operator=(const QWebPluginInfo& other);
+    ~QWebPluginInfo();
+
+private:
+    QWebPluginInfo(WebCore::PluginPackage* package);
+
+public:
+    typedef QWebPluginFactory::MimeType MimeType;
+
+    QString name() const;
+    QString description() const;
+    QList<MimeType> mimeTypes() const;
+    bool supportsMimeType(const QString& mimeType) const;
+    QString path() const;
+
+    bool isNull() const;
+
+    void setEnabled(bool enabled);
+    bool isEnabled() const;
+
+    bool operator==(const QWebPluginInfo& other) const;
+    bool operator!=(const QWebPluginInfo& other) const;
+
+    friend class QWebPluginDatabase;
+
+private:
+    QWebPluginInfoPrivate* d;
+    WebCore::PluginPackage* m_package;
+    mutable QList<MimeType> m_mimeTypes;
+};
+
+class QWebPluginDatabasePrivate;
+class QWEBKIT_EXPORT QWebPluginDatabase : public QObject {
+    Q_OBJECT
+
+private:
+    QWebPluginDatabase(QObject* parent = 0);
+    ~QWebPluginDatabase();
+
+public:
+    QList<QWebPluginInfo> plugins() const;
+
+    static QStringList defaultSearchPaths();
+    QStringList searchPaths() const;
+    void setSearchPaths(const QStringList& paths);
+    void addSearchPath(const QString& path);
+
+    void refresh();
+
+    QWebPluginInfo pluginForMimeType(const QString& mimeType);
+    void setPreferredPluginForMimeType(const QString& mimeType, const QWebPluginInfo& plugin);
+
+    friend class QWebSettings;
+
+private:
+    QWebPluginDatabasePrivate* d;
+    WebCore::PluginDatabase* m_database;
+};
+
+#endif // QWEBPLUGINDATABASE_H
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebpluginfactory.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebpluginfactory.cpp
index 8506099..e63ba41 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebpluginfactory.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebpluginfactory.cpp
@@ -76,6 +76,13 @@
     \inmodule QtWebKit
 */
 
+bool QWebPluginFactory::MimeType::operator==(const MimeType& other) const
+{
+    return name == other.name
+           && description == other.description
+           && fileExtensions == other.fileExtensions;
+}
+
 /*!
     \variable QWebPluginFactory::MimeType::name
 
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebpluginfactory.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebpluginfactory.h
index cff774d..4a06b59 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebpluginfactory.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebpluginfactory.h
@@ -34,10 +34,12 @@ class QWebPluginFactoryPrivate;
 class QWEBKIT_EXPORT QWebPluginFactory : public QObject {
     Q_OBJECT
 public:
-    struct MimeType {
+    struct QWEBKIT_EXPORT MimeType {
         QString name;
         QString description;
         QStringList fileExtensions;
+        bool operator==(const MimeType& other) const;
+        inline bool operator!=(const MimeType& other) const { return !operator==(other); }
     };
 
     struct Plugin {
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebsecurityorigin.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebsecurityorigin.cpp
index ed2e959..45c49c6 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebsecurityorigin.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebsecurityorigin.cpp
@@ -200,3 +200,49 @@ QList<QWebDatabase> QWebSecurityOrigin::databases() const
     return databases;
 }
 
+/*!
+    \since 4.6
+    Allow applications to use a custome scheme instead of file: scheme,
+    without being subjected to cross domain restrictions.
+*/
+void QWebSecurityOrigin::addLocalScheme(const QString& scheme)
+{
+    SecurityOrigin::registerURLSchemeAsLocal(scheme);
+}
+
+/*!
+    \since 4.6
+    Allow applications to stop using a custome scheme that was previously used,
+    \sa addLocalScheme().
+*/
+void QWebSecurityOrigin::removeLocalScheme(const QString& scheme)
+{
+    SecurityOrigin::removeURLSchemeRegisteredAsLocal(scheme);
+}
+
+/*!
+    \since 4.6
+    Returns a list of all the schemes that were set by the application as local schemes,
+    \sa addLocalScheme(), removeLocalScheme().
+*/
+QStringList QWebSecurityOrigin::localSchemes()
+{
+    QStringList list;
+    const URLSchemesMap& map = SecurityOrigin::localURLSchemes();
+    URLSchemesMap::const_iterator end = map.end();
+    for (URLSchemesMap::const_iterator i = map.begin(); i != end; ++i) {
+        const QString scheme = *i;
+        list.append(scheme);
+    }
+    return list;
+}
+
+void QWebSecurityOrigin::whiteListAccessFromOrigin(const QString& sourceOrigin, const QString& destinationProtocol, const QString& destinationHost, bool allowDestinationSubdomains)
+{
+    SecurityOrigin::whiteListAccessFromOrigin(*SecurityOrigin::createFromString(sourceOrigin), destinationProtocol, destinationHost, allowDestinationSubdomains);
+}
+
+void QWebSecurityOrigin::resetOriginAccessWhiteLists()
+{
+    SecurityOrigin::resetOriginAccessWhiteLists();
+}
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebsecurityorigin.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebsecurityorigin.h
index 3cfb0f4..94b96f0 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebsecurityorigin.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebsecurityorigin.h
@@ -37,6 +37,11 @@ class QWebFrame;
 class QWEBKIT_EXPORT QWebSecurityOrigin {
 public:
     static QList<QWebSecurityOrigin> allOrigins();
+    static void addLocalScheme(const QString& scheme);
+    static void removeLocalScheme(const QString& scheme);
+    static QStringList localSchemes();
+    static void whiteListAccessFromOrigin(const QString& sourceOrigin, const QString& destinationProtocol, const QString& destinationHost, bool allowDestinationSubdomains);
+    static void resetOriginAccessWhiteLists();
 
     ~QWebSecurityOrigin();
 
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.cpp
index 89595c3..e99ebbf 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.cpp
@@ -22,6 +22,7 @@
 
 #include "qwebpage.h"
 #include "qwebpage_p.h"
+#include "qwebplugindatabase.h"
 
 #include "Cache.h"
 #include "CrossOriginPreflightResultCache.h"
@@ -36,7 +37,11 @@
 #include "IntSize.h"
 #include "ApplicationCacheStorage.h"
 #include "DatabaseTracker.h"
+#include "FileSystem.h"
 
+#include <QApplication>
+#include <QDesktopServices>
+#include <QDir>
 #include <QHash>
 #include <QSharedData>
 #include <QUrl>
@@ -54,7 +59,7 @@ public:
     QHash<int, bool> attributes;
     QUrl userStyleSheetLocation;
     QString defaultTextEncoding;
-    QString localStorageDatabasePath;
+    QString localStoragePath;
     QString offlineWebApplicationCachePath;
     qint64 offlineStorageDefaultQuota;
 
@@ -166,8 +171,8 @@ void QWebSettingsPrivate::apply()
         QString encoding = !defaultTextEncoding.isEmpty() ? defaultTextEncoding: global->defaultTextEncoding;
         settings->setDefaultTextEncodingName(encoding);
 
-        QString localStoragePath = !localStorageDatabasePath.isEmpty() ? localStorageDatabasePath : global->localStorageDatabasePath;
-        settings->setLocalStorageDatabasePath(localStoragePath);
+        QString storagePath = !localStoragePath.isEmpty() ? localStoragePath : global->localStoragePath;
+        settings->setLocalStorageDatabasePath(storagePath);
 
         value = attributes.value(QWebSettings::ZoomTextOnly,
                                  global->attributes.value(QWebSettings::ZoomTextOnly));
@@ -185,13 +190,18 @@ void QWebSettingsPrivate::apply()
                                       global->attributes.value(QWebSettings::OfflineWebApplicationCacheEnabled));
         settings->setOfflineWebApplicationCacheEnabled(value);
 
-        value = attributes.value(QWebSettings::LocalStorageDatabaseEnabled,
-                                      global->attributes.value(QWebSettings::LocalStorageDatabaseEnabled));
+        value = attributes.value(QWebSettings::LocalStorageEnabled,
+                                      global->attributes.value(QWebSettings::LocalStorageEnabled));
+                                                                                                                                  
         settings->setLocalStorageEnabled(value);
 
         value = attributes.value(QWebSettings::LocalContentCanAccessRemoteUrls,
                                       global->attributes.value(QWebSettings::LocalContentCanAccessRemoteUrls));
         settings->setAllowUniversalAccessFromFileURLs(value);
+
+        value = attributes.value(QWebSettings::SessionStorageEnabled,
+                                    global->attributes.value(QWebSettings::SessionStorageEnabled));
+        settings->setSessionStorageEnabled(value);
     } else {
         QList<QWebSettingsPrivate*> settings = *::allSettings();
         for (int i = 0; i < settings.count(); ++i)
@@ -303,6 +313,8 @@ QWebSettings* QWebSettings::globalSettings()
 
     \value AutoLoadImages Specifies whether images are automatically loaded in
         web pages.
+    \value DnsPrefetchEnabled Specifies whether QtWebkit will try to pre-fetch DNS entries to
+        speed up browsing. This only works as a global attribute. Only for Qt 4.6 and later.
     \value JavascriptEnabled Enables or disables the running of JavaScript
         programs.
     \value JavaEnabled Enables or disables Java applets.
@@ -315,8 +327,9 @@ QWebSettings* QWebSettings::globalSettings()
     \value JavascriptCanAccessClipboard Specifies whether JavaScript programs
         can read or write to the clipboard.
     \value DeveloperExtrasEnabled Enables extra tools for Web developers.
-        Currently this enables the "Inspect" element in the context menu,
-    which shows the WebKit WebInspector for web site debugging.
+        Currently this enables the "Inspect" element in the context menu as
+        well as the use of QWebInspector which controls the WebKit WebInspector
+        for web site debugging.
     \value LinksIncludedInFocusChain Specifies whether hyperlinks should be
         included in the keyboard focus chain.
     \value ZoomTextOnly Specifies whether the zoom factor on a frame applies to
@@ -324,12 +337,14 @@ QWebSettings* QWebSettings::globalSettings()
     \value PrintElementBackgrounds Specifies whether the background color and images
         are also drawn when the page is printed.
     \value OfflineStorageDatabaseEnabled Specifies whether support for the HTML 5
-        offline storage feature is enabled or not.
+        offline storage feature is enabled or not. Disabled by default.
     \value OfflineWebApplicationCacheEnabled Specifies whether support for the HTML 5
-        web application cache feature is enabled or not.
-    \value LocalStorageDatabaseEnabled Specifies whether support for the HTML 5
-        local storage feature is enabled or not.
+        web application cache feature is enabled or not. Disabled by default.
+    \value LocalStorageEnabled Specifies whether support for the HTML 5
+        local storage feature is enabled or not. Disabled by default.
     \value LocalContentCanAccessRemoteUrls Specifies whether locally loaded documents are allowed to access remote urls.
+    \value SessionStorageEnabled Specifies whether support for the HTML 5
+        session storage feature is enabled or not. Enabled by default.                
 */
 
 /*!
@@ -351,16 +366,17 @@ QWebSettings::QWebSettings()
     d->fontFamilies.insert(QWebSettings::FantasyFont, QLatin1String("Arial"));
 
     d->attributes.insert(QWebSettings::AutoLoadImages, true);
+    d->attributes.insert(QWebSettings::DnsPrefetchEnabled, false);
     d->attributes.insert(QWebSettings::JavascriptEnabled, true);
     d->attributes.insert(QWebSettings::LinksIncludedInFocusChain, true);
     d->attributes.insert(QWebSettings::ZoomTextOnly, false);
     d->attributes.insert(QWebSettings::PrintElementBackgrounds, true);
-    d->attributes.insert(QWebSettings::OfflineStorageDatabaseEnabled, true);
-    d->attributes.insert(QWebSettings::OfflineWebApplicationCacheEnabled, true);
-    d->attributes.insert(QWebSettings::LocalStorageDatabaseEnabled, true);
-    d->attributes.insert(QWebSettings::LocalContentCanAccessRemoteUrls, true);
+    d->attributes.insert(QWebSettings::OfflineStorageDatabaseEnabled, false);
+    d->attributes.insert(QWebSettings::OfflineWebApplicationCacheEnabled, false);
+    d->attributes.insert(QWebSettings::LocalStorageEnabled, false);
+    d->attributes.insert(QWebSettings::LocalContentCanAccessRemoteUrls, false);
+    d->attributes.insert(QWebSettings::SessionStorageEnabled, true);
     d->offlineStorageDefaultQuota = 5 * 1024 * 1024;
-
 }
 
 /*!
@@ -542,6 +558,17 @@ QIcon QWebSettings::iconForUrl(const QUrl& url)
 }
 
 /*!
+    Returns the plugin database object.
+*/
+QWebPluginDatabase *QWebSettings::pluginDatabase()
+{
+    static QWebPluginDatabase* database = 0;
+    if (!database)
+        database = new QWebPluginDatabase();
+    return database;
+}
+
+/*!
     Sets \a graphic to be drawn when QtWebKit needs to draw an image of the
     given \a type.
 
@@ -629,7 +656,7 @@ int QWebSettings::maximumPagesInCache()
 
    The \a cacheMinDeadCapacity specifies the \e minimum number of bytes that
    dead objects should consume when the cache is under pressure.
-   
+
    \a cacheMaxDead is the \e maximum number of bytes that dead objects should
    consume when the cache is \bold not under pressure.
 
@@ -689,7 +716,7 @@ void QWebSettings::resetFontFamily(FontFamily which)
 
 /*!
     \fn void QWebSettings::setAttribute(WebAttribute attribute, bool on)
-    
+
     Enables or disables the specified \a attribute feature depending on the
     value of \a on.
 */
@@ -786,27 +813,35 @@ qint64 QWebSettings::offlineStorageDefaultQuota()
     return QWebSettings::globalSettings()->d->offlineStorageDefaultQuota;
 }
 
-/*
-    \internal
+/*!
+    \since 4.6
     \relates QWebSettings
 
     Sets the path for HTML5 offline web application cache storage to \a path.
 
+    An application cache acts like an HTTP cache in some sense. For documents
+    that use the application cache via JavaScript, the loader mechinery will
+    first ask the application cache for the contents, before hitting the
+    network.
+
+    The feature is described in details at:
+    http://dev.w3.org/html5/spec/Overview.html#appcache
+
     \a path must point to an existing directory where the cache is stored.
 
     Setting an empty path disables the feature.
 
     \sa offlineWebApplicationCachePath()
 */
-void QWEBKIT_EXPORT qt_websettings_setOfflineWebApplicationCachePath(const QString& path)
+void QWebSettings::setOfflineWebApplicationCachePath(const QString& path)
 {
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     WebCore::cacheStorage().setCacheDirectory(path);
 #endif
 }
 
-/*
-    \internal
+/*!
+    \since 4.6
     \relates QWebSettings
 
     Returns the path of the HTML5 offline web application cache storage
@@ -814,7 +849,7 @@ void QWEBKIT_EXPORT qt_websettings_setOfflineWebApplicationCachePath(const QStri
 
     \sa setOfflineWebApplicationCachePath()
 */
-QString QWEBKIT_EXPORT qt_websettings_offlineWebApplicationCachePath()
+QString QWebSettings::offlineWebApplicationCachePath()
 {
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     return WebCore::cacheStorage().cacheDirectory();
@@ -823,37 +858,98 @@ QString QWEBKIT_EXPORT qt_websettings_offlineWebApplicationCachePath()
 #endif
 }
 
-/*
-    \since 4.5
-    \relates QWebSettings
+/*!
+    \since 4.6
 
-    Sets the path for HTML5 local storage databases to \a path.
+    Sets the value of the quota for the offline web application cache
+    to \a maximumSize.
+*/
+void QWebSettings::setOfflineWebApplicationCacheQuota(qint64 maximumSize)
+{
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    WebCore::cacheStorage().setMaximumSize(maximumSize);
+#endif
+}
 
-    \a path must point to an existing directory where the cache is stored.
+/*!
+    \since 4.6
 
-    Setting an empty path disables the feature.
+    Returns the value of the quota for the offline web application cache.
+*/
+qint64 QWebSettings::offlineWebApplicationCacheQuota()
+{
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    return WebCore::cacheStorage().maximumSize();
+#else
+    return 0;
+#endif
+}
 
-    \sa localStorageDatabasePath()
+/*!
+    \since 4.6
+    \relates QWebSettings
+
+    Sets the path for HTML5 local storage to \a path.
+    
+    For more information on HTML5 local storage see the
+    \l{http://www.w3.org/TR/webstorage/#the-localstorage-attribute}{Web Storage standard}.
+    
+    Support for local storage can enabled by setting the
+    \l{QWebSettings::LocalStorageEnabled}{LocalStorageEnabled} attribute.     
+
+    \sa localStoragePath()
 */
-void QWEBKIT_EXPORT qt_websettings_setLocalStorageDatabasePath(QWebSettings* settings, const QString& path)
+void QWebSettings::setLocalStoragePath(const QString& path)
 {
-    QWebSettingsPrivate* d = settings->handle();
-    d->localStorageDatabasePath = path;
+    d->localStoragePath = path;
     d->apply();
 }
 
-/*
-    \since 4.5
+/*!
+    \since 4.6
     \relates QWebSettings
 
-    Returns the path for HTML5 local storage databases
-    or an empty string if the feature is disabled.
+    Returns the path for HTML5 local storage.
+    
+    \sa setLocalStoragePath()
+*/
+QString QWebSettings::localStoragePath() const
+{
+    return d->localStoragePath;
+}
+
+/*!
+    \since 4.6
+    \relates QWebSettings
 
-    \sa setLocalStorageDatabasePath()
+    Enables WebKit persistent data and sets the path to \a path.
+    If the \a path is empty the path for persistent data is set to the 
+    user-specific data location specified by 
+    \l{QDesktopServices::DataLocation}{DataLocation}.
+    
+    \sa localStoragePath()
 */
-QString QWEBKIT_EXPORT qt_websettings_localStorageDatabasePath(QWebSettings* settings)
+void QWebSettings::enablePersistentStorage(const QString& path)
 {
-    return settings->handle()->localStorageDatabasePath;
+    QString storagePath;
+
+    if (path.isEmpty()) {
+        storagePath = QDesktopServices::storageLocation(QDesktopServices::DataLocation);
+
+        if (storagePath.isEmpty())
+            storagePath = WebCore::pathByAppendingComponent(QDir::homePath(), QCoreApplication::applicationName());
+    } else
+        storagePath = path;
+
+    WebCore::makeAllDirectories(storagePath);
+
+    QWebSettings::setIconDatabasePath(storagePath);
+    QWebSettings::setOfflineWebApplicationCachePath(storagePath);
+    QWebSettings::setOfflineStoragePath(WebCore::pathByAppendingComponent(storagePath, "Databases"));
+    QWebSettings::globalSettings()->setLocalStoragePath(WebCore::pathByAppendingComponent(storagePath, "LocalStorage"));
+    QWebSettings::globalSettings()->setAttribute(QWebSettings::LocalStorageEnabled, true);
+    QWebSettings::globalSettings()->setAttribute(QWebSettings::OfflineStorageDatabaseEnabled, true);
+    QWebSettings::globalSettings()->setAttribute(QWebSettings::OfflineWebApplicationCacheEnabled, true);
 }
 
 /*!
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.h
index 63144cb..4790823 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.h
@@ -32,6 +32,7 @@ namespace WebCore {
 }
 
 class QWebPage;
+class QWebPluginDatabase;
 class QWebSettingsPrivate;
 QT_BEGIN_NAMESPACE
 class QUrl;
@@ -61,8 +62,13 @@ public:
         PrintElementBackgrounds,
         OfflineStorageDatabaseEnabled,
         OfflineWebApplicationCacheEnabled,
-        LocalStorageDatabaseEnabled,
-        LocalContentCanAccessRemoteUrls
+        LocalStorageEnabled,
+#ifdef QT_DEPRECATED
+        LocalStorageDatabaseEnabled = LocalStorageEnabled,
+#endif
+        LocalContentCanAccessRemoteUrls,
+        SessionStorageEnabled,
+        DnsPrefetchEnabled
     };
     enum WebGraphic {
         MissingImageGraphic,
@@ -102,6 +108,8 @@ public:
     static void clearIconDatabase();
     static QIcon iconForUrl(const QUrl &url);
 
+    static QWebPluginDatabase *pluginDatabase();
+
     static void setWebGraphic(WebGraphic type, const QPixmap &graphic);
     static QPixmap webGraphic(WebGraphic type);
 
@@ -114,8 +122,18 @@ public:
     static void setOfflineStorageDefaultQuota(qint64 maximumSize);
     static qint64 offlineStorageDefaultQuota();
 
+    static void setOfflineWebApplicationCachePath(const QString& path);
+    static QString offlineWebApplicationCachePath();
+    static void setOfflineWebApplicationCacheQuota(qint64 maximumSize);
+    static qint64 offlineWebApplicationCacheQuota();
+    
+    void setLocalStoragePath(const QString& path);
+    QString localStoragePath() const; 
+
     static void clearMemoryCaches();
 
+    static void enablePersistentStorage(const QString& path = QString());
+
     inline QWebSettingsPrivate* handle() const { return d; }
 
 private:
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp
index 422b5e6..d12de94 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp
@@ -36,40 +36,22 @@ public:
         : view(view)
         , page(0)
         , renderHints(QPainter::TextAntialiasing)
-#ifndef QT_NO_CURSOR
-        , cursorSetByWebCore(false)
-        , usesWebCoreCursor(true)
-#endif
     {}
 
+    void _q_pageDestroyed();
+
     QWebView *view;
     QWebPage *page;
 
     QPainter::RenderHints renderHints;
-
-#ifndef QT_NO_CURSOR
-    /*
-     * We keep track of if we have called setCursor and if the CursorChange
-     * event is sent due our setCursor call and if we currently use the WebCore
-     * Cursor and use it to decide if we can update to another WebCore Cursor.
-     */
-    bool cursorSetByWebCore;
-    bool usesWebCoreCursor;
-
-    void setCursor(const QCursor& newCursor)
-    {
-        webCoreCursor = newCursor;
-
-        if (usesWebCoreCursor) {
-            cursorSetByWebCore = true;
-            view->setCursor(webCoreCursor);
-        }
-    }
-
-    QCursor webCoreCursor;
-#endif
 };
 
+void QWebViewPrivate::_q_pageDestroyed()
+{
+    page = 0;
+    view->setPage(0);
+}
+
 /*!
     \class QWebView
     \since 4.4
@@ -244,6 +226,8 @@ void QWebView::setPage(QWebPage* page)
 
         connect(d->page, SIGNAL(microFocusChanged()),
                 this, SLOT(updateMicroFocus()));
+        connect(d->page, SIGNAL(destroyed()),
+                this, SLOT(_q_pageDestroyed()));
     }
     setAttribute(Qt::WA_OpaquePaintEvent, d->page);
     update();
@@ -696,18 +680,25 @@ bool QWebView::event(QEvent *e)
         if (e->type() == QEvent::ShortcutOverride) {
             d->page->event(e);
 #ifndef QT_NO_CURSOR
-        } else if (e->type() == static_cast<QEvent::Type>(WebCore::SetCursorEvent::EventType)) {
-            d->setCursor(static_cast<WebCore::SetCursorEvent*>(e)->cursor());
 #if QT_VERSION >= 0x040400
         } else if (e->type() == QEvent::CursorChange) {
-            // Okay we might use the WebCore Cursor now.
-            d->usesWebCoreCursor = d->cursorSetByWebCore;
-            d->cursorSetByWebCore = false;
-
-            // Go back to the WebCore Cursor. QWidget::unsetCursor is appromixated with this
-            if (!d->usesWebCoreCursor && cursor().shape() == Qt::ArrowCursor) {
-                d->usesWebCoreCursor = true;
-                d->setCursor(d->webCoreCursor);
+            // might be a QWidget::unsetCursor()
+            if (cursor().shape() == Qt::ArrowCursor) {
+                QVariant prop = property("WebCoreCursor");
+                if (prop.isValid()) {
+                    QCursor webCoreCursor = qvariant_cast<QCursor>(prop);
+                    if (webCoreCursor.shape() != Qt::ArrowCursor)
+                        setCursor(webCoreCursor);
+                }
+            }
+        } else if (e->type() == QEvent::DynamicPropertyChange) {
+            const QByteArray& propName = static_cast<QDynamicPropertyChangeEvent *>(e)->propertyName();
+            if (!qstrcmp(propName, "WebCoreCursor")) {
+                QVariant prop = property("WebCoreCursor");
+                if (prop.isValid()) {
+                    QCursor webCoreCursor = qvariant_cast<QCursor>(prop);
+                    setCursor(webCoreCursor);
+                }
             }
 #endif
 #endif
@@ -1096,3 +1087,6 @@ void QWebView::changeEvent(QEvent *e)
 
     \sa QWebPage::linkDelegationPolicy()
 */
+
+#include "moc_qwebview.cpp"
+
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebview.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebview.h
index e886144..0f2649d 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebview.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebview.h
@@ -50,7 +50,13 @@ class QWEBKIT_EXPORT QWebView : public QWidget {
     //Q_PROPERTY(Qt::TextInteractionFlags textInteractionFlags READ textInteractionFlags WRITE setTextInteractionFlags)
     Q_PROPERTY(qreal textSizeMultiplier READ textSizeMultiplier WRITE setTextSizeMultiplier DESIGNABLE false)
     Q_PROPERTY(qreal zoomFactor READ zoomFactor WRITE setZoomFactor)
+
+// FIXME: temporary work around for elftran issue that it couldn't find the QPainter::staticMetaObject
+// symbol from Qt lib; it should be reverted after the right symbol is exported.  
+// See bug: http://qt.nokia.com/developer/task-tracker/index_html?method=entry&id=258893
+#if !defined(Q_OS_SYMBIAN)
     Q_PROPERTY(QPainter::RenderHints renderHints READ renderHints WRITE setRenderHints)
+#endif
     Q_FLAGS(QPainter::RenderHints)
 public:
     explicit QWebView(QWidget* parent = 0);
@@ -162,6 +168,7 @@ protected:
 private:
     friend class QWebPage;
     QWebViewPrivate* d;
+    Q_PRIVATE_SLOT(d, void _q_pageDestroyed())
 };
 
 #endif // QWEBVIEW_H
diff --git a/src/3rdparty/webkit/WebKit/qt/ChangeLog b/src/3rdparty/webkit/WebKit/qt/ChangeLog
index e8f5ad0..8ec6b86 100644
--- a/src/3rdparty/webkit/WebKit/qt/ChangeLog
+++ b/src/3rdparty/webkit/WebKit/qt/ChangeLog
@@ -1,3 +1,1178 @@
+2009-09-17  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Symbian build fix.
+
+        Moved the #ifdefs around _q_cleanupLeakMessages() into the function
+        definition.
+
+        QMake is not being able to distinguish between release and debug builds
+        in Symbian build. This is a Symbian toolchain issue.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::_q_cleanupLeakMessages):
+        * Api/qwebpage.h:
+        * Api/qwebpage_p.h:
+
+2009-09-17  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Small cosmetic documentation fixlet in the QWebInspector.
+
+        * Api/qwebinspector.cpp:
+
+2009-09-16  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Detect and add Windows7 properly to the user agent.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::userAgentForUrl):
+
+2009-09-16  Andras Becsi  <andrewbecsi@yahoo.co.uk>
+
+        Rubberstamped by Kenneth Christiansen.
+
+        [Qt] Build fix for previous changes.
+
+        * QGVLauncher/main.cpp:
+        (MainView::flip):
+
+2009-09-16  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Unreviewed potential Qt < 4.6 build fix.
+
+        * QGVLauncher/main.cpp:
+        (MainView::flip):
+
+2009-09-16  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Add a "Flip effect" to our GraphicsView based launcher.
+
+        * QGVLauncher/main.cpp:
+        (MainView::resizeEvent):
+        (MainView::flip):
+        (MainWindow::flip):
+        (MainWindow::buildUI):
+
+2009-09-16  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Rubber-stamped by Simon Hausmann.
+
+        [Qt] Typo fix. Pass the window object to the Format
+        menu. In this way Qt can free its internal graphical
+        objects during exit.
+
+        * QtLauncher/main.cpp:
+        (MainWindow::setupUI):
+
+2009-09-16  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Build break fix on gcc ARM.
+
+        * Api/qwebgraphicsitem.cpp:
+        (QWebGraphicsItemPrivate::_q_doLoadProgress):
+
+2009-09-16  Warwick Allison  <warwick.allison@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix a crash in QWebFrame::hasFocus() with a simple null pointer check
+        when the focused frame is null. We do the same check in other places
+        where we call kit().
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::hasFocus):
+
+2009-09-16  Jure Repinc  <jlp@holodeck1.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fixed a typo found during translation.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::interruptForPolicyChangeError):
+
+2009-09-14  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] QWebGraphicsItem should check for null QWebPage.
+        https://bugs.webkit.org/show_bug.cgi?id=29185
+
+        Don't crash in QWebGraphicsItem when the page is still null, by
+        either checking if it's the case or constructing the default one.
+
+        * Api/qwebgraphicsitem.cpp:
+        (QWebGraphicsItem::icon):
+        (QWebGraphicsItem::setZoomFactor):
+        (QWebGraphicsItem::zoomFactor):
+        (QWebGraphicsItem::setGeometry):
+        (QWebGraphicsItem::load):
+        (QWebGraphicsItem::setHtml):
+        (QWebGraphicsItem::toHtml):
+        (QWebGraphicsItem::setContent):
+        (QWebGraphicsItem::history):
+        (QWebGraphicsItem::settings):
+
+2009-09-11  David Boddie  <dboddie@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Doc: Note that Netscape plugins are only available on desktop platforms.
+
+        * docs/qtwebkit.qdoc:
+
+2009-09-11  Martin Smith  <msmith@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Adjust the name of the contentspage for the documentation
+        to the new name used in Qt 4.6.
+
+        * docs/qtwebkit.qdoc:
+
+2009-09-11  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Changed URLs from qtsoftware.com to qt.nokia.com, as part of a general
+        renaming.
+
+        * Api/qwebpluginfactory.cpp:
+        * docs/webkitsnippets/simple/main.cpp:
+        (main):
+        * docs/webkitsnippets/webpage/main.cpp:
+        (main):
+
+2009-09-11  Volker Hilsheimer  <volker.hilsheimer@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Restructure the documentation, both on a file and on a content level.
+
+        * Api/qwebdatabase.cpp:
+        * Api/qwebelement.cpp:
+        * Api/qwebframe.cpp:
+        * Api/qwebhistory.cpp:
+        * Api/qwebhistoryinterface.cpp:
+        * Api/qwebpage.cpp:
+        * Api/qwebpluginfactory.cpp:
+        * Api/qwebsecurityorigin.cpp:
+        * Api/qwebsettings.cpp:
+        * Api/qwebview.cpp:
+        * docs/qtwebkit.qdoc:
+
+2009-09-11  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=29136
+        [Qt] emit microFocusChanged() signal when no QWidget-based view is present.
+
+        emit microFocusChange() signal regardless of view.
+
+        * WebCoreSupport/EditorClientQt.cpp:
+        (WebCore::EditorClientQt::setInputMethodState):
+
+2009-09-11  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28806
+
+        [Qt] Make the WebInspector available as a QWidget.
+
+        * Api/headers.pri:
+        * Api/qwebelement.cpp:
+        (QWebElement::enclosingElement):
+        * Api/qwebelement.h:
+        * Api/qwebinspector.cpp: Added.
+        * Api/qwebinspector.h: Added.
+        * Api/qwebinspector_p.h: Added.
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate):
+        (QWebPagePrivate::setInspector):
+        (QWebPagePrivate::getOrCreateInspector):
+        (QWebPagePrivate::inspectorController):
+        (QWebPage::~QWebPage):
+        (QWebPage::triggerAction):
+        * Api/qwebpage.h:
+        * Api/qwebpage_p.h:
+        * Api/qwebsettings.cpp:
+        * QtLauncher/main.cpp:
+        (MainWindow::MainWindow):
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (WebCore::InspectorClientWebPage::InspectorClientWebPage):
+        (WebCore::InspectorClientWebPage::createWindow):
+        (WebCore::InspectorClientQt::createPage):
+        (WebCore::InspectorClientQt::showWindow):
+        (WebCore::InspectorClientQt::closeWindow):
+        (WebCore::InspectorClientQt::attachWindow):
+        (WebCore::InspectorClientQt::detachWindow):
+        (WebCore::InspectorClientQt::updateWindowTitle):
+        * WebCoreSupport/InspectorClientQt.h:
+        * docs/webkitsnippets/qtwebkit_qwebinspector_snippet.cpp: Added.
+
+2009-09-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Fix comparison between signed and unsigned integer warnings
+        https://bugs.webkit.org/show_bug.cgi?id=29162
+
+        No functional change.
+
+        * Api/qwebelement.cpp:
+        (QWebElement::findAll):
+        * Api/qwebhistory.cpp:
+        (QWebHistory::items):
+        (QWebHistory::backItems):
+        (QWebHistory::forwardItems):
+        (QWebHistory::saveState):
+        * Api/qwebplugindatabase.cpp:
+        (QWebPluginDatabase::setSearchPaths):
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::runOpenPanel):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::createPlugin):
+
+2009-09-10  Simon Hausmann  <hausmann@webkit.org>
+
+        Rubber-stamped by Ariya Hidayat.
+
+        Fix a bunch of qdoc warnings: Invalid references, non-standard
+        wording, etc.
+
+        * Api/qwebelement.cpp:
+        * Api/qwebgraphicsitem.cpp:
+        * Api/qwebsecurityorigin.cpp:
+
+2009-09-10  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Fix context menu event delivery with QWebGraphicsItem.
+
+        Re-implement the correct context menu virtual function using
+        a QGraphicsSceneContextMenuEvent and forward & handle it in
+        QWebPage.
+
+        * Api/qwebgraphicsitem.cpp:
+        (QWebGraphicsItem::contextMenuEvent):
+        * Api/qwebgraphicsitem.h:
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::contextMenuEvent):
+        (QWebPage::event):
+        * Api/qwebpage_p.h:
+
+2009-09-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        Build fix for QtWebKit for Mac after r48219.
+
+        qevent and qstyleoption are QtGui interfaces.
+
+        * Api/qwebgraphicsitem.cpp:
+        * Api/qwebgraphicsitem.h:
+
+2009-09-09  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Call the right base class function QGraphicsWidget::event() instead
+        of skipping it and using QObject::event() instead.
+
+        * Api/qwebgraphicsitem.cpp:
+        (QWebGraphicsItem::event):
+
+2009-09-09  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Unreviewed.
+
+        Fix comment at Tor Arne Vestbø's request.
+
+        * Api/qwebgraphicsitem.cpp:
+        (QWebGraphicsItem::sceneEvent):
+        (QWebGraphicsItem::event):
+
+2009-09-09  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Implement some virtual event methods so that we can fix
+        event-related bugs in Qt patch releases.
+
+        * Api/qwebgraphicsitem.cpp:
+        (QWebGraphicsItem::sceneEvent):
+        (QWebGraphicsItem::event):
+        * Api/qwebgraphicsitem.h:
+
+2009-09-09  Kenneth Rohde Christiansen  <kenneth@webkit.org>, Antonio Gomes  <antonio.gomes@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Add a new QGraphicsWidget based version of the "QWebView"
+        under the name "QWebGraphicsItem".
+
+        https://bugs.webkit.org/show_bug.cgi?id=28862
+
+        Includes an alternative Qt launcher using the QGraphicsView.
+
+        * Api/headers.pri:
+        * Api/qwebgraphicsitem.cpp: Added.
+        * Api/qwebgraphicsitem.h: Added.
+        * Api/qwebpage.h:
+        * QGVLauncher/QGVLauncher.pro: Copied from WebKit/qt/QtLauncher/QtLauncher.pro.
+        * QGVLauncher/main.cpp: Added.
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::repaint):
+        (WebCore::ChromeClientQt::scroll):
+
+2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Unreviewed build fix.
+
+        Potential build fix for Qt 4.5
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::mousePressEvent):
+
+2009-09-08  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29007
+        Add a test for the signal QWebFrame::javaScriptWindowObjectCleared()
+
+        * tests/qwebframe/tst_qwebframe.cpp:
+
+2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix unused variable warnings
+        https://bugs.webkit.org/show_bug.cgi?id=29018
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::keyPressEvent):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::startDownload):
+        (WebCore::FrameLoaderClientQt::createFrame):
+
+2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Use the declaration order in initializer lists
+        https://bugs.webkit.org/show_bug.cgi?id=29017
+
+        * Api/qwebframe_p.h:
+
+2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Add support for handling QGraphicsScene events.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::mouseMoveEvent):
+        (QWebPagePrivate::mousePressEvent):
+        (QWebPagePrivate::mouseDoubleClickEvent):
+        (QWebPagePrivate::mouseTripleClickEvent):
+        (QWebPagePrivate::handleClipboard):
+        (QWebPagePrivate::mouseReleaseEvent):
+        (QWebPagePrivate::wheelEvent):
+        (QWebPagePrivate::dragEnterEvent):
+        (QWebPagePrivate::dragLeaveEvent):
+        (QWebPagePrivate::dragMoveEvent):
+        (QWebPagePrivate::dropEvent):
+        (QWebPage::event):
+        * Api/qwebpage_p.h:
+
+2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make cursor set cleaner in QtWebKit Api: eliminate SetCursorEvent hack.
+        https://bugs.webkit.org/show_bug.cgi?id=28865
+
+        Clean up the unserCursor hack to use the QCursor set
+        as a property of the QWidget by WebCore::WidgetQt.
+
+        Remove all code that are no longer necessary for getting
+        cursor change events.
+
+        Patch by Kenneth Rohde Christiansen <kenneth@webkit.org> and
+                 Antonio Gomes <antonio.gomes@openbossa.org> on 2009-09-07
+
+        * Api/qwebpage.cpp:
+        * Api/qwebpage_p.h:
+        * Api/qwebview.cpp:
+        (QWebViewPrivate::QWebViewPrivate):
+        (QWebView::event):
+
+2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] QtWebKit single API to enable persistency
+        https://bugs.webkit.org/show_bug.cgi?id=28682
+
+        Disable LocalStorage, ApplicationCache, HTML5 offline storage by
+        default.
+
+        If persistency is enabled the default directory for LocalStorage and
+        ApplicationCache is now based on QDesktopServices::DataLocation and not
+        QDesktopServices::CacheLocation (as it is expected to keep this data
+        around after a reboot).
+
+        If persistency is enabled initialize HTML5 offline storage as well - this
+        fixed offline Storage for QtLauncher.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate):
+        * Api/qwebsettings.cpp:
+        (QWebSettings::QWebSettings):
+        (QWebSettings::enablePersistentStorage):
+        * Api/qwebsettings.h: Add a new API called enablePersistentStorage
+        * QtLauncher/main.cpp: Use the new enablePersistentStorage API
+        (main):
+
+2009-09-07  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Speed up the QWebPluginInfo::supportsMimeType() function.
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        Instead of going through the MIME types list constructed with
+        mimeTypes() function, look up the internal mimeToDescriptions map.
+
+        * Api/qwebplugindatabase.cpp:
+        (QWebPluginInfo::supportsMimeType):
+
+2009-09-07  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Speed up the QWebPluginInfo::mimeTypes() function.
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        Instead of constructing a list of MIME types every time it is called,
+        do this only once.
+
+        * Api/qwebplugindatabase.cpp:
+        (QWebPluginInfo::mimeTypes):
+        (QWebPluginInfo::operator=):
+        * Api/qwebplugindatabase.h:
+        * tests/qwebplugindatabase/tst_qwebplugindatabase.cpp:
+        (tst_QWebPluginDatabase::operatorassign_data):
+        (tst_QWebPluginDatabase::operatorassign):
+
+2009-09-07  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Remove the private classes from QWebPluginDatabase.
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        Instead, hold the PluginDatabase and PluginPackage objects as class
+        members and take care of refcounting on our own instead of using RefPtr.
+
+        This way we not only made the code cleaner but also got rid of
+        redundant allocations when constructing null QWebPluginInfo objects.
+
+        The private classes have been forward-declared and the d-pointers left
+        to be on the safe side.
+
+        * Api/qwebplugindatabase.cpp:
+        (QWebPluginInfo::QWebPluginInfo):
+        (QWebPluginInfo::~QWebPluginInfo):
+        (QWebPluginInfo::name):
+        (QWebPluginInfo::description):
+        (QWebPluginInfo::mimeTypes):
+        (QWebPluginInfo::path):
+        (QWebPluginInfo::isNull):
+        (QWebPluginInfo::setEnabled):
+        (QWebPluginInfo::isEnabled):
+        (QWebPluginInfo::operator==):
+        (QWebPluginInfo::operator!=):
+        (QWebPluginInfo::operator=):
+        (QWebPluginDatabase::QWebPluginDatabase):
+        (QWebPluginDatabase::~QWebPluginDatabase):
+        (QWebPluginDatabase::plugins):
+        (QWebPluginDatabase::searchPaths):
+        (QWebPluginDatabase::setSearchPaths):
+        (QWebPluginDatabase::addSearchPath):
+        (QWebPluginDatabase::refresh):
+        (QWebPluginDatabase::pluginForMimeType):
+        (QWebPluginDatabase::setPreferredPluginForMimeType):
+        * Api/qwebplugindatabase.h:
+        * Api/qwebplugindatabase_p.h: Removed.
+
+2009-09-05  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] r47424 broke binary compatibility
+        https://bugs.webkit.org/show_bug.cgi?id=28996
+
+        Append the new DnsPrefetchEnabled attribute at the end of the enum.
+
+        * Api/qwebsettings.h:
+
+2009-09-04  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28614
+
+        Account for scrollbar state changes that occur during layout.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::setScrollBarPolicy):
+
+        Eliminate duplicated (and incorrect) scrollbar mode tracking between
+        FrameView and ScrollView.
+
+2009-09-04  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Fix tst_QWebPage::database autotest failure
+        https://bugs.webkit.org/show_bug.cgi?id=28961
+
+        Make sure that the test case enables the feature before 
+        the feature gets tested
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::database):
+
+2009-09-04  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+        
+        Any QtWebKit application crashes on exit if the inspector is
+        used during the session rather then exiting.
+        
+        If a QWebView has a QWebPage that is destroyed the QWebView
+        does not update its pointer and will crash the next time
+        it access the page pointers (such as in its destructor).
+        
+        InspectorClientView should not call deleteLater when the page
+        is destroyed because it does not have a parent and is a top
+        level widget.  close() needs to be called so that QApplication
+        can exit the application if quitOnLastWindowClosed is set
+        and a InspectorClientView is the last window, otherwise
+        the application will never exit.
+        
+        * Api/qwebview.cpp:
+        (QWebViewPrivate::_q_pageDestroyed):
+        (QWebView::setPage):
+        * Api/qwebview.h:
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (WebCore::InspectorClientView::InspectorClientView):
+
+2009-09-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by eric@webkit.org.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24696
+
+        Stub implementations of mixed content methods of FrameLoaderClient. 
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::didDisplayInsecureContent):
+        (WebCore::FrameLoaderClientQt::didRunInsecureContent):
+        * WebCoreSupport/FrameLoaderClientQt.h:
+
+2009-09-03  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Add a setting to turn SessionStorage on/off
+        https://bugs.webkit.org/show_bug.cgi?id=28836
+
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+        (QWebSettings::QWebSettings):
+        * Api/qwebsettings.h:
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (testFlag):
+        (tst_QWebPage::testOptionalJSObjects):
+
+2009-09-02  Richard Moore  <rich@kde.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Make sure we relayout the page after evaluating JS
+
+        https://bugs.webkit.org/show_bug.cgi?id=28235
+
+        QtWebKit does not always seem to reflow the page when evaluating
+        javascript. This patch changes the way evaluateJavaScript works to
+        use the frameloader which ensures that this is done properly.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::evaluateJavaScript):
+        * tests/qwebframe/tst_qwebframe.cpp:
+
+2009-08-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25889
+        [GTK] scrollbar policy for main frame is not implementable
+
+        Add empty implementation for new ChromeClient method.
+
+        * WebCoreSupport/ChromeClientQt.h:
+        (WebCore::ChromeClientQt::scrollbarsModeDidChange):
+
+2009-08-27  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        QWebHistory::clear() modifications.
+
+        Clear() method was changed. If QWebHistory is empty (there is no
+        elements even current) clear() do nothing. If there at least one
+        element clear() will delete everything apart of current.
+
+        New autotests in QWebHistory
+
+        New autotests were added to QWebHistory. They should check some crashes
+        in save and restore state process and clear() method and general
+        behavior on where QWebHistory::count() == 0 or QWebHistory::count() == 1
+
+        Bugzilla: https://bugs.webkit.org/show_bug.cgi?id=28711
+
+        * Api/qwebhistory.cpp:
+        (QWebHistory::clear):
+        * tests/qwebhistory/tst_qwebhistory.cpp:
+        (tst_QWebHistory::back):
+        (tst_QWebHistory::forward):
+        (tst_QWebHistory::saveAndRestore_crash_1):
+        (tst_QWebHistory::saveAndRestore_crash_2):
+        (tst_QWebHistory::saveAndRestore_crash_3):
+        (tst_QWebHistory::clear):
+
+2009-08-27  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Cleanup, old and commented part of source code was removed.
+        Fix some formatting problems.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28712
+
+        * Api/qwebhistory_p.h:
+        (QWebHistoryPrivate::QWebHistoryPrivate):
+
+2009-08-26  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Don't let local files access web URLs
+        https://bugs.webkit.org/show_bug.cgi?id=28480
+
+        * Api/qwebsettings.cpp:
+        (QWebSettings::QWebSettings):
+
+2009-08-25  Antonio Gomes   <antonio.gomes@openbossa.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Bug 28708 - Make possible to better use ResourceError in FrameLoaderClientQt class.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::requestedUrl):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::FrameLoaderClientQt):
+        (WebCore::FrameLoaderClientQt::dispatchDidFinishLoad):
+        (WebCore::FrameLoaderClientQt::postProgressFinishedNotification):
+        (WebCore::FrameLoaderClientQt::dispatchDidFailProvisionalLoad):
+        (WebCore::FrameLoaderClientQt::dispatchDidFailLoad):
+        * WebCoreSupport/FrameLoaderClientQt.h:
+
+2009-08-22  Adam Barth  <abarth@webkit.org>
+
+        Revert 47684.  We're going to do this later once clients have had a
+        chance to opt into the setting they like.
+
+        * Api/qwebsettings.cpp:
+        (QWebSettings::QWebSettings):
+
+2009-08-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Don't let local files access web URLs
+        https://bugs.webkit.org/show_bug.cgi?id=28480
+
+        * Api/qwebsettings.cpp:
+        (QWebSettings::QWebSettings):
+
+2009-08-19  Aaron Boodman  <aa@chromium.org>
+
+        Speculative build break fix for qt.
+
+        * Api/qwebsecurityorigin.cpp:
+        (QWebSecurityOrigin::whiteListAccessFromOrigin):
+        * Api/qwebsecurityorigin.h:
+
+2009-08-19  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24853: Provide a way for WebKit clients to
+        specify a more granular policy for cross-origin XHR access.
+
+        * Api/qwebsecurityorigin.cpp: Add API to manipulate origin access whitelists.
+        (QWebSecurityOrigin::whiteListAccessFromOrigin): Ditto.
+        (QWebSecurityOrigin::resetOriginAccessWhiteLists): Ditto.
+        * Api/qwebsecurityorigin.h: Ditto.
+
+2009-08-18  Markus Goetz <Markus.Goetz@nokia.com>
+
+        Reviwed by Ariya Hidayat.
+
+        [Qt] For prefecthDNS, the pre-fetching has to be enabled in the
+        WebSettings.
+
+        * Api/qwebsettings.cpp:
+        (QWebSettings::QWebSettings):
+        * Api/qwebsettings.h:
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Try to fix Qt build again.
+
+        * WebCoreSupport/EditorClientQt.cpp: Move "using namespace".
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Try to fix Qt build.
+
+        * WebCoreSupport/EditorClientQt.cpp:
+        (WebCore::EditorClientQt::shouldShowDeleteInterface):
+        Use getAttribute(classAttr) instead of className() function.
+
+2009-08-14  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        RVCT elftran fails to resolve QPainter::staticMetaObject coming with 
+        QWebView::RenderHints property.
+
+        This is a temporary fix and will be revereted when the right symbols
+        exported from Qt lib in S60.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28181
+
+        * Api/qwebview.h:
+
+2009-08-14  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Public API to configure the storage path for HTML5 localStorage
+        https://bugs.webkit.org/show_bug.cgi?id=28036
+
+        Disables LocalStorage for QtWebKit by default by setting
+        QWebSettings::LocalStorageEnabled to false.
+
+        Sets up a default for the LocalStorage path so that clients would only
+        need to enable the LocalStorageEnabled setting to turn on LocalStoragre
+        support.
+
+        Turn on LocalStorage support for QtLauncher and the relevant test
+        since LocalStorage is now disabled by default for QtWebkit.
+
+        * Api/qwebpage.cpp:
+        (defaultCachePath):
+        (initializeApplicationCachePathIfNecessary):
+        (QWebPagePrivate::QWebPagePrivate):
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+        (QWebSettings::QWebSettings):
+        (QWebSettings::setLocalStoragePath):
+        (QWebSettings::localStoragePath):
+        * Api/qwebsettings.h:
+        * QtLauncher/main.cpp:
+        (main):
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::multiplePageGroupsAndLocalStorage):
+
+2009-08-14  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Allow applications to register their own local URL scheme.
+        https://bugs.webkit.org/show_bug.cgi?id=28240
+
+        * Api/qwebsecurityorigin.cpp:
+        (QWebSecurityOrigin::addLocalScheme):
+        (QWebSecurityOrigin::removeLocalScheme):
+        (QWebSecurityOrigin::localSchemes):
+        * Api/qwebsecurityorigin.h:
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::localURLSchemes):
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Try and fix the Qt build.
+
+        * Api/qwebelement.cpp:
+
+2009-08-13  Kavindra Devi Palaraja  <kavindra.palaraja@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Doc - Some cleanup on the documentation of QWebElement
+
+        * Api/qwebelement.cpp:
+
+2009-08-13  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Symbian target components (library and executable files)
+        require Unique Identifiers (i.e., UID3).
+        These identifiers are defined in the respective project
+        files, conditionally for "symbian" platform.
+
+        * QtLauncher/QtLauncher.pro:
+        * tests/qwebelement/qwebelement.pro:
+        * tests/qwebframe/qwebframe.pro:
+        * tests/qwebhistory/qwebhistory.pro:
+        * tests/qwebhistoryinterface/qwebhistoryinterface.pro:
+        * tests/qwebpage/qwebpage.pro:
+        * tests/qwebview/qwebview.pro:
+
+2009-08-12  George Wright  <george.wright@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Initialise zoom levels independent of whether a URL is valid or not to
+        fix https://bugs.webkit.org/show_bug.cgi?id=28162
+
+        * QtLauncher/main.cpp:
+        (MainWindow::MainWindow):
+
+2009-08-12  Joerg Bornemann  <joerg.bornemann@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        QtWebKit compile fix for Windows CE
+
+        There's no getenv on Windows CE, use qgetenv instead.
+
+        * Api/qwebpage.cpp:
+        (qt_drt_overwritePluginDirectories):
+
+2009-08-10  Kavindra Palaraja  <kavindra.palaraja@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Various fixes and improvements to the QWebPluginInfo, QWebPluginDatabase and QWebSettings documentation.
+
+        * Api/qwebplugindatabase.cpp:
+        * Api/qwebsettings.cpp:
+
+2009-08-08  Volker Hilsheimer  <volker.hilsheimer@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Doc: there is no group of explicitly shared classes, only one class uses this.
+
+        Explain the implications in the QWebHistoryItem documentation, and get rid
+        of the "group".
+
+        * Api/qwebhistory.cpp:
+
+2009-08-05  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix build error caused by http://trac.webkit.org/changeset/46763
+
+        * Api/qwebpluginfactory.h: Export macro added.
+
+2009-08-04  Antonio Gomes   <antonio.gomes@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] QWebFrame::requestedUrl method can mis-behave in case of unhandled sslErrors.
+        https://bugs.webkit.org/show_bug.cgi?id=27804
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::requestedUrl):
+        * tests/qwebframe/tst_qwebframe.cpp:
+
+2009-08-04  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Rename QWebPlugin to QWebPluginInfo, as discussed on IRC.
+
+        * Api/qwebplugindatabase.cpp:
+        (QWebPluginInfoPrivate::QWebPluginInfoPrivate):
+        (QWebPluginInfo::QWebPluginInfo):
+        (QWebPluginInfo::~QWebPluginInfo):
+        (QWebPluginInfo::name):
+        (QWebPluginInfo::description):
+        (QWebPluginInfo::mimeTypes):
+        (QWebPluginInfo::supportsMimeType):
+        (QWebPluginInfo::path):
+        (QWebPluginInfo::isNull):
+        (QWebPluginInfo::setEnabled):
+        (QWebPluginInfo::isEnabled):
+        (QWebPluginInfo::operator==):
+        (QWebPluginInfo::operator!=):
+        (QWebPluginInfo::operator=):
+        (QWebPluginDatabase::plugins):
+        (QWebPluginDatabase::pluginForMimeType):
+        (QWebPluginDatabase::setPreferredPluginForMimeType):
+        * Api/qwebplugindatabase.h:
+        * Api/qwebplugindatabase_p.h:
+        * tests/qwebplugindatabase/tst_qwebplugindatabase.cpp:
+        (tst_QWebPluginDatabase::installedPlugins):
+        (tst_QWebPluginDatabase::searchPaths):
+        (tst_QWebPluginDatabase::null_data):
+        (tst_QWebPluginDatabase::null):
+        (tst_QWebPluginDatabase::pluginForMimeType):
+        (tst_QWebPluginDatabase::enabled):
+        (tst_QWebPluginDatabase::operatorequal_data):
+        (tst_QWebPluginDatabase::operatorequal):
+        (tst_QWebPluginDatabase::preferredPlugin):
+
+2009-08-04  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Adam Treat.
+
+        Replace QWebPlugin::MimeType with a typedef to
+        QWebPluginFactory::MimeType.
+
+        * Api/qwebplugindatabase.cpp:
+        * Api/qwebplugindatabase.h:
+        * Api/qwebpluginfactory.cpp:
+        (QWebPluginFactory::MimeType::operator==):
+        * Api/qwebpluginfactory.h:
+
+2009-08-04  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add QWebPluginDatabase API to the Qt API.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        * Api/headers.pri:
+        * Api/qwebplugindatabase.cpp: Added.
+        (QWebPluginPrivate::QWebPluginPrivate):
+        (QWebPluginDatabasePrivate::QWebPluginDatabasePrivate):
+        (QWebPlugin::MimeType::operator==):
+        (QWebPlugin::QWebPlugin):
+        (QWebPlugin::~QWebPlugin):
+        (QWebPlugin::name):
+        (QWebPlugin::description):
+        (QWebPlugin::mimeTypes):
+        (QWebPlugin::supportsMimeType):
+        (QWebPlugin::path):
+        (QWebPlugin::isNull):
+        (QWebPlugin::setEnabled):
+        (QWebPlugin::isEnabled):
+        (QWebPlugin::operator==):
+        (QWebPlugin::operator!=):
+        (QWebPlugin::operator=):
+        (QWebPluginDatabase::QWebPluginDatabase):
+        (QWebPluginDatabase::~QWebPluginDatabase):
+        (QWebPluginDatabase::plugins):
+        (QWebPluginDatabase::defaultSearchPaths):
+        (QWebPluginDatabase::searchPaths):
+        (QWebPluginDatabase::setSearchPaths):
+        (QWebPluginDatabase::addSearchPath):
+        (QWebPluginDatabase::refresh):
+        (QWebPluginDatabase::pluginForMimeType):
+        (QWebPluginDatabase::setPreferredPluginForMimeType):
+        * Api/qwebplugindatabase.h: Added.
+        * Api/qwebplugindatabase_p.h: Added.
+        * Api/qwebsettings.cpp:
+        (QWebSettings::pluginDatabase):
+        * Api/qwebsettings.h:
+        * tests/qwebplugindatabase/qwebplugindatabase.pro: Added.
+        * tests/qwebplugindatabase/tst_qwebplugindatabase.cpp: Added.
+        (tst_QWebPluginDatabase::installedPlugins):
+        (tst_QWebPluginDatabase::searchPaths):
+        (tst_QWebPluginDatabase::null_data):
+        (tst_QWebPluginDatabase::null):
+        (tst_QWebPluginDatabase::pluginForMimeType):
+        (tst_QWebPluginDatabase::enabled):
+        (tst_QWebPluginDatabase::operatorequal_data):
+        (tst_QWebPluginDatabase::operatorequal):
+        (tst_QWebPluginDatabase::preferredPlugin):
+        * tests/tests.pro:
+
+2009-08-03  Balazs Kelemen  <kelemen.balazs.3@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        Do memory cleanup when running robotized QtLauncher in debug as well.
+
+        * QtLauncher/main.cpp:
+        (launcherMain):
+        (main):
+
+2009-07-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Initialize HTML5 Application Cache for QtWebKit to a sensible default
+        https://bugs.webkit.org/show_bug.cgi?id=27866
+
+        * Api/qwebpage.cpp:
+        (initializeApplicationCachePathIfNecessary):
+        (QWebPagePrivate::QWebPagePrivate):
+
+2009-07-31  Jakob Petsovits  <jakob.petsovits@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Build QtWebKit without benchmark tests for Qt < 4.5.
+        https://bugs.webkit.org/show_bug.cgi?id=27886
+
+        The QBENCHMARK macro is only available from 4.5 on,
+        so builds for Qt < 4.5 shouldn't try to build those.
+
+        * tests/tests.pro:
+
+2009-07-31  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Adam Treat.
+
+        Fix warning by migrating use of QString.sprintf(...) to
+        QString.arg().arg()...
+
+        * WebCoreSupport/EditorClientQt.cpp:
+        (dumpRange):
+
+2009-07-31  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Expose the Offline Web Application Cache in the Qt API.
+
+        * Api/qwebsettings.cpp:
+        (QWebSettings::QWebSettings):
+        (QWebSettings::setOfflineWebApplicationCachePath):
+        (QWebSettings::offlineWebApplicationCachePath):
+        (QWebSettings::setOfflineWebApplicationCacheQuota):
+        (QWebSettings::offlineWebApplicationCacheQuota):
+        * Api/qwebsettings.h:
+
+2009-07-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Adam Treat.
+
+        Add missing Q_OBJECT to class inheriting from QObject.
+
+        * tests/qwebframe/tst_qwebframe.cpp:
+
+2009-07-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Adam Treat.
+
+        Fix indentation.
+
+        * tests/qwebframe/tst_qwebframe.cpp:
+
+2009-07-30  Volker Hilsheimer <volker.hilsheimer@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix documentation links to examples.
+
+        * Api/qwebview.cpp:
+
+2009-07-30  Balazs Kelemen  <kelemen.balazs.3@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        Allocate MainWindow on heap in robotized QtLauncher as well.
+
+        * QtLauncher/main.cpp:
+        (main):
+
+2009-07-29  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Added foundation work to allow a testing infrastructure for the Web
+        Inspector.
+
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (WebCore::InspectorClientQt::inspectorWindowObjectCleared):
+        * WebCoreSupport/InspectorClientQt.h:
+
+2009-07-29  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] In debug mode, this fix frees cached resources
+        and other unreferenced objects (by calling the
+        garbage collector) to remove the LEAK messages.
+        https://bugs.webkit.org/show_bug.cgi?id=27767
+
+        * Api/qwebframe.cpp:
+        (qt_drt_cache_clear):
+        * QtLauncher/main.cpp:
+        (main):
+
+2009-07-28  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Fix the Qt build by adapting to the changes of ScriptObject.
+
+        * Api/qwebelement.cpp:
+        (setupScriptObject):
+
+2009-07-28  Robert Hogan  <robert@roberthogan.net>
+
+        Reviewed by Simon Hausmann.
+
+        Add WebKit version API to Qt.
+
+        Get the current version of WebKit from WebKit/mac/Configurations/Version.xcconfig
+        at compile time and make it available to Qt applications through
+        qWebKitVersion().
+
+        Also amend the User Agent string to place the Safari clause outside
+        the final bracket and to the end of the UA string.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27158
+
+        Minor build tweak by Simon Hausmann (adding export macros to new functions).
+
+        * Api/headers.pri:
+        * Api/qwebkitversion.cpp: Added.
+        (webKitVersion):
+        (webKitMajorVersion):
+        (webKitMinorVersion):
+        * Api/qwebkitversion.h: Added.
+        * Api/qwebpage.cpp:
+        (QWebPage::userAgentForUrl):
+        * tests/qwebview/tst_qwebview.cpp:
+        (tst_QWebView::getWebKitVersion):
+
 2009-07-28  Simon Hausmann  <simon.hausmann@nokia.com>
 
         Rubber-stamped by Ariya Hidayat.
diff --git a/src/3rdparty/webkit/WebKit/qt/QGVLauncher/QGVLauncher.pro b/src/3rdparty/webkit/WebKit/qt/QGVLauncher/QGVLauncher.pro
new file mode 100644
index 0000000..b883b52
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/QGVLauncher/QGVLauncher.pro
@@ -0,0 +1,13 @@
+TEMPLATE = app
+SOURCES += main.cpp
+CONFIG -= app_bundle
+CONFIG += uitools
+DESTDIR = ../../../bin
+
+include(../../../WebKit.pri)
+
+QT += network
+macx:QT+=xml
+QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+
+symbian:TARGET.UID3 = 0x200267D0
diff --git a/src/3rdparty/webkit/WebKit/qt/QGVLauncher/main.cpp b/src/3rdparty/webkit/WebKit/qt/QGVLauncher/main.cpp
new file mode 100644
index 0000000..9d4742a
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/QGVLauncher/main.cpp
@@ -0,0 +1,317 @@
+/*
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2006 George Staikos <staikos@kde.org>
+ * Copyright (C) 2006 Dirk Mueller <mueller@kde.org>
+ * Copyright (C) 2006 Zack Rusin <zack@kde.org>
+ * Copyright (C) 2006 Simon Hausmann <hausmann@kde.org>
+ * Copyright (C) 2009 Kenneth Christiansen <kenneth@webkit.org>
+ * Copyright (C) 2009 Antonio Gomes <antonio.gomes@openbossa.org>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <QDebug>
+#include <QFile>
+#include <QGraphicsScene>
+#include <QGraphicsView>
+#include <QGraphicsWidget>
+#include <QNetworkRequest>
+#include <QTextStream>
+#include <QVector>
+#include <QtGui>
+#include <QtNetwork/QNetworkProxy>
+#include <cstdio>
+#include <qwebelement.h>
+#include <qwebframe.h>
+#include <qwebgraphicsitem.h>
+#include <qwebpage.h>
+#include <qwebsettings.h>
+#include <qwebview.h>
+
+class WebPage : public QWebPage {
+    Q_OBJECT
+
+public:
+    WebPage(QWidget* parent = 0) : QWebPage(parent)
+    {
+        applyProxy();
+    }
+    virtual QWebPage* createWindow(QWebPage::WebWindowType);
+
+private:
+    void applyProxy();
+};
+
+class MainView : public QGraphicsView {
+    Q_OBJECT
+
+public:
+    MainView(QWidget* parent) : QGraphicsView(parent), m_mainWidget(0)
+    {
+        setHorizontalScrollBarPolicy(Qt::ScrollBarAlwaysOff);
+        setVerticalScrollBarPolicy(Qt::ScrollBarAlwaysOff);
+    }
+
+    void setMainWidget(QGraphicsWidget* widget)
+    {
+        QRectF rect(QRect(QPoint(0, 0), size()));
+        widget->setGeometry(rect);
+        m_mainWidget = widget;
+    }
+
+    void resizeEvent(QResizeEvent* event)
+    {
+        QGraphicsView::resizeEvent(event);
+        if (!m_mainWidget)
+            return;
+        QRectF rect(QPoint(0, 0), event->size());
+        m_mainWidget->setGeometry(rect);
+    }
+
+public slots:
+    void flip()
+    {
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+        QSizeF center = m_mainWidget->boundingRect().size() / 2;
+        QPointF centerPoint = QPointF(center.width(), center.height());
+        m_mainWidget->setTransformOriginPoint(centerPoint);
+
+        m_mainWidget->setRotation(m_mainWidget->rotation() ? 0 : 180);
+#endif
+    }
+
+private:
+    QGraphicsWidget* m_mainWidget;
+};
+
+class SharedScene : public QSharedData {
+public:
+    SharedScene()
+    {
+        m_scene = new QGraphicsScene;
+
+        m_item = new QWebGraphicsItem;
+        m_item->setPage(new WebPage());
+
+        m_scene->addItem(m_item);
+        m_scene->setActiveWindow(m_item);
+    }
+
+    ~SharedScene()
+    {
+        delete m_item;
+        delete m_scene;
+    }
+
+    QGraphicsScene* scene() const { return m_scene; }
+    QWebGraphicsItem* webItem() const { return m_item; }
+
+private:
+    QGraphicsScene* m_scene;
+    QWebGraphicsItem* m_item;
+};
+
+
+class MainWindow : public QMainWindow {
+    Q_OBJECT
+
+public:
+    MainWindow(QExplicitlySharedDataPointer<SharedScene> other)
+        : QMainWindow(), view(new MainView(this)), scene(other)
+    {
+        init();
+    }
+
+    MainWindow()
+        : QMainWindow(), view(new MainView(this)), scene(new SharedScene())
+    {
+        init();
+    }
+
+    void init()
+    {
+        setAttribute(Qt::WA_DeleteOnClose);
+
+        view->setScene(scene->scene());
+        view->setFrameShape(QFrame::NoFrame);
+        view->setSizePolicy(QSizePolicy::Expanding, QSizePolicy::Expanding);
+        setCentralWidget(view);
+
+        view->setMainWidget(scene->webItem());
+
+        connect(scene->webItem(), SIGNAL(loadFinished()), this, SLOT(loadFinished()));
+        connect(scene->webItem(), SIGNAL(titleChanged(const QString&)), this, SLOT(setWindowTitle(const QString&)));
+        connect(scene->webItem()->page(), SIGNAL(windowCloseRequested()), this, SLOT(close()));
+
+        resize(640, 480);
+        buildUI();
+    }
+
+    void load(const QString& url)
+    {
+        QUrl deducedUrl = guessUrlFromString(url);
+        if (!deducedUrl.isValid())
+            deducedUrl = QUrl("http://" + url + "/");
+
+        urlEdit->setText(deducedUrl.toEncoded());
+        scene->webItem()->load(deducedUrl);
+        scene->webItem()->setFocus(Qt::OtherFocusReason);
+    }
+
+    QUrl guessUrlFromString(const QString& string)
+    {
+        QString input(string);
+        QFileInfo fi(input);
+        if (fi.exists() && fi.isRelative())
+            input = fi.absoluteFilePath();
+
+        return QWebView::guessUrlFromString(input);
+    }
+
+    QWebPage* page() const
+    {
+        return scene->webItem()->page();
+    }
+
+protected slots:
+    void changeLocation()
+    {
+        load(urlEdit->text());
+    }
+
+    void loadFinished()
+    {
+        QUrl url = scene->webItem()->url();
+        urlEdit->setText(url.toString());
+
+        QUrl::FormattingOptions opts;
+        opts |= QUrl::RemoveScheme;
+        opts |= QUrl::RemoveUserInfo;
+        opts |= QUrl::StripTrailingSlash;
+        QString s = url.toString(opts);
+        s = s.mid(2);
+        if (s.isEmpty())
+            return;
+        //FIXME: something missing here
+    }
+
+public slots:
+    void newWindow(const QString &url = QString())
+    {
+        MainWindow* mw = new MainWindow();
+        mw->load(url);
+        mw->show();
+    }
+
+    void clone()
+    {
+        MainWindow* mw = new MainWindow(scene);
+        mw->show();
+    }
+
+    void flip()
+    {
+        view->flip();
+    }
+
+private:
+    void buildUI()
+    {
+        QWebPage* page = scene->webItem()->page();
+        urlEdit = new QLineEdit(this);
+        urlEdit->setSizePolicy(QSizePolicy::Expanding, urlEdit->sizePolicy().verticalPolicy());
+        connect(urlEdit, SIGNAL(returnPressed()), SLOT(changeLocation()));
+
+        QToolBar* bar = addToolBar("Navigation");
+        bar->addAction(page->action(QWebPage::Back));
+        bar->addAction(page->action(QWebPage::Forward));
+        bar->addAction(page->action(QWebPage::Reload));
+        bar->addAction(page->action(QWebPage::Stop));
+        bar->addWidget(urlEdit);
+
+        QMenu* fileMenu = menuBar()->addMenu("&File");
+        fileMenu->addAction("New Window", this, SLOT(newWindow()));
+        fileMenu->addAction("Clone view", this, SLOT(clone()));
+        fileMenu->addAction("Close", this, SLOT(close()));
+
+        QMenu* viewMenu = menuBar()->addMenu("&View");
+        viewMenu->addAction(page->action(QWebPage::Stop));
+        viewMenu->addAction(page->action(QWebPage::Reload));
+
+        QMenu* fxMenu = menuBar()->addMenu("&Effects");
+        fxMenu->addAction("Flip", this, SLOT(flip()));
+    }
+
+private:
+    MainView* view;
+    QExplicitlySharedDataPointer<SharedScene> scene;
+
+    QLineEdit* urlEdit;
+};
+
+QWebPage* WebPage::createWindow(QWebPage::WebWindowType)
+{
+    MainWindow* mw = new MainWindow;
+    mw->show();
+    return mw->page();
+}
+
+void WebPage::applyProxy()
+{
+    QUrl proxyUrl = QWebView::guessUrlFromString(qgetenv("http_proxy"));
+
+    if (proxyUrl.isValid() && !proxyUrl.host().isEmpty()) {
+        int proxyPort = (proxyUrl.port() > 0) ? proxyUrl.port() : 8080;
+        networkAccessManager()->setProxy(QNetworkProxy(QNetworkProxy::HttpProxy, proxyUrl.host(), proxyPort));
+    }
+}
+
+int main(int argc, char** argv)
+{
+    QApplication app(argc, argv);
+    QString url = QString("file://%1/%2").arg(QDir::homePath()).arg(QLatin1String("index.html"));
+
+    app.setApplicationName("GQVLauncher");
+
+    QWebSettings::setObjectCacheCapacities((16 * 1024 * 1024) / 8, (16 * 1024 * 1024) / 8, 16 * 1024 * 1024);
+    QWebSettings::setMaximumPagesInCache(4);
+    QWebSettings::globalSettings()->setAttribute(QWebSettings::PluginsEnabled, true);
+    QWebSettings::globalSettings()->setAttribute(QWebSettings::DeveloperExtrasEnabled, true);
+    QWebSettings::globalSettings()->setAttribute(QWebSettings::LocalStorageEnabled, true);
+
+    const QStringList args = app.arguments();
+    if (args.count() > 1)
+        url = args.at(1);
+
+    MainWindow* window = new MainWindow;
+    window->load(url);
+
+    for (int i = 2; i < args.count(); i++)
+        window->newWindow(args.at(i));
+
+    window->show();
+    return app.exec();
+}
+
+#include "main.moc"
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
index d659833..9a63e85 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
@@ -45,6 +45,7 @@
 #include "qwebframe_p.h"
 #include "qwebsecurityorigin.h"
 #include "qwebsecurityorigin_p.h"
+#include "qwebview.h"
 
 #include <qtooltip.h>
 #include <qtextdocument.h>
@@ -307,8 +308,8 @@ void ChromeClientQt::repaint(const IntRect& windowRect, bool contentChanged, boo
 {
     // No double buffer, so only update the QWidget if content changed.
     if (contentChanged) {
-        QWidget* view = m_webPage->view();
-        if (view) {
+        // Only do implicit paints for QWebView's
+        if (QWebView* view = qobject_cast<QWebView*>(m_webPage->view())) {
             QRect rect(windowRect);
             rect = rect.intersected(QRect(QPoint(0, 0), m_webPage->viewportSize()));
             if (!rect.isEmpty())
@@ -323,8 +324,8 @@ void ChromeClientQt::repaint(const IntRect& windowRect, bool contentChanged, boo
 
 void ChromeClientQt::scroll(const IntSize& delta, const IntRect& scrollViewRect, const IntRect&)
 {
-    QWidget* view = m_webPage->view();
-    if (view)
+    // Only do implicit paints for QWebView's
+    if (QWebView* view = qobject_cast<QWebView*>(m_webPage->view()))
         view->scroll(delta.width(), delta.height(), scrollViewRect);
     emit m_webPage->scrollRequested(delta.width(), delta.height(), scrollViewRect);
 }
@@ -419,7 +420,7 @@ void ChromeClientQt::runOpenPanel(Frame* frame, PassRefPtr<FileChooser> prpFileC
         option.parentFrame = QWebFramePrivate::kit(frame);
 
         if (!fileChooser->filenames().isEmpty())
-            for (int i = 0; i < fileChooser->filenames().size(); ++i)
+            for (unsigned i = 0; i < fileChooser->filenames().size(); ++i)
                 option.suggestedFileNames += fileChooser->filenames()[i];
 
         QWebPage::ChooseMultipleFilesExtensionReturn output;
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ChromeClientQt.h b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ChromeClientQt.h
index 96c7fab..7ea6a70 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ChromeClientQt.h
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ChromeClientQt.h
@@ -108,6 +108,7 @@ namespace WebCore {
         virtual PlatformWidget platformWindow() const;
         virtual void contentsSizeChanged(Frame*, const IntSize&) const;
 
+        virtual void scrollbarsModeDidChange() const { }
         virtual void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags);
 
         virtual void setToolTip(const String&, TextDirection);
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/EditorClientQt.cpp b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
index 6c31bd8..40833f2 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
@@ -41,6 +41,7 @@
 #include "FocusController.h"
 #include "Frame.h"
 #include "HTMLElement.h"
+#include "HTMLNames.h"
 #include "KeyboardCodes.h"
 #include "KeyboardEvent.h"
 #include "NotImplemented.h"
@@ -84,17 +85,19 @@ static QString dumpRange(WebCore::Range *range)
 {
     if (!range)
         return QLatin1String("(null)");
-    QString str;
     WebCore::ExceptionCode code;
-    str.sprintf("range from %ld of %ls to %ld of %ls",
-                range->startOffset(code), dumpPath(range->startContainer(code)).unicode(),
-                range->endOffset(code), dumpPath(range->endContainer(code)).unicode());
+
+    QString str = QString("range from %1 of %2 to %3 of %4")
+        .arg(range->startOffset(code)).arg(dumpPath(range->startContainer(code)))
+        .arg(range->endOffset(code)).arg(dumpPath(range->endContainer(code)));
+
     return str;
 }
 
 
 namespace WebCore {
 
+using namespace HTMLNames;
 
 bool EditorClientQt::shouldDeleteRange(Range* range)
 {
@@ -107,7 +110,7 @@ bool EditorClientQt::shouldDeleteRange(Range* range)
 bool EditorClientQt::shouldShowDeleteInterface(HTMLElement* element)
 {
     if (QWebPagePrivate::drtRun)
-        return element->className() == "needsDeletionUI";
+        return element->getAttribute(classAttr) == "needsDeletionUI";
     return false;
 }
 
@@ -592,10 +595,10 @@ bool EditorClientQt::isEditing() const
 void EditorClientQt::setInputMethodState(bool active)
 {
     QWidget *view = m_page->view();
-    if (view) {
+    if (view)
         view->setAttribute(Qt::WA_InputMethodEnabled, active);
-        emit m_page->microFocusChanged();
-    }
+
+    emit m_page->microFocusChanged();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
index 43ef08e..0c636f6 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
@@ -144,7 +144,7 @@ FrameLoaderClientQt::FrameLoaderClientQt()
     , m_pluginView(0)
     , m_hasSentResponseToPlugin(false)
     , m_firstData(false)
-    , m_loadSucceeded(false)
+    , m_loadError (ResourceError())
 {
 }
 
@@ -376,7 +376,7 @@ void FrameLoaderClientQt::dispatchDidFinishLoad()
     if (dumpFrameLoaderCallbacks)
         printf("%s - didFinishLoadForFrame\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
 
-    m_loadSucceeded = true;
+    m_loadError = ResourceError(); // clears the previous error
 
     if (!m_webFrame)
         return;
@@ -461,7 +461,7 @@ void FrameLoaderClientQt::postProgressFinishedNotification()
     }
 
     if (m_webFrame && m_frame->page())
-        emit loadFinished(m_loadSucceeded);
+        emit loadFinished(m_loadError.isNull());
 }
 
 void FrameLoaderClientQt::setMainFrameDocumentReady(bool b)
@@ -637,6 +637,16 @@ bool FrameLoaderClientQt::shouldGoToHistoryItem(WebCore::HistoryItem *item) cons
     return true;
 }
 
+void FrameLoaderClientQt::didDisplayInsecureContent()
+{
+    notImplemented();
+}
+
+void FrameLoaderClientQt::didRunInsecureContent(WebCore::SecurityOrigin*)
+{
+    notImplemented();
+}
+
 void FrameLoaderClientQt::saveViewStateToItem(WebCore::HistoryItem* item)
 {
     QWebHistoryItem historyItem(new QWebHistoryItemPrivate(item));
@@ -850,20 +860,20 @@ void FrameLoaderClientQt::dispatchDidLoadResourceByXMLHttpRequest(unsigned long,
     notImplemented();
 }
 
-void FrameLoaderClientQt::dispatchDidFailProvisionalLoad(const WebCore::ResourceError&)
+void FrameLoaderClientQt::dispatchDidFailProvisionalLoad(const WebCore::ResourceError& error)
 {
     if (dumpFrameLoaderCallbacks)
         printf("%s - didFailProvisionalLoadWithError\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
 
-    m_loadSucceeded = false;
+    m_loadError = error;
 }
 
-void FrameLoaderClientQt::dispatchDidFailLoad(const WebCore::ResourceError&)
+void FrameLoaderClientQt::dispatchDidFailLoad(const WebCore::ResourceError& error)
 {
     if (dumpFrameLoaderCallbacks)
         printf("%s - didFailLoadWithError\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
 
-    m_loadSucceeded = false;
+    m_loadError = error;
 }
 
 WebCore::Frame* FrameLoaderClientQt::dispatchCreatePage()
@@ -946,7 +956,6 @@ void FrameLoaderClientQt::startDownload(const WebCore::ResourceRequest& request)
     if (!m_webFrame)
         return;
 
-    QWebPage *page = m_webFrame->page();
     emit m_webFrame->page()->downloadRequested(request.toNetworkRequest());
 #endif
 }
@@ -976,9 +985,6 @@ PassRefPtr<Frame> FrameLoaderClientQt::createFrame(const KURL& url, const String
 
     // ### set override encoding if we have one
 
-    FrameLoadType loadType = m_frame->loader()->loadType();
-    FrameLoadType childLoadType = FrameLoadTypeRedirectWithLockedBackForwardList;
-
     frameData.frame->loader()->loadURLIntoChildFrame(frameData.url, frameData.referrer, frameData.frame.get());
 
     // The frame's onload handler may have removed it from the document.
@@ -1087,12 +1093,12 @@ PassRefPtr<Widget> FrameLoaderClientQt::createPlugin(const IntSize& pluginSize,
     QStringList values;
     QString classid(element->getAttribute("classid"));
 
-    for (int i = 0; i < paramNames.size(); ++i) {
+    for (unsigned i = 0; i < paramNames.size(); ++i) {
         params.append(paramNames[i]);
         if (paramNames[i] == "classid")
             classid = paramValues[i];
     }
-    for (int i = 0; i < paramValues.size(); ++i)
+    for (unsigned i = 0; i < paramValues.size(); ++i)
         values.append(paramValues[i]);
 
     QString urlStr(url.string());
@@ -1110,7 +1116,7 @@ PassRefPtr<Widget> FrameLoaderClientQt::createPlugin(const IntSize& pluginSize,
             if (!styleSheet.isEmpty())
                 styleSheet += QLatin1Char(';');
 
-            for (int i = 0; i < numqStyleSheetProperties; ++i) {
+            for (unsigned i = 0; i < numqStyleSheetProperties; ++i) {
                 CSSPropertyID property = qstyleSheetProperties[i];
 
                 styleSheet += QString::fromLatin1(::getPropertyName(property));
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
index 754d8bc..8a7e428 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
@@ -148,6 +148,9 @@ namespace WebCore {
         virtual void updateGlobalHistoryRedirectLinks();
         virtual bool shouldGoToHistoryItem(HistoryItem*) const;
 
+        virtual void didDisplayInsecureContent();
+        virtual void didRunInsecureContent(SecurityOrigin*);
+
         virtual ResourceError cancelledError(const ResourceRequest&);
         virtual ResourceError blockedError(const ResourceRequest&);
         virtual ResourceError cannotShowURLError(const ResourceRequest&);
@@ -211,7 +214,7 @@ namespace WebCore {
         WebCore::PluginView* m_pluginView;
         bool m_hasSentResponseToPlugin;
 
-        bool m_loadSucceeded;
+        ResourceError m_loadError;
     };
 
 }
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
index fe4d43a..ce08d42 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
@@ -31,6 +31,8 @@
 #include "config.h"
 #include "InspectorClientQt.h"
 
+#include "qwebinspector.h"
+#include "qwebinspector_p.h"
 #include "qwebpage.h"
 #include "qwebpage_p.h"
 #include "qwebview.h"
@@ -44,46 +46,24 @@
 
 namespace WebCore {
 
-class InspectorClientWebPage : public QWebPage
-{
+class InspectorClientWebPage : public QWebPage {
     Q_OBJECT
     friend class InspectorClientQt;
 public:
-    QWebPage* createWindow(QWebPage::WebWindowType)
-    {
-        QWidget *w = new QWebView(0);
-        QWebPage *page = new QWebPage(w);
-        page->setView(w);
-        connect(page, SIGNAL(destroyed()), w, SLOT(deleteLater()));
-        return page;
-    }
-
-Q_SIGNALS:
-    void attachRequested();
-    void detachRequested();
-};
-
-
-class InspectorClientView : public QWebView {
-public:
-    InspectorClientView(InspectorController* controller)
-        : QWebView(0)
-        , m_controller(controller)
+    InspectorClientWebPage(QObject* parent = 0)
+    : QWebPage(parent)
     {
-        setPage(new InspectorClientWebPage);
-        connect(page(), SIGNAL(destroyed()), SLOT(deleteLater()));
+        settings()->setAttribute(QWebSettings::DeveloperExtrasEnabled, false);
     }
 
-protected:
-
-    void closeEvent(QCloseEvent* ev)
+    QWebPage* createWindow(QWebPage::WebWindowType)
     {
-        QWidget::closeEvent(ev);
-        m_controller->setWindowVisible(false);
+        QWebView* view = new QWebView;
+        QWebPage* page = new QWebPage;
+        view->setPage(page);
+        view->setAttribute(Qt::WA_DeleteOnClose);
+        return page;
     }
-
-private:
-    InspectorController* m_controller;
 };
 
 
@@ -98,14 +78,19 @@ void InspectorClientQt::inspectorDestroyed()
 
 Page* InspectorClientQt::createPage()
 {
-    if (m_webPage)
-        return m_webPage->d->page;
+    if (m_inspectorView)
+        return m_inspectorView->page()->d->page;
+
+    QWebView* inspectorView = new QWebView;
+    InspectorClientWebPage* inspectorPage = new InspectorClientWebPage(inspectorView);
+    inspectorView->setPage(inspectorPage);
+    m_inspectorView.set(inspectorView);
+
+    inspectorPage->mainFrame()->load(QString::fromLatin1("qrc:/webkit/inspector/inspector.html"));
+    m_inspectedWebPage->d->inspectorFrontend = inspectorView;
+    m_inspectedWebPage->d->getOrCreateInspector()->d->setFrontend(inspectorView);
 
-    InspectorClientView* view = new InspectorClientView(m_inspectedWebPage->d->page->inspectorController());
-    m_webPage.set(qobject_cast<InspectorClientWebPage*>(view->page()));
-    m_webPage->mainFrame()->load(QString::fromLatin1("qrc:/webkit/inspector/inspector.html"));
-    m_webPage->view()->setMinimumSize(400,300);
-    return m_webPage->d->page;
+    return m_inspectorView->page()->d->page;
 }
 
 String InspectorClientQt::localizedStringsURL()
@@ -122,44 +107,29 @@ String InspectorClientQt::hiddenPanels()
 
 void InspectorClientQt::showWindow()
 {
-    if (!m_webPage)
-        return;
-
     updateWindowTitle();
-    m_webPage->view()->show();
-    m_inspectedWebPage->d->page->inspectorController()->setWindowVisible(true);
-}
-
-void InspectorClientQt::closeWindow()
-{
-    if (!m_webPage)
-        return;
 
-    m_webPage->view()->hide();
-    m_inspectedWebPage->d->page->inspectorController()->setWindowVisible(false);
+    m_inspectedWebPage->d->inspectorController()->setWindowVisible(true, true);
+    // We don't allow the inspector to ask for widget visibility itself because showWindow is
+    // not always called when we want.
+    // Inspecting an element or calling QWebInspector::show() should already have made the
+    // widget visible.
 }
 
-bool InspectorClientQt::windowVisible()
+void InspectorClientQt::closeWindow()
 {
-    if (!m_webPage)
-        return false;
-    return m_webPage->view()->isVisible();
+    if (m_inspectedWebPage->d->inspector)
+        m_inspectedWebPage->d->inspector->close();
 }
 
 void InspectorClientQt::attachWindow()
 {
-    if (!m_webPage)
-        return;
-
-    emit m_webPage->attachRequested();
+    notImplemented();
 }
 
 void InspectorClientQt::detachWindow()
 {
-    if (!m_webPage)
-        return;
-
-    emit m_webPage->detachRequested();
+    notImplemented();
 }
 
 void InspectorClientQt::setAttachedWindowHeight(unsigned height)
@@ -183,13 +153,18 @@ void InspectorClientQt::inspectedURLChanged(const String& newURL)
     updateWindowTitle();
 }
 
-void InspectorClientQt::updateWindowTitle()
+void InspectorClientQt::inspectorWindowObjectCleared()
 {
-    if (!m_webPage)
-        return;
+    notImplemented();
+}
 
-    QString caption = QCoreApplication::translate("QWebPage", "Web Inspector - %2");
-    m_webPage->view()->setWindowTitle(caption.arg(m_inspectedURL));
+void InspectorClientQt::updateWindowTitle()
+{
+    if (m_inspectedWebPage->d->inspector) {
+        QString caption = QCoreApplication::translate("QWebPage", "Web Inspector - %2").arg(m_inspectedURL);
+        m_inspectedWebPage->d->inspector->setWindowTitle(caption);
+        emit m_inspectedWebPage->d->inspector->windowTitleChanged(caption);
+    }
 }
 
 void InspectorClientQt::populateSetting(const String& key, InspectorController::Setting& setting)
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.h b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.h
index 60ed77a..ccf8b69 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.h
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/InspectorClientQt.h
@@ -35,12 +35,12 @@
 #include <QtCore/QString>
 
 class QWebPage;
+class QWebView;
 
 namespace WebCore {
     class Node;
     class Page;
     class String;
-    class InspectorClientWebPage;
 
     class InspectorClientQt : public InspectorClient {
     public:
@@ -56,7 +56,6 @@ namespace WebCore {
 
         virtual void showWindow();
         virtual void closeWindow();
-        virtual bool windowVisible();
 
         virtual void attachWindow();
         virtual void detachWindow();
@@ -71,10 +70,12 @@ namespace WebCore {
         virtual void storeSetting(const String& key, const InspectorController::Setting&);
         virtual void removeSetting(const String& key);
 
+        virtual void inspectorWindowObjectCleared();
+
     private:
         void updateWindowTitle();
         QWebPage* m_inspectedWebPage;
-        OwnPtr<InspectorClientWebPage> m_webPage;
+        OwnPtr<QWebView> m_inspectorView;
         QString m_inspectedURL;
     };
 }
diff --git a/src/3rdparty/webkit/WebKit/qt/docs/webkitsnippets/qtwebkit_qwebinspector_snippet.cpp b/src/3rdparty/webkit/WebKit/qt/docs/webkitsnippets/qtwebkit_qwebinspector_snippet.cpp
new file mode 100644
index 0000000..0ba1cad
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/docs/webkitsnippets/qtwebkit_qwebinspector_snippet.cpp
@@ -0,0 +1,17 @@
+
+void wrapInFunction()
+{
+
+//! [0]
+    // ...
+    QWebPage *page = new QWebPage;
+    // ...
+
+    QWebInspector *inspector = new QWebInspector;
+    inspector->setPage(page);
+
+    connect(page, SIGNAL(webInspectorTriggered(const QWebElement&)), inspector, SLOT(show()));
+//! [0]
+
+}
+
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/qwebelement.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/qwebelement.pro
index dd0b88a..ea2bc79 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/qwebelement.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/qwebelement.pro
@@ -5,3 +5,5 @@ SOURCES  += tst_qwebelement.cpp
 RESOURCES += qwebelement.qrc
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+
+symbian:TARGET.UID3 = 0x200267C3
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/qwebframe.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/qwebframe.pro
index e45e6dc..a3e099b 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/qwebframe.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/qwebframe.pro
@@ -5,3 +5,5 @@ SOURCES  += tst_qwebframe.cpp
 RESOURCES += qwebframe.qrc
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+
+symbian:TARGET.UID3 = 0x200267C6
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
index a3bcd20..561087f 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
@@ -33,6 +33,8 @@
 #include <QRegExp>
 #include <QNetworkRequest>
 #include <QNetworkReply>
+#include <qsslerror.h>
+
 //TESTED_CLASS=
 //TESTED_FILES=
 
@@ -576,6 +578,9 @@ private slots:
     void urlChange();
     void domCycles();
     void requestedUrl();
+    void javaScriptWindowObjectCleared_data();
+    void javaScriptWindowObjectCleared();
+    void javaScriptWindowObjectClearedOnEvaluate();
     void setHtml();
     void setHtmlWithResource();
     void ipv6HostEncoding();
@@ -590,6 +595,7 @@ private slots:
     void hasSetFocus();
     void render();
     void scrollPosition();
+    void evaluateWillCauseRepaint();
 
 private:
     QString  evalJS(const QString&s) {
@@ -2167,56 +2173,70 @@ void tst_QWebFrame::domCycles()
 class FakeReply : public QNetworkReply {
     Q_OBJECT
 
-    public:
-        FakeReply(const QNetworkRequest& request, QObject* parent = 0)
-            : QNetworkReply(parent)
-        {
-            setOperation(QNetworkAccessManager::GetOperation);
-            setRequest(request);
-            if (request.url() == QUrl("qrc:/test1.html")) {
-                setHeader(QNetworkRequest::LocationHeader, QString("qrc:/test2.html"));
-                setAttribute(QNetworkRequest::RedirectionTargetAttribute, QUrl("qrc:/test2.html"));
-            } else
-                setError(QNetworkReply::HostNotFoundError, tr("Invalid URL"));
-
-            open(QIODevice::ReadOnly);
-            QTimer::singleShot(0, this, SLOT(timeout()));
-        }
-        ~FakeReply()
-        {
-            close();
-        }
-        virtual void abort() {}
-        virtual void close() {}
-    protected:
-        qint64 readData(char*, qint64)
-        {
-            return 0;
-        }
-    private slots:
-        void timeout()
-        {
-            if (request().url() == QUrl("qrc://test1.html"))
-                emit error(this->error());
-            else if (request().url() == QUrl("http://abcdef.abcdef/"))
-                emit metaDataChanged();
+public:
+    FakeReply(const QNetworkRequest& request, QObject* parent = 0)
+        : QNetworkReply(parent)
+    {
+        setOperation(QNetworkAccessManager::GetOperation);
+        setRequest(request);
+        if (request.url() == QUrl("qrc:/test1.html")) {
+            setHeader(QNetworkRequest::LocationHeader, QString("qrc:/test2.html"));
+            setAttribute(QNetworkRequest::RedirectionTargetAttribute, QUrl("qrc:/test2.html"));
+        } else if (request.url() == QUrl("qrc:/fake-ssl-error.html"))
+            setError(QNetworkReply::SslHandshakeFailedError, tr("Fake error !")); // force a ssl error
+        else if (request.url() == QUrl("http://abcdef.abcdef/"))
+            setError(QNetworkReply::HostNotFoundError, tr("Invalid URL"));
 
-            emit readyRead();
-            emit finished();
-        }
+        open(QIODevice::ReadOnly);
+        QTimer::singleShot(0, this, SLOT(timeout()));
+    }
+    ~FakeReply()
+    {
+        close();
+    }
+    virtual void abort() {}
+    virtual void close() {}
+
+protected:
+    qint64 readData(char*, qint64)
+    {
+        return 0;
+    }
+
+private slots:
+    void timeout()
+    {
+        if (request().url() == QUrl("qrc://test1.html"))
+            emit error(this->error());
+        else if (request().url() == QUrl("http://abcdef.abcdef/"))
+            emit metaDataChanged();
+        else if (request().url() == QUrl("qrc:/fake-ssl-error.html"))
+            return;
+
+        emit readyRead();
+        emit finished();
+    }
 };
 
 class FakeNetworkManager : public QNetworkAccessManager {
+    Q_OBJECT
+
 public:
     FakeNetworkManager(QObject* parent) : QNetworkAccessManager(parent) { }
 
 protected:
     virtual QNetworkReply* createRequest(Operation op, const QNetworkRequest& request, QIODevice* outgoingData)
     {
-        if (op == QNetworkAccessManager::GetOperation
-            && (request.url().toString() == "qrc:/test1.html"
-            ||  request.url().toString() == "http://abcdef.abcdef/"))
-            return new FakeReply(request, this);
+        QString url = request.url().toString();
+        if (op == QNetworkAccessManager::GetOperation)
+            if (url == "qrc:/test1.html" ||  url == "http://abcdef.abcdef/")
+                return new FakeReply(request, this);
+            else if (url == "qrc:/fake-ssl-error.html") {
+                FakeReply* reply = new FakeReply(request, this);
+                QList<QSslError> errors;
+                emit sslErrors(reply, errors << QSslError(QSslError::UnspecifiedError));
+                return reply;
+            }
 
         return QNetworkAccessManager::createRequest(op, request, outgoingData);
     }
@@ -2249,6 +2269,50 @@ void tst_QWebFrame::requestedUrl()
     QCOMPARE(spy.count(), 3);
     QCOMPARE(frame->requestedUrl(), QUrl("http://abcdef.abcdef/"));
     QCOMPARE(frame->url(), QUrl("http://abcdef.abcdef/"));
+
+    qRegisterMetaType<QList<QSslError> >("QList<QSslError>");
+    qRegisterMetaType<QNetworkReply* >("QNetworkReply*");
+
+    QSignalSpy spy2(page.networkAccessManager(), SIGNAL(sslErrors(QNetworkReply*, const QList<QSslError>&)));
+    frame->setUrl(QUrl("qrc:/fake-ssl-error.html"));
+    QTest::qWait(200);
+    QCOMPARE(spy2.count(), 1);
+    QCOMPARE(frame->requestedUrl(), QUrl("qrc:/fake-ssl-error.html"));
+    QCOMPARE(frame->url(), QUrl("qrc:/fake-ssl-error.html"));
+}
+
+void tst_QWebFrame::javaScriptWindowObjectCleared_data()
+{
+    QTest::addColumn<QString>("html");
+    QTest::addColumn<int>("signalCount");
+    QTest::newRow("with <script>") << "<html><body><script></script><p>hello world</p></body></html>" << 1;
+    QTest::newRow("without <script>") << "<html><body><p>hello world</p></body></html>" << 0;
+}
+
+void tst_QWebFrame::javaScriptWindowObjectCleared()
+{
+    QWebPage page;
+    QWebFrame* frame = page.mainFrame();
+    QSignalSpy spy(frame, SIGNAL(javaScriptWindowObjectCleared()));
+    QFETCH(QString, html);
+    frame->setHtml(html);
+
+    QFETCH(int, signalCount);
+    QCOMPARE(spy.count(), signalCount);
+}
+
+void tst_QWebFrame::javaScriptWindowObjectClearedOnEvaluate()
+{
+    QWebPage page;
+    QWebFrame* frame = page.mainFrame();
+    QSignalSpy spy(frame, SIGNAL(javaScriptWindowObjectCleared()));
+    frame->setHtml("<html></html>");
+    QCOMPARE(spy.count(), 0);
+    frame->evaluateJavaScript("var a = 'a';");
+    QCOMPARE(spy.count(), 1);
+    // no new clear for a new script:
+    frame->evaluateJavaScript("var a = 1;");
+    QCOMPARE(spy.count(), 1);
 }
 
 void tst_QWebFrame::setHtml()
@@ -2643,5 +2707,24 @@ void tst_QWebFrame::scrollPosition()
     QCOMPARE(y, 29);
 }
 
+void tst_QWebFrame::evaluateWillCauseRepaint()
+{
+    QWebView view;
+    QString html("<html><body>top<div id=\"junk\" style=\"display: block;\">"
+                    "junk</div>bottom</body></html>");
+    view.setHtml(html);
+    view.show();
+
+    QTest::qWait(200);
+
+    view.page()->mainFrame()->evaluateJavaScript(
+        "document.getElementById('junk').style.display = 'none';");
+
+    ::waitForSignal(view.page(), SIGNAL(repaintRequested( const QRect &)));
+
+    QTest::qWait(2000);
+}
+
+
 QTEST_MAIN(tst_QWebFrame)
 #include "tst_qwebframe.moc"
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/qwebhistory.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/qwebhistory.pro
index fd1074c..55ed414 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/qwebhistory.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/qwebhistory.pro
@@ -5,3 +5,5 @@ SOURCES  += tst_qwebhistory.cpp
 RESOURCES  += tst_qwebhistory.qrc
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+
+symbian:TARGET.UID3 = 0x200267C4
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/tst_qwebhistory.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/tst_qwebhistory.cpp
index 5b55613..ec7a040 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/tst_qwebhistory.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/tst_qwebhistory.cpp
@@ -58,6 +58,11 @@ private slots:
     void saveAndRestore_1();  //simple checks saveState and restoreState
     void saveAndRestore_2();  //bad parameters saveState and restoreState
     void saveAndRestore_3();  //try use different version
+    void saveAndRestore_crash_1();
+    void saveAndRestore_crash_2();
+    void saveAndRestore_crash_3();
+    void clear();
+
 
 private:
     QWebPage* page;
@@ -119,6 +124,8 @@ void tst_QWebHistory::back()
         hist->back();
         waitForLoadFinished.exec();
     }
+    //try one more time (too many). crash test
+    hist->back();
 }
 
 /**
@@ -137,6 +144,8 @@ void tst_QWebHistory::forward()
         hist->forward();
         waitForLoadFinished.exec();
     }
+    //try one more time (too many). crash test
+    hist->forward();
 }
 
 /**
@@ -322,5 +331,63 @@ void tst_QWebHistory::saveAndRestore_3()
     QVERIFY(hist->itemAt(3).isValid());
 }
 
+/** The test shouldn't crash */
+void tst_QWebHistory::saveAndRestore_crash_1()
+{
+    QByteArray tmp = hist->saveState();
+    for (unsigned i = 0; i < 5; i++){
+        hist->restoreState(tmp);
+        hist->saveState();
+    }
+}
+
+/** The test shouldn't crash */
+void tst_QWebHistory::saveAndRestore_crash_2()
+{
+    QByteArray tmp = hist->saveState();
+    QWebPage* page2 = new QWebPage(this);
+    QWebHistory* hist2 = page2->history();
+    for (unsigned i = 0; i < 5; i++){
+        hist2->restoreState(tmp);
+        hist2->saveState();
+    }
+    delete page2;
+}
+
+/** The test shouldn't crash */
+void tst_QWebHistory::saveAndRestore_crash_3()
+{
+    QByteArray tmp = hist->saveState();
+    QWebPage* page2 = new QWebPage(this);
+    QWebHistory* hist1 = hist;
+    QWebHistory* hist2 = page2->history();
+    for (unsigned i = 0; i < 5; i++){
+        hist1->restoreState(tmp);
+        hist2->restoreState(tmp);
+        QVERIFY(hist1->count() == hist2->count());
+        QVERIFY(hist1->count() == histsize);
+        hist2->back();
+        tmp = hist2->saveState();
+        hist2->clear();
+    }
+    delete page2;
+}
+
+/** ::clear */
+void tst_QWebHistory::clear()
+{
+    hist->saveState();
+    QVERIFY(hist->count() > 1);
+    hist->clear();
+    QVERIFY(hist->count() == 1);  //leave current item
+
+    QWebPage* page2 = new QWebPage(this);
+    QWebHistory* hist2 = page2->history();
+    QVERIFY(hist2->count() == 0);
+    hist2->clear();
+    QVERIFY(hist2->count() == 0); //do not change anything
+    delete page2;
+}
+
 QTEST_MAIN(tst_QWebHistory)
 #include "tst_qwebhistory.moc"
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistoryinterface/qwebhistoryinterface.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistoryinterface/qwebhistoryinterface.pro
index af3b348..011869d 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistoryinterface/qwebhistoryinterface.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistoryinterface/qwebhistoryinterface.pro
@@ -4,3 +4,5 @@ include(../../../../WebKit.pri)
 SOURCES  += tst_qwebhistoryinterface.cpp
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+
+symbian:TARGET.UID3 = 0x200267C5
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/qwebpage.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/qwebpage.pro
index 2f3a108..e4b11c2 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/qwebpage.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/qwebpage.pro
@@ -5,3 +5,5 @@ SOURCES  += tst_qwebpage.cpp
 RESOURCES  += tst_qwebpage.qrc
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+
+symbian:TARGET.UID3 = 0x200267C7
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
index 966f049..121d7cb 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
@@ -110,6 +110,9 @@ private slots:
     void frameAt();
     void requestCache();
     void protectBindingsRuntimeObjectsFromCollector();
+    void localURLSchemes();
+    void testOptionalJSObjects();
+    void testEnablePersistentStorage();
 
 private:
 
@@ -405,6 +408,10 @@ void tst_QWebPage::database()
     QWebSettings::setOfflineStorageDefaultQuota(1024 * 1024);
     QVERIFY(QWebSettings::offlineStorageDefaultQuota() == 1024 * 1024);
 
+    m_page->settings()->setAttribute(QWebSettings::LocalStorageEnabled, true);
+    m_page->settings()->setAttribute(QWebSettings::SessionStorageEnabled, true);
+    m_page->settings()->setAttribute(QWebSettings::OfflineStorageDatabaseEnabled, true);
+
     QString dbFileName = path + "Databases.db";
 
     if (QFile::exists(dbFileName))
@@ -627,7 +634,6 @@ void tst_QWebPage::createViewlessPlugin()
 // import private API
 void QWEBKIT_EXPORT qt_webpage_setGroupName(QWebPage* page, const QString& groupName);
 QString QWEBKIT_EXPORT qt_webpage_groupName(QWebPage* page);
-void QWEBKIT_EXPORT qt_websettings_setLocalStorageDatabasePath(QWebSettings* settings, const QString& path);
 
 void tst_QWebPage::multiplePageGroupsAndLocalStorage()
 {
@@ -638,9 +644,11 @@ void tst_QWebPage::multiplePageGroupsAndLocalStorage()
     QWebView view1;
     QWebView view2;
 
-    qt_websettings_setLocalStorageDatabasePath(view1.page()->settings(), QDir::toNativeSeparators(QDir::currentPath() + "/path1"));
+    view1.page()->settings()->setAttribute(QWebSettings::LocalStorageEnabled, true);
+    view1.page()->settings()->setLocalStoragePath(QDir::toNativeSeparators(QDir::currentPath() + "/path1"));
     qt_webpage_setGroupName(view1.page(), "group1");
-    qt_websettings_setLocalStorageDatabasePath(view2.page()->settings(), QDir::toNativeSeparators(QDir::currentPath() + "/path2"));
+    view2.page()->settings()->setAttribute(QWebSettings::LocalStorageEnabled, true);    
+    view2.page()->settings()->setLocalStoragePath(QDir::toNativeSeparators(QDir::currentPath() + "/path2"));
     qt_webpage_setGroupName(view2.page(), "group2");
     QCOMPARE(qt_webpage_groupName(view1.page()), QString("group1"));
     QCOMPARE(qt_webpage_groupName(view2.page()), QString("group2"));
@@ -1190,5 +1198,81 @@ void tst_QWebPage::protectBindingsRuntimeObjectsFromCollector()
     newPage->mainFrame()->evaluateJavaScript("testme('bar')");
 }
 
+void tst_QWebPage::localURLSchemes()
+{
+    int i = QWebSecurityOrigin::localSchemes().size();
+    QWebSecurityOrigin::removeLocalScheme("file");
+    QTRY_COMPARE(QWebSecurityOrigin::localSchemes().size(), i);
+    QWebSecurityOrigin::addLocalScheme("file");
+    QTRY_COMPARE(QWebSecurityOrigin::localSchemes().size(), i);
+    QString myscheme = "myscheme";
+    QWebSecurityOrigin::addLocalScheme(myscheme);
+    QTRY_COMPARE(QWebSecurityOrigin::localSchemes().size(), i + 1);
+    QVERIFY(QWebSecurityOrigin::localSchemes().contains(myscheme));
+    QWebSecurityOrigin::removeLocalScheme(myscheme);
+    QTRY_COMPARE(QWebSecurityOrigin::localSchemes().size(), i);
+    QWebSecurityOrigin::removeLocalScheme(myscheme);
+    QTRY_COMPARE(QWebSecurityOrigin::localSchemes().size(), i);
+}
+
+static inline bool testFlag(QWebPage& webPage, QWebSettings::WebAttribute settingAttribute, const QString& jsObjectName, bool settingValue)
+{
+    webPage.settings()->setAttribute(settingAttribute, settingValue);
+    return webPage.mainFrame()->evaluateJavaScript(QString("(window.%1 != undefined)").arg(jsObjectName)).toBool();
+}
+
+void tst_QWebPage::testOptionalJSObjects()
+{
+    // Once a feature is enabled and the JS object is accessed turning off the setting will not turn off
+    // the visibility of the JS object any more. For this reason this test uses two QWebPage instances.
+    // Part of the test is to make sure that the QWebPage instances do not interfere with each other so turning on
+    // a feature for one instance will not turn it on for another.
+
+    QWebPage webPage1;
+    QWebPage webPage2;
+
+    webPage1.currentFrame()->setHtml(QString("<html><body>test</body></html>"), QUrl());
+    webPage2.currentFrame()->setHtml(QString("<html><body>test</body></html>"), QUrl());
+
+    QCOMPARE(testFlag(webPage1, QWebSettings::OfflineWebApplicationCacheEnabled, "applicationCache", false), false);
+    QCOMPARE(testFlag(webPage2, QWebSettings::OfflineWebApplicationCacheEnabled, "applicationCache", true),  true);
+    QCOMPARE(testFlag(webPage1, QWebSettings::OfflineWebApplicationCacheEnabled, "applicationCache", false), false);
+    QCOMPARE(testFlag(webPage2, QWebSettings::OfflineWebApplicationCacheEnabled, "applicationCache", false), true);
+
+    QCOMPARE(testFlag(webPage1, QWebSettings::LocalStorageEnabled, "localStorage", false), false);
+    QCOMPARE(testFlag(webPage2, QWebSettings::LocalStorageEnabled, "localStorage", true),  true);
+    QCOMPARE(testFlag(webPage1, QWebSettings::LocalStorageEnabled, "localStorage", false), false);
+    QCOMPARE(testFlag(webPage2, QWebSettings::LocalStorageEnabled, "localStorage", false), true);
+
+    QCOMPARE(testFlag(webPage1, QWebSettings::SessionStorageEnabled, "sessionStorage", false), false);
+    QCOMPARE(testFlag(webPage2, QWebSettings::SessionStorageEnabled, "sessionStorage", true),  true);
+    QCOMPARE(testFlag(webPage1, QWebSettings::SessionStorageEnabled, "sessionStorage", false), false);
+    QCOMPARE(testFlag(webPage2, QWebSettings::SessionStorageEnabled, "sessionStorage", false), true);
+}
+
+void tst_QWebPage::testEnablePersistentStorage()
+{
+    QWebPage webPage;
+
+    // By default all persistent options should be disabled
+    QCOMPARE(webPage.settings()->testAttribute(QWebSettings::LocalStorageEnabled), false);
+    QCOMPARE(webPage.settings()->testAttribute(QWebSettings::OfflineStorageDatabaseEnabled), false);
+    QCOMPARE(webPage.settings()->testAttribute(QWebSettings::OfflineWebApplicationCacheEnabled), false);
+    QVERIFY(webPage.settings()->iconDatabasePath().isEmpty());
+
+    QWebSettings::enablePersistentStorage();
+
+    // Give it some time to initialize - icon database needs it
+    QTest::qWait(1000);
+
+    QCOMPARE(webPage.settings()->testAttribute(QWebSettings::LocalStorageEnabled), true);
+    QCOMPARE(webPage.settings()->testAttribute(QWebSettings::OfflineStorageDatabaseEnabled), true);
+    QCOMPARE(webPage.settings()->testAttribute(QWebSettings::OfflineWebApplicationCacheEnabled), true);
+
+    QVERIFY(!webPage.settings()->offlineStoragePath().isEmpty());
+    QVERIFY(!webPage.settings()->offlineWebApplicationCachePath().isEmpty());
+    QVERIFY(!webPage.settings()->iconDatabasePath().isEmpty());
+}
+
 QTEST_MAIN(tst_QWebPage)
 #include "tst_qwebpage.moc"
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebplugindatabase/qwebplugindatabase.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebplugindatabase/qwebplugindatabase.pro
new file mode 100644
index 0000000..5d10993
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebplugindatabase/qwebplugindatabase.pro
@@ -0,0 +1,6 @@
+TEMPLATE = app
+TARGET = tst_qwebplugindatabase
+include(../../../../WebKit.pri)
+SOURCES  += tst_qwebplugindatabase.cpp
+QT += testlib network
+QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebplugindatabase/tst_qwebplugindatabase.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebplugindatabase/tst_qwebplugindatabase.cpp
new file mode 100644
index 0000000..1ee6206
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebplugindatabase/tst_qwebplugindatabase.cpp
@@ -0,0 +1,437 @@
+/*
+    Copyright (C) 2009 Jakub Wieczorek <faw217@gmail.com>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include <QtTest/QtTest>
+
+#include <qdir.h>
+#include <qwebframe.h>
+#include <qwebpage.h>
+#include <qwebplugindatabase.h>
+#include <qwebsettings.h>
+#include <qvariant.h>
+
+class tst_QWebPluginDatabase : public QObject
+{
+    Q_OBJECT
+
+private slots:
+    void installedPlugins();
+    void searchPaths();
+    void null_data();
+    void null();
+    void pluginForMimeType();
+    void enabled();
+    void operatorequal_data();
+    void operatorequal();
+    void preferredPlugin();
+    void operatorassign_data();
+    void operatorassign();
+};
+
+typedef QWebPluginInfo::MimeType MimeType;
+
+void tst_QWebPluginDatabase::installedPlugins()
+{
+    QWebPage page;
+    page.settings()->setAttribute(QWebSettings::PluginsEnabled, true);
+    QWebFrame* frame = page.mainFrame();
+
+    QVariantMap jsPluginsMap = frame->evaluateJavaScript("window.navigator.plugins").toMap();
+    QList<QWebPluginInfo> plugins = QWebSettings::pluginDatabase()->plugins();
+    QCOMPARE(plugins, QWebSettings::pluginDatabase()->plugins());
+
+    int length = jsPluginsMap["length"].toInt();
+    QCOMPARE(length, plugins.count());
+
+    for (int i = 0; i < length; ++i) {
+        QWebPluginInfo plugin = plugins.at(i);
+
+        QVariantMap jsPlugin = frame->evaluateJavaScript(QString("window.navigator.plugins[%1]").arg(i)).toMap();
+        QString name = jsPlugin["name"].toString();
+        QString description = jsPlugin["description"].toString();
+        QString fileName = jsPlugin["filename"].toString();
+
+        QCOMPARE(plugin.name(), name);
+        QCOMPARE(plugin.description(), description);
+        QCOMPARE(QFileInfo(plugin.path()).fileName(), fileName);
+
+        QList<MimeType> mimeTypes;
+        int mimeTypesCount = jsPlugin["length"].toInt();
+
+        for (int j = 0; j < mimeTypesCount; ++j) {
+            QVariantMap jsMimeType = frame->evaluateJavaScript(QString("window.navigator.plugins[%1][%2]").arg(i).arg(j)).toMap();
+
+            MimeType mimeType;
+            mimeType.name = jsMimeType["type"].toString();
+            mimeType.description = jsMimeType["description"].toString();
+            mimeType.fileExtensions = jsMimeType["suffixes"].toString().split(',', QString::SkipEmptyParts);
+
+            mimeTypes.append(mimeType);
+            QVERIFY(plugin.supportsMimeType(mimeType.name));
+        }
+
+        QCOMPARE(plugin.mimeTypes(), mimeTypes);
+
+        QVERIFY(!plugin.isNull());
+        QVERIFY(plugin.isEnabled());
+    }
+}
+
+void tst_QWebPluginDatabase::searchPaths()
+{
+    QWebPluginDatabase* database = QWebSettings::pluginDatabase();
+    QList<QWebPluginInfo> plugins = database->plugins();
+    QStringList directories = database->searchPaths();
+    QCOMPARE(QWebPluginDatabase::defaultSearchPaths(), directories);
+
+    database->setSearchPaths(directories);
+    QCOMPARE(QWebPluginDatabase::defaultSearchPaths(), directories);
+    QCOMPARE(database->searchPaths(), directories);
+    QCOMPARE(database->plugins(), plugins);
+    database->refresh();
+    QCOMPARE(database->plugins(), plugins);
+
+    database->setSearchPaths(QStringList());
+    QCOMPARE(QWebPluginDatabase::defaultSearchPaths(), directories);
+    QCOMPARE(database->searchPaths(), QStringList());
+    QCOMPARE(database->plugins().count(), 0);
+
+    database->setSearchPaths(directories);
+    QCOMPARE(database->searchPaths(), directories);
+    database->addSearchPath(QDir::tempPath());
+    QCOMPARE(database->searchPaths().count(), directories.count() + 1);
+    QVERIFY(database->searchPaths().contains(QDir::tempPath()));
+    directories.append(QDir::tempPath());
+    QCOMPARE(database->searchPaths(), directories);
+
+    // As an empty set of search paths has been set, the database has been rebuilt
+    // from scratch after bringing the old path set back.
+    // Because the QWebPlugins no longer point to the same PluginPackages,
+    // the list is also no longer equal to the older one, even though it contains
+    // the same information.
+    QCOMPARE(database->plugins().count(), plugins.count());
+    plugins = database->plugins();
+    QCOMPARE(database->plugins(), plugins);
+
+    for (int i = (directories.count() - 1); i >= 0; --i) {
+        QDir directory(directories.at(i));
+        if (!directory.exists() || !directory.count())
+            directories.removeAt(i);
+    }
+
+    database->setSearchPaths(directories);
+    QCOMPARE(database->plugins(), plugins);
+    database->refresh();
+    QCOMPARE(database->plugins(), plugins);
+
+    database->setSearchPaths(QWebPluginDatabase::defaultSearchPaths());
+    directories = QWebPluginDatabase::defaultSearchPaths();
+    QCOMPARE(QWebPluginDatabase::defaultSearchPaths(), directories);
+    QCOMPARE(database->searchPaths(), directories);
+    QCOMPARE(database->plugins(), plugins);
+}
+
+Q_DECLARE_METATYPE(QWebPluginInfo)
+void tst_QWebPluginDatabase::null_data()
+{
+    QTest::addColumn<QWebPluginInfo>("plugin");
+    QTest::addColumn<bool>("null");
+
+    QTest::newRow("null") << QWebPluginInfo() << true;
+    QTest::newRow("foo") << QWebSettings::pluginDatabase()->pluginForMimeType("foobarbaz") << true;
+
+    QList<QWebPluginInfo> plugins = QWebSettings::pluginDatabase()->plugins();
+    for (int i = 0; i < plugins.count(); ++i)
+        QTest::newRow(QString::number(i).toUtf8().constData()) << plugins.at(i) << false;
+}
+
+void tst_QWebPluginDatabase::null()
+{
+    QFETCH(QWebPluginInfo, plugin);
+    QFETCH(bool, null);
+
+    QCOMPARE(plugin.isNull(), null);
+}
+
+void tst_QWebPluginDatabase::pluginForMimeType()
+{
+    QMultiMap<QString, QWebPluginInfo> pluginsMap;
+    QWebPluginDatabase* database = QWebSettings::pluginDatabase();
+    QList<QWebPluginInfo> plugins = database->plugins();
+
+    for (int i = 0; i < plugins.count(); ++i) {
+        QWebPluginInfo plugin = plugins.at(i);
+
+        QList<MimeType> mimeTypes = plugin.mimeTypes();
+        for (int j = 0; j < mimeTypes.count(); ++j) {
+            QString mimeType = mimeTypes.at(j).name;
+            pluginsMap.insert(mimeType, plugin);
+            QVERIFY(plugin.supportsMimeType(mimeType));
+        }
+    }
+
+    for (int i = 0; i < plugins.count(); ++i) {
+        QWebPluginInfo plugin = plugins.at(i);
+
+        QList<MimeType> mimeTypes = plugin.mimeTypes();
+        for (int j = 0; j < mimeTypes.count(); ++j) {
+            QString mimeType = mimeTypes.at(j).name;
+
+            QVERIFY(pluginsMap.count(mimeType) > 0);
+            if (pluginsMap.count(mimeType) > 1)
+                continue;
+
+            QWebPluginInfo pluginForMimeType = database->pluginForMimeType(mimeType);
+            QCOMPARE(pluginForMimeType, plugin);
+            database->setSearchPaths(database->searchPaths());
+            QCOMPARE(pluginForMimeType, plugin);
+            QCOMPARE(pluginForMimeType, database->pluginForMimeType(mimeType.toUpper()));
+            QCOMPARE(pluginForMimeType, database->pluginForMimeType(mimeType.toLower()));
+            QVERIFY(plugin.supportsMimeType(mimeType));
+            QVERIFY(!pluginForMimeType.isNull());
+            QVERIFY(!plugin.isNull());
+        }
+    }
+}
+
+void tst_QWebPluginDatabase::enabled()
+{
+    QMultiMap<QString, QWebPluginInfo> pluginsMap;
+    QWebPluginDatabase* database = QWebSettings::pluginDatabase();
+    QList<QWebPluginInfo> plugins = database->plugins();
+
+    for (int i = 0; i < plugins.count(); ++i) {
+        QWebPluginInfo plugin = plugins.at(i);
+
+        QList<MimeType> mimeTypes = plugin.mimeTypes();
+        for (int j = 0; j < mimeTypes.count(); ++j) {
+            QString mimeType = mimeTypes.at(j).name;
+            pluginsMap.insert(mimeType, plugin);
+            QVERIFY(plugin.supportsMimeType(mimeType));
+        }
+    }
+
+    QMultiMap<QString, QWebPluginInfo>::iterator it = pluginsMap.begin();
+    while (it != pluginsMap.end()) {
+        QString mimeType = it.key();
+        QWebPluginInfo plugin = it.value();
+        QWebPluginInfo pluginForMimeType = database->pluginForMimeType(mimeType);
+
+        QVERIFY(pluginsMap.count(mimeType) > 0);
+
+        if (pluginsMap.count(mimeType) == 1) {
+            QCOMPARE(plugin, pluginForMimeType);
+
+            QVERIFY(plugin.isEnabled());
+            QVERIFY(pluginForMimeType.isEnabled());
+            plugin.setEnabled(false);
+            QVERIFY(!plugin.isEnabled());
+            QVERIFY(!pluginForMimeType.isEnabled());
+        } else {
+            QVERIFY(plugin.isEnabled());
+            QVERIFY(pluginForMimeType.isEnabled());
+            plugin.setEnabled(false);
+            QVERIFY(!plugin.isEnabled());
+        }
+
+        QVERIFY(!plugin.isNull());
+        QVERIFY(!pluginForMimeType.isNull());
+
+        QWebPluginInfo pluginForMimeType2 = database->pluginForMimeType(mimeType);
+        if (pluginsMap.count(mimeType) == 1) {
+            QVERIFY(pluginForMimeType2 != plugin);
+            QVERIFY(pluginForMimeType2.isNull());
+        } else {
+            QVERIFY(pluginForMimeType2 != plugin);
+            QVERIFY(!pluginForMimeType2.isNull());
+        }
+
+        plugin.setEnabled(true);
+
+        ++it;
+    }
+}
+
+void tst_QWebPluginDatabase::operatorequal_data()
+{
+    QTest::addColumn<QWebPluginInfo>("first");
+    QTest::addColumn<QWebPluginInfo>("second");
+    QTest::addColumn<bool>("equal");
+
+    QWebPluginDatabase* database = QWebSettings::pluginDatabase();
+    QTest::newRow("null") << QWebPluginInfo() << QWebPluginInfo() << true;
+    QTest::newRow("application/x-shockwave-flash") << database->pluginForMimeType("application/x-shockwave-flash")
+                                                   << database->pluginForMimeType("application/x-shockwave-flash") << true;
+    QTest::newRow("foo/bar-baz") << database->pluginForMimeType("foo/bar-baz")
+                                 << database->pluginForMimeType("foo/bar-baz") << true;
+
+    QList<QWebPluginInfo> plugins = database->plugins();
+    for (int i = 0; i < (plugins.count() - 1); ++i) {
+        QWebPluginInfo first = plugins.at(i);
+        QWebPluginInfo second = plugins.at(i + 1);
+
+        QTest::newRow(QString("%1==%2").arg(first.name(), second.name()).toUtf8().constData())
+                                    << first << second << false;
+    }
+}
+
+void tst_QWebPluginDatabase::operatorequal()
+{
+    QFETCH(QWebPluginInfo, first);
+    QFETCH(QWebPluginInfo, second);
+    QFETCH(bool, equal);
+
+    QCOMPARE(first == second, equal);
+}
+
+void tst_QWebPluginDatabase::preferredPlugin()
+{
+    QMultiMap<QString, QWebPluginInfo> pluginsMap;
+    QWebPluginDatabase* database = QWebSettings::pluginDatabase();
+    QList<QWebPluginInfo> plugins = database->plugins();
+
+    for (int i = 0; i < plugins.count(); ++i) {
+        QWebPluginInfo plugin = plugins.at(i);
+
+        QList<MimeType> mimeTypes = plugin.mimeTypes();
+        for (int j = 0; j < mimeTypes.count(); ++j) {
+            QString mimeType = mimeTypes.at(j).name;
+            pluginsMap.insert(mimeType, plugin);
+        }
+    }
+
+    QMultiMap<QString, QWebPluginInfo>::iterator it = pluginsMap.begin();
+    while (it != pluginsMap.end()) {
+        QString mimeType = it.key();
+
+        if (pluginsMap.count(mimeType) > 1) {
+            QList<QWebPluginInfo> pluginsForMimeType = pluginsMap.values(mimeType);
+            QWebPluginInfo plugin = database->pluginForMimeType(mimeType);
+            QVERIFY(plugin.supportsMimeType(mimeType));
+
+            pluginsForMimeType.removeAll(plugin);
+            for (int i = 0; i < pluginsForMimeType.count(); ++i) {
+                QWebPluginInfo anotherPlugin = pluginsForMimeType.at(i);
+                QVERIFY(plugin.supportsMimeType(mimeType));
+                QVERIFY(plugin != anotherPlugin);
+
+                QCOMPARE(database->pluginForMimeType(mimeType), plugin);
+                database->setPreferredPluginForMimeType(mimeType, anotherPlugin);
+                QCOMPARE(database->pluginForMimeType(mimeType), anotherPlugin);
+
+                anotherPlugin.setEnabled(false);
+                QCOMPARE(database->pluginForMimeType(mimeType), plugin);
+
+                anotherPlugin.setEnabled(true);
+                QCOMPARE(database->pluginForMimeType(mimeType), anotherPlugin);
+                database->setSearchPaths(database->searchPaths());
+                QCOMPARE(database->pluginForMimeType(mimeType), anotherPlugin);
+
+                database->setPreferredPluginForMimeType(mimeType, QWebPluginInfo());
+                QCOMPARE(database->pluginForMimeType(mimeType), plugin);
+            }
+        } else {
+            QWebPluginInfo plugin = database->pluginForMimeType(mimeType);
+            QCOMPARE(pluginsMap.value(mimeType), plugin);
+
+            database->setPreferredPluginForMimeType(mimeType, plugin);
+            QCOMPARE(database->pluginForMimeType(mimeType), plugin);
+
+            plugin.setEnabled(false);
+            QCOMPARE(database->pluginForMimeType(mimeType), QWebPluginInfo());
+            plugin.setEnabled(true);
+
+            database->setPreferredPluginForMimeType(mimeType, QWebPluginInfo());
+            QCOMPARE(database->pluginForMimeType(mimeType), plugin);
+        }
+
+        ++it;
+    }
+
+    if (pluginsMap.keys().count() >= 2) {
+        QStringList mimeTypes = pluginsMap.uniqueKeys();
+
+        QString mimeType1 = mimeTypes.at(0);
+        QString mimeType2 = mimeTypes.at(1);
+        QWebPluginInfo plugin1 = database->pluginForMimeType(mimeType1);
+        QWebPluginInfo plugin2 = database->pluginForMimeType(mimeType2);
+
+        int i = 2;
+        while (plugin2.supportsMimeType(mimeType1)
+               && !mimeType2.isEmpty()
+               && i < mimeTypes.count()) {
+            mimeType2 = mimeTypes.at(i);
+            plugin2 = database->pluginForMimeType(mimeType2);
+            ++i;
+        }
+
+        plugin1 = database->pluginForMimeType(mimeType1);
+        QVERIFY(plugin1.supportsMimeType(mimeType1));
+        QVERIFY(!plugin1.isNull());
+        plugin2 = database->pluginForMimeType(mimeType2);
+        QVERIFY(plugin2.supportsMimeType(mimeType2));
+        QVERIFY(!plugin2.isNull());
+
+        database->setPreferredPluginForMimeType(mimeType2, plugin1);
+        QVERIFY(!plugin1.supportsMimeType(mimeType2));
+        QCOMPARE(database->pluginForMimeType(mimeType2), plugin2);
+
+        database->setPreferredPluginForMimeType(mimeType1, plugin1);
+        QVERIFY(!plugin2.supportsMimeType(mimeType1));
+        QCOMPARE(database->pluginForMimeType(mimeType2), plugin2);
+    }
+}
+
+void tst_QWebPluginDatabase::operatorassign_data()
+{
+    QTest::addColumn<QWebPluginInfo>("first");
+    QTest::addColumn<QWebPluginInfo>("second");
+
+    QWebPluginDatabase* database = QWebSettings::pluginDatabase();
+    QTest::newRow("null") << QWebPluginInfo() << QWebPluginInfo();
+
+    QList<QWebPluginInfo> plugins = database->plugins();
+    for (int i = 0; i < (plugins.count() - 1); ++i) {
+        QWebPluginInfo first = plugins.at(i);
+        QWebPluginInfo second = plugins.at(i + 1);
+
+        QTest::newRow(QString("%1=%2").arg(first.name(), second.name()).toUtf8().constData()) << first << second;
+    }
+}
+
+void tst_QWebPluginDatabase::operatorassign()
+{
+    QFETCH(QWebPluginInfo, first);
+    QFETCH(QWebPluginInfo, second);
+
+    QWebPluginInfo info;
+    QCOMPARE(info.mimeTypes(), QList<MimeType>());
+    QCOMPARE(info = first, first);
+    QCOMPARE(info, first);
+    QCOMPARE(info.mimeTypes(), first.mimeTypes());
+    QCOMPARE(info = second, second);
+    QCOMPARE(info, second);
+    QCOMPARE(info.mimeTypes(), second.mimeTypes());
+    QCOMPARE(info = QWebPluginInfo(), QWebPluginInfo());
+    QCOMPARE(info.mimeTypes(), QList<MimeType>());
+}
+
+QTEST_MAIN(tst_QWebPluginDatabase)
+
+#include "tst_qwebplugindatabase.moc"
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebview/qwebview.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/qwebview.pro
index 799ccfb..b7e0fb1 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebview/qwebview.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/qwebview.pro
@@ -4,3 +4,5 @@ include(../../../../WebKit.pri)
 SOURCES  += tst_qwebview.cpp
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+
+symbian:TARGET.UID3 = 0x200267C8
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebview/tst_qwebview.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/tst_qwebview.cpp
index 6501bfc..01d0e92 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebview/tst_qwebview.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebview/tst_qwebview.cpp
@@ -25,6 +25,7 @@
 #include <qwebpage.h>
 #include <qnetworkrequest.h>
 #include <qdiriterator.h>
+#include <qwebkitversion.h>
 
 class tst_QWebView : public QObject
 {
@@ -40,6 +41,7 @@ private slots:
     void renderHints();
     void guessUrlFromString_data();
     void guessUrlFromString();
+    void getWebKitVersion();
 };
 
 // This will be called before the first test function is executed.
@@ -160,6 +162,11 @@ void tst_QWebView::guessUrlFromString()
     QCOMPARE(url, guessUrlFromString);
 }
 
+void tst_QWebView::getWebKitVersion()
+{
+    QVERIFY(qWebKitVersion().toDouble() > 0);
+}
+
 QTEST_MAIN(tst_QWebView)
 #include "tst_qwebview.moc"
 
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/tests.pro b/src/3rdparty/webkit/WebKit/qt/tests/tests.pro
index 7000d32..b5f66ee 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/tests.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/tests.pro
@@ -1,4 +1,4 @@
 
 TEMPLATE = subdirs
-SUBDIRS = qwebframe qwebpage qwebelement qwebhistoryinterface qwebview qwebhistory
-SUBDIRS += benchmarks/painting/tst_painting.pro benchmarks/loading/tst_loading.pro
+SUBDIRS = qwebframe qwebpage qwebelement qwebhistoryinterface qwebplugindatabase qwebview qwebhistory
+greaterThan(QT_MINOR_VERSION, 4): SUBDIRS += benchmarks/painting/tst_painting.pro benchmarks/loading/tst_loading.pro
diff --git a/src/3rdparty/webkit/WebKit/scripts/generate-webkitversion.pl b/src/3rdparty/webkit/WebKit/scripts/generate-webkitversion.pl
new file mode 100644
index 0000000..0feb770
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/scripts/generate-webkitversion.pl
@@ -0,0 +1,136 @@
+#!/usr/bin/perl
+
+# Based on make_names.pl
+#
+# Copyright (C) 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
+# Copyright (C) 2009, Julien Chaffraix <jchaffraix@webkit.org>
+# Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+# Copyright (C) 2009 Robert Hogan <robert@roberthogan.net>
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+# 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+#     its contributors may be used to endorse or promote products derived
+#     from this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+# This script reads Version.xcconfig and returns either or both of the major and minor
+# WebKit version numbers. It is currently used by WebKit.pri.
+
+use strict;
+
+use Config;
+use Getopt::Long;
+use File::Path;
+use Switch;
+
+my $usage = "generate-webkitversion --config WebKit/mac/Configurations/Version.xcconfig --outputDir <outputdir>";
+
+my $major_version = "";
+my $minor_version = "";
+# The appropriate Apple-maintained Version.xcconfig file for WebKit version information is in WebKit/mac/Configurations/.
+my $configFile = "./WebKit/mac/Configurations/Version.xcconfig";
+my $outputDir = "";
+
+GetOptions('config=s' => \$configFile,
+    'outputDir=s' => \$outputDir);
+
+die "You must specify a --config <file> " unless (length($configFile));
+die "You must specify a --outputDir <outputdir> " unless (length($outputDir));
+
+die "./WebKit/mac/Configurations/Version.xcconfig does not exist: use --config <file> to specify its correct location." unless (-e $configFile);
+die "$outputDir/ does not exist: use --outputDir <directory> to specify the location of an output directory that exists" unless (-e "$outputDir");
+
+unless (open INPUT, "<", $configFile) { print STDERR "File does not exist: $configFile\n";}
+while (my $line = <INPUT>) {
+    chomp $line;
+    if ($line =~ /^MAJOR_VERSION\s+=\s+\d+;/) {
+      $line =~ s/^(MAJOR_VERSION)\s+(=)\s+(\d+);/$3/;
+      $major_version = $line;
+    }
+    if ($line =~ /^MINOR_VERSION\s+=\s+\d+;/) {
+      $line =~ s/^(MINOR_VERSION)\s+(=)\s+(\d+);/$3/;
+      $minor_version = $line;
+    }
+}
+
+$major_version = "531" unless (length($major_version));
+$minor_version = "3" unless (length($minor_version));
+
+my $webKitVersionPath = "$outputDir/WebKitVersion.h";
+
+printWebKitVersionHeaderFile("$webKitVersionPath");
+
+sub printLicenseHeader
+{
+    my $F = shift;
+    print F "/*
+ * THIS FILE IS AUTOMATICALLY GENERATED, DO NOT EDIT.
+ *
+ *
+ * Copyright (C) 2009 Apple Computer, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+
+";
+}
+
+sub printWebKitVersionHeaderFile
+{
+    my $headerPath = shift;
+    my $F;
+    open F, ">$headerPath";
+
+    printLicenseHeader($F);
+
+    print F "#ifndef WebKitVersion_h\n";
+    print F "#define WebKitVersion_h\n\n";
+
+    print F "#define WEBKIT_MAJOR_VERSION $major_version\n";
+    print F "#define WEBKIT_MINOR_VERSION $minor_version\n\n";
+
+    print F "#endif //WebKitVersion_h\n";
+
+    close F;
+}
+
+
+